Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 773 of 1013.
- CVE-2026-25155 Qwik City CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form-data)
- CVE-2026-25154 LocalSend has Stored XSS in Web Share Interface via Filename
- CVE-2026-25153 @backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooks
- CVE-2026-25152 @backstage/plugin-techdocs-node vulnerable to possible Path Traversal in TechDocs Local Generator
- CVE-2026-25151 Qwik City has a CSRF Protection Bypass via Content-Type Header Validation
- CVE-2026-25150 Prototype Pollution via FormData Processing in Qwik City
- CVE-2026-2515 Hostinger Reach <= 1.3.8 - Missing Authorization to Authenticated (Subscriber+) Integration API Key Update
- CVE-2026-25149 Qwik City Open Redirect via fixTrailingSlash
- CVE-2026-25148 Qwik SSR XSS via Unsafe Virtual Node Serialization
- CVE-2026-25147 OpenEMR's Portal Payment Endpoint Trusts User-Controlled pid
- CVE-2026-25146 OpenEMR's payments gateway_api_key secret rendered into client JS code
- CVE-2026-25145 melange has a path traversal in license-path which allows reading files outside workspace
- CVE-2026-25144 Talishar has a Stored XSS which can lead to data exfiltration & user impersonation
- CVE-2026-25143 melange affected by potential host command execution via license-check YAML mode patch pipeline
- CVE-2026-25142 SandboxJS Prototype Pollution -> Sandbox Escape -> RCE
- CVE-2026-25141 Orval has a code injection via unsanitized x-enum-descriptions uing JS comments
- CVE-2026-25140 apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams
- CVE-2026-2514 Possibility of unintended actions when viewing maliciously crafted network data in Progress Flowmon ADS web application
- CVE-2026-25139 RIOT Vulnerable to Multiple Out-of-Bounds Read When Processing Received 6LoWPAN SFR Fragments
- CVE-2026-25138 Rucio WebUI has Username Enumeration via Login Error Message
- CVE-2026-25137 NixOs Odoo database and filestore publicly accessible with default odoo configuration
- CVE-2026-25136 Rucio WebUI has a Reflected Cross-site Scripting Vulnerability
- CVE-2026-25135 OpenEMR's location resource for Group.$export operation returns entire patient/user population contact information
- CVE-2026-25134 Group-Office Argument Injection in MaintenanceController::actionZipLanguage
- CVE-2026-25133 October CMS has Stored XSS via SVG Filter Bypass
- CVE-2026-25131 OpenEMR has Broken Access Control in Procedures Configuration
- CVE-2026-25130 Cybersecurity AI vulnerable to command Injection through argument injection in find_file Agent tool
- CVE-2026-2513 Cross-site scripting in Flowmon ADS
- CVE-2026-25129 PsySH has Local Privilege Escalation via CWD .psysh.php auto-load
- CVE-2026-25128 fast-xml-parser has RangeError DoS Numeric Entities Bug
- CVE-2026-25127 OpenEMR has Broken Access Control on Care Coordination Module
- CVE-2026-25126 PolarLearn's unvalidated vote direction allows vote count manipulation
- CVE-2026-25125 October CMS: Environment Variable Exfiltration via INI Parser Interpolation
- CVE-2026-25124 OpenEMR has Broken Access Control in Report/Clients/Message List CSV Export
- CVE-2026-25123 Homarr affected by Unauthenticated SSRF / Port-Scan Primitive via widget.app.ping
- CVE-2026-25122 apko is vulnerable to unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams
- CVE-2026-25121 apko is vulnerable to path traversal in apko dirFS which allows filesystem writes outside base
- CVE-2026-25120 Gogs Allows Cross-Repository Comment Deletion via DeleteComment
- CVE-2026-2512 Code Embed <= 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Fields
- CVE-2026-25119 Gogs: Authentication Bypass via Unvalidated Reverse Proxy Headers
- CVE-2026-25118 Information disclosure in immich
- CVE-2026-25117 pwn.college DOJO vulnerable to sandbox escape leading to arbitrary javascript execution
- CVE-2026-25116 Runtipi vulnerable to unauthenticated docker-compose.yml Overwrite via Path Traversal
- CVE-2026-25115 n8n is vulnerable to Python sandbox escape
- CVE-2026-25114 CloudCharge cloudcharge.se Improper Restriction of Excessive Authentication Attempts
- CVE-2026-25113 SWITCH EV swtchenergy.com Improper Restriction of Excessive Authentication Attempts
- CVE-2026-25112 Privilege escalation in Genetec Airport Operational Manager
- CVE-2026-25111 Copeland XWEB and XWEB Pro OS Command Injection
- CVE-2026-25110 Sensors_medical_sensor has a NULL pointer dereference vulnerability
- CVE-2026-2511 SQL injection in JS Help Desk – AI-Powered Support & Ticketing System
- CVE-2026-25109 Copeland XWEB and XWEB Pro OS Command Injection
- CVE-2026-25108 Soliton Systems K.K FileZen OS Command Injection
- CVE-2026-25107 Hardcoded credentials in WRC-X1800GS-B
- CVE-2026-25105 Copeland XWEB and XWEB Pro OS Command Injection
- CVE-2026-25104 Memory corruption in MediaInfoLib
- CVE-2026-25101 Session Fixation in Bludit
- CVE-2026-25100 Stored XSS via SVG File Upload in Bludit
- CVE-2026-25099 Remote Code Execution via Unrestricted File Upload in Bludit
- CVE-2026-2509 Cross-site scripting in Page Builder: Pagelayer – Drag and Drop website builder
- CVE-2026-25089 Fortinet FortiSandbox OS Command Injection
- CVE-2026-25088 SQL injection in FortiNDR
- CVE-2026-25087 Apache Arrow: Potential use-after-free when reading IPC file with pre-buffering
- CVE-2026-25086 Automated Logic WebCTRL Premium Server Multiple Binds to the Same Port
- CVE-2026-25085 Copeland XWEB and XWEB Pro Unexpected Status Code or Return Value
- CVE-2026-25084 ZLAN Information Technology ZLAN5143D Missing Authentication for Critical Function
- CVE-2026-25083 Missing authorization in GROWI
- CVE-2026-2508 Gravity Forms Booking <= 2.7.1 - Authenticated (Subscriber+) Time-Based SQL Injection via 'staff_id'
- CVE-2026-25077 Apache CloudStack: Unauthenticated Command Injection in Direct Download Templates
- CVE-2026-25076 Anchore Enterprise GraphQL Reports API SQL injection
- CVE-2026-25075 strongSwan 4.5.0 < 6.0.5 EAP-TTLS AVP Parsing Integer Underflow
- CVE-2026-25073 XikeStor SKS8310-8X Stored XSS via System Name
- CVE-2026-25072 XikeStor SKS8310-8X Predictable Session Identifiers
- CVE-2026-25071 XikeStor SKS8310-8X switch_config.src Missing Authentication
- CVE-2026-25070 XikeStor SKS8310-8X PingTestSet Command Injection
- CVE-2026-2507 BIG-IP TMM Vulnerability
- CVE-2026-25069 SunFounder Pironman Dashboard <= 1.3.13 Path Traversal Arbitrary File Read/Deletion
- CVE-2026-25068 alsa-lib 1.2.15.2 Topology Decoder Heap-based Buffer Overflow
- CVE-2026-25067 SmarterTools SmarterMail < Build 9518 Unauthenticated background-of-the-day Path Coercion
- CVE-2026-25063 gradle-completion has a Bash command injection issue
- CVE-2026-25062 Outline Affected an Arbitrary File Read via Path Traversal in JSON Import
- CVE-2026-25061 tcpflow has TIM Element OOB Write in wifipcap
- CVE-2026-25060 OpenList Insecure TLS Default Configuration
- CVE-2026-2506 EM Cost Calculator <= 2.3.1 - Unauthenticated Stored Cross-Site Scripting via 'customer_name'
- CVE-2026-25059 OpenList affected by Path Traversal in file copy and remove handlers
- CVE-2026-25058 Vexa's unauthenticated internal transcript endpoint exposed by default
- CVE-2026-25057 Zip Slip in MarkUs config upload allowing RCE
- CVE-2026-25056 n8n Arbitrary File Write leading to RCE in n8n Merge Node
- CVE-2026-25055 n8n Arbitrary File Write on Remote Systems via SSH Node
- CVE-2026-25054 n8n is Vulnerable to Stored Cross-Site Scripting via Markdown Rendering in Workflow UI
- CVE-2026-25053 n8n is Vulnerable to OS Command Injection in Git Node
- CVE-2026-25052 n8n Improper File Access Controls Allow Arbitrary File Read by Authenticated Users
- CVE-2026-25051 n8n Improper CSP Enforcement in Webhook Responses May Allow Stored XSS
- CVE-2026-25050 Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategy
- CVE-2026-2505 Categories Images <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'z_taxonomy_image' Shortcode
- CVE-2026-25049 n8n Has an Expression Escape Vulnerability Leading to RCE
- CVE-2026-25048 xgrammar: Multi-layer nesting causes DoS
- CVE-2026-25047 deepHas vulnerable to Prototype Pollution via constructor.prototype
- CVE-2026-25046 [Kimi VS Code] Command Injection in publish scripts vsix-publish.js and ovsx-publish.js
- CVE-2026-25045 Budibase Critical Privilege Escalation & IDOR via Missing RBAC on User Role Management (Creator-Role)
- CVE-2026-25044 Budibase: Command Injection in Bash Automation Step