Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 928 of 1013.
- CVE-2026-111756 follow-redirects array-form headers bypass cross-origin credential stripping
- CVE-2026-111755 follow-redirects sensitiveHeaders regex escaping can expose credential headers
- CVE-2026-111750 AIOHTTP: Pure-Python parser request smuggling
- CVE-2026-11175 Other in Chrome
- CVE-2026-111749 AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies
- CVE-2026-111748 AIOHTTP: Absolute-form request targets can spoof Request.scheme
- CVE-2026-11174 Security feature bypass in Chrome
- CVE-2026-111739 Auth bypass in All-In-One Security (AIOS)
- CVE-2026-111738 Speed Optimizer < 7.8.5 - Admin+ Network Option Update via enable-option/disable-option
- CVE-2026-111737 Speed Optimizer < 7.8.5 - Admin+ Stored XSS via DNS Prefetch and Font Preload URL Lists
- CVE-2026-111736 NULL pointer dereference on implicit read of user specific record index
- CVE-2026-111735 Integer underflow leads to out-of-bounds read in pf_cpm_c_data_ind()
- CVE-2026-111734 Missing length validation of EtherType, VLAN and FrameID fields in pf_eth_recv()
- CVE-2026-111733 NULL pointer dereference on implicit read of AR specific record index
- CVE-2026-111732 Out-of-bounds write when parsing AR Vendor Block requests
- CVE-2026-111731 Infinite loop when reading PDPortDataCheck record of subslot 0
- CVE-2026-111730 Out-of-bounds write in CheckPeers block parser due to unvalidated peer station name length
- CVE-2026-11173 Memory corruption in Chrome
- CVE-2026-111728 Seanime v3.10.3 Argument Injection via TranscodeHwAccelCustomSettings
- CVE-2026-111727 Cross-site scripting in Appointment Booking Calendar
- CVE-2026-111726 Themify Builder <= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'visible' Shortcode Attribute
- CVE-2026-111723 LingGuo-Drama through commit 8a6924a Broken Access Control via /admin/v1/admins API
- CVE-2026-111722 LingGuo-Drama through commit 8a6924a IDOR via /admin/v1/projects/:id API
- CVE-2026-111721 Open WES through 1.0.0 Broken Access Control via GlobalGatewayFilter Warehouse Scoping
- CVE-2026-111720 fish-island-backend through commit 7c61b78 SSRF via /api/web/parse
- CVE-2026-11172 Other in Chrome
- CVE-2026-111719 Roncoo-pay through commit 9428382 Information Disclosure via /f2fPay/order/query
- CVE-2026-111718 AipexBase through commit 690adb9 SQL Injection via /api/data/invoke
- CVE-2026-111717 Arkon through 0.9.2 Missing Authorization via Skills Versions API
- CVE-2026-111716 Arkon through 0.9.2 Broken Access Control via Sources By-ID Routes
- CVE-2026-111715 Arkon through 0.9.2 Missing Authorization via Wiki Graph Neighborhood API
- CVE-2026-111714 tarteaucitron.js before 1.37.0 ReDoS via Unescaped Cookie Name in cookie.purge
- CVE-2026-111713 tarteaucitron.js before 1.37.0 XSS via getElemAttr Attribute Validation Mismatch
- CVE-2026-111712 Netcore NR256CN through 1.5.140116 Authentication Bypass via CGI Path Prefix
- CVE-2026-111711 Netcore NR256CN through 1.5.140116 Pre-Auth Stack Overflow via Boa user_ok()
- CVE-2026-111710 Netcore NR256CN through 1.5.140116 Boa Web Server NULL Pointer Dereference DoS
- CVE-2026-11171 Integer overflow in Chrome
- CVE-2026-111709 WhaTicket Community through commit cf04795 IDOR via /tickets/:ticketId and /messages/:ticketId
- CVE-2026-111708 WhaTicket Community through commit cf04795 Admin Self-Registration via /auth/signup
- CVE-2026-111707 99AI through 4.3.0 IDOR via /api/chatLog/querySingleChat Chat Message Disclosure
- CVE-2026-111706 99AI through 4.3.0 Unauthenticated Information Disclosure via chatLog exportExcel
- CVE-2026-111705 Fuint through commit 57ec018 IDOR via bookId in myBookDetail
- CVE-2026-111704 LangChat through commit 2a6285a Missing Authentication on REST API Controllers
- CVE-2026-111703 yshop-crm through 2.1.3 IDOR via CRM customer by-id endpoints
- CVE-2026-111702 ChatOllama through commit 96c3ce5 IDOR Exposes Private Knowledge Bases
- CVE-2026-111701 OtterMind Nubase through 0.1.4 Missing Authentication in Storage Object API
- CVE-2026-111700 WebVella ERP through 1.8.8 SQL Injection via EQL Query API
- CVE-2026-11170 Privilege escalation in Chrome
- CVE-2026-1117 Improper Access Control in parisneo/lollms
- CVE-2026-111699 Niefy wx-api through 0.8.2 Authentication Bypass via Unverified openid Cookie
- CVE-2026-111698 HUIZHI ChargeOS cloud through 3.0.9 Unpaid Wallet Credit via /pay/xcxRecharge
- CVE-2026-111697 HUIZHI ChargeOS cloud through 3.0.9 IDOR via hcp-mp Member and Order APIs
- CVE-2026-111696 data-platform-open through commit efeacd3 Hardcoded AES Key for Datasource Passwords
- CVE-2026-111695 Shaiwz data-platform-open through commit efeacd3 IDOR in Datasource API
- CVE-2026-111694 qKnow through 2.4.3 Missing Authentication via /flyflow Workflow Endpoints
- CVE-2026-111693 DataBuff ai-apm-web through 0.1.10 Hard-Coded Default Admin Credentials
- CVE-2026-111692 DataBuff ai-apm-web through 0.1.10 Authentication Bypass via Hardcoded HMAC Secret
- CVE-2026-111691 WIMOOR through commit ec86736 Authentication Bypass via Forged X-USERINFO Header
- CVE-2026-111690 Simple Admin Core through 1.8.7 Hard-Coded JWT Secret Authentication Bypass
- CVE-2026-11169 Cross-site scripting in Chrome
- CVE-2026-111689 XBoot through 3.3.4 Authorization Bypass via getByDepartmentId Endpoint
- CVE-2026-111688 Exrick XBoot through 3.3.4 Data-Scope Bypass via openDataFilter Parameter
- CVE-2026-111687 WeRSS (we-mp-rss) through 1.5.3 RCE via template Parameter in /rss Endpoint
- CVE-2026-111686 IceCMS through 4.1.5 SQL Injection via /WebArticle/findarticlesbynum
- CVE-2026-111685 IceCMS through 4.1.5 SQL Injection via /WebResource/findresourcebynum
- CVE-2026-111684 Magistrala through 1.0.0 Cross-Tenant Authorization Bypass in Certs Service
- CVE-2026-111683 Allegro Ralph through 20260902.1 Missing Authorization in Data Center Rack API
- CVE-2026-111682 EFAK 5.0.0 through 5.1.0 Missing Authorization via /api/model-config Exposes API Keys
- CVE-2026-111681 EFAK through 5.1.0 Privilege Escalation via /api/users REST API
- CVE-2026-111680 APIPark through 1.9.7-beta Cross-Team Authorization Bypass via Team Query Parameter
- CVE-2026-11168 Information disclosure in Chrome
- CVE-2026-111679 Ekko Studio through 0.7.36 Missing Authorization via /api/auth/locked-ips
- CVE-2026-111678 Antiword through 0.37 Stack Out-of-Bounds Read via prop8.c FKP Parsing
- CVE-2026-111677 Antiword through 0.37 Heap Out-of-Bounds Read via vGet8LstInfo in prop8.c
- CVE-2026-111676 Faveo Helpdesk through 2.0.3 Broken Access Control via /ticket/tooltip Endpoint
- CVE-2026-111675 Course-tencent-cloud through 2.0.1 Verification Code Brute Force Account Takeover
- CVE-2026-111674 Tbed through 20240319 Missing Authorization via setImgFileName Endpoint
- CVE-2026-111673 IceCMS through 4.1.5 Missing Authentication via /User Administrative Endpoints
- CVE-2026-111672 Cube-studio through 2026.09.01 IDOR via Pipeline View and Copy Endpoints
- CVE-2026-111671 Cube-studio through 2026.09.01 IDOR via Notebook and Serving Lifecycle Endpoints
- CVE-2026-111670 ClickVisual through 1.1.2 Missing Authorization in apiv2 Report Module
- CVE-2026-11167 Security feature bypass in Chrome
- CVE-2026-111669 ZR.Admin.NET through 3.8.2 SQL Injection via PagerInfo.Sort ORDER BY
- CVE-2026-111668 AIHelms through 0.1.25 Missing Authorization in Efficiency Analytics API
- CVE-2026-111667 REBUILD through 4.5.0 Missing Authorization via /project/comments/list Endpoint
- CVE-2026-111666 Steedos Platform through 3.0.15-beta.51 Cross-Tenant Information Disclosure via Reports API
- CVE-2026-111665 Piranha CMS through 12.2 Missing Authorization in Manager Language API
- CVE-2026-111664 Safing Portmaster before 2.2.5 Unauthenticated Forced Downgrade via /api/v1/updates/from-url
- CVE-2026-111663 Chaskiq through 2.0.3 SSRF via createUrlUpload GraphQL Mutation
- CVE-2026-111662 Chaskiq through 2.0.3 Unauthenticated SSRF via /oembed Endpoint
- CVE-2026-111661 waynboot-mall through 2.0.0 Missing Authentication via /callback/email Mail Endpoint
- CVE-2026-111660 waynboot-mall through 2.0.0 Missing Authentication via /callback/order/unpaid
- CVE-2026-11166 Cross-site scripting in Chrome
- CVE-2026-111659 Waynboot-mall through 2.0.0 Unauthenticated Order Forgery via /callback/order/submit
- CVE-2026-111658 SiteServer SSCMS through 7.4.0 Cross-Site Authorization Bypass via Channels API
- CVE-2026-111657 BeikeShop through 2.0.0.31 IDOR via RMA mark_as_shipped Endpoint
- CVE-2026-111656 ChatWiki through 2.9.6 Cross-Tenant IDOR via Form Filter Management Endpoints
- CVE-2026-111655 ThinkAdmin think-plugs-admin through 1.0.81 IDOR via admin/file.edit
- CVE-2026-111654 FastBee through 2.1.0 IDOR via /iot/group By-ID Endpoints
- CVE-2026-111653 53AIHub through 0.5.3 Missing Authentication via PUT /api/enterprises/:id