Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 961 of 1013.
- CVE-2026-106557 Backstage: Improper input validation in TechDocs Markdown extension configuration
- CVE-2026-106556 Backstage: Configuration bypass in TechDocs mkdocs.yml sanitization
- CVE-2026-106555 Other in OpenSSH
- CVE-2026-106553 Information disclosure in OpenSSH
- CVE-2026-106552 Path traversal in OpenSSH
- CVE-2026-106550 CVE-2026-106550
- CVE-2026-10655 Use-after-free race in SNTP async client when closing the socket while the socket service is still polling it
- CVE-2026-106547 HDF5 heap buffer overflow in H5VM_array_fill via crafted fill-value metadata
- CVE-2026-10654 RFCOMM session-disconnect race leaks session/L2CAP and denies further RFCOMM service in Zephyr Bluetooth Classic
- CVE-2026-10653 Non-atomic `net_buf` reference counts cause double-free / free-list corruption under concurrent unref
- CVE-2026-10652 Out-of-bounds read in Zephyr DNS resolver TXT/SRV record parsing (unvalidated `rdlength`)
- CVE-2026-106513 MISP: Site-Admin Can Repoint Redis Workers to Attacker-Controlled Server via UI/API Configuration Change
- CVE-2026-106512 MISP sachertortephp - CakeResponse::download() HTTP Response Splitting via Unsanitized Filename Enables Stored XSS
- CVE-2026-106511 CVE-2026-106511
- CVE-2026-106510 Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml
- CVE-2026-10651 Out-of-bounds read in Bluetooth Classic SDP attribute parsing (`bt_sdp_parse_attribute`)
- CVE-2026-106509 Backstage: Improper validation of MkDocs theme configuration in TechDocs
- CVE-2026-106508 Backstage: Potential file exposure through local TechDocs publisher
- CVE-2026-106507 Backstage: TechDocs arbitrary file read via mkdocs snippets
- CVE-2026-106506 Backstage: Improper input validation in scaffolder task list ordering
- CVE-2026-106505 Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend
- CVE-2026-106504 Backstage: Sensitive information exposure in scaffolder task logs
- CVE-2026-106503 Backstage: Scaffolder action input authorization bypass
- CVE-2026-106502 Backstage: Sensitive information may be exposed in Scaffolder task failure events
- CVE-2026-106501 Backstage: Sensitive information exposure in Scaffolder
- CVE-2026-106500 Backstage: Improper task state validation in Scaffolder backend
- CVE-2026-10650 warmcat libwebsockets SSH Protocol sshd.c lws_ssh_parse_plaintext resource consumption
- CVE-2026-1065 Form Maker by 10Web <= 1.15.35 - Unauthenticated Stored Cross-Site Scripting via SVG file
- CVE-2026-106499 Backstage: Secret-derived values may be exposed in scaffolder task logs
- CVE-2026-106498 Backstage: Improper URL validation in catalog entity placeholder resolution
- CVE-2026-106497 Backstage: Inconsistent catalog property permission evaluation
- CVE-2026-106496 Backstage: Inconsistent enforcement of allowed location types during catalog processing
- CVE-2026-106495 Backstage: Improper access control in backend action invocation
- CVE-2026-106494 Backstage: Improper input validation in cloud storage URL readers
- CVE-2026-106493 Backstage: Cloud storage catalog locations may cross configured storage boundaries
- CVE-2026-106492 Backstage: Improper preservation of access restrictions during service credential delegation
- CVE-2026-106491 Backstage: Improper input validation in proxy-backend
- CVE-2026-106490 Backstage: Improper input validation in TechDocs static content requests
- CVE-2026-10649 Pacemaker: pacemaker: denial of service via integer overflow in remote message decompression
- CVE-2026-106489 Backstage: Improper authorization enforcement for TechDocs static content
- CVE-2026-106488 Backstage: Improper authentication in the OIDC provider
- CVE-2026-106487 Backstage: Unsupported catalog cluster authentication mode in kubernetes backend
- CVE-2026-106486 Backstage: Improper filesystem validation in Bitbucket pull-request scaffolder actions
- CVE-2026-106484 Security feature bypass in chrome-devtools-mcp
- CVE-2026-10648 NULL-pointer dereference in MCUmgr serial/console SMP transport on buffer-pool exhaustion
- CVE-2026-106471 Candlepin: candlepin: broken object-level authorization via verifyauthorizationfilter multi-@verify hasaccess latching
- CVE-2026-106470 WP Data Access < 5.5.88 - Subscriber+ SSRF
- CVE-2026-10647 Deadlock denial of service in USB CDC-NCM device class on TX enqueue failure
- CVE-2026-106469 Gutenverse Form < 3.0.11 - Contributor+ Stored XSS via SVG Icon
- CVE-2026-106465 Security feature bypass in NetX Duo
- CVE-2026-106464 Memory corruption in NetX Duo
- CVE-2026-106463 Backstage: Improper authorization in GitLab organizational user ingestion
- CVE-2026-106462 Backstage: Scaffolder credential handling may allow unintended GitHub authentication fallback
- CVE-2026-106461 Backstage: Incorrect authorization in scaffolder task listing
- CVE-2026-106460 Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization
- CVE-2026-10646 Use-after-return in `zsock_getaddrinfo()` when a timed-out DNS query is retried without cancellation
- CVE-2026-106459 Backstage: Improper input validation in Sentry scaffolder actions
- CVE-2026-106458 Backstage: Inconsistent repository filtering in Bitbucket Server catalog event updates
- CVE-2026-106457 Backstage: Insufficient audience validation in the Cloudflare Access auth provider
- CVE-2026-106456 Backstage: Inconsistent credential enforcement for overlapping proxy routes
- CVE-2026-106455 Backstage: Improper validation of MkDocs plugin configuration in TechDocs
- CVE-2026-106454 Twisted: IMAP wildcardToRegexp() ReDoS
- CVE-2026-106453 yawkat LZ4 Java: LZ4DecompressorWithLength allocates the unvalidated size from the 4-byte length header, so a 5-byte input triggers a 1 GiB allocation and OutOfMemoryError
- CVE-2026-106452 yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream header
- CVE-2026-106451 yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user
- CVE-2026-106450 yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs
- CVE-2026-10645 Out-of-bounds read in Zephyr ext2 directory entry traversal from a crafted filesystem image
- CVE-2026-106449 yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError
- CVE-2026-106448 StableLib: Prototype poisoning via `__proto__` map keys in CBOR decoding
- CVE-2026-106447 StableLib: Stack exhaustion denial of service via deeply nested CBOR arrays, maps, or tags
- CVE-2026-106446 Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)
- CVE-2026-106445 Handlebars: JavaScript Injection via Own Property Check Bypass
- CVE-2026-106444 Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates
- CVE-2026-106443 WeasyPrint: EPS images reach the Ghostscript interpreter resulting in RCE
- CVE-2026-106442 Hydra instantiate target blacklist bypasses permit code execution
- CVE-2026-106441 Hydra logging configuration permits unsafe callable resolution
- CVE-2026-106440 Hydra: Optuna custom_search_space can resolve and execute untrusted callables via get_method
- CVE-2026-10644 Out-of-bounds write in Microchip SERCOM-G1 (PIC32CM-JH) async UART RX with 1-byte buffer
- CVE-2026-106439 Hydra: Mutable instantiate policy sets allow target blocklist bypass
- CVE-2026-106438 Silent Decimal128 value corruption via incorrect exactness check in MongoDB C Driver
- CVE-2026-106437 Out-of-bounds read and write via undersized BSON buffer reservation in MongoDB C Driver
- CVE-2026-106436 Application denial of service and data truncation via unchecked BSON append failures in MongoDB PHP Driver
- CVE-2026-106435 Application denial of service via out-of-bounds read in BSON Regex decoding in MongoDB Python Driver
- CVE-2026-106434 Unrecognized payload acceptance in explicit decryption in MongoDB libmongocrypt
- CVE-2026-106433 Heap corruption via duplicate masterKey fields in MongoDB libmongocrypt
- CVE-2026-106432 Heap buffer overflow via 32-bit string-length truncation in MongoDB PHP Driver
- CVE-2026-106431 One-byte heap buffer overflow in BSON bulk document writer in MongoDB C Driver
- CVE-2026-106430 Query and rename target confusion via embedded NUL truncation in MongoDB C++ Driver
- CVE-2026-10643 Memory corruption in zephyr
- CVE-2026-106429 Application denial of service via malformed KMS endpoint in MongoDB libmongocrypt
- CVE-2026-106428 Out-of-bounds read in SCRAM response parsing in MongoDB C Driver
- CVE-2026-106427 Security feature bypass in Chrome
- CVE-2026-106426 Race condition in Chrome
- CVE-2026-106425 Missing authorization in Chrome
- CVE-2026-106424 Information disclosure in Chrome
- CVE-2026-106423 Use after free in Chrome
- CVE-2026-106422 Security feature bypass in Chrome
- CVE-2026-106421 Use after free in Chrome
- CVE-2026-106420 Other in Chrome
- CVE-2026-10642 Unbounded TX busy-loop DoS in Zephyr PL011 UART driver under CTS hardware flow control