Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 967 of 1013.
- CVE-2026-105844 Payload: Prototype pollution in Payload Import Export plugin
- CVE-2026-105842 lrzsz before 0.13.0 Heap Buffer Overflow via lrz procheader() Pathname
- CVE-2026-105841 lrzsz before 0.13.0 OS Command Injection via lrz Pipe Mode
- CVE-2026-105840 lrzsz before 0.13.0 Path Traversal via lrz Restricted Mode checkpath()
- CVE-2026-10584 HTTPS Fallback to HTTP in Graph Explorer
- CVE-2026-105839 libmikmod before 3.3.14 Heap Buffer Overflow via OKT Loader OKT_doPBOD
- CVE-2026-105838 libmikmod before 3.3.14 Heap Out-of-Bounds Read via IT Module Loader
- CVE-2026-105837 libmikmod before 3.3.14 Heap Buffer Overflow via DSM Loader Integer Overflow
- CVE-2026-105836 QloApps through 1.7.0 Authorization Bypass via ajaxProcessBulkUpdateRooms
- CVE-2026-105835 PLANKA 2.2.0 through 2.2.1 TOTP Brute Force via verify-totp Endpoint
- CVE-2026-105834 Rundeck before 6.2.0 Arbitrary File Read via File Resource Model Source
- CVE-2026-105833 EspoCRM before 10.0.5 IDOR via PersonalAccount Service Exposes IMAP Passwords
- CVE-2026-105832 EspoCRM before 10.0.6 Two-Factor Authentication Bypass on Unauthenticated Routes
- CVE-2026-105831 EspoCRM before 10.0.6 Unauthenticated Stored HTML Injection via Lead Capture Form
- CVE-2026-105830 league/commonmark 2.0.0 before 2.10.2 Quadratic DoS via TableStartParser
- CVE-2026-10583 nextlevelbuilder GoClaw TTS Configuration Endpoint tts_config.go import server-side request forgery
- CVE-2026-105829 League CommonMark 1.3.0 before 2.10.2 Stored XSS via DisallowedRawHtml Bypass
- CVE-2026-105828 Parse Server 9.0.0 before 9.10.1-alpha.12 Class Name Disclosure via GraphQL Errors
- CVE-2026-105820 Vault ACL Policy Cache Vulnerable to Cross-Namespace Policy Resolution
- CVE-2026-10582 Hugo 0.91.0 through 0.165.0 Server-Side Request Forgery via security.http.urls Lacking Destination Address Validation
- CVE-2026-105818 Vault PKI ACME Issues Certificate With Unvalidated SANs
- CVE-2026-105816 Vault Vulnerable to Arbitrary Code Execution via Plugin Catalog Entries Restored From Raft Snapshots
- CVE-2026-105815 Credential Material Exposure Leading to Unauthorized Streamed Media-Session Access in TP-Link Tapo C210
- CVE-2026-105814 Order-Dependent Authentication Bypass in the DS JSON API in TP-Link Tapo C210
- CVE-2026-105812 Code injection in bedrock-agentcore-starter-toolkit
- CVE-2026-105811 Authorization bypass through a user-controlled key in the Amazon Q Business Lambda hook sample in QnABot on AWS
- CVE-2026-105810 Authenticated Local Stack Overflow in TP-Link Tapo C320WS
- CVE-2026-10581 DedeCMS download.php base64_decode server-side request forgery
- CVE-2026-105809 SourceCodester Simple Student Information System Profile Field register.php cross site scripting
- CVE-2026-105808 SourceCodester Simple Student Information System searchresults.php clean cross site scripting
- CVE-2026-105807 SourceCodester Simple Student Information System searchquery.php sql injection
- CVE-2026-105806 Payload: Improper access control for MCP API keys
- CVE-2026-105805 Payload: Sort queries could expose protected field information
- CVE-2026-105804 Payload: Password hashes use insufficient PBKDF2 iterations
- CVE-2026-105801 openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation
- CVE-2026-105800 i18next-http-backend incomplete URL validation permits SSRF
- CVE-2026-10580 Auth bypass in Hippoo Mobile App for WooCommerce
- CVE-2026-1058 Form Maker by 10Web <= 1.15.35 - Unauthenticated Stored Cross-Site Scripting via Hidden Field
- CVE-2026-105799 LangChain: RediSearch Filter Injection via Unescaped Tag/Text Values
- CVE-2026-105798 SimpleChat: Stored XSS via group document filename in inline onclick handler
- CVE-2026-105797 Command injection in simplechat
- CVE-2026-105796 Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP generators
- CVE-2026-105795 Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifests
- CVE-2026-105794 MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL
- CVE-2026-105793 Microsoft UFO: Authenticated Android shell command injection in Mobile MCP `press_key`
- CVE-2026-105792 Microsoft UFO: Authenticated task-result request can deadlock UFO server session manager
- CVE-2026-105791 Microsoft UFO: Arbitrary code execution in `run_shell` via `explorer.exe` argument injection
- CVE-2026-105790 Microsoft UFO: Authenticated Galaxy device registration can bypass WebSocket SSRF IP pinning via redirects
- CVE-2026-10579 Picketlink-federation: auth bypass in picketlink saml unsolicited-response
- CVE-2026-105789 Microsoft UFO: Arbitrary file write in the Linux MCP `execute_command` tool
- CVE-2026-105788 Microsoft UFO: Authenticated Android shell command injection in Mobile MCP type_text and launch_app
- CVE-2026-105786 Joplin: Unauthenticated account takeover via an attacker-chosen application-authorisation identifier
- CVE-2026-105785 Joplin Server password reset accepts tokens issued for unrelated purposes
- CVE-2026-105784 Joplin whiteboard card rendering allows CSS injection into application chrome
- CVE-2026-105783 Joplin Web Clipper pairing allows cross-origin theft of a permanent API token
- CVE-2026-105782 Scrapy: Arbitrary Module Import via Referrer-Policy Header in RefererMiddleware
- CVE-2026-105781 SQL injection in Adobe Campaign Classic
- CVE-2026-105780 Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)
- CVE-2026-105779 SQL injection in Adobe Campaign Classic
- CVE-2026-105778 Tenda AC5 Wifi setWifi stack-based overflow
- CVE-2026-105777 Insertion of Sensitive Information Into Sent Data in GitLab
- CVE-2026-105776 bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL admin_transaction.php sql injection
- CVE-2026-105775 vllm-project vLLM Completions Request mamba_mixer2.py conv_ssm_forward out-of-bounds
- CVE-2026-105773 Canimaan Software ClamXAV local privilege escalation
- CVE-2026-105772 Path traversal in ADK TypeScript (@google/adk)
- CVE-2026-10577 Rockwell Automation 1715 Redundant IO – Access Control Vulnerability
- CVE-2026-105768 apko /etc/passwd and /etc/group UID/GID truncation writes package-supplied entries as root
- CVE-2026-105767 Chainguard Academy (edu) integrate-platform-docs composite action interpolates inputs into shell commands
- CVE-2026-105766 Chainguard Academy (edu) Nginx directory redirect downgrades HTTPS requests to HTTP
- CVE-2026-105765 Consul vulnerable to an authorization bypass in the agent's service mesh leaf certificate API
- CVE-2026-105764 Immich: Authenticated SVG upload reaches ImageMagick coders and enables RCE
- CVE-2026-105763 Twenty: Plaintext IMAP/SMTP/CalDAV password disclosure to any workspace member via /metadata GraphQL
- CVE-2026-105762 Dify: Unauthenticated Server-Side Request Forgery in /console/api/remote-files/upload endpoint
- CVE-2026-105761 Dify: IDOR in AppMCPServer PUT Endpoint Allows Modification of Other Apps' MCP Servers
- CVE-2026-105760 vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion
- CVE-2026-105759 Denial of service in vllm
- CVE-2026-105758 vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max_frames, which the num_frames ceiling does not reach
- CVE-2026-105757 vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites)
- CVE-2026-105756 vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service
- CVE-2026-105755 vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on `/score` and `/rerank`
- CVE-2026-105754 vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features
- CVE-2026-105753 vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core
- CVE-2026-105752 vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle
- CVE-2026-105751 Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend
- CVE-2026-105750 Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode
- CVE-2026-10575 IBM MQ queue manager is vulnerable to remote code execution
- CVE-2026-105749 Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion
- CVE-2026-105748 Docling: Crafted DoclingDocument JSON embeds local image files into converted output
- CVE-2026-105747 Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection)
- CVE-2026-105746 Docling: KServe v2 OCR engine does not enforce enable_remote_services
- CVE-2026-105745 Docling: Plugin entry points are imported before the allow_external_plugins check
- CVE-2026-105744 Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine
- CVE-2026-105743 Docling has SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode)
- CVE-2026-105742 Docling: Configured HTTP headers sent to every remote image host named by a document
- CVE-2026-105741 Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write
- CVE-2026-105740 Langflow: Authenticated RCE via MCP Stdio transport allows any user to execute arbitrary OS commands on the server
- CVE-2026-10574 IBM MQ Buffer Overflow
- CVE-2026-105733 Windows Hyper-V Remote Code Execution Vulnerability
- CVE-2026-105732 SysInternals Elevation of Privilege Vulnerability
- CVE-2026-105731 Microsoft Office Graphics Component Information Disclosure Vulnerability