Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 935 of 1013.
- CVE-2026-110675 Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allow_barekey in decode_hv.
- CVE-2026-110674 Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hv.
- CVE-2026-110673 Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag.
- CVE-2026-110672 Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv.
- CVE-2026-110670 cemtan sar2html Archive Processing sar2html.py updateDb sql injection
- CVE-2026-11067 Information disclosure in Chrome
- CVE-2026-110669 cemtan sar2html sar2html.py deleteAll missing authentication
- CVE-2026-110668 cemtan sar2html sar2html.py index sql injection
- CVE-2026-110667 cemtan sar2html sar2html.py hard-coded credentials
- CVE-2026-110666 cemtan sar2html File Upload sar2html.py updateDb path traversal
- CVE-2026-110664 Premium Packages <= 7.2.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Order Notes
- CVE-2026-110662 Cross-site scripting in MxChat – AI Chatbot & Content Generation for WordPress
- CVE-2026-110661 CGNS through 4.5.2 Stack Out-of-Bounds Read via ADFI_read_node_header
- CVE-2026-110660 vgmstream through r2117 Stack Out-of-Bounds Read via G.722.1/Siren14 Decoder
- CVE-2026-11066 Security feature bypass in Chrome
- CVE-2026-110659 ELFIO through 3.12 NULL Pointer Dereference via relocation_section_accessor get_entry
- CVE-2026-110658 Sofia-SIP through 1.13.18 Heap Out-of-Bounds Read via msg_multipart_parse
- CVE-2026-110657 Khronos NNEF-Tools nnef through 1.0.10 and nnef-tools through 1.0.11 Path Traversal via Variable Label
- CVE-2026-110656 miniupnpc through 2.3.3 Heap Out-of-Bounds Read via minixml parseelt
- CVE-2026-110655 miniupnpc through 2.3.3 Heap Out-of-Bounds Read via minixml parseatt
- CVE-2026-110654 libzvbi through 0.2.45 Out-of-Bounds Write via Teletext DRCS convert_drcs
- CVE-2026-110653 Appointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter
- CVE-2026-110652 ONLYOFFICE DocumentServer before 10.0.0 SSRF via downloadfile isInJwtToken Bypass
- CVE-2026-110651 Swift Performance Lite < 2.3.7.4 - Author+ SQLi via Image Optimizer
- CVE-2026-110650 Thumbnail through 1.5 OS Command Injection via generate_thumbnail File Paths
- CVE-2026-11065 Use after free in Chrome
- CVE-2026-110649 Stills before 25.24.2 OS Command Injection via Media File Names
- CVE-2026-110648 @offactory/compress-fonts before 1.1.1 OS Command Injection via Font File Names
- CVE-2026-110647 Turnpress through 0.4.2 OS Command Injection via Crafted .docx File Names
- CVE-2026-110646 Beganovich snappdf 1.1.0 before 6.1.0 OS Command Injection on Windows via setUrl()
- CVE-2026-110645 Video-stitch before 2.0.0-beta.1 OS Command Injection via concat() and cut()
- CVE-2026-110644 nodejs-whisper through 0.3.1 OS Command Injection via convertToWavType
- CVE-2026-110643 transcribe2texts through 1.0.6 OS Command Injection via transcribeAudio audioPath
- CVE-2026-110642 xhtml2pdf before 0.2.19 OS Command Injection via startViewer File Name
- CVE-2026-110641 @runnerty/executor-decompress through 3.1.1 OS Command Injection via Archive File Name
- CVE-2026-110640 Whisper-node through 1.1.1 OS Command Injection via filePath and language
- CVE-2026-11064 Race condition in Chrome
- CVE-2026-110639 @mborne/extract before 0.2.1 OS Command Injection via archivePath and targetDir
- CVE-2026-110638 doc-recog through 1.1.6 OS Command Injection via DocData._readPDF File Path
- CVE-2026-110637 buildebooks before 0.2.2 OS Command Injection via kindlegen EPUB File Name
- CVE-2026-110636 pypdftk through 0.5 OS Command Injection via PDF and Output Paths
- CVE-2026-110635 webp-converter before 3.0.0 OS Command Injection via File Names and Options
- CVE-2026-110634 git-diff before 2.0.7 OS Command Injection via gitDiff Input Strings
- CVE-2026-110633 MyReport Updater through 2.1.1 Local Privilege Escalation via Updater Service
- CVE-2026-110632 Report One MyReport Updater through 2.1.1 Unauthenticated gRPC Service RCE
- CVE-2026-110631 Komodo through 2.3.3 Periphery Agent Unauthenticated RCE via Default Configuration
- CVE-2026-110630 VentureDrake Laravel CRM before 2.4.0 Privilege Escalation via Unscoped Role Assignment
- CVE-2026-11063 Security feature bypass in Chrome
- CVE-2026-110629 VentureDrake Laravel CRM before 2.4.0 Missing Authorization via Livewire Actions
- CVE-2026-110628 Kan 0.5.5 through 0.6.0 Unauthenticated SSRF via /api/download/attatchment
- CVE-2026-110627 ClipBucket v5 through 5.5.3-#206 Reflected XSS via add_todo val Parameter
- CVE-2026-110626 ClipBucket v5 through 5.5.3-#206 Reflected XSS via edit_language in language_settings.php
- CVE-2026-110625 ClipBucket v5 through 5.5.3-#206 Reflected XSS via type Parameter in flagged_item.php
- CVE-2026-110624 Papermerge Core through 3.5.3 Missing Authorization via /tags/all and /document-types/all
- CVE-2026-110623 Papermerge Core through 3.5.3 Missing Authorization in Shared Nodes API
- CVE-2026-110622 Papermerge Core through 3.5.3 Missing Authorization in Page Management and OCR Endpoints
- CVE-2026-110621 Swetrix Cloud before 5.1.0 Missing Authorization via POST /project/organisation/:orgId
- CVE-2026-110620 Formbricks before 4.9.0 Cross-Organization IDOR in Server Actions via organizationId
- CVE-2026-11062 Security feature bypass in Chrome
- CVE-2026-110619 frp 0.41.0 through 0.71.1 Missing Authentication for pprof Debug Endpoints
- CVE-2026-110618 SmsForwarder through 3.5.0 Missing Authentication in HTTP Server Remote Control API
- CVE-2026-110617 we-mp-rss through 1.5.3 Missing Authorization via Export File Download Endpoint
- CVE-2026-110616 NullHub through 2026.5.29 Missing Authentication for /api Management API
- CVE-2026-110615 jshERP through 3.6 Missing Authorization via /user/batchSetStatus
- CVE-2026-110614 Yiuman citrus through 0.15.0 ORDER BY SQL Injection via sortBy Parameter
- CVE-2026-110613 youlai-mall through commit 9f62de8 Order Information Disclosure via App Order List
- CVE-2026-110612 vlife through 2.0.1 Authentication Bypass via Hardcoded JWT Secret in TokenUtil
- CVE-2026-110611 REBUILD through 4.5.0 Authorization Bypass via aibot2 Chat Endpoints chatid
- CVE-2026-110610 ruoyi-vue-pro through 2026.09 SSRF via Midjourney referImageUrl and notify imageUrl
- CVE-2026-11061 Memory corruption in Chrome
- CVE-2026-110609 Dromara Skyeye through commit 65d3ddcede70 SQL Injection via keyword Parameter
- CVE-2026-110608 BizSpring Shop through commit cf22d39daaf1 IDOR via /member/order Cancel and Receive
- CVE-2026-110607 BizSpring Shop through commit cf22d39daaf1 Payment Bypass via test_post_pay Endpoint
- CVE-2026-110606 LibreCAD libdxfrw through LC2.2.0 Stack Out-of-Bounds Read via dwgReader18::readFileHeader
- CVE-2026-110605 libschrift through 0.10.2 Divide by Zero via unitsPerEm in draw_line
- CVE-2026-110604 Mini-XML 4.0.0 through 4.0.6 Stack Out-of-Bounds Write via mxml_strtod()
- CVE-2026-110603 LASzip through 3.5.0 Invalid Free via Truncated VLR Header in laszip_read_header
- CVE-2026-110602 libmspack through 0.11alpha Uninitialized Pointer Free via kwajd_open Error Path
- CVE-2026-110601 libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 Heap Out-of-Bounds Write via GIF
- CVE-2026-110600 xlsxio through 0.2.37 NULL Pointer Dereference via Worksheet Relationship Without Id
- CVE-2026-11060 Use after free in Chrome
- CVE-2026-1106 Chamilo LMS Legal Consent SocialController.php deleteLegal improper authorization
- CVE-2026-110599 L-SMASH through 2.14.5 Double Free in HEVC and H.264 Importer Probe
- CVE-2026-110598 Libyal libpff through 20260926 heap out-of-bounds read via libpff_record_entry_get_multi_value
- CVE-2026-110597 Tinyexr through 3.2.0 Heap Out-of-Bounds Read via ParseEXRMultipartHeaderFromMemory
- CVE-2026-110596 quirc through 1.2 Denial of Service via find_alignment_pattern Spiral Search
- CVE-2026-110595 BottleCRM 0.45 through 1.14.5 Memory Exhaustion via Contact and Case CSV Import
- CVE-2026-110594 BottleCRM 0.43 through 1.14.5 ReDoS via Case Routing Rule Regex
- CVE-2026-110593 BottleCRM through 1.14.5 Server-Side Template Injection via Account Email create_mail
- CVE-2026-110592 BottleCRM 0.30 through 1.14.5 HTML Injection via Custom Invoice PDF Template
- CVE-2026-110591 OW2 ASM 1.4.3 before 9.11 Excessive Resource Consumption via Analyzer
- CVE-2026-110590 Missing authorization in Klarna for WooCommerce
- CVE-2026-11059 Use after free in Chrome
- CVE-2026-11058 Integer overflow in Chrome
- CVE-2026-11057 Information disclosure in Chrome
- CVE-2026-11056 Security feature bypass in Chrome
- CVE-2026-11055 Use after free in Chrome
- CVE-2026-110541 Command injection in PowerProtect Data Domain
- CVE-2026-110540 Missing authorization in PowerProtect Data Domain Management Center
- CVE-2026-11054 Use after free in Chrome