Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 356 of 1013.
- CVE-2026-79425 An authenticated Server-Side Request Forgery (SSRF) in the /adminapi/file/online_upload component of CRMEB v6.0.0 allows attackers to scan i
- CVE-2026-79423 An authenticated remote code execution (RCE) vulnerability in the admin_config.php component of seacms v13.6 allows attackers to execute arb
- CVE-2026-7942 Integer overflow in Chrome
- CVE-2026-79419 Cross-site scripting in emxtecnologia:gestao x business suite
- CVE-2026-79418 Cross-site scripting in emxtecnologia:gestao x business suite
- CVE-2026-79417 Improper Access Control in ArgusMonitor.sys in Argotronic eGbR ArgusMonitor 7.4.02 and earlier allows local, low-privileged users to bypass
- CVE-2026-79411 Incorrect privilege assignment in the admin user-management component of Webkul Bagisto 2.4.9 allows an authenticated backend user holding o
- CVE-2026-79410 Improper validation of the quantity parameter in the add-to-cart path of Webkul Bagisto v2.4.9 allows authenticated attackers to reduce thei
- CVE-2026-7941 Cross-site scripting in Chrome
- CVE-2026-79409 An issue in Webkul Bagisto 2.4.9 allows a remote attacker to obtain sensitive information via the add-to-cart API and the downloadable fulfilment components.
- CVE-2026-79408 An OS command injection vulnerability in MetaGPT 0.8.1 allows an attacker to execute arbitrary commands via the path argument of RepoParser.
- CVE-2026-79407 A path traversal vulnerability in the SPO extension of MetaGPT 0.8.1 allows an attacker to read arbitrary files via the FILE_NAME value used
- CVE-2026-79406 macrozheng mall quantity OmsCartItemServiceImpl.updateQuantity logic error
- CVE-2026-79403 An issue in Kilo Code before v7.4.1 allows a local attacker to execute arbitrary code via the permission/allow-everything endpoint
- CVE-2026-7940 Use after free in Chrome
- CVE-2026-79396 Use of hardcoded default credentials in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier stores static account credenti
- CVE-2026-79395 An improper authentication vulnerability in the WS-Security (wsse:UsernameToken) verification routine within the Sofia IPC daemon in Xiongma
- CVE-2026-79394 An insecure default configuration in the embedded Happytime RTSP server within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT
- CVE-2026-79393 A heap-based buffer overflow vulnerability in the WS-Addressing Action transformation function in the Sofia IPC daemon in Xiongmai IP Camera
- CVE-2026-79391 No authentication exists in the MQTT service of Trueview 6.0.23.4.
- CVE-2026-79390 Trueview TI8161 6.0.23.4 is vulnerable to information disclosure due to the transmission of MQTT communications in plaintext over TCP port 1883.
- CVE-2026-7939 Cross-site scripting in Chrome
- CVE-2026-79389 Trueview T18161 S 6.0.23.4 contains an improper verification in MQTT command processing.
- CVE-2026-79387 SQL injection vulnerability in PbootCMS versions 3.2.0 through 3.2.5 allows an authenticated user to modify arbitrary user account fields (i
- CVE-2026-7938 Use after free in Chrome
- CVE-2026-79379 A buffer overflow in the SBC_DecodeFrames() function of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmware v3.x and earlier and fixed
- CVE-2026-79378 An issue in the btm_acl_handle() function of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmware v3.x and earlier allows attackers to c
- CVE-2026-79377 A heap overflow in the a2dp_decoder_sbc.cpp component of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmware v3.x and earlier allows at
- CVE-2026-79376 An issue in the l2cap_handle_data() function of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmware v3.x and earlier allows attackers t
- CVE-2026-7937 Security feature bypass in Chrome
- CVE-2026-79363 Cloudron 9.1.7 and 9.2 contain a stored cross-site scripting (XSS) vulnerability in the Branding Footer feature.
- CVE-2026-79362 Certain Woltlab products are affected by RCE via Cache Poisoning.
- CVE-2026-7935 Other in Chrome
- CVE-2026-79348 KitchenAsty through 0.3.0 contains a broken object level authorization (IDOR) vulnerability in the reservations API.
- CVE-2026-7934 Security feature bypass in Chrome
- CVE-2026-7933 Memory corruption in Chrome
- CVE-2026-79324 Missing authorization in mageplaza:gdpr
- CVE-2026-79323 Information disclosure in mageplaza:magefan blog
- CVE-2026-79322 SQL injection in mageplaza:mageplaza blog
- CVE-2026-79320 Stencil core 4.43.5 contains a DOM-based cross-site scripting (XSS) vulnerability in the component runtime.
- CVE-2026-7932 Security feature bypass in Chrome
- CVE-2026-79319 Stencil core 4.43.5 is vulnerable to Incorrect Access Control.
- CVE-2026-79318 web2py 3.2.2-stable (commit a7330a2bf21219fa77860b6665de927dd4f98e6d) is vulnerable to Directory Traversal in read_file()/write_file() (appl
- CVE-2026-79317 A session invalidation flaw exists in x-ui 0.3.2.
- CVE-2026-79316 An improper access control vulnerability exists in x-ui 0.3.2.
- CVE-2026-79315 A reflected cross-site scripting vulnerability exists in x-ui 0.3.2.
- CVE-2026-79314 A horizontal privilege escalation vulnerability exists in x-ui 0.3.2.
- CVE-2026-79313 webpy web.py 0.76 is vulnerable to Insufficient Session Expiration.
- CVE-2026-79312 webpy web.py 0.76 is vulnerable to Session Fixation.
- CVE-2026-79311 webpy web.py 0.76 is vulnerable to Cross Site Scripting (XSS) via render_jinja.__init__().
- CVE-2026-79310 webpy web.py 0.76 is vulnerable to server-side template injection (SSTI).
- CVE-2026-7931 Other in Chrome
- CVE-2026-79306 CyberPanel v1.9.1 contains a path traversal vulnerability in the compress method exposed through the /filemanager/controller endpoint.
- CVE-2026-79304 CyberPanel 1.9.1 contains a path traversal vulnerability in the readFileContents method of the /filemanager/controller endpoint.
- CVE-2026-79303 kaiten from 57.192.20 to before 57.214.26 is vulnerable to SQL Injection.
- CVE-2026-79300 Auth bypass in sesam
- CVE-2026-79298 An issue in Howyar Technologies Inc SysReturn Versions prior to 11.3.034 and fixed in v.11.3.0.34 allows a local attcker to execute arbitrar
- CVE-2026-79294 Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18 allows a remote attacker to execute arbitrary code via the H
- CVE-2026-79293 Information disclosure in Chrome
- CVE-2026-79292 Integer overflow in Chrome
- CVE-2026-79291 Information disclosure in Chrome
- CVE-2026-79290 Use after free in Chrome
- CVE-2026-7929 Use after free in Chrome
- CVE-2026-79289 Security feature bypass in Chrome
- CVE-2026-79288 Information disclosure in Chrome
- CVE-2026-79287 Information disclosure in Chrome
- CVE-2026-79286 Missing authorization in Chrome
- CVE-2026-79285 Information disclosure in Chrome
- CVE-2026-79284 Other in Chrome
- CVE-2026-79283 Other in Chrome
- CVE-2026-79282 Use after free in Chrome
- CVE-2026-7928 Use after free in Chrome
- CVE-2026-79276 Privilege escalation in Chrome
- CVE-2026-79275 Use after free in Chrome
- CVE-2026-79274 Information disclosure in Chrome
- CVE-2026-79273 Security feature bypass in Chrome
- CVE-2026-79272 Information disclosure in Chrome
- CVE-2026-79271 Information disclosure in Chrome
- CVE-2026-79270 Information disclosure in Chrome
- CVE-2026-7927 Memory corruption in Chrome
- CVE-2026-79269 Information disclosure in Chrome
- CVE-2026-79267 Race condition in Chrome
- CVE-2026-79266 Use after free in Chrome
- CVE-2026-79265 Information disclosure in Chrome
- CVE-2026-79264 Security feature bypass in Chrome
- CVE-2026-79263 Race condition in Chrome
- CVE-2026-79262 Security feature bypass in Chrome
- CVE-2026-79261 Security feature bypass in Chrome
- CVE-2026-79260 Security feature bypass in Chrome
- CVE-2026-7926 Use after free in Chrome
- CVE-2026-79259 Security feature bypass in Chrome
- CVE-2026-79258 Missing authorization in Chrome
- CVE-2026-79257 Use after free in Chrome
- CVE-2026-79256 Code injection in Chrome
- CVE-2026-79255 Security feature bypass in Chrome
- CVE-2026-79254 Security feature bypass in Chrome
- CVE-2026-79253 Information disclosure in Chrome
- CVE-2026-79252 Information disclosure in Chrome
- CVE-2026-79251 Security feature bypass in Chrome
- CVE-2026-79250 Other in Chrome