Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 957 of 1013.
- CVE-2026-10740 Excessive memory allocation in s2n-quic
- CVE-2026-1074 WP App Bar <= 1.5 - Unauthenticated Stored Cross-Site Scripting via 'app-bar-features' Parameter
- CVE-2026-107399 Mechanize sends credential headers to another origin after a meta refresh
- CVE-2026-107397 Indico: Cross-Site-Scripting in minutes editor
- CVE-2026-107396 Indico: Cross-Site-Scripting in link fields
- CVE-2026-107395 Indico: Missing access check in legacy session export API
- CVE-2026-107394 Indico: Incomplete Server-Side Request Forgery (SSRF) check
- CVE-2026-107393 FreeScout: Stored HTML Injection in Administrator Alert Emails via Spoofed CF-Connecting-IP Header
- CVE-2026-107392 music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of CVE-2026-32256)
- CVE-2026-107391 music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master
- CVE-2026-107390 music-metadata: MP4 parser allows memory exhaustion via oversized extended atom length
- CVE-2026-10739 Cato Networks SDP Client for Windows is vulnerable to Local Privilege Escalation
- CVE-2026-107389 music-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abort
- CVE-2026-107388 music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS
- CVE-2026-107387 music-metadata: Uncontrolled memory allocation in APEv2 parser
- CVE-2026-107386 amqp091-go: Pre-negotiation frame limit is not enforced to 4KB
- CVE-2026-107385 MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES
- CVE-2026-107384 MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)
- CVE-2026-107383 MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters
- CVE-2026-107382 MariaDB Connector/Node.js: Uncaught exception crashes the client during ed25519 authentication with zero-configuration TLS
- CVE-2026-107381 svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences
- CVE-2026-107380 enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision
- CVE-2026-10738 Cross-site scripting in jQuery Hover Footnotes
- CVE-2026-107379 enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash
- CVE-2026-107378 CairoSVG: Quadratic-time DoS parsing a crafted SVG <path>
- CVE-2026-107377 datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory
- CVE-2026-107376 webonyx graphql-php: Unbounded recursion in parser causes stack overflow on crafted nested input
- CVE-2026-107375 JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort
- CVE-2026-107373 ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument.
- CVE-2026-107371 Missing Verification of auth_time Claim in auth0.js
- CVE-2026-107370 Improper Request Handling for Active Directory Logins in auth0-lock
- CVE-2026-10737 Missing authorization in SP Project & Document Manager
- CVE-2026-107369 Improper Validation of Post-Login Redirect URL in nextjs-auth0
- CVE-2026-107366 Langflow OSS Authorization Bypass Through User-Controlled Key
- CVE-2026-107363 Missing authorization in Zaqar
- CVE-2026-107362 Server-Side Request Forgery in Malcolm
- CVE-2026-107361 Authentication Bypass Using an Alternate Path or Channel in Malcolm
- CVE-2026-10736 Tutor LMS <= 3.9.11 - Authenticated (Administrator+) SQL Injection via 'data' Parameter
- CVE-2026-107353 traverse: set() can write to built-in prototypes via an untrusted path
- CVE-2026-107352 Missing authorization checks in Amazon Athena engine version 3 request handling
- CVE-2026-107350 Authentication bypass via second StartupMessage during SCRAM authentication in PgBouncer
- CVE-2026-10735 ShapedPlugin Multiple Pro Plugins - Backdoor via Compromised Vendor Update Server
- CVE-2026-107349 Infinite loop on empty option name in startup options parameter in PgBouncer
- CVE-2026-107348 Integer overflow causes an infinite loop in message buffer growth in PgBouncer
- CVE-2026-107347 Nomad dispatch payload writes can escape the allocation directory through symlinks
- CVE-2026-10734 Infility Global <= 2.15.21 - Unauthenticated Stored Cross-Site Scripting via /cf7_record Log Endpoint
- CVE-2026-107337 Cross-Site Request Forgery in Malcolm
- CVE-2026-107336 Authentication Bypass by Spoofing in Malcolm
- CVE-2026-107335 Improper Handling of Highly Compressed Data in Malcolm
- CVE-2026-107334 Incorrect Authorization in Malcolm
- CVE-2026-107333 Incorrect Authorization in Malcolm
- CVE-2026-107332 Insecure Default File Permissions on Cached Credentials in AWS Toolkit for Visual Studio Code
- CVE-2026-10733 Improper Restriction of Rendered UI Layers or Frames in GitLab
- CVE-2026-107329 Langflow OSS is affected by multiple vulnerabilities
- CVE-2026-107328 Langflow OSS is affected by multiple vulnerabilities
- CVE-2026-107327 Langflow OSS is affected by multiple vulnerabilities
- CVE-2026-107326 Langflow OSS is affected by multiple vulnerabilities
- CVE-2026-107325 Application denial of service via missing BSON array length validation in MongoDB Go Driver
- CVE-2026-107324 Application denial of service via integer overflow in BSON value-length validation in MongoDB Go Driver
- CVE-2026-107323 Gallery PhotoBlocks 1.3.5 - Contributor+ Stored XSS
- CVE-2026-107322 OS command injection in Amazon Agent Plugins for AWS databases-on-aws
- CVE-2026-107321 W3 Total Cache < 2.10.6 - Author+ Path Traversal via CDN Media Library Import
- CVE-2026-107320 GamiPress 7.9.5 - 8.0.5 - Unauthenticated Private Activity Log Disclosure
- CVE-2026-10732 decompress: Arbitrary File Write via Archive Extraction (Zip Slip)
- CVE-2026-107319 GamiPress < 8.0.6 - Subscriber+ Activity Log Disclosure
- CVE-2026-107318 @fastify/reply-from vulnerable to improper certificate validation in built-in HTTPS transports
- CVE-2026-107315 pgjdbc pads a value shorter than its declared length with bytes of earlier statements (rather than zeros)
- CVE-2026-107314 pgjdbc does not enforce requireAuth when the value excludes every authentication method
- CVE-2026-107313 pgjdbc stores bytes of earlier messages in place of a large value on GSS-encrypted connections
- CVE-2026-10731 SQL injection in Nemon products
- CVE-2026-107305 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-107303 JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin Blob
- CVE-2026-107302 msgpack5: Truncated map32 headers throw an unexpected error
- CVE-2026-107301 msgpack5: Partial options disable prototype protection
- CVE-2026-107300 msgpack5: Many buffered values can exhaust the streaming decoder stack
- CVE-2026-1073 Purchase Button For Affiliate Link <= 1.0.2 - Cross-Site Request Forgery to Settings Update
- CVE-2026-107299 msgpack5: Reserved byte can cause unbounded stream buffering
- CVE-2026-107298 msgpack5: Deeply nested input can exhaust the decoder stack
- CVE-2026-107297 msgpack5: Quadratic parsing in the streaming decoder
- CVE-2026-107296 msgpack5: Decoding negative int64 values mutates the input buffer
- CVE-2026-107295 Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint
- CVE-2026-107294 Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl
- CVE-2026-107293 Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False`
- CVE-2026-107292 Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header
- CVE-2026-107291 Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`
- CVE-2026-107290 Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`
- CVE-2026-10729 HTML injection in the notification email for "Slow Redirect" and "Cloned Website" Canarytokens
- CVE-2026-107289 Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers
- CVE-2026-107288 Pydantic AI: web_fetch_tool blocked_domains bypass via a hostname the resolver normalizes differently
- CVE-2026-107287 Pydantic AI: Excessive resource use when local web fetching converts nested HTML
- CVE-2026-107286 Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early
- CVE-2026-107285 AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel
- CVE-2026-107284 AsyncHttpClient: WebSocket handshake continues after a failed Sec-WebSocket-Accept check
- CVE-2026-107283 AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source
- CVE-2026-107282 AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host
- CVE-2026-107281 Auth bypass in async-http-client
- CVE-2026-107280 AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk
- CVE-2026-107279 AsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-int
- CVE-2026-107278 MISP Object Sync Drops Objects and Attributes When Description Is Empty
- CVE-2026-107276 MISP Email OTP Race Condition Allows One-Time Password to Be Consumed by Multiple Concurrent Requests