Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 898 of 1013.
- CVE-2026-116856 Missing authorization in Flexible Quantity – Measurement Price Calculator for WooCommerce
- CVE-2026-116855 WordPress My auctions allegro plugin <= 4.0.3 - Broken Access Control vulnerability
- CVE-2026-116850 WordPress Happy Addons for Elementor plugin <= 3.50.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-11685 Information disclosure in Chrome
- CVE-2026-116849 WordPress StreamCast plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-116848 WordPress The Plus Addons for Elementor Page Builder Lite plugin <= 6.5.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-116846 WordPress WP User Manager plugin <= 2.9.26 - Broken Access Control vulnerability
- CVE-2026-116844 Fclairamb ftpserverlib through 0.32.4 Cleartext FTPES Data Transfer via PROT P
- CVE-2026-116843 Mistral Vibe before 3.0.3 RCE via Git Filter Drivers in Worktree Mode
- CVE-2026-116842 DevilutionX 1.4.0 through 1.5.5 Heap Buffer Overflow via libmpq__archive_dup
- CVE-2026-116841 DevilutionX 1.4.0 through 1.5.5 Out-of-Bounds Read via libmpq Hash Table Lookup
- CVE-2026-116840 llama.cpp b5854 before b11275 Integer Overflow in gguf_init_from_reader
- CVE-2026-11684 Security feature bypass in Chrome
- CVE-2026-116839 Cross-site request forgery in airMAX M
- CVE-2026-116838 Cross-site request forgery in airMAX M
- CVE-2026-116837 Memory corruption in LTU PTMP
- CVE-2026-116836 Cross-site scripting in airMAX M
- CVE-2026-11683 Use after free in Chrome
- CVE-2026-116829 llama.cpp b10398 before b11301 Integer Overflow in gguf_init_from_reader
- CVE-2026-116828 YesWiki before 4.7.0 SQL Injection via despam.php INTERVAL operand
- CVE-2026-116827 YesWiki before 4.7.0 SSRF via copyUrlToLocalFile in Bazar CSV Import
- CVE-2026-116826 YesWiki before 4.7.0 Authenticated SSRF via Page Duplication API downloadFile
- CVE-2026-116825 YesWiki from 4.6.2 before 4.7.0 HTTP Signature Replay via ActivityPub Inbox
- CVE-2026-116824 YesWiki before 4.7.0 Stored XSS via Referer Header in referrers_sites Handler
- CVE-2026-116823 YesWiki before 4.7.0 Reflected XSS via BazarField $_REQUEST Fallback
- CVE-2026-116822 YesWiki before 4.7.0 Template Traversal via BazarListeAction template Parameter
- CVE-2026-116821 YesWiki before 4.7.0 Read-ACL Bypass via SQL LIKE Wildcards in Usernames
- CVE-2026-116820 YesWiki from 4.6.0 before 4.7.0 SQL Query Disclosure via showreq Parameter
- CVE-2026-11682 Security feature bypass in Chrome
- CVE-2026-116819 OpenPanel before 3.0.0 Credential Disclosure via notification.rules Query
- CVE-2026-116818 OpenPanel before 3.0.0 Unauthenticated ClickHouse SQL Injection via /live/visitors WebSocket
- CVE-2026-116817 OpenPanel before 3.0.0 Missing Authentication on Worker Bull Board
- CVE-2026-116816 llama.cpp b5899 before b10261 Heap Out-of-Bounds Write via plamo2 Tokenizer
- CVE-2026-116815 OpenPanel before 3.0.0 Improper ClickHouse Escaping in sankey.service.ts
- CVE-2026-116814 OpenPanel before 3.0.0 Sensitive Information Exposure via Application Logs
- CVE-2026-116813 OpenPanel before 3.0.0 ClickHouse SQL Injection via conversion.service.ts
- CVE-2026-116812 OpenPanel before 3.0.0 ClickHouse SQL Injection via cohort.preview profile filter
- CVE-2026-116811 OpenPanel before 3.0.0 Sandbox Escape RCE via Webhook JavaScript Template
- CVE-2026-116810 OpenPanel before 3.0.0 Missing Authorization via reference.getChartReferences
- CVE-2026-11681 Use after free in Chrome
- CVE-2026-116809 OpenPanel before 3.0.0 Missing Authorization in event.bots tRPC Procedure
- CVE-2026-116808 OpenPanel before 3.0.0 ClickHouse SQL Injection via profile.values
- CVE-2026-116807 OpenPanel before 3.0.0 ClickHouse SQL Injection via event.events tRPC Query
- CVE-2026-116806 OpenPanel before 3.0.0 Privilege Escalation via onboarding.project tRPC Mutation
- CVE-2026-116805 OpenPanel before 3.0.0 Information Disclosure of Ingestion Secret Hashes via client.list
- CVE-2026-116804 DOMPurify from 3.4.4 before 3.4.17 SAFE_FOR_TEMPLATES Bypass via Shadow Root Content
- CVE-2026-116803 DOMPurify before 3.4.17 DOM XSS via IN_PLACE Hook-Detached Subtrees
- CVE-2026-116802 DOMPurify before 3.4.17 XSS via SMIL attributeName Guard Bypass in XHTML Mode
- CVE-2026-116801 Parse Server 9.0.0 before 9.10.5-alpha.6 ACL Bypass via $relatedTo Query
- CVE-2026-116800 WWBN AVideo before 29.5.0 Local PHP File Inclusion via Accept-Language Header
- CVE-2026-11680 Use after free in Chrome
- CVE-2026-1168 Allocation of Resources Without Limits or Throttling in GitLab
- CVE-2026-116797 Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`
- CVE-2026-116796 Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts
- CVE-2026-116795 RE2JS: Quadratic-time denial of service in re2js lookbehind matching
- CVE-2026-116794 Missing authorization in russh
- CVE-2026-11679 Use after free in Chrome
- CVE-2026-11678 Integer overflow in Chrome
- CVE-2026-116778 FOG: Authenticated low-privileged API user can modify Storage Nodes and reach root command execution
- CVE-2026-116776 USB Test: Heap-based Buffer Overflow in getSectorSize via untrusted DISK_GEOMETRY.BytesPerSector leads to RCE/DoS
- CVE-2026-116775 pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS)
- CVE-2026-116774 russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang)
- CVE-2026-116773 russh's SSH client is susceptible to unbounded allocations via EXT_INFO packets
- CVE-2026-11677 Race condition in Chrome
- CVE-2026-116763 Cross-site scripting in LiteSpeed Cache
- CVE-2026-116761 CMB2 <= 2.13.4 - Unauthenticated Stored Cross-Site Scripting via Grouped WYSIWYG Field via Front-End Form
- CVE-2026-11676 Security feature bypass in Chrome
- CVE-2026-116750 SQL injection in VikRentCar Car Rental Management System
- CVE-2026-11675 Memory corruption in Chrome
- CVE-2026-116749 Cross-site scripting in VikRentCar Car Rental Management System
- CVE-2026-116748 Transmission 4.0.0 before 4.1.3 Permissive CORS Leaks RPC Anti-CSRF Token
- CVE-2026-116747 Kener 3.0.0 before 4.1.10 Authentication Bypass via Hardcoded Fallback JWT Secret
- CVE-2026-116746 QloApps 1.6.0 through 1.7.0 Unauthorized Hotel Review Submission via qlohotelreview
- CVE-2026-116745 QloApps through 1.7.0 Guest Order Disclosure via id_cart in Order Confirmation
- CVE-2026-116744 ntop nDPI through 6.0 Out-of-Bounds Read in SoftEther Dissector
- CVE-2026-116743 libyal libmsiecf through 20260525 Double Free via libmsiecf_url_values_read_data
- CVE-2026-116742 HTSlib through 1.24 Heap Out-of-Bounds Write via Truncated .gzi Index Count
- CVE-2026-116741 Speex through 1.2.1 Out-of-Bounds Write via speex_bits_read_whole_bytes
- CVE-2026-116740 libcss through 0.9.2 NULL Pointer Dereference via Media-Query Parser
- CVE-2026-11674 Use after free in Chrome
- CVE-2026-116739 VMime through 0.9.2 Uninitialized Stack Memory Disclosure via uuencode Decoder
- CVE-2026-116738 VMime through 0.9.2 Stack-Based Buffer Overflow via uuencode Decoder
- CVE-2026-116737 libphdi through 20260902 Heap Out-of-Bounds Read via Extent Data File Path
- CVE-2026-116736 libpff through 20260926 Heap Out-of-Bounds Read via libpff_table_read_values_array
- CVE-2026-116735 libpff through 20260926 Heap Out-of-Bounds Read via libpff_table_read_6c_record_entries
- CVE-2026-116734 flatcc through 0.6.4 Out-of-Bounds Read via verifier check_header
- CVE-2026-116733 flatcc through 0.6.4 Out-of-Bounds Read via __flatcc_json_parser_number
- CVE-2026-116732 libdwarf through 2.3.3 Heap Out-of-Bounds Read via dwarf_debug_addr_table
- CVE-2026-116731 Furnace through 0.6.8.3 Out-of-Bounds Write via FamiTracker GROOVES Block Import
- CVE-2026-116730 Furnace through 0.6.8.3 Out-of-Bounds Read via FamiTracker Module Import
- CVE-2026-11673 Use after free in Chrome
- CVE-2026-116729 libfvde through 20260923 Heap Out-of-Bounds Read via libfvde_encrypted_metadata_read_type_0x001a
- CVE-2026-116728 libfvde through 20260923 Heap Out-of-Bounds Read via libfvde_encrypted_metadata_read_type_0x0024
- CVE-2026-116727 gbsplay through 0.0.103 Heap Out-of-Bounds Read via vgm_open in gbs.c
- CVE-2026-116726 gbsplay through 0.0.103 Heap Out-of-Bounds Read via gbr_open GBR Title
- CVE-2026-116725 gbsplay through 0.0.103 Out-of-Bounds Read via mapper_map ROM Bank Index
- CVE-2026-116724 FLTK through 1.4.5 Heap Buffer Overflow via Fl_BMP_Image Integer Overflow
- CVE-2026-116723 FLTK through 1.4.5 Stack Buffer Overflow via Fl_BMP_Image colors_used Field
- CVE-2026-11672 Memory corruption in Chrome
- CVE-2026-11671 Use after free in Chrome