Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 912 of 1013.
- CVE-2026-113949 Memory corruption in Safari
- CVE-2026-113948 Security feature bypass in macOS
- CVE-2026-113947 Privilege escalation in macOS
- CVE-2026-113946 Memory corruption in macOS
- CVE-2026-113945 Memory corruption in macOS
- CVE-2026-113944 Memory corruption in macOS
- CVE-2026-113943 Memory corruption in macOS
- CVE-2026-113942 Memory corruption in macOS
- CVE-2026-113941 Memory corruption in macOS
- CVE-2026-113940 Memory corruption in macOS
- CVE-2026-113939 Memory corruption in macOS
- CVE-2026-113938 Memory corruption in macOS
- CVE-2026-113937 Memory corruption in macOS
- CVE-2026-113936 Memory corruption in macOS
- CVE-2026-113935 Memory corruption in macOS
- CVE-2026-113934 Memory corruption in macOS
- CVE-2026-11393 Code injection via improper triple-quote escaping in AgentCore CLI Bedrock Agent import
- CVE-2026-11392 WP Hotel Booking <= 2.3.1 - Reflected Cross-Site Scripting via 'check_in_date' and 'check_out_date' Parameters
- CVE-2026-113915 Race condition in iOS and iPadOS
- CVE-2026-113914 Missing authorization in iOS and iPadOS
- CVE-2026-113913 Information disclosure in iOS and iPadOS
- CVE-2026-113912 Memory corruption in iOS and iPadOS
- CVE-2026-113910 Information disclosure in iOS and iPadOS
- CVE-2026-11391 Tanium addressed a SQL injection vulnerability in Patch.
- CVE-2026-113909 Memory corruption in iOS and iPadOS
- CVE-2026-113908 Information disclosure in iOS and iPadOS
- CVE-2026-113907 Memory corruption in iOS and iPadOS
- CVE-2026-113906 Null dereference in iOS and iPadOS
- CVE-2026-113904 Use after free in Safari
- CVE-2026-113903 Use after free in Safari
- CVE-2026-113901 Use after free in Safari
- CVE-2026-113900 Race condition in macOS
- CVE-2026-11390 Cross-site scripting in News Kit Addons For Elementor
- CVE-2026-1139 UTT 进取 520W ConfigExceptMSN strcpy buffer overflow
- CVE-2026-113899 Denial of service in macOS
- CVE-2026-113898 Security feature bypass in iOS and iPadOS
- CVE-2026-113897 Security feature bypass in Safari
- CVE-2026-113896 Race condition in iOS and iPadOS
- CVE-2026-11389 Memory corruption in Connext Professional
- CVE-2026-113881 Fireware OS Stack Buffer Overflow in VPN Network Access Enforcement Allows Unprivileged Code Execution
- CVE-2026-11388 Double Free vulnerability in RTI Connext Professional (Core Libraries) allows File Manipulation.
- CVE-2026-113877 HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions.
- CVE-2026-113876 SmileCDR HAPI FHIR unauthorized read
- CVE-2026-113875 SmileCDR HAPI FHIR unauthorized read via subscription
- CVE-2026-113874 SmileCDR HAPI FHIR trusted tenant partition override
- CVE-2026-113873 SmileCDR HAPI FHIR improper data decompression
- CVE-2026-113872 multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown
- CVE-2026-113870 Improper Encoding of Server-Supplied JavaScript Values in MongoDB Compass BSON Parsing
- CVE-2026-11387 SMS Alert <= 3.9.5 - Unauthenticated Privilege Escalation via Arbitrary Password Reset
- CVE-2026-113869 Use-after-free in S/MIME decryption during a security device password prompt
- CVE-2026-113868 Uninitialized memory disclosure and out-of-bounds read in POP3 and SMTP NTLM authentication
- CVE-2026-113867 Stanza injection in XMPP chat
- CVE-2026-113866 Account password sent unencrypted during Exchange account setup
- CVE-2026-11386 ubuntu-pro-client Input Validation Vulnerability Leading to Arbitrary APT Directive Injection and Remote Code Execution
- CVE-2026-11383 Cross-site Scripting in IBM WebSphere Application Server shipped with Tivoli System Automation Application Manager
- CVE-2026-113813 PayPlug for WooCommerce 2.8.0 - 3.1.0 - Unauthenticated Arbitrary Order Deletion, Modification and Disclosure
- CVE-2026-113812 Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates.
- CVE-2026-113811 Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory exhaustion via a never-cleared failure shift cache in search.
- CVE-2026-113810 Stored XSS on SNS Enrollment Portal
- CVE-2026-11381 IBM MQ for HPE NonStop is vulnerable to a denial of service issue
- CVE-2026-113808 Stored XSS on SNS Enrollment Portal
- CVE-2026-113802 Wavlink WL-WN530BE1-A Unauthenticated OS Command Injection in ioos protocol.csp ovpn_file Handler
- CVE-2026-113800 Electron: HID and USB permission checks can be attributed to the wrong origin
- CVE-2026-11380 Cross-site scripting in JetWidgets For Elementor
- CVE-2026-1138 UTT 进取 520W ConfigExceptQQ strcpy buffer overflow
- CVE-2026-113799 Slack Morphism verifier errors disclose valid HMACs in the logs
- CVE-2026-113798 Electron: Pointer lock permission requests can be attributed to the wrong frame
- CVE-2026-113797 Electron: Extension tabs.query returns tab URLs and titles without the tabs permission
- CVE-2026-113796 Electron: SameSite cookie restrictions are not applied to windows opened from links
- CVE-2026-113795 pypdf: Possible large memory usage for streams with multiple filters
- CVE-2026-113794 pypdf: Possible infinite loop when hitting EOF in standard xref table
- CVE-2026-113793 pypdf: Possible infinite loop when removing tree items
- CVE-2026-113792 pypdf: Possible infinite loop in PdfWriter.find_outline_item
- CVE-2026-113791 pypdf: Possible large memory usage when parsing content streams
- CVE-2026-113790 pypdf: Possible large memory usage when parsing arrays and dictionaries
- CVE-2026-11379 Incorrect Authorization in GitLab
- CVE-2026-113789 pypdf: Possible long runtimes/large memory usage when retrieving form fields
- CVE-2026-113788 Lagoon core ssh service vulnerable to remote code execution
- CVE-2026-113787 odf-kit: HTML injection leading to XSS in odtToHtml() via unescaped style attribute values
- CVE-2026-113786 pypdf: Unvalidated JPEG image data loading
- CVE-2026-11378 IBM MQ queue manager is vulnerable to remote code execution
- CVE-2026-113779 pfSense REST API package Vulnerable to Privilege Escalation via Scoped HA Settings Sync Permission
- CVE-2026-113776 virtualenv activation scripts run code from a path that contains a placeholder name
- CVE-2026-113775 Dynamic Library Loading Process Control in Autodesk Fusion Desktop
- CVE-2026-11375 IBM MQ queue manager is vulnerable to remote code execution
- CVE-2026-113744 Tenda AC19 httpd Web Management Service SetFirewallCfg formSetFirewallCfg stack-based overflow
- CVE-2026-113743 Tenstorrent tt-metal load_checkpoints.py load_hf_state_dict_filtered path traversal
- CVE-2026-113741 itsourcecode Online Cake Ordering System 404.php cross site scripting
- CVE-2026-113740 itsourcecode Online Cake Ordering System deletecustomer.php sql injection
- CVE-2026-11374 Account Takeover via Predictable SSO Ticket Generation
- CVE-2026-113738 R6410418 Jackrong-llm-finetuning-guide MTP weight_map qwen_mtp_gguf_pipeline.py extract_mtp_heads path traversal
- CVE-2026-113737 R6410418 Jackrong-llm-finetuning-guide qwen_mtp_gguf_pipeline.py validate_indexed_tensors path traversal
- CVE-2026-113736 D-Link DHP-W610AV HNAP Login defaultvalue.xml login_prepare_hnap empty password
- CVE-2026-113735 D-Link DCS-6501LH aoni_ipc mydlink_set_root_pwd weak credentials
- CVE-2026-113732 virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote
- CVE-2026-113731 djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool
- CVE-2026-113730 OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies
- CVE-2026-11373 Net::Statsite::Client versions through 1.1.0 for Perl allow metric injections
- CVE-2026-113729 Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization
- CVE-2026-113728 Bulwark Webmail: DNS-rebinding SSRF in public iCalendar fetch endpoint