Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 679 of 1013.
- CVE-2026-39356 SQL Injection via escapeName() in all Drizzle ORM SQL dialects
- CVE-2026-39355 Missing authorization in genealogy
- CVE-2026-39354 Scoold has an Authenticated Arbitrary Question Overwrite via Client-Controlled postId in POST /questions/ask
- CVE-2026-39353 InvoicePlane: Remote Code Execution via Writable Templates Directory
- CVE-2026-39352 Frappe has an Arbitrary File Read via Path Traversal in render_include
- CVE-2026-39351 Frappe allows unrestricted Doctype access via API exploit
- CVE-2026-39350 Istio AuthorizationPolicy Incorrect Regex Matching of Dots in serviceAccounts Fields Allows Policy Bypass
- CVE-2026-3935 Other in Chrome
- CVE-2026-39349 OrangeHRM Uses AES-ECB for Sensitive Data Encryption Enables Pattern Disclosure
- CVE-2026-39348 Missing authorization in orangehrm
- CVE-2026-39347 OrangeHRM's Self‑Appraisal Submission of Admin Users Can Be Modified After Completion
- CVE-2026-39346 OrangeHRM has Improper Access Control Allowing Access to Disabled Modules via URL Encoding
- CVE-2026-39345 OrangeHRM Affected by Arbitrary File Read via Path Traversal in Email Template Loader
- CVE-2026-39344 Reflected XSS the login page through the 'username' parameter
- CVE-2026-39343 ChurchCRM has a SQL Injection in Event Type Editor (Admin)
- CVE-2026-39342 ChurchCRM has a SQL injection searchwhat parameter via QueryView.php
- CVE-2026-39341 SQL injection in ChurchCRM.0
- CVE-2026-39340 ChurchCRM has a SQL Injection in PropertyTypeEditor.php via Incorrect Sanitizer Substitution
- CVE-2026-3934 Security feature bypass in Chrome
- CVE-2026-39339 ChurchCRM has an API Authentication Bypass
- CVE-2026-39338 ChurchCRM has Blind XSS via Global Search – Administrative Cookie Session Exfiltration
- CVE-2026-39337 ChurchCRM Affected by Unauthenticated RCE in Install Wizard
- CVE-2026-39336 ChurchCRM has Stored XSS from unescaped config values in HTML attributes
- CVE-2026-39335 ChurchCRM has Stored XSS via Unescaped data-* Attributes in Group/Family Controls
- CVE-2026-39334 ChurchCRM has a Blind SQL injection in SettingsIndividual.php
- CVE-2026-39333 ChurchCRM has Reflected XSS in DateStart/DateEnd parameters in FindFundRaiser.php
- CVE-2026-39332 ChurchCRM has Reflected Cross-Site Scripting (XSS) in GeoPage.php
- CVE-2026-39331 ChurchCRM has an API Authorization Bypass Allows Authenticated User to Deactivate, Modify, and Spam Arbitrary Families
- CVE-2026-39330 ChurchCRM has a Blind SQL injection in PropertyAssign.php
- CVE-2026-39329 ChurchCRM has a Blind SQL injection in EventNames.php
- CVE-2026-39328 ChurchCRM has Stored XSS in Social Profile Fields
- CVE-2026-39327 ChurchCRM has a SQL injection in MemberRoleChange.php
- CVE-2026-39326 ChurchCRM has a Blind SQL injection in PropertyTypeEditor.php
- CVE-2026-39325 ChurchCRM has a Blind SQL injection in SettingsUser.php
- CVE-2026-39324 Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization
- CVE-2026-39322 PolarLearn: Any password authenticates banned accounts and grants API access
- CVE-2026-39321 Parse Server has a login timing side-channel reveals user existence
- CVE-2026-39320 Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription Paths
- CVE-2026-3932 Security feature bypass in Chrome
- CVE-2026-39319 ChurchCRM has a Second Order SQLI via FundRaiserEditor.php
- CVE-2026-39318 ChurchCRM has a DDL SQL Injection in GroupPropsFormRowOps.php
- CVE-2026-39316 CUPS has a use-after-free in `cupsdDeleteTemporaryPrinters` via dangling subscription pointer
- CVE-2026-39315 Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe()
- CVE-2026-39314 CUPS has an integer underflow in `_ppdCreateFromIPP` causes root cupsd crash via negative `job-password-supported`
- CVE-2026-39313 MCP-Framework: Unbounded memory allocation in readRequestBody allows denial of service via HTTP transport
- CVE-2026-39312 Pre-Auth EAP-TLS DoS on SoftEther VPN Developer Edition
- CVE-2026-39311 Trilium Notes: Stored XSS Leads to Unauthorized Remote Code Execution (RCE) via Unsanitized SVG Attachments
- CVE-2026-39310 Trilium Notes: Authentication Bypass in Clipper API for Electron (Desktop) Builds
- CVE-2026-3931 Memory corruption in Chrome
- CVE-2026-39309 Trilium Notes: macOS TCC Bypass via Prompt Spoofing
- CVE-2026-39308 PraisonAI recipe registry publish path traversal allows out-of-root file write
- CVE-2026-39307 PraisonAI has an Arbitrary File Write (Zip Slip) in Templates Extraction
- CVE-2026-39306 PraisonAI recipe registry pull path traversal writes files outside the chosen output directory
- CVE-2026-39305 Arbitrary File Write / Path Traversal in Action Orchestrator
- CVE-2026-39304 Apache ActiveMQ: Denial of Service via Out of Memory vulnerability
- CVE-2026-3930 Security feature bypass in Chrome
- CVE-2026-39292 Falco Solutions PHPPageBuilder v0.31.0 contains an unrestricted file upload vulnerability in the pagemanager/pagebuilder module that allows
- CVE-2026-3929 Information disclosure in Chrome
- CVE-2026-3928 Security feature bypass in Chrome
- CVE-2026-39276 Path traversal in emlog:emlog
- CVE-2026-39275 Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code via the item.php, f
- CVE-2026-3927 Other in Chrome
- CVE-2026-3926 Memory corruption in Chrome
- CVE-2026-39255 Buffer Overflow vulnerability in SteelSeries GG (macOS) v.107.0.0 allows a remote attacker to execute arbitrary code via the libSSEdevice.dy
- CVE-2026-39254 Buffer Overflow vulnerability in SteelSeries GG (macOS) v.107.0.0 allows a remote attacker to execute arbitrary code via the libSSEdevice.dy
- CVE-2026-39253 An issue in Pivotal CRM v.6.6.04.08 allows a remote attacker to execute arbitrary code via the Pivotal.Core.Common.dll and Pivotal.Engine.Cl
- CVE-2026-39250 An authorization vulnerability exists in Innoshop 0.6.0.
- CVE-2026-3925 Other in Chrome
- CVE-2026-39246 Path traversal in decompress project:decompress
- CVE-2026-39245 Path traversal in decompress project:decompress
- CVE-2026-39244 adm-zip: Crafted ZIP file triggers 4GB memory allocation
- CVE-2026-39243 decompress allows arbitrary hardlink creation during archive extraction
- CVE-2026-3924 Use after free in Chrome
- CVE-2026-3923 Use after free in Chrome
- CVE-2026-39229 Bolt CMS through 3.7.0 allows SQL Injection in the 'order' parameter of the content listing pages.
- CVE-2026-3922 Use after free in Chrome
- CVE-2026-3921 Use after free in Chrome
- CVE-2026-3920 Memory corruption in Chrome
- CVE-2026-39199 Memory corruption in Snes9X
- CVE-2026-39197 An issue in the /util/http/prelude.rs endpoint of Datadog, Inc Vector v0.54.0 allows attackers to cause a Denial of Service (DoS) via a craf
- CVE-2026-39196 Datadog, Inc Vector v0.54.0 was discovered to contain a SQL injection vulnerability in the set_uri_query parameter in the KeyPartitioner::partition function.
- CVE-2026-3919 Use after free in Chrome
- CVE-2026-3918 Use after free in Chrome
- CVE-2026-39179 A SQL injection vulnerability in SOGo before 5.12.7 allows authenticated users to execute arbitrary SQL statements via the newPassword param
- CVE-2026-39178 A SQL injection vulnerability in SOGo before 5.12.7 allows authenticated users to execute arbitrary SQL statements via the search parameter
- CVE-2026-39170 SemCms 5.0 is vulnerable to Cross Site Request Forgery (CSRF) via crafted POST request to /admin/semcms_user.php.
- CVE-2026-3917 Use after free in Chrome
- CVE-2026-39169 SEMCMS 5.0 is vulnerable to unauthorized access in SEMCMS_copy.php.
- CVE-2026-3916 Memory corruption in Chrome
- CVE-2026-39155 Knot DNS before 3.4.10 and 3.5.x before 3.5.4 contains a vulnerability in mod-onlinesign where the next NSEC owner name can be computed incorrectly.
- CVE-2026-3915 Memory corruption in Chrome
- CVE-2026-3914 Integer overflow in Chrome
- CVE-2026-3913 Memory corruption in Chrome
- CVE-2026-3912 TIBCO ActiveMatrix BusinessWorks Injection Vulnerability
- CVE-2026-39118 An issue in Iru, Inc Kandji Agent before v.4.7.5(5374) allows a local attacker to escalate privileges via a client validation gap to invoke
- CVE-2026-39117 An issue in AltumCode 66Uptime before v.54.0.0 and 66Uptime ping-servers plugin before v.2.0.0 allows a remote attacker to execute arbitrary
- CVE-2026-39113 Buffer Overflow vulnerability in SQLite affected version source snapshots/builds containing Fossil check-in 8bdc0d485e3ad0c7a1e818da66f10695
- CVE-2026-39112 Cross Site Scripting vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 in the visname paramete
- CVE-2026-39111 SQL Injection vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 in the email parameter of the
- CVE-2026-39110 SQL Injection vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 in the contactno parameter of