Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 930 of 1013.
- CVE-2026-111446 Missing authorization in Wheels
- CVE-2026-111445 Missing authorization in Wheels
- CVE-2026-111444 SQL injection in Wheels
- CVE-2026-111443 Security feature bypass in Wheels
- CVE-2026-111442 Cross-site scripting in Backdrop
- CVE-2026-111441 HLL 反序列化 lenTotal/lenUsed 校验缺失导致堆越界写
- CVE-2026-111440 JDBC LogFactory 任意类加载/构造导致潜在 RCE
- CVE-2026-11144 Use after free in Chrome
- CVE-2026-111439 pg_read_binary_file_blocks 缺少初始用户权限校验，普通用户可读取 relation 文件块
- CVE-2026-111438 check_hba_replication 认证与访问控制绕过
- CVE-2026-11143 Memory corruption in Chrome
- CVE-2026-111422 Apache Airflow SSH provider: SSHRemoteJobOperator: `environment` values are executed as shell on the remote host
- CVE-2026-11142 Security feature bypass in Chrome
- CVE-2026-111419 Hardcoded API Token in Foxit Official Website
- CVE-2026-111418 SSRF and JavaScript Execution in the Foxit Official Website's HTML-to-PDF Service
- CVE-2026-111417 Cross-user Document Access on Foxit Official Website's HTML-to-PDF Service
- CVE-2026-111414 WordPress JetElements For Elementor plugin <= 2.9.2.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-111413 WordPress aThemeArt theme Helper plugin <= 1.0.8 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-111411 WordPress FunnelKit Automations plugin <= 3.8.5.2 - SQL Injection vulnerability
- CVE-2026-111410 WordPress e2pdf plugin <= 1.32.57 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-11141 Information disclosure in Chrome
- CVE-2026-111409 WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.61.0 - Broken Access Control vulnerability
- CVE-2026-111408 WordPress Quiz And Survey Master plugin <= 11.2.7 - PHP Object Injection vulnerability
- CVE-2026-111407 WordPress Tutor LMS plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-111406 WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Upload vulnerability
- CVE-2026-111405 WordPress MapSVG plugin <= 8.16.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-111404 WordPress Photo Reviews for WooCommerce plugin <= 1.2.31 - Race Condition vulnerability
- CVE-2026-111402 WordPress Newsletters plugin <= 4.18.1 - SQL Injection vulnerability
- CVE-2026-111401 WordPress Tailored Tools plugin <= 3.0.3 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-111400 WordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-11140 Memory corruption in Chrome
- CVE-2026-1114 Improper Access Control via Weak JWT Token in parisneo/lollms
- CVE-2026-111399 WordPress MapSVG plugin <= 8.16.1 - SQL Injection vulnerability
- CVE-2026-111398 WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Deletion vulnerability
- CVE-2026-111397 WordPress MapSVG plugin <= 8.16.1 - Sensitive Data Exposure vulnerability
- CVE-2026-111396 WordPress Advanced Post Manager plugin <= 4.5.6 - Broken Access Control vulnerability
- CVE-2026-111392 SGLang through 0.5.21 KV Cache Poisoning via mm_hashes in /generate
- CVE-2026-111391 SGLang 0.5.10 through 0.5.22 Code Injection via Debug Dumper Filter
- CVE-2026-111390 Erupt through 2.3.0 HQL Injection via linkTreeVal in Data Table API
- CVE-2026-11139 Information disclosure in Chrome
- CVE-2026-111389 Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation
- CVE-2026-111388 Frappe before 16.33.0 restrict_ip Allowlist Bypass via API Key, OAuth Authentication
- CVE-2026-111387 Nezha 2.2.5 before 2.3.15 Information Disclosure via DDNS List Endpoint
- CVE-2026-111386 Nezha 1.7.0 before 2.3.15 Cross-Tenant Server-ID Enumeration via getServerConfig
- CVE-2026-111385 Nezha 2.1.0 before 2.3.15 Host Header Injection via MCP Transfer Tools
- CVE-2026-111384 Nezha 1.0.0 before 2.3.15 Memory Exhaustion via File Manager WebSocket
- CVE-2026-111383 Nezha 2.0.13 before 2.3.15 Denial of Service via /api/v1/ws/transfer WebSocket
- CVE-2026-111382 FreeRDP before 3.32.0 Heap Out-of-Bounds Write in AVC444 YUV444 Combine
- CVE-2026-111381 FreeRDP before 3.32.0 Heap Buffer Overflow via Persistent Cache v2 Parser
- CVE-2026-111380 FreeRDP 3.29.0 before 3.32.0 Heap Overflow via audin Apple Backends
- CVE-2026-11138 Information disclosure in Chrome
- CVE-2026-111379 FreeRDP before 3.32.0 Heap Buffer Overflow via persistent_cache_read_entry_v3
- CVE-2026-111378 FreeRDP 3.0.0 before 3.32.0 Unauthenticated Memory Exhaustion via NLA Frame Parser
- CVE-2026-111377 FreeRDP 2.0.0 before 3.32.0 Memory Exhaustion via Static Channel Reassembly
- CVE-2026-111376 FreeRDP 3.30.0 before 3.32.0 Heap Over-Read via Windows cliprdr FILECONTENTS_SIZE
- CVE-2026-111375 FreeRDP 3.0.0 before 3.32.0 Out-of-Bounds Read via RAIL Window Title
- CVE-2026-111374 FreeRDP from 3.30.0 before 3.32.0 Resource Exhaustion via rdpecam StartStreamsRequest
- CVE-2026-111373 FreeRDP before 3.32.0 NULL Dereference via Zero-Length WebSocket Ping
- CVE-2026-111372 Missing authorization in AI ChatBot for WooCommerce – WoowBot
- CVE-2026-11137 Information disclosure in Chrome
- CVE-2026-111369 ClassroomIO through 1.0.0 Incorrect Authorization via Lesson Update and Delete Routes
- CVE-2026-111368 ClassroomIO through 1.0.0 IDOR via Course Submission Update, Grade and Delete Routes
- CVE-2026-111367 BillionMail through 4.9 Forgeable JWTs via Default Signing Key
- CVE-2026-111366 cool-admin-midway through 8.0.0 Authorization Bypass via /admin/sys/user Endpoints
- CVE-2026-111365 cool-admin-midway through 8.0.0 Missing Authorization via System Role Endpoints
- CVE-2026-111364 MinDoc through 2.2-beta.2 IDOR via /api/:key/content/:id GET Branch
- CVE-2026-111363 BISHENG through 3.0.0-beta4 IDOR via /api/v1/knowledge/file_bbox
- CVE-2026-11136 Use after free in Chrome
- CVE-2026-111359 CRMEB 5.6.1 through 6.0.0 IDOR via giftDetail and receiveGift
- CVE-2026-111358 SendPortal sendportal-core through 4.0.1 Cross-Workspace Tag Attachment via Subscriber Form
- CVE-2026-111357 Privilege escalation in Connect Secure
- CVE-2026-111356 MacCMS v10 through 2026.1000.4056 Account Takeover via Password Recovery Brute-Force
- CVE-2026-111355 zhontai Admin.Core through 10.1.0 Authorization Bypass via User and Organization By-ID Endpoints
- CVE-2026-111354 crmeb_java through 3.1 Authorization Bypass via Front Order Express and Refund Endpoints
- CVE-2026-111353 Peppermint through 0.5.5 Missing Authorization via Time-Tracking and Attachment Upload Endpoints
- CVE-2026-111352 ThinkCMF through 8.0.1 Incorrect Authorization in Admin REST API
- CVE-2026-111351 metasfresh through 5.175 Authorization Bypass via /rest/api/board REST API
- CVE-2026-111350 Papermark through 0.22.0 Missing Authorization in Data Room Viewer Group API
- CVE-2026-11135 Security feature bypass in Chrome
- CVE-2026-111349 Craftplan through 0.7.5 Missing Authorization via CRM Customer JSON:API and GraphQL
- CVE-2026-111348 Likeshop through 3.5.1 IDOR via AfterSale API Refund Endpoints
- CVE-2026-111347 go-ldap-admin through 0.6.2 Hard-Coded RSA Private Key via /base/decryptpwd
- CVE-2026-111346 ZenTao PMS through 22.6 Authorization Bypass via action::editComment
- CVE-2026-111345 Trudesk through 1.2.11 Authorization Bypass via GET /api/v1/messages/conversation/:id
- CVE-2026-111344 APITable through 1.14.0-beta Authorization Bypass via GET /node/{nodeId}/description
- CVE-2026-111343 pig through 4.1.1 Missing Authorization via GET /admin/user/details/{id}
- CVE-2026-11134 Information disclosure in Chrome
- CVE-2026-111332 OxiCloud 0.9.1 through 0.9.3 Incorrect Authorization via Share Ring Cookie
- CVE-2026-111331 Dokploy through 0.30.8 Cross-Organization Authorization Bypass via port tRPC Router
- CVE-2026-111330 JuggleIM im-server through 1.8.16 Weak Password Hashing via Unsalted SHA-1
- CVE-2026-11133 Security feature bypass in Chrome
- CVE-2026-111329 JuggleIM im-server through 1.8.16 Default Admin Credentials in Admin Console
- CVE-2026-111324 rustdesk-api through 2.7 Authorization Bypass via POST /api/sysinfo
- CVE-2026-111323 RedAmon through 7.0.1 Unauthenticated SSRF via /tradecraft/verify Endpoint
- CVE-2026-111322 Archon 0.2.13 through 0.11.1 Missing Authentication via /api/* Control API
- CVE-2026-111321 TaskingAI through 0.3.0 SSRF via OpenAPI servers[0].url in Actions
- CVE-2026-111320 ValueCell through 0.1.20 Unauthenticated SSRF via /api/v1/models/check
- CVE-2026-11132 Security feature bypass in Chrome
- CVE-2026-111318 Cross-site scripting in HT Mega Addons for Elementor – Elementor Widgets & Template Builder
- CVE-2026-111314 affiliate-toolkit <= 3.9.2 - Unauthenticated Stored Cross-Site Scripting via 'atkp_product_producturl' Parameter