Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 924 of 1013.
- CVE-2026-112271 libdisplay-info through 0.4.0 Heap Out-of-Bounds Read via DisplayID v1 Parser
- CVE-2026-112270 SGLang through 0.5.22 Memory Exhaustion via Mooncake STAGING_RSP chunk_idx
- CVE-2026-11227 Other in Chrome
- CVE-2026-112269 SGLang through 0.5.22 Memory Exhaustion via Unauthenticated Mooncake Decode Registrations
- CVE-2026-112268 sglang-router through 0.3.2 Authorization Bypass via Mesh HA Management Routes
- CVE-2026-112267 SGLang through 0.5.22 SSRF via bootstrap_host and bootstrap_port on Decode Worker
- CVE-2026-112266 SGLang through 0.5.22 Cross-Request Abort via rid Prefix Matching
- CVE-2026-112265 LangBot through 4.11.0 Missing Lark/Feishu Webhook Authenticity Verification
- CVE-2026-112264 BentoML through 1.4.39 Dockerfile Instruction Injection via docker.env Keys
- CVE-2026-112263 Television 0.15.0 through 0.15.9 OS Command Injection via External Action Formatting
- CVE-2026-112262 RisingWave before 3.1.0 Missing Authorization via posix_fs and fs Connectors
- CVE-2026-112261 Gimp: gimp: use-after-free in xcf loader via prop_selected_path
- CVE-2026-112260 Gimp: gimp: heap out-of-bounds read in xcf text-layer parasite parsing
- CVE-2026-11226 Security feature bypass in Chrome
- CVE-2026-112259 Gimp: gimp: null pointer dereference in swatchbooker (sbz) palette import
- CVE-2026-112258 Gimp: gimp: use-after-free in xcf loader via prop_linked and prop_selection on channels
- CVE-2026-112257 Gimp: gimp: heap out-of-bounds read/write in psd thumbnail loader (load_resource_1033)
- CVE-2026-112256 Logon bypass (trust of attacker-controlled completed-methods list)
- CVE-2026-112255 Endpoint credential minting (insecure default allow-list)
- CVE-2026-112254 agit8or1 clientst0r Property URL Importer property_url_importer.py _fetch_html server-side request forgery
- CVE-2026-112252 SQL injection in Wubang Five-in-One Safety Production Management Information System
- CVE-2026-112251 antoinersx clawhost Reverse Proxy reverseProxy.ts handleRequest redirect
- CVE-2026-112250 Cleartext Storage of Windows Service Account Password in BRAIN2 Setup Log Files
- CVE-2026-11225 Other in Chrome
- CVE-2026-112249 grandnode grandnode2 Product Description Product.Layout.Simple.cshtml Html.Raw cross site scripting
- CVE-2026-112248 grandnode grandnode2 Excel Import ProductImportDataObject.PrepareProductPictures path traversal
- CVE-2026-112247 Cross-site scripting in Five-in-One Safety Production Management Information System
- CVE-2026-112242 WordPress Profile Builder plugin <= 4.0.4 - Privilege Escalation vulnerability
- CVE-2026-112241 WordPress SureCart plugin <= 4.9.5 - Broken Authentication vulnerability
- CVE-2026-112240 Broken Access Control in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)
- CVE-2026-11224 Use after free in Chrome
- CVE-2026-112239 Broken Access Control in extension "TYPO3 AI Integration Extension" (ns_t3ai)
- CVE-2026-112238 SQL Injection in extension "File manager" (ameos_filemanager)
- CVE-2026-112237 Server-Side Request Forgery in extension "Kitodo.Presentation" (dlf)
- CVE-2026-112230 Popup Builder < 4.4.6 - Unauthenticated Popup Trashing via post_type Parameter
- CVE-2026-11223 Security feature bypass in Chrome
- CVE-2026-112222 WordPress Surfer plugin <= 1.8.0.744 - Broken Access Control vulnerability
- CVE-2026-112221 WordPress SureCart plugin <= 4.9.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-11222 Other in Chrome
- CVE-2026-112219 Download Monitor < 5.3.5 - Multisite Subsite Admin+ Incorrect Authorization via Approved Download Paths REST Route
- CVE-2026-112218 WordPress Majestic Support plugin <= 1.2.1 - Broken Access Control vulnerability
- CVE-2026-112214 Gstreamer1-plugins-ugly-free: gstreamer1-plugins-ugly-free: unbounded memory allocation in asfdemux simple index parser
- CVE-2026-112212 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in GitLab
- CVE-2026-112210 Rhc: rhc: local privilege escalation via symlink following in rhc-canonical-facts.service
- CVE-2026-11221 Other in Chrome
- CVE-2026-112207 Download Monitor < 5.3.4 - Reflected XSS via Cross-Origin Download Link
- CVE-2026-112202 Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images
- CVE-2026-112200 Resource exhaustion from unreleased AR and RPC session on RPC requests with incorrect endianness
- CVE-2026-11220 Security feature bypass in Chrome
- CVE-2026-1122 Yonyou KSOA HTTP GET Parameter work_info.jsp sql injection
- CVE-2026-112199 WordPress YITH WooCommerce Wishlist plugin <= 4.18.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-112198 Improper Restriction of XML External Entity Reference in Tactis' NoviGest Desktop App
- CVE-2026-112197 Missing Authentication for Critical Function in Tactis' NoviGest Desktop App
- CVE-2026-112195 FusionPBX Dialplan Editor dialplan.php os command injection
- CVE-2026-112193 Webkul Aureus ERP UserForm.php weak password
- CVE-2026-112192 MISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only Settings
- CVE-2026-112190 Webkul Aureus ERP composer.json insertion of sensitive information into debugging code
- CVE-2026-11219 Security feature bypass in Chrome
- CVE-2026-112188 MISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name Resolution
- CVE-2026-112184 MISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form Labels
- CVE-2026-112183 MISP CSS Injection via Remote Tag Colour in Event Preview
- CVE-2026-112180 MISP Incomplete Event Deletion Leaves Orphaned Sensitive Records
- CVE-2026-11218 Code injection in Chrome
- CVE-2026-112179 MISP Event Synchronization Exposes Non-Exportable Tags on Remote Instances
- CVE-2026-112178 MISP Proposal ACL Bypass: Incomplete Distribution Level Check in Shadow Attribute Access Control
- CVE-2026-112177 Ghostscript: reintroduction of .charkeys -dsafer bypass in rhel 8
- CVE-2026-11217 Security feature bypass in Chrome
- CVE-2026-112161 Lack of integrity checks in Mobatek’s MobaXterm
- CVE-2026-11216 Other in Chrome
- CVE-2026-112159 JumpServer Template Rendering os command injection
- CVE-2026-112158 MikroTik RouterOS ipt_SAME.ko same_check integer overflow
- CVE-2026-112157 MemTensor memmy-agent Memory Service http.ts requireAdminWrite resource consumption
- CVE-2026-112153 vraj404 Criminal-Management-System Officer Registration Form addOfficer.php mysqli_error sql injection
- CVE-2026-112152 vraj404 Criminal-Management-System Search searchOff.php mysqli_query sql injection
- CVE-2026-112151 vraj404 Criminal Management System Submission Form home.php sql injection
- CVE-2026-112150 vraj404 Criminal-Management-System search.php sql injection
- CVE-2026-11215 Other in Chrome
- CVE-2026-112149 vraj404 Criminal-Management-System home.php move_uploaded_file unrestricted upload
- CVE-2026-112148 Cross-site scripting in LIFF SDK
- CVE-2026-112147 ai-genius-automations octoally index.ts information disclosure
- CVE-2026-112146 D-Link E15/M32/R15/R32 MQTT Broker passwd hard-coded credentials
- CVE-2026-112145 Code injection in speaches
- CVE-2026-112144 satya-vinay Events-Management-System project.sql file access
- CVE-2026-112143 satya-vinay Events-Management-System missing authentication
- CVE-2026-112142 satya-vinay Events-Management-System Registration-Delete dodelete.php sql injection
- CVE-2026-112141 satya-vinay Events-Management-System Registration-Edit doedit.php mysqli_query sql injection
- CVE-2026-112140 llSourcell Doctor-Dignity chat_module.py _get_lib_module code injection
- CVE-2026-11214 Information disclosure in Chrome
- CVE-2026-112139 subhajitkhan online-clinic-management-system Administrative Mutation admindocview.php sql injection
- CVE-2026-112138 diem-project diem dmCodeEditor actions.class.php join path traversal
- CVE-2026-11213 Security feature bypass in Chrome
- CVE-2026-11212 Security feature bypass in Chrome
- CVE-2026-112112 Security feature bypass in BIRD
- CVE-2026-112111 Cross-site scripting in Bootstrap Shortcodes
- CVE-2026-11211 Integer overflow in Chrome
- CVE-2026-112108 ztxz16 fastllm String Parsing gguf.cpp ReadString buffer overflow
- CVE-2026-112107 ztxz16 fastllm Safetensors Weight Loading model.cpp CreateBuffer buffer overflow
- CVE-2026-112106 TufayelLUS TikTok-Video-Downloader-PHP TLS index.php certificate validation
- CVE-2026-112105 GlitterWare Passy TLS main.dart MyHttpOverrides certificate validation
- CVE-2026-112104 eremef bandcamp-player Remote Control Server database.ts missing authentication