Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 769 of 1013.
- CVE-2026-25556 MuPDF 1.23.0 through 1.27.0 Barcode Decoding Double Free
- CVE-2026-25555 OpenBullet2 0.3.2 Authentication Bypass via X-Api-Key Header
- CVE-2026-25554 OpenSIPS 3.1 <= 3.6.4 auth_jwt SQL Injection Enables JWT Authentication Bypass
- CVE-2026-25552 Ghost CLI < 1.30.1 IP Spoofing via X-Forwarded-For Header
- CVE-2026-25551 Seagull Software BarTender Deserialization Privilege Escalation via .NET Remoting Service
- CVE-2026-25550 Seagull Software BarTender Unauthenticated RCE via .NET Remoting Service
- CVE-2026-2555 JeecgBoot Retrieval-Augmented Generation AiragKnowledgeController.java importDocumentFromZip deserialization
- CVE-2026-25548 InvoicePlane Vulnerable to Remote Code Execution via Local File Inclusion and Log Poisoning
- CVE-2026-25547 Uncontrolled Resource Consumption in @isaacs/brace-expansion
- CVE-2026-25546 Godot MCP is vulnerable to Command Injection via unsanitized projectPath
- CVE-2026-25545 Astro has Full-Read SSRF in error rendering via Host: header injection
- CVE-2026-25544 Payload has an SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters
- CVE-2026-25543 HtmlSanitizer has a bypass via template tag
- CVE-2026-25542 Tekton Pipelines: VerificationPolicy regex pattern bypass via substring matching
- CVE-2026-25541 Bytes is vulnerable to integer overflow in BytesMut::reserve
- CVE-2026-25540 Information disclosure in mastodon
- CVE-2026-2554 Missing authorization in WCFM – Frontend Manager for WooCommerce
- CVE-2026-25539 SiYuan has Arbitrary File Write via /api/file/copyFile leading to RCE
- CVE-2026-25538 Devtron Attributes API Unauthorized Access Leading to API Token Signing Key Leakage
- CVE-2026-25537 jsonwebtoken has Type Confusion that leads to potential authorization bypass
- CVE-2026-25536 @modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
- CVE-2026-25535 jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions
- CVE-2026-25534 Spinnaker clouddriver and orca URL validation bypass via underscores in hostnames
- CVE-2026-25533 Enclave has a sandbox escape via infinite recursion and error objects
- CVE-2026-25532 ESF-IDF is Vulnerable to WPS Enrollee Fragment Integer Underflow
- CVE-2026-25531 Kanboard TaskCreationController::duplicateProjects() endpoint does not validate user permissions for target projects
- CVE-2026-25530 Kanboard is missing authorization check in getSwimlane API allows cross-project data access
- CVE-2026-2553 tushar-2223 Hotel-Management-System HTTP POST Request home.php sql injection
- CVE-2026-25529 Postal has HTML injection / XSS in message view
- CVE-2026-25528 LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection
- CVE-2026-25527 changedetection.io vulnerable to unauthenticated static path traversal
- CVE-2026-25526 JinJava Bypass through ForTag leads to Arbitrary Java Execution
- CVE-2026-25525 OpenMage LTS has Path Traversal Filter Bypass in Dataflow Module
- CVE-2026-25524 OpenMage LTS's Phar Deserialization leads to Remote Code Execution
- CVE-2026-25523 Magento's X-Original-Url header can expose admin url
- CVE-2026-25522 Craft Commerce has Stored XSS in Shipping Zone (Name & Description) Fields Leading to Potential Privilege Escalation
- CVE-2026-25521 Locutus is vulnerable to Prototype Pollution
- CVE-2026-25520 SandboxJS has a Sandbox Escape
- CVE-2026-2552 ZenTao Editor control.php delete path traversal
- CVE-2026-25519 OpenSlides has incorrect access control vulnerability in authentication service
- CVE-2026-25518 cert-manager-controller DoS via Specially Crafted DNS Response
- CVE-2026-25517 Wagtail has improper permission handling on admin preview endpoints
- CVE-2026-25516 NiceGUI's XSS vulnerability in ui.markdown() allows arbitrary JavaScript execution through unsanitized HTML content
- CVE-2026-25514 FacturaScripts has SQL Injection vulnerability in Autocomplete Actions
- CVE-2026-25513 FacturaScripts has SQL Injection vulnerability in API ORDER BY Clause
- CVE-2026-25512 Group-Office is vulnerable to RCE due to Command Injection via TNEF Attachment Handler
- CVE-2026-25511 Group-Office is vulnerable to SSRF and File Read in WOPI service discovery
- CVE-2026-25510 CI4MS Vulnerable to Remote Code Execution (RCE) via Arbitrary File Creation and Save in File Editor
- CVE-2026-2551 ZenTao Backup control.php delete path traversal
- CVE-2026-25509 CI4MS Vulnerable to User Email Enumeration via Password Reset Flow
- CVE-2026-25508 ESF-IDF Has Memory Safety Vulnerabilities in BLE Provisioning
- CVE-2026-25507 ESF-IDF Has Use-after-free Vulnerability in BLE Provisioning
- CVE-2026-25506 MUNGE has a buffer overflow in message unpacking allows key leakage and credential forgery
- CVE-2026-25505 Bambuddy Uses Hardcoded Secret Key + Many API Endpoints do not Require Authentication
- CVE-2026-25503 iccDEV Has Type Confusion in CIccTagEmbeddedHeightImage::Validate()
- CVE-2026-25502 iccDEV is vulnerable to stack-buffer-overflow in icFixXml()
- CVE-2026-25501 Null dereference in smf
- CVE-2026-25500 Rack's Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href
- CVE-2026-2550 EFM iptime A6004MX timepro.cgi commit_vpncli_file_upload unrestricted upload
- CVE-2026-25499 terraform-provider-proxmox has insecure sudo recommendation in the documentation
- CVE-2026-25498 Craft has a potential authenticated Remote Code Execution via malicious attached Behavior
- CVE-2026-25497 Craft has a GraphQL Asset Mutation Privilege Escalation
- CVE-2026-25496 Craft has a stored XSS in Number Prefix & Suffix Fields
- CVE-2026-25495 Craft has a SQL Injection in Element Indexes via criteria[orderBy]
- CVE-2026-25494 Craft has a SSRF in GraphQL Asset Mutation via Alternative IP Notation
- CVE-2026-25493 Craft has a SSRF in GraphQL Asset Mutation via HTTP Redirect
- CVE-2026-25492 Craft has a save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying host
- CVE-2026-25491 Craft has a Stored XSS in Entry Types Name
- CVE-2026-25490 Craft Commerce has Stored XSS in Inventory Location Address Leading to Potential Privilege Escalation
- CVE-2026-2549 zhanghuanhao LibrarySystem 图书馆管理系统 BookController.java access control
- CVE-2026-25489 Craft Commerce has Stored XSS in Tax Zones (Name & Description) Leading to Potential Privilege Escalation
- CVE-2026-25488 Craft Commerce has Stored XSS in Tax Categories (Name & Description) Fields Leading to Potential Privilege Escalation
- CVE-2026-25487 Craft CMS has Stored XSS in Tax Rates Name Leading to Potential Privilege Escalation
- CVE-2026-25486 Craft Commerce has Stored XSS in Shipping Methods Name Field Leading to Potential Privilege Escalation
- CVE-2026-25485 Craft Commerce has Stored XSS in Shipping Categories (Name & Description) Fields Leading to Potential Privilege Escalation
- CVE-2026-25484 Craft Commerce has Stored XSS in Product Type Name
- CVE-2026-25483 Craft Commerce has Stored XSS via Order Status Message with potential database exfiltration
- CVE-2026-25482 Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget)
- CVE-2026-25481 Langroid has WAF Bypass Leading to RCE in TableChatAgent
- CVE-2026-25480 FileStore key canonicalization collisions allow response cache mixup/poisoning (ASCII ord + Unicode NFKD)
- CVE-2026-2548 WAYOS FBM-220G rc sub_40F820 command injection
- CVE-2026-25479 Litestar has an AllowedHosts validation bypass due to unescaped regex metacharacters in configured host patterns
- CVE-2026-25478 Litestar has a CORS origin allowlist bypass due to unescaped regex metacharacters in allowed origins
- CVE-2026-25477 AFFiNE: Open Redirect via Regex Bypass in redirect-proxy
- CVE-2026-25476 OpenEMR has Session Timeout Bypass via skip_timeout_reset
- CVE-2026-25475 OpenClaw Vulnerable to Local File Inclusion via MEDIA: Path Extraction
- CVE-2026-25474 OpenClaw has a Telegram webhook request forgery (missing `channels.telegram.webhookSecret`) → auth bypass
- CVE-2026-25473 WordPress WZone plugin <= 14.0.31 - Broken Access Control vulnerability
- CVE-2026-25472 WordPress Fusion Builder plugin <= 3.14.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-25471 WordPress Admin Safety Guard plugin <= 1.2.6 - Broken Authentication vulnerability
- CVE-2026-25470 Code injection in ACPT (Pro) - Custom Post Types Plugin for WordPress
- CVE-2026-2547 LigeroSmart index.pl AgentDashboard cross site scripting
- CVE-2026-25469 WordPress ViaBill – WooCommerce plugin <= 1.1.53 - Settings Change vulnerability
- CVE-2026-25468 WordPress Happy Addons for Elementor plugin <= 3.20.8 - Sensitive Data Exposure vulnerability
- CVE-2026-25467 WordPress User Registration plugin <= 5.3.0 - Content Injection vulnerability
- CVE-2026-25466 WordPress WP Go Maps plugin <= 10.1.04 - Broken Access Control vulnerability
- CVE-2026-25465 WordPress CP Multi View Event Calendar plugin <= 1.4.36 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-25464 WordPress Jannah theme <= 7.6.4 - Local File Inclusion vulnerability
- CVE-2026-25463 WordPress Wpresidence Core plugin <= 5.4.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-25462 WordPress avalex plugin <= 3.1.3 - Broken Access Control vulnerability