Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 1005 of 1013.
- CVE-2026-100174 Stored Cross-Site Scripting (XSS) in AIL Framework Tag Selector via Unescaped Tag Names
- CVE-2026-100172 Cross-site scripting in ail framework
- CVE-2026-10017 Memory corruption in Chrome
- CVE-2026-100169 Account pre-hijacking in the Prowler API through email based social account linking without verification
- CVE-2026-100164 User Enumeration in Rolantis Information Technologies' Agentis
- CVE-2026-100163 Auth bypass in Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
- CVE-2026-100161 Cross-site scripting in Photo Reviews for WooCommerce
- CVE-2026-10016 Use after free in Chrome
- CVE-2026-100159 Popup Box 6.4.1 - 6.4.2 - Unauthenticated Arbitrary Shortcode Execution via Client-IP / X-Forwarded-For HTTP Headers
- CVE-2026-100158 Cross-site scripting in SQL Chart Builder
- CVE-2026-100157 Code injection in WP Ultimate Review
- CVE-2026-100153 NewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via URL Request Tracking (urlrequested field)
- CVE-2026-100152 All in One SEO <= 5.0.2 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Query Parameter
- CVE-2026-10015 Integer overflow in Chrome
- CVE-2026-100149 Information disclosure in WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons
- CVE-2026-100148 Cross-site scripting in Rich Showcase for Google Reviews
- CVE-2026-100147 FunnelKit <= 3.16.0.5 - Unauthenticated Stored Cross-Site Scripting via Order Fields (shipping/billing)
- CVE-2026-100145 Synchrony Financing 1.0.5 - 1.1.1 - Unauthenticated Order Takeover via admin_order_callback REST Route
- CVE-2026-100143 FluentCart < 1.6.5 - Unauthenticated Guest Customer Account Takeover via Checkout Email
- CVE-2026-100142 FluentCart < 2.2.0 - Unauthenticated Customer Address Disclosure via IDOR
- CVE-2026-10014 Use after free in Chrome
- CVE-2026-100139 CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)
- CVE-2026-100138 CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)
- CVE-2026-100137 CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)
- CVE-2026-100136 CAI Content Credentials | Integer Overflow or Wraparound (CWE-190)
- CVE-2026-100135 CAI Content Credentials | Improper Input Validation (CWE-20)
- CVE-2026-100134 Acrobat for Edge | Out-of-bounds Write (CWE-787)
- CVE-2026-100133 Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-100132 Acrobat for Edge | Out-of-bounds Read (CWE-125)
- CVE-2026-100131 Substance3D - Sampler | Out-of-bounds Read (CWE-125)
- CVE-2026-100130 Substance3D - Sampler | Out-of-bounds Read (CWE-125)
- CVE-2026-10013 Use after free in Chrome
- CVE-2026-100129 Bridge | Out-of-bounds Write (CWE-787)
- CVE-2026-100128 Bridge | Out-of-bounds Write (CWE-787)
- CVE-2026-100127 Bridge | Out-of-bounds Write (CWE-787)
- CVE-2026-100126 Bridge | Out-of-bounds Read (CWE-125)
- CVE-2026-100125 CAI Content Credentials | Improper Input Validation (CWE-20)
- CVE-2026-100124 CAI Content Credentials | Improper Input Validation (CWE-20)
- CVE-2026-100123 CAI Content Credentials | Improper Certificate Validation (CWE-295)
- CVE-2026-100122 CAI Content Credentials | Improper Certificate Validation (CWE-295)
- CVE-2026-100121 CAI Content Credentials | Improper Certificate Validation (CWE-295)
- CVE-2026-100120 CAI Content Credentials | Improper Input Validation (CWE-20)
- CVE-2026-10012 Use after free in Chrome
- CVE-2026-100119 CAI Content Credentials | Improper Input Validation (CWE-20)
- CVE-2026-100118 CAI Content Credentials | Improper Certificate Validation (CWE-295)
- CVE-2026-100117 CAI Content Credentials | Improper Input Validation (CWE-20)
- CVE-2026-100116 CAI Content Credentials | Improper Certificate Validation (CWE-295)
- CVE-2026-100115 CAI Content Credentials | Improper Access Control (CWE-284)
- CVE-2026-100114 CAI Content Credentials | Improper Access Control (CWE-284)
- CVE-2026-100113 CAI Content Credentials | Improper Input Validation (CWE-20)
- CVE-2026-100112 Photoshop Desktop | Out-of-bounds Write (CWE-787)
- CVE-2026-100111 Photoshop Desktop | Out-of-bounds Write (CWE-787)
- CVE-2026-10011 Information disclosure in Chrome
- CVE-2026-100108 Social Share Buttons <= 1.30 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'share_url' Network Setting
- CVE-2026-100107 Cross-site scripting in Kubio AI Page Builder
- CVE-2026-100106 FiboSearch <= 1.34.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'purchased_plan' Parameter
- CVE-2026-100105 Alerting contact point authorization bypass via schema downgrade
- CVE-2026-100104 Server-Side Request Forgery (SSRF) in GitLab
- CVE-2026-100103 Authentication bypass via default auth token in P4Search
- CVE-2026-100102 RCE via exposed JDWP debug agent in P4Search
- CVE-2026-10010 Security feature bypass in Chrome
- CVE-2026-1001 Domoticz < 2026.1 Stored XSS via Hardware Configuration Endpoint
- CVE-2026-10009 Integer overflow in Chrome
- CVE-2026-10008 Information disclosure in Chrome
- CVE-2026-100079 usb: typec: ucsi: unregister debugfs entries on teardown
- CVE-2026-100078 wifi: iwlwifi: mei: pass correct argument to function
- CVE-2026-100077 drm/msm: Recover HW before retire hung submit
- CVE-2026-100076 staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths
- CVE-2026-100075 RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters
- CVE-2026-100074 bpf: Mark bpf_refcount field as unique
- CVE-2026-100073 ext4: fix transaction overflow during writeback
- CVE-2026-100072 ACPI: platform: Use acpi_bus_get_primary_device()
- CVE-2026-100071 net: hsr: free learned nodes on device setup failure
- CVE-2026-100070 netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet
- CVE-2026-10007 Use after free in Chrome
- CVE-2026-10006 Race condition in Chrome
- CVE-2026-10005 Use after free in Chrome
- CVE-2026-10004 Other in Chrome
- CVE-2026-10003 Use after free in Chrome
- CVE-2026-10002 Use after free in Chrome
- CVE-2026-10001 Use after free in Chrome
- CVE-2026-10000 Use after free in Chrome
- CVE-2026-1000 MailerLite - WooCommerce integration <= 3.1.3 - Missing Authorization to Data Deletion
- CVE-2026-0999 Authentication bypass via userID login when email and username login are disabled
- CVE-2026-0998 Mattermost Zoom Plugin allows unauthorized meeting creation and post modification via insufficient API access controls
- CVE-2026-0997 Mattermost Zoom Plugin channel preference API lacks authorization checks
- CVE-2026-0996 Fluent Forms <= 6.1.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via AI Form Builder Module
- CVE-2026-0995 Race condition in C1 Pro
- CVE-2026-0994 Denial of Service in Python Protobuf
- CVE-2026-0993 SODOLA SL902-SWTGW124AS Buffer Overflow DoS via Multipart Boundary Parser
- CVE-2026-0992 Libxml2: libxml2: denial of service via crafted xml catalogs
- CVE-2026-0990 Libxml2: libxml2: denial of service via uncontrolled recursion in xml catalog processing
- CVE-2026-0989 Libxml2: unbounded relaxng include recursion leading to stack overflow
- CVE-2026-0988 Glib: glib: denial of service via integer overflow in g_buffered_input_stream_peek()
- CVE-2026-0983 Denial of service vulnerability in M-Files Server
- CVE-2026-0980 Rubyipmi: red hat satellite: remote code execution in rubyipmi via malicious bmc username
- CVE-2026-0977 IBM CICS Transaction Gateway for Multiplatforms Information Disclosure
- CVE-2026-0976 Org.keycloak/keycloak-quarkus-server: keycloak: proxy bypass due to improper handling of matrix parameters in url paths
- CVE-2026-0975 DIAView - Command Injection Vulnerability
- CVE-2026-0974 Orderable <= 1.20.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation