Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 360 of 1013.
- CVE-2026-78935 Memory corruption in Chrome
- CVE-2026-78934 Race condition in Chrome
- CVE-2026-78915 Race condition in Chrome
- CVE-2026-78914 Information disclosure in Chrome
- CVE-2026-78913 Use after free in Chrome
- CVE-2026-78912 Other in Chrome
- CVE-2026-78911 Missing authorization in Chrome
- CVE-2026-78910 Memory corruption in Chrome
- CVE-2026-78909 Use after free in Chrome
- CVE-2026-78908 Information disclosure in Chrome
- CVE-2026-78907 Information disclosure in Chrome
- CVE-2026-78906 Race condition in Chrome
- CVE-2026-78905 Memory corruption in Chrome
- CVE-2026-78904 Memory corruption in Chrome
- CVE-2026-78903 Security feature bypass in Chrome
- CVE-2026-78902 Cross Site Scripting vulnerability in Netgate pfSense 26.03.1-RELEASE allows an attacker to execute arbitrary code via the pfBlockerNG packa
- CVE-2026-78901 Race condition in Chrome
- CVE-2026-78900 Other in Chrome
- CVE-2026-7890 Concrete CMS 9.5.0 is vulnerable to SSRF via RSS Displayer Block
- CVE-2026-78899 Use after free in Chrome
- CVE-2026-78898 Security feature bypass in Chrome
- CVE-2026-78897 Missing authorization in Chrome
- CVE-2026-78896 Information disclosure in Chrome
- CVE-2026-78895 Information disclosure in Chrome
- CVE-2026-78894 Race condition in Chrome
- CVE-2026-78893 Information disclosure in Chrome
- CVE-2026-78892 Security feature bypass in Chrome
- CVE-2026-78891 Memory corruption in Chrome
- CVE-2026-78887 liketrek TREK Journey Photo Proxy validateShareTokenForAsset authorization
- CVE-2026-78886 liketrek TREK Public Journey Photo Proxy journey-public.controller.ts path traversal
- CVE-2026-78885 liketrek TREK OIDC Service oidcService.ts findOrCreateUser improper authentication
- CVE-2026-7888 Concrete CMS is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components
- CVE-2026-7887 For Concrete CMS 9.5.0 and below, OAuth 2.0 Authorization-Code Handler Bypasses Account Status
- CVE-2026-78864 liketrek TREK Journey Entry Update journey.controller.t journeyService.updateEntry sql injection
- CVE-2026-78863 liketrek TREK Pre-2FA mfa_token authService.ts loginUser improper authentication
- CVE-2026-78862 An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the UART serial interface on the printed circuit board (P
- CVE-2026-78861 An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via a hardcoded 512-bit RSA Private Key
- CVE-2026-78860 An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the storage of information in plaintext
- CVE-2026-7886 Concrete CMS 9.5.0 and below is vulnerable to IDOR in AddMessage/UpdateMessage via attachments[] parameter
- CVE-2026-78851 Directory Traversal vulnerability in Grav CMS 2.0.3 through 2.0.6 allows a remote attacker to obtain sensitive information via the GravExten
- CVE-2026-78850 An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the SiteContentDetector / SitesManager component.
- CVE-2026-78849 Cross Site Scripting vulnerability in Netgate pfSense Plus software versions <= 26.03 pfSense CE software versions <= 2.8.1 allows a remote
- CVE-2026-78847 An issue in gray-matter All versions (verified on 4.0.3) allows the JavaScript engine in lib/engines.js using eval() to parse front matter w
- CVE-2026-78846 Multiple AiDot devices are vulnerable to a heap-based buffer overflow via SSDP location header parsing.
- CVE-2026-78845 Aidot products Linkind Matter Smart Plug 1.01.32, OREiN Matter Smart Light Bulb 3.15.21, and Linkind Wi-Fi Smart Light Bulb 3.30.17 are vuln
- CVE-2026-7884 IBM Cognos Analytics versions 12.0.4 and 12.1.3 is affected by security vulnerabilities
- CVE-2026-78839 An arbitrary file upload vulnerability in AppNitro MachForm v30 allows attackers to execute arbitrary code via uploading a crafted .phar file.
- CVE-2026-78838 A reflected cross-site scripting (XSS) vulnerability in the grid_datasource.php component of AppNitro MachForm v30 allows attackers to execu
- CVE-2026-78837 A SQL injection vulnerability in the ap_form_{id} parameter in AppNitro MachForm v30 allows attackers to access sensitive database informati
- CVE-2026-78835 Rocket Software Rocket Remote Desktop 18.0.8583.1 is vulnerable to Insufficiently Protected Credentials.
- CVE-2026-78834 A code execution vulnerability exists in CMSimple 5.22 in the CoAuthors plugin.
- CVE-2026-7882 Concrete CMS 9.5.0 and below is vulnerable to CSRF via the DeleteFile controller
- CVE-2026-7881 Concrete CMS 9.5.0 and below is vulnerable to IDOR in the Express Entry Detail block
- CVE-2026-78807 An issue in wpa_supplicant all versions before v.2.12 allows a local attacker to bypass proper network context and AKMP matching for PMKSA c
- CVE-2026-78806 An issue in Matter Standard Specification-Implementation gap v1.5.1 Matter Project Chip V1.5.1 allows a local attacker to obtain sensitive i
- CVE-2026-78802 An issue in SKYWORTH DIGITAL CO.,LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to execute arbitrary code.
- CVE-2026-78801 An issue in SKYWORTH DIGITAL CO., LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to obtain sensitiv
- CVE-2026-78799 Directory Traversal vulnerability in Quanxun Huiju Network Technology (Beijing) Co., Ltd IK-Q3000 Enterprise-grade Wi-Fi 6 wireless router E
- CVE-2026-78797 An issue in iStoreOS istoreos-24.10.7 and before allows a remote attacker to execute arbitrary code via the task_id in tasks-lib.lua.
- CVE-2026-78796 An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114.024540 and before allows a remote attacker to
- CVE-2026-78795 An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114.024540 and before allows a remote attacker to
- CVE-2026-7879 Concrete CMS 9.5.0 and below is vulnerable to File Download Authorization Bypass in submit_password()
- CVE-2026-7877 Cross-site scripting in WP Recipe Maker Premium
- CVE-2026-7876 Authentication bypass vulnerability found in Aspera High-Speed Transfer Server for Cloud Pak for Integration
- CVE-2026-7875 NanoClaw Host/Container Filesystem Boundary Vulnerability via Outbound Attachment Handling
- CVE-2026-78745 An issue in HiDPT/ Weyon HiDPTAndroid Hi3751V350 Hi3751V352E_DMO allows a remote attacker to execute arbitrary code via the Android Debug Br
- CVE-2026-78742 Silverpeas Core <=6.4.6 is vulnerable to Cross Site Scripting (XSS) via the Multimedia library application introduction.
- CVE-2026-78741 Silverpeas Core <=6.4.6 is vulnerable to Cross Site Scripting (XSS) in the wysiwyg-CKEditor image upload feature.
- CVE-2026-7874 Weak Cryptographic Key Derivation Exposed All Stored Credentials
- CVE-2026-78738 Silverpeas Core 6.4.6 is vulnerable to Cross Site Scripting (XSS) via the Document management file upload feature.
- CVE-2026-7873 Code Injection Vulnerability in Code Validation Endpoint
- CVE-2026-7872 Path Traversal Vulnerability in File Component Leading to Arbitrary File Read and Authentication Bypass
- CVE-2026-7871 Insecure Deserialization in Redis Cache Backend
- CVE-2026-78701 389-ds-base: 389-ds-base: cve-2026-11610 incomplete fix may introduce a connection-stall dos
- CVE-2026-7870 IBM i is Affected by Privilege Escalation []
- CVE-2026-78699 rename_tenant returns :ok on a failed rename, enabling cross-tenant access in AshPostgres
- CVE-2026-78693 Incomplete redaction re-attaches the original error path in AshGraphql, leaking internal field names
- CVE-2026-78691 Unescaped backslash allows LIKE wildcard injection in AshSql string search
- CVE-2026-7869 Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement
- CVE-2026-78689 NGINX ngx_http_js_module vulnerablility
- CVE-2026-78685 Le-yan｜Medical Practice Management System - Remote Code Execution
- CVE-2026-78684 vLLM before 0.27.0 Denial of Service via DeepStream Backend
- CVE-2026-78683 NLTK before 3.10.0 Remote Code Execution via Unsafe Pickle Deserialization
- CVE-2026-78682 NLTK before 3.10.3 SSRF Protection Bypass via Proxy
- CVE-2026-78681 NLTK before 3.10.3 Entity Expansion DoS via ElementTree
- CVE-2026-78680 NLTK before 3.10.3 Arbitrary Code Execution via Graphviz dot Binary
- CVE-2026-7868 This Power System update is being released to address incorrect authorization
- CVE-2026-78679 GitPython before 3.1.59 Arbitrary File Read via TagReference.create
- CVE-2026-78678 GitPython before 3.1.59 Arbitrary File Read via Repo.blame()
- CVE-2026-78677 GitPython before 3.1.59 Path Traversal via separate-git-dir
- CVE-2026-78676 GitPython before 3.1.59 Remote Code Execution via Config Injection
- CVE-2026-78675 GitPython before 3.1.59 Local File Content Disclosure via .gitmodules
- CVE-2026-78674 Remote Code Execution via BPMN System REST APIs in Multiple WSO2 Products Permits Arbitrary Command Execution
- CVE-2026-78673 Maximo AI Service Improper Input Validation
- CVE-2026-7867 Udisks2: udisks2: local privilege escalation via as-user option spoofing
- CVE-2026-78669 Excessive CPU consumption from repeated initial window changes in net/http
- CVE-2026-78667 Lack of limit on size of parsed Range headers in net/http
- CVE-2026-78663 Double flow control refund on HTTP/2 server streams in net/http
- CVE-2026-78662 Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh
- CVE-2026-78661 Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net