Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 929 of 1013.
- CVE-2026-111652 Engineercms through 2.0.5 Missing Authorization via AttachController.Attachment
- CVE-2026-111651 Risesoft Digital-Infrastructure through 9.6.11 Cross-Tenant Data Exposure via DownloadController
- CVE-2026-111650 ChronoFrame through 1.0.0 Missing Authentication via Setup Wizard API
- CVE-2026-11165 Use after free in Chrome
- CVE-2026-111649 Rocboss paopao-ce through 0.6.0-alpha.3 IDOR via DownloadAttachment Endpoint
- CVE-2026-111648 BuildAdmin through 2.3.9 IDOR via routine/adminInfo/edit id Parameter
- CVE-2026-111647 PickMall lilishop through 5.0.0 IDOR via /buyer/trade/receipt/{id}
- CVE-2026-111646 SurveyKing before 1.13.0 Unauthenticated File Download via /api/public/preview
- CVE-2026-111645 MrDoc through 1.1.1 Missing Authorization via api/import_local_doc/ Endpoint
- CVE-2026-111644 Misaka Danmu Server through 2.8.9 Missing Authentication on /api/ui Routes
- CVE-2026-111643 Misaka Danmu Server through 2.8.9 Authentication Bypass via Config-History Rollback
- CVE-2026-111642 FastapiAdmin through 3.0 Hard-Coded JWT Secret Privilege Escalation
- CVE-2026-111641 FastapiAdmin through 3.0 Authentication Bypass via Auto-Login Endpoints
- CVE-2026-111640 DooTask through 1.9.66 Missing Authorization in OKR Comment Dialogs
- CVE-2026-11164 Use after free in Chrome
- CVE-2026-111639 bbs-go through 4.4.6 Account Takeover via Google One Tap Login
- CVE-2026-111638 sshportal through 1.19.5 Missing Authorization in 'key show' Command Exposes Private Keys
- CVE-2026-111637 NexoPOS through 6.2.4 Unauthenticated Transaction Disclosure via /api/fields Endpoint
- CVE-2026-111636 OpenBMB StaffDeck through 0.5.6 Authentication Bypass via Hard-Coded Session Secret
- CVE-2026-111635 Helical Insight through 7.0.0 Path Traversal via /getExternalResource
- CVE-2026-111634 Helical Insight through 7.0.0 SQL Injection via /executeDatasource
- CVE-2026-111633 ZKEACMS through 4.4 Authentication Bypass via Hard-Coded JWT Signing Key
- CVE-2026-111632 Aureus ERP through 1.6.0 Multi-Company Authorization Bypass via company_id
- CVE-2026-111631 Distributor before 2.3.2 Missing Authorization in External Connection AJAX Actions
- CVE-2026-111630 abp-next-admin 10.2.0 through 10.6.0 IDOR in AIManagement Chat Conversations
- CVE-2026-11163 Use after free in Chrome
- CVE-2026-111629 IoTSharp through 3.6.1 Cross-Tenant Data Exposure via Customers and Devices APIs
- CVE-2026-111628 10up Distributor before 2.3.2 PHP Object Injection via set_meta()
- CVE-2026-111627 HestiaCP before 1.10.5 Protected Admin Bypass via Cron Job Creation
- CVE-2026-111626 Webreaper Damselfly through 4.5.3 Missing Authentication on REST API Controllers
- CVE-2026-111625 10up Distributor before 2.3.2 Missing Authorization via dt_push AJAX Action
- CVE-2026-111624 Umbraco CMS before 17.7.1 and 18.2.1 Missing Authorization on SignalR Hubs
- CVE-2026-111623 Xiaozhi-esp32-server-java through 6.1.0 Authentication Bypass via OTA Endpoint Token Issuance
- CVE-2026-111622 smart-sso through 2.1.1 OAuth2 Authorization Code Theft via Unvalidated redirectUri
- CVE-2026-111621 TDuck Survey Form through 5.3 Missing Authorization via /user/form/setting/{key}
- CVE-2026-111620 O2OA through 10.0.2-ce Cross-Work Attachment Read via Attachment Download Endpoint
- CVE-2026-11162 Information disclosure in Chrome
- CVE-2026-111619 FilePress through 3.0.1 SQL Injection via asc Parameter in filelist.php
- CVE-2026-111618 CoAI through 4.0.0 Unauthenticated Path Traversal via Archive Download Endpoints
- CVE-2026-111617 WHartTest through 2.8.1 Missing Authentication on UI-Automation WebSocket Endpoints
- CVE-2026-111616 Oqtane Framework through 10.2.6 Cross-Site Settings Disclosure via Setting API
- CVE-2026-111615 Mall4cloud through 4.0 IDOR Exposing Buyer Addresses via order_addr Endpoint
- CVE-2026-111614 DataCap through 2025.1.1 IDOR via BaseController.getInfoForPath Exposes Credentials
- CVE-2026-111613 AllData through 0.7.1 Unauthenticated JDBC Injection via /jobJdbcDatasource/test
- CVE-2026-111612 netdisk-fast-download through 0.4.8 Credential Disclosure via /v2/randomAuth
- CVE-2026-111611 roncoo-education through 25.0.0-RELEASE IDOR via Order Pay Cancel and Continue Endpoints
- CVE-2026-111610 B3log Solo through 4.4.0 Missing Authorization in ArticleConsole
- CVE-2026-11161 Information disclosure in Chrome
- CVE-2026-111609 PKP Open Journal Systems through 3.5.0-5 Cross-Journal Subscription IDOR via updateSubscription
- CVE-2026-111608 Jeepay through 3.2.9 IDOR via DELETE /api/divisionReceivers/{recordId}
- CVE-2026-111607 Jeepay through 3.2.9 IDOR via POST /api/mch/payConfigs
- CVE-2026-111606 Huly Platform through 0.7.432 Account Takeover via mergeSpecifiedPersons RPC
- CVE-2026-111605 Jpom through 2.11.12 Cross-Workspace Authorization Bypass via SshFileController
- CVE-2026-111604 eladmin through 2.7 Broken Access Control via /api/users Update and Delete
- CVE-2026-111603 PlayEdu through 2.3 Missing Authorization via Student CourseController Endpoints
- CVE-2026-111602 Information disclosure in Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
- CVE-2026-111601 Hippoo Mobile App for WooCommerce <= 1.12.0 - Reflected Cross-Site Scripting via 'token_id' Parameter
- CVE-2026-11160 Memory corruption in Chrome
- CVE-2026-1116 Cross-site Scripting (XSS) in parisneo/lollms
- CVE-2026-111596 Kliken: Ads + Pixel for Meta < 1.2.3 - Unauthenticated Order Data Disclosure via IDOR
- CVE-2026-111594 InterSystems Corporation InterSystems IRIS for Health Cleartext Transmission of Sensitive Information
- CVE-2026-111590 SSRF in Harbor webhook delivery allows ProjectAdmin to reach internal services
- CVE-2026-11159 Information disclosure in Chrome
- CVE-2026-111585 Integer Overflow in TeamViewer Remote Control Screen Decompression Leading to Heap-Based Buffer Overflow
- CVE-2026-111584 Local Privilege Escalation via Race Condition in TeamViewer Patch Management for Windows
- CVE-2026-111583 Local Privilege Escalation during Advanced Asset Management Installation in TeamViewer Client for Windows
- CVE-2026-111582 Local Privilege Escalation via DLL Hijacking in TeamViewer Monitoring for Windows
- CVE-2026-111581 Libblockdev: libblockdev: argument injection in ntfs/vfat label-setting helpers via udisks2 setlabel() d-bus method
- CVE-2026-11158 Security feature bypass in Chrome
- CVE-2026-111577 GoSMTP < 1.2.5 - Plugin Activator+ Privilege Escalation via SMTP Settings
- CVE-2026-111574 Redirection for Contact Form 7 2.2.7 - 3.2.11 - Unauthenticated Stored XSS via Lead Debug Metabox
- CVE-2026-11157 Cross-site scripting in Chrome
- CVE-2026-11156 Information disclosure in Chrome
- CVE-2026-111555 Luksmeta: missing slot-range validation permits out-of-gap device i/o
- CVE-2026-111551 Apache Kafka: Denial of service in Kafka Streams and client deserializers via unbounded memory allocation
- CVE-2026-11155 Information disclosure in Chrome
- CVE-2026-111548 Memory corruption in NPort W2150A-W4/W2250A-W4 Series
- CVE-2026-11154 Use after free in Chrome
- CVE-2026-11153 Information disclosure in Chrome
- CVE-2026-11152 Use after free in Chrome
- CVE-2026-11151 Security feature bypass in Chrome
- CVE-2026-11150 Cross-site scripting in Chrome
- CVE-2026-1115 Stored XSS in parisneo/lollms
- CVE-2026-111497 Google Brotli Unchecked Return Value
- CVE-2026-111496 Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuation
- CVE-2026-11149 Privilege escalation in Chrome
- CVE-2026-11148 Information disclosure in Chrome
- CVE-2026-111472 SQL injection in TSG Profleet
- CVE-2026-11147 Use after free in Chrome
- CVE-2026-111461 SMS upgrade argument reaches system() unescaped in OnCell G3150A-LTE Series
- CVE-2026-111460 Static HTTPS private key and CA private key in firmware in OnCell G3150A-LTE Series
- CVE-2026-11146 Security feature bypass in Chrome
- CVE-2026-111459 Unauthenticated server-supplied OpenVPN configuration in Moxa Remote Connect Suite (MRC Client)
- CVE-2026-111458 ssldump Heap Buffer Overflow in FAN/1 X.509 Fingerprint Formatting
- CVE-2026-111451 Command injection in Wheels CLI
- CVE-2026-111450 Information disclosure in Wheels
- CVE-2026-11145 Race condition in Chrome
- CVE-2026-111449 Race condition in Wheels
- CVE-2026-111448 Path traversal in Wheels
- CVE-2026-111447 Business logic in Wheels