Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 251 of 1013.
- CVE-2026-92138 Auth bypass in Jenkins Bitbucket Server Integration Plugin
- CVE-2026-92137 Path traversal in Jenkins Robot Framework Plugin
- CVE-2026-92136 Cross-site scripting in Jenkins OWASP Dependency-Check Plugin
- CVE-2026-92135 Cross-site scripting in Jenkins Coverage Plugin
- CVE-2026-92134 Cross-site scripting in Jenkins Warnings Plugin
- CVE-2026-92133 Information disclosure in Jenkins GitLab Plugin
- CVE-2026-92132 Server-side request forgery in Jenkins Gradle Plugin
- CVE-2026-92131 Path traversal in Jenkins Pipeline: Groovy Libraries Plugin
- CVE-2026-92130 Missing authorization in Jenkins Pipeline: Multibranch Plugin
- CVE-2026-9213 Insufficient input validation in certain NETGEAR routers
- CVE-2026-92129 Security feature bypass in Jenkins Script Security Plugin
- CVE-2026-92128 Code injection in Jenkins Script Security Plugin
- CVE-2026-92127 Code injection in Jenkins Script Security Plugin
- CVE-2026-92126 Code injection in Jenkins Script Security Plugin
- CVE-2026-92125 Code injection in Jenkins Script Security Plugin
- CVE-2026-92124 Security feature bypass in Jenkins Script Security Plugin
- CVE-2026-92123 Security feature bypass in Jenkins Script Security Plugin
- CVE-2026-92122 Security feature bypass in Jenkins Script Security Plugin
- CVE-2026-92121 Apache WSS4J: WS-SecurityPolicy signature checks skipped in the streaming code after an STR-Transform reference
- CVE-2026-92120 Apache Allura: Oauth1 Replay Attack
- CVE-2026-9212 Insufficient authentication and input validation in certain NETGEAR products
- CVE-2026-92119 Apache Allura: REST API Mass Assignment
- CVE-2026-92116 Apache Allura: OAuth1 missing callback validation
- CVE-2026-92115 Command injection in WP Photo Album Plus
- CVE-2026-92114 a2ui-project a2ui Basic Catalog safe_regex.ts redos
- CVE-2026-9211 Certain NETGEAR routers allow unauthenticated users to gain control of the router
- CVE-2026-92106 lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS
- CVE-2026-92103 Mint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max_frame_size
- CVE-2026-9210 Certain NETGEAR routers allow authenticated administrators to gain unintended control of the router
- CVE-2026-92099 WPGraphQL Smart Cache < 2.3.2 - Unauthenticated Persisted Query Registration and Alias Squatting
- CVE-2026-92098 Cross-site scripting in Webheadcoder Multi-Step Forms for Contact Form 7
- CVE-2026-92097 Click to Chat <= 4.44 - Unauthenticated Arbitrary Shortcode Execution via REQUEST_URI via {url} Placeholder
- CVE-2026-92092 Supply chain in Red Hat OpenShift Container Platform 4
- CVE-2026-92091 Jwcrypto: jwcrypto: denial of service via o(n^2) duplicate check on unbounded jwk key_ops array
- CVE-2026-9209 mJobTime 15.7.3.32 Unauthenticated SQL Execution RCE via Login.aspx
- CVE-2026-92088 Privilege escalation in upKeeper Instant Privilege Access
- CVE-2026-92087 @fastify/auth vulnerable to Authorization Bypass via order-dependent evaluation of composed auth
- CVE-2026-92086 MW WP Form <= 5.1.7 - Unauthenticated Sensitive Information Exposure in 'post_id' Parameter
- CVE-2026-92085 Stored XSS in TMT Machine's Talassoft Industrial Management Software
- CVE-2026-92084 Code injection in Beaver Builder Page Builder – Drag and Drop Website Builder
- CVE-2026-92082 Payara Server is vulnerable to brute-force login attacks due to the absence of a limit on failed login attempts
- CVE-2026-92081 fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses
- CVE-2026-9208 Tanium addressed an unauthorized code execution vulnerability in Connect.
- CVE-2026-92079 Mitigation bypass in the Widget: Win32 component
- CVE-2026-92078 Denial-of-service in the Security component
- CVE-2026-92077 Denial-of-service in the SVG component
- CVE-2026-92076 Incorrect boundary conditions in the Networking component
- CVE-2026-92075 Mitigation bypass in the Networking component
- CVE-2026-92074 Mitigation bypass in the Popup Blocker component
- CVE-2026-92073 Privilege escalation in the Enterprise Policies component
- CVE-2026-92072 Incorrect boundary conditions in the Safe Browsing component
- CVE-2026-92071 Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component
- CVE-2026-92070 Information disclosure in the Networking component
- CVE-2026-9207 Tanium addressed an unauthorized code execution vulnerability in Connect.
- CVE-2026-92069 Spoofing issue in the DOM: Navigation component
- CVE-2026-92068 Site isolation issue in the Reader Mode component
- CVE-2026-92067 Use-after-free in the Widget: Gtk component
- CVE-2026-92066 Sandbox escape in the Profile Backup component
- CVE-2026-92065 Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component
- CVE-2026-92064 Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component
- CVE-2026-92063 Denial-of-service in the Audio/Video component
- CVE-2026-92062 Privilege escalation in the Session Restore component
- CVE-2026-92061 Incorrect boundary conditions in the Security: Process Sandboxing component
- CVE-2026-92060 Use-after-free in the Internationalization component
- CVE-2026-92059 Incorrect boundary conditions in the DOM: Editor component
- CVE-2026-92058 Use-after-free in the Graphics component
- CVE-2026-92057 Mitigation bypass in the Enterprise Policies component
- CVE-2026-92056 Use-after-free in the Graphics: Text component
- CVE-2026-92055 Privilege escalation in the DevTools component
- CVE-2026-92054 Privilege escalation in the Memory component
- CVE-2026-92053 Privilege escalation in the Graphics: CanvasWebGL component
- CVE-2026-92052 Privilege escalation due to uninitialized memory in the Graphics: CanvasWebGL component
- CVE-2026-92051 Spoofing issue due to invalid pointer in the Graphics component
- CVE-2026-92050 Sandbox escape due to race condition in the XPConnect component
- CVE-2026-9205 Langflow is affected by weaknesses in secret handling and sensitive configuration access
- CVE-2026-92049 Use-after-free in the Widget: Win32 component
- CVE-2026-92048 Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component
- CVE-2026-92047 Privilege escalation in the Crash Reporting component
- CVE-2026-92046 Use-after-free in the Graphics component
- CVE-2026-92045 Sandbox escape due to incorrect boundary conditions in the WebRTC component
- CVE-2026-92044 Information disclosure in the Networking: HTTP component
- CVE-2026-92043 Privilege escalation due to incorrect boundary conditions in the Audio/Video component
- CVE-2026-92042 Race condition in the DOM: Content Processes component
- CVE-2026-92041 Mitigation bypass in the DOM: Networking component
- CVE-2026-92040 Use-after-free in the JavaScript: WebAssembly component
- CVE-2026-9204 Server-Side Request Forgery (SSRF) in GitLab
- CVE-2026-92039 Mitigation bypass in the DOM: Notifications component
- CVE-2026-92038 Mitigation bypass in the Remote Settings Client component
- CVE-2026-92037 Incorrect boundary conditions in the DOM: Animation component
- CVE-2026-92036 Incorrect boundary conditions in the Networking: HTTP component
- CVE-2026-92035 Sandbox escape due to incorrect boundary conditions in the Graphics component
- CVE-2026-92034 Site isolation issue in the Graphics component
- CVE-2026-92033 Privilege escalation in Firefox for Android
- CVE-2026-92032 Sandbox escape due to invalid pointer in the Graphics component
- CVE-2026-92031 Information disclosure in the Graphics: ImageLib component
- CVE-2026-92030 Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component
- CVE-2026-9203 Server-side request forgery in Progress MarkLogic Server
- CVE-2026-92029 Use-after-free in the SVG component
- CVE-2026-92028 Use-after-free in the DOM: Core & HTML component
- CVE-2026-92027 Use-after-free in the DOM: Streams component