Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 931 of 1013.
- CVE-2026-111313 JobOps through 0.13.1 SSRF via POST /api/manual-jobs/fetch
- CVE-2026-111312 OpenHealth through 0.2.0 Missing Authentication via /api/health-data/[id] Route
- CVE-2026-111311 File upload in DoubleScale CRM | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More
- CVE-2026-11131 Use after free in Chrome
- CVE-2026-11130 Use after free in Chrome
- CVE-2026-11129 Information disclosure in Chrome
- CVE-2026-111284 Aureus ERP through 1.6.0 Stored XSS via Time Off Holiday Action Modal
- CVE-2026-111283 BMC Helix Network Management 26.3.00 before 26.3.01 Authentication Bypass via SAML Configuration
- CVE-2026-111282 iso14229 before 0.10.1 Out-of-Bounds Read via Handle_0x38_RequestFileTransfer
- CVE-2026-111281 Jooan JA-A12 Unauthenticated Root RCE via SetDiagMode Hard-Coded Credentials
- CVE-2026-111280 snap7 through 1.4.3 Out-of-Bounds Write via TSnap7MicroClient::opReadArea
- CVE-2026-11128 Information disclosure in Chrome
- CVE-2026-111279 Dragonfly through 2.0.2 Unbounded Memory Allocation via Negative COUNT in HRANDFIELD, ZRANDMEMBER and SRANDMEMBER
- CVE-2026-111278 NivoCart through 2.5.1 CAPTCHA Bypass via Answer Disclosed in Page HTML
- CVE-2026-111277 NivoCart through 2.5.1 Guest Order Invoice Disclosure via account/order/download
- CVE-2026-111275 nifti_clib through 3.0.1 Stack Out-of-Bounds Access via nifti_convert_n2hdr2nim
- CVE-2026-111274 unarr through 1.1.1 Heap Out-of-Bounds Read via zip_parse_extra_fields
- CVE-2026-111273 unarr through 1.1.1 Off-by-One Heap Buffer Overflow via tar_get_name
- CVE-2026-111272 LibRaw through 0.22.2 Heap Out-of-Bounds Read via parseNikonMakernote ShotInfo
- CVE-2026-111271 libmodplug through 0.8.9.1 Heap Out-of-Bounds Read via CSoundFile::ReadAMS2
- CVE-2026-111270 libmodplug through 0.8.9.1 Heap Out-of-Bounds Write via CSoundFile::ReadDSM
- CVE-2026-11127 Security feature bypass in Chrome
- CVE-2026-111269 libical through 4.0.6 Heap Out-of-Bounds Read via icalvalue_decode_ical_string
- CVE-2026-11126 Information disclosure in Chrome
- CVE-2026-111255 File upload in affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display
- CVE-2026-111252 OpenNMS denial of service via XML entity expansion
- CVE-2026-11125 Use after free in Chrome
- CVE-2026-11124 Integer overflow in Chrome
- CVE-2026-111237 Ultralytics FastSAM AutoBackend Model Loading autobackend.py session.get_modelmeta.custom_metadata_map eval injection
- CVE-2026-111235 OpenNMS REST authorization bypass via non-canonical HTTP method
- CVE-2026-111234 SimplePie through 1.9.0 Local File Read via file:// Redirect
- CVE-2026-111233 Netgate pfSense CE 2.7.1 through 2.9.0 Reflected XSS via firewall_rules.php
- CVE-2026-111232 Netgate pfSense CE 2.3.0 through 2.9.0 Stored XSS via Separator Color
- CVE-2026-111231 Netgate pfSense CE through 2.9.0 Authorization Bypass via config_restore() and config_install()
- CVE-2026-111230 Netgate pfSense CE through 2.9.0 Local File Read via Dynamic DNS Update URL
- CVE-2026-11123 Information disclosure in Chrome
- CVE-2026-111229 Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via Captive Portal HA Sync
- CVE-2026-111228 Netgate pfSense CE 2.7.1 through 2.9.0 CRLF Injection via services_unbound_advanced.php
- CVE-2026-111227 Netgate pfSense CE through 2.9.0 CRLF Injection via services_unbound_acls.php
- CVE-2026-111226 Netgate pfSense CE 2.4.5 through 2.9.0 OS Command Injection via system_advanced_admin.php
- CVE-2026-111225 Netgate pfSense CE 2.5.0 through 2.9.0 OS Command Injection via openvpn.learn-address.sh
- CVE-2026-111224 Netgate pfSense CE through 2.9.0 OS Command Injection via openvpn.connect_async.sh
- CVE-2026-111223 Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via IPsec Mobile Login Banner
- CVE-2026-111222 Netgate pfSense CE through 2.9.0 php.ini Injection via Timezone Setting
- CVE-2026-111221 Netgate pfSense CE through 2.9.0 Command Injection via RADIUS Secret mpd.conf Injection
- CVE-2026-111220 Netgate pfSense CE through 2.9.0 Crontab Injection via PPP Periodic Reset ptpid
- CVE-2026-11122 Cross-site scripting in Chrome
- CVE-2026-111219 Netgate pfSense CE through 2.9.0 Command Injection via PPPoE Server Username
- CVE-2026-111218 Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper Limiters
- CVE-2026-111217 Netgate pfSense CE through 2.9.0 OS Command Injection via CARP VHID
- CVE-2026-111216 Netgate pfSense CE through 2.9.0 OS Command Injection via Gateway Monitor IP
- CVE-2026-111215 Netgate pfSense CE through 2.9.0 OS Command Injection via Wireless Parent Interface
- CVE-2026-111214 Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.php
- CVE-2026-111213 Missing authorization in Travelly – Tour & Travel Booking Manager for WooCommerce
- CVE-2026-111212 Code injection in Medical-SAM-Adapter
- CVE-2026-111210 bitcoinj Payment Request PaymentSession.java url.openConnection server-side request forgery
- CVE-2026-11121 Information disclosure in Chrome
- CVE-2026-11120 Security feature bypass in Chrome
- CVE-2026-1112 Sanluan PublicCMS Trade Address Deletion Endpoint TradeAddressController.java delete improper authorization
- CVE-2026-11119 Security feature bypass in Chrome
- CVE-2026-111184 NoMachine Named Pipe Incorrect Permission Assignment Local Privilege Escalation Vulnerability
- CVE-2026-111183 GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability
- CVE-2026-111181 body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body
- CVE-2026-11118 Use after free in Chrome
- CVE-2026-111178 WP Booking System <= 2.1.0.1 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
- CVE-2026-111172 @casl/ability 6.7.5 before 7.0.2 Prototype Pollution via rulesToFields setByPath
- CVE-2026-111171 Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 CCIP-Read SSRF Bypass
- CVE-2026-111170 kedro-datasets 9.3.0 through 9.6.0 Path Traversal via MatplotlibDataset Plot Name
- CVE-2026-11117 Use after free in Chrome
- CVE-2026-111169 La Suite Docs through 6.0.1 Authorization Bypass via Comment Thread Creation
- CVE-2026-111168 LibreDesk before 2.9.0-rc.8 Stored XSS via SVG Upload Content-Type Parameter
- CVE-2026-111167 GNU LibreDWG through 0.14.8612 Out-of-Bounds Read in acds_private AcDs Decoder
- CVE-2026-111166 libmikmod through 3.3.15 Heap Out-of-Bounds Read via IMF_Load
- CVE-2026-111165 libmikmod through 3.3.15 Out-of-Bounds Read in MTM_Load via Channel Count
- CVE-2026-111164 UADE through 3.05 Out-of-Bounds Read in uade_filemagic via Short Module
- CVE-2026-111163 WildMIDI through 0.5.0 Heap Out-of-Bounds Read via _WM_ParseNewHmi
- CVE-2026-111162 WildMIDI through 0.5.0 Heap Out-of-Bounds Read via _WM_ParseNewHmp
- CVE-2026-111161 libADLMIDI 1.6.2 through 1.6.2.1 Stack Out-of-Bounds Write via BW_MidiSequencer noteStates
- CVE-2026-111160 LightLLM through 1.2.0 Unauthenticated DoS via pd_kv_trans_params Deserialization
- CVE-2026-11116 Use after free in Chrome
- CVE-2026-111159 libewf through 20260924 Heap Out-of-Bounds Read via L01 Extended Attribute Parsing
- CVE-2026-111158 EarthScope libmseed through 3.5.4 Heap Out-of-Bounds Read via ms3_detect
- CVE-2026-111157 SoX through 14.4.2 Heap Out-of-Bounds Write via MS ADPCM WAV Decoding
- CVE-2026-111156 libTiMidity through 0.2.8 Out-of-Bounds Access via SoundFont Preset Header
- CVE-2026-111155 libTiMidity through 0.2.8 Out-of-Bounds Read via SoundFont Loader sndfont.c
- CVE-2026-111154 libTiMidity through 0.2.8 Stack Out-of-Bounds Write via parse_gen in SoundFont Loader
- CVE-2026-111153 Game Music Emu (libgme) through 0.6.5 Out-of-Bounds Read via Classic_Emu::mute_voices_
- CVE-2026-111152 Game Music Emu (libgme) through 0.6.5 Heap Out-of-Bounds Read via AY Loader
- CVE-2026-111151 OpenJPH through 0.32.0 Heap Out-of-Bounds Write in HTJ2K Cleanup-Pass Decoder
- CVE-2026-111150 ValleyBell libvgm through commit a6eed945 Heap Out-of-Bounds Read via DecompressDataBlk
- CVE-2026-11115 Use after free in Chrome
- CVE-2026-111149 FreeImage through 3.19.23 Heap Out-of-Bounds Read via PICT Unpack32Bits
- CVE-2026-111148 libsidplayfp through 3.1.1 Heap Out-of-Bounds Read via SidTuneBase::acceptSidTune
- CVE-2026-111147 Libyal libesedb through 20260704 Heap Out-of-Bounds Read via libesedb_record_get_multi_value
- CVE-2026-111146 ytnef through 2.1.2 Heap Out-of-Bounds Read via MAPIPrint in lib/ytnef.c
- CVE-2026-111145 ytnef through 2.1.2 Heap Out-of-Bounds Read via DecompressRTF
- CVE-2026-111144 libansilove 1.3.0 through 1.4.2 NULL Pointer Dereference via ansilove_xbin
- CVE-2026-111143 Ansilove libansilove through 1.4.2 Out-of-Bounds Read via ansilove_xbin RLE Decoding
- CVE-2026-111142 Zziplib through 0.13.80 Out-of-Bounds Read via zzip_disk_findfirst
- CVE-2026-111141 zziplib through 0.13.80 Out-of-Bounds Read via __zzip_parse_root_directory ZIP64 Parsing