Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 254 of 1013.
- CVE-2026-9178 WP Forms Connector <= 1.8 - Missing Authorization to Unauthenticated Information Exposure via 'user/list' REST Endpoint
- CVE-2026-91779 GNU Binutils Eh Frame elf-eh-frame.c _bfd_elf_eh_frame_section_offset null pointer dereference
- CVE-2026-91778 Missing authorization in Octopus Server
- CVE-2026-91777 jackson-databind: quadratic forward-reference completion in Collection and Map deserializers
- CVE-2026-91776 jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID
- CVE-2026-91775 LimeSurvey Community Edition 7.0.14 - Reflected XSS through unescaped LSS survey-import warnings
- CVE-2026-91774 Yao through v1.0.0-rc22 Missing Authorization via OpenAPI team endpoint
- CVE-2026-91773 Soft Serve 0.7.1 through 0.11.6 Information Disclosure via LFS Locks
- CVE-2026-91772 Halo through 2.26.1 Open Redirect via Unvalidated URI Parameter
- CVE-2026-91771 Weights & Biases wandb before 0.29.0 Path Traversal via File Download
- CVE-2026-91770 IceHRM before 36.0.0 Broken Access Control via Employee ID
- CVE-2026-9177 Server-Side Template Injection in SecureTransport's Apache Velocity mail templates
- CVE-2026-91769 TLS Hostname Verification Falls Back to CN After SAN Mismatch
- CVE-2026-91768 IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)
- CVE-2026-91767 Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN
- CVE-2026-91766 Cross-origin credential leak in HTTP stream wrapper redirects
- CVE-2026-91765 SOAP: Unbounded Recursion in Server-Side cleanup_xml_node
- CVE-2026-9176 IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
- CVE-2026-91752 GNU libextractor before 1.15 Stack Overflow via OLE2
- CVE-2026-91751 Flextype CMS through 1.0.0-alpha.3 Path Traversal via Entries REST API
- CVE-2026-91750 WeKnora before 0.7.0 SSRF via Unvalidated HTTP Redirects
- CVE-2026-9175 Devs Accounting <= 1.2.0 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'id' Parameter
- CVE-2026-91749 Use after free in Chrome
- CVE-2026-91748 Race condition in Chrome
- CVE-2026-91747 Use after free in Chrome
- CVE-2026-91746 Integer overflow in Chrome
- CVE-2026-91745 Use after free in Chrome
- CVE-2026-91744 Race condition in Chrome
- CVE-2026-91743 Race condition in Chrome
- CVE-2026-91742 Security feature bypass in Chrome
- CVE-2026-91741 Memory corruption in Chrome
- CVE-2026-91740 Information disclosure in Chrome
- CVE-2026-91739 Missing authorization in Chrome
- CVE-2026-91738 Other in Chrome
- CVE-2026-91737 Use after free in Chrome
- CVE-2026-91736 Use after free in Chrome
- CVE-2026-91735 Missing authorization in Chrome
- CVE-2026-91734 Missing authorization in Chrome
- CVE-2026-91733 Information disclosure in Chrome
- CVE-2026-91732 Missing authorization in Chrome
- CVE-2026-91731 Memory corruption in Chrome
- CVE-2026-91730 Information disclosure in Chrome
- CVE-2026-91729 Use after free in Chrome
- CVE-2026-91728 Integer overflow in Chrome
- CVE-2026-91727 Code injection in Chrome
- CVE-2026-91726 Memory corruption in Chrome
- CVE-2026-91725 Information disclosure in Chrome
- CVE-2026-91724 Use after free in Chrome
- CVE-2026-91723 Race condition in Chrome
- CVE-2026-91722 Use after free in Chrome
- CVE-2026-91721 Use after free in Chrome
- CVE-2026-91720 Information disclosure in Chrome
- CVE-2026-9172 Devs Accounting <= 1.2.0 - Missing Authorization to Unauthenticated Account Deletion via /delete-account/ REST Endpoint
- CVE-2026-91719 Code injection in Chrome
- CVE-2026-91718 Use after free in Chrome
- CVE-2026-91717 Missing authorization in Chrome
- CVE-2026-91716 Use after free in Chrome
- CVE-2026-91715 Memory corruption in Chrome
- CVE-2026-91714 Information disclosure in Chrome
- CVE-2026-91713 Missing authorization in Chrome
- CVE-2026-91712 Race condition in Chrome
- CVE-2026-91711 Memory corruption in Chrome
- CVE-2026-91710 Use after free in Chrome
- CVE-2026-9171 Vulnerabilities in IBM WebSphere Application affects IBM PowerVM Novalink.
- CVE-2026-91709 Memory corruption in Chrome
- CVE-2026-91708 Race condition in Chrome
- CVE-2026-91707 Missing authorization in Divi
- CVE-2026-9170 IBM HTTP Server is affected by multiple vulnerabilities
- CVE-2026-9169 LUCID Vision Labs: DLL Search Order Hijacking in Arena SDK 1.0.80.49 on Windows
- CVE-2026-91668 Privilege escalation in Oracle Data Integrator
- CVE-2026-91665 Auth bypass in Oracle Essbase
- CVE-2026-91664 Denial of service in Oracle Essbase
- CVE-2026-91663 Missing authorization in Oracle Essbase
- CVE-2026-91662 Missing authorization in Oracle Essbase
- CVE-2026-91661 Information disclosure in Oracle Essbase
- CVE-2026-91660 Denial of service in Oracle Essbase
- CVE-2026-9166 LFI in GIS Informatics' GisLab Laboratory Management System
- CVE-2026-91659 Missing authorization in Oracle Essbase
- CVE-2026-91658 Missing authorization in Oracle Essbase
- CVE-2026-91657 Information disclosure in Oracle Essbase
- CVE-2026-91656 Missing authorization in Oracle Essbase
- CVE-2026-91655 Missing authorization in Oracle Essbase
- CVE-2026-91654 Missing authorization in Oracle Essbase
- CVE-2026-91653 Missing authorization in Oracle Essbase
- CVE-2026-91652 Information disclosure in Oracle Essbase
- CVE-2026-91651 Missing authorization in Oracle Essbase
- CVE-2026-91650 Information disclosure in Oracle Essbase
- CVE-2026-9165 Stackrox: stackrox: unbounded graphql query depth allows authenticated denial of service
- CVE-2026-91649 Privilege escalation in Oracle Essbase
- CVE-2026-91648 Information disclosure in Oracle Essbase
- CVE-2026-91647 Missing authorization in Oracle Essbase
- CVE-2026-91646 Missing authorization in Oracle Essbase
- CVE-2026-91645 Information disclosure in Oracle Essbase
- CVE-2026-91644 Missing authorization in Oracle Essbase
- CVE-2026-91643 Information disclosure in Oracle Essbase
- CVE-2026-91642 Missing authorization in Oracle Essbase
- CVE-2026-91641 Information disclosure in Oracle Essbase
- CVE-2026-91640 Information disclosure in Oracle Essbase
- CVE-2026-91639 Information disclosure in Oracle Essbase
- CVE-2026-91638 Missing authorization in Oracle Essbase