2026 · High

High-severity vulnerabilities disclosed in 2026

High-rated CVEs published in 2026, with SEC.co remediation and prioritization guidance.

4140 published vulnerabilities · page 30 of 42

• CVE-2026-45788HIGH 7.5

  Discourse, a popular open-source discussion and community platform, contains a vulnerability in its secure uploads feature that could allow unauthorized access to sensitive files. When the secure_uploads setting is enabled—which is meant to protect uploaded content from public viewing—an attacker who discovers the hidden URL of a secured upload can retrieve it through Discourse's pull_hotlinked_images function, bypassing access controls. This is a confidentiality issue affecting instances running older versions of Discourse.

• CVE-2026-46110HIGH 7.5

  CVE-2026-46110 is a NULL pointer dereference vulnerability in the Linux kernel's stmmac network driver that can crash a system when memory becomes exhausted during packet reception. The driver manages a circular ring of descriptors to coordinate DMA transfers between the CPU and network hardware. When the driver runs out of memory to allocate new receive buffers, it can incorrectly process already-used descriptors as if they were fresh, leading to a kernel panic. This occurs because the driver doesn't properly distinguish between descriptors that are waiting to be refilled versus those that have already been processed.

• CVE-2026-46114HIGH 7.5

  A memory leak vulnerability exists in the Linux kernel's RDMA over Converged Ethernet (RoCE) driver. An attacker on the network can send specially crafted RDMA ATOMIC_WRITE requests with zero-length payloads to trigger the responder into reading uninitialized kernel memory and inadvertently leaking it back to the attacker. The vulnerability specifically affects how the kernel validates packet lengths before dereferencing memory, allowing 8 bytes of sensitive kernel data (including kernel strings and pointer information) to be extracted per malicious probe.

• CVE-2026-46124HIGH 7.5

  A vulnerability in the Linux kernel's ISO 9660 filesystem (isofs) allows an attacker to read arbitrary blocks from a storage device when the filesystem is exported over NFS. An authenticated attacker can craft a malicious NFS file handle that causes the kernel to interpret unrelated data on the underlying block device as if it were part of the ISO filesystem, leaking that data to the NFS client. While this does not cause memory corruption or system crashes, it exposes sensitive information from adjacent partitions or disk regions. The issue affects systems that export ISO images (typically loop-mounted) over NFS, which is a narrower deployment scenario but still represents a data confidentiality risk.

• CVE-2026-46133HIGH 7.5

  A flaw in the Linux kernel's RDMA/rxe (Soft RoCE) driver allows an unauthenticated attacker to crash the system by sending a specially crafted UDP packet with an invalid opcode. The vulnerability exists in how the driver validates incoming packets before processing checksums. When a packet uses an undefined opcode value, the driver fails to properly validate packet length, leading to an out-of-bounds memory read that triggers a kernel panic. An attacker needs only network access to the RDMA port and can exploit this without authentication, credentials, or any prior connection setup.

• CVE-2026-46177HIGH 7.5

  A flaw in the Linux kernel's IPMI (Intelligent Platform Management Interface) driver can cause a system to become unresponsive or hang indefinitely. The vulnerability occurs when a Baseboard Management Controller (BMC) continuously reports that it has events or messages to deliver without ever indicating it is finished. The driver lacks safeguards to prevent endless polling loops, allowing a misbehaving BMC—whether due to firmware bugs or hardware issues—to starve system resources and degrade performance or availability. The fix introduces fetch limits and scheduling improvements to prevent the driver from getting stuck in these loops.

• CVE-2026-46265HIGH 7.5

  CVE-2026-46265 is a Linux kernel workqueue memory-reclaim configuration bug in the RDMA/hns (Huawei RoCE) driver. When the driver resets during RPC over RDMA operations, a workqueue used for interrupt handling lacks the WQ_MEM_RECLAIM flag, triggering kernel warnings. While the issue itself does not directly compromise confidentiality or integrity, it can cause availability disruptions by crashing the kernel or forcing emergency resets during high-stress memory conditions. This primarily affects systems running Sun RPC over RDMA on Huawei RoCE hardware.

• CVE-2026-46304HIGH 7.5

  A deadlock vulnerability exists in the Linux kernel's NVMe target (nvmet) subsystem. During controller teardown, the code attempts to flush a work item on the same work queue that is currently executing, creating a recursive locking condition. This occurs when releasing NVMe-over-TCP queue resources triggers final controller cleanup. The issue manifests as a kernel warning and can cause the affected work queue to hang, disrupting NVMe target operations on systems hosting virtual NVMe devices or NVMe-over-Fabrics services.

• CVE-2026-46306HIGH 7.5

  A flaw in the Linux kernel's network flow dissector can crash systems when they receive malformed PPPoE (Point-to-Point Protocol over Ethernet) frames with Protocol Field Compression enabled. The kernel incorrectly attempts to process these frames, causing memory alignment violations that trigger kernel exceptions on affected CPU architectures like MIPS. An attacker can send a specially crafted PPPoE packet to any ethernet interface with RPS (Receive Packet Steering) enabled—even if no active PPPoE session exists—to crash the system.

• CVE-2026-46340HIGH 7.5

  Netty is a widely-used Java framework for building networked applications. A flaw in the SCTP (Stream Control Transmission Protocol) transport component allows a remote attacker to exhaust a server's memory by sending fragmented messages that never complete. Rather than consolidating fragments efficiently, the code creates an exponentially deeper chain of buffer wrappers for each new piece, and there's no limit on how many fragments or how many separate data streams an attacker can use. This lets someone crash or severely degrade a Netty-based SCTP server with relatively small amounts of traffic.

• CVE-2026-46373HIGH 7.5

  SQLFluff, a popular SQL linter and code formatter, contains a denial-of-service vulnerability in versions before 4.1.0. An attacker who can submit SQL queries to an application using SQLFluff's parser can craft a specially nested query to exhaust system resources, causing the application to become unresponsive or crash. This affects any deployment where untrusted users have the ability to lint arbitrary SQL code.

• CVE-2026-46374HIGH 7.5

  SQLFluff, a widely-used SQL linter and formatter, contains a denial-of-service vulnerability affecting versions prior to 4.2.0. An attacker who can submit SQL queries to an application using SQLFluff's parser can trigger resource exhaustion by crafting an exceptionally long query, causing the service to become unavailable. This risk is most acute in environments where untrusted users have direct access to linting functionality—such as shared development platforms, online SQL validators, or multi-tenant SaaS tools.

• CVE-2026-46384HIGH 7.5

  iskorotkov/avro is a Go library used to encode and decode Avro data format, a binary serialization standard. This vulnerability allows an attacker to crash applications using versions prior to 2.33.0 by sending specially crafted binary data over the network. The attack requires no authentication and can be triggered remotely. The flaw stems from how the decoder handles large numbers from untrusted input—on 32-bit systems, a mathematical trick causes boundary checks to fail silently, while on all systems, adding very large numbers can wrap around and cause the application to panic. An attacker cannot read sensitive data or modify data, but can reliably deny service to affected applications.

• CVE-2026-46385HIGH 7.5

  A vulnerability in the iskorotkov/avro Go library allows an attacker to crash applications processing Avro-encoded data. By sending a specially crafted message that declares an extremely large block of array or map elements (up to 9.2 quintillion), an attacker can force the decoder into a loop that consumes CPU resources indefinitely until the application runs out of memory or is forcibly terminated. The attack requires no authentication and can be triggered over the network with a single malicious payload.

• CVE-2026-46457HIGH 7.5

  Apache Camel's NATS component has a header-handling flaw that allows untrusted message publishers to inject fake control headers into Camel routes. When a NATS client sends a message to a topic that Camel is consuming, those headers—including Camel's own internal directives like CamelHttpUri or CamelFileName—are copied directly into the message flow without filtering. An attacker who can publish to that NATS topic can craft headers that hijack downstream behavior: redirecting HTTP calls, changing file paths, altering database queries, or worse. The vulnerability affects Camel 4.0.0 through 4.21.0 (with fixes in 4.14.8, 4.18.3, and 4.21.0). It requires NATS 2.2+ and is exploitable on out-of-the-box NATS servers that have no authentication.

• CVE-2026-46493HIGH 7.5

  HAX CMS, a platform for managing microsite universes across PHP and Node.js backends, contains a cryptographic weakness in how it generates password salts. Versions before 26.0.1 rely on PHP's `uniqid()` function, which produces predictable values unsuitable for security-sensitive operations. An attacker with network access can feasibly recover or forge password salts, enabling offline password cracking or account compromise. The vulnerability is network-accessible, requires no authentication, and does not depend on user interaction, making it a practical attack vector for hostile actors.

• CVE-2026-46520HIGH 7.5

  ImageMagick, a widely-used image editing library, contains a memory safety flaw that can crash or destabilize applications when processing multiple images of different sizes. The vulnerability exists in versions before 6.9.13-48 (legacy branch) and 7.1.2-23 (current branch). An attacker can trigger an out-of-bounds write by submitting specially crafted image files, leading to denial of service or potential code execution depending on system configuration and memory layout.

• CVE-2026-46522HIGH 7.5

  ImageMagick, a widely-used image processing library, contains a flaw in its MIFF file decoder that can be triggered by a specially crafted image file. When processed, the vulnerability causes the application to enter an infinite loop, consuming CPU resources until the process is manually stopped or times out. An attacker can exploit this remotely without authentication to degrade or disable image processing services. The vulnerability affects ImageMagick versions prior to 7.1.2.23 (for the 7.x branch) and 6.9.13-48 (for the 6.x branch).

• CVE-2026-46527HIGH 7.5

  cpp-httplib versions before 0.44.0 crash when a trusted proxy configuration is enabled and an attacker sends a specially crafted X-Forwarded-For header that contains no parseable IP addresses. The crash results from the library attempting to access an empty data structure without bounds checking, causing the application to terminate abnormally. This is a denial-of-service vulnerability affecting only deployments that have explicitly configured trusted proxies.

• CVE-2026-46541HIGH 7.5

  Nimiq, a Rust-based blockchain network implementation, contains a flaw in its distributed hash table (DHT) lookup mechanism that allows an attacker to poison the DHT retrieval process. When the first DHT record received fails verification (which an attacker can engineer), the system never initializes its result accumulator. This causes all subsequent legitimate records to be rejected as inconsistent, effectively blocking the node from retrieving valid network data. An unauthenticated attacker on the network can trigger this condition, degrading node functionality without requiring special privileges or user interaction.

• CVE-2026-46545HIGH 7.5

  Nimiq, a blockchain implementation using Rust, contains a vulnerability that allows remote attackers to crash nodes that are synchronizing state data from the network. This affects newly joining nodes and nodes recovering from downtime. The issue stems from improper handling of data chunks during state synchronization, enabling any peer on the network to send malicious input that triggers a denial-of-service condition. The vulnerability has been resolved in version 1.5.0.

• CVE-2026-46585HIGH 7.5

  Apache Camel's Lucene component contains a vulnerability that allows attackers to bypass intended query restrictions and access unauthorized data through HTTP requests. When a Camel route exposes Lucene search functionality via HTTP, an attacker can inject a malicious search query by setting specific HTTP headers, causing the application to execute searches against the full text index that should have been blocked or filtered. This affects Camel versions 4.0.0 through 4.20.x, with no authentication required if the HTTP endpoint is public. The risk ranges from unauthorized document disclosure to resource exhaustion through expensive queries.

• CVE-2026-46592HIGH 7.5

  Apache Camel's CXF component has a vulnerability that allows an attacker to trick the system into invoking unintended operations on a backend SOAP service. When a Camel route bridges an HTTP request directly to a SOAP backend, an attacker can inject HTTP headers that override which SOAP operation gets executed. This could mean replacing a safe read operation with a destructive write or delete. The vulnerability exists because Camel's header filtering didn't recognize these control headers as needing protection, letting them pass through from untrusted HTTP clients into the routing logic.

• CVE-2026-46599HIGH 7.5

  CVE-2026-46599 is a denial-of-service vulnerability in TIFF image decoders that affects how they handle PackBits-compressed image data. An attacker can craft a specially-designed image file that appears small on disk but, when decoded, forces the decoder to expand and process far larger amounts of data than expected. This resource exhaustion can crash applications or services that attempt to process the malicious image, making it a practical availability threat in environments that automatically process untrusted images.

• CVE-2026-46601HIGH 7.5

  A vulnerability exists in webp image decoder implementations where a specially crafted WebP file containing a VP8 video chunk with mismatched dimensions can cause the decoder to crash. An attacker could trigger this by serving a malicious WebP image to a user or application, resulting in a denial of service. The issue does not allow data theft or system compromise—only service disruption.

• CVE-2026-46602HIGH 7.5

  A flaw in TIFF image decoding allows an attacker to craft a malicious or corrupted TIFF file with unusually large image tiles that can consume unlimited amounts of system memory. When processed by vulnerable software, such a file can exhaust available RAM, causing the application to crash or become unresponsive. The vulnerability requires no user authentication and can be triggered by simply opening a hostile image file.

• CVE-2026-46604HIGH 7.5

  A vulnerability exists in Go's TIFF image decoder that can cause the application to crash when processing specially crafted TIFF files. The decoder fails to validate strip offset values properly, allowing an attacker to trigger a panic by supplying an out-of-bounds offset. This is a denial-of-service issue that affects any Go-based service handling untrusted TIFF images, particularly those exposed to the internet or processing user-supplied files.

• CVE-2026-46625HIGH 7.5

  js-cookie is a popular JavaScript library that manages browser cookies. Versions before 3.0.7 contain a prototype pollution vulnerability where an attacker can manipulate cookie security attributes. By crafting a malicious JSON object with a specially-formed __proto__ property, an attacker can inject unauthorized cookie attributes like domain, secure, samesite, expires, and path. This allows them to broaden cookie scope, remove security restrictions, or extend cookie lifetime—potentially enabling session hijacking, cross-site request forgery, or credential theft depending on how the application uses cookies.

• CVE-2026-46669HIGH 7.5

  OpenVM is a zero-knowledge virtual machine framework used for proving computation. A flaw in how it validates cryptographic pairing checks allows the system to incorrectly accept or process proofs that should be rejected. Specifically, the library fails to verify that an internal scaling factor meets required mathematical constraints, potentially enabling an attacker to craft a proof that passes validation when it shouldn't. This is a cryptographic soundness issue—the affected proofs may look valid but could represent false claims about computation.

• CVE-2026-46673HIGH 7.5

  Russh, a Rust-based SSH library used for building secure communication clients and servers, contains a critical memory management flaw in its CryptoVec component—a cryptographic buffer used internally for sensitive data. The vulnerability stems from unsafe buffer operations that don't properly validate size calculations before allocating or locking memory. Depending on the version, local SSH agents or remote attackers could exploit this by sending malformed frame lengths that trigger uncontrolled memory growth, leading to denial of service. The flaw has been fixed in version 0.60.3.

• CVE-2026-46679HIGH 7.5

  A flaw in the @libp2p/gossipsub library allows a single attacker to remotely crash any gossipsub node running the default configuration by exhausting its heap memory. No authentication is required—the attacker needs only network access to the target node. This denial-of-service attack exploits three related implementation gaps that compound to trigger excessive memory allocation. The vulnerability affects libp2p versions prior to 15.0.23 and has been patched.

• CVE-2026-46697HIGH 7.5

  Fediverse Embeds, a WordPress plugin that displays posts from social media networks, contains a server-side request forgery (SSRF) vulnerability that allows anyone on the internet to use an affected WordPress site as an open proxy. The plugin's REST API endpoint accepts web addresses, retrieves their contents, and returns the full response to the requester without validating that the target is a legitimate fediverse domain. An attacker can exploit this to access internal network resources, retrieve sensitive files, or perform reconnaissance on infrastructure not normally accessible from the internet. Version 1.5.8 patches this issue.

• CVE-2026-46702HIGH 7.5

  Russh, a Rust-based SSH client and server library, contains a vulnerability affecting versions 0.34.0 through 0.61.0 that allows attackers to cause denial-of-service by exploiting SSH compression. When compression is enabled, the library fails to properly validate the decompressed size of packets, allowing an attacker to send compressed data that passes initial size checks but expands to excessively large packets after decompression. This exhausts server resources and disrupts availability. The vulnerability is patched in version 0.61.1.

• CVE-2026-46726HIGH 7.5

  Apache Camel's Vertx WebSocket component fails to filter incoming connection parameters, allowing unauthenticated attackers to inject Camel control headers through query or path parameters. When a WebSocket consumer feeds data into an HTTP producer downstream, attackers can redirect the HTTP request to arbitrary internal or external servers and extract sensitive information like environment variables, application properties, or vault secrets by embedding property placeholder references in the injected headers. This is a remote attack requiring no authentication if the WebSocket endpoint is publicly exposed.

• CVE-2026-46741HIGH 7.5

  Etsy::StatsD, a Perl library used to send monitoring metrics to StatsD servers, fails to properly validate metric names and values before transmission. An attacker who controls data that flows into the application's metrics can inject malicious StatsD commands by embedding newlines, colons, or pipes—characters that have special meaning in the StatsD protocol. This allows injection of unauthorized metrics that could disrupt monitoring, mask real alerts, or degrade observability infrastructure.

• CVE-2026-46749HIGH 7.5

  SINEC INS, Siemens' industrial networking and security solution, contains a password storage flaw that makes user credentials vulnerable to attack. The system uses the same password salt for every user across all installations, and applies too few computational iterations during hashing. This combination allows an attacker with local system access to crack passwords much faster than intended, potentially gaining unauthorized control of the application.

• CVE-2026-46791HIGH 7.5

  An Oracle WebCenter Content vulnerability allows unauthenticated attackers to read sensitive data over the network without authentication. The flaw resides in the Content Server component of Oracle Fusion Middleware version 14.1.2.0.0. An attacker with network access can exploit this over HTTP to gain unauthorized access to critical information stored within WebCenter Content. The vulnerability does not allow attackers to modify or delete data, only to read it.

• CVE-2026-46829HIGH 7.5

  Oracle REST Data Services versions 24.2.0 through 26.1.0 contain a flaw in the Mongoapi component that allows anyone on the network to crash the service without needing to log in. An attacker can send specially crafted requests over HTTPS to trigger a denial-of-service condition—either a complete hang or repeated crashes—that disrupts availability. No authentication, credentials, or special access is required; the attack works from across the network.

• CVE-2026-46834HIGH 7.5

  A denial-of-service vulnerability exists in Oracle Database Server's Net Service component that allows an unauthenticated attacker on the network to crash or hang the service repeatedly. The attacker needs only network access and can exploit this over TLS without providing credentials or user interaction. The vulnerability affects versions 23.4.0 through 23.26.2 of Oracle Database Server.

• CVE-2026-46835HIGH 7.5

  A flaw in Oracle Database Server's Net Service component allows attackers on the network to remotely crash or hang the service without needing valid credentials. The vulnerability affects versions 23.4.0 through 23.26.2 and is triggered via TLS connections, making it accessible to any attacker with network connectivity to the affected database service.

• CVE-2026-46862HIGH 7.5

  A denial-of-service vulnerability exists in Oracle MySQL Router versions 8.4.0–8.4.9 and 9.0.0–9.7.0. An attacker on the network can send specially crafted TLS traffic to cause the Router service to hang or crash repeatedly, disrupting database connectivity for applications that depend on it. No authentication is required, and the attack can be repeated reliably. The vulnerability does not expose data or allow unauthorized access to databases themselves, but prevents legitimate clients from connecting through the affected Router instance.

• CVE-2026-46863HIGH 7.5

  A vulnerability in Oracle MySQL Server and MySQL Cluster allows an unauthenticated attacker on the network to crash or hang the database service without authentication. The vulnerability affects multiple recent versions across both products and requires only network access—no special configuration or user interaction. Successful exploitation results in a complete denial of service.

• CVE-2026-46873HIGH 7.5

  Oracle VM VirtualBox 7.2.8 contains a vulnerability in its VMSVGA device emulation that could allow an attacker with high privileges and local access to compromise the hypervisor and potentially affect systems beyond VirtualBox itself. The flaw is difficult to exploit in practice but could lead to complete control of the virtualization environment if successfully weaponized.

• CVE-2026-46934HIGH 7.5

  A vulnerability in Oracle's Complex Maintenance, Repair and Overhaul component of E-Business Suite allows attackers with low-level network access to gain complete control over the application. The flaw requires an attacker to already be authenticated with basic user credentials and involves HTTP-based exploitation, but once leveraged successfully, gives an adversary full read, write, and availability control over the system. Versions 12.2.3 through 12.2.15 are affected.

• CVE-2026-46935HIGH 7.5

  A vulnerability exists in Oracle's Complex Maintenance, Repair and Overhaul component within Oracle E-Business Suite that allows a low-privileged user with network access to take over the affected system. The flaw is difficult to exploit but has severe consequences—attackers can read, modify, or disable critical maintenance and repair operations. Organizations using versions 12.2.3 through 12.2.15 are at risk and should prioritize assessment and patching.

• CVE-2026-46955HIGH 7.5

  A vulnerability in Oracle's Human Resources module within E-Business Suite allows an unauthenticated attacker to potentially take over the system. The attacker would need network access and would require the victim to interact with a malicious link or content—making it a social engineering vector rather than a direct attack. While exploitation is difficult to execute, successful compromise could give an attacker full control over HR data and functions.

• CVE-2026-46957HIGH 7.5

  CVE-2026-46957 is a high-severity vulnerability in Oracle's iSupplier Portal, a component of Oracle E-Business Suite used for supplier collaboration. An attacker with low-level user credentials and network access can exploit an improper access control flaw to fully compromise the portal, potentially gaining control over supplier data, transactions, and operations. The vulnerability affects iSupplier Portal versions 12.2.3 through 12.2.15 and requires the attacker to already have valid user credentials, which significantly reduces opportunistic attack risk but remains a concern for insider threats and credential compromise scenarios.

• CVE-2026-46958HIGH 7.5

  A vulnerability in Oracle's Subledger Accounting module (part of E-Business Suite) allows a low-privileged network user to gain complete control over the accounting system through a difficult-to-exploit flaw. The attacker would need valid system credentials and network access, but if successful, could read, modify, or delete critical financial data and disrupt operations. This affects Oracle E-Business Suite versions 12.2.3 through 12.2.15.

• CVE-2026-46959HIGH 7.5

  A vulnerability in Oracle's Subledger Accounting component—part of the E-Business Suite—allows attackers with low-level network access to potentially take over the entire accounting module. While the attack requires special conditions to execute and the attacker must already have basic user credentials, success grants complete control over Subledger Accounting's data and operations. Organizations running versions 12.2.3 through 12.2.15 are at risk.

• CVE-2026-46966HIGH 7.5

  A vulnerability in Oracle's Universal Work Queue component of E-Business Suite allows a low-privileged user with network access to take over the application. The flaw exists in the site-level administration features and requires specific difficult-to-exploit conditions, but successful compromise results in complete loss of confidentiality, integrity, and availability for the affected system. This affects E-Business Suite versions 12.2.3 through 12.2.15.

• CVE-2026-46971HIGH 7.5

  Oracle's HR Intelligence system, which is part of Oracle E-Business Suite, contains a security vulnerability that allows a logged-in attacker with network access to take over the application. The flaw affects versions 12.2.3 through 12.2.15. An attacker would need valid user credentials and would need to navigate through some technical obstacles, but successful exploitation grants them complete control over HR Intelligence, potentially exposing or modifying sensitive employee and HR data.

• CVE-2026-46974HIGH 7.5

  Oracle VM VirtualBox version 7.2.8 contains a privilege escalation vulnerability that allows an attacker with high administrative privileges and local access to the system running VirtualBox to gain complete control over the hypervisor. This is a difficult-to-exploit flaw that requires the attacker to already have elevated credentials and physical or direct system access, but successful exploitation grants them the ability to take over VirtualBox and potentially impact guest virtual machines and the underlying infrastructure.

• CVE-2026-47123HIGH 7.5

  FreeScout, a PHP-based help desk platform, contains a flaw in how it processes incoming email replies. Attackers who can forge the sender address of a help desk agent can trick FreeScout into treating their messages as legitimate agent responses. Because the system doesn't cryptographically verify these replies, the spoofed messages get automatically forwarded to customers using the real help desk email account. This means attackers could impersonate support staff and send messages to your customers without proper authorization.

• CVE-2026-47193HIGH 7.5

  OpenProject, a popular open-source project management platform, contains a vulnerability in its journal diff endpoint that leaks sensitive historical field values. The vulnerability exists because the endpoint does not properly check whether users should have access to view specific objects or fields before returning historical change data. An unauthenticated attacker can request historical project or task information that should remain hidden, potentially exposing sensitive business data, decisions, or field changes. The issue affects versions prior to 17.3.3 and 17.4.1.

• CVE-2026-47220HIGH 7.5

  Envoy, a widely-deployed proxy for cloud-native applications, contains a denial-of-service vulnerability in versions 1.37.0–1.37.4 and 1.38.0–1.38.2. The flaw occurs when administrators configure logging to extract the requested server name with specific host-matching options (such as HOST_FIRST or SNI_FIRST), but the incoming request lacks a host header. This combination causes Envoy to crash unexpectedly, disrupting traffic routing until the service restarts. Patched versions 1.37.5 and 1.38.3 address the issue.

• CVE-2026-47261HIGH 7.5

  Wasmtime, a WebAssembly runtime, contains an access control bypass in its filesystem permission enforcement. When a WebAssembly module is granted read-only access to a directory, an attacker can use a specific file-opening technique (the TRUNCATE flag) to bypass those restrictions and modify files that should be protected. The vulnerability exists in versions before 24.0.9, 36.0.10, and 44.0.2, and stems from a missing permission check in the code that handles file opening operations.

• CVE-2026-47265HIGH 7.5

  AIOHTTP, a popular Python framework for building asynchronous web applications, has a cookie-handling vulnerability that can leak sensitive data during cross-origin redirects. When developers attach cookies directly to individual requests using the `cookies` parameter, those cookies are transmitted to redirect destinations across different origins—a behavior that violates the same-origin principle. An attacker who can trigger a redirect to a malicious domain they control could intercept authentication tokens, session IDs, or other sensitive cookie data. The issue affects all versions prior to 3.14.0 and is now patched.

• CVE-2026-47430HIGH 7.5

  A vulnerability in the Apache Cordova InAppBrowser plugin (versions 3.1.0–6.0.0) allows attackers to trick iOS apps into executing unintended plugin callbacks. When an app displays untrusted content in InAppBrowser—such as a social login redirect or marketing landing page—an attacker can craft a malicious message that fires callbacks meant for other installed plugins (like Camera, Contacts, or Geolocation). Because Cordova uses predictable callback naming, attackers can enumerate and target these IDs without specialized knowledge. The result is that the attacker can spoof plugin results: falsely approving a camera request, injecting fake contacts, or returning fabricated file data—all appearing to come from legitimate plugin operations.

• CVE-2026-47633HIGH 7.5

  Microsoft Cost Management contains a flaw that exposes sensitive financial and operational data to attackers who do not need to authenticate. An attacker on the network can retrieve confidential information without any special access or user interaction, making this a straightforward network-based attack. The vulnerability does not allow attackers to modify data or disrupt service, but the disclosure of cost management data—which typically includes pricing, usage patterns, resource allocation, and billing information—can have significant downstream consequences for organizational security and business strategy.

• CVE-2026-47654HIGH 7.5

  A use-after-free memory vulnerability exists in the Remote Desktop Client component across multiple Windows Server versions. An attacker can exploit this flaw to execute arbitrary code on a target system over the network. The attack requires user interaction—specifically, a user must open a malicious RDP connection or file—but once triggered, an unauthenticated attacker gains the ability to run code with the privileges of the affected user. This is a network-reachable vulnerability with no authentication requirement, making it a material risk for organizations using Remote Desktop services.

• CVE-2026-47774HIGH 7.5

  Envoy, a widely-deployed HTTP/2 proxy for cloud applications, contains a memory exhaustion vulnerability that allows attackers to crash the service without authentication. The flaw stems from inadequate header size validation: cookie headers bypass size checks, and compressed header blocks can decompress to enormous sizes that aren't capped. An attacker can exploit this combination to force Envoy to allocate excessive memory, triggering out-of-memory errors and service downtime. Affected versions are older than 1.35.11, 1.36.7, 1.37.3, and 1.38.1.

• CVE-2026-47777HIGH 7.5

  Mastodon, an open-source social network platform, contains a flaw in its experimental Collections feature that allows attackers to forge authorization objects and falsely claim permission to feature accounts in remote Collections. The vulnerability exists because Mastodon fails to properly validate that the authorization object matches the actual account being featured. Exploitation is straightforward—no user interaction or special privileges are required—but only affects Mastodon instances that have explicitly enabled the experimental Collections feature. The flaw has been patched in version 4.6.0-beta.1.

• CVE-2026-47831HIGH 7.5

  A weakness in how bosh-windows-stemcell-builder generates SSH passwords allows attackers on the same network to guess login credentials more easily than they should be able to. The vulnerability stems from using a cryptographically weak random number generator in the password generation function, meaning the passwords produced lack sufficient entropy. Versions before v2019.98 are affected. An attacker with network access to affected systems could potentially brute-force SSH login credentials and gain remote access.

• CVE-2026-47840HIGH 7.5

  A network attacker positioned on the path between a UAA (User Account and Authentication) system and its LDAP directory server can intercept and impersonate the directory using any certificate issued by a trusted certificate authority. This allows the attacker to steal the LDAP bind password, capture every end-user password transmitted during authentication, and inject forged group memberships that grant themselves administrator privileges. The vulnerability affects all deployments that use LDAP with StartTLS encryption. An attacker needs to be on the network path between UAA and LDAP (man-in-the-middle position) but does not need any special credentials or user interaction to execute the attack.

• CVE-2026-47896HIGH 7.5

  Apache Lucene.Net's Lucene.Net.Replicator library contains a path traversal vulnerability that allows an attacker to read files outside the intended directory on affected systems. An unauthenticated remote attacker can exploit this over the network without user interaction, potentially exposing sensitive data. The vulnerability affects beta versions 4.8.0-beta00005 through 4.8.0-beta00017, and a fix is available in version 4.8.0-beta00018.

• CVE-2026-47897HIGH 7.5

  A path traversal vulnerability exists in Apache Lucene.Net's Replicator library (versions 4.8.0-beta00005 through 4.8.0-beta00017) that allows unauthenticated network attackers to write or modify files outside of their intended directory. An attacker can craft requests that bypass directory restrictions, potentially overwriting configuration files, application binaries, or other sensitive data on affected systems. The vulnerability requires no authentication and can be exploited remotely over the network.

• CVE-2026-48006HIGH 7.5

  Netty's Redis message aggregator has a memory leak that can crash applications. When a Redis client closes its connection mid-request, the handler doesn't clean up buffered data, leaving memory fragments locked in the heap. Attackers can exploit this by repeatedly opening and closing connections, slowly poisoning the shared memory pool until the entire application runs out of buffer space and fails to handle new network traffic.

• CVE-2026-48042HIGH 7.5

  Envoy, an open source proxy widely used in cloud-native infrastructure, contains a flaw in how it handles JSON parsing. When processing JSON with extremely deep nesting—roughly 100,000 levels—the proxy's memory cleanup process can overflow the call stack, crashing the service. This is a denial-of-service vulnerability: an attacker can send a specially crafted JSON payload to exhaust resources and take down an Envoy instance. The vulnerability affects multiple versions across the supported release lines.

• CVE-2026-48044HIGH 7.5

  Envoy, a widely-used proxy for containerized environments, contains a flaw in how it handles compressed data. When compression is turned on, an attacker can send a specially crafted compressed payload that tricks Envoy into allocating massive amounts of memory, eventually crashing the proxy with an out-of-memory error. This is a network-accessible denial-of-service vulnerability that requires no authentication.

• CVE-2026-48059HIGH 7.5

  Netty, a widely-used Java framework for building networked applications, contains a memory leak in its HAProxy PROXY protocol v2 decoder. When a client sends a specially crafted but valid header containing nested SSL metadata records, the decoder fails to properly release the underlying memory buffer. This happens silently—no errors are reported, the connection appears to handle normally, and the leak accumulates with each affected connection. Over time, this can exhaust server memory and cause denial of service. The issue affects Netty versions before 4.1.135.Final and 4.2.15.Final.

• CVE-2026-48110HIGH 7.5

  Russh, a Rust SSH library used for building SSH clients and servers, contains a memory allocation vulnerability affecting versions 0.34.0 through 0.60.x. An attacker connecting over the network can craft malformed SSH protocol messages with oversized or malformed data fields that force the library to allocate large amounts of memory before validating the input. This can cause denial of service by exhausting available memory or slowing the application. The vulnerability has been fixed in version 0.61.0.

• CVE-2026-48116HIGH 7.5

  AnythingLLM versions before 1.13.0 contain a command injection vulnerability in their filesystem search capability. When an authenticated user chats with the filesystem agent, an attacker can craft malicious search patterns that trick the underlying ripgrep tool into executing arbitrary commands on the server. The vulnerability exists because the application doesn't properly isolate user input before passing it to ripgrep, allowing an attacker to inject command-line flags that transform ripgrep into a command executor. Combined with AnythingLLM's file-writing capability, this creates a complete remote code execution path within the container.

• CVE-2026-48138HIGH 7.5

  A vulnerability in the NI grpc-device streaming API allows attackers to read memory beyond proper bounds, potentially causing the application to crash or become unavailable. The flaw stems from missing validation when processing specially crafted network requests. No authentication is required to trigger the issue, making it accessible to anyone with network access to affected systems.

• CVE-2026-48139HIGH 7.5

  A NULL pointer dereference flaw exists in National Instruments' grpc-device data moniker service. An unauthenticated attacker can crash the affected service by sending a specially crafted request containing an unknown value. This denial-of-service vulnerability impacts NI grpc-device version 2.17.0 and earlier. The attack requires no user interaction and can be executed remotely, but does not allow data theft or system compromise—only service disruption.

• CVE-2026-48502HIGH 7.5

  MessagePack for C# versions before 2.5.301 and 3.1.7 contain a critical memory management vulnerability in the timestamp parsing logic. When processing specially crafted MessagePack messages, the library allocates stack memory based on attacker-supplied values without first validating those values are legitimate. This can trigger a stack overflow that crashes the entire application with no opportunity for error handling. An attacker can exploit this remotely with a tiny payload to take down services using vulnerable versions of the library.

• CVE-2026-48506HIGH 7.5

  MessagePack for C# versions before 2.5.301 and 3.1.7 contain a flaw in the TrySkip() function that allows deeply nested data structures to bypass the library's built-in depth-checking protection. When the serializer encounters data it needs to skip—such as unknown fields or unrecognized map keys—it recursively processes nested structures without respecting the configured maximum object graph depth limit. An attacker who sends a specially crafted MessagePack payload with extreme nesting can trigger an unrecoverable stack overflow, causing the application to crash. This is a denial-of-service vulnerability affecting any .NET application using vulnerable versions of MessagePack.

• CVE-2026-48510HIGH 7.5

  MessagePack for C# has a denial-of-service vulnerability in how it handles compressed data. When decompressing LZ4-compressed payloads, the library allocates memory based on a size value claimed by the incoming data before checking whether that claim is legitimate. An attacker can send a small malicious file that declares itself to be enormous, forcing the application to reserve huge amounts of memory. This exhausts system resources and crashes the service. The flaw affects versions before 2.5.301 and 3.1.7, and patches are now available.

• CVE-2026-48511HIGH 7.5

  MessagePack for C# contains a performance vulnerability in its ExpandoObject deserialization handler. When deserializing untrusted data containing large maps with many distinct keys, the library exhibits quadratic behavior—CPU and memory usage grow exponentially rather than linearly with input size. An attacker sending a specially crafted MessagePack message can trigger excessive resource consumption, potentially causing denial of service. The flaw affects versions before 2.5.301 and 3.1.7.

• CVE-2026-48512HIGH 7.5

  MessagePack for C# contains multiple unguarded recursion paths in its JSON conversion helpers that allow attackers to trigger stack exhaustion. When processing nested JSON structures or even malformed JSON with repeated separators, the library fails to enforce depth limits consistently, leading to an uncatchable StackOverflowException that crashes the process. This is a denial-of-service vulnerability affecting applications that use MessagePack to deserialize or convert JSON from untrusted sources.

• CVE-2026-48513HIGH 7.5

  MessagePack for C# versions before 2.5.301 and 3.1.7 contain a flaw in how they deserialize union types—a common pattern for handling multiple possible data structures. When processing union data, the library fails to enforce recursion depth limits that normally prevent attackers from sending deeply nested objects that exhaust memory and crash applications. An attacker can send specially crafted MessagePack data with unknown union keys that bypasses these safety checks entirely, leading to denial of service.

• CVE-2026-48514HIGH 7.5

  MessagePack for C# contains a vulnerability in its deserialization logic that allows an attacker to trigger excessive memory allocation with minimal network traffic. When deserializing specially crafted MessagePack data, the library reads a size value from the data stream and allocates memory for an array without properly validating that the claimed size matches the actual available data. An attacker can send a tiny payload claiming to contain a massive array, forcing the application to allocate gigabytes of RAM—potentially exhausting system resources and causing the application to crash.

• CVE-2026-48515HIGH 7.5

  MessagePack for C# versions before 2.5.301 and 3.1.7 contain a denial-of-service vulnerability in how they deserialize multi-dimensional arrays. When processing serialized data, the library allocates memory for arrays based on dimension sizes claimed in the payload before checking whether those dimensions are consistent with the actual array data. An attacker can craft a small malicious message that declares enormous array dimensions, triggering a massive memory allocation on the target system even though the message contains little actual data. This causes the application to consume excessive heap memory and can crash the service.

• CVE-2026-48516HIGH 7.5

  MessagePack for C# versions before 2.5.301 and 3.1.7 contain a flaw that bypasses security protections when deserializing untrusted data. The vulnerability allows attackers to craft specially designed input that causes excessive CPU usage, effectively freezing or slowing an application—a denial-of-service condition. Even applications that have explicitly enabled security-hardened settings to handle untrusted input remain vulnerable because the library fails to apply the configured security rules in one specific code path.

• CVE-2026-48517HIGH 7.5

  MessagePack for C# contains a type-filtering bypass vulnerability in its typeless deserialization mechanism. The library implements a safety check to block dangerous types from being deserialized, but this check only examines the outermost type. An attacker can circumvent this protection by wrapping a blocked type inside an array or generic type wrapper, allowing the forbidden type to slip through validation and be instantiated anyway. This creates a deserialization attack surface that the vendor intended to close.

• CVE-2026-48563HIGH 7.5

  A use-after-free bug in Microsoft's Remote Desktop Client can allow an attacker to run malicious code on a victim's machine over the network. The attacker would need to trick the user into connecting to a compromised or malicious Remote Desktop server, but once successful, they gain full control. This affects Windows 10 and Windows 11 systems, as well as Windows Server 2019, 2022, and 2025.

• CVE-2026-48615HIGH 7.5

  Node.js has a vulnerability in how it handles errors when proxy connections fail. If you configure Node.js to use a proxy server and include the login credentials directly in the proxy URL, those credentials can leak into error messages. This leaked information may end up in application logs, monitoring systems, or diagnostic tools where unauthorized parties could read it. The vulnerability affects all three currently supported Node.js release lines: versions 22, 24, and 26.

• CVE-2026-48619HIGH 7.5

  Node.js has a vulnerability in how it handles HTTP/2 connections where a malicious server can overwhelm a client by sending an excessive number of ORIGIN frames, causing the client process to consume memory until it crashes. This is a denial-of-service flaw that affects all three currently supported Node.js release lines: versions 22, 24, and 26.

• CVE-2026-4870HIGH 7.5

  IBM Qiskit SDK versions 0.43.0 through 2.5.0 contain a parser vulnerability that allows remote attackers to cause the application to crash by triggering excessive recursion. An attacker can send specially crafted input that forces the parser into a recursive loop, ultimately causing a segmentation fault and denying service to legitimate users. No authentication is required, and the attack can be launched over the network.

• CVE-2026-48708HIGH 7.5

  OliveTin is a web-based interface for executing predefined shell commands. A race condition in versions up to 3000.0.0 allows concurrent command executions to interfere with each other. When multiple users run actions simultaneously—which happens by default—the template engine that constructs these commands can be corrupted mid-execution, leading to commands being swapped between users, application crashes, or commands running with unintended parameters. This issue is fixed in version 3000.13.0.

• CVE-2026-48712HIGH 7.5

  protobufjs is a widely used JavaScript library that converts protobuf message definitions into executable code. Versions before 7.6.1 and 8.4.1 contain a flaw where the library fails to limit recursion depth when converting decoded protobuf messages to plain JavaScript objects or JSON format. An attacker can craft a malicious protobuf message with deeply nested structures (particularly using the google.protobuf.Any type) that will cause the JavaScript runtime to exhaust its call stack, crashing the application. This is a denial-of-service vulnerability affecting any service that parses untrusted protobuf input and converts it to JSON or object form.

• CVE-2026-48743HIGH 7.5

  Envoy, a widely-deployed proxy for cloud-native systems, contains a request smuggling vulnerability in versions before 1.35.11, 1.36.7, 1.37.3, and 1.38.1. When Envoy processes an HTTP/3 request from a client that claims to have a body (via Content-Length header) but actually doesn't, it can inadvertently mix that declaration with the start of the next upstream request. An origin server that replies before reading the body and reuses the connection will parse the beginning of Envoy's next request as part of the first request's body, then interpret the remainder as a new request. This creates a route-bypass scenario where requests denied by Envoy's policy can reach the backend, or traffic intended for one path reaches another.

• CVE-2026-48748HIGH 7.5

  Netty, a widely-used Java framework for building network applications, contains a vulnerability in its HTTP/3 codec that can be exploited to exhaust server memory. An attacker can trigger the creation of an unlimited number of blocked streams, causing the affected application to run out of memory and crash. This denial-of-service condition requires no authentication and can be triggered remotely over the network. Netty versions prior to 4.2.15.Final are vulnerable.

• CVE-2026-48774HIGH 7.5

  ProxySQL versions 3.0.0 through 3.0.8 contain a critical flaw in their GenAI/MCP feature that allows attackers to perform database writes and administrative commands despite the tool being advertised as read-only. An attacker can craft a SQL request that starts with a harmless SELECT statement followed by destructive commands like RENAME TABLE or DROP TABLE. ProxySQL's validation only checks the beginning of the request and uses a blacklist that misses common write operations, so the full multi-statement payload gets executed on the backend. This means anyone with network access to the MCP query endpoint can modify, delete, or lock database tables.

• CVE-2026-48779HIGH 7.5

  The ws library, a widely-used WebSocket implementation for Node.js, contains a denial-of-service vulnerability that allows a remote attacker to crash an application by sending a carefully crafted stream of tiny data fragments. Despite the small individual packets, the server allocates internal memory structures for each fragment that far exceed the advertised message-size limits, eventually exhausting available memory and terminating the process. No authentication is required, and the attack traffic is modest, making this a practical threat for exposed WebSocket services.

• CVE-2026-48818HIGH 7.5

  Starlette, a popular lightweight web framework used by FastAPI and other applications, has a vulnerability in how it handles file serving on Windows systems. When serving static files, the framework can be tricked into initiating SMB (network file sharing) connections to attacker-controlled servers by requesting UNC paths like \\attacker.com\share. Even though the HTTP response is a 404 error, the vulnerability exposes the Windows service account's NTLMv2 credentials during this failed connection attempt. These credentials can then be cracked offline or used in relay attacks. The flaw does not affect Linux/Unix systems or configurations where symlink following is explicitly enabled.

• CVE-2026-48835HIGH 7.5

  A flaw in Contact Form by WPForms versions 1.10.0.4 and earlier allows attackers to bypass authentication and modify contact form data without permission. Because no login is required and the vulnerability is straightforward to trigger over the network, any attacker can exploit it. The flaw does not expose sensitive data directly, but enables unauthorized changes to form submissions and settings, disrupting business processes and data integrity.

• CVE-2026-48868HIGH 7.5

  A vulnerability exists in Simple Shopping Cart up to version 5.2.9 that allows attackers to access other users' sensitive information without authentication. The flaw stems from insecure direct object references—a common design pattern where the application directly uses user-supplied IDs to fetch data without verifying that the requester has permission to access it. Because no login is required and the attack is straightforward to execute over the network, this poses a meaningful confidentiality risk to organizations running affected versions.

• CVE-2026-48883HIGH 7.5

  A critical access control vulnerability exists in WPC Product Bundles for WooCommerce versions 8.5.3 and earlier. The plugin fails to properly validate user permissions, allowing unauthenticated attackers to modify product bundle configurations and pricing without authentication. This means an attacker could alter how bundles are presented to customers, change prices, or manipulate bundle contents—all without needing to log in or have any legitimate access to the store.

• CVE-2026-48929HIGH 7.5

  Rocket.Chat versions before 8.5.1 (and earlier branches) contain a flaw that allows anyone on the internet to permanently delete files that users have uploaded to the chat platform—without needing to log in. An attacker discovers the ID of a file from public messages or download links, then sends a single command via Rocket.Chat's WebSocket connection that deletes it from the server. The vulnerability stems from a missing authentication check in the file deletion function. Because file IDs are often visible in public channels, this poses a material risk to data integrity and availability for any Rocket.Chat deployment exposed to untrusted networks.

• CVE-2026-48933HIGH 7.5

  Node.js has a vulnerability in its WebCrypto module that can crash the entire process when certain cryptographic encryption operations receive very large inputs—specifically, inputs that are exactly a multiple of 2 gigabytes in size. This affects currently supported versions of Node.js (22, 24, and 26), and an attacker on the network could trigger this denial-of-service condition without authentication.