Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 388 of 1013.
- CVE-2026-74987 Internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154
- CVE-2026-74986 Site isolation issue in the CSS Parsing and Computation component
- CVE-2026-74985 Privilege escalation in the Enterprise Policies component
- CVE-2026-74984 Race condition in the JavaScript Engine component
- CVE-2026-74983 Mitigation bypass in the Data Loss Prevention component
- CVE-2026-74982 Denial-of-service in the Widget component
- CVE-2026-74981 Site isolation issue in the Audio/Video: Web Codecs component
- CVE-2026-74980 Clickjacking issue in the Downloads component in Firefox for Android
- CVE-2026-7498 Stored XSS in Basamak Informatics' DernekWeb
- CVE-2026-74979 Mitigation bypass in the Add-ons Manager component
- CVE-2026-74978 Clickjacking issue in the Widget component
- CVE-2026-74977 Integer overflow in the Graphics component
- CVE-2026-74976 JIT miscompilation in the JavaScript Engine: JIT component
- CVE-2026-74975 Spoofing issue in the Downloads component in Firefox for Android
- CVE-2026-74974 Same-origin policy bypass in the Graphics: ImageLib component
- CVE-2026-74973 Race condition, use-after-free in the Graphics component
- CVE-2026-74972 Information disclosure in the DOM: Push Subscriptions component
- CVE-2026-74971 Information disclosure in the DOM: UI Events & Focus Handling component
- CVE-2026-74970 Site isolation issue in the Graphics component
- CVE-2026-74969 Race condition, use-after-free in the Layout: Text and Fonts component
- CVE-2026-74968 Site isolation issue in the Graphics: WebRender component
- CVE-2026-74967 Same-origin policy bypass in the Audio/Video: Playback component
- CVE-2026-74966 Information disclosure in the Form Autofill component
- CVE-2026-74965 Privilege escalation in the Shell Integration component
- CVE-2026-74964 Integer overflow in the Graphics component
- CVE-2026-74963 Same-origin policy bypass in the Networking: Cookies component
- CVE-2026-74962 Site isolation issue in the Networking: Cookies component
- CVE-2026-74961 Side-channel in the Web Audio component
- CVE-2026-74960 Site isolation issue in the WebExtensions component
- CVE-2026-74959 Mitigation bypass in the Storage: Cache API component
- CVE-2026-74958 Information disclosure in the WebRTC component
- CVE-2026-74957 Mitigation bypass in the Safe Browsing component
- CVE-2026-74956 Same-origin policy bypass in the DOM: Service Workers component
- CVE-2026-74955 Privilege escalation in the Request Handling component
- CVE-2026-74954 Information disclosure due to side-channel in the Storage: Cache API component
- CVE-2026-74953 Privilege escalation in the Networking: Cookies component
- CVE-2026-74952 Privilege escalation in the Application Update component
- CVE-2026-74951 Clickjacking issue in Firefox for Android
- CVE-2026-74950 Privilege escalation in the Downloads API component
- CVE-2026-74949 Use-after-free in the Graphics: Canvas2D component
- CVE-2026-74948 Information disclosure in the Graphics component
- CVE-2026-74947 Privilege escalation due to invalid pointer in the Graphics component
- CVE-2026-74946 Information disclosure due to incorrect boundary conditions in the Graphics: CanvasWebGL component
- CVE-2026-74945 Information disclosure in the Graphics: Text component
- CVE-2026-74944 Use-after-free in the DOM: Core & HTML component
- CVE-2026-74943 Use-after-free in the Graphics: ImageLib component
- CVE-2026-74942 Privilege escalation in the Remote Settings Client component
- CVE-2026-74941 Privilege escalation in the Graphics: CanvasWebGL component
- CVE-2026-74940 Use-after-free in the Graphics: Text component
- CVE-2026-7494 Nexus Repository - SSRF in SSL Certificate Retrieval
- CVE-2026-74939 Privilege escalation in the DOM: Navigation component
- CVE-2026-74938 Mitigation bypass in the JavaScript: GC component
- CVE-2026-74937 Use-after-free in the JavaScript: GC component
- CVE-2026-74936 Use-after-free in the JavaScript: WebAssembly component
- CVE-2026-74935 Privilege escalation in the DOM: Networking component
- CVE-2026-74934 Site isolation issue in the Graphics: CanvasWebGL component
- CVE-2026-74933 GenieWords 1.5.27 - 1.5.34 - Unauthenticated Stored XSS and Configuration Overwrite
- CVE-2026-74932 WP Fastest Cache 0.9.0.3 - 1.5.0 - Unauthenticated Stored XSS via Host Header Cache Poisoning
- CVE-2026-74930 WP Project Manager 2.2.0 - 4.0.6 - Subscriber+ User Activity Feed Disclosure via IDOR
- CVE-2026-7493 Denial of service in Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin
- CVE-2026-74929 WP Project Manager < 4.0.7 - Subscriber+ Cross-Project Task Disclosure and Task Board Modification via IDOR
- CVE-2026-74928 WP Project Manager 2.1.0 - 4.0.6 - Unauthenticated Subscriber Account Creation via Trello Import Routes
- CVE-2026-74927 MultiVendorX 5.0.13 - 5.0.14 - Unauthenticated Vendor PII and Payout Data Disclosure via stores REST Endpoint
- CVE-2026-74926 MultiVendorX 5.0.0 - 5.0.15 - Subscriber+ Arbitrary Store Data and Ownership Overwrite via stores REST Endpoint
- CVE-2026-74925 MultiVendorX 5.0.0 - 5.0.15 - Store Owner+ Privilege Escalation to Administrator
- CVE-2026-74923 Missing authorization in Document Gallery
- CVE-2026-74922 Document Gallery 4.1 - 5.1.1 - Unauthenticated Document Thumbnail Replacement via Thumber Webhook Signature Bypass
- CVE-2026-74921 Document Gallery 4.0 - 5.1.1 - Contributor+ Stored XSS via Gallery Shortcode Attributes
- CVE-2026-74920 Document Gallery <= 5.1.1 - Reflected XSS via data-shortcode Attribute
- CVE-2026-7492 Missing Authorization in GitLab
- CVE-2026-74916 WP Fastest Cache 0.8.7.7 - 1.5.0 - Unauthenticated Cache Poisoning via Unkeyed Tracking Parameters
- CVE-2026-7491 Zyosoft｜School App - Insecure Direct Object Reference
- CVE-2026-74909 Security feature bypass in Red Hat Single Sign-On 7
- CVE-2026-74908 Grav plugin-api before 1.0.15 Script Injection via SVG
- CVE-2026-74907 Grav before 2.0.15 Path Traversal via plugin-asset-map.php
- CVE-2026-74906 SiYuan before v3.7.4 Incorrect Authorization via Publish Access
- CVE-2026-74905 SiYuan before v3.7.4 SSRF via IPv6 Transition Address Bypass
- CVE-2026-74904 SiYuan before v3.7.4 Missing Authorization via block API
- CVE-2026-74903 SiYuan before v3.7.4 Insufficient Access Control via spinBlockDOM
- CVE-2026-74902 SiYuan before v3.7.4 XSS-to-RCE via malicious filename upload
- CVE-2026-74901 openssl_encrypt before 1.4.0 Authentication Bypass via AES-CTR Fallback
- CVE-2026-74900 openssl_encrypt before 1.4.0 Weak Shared Secret via PQC Simulation Mode
- CVE-2026-7490 Sunnet｜CTMS and CPAS - Arbitrary File Upload
- CVE-2026-74899 openssl_encrypt before 1.4.0 Sandbox Escape via Type Hierarchy
- CVE-2026-74896 openssl_encrypt before 1.4.0 Sandbox Escape via Dunder Attribute Traversal
- CVE-2026-74895 openssl_encrypt before 1.4.0 Plugin Sandbox Bypass via Process Isolation
- CVE-2026-74894 openssl_encrypt before 1.4.0 Authentication Bypass via Bearer Token
- CVE-2026-74893 openssl_encrypt before 1.4.0 JWT Token Forgery via Hardcoded Secrets
- CVE-2026-74892 openssl_encrypt before 1.4.0 Hardcoded Secret Key
- CVE-2026-74891 openssl_encrypt before 1.4.0 Hardcoded Database Credentials
- CVE-2026-74890 openssl_encrypt before 1.4.0 HMAC Authentication Bypass via Environment Variable
- CVE-2026-7489 Sunnet｜CTMS - SQL Injection
- CVE-2026-74889 openssl_encrypt before 1.4.0 Weak Key Derivation via HKDF
- CVE-2026-74888 openssl_encrypt before 1.4.0 Non-Standard PBKDF2 Key Derivation
- CVE-2026-74887 openssl_encrypt before 1.4.0 Insecure Random Import in PQC Module
- CVE-2026-74886 openssl_encrypt before 1.4.0 Plugin Import Guard Bypass
- CVE-2026-74885 openssl_encrypt before 1.4.0 Logging Bug and Race Condition
- CVE-2026-74884 openssl_encrypt before 1.4.0 Path Traversal via plugin_id
- CVE-2026-74883 openssl_encrypt before 1.4.0 Sandbox Bypass via pathlib and io
- CVE-2026-74882 openssl_encrypt before 1.4.0 Insecure Default Configuration