Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 725 of 1013.
- CVE-2026-31901 Parse Server has user enumeration via email verification endpoint
- CVE-2026-31900 Black's vulnerable version parsing leads to RCE in GitHub Action
- CVE-2026-3190 Keycloak: keycloak: information disclosure via improper role enforcement in uma 2.0 protection api
- CVE-2026-31899 CairoSVG vulnerable to Exponential DoS via recursive <use> element amplification
- CVE-2026-31898 jsPDF has a PDF Object Injection via FreeText color
- CVE-2026-31897 FreeRDP has an out-of-bounds read in `freerdp_bitmap_decompress_planar`
- CVE-2026-31896 WeGIA has a Time-Based Blind SQL Injection in remover_produto_ocultar.php
- CVE-2026-31895 WeGIA has a SQL Injection via Direct Query Interpolation in restaurar_produto.php
- CVE-2026-31894 WeGIA affected by arbitrary file read via symlink in backup restore
- CVE-2026-31893 Tunnelblick arbitrary file read via symlink following in tunnelblickd
- CVE-2026-31892 WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode
- CVE-2026-31891 Cockpit CMS has SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw()
- CVE-2026-31890 Inspektor Gadget: Tracing Denial of Service via Event Flooding
- CVE-2026-3189 feiyuchuixue sz-boot-parent download server-side request forgery
- CVE-2026-31889 Shopware has a potential take over of app credentials
- CVE-2026-31888 Shopware has user enumeration via distinct error codes on Store API login endpoint
- CVE-2026-31887 Shopware unauthenticated data extraction possible through store-api.order endpoint
- CVE-2026-31886 Dagu has a Path Traversal via `dagRunId` in Inline DAG Execution
- CVE-2026-31885 FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks
- CVE-2026-31884 FreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0
- CVE-2026-31883 FreeRDP has a `size_t` underflow in ADPCM decoder leads to heap-buffer-overflow write
- CVE-2026-31882 Dagu SSE Authentication Bypass in Basic Auth Mode
- CVE-2026-31881 Runtipi unauthenticated /api/auth/reset-password allows operator account takeover during active reset window
- CVE-2026-31880 Combodo iTop: Reflected XSS in universal search
- CVE-2026-3188 feiyuchuixue sz-boot-parent API templates path traversal
- CVE-2026-31879 Frappe Workspace modification and stored XSS due to improper resource ownership checks
- CVE-2026-31878 Frappe: Possible SSRF by any authenticated user
- CVE-2026-31877 Frappe SQL Injection due to improper field sanitization
- CVE-2026-31876 Notesnook has Stored XSS via unsanitized Twitter/X embed URL in editor (`tweetToEmbed`)
- CVE-2026-31875 Parse Server MFA recovery codes not consumed after use
- CVE-2026-31874 Taskosaur Improper Role Assignment via Parameter Manipulation in User Registration
- CVE-2026-31873 Unhead has a Bypass of URI Scheme Sanitization in makeTagSafe via Case-Sensitivity
- CVE-2026-31872 Parse Server has a protected fields bypass via dot-notation in query and sort
- CVE-2026-31871 Parse Server has a SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL
- CVE-2026-31870 cpp-httplib Affected by Remote Process Crash via Malformed Content-Length Response Header
- CVE-2026-3187 feiyuchuixue sz-boot-parent API Endpoint upload unrestricted upload
- CVE-2026-31869 Discourse: Composer mentions endpoint leaks hidden group membership through PM `allowed_names` check
- CVE-2026-31868 Parse Server has Stored XSS via file upload of HTML-renderable file types
- CVE-2026-31867 Craft Commerce has a Potential IDOR in Commerce carts
- CVE-2026-31866 Allocation of Resources Without Limits or Throttling in flagd
- CVE-2026-31865 Elysia Cookie Value Prototype Pollution
- CVE-2026-31864 JumpServer has a Server-Side Template Injection Leading to RCE via YAML Rendering
- CVE-2026-31863 Improper Restriction of Excessive Authentication Attempts in github.com/anyproto/anytype-heart
- CVE-2026-31862 Cloud CLI has Command Injection via Multiple Parameters
- CVE-2026-31861 Shell Command Injection in Git Routes [CloudCLI UI]
- CVE-2026-31860 Unhead has a XSS bypass in `useHeadSafe` via attribute name injection and case-sensitive protocol check
- CVE-2026-3186 feiyuchuixue sz-boot-parent Password Reset password default password
- CVE-2026-31859 Craft has Reflective XSS via incomplete return URL sanitization
- CVE-2026-31858 CraftCMS's `ElementSearchController` Affected by Blind SQL Injection
- CVE-2026-31857 CraftCMS has an RCE vulnerability via relational conditionals in the control panel
- CVE-2026-31856 Parse Server has a SQL injection via `Increment` operation on nested object field in PostgreSQL
- CVE-2026-31854 Cursor Affected by Arbitrary Code Execution via Prompt Injection and Whitelist Bypass
- CVE-2026-31853 ImageMagick has a heap buffer over-write on 32-bit systems in SFW decoder
- CVE-2026-31852 Jellyfin Possible Organization/Secret Compromise from dangerous CI implementation
- CVE-2026-31851 Nexxt Nebula 300+ - Lack of Rate Limiting Enables Brute-Force Attacks
- CVE-2026-31850 Plaintext Storage of Credentials in Configuration Backup in Nexxt Nebula 300+
- CVE-2026-3185 feiyuchuixue sz-boot-parent API Endpoint sys-message authorization
- CVE-2026-31849 Missing CSRF Protection on Administrative Endpoints in Nexxt Nebula 300+
- CVE-2026-31848 Reversible ecos_pw Cookie Allows Authentication Bypass in Nexxt Nebula 300+
- CVE-2026-31847 Hidden Functionality Enables Remote Telnet Activation via /goform/setSysTools in Nexxt Nebula 300+
- CVE-2026-31846 Unauthenticated Credential Disclosure via /goform/ate in Nexxt Nebula 300+
- CVE-2026-31845 Rukovoditel CRM Reflected XSS via zd_echo Parameter in Zadarma Telephony API Endpoint
- CVE-2026-31844 Authenticated SQL Injection in Koha displayby parameter of suggestion.pl
- CVE-2026-31843 goodoneuz/pay-uz Unauthenticated PHP File Overwrite via /payment/api/editable/update Leading to Remote Code Execution
- CVE-2026-31842 Tinyproxy HTTP request parsing desynchronization via case-sensitive Transfer-Encoding handling
- CVE-2026-31841 Raw exposure of database statements in Hyperterse MCP search tool
- CVE-2026-31840 Parse Server has a SQL injection via dot-notation field name in PostgreSQL
- CVE-2026-3184 Util-linux: util-linux: access control bypass due to improper hostname canonicalization
- CVE-2026-31839 Striae has a hash validation utility vulnerability
- CVE-2026-31838 Auth bypass in istio
- CVE-2026-31837 Istio JWKS resolver to prevent private key material from being exposed when JWKS fetch fails.
- CVE-2026-31836 Mass Assignment Privilege Escalation in Checkmate
- CVE-2026-31835 Vaultwarden WebAuthn credential metadata tampered before signature verification
- CVE-2026-31834 Umbraco Affected by Vertical Privilege Escalation via Missing Authorization Checks
- CVE-2026-31833 Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute Filtering
- CVE-2026-31832 Umbraco Backoffice API Allows Unauthorized Modification of Domain Data
- CVE-2026-31831 Tautulli: Unauthenticated Path Traversal in `/newsletter/image/images` endpoint
- CVE-2026-31830 sigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto subject digest
- CVE-2026-3183 Multi Factor Auth Bypass
- CVE-2026-31829 Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access
- CVE-2026-31828 Parse Server has an LDAP injection via unsanitized user input in DN and group filter construction
- CVE-2026-31827 Alienbin: TTL Index Race Condition allows unauthorized deletion of other users data
- CVE-2026-31826 pypdf: manipulated stream length values can exhaust RAM
- CVE-2026-31825 Sylius has a DQL Injection via API Order Filters
- CVE-2026-31824 Sylius has a Promotion Usage Limit Bypass via Race Condition
- CVE-2026-31823 Sylius has Authenticated Stored XSS
- CVE-2026-31822 Sylius has a XSS vulnerability in checkout login form
- CVE-2026-31821 Sylius is Missing Authorization in API v2 Add Item Endpoint
- CVE-2026-31820 Sylius affected by IDOR in Cart and Checkout LiveComponents
- CVE-2026-3182 Sensitive Data Exposure
- CVE-2026-31819 Sylius has an Open Redirect via Referer Header
- CVE-2026-31818 Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist
- CVE-2026-31817 OliveTin's unsafe parsing of UniqueTrackingId can be used to write files
- CVE-2026-31816 Budibase Universal Auth Bypass via Webhook Query Param Injection
- CVE-2026-31815 django-unicorn affected by component state manipulation via unvalidated attribute access
- CVE-2026-31814 Yamux remote Panic via malformed WindowUpdate credit
- CVE-2026-31813 Supabase Auth has insecure Apple and Azure authentication with ID tokens
- CVE-2026-31812 Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing
- CVE-2026-31809 SiYuan has a SVG Sanitizer Bypass via Whitespace in `javascript:` URI — Unauthenticated XSS
- CVE-2026-31808 file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header