Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 895 of 1013.
- CVE-2026-117933 Frame poisoning in the CSS Parsing and Computation component
- CVE-2026-117932 Use-after-free in the DOM: Core & HTML component
- CVE-2026-117931 Use-after-free in the DOM: Events component
- CVE-2026-117930 Use-after-free in the DOM: Bindings (WebIDL) component
- CVE-2026-11793 389-ds-base: 389-ds-base: stack buffer overflow in checkprefix() algorithm id parsing
- CVE-2026-117929 Use-after-free in the DOM: Core & HTML component
- CVE-2026-117928 Same-origin policy bypass in the CSS Parsing and Computation component
- CVE-2026-117927 Use-after-free in the SVG component
- CVE-2026-117926 Incorrect boundary conditions in the SVG component
- CVE-2026-117925 Use-after-free in the DOM: Core & HTML component
- CVE-2026-117924 Use-after-free in the XSLT component
- CVE-2026-117923 Use-after-free in the Audio/Video component
- CVE-2026-117922 Use-after-free in the Networking: WebSockets component
- CVE-2026-117921 Use-after-free in the CSS Parsing and Computation component
- CVE-2026-117920 Use-after-free in the DOM: HTML Parser component
- CVE-2026-11792 389-ds-base: 389-ds-base: heap buffer overflow in audit log password masking (create_masked_entry_string)
- CVE-2026-117919 Use-after-free in the DOM: Core & HTML component
- CVE-2026-117918 Use-after-free in the Graphics: Canvas2D component
- CVE-2026-117917 Invalid pointer in the Graphics: WebRender component
- CVE-2026-117916 Use-after-free in the XSLT component
- CVE-2026-117915 Incorrect boundary conditions in the Layout: Block and Inline component
- CVE-2026-117914 Use-after-free in the SVG component
- CVE-2026-117913 Use-after-free in the SVG component
- CVE-2026-117912 Same-origin policy bypass in the CSS Parsing and Computation component
- CVE-2026-117911 Use-after-free in the Audio/Video: Playback component
- CVE-2026-117910 Invalid pointer in the JavaScript Engine component
- CVE-2026-11791 389-ds-base: 389-ds-base: use-after-free in schema reload via attr_syntax_swap_ht()
- CVE-2026-117909 Use-after-free in the JavaScript: GC component
- CVE-2026-117908 Use-after-free in the Graphics: ImageLib component
- CVE-2026-117907 Use-after-free in the Networking component
- CVE-2026-117906 Use-after-free in the CSS Parsing and Computation component
- CVE-2026-117905 Use-after-free in the Audio/Video: Playback component
- CVE-2026-117904 Use-after-free in the JavaScript: GC component
- CVE-2026-117903 Use-after-free in the Audio/Video component
- CVE-2026-117902 Use-after-free in the Layout: Text and Fonts component
- CVE-2026-117901 Use-after-free in the DOM: Core & HTML component
- CVE-2026-117900 Use-after-free in the DOM: Editor component
- CVE-2026-11790 389-ds-base: 389-ds-base: pbkdf2 password storage plugin unbounded iteration count denial of service
- CVE-2026-1179 Yonyou KSOA HTTP GET Parameter user_popedom.jsp sql injection
- CVE-2026-117899 Use-after-free in the Networking: HTTP component
- CVE-2026-117898 Use-after-free in the JavaScript Engine: JIT component
- CVE-2026-117897 Incorrect boundary conditions in the Layout: Tables component
- CVE-2026-117896 Use-after-free in the DOM: Core & HTML component
- CVE-2026-117895 Use-after-free in the DOM: Core & HTML component
- CVE-2026-117894 Incorrect boundary conditions in the WebRTC: Signaling component
- CVE-2026-117893 Incorrect boundary conditions in the Security: PSM component
- CVE-2026-117892 Privilege escalation due to use-after-free in the WebRTC: Networking component
- CVE-2026-117891 Use-after-free in the JavaScript Engine: JIT component
- CVE-2026-117890 JIT miscompilation in the JavaScript Engine: JIT component
- CVE-2026-11789 389-ds-base: 389-ds-base: smd5 password storage plugin salt length integer underflow crash
- CVE-2026-117889 Incorrect boundary conditions in the JavaScript Engine component
- CVE-2026-117888 Uninitialized memory in the Graphics: Canvas2D component
- CVE-2026-117887 Use-after-free in the DOM: Core & HTML component
- CVE-2026-117886 Incorrect boundary conditions in the Graphics: Text component
- CVE-2026-117885 Use-after-free in the Layout: Grid component
- CVE-2026-117884 Use-after-free in the Networking component
- CVE-2026-117883 Use-after-free in the DOM: HTML Parser component
- CVE-2026-117882 Use-after-free in the Layout component
- CVE-2026-117881 Use-after-free in the DOM: Core & HTML component
- CVE-2026-117880 Use-after-free in the XML component
- CVE-2026-11788 389-ds-base: 389-ds-base: null pointer dereference in deref control plugin ber parser
- CVE-2026-117879 Incorrect boundary conditions in the Layout: Tables component
- CVE-2026-117878 Other issue, use-after-free in the Storage: IndexedDB component
- CVE-2026-117877 Use-after-free in the Layout: Text and Fonts component
- CVE-2026-117876 Use-after-free in the Layout: Text and Fonts component
- CVE-2026-117875 Use-after-free in the Layout: Scrolling and Overflow component
- CVE-2026-117874 Use-after-free in the Internationalization component
- CVE-2026-117873 Incorrect boundary conditions in the Audio/Video: Playback component
- CVE-2026-117872 Use-after-free in the JavaScript: Standard Library component
- CVE-2026-117871 Invalid pointer in the Graphics component
- CVE-2026-117870 Use-after-free in the JavaScript Engine component
- CVE-2026-11787 389-ds-base: 389-ds-base: heap buffer over-read in ldap_utf8prev() via str2simple filter parsing
- CVE-2026-117869 Use-after-free in the DOM: Core & HTML component
- CVE-2026-117868 Sandbox escape in the DOM: Networking component
- CVE-2026-117867 Use-after-free in the Layout component
- CVE-2026-117866 Privilege escalation due to use-after-free in the Graphics: Canvas2D component
- CVE-2026-117865 Use-after-free in the JavaScript: GC component
- CVE-2026-117864 Sandbox escape in the Form Manager component
- CVE-2026-117863 Information disclosure due to uninitialized memory in the Audio/Video component
- CVE-2026-117862 Privilege escalation due to incorrect boundary conditions in the Networking component
- CVE-2026-117861 Sandbox escape in the DOM: Navigation component
- CVE-2026-117860 Same-origin policy bypass in the DOM: Navigation component
- CVE-2026-11786 389-ds-base: 389-ds-base: heap out-of-bounds read in ldif parser str2entry_state_information_from_type()
- CVE-2026-117859 Keycloak-services: keycloak-services: par single-use bypass via flow restart
- CVE-2026-11785 389-ds-base: 389-ds-base: partial stack address information leak via ber_printf type confusion in sso token handler
- CVE-2026-11784 Cross-site request forgery in Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization
- CVE-2026-11783 Cross-site scripting in Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
- CVE-2026-11782 Points and Rewards for WooCommerce < 2.10.1 - Unauthenticated Arbitrary User Wallet & Points Manipulation via IDOR
- CVE-2026-11781 Adminify < 4.2.10 - Contributor+ Sensitive Information Disclosure via Global Search AJAX
- CVE-2026-11780 Cross-site scripting in Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
- CVE-2026-1178 Yonyou KSOA HTTP GET Parameter select.jsp sql injection
- CVE-2026-11779 PayloadCMS 3.84.1 - Authenticated account lockout bypass through default unlock access
- CVE-2026-11778 CURCY <= 2.2.14 - Unauthenticated Arbitrary Shortcode Execution via 'exchange' Parameter
- CVE-2026-11777 Form Maker by 10Web <= 1.15.43 - Authenticated (Administrator+) SQL Injection via 'name' Parameter
- CVE-2026-11776 Form Maker by 10Web <= 1.15.43 - Authenticated (Adminsitrator+) SQL Injection via 'groupids' Parameter
- CVE-2026-11775 User Admin Simplifier <= 3.0.0 - Cross-Site Request Forgery
- CVE-2026-11774 389-ds-base: 389-ds-base: integer overflow in sasl packet length bypasses size limit leading to heap buffer overflow
- CVE-2026-11773 Masteriyo LMS <= 2.2.1 - Missing Authorization to Authenticated (Student+) Arbitrary Course Announcement Modification
- CVE-2026-11772 Reflected XSS in DRIMO CMS
- CVE-2026-11771 Memory corruption in OpenVPN