Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 309 of 1013.
- CVE-2026-85217 Man-in-the-Middle (MITM) Vulnerability in Autodesk Fusion Desktop
- CVE-2026-85216 MISP LDAP and LinOTP Authentication Bypass via Empty or Invalid Credentials
- CVE-2026-85215 SQL Injection in GG Soft's Paperwork
- CVE-2026-85214 vhr Missing Authorization in PUT /hr/info Allows Arbitrary Profile Overwrite
- CVE-2026-85213 Kill Bill through 0.24.21 Missing Authorization on AdminResource Endpoints
- CVE-2026-85212 CRMEB through 6.0.0 Missing Authorization via Inert verifyAuth Role Check
- CVE-2026-85211 Label Studio through 1.23.0 Cross-Organization Storage URI Resolution
- CVE-2026-85210 Oppia through 3.5.2 Missing Authorization on AdminRoleHandler GET
- CVE-2026-8521 Use after free in Chrome
- CVE-2026-85209 IDOR in AVEZ Electronics's LMS
- CVE-2026-85208 itsourcecode Online Medicine Delivery System Order Management Controller controller.php doInsert unrestricted upload
- CVE-2026-85207 itsourcecode Online Medicine Delivery System index.php cross site scripting
- CVE-2026-85205 itsourcecode Online Medicine Delivery System Wishlist controller.php addwishlist sql injection
- CVE-2026-85201 Denial of service in Eclipse Ankaios
- CVE-2026-85200 GEO my WP <= 4.5.5.3 - Unauthenticated Local File Inclusion
- CVE-2026-8520 Race condition in Chrome
- CVE-2026-85199 Path traversal in Eclipse aeriOS
- CVE-2026-85198 MPG <= 4.2.1 - Unauthenticated SQL Injection via URL Path
- CVE-2026-85197 Libsoup: libsoup: heap use-after-free in libsoup http/2 client on_data_read() via goaway during body upload
- CVE-2026-85196 Cross-site scripting in Articles Anywhere (Pro) extension for Joomla
- CVE-2026-85195 Cross-site scripting in Articles Anywhere (Free, Pro) extension for Joomla
- CVE-2026-85192 Code injection in Conditional Content Pro extension for Joomla
- CVE-2026-85191 Cross-site scripting in Tabs & Accordions (Free, Pro) extension for Joomla
- CVE-2026-85190 Joomla Extension - regularlabs.com - Privileged stored XSS via class option in Quick Index extension for Joomla < 5.0.5
- CVE-2026-8519 Integer overflow in Chrome
- CVE-2026-85189 Cross-site scripting in Modals (Free, Pro) extension for Joomla
- CVE-2026-85188 Missing authorization in Advanced Module Manager (Free, Pro) extension for Joomla
- CVE-2026-85187 itsourcecode Online Medicine Delivery System Order Status Update controller.php pupdate sql injection
- CVE-2026-85186 itsourcecode Online Medicine Delivery System Customer Controller controller.php doupdateimage unrestricted upload
- CVE-2026-85185 Path traversal in LXD btrfs storage driver allows arbitrary file deletion and write on host as root
- CVE-2026-85184 @fastify/middie vulnerable to path-scoped middleware bypass via absolute-form request target
- CVE-2026-85183 Taipy through 4.1.1 Cross-Site WebSocket Hijacking via Wildcard socket.io CORS
- CVE-2026-85182 vhr Missing Authorization in PUT /hr/pass Allows Cross-Account Password Change
- CVE-2026-85181 CAT through 3.1.0 Session Cookie Forgery via Unkeyed hashCode Checksum
- CVE-2026-85180 Ollama 0.30.0 through 0.33.2 SSRF via Cross-Host Tensor Blob Redirect
- CVE-2026-8518 Use after free in Chrome
- CVE-2026-85179 Label Studio through 1.23.0 SSRF via Unvalidated Webhook URL
- CVE-2026-85178 Helicone Cross-Tenant Provider Key Disclosure via Missing Organization Filter
- CVE-2026-85177 CRMEB through 6.0.0 Unauthorized Message Modification via edit_message
- CVE-2026-85176 DbGate through 7.2.6 Arbitrary File Read and Write via file:// jslid
- CVE-2026-85175 SiYuan before v3.8.2 TLS Private Key Disclosure via getFile
- CVE-2026-85174 SiYuan before v3.8.2 API Token Exposure via Log File
- CVE-2026-85173 n8n before 2.36.2 Missing Authorization via Insights API
- CVE-2026-85172 n8n before 2.34.1 SSRF via Request Helper URI Validation Bypass
- CVE-2026-85171 n8n before 1.123.73 Credential Exposure via Error Logging
- CVE-2026-85170 n8n before 1.123.73 Local File Read and SSRF via Gmail and Brevo nodes
- CVE-2026-8517 Use after free in Chrome
- CVE-2026-85169 n8n before 1.123.73 Remote Code Execution via $fromAI Prototype Leak
- CVE-2026-85168 n8n before 1.123.73 Remote Code Execution via Git Node
- CVE-2026-85167 n8n before 2.36.2 Query Injection via Elasticsearch Firestore Nodes
- CVE-2026-85166 n8n before 2.36.2 Credential Exfiltration via Workflow Tool Node
- CVE-2026-85165 n8n before 2.36.2 Expression Sandbox Bypass via SpreadElement
- CVE-2026-85164 WWBN AVideo Server-Side Request Forgery via set_api_userImages
- CVE-2026-85163 AVideo Server-Side Request Forgery via epg_link parameter
- CVE-2026-85162 AVideo through c91b5975d CSRF via saveLive.php
- CVE-2026-85161 AVideo removePoster.php Cross-Site Request Forgery File Deletion
- CVE-2026-85160 AVideo through c91b5975d CSRF and Path Traversal via stopLive.php
- CVE-2026-8516 Information disclosure in Chrome
- CVE-2026-85159 AVideo Reflected XSS via cancelUri in userLogin.php
- CVE-2026-85158 AVideo Reflected XSS via videoEmbeded.php link parameter
- CVE-2026-85157 WWBN AVideo Broken Access Control via feed/index.php program_id
- CVE-2026-85156 WWBN AVideo Broken Access Control via Channel Page
- CVE-2026-85155 WWBN AVideo SQL Injection via get.json.php APIName channels
- CVE-2026-85154 WWBN AVideo Authentication Bypass via Non-Expiring video_id_hash
- CVE-2026-85153 Information Disclosure Vulnerability in Schmooze dating mobile Application
- CVE-2026-85152 undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors
- CVE-2026-85150 Null dereference in Red Hat Enterprise Linux 10
- CVE-2026-8515 Use after free in Chrome
- CVE-2026-85149 Lightstar｜SmartIT Desktop Manager - Use of Hard-coded Credentials
- CVE-2026-85148 Lightstar｜SmartIT Desktop Manager - Use of Hard-coded Credentials
- CVE-2026-85147 Lightstar｜SmartIT Desktop Manager - Use of Hard-coded Credentials
- CVE-2026-85146 Lightstar｜SmartIT Desktop Manager - Use of Hard-coded Credentials
- CVE-2026-8514 Use after free in Chrome
- CVE-2026-85138 SeaCMS WeChat index.php addslashes sql injection
- CVE-2026-85137 SeaCMS Locoy Collector seacms_locoy_news.php parseIf code injection
- CVE-2026-85135 ILIAS MediaPool ZipAdapter.php uploadMultipleSubtitleFileObject unrestricted upload
- CVE-2026-85134 Arbitrary File Upload Leading to Remote Command Execution in Bimser's eBA Plus
- CVE-2026-85133 WPLP Cookie Consent < 4.4.2 - Subscriber+ Missing Authorization via Multiple Settings AJAX Actions
- CVE-2026-85132 WPLP Cookie Consent 4.0.2 - 4.4.1 - Subscriber+ Cookie Scan Schedule Disclosure via gcc_get_schedule_scan
- CVE-2026-85131 WPLP Cookie Consent < 4.4.4 - Arbitrary Post Deletion via CSRF
- CVE-2026-85130 WPLP Cookie Consent < 4.4.4 - Unauthenticated Stored XSS via Consent Logs
- CVE-2026-8513 Use after free in Chrome
- CVE-2026-85129 Hoo Companion 1.0.2 - Unauthenticated Stored XSS via Theme Settings Import
- CVE-2026-85128 Privilege escalation in Choose User Role at Registration
- CVE-2026-85127 VikBooking 1.8.8 - 1.8.14 - Unauthenticated Stored XSS via SVG Chat Attachment
- CVE-2026-85126 Crowdfundly <= 2.2.2 - Crowdfundly Manager+ Privilege Escalation
- CVE-2026-85125 Security feature bypass in YAMAP -Social Trekking GPS App
- CVE-2026-85124 @fastify/http-proxy vulnerable to prefix escape via backslash dot-segments
- CVE-2026-85123 Easy Form Builder 4.0.0 - 4.1.3 - Unauthenticated Registration Policy Bypass via Login Form Type Confusion
- CVE-2026-85122 Easy Form Builder 4.0.0 - 4.1.3 - Unauthenticated Stored XSS via Form Type Confusion
- CVE-2026-85121 Insurify <= 1.0 - Unauthenticated Arbitrary Option Creation and Overwrite via saveemailtemplatedesign
- CVE-2026-8512 Use after free in Chrome
- CVE-2026-85118 AI Content Generator Marketing <= 1.0.0 - Unauthenticated Privilege Escalation via Arbitrary Option Update and Deletion
- CVE-2026-85117 Contact Form 7 Captcha 0.1.7 - 0.1.8 - Unauthenticated Arbitrary Shortcode Execution via Form Field Repopulation
- CVE-2026-85116 Code injection in Simple CAPTCHA with Cloudflare Turnstile
- CVE-2026-85115 Information disclosure in .NET Client Library for SIMATIC S7 Webserver API
- CVE-2026-85114 Path traversal in .NET Client Library for SIMATIC S7 Webserver API
- CVE-2026-85113 GiveWP < 4.16.9 - Unauthenticated Arbitrary Shortcode Execution via Donor Name
- CVE-2026-85110 Tenda HG10 Boa Web Server formWlanSetup buffer overflow
- CVE-2026-8511 Use after free in Chrome