Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 721 of 1013.
- CVE-2026-32288 Unbounded allocation for old GNU sparse in archive/tar
- CVE-2026-32287 Infinite loop in github.com/antchfx/xpath
- CVE-2026-32286 Denial of service in github.com/jackc/pgproto3/v2
- CVE-2026-32285 Denial of service in github.com/buger/jsonparser
- CVE-2026-32284 Denial of service in github.com/shamaton/msgpack
- CVE-2026-32283 Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls
- CVE-2026-32282 TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix
- CVE-2026-32281 Inefficient policy validation in crypto/x509
- CVE-2026-32280 Unexpected work during chain building in crypto/x509
- CVE-2026-3228 Cross-site scripting in NextScripts: Social Networks Auto-Poster
- CVE-2026-32279 Connect CMS has SSRF in the External Page Migration Feature of its Page Management Plugin
- CVE-2026-32278 Connect CMS has Stored Cross-site Scripting (XSS) in the File Field of its Form Plugin
- CVE-2026-32277 Connect-CMS has DOM-based Cross-Site Scripting (XSS) in the Cabinet Plugin List View
- CVE-2026-32276 Connect-CMS has Arbitrary Code Execution by an Authenticated User in its Code Study Plugin
- CVE-2026-32275 Tautulli: Unsanitized JSONP callback parameter allows cross-origin script injection and API key theft
- CVE-2026-32274 Black: Arbitrary file writes from unsanitized user input in cache file name
- CVE-2026-32273 Discourse: XSS on category description update via API
- CVE-2026-32272 Craft Commerce: Blind SQL Injection via hasVariant/hasProduct
- CVE-2026-32271 Craft Commerce: SQL Injection can lead to Remote Code Execution via TotalRevenue Widget
- CVE-2026-32270 Craft Commerce has an unauthenticated information disclosure that can leak some customer order data on anonymous payments
- CVE-2026-3227 Authenticated Command Injection on TP-Link TL-WR802N, TL-WR841N and TL-WR840N
- CVE-2026-32269 Parse Server OAuth2 adapter app ID validation sends wrong token to introspection endpoint
- CVE-2026-32268 Azure Blob Storage for Craft CMS Potential Sensitive Information Disclosure vulnerability
- CVE-2026-32267 Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()
- CVE-2026-32266 Google Cloud Storage for Craft CMS has an Information Disclosure Vulnerability
- CVE-2026-32265 Amazon S3 for Craft CMS has an Information Disclosure vulnerability
- CVE-2026-32264 Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController
- CVE-2026-32263 Craft CMS vulnerable to behavior injection RCE via EntryTypesController
- CVE-2026-32262 Craft CMS has a Path Traversal Vulnerability in AssetsController
- CVE-2026-32261 RCE via SSTI for users with permissions to access the Craft CMS Webhooks plugin
- CVE-2026-32260 Command Injection via incomplete shell metacharacter blocklist in node:child_process (bypass of CVE-2026-27190 fix)
- CVE-2026-3226 LearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Notification Triggering
- CVE-2026-32259 ImageMagick has a possible stack buffer overflow in sixel encoder
- CVE-2026-32258 Winter: Stored XSS through Editor Settings custom styles
- CVE-2026-32257 Winter: Stored XSS through Brand Settings custom styles
- CVE-2026-32256 music-metadata has an infinite loop vulnerability in ASF parser
- CVE-2026-32255 Kan is Vulnerable to Unauthenticated SSRF via Attachment Download Endpoint
- CVE-2026-32254 Kube-router Proxy Module Blindly Trusts ExternalIPs/LoadBalancer IPs Enabling Cluster-Wide Traffic Hijacking and DNS DoS
- CVE-2026-32253 Sunshine: Authentication bypass via improper client certificate validation
- CVE-2026-32252 Chartbrew Cross-Tenant Template Export and Secret Disclosure in `GET /team/:team_id/template/generate/:project_id`
- CVE-2026-32251 Tolgee has an XXE Injection in Translation Import
- CVE-2026-32250 NamelessMC has Reflected Cross-Site Scripting (XSS) in id parameter of /index.php?route=/queries/user/
- CVE-2026-3225 LearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Answer Deletion
- CVE-2026-32249 NFA regex engine NULL pointer dereference affects Vim < 9.2.0137
- CVE-2026-32248 Parse Server: Account takeover via operator injection in authentication data identifier
- CVE-2026-32247 Graphiti vulnerable to Cypher Injection via unsanitized node_labels in search filters
- CVE-2026-32246 Tinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpoint
- CVE-2026-32245 Tinyauth's OIDC authorization codes are not bound to client on token exchange
- CVE-2026-32244 Discourse: Cached outdated summaries can leak removed content
- CVE-2026-32243 Discourse: Stored XSS in discourse-ai shared conversations onebox
- CVE-2026-32242 Parse Server OAuth2 adapter shares mutable state across providers via singleton instance
- CVE-2026-32241 Flannel vulnerable to cross-node remote code execution via extension backend BackendData injection
- CVE-2026-32240 Cap'n Proto: Integer overflow in KJ-HTTP chunk size
- CVE-2026-3224 Auth bypass in Server
- CVE-2026-32239 Cap'n Proto has an integer overflow in KJ-HTTP
- CVE-2026-32238 OpenEMR has Remote Code Execution in backup functionality
- CVE-2026-32237 @backstage/plugin-scaffolder-backend: Possible exposure of defaultEnvironment secrets using dry-run endpoint
- CVE-2026-32236 @backstage/plugin-auth-backend: SSRF in experimental CIMD metadata fetch
- CVE-2026-32235 @backstage/plugin-auth-backend: OAuth redirect URI allowlist bypass
- CVE-2026-32234 Parse Server has a SQL injection via query field name when using PostgreSQL
- CVE-2026-32232 ZeptoClaw: Path boundary checks bypass via symlink, TOCTOU, and hardlink
- CVE-2026-32231 ZeptoClaw: Generic webhook channel trusts caller-supplied identity fields; allowlist is checked against untrusted payload data
- CVE-2026-32230 Uptime Kuma is Missing Authorization Checks on Ping Badge Endpoint, Leaks Ping times of monitors without needing to be on a status page
- CVE-2026-3223 Zip Slip leading to Arbitrary File Write and Privilege Escalation in Google Web Designer
- CVE-2026-32229 Auth bypass in Hub
- CVE-2026-32228 Apache Airflow: Users with asset materialization permisssions could trigger Dags they had no access to
- CVE-2026-32227 Apache Ranger: SQL Injection vulnerability in lookup functionality
- CVE-2026-32226 .NET Framework Denial of Service Vulnerability
- CVE-2026-32225 Windows Shell Security Feature Bypass Vulnerability
- CVE-2026-32224 Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability
- CVE-2026-32223 Windows USB Printing Stack (usbprint.sys) Elevation of Privilege Vulnerability
- CVE-2026-32222 Windows Win32k Elevation of Privilege Vulnerability
- CVE-2026-32221 Windows Graphics Component Remote Code Execution Vulnerability
- CVE-2026-32220 UEFI Secure Boot Security Feature Bypass Vulnerability
- CVE-2026-3222 WP Maps <= 4.9.1 - Unauthenticated SQL Injection via 'location_id' Parameter
- CVE-2026-32219 Microsoft Brokering File System Elevation of Privilege Vulnerability
- CVE-2026-32218 Windows Kernel Information Disclosure Vulnerability
- CVE-2026-32217 Windows Kernel Information Disclosure Vulnerability
- CVE-2026-32216 Windows Redirected Drive Buffering System Denial of Service Vulnerability
- CVE-2026-32215 Windows Kernel Information Disclosure Vulnerability
- CVE-2026-32214 Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability
- CVE-2026-32213 Azure AI Foundry Elevation of Privilege Vulnerability
- CVE-2026-32212 Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability
- CVE-2026-32211 Azure MCP Server Information Disclosure Vulnerability
- CVE-2026-32210 Microsoft Dynamics 365 (online) Spoofing Vulnerability
- CVE-2026-3221 Information disclosure in Server
- CVE-2026-32209 Windows Filtering Platform (WFP) Security Feature Bypass Vulnerability
- CVE-2026-32208 Microsoft Entra ID Spoofing Vulnerability
- CVE-2026-32207 Azure Machine Learning Notebook Spoofing Vulnerability
- CVE-2026-32204 Azure Monitor Agent Elevation of Privilege Vulnerability
- CVE-2026-32203 .NET and Visual Studio Denial of Service Vulnerability
- CVE-2026-32202 Microsoft Windows Protection Mechanism Failure
- CVE-2026-32201 Microsoft SharePoint Server Improper Input Validation
- CVE-2026-32200 Microsoft PowerPoint Remote Code Execution Vulnerability
- CVE-2026-3220 Multiple Plugins - Unauthenticated Stored XSS via Minify Library
- CVE-2026-32199 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-32198 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-32197 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-32196 Windows Admin Center Spoofing Vulnerability
- CVE-2026-32195 Windows Kernel Elevation of Privilege Vulnerability