Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 304 of 1013.
- CVE-2026-8582 Information disclosure in Chrome
- CVE-2026-85818 Windows Schannel Spoofing Vulnerability
- CVE-2026-85817 Microsoft PowerShell Remote Code Execution Vulnerability
- CVE-2026-85816 Windows Wi-Fi Driver Information Disclosure Vulnerability
- CVE-2026-85815 Windows Device Association Service Information Disclosure Vulnerability
- CVE-2026-85814 Microsoft Windows Media Foundation Remote Code Execution Vulnerability
- CVE-2026-85812 Windows Bind Filter Driver Information Disclosure Vulnerability
- CVE-2026-85811 Network Policy Server (NPS) Remote Code Execution Vulnerability
- CVE-2026-85810 Windows Telephony Server Elevation of Privilege Vulnerability
- CVE-2026-8581 Use after free in Chrome
- CVE-2026-85809 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
- CVE-2026-85808 Windows Routing and Remote Access Service (RRAS) Denial of Service Vulnerability
- CVE-2026-85807 Windows USB Video Driver Elevation of Privilege Vulnerability
- CVE-2026-85806 Network Policy Server (NPS) Remote Code Execution Vulnerability
- CVE-2026-85805 Microsoft PowerShell Security Feature Bypass Vulnerability
- CVE-2026-85804 Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
- CVE-2026-85803 Windows Camera Frame Server Monitor Elevation of Privilege Vulnerability
- CVE-2026-85802 Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
- CVE-2026-85800 Windows Error Reporting Elevation of Privilege Vulnerability
- CVE-2026-8580 Use after free in Chrome
- CVE-2026-85799 Network Policy Server (NPS) Remote Code Execution Vulnerability
- CVE-2026-85798 Windows Distributed File System (DFS) Remote Code Execution Vulnerability
- CVE-2026-85797 Windows GDI Information Disclosure Vulnerability
- CVE-2026-85796 Windows Installer Elevation of Privilege Vulnerability
- CVE-2026-85795 Windows Text Services Framework Elevation of Privilege Vulnerability
- CVE-2026-85794 Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability
- CVE-2026-85793 Windows Sysmain Service Information Disclosure Vulnerability
- CVE-2026-85792 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
- CVE-2026-85791 Windows Encrypting File System (EFS) Elevation of Privilege Vulnerability
- CVE-2026-85790 Microsoft QUIC Information Disclosure Vulnerability
- CVE-2026-8579 Memory corruption in Chrome
- CVE-2026-85788 Incomplete list of disallowed inputs in awslabs mysql-mcp-server
- CVE-2026-85787 An incomplete list of disallowed inputs in the SQL validation component of Amazon awslabs postgres-mcp-server
- CVE-2026-85786 Incomplete fix for CVE-2026-75936 memory-amplification denial of service in Amazon ion-java
- CVE-2026-85783 Crypt::Age versions before 0.004 for Perl allow CPU exhaustion via an unbounded number of recipient stanzas, each costing an X25519 scalar m
- CVE-2026-85781 Unverified access point ownership in Amazon EFS CSI Driver
- CVE-2026-8578 Memory corruption in Chrome
- CVE-2026-8577 Integer overflow in Chrome
- CVE-2026-85769 Libtpms: libtpms: heap out-of-bounds read in tpm2 state unmarshalling via unchecked block_skip_read() blocksize
- CVE-2026-8576 Security feature bypass in Chrome
- CVE-2026-85756 SSH.NET: ScpClient allows server-side RCE via default SCP path handling
- CVE-2026-85751 Mailu: Authentication bypass in header-based proxy authentication via spoofable `X-Forwarded-By` trust
- CVE-2026-85750 Piwigo arbitrary file read and remote code execution via insecure image processing
- CVE-2026-8575 Use after free in Chrome
- CVE-2026-85749 MailWatch: IDOR lets any authenticated user release or delete another tenant's quarantined mail
- CVE-2026-85748 MariaDB: Use-after-free with a large number of SYS_REFCURSOR's
- CVE-2026-85747 Distribution: Client `manifests.Get()` does not verify returned content against requested digest
- CVE-2026-85746 MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections
- CVE-2026-85745 MariaDB: Out-of-bound buffer read on in `ST_Area` of a multipolygon.
- CVE-2026-85740 lightrag-hku: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard
- CVE-2026-8574 Use after free in Chrome
- CVE-2026-85738 TREK: SSRF Guard Bypass via IPv6 Transition Addresses (NAT64/6to4)
- CVE-2026-85734 LightRAG: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks
- CVE-2026-85733 FrankenPHP: Docker images serve phpinfo() as the default index.php, leaking environment variables
- CVE-2026-85732 oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing
- CVE-2026-85731 oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)
- CVE-2026-85730 smol-toml: Denial of Service via malformed TOML documents
- CVE-2026-8573 Integer overflow in Chrome
- CVE-2026-85725 LightRAG: Plaintext Passwords Compared Without Constant-Time Function
- CVE-2026-85724 Moquette pattern ACL wildcard injection allows cross-tenant authorization bypass
- CVE-2026-85721 AsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service
- CVE-2026-85720 AsyncHttpClient: Origin credentials sent to the proxy on the plaintext CONNECT request
- CVE-2026-8572 Security feature bypass in Chrome
- CVE-2026-85719 AsyncHttpClient: SOCKS proxy credentials sent to the origin server over plaintext HTTP
- CVE-2026-85718 AsyncHttpClient: Connection permit leak on TLS handshake failure causes per-host denial of service
- CVE-2026-85717 AsyncHttpClient: Client-wide realm credentials re-sent to a cross-origin redirect target
- CVE-2026-85716 AsyncHttpClient: SCRAM and Digest mutual-authentication responses are not verified
- CVE-2026-85715 ExifReader: DoS via Crafted HEIC/AVIF iloc Box - Memory Exhaustion
- CVE-2026-85714 Stirling-PDF: Remote Code Execution via H2
- CVE-2026-8571 Security feature bypass in Chrome
- CVE-2026-85709 LightRAG: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses
- CVE-2026-85706 GitLab Community Edition and Enterprise Edition Path Traversal
- CVE-2026-85705 Location Manager <= 2.3.38 - Unauthenticated SQL Injection via 'latitude' and 'longitude' REST API Parameters
- CVE-2026-85704 ramon-victor freegpt-webui Jailbreak Mode config.py getJailbreak race condition
- CVE-2026-85703 ramon-victor freegpt-webui Jailbreak Mode backend.py getJailbreak allocation of resources
- CVE-2026-85702 ramon-victor freegpt-webui Backend Conversation API backend.py _conversation missing authentication
- CVE-2026-85701 ramon-victor freegpt-webui Authentication Check __init__.py ChatCompletion.create missing authentication
- CVE-2026-85700 Onyx 4.6.6 Custom Tool Secret Header Disclosure via Tool Endpoints
- CVE-2026-8570 Memory corruption in Chrome
- CVE-2026-85699 jina-ai reader server-side request forgery via redirect validation bypass
- CVE-2026-85698 Turso through 0.8.0-pre.8 Out-of-Bounds Read Denial of Service
- CVE-2026-85697 Documenso 2.17.0 PDF Route Ignores Document Visibility
- CVE-2026-85696 SadTalker OS Command Injection via Audio Filename
- CVE-2026-85695 FastChat Unauthenticated Worker Registration SSRF and Model Spoofing
- CVE-2026-85694 LaVague 0.2.35 Remote Code Execution via eval extraction
- CVE-2026-85693 Chatbot UI Cross-User Private File Content Disclosure via Retrieval API
- CVE-2026-85692 Nightingale 9.1.1 SSRF Guard Bypass via IPv6 Encoding
- CVE-2026-85691 MegaParse 0.0.55 Server-Side Request Forgery via POST /v1/url
- CVE-2026-85690 Plandex 2.2.1 Path Traversal via ApplyFiles
- CVE-2026-8569 Memory corruption in Chrome
- CVE-2026-85689 llmware 0.4.6 SQL Injection via unescaped filter values
- CVE-2026-85688 TEN Framework 0.11.71 Unauthenticated File Read/Write via TMAN Designer
- CVE-2026-85687 surya 0.22.1 Unauthenticated Arbitrary File Read via screenshot server
- CVE-2026-85686 ms-swift 4.5.2 Unauthenticated SSRF via Multimodal Media URLs
- CVE-2026-85685 AgentScope through 2.0.7.post1 Arbitrary Directory Copy via add_skill
- CVE-2026-85684 marker through 2.0.0 Path Traversal via upload filename
- CVE-2026-85683 Jane Menu < 1.5.1 - Unauthenticated Stored XSS via Store Config Proxy URL
- CVE-2026-85682 Cross-site request forgery in YOP Poll
- CVE-2026-85681 WP Component <= 2.2.4 - Unauthenticated Privilege Escalation via Arbitrary Blog Option Update
- CVE-2026-85680 Ultimate Member < 2.13.1 - Unauthenticated Stored XSS via Profile Page Title