Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 897 of 1013.
- CVE-2026-117468 Device-code claim permits restricted token escalation in Psono Server
- CVE-2026-117466 Privilege escalation in Octopus Server
- CVE-2026-11746 Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover
- CVE-2026-11745 Central Dogma: SSH host-key verification permanently disabled in Git mirror (SshGitMirror)
- CVE-2026-11744 PaperCut Hive Embedded App for Ricoh: Javascript injection
- CVE-2026-11743 Missing negative-offset/overflow check in SF32LB MPI QSPI NOR flash driver allows out-of-bounds read and write
- CVE-2026-11742 Use-after-free race in kernel `k_queue_peek_head/tail` due to missing spinlock
- CVE-2026-1174 birkir prime GraphQL Alias graphql resource consumption
- CVE-2026-11739 Command injection vulnerability in some NETGEAR Nighthawk devices
- CVE-2026-11738 Insufficient input validation in certain NETGEAR Nighthawk routers allows administrators to tamper with the device.
- CVE-2026-11737 Some NETGEAR Nighthawk devices allow administrators to tamper with the device
- CVE-2026-11736 Stack-based buffer overflow vulnerability in some NETGEAR Nighthawk routers
- CVE-2026-11735 Stack-based buffer overflow vulnerability in some NETGEAR Nighthawk models
- CVE-2026-117341 Information disclosure in Octopus Server
- CVE-2026-11734 Device administrator can interrupt the normal operation of some NETGEAR Nighthawk devices.
- CVE-2026-11733 Buffer overflow vulnerability in some NETGEAR Nighthawk routers
- CVE-2026-11732 Insufficient input validation vulnerability exists in website blocking feature of certain NETGEAR RAX/CAX series models
- CVE-2026-11731 Authentication Bypass Vulnerability in Certain NETGEAR RAX Series Models
- CVE-2026-11730 Insufficient session randomness vulnerability exists in certain NETGEAR EX Series Models
- CVE-2026-1173 birkir prime GraphQL Array Based Query Batch graphql denial of service
- CVE-2026-11729 IBM MQ Java messaging is vulnerable to remote code execution
- CVE-2026-11728 IBM MQ .NET client is vulnerable to remote code execution
- CVE-2026-11727 IBM MQ for HPE NonStop is vulnerable to a denial of service issue
- CVE-2026-11726 IBM MQ for HPE NonStop is vulnerable to a denial of service issue
- CVE-2026-11725 IBM MQ queue manager is vulnerable to privilege escalation
- CVE-2026-11722 IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty HTTP Request Smuggling
- CVE-2026-11721 Cache poisoning possible with label count discrepancy, RRSIG, and wildcards
- CVE-2026-11720 Path Traversal in googleapis/mcp-toolbox HTTP Tool URL Builder
- CVE-2026-1172 birkir prime GraphQL Directive graphql denial of service
- CVE-2026-11719 MCP Toolbox for Databases: authenticated authorization bypass
- CVE-2026-11718 googleapis/mcp-toolbox: authentication bypass vulnerability in the generic opaque token validation path (validateOpaqueToken)
- CVE-2026-11717 googleapis/mcp-toolbox: authentication bypass vulnerability in the generic opaque token validation path (validateOpaqueToken)
- CVE-2026-11716 IBM MQ for HPE NonStop is vulnerable to a denial of service attack
- CVE-2026-11714 IBM WebSphere Application Server Liberty is affected by an authorization bypass vulnerability
- CVE-2026-11713 IBM WebSphere Application Server Liberty Incorrect Authorization
- CVE-2026-11712 IBM WebSphere Application Server is affected by a cross-site scripting vulnerability
- CVE-2026-11711 IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
- CVE-2026-11710 IBM WebSphere Application Server is affected by an HTTP request smuggling vulnerability
- CVE-2026-1171 birkir prime GraphQL Field graphql denial of service
- CVE-2026-11708 IBM WebSphere Application Server is affected by a cross-site scripting vulnerability
- CVE-2026-11707 Cross-site scripting in Tivoli System Automation Application Manager
- CVE-2026-11703 Missing SNI/ALPN binding on stateful (session-ID) TLS session resumption
- CVE-2026-11702 Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across forked processes
- CVE-2026-11701 Other in Chrome
- CVE-2026-11700 Use after free in Chrome
- CVE-2026-1170 birkir prime GraphQL API graphql information disclosure
- CVE-2026-11699 Use after free in Chrome
- CVE-2026-11698 Use after free in Chrome
- CVE-2026-11697 Security feature bypass in Chrome
- CVE-2026-11696 Information disclosure in Chrome
- CVE-2026-11695 Information disclosure in Chrome
- CVE-2026-11694 Use after free in Chrome
- CVE-2026-11693 Security feature bypass in Chrome
- CVE-2026-11692 Use after free in Chrome
- CVE-2026-11691 Information disclosure in Chrome
- CVE-2026-116900 REDAXO before 5.21.4 Stored XSS via Media and Link Input Widgets
- CVE-2026-11690 Memory corruption in Chrome
- CVE-2026-1169 birkir prime cross-site request forgery
- CVE-2026-116899 REDAXO before 5.21.4 Broken Access Control in Slice Operations
- CVE-2026-116898 REDAXO before 5.21.4 Missing Authorization in Media Pool Bulk Move
- CVE-2026-116897 REDAXO before 5.21.4 Missing Authorization in Version and History Previews
- CVE-2026-116896 REDAXO before 5.21.5 Privilege Escalation via Backup Export of Authentication Tables
- CVE-2026-116895 REDAXO before 5.21.5 CSRF via Safe Mode Toggle Parameter
- CVE-2026-116894 REDAXO before 5.21.5 Insufficient Session Expiration on Password Change
- CVE-2026-116893 REDAXO core before 5.21.5 Missing Authorization in rex_api_package API
- CVE-2026-116892 SemanticMediaWiki 3.1.0 before 7.3.1 Reflected XSS via Special:Search smw Profile
- CVE-2026-116891 SemanticMediaWiki 4.2.0 before 7.2.1 Reflected XSS via Special:FacetedSearch cstate
- CVE-2026-116890 Semantic MediaWiki 3.0.0 before 7.3.0 Missing Authorization via smwtask API
- CVE-2026-11689 Security feature bypass in Chrome
- CVE-2026-116889 SemanticMediaWiki 2.5.0 before 7.3.1 Stored XSS via Special:Browse Code Property
- CVE-2026-116888 SemanticMediaWiki 3.2.0 before 7.3.1 Stored XSS via Special:Browse Group Heading
- CVE-2026-116887 Semantic MediaWiki 3.0.0 before 7.3.1 Stored XSS via Special:Browse Keyword Property
- CVE-2026-116886 Semantic MediaWiki before 7.3.1 Stored XSS via External Identifier in Special:Browse
- CVE-2026-116885 Semantic MediaWiki before 7.3.1 Reflected XSS via Special:SMWAdmin id Parameter
- CVE-2026-116884 SemanticMediaWiki 5.0.0 before 7.3.1 Stored XSS via Tooltip Module data-* Attributes
- CVE-2026-116883 Semantic MediaWiki 3.1.0 before 7.3.1 Stored XSS via Schema Descriptions
- CVE-2026-116882 Semantic MediaWiki 4.2.0 before 7.3.1 Stored XSS via FacetedSearch Exploration Labels
- CVE-2026-116881 Semantic MediaWiki 3.0.0 before 7.3.1 XSS via Property-Value Autocomplete
- CVE-2026-116880 Semantic MediaWiki 3.0.0 before 7.3.1 CSRF via Special:SMWAdmin Maintenance Actions
- CVE-2026-11688 Code injection in Chrome
- CVE-2026-116879 Semantic MediaWiki 7.3.0 before 7.3.1 Missing Authorization via smwtask Update Task
- CVE-2026-116878 Semantic MediaWiki 2.5.0 before 7.3.1 Resource Exhaustion via Special:PropertyLabelSimilarity
- CVE-2026-116877 Semantic MediaWiki 2.5.0 before 7.3.1 Resource Exhaustion via #set_recurring_event
- CVE-2026-116876 Semantic MediaWiki 2.5.0 before 7.3.1 Missing Authorization via Is edit protected
- CVE-2026-116875 SemanticMediaWiki 3.0.0 before 7.3.1 Reflected XSS via Special:Ask Separator Parameters
- CVE-2026-116874 SemanticMediaWiki 3.1.0 before 7.3.1 Reflected XSS via JsonResultPrinter Default Parameter
- CVE-2026-116873 Semantic MediaWiki 7.3.0 Missing Authorization via smwtask API run-joblist and update
- CVE-2026-116872 Semantic MediaWiki 3.0.0 before 7.3.1 Denial of Service via Special:Search Compact Filters
- CVE-2026-116871 Semantic MediaWiki 3.0.0 before 7.3.1 Uncontrolled Recursion via Special:Ask
- CVE-2026-116870 Auth bypass in Octopus Server
- CVE-2026-11687 Use after free in Chrome
- CVE-2026-116869 WordPress myPOS Checkout plugin <= 1.4.5 - PHP Object Injection vulnerability
- CVE-2026-116868 WordPress BuddyPress Xprofile Custom Field Types plugin <= 1.3.1 - PHP Object Injection vulnerability
- CVE-2026-116867 WordPress Dynamic QR Code – generator plugin <= 1.0.1 - PHP Object Injection vulnerability
- CVE-2026-116866 WordPress Extra Fees Plugin for WooCommerce plugin <= 4.4.0 - PHP Object Injection vulnerability
- CVE-2026-116865 WordPress Zippy plugin <= 1.7.0 - PHP Object Injection vulnerability
- CVE-2026-116864 WordPress WPCargo Track & Trace plugin <= 8.0.5 - PHP Object Injection vulnerability
- CVE-2026-116863 WordPress Newsletters plugin <= 4.18.2 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-11686 Information disclosure in Chrome
- CVE-2026-116857 WordPress JetSmartFilters plugin <= 3.8.6.2 - Cross Site Scripting (XSS) vulnerability