Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 259 of 1013.
- CVE-2026-9121 Memory corruption in Chrome
- CVE-2026-91209 Other in Oracle Solaris
- CVE-2026-91208 Denial of service in Oracle Solaris
- CVE-2026-91206 Apache Roller: Reflected XSS in the optional LDAP comment authenticator
- CVE-2026-91205 Cockpit-files: cockpit-files: local attacker can hijack file ownership via symlink race
- CVE-2026-91204 Apache Roller: Stored javascript: URI in HTML comments
- CVE-2026-91203 Cockpit-files: cockpit-files: arbitrary file ownership and permission modification via symlink race condition
- CVE-2026-91202 Cockpit-files: cockpit-files: arbitrary file ownership change via symlink following in privileged paste
- CVE-2026-91201 DocsGPT through 0.20.0 OAuth Token Disclosure via Wildcard postMessage
- CVE-2026-91200 DevSpace through 6.3.21 Path Traversal via tar extraction
- CVE-2026-9120 Use after free in Chrome
- CVE-2026-91199 Refly through 1.1.0 Server-Side Request Forgery via scrape endpoint
- CVE-2026-91198 GrowthBook through 5.0.1 Information Disclosure via Public Endpoints
- CVE-2026-91197 Flowable flowable-engine through 8.0.0 XXE via ProcessDiagramLayoutFactory
- CVE-2026-91191 Lantronix G520 Series Cellular Gateway Improper Verification of Cryptographic Signature
- CVE-2026-9119 Memory corruption in Chrome
- CVE-2026-91189 Integer overflow in Eclipse ThreadX - GUIX
- CVE-2026-91187 Improper Verification of Cryptographic Signature in dashbit nimble_zta Cloudflare strategy
- CVE-2026-91186 PNG decoder: a duplicate IHDR chunk after IDAT resizes the image after allocation, causing a heap out-of-bounds write
- CVE-2026-91184 NGINX Gateway Fabric vulnerability
- CVE-2026-91181 Data Retention Teams Endpoint Leaks Private Team Invite ID
- CVE-2026-9118 Use after free in Chrome
- CVE-2026-9117 Memory corruption in Chrome
- CVE-2026-91167 Missing authorization in warpgate
- CVE-2026-91166 Warpgate: Web SSH stores a jump host's key against the target's address, so it validates as the target
- CVE-2026-91165 Warpgate: Markup injection in SSO form_post return page via unencoded redirect/error values
- CVE-2026-91164 Warpgate: API tokens bypass the user's allowed_ip_ranges restriction
- CVE-2026-91161 OpenWA: VIEWER API keys can read WhatsApp group invite codes
- CVE-2026-91160 OpenWA: A read-only API key can receive a session pairing QR over the WebSocket event stream
- CVE-2026-9116 Security feature bypass in Chrome
- CVE-2026-91159 Discourse: Stored oEmbed HTML injection via allowed iframe
- CVE-2026-91157 Discourse: Media uploads remain publicly accessible after category permissions are restricted
- CVE-2026-91156 Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users
- CVE-2026-91154 Missing authentication in Ecommerce Template product cache revalidation allows unauthenticated denial of service
- CVE-2026-91153 Information disclosure in Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
- CVE-2026-91152 Everest Forms <= 3.6.2 - Reflected Cross-Site Scripting via 'evf_toast_type' Parameter
- CVE-2026-9115 Security feature bypass in Chrome
- CVE-2026-91149 Cockpit: cockpit: denial of service via unbounded connection thread spawning
- CVE-2026-91147 Cockpit: cockpit: denial of service in `cockpit-ws` due to url-root handling without a trailing slash
- CVE-2026-91146 Takahe through 0.11.0 Cross-Site Scripting via javascript: URL Scheme
- CVE-2026-91145 Activiti through 7.1.0.M6 Expression Injection via Mail Task
- CVE-2026-91144 ZFile through 5.0.5 Share Entry Filter Bypass via Download Endpoint
- CVE-2026-91143 goproxy through 15.3 Authentication Bypass via CONNECT
- CVE-2026-91142 Cockpit: cockpit: unauthorized modification of login records via integer overflow
- CVE-2026-91140 OS command injection in Progress Software Autonomous REST Connector GenAI Agents
- CVE-2026-9114 Use after free in Chrome
- CVE-2026-91137 Apache Thrift: PHP `thrift_protocol` accelerator: zero-byte container elements
- CVE-2026-91136 Divi Plus <= 2.4.0 - Unauthenticated Arbitrary File Read via 'svg_image' Parameter
- CVE-2026-91135 Apache Thrift: C++ `THeaderTransport::transform()` heap buffer overflow (write direction)
- CVE-2026-91134 Discourse: Block post iframes whose encoded userinfo bypasses the allowed_iframes allowlist
- CVE-2026-91133 Discourse: Escape LIKE metacharacters in upload paths to prevent disclosure
- CVE-2026-91132 Discourse: Wildcard iframe origin allowlist bypass via authority separators
- CVE-2026-91130 Home Assistant: XSS in Statistics Graph Card
- CVE-2026-9113 Memory corruption in Chrome
- CVE-2026-91129 Home Assistant: mDNS Server-Side Request Forgery
- CVE-2026-91127 File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer
- CVE-2026-91123 Discourse: Reject literal backslash path separators in iframe src traversal guard
- CVE-2026-91122 Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users
- CVE-2026-91121 Discourse: Chat upload filenames rendered as raw HTML in excerpts
- CVE-2026-91120 Discourse: Stored HTML injection in video notification emails
- CVE-2026-9112 Use after free in Chrome
- CVE-2026-91119 Discourse: Encode action_code_who in mention URLs
- CVE-2026-9111 Use after free in Chrome
- CVE-2026-91109 Missing authorization in Simply Schedule Appointments
- CVE-2026-91108 Missing authorization in Alt Text AI – Automatically generate image alt text for SEO and accessibility
- CVE-2026-91107 openSIS Classic 9.3 - Insecure Direct Object Reference (IDOR)
- CVE-2026-91106 HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities
- CVE-2026-91105 HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities
- CVE-2026-91104 HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities
- CVE-2026-91103 HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities
- CVE-2026-91102 HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities
- CVE-2026-91101 HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities
- CVE-2026-91100 HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities
- CVE-2026-9110 Other in Chrome
- CVE-2026-91099 HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities
- CVE-2026-91098 HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities
- CVE-2026-91097 HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities
- CVE-2026-91096 Use after free in proxygen
- CVE-2026-91095 Use after free in proxygen
- CVE-2026-91093 HP One Agent Software – Security Update
- CVE-2026-91092 Missing authorization in wpForo Forum
- CVE-2026-91091 GPAC Node Insertion base_scenegraph.c gf_node_list_insert_child memory corruption
- CVE-2026-91090 GPAC base_scenegraph.c gf_node_activate_ex stack-based overflow
- CVE-2026-9109 GPTranslate <= 2.31 - Unauthenticated Stored Cross-Site Scripting via REST API Translation Storage
- CVE-2026-91089 GPAC base_scenegraph.c gf_node_get_name_and_id use after free
- CVE-2026-91088 GPAC URL url.c gf_url_concatenate_ex heap-based overflow
- CVE-2026-91087 GPAC Compositor media_object.c gf_mo_get_od_id use after free
- CVE-2026-91086 GPAC MPEG Video Reframer reframe_mpgvid.c mpgviddmx_process heap-based overflow
- CVE-2026-91085 Apache Karaf: config:install missing ACL entry allows privilege escalation to admin
- CVE-2026-91081 Docs through 5.6.1 SSRF via Unauthenticated cors-proxy Endpoint
- CVE-2026-91080 webhook through 2.8.3 Memory Exhaustion via Oversized Request Body
- CVE-2026-9108 Studio 5000 Logix Designer® – Multiple Vulnerabilities
- CVE-2026-91079 Huly Platform through 0.7.426 SSRF via Print Service
- CVE-2026-91078 TillKit < 1.0.5 - Unauthenticated POS Takeover via Hard-Coded Default Manager PIN
- CVE-2026-91077 Missing authorization in Event Booking Manager for WooCommerce
- CVE-2026-91076 Robokassa payment for WooCommerce < 1.9.0 - Unauthenticated Arbitrary Order Status Change to Failed
- CVE-2026-91074 BSK PDF Manager <= 3.8.1 - Contributor+ SQLi via tags_specific Shortcode Attribute
- CVE-2026-91073 Subscribe Forms 1.4.1 - 1.6.2 - Author+ Stored XSS via Attention Effect Form Setting
- CVE-2026-91072 EWWW Image Optimizer < 8.8.0 - Admin+ WebP File Rename and Deletion via Unrestricted Path in WebP Migration Handler
- CVE-2026-9107 Cross-site scripting in Kali Forms — Contact Form & Drag-and-Drop Builder