Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 926 of 1013.
- CVE-2026-112008 libmng through 2.0.3 Heap Buffer Overflow via ORDR Chunk Reader mng_read_ordr
- CVE-2026-112007 Schism Tracker through 20260524 Heap Out-of-Bounds Write via ULT Loader
- CVE-2026-112006 OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 Improper Certificate Validation
- CVE-2026-112005 WhoDB 0.104.0 before 0.135.0 Arbitrary File Read/Write via DuckDB Query Editor
- CVE-2026-112004 Teable before 2026-10-12T12-45-53Z.3331 Authorization Bypass via Folder Rename Endpoint
- CVE-2026-112003 ProjectSend 2.0.0 before 2.7.0 Path Validation Bypass via Orphan File Import/Delete
- CVE-2026-112002 ProjectSend 2.5.0 before 2.7.0 Unverified Password Change via /settings/password
- CVE-2026-112001 ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token Abilities
- CVE-2026-112000 Vanus 0.8.0 through 0.9.0 Missing Authorization in Gateway Streaming RPCs
- CVE-2026-11200 Information disclosure in Chrome
- CVE-2026-1120 Yonyou KSOA HTTP GET Parameter del_work.jsp sql injection
- CVE-2026-111999 Vanus 0.8.0 through 0.9.0 Missing Authentication via Gateway CloudEvents HTTP Receiver
- CVE-2026-111998 Vanus 0.8.0 through 0.9.0 Default Admin Credentials via Gateway
- CVE-2026-111997 ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process
- CVE-2026-111993 Soarkey StudentManagement AdminDao.java UserDao.login cleartext storage
- CVE-2026-111992 itsmeravitejak Online-Examination-System Exam exam.php startExam sql injection
- CVE-2026-111991 WongKinYiu yolov9 ONNX Metadata common.py DetectMultiBackend.__init__ code injection
- CVE-2026-111990 kishan0725 Hospital Management System Appointment Cancellation admin-panel.php mysqli_query sql injection
- CVE-2026-11199 Information disclosure in Chrome
- CVE-2026-111988 dyad-sh dyad OAuth Callback cross-site request forgery
- CVE-2026-111987 Cross-site scripting in stable-diffusion-webui
- CVE-2026-111986 AUTOMATIC1111 stable-diffusion-webui Model Instantiation sd_models.py get_obj_from_str code injection
- CVE-2026-111985 Denial of service in stable-diffusion-webui
- CVE-2026-111984 AUTOMATIC1111 stable-diffusion-webui Card Builder ui_extra_networks.py create_item_html cross site scripting
- CVE-2026-111982 Profile Builder < 4.0.5 - Multisite Subsite Admin+ Network Super Admin Account Takeover via Edit Profile Email Change
- CVE-2026-111981 GiveWP < 4.19.0.1 - Authenticated Arbitrary Donor Address Modification via donor_manage_addresses
- CVE-2026-111980 GiveWP < 4.19.0.1 - Give Worker+ Arbitrary Page Modification via Campaign Page Capability Grant
- CVE-2026-11198 Security feature bypass in Chrome
- CVE-2026-111979 GiveWP < 4.19.0.1 - Give Worker+ Stored XSS via Form Template Primary Color
- CVE-2026-111978 GiveWP < 4.19.0.1 - Give Manager+ Path Traversal via Core Settings Import
- CVE-2026-111976 GiveWP < 4.19.0.1 - Unauthenticated Unpublished Donation Form Disclosure via Form View Route
- CVE-2026-111974 GiveWP < 4.19.0.1 - Unauthenticated Donation Amount Restriction Bypass via Currency
- CVE-2026-111972 Photo Engine < 6.5.8 - Author+ Arbitrary Attachment Deletion via IDOR
- CVE-2026-111971 Photo Engine < 6.5.8 - Author+ Stored XSS via Collection Name
- CVE-2026-11197 Security feature bypass in Chrome
- CVE-2026-111967 MP3 Audio Player by Sonaar 5.9 - 5.15 - Contributor+ Stored XSS via Shortcode Attribute
- CVE-2026-111966 Profile Builder < 4.0.5 - Contributor+ Stored XSS via redirect_url Shortcode Attribute
- CVE-2026-111965 Profile Builder 4.0.0 - 4.0.4 - Subscriber+ Comment reCAPTCHA Bypass
- CVE-2026-111961 Missing authorization in Royal MCP
- CVE-2026-111960 Royal MCP 1.4.38 - 1.5.9 - Subscriber+ Non-Public Post Disclosure via wp_search Ability
- CVE-2026-11196 Memory corruption in Chrome
- CVE-2026-111958 Royal MCP < 1.5.7 - Authentication Bypass via Preview Link Token
- CVE-2026-111957 SUMIT Payment Gateway for WooCommerce < 4.0.0 - Unauthenticated Payment Confirmation Forgery via Redirect Callback
- CVE-2026-111956 WholesaleX < 3.0.9 - Unauthenticated Imported User CSV Disclosure
- CVE-2026-111955 WholesaleX < 3.0.9 - Unauthenticated Account Activation and Administrator Approval Bypass
- CVE-2026-11195 Information disclosure in Chrome
- CVE-2026-111949 miniOrange 2FA 6.2.9 - 6.3.0 - 2FA Bypass via Passkey Second-Factor Rebinding
- CVE-2026-111948 Profile Builder < 4.0.1 - Reflected XSS via Unconfirmed Emails Row Actions
- CVE-2026-111947 Easy Pricing Tables < 4.1.3 - Contributor+ Arbitrary Post Clone and Publish via Legacy Table Duplication
- CVE-2026-111946 Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header
- CVE-2026-111943 Distrust compromised intermediate certificates in crypto/x509
- CVE-2026-111942 hrisikeshpal Blood_Bank_Management_System abs.php cross site scripting
- CVE-2026-11194 Information disclosure in Chrome
- CVE-2026-111939 Frappe Helpdesk before 1.26.0 Authorization Bypass via raised_by in Ticket Creation
- CVE-2026-111938 Frappe CRM before 1.74.0 Missing Authorization via add_note_to_call_log
- CVE-2026-111937 Frappe CRM before 1.81.2 Missing Authorization on CRM Notification Records
- CVE-2026-111936 Sigma File Manager through 2.2.0 SSRF via Extension Download Commands
- CVE-2026-111935 NoteGen through 0.38.3 Local File Disclosure via Chat Image Analysis
- CVE-2026-111934 Coder before 2.34.7 IP Spoofing via X-Forwarded-For Header
- CVE-2026-111933 Coder before 2.34.2 User Enumeration via Login Placeholder Hash
- CVE-2026-111932 Coder before 2.34.2 Stored HTML Injection via Appearance Settings
- CVE-2026-111931 Coder 2.0.0 before 2.34.8 Open Redirect via Workspace App Proxy
- CVE-2026-111930 Coder from 2.26.0 before 2.34.8 Information Disclosure via Workspace ACL Endpoint
- CVE-2026-11193 Security feature bypass in Chrome
- CVE-2026-111929 Coder 2.30.0 before 2.34.8 Cross-Organization File Disclosure via DownloadFile RPC
- CVE-2026-111928 Coder 2.0.0 before 2.34.8 Authorization Bypass via User-Level ACL in RBAC Policy
- CVE-2026-111927 Coder before 2.35.4 Credential Theft via Workspace Proxy Hostname Prefix Match
- CVE-2026-111926 Coder from 2.10.0 before 2.34.8 Information Disclosure via Agent /debug/manifest
- CVE-2026-111925 Mopidy before 4.0.5 Path Traversal via File Backend library.lookup
- CVE-2026-111924 Fleet before 4.83.0 Denial of Service via Unbounded Gzip Decompression
- CVE-2026-111923 Fleet before 4.89.0 Unauthenticated DoS via Apple MDM Enrollment Plist Parsing
- CVE-2026-111922 Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting Localhost Origins
- CVE-2026-111921 Vikunja 0.13.0 before 2.7.0 Incorrect Authorization in Link Share Deletion
- CVE-2026-111920 Vikunja 2.6.0 Broken Access Control via Inherited Project Permissions
- CVE-2026-11192 Other in Chrome
- CVE-2026-111919 Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via Webhooks
- CVE-2026-111918 Vikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Writes via Saved Filter Creation
- CVE-2026-111917 Vikunja 2.3.0 before 2.7.0 WebSocket Authentication Ignores Session Revocation
- CVE-2026-111916 Admidio before 5.0.16 Information Disclosure via rss/links.php Weblinks Feed
- CVE-2026-111915 Yank Note before 3.93.1 Path Traversal via /api/help Endpoint
- CVE-2026-111914 Admidio 5.0.11 before 5.0.16 Broken Access Control via inventory_data.php
- CVE-2026-111913 Admidio 5.0.0 before 5.0.16 Authorization Bypass via pdfl Mode in lists_show.php
- CVE-2026-111912 Admidio 5.0.0 before 5.0.16 IDOR via Forum Topic Update
- CVE-2026-111911 phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injection
- CVE-2026-111910 phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Authorization Bypass via attachment.php Downloads
- CVE-2026-11191 Memory corruption in Chrome
- CVE-2026-111909 phpMyFAQ before 4.1.9 Missing Authorization Allows Superadmin Deletion via deleteUser API
- CVE-2026-111908 phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta BOLA in FAQ Update via REST API
- CVE-2026-111907 phpMyFAQ 4.0.0 before 4.1.9 CSRF via /admin/api/update-database
- CVE-2026-111906 phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta CSRF in Elasticsearch/OpenSearch Admin API Index Operations
- CVE-2026-111905 phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta IDOR Leaks TOTP Secret via /admin/api/user/data
- CVE-2026-111904 phpMyFAQ 4.2.0-alpha before 4.2.0-beta Information Disclosure via open-questions API
- CVE-2026-111903 phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG DTD Entity Bypass
- CVE-2026-111902 phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass via Comments and Attachments API
- CVE-2026-111901 phpMyFAQ 4.2.0-alpha before 4.2.0-beta Unauthenticated DoS via API Pagination
- CVE-2026-111900 phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Draft FAQ Attachment Disclosure via attachment.php
- CVE-2026-11190 Security feature bypass in Chrome
- CVE-2026-1119 itsourcecode Society Management System delete_activity.php sql injection
- CVE-2026-111899 KitchenOwl through 0.7.10 SSRF via Recipe Import scrapeKitchenOwl Fetch
- CVE-2026-111898 phpMyFAQ 4.2.0-alpha before 4.2.0-beta Account Takeover via Keycloak Implicit Account Linking