Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 199 of 1013.
- GHSA-2jx3-ff3v-j7jj yara-x: Unvalidated deserialization in safe `Rules::deserialize` allows memory corruption and UB
- GHSA-2jx3-65f3-xr8r `OTPHP\Factory::loadFromProvisioningUri()` parses an attacker-supplied `otpauth://` URI and forwards **every** query key to `OTP:
- GHSA-2j22-pr5w-6gq8 Loofah has improper detection of disallowed URIs via `allowed_uri?`
- GHSA-2hm8-rqrm-xfjq OpenClaw's owner-only gateway tool access checks were incomplete in specific authenticated DM flows
- GHSA-2g87-pp6c-29x5 aiohttp: Multiple instances of excessive or unbounded memory/CPU use
- GHSA-2ch6-x3g4-7759 OpenClaw's commands.allowFrom sender authorization accepted conversation identifiers via ctx.From
- GHSA-2ccx-cjjh-r2j8 MediaMTX affected by CVE-2026-27143 due to vulnerable dependency
- GHSA-2c85-rfcc-g74j Karate Mock Server RCE via embedded expression evaluation of request-derived data
- GHSA-2c6h-4899-wjxr Multiple soundness issues in `scaly` safe APIs
- GHSA-29h2-jr22-frmh Impact Two locations consume an encrypted handle returned by an untrusted external party and use it without verifying that the party is ACL-authorized on it.
- GHSA-2944-57xv-2682 @asymmetric-effort/specifyjs: `data:` URI allowed without size restriction
- GHSA-28xx-pppm-vqff Impact Transactions were NOT committed despite the explicit `options.WithCommit` flag using table service client.
- GHSA-2858-xg23-26fp OpenClaw: Node camera URL payload host-binding bypass allowed gateway fetch pivots
- GHSA-27qh-8cxx-2cr5 AWS SDK for PHP has CloudFront Policy Document Injection via Special Characters
- GHSA-27jp-wm6q-gp25 sqlparse: formatting list of tuples leads to denial of service
- GHSA-27f5-xjrr-q9ff Malware in @opensearch-project/opensearch
- GHSA-26wg-9xf2-q495 Novu has a XSS sanitization bypass
- GHSA-26w7-cxv4-gfx2 Astro: Remote code execution through AVIF image optimization
- GHSA-26gq-grmh-6xm6 Gogs vulnerable to Stored XSS via Mermaid diagrams
- GHSA-2625-rw7m-5q5x Hubuum client library (Rust): Sensitive data may be exposed through default diagnostics
- GHSA-258c-965c-p3hc Daptin's Session Management Vulnerability Leads to Insufficient Session Expiration After Password Change
- GHSA-253c-mchw-3w2r Two independent quadratic paths in the `linkify: true` handling.
- GHSA-248h-974q-xrc2 axonflow-sdk-java: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification
- GHSA-2464-fhr4-w9xw Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used
- GHSA-22w5-2fxg-vrwx Impact Unauthenticated denial of service.
- GHSA-22w3-693w-x895 webauthn-rs-core/webauthn-authenticator-rs: Origin validation mismatch possible when subdomains are allowed
- GHSA-22vx-2x23-98w6 OpenSearch vulnerable to improper authorization for Rollover Requests
- DRUPAL-CORE-2026-013 The Drupal project uses the [CKEditor](https://github.com/ckeditor/ckeditor5) library for WYSIWYG editing.
- DRUPAL-CONTRIB-2026-265 This module enables you to use the Stripe Connect API to quickly configure your Drupal Commerce store to take payments via multiple Stripe APIs.
- DRUPAL-CONTRIB-2026-246 TinyPNG uses smart lossy compression techniques to reduce the file size of your PNG files.
- CVE-2026-99999 ipv4: validate checksum_start before completing checksum
- CVE-2026-9999 Privilege escalation in Chrome
- CVE-2026-9998 Integer overflow in Chrome
- CVE-2026-9997 Use after free in Chrome
- CVE-2026-9996 Memory corruption in Chrome
- CVE-2026-9995 Use after free in Chrome
- CVE-2026-9994 Use after free in Chrome
- CVE-2026-9993 Use after free in Chrome
- CVE-2026-9992 Use after free in Chrome
- CVE-2026-9991 Information disclosure in Chrome
- CVE-2026-9990 Use after free in Chrome
- CVE-2026-9989 Security feature bypass in Chrome
- CVE-2026-9988 Use after free in Chrome
- CVE-2026-9987 Code injection in Chrome
- CVE-2026-9986 Other in Chrome
- CVE-2026-9985 Information disclosure in Chrome
- CVE-2026-9984 Use after free in Chrome
- CVE-2026-9983 Memory corruption in Chrome
- CVE-2026-9982 Security feature bypass in Chrome
- CVE-2026-9981 Information disclosure in Chrome
- CVE-2026-9980 Security feature bypass in Chrome
- CVE-2026-9979 Security feature bypass in Chrome
- CVE-2026-9978 Use after free in Chrome
- CVE-2026-9977 Security feature bypass in Chrome
- CVE-2026-9976 Code injection in Chrome
- CVE-2026-9975 Memory corruption in Chrome
- CVE-2026-9974 Memory corruption in Chrome
- CVE-2026-9973 Memory corruption in Chrome
- CVE-2026-9972 Memory corruption in Chrome
- CVE-2026-9971 Cross-site scripting in Chrome
- CVE-2026-9970 Use after free in Chrome
- CVE-2026-9969 Other in Chrome
- CVE-2026-9968 Integer overflow in Chrome
- CVE-2026-9967 Memory corruption in Chrome
- CVE-2026-9966 Integer overflow in Chrome
- CVE-2026-9965 Memory corruption in Chrome
- CVE-2026-9964 Use after free in Chrome
- CVE-2026-9963 Memory corruption in Chrome
- CVE-2026-9962 Use after free in Chrome
- CVE-2026-9961 Use after free in Chrome
- CVE-2026-9960 Integer overflow in Chrome
- CVE-2026-9959 Race condition in Chrome
- CVE-2026-9958 Use after free in Chrome
- CVE-2026-9957 Use after free in Chrome
- CVE-2026-9956 Use after free in Chrome
- CVE-2026-9955 Information disclosure in Chrome
- CVE-2026-9954 Use after free in Chrome
- CVE-2026-9953 Memory corruption in Chrome
- CVE-2026-9952 Use after free in Chrome
- CVE-2026-9951 Use after free in Chrome
- CVE-2026-9950 Security feature bypass in Chrome
- CVE-2026-9949 Use after free in Chrome
- CVE-2026-9948 Use after free in Chrome
- CVE-2026-9947 Use after free in Chrome
- CVE-2026-9946 Use after free in Chrome
- CVE-2026-9945 Use after free in Chrome
- CVE-2026-9944 Information disclosure in Chrome
- CVE-2026-9943 Memory corruption in Chrome
- CVE-2026-9942 Memory corruption in Chrome
- CVE-2026-9941 Use after free in Chrome
- CVE-2026-9940 Memory corruption in Chrome
- CVE-2026-9939 Memory corruption in Chrome
- CVE-2026-9938 Code injection in Chrome
- CVE-2026-9937 Use after free in Chrome
- CVE-2026-9936 Use after free in Chrome
- CVE-2026-9935 Information disclosure in Chrome
- CVE-2026-9934 Use after free in Chrome
- CVE-2026-9933 Use after free in Chrome
- CVE-2026-9932 Use after free in Chrome
- CVE-2026-9931 Use after free in Chrome