Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 305 of 1013.
- CVE-2026-85679 Extendify <= 3.1.6 - Unauthenticated Stored Cross-Site Scripting via 'styles.blocks' Block Type Key
- CVE-2026-85678 AI Builder 2.4.1 - 2.7.7 - Contributor+ Stored XSS via Post JavaScript
- CVE-2026-85677 Gutenverse News < 3.3.3 - Unauthenticated Stored XSS via Comment Content
- CVE-2026-85676 Dub Open Redirect via Unrestricted redir_url Parameter
- CVE-2026-85675 OWL DocumentProcessingToolkit Server-Side Request Forgery via URL Fetching
- CVE-2026-85674 aider 0.86.2 Remote Code Execution via .aider.conf.yml
- CVE-2026-85673 LLaMA-Factory SSRF Guard Bypass via Redirect and DNS Rebinding
- CVE-2026-85672 zerox 1.1.20 OS Command Injection via Document URL File Extension
- CVE-2026-85671 QAnything 2.0.0 Unauthenticated Cross-User File Disclosure
- CVE-2026-85670 tokenizers BpeBuilder Buffer Overflow via merge token
- CVE-2026-8567 Integer overflow in Chrome
- CVE-2026-85669 potpie through 2.0.0 Missing Ownership Check via code-changes sync
- CVE-2026-85668 Xinference 3.3.0 Unauthenticated Arbitrary-Path File Read via /v1/models/llm/auto-register
- CVE-2026-85667 xiaobei through 5.5.2 Unauthenticated Webhook Message Injection
- CVE-2026-85666 ogx 1.3.1 Server-Side Request Forgery via MCP tool server_url
- CVE-2026-85665 Bruno through 4.1.0 Arbitrary File Read via Unconfined Body File Path
- CVE-2026-85664 Chroma 1.5.9 Unbounded HNSW Index Parameters Memory Exhaustion
- CVE-2026-85663 Aim 3.29.1 Remote Code Execution via Unauthenticated Method Dispatch
- CVE-2026-85662 Marqo 2.26.0 Server-Side Request Forgery via Media URLs
- CVE-2026-85661 excel-mcp-server 0.1.8 Arbitrary File Read/Write via stdio mode
- CVE-2026-85660 cli-mcp-server 0.2.5 Command Allowlist Bypass via Shell Substitution
- CVE-2026-8566 Security feature bypass in Chrome
- CVE-2026-85659 PilotPress <= 2.0.43 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover via 'username' Parameter
- CVE-2026-85658 Code injection in Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
- CVE-2026-85657 Cross-site scripting in Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors
- CVE-2026-85656 OS command injection in Amazon log4j-cve-2021-44228-hotpatch
- CVE-2026-85655 Missing authorization in Enable Media Replace
- CVE-2026-85654 Code injection in the CDK generator in Amazon awslabs.dynamodb-mcp-server
- CVE-2026-85653 Cross-site scripting in Contextual Related Posts
- CVE-2026-85652 Photo Gallery by 10Web <= 1.8.44 - Authenticated (Author+) SQL Injection via 'album_id' Shortcode Attribute
- CVE-2026-85651 Trigger.dev before 4.5.2 Unauthorized Environment Access via Run Replay
- CVE-2026-85650 Trigger.dev before 4.5.2 Server-Side Request Forgery via webhook alert-channel
- CVE-2026-8565 Other in Chrome
- CVE-2026-85649 Security feature bypass in software-actualizer
- CVE-2026-85645 Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.46 - Reflected Cross-Site Scripting
- CVE-2026-85644 XS::Parse::Infix versions from 0.40 through 0.49 for Perl treat a number as an array reference
- CVE-2026-85643 code-projects Online Shopping System adduser.php mysqli_query sql injection
- CVE-2026-85642 Formidable Forms 6.5 - 6.35 - Unauthenticated Payment Gateway Connect Verification DoS
- CVE-2026-85641 Formidable Forms 6.34 - Unauthenticated Stored Content Injection via 'updated_by' Parameter
- CVE-2026-85640 Privilege Escalation
- CVE-2026-8564 Other in Chrome
- CVE-2026-85639 jofpin trape Telemetry Endpoint user.py race condition
- CVE-2026-85638 jofpin trape user.py authorization
- CVE-2026-85637 jofpin trape Admin Endpoint sockets.py join_room missing authentication
- CVE-2026-85636 jofpin trape Login Endpoint stats.py missing authentication
- CVE-2026-85634 Wildfly-core: wildfly-core: deployer rbac role privilege escalation via path traversal in deployment name
- CVE-2026-85630 HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the process_attrs method.
- CVE-2026-8563 Security feature bypass in Chrome
- CVE-2026-85628 Cleartext Transmission of Sensitive Information in the Pairing Process vulnerability
- CVE-2026-85626 git-mcp-server 2.15.1 Argument Injection via Git Ref Parameters
- CVE-2026-85625 sift 17.1.3 Prototype Pollution Remote Code Execution via $where
- CVE-2026-85624 Blinko 1.8.7 Cross-User Private Note Disclosure via noteReferenceList
- CVE-2026-85623 goose 1.37.0 Arbitrary Command Execution via Recipe Extensions
- CVE-2026-85622 AppFlowy-Cloud through 0.9.64 Cross-Workspace Collab Read via WebSocket
- CVE-2026-85621 LobeChat 2.2.1 Webhook Signature Verification Bypass QQ Feishu
- CVE-2026-85620 Postgres MCP Pro 0.3.0 Restricted-Mode Bypass via FROM-Clause Function
- CVE-2026-8562 Information disclosure in Chrome
- CVE-2026-85619 AppFlowy-Cloud 0.9.64 Cross-Workspace Collab Access via HTTP API
- CVE-2026-85618 ConvertX 0.17.0 Arbitrary File Read via LaTeX Input Directives
- CVE-2026-85617 snipe-it before 8.6.3 Authorization Bypass via Bulk Delete
- CVE-2026-85616 Snipe-IT before 8.6.2 Authorization Bypass via Checkout-Acceptance
- CVE-2026-85615 Openpanel before 2.3.0 Cross-Tenant IDOR via report.getLayouts
- CVE-2026-85614 OpenPanel API before 2.3.0 Unauthenticated SSRF via site-checker
- CVE-2026-85613 OpenPanel before 2.3.0 Unauthenticated XSS via SVG Favicon Proxy
- CVE-2026-85612 OpenPanel before 2.3.0 SSRF via favicon and og endpoints
- CVE-2026-85611 OpenPanel before 2.3.0 Cross-Tenant BOLA via report procedures
- CVE-2026-85610 OpenPanel before 2.3.0 Remote Code Execution via chart formulas
- CVE-2026-8561 Other in Chrome
- CVE-2026-85609 Openpanel before 2.3.0 SSRF via Site Checker Endpoint
- CVE-2026-85608 Douyin_TikTok_Download_API 4.1.2 SSRF via url parameter
- CVE-2026-85607 Blinko 1.8.7 Cross-User AI Conversation Read and Write via message tRPC Router
- CVE-2026-85606 firecrawl-mcp-server 3.20.2 Arbitrary Local File Read via filePath
- CVE-2026-85605 Slink before 1.12.3 Missing Authorization on Image Comment Endpoints
- CVE-2026-85604 Grav before 2.0.18 Remote Code Execution via sort filter
- CVE-2026-85603 Grav Admin Plugin Path Traversal via Save As Language Code
- CVE-2026-85602 Grav Form Plugin before 9.1.20 reCAPTCHA v3 Authentication Bypass
- CVE-2026-85601 Grav Admin before 2.0.20 Cross-Site Scripting via marked.js
- CVE-2026-85600 Grav Admin before 2.0.21 Stored XSS via username
- CVE-2026-8560 Memory corruption in Chrome
- CVE-2026-85599 Grav Shortcode Core before 6.2.5 Stored XSS via unescaped parameters
- CVE-2026-85598 Grav 2.0.0 through 2.0.17 Stored XSS via Modular Pages
- CVE-2026-85597 Traefik before v2.11.55 and v3.0.0 through v3.7.10 mTLS Bypass via TLS Option Conflict
- CVE-2026-85596 Traefik v3.7 Authentication Bypass via TLS Option Conflict
- CVE-2026-85595 Traefik before v2.11.55 and v3.0.0 through v3.7.10 Authentication Bypass via digestAuth
- CVE-2026-85594 Traefik v3.7.1 crossProviderNamespaces Bypass via Service Middleware
- CVE-2026-85593 phpMyFAQ before 4.1.8 Stored XSS via html_entity_decode
- CVE-2026-85592 phpMyFAQ before 4.1.8 Authorization Bypass via question/create
- CVE-2026-85591 phpMyFAQ before 4.1.8 Authentication Bypass via Unverified Password Change
- CVE-2026-85590 phpMyFAQ before 4.1.8 Authentication Bypass via Two-Factor Disable
- CVE-2026-8559 Integer overflow in Chrome
- CVE-2026-85589 phpMyFAQ before 4.2.0-alpha.2 Missing Authorization via Dashboard API
- CVE-2026-85588 phpMyFAQ before 4.1.8 TOTP Secret Exposure via Data Export
- CVE-2026-85587 phpMyFAQ before 4.1.8 Incorrect Authorization via Admin Pages
- CVE-2026-85586 phpMyFAQ before 4.1.8 CAPTCHA Bypass via store parameter
- CVE-2026-85585 SiYuan before v3.8.2 Unbounded Memory Consumption via ControlConcurrency
- CVE-2026-85584 SiYuan before v3.8.2 Denial of Service via Auth Throttle
- CVE-2026-85583 SiYuan before v3.8.2 Path Traversal via symlink in file API
- CVE-2026-85582 SiYuan before v3.8.2 Unbounded Session Creation via Basic Auth
- CVE-2026-85581 SiYuan before v3.8.2 Denial of Service via unauthenticated UI-process registration
- CVE-2026-85580 SiYuan before v3.8.2 Path Guard Bypass via Case Mismatch