Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 355 of 1013.
- CVE-2026-79663 Ech0 before 4.7.3 Stored XSS via RSS feed tag names
- CVE-2026-79662 Ech0 before 4.7.3 OAuth Redirect URI Validation Bypass
- CVE-2026-79661 Ech0 before 4.7.3 Unauthenticated fav_count Modification
- CVE-2026-79660 Ech0 before 4.7.3 Email Disclosure via Public API
- CVE-2026-7966 Security feature bypass in Chrome
- CVE-2026-79659 Ech0 before 4.7.3 Server-Side Request Forgery via fetchPeerConnectInfo
- CVE-2026-79658 Ech0 before 5.0.1 Denial of Service via Accept-Language
- CVE-2026-79657 NLTK before 3.10.3 Remote Code Execution via Unsafe Pickle Deserialization
- CVE-2026-79656 OAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors
- CVE-2026-79655 Path traversal in Red Hat Enterprise Linux 10
- CVE-2026-79654 Ketello: katello content view history api cross-organization authorization bypass
- CVE-2026-79653 Path traversal in Eclipse SW360
- CVE-2026-79652 Keycloak-services: keycloak-services: jwt bearer authorization grant does not enforce consentrequired
- CVE-2026-79651 Keycloak-services: keycloak-services: unauthenticated dos via unbounded locale caching
- CVE-2026-79650 Apache CXF: OIDC RP Open Redirect
- CVE-2026-7965 Information disclosure in Chrome
- CVE-2026-79645 Auth bypass in Secure Connect Gateway 5.0 - Appliance
- CVE-2026-79644 Security feature bypass in Secure Connect Gateway 5.0 - Appliance
- CVE-2026-79643 Auth bypass in Secure Connect Gateway 5.0 - Appliance
- CVE-2026-79642 Security feature bypass in Secure Connect Gateway 5.0 - Appliance
- CVE-2026-79641 Command injection in Secure Connect Gateway 5.0 - Appliance
- CVE-2026-79640 SQL injection in Secure Connect Gateway 5.0 - Appliance
- CVE-2026-7964 Other in Chrome
- CVE-2026-79639 Security feature bypass in Secure Connect Gateway 5.0 - Appliance
- CVE-2026-79638 Cross-site scripting in Secure Connect Gateway 5.0 - Appliance
- CVE-2026-79637 Security feature bypass in Secure Connect Gateway 5.0 - Appliance
- CVE-2026-79636 Security feature bypass in Secure Connect Gateway 5.0 - Appliance
- CVE-2026-79635 Server-side request forgery in Secure Connect Gateway 5.0 - Appliance
- CVE-2026-79633 Apache Answer: Missing Authorization Allows Mutations of Non-Public Content
- CVE-2026-79632 WPFunnels < 3.13.0 - Unauthenticated Arbitrary Recipient Email Sending via wpfnl_shortcode_optin_submission
- CVE-2026-79631 WPFunnels < 3.13.0 - Unauthenticated Order and Opt-In PII Disclosure via Web-Accessible Log Files
- CVE-2026-79630 WPFunnels < 3.13.0 - Unauthenticated Price Manipulation via Order Bump Product ID Substitution
- CVE-2026-7963 Security feature bypass in Chrome
- CVE-2026-79627 Advanced File Manager 5.4.13 - 5.4.14 - Authenticated Stored XSS via SVG Sanitiser Content-Sniff Bypass
- CVE-2026-79625 Improper Synchronization in Monitoring in CODESYS Control Runtime
- CVE-2026-79624 Apache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session Revocation
- CVE-2026-79623 FishCodeTech Muteki Default Local Worker Backend settings.json os command injection
- CVE-2026-79622 dekdee adobe-xd-mcp file-access-from-request Endpoint xd-parser.ts path traversal
- CVE-2026-79621 CatalogX < 6.1.3 - Unauthenticated Email Content Injection via Shared Transient
- CVE-2026-79620 Apache Answer: Improper Authorization Allows Disclosure of Non-Public Question Metadata
- CVE-2026-7962 Security feature bypass in Chrome
- CVE-2026-79619 OpenZFS: user-namespace capability check allows unprivileged local authorization bypass
- CVE-2026-79618 WP User Frontend < 4.3.12 - Subscriber+ Post Creation via Subscription-Gated Form
- CVE-2026-79617 Improper Access Control Leading to Display Exposure in TÜBİTAK BİLGEM's Pardus LightDM Greeter
- CVE-2026-79616 Out-of-bounds read vulnerability in Context2D.path and PathSvg.path properties impacts Qt Quick
- CVE-2026-79615 Quiz And Survey Master < 11.2.4 - Contributor+ Cross-Quiz Question Bank and Answer Key Disclosure via IDOR
- CVE-2026-79613 Apache Answer: Disclosure of Comments on Non-Public Content Through Public Profiles
- CVE-2026-79611 VMX: VMentry failure with branch tracing and blocked states
- CVE-2026-79610 grant-table: double version change race
- CVE-2026-7961 Information disclosure in Chrome
- CVE-2026-79609 x86: XPTI may break on huge-memory systems
- CVE-2026-79608 x86/AMD: ineffectual Zenbleed workaround
- CVE-2026-79607 Xenstore: Guests can crash xenstored during Live Update
- CVE-2026-79603 Unconditionally do TLB flushing ahead of page scrubbing
- CVE-2026-79602 x86: improper handling of HVM emulation return codes
- CVE-2026-7960 Race condition in Chrome
- CVE-2026-79592 An out-of-bounds read vulnerability exists in the xls_dumpSummary() function of libxls 1.6.3 due to insufficient validation of file-controll
- CVE-2026-79591 A heap-buffer-overflow and use-after-free vulnerability exists in the xls_getCSS() function of libxls 1.6.3 due to insufficient validation o
- CVE-2026-79590 A NULL pointer dereference vulnerability exists in the Prism parser component of mruby 4.0.0.
- CVE-2026-7959 Security feature bypass in Chrome
- CVE-2026-79589 The WIFI4 N300 router (Model: T1 Pro) v1.0.0 by U-speed contains an insecure access control flaw that allows an attacker to gain unauthenticated root shell.
- CVE-2026-79588 U-speed WIFI4 N300 T1 Pro v1.0.0 is vulnerable to Cleartext transmission of administration credentials over HTTP.
- CVE-2026-7958 Cross-site scripting in Chrome
- CVE-2026-79577 An issue in the /cas/login component of sso-master v1.0.0 allows attackers to authenticate into the application without a password via sendi
- CVE-2026-79576 An issue in the Single-Sign On (SSO) component of Digital-Infrastructure v9.6.7 allows attackers to authenticate as any user, including the
- CVE-2026-79575 The JWT signing secret in yfexam-exam v2.0 is derived from the username and the current month instead of a random server-side key, making th
- CVE-2026-79574 An issue in the gateway server of mpush v0.8.1 allows attackers to execute arbitrary code via sending a crafted broadcast message.
- CVE-2026-79573 L-ONE v1.0.0 was discovered to contain multiple SQL injection vulnerabilities in the /attachment/getBusinessUploadList component via the bus
- CVE-2026-79572 An XXE (XML External Entity) vulnerability in the level-rule module of Distribution Management v1.0.0 allows attackers to read sensitive fil
- CVE-2026-79571 Incorrect access control in the SellerAuthorizeAspect component of springboot-project v1.0.0 allows unauthenticated attackers to access all
- CVE-2026-79570 mfish-nocode-pro v1.0.0 was discovered to contain a SQL injection vulnerability in the tableName parameter at /sys/dbConnect/data.
- CVE-2026-7957 Memory corruption in Chrome
- CVE-2026-79569 Movie_Recommend v1.0.0 was discovered to contain a SQL injection vulnerability in the sort parameter at /loadingmore.
- CVE-2026-7956 Use after free in Chrome
- CVE-2026-79551 Tenda Technology Co., Ltd NVR_4H CH3 v2.1 V27.5.58.6 was discovered to contain a hardcoded cryptographic key.
- CVE-2026-7955 Information disclosure in Chrome
- CVE-2026-7954 Race condition in Chrome
- CVE-2026-79538 metatool-ai MetaMCP up to and including 2.4.22 is vulnerable to Code Execution in the internal MCP inspector proxy endpoint GET /mcp-proxy/s
- CVE-2026-79537 metatool-ai MetaMCP through 2.4.22 contains an insecure direct object reference (IDOR) in the MCP transport session dispatch.
- CVE-2026-79536 bytebase dbhub v1.2.0 was discovered to contain a SQL injection vulnerability in the /utils/sql-parser.ts component.
- CVE-2026-79535 mbailey VoiceMode <= 8.10.1 is vulnerable to OS Command Injection.
- CVE-2026-79534 mark3labs mcp-filesystem-server v0.11.1 is vulnerable to Directory Traversal due to an improper link resolution in validatePath (filesystems
- CVE-2026-7953 Cross-site scripting in Chrome
- CVE-2026-79522 Memory corruption in gpac:gpac
- CVE-2026-7952 Security feature bypass in Chrome
- CVE-2026-79516 An out-of-bounds read in the stbsp_vsnprintf function (stb_sprintf.h) of nothings stb commit 31c1ad3 allows attackers to cause a Denial of S
- CVE-2026-79515 An out-of-bounds read in the stbtt_GetGlyphShape component of nothings stb commit 31c1ad3 allows attackers to cause a Denial of Service (DoS
- CVE-2026-79514 Memory corruption in gpac:gpac
- CVE-2026-79513 Denial of service in gpac:gpac
- CVE-2026-7951 Memory corruption in Chrome
- CVE-2026-7950 Memory corruption in Chrome
- CVE-2026-7949 Memory corruption in Chrome
- CVE-2026-79483 FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint.
- CVE-2026-7948 Race condition in Chrome
- CVE-2026-7947 Other in Chrome
- CVE-2026-7946 Security feature bypass in Chrome
- CVE-2026-7945 Security feature bypass in Chrome
- CVE-2026-7944 Security feature bypass in Chrome
- CVE-2026-7943 Memory corruption in Chrome
- CVE-2026-79426 An arbitrary file deletion vulnerability in the /adminapi/file/video_data_save component of CRMEB v6.0.0 allows authenticated attackers to d