Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 381 of 1013.
- CVE-2026-7605 Server-side request forgery in JeecgBoot
- CVE-2026-76049 SourceCodester Simple Online Food Ordering System ajax.php save_menu sql injection
- CVE-2026-76048 SourceCodester Simple Online Food Ordering System ajax.php login sql injection
- CVE-2026-76047 Memory corruption in Chrome
- CVE-2026-76046 Memory corruption in Chrome
- CVE-2026-76045 Use after free in Chrome
- CVE-2026-76044 Race condition in Chrome
- CVE-2026-76043 Memory corruption in Chrome
- CVE-2026-76042 Information disclosure in Chrome
- CVE-2026-76041 Information disclosure in Chrome
- CVE-2026-76040 Use after free in Chrome
- CVE-2026-7604 JeecgBoot OpenApi Service OpenApiController.java OpenApiController.call server-side request forgery
- CVE-2026-76039 Information disclosure in Chrome
- CVE-2026-76038 Memory corruption in Chrome
- CVE-2026-76037 Path traversal in Chrome
- CVE-2026-76036 Memory corruption in Chrome
- CVE-2026-76035 Code injection in Chrome
- CVE-2026-76034 Memory corruption in Chrome
- CVE-2026-76033 Security feature bypass in Chrome
- CVE-2026-76032 Pydio Cells 5.0.0 to 5.0.2 - Missing Authorization on the Share Link REST Handler
- CVE-2026-7603 JeecgBoot LoadFile Endpoint FileDownloadUtils.jav checkPathTraversalBatch server-side request forgery
- CVE-2026-76023 Code injection in Chrome
- CVE-2026-76022 Memory corruption in Chrome
- CVE-2026-76021 Use after free in Chrome
- CVE-2026-76020 Race condition in Chrome
- CVE-2026-7602 JeecgBoot FillRuleUtil edit improper authorization
- CVE-2026-76019 Security feature bypass in Chrome
- CVE-2026-76018 Privilege escalation in Chrome
- CVE-2026-76017 Use after free in Chrome
- CVE-2026-76014 BusyBox FEATURE_WGET_TIMEOUT wget.c null pointer dereference
- CVE-2026-7601 Open5GS AMF gmm-handler.c denial of service
- CVE-2026-76009 Auth bypass in Next-Cart Store to WooCommerce Migration
- CVE-2026-76008 Comfast CF-N1-S URI Parameter Parsing mbox-config get_para_from_uri stack-based overflow
- CVE-2026-76006 Photo Gallery by Ays <= 6.8.2 - Authenticated (Administrator+) SQL Injection via 's' Parameter
- CVE-2026-76005 WP Inventory Manager <= 2.5.5 - Authenticated (Contributor+) SQL Injection via 'sort_order' Shortcode Attribute
- CVE-2026-76004 UTT HiPER 1250GW HTTP aspApBasicConfigUrcp strcpy stack-based overflow
- CVE-2026-76003 UTT HiPER 1200GW formGroupConfig strcpy stack-based overflow
- CVE-2026-76002 ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)
- CVE-2026-76001 ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)
- CVE-2026-76000 ColdFusion | Uncontrolled Resource Consumption (CWE-400)
- CVE-2026-7600 ArtMin96 yii2-mcp-server MCP index.ts yii_execute_command os command injection
- CVE-2026-75999 ColdFusion | Improper Input Validation (CWE-20)
- CVE-2026-75998 ColdFusion | Improper Access Control (CWE-284)
- CVE-2026-75996 ColdFusion | Uncontrolled Resource Consumption (CWE-400)
- CVE-2026-75995 ColdFusion | Improper Input Validation (CWE-20)
- CVE-2026-75994 ColdFusion | Incorrect Authorization (CWE-863)
- CVE-2026-75993 ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)
- CVE-2026-75992 Illustrator | Out-of-bounds Write (CWE-787)
- CVE-2026-75991 Illustrator | Improper Input Validation (CWE-20)
- CVE-2026-75990 Illustrator | Incorrect Authorization (CWE-863)
- CVE-2026-7599 Dayoooun hwpx-mcp MCP index.ts export_to_html path traversal
- CVE-2026-75987 SPLWare esProc SocketData.java ObjectInputStream.readUnshared deserialization
- CVE-2026-75986 code-projects Online Job Portal System Password Recovery ForPass.php sql injection
- CVE-2026-75985 TRENDnet Router ping.cgi command injection
- CVE-2026-75984 TRENDnet TEW-823DRU admin.cgi command injection
- CVE-2026-75983 Privilege escalation in Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce
- CVE-2026-75982 LearnPress <= 4.4.4 - Missing Authorization to Authenticated (Editor+) Limited Option Update via 'field_name' Parameter
- CVE-2026-75981 Cross-site scripting in TranslatePress – Translate Multilingual sites with AI Translation
- CVE-2026-75980 Cross-site scripting in BetterDocs – AI Documentation, Knowledge Base, MCP Server, Docs, Wikis, FAQ & Chatbot
- CVE-2026-7598 libssh2 userauth.c userauth_password integer overflow
- CVE-2026-75979 xianrendzw EasyReport SQL Preview Endpoint DesignerController.java previewSqlText special elements in template engine
- CVE-2026-75978 xianrendzw EasyReport QueryerFactory DataSourceController.java DataSourceController.add permission
- CVE-2026-75977 Mang Board WP <= 2.3.7 - Authenticated (Subscriber+) Privilege Escalation to Forged Authentication Cookie
- CVE-2026-75976 TRENDnet TEW-823DRU NVRAM wan.cgi strcpy stack-based overflow
- CVE-2026-75975 fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization
- CVE-2026-75973 Apache Tomcat: Cross-context authentication mix-up with Jakarta Authentication configured
- CVE-2026-75971 Privilege escalation in ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets
- CVE-2026-7597 mem0ai mem0 faiss.py pickle.dump deserialization
- CVE-2026-75969 PTZOptics Missing Authentication in Firmware Upload
- CVE-2026-75966 Cross-site scripting in Podlove Podcast Publisher
- CVE-2026-75965 User Profile Builder <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date' Shortcode Attribute
- CVE-2026-75964 User Profile Builder <= 4.0.0 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter
- CVE-2026-75963 Events Made Easy <= 3.2.5 - Authenticated (Contributor+) Local File Inclusion via 'wp_page_template' Event Property
- CVE-2026-75962 Cross-site scripting in Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App
- CVE-2026-75961 SQL injection in NEX-Forms – Ultimate Forms Plugin for WordPress
- CVE-2026-75960 Insufficiently Protected Credentials in Rently Smart Home
- CVE-2026-7596 nextlevelbuilder ui-ux-pro-max-skill Slide Generator generate-slide.py data.get cross site scripting
- CVE-2026-75959 GoPay for WooCommerce <= 1.0.36 - Authenticated (Shop Manager+) SQL Injection via 'log_table_filter' Parameter
- CVE-2026-75957 Ultimate Multisite <= 2.15.0 - Unauthenticated Authentication Bypass via 'checkout_form' Parameter
- CVE-2026-75956 Joomla Extension - cmsjunkie.com - DOS vector in pagination parameter handling in J-BusinessDirectory < 6.2.3
- CVE-2026-75955 Joomla Extension - cmsjunkie.com - Reflected XSS / XML injection in J-BusinessDirectory < 6.2.3
- CVE-2026-75954 Joomla Extension - cmsjunkie.com - SQL injection in trips search in J-BusinessDirectory < 6.2.3
- CVE-2026-75953 Joomla Extension - cmsjunkie.com - Open mail relay in J-BusinessDirectory < 6.2.3
- CVE-2026-75952 Joomla Extension - cmsjunkie.com - Cross-site request forgery in J-BusinessDirectory < 6.2.3
- CVE-2026-75951 Missing authorization in J-BusinessDirectory extension for Joomla
- CVE-2026-75950 Joomla Extension - cmsjunkie.com - Unauthenticated listing ownership takeover in J-BusinessDirectory < 6.2.3
- CVE-2026-7595 nextlevelbuilder ui-ux-pro-max-skill Tailwind Config Generator tailwind_config_gen.py _format_plugins code injection
- CVE-2026-75949 Joomla Extension - cmsjunkie.com - Arbitrary file upload / deletion (path traversal) in J-BusinessDirectory < 6.2.3
- CVE-2026-75948 Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12
- CVE-2026-75946 OMEN Gaming Hub – Potential Escalation of Privilege & Information Disclosure
- CVE-2026-75945 Race condition in EOS
- CVE-2026-75944 Race condition in EOS
- CVE-2026-75943 Security feature bypass in EOS
- CVE-2026-75941 Deserialization in Legion Zone Application
- CVE-2026-75940 Hardcoded credentials in Health Application
- CVE-2026-7594 Flux159 mcp-game-asset-gen MCP index.ts image_to_3d_async path traversal
- CVE-2026-75939 Openshift/oc-mirror: release signature verification: openpgp signatureerror checked before signed body is consumed
- CVE-2026-75937 OS Command Injection in Digi Accelerated Linux (DAL OS)
- CVE-2026-75936 Memory-amplification denial of service via GZIP decompression bomb in Amazon ion-java
- CVE-2026-75935 Memory-amplification denial of service via declared-length preallocation in Amazon ion-java