Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 913 of 1013.
- CVE-2026-113727 OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs
- CVE-2026-113726 virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST
- CVE-2026-113725 virtualenv bash activate runs commands from an environment name with a backslash before $
- CVE-2026-113724 virtualenv: Deletion recovery can change a symlink target's mode
- CVE-2026-113723 virtualenv: Bash prompt values can change meaning under older compatibility modes
- CVE-2026-113722 virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax
- CVE-2026-113721 virtualenv: Generated files can follow existing destination links
- CVE-2026-113720 virtualenv: Seeded files retain permissions from an older cache
- CVE-2026-11372 IBM TRIRIGA Cross-Site Scripting Vulnerability
- CVE-2026-113719 virtualenv: Seed replacement does not contain metadata deletion paths
- CVE-2026-113718 virtualenv: Xonsh activation literals depend on the script decoding codec
- CVE-2026-113717 virtualenv: Pip seeding with download omits wheel digest verification
- CVE-2026-113716 virtualenv: Builtin creation follows linked environment directories
- CVE-2026-113715 virtualenv: Venv configuration readback can reinterpret path boundaries
- CVE-2026-113714 virtualenv: Downloaded wheel selection and caching precede verification
- CVE-2026-113713 virtualenv: Temporary app-data can leave dangling seed package links
- CVE-2026-113712 Cachet has Stored XSS in Incident Component
- CVE-2026-113711 ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export
- CVE-2026-113710 ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing
- CVE-2026-11371 BetterDocs < 4.5.5 - Unauthenticated Stored XSS via AI Doc Summarizer Prompt Injection
- CVE-2026-113709 Argo CD: A Kustomize Helm config home can run commands in the repo-server
- CVE-2026-113708 Argo CD: A Kustomize remote ref can run commands in the repo-server
- CVE-2026-113707 a2aproject a2a-rs inmemory.rs update race condition
- CVE-2026-113706 a2aproject a2a-rs inmemory.rs information disclosure
- CVE-2026-113705 a2aproject a2a-rs error.rs information exposure
- CVE-2026-113704 a2aproject a2a-rs Push Notification push_notification_sender.rs HttpPushSender server-side request forgery
- CVE-2026-113703 SuggestArr before 3.0.0 Authentication Bypass via X-Forwarded-For Spoofing
- CVE-2026-11370 WP Meta SEO <= 4.5.18 - Authenticated (Contributor+) Server-Side Request Forgery via 'new_link' Parameter
- CVE-2026-1137 UTT 进取 520W formWebAuthGlobalConfig strcpy buffer overflow
- CVE-2026-113697 Reflected Cross-Site Scripting in BMC Helix Operations Management
- CVE-2026-113696 Improper Authorization in BMC ITSM SmartIT Change Approvals
- CVE-2026-113695 Reflected Cross-Site Scripting in BMC ITSM SmartIT
- CVE-2026-113694 Improper Authorization in BMC ITSM SmartIT Attachments
- CVE-2026-113693 System Account Credential Disclosure in BMC ITSM
- CVE-2026-113692 Path Traversal in BMC ITSM
- CVE-2026-113691 Stored Cross-Site Scripting in BMC ITSM Knowledge Articles
- CVE-2026-113690 Stored Cross-Site Scripting in BMC ITSM Attachments
- CVE-2026-11369 IDOR in Comment API Allows Cross-Process Comment Read and Write
- CVE-2026-113689 Stored Cross-Site Scripting in BMC ITSM Work Notes
- CVE-2026-113688 Server-Side Request Forgery in BMC ITSM SmartIT
- CVE-2026-113683 VPL for Moodle before 5.0.0 Reflected XSS via similarity/diff.php filename
- CVE-2026-113682 Networknt light-4j 2.1.5 before 2.4.0 Authentication Bypass via Empty LDAP Password
- CVE-2026-113681 Integer overflow in OpenImageIO
- CVE-2026-113680 HarfBuzz 8.0.0 through 14.6.0 WebAssembly Shaper NULL Pointer Dereference DoS
- CVE-2026-11368 Use-after-free in Bluetooth host ATT TX completion on disconnect mid-transfer
- CVE-2026-113679 HarfBuzz 8.0.0 through 14.6.0 Out-of-Bounds Write via WebAssembly font_glyph_to_string
- CVE-2026-113678 Froxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic Cron
- CVE-2026-113677 Froxlor 0.10.0 before 2.3.15 Missing Authorization via SubDomains.delete API
- CVE-2026-113676 Froxlor 0.10.0 before 2.3.15 Authorization Bypass via Admins.get API
- CVE-2026-113674 GeoDirectory < 2.8.194 - Unauthenticated Guest-Submitted Listing Modification
- CVE-2026-113673 GeoDirectory < 2.8.194 - Admin+ RCE via DB Text Export
- CVE-2026-113672 Argo CD: A Jsonnet import can read files from the repo-server
- CVE-2026-113671 ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF
- CVE-2026-11367 PixMagix <= 1.7.2 - Authenticated (Author+) Path Traversal in 'layers[].id' Parameter
- CVE-2026-113669 ApostropheCMS: Cross-domain session token in URL confers session takeover
- CVE-2026-113668 ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)
- CVE-2026-113667 ApostropheCMS: CAPTCHA response token not URL-encoded
- CVE-2026-113666 ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service
- CVE-2026-113665 ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints
- CVE-2026-113664 ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test
- CVE-2026-113662 ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document
- CVE-2026-113661 ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs
- CVE-2026-113660 ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers
- CVE-2026-11366 MonsterInsights < 11.1.0 - Unauthenticated Measurement Protocol Secret Update via Empty-Key HMAC Bypass
- CVE-2026-113659 ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users
- CVE-2026-113658 ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory
- CVE-2026-113657 ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)
- CVE-2026-113656 ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS
- CVE-2026-113655 ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization
- CVE-2026-113654 ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render
- CVE-2026-113653 ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public)
- CVE-2026-113652 ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)
- CVE-2026-113651 ApostropheCMS: Path traversal in uploadfs
- CVE-2026-113650 ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)
- CVE-2026-113649 ApostropheCMS: Import API bypasses publication roles for protected content
- CVE-2026-113648 ApostropheCMS: Missing Authentication in `cleanExport` Route
- CVE-2026-113644 iofogctl command injection via Controller provisioning response
- CVE-2026-113643 EspoCRM PDF Rendering Pipeline ImageSourceProvider.php get authorization
- CVE-2026-11364 Missing authorization in Product Specifications for Woocommerce
- CVE-2026-11363 Ninja Forms <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection via Form Import
- CVE-2026-113620 Eclipse ioFog operator WebSocket accepts an unverified JWT
- CVE-2026-11362 DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tags
- CVE-2026-113619 Eclipse ioFog renders request templates before authentication
- CVE-2026-113617 Automated Import Products to Cart < 1.0.4 - Subscriber+ Arbitrary File Read and Deletion via Path Traversal
- CVE-2026-113616 LogixFast Auth < 1.0.4 - Unauthenticated Account Takeover via Password Reset
- CVE-2026-113613 FlexGet before 3.20.7 Path Traversal (Zip Slip) via decompress plugin
- CVE-2026-113612 SparkyFitness before 0.17.0 Missing Authorization via food-variants DELETE Endpoint
- CVE-2026-113611 Outline before 1.8.0 Information Disclosure via Orphaned Webhook Subscriptions
- CVE-2026-113610 Xen Orchestra before 6.9.0 Authorization Bypass via user.set API
- CVE-2026-11361 Formidable Forms < 6.32.1 - Unauthenticated Payment Bypass via PayPal APPROVAL_PENDING Subscription Status
- CVE-2026-113609 Bandisoft Bandizip before 7.47 Mark-of-the-Web Bypass for PowerShell Scripts
- CVE-2026-113608 Configurable Reports block for Moodle before 5.3.1 SQL Injection via filter_var
- CVE-2026-113607 Configurable Reports block for Moodle before 5.3.0 Authorization Bypass via get_report_data
- CVE-2026-113606 Stirling-PDF 3.0.0 through 3.2.0 Authorization Bypass via Processing Folders
- CVE-2026-113605 Stirling-PDF 2.13.2 through 3.2.0 H2 SQL Denylist Bypass via import-database
- CVE-2026-113604 Ghidra 10.2 through 12.1.4 Denial of Service via ELF Loader Extended Header Counts
- CVE-2026-113603 x402 @x402/extensions 2.3.1 through 2.28.0 SIWX Payment Bypass via PaymentPayload.resource
- CVE-2026-113602 json-smart through 2.6.0 Strict-Mode Validation Bypass via 0x1A Character
- CVE-2026-113601 Memos before 0.27.0 Missing Authorization via ActivityService ListActivities/GetActivity
- CVE-2026-113600 Fat Free CRM before 0.26.0 IDOR via CommentsController update and destroy