Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 318 of 1013.
- CVE-2026-84141 Integer overflow in the Graphics: ImageLib component
- CVE-2026-84140 Site isolation issue in the DOM: Navigation component
- CVE-2026-8414 Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event/duplicate
- CVE-2026-84139 Clickjacking issue in the DOM: Events component
- CVE-2026-84138 Denial-of-service in the PDF Viewer component
- CVE-2026-84137 Spoofing issue in the DOM: Core & HTML component
- CVE-2026-84136 Other issue in the DOM: Navigation component
- CVE-2026-84135 Other issue in Firefox Focus for Android
- CVE-2026-84134 Other issue in the Profile Backup component
- CVE-2026-84133 Site isolation issue in the DOM: Push Subscriptions component
- CVE-2026-84132 Information disclosure in the Networking: HTTP component
- CVE-2026-84131 Privilege escalation due to invalid pointer in the Graphics component
- CVE-2026-84130 Information disclosure in the Graphics: WebGPU component
- CVE-2026-8413 Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/design
- CVE-2026-84129 Site isolation issue in the DOM: Navigation component
- CVE-2026-84128 Privilege escalation in the WebDriver BiDi component
- CVE-2026-84127 Information disclosure in the WebExtensions component in Firefox for Android
- CVE-2026-84126 Incorrect boundary conditions in the Layout: Grid component
- CVE-2026-84125 Use-after-free in the DOM: Core & HTML component
- CVE-2026-84124 Use-after-free in the DOM: Core & HTML component
- CVE-2026-84123 Privilege escalation due to use-after-free in the Graphics: WebGPU component
- CVE-2026-84122 Use-after-free in the Audio/Video component
- CVE-2026-84121 Sandbox escape due to use-after-free in the DOM: Security component
- CVE-2026-84120 Use-after-free in the Audio/Video component
- CVE-2026-8412 Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/cache
- CVE-2026-84119 Sandbox escape due to use-after-free in the DOM: Navigation component
- CVE-2026-84118 Use-after-free in the JavaScript: GC component
- CVE-2026-84117 Privilege escalation in Firefox for Android
- CVE-2026-84115 Cleo Harmony JWT Refresh Token connections privileges management
- CVE-2026-84114 Cleo Harmony SAML Authentication LocalUserUtil.getNativeUserByAssertions improper authentication
- CVE-2026-84113 Quentn WP < 1.2.15 - Admin+ SQLi via 'orderby'/'order' Parameter
- CVE-2026-84111 Chanjet CRM jxf_dump_table.php sql injection
- CVE-2026-84110 Releasit Releasit COD Form & Upsells OTP Validation client-side enforcement of server-side security
- CVE-2026-8411 Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/delete
- CVE-2026-84109 Xinhu Rainrock RockOA webmainAction.php getOrder sql injection
- CVE-2026-84108 IBM Guardium Data Protection is affected by multiple vulnerabilities.
- CVE-2026-84106 IBM Guardium Data Protection is affected by multiple vulnerabilities.
- CVE-2026-84105 IBM Guardium Data Protection is affected by multiple vulnerabilities.
- CVE-2026-8410 Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/bulk/delete
- CVE-2026-84099 Deserialization in wpstorecart
- CVE-2026-84098 Directorist 3.1.0 - 8.9.4 - Subscriber+ Arbitrary Listing Deletion via remove_listing
- CVE-2026-84097 WP Review Slider Pro < 12.7.12 - Subscriber+ SQLi via Stored Template Filter
- CVE-2026-84096 WP Review Slider Pro < 12.7.12 - Subscriber+ Stored XSS via Review Form Fields
- CVE-2026-84095 WP Review Slider Pro < 12.7.12 - Subscriber+ Stored XSS via Review Import
- CVE-2026-84091 SUMIT Payment Gateway for WooCommerce < 4.0.0 - Unauthenticated Payment Confirmation Forgery via bit IPN
- CVE-2026-8409 Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/delete
- CVE-2026-84089 IBM Guardium Data Protection is affected by multiple vulnerabilities.
- CVE-2026-84088 Xpro Elementor Addons < 1.7.9 - Contributor+ Stored XSS via Interactive Circle Widget
- CVE-2026-84086 IBM Guardium Data Protection is affected by multiple vulnerabilities.
- CVE-2026-84085 IBM Guardium Data Protection is affected by multiple vulnerabilities.
- CVE-2026-84084 IBM Guardium Data Protection is affected by multiple vulnerabilities.
- CVE-2026-84083 IBM Guardium Data Protection is affected by multiple vulnerabilities.
- CVE-2026-84082 IBM Guardium Data Protection is affected by multiple vulnerabilities.
- CVE-2026-84081 IBM Guardium Data Protection is affected by multiple vulnerabilities.
- CVE-2026-84078 IBM Guardium Data Protection is affected by multiple vulnerabilities.
- CVE-2026-84077 IBM Guardium Data Protection is affected by multiple vulnerabilities.
- CVE-2026-84076 IBM Guardium Data Protection is affected by multiple vulnerabilities.
- CVE-2026-84075 IBM Guardium Data Protection is affected by multiple vulnerabilities.
- CVE-2026-84074 IBM Guardium Data Protection is affected by multiple vulnerabilities.
- CVE-2026-84073 IBM Guardium Data Protection is affected by multiple vulnerabilities.
- CVE-2026-84071 IBM Guardium Data Protection is affected by multiple vulnerabilities.
- CVE-2026-84070 IBM Guardium Data Protection is affected by multiple vulnerabilities.
- CVE-2026-8407 Missing authorization in Server
- CVE-2026-84069 WebFacing Email Accounts for cPanel 5.3 - 5.3.6 - Unauthenticated LFI via assets/index.php
- CVE-2026-84068 Quentn WP 1.2.13 - 1.2.14 - Unauthenticated SQLi via 'qntn_wp' Parameter
- CVE-2026-84066 Directorist < 8.9 - Subscriber+ Arbitrary Post Meta Write via atbdp_post_attachment_upload
- CVE-2026-84064 IBM Guardium Data Protection is affected by multiple vulnerabilities.
- CVE-2026-84063 File upload in BurgerEditor
- CVE-2026-84062 Missing authorization in BurgerEditor
- CVE-2026-84061 zhongyu09 OpenChatBI generate_sql.py _validate_sql_safety sql injection
- CVE-2026-8406 openSIS Classic 9.3 - Insecure Direct Object Reference in Sent Mail
- CVE-2026-84059 ICP DAS UA-2200/UA-5200 CGI ArmAngstromInstructionSet command injection
- CVE-2026-84058 Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection
- CVE-2026-84057 IBM Guardium Data Protection is affected by multiple vulnerabilities.
- CVE-2026-8405 IBM Guardium Data Protection is affected by Exposure of Sensitive Information vulnerability
- CVE-2026-84048 File upload in JoomGallery extension for Joomla
- CVE-2026-84047 Album Cover Finder <= 0.7.0 - Unauthenticated SQLi via and_action
- CVE-2026-84046 Directorist < 8.9.5 - Subscriber+ SSRF via Avatar URL
- CVE-2026-84045 E-cab Taxi Booking Manager for Woocommerce < 2.0.5 - Unauthenticated Price Manipulation via mptbm_add_to_cart
- CVE-2026-84044 Restaurant Menu and Food Ordering < 2.4.12 - Unauthenticated Payment Bypass via Forged PayPal IPN
- CVE-2026-84043 ePayco Payment Gateway for WooCommerce < 8.4.7 - Unauthenticated Payment Confirmation Bypass
- CVE-2026-84042 Crun: crun: rootful krun with passt executes container payload as host root
- CVE-2026-8404 Potential exposure of private data via case-sensitive Cache-Control directives in UpdateCacheMiddleware
- CVE-2026-84036 IBM Guardium Data Protection is affected by multiple vulnerabilities.
- CVE-2026-84035 Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection
- CVE-2026-84034 IBM Guardium Data Protection is affected by multiple vulnerabilities.
- CVE-2026-84032 IBM Guardium Data Protection is affected by multiple vulnerabilities
- CVE-2026-84031 IBM Guardium Data Protection is affected by multiple vulnerabilities.
- CVE-2026-8403 Stored XSS in Exagate's SYSGUARD 6001
- CVE-2026-84028 Bold Page Builder < 5.9.9 - Contributor+ Stored XSS via Slider Elements' additional_settings
- CVE-2026-84027 Directorist 8.9.1 - 8.9.4 - Subscriber+ Paid Order and Payment Record Forgery via REST Orders Endpoint
- CVE-2026-84026 Directorist 8.1 - 8.9.4 - Unauthenticated Sensitive Data Disclosure via REST Users Endpoint
- CVE-2026-84025 Missing authorization in BEAR
- CVE-2026-84024 BEAR - Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Meta Field Configuration Update via CSRF
- CVE-2026-84023 BEAR - Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Taxonomy Term Modification via CSRF
- CVE-2026-84022 Bold Page Builder < 5.9.8 - Contributor+ Stored XSS via Multiple Shortcode Element Attributes
- CVE-2026-84021 Bold Page Builder < 5.9.8 - Contributor+ Stored XSS via bt_bb_button/bt_bb_headline/bt_bb_icon URL
- CVE-2026-84020 Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability
- CVE-2026-8402 SQLi in Exagate's SYSGUARD 6001
- CVE-2026-84019 Windows Advanced Rasterization Platform Elevation of Privilege Vulnerability