Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 401 of 1013.
- CVE-2026-73450 Security Advisory 0161
- CVE-2026-7345 Security feature bypass in Chrome
- CVE-2026-73449 Auth bypass in EOS
- CVE-2026-73447 Security Advisory 0162 - gNSI Certz/Bootz OS Command Injection via Crafted Rotate Request
- CVE-2026-73446 Security Advisory 0160
- CVE-2026-73445 Security Advisory 0167
- CVE-2026-73444 Auth bypass in EOS
- CVE-2026-73443 Security feature bypass in EOS
- CVE-2026-73442 Information disclosure in EOS
- CVE-2026-73440 Security Advisory 0178
- CVE-2026-7344 Use after free in Chrome
- CVE-2026-73439 Security Advisory 0164
- CVE-2026-73438 Security Advisory 0172
- CVE-2026-73437 Security feature bypass in EOS
- CVE-2026-73436 Security Advisory 0171
- CVE-2026-73435 Security Advisory 0171
- CVE-2026-73434 Gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsing
- CVE-2026-73433 Integer overflow in Red Hat Enterprise Linux 10
- CVE-2026-73432 Server-side request forgery in vulnerability-lookup
- CVE-2026-73431 Reusable Account Activation and Recovery Tokens Allow Repeated Account Takeover in vulnerability-lookup
- CVE-2026-73430 Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)
- CVE-2026-7343 Use after free in Chrome
- CVE-2026-73429 Russh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS)
- CVE-2026-73428 Trix: Stored XSS via HTMLParser attribute injection on paste
- CVE-2026-73427 Trix: XSS via JSON deserialization bypass in drag-and-drop (Level0InputController)
- CVE-2026-73426 Trix: Stored XSS vulnerability through serialized attributes
- CVE-2026-73425 @astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped
- CVE-2026-73424 Astro: Unauthenticated path override in the @astrojs/vercel ISR function
- CVE-2026-73423 Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered
- CVE-2026-73422 Astro: Reflected XSS via unescaped View Transition animation properties
- CVE-2026-73421 Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)
- CVE-2026-73420 NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass
- CVE-2026-7342 Use after free in Chrome
- CVE-2026-73419 NextAuth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them
- CVE-2026-73418 NextAuth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers
- CVE-2026-73417 JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)
- CVE-2026-73416 jupyterlab: PyPI extension blocklist package-name canonicalization bypass
- CVE-2026-73415 jupyterlab: Image viewer in JupyterLab allows XSS when opening malicious image in new browser tab
- CVE-2026-73414 Shescape: Shell injection via unescaped parentheses on Windows with CMD
- CVE-2026-73413 Shescape: Quadratic-time denial of service in flag-protection
- CVE-2026-73412 Shescape: Path disclosure on Unix with Zsh
- CVE-2026-73411 Shescape: Home-directory disclosure in assignment context on Unix with Dash
- CVE-2026-73410 Budibase: SSRF via DNS rebinding in the REST datasource integration
- CVE-2026-7341 Use after free in Chrome
- CVE-2026-73409 Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile
- CVE-2026-73408 Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector
- CVE-2026-73407 Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak (bypass of CVE-2026-48152))
- CVE-2026-73406 Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint
- CVE-2026-73405 Authorization Bypass in SSE Pub/Sub Allows Unconfirmed Accounts to Access Stream Events in vulnerability-lookup
- CVE-2026-73404 WordPress MasterStudy LMS plugin <= 3.7.41 - Broken Access Control vulnerability
- CVE-2026-73403 WordPress User Registration plugin <= 5.2.6 - Broken Access Control vulnerability
- CVE-2026-73402 WordPress WP BASE Booking plugin <= 6.3.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-73401 WordPress InstaWP Connect plugin <= 0.1.3.7 - Broken Access Control vulnerability
- CVE-2026-73400 WordPress Restaurant Menu by MotoPress plugin <= 2.4.11 - Local File Inclusion vulnerability
- CVE-2026-7340 Integer overflow in Chrome
- CVE-2026-73399 WordPress Flutterwave WooCommerce plugin <= 3.3.0 - Broken Authentication vulnerability
- CVE-2026-73398 WordPress Piraeus Bank WooCommerce Payment Gateway plugin 3.2.0 - Broken Authentication vulnerability
- CVE-2026-73397 WordPress Youzify plugin <= 1.3.7 - Deserialization of untrusted data vulnerability
- CVE-2026-73396 WordPress MWB HubSpot for WooCommerce plugin <= 1.6.7 - Broken Authentication vulnerability
- CVE-2026-73395 Missing authorization in Booking calendar, Appointment Booking System
- CVE-2026-73394 WordPress Stitch Express plugin <= 1.9.0 - Broken Access Control vulnerability
- CVE-2026-73393 WordPress Subscribe2 plugin <= 10.46 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-73391 WordPress Total Donations plugin <= 2.0.5 - SQL Injection vulnerability
- CVE-2026-73390 WordPress Total Donations plugin <= 2.0.5 - Privilege Escalation vulnerability
- CVE-2026-7339 Memory corruption in Chrome
- CVE-2026-73389 WordPress Kalles Addons plugin <= 1.0.6 - PHP Object Injection vulnerability
- CVE-2026-73388 WordPress Nikstore Core plugin <= 1.5 - SQL Injection vulnerability
- CVE-2026-73387 WordPress Resido theme <= 1.5 - Local File Inclusion vulnerability
- CVE-2026-73386 WordPress Track Geolocation Of Users Using Contact Form 7 plugin <= 3.0.2 - Sensitive Data Exposure vulnerability
- CVE-2026-73385 WordPress Outranking plugin Options plugin <= 1.1.3 - Broken Access Control vulnerability
- CVE-2026-73384 WordPress Pay with Contact Form 7 plugin <= 1.0.4 - Sensitive Data Exposure vulnerability
- CVE-2026-73383 WordPress CTX Feed plugin <= 6.6.47 - Arbitrary File Download vulnerability
- CVE-2026-73382 WordPress Site Reviews plugin <= 8.2.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-73381 WordPress Popup by Supsystic plugin <= 1.13.0 - Broken Authentication vulnerability
- CVE-2026-73380 WordPress Popup by Supsystic plugin <= 1.13.0 - PHP Object Injection vulnerability
- CVE-2026-7338 Use after free in Chrome
- CVE-2026-73379 WordPress Contact Form by Supsystic plugin < 1.10.0 - Bypass Vulnerability vulnerability
- CVE-2026-73378 WordPress Contact Form by Supsystic plugin < 1.10.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-73377 WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - Broken Access Control vulnerability
- CVE-2026-73376 WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - PHP Object Injection vulnerability
- CVE-2026-73375 WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-73374 Stored Cross-Site Scripting (XSS) via Unescaped CNA Reference Tags in vulnerability-lookup
- CVE-2026-73373 Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2
- CVE-2026-73372 Missing authorization in Joomla! CMS
- CVE-2026-73371 Joomla! Core - [20260808] - Improper ACL checks for batch copy actions in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2
- CVE-2026-73370 Apache Syncope: Cross-Realm boundaries reconciliation bypass
- CVE-2026-7337 Memory corruption in Chrome
- CVE-2026-73369 Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)
- CVE-2026-73367 WordPress Easy Google Maps plugin < 1.14.2 - Remote File Inclusion vulnerability
- CVE-2026-73366 WordPress Easy Google Maps plugin <= 1.13.0 - PHP Object Injection vulnerability
- CVE-2026-73365 WordPress JetAppointment plugin <= 2.5.2 - SQL Injection vulnerability
- CVE-2026-73364 WordPress Flexible Subscriptions plugin <= 1.8.1 - PHP Object Injection vulnerability
- CVE-2026-73363 WordPress Taxi Booking Manager for WooCommerce plugin < 2.0.8 - Broken Access Control vulnerability
- CVE-2026-73362 WordPress URL Shortify plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-73361 WordPress Recipe Card Blocks for Gutenberg & Elementor plugin <= 3.4.18 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-73360 WordPress Chaty Pro plugin <= 3.5.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-7336 Use after free in Chrome
- CVE-2026-73359 WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.3.9 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-73358 WordPress Affiliates Manager plugin <= 2.9.53 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-73357 WordPress GiveWP plugin < 4.16.6 - Cross Site Scripting (XSS) vulnerability