Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 919 of 1013.
- CVE-2026-112955 ApostropheCMS: Import archives can exhaust server storage and deny service
- CVE-2026-112954 ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API
- CVE-2026-112953 ApostropheCMS: Exposure of Sensitive Information via predictable export filenames
- CVE-2026-112952 ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user
- CVE-2026-112951 ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix
- CVE-2026-112950 Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix
- CVE-2026-11295 Privilege escalation in Chrome
- CVE-2026-112949 Vitest: Code injection via unauthenticated manual mock registration
- CVE-2026-112948 Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file
- CVE-2026-112947 Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`
- CVE-2026-112946 Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine
- CVE-2026-112945 Vite: Cross origin script execution through Vite custom middleware
- CVE-2026-112944 launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors
- CVE-2026-112943 launch-editor: escapeCmdArgs() omits % escaping on Windows
- CVE-2026-112942 launch-editor: `fs.existsSync()` existence check can be bypassed on Windows
- CVE-2026-112941 filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock
- CVE-2026-112940 filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files
- CVE-2026-11294 Other in Chrome
- CVE-2026-112939 filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker
- CVE-2026-112937 filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name
- CVE-2026-112936 filelock: ReadWriteLock follows a symlink at the lock path into SQLite
- CVE-2026-112935 filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders
- CVE-2026-112934 filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record
- CVE-2026-11293 Use after free in Chrome
- CVE-2026-112921 Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over from a previous request.
- CVE-2026-11292 Security feature bypass in Chrome
- CVE-2026-112915 filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout
- CVE-2026-112914 filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory
- CVE-2026-112912 filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker
- CVE-2026-112911 filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion
- CVE-2026-11291 Security feature bypass in Chrome
- CVE-2026-112909 filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path
- CVE-2026-112906 filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse
- CVE-2026-112904 Vvveb: Path Traversal in nextRestore() and nextBackup()
- CVE-2026-112901 Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes
- CVE-2026-112900 Pillow: Argument Injection in Ghostscript call, potentially leading into RCE
- CVE-2026-11290 Integer overflow in Chrome
- CVE-2026-1129 Yonyou KSOA HTTP GET Parameter worksadd.jsp sql injection
- CVE-2026-112898 Pillow: Image.quantize() with empty palette leaks uninitialized stack memory
- CVE-2026-112897 Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips
- CVE-2026-112896 Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read
- CVE-2026-112895 Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)
- CVE-2026-112894 Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)
- CVE-2026-112893 Pillow: Invalid free in FreeType glyph rendering when a stroker is active
- CVE-2026-112892 Pillow: MSP RLE decoder expands a tiny file into unbounded memory
- CVE-2026-112891 Pillow: Quadratic GIF comment copying during save
- CVE-2026-11289 Information disclosure in Chrome
- CVE-2026-112880 CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney
- CVE-2026-11288 Security feature bypass in Chrome
- CVE-2026-11287 Security feature bypass in Chrome
- CVE-2026-112869 WordPress We’re Open! plugin <= 2.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-112868 WordPress H5P plugin <= 1.17.9 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-112867 WordPress H5P plugin <= 1.17.9 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-112866 WordPress Product Filter by WBW plugin <= 3.4.6 - SQL Injection vulnerability
- CVE-2026-112865 WordPress Royal Elementor Addons plugin <= 1.7.1069 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-112863 WordPress KALLYAS theme <= 4.25.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-112862 WordPress Participants Database plugin <= 2.7.8.5 - PHP Object Injection vulnerability
- CVE-2026-112861 WordPress Participants Database plugin <= 2.7.8.5 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-112860 WordPress Participants Database plugin <= 2.7.8.5 - SQL Injection vulnerability
- CVE-2026-11286 Other in Chrome
- CVE-2026-112859 WordPress Little Birdies theme <= 1.3.16 - PHP Object Injection vulnerability
- CVE-2026-112858 WordPress Rhodos theme <= 1.3.3 - PHP Object Injection vulnerability
- CVE-2026-112857 WordPress Reprizo theme <= 1.0.8 - PHP Object Injection vulnerability
- CVE-2026-112856 WordPress Vagabonds theme <= 1.3.10 - PHP Object Injection vulnerability
- CVE-2026-112855 WordPress Redy theme <= 1.3.5 - PHP Object Injection vulnerability
- CVE-2026-112854 WordPress Holistic Center theme <= 1.2.6 - PHP Object Injection vulnerability
- CVE-2026-112853 WordPress Hallelujah theme <= 1.1.1 - PHP Object Injection vulnerability
- CVE-2026-112852 WordPress Helion theme <= 1.1.12 - PHP Object Injection vulnerability
- CVE-2026-112851 WordPress HotLock theme <= 1.3.9 - PHP Object Injection vulnerability
- CVE-2026-112850 WordPress Your Dress theme <= 1.4.1 - Local File Inclusion vulnerability
- CVE-2026-11285 Other in Chrome
- CVE-2026-112849 WordPress Hostme v2 theme <= 7.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-112848 WordPress Hostme v2 theme <= 7.0 - PHP Object Injection vulnerability
- CVE-2026-112847 WordPress ZenSoul theme <= 1.13 - PHP Object Injection vulnerability
- CVE-2026-112846 WordPress Save Life theme <= 1.2.14 - PHP Object Injection vulnerability
- CVE-2026-112845 WordPress Off-Canvas Sidebars & Menus (Slidebars) plugin <= 0.5.9 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-112844 WordPress WP Event Solution plugin <= 4.1.26 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-112843 WordPress Strong Testimonials plugin <= 3.3.14 - Broken Access Control vulnerability
- CVE-2026-112842 WordPress Paid Member Subscriptions plugin <= 3.1.2 - Broken Access Control vulnerability
- CVE-2026-112840 WordPress SureCart plugin <= 4.9.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-11284 Information disclosure in Chrome
- CVE-2026-112839 WordPress Customer Coupons for WooCommerce plugin <= 1.3.14 - Broken Access Control vulnerability
- CVE-2026-112838 WordPress VikRentCar plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-112837 WordPress GamiPress plugin <= 8.0.7 - SQL Injection vulnerability
- CVE-2026-112836 WordPress VikRentCar plugin <= 1.4.8 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-112835 WordPress VikRentCar plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-112834 WordPress Seriously Simple Podcasting plugin <= 3.17.0 - Broken Access Control vulnerability
- CVE-2026-112833 WordPress Seriously Simple Podcasting plugin <= 3.17.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-112832 WordPress Rootblox plugin <= 1.0.6 - Local File Inclusion vulnerability
- CVE-2026-11283 Security feature bypass in Chrome
- CVE-2026-112829 WordPress Booktics plugin <= 1.0.30 - Broken Access Control vulnerability
- CVE-2026-112828 WordPress AI Engine plugin <= 3.8.6 - Broken Access Control vulnerability
- CVE-2026-112827 WordPress HANDMADE – Dropshipping for Etsy and WooCommerce plugin <= 1.0.10 - Broken Access Control vulnerability
- CVE-2026-112826 WordPress Falcon – WordPress Optimizations & Tweaks plugin <= 2.12.0 - Broken Access Control vulnerability
- CVE-2026-112825 WordPress Car Rental Manager plugin <= 1.5.3 - Broken Access Control vulnerability
- CVE-2026-112824 WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.9.7 - Broken Access Control vulnerability
- CVE-2026-112823 WordPress WP User Manager plugin <= 2.9.25 - Broken Access Control vulnerability
- CVE-2026-112822 WordPress Workreap Core plugin < 3.4.4 - SQL Injection vulnerability
- CVE-2026-112821 WordPress Knit Pay plugin <= 9.6.3.0 - Broken Access Control vulnerability
- CVE-2026-112820 WordPress Academist Core plugin <= 1.4.1 - Local File Inclusion vulnerability