Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 354 of 1013.
- CVE-2026-79771 Nokogiri before 1.19.3 Memory Leak via XSLT Transform
- CVE-2026-79770 Nokogiri before 1.19.3 ReDoS via CSS selector tokenizer
- CVE-2026-7977 Security feature bypass in Chrome
- CVE-2026-79769 Nokogiri before 1.19.4 Invalid Memory Read via initialize_copy_with_args
- CVE-2026-79768 Apache HTTP Server: mod_userdir information disclosure
- CVE-2026-79767 Gardener: Authorization Bypass via Group Subject Injection
- CVE-2026-79766 Termix: OS command injection in ACME/Let's Encrypt certificate-request handler via admin-controlled domain/email
- CVE-2026-79764 Termix: Authenticated SSRF via `/homepage/proxy` — No Destination Allowlist
- CVE-2026-79763 Termix: MFA-critical operations accept the account password as a sole factor (regression of CVE-2026-45749)
- CVE-2026-79762 Hardcoded credentials in Termix
- CVE-2026-79761 Termix: Command injection in SSH key deployment verification
- CVE-2026-79760 Termix: Authenticated blind SSRF through notification channel test endpoints
- CVE-2026-7976 Use after free in Chrome
- CVE-2026-79759 Termix: Cross-User Information Disclosure via Missing Ownership Check in deploy-to-host Endpoint
- CVE-2026-79758 Termix: Authenticated users can read other users' host status and clear global SSH connections
- CVE-2026-79756 Nuclio: Unauthenticated OS command injection via namespace header in list-all resource path on local platform
- CVE-2026-79755 Nuclio: Unauthenticated OS command injection via function namespace in docker ps --filter label (local Docker platform)
- CVE-2026-79754 Nuclio: Kaniko build tempDir command injection
- CVE-2026-79752 CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection
- CVE-2026-79750 Missing authorization in mcphub
- CVE-2026-7975 Use after free in Chrome
- CVE-2026-79749 MCPHub: SSRF Guard Bypass via IPv6 Transition Addresses in URL Validation
- CVE-2026-79748 MCPHub: Authenticated non-admin user achieves RCE via POST /api/servers (missing authorization on stdio command/args)
- CVE-2026-79747 Server-side request forgery in mcphub
- CVE-2026-79746 MCPHub: Server-scoped bearer key gains access to an entire group via partial (any-overlap) server matching
- CVE-2026-79745 Missing authorization in mcphub
- CVE-2026-79744 MCPHub: Missing Authorization on `PUT /api/system-config` Lets Any Non-Admin Rewrite Global Security Configuration
- CVE-2026-79743 MCPHub: Path Traversal via Malicious MCPB Manifest Name
- CVE-2026-79742 Code injection in Langflow OSS
- CVE-2026-79741 Command injection in Secure Connect Gateway 5.0 - Appliance
- CVE-2026-79740 Hardcoded credentials in Secure Connect Gateway 5.0 - Appliance
- CVE-2026-7974 Use after free in Chrome
- CVE-2026-79738 Hardcoded credentials in Secure Connect Gateway 5.0 - Appliance
- CVE-2026-79736 Security feature bypass in Secure Connect Gateway 5.0 - Appliance
- CVE-2026-79735 Hardcoded credentials in Secure Connect Gateway 5.0 - Appliance
- CVE-2026-79734 Security feature bypass in Secure Connect Gateway 5.0 - Appliance
- CVE-2026-79732 Security feature bypass in Secure Connect Gateway 5.0 - Appliance
- CVE-2026-79731 Hardcoded credentials in Secure Connect Gateway 5.0 - Appliance
- CVE-2026-79730 Race condition in Secure Connect Gateway 5.0 - Appliance
- CVE-2026-7973 Integer overflow in Chrome
- CVE-2026-79729 Security feature bypass in Secure Connect Gateway 5.0 - Appliance
- CVE-2026-79728 Path traversal in Secure Connect Gateway 5.0 - Appliance
- CVE-2026-79727 Information disclosure in Secure Connect Gateway 5.0 - Appliance
- CVE-2026-79725 Langflow is vulnerable to unauthorized file system access due to path traversal and missing storage path validation
- CVE-2026-79724 Command injection in Langflow OSS
- CVE-2026-79723 Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches
- CVE-2026-79721 Code injection in mlflow
- CVE-2026-79720 Cross-site scripting in Netron
- CVE-2026-7972 Information disclosure in Chrome
- CVE-2026-79719 Cross-site scripting in Netron
- CVE-2026-79718 Cross-site scripting in Netron
- CVE-2026-79717 Galaxy_ng: galaxy_ng: blind ssrf via namespace avatar_url with no private-address restriction
- CVE-2026-79715 IBM WebSphere Application Server Liberty Path Traversal
- CVE-2026-79713 Breeze Cache 1.2.5 - 2.5.14 - Unauthenticated Cache Poisoning via Unkeyed Tracking Parameters
- CVE-2026-7971 Security feature bypass in Chrome
- CVE-2026-79708 Incorrect Authorization in GitLab
- CVE-2026-79707 Arbitrary File Read in Google Agent Development Kit (ADK)
- CVE-2026-79706 Breeze Cache < 2.5.13 - Unauthenticated File Creation via Cache Path Traversal
- CVE-2026-79705 Path traversal in Red Hat Ansible Automation Platform 2
- CVE-2026-79704 Apache bRPC: Out-of-bounds Read in Multi-stream RPC Response Handling
- CVE-2026-79701 Security feature bypass in SP Page Builder (Pro) extension for Joomla
- CVE-2026-79700 Security feature bypass in SP Page Builder (Pro) extension for Joomla
- CVE-2026-7970 Use after free in Chrome
- CVE-2026-79699 Path traversal in Red Hat Ansible Automation Platform 2
- CVE-2026-79698 Advantech WISE-6610-NB Node-RED nodered_lib_apply command injection
- CVE-2026-79697 Advantech WISE-6610-NB Basic Station Certificate-Deletion basicstation_apply command injection
- CVE-2026-79696 Remote Code Execution in Google ADK for Python via Incomplete Standard Library Denylist
- CVE-2026-79695 Denial of service in Secure Connect Gateway 5.0 - Appliance
- CVE-2026-79694 Information disclosure in Secure Connect Gateway 5.0 - Appliance
- CVE-2026-79693 Privilege escalation in Secure Connect Gateway 5.0 - Appliance
- CVE-2026-79692 Path traversal in Secure Connect Gateway 5.0 - Appliance
- CVE-2026-79691 Security feature bypass in Secure Connect Gateway 5.0 - Appliance
- CVE-2026-79690 Security feature bypass in Secure Connect Gateway 5.0 - Appliance
- CVE-2026-7969 Integer overflow in Chrome
- CVE-2026-79689 Command injection in Secure Connect Gateway 5.0 - Appliance
- CVE-2026-79687 Auth bypass in PowerStore 1000T
- CVE-2026-79686 Security feature bypass in PowerStore 1000T
- CVE-2026-79685 Command injection in PowerStore 1000T
- CVE-2026-79684 Security feature bypass in PowerStore 1000T
- CVE-2026-79683 Security feature bypass in PowerStore 1000T
- CVE-2026-79682 Command injection in PowerStore 1000T
- CVE-2026-79680 Authentication bypass vulnerability in the password authentication mechanism of the Qt VNC Server module
- CVE-2026-7968 Security feature bypass in Chrome
- CVE-2026-79679 Use of Weak Credentials
- CVE-2026-79678 Code injection in Red Hat Enterprise Linux 10
- CVE-2026-79677 Apache Tomcat: WebSocket DoS due to lost asynchronous write timeout
- CVE-2026-79676 NLTK before 3.10.3 Path Traversal via Symlink Bypass
- CVE-2026-79675 NLTK before 3.10.3 JVM Argument Injection via Per-Call Options
- CVE-2026-79674 NLTK 3.10.2 Path Traversal via corpus-reader constructors
- CVE-2026-79673 Ech0 before 4.4.3 Scope Bypass via profile:read Token
- CVE-2026-79672 Ech0 before 4.4.3 Authentication Bypass via Comment Panel
- CVE-2026-79671 Ech0 before 4.4.3 SSRF via DNS Resolution Bypass
- CVE-2026-79670 Ech0 before 4.4.3 Stored XSS via SVG Upload
- CVE-2026-7967 Security feature bypass in Chrome
- CVE-2026-79669 Ech0 before 4.4.3 Missing Authorization on System Logs
- CVE-2026-79668 Ech0 before 4.7.3 Unauthenticated Like Endpoint Metric Inflation
- CVE-2026-79667 Ech0 before 4.4.3 Authentication Bypass via Scope Enforcement
- CVE-2026-79666 Ech0 before 4.4.3 Missing Authorization via dashboard log endpoints
- CVE-2026-79665 Ech0 before 4.5.1 Authorization Bypass via Session Tokens
- CVE-2026-79664 Ech0 before 4.7.3 Access Token Revocation Bypass