Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 1000 of 1013.
- CVE-2026-100813 Invalid pointer in the JavaScript Engine: JIT component
- CVE-2026-100812 Denial-of-service in the Graphics component
- CVE-2026-100811 Sandbox escape due to use-after-free in the DOM: Core & HTML component
- CVE-2026-100810 Other issue in the DevTools component
- CVE-2026-10081 Unlimited Elements for Elementor < 2.0.11 - Unauthenticated Stored XSS via Google Reviews Widget
- CVE-2026-100809 Same-origin policy bypass in the DevTools component
- CVE-2026-100808 Mitigation bypass in the DOM: Service Workers component
- CVE-2026-100807 Privilege escalation in the DOM: Service Workers component
- CVE-2026-100806 Uninitialized memory in the Graphics: WebGPU component
- CVE-2026-100805 Race condition, use-after-free in the Audio/Video component
- CVE-2026-100804 Sandbox escape due to use-after-free in the Preferences: Backend component
- CVE-2026-100803 Same-origin policy bypass in the WebExtensions component
- CVE-2026-100802 Uninitialized memory in the Graphics: WebGPU component
- CVE-2026-100801 Privilege escalation in the DLL Services component
- CVE-2026-100800 Sandbox escape due to use-after-free in the Disability Access APIs component
- CVE-2026-10080 Boards plugin panics on WebSocket command with non-string field types
- CVE-2026-1008 Stored Cross-Site Scripting in Altium Live User Profile Fields
- CVE-2026-100799 Uninitialized memory in the Graphics: WebGPU component
- CVE-2026-100798 Cryptography misuse in Storage: Quota Manager component
- CVE-2026-100797 Privilege escalation due to use-after-free in the Graphics: WebRender component
- CVE-2026-100796 Use-after-free in the JavaScript: WebAssembly component
- CVE-2026-100795 Denial-of-service in the Networking component
- CVE-2026-100794 Sandbox escape due to incorrect boundary conditions in the Internationalization component
- CVE-2026-100793 JIT miscompilation in the JavaScript Engine component
- CVE-2026-100792 JIT miscompilation in the JavaScript: WebAssembly component
- CVE-2026-100791 Use-after-free in the DOM: Core & HTML component
- CVE-2026-100790 Use-after-free in the XSLT component
- CVE-2026-10079 Stackrox: stackrox: deploy-time policy enforcement and visibility bypass via label injection
- CVE-2026-100789 Use-after-free in the Graphics: Canvas2D component
- CVE-2026-100788 Invalid pointer in the JavaScript: WebAssembly component
- CVE-2026-100787 Sandbox escape in the XUL component
- CVE-2026-100786 Sandbox escape due to use-after-free in the Graphics component
- CVE-2026-100785 Use-after-free in the DOM: Core & HTML component
- CVE-2026-100784 Use-after-free in the Layout: Text and Fonts component
- CVE-2026-100783 Uninitialized memory in the Audio/Video component
- CVE-2026-100782 Privilege escalation due to incorrect boundary conditions in the Graphics component
- CVE-2026-100781 Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component
- CVE-2026-100780 Use-after-free in the DOM: Core & HTML component
- CVE-2026-10078 Quay/config-tool: quay/config-tool: gitlab oauth client_secret exposed in url querystring
- CVE-2026-100779 Use-after-free in the XSLT component
- CVE-2026-100778 Sandbox escape due to use-after-free in the DOM: Core & HTML component
- CVE-2026-100777 Use-after-free in the Graphics: Canvas2D component
- CVE-2026-100776 Use-after-free in the JavaScript: WebAssembly component
- CVE-2026-100775 Sandbox escape in the Graphics component
- CVE-2026-100774 Use-after-free in the DOM: Core & HTML component
- CVE-2026-100773 Use-after-free in the Storage: IndexedDB component
- CVE-2026-100772 Use-after-free in the DOM: Core & HTML component
- CVE-2026-100771 Undefined behavior in the DOM: Streams component
- CVE-2026-100770 Sandbox escape due to use-after-free in the DOM: Content Processes component
- CVE-2026-10077 YOOtheme Pro < 5.0.35 - Author+ Stored XSS via UIkit Data Attributes
- CVE-2026-100769 Use-after-free in the JavaScript: WebAssembly component
- CVE-2026-100768 Use-after-free in the Graphics: WebGPU component
- CVE-2026-100767 Use-after-free in the Networking: Cache component
- CVE-2026-100766 Information disclosure in the Networking: JAR component
- CVE-2026-100765 Use-after-free in the JavaScript: WebAssembly component
- CVE-2026-100764 Privilege escalation due to incorrect boundary conditions in the Graphics: WebGPU component
- CVE-2026-100763 Incorrect boundary conditions in the Graphics: WebGPU component
- CVE-2026-100762 Sandbox escape due to use-after-free in the DOM: Content Processes component
- CVE-2026-100761 Privilege escalation due to use-after-free in the Graphics: WebGPU component
- CVE-2026-100760 Sandbox escape in the Security: Process Sandboxing component
- CVE-2026-100759 Uninitialized memory in the Storage: Quota Manager component
- CVE-2026-100758 Sandbox escape in the DOM: Navigation component
- CVE-2026-100757 Use-after-free in the Widget component
- CVE-2026-100756 Incorrect boundary conditions in the Audio/Video: Playback component
- CVE-2026-100755 Acceptance of Extraneous Untrusted Data With Trusted Data in GitLab
- CVE-2026-100753 Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager (Free) < 6.7.9
- CVE-2026-100752 Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9
- CVE-2026-100751 Cross-site scripting in Tabs & Accordions (Free, Pro) extension for Joomla
- CVE-2026-100750 Joomla Extension - regularlabs.com - Arbitrary file read / SSRF in Modules Anywhere 1.5.0 - 9.0.5 for Joomla
- CVE-2026-10075 Interinfo｜DreamMaker - Path Traversal
- CVE-2026-100749 Joomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gallery extension < 6.5.0
- CVE-2026-100748 Joomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery extension < 6.5.0
- CVE-2026-100747 Joomla Extension - svenbluege.de - CSRF in image upload in Event Gallery extension < 6.5.0
- CVE-2026-100746 coollabsio Coolify GitHub App Setup redirect missing authentication
- CVE-2026-100745 Edimax BR-6428nC Wireless Wizard formWizSurvey stack-based overflow
- CVE-2026-100744 coollabsio Coolify Route-Level Middleware CanUpdateResource.php authorization
- CVE-2026-100741 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in hMailServer
- CVE-2026-100740 D-Link DIR-895L L2TP Control Channel tunnel.c tunnel_set_params out-of-bounds write
- CVE-2026-10074 Interinfo｜DreamMaker - Arbitrary File Read
- CVE-2026-100739 mathurvishal CloudClassroom-PHP-Project viewresult.php sql injection
- CVE-2026-100737 Security feature bypass in ADX1004
- CVE-2026-100730 Grid Protection Alliance openPDC and openHistorian Deserialization of Untrusted Data
- CVE-2026-10073 Interinfo｜DreamMaker - Arbitrary File Read
- CVE-2026-100727 Missing authorization in GROWI
- CVE-2026-100725 http4k before 6.48.0.0 Cookie Scoping Bypass via BasicCookieStorage
- CVE-2026-100724 http4k before 6.49.0.0 Host Header Routing Bypass via reverseProxy
- CVE-2026-100723 vm2 before 3.12.2 Memory Disclosure via zlib Buffer Pool
- CVE-2026-100722 vm2 before 3.12.2 Host Process Termination via Construct Trap
- CVE-2026-100721 vm2 before 3.12.2 Authorization Bypass via Custom Resolver
- CVE-2026-100720 Froxlor before 2.3.12 Stored XSS via SSL certificate issuer
- CVE-2026-10072 Interinfo｜DreamMaker - Arbitrary File Upload
- CVE-2026-100719 Froxlor before 2.3.12 Credential Disclosure via DirProtections API
- CVE-2026-100718 Froxlor before 2.3.12 Authentication Bypass via EmailSender.add
- CVE-2026-100717 froxlor before 2.3.12 CRLF Injection via validateUrl userinfo
- CVE-2026-100716 Froxlor before 2.3.12 Privilege Escalation via Symlink
- CVE-2026-100715 Froxlor before 2.3.12 Arbitrary File Deletion via Symlink
- CVE-2026-100714 Froxlor before 2.3.12 Command Injection via letsencryptchallengepath
- CVE-2026-100713 Froxlor before 2.3.12 Privilege Escalation via SSH Key Sync
- CVE-2026-100712 froxlor before 2.3.12 Two-Factor Authentication Bypass via CSRF
- CVE-2026-100711 froxlor before 2.3.12 Authentication Bypass via Session Persistence