Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 762 of 1013.
- CVE-2026-26333 Calero VeraSMART < 2022 R1 .NET Remoting Arbitrary File Read Leading to ViewState RCE
- CVE-2026-26332 vm2: Sandbox Escape
- CVE-2026-26331 yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option
- CVE-2026-26330 Envoy's global rate limit may crash when the response phase limit is enabled and the response phase request is failed directly
- CVE-2026-2633 Missing authorization in Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- CVE-2026-26329 OpenClaw has a path traversal in browser upload allows local file read
- CVE-2026-26328 OpenClaw iMessage group allowlist authorization inherited DM pairing-store identities
- CVE-2026-26327 OpenClaw allows unauthenticated discovery TXT records to steer routing and TLS pinning
- CVE-2026-26326 OpenClaw skills.status could leak secrets to operator.read clients
- CVE-2026-26325 OpenClaw Node host system.run rawCommand/command mismatch can bypass allowlist/approvals
- CVE-2026-26324 OpenClaw has a SSRF guard bypass via full-form IPv4-mapped IPv6 (loopback / metadata reachable)
- CVE-2026-26323 OpenClaw has a command injection in maintainer clawtributors updater
- CVE-2026-26322 OpenClaw Gateway tool allowed unrestricted gatewayUrl override
- CVE-2026-26321 OpenClaw has a local file disclosure via sendMediaFeishu in Feishu extension
- CVE-2026-26320 OpenClaw macOS deep link confirmation truncation can conceal executed agent message
- CVE-2026-26319 OpenClaw has Missing Webhook Authentication in Telnyx Provider Allowing Unauthenticated Requests
- CVE-2026-26318 systeminformation has Command Injection via Unsanitized `locate` Output in `versions()`
- CVE-2026-26317 OpenClaw affected by cross-site request forgery (CSRF) through loopback browser mutation endpoints
- CVE-2026-26316 OpenClaw has BlueBubbles webhook auth bypass via loopback proxy trust
- CVE-2026-26315 Go Ethereum Improperly Validates the ECIES Public Key in RLPx Handshake
- CVE-2026-26314 Go Ethereum affected by DoS via malicious p2p message
- CVE-2026-26313 Go Ethereum affected by DoS via malicious p2p message
- CVE-2026-26312 Stalwart Mail Server has Out-of-Memory Denial of Service via Malformed Nested MIME Messages
- CVE-2026-26311 Envoy HTTP: filter chain execution on reset streams causing UAF crash
- CVE-2026-26310 Crash for scoped ip address in Envoy during DNS
- CVE-2026-2631 Datalogics Ecommerce Delivery < 2.6.60 - Unauthenticated Privilege Escalation
- CVE-2026-26309 Envoy has an off-by-one write in JsonEscaper::escapeString()
- CVE-2026-26308 Envoy has an RBAC Header Validation Bypass via Multi-Value Header Concatenation
- CVE-2026-26307 Gitea git grep search lacks a timeout
- CVE-2026-26306 Other in OM Workspace (Windows Edition)
- CVE-2026-26305 Mobility46 mobility46.se Improper Restriction of Excessive Authentication Attempts
- CVE-2026-26304 Permission Bypass in Playbook Run Creation
- CVE-2026-2630 Command injection in Security Center
- CVE-2026-26292 Gitea LFS mirror synchronization bypasses migration HTTP transport restrictions
- CVE-2026-26291 Cross-site scripting in GROWI
- CVE-2026-26290 EV Energy ev.energy Insufficient Session Expiration
- CVE-2026-2629 jishi node-sonos-http-api TTS Provider mac-os.js Promise os command injection
- CVE-2026-26289 Subnet Solutions PowerSYSTEM Center Incorrect Authorization
- CVE-2026-26288 Everon api.everon.io Missing Authentication for Critical Function
- CVE-2026-26287 External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration
- CVE-2026-26286 SillyTavern has Server-Side Request Forgery (SSRF) via Asset Download Endpoint that Allows Reading Internal Services
- CVE-2026-26284 ImageMagick has heap overflow in pcd decoder that leads to out of bounds read.
- CVE-2026-26283 ImageMagick has possible infinite loop in JPEG encoder when using `jpeg:extent`
- CVE-2026-26282 NanaZip has DotNet Single file OOB Heap Read
- CVE-2026-26281 InvoicePlane has Stored Cross-Site Scripting (XSS) Issue in Sumex Invoice View
- CVE-2026-26280 Systeminformation has a Command Injection via unsanitized interface parameter in wifi.js retry path
- CVE-2026-2628 All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login <= 2.2.5 - Authentication Bypass
- CVE-2026-26279 Froxlor Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injection
- CVE-2026-26278 fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)
- CVE-2026-26276 Gogs: DOM-based XSS via milestone selection
- CVE-2026-26275 httpsig-hyper has Improper Digest Verification that May Allow Message Integrity Bypass
- CVE-2026-26274 October: Safe Mode Bypass via Twig Database Write Operations
- CVE-2026-26273 Known affected by Account Takeover via Password Reset Token Leakage
- CVE-2026-26272 HomeBox affected by Stored XSS via HTML/SVG Attachment Upload
- CVE-2026-26271 Buffer Overread in FreeRDP Icon Processing
- CVE-2026-26270 InvoicePlane has Stored Cross-Site Scripting Issue in Identifier Formatting
- CVE-2026-2627 Softland FBackup Backup/Restore HID.dll link following
- CVE-2026-26269 Vim has a Netbeans specialKeys Stack Buffer Overflow
- CVE-2026-26268 Cursor sandbox escape via Git hooks
- CVE-2026-26267 rs-soroban-sdk #[contractimpl] macro calls inherent function instead of trait function when names collide
- CVE-2026-26266 AliasVault affected by Cross-Site Scripting (XSS) via Email HTML Rendering
- CVE-2026-26265 Discourse has IDOR vulnerability in the directory items endpoint
- CVE-2026-26264 BACnet Stack WriteProperty decoding length underflow leads to OOB read and crash
- CVE-2026-26263 GLPI has an Unauthenticated SQL Injection via Search engine
- CVE-2026-2626 Divi Booster < 5.0.2 - Unauthenticated PHP Object Injection
- CVE-2026-2625 Rust-rpm-sequoia: rust-rpm-sequoia: denial of service via crafted rpm file during signature verification
- CVE-2026-26247 Gitea OAuth2 PKCE S256 challenges are not enforced during token exchange
- CVE-2026-26246 Memory Exhaustion via Malformed PSD File Upload
- CVE-2026-26245 SQLi#2 SQL Injection in class_videos.php getSmartVideosByOffset
- CVE-2026-26244 SQLi#1 SQL Injection in class_videos.php _getFilters
- CVE-2026-26243 Arbitrary Folder Deletion in Qsync Central 5.0.0.5
- CVE-2026-26241 File Station 5
- CVE-2026-26240 File Station 5
- CVE-2026-2624 Authentication Bypass in ePati's Antikor NGFW
- CVE-2026-26239 File Station 5
- CVE-2026-26237 QuMagie
- CVE-2026-26236 QuMagie
- CVE-2026-26235 JUNG Smart Visu Server 1.1.1050 - 'JUNG Smart Visu Server' Missing Authentication
- CVE-2026-26234 JUNG Smart Visu Server - Improper Neutralization of HTTP Headers for Scripting Syntax
- CVE-2026-26233 Denial of Service via HTTP/2 single packet attack on login endpoint
- CVE-2026-26232 Gitea OAuth2 authorization codes lack expiry and reuse enforcement
- CVE-2026-26231 Gitea maintainer-edit permissions allow unauthorized commits to readable repositories
- CVE-2026-26230 Team Admin Privilege Escalation to Demote Members to Guest
- CVE-2026-2623 Blossom File Upload BLOSManager.java put path traversal
- CVE-2026-26228 VLC for Android < 3.7.0 Remote Access Path Traversal
- CVE-2026-26227 VLC for Android < 3.7.0 Remote Access OTP Authentication Bypass
- CVE-2026-26226 beautiful-mermaid < 0.1.3 SVG Attribute Injection
- CVE-2026-26225 Intego Personal Backup Task File Privilege Escalation
- CVE-2026-26224 Intego Log Reporter TOCTOU Local Privilege Escalation
- CVE-2026-26223 SPIP < 4.4.8 Cross-Site Scripting via Iframe Tags in Private Area
- CVE-2026-26222 DocLink .NET Remoting Unauthenticated Arbitrary File Read/Write RCE
- CVE-2026-26221 Hyland OnBase Timer Service Unauthenticated .NET Remoting RCE
- CVE-2026-26220 LightLLM <= 1.1.0 PD Mode Unsafe Deserialization RCE
- CVE-2026-2622 Blossom Article Title ArticleController.java content cross site scripting
- CVE-2026-26219 newbee-mall Unsalted MD5 Password Hashing Enables Offline Credential Cracking
- CVE-2026-26218 newbee-mall Default Seeded Administrator Credentials Allow Account Takeover
- CVE-2026-26217 Crawl4AI < 0.8.0 Docker API Local File Inclusion via file URL Handling
- CVE-2026-26216 Crawl4AI < 0.8.0 Docker API Unauthenticated Remote Code Execution via Hooks Parameter
- CVE-2026-26215 manga-image-translator Shared API Unsafe Deserialization RCE
- CVE-2026-26214 Xiaomi Galaxy FDS Android SDK <= 3.0.8 TLS Hostname Verification Disabled Enables MITM