Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 901 of 1013.
- CVE-2026-116266 MIME::Head versions from 5.518 before 5.521 for Perl decode a partly encoded multipart boundary without flagging the parse as ambiguous.
- CVE-2026-116265 MIME::Field::ParamVal versions before 5.521 for Perl do not flag an ambiguous multipart boundary written as RFC 2231 continuations.
- CVE-2026-116264 MIME::Field::ParamVal versions before 5.521 for Perl allow one invalid Content-Type parameter to hide the parameters after it, including the multipart boundary.
- CVE-2026-116263 HaschekSolutions PictShare File Upload core.php architect race condition
- CVE-2026-116262 libimobiledevice Web Inspector webinspector.c webinspector_receive_with_timeout heap-based overflow
- CVE-2026-116261 libimobiledevice AFC File afc.c afc_file_open out-of-bounds
- CVE-2026-116260 libimobiledevice AFC Service afc.c service_receive double free
- CVE-2026-11626 Local Privilege Escalation in Symantec Endpoint Protection macOS CleanWipe Removal Tool
- CVE-2026-116259 libimobiledevice Device Info afc.c afc_get_device_info_key memory corruption
- CVE-2026-116258 libimobiledevice AFC afc.c heap-based overflow
- CVE-2026-116257 BillaBear Installation InstallController.php processInstall missing authentication
- CVE-2026-116256 geesondog RhaPHP Mp Module Media Proxy Show.php image server-side request forgery
- CVE-2026-116255 PGYER codefever URI Sanitizer doc.php _detail path traversal
- CVE-2026-116254 rathena FluxCP PayPal IPN PaymentNotifyRequest.php verifyiprange origin validation
- CVE-2026-116253 DedeCMS Advertisement Rendering ad_js.php _RunMagicQuotes code injection
- CVE-2026-11625 Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes
- CVE-2026-11624 MCP Toolbox for Databases has an Origin Validation Error
- CVE-2026-116237 Oray Pugongying X5 Pro Dnsmasq crlf injection
- CVE-2026-116236 Oray Pugongying X5 Pro PPPoE WAN Setting upload_files plugin_init unrestricted upload
- CVE-2026-116235 Oray Pugongying X5 Pro L2TP Authentication crlf injection
- CVE-2026-116234 Oray Pugongying X5 Pro IPsec Policy ipsec.conf crlf injection
- CVE-2026-116233 Oray Pugongying X5 Pro Dnsmasq crlf injection
- CVE-2026-116232 Oray Pugongying X5 Pro SNMP snmp_set crlf injection
- CVE-2026-116231 Oray Pugongying X5 Pro Ser2net crlf injection
- CVE-2026-116230 Ndemic Creations Plague Inc Evolved Workshop Scenario Loader deserialization
- CVE-2026-11623 tmux image.c image_free use after free
- CVE-2026-116229 ffxiv-teamcraft FFXIV Teamcraft Renderer-Process IPC Bridge preload.ts clipboard.readText cross site scripting
- CVE-2026-116228 777genius agent-teams-ai Local HTTP Service HttpServer.ts doStart missing authentication
- CVE-2026-116227 Edimax BR-6208AC Virtual Server cross site scripting
- CVE-2026-116224 fr0tt benotes Bookmark Metadata Endpoint PostController.php getUrlInfo server-side request forgery
- CVE-2026-116223 icret EasyImage del.php privileges management
- CVE-2026-11622 Potential memory usage beyond configured limits
- CVE-2026-116219 Dolibarr ERP CRM before 24.0.0 OS Command Injection via mysqldump Parameter
- CVE-2026-116218 Dolibarr ERP CRM 19.0.0 before 23.0.4 SQL Injection via bankaccounts API type field
- CVE-2026-116217 RosarioSIS before 12.9.2 Reflected XSS via menu_id in MenuReports.php
- CVE-2026-116216 MacCMS v10 through 2026.1000.4056 Comment Impersonation via user_id Mass Assignment
- CVE-2026-116215 MacCMS v10 through 2026.1000.4056 Race Condition via Card Redemption
- CVE-2026-116214 MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code
- CVE-2026-116213 Webasyst Framework through 4.4.0 Arbitrary File Read via waArchiveTar Symlinks
- CVE-2026-116212 Webasyst Framework through 4.4.0 Stored XSS via Photos Album URL
- CVE-2026-116211 YesWiki 4.5.0 before 4.7.0 SQL Injection via date_maj_fiche in Bazar entry create
- CVE-2026-116210 Webasyst Framework through 4.4.0 Photos App CSRF via Backend Actions
- CVE-2026-11621 Dcat-Admin User Setting upload editorMDUpload unrestricted upload
- CVE-2026-116208 YesWiki 4.6.2 before 4.7.0 Missing Authorization in ActivityPub syncActorPosts
- CVE-2026-116207 YesWiki 4.6.0 before 4.7.0 SQL Injection via Bazar Entries Search API
- CVE-2026-116206 YesWiki 4.2.0 before 4.7.0 Stored XSS via Comment Raw-HTML Syntax
- CVE-2026-116205 YesWiki before 4.7.0 Unauthenticated SSRF via [[|URL]] Raw-Inclusion Syntax
- CVE-2026-116204 YesWiki before 4.7.0 CSRF via despam Admin Action
- CVE-2026-116203 YesWiki before 4.7.0 Stored XSS via filtertags Action Parameters
- CVE-2026-116202 YesWiki before 4.7.0 Stored XSS via ImageField SVG Upload
- CVE-2026-116201 Snipe-IT before 8.5.0 SAML Assertion Replay via Race Condition
- CVE-2026-116200 Snipe-IT before 8.6.3 LDAP StartTLS Downgrade via connectToLdap()
- CVE-2026-11620 TOTOLINK EX200 vsftpd vsftpd.conf least privilege violation
- CVE-2026-1162 UTT HiPER 810 setSysAdm strcpy buffer overflow
- CVE-2026-116199 Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback
- CVE-2026-116198 Snipe-IT before 8.7.0 Missing Encryption via Api AssetsController store
- CVE-2026-116197 Contrast 1.21.0 before 1.25.0 Credential Leak via imagepuller Wildcard Registry Selection
- CVE-2026-116196 Rclone before v1.75.2 B2 Credential Leak on Redirect via --b2-download-url
- CVE-2026-116195 Rclone before 1.75.2 Path Traversal via translateLink .rclonelink Suffix Trim
- CVE-2026-116194 Rclone 1.52.0 before 1.75.2 CSRF via pCloud OAuth Callback
- CVE-2026-116193 Rclone 1.64.0 before 1.75.2 serve webdav Authentication Bypass via OPTIONS Requests
- CVE-2026-116192 rclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote roots
- CVE-2026-116191 Rclone before 1.75.2 Path Traversal via serve webdav MKCOL
- CVE-2026-116190 rclone v1.56.0 before v1.75.2 WebDAV Credential Header Leak on Redirect
- CVE-2026-11619 Dolibarr ERP CRM Legacy Filemanager config.inc.php improper authorization
- CVE-2026-116189 rclone 1.55.0 before 1.75.2 selfupdate Signature Verification Bypass via SHA256SUMS
- CVE-2026-116188 rclone serve s3 1.75.0 before 1.75.2 Memory Limit Bypass via Multipart Overflow
- CVE-2026-116187 Rclone v1.68.0 before v1.75.2 Authorization Bypass in serve s3 Multipart Uploads
- CVE-2026-116186 OpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetId
- CVE-2026-116185 OpenRemote before 1.31.0 Cross-Realm Information Disclosure via getGatewayActiveTunnelInfos
- CVE-2026-116184 OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocket
- CVE-2026-116183 phpMyFAQ before 4.1.10 Authorization Bypass via /api/faq/create openQuestionID
- CVE-2026-116182 phpMyFAQ before 4.1.10 SSRF via PDF Export Image Fetching
- CVE-2026-116181 vLLM 0.20.1 before 0.29.0 DoS and GPU Out-of-Bounds Write via stop_token_ids
- CVE-2026-116180 vLLM from 0.8.5 before 0.31.0 Cross-Tenant DoS via Uninitialized LogprobsTensors
- CVE-2026-11618 DTStack Taier Source Connection Test Endpoint LoginInterceptor.java preHandle improper authentication
- CVE-2026-116179 vLLM 0.18.0 before 0.31.0 Memory Exhaustion via media_io_kwargs num_frames Override
- CVE-2026-116178 vLLM 0.20.0 before 0.30.0 DoS via /inference/v1/generate mm_placeholders
- CVE-2026-116177 vLLM 0.10.2 before 0.25.0 DoS via Nemotron-VL Processor Decompression-Bomb Guard Bypass
- CVE-2026-116176 vLLM 0.9.2 before 0.24.0 SSRF via X-Request-Id in P2pNcclConnector
- CVE-2026-116175 vLLM 0.19.0 before 0.24.0 Audio Decompression Bomb DoS via Chat Completions
- CVE-2026-116174 vLLM 0.22.0 before 0.24.0 Denial of Service via Rust gRPC Generate
- CVE-2026-116173 vLLM 0.22.0 before 0.24.0 Denial of Service via gRPC output_candidates.token_ids
- CVE-2026-116172 vLLM 0.22.0 before 0.24.0 DoS via Rust gRPC CandidateTokens.top_n
- CVE-2026-116171 SiYuan 3.5.4 before 3.8.7 Sensitive Path Bypass via Windows Extended-Length Prefix
- CVE-2026-116170 SiYuan before v3.8.7 SQL Injection via History Search op and query
- CVE-2026-11617 Tanium addressed a compression bomb vulnerability in Findings.
- CVE-2026-116169 SiYuan 2.10.0 before 3.8.7 Stored XSS via KaTeX \href in Math Blocks
- CVE-2026-116168 SiYuan before v3.8.7 Path Traversal Local File Read via MCP Asset Tool
- CVE-2026-116167 SiYuan 2.9.0 before 3.8.7 XSS via check-auth to Parameter
- CVE-2026-116166 SiYuan 3.6.0 before 3.8.7 Cleartext Transmission via Unenforced networkServeTLS Setting
- CVE-2026-116165 Parse Server 9.0.0 before 9.10.4-alpha.4 Unauthenticated Class Schema Deletion on MongoDB
- CVE-2026-116164 Parse Server 9.0.0 before 9.10.4-alpha.3 Reserved Field Name Injection via Object Writes
- CVE-2026-116163 Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses
- CVE-2026-116162 Parse Server 9.0.0 before 9.10.5-alpha.5 Privilege Escalation via SMS MFA Login
- CVE-2026-116161 Parse Server 9.0.0 before 9.10.5-alpha.4 LiveQuery Information Disclosure via $or Subscriptions
- CVE-2026-116160 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Heap Buffer Overflow via X11 Animate
- CVE-2026-11616 Events Calendar for GeoDirectory <= 2.3.28 - Authenticated (Subscriber+) Privilege Escalation
- CVE-2026-116159 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via -cdl Option
- CVE-2026-116158 ImageMagick before 7.1.2-33 Memory Leak in magick compare