Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 925 of 1013.
- CVE-2026-112103 f3-factory fatfree-core HTTP Client web.php _curl certificate validation
- CVE-2026-112102 AXA Group NLP.js Condition Expression Pipeline evaluator.js Evaluator.walkFunction code injection
- CVE-2026-112101 BlackBeltTechnology pi-agent-dashboard WebSocket Gateway origin validation
- CVE-2026-112100 DeepPavlov multitask_preprocessor.py MultiTaskPipelinePreprocessor.__init__ code injection
- CVE-2026-11210 Security feature bypass in Chrome
- CVE-2026-1121 Yonyou KSOA HTTP GET Parameter del_workplan.jsp sql injection
- CVE-2026-112098 DeepPavlov Config Reference Resolver params.py resolve code injection
- CVE-2026-112097 SourceCodester Inventory System Sales Management transactions_handler.php save_sale cross site scripting
- CVE-2026-112096 SourceCodester Inventory System Purchase Records transactions_handler.php save_purchase cross site scripting
- CVE-2026-112095 SourceCodester Inventory System Product Management products_handler.php save cross site scripting
- CVE-2026-112094 michaelrsweet mxml mxml-file.c mxml_load_data use after free
- CVE-2026-112093 subhajitkhan online-clinic-management-system feedback.php cross site scripting
- CVE-2026-112092 subhajitkhan online-clinic-management-system Doctor Registration doctorregistration.php echo cross site scripting
- CVE-2026-112091 Dav-ee dairy-management-system AJAX Endpoint checkfarmer.json.php information disclosure
- CVE-2026-112090 Dav-ee dairy-management-system pay.php mysqli_real_escape_string sql injection
- CVE-2026-11209 Information disclosure in Chrome
- CVE-2026-112089 Dav-ee dairy-management-system delete.php mysqli_query sql injection
- CVE-2026-112088 Dav-ee dairy-management-system add.php mysqli_query sql injection
- CVE-2026-112087 itsourcecode Online Cake Ordering System confirm.php sql injection
- CVE-2026-112086 ESPnet Inference Model inference_model.py build_model deserialization
- CVE-2026-112085 webpack-dev-server vulnerable to cross-origin WebSocket access via proxied upgrades
- CVE-2026-112083 sgl-project SGLang Weight Exporter weight_exporter.py WeightExporter.send_weights_to_remote_instance denial of service
- CVE-2026-112082 Denial of service in SGLang
- CVE-2026-112081 hankcs HanLP Model Config Loading reflection.py hanlp.load deserialization
- CVE-2026-112080 LlamaChinese Llama-Chinese Adapter Config chat_gradio_no_merge.py get_class_from_dynamic_module code injection
- CVE-2026-11208 Use after free in Chrome
- CVE-2026-112079 hankcs HanLP torch_util.py load_word2vec_as_vocab_tensor deserialization
- CVE-2026-112078 RVC-Project Retrieval-based-Voice-Conversion-WebUI webui.py change_info_ code injection
- CVE-2026-112077 radareorg radare2 HTTP Sandbox Policy rtr_http.inc.c r_core_cmd_str_pipe protection mechanism
- CVE-2026-112076 Server-side request forgery in MeTube
- CVE-2026-112075 unslothai unsloth sentence_transformer.py externally-controlled input to select classes or code
- CVE-2026-112074 Tencent ncnn Conversion API mat_pixel.cpp yuv420sp2rgb integer overflow
- CVE-2026-112073 Tencent ncnn MatMul matmul.cpp matmul_transb out-of-bounds
- CVE-2026-112071 Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)
- CVE-2026-112070 Broken Access Control in extension "Analytics" (analytics)
- CVE-2026-11207 Security feature bypass in Chrome
- CVE-2026-112069 Broken Access Control in extension "FAL Protect" (fal_protect)
- CVE-2026-112068 Insecure Direct Object Reference in extension "Analytics" (analytics)
- CVE-2026-112067 Captcha Bypass in extension "Accessible Form Captcha" (bw_captcha)
- CVE-2026-112066 Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)
- CVE-2026-112065 Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)
- CVE-2026-112064 SQL Injection in extension "sgalinski Cookie Consent" (sg_cookie_optin)
- CVE-2026-112063 libstrophe through 0.14.0 Stack-Based Buffer Overflow via SCRAM Salt in SCRAM_Hi
- CVE-2026-112062 lwIP through 2.2.1 Stack Out-of-Bounds Write via mDNS Search Response Handler
- CVE-2026-112061 librtmp (RTMPDump) through 2.6 Heap Out-of-Bounds Read via AMFProp_Decode
- CVE-2026-112060 librtmp (RTMPDump) through 2.6 Heap Out-of-Bounds Write via AMF3_Decode
- CVE-2026-11206 Security feature bypass in Chrome
- CVE-2026-112059 libLAS through 1.8.1 Heap Out-of-Bounds Write via LASSchema VLR
- CVE-2026-112058 libdvdnav through 7.0.0 Out-of-Bounds Read via set_PTT JumpTT
- CVE-2026-112057 libdvdnav before 7.0.0 Out-of-Bounds Read in dvdnav_describe_title_chapters
- CVE-2026-112056 wvWare wv through 1.2.9 Heap Out-of-Bounds Read via wvGetSTSH
- CVE-2026-112055 wvWare wv through 1.2.9 Stack Out-of-Bounds Read via wvGetPAPX_FKP and wvGetCHPX_FKP
- CVE-2026-112054 Schroedinger libschroedinger through 1.0.11 Divide by Zero in Low-Delay Transform Parsing
- CVE-2026-112053 Schroedinger libschroedinger through 1.0.11 Out-of-Bounds Read via schro_params_set_default_quant_matrix
- CVE-2026-112052 libspatialite through 5.1.0 Integer Overflow in WKB Geometry Parsing
- CVE-2026-112051 Xinference through 4.0.1 Path Traversal via model_name in Custom Model Registration
- CVE-2026-112050 Gitify before 7.10.0 Login CSRF via Missing OAuth State Validation
- CVE-2026-11205 Cross-site scripting in Chrome
- CVE-2026-112049 Vita3K before build 4187 Path Traversal via VPK Package Installation
- CVE-2026-112048 libspatialite through 5.1.0 Uncontrolled Memory Allocation via ParseWkbPolygon Ring Count
- CVE-2026-112047 OneUptime 14.0.2 before 14.0.69 Incorrect Authorization in Kubernetes AI Actions
- CVE-2026-112046 OW2 ASM 9.11 before 9.11.1 Denial of Service via Infinite Loop in Label.resolve()
- CVE-2026-112045 donetick History Deletion model.go CanDeleteHistory improper authorization
- CVE-2026-112044 dotnet eShop Catalog API Extensions.cs AddApplicationServices improper authentication
- CVE-2026-112043 calcom cal.com/cal.diy Webhook util.ts createWebhookProcedure authorization
- CVE-2026-112042 diem-project diem dmWidget dmBaseLinkTag.php text cross site scripting
- CVE-2026-112041 diem-project diem dmString.php random weak prng
- CVE-2026-112040 diem-project diem Sign-In BasedmUserActions.class.php redirect
- CVE-2026-11204 Security feature bypass in Chrome
- CVE-2026-112039 diem-project diem Administrative Console actions.class.php append cross site scripting
- CVE-2026-112038 diem-project diem Version Check Service dmAdminCtrl.js html cross site scripting
- CVE-2026-112037 diem-project diem Google Analytics Client gapi.class.php certificate validation
- CVE-2026-112036 Artifex MuPDF Signature Locking pdf-xref.c free_char_list double free
- CVE-2026-112035 aircheng-org iWebShop-5 simple.php send_message_mobile password recovery
- CVE-2026-112034 aircheng-org iWebShop-5 Login Redirect _userInfo.php redirect
- CVE-2026-112033 aircheng-org iWebShop-5 Password Change system.php admin_repwd_act cross-site request forgery
- CVE-2026-112032 aircheng-org iWebShop-5 util.php search sql injection
- CVE-2026-112031 Chamilo LMS Ticket TicketManager.php addProject cross site scripting
- CVE-2026-112030 diem-project diem dmDataLoad.php default password
- CVE-2026-11203 Information disclosure in Chrome
- CVE-2026-112029 diem-project diem SHA1 PluginDmUser.class.php weak password hash
- CVE-2026-112028 light0011 cms Vote VoteController.class.php logic error
- CVE-2026-112027 light0011 cms Uploadify check-exists.php file_exists file information disclosure
- CVE-2026-112026 light0011 cms UserModel.class.php sha1 weak password hash
- CVE-2026-112025 light0011 cms Captcha Validation UserController.class.php access control
- CVE-2026-112021 snac2 before 2.93 Heap-Based Buffer Overflow via JSON Parser _xs_json_load_lexer()
- CVE-2026-112020 LodePNG through 20261006 Heap Out-of-Bounds Read via getFilterTypesInterlaced()
- CVE-2026-11202 Security feature bypass in Chrome
- CVE-2026-112019 cgltf through 1.15 Heap Out-of-Bounds Read via cgltf_accessor_unpack_floats()
- CVE-2026-112018 cgltf through 1.15 Heap Out-of-Bounds Write via cgltf_accessor_unpack_floats()
- CVE-2026-112017 JeecgBoot before 3.9.5 SQL Injection via SqlInjectionUtil Newline Bypass
- CVE-2026-112016 Netcore NR256CN through 1.5.140116 Unauthenticated Write to Fixed Boa Staging Files
- CVE-2026-112015 Omnigent 0.3.0 before 0.14.0 Path Traversal via Sub-Agent os_env.cwd
- CVE-2026-112014 LobsterAI before 2026.10.16 Hardcoded Password in Provider API Key Export
- CVE-2026-112013 libtta through 2.3 Divide by Zero via tta_decoder_init_get_info
- CVE-2026-112012 libtta through 2.3 Stack Out-of-Bounds Write via Zero Channel Count
- CVE-2026-112011 libtta through 2.3 Integer Overflow via tta_decoder_init_get_info Seek Table
- CVE-2026-112010 smpeg through 2.0.0 Integer Underflow via stream_header in MPEGsystem.cpp
- CVE-2026-11201 Use after free in Chrome
- CVE-2026-112009 smpeg through 2.0.0 Heap Out-of-Bounds Read via MPEGsystem::FillBuffer