Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 827 of 1013.
- CVE-2026-19151 Use after free in Chrome
- CVE-2026-19150 Security feature bypass in Chrome
- CVE-2026-1915 Simple Plyr <= 0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'poster' Shortcode Attribute
- CVE-2026-19149 Use after free in Chrome
- CVE-2026-19148 Memory corruption in Chrome
- CVE-2026-19147 Use after free in Chrome
- CVE-2026-19146 Information disclosure in Chrome
- CVE-2026-19145 Use after free in Chrome
- CVE-2026-19144 Use after free in Chrome
- CVE-2026-19143 Security feature bypass in Chrome
- CVE-2026-19142 Use after free in Chrome
- CVE-2026-19141 Use after free in Chrome
- CVE-2026-19140 Use after free in Chrome
- CVE-2026-1914 FuseDesk <= 6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'emailtext' Shortcode Attribute
- CVE-2026-19139 Race condition in Chrome
- CVE-2026-19138 Memory corruption in Chrome
- CVE-2026-19137 Use after free in Chrome
- CVE-2026-19136 Command injection in Tianxi AI Agent PC Application
- CVE-2026-19135 OpenNMS JEXL sandbox bypass in Measurements REST API allows ROLE_USER to load arbitrary classes
- CVE-2026-19130 Missing authorization in multicluster engine for Kubernetes 2.10
- CVE-2026-1913 Cross-site scripting in Gallagher Website Design
- CVE-2026-19127 Insufficient verification of lifetime-deal redemption codes allows forgery of permanent paid subscriptions
- CVE-2026-19125 EthPress <= 2.3.5 - Unauthenticated Authentication Bypass
- CVE-2026-1912 Citations tools <= 0.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'code' Shortcode Attribute
- CVE-2026-19118 Race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution
- CVE-2026-19117 Delinea Secret Server FIDO2 credential registration authentication bypass vulnerability
- CVE-2026-19116 WP User Frontend < 4.3.11 - Subscriber+ PHP Object Injection via Frontend Post Edit Form
- CVE-2026-19113 Unauthenticated denial of service via unbounded request body processing
- CVE-2026-19111 Insecure direct object reference in Strands Agents Tools memory tool namespace isolation
- CVE-2026-19110 DataGear Chart Name HtmlTplDashboardWidgetHtmlRenderer.java HtmlTplDashboardWidgetHtmlRenderer cross site scripting
- CVE-2026-1911 Twitter Feeds <= 1.0.0 - Authenticated (Contributor+) Cross-Site Scripting via 'tweet_title' Shortcode Attribute
- CVE-2026-19108 MZ Automation libiec61850 URCB Revalidation reporting.c deleteDataSetValuesShadowBuffer use after free
- CVE-2026-1910 UpMenu <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'upmenu-menu' Shortcode 'lang' Attribute
- CVE-2026-19094 Tutor LMS < 4.0.6 - Unauthenticated SQLi via 'offset' and 'item_per_page' Parameters
- CVE-2026-19093 Tutor LMS < 4.0.6 - Instructor+ Arbitrary File Read via Video Path
- CVE-2026-19092 Tutor LMS < 4.0.6 - Unauthenticated Arbitrary Zero-Argument Function Invocation via Template Variable Shadowing
- CVE-2026-19091 Path traversal in GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
- CVE-2026-1909 WaveSurfer-WP <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'src' Shortcode Attribute
- CVE-2026-19089 Product Input Fields for WooCommerce < 2.0.2 - Unauthenticated Arbitrary File Upload
- CVE-2026-19088 ShopEngine < 4.9.3 - Customer PII Disclosure via Forced Authentication
- CVE-2026-19087 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
- CVE-2026-19086 IBM i is Affected By Multiple Vulnerabilities in PASE [, ]
- CVE-2026-19085 Copy & Delete Posts < 1.5.6 - Author+ Password-Protected Post Content Disclosure
- CVE-2026-19084 Shared Files < 1.7.70 - Unauthenticated Arbitrary File Read
- CVE-2026-19083 IDOR in AKIN Software's OctoCloud
- CVE-2026-19082 Information disclosure in Imager
- CVE-2026-19081 Missing authorization in Gastromenum Ticket and QR Menu System
- CVE-2026-19080 Username Enumeration in Menulux Software's Menulux Portal
- CVE-2026-1908 Cross-site scripting in Integration with Hubspot Forms
- CVE-2026-19079 Policycoreutils: policycoreutils: toctou race condition in fixfiles allows arbitrary selinux label manipulation
- CVE-2026-19078 Ose-oauth-server: oauth-server: open redirect vulnerability enables phishing via unvalidated parameter.
- CVE-2026-19077 Copy & Delete Posts < 1.5.5 - Authenticated Arbitrary Post Deletion via Missing Object-Level Authorization
- CVE-2026-19076 Auth bypass in Mattermost
- CVE-2026-19075 All-in-One Video Gallery < 4.9.2 - Subscriber+ Server-Side Request Forgery via 'vdl' Parameter
- CVE-2026-19074 Advanced Classifieds & Directory Pro < 3.4.3 - Unauthenticated Non-Public Listing Custom Field Disclosure
- CVE-2026-19073 Order Sync with Zendesk for WooCommerce < 2.2.3 - Unauthenticated Customer Order Data Disclosure
- CVE-2026-19072 Velociraptor Investigator reaches SuperUser via hunt EffectivePrincipal
- CVE-2026-19071 itsourcecode Hospital Management System viewappointment.php sql injection
- CVE-2026-19070 itsourcecode Hospital Management System viewadmin.php sql injection
- CVE-2026-1907 SQL Injection in Clustering Communication (Hybrid Mode)
- CVE-2026-19069 itsourcecode Hospital Management System treatmentrecord.php sql injection
- CVE-2026-19068 itsourcecode Hospital Management System treatmentdetail.php sql injection
- CVE-2026-19067 itsourcecode Hospital Management System treatment.php sql injection
- CVE-2026-19066 SourceCodester Online Examination & Learning Management System view_students.php authorization
- CVE-2026-19065 SourceCodester Online Examination & Learning Management System upload_files.php unrestricted upload
- CVE-2026-19064 SourceCodester Online Examination & Learning Management System view.php authorization
- CVE-2026-19062 chiuwingyan house selectall.action sql injection
- CVE-2026-19061 Insta InstaKNXServiceApp Firmware Update CreateWebClientAndDownloadFileList data authenticity
- CVE-2026-19060 FoundationAgents MetaGPT code injection
- CVE-2026-1906 Missing authorization in PDF Invoices & Packing Slips for WooCommerce
- CVE-2026-19059 FoundationAgents MetaGPT editor.py read path traversal
- CVE-2026-19058 FoundationAgents MetaGPT data_interpreter.py DataInterpreter code injection
- CVE-2026-19057 Stored XSS in Gastromenum's Gastromenum Ticket and QR Menu System
- CVE-2026-19056 ProSolution WP Client < 2.0.11 - Reflected XSS via 'page' Parameter
- CVE-2026-19055 ProSolution WP Client < 2.0.11 - Reflected XSS via Multiple Parameters
- CVE-2026-19054 Lspace-io lspace-server Repositories File API repository.ts deleteFile path traversal
- CVE-2026-19053 ProSolution WP Client < 2.0.6 - Unauthenticated Blind SQLi via 'jobID' Parameter
- CVE-2026-19052 ProSolution WP Client < 2.0.9 - Subscriber+ proSol_ajaxTablesync and proSol_ajaxClearlog Calls
- CVE-2026-19051 Plaintext Storage of User Credentials in Menulux Software's Menulux Portal
- CVE-2026-19050 ProSolution WP Client < 2.0.9 - Subscriber+ SSRF via proSol_url_validate
- CVE-2026-1905 Sphere Manager <= 1.0.2 - Authenticated (Contributor+) Cross-Site Scripting via 'width' Shortcode Attribute
- CVE-2026-19049 ProSolution WP Client < 2.0.9 - Unauthenticated SQLi and Plugin Data Deletion via 'removesite' Cookie
- CVE-2026-19047 NocteDefensor LudusMCP ludus_cli_execute cliWrapper.ts executeCommand command injection
- CVE-2026-19046 NocteDefensor LudusMCP ludus_environment_guides_search ludusEnvironmentGuidesSearch.ts path traversal
- CVE-2026-19045 NocteDefensor LudusMCP get_credential_from_user secretDialog.ts SecretDialog.showSecretDialog command injection
- CVE-2026-19044 LeeSinLiang godot-mcp create_scene/add_node index.ts executeOperation command injection
- CVE-2026-19043 Authorization Bypass Critical POS Management Functions in Menulux Software's Menulux Portal
- CVE-2026-19042 Command Injection in TeamViewer Desktop Client for Linux through Chat Link Handling
- CVE-2026-19041 MissionSquad mcp-api NPM Package Version packages.ts this.packageService.installPackage command injection
- CVE-2026-19040 MissionSquad mcp-api dcrClients.ts server-side request forgery
- CVE-2026-1904 Cross-site scripting in Simple Wp colorfull Accordion
- CVE-2026-19039 Kino-Kafkaesque ssh-mcp-server SSH index.ts ssh_exec command injection
- CVE-2026-19038 MonomythDevelopment la-forge-mcp screenshot_element Tool index.ts screenshotElement path traversal
- CVE-2026-19037 WonderTrader Internal Limit Order Book Cache MatchEngine.cpp update_lob behavioral workflow
- CVE-2026-19036 Shibby Tomato wanoptions sub_40F88C os command injection
- CVE-2026-19035 Shibby Tomato qoslimit new_qoslimit_start os command injection
- CVE-2026-19034 Shibby Tomato qoslimittc_stop.sh new_qoslimit_stop os command injection
- CVE-2026-19033 Unauthenticated IXFR deltas are applied to the live zone before TSIG verification
- CVE-2026-19032 jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path
- CVE-2026-1903 Cross-site scripting in Ravelry Designs Widget