Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 855 of 1013.
- CVE-2026-15779 Samba-winbind: samba: pam_winbind mkhomedir chowns critical system paths without validation
- CVE-2026-15778 Security feature bypass in Chrome
- CVE-2026-15777 Use after free in Chrome
- CVE-2026-15776 Code injection in Chrome
- CVE-2026-15775 Security feature bypass in Chrome
- CVE-2026-15774 Use after free in Chrome
- CVE-2026-15773 Use after free in Chrome
- CVE-2026-15772 Use after free in Chrome
- CVE-2026-15771 Information disclosure in Chrome
- CVE-2026-15770 Information disclosure in Chrome
- CVE-2026-1577 IBM® Db2® is vulnerable to a denial of service with a specially crafted query involving multiple subqueries
- CVE-2026-15769 Security feature bypass in Chrome
- CVE-2026-15768 Security feature bypass in Chrome
- CVE-2026-15767 Memory corruption in Chrome
- CVE-2026-15766 Information disclosure in Chrome
- CVE-2026-15765 Use after free in Chrome
- CVE-2026-15764 Use after free in Chrome
- CVE-2026-15762 IBM DataPower Gateway Out-of-bounds Write
- CVE-2026-15761 Tickera <= 3.6.0.1 - Authenticated (Staff+) SQL Injection via 'tc_event_filter' Parameter
- CVE-2026-15760 Missing authorization in Divi Essentials
- CVE-2026-15759 Cross-site scripting in ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form
- CVE-2026-15758 3D FlipBook <= 1.16.20 - Unauthenticated Sensitive Information Exposure in 'id' Parameter
- CVE-2026-15757 Insufficient input validation vulnerability in NETGEAR DGND3700v1 modem router
- CVE-2026-15755 Open User Map <= 1.4.45 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-15754 Missing per-channel team-scope check in ABAC access control policy unassign allows cross-team policy removal
- CVE-2026-15753 zhinianboke xianyu-auto-reply review approve trusting http permission methods on the server side
- CVE-2026-15752 zhinianboke xianyu-auto-reply Backend User Endpoint users authorization
- CVE-2026-15751 mastergo-design mastergo-magic-mcp mcp__getComponentGenerator component-workflow.md execute path traversal
- CVE-2026-15750 mastergo-design mastergo-magic-mcp mcp__getComponentLink get-component-link.ts z.string server-side request forgery
- CVE-2026-1575 Schema Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2026-15749 mastergo-design mastergo-magic-mcp mcp__C2d get-c2d.ts execute path traversal
- CVE-2026-15748 Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration
- CVE-2026-15747 Information disclosure in Mojolicious
- CVE-2026-15746 Credential disclosure in Strands Agents Tools elasticsearch_memory tool
- CVE-2026-15743 Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable
- CVE-2026-15742 PostgreSQL fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound
- CVE-2026-15741 PostgreSQL expression deparse allows SQL injection via EXTRACT argument
- CVE-2026-1574 MyQtip – easy qTip2 <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2026-15739 Cross-site scripting in Rich Showcase for Google Reviews
- CVE-2026-15738 Cross-namespace traffic interception via incorrect route precedence ordering in AWS Load Balancer Controller
- CVE-2026-15737 Sensitive content disclosure via OpenTelemetry spans in AgentCore Python SDK
- CVE-2026-15736 Multiple SQL/DDL Injection and Arbitrary File Read Vulnerabilities in snowflake-sqlalchemy
- CVE-2026-15735 Cross-site scripting in Contact Form to Any API
- CVE-2026-15734 WGDashboard Server-Side Template Injection vulnerability
- CVE-2026-15733 WGDashboard Remote Code Execution vulnerability
- CVE-2026-15732 WGDashboard Server-Side Request Forgery Vulnerability
- CVE-2026-15731 Cross-site scripting in WP Multilang – Translation and Multilingual Plugin
- CVE-2026-15730 GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'heading_size' Shortcode Attribute
- CVE-2026-1573 OMIGO <= 3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2026-15727 WP Bulk Delete <= 1.4.2 - Authenticated (Administrator+) SQL Injection via 'delete_user_roles' Parameter
- CVE-2026-15726 Serious Slider <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'theme' Shortcode Attribute
- CVE-2026-15724 Path traversal in Progress ShareFile Storage Zones Controller (SZC)
- CVE-2026-15723 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') in GitLab
- CVE-2026-15722 Memory corruption in Red Hat Directory Server 11.5 E4S for RHEL 8
- CVE-2026-15721 Query Console SQL Injection Leading to Sensitive Data Disclosure in Bilin Software's HUMANIST Digital Human Resources
- CVE-2026-15720 Pre-auth heap out-of-bounds read in the AMF NAS 5GS mobile-identity handler
- CVE-2026-1572 Cross-site scripting in Livemesh Addons by Elementor
- CVE-2026-15719 Site isolation issue in the DOM: Navigation component
- CVE-2026-15718 Invalid pointer in the JavaScript: WebAssembly component
- CVE-2026-15715 SourceCodester Class and Exam Timetabling System exam.php cross site scripting
- CVE-2026-15714 Memory corruption in Red Hat Enterprise Linux 10
- CVE-2026-15713 Libsoup: soupcache: libsoup: http/2 frame window exhaustion remote denial of service via memory leak
- CVE-2026-15712 Memory corruption in Red Hat Enterprise Linux 10
- CVE-2026-15711 Denial of service in Red Hat Enterprise Linux 10
- CVE-2026-15710 Netskope Client Endpoint DLP Kernel Driver Information Leakage
- CVE-2026-1571 Reflected XSS Vulnerability on TP-Link Archer C60
- CVE-2026-15709 Denial of service in Red Hat Enterprise Linux 10
- CVE-2026-15706 Missing Authentication for Critical Function in Management API in Baylan Water Meters's BMS
- CVE-2026-15704 CWE-863: ABAC authorization bypass via trailing slash route normalization in Eclipse BaSyx Go Components
- CVE-2026-15703 SourceCodester Simple and Nice Shopping Cart Script userproductdeletequery.php sql injection
- CVE-2026-15702 tamagui config.ts updateConfig prototype pollution
- CVE-2026-15701 Totolink NR1800X lighttpd formLogout.htm Form_Logout stack-based overflow
- CVE-2026-15700 DedeCMS Album Publishing Feature zip.class.php ExtractFile path traversal
- CVE-2026-1570 Simple Bible Verse via Shortcode <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2026-15699 spencermountain compromise Public Root API extend.js nlp.extend prototype pollution
- CVE-2026-15698 kofrasa mingo Update API updateMany prototype pollution
- CVE-2026-15697 svgdotjs svg.js npm Package API EventTarget.on prototype pollution
- CVE-2026-15696 Tenda BE12 Pro VirtualSer fromVirtualSer stack-based overflow
- CVE-2026-15695 Tenda BE12 Pro DhcpListClient fromDhcpListClient stack-based overflow
- CVE-2026-15694 Tenda BE12 Pro SetIpBind fromSetIpBind stack-based overflow
- CVE-2026-15693 Tenda BE12 Pro SafeMacFilter fromSafeMacFilter stack-based overflow
- CVE-2026-15692 Tenda BE12 Pro SafeUrlFilter fromSafeUrlFilter stack-based overflow
- CVE-2026-15691 Tenda BE12 Pro SafeClientFilter fromSafeClientFilter stack-based overflow
- CVE-2026-15690 open62541 Shared Client ua_client_connect.c responseReadNamespacesArray null pointer dereference
- CVE-2026-1569 Wueen <= 0.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin's Shortcode
- CVE-2026-15689 Business logic in Dancer2::Plugin::Auth::Extensible
- CVE-2026-15688 Password Authentication Bypass Vulnerability in GX Works3 and Motion Control Setting
- CVE-2026-15687 Path traversal via non-tar copyDirectoryFromPod
- CVE-2026-15686 Adminer multi_query Incorrect Check of Function Return Value Remote Code Execution Vulnerability
- CVE-2026-15685 Ollama downloadBlob Improper Validation of Array Index Denial-of-Service Vulnerability
- CVE-2026-15684 Glarysoft Glary Utilities Link Following Local Privilege Escalation Vulnerability
- CVE-2026-15683 Lorex 2K Indoor Wi-Fi Security Camera Device Management Server Improper Certificate Validation Vulnerability
- CVE-2026-15682 AnyDesk Support Information Link Following Denial-of-Service Vulnerability
- CVE-2026-15681 AnyDesk Screen Recording Link Following Denial-of-Service Vulnerability
- CVE-2026-15680 Lorex 2K Indoor Wi-Fi Security Camera CDeviceOperator Format String Remote Code Execution Vulnerability
- CVE-2026-1568 Rapid7 InsightVM Signature Validation Vulnerability
- CVE-2026-15679 Hugging Face PyTorch Image Models checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability
- CVE-2026-15678 code-projects Online Job Portal DetailJob.php cross site scripting
- CVE-2026-15677 code-projects Online Job Portal JobSeekerInsert.php unrestricted upload
- CVE-2026-15676 code-projects Online Job Portal DeleteUser.php sql injection