Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 308 of 1013.
- CVE-2026-85342 Windows Device Association Service Elevation of Privilege Vulnerability
- CVE-2026-85341 Windows USB Video Driver Elevation of Privilege Vulnerability
- CVE-2026-85340 Microsoft Office Click-To-Run Elevation of Privilege Vulnerability
- CVE-2026-8534 Integer overflow in Chrome
- CVE-2026-85339 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
- CVE-2026-85338 Microsoft Graphics Component Elevation of Privilege Vulnerability
- CVE-2026-85337 Windows Remote Desktop Client Information Disclosure Vulnerability
- CVE-2026-85336 Windows Device Association Service Information Disclosure Vulnerability
- CVE-2026-85334 Windows Message Queuing Queue Manager Information Disclosure Vulnerability
- CVE-2026-85333 Windows Performance Monitor Elevation of Privilege Vulnerability
- CVE-2026-85332 Windows Device Association Service Elevation of Privilege Vulnerability
- CVE-2026-85331 Windows Device Association Service Information Disclosure Vulnerability
- CVE-2026-85330 Microsoft Edge for Android Security Feature Bypass Vulnerability
- CVE-2026-8533 Use after free in Chrome
- CVE-2026-85329 Microsoft Account Elevation of Privilege Vulnerability
- CVE-2026-85328 Windows Projected File System Elevation of Privilege Vulnerability
- CVE-2026-85327 Windows Print Spooler Components Elevation of Privilege Vulnerability
- CVE-2026-85324 Active Directory Federation Services (AD FS) Denial of Service Vulnerability
- CVE-2026-85323 Network Device Enrollment Service (NDES) Spoofing Vulnerability
- CVE-2026-85322 Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability
- CVE-2026-85321 Active Directory Federation Services (AD FS) Denial of Service Vulnerability
- CVE-2026-85320 Windows Print Spooler Components Information Disclosure Vulnerability
- CVE-2026-8532 Integer overflow in Chrome
- CVE-2026-85319 Active Directory Federation Services (AD FS) Denial of Service Vulnerability
- CVE-2026-85318 Servicing Stack Updates Elevation of Privilege Vulnerability
- CVE-2026-85317 Apache Camel: Camel-HTTP OAuth2 Token Confusion via an Under-Keyed JVM-Global Token Cache
- CVE-2026-85316 Apache Camel: Camel-Platform-HTTP Unintended Proxy Mode via Prefix Path Matching
- CVE-2026-85315 Apache Camel: Camel-gRPC Information Disclosure via Unmuted Consumer Exceptions
- CVE-2026-85314 Other in Apache Camel
- CVE-2026-85313 Misconfiguration in Apache Camel
- CVE-2026-85312 Apache Camel: Camel-Core Saga Participation Hijacking via the Unfiltered Long-Running-Action Header
- CVE-2026-85311 WordPress MarketKing plugin <= 2.1.60 - Broken Access Control vulnerability
- CVE-2026-85310 WordPress Groundhogg plugin <= 4.7.1 - Path Traversal vulnerability
- CVE-2026-8531 Memory corruption in Chrome
- CVE-2026-85309 WordPress Ultimate Maps by Supsystic plugin <= 1.5.3 - Broken Access Control vulnerability
- CVE-2026-85308 WordPress SureForms plugin <= 2.12.5 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-85307 WordPress KP Agent Ready plugin < 1.2.08 - Sensitive Data Exposure vulnerability
- CVE-2026-85306 WordPress MountDev AI MCP Connector for WordPress plugin <= 1.6.5 - Broken Access Control vulnerability
- CVE-2026-85305 WordPress SEOPress plugin <= 10.1 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2026-85304 Missing authorization in Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
- CVE-2026-85303 WordPress Booking and Rental Manager plugin <= 2.7.7 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-85302 WordPress WPKoi Templates for Elementor plugin <= 3.7.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-85301 Apache Camel: Camel-Keycloak Issuer Validation Bypass When the Introspection Response Omits the iss Claim
- CVE-2026-85300 Apache Camel: Camel-PQC Private Key Disclosure via Key Material Written with Default File Permissions
- CVE-2026-8530 Use after free in Chrome
- CVE-2026-85299 Missing Authorization in Compute Engine allows Cross-Project Disk Exfiltration
- CVE-2026-85298 Improper Authorization in Google Cloud Application Integration Leads to Privilege Escalation
- CVE-2026-85297 Bucket Squatting in Cloud Run MCP leads to Service Account Takeover
- CVE-2026-85296 Apache Camel: Camel-AS2 Cross-Partner Signing Key Confusion via Shared Per-Request State
- CVE-2026-85293 InvoicePlane: Stored Cross-Site Scripting (XSS) via Client Email in Invoice and Quote Mailer Forms
- CVE-2026-85292 InvoicePlane: Loose Type Comparison in Core Authentication Check (Defense-in-Depth)
- CVE-2026-85291 InvoicePlane IDOR: Horizontal Privilege Escalation via Password Change Without Authorization Check
- CVE-2026-85290 InvoicePlane: Log Injection via Unsanitized User Input in Cron Key Error Logging
- CVE-2026-8529 Memory corruption in Chrome
- CVE-2026-85289 InvoicePlane: Missing CSRF Token Validation on Multiple Delete Endpoints
- CVE-2026-85288 Notepad++: Shortcuts.xml macro HMAC bypass still reachable via the "Run a Macro Multiple Times" dialog
- CVE-2026-8528 Security feature bypass in Chrome
- CVE-2026-85279 Notepad++: Stack Buffer Overflow in Plugin Lexer Loading via Unchecked GetLexerCount() Return Value
- CVE-2026-85274 InvoicePlane: Recurring Invoice State Change via GET Request Without CSRF Protection
- CVE-2026-85272 Open edX Platform: Path traversal via prefix-bypass in safe_extractall Path Validation
- CVE-2026-85271 Cross-site scripting in openedx-platform
- CVE-2026-8527 Code injection in Chrome
- CVE-2026-85267 Cross-Site WebSocket Hijacking in Google Cloud Shell
- CVE-2026-85260 Apache Camel: Camel-MLLP Protected Health Information Disclosure to Logs by Default
- CVE-2026-8526 Memory corruption in Chrome
- CVE-2026-85257 Apache Camel: Camel-CXF Information Disclosure via Unmuted Consumer Exceptions
- CVE-2026-85254 Apache Camel: Camel-Platform-HTTP Request-Header Echo Suppression Bypassed by Header-Name Casing
- CVE-2026-85251 Apache Camel: Camel-HTTP Credential Disclosure to Cross-Host Redirect Targets
- CVE-2026-85250 Apache Camel: Camel-XPath XML External Entity Processing and File Disclosure via the documentType=InputSource Option
- CVE-2026-8525 Memory corruption in Chrome
- CVE-2026-85249 Apache Camel: Camel-Tika Header Injection via Unfiltered Document Metadata
- CVE-2026-85248 Apache Camel: Camel-PQC Signature Verification Bypass via a Shared Unsynchronized Signature Instance
- CVE-2026-85247 Apache Camel: Camel-Knative Improper Certificate Validation When SSL Is Enabled Without a Truststore
- CVE-2026-85246 Apache Camel: Camel-Mina Information Disclosure via Unmuted Consumer Exceptions
- CVE-2026-85245 Apache Camel: Camel-Thrift Cross-Exchange Data Disclosure via a Shared Deserialization Target
- CVE-2026-85243 Apache Camel: Camel-Crypto-PGP Integrity Verification Downgrade via Attacker-Controlled Message Structure
- CVE-2026-85242 Server-Side Request Forgery via Favicon Redirect to Local Network Resources in PlaywrightCapture
- CVE-2026-85241 SpecterOps BloodHound Graph Write Endpoint v2.go NewV2API improper authorization
- CVE-2026-8524 Memory corruption in Chrome
- CVE-2026-85239 MISP Event Template Definition Validation Bypass Allows Persistent Denial of Service
- CVE-2026-85238 Session Fixation in MISP CustomAuth Authentication Allows Session Hijacking
- CVE-2026-85237 Missing Rate Limiting in Email OTP Verification Allows Brute-Force Authentication Bypass
- CVE-2026-85236 MISP cullEmptyEvents CSRF Allows Irreversible Deletion of Events via GET Request
- CVE-2026-85235 Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field
- CVE-2026-85234 Tftp: tftp-hpa: denial of service due to out-of-bounds read/write in remap engine
- CVE-2026-85231 Libtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec_gss decoding
- CVE-2026-85230 MISP Dashboard Button Widget Allows Persistent JavaScript URL Injection
- CVE-2026-8523 Use after free in Chrome
- CVE-2026-85229 Apache SkyWalking: CWE-79 stored XSS in Booster UI dashboard widgets (incomplete fix of CVE-2025-54057)
- CVE-2026-85228 Integer overflow in tensor buffer validation in Deep Java Library
- CVE-2026-85227 Reflected Cross-Site Scripting in MISP Event Filtering via taggedAttributes and galaxyAttachedAttributes Parameters
- CVE-2026-85226 MISP OnDemand Correlation Engine Missing Access Control Allows Disclosure of Restricted Correlations
- CVE-2026-85225 code-projects Doctor Appointment System patient_login.php sql injection
- CVE-2026-85224 D-Link DNS-320 ShareCenter File Sharing file_sharing.cgi os command injection
- CVE-2026-85223 D-Link DNS-340L CGI dropbox.cgi os command injection
- CVE-2026-85222 D-Link DNS-340L Add-On Center addon_center.cgi os command injection
- CVE-2026-85221 MISP CurlClient TLS Peer Verification Disabled by Default Enables Man-in-the-Middle Attacks
- CVE-2026-85220 Denial-of-Service in the Thinkst Canary Redis service
- CVE-2026-8522 Use after free in Chrome
- CVE-2026-85219 Denial-of-Service in the OpenCanary Redis service