Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 784 of 1013.
- CVE-2026-23991 go-tuf affected by client DoS via malformed server response
- CVE-2026-23990 Flux Operator Web UI Impersonation Bypass via Empty OIDC Claims
- CVE-2026-2399 Path traversal in PowerChute™ Serial Shutdown
- CVE-2026-23989 REVA Public Link Exploit
- CVE-2026-23988 Rufus has Local Privilege Escalation via TOCTOU Race Condition in Fido Script Handling
- CVE-2026-23986 Copier safe template has arbitrary filesystem write access via directory symlinks when _preserve_symlinks: true
- CVE-2026-23985 Apache Superset: Regular Expression Denial of Service (ReDoS) in SQL Parser
- CVE-2026-23984 Apache Superset: SQLLab Read-Only Bypass on PostgreSQL
- CVE-2026-23983 Apache Superset: Sensitive Data Exposure via REST API (disabled by default)
- CVE-2026-23982 Apache Superset: Improper Authorization in Dataset Creation Allows Access Control Bypass
- CVE-2026-23981 Apache Superset: Improper Authorization in Chart Update allowing Dashboard Modification
- CVE-2026-23980 Apache Superset: Improper Neutralization of Special Elements used in a SQL Command
- CVE-2026-2398 IDOR in AdamPOS' MobilMen 20T
- CVE-2026-23979 WordPress Gyan Elements plugin <= 2.2.1 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-23978 WordPress Gyan Elements plugin <= 2.2.1 - Local File Inclusion vulnerability
- CVE-2026-23977 WordPress Helpdesk Support Ticket System for WooCommerce plugin <= 2.1.2 - Broken Access Control vulnerability
- CVE-2026-23976 WordPress Modula Image Gallery plugin <= 2.13.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-23975 WordPress Golo theme < 1.7.5 - Local File Inclusion vulnerability
- CVE-2026-23974 WordPress Golo theme < 1.7.5 - Broken Access Control vulnerability
- CVE-2026-23973 WordPress Golo theme < 1.7.5 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-23972 WordPress Booking and Rental Manager plugin <= 2.6.0 - Broken Access Control vulnerability
- CVE-2026-23971 WordPress WoodMart theme <= 8.3.8 - PHP Object Injection vulnerability
- CVE-2026-23970 WordPress Redirection for Contact Form 7 plugin <= 3.2.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-2397 SQLi in AdamPOS' MobilMen 20T
- CVE-2026-23969 Apache Superset: Exposure of Sensitive Information via Incomplete ClickHouse Function Filtering
- CVE-2026-23968 Copier safe template has arbitrary filesystem read access via symlinks when _preserve_symlinks: false
- CVE-2026-23967 sm-crypto Affected by Signature Malleability in SM2-DSA
- CVE-2026-23966 sm-crypto Affected by Private Key Recovery in SM2-PKE
- CVE-2026-23965 sm-crypto Affected by Signature Forgery in SM2-DSA
- CVE-2026-23964 Mastodon has insufficient access control to push notification settings
- CVE-2026-23963 Mastodon missing length limits on list names, filter names, and filter keywords
- CVE-2026-23962 Mastodon vulnerable to Denial of Service from a single post (client/server)
- CVE-2026-23961 Mastodon may allow a remote suspension bypass
- CVE-2026-23960 Argo Workflows affected by stored XSS in the artifact directory listing
- CVE-2026-2396 List View Google Calendar <= 7.4.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via Event Description
- CVE-2026-23959 CoreShop Vulnerable to SQL Injection via Admin customer-company-modifier
- CVE-2026-23958 DataEase Vulnerable to Brute-Force Attack on Admin JWT Secret Derived from Password that Enables Full Account Takeover
- CVE-2026-23957 seroval is vulnerable to Denial of Service via array serialization
- CVE-2026-23956 seroval affected by Denial of Service via RegExp serialization
- CVE-2026-23955 EVerest vulnerable to concatenation of strings literal and integers
- CVE-2026-23954 Incus container image templating arbitrary host file read and write
- CVE-2026-23953 Incus container environment configuration newline injection
- CVE-2026-23952 ImageMagick has a NULL pointer dereference in MSL parser via <comment> tag before image load
- CVE-2026-23951 SumatraPDF's Integer Underflow in PalmDbReader Leads to Crash
- CVE-2026-23950 node-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFS
- CVE-2026-2395 SQLi in Xpoda Türkiye Informatics Technology's No Code Platform
- CVE-2026-23949 jaraco.context Has a Path Traversal Vulnerability
- CVE-2026-23948 FreeRDP has a NULL Pointer Dereference in rdp_write_logon_info_v2()
- CVE-2026-23947 Orval MCP client is vulnerable to code injection via unsanitized x-enum-descriptions in enum generation
- CVE-2026-23946 Tendenci has Authenticated Remote Code Execution via Pickle Deserialization
- CVE-2026-23944 Arcane allows unauthenticated proxy access to remote environments
- CVE-2026-23943 Pre-auth SSH DoS via unbounded zlib inflate
- CVE-2026-23942 SFTP root escape via component-agnostic prefix check in ssh_sftpd
- CVE-2026-23941 Request smuggling via first-wins Content-Length parsing in inets httpd
- CVE-2026-23940 Denial of Service via Oversized Package Upload
- CVE-2026-2394 Buffer Over-read vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers.
- CVE-2026-23939 Path Traversal in Local File Store Backend
- CVE-2026-23938 Server DoS via JavaScript preprocessing or script items
- CVE-2026-23937 Host PSK extraction in Zabbix API
- CVE-2026-23935 Use-after-free read in script item/preprocessing HttpRequest body
- CVE-2026-23934 Frontend DoS via the validate.api.exists action
- CVE-2026-23933 Hardcoded session key in Zabbix 7.4
- CVE-2026-23931 Frontend plaintext macro value enumeration via the validatate.api.exists action
- CVE-2026-23930 Frontend DoS via the popup.testtriggerexpr action
- CVE-2026-2393 Server-Side Request Forgery (SSRF) in mlflow/mlflow
- CVE-2026-23929 Prototype pollution leading to stored XSS
- CVE-2026-23928 Stored XSS vulnerability in the Item history/Plain text widget
- CVE-2026-23927 Agent 2 Oracle plugin TNS connection string injection via the 'service' parameter
- CVE-2026-23926 Stored XSS vulnerability in Host navigator widget maintenance tooltip
- CVE-2026-23925 Unauthorized host creation via configuration.import API by low-privilege user with write permissions
- CVE-2026-23924 Agent 2 Docker plugin arbitrary file read via Docker API injection
- CVE-2026-23923 Unauthenticated arbitrary PHP class instantiation
- CVE-2026-23922 Email media OAuth secret leak to Super Admin
- CVE-2026-23921 Blind, read-only SQL injection in Zabbix API via sortfield parameter
- CVE-2026-23920 Command injection in Zabbix
- CVE-2026-23919 Insufficient isolation of JavaScript (Duktape) execution context on Zabbix Server
- CVE-2026-23918 Apache HTTP Server: http2: double free and possible RCE on early reset
- CVE-2026-2391 qs's arrayLimit bypass in comma parsing allows denial of service
- CVE-2026-23907 Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code
- CVE-2026-23906 Apache Druid: Authentication Bypass via LDAP Anonymous Bind
- CVE-2026-23904 Apache Kyuubi: Unrestricted access via Kyuubi engine-ui proxy
- CVE-2026-23903 Apache Shiro: Auth bypass when accessing static files only on case-insensitive filesystems
- CVE-2026-23902 Apache DolphinScheduler: Users are able to use tenants that are not defined on the platform during workflow execution.
- CVE-2026-23901 Apache Shiro: Brute force attack possible to determine valid user names
- CVE-2026-23900 Extension - phoca.cz - Stored XSS vectors in Phoca Maps component 5.0.0 - 6.0.2 for Joomla
- CVE-2026-2390 Powerkit <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy Load Image Processing
- CVE-2026-23899 Joomla! Core - [20260306] - Improper access check in webservice endpoints
- CVE-2026-23898 Joomla! Core - [20260305] - Arbitrary file deletion in com_joomlaupdate
- CVE-2026-23897 Apollo Server is vulnerable to denial of service with `startStandaloneServer`
- CVE-2026-23896 immich API Key Privilege Escalation vulnerability
- CVE-2026-23893 openCryptoki has improper link resolution before file access (link following)
- CVE-2026-23892 OctoPrint has Timing Side-Channel Vulnerability in API Key Authentication
- CVE-2026-23891 Decidim has a Cross-site scripting (XSS) vulnerability via user name field
- CVE-2026-23890 pnpm scoped bin name Path Traversal allows arbitrary file creation outside node_modules/.bin
- CVE-2026-2389 Cross-site scripting in Complianz – GDPR/CCPA Cookie Consent
- CVE-2026-23889 pnpm has Windows-specific tarball Path Traversal
- CVE-2026-23888 pnpm: Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip)
- CVE-2026-23887 Group-Office has stored XSS vulnerability via unsanitized filenames
- CVE-2026-23886 Swift W3C TraceContext has malformed HTTP header that can cause a crash
- CVE-2026-23885 AlchemyCMS has Authenticated Remote Code Execution (RCE) via eval injection in ResourcesHelper