Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 933 of 1013.
- CVE-2026-11093 Information disclosure in Chrome
- CVE-2026-110922 Use after free in Chrome
- CVE-2026-110921 Use after free in Chrome
- CVE-2026-110920 Memory corruption in Chrome
- CVE-2026-11092 Privilege escalation in Chrome
- CVE-2026-110919 Use after free in Chrome
- CVE-2026-110918 Memory corruption in Chrome
- CVE-2026-110917 Memory corruption in Chrome
- CVE-2026-110916 Other in Chrome
- CVE-2026-110915 Use after free in Chrome
- CVE-2026-110914 Memory corruption in Chrome
- CVE-2026-110913 Memory corruption in Chrome
- CVE-2026-110912 Information disclosure in DragonFlyBSD
- CVE-2026-110911 SQL injection in Wheels
- CVE-2026-110910 qs.stringify with allowEmptyArrays does not encode the keys of empty arrays, allowing query string parameter injection
- CVE-2026-11091 Memory corruption in Chrome
- CVE-2026-110909 Other in Wheels CLI
- CVE-2026-110908 Command injection in pfSense-pkg-frr
- CVE-2026-110907 Information disclosure in Backdrop
- CVE-2026-110904 Auth bypass in ApostropheCMS
- CVE-2026-110903 WordPress The Events Calendar plugin <= 6.18.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-110902 WordPress Event Tickets plugin <= 5.30.1 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-110901 WordPress SmartCrawl plugin <= 3.16.4 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-110900 WordPress BookIt plugin <= 2.6.0.5 - Broken Access Control vulnerability
- CVE-2026-11090 Information disclosure in Chrome
- CVE-2026-1109 cijliu librtsp rtsp_parse_request buffer overflow
- CVE-2026-110899 WordPress Ninja Forms plugin <= 3.15.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-110898 WordPress Essential Addons for Elementor plugin <= 6.8.5 - Privilege Escalation vulnerability
- CVE-2026-110897 WordPress PowerPack Lite for Beaver Builder plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-110896 WordPress Passster plugin <= 4.3.18 - Broken Access Control vulnerability
- CVE-2026-110895 WordPress Support Genix plugin <= 1.4.54 - SQL Injection vulnerability
- CVE-2026-110894 WordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerability
- CVE-2026-110893 WordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerability
- CVE-2026-110892 WordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerability
- CVE-2026-110891 WordPress WordLift plugin <= 3.54.15 - Broken Access Control vulnerability
- CVE-2026-110890 WordPress JetSmartFilters plugin <= 3.8.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-11089 Information disclosure in Chrome
- CVE-2026-110889 WordPress Gantry 5 Framework plugin <= 5.6.4 - Sensitive Data Exposure vulnerability
- CVE-2026-110888 WordPress AI Engine plugin <= 3.8.3 - Broken Access Control vulnerability
- CVE-2026-110887 WordPress HivePress plugin <= 1.7.32 - Remote Code Execution (RCE) vulnerability
- CVE-2026-110886 WordPress Conversational Forms for ChatBot plugin <= 1.5.1 - PHP Object Injection vulnerability
- CVE-2026-110885 WordPress HivePress plugin <= 1.7.32 - Content Injection vulnerability
- CVE-2026-110884 WordPress Live Summary for Gravity Forms plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-110883 WordPress 2Way VideoCalls and Random Chat plugin <= 6.1.5 - Broken Authentication vulnerability
- CVE-2026-110882 WordPress SMS Alert Order Notifications plugin <= 4.0.1 - Broken Access Control vulnerability
- CVE-2026-110881 WordPress SureDash plugin <= 1.12.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-110880 WordPress Kit (formerly ConvertKit) plugin <= 3.4.6 - Broken Access Control vulnerability
- CVE-2026-11088 Integer overflow in Chrome
- CVE-2026-110879 Deserialization in jackson-databind
- CVE-2026-110878 Aureus ERP through 1.6.0 Stored XSS via Inventory Rule Action Information
- CVE-2026-110877 AdPlug through 2.4 Heap Out-of-Bounds Read via CdmoLoader::load
- CVE-2026-110876 AdPlug through 2.4 Out-of-Bounds Read via CxsmPlayer::play_note in XSM Files
- CVE-2026-110875 AdPlug through 2.4 Heap Buffer Overflow via CksmPlayer::update in ksm.cpp
- CVE-2026-110874 Dolibarr before 23.0.4 PHP Object Injection via jsonOrUnserialize()
- CVE-2026-110873 Heym 0.0.55 before 0.0.121 Credential Theft via error_workflow_id Field
- CVE-2026-110872 Nodemailer 3.0.0 before 10.0.10 Denial of Service via SMTP Reply Parsing
- CVE-2026-110871 Nodemailer 3.0.0 before 10.0.10 Quadratic DKIM Header Unfolding Denial of Service
- CVE-2026-110870 Nodemailer before 10.0.13 Improper Input Validation via Angle-Bracket Address Comments
- CVE-2026-11087 Information disclosure in Chrome
- CVE-2026-110869 Nodemailer 3.0.0 before 10.0.13 ReDoS via SMTP AUTH Mechanism Detection Regexes
- CVE-2026-110868 Renovate before 44.79.0 SSRF via HTTP Preset URLs and customDatasources
- CVE-2026-110867 Renovate before 44.60.1 allowedEnv Allowlist Bypass via Shared Preset
- CVE-2026-110866 Renovate before 44.61.3 minimumReleaseAge Bypass via PR Rebase Request
- CVE-2026-110865 Renovate before 44.60.1 HTTP Header Allowlist Bypass via Shared Presets
- CVE-2026-110864 Better Auth 1.5.0-beta.12 before 1.7.7 Authentication Bypass via OAuth Proxy
- CVE-2026-110863 Better Auth @better-auth/sso before 1.7.3 Authentication Bypass via Personal SSO Providers
- CVE-2026-110862 Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic Link
- CVE-2026-110861 Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition
- CVE-2026-110860 GitPython 3.1.62 before 3.2.0 Symlink Path Traversal via Submodule.move()
- CVE-2026-11086 Other in Chrome
- CVE-2026-110859 GitPython before 3.2.0 Arbitrary File Read via Head.checkout() Branch Name
- CVE-2026-110858 GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec
- CVE-2026-110857 GitPython before 3.2.0 Command Execution via ls_remote ext:: URLs
- CVE-2026-110856 GitPython before 3.2.0 ReDoS via _re_actor_epoch in parse_actor_and_date
- CVE-2026-110855 GitPython before 3.2.0 Environment Variable Disclosure via .gitmodules Submodule Name
- CVE-2026-110854 Parse Server before 8.6.97 and 9.10.2-alpha.6 Denial of Service via Unhandled Email Error
- CVE-2026-110853 n8n before 1.123.83 Authorization Bypass via Execute Sub-workflow Inline JSON
- CVE-2026-110852 n8n before 1.123.83, 2.41.4, and 2.42.1 Unauthenticated Workflow Execution via Dynamic-Path Webhook Resolution
- CVE-2026-110851 n8n before 2.41.4 and 2.42.1 Cross-Project Agent Ownership Transfer via Agents Create Endpoint
- CVE-2026-110850 n8n before 2.41.4 and 2.42.1 Credential Check Bypass via Agent Node Parameters
- CVE-2026-11085 Integer overflow in Chrome
- CVE-2026-110849 n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Binary-Data File Preview
- CVE-2026-110848 n8n before 1.123.83, 2.41.4, and 2.42.1 Prototype Pollution via AI Workflow Builder Connection Merge
- CVE-2026-110847 n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Chat Trigger customCss Parameter
- CVE-2026-110846 n8n before 2.41.4 and 2.42.1 Send-and-Wait HMAC Signature Bypass via Waiting-Webhook
- CVE-2026-110845 n8n before 1.123.83, 2.41.4, and 2.42.1 Code Execution via Git Node Log Operation
- CVE-2026-110844 n8n before 1.123.83 Credential Authorization Bypass via Nested Inline Sub-Workflows
- CVE-2026-110843 n8n before 2.41.4 and 2.42.1 Unauthenticated Unbounded OAuth Client Persistence via Authorize Endpoint
- CVE-2026-110842 n8n before 2.41.4 and 2.42.1 Prototype Pollution via MCP Workflow-Validation Interpreter
- CVE-2026-110841 n8n before 2.41.4 and 2.42.0 Authorization Bypass in Agent Chat Resume Tool Approval
- CVE-2026-110840 n8n before 2.41.4 and 2.42.1 SQL Injection via Microsoft SQL Node Query Field
- CVE-2026-11084 Information disclosure in Chrome
- CVE-2026-110839 FreeRDP 3.3.0 before 3.32.0 Heap Out-of-Bounds Write via Grayscale JPEG Clipboard Data
- CVE-2026-110838 FreeRDP shadow before 3.32.0 Pre-Authentication Input Injection via Confirm Active bypass
- CVE-2026-110837 FreeRDP 2.0.0 before 3.32.0 Heap Buffer Overflow via MP3 Audio Decoding
- CVE-2026-110836 FreeRDP 3.0.0 before 3.32.0 Infinite Loop DoS via Gateway Content-Type
- CVE-2026-110835 FreeRDP 3.0.0 before 3.32.0 HTTP Header Injection via Proxy Routing Token
- CVE-2026-110834 FreeRDP 2.0.0 before 3.32.0 Denial of Service via Serial IRP Null Handle
- CVE-2026-110833 FreeRDP before 3.32.0 Unbounded Memory Retention via RDPDR Proxy
- CVE-2026-110832 FreeRDP 2.0.0 before 3.32.0 Memory Exhaustion via DRDYNVC DATA_FIRST