Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 739 of 1013.
- CVE-2026-29184 @backstage/plugin-scaffolder-backend: Potential Session Token Exfiltration via Log Redaction Bypass
- CVE-2026-29183 SiYuan: Unauthenticated Reflected XSS via SVG Injection in /api/icon/getDynamicIcon Endpoint
- CVE-2026-29182 Parse Server: Cloud Hooks and Cloud Jobs bypass `readOnlyMasterKey` write restriction
- CVE-2026-29181 OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)
- CVE-2026-29180 Fleet's team maintainer can transfer hosts from any team via missing source team authorization
- CVE-2026-2918 Missing authorization in Happy Addons for Elementor
- CVE-2026-29179 October: Editor Sub-Permission Bypass for Asset and Blueprint File Operations
- CVE-2026-29178 Lemmy: Unauthenticated SSRF via file_type query parameter injection in image endpoint
- CVE-2026-29177 Craft Commerce has Stored XSS in Craft Commerce Order Details Slideout
- CVE-2026-29176 Craft Commerce has Stored XSS in Inventory Location Name
- CVE-2026-29175 Multiple Stored XSS in Commerce Inventory Page Leading to Session Hijacking
- CVE-2026-29174 Craft Commerce has a SQL Injection in Commerce Inventory Table Sorting
- CVE-2026-29173 Craft Commerce has Stored XSS while updating Order Status from Orders Table
- CVE-2026-29172 Craft Commerce has a SQL Injection in Commerce Purchasables Table Sorting
- CVE-2026-29170 Apache HTTP Server: mod_proxy_ftp XSS
- CVE-2026-2917 Missing authorization in Happy Addons for Elementor
- CVE-2026-29169 Apache HTTP Server: mod_dav_lock indirect lock crash
- CVE-2026-29168 Apache HTTP Server: mod_md unrestricted OCSP response
- CVE-2026-29167 Apache HTTP Server: mod_ldap per-dir use-after-free
- CVE-2026-2916 Information disclosure in Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress
- CVE-2026-2915 HP System Event Utility – Denial of Service
- CVE-2026-29146 Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default
- CVE-2026-29145 Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled
- CVE-2026-29144 Unicode Subject Tags
- CVE-2026-29143 S/MIME Decryption Impersonation
- CVE-2026-29142 Plaintext secure-mail.html
- CVE-2026-29141 Bounded Subject Tag Sanitization
- CVE-2026-29140 S/MIME Signature Additional Certificate
- CVE-2026-2914 Privilege escalation in Endpoint Privilege Manager Agent
- CVE-2026-29139 GINA State Confusion Account Takeover
- CVE-2026-29138 PGP Decryption Sender LDAP Injection
- CVE-2026-29137 Long Subject Untagging
- CVE-2026-29136 CA Notification HTML Injection
- CVE-2026-29135 Webmail Password Tag Sanitization Bypass
- CVE-2026-29134 GINA Domain Switch
- CVE-2026-29133 UID Regex Bypass
- CVE-2026-29132 ESWmail-Verify Bypass
- CVE-2026-29131 PGP Decryption Recipient LDAP Injection
- CVE-2026-2913 libvips source.c vips_source_read_to_memory heap-based overflow
- CVE-2026-29129 Apache Tomcat: TLS cipher order is not preserved
- CVE-2026-29128 IDC SFX2100 Satellite Receiver bgpd/ospfd/ripd/zebra Config Credential Disclosure via World-Readable Files
- CVE-2026-29127 Incorrect Permission Assignment(777) on `monitor` Users Home Directory Containing SUID Root Binaries in IDC SFX2100
- CVE-2026-29126 World-Writable, Root Owned/Run `/etc/udhcpc/default.script` in IDC SFX2100 Satellite Receiver Leads To Potential LPE
- CVE-2026-29125 Misconfiguration in SFX2100 Satellite Receiver
- CVE-2026-29124 Multiple SUID Root Binaries in `monitor` User Home Directory Leading to Potential Local Privilege Escalation
- CVE-2026-29123 Multiple SUID Root Binaries in `xd` User Home Directory Leading to Potential Local Privilege Escalation
- CVE-2026-29122 `/bin/date` Binary given SETUID Permissions on IDC SFX2100 Leading to Potential LPE
- CVE-2026-29121 `/sbin/ip` Binary given SETUID Permissions on IDC SFX2100 Leading to Potential LPE
- CVE-2026-29120 Insecure, Hardcoded Root Password Stored in Anaconda Configuration File On IDC SFX2100 Satellite Receiver
- CVE-2026-2912 code-projects Online Reviewer System studentresult-view.php sql injection
- CVE-2026-29119 Hardcoded and Insecure Credentials for "Admin" Account providing Telnet Access on IDC SFX2100 Satellite Receiver
- CVE-2026-29116 Denial of service in IPC/SD/NVR/XVR/EVS/VTO/VTH/ASI/TPC
- CVE-2026-29115 Denial of service in IPC/SD
- CVE-2026-29114 Information disclosure in IPC
- CVE-2026-29113 Craft has a potential information disclosure vulnerability in preview tokens
- CVE-2026-29112 @dicebear/converter vulnerable to ncontrolled memory allocation via crafted SVG dimensions
- CVE-2026-29111 systemd: Local unprivileged user can trigger an assert
- CVE-2026-29110 Cryptomator: Leaking of cleartext paths into log file in non-debug mode
- CVE-2026-2911 Tenda FH451 GstDhcpSetSer buffer overflow
- CVE-2026-29109 SuiteCRM Authenticated Remote Code Execution via Unsafe Deserialization in SavedSearch Filter Processing
- CVE-2026-29108 Authenticated SuiteCRM Users Can Retrieve The Password Hash of Any User
- CVE-2026-29107 SuiteCRM vulnerable to authenticated SSRF via PDF export
- CVE-2026-29106 SuiteCRM has blind XSS in return_id parameter
- CVE-2026-29105 SuiteCRM has Unauthenticated Open Redirect in Leads WebToLead Capture
- CVE-2026-29104 SuiteCRM Vulnerable to Authenticated Arbitrary File Upload via Configurator addfontresult View in SuiteCRM
- CVE-2026-29103 SuiteCRM Vulnerable to Remote Code Execution via Module Loader Package Scanner Bypass
- CVE-2026-29102 SuiteCRM has Authenticated RCE in Modules
- CVE-2026-29101 SuiteCRM Vulnerable to Directory Traversal to DoS in Modules
- CVE-2026-29100 SuiteCRM has Reflected HTML Injection in Login Page via default_user_name Parameter
- CVE-2026-2910 Tenda HG9 formPing6 stack-based overflow
- CVE-2026-29099 SuiteCRM has Authenticated Blind SQL Injection in OutboundEmail Legacy Functionality.
- CVE-2026-29098 SuiteCRM has Relative Path Traversal via ModuleBuilder Modules ExportCustom Action
- CVE-2026-29097 SuiteCRM Server-Side Request Forgery and Denial of Service via RSS Feed Dashlet
- CVE-2026-29096 SuiteCRM vulnerable to Authenticated SQL Injection via unsanitized field_function in Report Fields
- CVE-2026-29093 WWBN AVideo: Unauthenticated PHP session store exposed to host network via published memcached port
- CVE-2026-29092 Kiteworks Email Protection Gateway has an Insufficient Session Expiration
- CVE-2026-29091 Locutus: Remote Code Execution (RCE) in locutus call_user_func_array due to Code Injection
- CVE-2026-29090 Rucio SQL injection in postgres_meta DID search path compromises PostgreSQL metadata database
- CVE-2026-2909 Tenda HG9 Diagnostic Ping Endpoint formPing stack-based overflow
- CVE-2026-29089 TimescaleDB uses untrusted search path during extension upgrade
- CVE-2026-29087 @hono/node-server: Authorization bypass for protected static paths via encoded slashes in Serve Static Middleware
- CVE-2026-29086 Hono: Cookie Attribute Injection via Unsanitized domain and path in setCookie()
- CVE-2026-29085 Hono: SSE Control Field Injection via CR/LF in writeSSE()
- CVE-2026-29084 Gokapi: CSRF in Login Endpoint
- CVE-2026-29082 Kestra: Stored Cross-Site Scripting in Markdown File Preview
- CVE-2026-29081 Frappe: Possibility of SQL Injection due to improper fieldname sanitization
- CVE-2026-29080 Rucio SQL Injection in FilterEngine Oracle JSON Path via DID Search API
- CVE-2026-2908 Tenda HG9 Loopback Detection Configuration Endpoint formLoopBack stack-based overflow
- CVE-2026-29079 Type Confusion in Lexbor Fragment Parser
- CVE-2026-29078 Integer Underflow in Lexbor ISO‑2022‑JP Encoder
- CVE-2026-29077 Frappe: Broken Access Control in DocShare
- CVE-2026-29076 cpp-httplib: Stack Overflow Denial of Service (DoS) via std::regex in multipart filename parsing
- CVE-2026-29075 Mesa: Checking out of untrusted code in `benchmarks.yml` workflow may lead to code execution in privileged runner
- CVE-2026-29074 SVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)
- CVE-2026-29073 SiYuan: Direct SQL Query API accessible to Reader-level users enables unauthorized database access
- CVE-2026-29072 Discourse missing permission check for policy creation in discourse-policy
- CVE-2026-29071 Open WebUI's Insecure Direct Object Reference (IDOR) allows access to other users' memories
- CVE-2026-29070 Open WebUI has unauthorized deletion of knowledge files
- CVE-2026-2907 Tenda HG9 GPON Configuration Endpoint formgponConf stack-based overflow
- CVE-2026-29069 Craft has an unauthenticated activation email trigger with potential user enumeration