Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 733 of 1013.
- CVE-2026-30914 SFTPGo has a Path Traversal and Permission Bypass via Path Normalization Discrepancy
- CVE-2026-30913 flarum/nickname: Display name injection in notification emails (autolink & markdown)
- CVE-2026-30912 Apache Airflow: Exposing stack trace in case of constraint error
- CVE-2026-30911 Apache Airflow: Execution API HITL Endpoints Missing Per-Task Authorization
- CVE-2026-30910 Crypt::Sodium::XS versions through 0.001000 for Perl has potential integer overflows
- CVE-2026-3091 Other in Synology Presto Client
- CVE-2026-30909 Crypt::NaCl::Sodium versions through 2.002 for Perl has potential integer overflows
- CVE-2026-30906 Privilege escalation in Zoom Rooms
- CVE-2026-30905 Privilege escalation in Zoom Workplace VDI Plugin
- CVE-2026-30904 Security feature bypass in Zoom Workplace
- CVE-2026-30903 Path traversal in Zoom Workplace
- CVE-2026-30902 Zoom Clients for Windows - Improper Privilege Management
- CVE-2026-30901 Zoom Rooms for Windows - Improper Input Validation
- CVE-2026-30900 Zoom Workplace Clients for Windows - Improper Check
- CVE-2026-3090 Post SMTP <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'event_type'
- CVE-2026-30898 Apache Airflow: Bad example of BashOperator shell injection via dag_run.conf
- CVE-2026-30897 Memory corruption in FortiWeb
- CVE-2026-30896 Other in Qsee Client
- CVE-2026-30895 Joomla! Core - [20260504] - XSS in readmore links
- CVE-2026-30894 Joomla! Core - [20260503] - XSS in com_contenthistory
- CVE-2026-30893 Path traversal in wazuh
- CVE-2026-30892 Crun incorrectly parses `crun exec` option `-u`, leading to privilege escalation
- CVE-2026-30891 Discourse hasUnauthorized Exposure of Private User Action Types
- CVE-2026-30890 Combodo iTop: Reflected XSS in synchro/synchro_import.php
- CVE-2026-3089 Actual Sync Server 26.2.1 - Authenticated Path Traversal
- CVE-2026-30889 Discourse has Unauthorized Post Data Exposure in discourse-user-notes
- CVE-2026-30888 Discourse has moderator privilege escalation via arbitrary post_id in suspend/silence endpoint
- CVE-2026-30887 OneUptime Affected by Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE
- CVE-2026-30886 New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check
- CVE-2026-30885 WWBN AVideo - Unauthenticated IDOR - Playlist Information Disclosure
- CVE-2026-30884 mdjnelson/moodle-mod_customcert Vulnerable to Authorization Bypass Through User-Controlled Key
- CVE-2026-30883 ImageMagick has a Heap Overflow when writing extremely large image profile in the PNG encoder
- CVE-2026-30882 Chamilo LMS: Reflected XSS in the session category listing page
- CVE-2026-30881 Chamilo LMS: SQL Injection in the statistics AJAX endpoint
- CVE-2026-30880 baserCMS: OS command injection vulnerability in installer
- CVE-2026-3088 Unauthenticated users can disrupt router operation
- CVE-2026-30879 baserCMS: Cross-site scripting vulnerability in blog post
- CVE-2026-30878 baserCMS: Mail Form Acceptance Bypass via Public API
- CVE-2026-30877 baserCMS: OS Command Injection in the baserCMS Update Functionality
- CVE-2026-30876 Chamilo LMS: User enumeration vulnerability via response
- CVE-2026-30875 Chamilo LMS: Authenticated RCE via H5P Import
- CVE-2026-30874 OpenWrt procd PATH Environment Variable Filter Bypass via Incorrect String Comparison Leads to Privilege Escalation
- CVE-2026-30873 OpenWrt Project jsonpath: Memory leak when processing strings, labels, and regexp tokens
- CVE-2026-30872 OpenWrt Project has a Stack-based Buffer Overflow vulnerability via IPv6 reverse DNS lookup
- CVE-2026-30871 OpenWrt Project has Stack-based Buffer Overflow in DNS PTR Query
- CVE-2026-30870 Some sync filters in PowerSync Service ignored using `config.edition: 3`
- CVE-2026-3087 shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs
- CVE-2026-30869 SiYuan has a Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage
- CVE-2026-30868 Cross-Site Request Forgery (CSRF) in opnsense/core
- CVE-2026-30867 CocoaMQTT: Denial of Service via Reachable Assertion in `PUBLISH` Packet Parsing
- CVE-2026-30866 Combodo iTop: Insecured access to uploaded images via sniffed url
- CVE-2026-30865 Combodo iTop: Reflected XSS in dashboard save
- CVE-2026-30864 Combodo iTop: Reflected XSS in dashboard revert
- CVE-2026-30863 Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters
- CVE-2026-30862 Critical Stored XSS & Privilege Escalation in Appsmith
- CVE-2026-30861 WeKnora: Remote Code Execution (RCE) via Command Injection in MCP Stdio Configuration Validation
- CVE-2026-30860 WeKnora: Remote Code Execution via SQL Injection Bypass in AI Database Query Tool
- CVE-2026-3086 GStreamer H.266 Codec Parser Out-Of-Bounds Write Remote Code Execution Vulnerability
- CVE-2026-30859 WeKnora: Broken Access Control - Cross-Tenant Data Exposure
- CVE-2026-30858 WeKnora: DNS Rebinding Vulnerability in web_fetch Tool Allows SSRF to Internal Resources
- CVE-2026-30857 WeKnora: Unauthorized Cross‑Tenant Knowledge Base Cloning
- CVE-2026-30856 WeKnora: Tool Execution Hijacking via Ambigous Naming Convention In MCP client and Indirect Prompt Injection
- CVE-2026-30855 WeKnora: Broken Access Control in Tenant Management
- CVE-2026-30854 Parse Server: GraphQL `__type` introspection bypass via inline fragments when public introspection is disabled
- CVE-2026-30853 calibre has a Path Traversal Leading to Arbitrary File Write
- CVE-2026-30852 Caddy: vars_regexp double-expands user input, leaking env vars and files
- CVE-2026-30851 Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation
- CVE-2026-30850 Parse Server: File metadata endpoint bypasses `beforeFind` / `afterFind` trigger authorization
- CVE-2026-3085 GStreamer rtpqdm2depay Heap-based Buffer Overflow Remote Code Execution Vulnerability
- CVE-2026-30849 MantisBT SOAP API has an authentication bypass vulnerability on MySQL
- CVE-2026-30848 Parse Server: `PagesRouter` path traversal allows reading files outside configured pages directory
- CVE-2026-30847 Wekan Credential Leak via notificationUsers Publication Exposes Password Hashes and Session Tokens
- CVE-2026-30846 Wekan Exposes All Global Webhook Integrations through globalwebhooks Publication
- CVE-2026-30845 Wekan Exposes Sensitive Data through Lack of Field Filtering During Board Publication
- CVE-2026-30844 Wekan Vulnerable to SSRF through Lack of Validation or Filtering in Attachment URL Loading
- CVE-2026-30843 Wekan has Cross-Board IDOR in Custom Fields Update Endpoints
- CVE-2026-30842 Wallos: Authenticated Missing Authorization Allows Deletion of Other Users’ Uploaded Avatars
- CVE-2026-30841 Wallos: Reflected XSS via unescaped token and email parameters in passwordreset.php
- CVE-2026-30840 Wallos: Server-Side Request Forgery (SSRF) in Notification Testers
- CVE-2026-3084 GStreamer H.266 Codec Parser Integer Underflow Remote Code Execution Vulnerability
- CVE-2026-30839 Wallos: SSRF via webhook test endpoint
- CVE-2026-30838 league/commonmark: DisallowedRawHtml extension bypass via whitespace in HTML tag names
- CVE-2026-30837 Elysia has a string URL format redos
- CVE-2026-30836 Step CA: Unauthenticated Certificate Issuance via SCEP UpdateReq (MessageType=18)
- CVE-2026-30835 Parse Server: Malformed `$regex` query leaks database error details in API response
- CVE-2026-30834 PinchTab: SSRF with Full Response Exfiltration via Download Handler
- CVE-2026-30833 Rocket.Chat: NoSQL injection in the EE ddp-streamer-service
- CVE-2026-30832 Soft Serve: SSRF via unvalidated LFS endpoint in repo import
- CVE-2026-30831 Rocket.Chat: 2FA bypass and login of deactivated users via EE ddp-streamer
- CVE-2026-30830 Defuddle: XSS via unescaped string interpolation in _findContentBySchemaText image tag
- CVE-2026-3083 GStreamer rtpqdm2depay Out-Of-Bounds Write Remote Code Execution Vulnerability
- CVE-2026-30829 Checkmate: Unauthenticated Access to Unpublished Status Page
- CVE-2026-30828 Wallos: SSRF via url parameter leading to File Traversal
- CVE-2026-30827 express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting on servers with dual-stack network
- CVE-2026-30826 Combodo iTop: Reflected XSS in run_query.php
- CVE-2026-30825 hoppscotch: IDOR - Any authenticated user can revoke any other user's Personal Access Token
- CVE-2026-30824 Flowise: Missing Authentication on NVIDIA NIM Endpoints
- CVE-2026-30823 Flowise: IDOR leading to Account Takeover and Enterprise Feature Bypass via SSO Configuration
- CVE-2026-30822 Flowise: Mass Assignment in `/api/v1/leads` Endpoint
- CVE-2026-30821 Flowise: Arbitrary File Upload via MIME Spoofing