Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 850 of 1013.
- CVE-2026-16378 Other issue in the DOM: Copy & Paste and Drag & Drop component
- CVE-2026-16377 Mitigation bypass in the PDF Viewer component
- CVE-2026-16376 Denial-of-service in the Graphics: WebGPU component
- CVE-2026-16375 Site isolation issue in the Networking: HTTP component
- CVE-2026-16374 Information disclosure in the Framework component in DevTools
- CVE-2026-16373 Information disclosure in the Privacy component in Firefox for Android
- CVE-2026-16372 Privilege escalation in the DOM: Content Processes component
- CVE-2026-16371 Privilege escalation in the DOM: Navigation component
- CVE-2026-16370 Mitigation bypass in the DOM: Networking component
- CVE-2026-1637 Tenda AC21 AdvSetMacMtuWan fromAdvSetMacMtuWan stack-based overflow
- CVE-2026-16369 Integer overflow in the JavaScript: WebAssembly component
- CVE-2026-16368 Incorrect boundary conditions in the JavaScript: WebAssembly component
- CVE-2026-16367 Sandbox escape due to invalid pointer in the Disability Access APIs component
- CVE-2026-16366 Privilege escalation in the DOM: Navigation component
- CVE-2026-16365 Privilege escalation in the DOM: Workers component
- CVE-2026-16364 Incorrect boundary conditions in the Audio/Video: Playback component
- CVE-2026-16363 JIT miscompilation in the JavaScript: WebAssembly component
- CVE-2026-16362 Use-after-free in the WebRTC: Audio/Video component
- CVE-2026-16361 Memory safety bugs fixed in Thunderbird ESR 140.13
- CVE-2026-16360 Memory safety bugs fixed in Thunderbird ESR 140.13 and Thunderbird 153
- CVE-2026-1636 Privilege escalation in Service Bridge
- CVE-2026-16359 Incorrect boundary conditions in the Audio/Video: GMP component
- CVE-2026-16358 Site isolation issue in the Graphics: WebRender component
- CVE-2026-16357 Incorrect boundary conditions in the Graphics component
- CVE-2026-16356 Sandbox escape due to use-after-free in the Disability Access APIs component
- CVE-2026-16355 JIT miscompilation in the JavaScript Engine: JIT component
- CVE-2026-16354 Information disclosure in the Graphics: ImageLib component
- CVE-2026-16353 Invalid pointer in the DOM: Bindings (WebIDL) component
- CVE-2026-16352 Sandbox escape due to use-after-free in the Disability Access APIs component
- CVE-2026-16351 Sandbox escape due to use-after-free in the DOM: Navigation component
- CVE-2026-16350 Incorrect boundary conditions in the Audio/Video: cubeb component
- CVE-2026-16349 Same-origin policy bypass in the DOM: Navigation component
- CVE-2026-16348 Command Injection Vulnerability in VPN connection of Archer BE800
- CVE-2026-16347 Improper restriction of excessive authentication attempts in MikroTik RouterOS and Cloud Hosted Router
- CVE-2026-16346 DataStage on Cloud Pak for Data has several vulnerabilities
- CVE-2026-16340 IBM DataPower Gateway Out-of-bounds Write
- CVE-2026-1634 Subitem AL Slider <= 1.0.0 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
- CVE-2026-16338 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- CVE-2026-16337 Privilege escalation in dotCMS
- CVE-2026-16336 trinodb trino OAuth2/OIDC ExternalUriInfo.java redirect
- CVE-2026-16335 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- CVE-2026-16334 itsourcecode Hospital Management System prescriptionorder.php sql injection
- CVE-2026-16332 D-Link DNS-320 multi_uploadify.php unrestricted upload
- CVE-2026-16331 D-Link DNS-320 save_ajax.php unrestricted upload
- CVE-2026-16330 D-Link DNS-320 uploadify.php unrestricted upload
- CVE-2026-1633 Synectix LAN 232 TRIO Missing Authentication for Critical Function
- CVE-2026-16329 D-Link DNS-320 uploadify.php unrestricted upload
- CVE-2026-16328 consul-mcp-server vulnerable to server side request forgery leading to token exposure
- CVE-2026-16327 D-Link DNS-320 upload.php unrestricted upload
- CVE-2026-16326 consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode
- CVE-2026-16324 Metasoft 美特软件 MetaCRM upload.jsp unrestricted upload
- CVE-2026-16323 Authentication Bypass via Execution After Redirect in FuyaSoft's Architect Panel Web Management Panel
- CVE-2026-1632 RISS SRL MOMA Seismic Station Missing Authentication for Critical Function
- CVE-2026-16318 QUIC Transport Parameters Memory Leak During HelloRetryRequest in s2n-tls
- CVE-2026-16317 Silent Drop of TLS 1.3 Encrypted Records in s2n-tls
- CVE-2026-16316 Malformed IEC 61850 Sampled Values frames cause partial denial of service in StationGuard
- CVE-2026-16315 Authentication and authorization bypass via cryptographic timing side-channel attack in StationGuard
- CVE-2026-16313 Sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export
- CVE-2026-16310 MemberDash <= 1.8.5 - Unauthenticated Account Takeover via Insecure Direct Object Reference via 'id' Parameter
- CVE-2026-1631 Feeds for YouTube < 2.6.4 - Subscriber+ License Data Deletion
- CVE-2026-16309 IDOR in Netiket Information Technologies' EdoWEB
- CVE-2026-16308 IBM Enterprise Build of Quarkus is affected by a DoS vulnerability
- CVE-2026-16307 IDOR in Netiket Information Technologies' EdoWEB
- CVE-2026-16302 Spectra Legacy – Gutenberg Blocks <= 2.20.0 - Authenticated (Contributor+) Sensitive Information Exposure
- CVE-2026-16301 Incorrect Authorization in GitLab
- CVE-2026-16300 Chama < 1.0.13 - Unauthenticated Arbitrary User Password Reset
- CVE-2026-1630 Reflected XSS in WEBCON BPS
- CVE-2026-16299 Single Sign On For TNG < 2.2.0 - Unauthenticated Arbitrary Password Reset
- CVE-2026-16298 FoodBoxBooker < 1.0.7 - Unauthenticated Arbitrary Password Reset
- CVE-2026-16297 Clearfy < 2.4.3 - Admin+ PHP Object Injection via Settings Import
- CVE-2026-16296 Clearfy < 2.4.3 - Open Redirect via Cyrlitera 404 Handler
- CVE-2026-16295 Clearfy < 2.4.3 - Subscriber+ Sensitive Information Disclosure via Factory Page-Action Dispatcher
- CVE-2026-16294 Blubrry PowerPress < 11.17.1 - Contributor+ Server-Side Request Forgery via Podcast Episode Chapters URL
- CVE-2026-16293 Blubrry PowerPress < 11.16.11 - Contributor+ Stored XSS via Podcast Episode Chapters URL
- CVE-2026-16292 Frontend File Manager Plugin <= 23.6 - File Metadata Update via CSRF
- CVE-2026-16291 ProfileGrid < 5.9.9.8 - Subscriber+ Arbitrary Notification Deletion via IDOR
- CVE-2026-16290 ProfileGrid < 6.0.0.0 - Unauthenticated Group Member List Disclosure via pm_get_all_users_from_group
- CVE-2026-1629 Permalink Preview Information Disclosure After Permission Revocation
- CVE-2026-16289 ProfileGrid < 6.0.0.0 - Subscriber+ Group Join Request Disclosure via pm_get_all_requests_from_group
- CVE-2026-16287 Root Command Injection via Offline Update in TÜBİTAK BİLGEM's pardus-update
- CVE-2026-16286 File Upload in TRTEK Software's Software Repository Management
- CVE-2026-16285 WooCommerce Product Attachment < 2.3.3 - Unauthenticated Arbitrary Media Download
- CVE-2026-16282 Appointment Hour Booking < 1.5.88 - Unauthenticated Booking Price Manipulation via tcost Parameter
- CVE-2026-16281 Classified Listing < 6.1.1 - Subscriber+ Arbitrary Attachment Deletion and Listing Image Tampering via IDOR
- CVE-2026-16280 GPU DDK - Integer overflow in _PMRLogicalOffsetToPhysicalOffset
- CVE-2026-1628 Mattermost allows external websites to open within the app, exposing preload functionality to non-trusted sites.
- CVE-2026-16279 Missing authorization in 3DSwymer
- CVE-2026-16277 Rpcbind: rpcbind: stack buffer overflow in rpcinfo rpcbaddrlist()
- CVE-2026-16276 Classified Listing < 5.4.4 - Contributor+ Store Revenue Total Disclosure via rtcl_revenue_order_search
- CVE-2026-16275 Incorrect Authorization in GitLab
- CVE-2026-16274 Classified Listing < 5.4.4 - Contributor+ Unpublished Post Content Disclosure via rtcl_block_css_get_posts
- CVE-2026-16273 Narrative Publisher <= 1.0.7 - Contributor+ Stored XSS via narrative_post_script Post Meta
- CVE-2026-16272 Client IP Spoofing via Untrusted HTTP Headers in PayTR's PayTR Virtual Pos iFrame API WHMCS Module
- CVE-2026-16270 ReDoS in Open Mercato
- CVE-2026-1627 Weak cryptography in SICK LMS1000
- CVE-2026-16269 Newsletters < 4.16 - Unauthenticated API Authentication Bypass via Type Juggling
- CVE-2026-16268 Newsletters < 4.16 - Unauthenticated Server-Side Request Forgery via SNS Bounce Handler
- CVE-2026-16267 Newsletters < 4.16 - Unauthenticated PHP Object Injection via Date Form Field
- CVE-2026-16266 Code injection in mongo-object
- CVE-2026-16265 WP Maps < 4.9.7 - Subscriber+ Denial of Service