Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 252 of 1013.
- CVE-2026-92026 Use-after-free in the Networking component
- CVE-2026-92025 Use-after-free in the DOM: Navigation component
- CVE-2026-92024 Use-after-free in the SVG component
- CVE-2026-92023 Use-after-free in the XML component
- CVE-2026-92022 Use-after-free in the DOM: HTML Parser component
- CVE-2026-92021 Use-after-free in the JavaScript Engine: JIT component
- CVE-2026-92020 Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component
- CVE-2026-9202 Unauthenticated User Registration Could Lead to Remote Code Execution
- CVE-2026-92019 Mitigation bypass in the Remote Settings Client component
- CVE-2026-92018 Sandbox escape in the DOM: Core & HTML component
- CVE-2026-92017 Privilege escalation in the DOM: Service Workers component
- CVE-2026-92016 Use-after-free in the Disability Access APIs component
- CVE-2026-92015 Privilege escalation in the WebExtensions component
- CVE-2026-92014 Privilege escalation due to incorrect boundary conditions in the Graphics component
- CVE-2026-92013 Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
- CVE-2026-92012 Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
- CVE-2026-92011 Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
- CVE-2026-92010 Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
- CVE-2026-9201 Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling
- CVE-2026-92009 Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
- CVE-2026-92008 Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
- CVE-2026-92007 Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
- CVE-2026-92006 Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
- CVE-2026-92005 Use-after-free in the Audio/Video: Web Codecs component
- CVE-2026-92003 MISP Unthrottled Authentication Failure Log Writes Enable Resource Exhaustion
- CVE-2026-92002 MISP: Authentication failure logging suppressed during Redis unavailability
- CVE-2026-92001 Apache Sling XSS: Missing parser resource limits
- CVE-2026-92000 adm-zip 0.5.14 through 0.6.0 Denial of Service via Zero Declared Uncompressed Size
- CVE-2026-9200 Query Shortcode <= 0.2.1 - Authenticated (Contributor+) Local File Inclusion via 'lens' Shortcode Attribute
- CVE-2026-91999 Apache Sling XSS: Improper escaping in the XSS Webconsole plugin
- CVE-2026-91998 Casdoor through 4.4.0 Cross-Organization User Administration via /api/mcp
- CVE-2026-91997 evolution-api through 2.3.7 Prometheus Metrics IP Allowlist Bypass
- CVE-2026-91996 lamp-cloud through 5.10.0 Missing Authentication for JVM Properties Endpoint
- CVE-2026-91995 pig before 4.1.0 Unverified Password Change via /register/password
- CVE-2026-91994 Semaphore UI through 2.19.12 Missing Authorization on GET and HEAD Requests
- CVE-2026-91993 Jpom through 2.11.12 Workspace Isolation Bypass via /build/branch-list
- CVE-2026-91992 Tornado before 6.5.7 Credential Leak via Handle Reuse
- CVE-2026-91991 Tornado before 6.5.8 Cookie Attribute Injection via Capitalized kwargs
- CVE-2026-91990 Tornado before 6.5.8 Memory Amplification DoS via multipart
- CVE-2026-9199 Missing authorization in Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance
- CVE-2026-91989 atomic-agents-stack before 1.1.0 Path Traversal via dashboard serve.py
- CVE-2026-91988 atomic-agents-stack before 1.1.0 Remote Code Execution via HTTP MCP
- CVE-2026-91987 atomic-agents-stack before 1.1.0 Cost Guardrail Bypass via Unknown Model
- CVE-2026-91986 gitoxide gix-transport before 0.59.2 CR/LF/NUL Injection
- CVE-2026-91985 Vikunja before 2.6.0 Privilege Escalation via Link Share Hash
- CVE-2026-91984 Vikunja before 2.6.0 Broken Object-Level Authorization via task-position
- CVE-2026-91983 Vikunja before 2.6.0 API Token Scope Bypass via expand Parameter
- CVE-2026-91982 Vikunja before 2.6.0 TOTP Secret Disclosure via API
- CVE-2026-91981 Vikunja before 2.6.0 User Enumeration via v2 API
- CVE-2026-91980 vikunja before 2.6.0 Team Enumeration via Project Share
- CVE-2026-9198 IBM Langflow Code Injection
- CVE-2026-91979 Vikunja before 2.6.0 Denial of Service via Decompression Bomb
- CVE-2026-91973 Vikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuth
- CVE-2026-91972 Vikunja before 2.6.0 Authentication Bypass via Unthrottled API
- CVE-2026-91971 Vikunja before 2.6.0 Denial of Service via Avatar Upload
- CVE-2026-91970 Vikunja before 2.6.0 Resource Exhaustion via Planka Migration
- CVE-2026-9197 Path traversal in Smart Slider 3
- CVE-2026-91969 vikunja before 2.6.0 Resource Exhaustion via CSV Migration
- CVE-2026-91968 vikunja before 2.6.0 Denial of Service via unbounded filter recursion
- CVE-2026-91967 AVideo through 29.0 Blind SSRF via getHeaderContentTypeFromURL
- CVE-2026-91966 AVideo through 29.0 Unauthenticated SSRF via Host Header
- CVE-2026-91965 WWBN AVideo through 29.0 Broken Access Control via Live Endpoints
- CVE-2026-91964 FreeRDP 2.0.0 through 3.30.0 Heap Buffer Overflow via RoutingToken
- CVE-2026-91963 FreeRDP 2.0.0 through 3.30.0 Uninitialized Heap Memory Disclosure via urbdrc
- CVE-2026-91962 FreeRDP before 3.31.0 Integer Overflow via audin Apple backends
- CVE-2026-91961 FreeRDP before 3.31.0 Denial of Service via URBDRC
- CVE-2026-91960 FreeRDP before 3.31.0 Integer Overflow Double Free
- CVE-2026-9196 Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling
- CVE-2026-91959 FreeRDP before 3.31.0 Buffer Over-read via RTS Gateway
- CVE-2026-91958 FreeRDP 3.11.0 through 3.30.0 Heap Buffer Overflow via Monitor Index
- CVE-2026-91957 FreeRDP before 3.31.0 Use-After-Free via smartcard worker
- CVE-2026-91956 FreeRDP before 3.31.0 Out-of-Bounds Read via URBDRC
- CVE-2026-91955 FreeRDP before 3.31.0 Denial of Service via Desktop Dimensions
- CVE-2026-91954 FreeRDP before 3.31.0 NULL Pointer Dereference via NSCodec
- CVE-2026-91953 FreeRDP before 3.31.0 Heap Buffer Overflow via LB_LOAD_BALANCE_INFO
- CVE-2026-91952 FreeRDP before 3.31.0 Denial of Service via pool_decode_rect
- CVE-2026-91951 FreeRDP 3.14.0 through 3.30.0 Out-of-bounds Write via urbdrc
- CVE-2026-91950 FreeRDP before 3.31.0 Out-of-Bounds Read via UINT32 Wraparound
- CVE-2026-9195 Cross-site scripting in Progress MarkLogic Server Query Console
- CVE-2026-91949 FreeRDP 3.0.0 through 3.30.0 Protocol Negotiation Bypass
- CVE-2026-91948 FreeRDP before 3.31.0 Out-of-bounds Write via SHOW_PROTOCOL
- CVE-2026-91947 FreeRDP Server before 3.31.0 Use-After-Free via DRDYNVC
- CVE-2026-91946 FreeRDP before 3.31.0 Information Disclosure via RDPGFX ResetGraphics
- CVE-2026-91945 FreeRDP before 3.31.0 Out-of-bounds Read via Smartcard ATR
- CVE-2026-91944 crawl4ai before 0.9.3 DOM-based XSS via Playground UI
- CVE-2026-91943 Crawl4AI before 0.9.3 SSRF via PDFContentScrapingStrategy
- CVE-2026-91942 crawl4ai before 0.9.3 Cross-Site Scripting via innerHTML
- CVE-2026-91941 Crawl4AI before 0.9.3 Denial of Service via PDFContentScrapingStrategy
- CVE-2026-91940 crawl4ai before 0.9.3 Arbitrary File Write via PDFContentScrapingStrategy
- CVE-2026-91939 Cotonti 1.0.0 Comments Plugin PHP Object Injection via ci Parameter
- CVE-2026-91938 Flowise before 3.1.4 Server-Side Request Forgery via document loaders
- CVE-2026-91937 Flowise before 3.1.4 NoSQL Injection via sessionId
- CVE-2026-91936 Flowise before 3.1.4 Script Injection via Docker Workflows
- CVE-2026-91935 Flowise before 3.1.4 SSRF and API Key Exfiltration via Chat Model Nodes
- CVE-2026-91934 Flowise before 3.1.4 Remote Code Execution via SQL Database Chain
- CVE-2026-91933 Flowise before 3.1.4 Authorization Bypass via openai-realtime
- CVE-2026-91932 Flowise before 3.1.4 Remote Code Execution via cwd Parameter
- CVE-2026-91931 Flowise before 3.1.4 Remote Code Execution via Custom MCP npx
- CVE-2026-91930 Flowise before 3.1.4 Cross-Tenant Organization Admin Takeover
- CVE-2026-9193 Privilege escalation in Progress MarkLogic Server Hadoop integration