Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 306 of 1013.
- CVE-2026-8558 Memory corruption in Chrome
- CVE-2026-85579 SiYuan before v3.8.2 Information Disclosure via undoState
- CVE-2026-85578 SiYuan through 3.8.1 Authorization Bypass via getFile
- CVE-2026-85577 AVideo userLogin.php Reflected XSS via error parameter
- CVE-2026-85576 All in One Files Upload for WooCommerce < 2.0.17 - Subscriber+ Arbitrary Plugin Settings Update
- CVE-2026-85575 Cross-site scripting in ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets
- CVE-2026-85574 Unbounce Landing Pages 1.1.1 - 1.1.4 - Subscriber+ Reverse-Proxy Target Hijack via set_unbounce_domains
- CVE-2026-85573 All in One Files Upload for WooCommerce 2.0.3 - 2.0.16 - Unauthenticated Stored XSS via SVG Upload
- CVE-2026-85572 Tutor LMS 4.0.0 - < 4.0.8 - Subscriber+ Cross-Course Lesson Comment Disclosure
- CVE-2026-85571 Tutor LMS 4.0.5 - 4.1.0 - Instructor+ Arbitrary Post Reparenting via IDOR
- CVE-2026-8557 Use after free in Chrome
- CVE-2026-85569 Tutor LMS 2.7.1 - < 4.0.8 - Read-Only API Key Privilege Escalation via REST Request Misclassification
- CVE-2026-85568 Unlimited Elements For Elementor 1.5.139 - 2.0.20 - Unauthenticated SQLi via 'ucs' Parameter
- CVE-2026-8556 Information disclosure in Chrome
- CVE-2026-8555 Use after free in Chrome
- CVE-2026-85547 Cross-Site Request Forgery via Attacker-Controlled REST Detection in MISP
- CVE-2026-85546 MISP Sharing Group Quick-Edit Actions Allow CSRF via State-Changing GET Requests
- CVE-2026-85545 Missing authorization in HikCentral Access Control
- CVE-2026-85544 Hardcoded credentials in DS-KD8003
- CVE-2026-85543 Missing authorization in Wi-Fi series camera
- CVE-2026-85542 IBM Guardium Data Protection is affected by multiple vulnerabilities.
- CVE-2026-85541 Interinfo｜DreamMaker - Reflected Cross-site Scripting
- CVE-2026-85540 Interinfo｜DreamMaker - SQL Injection
- CVE-2026-8554 Memory corruption in Chrome
- CVE-2026-85538 MISP Attribute Deletion Authorization Bypass Allows Users Without Modify Permissions to Delete Attributes
- CVE-2026-85534 Denial of service in Red Hat Enterprise Linux 10
- CVE-2026-85533 MISP Sharing Group Authorization Bypass via Omitted Distribution Parameter
- CVE-2026-85532 Apache WSS4J: Insufficient Validation of Derived-Key Parameters
- CVE-2026-85531 Payment Validation Bypass in Sipay Electronic Money's OpenCart 3.x
- CVE-2026-85530 GiveWP < 4.16.8.1 - Unauthenticated Account Takeover via Donor Email Sanitization Mismatch
- CVE-2026-8553 Use after free in Chrome
- CVE-2026-85529 Incorrect Authorization in GitLab
- CVE-2026-85528 Snowflake JDBC Driver auto-configuration account validation permits credential redirection
- CVE-2026-85526 Path traversal via Btrfs optimized-backup subvolumes[].path enables root file/dir manipulation in LXD
- CVE-2026-85525 Improper OCSP response validation in Snowflake drivers
- CVE-2026-85523 OS Command Injection in Felisify Informatics' SambaBox
- CVE-2026-85522 valkey-io valkey Slot Migration cluster_migrateslots.c createSlotImportJob out-of-bounds
- CVE-2026-85520 Unauthenticated arbitrary file write leading to RCE in gmfeed PrestaShop module
- CVE-2026-8552 Memory corruption in Chrome
- CVE-2026-85518 Openscap: openscap: arbitrary file write via path traversal in source datastream decomposition
- CVE-2026-85517 code-projects Vehicle Management System SQL Database Backup File vehicle_management.sql information disclosure
- CVE-2026-85516 code-projects Vehicle Management System busprofile.php sql injection
- CVE-2026-85515 OpenPGP message truncation not reported, bypassing the SEIPDv1 integrity check
- CVE-2026-85514 StackStorm st2 API Key auth.py privileges management
- CVE-2026-85513 StackStorm st2 NoOp RBAC backend actionexecutions.py privileges management
- CVE-2026-85512 SourceCodester Class and Exam Timetabling System session.php authorization
- CVE-2026-85511 Wildfly-elytron-realm-token: parameter injection in eap's elytron oauth2
- CVE-2026-8551 Use after free in Chrome
- CVE-2026-85509 Memory corruption in FreeIPMI
- CVE-2026-85508 Memory corruption in FreeIPMI
- CVE-2026-85507 Memory corruption in FreeIPMI
- CVE-2026-85506 Memory corruption in FreeIPMI
- CVE-2026-85505 Memory corruption in FreeIPMI
- CVE-2026-85504 Memory corruption in FreeIPMI
- CVE-2026-85501 Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC
- CVE-2026-85500 `require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication
- CVE-2026-8550 Use after free in Chrome
- CVE-2026-85499 Apache SkyWalking BanyanDB: Canopy does not enforce readonly-role restrictions on the /monitoring/* proxy
- CVE-2026-85498 Polkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflow
- CVE-2026-85497 CareCam CM2507 Use of Password Hash With Insufficient Computational Effort
- CVE-2026-85496 Botslab G980H Dashcams Generation of Predictable Numbers or Identifiers
- CVE-2026-85494 Denial of service in Apache Thrift
- CVE-2026-85493 Denial of service in Apache Thrift
- CVE-2026-85492 All in One SEO <= 5.0.1.1 - Reflected DOM-Based Cross-Site Scripting via URL Pathname
- CVE-2026-85491 Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a disp
- CVE-2026-85490 Path traversal in Brocade Active Support Connectivity Gateway
- CVE-2026-8549 Use after free in Chrome
- CVE-2026-85489 Auth bypass in Brocade Active Support Connectivity Gateway
- CVE-2026-85488 Hardcoded credentials in Brocade Active Support Connectivity Gateway
- CVE-2026-85487 Path traversal in Brocade Active Support Connectivity Gateway
- CVE-2026-85486 Code injection in Brocade Active Support Connectivity Gateway
- CVE-2026-85485 HTML::FormHandler versions before 0.410002 for Perl render some error messages into HTML without escaping
- CVE-2026-85484 HTML::FormHandler versions before 0.410002 for Perl render option group labels and radio button labels into HTML without escaping.
- CVE-2026-85483 Apache Thrift: c_glib TZlibTransport reports a full read after a premature stream end
- CVE-2026-8548 Memory corruption in Chrome
- CVE-2026-85479 Grid Protection Alliance openPDC and openHistorian Missing Authentication for Critical Function
- CVE-2026-85478 CareCam CM2507 Missing Authentication for Critical Function
- CVE-2026-85476 Apache Thrift: c_glib `read_all` spins when the underlying read returns 0
- CVE-2026-85475 Code injection in Red Hat Ansible Automation Platform 2
- CVE-2026-85473 Out-of-Range Timestamp Claim Handling in auth0/java-jwt
- CVE-2026-85471 Quay: quay: webhook notification ssrf -- hostname-string blocklist trivially bypassable
- CVE-2026-8547 Missing authorization in Chrome
- CVE-2026-85469 Supply chain in Red Hat Quay 3
- CVE-2026-8546 Memory corruption in Chrome
- CVE-2026-85458 Divide-by-zero in Xpdf 4.06 due to zero-height Type 3 glyph
- CVE-2026-85457 IBM Planning Analytics Local is affected by security vulnerabilities
- CVE-2026-85456 MOOS-IvP through 24.8.1 alog Splitting Path Traversal on Windows
- CVE-2026-85455 MOOS core-moos through 10.4.0 MOOSDB Out-of-Bounds Read via Short Packet
- CVE-2026-85454 MOOS core-moos through 10.4.0 Off-by-One Buffer Overflow in Serial Telegram Handling
- CVE-2026-85453 MOOS core-moos through 10.4.0 MOOSDB HTTP Pages Stored Cross-Site Scripting
- CVE-2026-85452 MOOS ui-moos through 50b9c6c uMS Buffer Overflow via Long MOOS Identifiers
- CVE-2026-85451 MOOS core-moos through 10.4.0 Remote Process Termination via Hard-Coded Multicast Passphrase
- CVE-2026-85450 MOOS core-moos through 10.4.0 MOOSDB HTTP Server Resource Exhaustion
- CVE-2026-8545 Memory corruption in Chrome
- CVE-2026-85449 MOOS-IvP through 24.8.1 pMarineViewer Unbounded Memory Consumption via NODE_REPORT
- CVE-2026-85448 MOOS-IvP through 24.8.1 uFldShoreBroker Unbounded Community State Retention
- CVE-2026-85447 MOOS-IvP through 24.8.1 pRealm Unbounded REALMCAST_REQ Subscription Denial of Service
- CVE-2026-85446 MOOS-IvP through 24.8.1 uFldNodeComms Quadratic Processing Denial of Service
- CVE-2026-85445 MOOS-IvP through 24.8.1 BHV_IPF Demultiplexer Memory Exhaustion via Packet Count
- CVE-2026-85444 MOOS-IvP through 24.8.1 Out-of-Bounds Read in isBraced, isQuoted and isChevroned