Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 892 of 1013.
- CVE-2026-118538 a2ui-project a2ui Renderer root.js Root.renderComponentTree dynamically-determined object attributes
- CVE-2026-118537 a2ui Image Player/Video Player/Audio Player Image.js input validation
- CVE-2026-11853 Path traversal in debusine
- CVE-2026-11852 Missing authorization in debusine
- CVE-2026-118510 Laravel MongoDB `whereDoesntHave` misses deny records for numeric string IDs
- CVE-2026-11851 SQL injection in Router
- CVE-2026-11850 Krb5: krb5: integer underflow in berval2tl_data() leads to heap out-of-bounds read
- CVE-2026-1185 Code injection in AXIS OS
- CVE-2026-11849 IEI Integration Corp｜iRM-IEI Remote Management - Hard-coded Credentials
- CVE-2026-118485 Axel Download Accelerator Path Traversal via URL Filename Decoding
- CVE-2026-11848 IEI Integration Corp｜ iRM-IEI Remote Management - Missing Authentication
- CVE-2026-118477 KaliFast Project Management Platform ei_git_repo_url OS Command Injection
- CVE-2026-11847 Integration Corp｜iVEC-IEI Virtualization Edge Computer - Arbitrary File Deletion
- CVE-2026-11846 IEI Integration Corp｜iVEC-IEI Virtualization Edge Computer - Arbitrary File Deletion
- CVE-2026-11845 IEI Integration Corp｜iVEC-IEI Virtualization Edge Computer - OS Command Injection
- CVE-2026-11844 IEI Integration Corp｜iVEC-IEI Virtualization Edge Computer - Arbitrary File Read
- CVE-2026-118435 Memory corruption in escargot
- CVE-2026-118426 Missing authorization in Octopus Server
- CVE-2026-118425 Keycloak-services: keycloak-services: redirect uri domain allowlist bypass via dns resolution to loopback
- CVE-2026-11841 CVE-2026-11841
- CVE-2026-11840 SQL Injection
- CVE-2026-1184 Deserialization of Untrusted Data in GitLab
- CVE-2026-11839 Arbitrary File Upload in Basarsoft's Rotaban
- CVE-2026-118384 Memory corruption in mtools
- CVE-2026-11838 Improper Authorization in Yordam Informatics' Library Reservation System
- CVE-2026-118378 Tabularis before 0.28.0 SQL Injection via MCP describe_table table_name
- CVE-2026-118377 mews/pos through 2.0.0 Missing Hash Verification in 3D Pay and 3D Host Callbacks
- CVE-2026-118376 WeKnora before 0.8.2 SSRF Guard Bypass via NAT64 IPv6 Addresses
- CVE-2026-118375 llama.cpp b8841 before b11865 Stack-based Buffer Overflow via ggml-rpc RDMA rdma_recv()
- CVE-2026-118374 LibreSSL ocspcheck through 4.4.0 Memory Exhaustion via Unbounded OCSP HTTP Response
- CVE-2026-118373 LibreSSL ocspcheck through 4.4.0 Cleartext Transmission of OCSP Requests via url2host()
- CVE-2026-118372 LibreSSL ocspcheck through 4.4.0 CRLF Injection via AIA OCSP URL Path
- CVE-2026-118371 LibreSSL through 4.4.0 CRLF Injection via OCSP_sendreq_new() Request Line
- CVE-2026-118370 libexpat through 2.9.0 Integer Overflow in storeAtts via attIndex and nPrefixes
- CVE-2026-11837 Ansible-collection-ansible-posix: ansible.posix authorized_key: local privilege escalation via symlink-following chown
- CVE-2026-11836 Production Debug-Unlock Token Verification Missing Device Binding
- CVE-2026-118359 Memory corruption in Chrome
- CVE-2026-118358 Memory corruption in Chrome
- CVE-2026-118357 Use after free in Chrome
- CVE-2026-118356 Use after free in Chrome
- CVE-2026-118355 Code injection in Chrome
- CVE-2026-118354 Other in Chrome
- CVE-2026-118353 Use after free in Chrome
- CVE-2026-118352 Memory corruption in Chrome
- CVE-2026-118351 Memory corruption in Chrome
- CVE-2026-118350 Use after free in Chrome
- CVE-2026-11835 Caliptra Update-Reset Secure-Boot Bypass via Attacker-Chosen AXI Staging Address (TOCTOU)
- CVE-2026-118349 Memory corruption in Chrome
- CVE-2026-118348 Other in Chrome
- CVE-2026-118347 Use after free in Chrome
- CVE-2026-118346 Use after free in Chrome
- CVE-2026-118345 Use after free in Chrome
- CVE-2026-118344 Use after free in Chrome
- CVE-2026-118343 Other in Chrome
- CVE-2026-118342 Memory corruption in Chrome
- CVE-2026-118341 Use after free in Chrome
- CVE-2026-118340 Memory corruption in Chrome
- CVE-2026-11834 Unauthenticated Command Injection via DHCP Option Handling in Multiple TP-Link Routers
- CVE-2026-118339 Use after free in Chrome
- CVE-2026-118338 Use after free in Chrome
- CVE-2026-118337 Security feature bypass in Chrome
- CVE-2026-118336 Other in Chrome
- CVE-2026-118335 Other in Chrome
- CVE-2026-118334 Use after free in Chrome
- CVE-2026-118333 Missing authorization in Chrome
- CVE-2026-118332 Other in Chrome
- CVE-2026-118331 Other in Chrome
- CVE-2026-118330 Use after free in Chrome
- CVE-2026-11833 Information disclosure in CI Server
- CVE-2026-118329 Other in Chrome
- CVE-2026-118328 Other in Chrome
- CVE-2026-118327 Memory corruption in Chrome
- CVE-2026-118322 Memory corruption in Chrome
- CVE-2026-118321 Other in Chrome
- CVE-2026-118320 Memory corruption in Chrome
- CVE-2026-11832 Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a predictable nonce
- CVE-2026-118319 Memory corruption in Chrome
- CVE-2026-118318 Information disclosure in Chrome
- CVE-2026-118317 Memory corruption in Chrome
- CVE-2026-118316 Other in Chrome
- CVE-2026-118315 Other in Chrome
- CVE-2026-118314 Other in Chrome
- CVE-2026-118313 Use after free in Chrome
- CVE-2026-118312 Memory corruption in Chrome
- CVE-2026-118311 Memory corruption in Chrome
- CVE-2026-118310 Other in Chrome
- CVE-2026-11831 IBM MQ Heap-based Buffer Overflow
- CVE-2026-118309 Other in Chrome
- CVE-2026-118308 Use after free in Chrome
- CVE-2026-118307 Use after free in Chrome
- CVE-2026-118306 Memory corruption in Chrome
- CVE-2026-118305 Memory corruption in Chrome
- CVE-2026-118304 Other in Chrome
- CVE-2026-1183 HTML injection in multiple Botble products
- CVE-2026-11829 IBM MQ Buffer Overflow
- CVE-2026-11828 IBM MQ Buffer Overflow
- CVE-2026-118276 a2ui-project a2ui Parser expression_parser.ts formatString resource consumption
- CVE-2026-118275 a2ui-project a2ui Resolver data-context.ts DataContext.resolveSignal resource consumption
- CVE-2026-118274 a2ui-project a2ui Binder generic-binder.ts resource consumption
- CVE-2026-118273 a2ui-project a2ui data-model.ts DataModel.set resource consumption