Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 900 of 1013.
- CVE-2026-116531 HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunk.
- CVE-2026-11653 Security feature bypass in Chrome
- CVE-2026-11652 Use after free in Chrome
- CVE-2026-116516 Insufficient length validation when parsing Zoom chat transcriptions
- CVE-2026-116515 itsourcecode Online Book Store book.php sql injection
- CVE-2026-116514 itsourcecode Airline Reservation System book_flight.php cross site scripting
- CVE-2026-11651 Use after free in Chrome
- CVE-2026-116508 TOTOLINK A950RG Device-Information CGI infostat.cgi sub_402340 stack-based overflow
- CVE-2026-116507 TOTOLINK A950RG global.so getLanguageCfg information disclosure
- CVE-2026-116506 TOTOLINK A950RG firewall.so apmib_set command injection
- CVE-2026-116505 TOTOLINK A950RG device-information udhcpd.leases getDeviceInfo command injection
- CVE-2026-116504 TOTOLINK A950RG Cloud Upgrade upgrade.so setCloudUpgradeFW command injection
- CVE-2026-116502 turboderp-org ExLlamaV2 GPTQ Index q_matrix.cu make_sequential out-of-bounds write
- CVE-2026-11650 Use after free in Chrome
- CVE-2026-1165 Popup Box <= 6.1.1 - Cross-Site Request Forgery to Popup Status Change
- CVE-2026-116497 Gssproxy: gssproxy: null pointer dereference in gssx_init_sec_context crashes daemon
- CVE-2026-116492 Frappe CRM before 1.89.1 Missing Authorization via Phone Lookup API
- CVE-2026-11649 Use after free in Chrome
- CVE-2026-116489 Timescale pgvectorscale before 0.9.1 Type Confusion via Unqualified DiskANN Operator Classes
- CVE-2026-116488 NXP MCUXpresso SDK USB Middleware before 2.13.0 Heap Overflow via Host Class Drivers
- CVE-2026-116487 NXP MCUXpresso SDK USB Middleware before 2.13.0 RNDIS Out-of-Bounds Read
- CVE-2026-116486 Objenesis before 3.6 Type Confusion via Class Name Instantiator Cache
- CVE-2026-116485 danmu_api before 1.21.7 Authentication Bypass via Default Token in Env Endpoints
- CVE-2026-116482 subhajitkhan online-clinic-management-system patientregistration.php cross site scripting
- CVE-2026-11648 Use after free in Chrome
- CVE-2026-116479 a2aproject a2a-java JSON-RPC Error getMessage information exposure
- CVE-2026-116478 a2aproject a2a-go Push Notification agentexec.go CreateExecutor information exposure
- CVE-2026-116477 a2aproject a2a-dotnet Parser A2AJsonRpcProcessor.cs A2AJsonRpcProcessor.ProcessRequestAsync information exposure
- CVE-2026-116476 a2aproject a2a-dotnet TaskProjection TaskProjection.ApplyStatus race condition
- CVE-2026-116471 BKWLD Decoy Authorization Policy Policy.php privileges management
- CVE-2026-11647 Use after free in Chrome
- CVE-2026-116469 MISP Guard Case-Sensitive Policy Bypass Allows Unauthorized Feed Data Forwarding
- CVE-2026-116467 ggml-org llama.cpp Mirostat Sampler llama-sampler.cpp assertion
- CVE-2026-116463 FastStone Image Viewer Box-Average Downsampler FUN_0062d96c out-of-bounds
- CVE-2026-116461 Omega Solution Restro POS sale-invoice logic error
- CVE-2026-11646 Use after free in Chrome
- CVE-2026-11645 Google Chromium V8 Out-of-Bounds Read and Write
- CVE-2026-11644 Use after free in Chrome
- CVE-2026-11643 Use after free in Chrome
- CVE-2026-11642 Use after free in Chrome
- CVE-2026-11641 Use after free in Chrome
- CVE-2026-116409 WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-116408 WordPress Gallery PhotoBlocks plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-116406 WordPress Webba Booking plugin <= 6.5.4 - Broken Access Control vulnerability
- CVE-2026-116404 WordPress Redux Framework plugin <= 4.5.16 - Broken Access Control vulnerability
- CVE-2026-116403 WordPress Easy Digital Downloads plugin <= 3.7.1 - Race Condition vulnerability
- CVE-2026-116402 WordPress SureForms plugin <= 2.12.9 - Content Injection vulnerability
- CVE-2026-116400 WordPress Button Block plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-11640 Integer overflow in Chrome
- CVE-2026-1164 Easy Voice Mail <= 1.2.5 - Unauthenticated Stored Cross-Site Scripting via 'message'
- CVE-2026-116399 WordPress InstaWP Connect plugin <= 0.1.4.2 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-116398 WordPress Content Slider Block plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-116396 WordPress Amelia plugin <= 2.4.12 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-116395 WordPress LightBox Block plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-116394 WordPress WpEvently plugin <= 5.7.9 - Content Injection vulnerability
- CVE-2026-116393 WordPress Optima Express + MarketBoost IDX Plugin plugin <= 8.7.8 - Broken Access Control vulnerability
- CVE-2026-116392 WordPress Accordion plugin <= 2.3.25 - PHP Object Injection vulnerability
- CVE-2026-116391 WordPress GS Logo Slider plugin <= 3.8.9 - PHP Object Injection vulnerability
- CVE-2026-116390 WordPress Filter Everything — WordPress & WooCommerce Filters plugin <= 1.9.7 - PHP Object Injection vulnerability
- CVE-2026-11639 Use after free in Chrome
- CVE-2026-116389 WordPress Phoenix Media Rename plugin <= 3.13.5 - PHP Object Injection vulnerability
- CVE-2026-116388 WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability
- CVE-2026-116387 WordPress SureForms plugin <= 2.12.9 - Broken Access Control vulnerability
- CVE-2026-116385 Bdtask Garage 24 Garage Management Software Profile edit_profile cross site scripting
- CVE-2026-116384 Bdtask Garage 24 Garage Management Software Backend improper authorization
- CVE-2026-11638 Use after free in Chrome
- CVE-2026-116372 MISP mispguard: Feed responses with 2xx status codes other than 200 bypass filtering rules
- CVE-2026-116371 Akuvox Akubela HyPanel PS51 login improper authentication
- CVE-2026-116370 2K Games Sid Meier's Civilization VI Lua sandbox loadstring type confusion
- CVE-2026-11637 Use after free in Chrome
- CVE-2026-116369 Sunwood-ai-labs github-kanban-mcp-server issue-handlers.ts handleListIssues os command injection
- CVE-2026-116368 DeepSeek Harness Browser Auth browser-auth.ts improper authorization
- CVE-2026-116367 DeepSeek Harness sandbox.ts createContext
- CVE-2026-11636 Use after free in Chrome
- CVE-2026-11635 Use after free in Chrome
- CVE-2026-116340 Missing authorization in astron-agent
- CVE-2026-11634 Use after free in Chrome
- CVE-2026-116339 iFlytek astron-agent DDL Whitelist exec_ddl.py incomplete blacklist
- CVE-2026-11633 Use after free in Chrome
- CVE-2026-11632 Use after free in Chrome
- CVE-2026-11631 Use after free in Chrome
- CVE-2026-11630 Use after free in Chrome
- CVE-2026-1163 Insufficient Session Expiration in parisneo/lollms
- CVE-2026-11629 Use after free in Chrome
- CVE-2026-116285 HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies.
- CVE-2026-116284 Kameleo Local API user-info information disclosure
- CVE-2026-116283 Kameleo Local API profiles information disclosure
- CVE-2026-116282 Kameleo Cookie Controller w.cs CookieController.ListCookies information disclosure
- CVE-2026-116281 Kameleo Profile Controller t.cs ListProfiles information disclosure
- CVE-2026-116280 Kameleo Proxy Validation f.cs InternalController.TestProxy server-side request forgery
- CVE-2026-11628 Use after free in Chrome
- CVE-2026-116275 AllenAI AllenNLP Registrable Configuration Machinery registrable.py Registrable.resolve_class_name code injection
- CVE-2026-116274 JIZHICMS Front-end Order OrderController.php pay improper authorization
- CVE-2026-116273 MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustion.
- CVE-2026-116272 MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested comment.
- CVE-2026-116271 MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users r
- CVE-2026-116270 MIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated "=?" sequences in decode_mimewords
- CVE-2026-116269 MIME::Field::ParamVal versions before 5.521 for Perl turn an RFC 2231 filename with a hyphenated language tag into an empty recommended filename.
- CVE-2026-116268 MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parameters
- CVE-2026-116267 MIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented error messages from a truncated, deeply nested message.