Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 753 of 1013.
- CVE-2026-27680 CSS Injection vulnerability in SAP NetWeaver Application Server ABAP
- CVE-2026-2768 Sandbox escape in the Storage: IndexedDB component
- CVE-2026-27679 Missing Authorization check in SAP S/4HANA Frontend OData Service (Manage Reference Structures)
- CVE-2026-27678 Missing Authorization check in SAP S/4HANA Backend OData Service (Manage Reference Structures)
- CVE-2026-27677 Missing Authorization check in SAP S/4HANA OData Service (Manage Reference Equipment)
- CVE-2026-27676 Missing Authorization check in SAP S/4HANA OData Service (Manage Technical Object Structures)
- CVE-2026-27675 Code Injection vulnerability in SAP Landscape Transformation
- CVE-2026-27674 Code Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java)
- CVE-2026-27673 Missing Authorization Check in SAP S/4HANA (Private Cloud and On-Premise)
- CVE-2026-27672 Missing Authorization check in Material Master Application
- CVE-2026-27671 Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform
- CVE-2026-27670 OpenClaw < 2026.3.2 - Arbitrary File Write via ZIP Extraction Parent Symlink Race Condition
- CVE-2026-2767 Use-after-free in the JavaScript: WebAssembly component
- CVE-2026-27668 Privilege escalation in RUGGEDCOM CROSSBOW Secure Access Manager Primary (SAM-P)
- CVE-2026-27664 Memory corruption in CPCI85 Central Processing/Communication
- CVE-2026-27663 Denial of service in CPCI85 Central Processing/Communication
- CVE-2026-27662 Missing authorization in SIMATIC HMI MTP1000 Unified Comfort Panel
- CVE-2026-27661 Information disclosure in SINEC Security Monitor
- CVE-2026-27660 Gitea draft releases use insufficient permission checks
- CVE-2026-2766 Use-after-free in the JavaScript Engine: JIT component
- CVE-2026-27659 CSRF vulnerability in UpdateAccessControlPolicyActiveStatus endpoint
- CVE-2026-27657 Gitea email settings allow changing another user's primary email address
- CVE-2026-27656 Account Takeover via Substring Matching in OpenID Connect Authentication
- CVE-2026-27655 Stored XSS Vulnerability
- CVE-2026-27654 NGINX ngx_http_dav_module vulnerability
- CVE-2026-27653 Misconfiguration in Soliton SecureBrowser II
- CVE-2026-27652 CloudCharge cloudcharge.se Insufficient Session Expiration
- CVE-2026-27651 NGINX ngx_mail_auth_http_module vulnerability
- CVE-2026-27650 Command injection in BUFFALO Wi-Fi router products
- CVE-2026-2765 Use-after-free in the JavaScript Engine component
- CVE-2026-27649 CTEK Chargeportal Insufficient Session Expiration
- CVE-2026-27648 web_webview has an out-of-bounds write vulnerability
- CVE-2026-27647 Mobility46 mobility46.se Insufficient Session Expiration
- CVE-2026-27646 OpenClaw < 2026.3.7 - Sandbox Escape via /acp spawn Command
- CVE-2026-27645 changedetection.io Vulnerable to Reflected XSS in RSS Single Watch Error Response
- CVE-2026-27644 traccar allows CSV formula injection via exported position data
- CVE-2026-27643 free5GC has improper error handling in NEF with information exposure
- CVE-2026-27642 free5GC has Improper Input Validation in UDM UEAU Service
- CVE-2026-27641 Flask-Reuploaded vulnerable to Remote Code Execution via Server-Side Template Injection
- CVE-2026-27640 tfplan2md has Sensitive Value Exposure in Generated Reports
- CVE-2026-2764 JIT miscompilation, use-after-free in the JavaScript Engine: JIT component
- CVE-2026-27639 Mercator vulnerable to stored XSS via unescaped Blade directives in display templates
- CVE-2026-27638 ActualBudget missing authorization in sync endpoints allows cross-user budget file access in multi-user mode
- CVE-2026-27637 FreeScout's Predictable Authentication Token Enables Account Takeover
- CVE-2026-27636 FreeScout: Missing .htaccess in Restricted File Extensions Allows Remote Code Execution on Apache
- CVE-2026-27635 Manyfold vulnerable to OS command injection via ZIP filename in f3d render
- CVE-2026-27634 Piwigo: Pre-auth SQL injection via date filter parameters in ws_std_image_sql_filter
- CVE-2026-27633 TinyWeb has Unbounded Content-Length Memory Exhaustion (DoS)
- CVE-2026-27632 Talishar Vulnerable to Cross-Site Request Forgery (CSRF)
- CVE-2026-27631 Exiv2: Uncaught exception - cannot create std::vector larger than max_size()
- CVE-2026-27630 TinyWeb vulnerable to Remote Denial of Service via Thread/Connection Exhaustion (Slowloris)
- CVE-2026-2763 Use-after-free in the JavaScript Engine component
- CVE-2026-27629 InvenTree Vulnerable to Server Side Template Injection (SSTI)
- CVE-2026-27628 pypdf has a possible infinite loop when loading circular /Prev entries in cross-reference streams
- CVE-2026-27627 Karakeep's Reddit plugin content bypasses DOMPurify sanitization, enabling stored XSS
- CVE-2026-27626 OliveTin: OS Command Injection via `password` argument type and webhook JSON extraction bypasses shell safety checks
- CVE-2026-27625 Stirling-PDF Zip Slip: Arbitrary File Write via Path Traversal in Markdown-to-PDF ZIP Extraction
- CVE-2026-27624 Coturn: IPv4-mapped IPv6 (::ffff:0:0/96) bypasses denied-peer-ip ACL
- CVE-2026-27623 Valkey has Pre-Authentication DOS from malformed RESP request
- CVE-2026-27622 OpenEXR CompositeDeepScanLine integer-overflow leads to heap OOB write
- CVE-2026-27621 TypiCMS Core has Stored Cross-Site Scripting (XSS) via SVG File Upload
- CVE-2026-2762 Integer overflow in the JavaScript: Standard Library component
- CVE-2026-27616 Vikunja Vulnerable to Stored Cross-Site Scripting (XSS) via Unsanitized SVG Attachment Upload Leading to Token Exposure
- CVE-2026-27615 ADB-Explorer: UNC Path Support in ManualAdbPath Leads to Remote Code Execution (RCE)
- CVE-2026-27614 Bugsink is vulnerable to Stored XSS via Pygments fallback in stacktrace rendering
- CVE-2026-27613 CGI Parameter Injection (Bypass of STRICT_CGI_PARAMS and EscapeShellParam)
- CVE-2026-27612 Repostat Vulnerable to Reflected Cross-Site Scripting (XSS) via repo prop in RepoCard
- CVE-2026-27611 FileBrowser Quantum: Password Protection Not Enforced on Shared File Links
- CVE-2026-27610 Parse Dashboard Has a Cache Key Collision that Leaks Master Key to Read-Only Sessions
- CVE-2026-2761 Sandbox escape in the Graphics: WebRender component
- CVE-2026-27609 Parse Dashboard Missing CSRF Protection on Agent Endpoint
- CVE-2026-27608 Parse Dashboard Missing Authorization on Agent Endpoint
- CVE-2026-27607 RustFS's Missing Post Policy Validation leads to Arbitrary Object Write
- CVE-2026-27606 Rollup 4 has Arbitrary File Write via Path Traversal
- CVE-2026-27605 Chartbrew: Stored Cross-Site Scripting (XSS) via File Upload API
- CVE-2026-27604 FOSSBilling: Improper API Role Validation (system) Enables Unauthenticated Access to Privileged Admin Functions
- CVE-2026-27603 Missing authorization in chartbrew
- CVE-2026-27602 Modoboa has an OS Command Injection
- CVE-2026-27601 Underscore.js has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack
- CVE-2026-27600 HomeBox affected by Blind SSRF
- CVE-2026-2760 Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component
- CVE-2026-27599 ci4-cms-erp/ci4ms: System Settings (Mail Settings) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
- CVE-2026-27598 Dagu: Path traversal in DAG creation allows arbitrary YAML file write outside DAGs directory
- CVE-2026-27597 @enclave-vm/core is vulnerable to Sandbox Escape
- CVE-2026-27596 Exiv2: Integer Underflow in LoaderNative::getData() Causes Heap Buffer Overflow
- CVE-2026-27595 Parse Dashboard has incomplete authentication on AI Agent endpoint
- CVE-2026-27593 Statamic is vulnerable to account takeover via password reset link injection
- CVE-2026-27591 Winter: Privilege escalation by authenticated backend users
- CVE-2026-27590 Caddy: Unicode case-folding length expansion causes incorrect split_path index in FastCGI transport
- CVE-2026-2759 Incorrect boundary conditions in the Graphics: ImageLib component
- CVE-2026-27589 Caddy vulnerable to cross-origin config application via local admin API /load (caddy)
- CVE-2026-27588 Caddy: MatchHost becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass
- CVE-2026-27587 Caddy: MatchPath %xx (escaped-path) branch skips case normalization, enabling path-based route/auth bypass
- CVE-2026-27586 Caddy's mTLS client authentication silently fails open when CA certificate file is missing or malformed
- CVE-2026-27585 Caddy's improper sanitization of glob characters in file matcher may lead to bypassing security protections
- CVE-2026-27584 ActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync endpoints
- CVE-2026-2758 Use-after-free in the JavaScript: GC component
- CVE-2026-27579 Misconfiguration in realtime-collaboration-platform
- CVE-2026-27578 n8n Vulnerable to Stored XSS via Various Nodes
- CVE-2026-27577 n8n: Expression Sandbox Escape Leads to RCE