Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 745 of 1013.
- CVE-2026-28515 openDCIM <= 23.04 Missing Authorization in install.php
- CVE-2026-28514 Rocket.Chat: Users can login with any password via the EE ddp-streamer-service
- CVE-2026-28513 Pocket ID: OIDC authorization code validation uses AND instead of OR, allowing cross-client token exchange
- CVE-2026-28512 Pocket ID: OAuth redirect_uri validation bypass via userinfo/host confusion
- CVE-2026-28511 elabftw has entry title leakage through autocompletion search
- CVE-2026-28510 elabftw allows MFA bypass during login
- CVE-2026-2851 yeqifu warehouse Inport Endpoint InportController.java deleteInport access control
- CVE-2026-28509 LangBot has a Cross Site Scripting(XSS) Vulnerability
- CVE-2026-28508 Idno: Unauthenticated SSRF via URL Unfurl Endpoint
- CVE-2026-28507 Idno: Remote Code Execution via Chained Import File Write and Template Path Traversal
- CVE-2026-28506 Outline's Information Disclosure in Activity Logs allows User Enumeration of Private Drafts
- CVE-2026-28505 Tautulli: RCE via eval() sandbox bypass using lambda nested scope to escape co_names whitelist check
- CVE-2026-28503 Tandoor Recipes has Cross-Space IDOR in SyncViewSet.query_synced_folder: missing space scoping on get_object_or_404
- CVE-2026-28502 WWBN AVideo: Authenticated Remote Code Execution via Unsafe Plugin ZIP Extraction
- CVE-2026-28501 WWBN AVideo: Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php
- CVE-2026-28500 ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack
- CVE-2026-2850 yeqifu warehouse Customer Endpoint CustomerController.java deleteCustomer access control
- CVE-2026-28499 LeafKit's HTML escaping may be skipped for Collection values, enabling XSS
- CVE-2026-28498 Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding
- CVE-2026-28497 TinyWeb: Integer Overflow in `_Val` (HTTP Request Smuggling)
- CVE-2026-28496 FOSSBilling: Server-side template injection in Twig template rendering enables information disclosure and RCE
- CVE-2026-28495 GetSimple CMS has CSRF to Remote Code Execution via Arbitrary PHP Write in gsconfig.php
- CVE-2026-28494 ImageMagick affected by stack corruption through long morphology kernel names or arrays
- CVE-2026-28493 ImageMagick has a Integer Overflow leading to out of bounds write in SIXEL decoder
- CVE-2026-28492 File Browser: Path Traversal in Public Share Links Exposes Files Outside Shared Directory
- CVE-2026-28490 Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle
- CVE-2026-2849 yeqifu warehouse Cache Sync CacheController.java syncCache access control
- CVE-2026-28486 OpenClaw 2026.1.16-2 < 2026.2.14 - Path Traversal (Zip Slip) in Archive Extraction via Installation Commands
- CVE-2026-28485 OpenClaw 2026.1.5 < 2026.2.12 - Missing Authentication in Browser Control HTTP Endpoints
- CVE-2026-28482 OpenClaw < 2026.2.12 - Path Traversal via Unsanitized sessionId and sessionFile Parameters
- CVE-2026-28481 OpenClaw < 2026.2.1 - Bearer Token Leakage via MS Teams Attachment Downloader Suffix Matching
- CVE-2026-28480 OpenClaw < 2026.2.14 - Identity Spoofing via Mutable Username in Telegram Allowlist Authorization
- CVE-2026-2848 SourceCodester Simple Responsive Tourism Website Registration Master.php sql injection
- CVE-2026-28479 OpenClaw < 2026.2.15 - Cache Poisoning via Deprecated SHA-1 Hash in Sandbox Configuration
- CVE-2026-28478 OpenClaw < 2026.2.13 - Denial of Service via Unbounded Webhook Request Body Buffering
- CVE-2026-28477 OpenClaw < 2026.2.14 - OAuth State Validation Bypass in Manual Chutes Login Flow
- CVE-2026-28476 OpenClaw < 2026.2.14 - Server-Side Request Forgery in Tlon Extension Authentication
- CVE-2026-28475 OpenClaw < 2026.2.13 - Timing Attack via Hook Token Comparison
- CVE-2026-28474 OpenClaw Nextcloud Talk < 2026.2.6 - Allowlist Bypass via actor.name Display Name Spoofing
- CVE-2026-28473 OpenClaw < 2026.2.2 - Authorization Bypass via /approve Chat Command
- CVE-2026-28472 OpenClaw < 2026.2.2 - Device Identity Check Bypass in Gateway WebSocket Connect Handshake
- CVE-2026-28471 OpenClaw has a Matrix allowlist bypass via displayName and cross-homeserver localpart matching
- CVE-2026-28470 OpenClaw < 2026.2.2 - Exec Allowlist Bypass via Command Substitution in Double Quotes
- CVE-2026-2847 UTT HiPER 520 Web Management formReleaseConnect sub_44EFB4 os command injection
- CVE-2026-28469 OpenClaw < 2026.2.14 - Cross-Account Policy Context Misrouting via Shared Webhook Path Ambiguity
- CVE-2026-28468 OpenClaw 2026.1.29-beta.1 < 2026.2.14 - Authentication Bypass in Sandbox Browser Bridge Server
- CVE-2026-28467 OpenClaw < 2026.2.2 - SSRF via Attachment Media URL Hydration
- CVE-2026-28466 OpenClaw < 2026.2.14 - Remote Code Execution via Node Invoke Approval Bypass
- CVE-2026-28465 OpenClaw voice-call < 2026.2.3 - Webhook Verification Bypass via Forwarded Headers
- CVE-2026-28464 OpenClaw < 2026.2.12 - Timing Attack in Hooks Token Authentication
- CVE-2026-28463 OpenClaw < 2026.2.14 - Arbitrary File Read via Shell Expansion in Safe Bins Allowlist
- CVE-2026-28462 OpenClaw < 2026.2.13 - Path Traversal in Trace and Download Output Paths
- CVE-2026-28461 OpenClaw < 2026.3.1 - Unbounded Memory Growth in Zalo Webhook via Query String Key Churn
- CVE-2026-28460 OpenClaw < 2026.2.22 - Allowlist Bypass via Shell Line-Continuation Command Substitution in system.run
- CVE-2026-2846 UTT HiPER 520 Web Management formPdbUpConfig sub_44D264 os command injection
- CVE-2026-28459 OpenClaw < 2026.2.12 - Arbitrary File Write via Untrusted sessionFile Path
- CVE-2026-28458 OpenClaw 2026.1.20 < 2026.2.1 - Missing Authentication in Browser Relay /cdp WebSocket Endpoint
- CVE-2026-28457 OpenClaw < 2026.2.14 - Path Traversal in Sandbox Skill Mirroring via Name Parameter
- CVE-2026-28456 OpenClaw 2026.1.5 < 2026.2.14 - Arbitrary Code Execution via Unsafe Hook Module Path Handling
- CVE-2026-28454 OpenClaw < 2026.2.2 - Authorization Bypass via Unauthenticated Telegram Webhook
- CVE-2026-28453 OpenClaw < 2026.2.14 - Zip Slip Path Traversal in TAR Archive Extraction
- CVE-2026-28452 OpenClaw < 2026.2.14 - Denial of Service via Unguarded Archive Extraction in extractArchive
- CVE-2026-28451 OpenClaw < 2026.2.14 - SSRF via Feishu Extension Media Fetching
- CVE-2026-28450 OpenClaw < 2026.2.12 - Unauthenticated Profile Tampering via Nostr Plugin HTTP Endpoints
- CVE-2026-2845 Allocation of Resources Without Limits or Throttling in GitLab
- CVE-2026-28449 OpenClaw < 2026.2.25 - Webhook Replay Attack via Missing Durable Replay Suppression
- CVE-2026-28448 OpenClaw 2026.1.29 < 2026.2.1 - Authorization Bypass in Twitch Plugin allowFrom Access Control
- CVE-2026-28447 OpenClaw 2026.1.29-beta.1 < 2026.2.1 - Path Traversal in Plugin Installation via Package Name
- CVE-2026-28446 OpenClaw < 2026.2.1 - Inbound Allowlist Policy Bypass in voice-call Extension via Empty Caller ID and Suffix Matching
- CVE-2026-28445 Typebot: Stored XSS via Rating Block Custom Icon Bypasses isUnsafe Sandbox in Builder Preview
- CVE-2026-28444 Typebot: IDOR in Result Logs Endpoint Allows Cross-Workspace Data Disclosure
- CVE-2026-28443 OpenReplay: SQL injection in cards/search via unvalidated sort field parameter
- CVE-2026-28442 ZimaOS: Arbitrary Deletion of Internal System Files via API Path Manipulation
- CVE-2026-2844 TimePictra Authentication Bypass Vulnerability
- CVE-2026-28438 CocoIndex Doris target connector didn't verify table name when constructing ALTER TABLE statements
- CVE-2026-28436 Frappe: Stored XSS in avatar_macro.html
- CVE-2026-28435 Denial of service in cpp-httplib
- CVE-2026-28434 cpp-httplib's default exception handler leaks e.what() to clients via EXCEPTION_WHAT response header
- CVE-2026-28433 Misskey lacks resource ownership validation
- CVE-2026-28432 HTTP signature verification can be bypassed
- CVE-2026-28431 Misskey lacks proper authorization checks and input validation
- CVE-2026-28430 Chamilo LMS Vulnerable to Unauthenticated SQL Injection in chamiko-lms model.ajax.php
- CVE-2026-28429 Talishar: Critical Path Traversal in gameName Parameter
- CVE-2026-28428 Talishar: Authentication Bypass via Empty authKey Parameter Allows Unauthenticated Game Actions
- CVE-2026-28427 OpenDeck affected by path traversal allows arbitrary file read
- CVE-2026-28426 Statamic vulnerable to privilege escalation via stored cross-site scripting
- CVE-2026-28425 Statamic vulnerable to remote code execution via Antlers-enabled control panel inputs
- CVE-2026-28424 Statamic's missing authorization allows access to email addresses
- CVE-2026-28423 Statamic Vulnerable to Server-Side Request Forgery via Glide
- CVE-2026-28422 Vim has stack-buffer-overflow in build_stl_str_hl()
- CVE-2026-28421 Vim has a heap-buffer-overflow and a segmentation fault
- CVE-2026-28420 Vim has Heap-based Buffer Overflow and OOB Read in :terminal
- CVE-2026-28419 Vim has Heap-based Buffer Underflow in Emacs tags parsing
- CVE-2026-28418 Vim has Heap-based Buffer Overflow in Emacs tags parsing
- CVE-2026-28417 Vim has OS Command Injection in netrw
- CVE-2026-28416 Gradio has SSRF via Malicious `proxy_url` Injection in `gr.load()` Config Processing
- CVE-2026-28415 Gradio has Open Redirect in OAuth Flow
- CVE-2026-28414 Gradio has Absolute Path Traversal on Windows with Python 3.13+
- CVE-2026-28413 Products.isurlinportal: Possible open redirect when using more than 2 forward slashes
- CVE-2026-28412 Textream Vulnerable to Uncontrolled Resource Consumption (Denial of Service)