Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 867 of 1013.
- CVE-2026-1449 Hisense TransTech Smart Bus Management System TireMng.aspx Page_Load sql injection
- CVE-2026-14489 WHMCS Bridge <= 6.9 - Unauthenticated Arbitrary File Upload via 'ccce' Parameter
- CVE-2026-14488 Missing authorization in Meta Box AIO
- CVE-2026-14487 Simple Coherent Form <= 2.4.13 - Unauthenticated Arbitrary File Deletion via 'id' Parameter
- CVE-2026-14484 RapiSafe <= 1.0.4 - Unauthenticated Arbitrary File Deletion via 'rsmfcf7_session' and 'file_name' Parameters
- CVE-2026-14483 File upload in Realtyna Organic IDX plugin + WPL Real Estate
- CVE-2026-14482 多说社会化评论框 <= 1.2 - Unauthenticated Privilege Escalation via api.php 'option'/'value' Parameters
- CVE-2026-14481 Cross-site scripting in Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance
- CVE-2026-14480 OpenPLC v3 External Control of File Name or Path
- CVE-2026-1448 D-Link DIR-615 Web Management wiz_policy_3_machine.php os command injection
- CVE-2026-14479 Denial of Service in Autodesk Installer IPC Channel
- CVE-2026-14478 Incorrect Permission Assignment in Autodesk Installer Named Pipes
- CVE-2026-14476 Sssd: sssd: gpo cache path traversal via unsanitized gpcfilesyspath allows kerberos authentication bypass
- CVE-2026-14475 Cookie Banner for GDPR / CCPA <= 4.3.6 - Authenticated (Administrator+) SQL Injection via 'scan_id' Parameter
- CVE-2026-14474 Privilege escalation in Red Hat Enterprise Linux 10
- CVE-2026-14472 Cross-site scripting in Kubio AI Page Builder
- CVE-2026-14471 Authenticated SQL injection in the metrics-service retention policy subsystem of mcp-gateway-registry
- CVE-2026-14470 Path traversal in Langflow OSS
- CVE-2026-1447 Mail Mint <= 1.19.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- CVE-2026-14468 Path traversal allows arbitrary file read in Terraform Enterprise container
- CVE-2026-14466 Possible XSS in the SNS web administration panel
- CVE-2026-14465 Session Fixation in Bilin Software's HUMANIST Digital Human Resources
- CVE-2026-14461 Out-of-bound read in mtr
- CVE-2026-14460 Missing Authorization in TUBITAK BILGEM's pardus-software
- CVE-2026-1446 XSS issue is Esri ArcGIS Pro versions 3.6.0 and earlier
- CVE-2026-14459 Argument Injection in TUBITAK BILGEM's pardus-software
- CVE-2026-14457 RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate
- CVE-2026-14456 Unbounded Memory Growth in QUIC Server Incoming Channel Queue
- CVE-2026-14454 Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed
- CVE-2026-14453 A user with low privileges can inject SSTI templates that can lead to RCE in open-tickets
- CVE-2026-14452 Open redirect and XSS via reset_url parameter
- CVE-2026-14450 Maas-billing: maas api: privilege escalation via forged http headers due to missing authentication
- CVE-2026-1445 iJason-Liu Books_Manager upload_bookCover.php unrestricted upload
- CVE-2026-14449 POST-based reflected XSS via the thanks parameter in form components
- CVE-2026-14448 Authenticated RCE in system_certificates view
- CVE-2026-14446 IBM WebSphere Application Server is affected by a privilege escalation
- CVE-2026-14444 Privilege escalation in WP Fusion (Pro)
- CVE-2026-14443 Incomplete log sanitization during bulk IPsec policy collection in Brocade SANnav before 3.0.1a
- CVE-2026-14442 Information exposure vulnerability in the job scheduling component of SANnav before 3.0.1a
- CVE-2026-14441 Logic flaw in SANnav Java cache key handling object comparison handling
- CVE-2026-14440 Cloudflare Universal SSL automatically managed CAA RRset supersedes customer-configured CAA records
- CVE-2026-1444 iJason-Liu Books_Manager add_book_check.php cross site scripting
- CVE-2026-14439 Path Traversal in Altium Git Service Allows Remote Code Execution
- CVE-2026-14433 Cross-site scripting in Online Booking & Scheduling Calendar by vcita
- CVE-2026-14432 Use after free in Chrome
- CVE-2026-14431 Memory corruption in Chrome
- CVE-2026-14430 Integer overflow in Chrome
- CVE-2026-1443 code-projects Online Music Site AdminDeleteUser.php sql injection
- CVE-2026-14429 Security feature bypass in Chrome
- CVE-2026-14428 Security feature bypass in Chrome
- CVE-2026-14427 Memory corruption in Chrome
- CVE-2026-14426 Use after free in Chrome
- CVE-2026-14425 Use after free in Chrome
- CVE-2026-14424 Use after free in Chrome
- CVE-2026-14423 Memory corruption in Chrome
- CVE-2026-14422 Memory corruption in Chrome
- CVE-2026-14421 Information disclosure in Chrome
- CVE-2026-14420 Memory corruption in Chrome
- CVE-2026-1442 Unitree UPK files Hard-Coded Key
- CVE-2026-14419 Use after free in Chrome
- CVE-2026-14418 Information disclosure in Chrome
- CVE-2026-14417 Use after free in Chrome
- CVE-2026-14416 Memory corruption in Chrome
- CVE-2026-14415 Memory corruption in Chrome
- CVE-2026-14414 Information disclosure in Chrome
- CVE-2026-14413 Memory corruption in Chrome
- CVE-2026-14412 Security feature bypass in Chrome
- CVE-2026-14411 Security feature bypass in Chrome
- CVE-2026-14410 Other in Chrome
- CVE-2026-1441 Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web Interface
- CVE-2026-14409 Security feature bypass in Chrome
- CVE-2026-14408 Information disclosure in Chrome
- CVE-2026-14407 Code injection in Chrome
- CVE-2026-14406 Memory corruption in Chrome
- CVE-2026-14405 Memory corruption in Chrome
- CVE-2026-14404 Other in Chrome
- CVE-2026-14403 Use after free in Chrome
- CVE-2026-14402 Information disclosure in Chrome
- CVE-2026-14401 Security feature bypass in Chrome
- CVE-2026-14400 Memory corruption in Chrome
- CVE-2026-1440 Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web Interface
- CVE-2026-14399 Information disclosure in Chrome
- CVE-2026-14398 Use after free in Chrome
- CVE-2026-14397 Memory corruption in Chrome
- CVE-2026-14396 Memory corruption in Chrome
- CVE-2026-14395 Memory corruption in Chrome
- CVE-2026-14394 Use after free in Chrome
- CVE-2026-14393 Use after free in Chrome
- CVE-2026-14392 Memory corruption in Chrome
- CVE-2026-14391 Integer overflow in Chrome
- CVE-2026-14390 Use after free in Chrome
- CVE-2026-1439 Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web Interface
- CVE-2026-14389 Integer overflow in Chrome
- CVE-2026-14388 Memory corruption in Chrome
- CVE-2026-14387 Integer overflow in Chrome
- CVE-2026-14386 Memory corruption in Chrome
- CVE-2026-14385 Memory corruption in Chrome
- CVE-2026-14384 Memory corruption in Chrome
- CVE-2026-14383 Code injection in Chrome
- CVE-2026-14382 Security feature bypass in Chrome