Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 936 of 1013.
- CVE-2026-110537 Essential Addons for Elementor < 6.8.7 - Admin+ Cross-Site User Approval State Change via Bulk Action
- CVE-2026-110536 D-Link DIR-868L HNAP CGI cgibin system os command injection
- CVE-2026-110527 WP User Manager 2.9 - 2.9.19 - Unauthenticated Account Creation via Stripe Registration Payment Bypass
- CVE-2026-110524 Copy Anything to Clipboard < 5.5.5 - Contributor+ Stored XSS via 'success-text' Shortcode Attribute
- CVE-2026-110523 Business logic in WP User Manager
- CVE-2026-11052 Memory corruption in Chrome
- CVE-2026-110514 WPZOOM Portfolio < 1.4.34 - Contributor+ Arbitrary Post/Page Type Overwrite via IDOR
- CVE-2026-110510 Essential Addons for Elementor < 6.8.7 - Author+ Content Injection via Pricing Table and Post Timeline Title Tag
- CVE-2026-11051 Memory corruption in Chrome
- CVE-2026-110509 Essential Addons for Elementor < 6.8.7 - Unauthenticated Private Post Meta Disclosure via load_more AJAX Handler
- CVE-2026-110508 Essential Addons for Elementor 6.7.3 - 6.8.6 - Unauthenticated Registration Approval Bypass via OTP Verification
- CVE-2026-110507 Page Builder by SiteOrigin < 2.38.0 - Contributor+ Sensitive Data Disclosure via Post Loop Widget Query Arguments
- CVE-2026-110506 Page Builder by SiteOrigin < 2.38.0 - Contributor+ Stored XSS via panels_info.class
- CVE-2026-110505 Enable SVG, WebP, and ICO Upload < 1.1.6 - Author+ Stored XSS via SMIL Animation Bypass
- CVE-2026-110504 Enable SVG, WebP, and ICO Upload 1.1.3 - 1.1.5 - Author+ Stored XSS via SVG Sanitization Bypass
- CVE-2026-11050 Use after free in Chrome
- CVE-2026-1105 EasyCMS UserAction.class.php sql injection
- CVE-2026-110499 Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit
- CVE-2026-110494 Gitea release attachment re-linking of issue attachments
- CVE-2026-110491 Kiloview E3 NDI Encoder NULL Pointer Dereference
- CVE-2026-11049 Use after free in Chrome
- CVE-2026-11048 Security feature bypass in Chrome
- CVE-2026-110475 Improper Authentication Vulnerability in CreditNirvana Collections Platform
- CVE-2026-110474 Hardcoded API Key Vulnerability in CreditNirvana Agentic AI Call Centre application
- CVE-2026-11047 Security feature bypass in Chrome
- CVE-2026-110467 WisdomGarden｜Tronclass - Insecure Direct Object Reference
- CVE-2026-110466 WisdomGarden｜Tronclass - Sensitive Data Exposure
- CVE-2026-110465 WisdomGarden｜Tronclass - Insecure Direct Object Reference
- CVE-2026-11046 Code injection in Chrome
- CVE-2026-110459 Missing authorization in UniFi Protect AI Key
- CVE-2026-110458 Path traversal in UniFi Protect AI Key
- CVE-2026-110457 Path traversal in UniFi Protect AI Key
- CVE-2026-110456 Missing authorization in UniFi Protect AI Key
- CVE-2026-110455 Command injection in UniFi Protect AI Key
- CVE-2026-110454 Missing authorization in UniFi Protect AI Key
- CVE-2026-110453 Missing authorization in Nix
- CVE-2026-110452 Misconfiguration in Nix
- CVE-2026-110451 Security feature bypass in Nix
- CVE-2026-110450 Privilege escalation in Nix
- CVE-2026-11045 Information disclosure in Chrome
- CVE-2026-110449 Integer overflow in Nix
- CVE-2026-110447 Collabora Online – Built-in CODE Server OS Command Injection
- CVE-2026-110445 TEAMPLUS TECHNOLOGY｜TeamPlus Messenger - Code Injection
- CVE-2026-110444 TEAMPLUS TECHNOLOGY｜TeamPlus Messenger - Code Injection
- CVE-2026-11044 Integer overflow in Chrome
- CVE-2026-11043 Memory corruption in Chrome
- CVE-2026-11042 Use after free in Chrome
- CVE-2026-11041 Security feature bypass in Chrome
- CVE-2026-11040 Use after free in Chrome
- CVE-2026-1104 Missing authorization in FastDup – Fastest WordPress Migration & Duplicator
- CVE-2026-110392 Samsung QA-Board — Unauthenticated OS command injection via output redo/tuning
- CVE-2026-11039 Information disclosure in Chrome
- CVE-2026-110385 Code injection in Document Server
- CVE-2026-110384 WordPress Fancy Comments WordPress plugin <= 1.2.21 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-110383 Missing authorization in Electronic Signature Add-on for Fluent Forms
- CVE-2026-110382 WordPress Simply Schedule Appointments plugin <= 1.6.12.35 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-110381 WordPress Simply Schedule Appointments plugin <= 1.6.12.35 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-110380 WordPress WP Event Solution plugin <= 4.1.26 - Broken Access Control vulnerability
- CVE-2026-11038 Security feature bypass in Chrome
- CVE-2026-110379 WordPress Quiz Maker plugin <= 6.7.1.91 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-110378 WordPress Ninja Forms Signature Contract Add-On plugin <= 3.2.5 - Broken Access Control vulnerability
- CVE-2026-110377 WordPress Bopo – WooCommerce Product Bundle Builder plugin <= 1.2.3 - Broken Access Control vulnerability
- CVE-2026-110376 WordPress DEPART plugin <= 1.0.10 - Broken Access Control vulnerability
- CVE-2026-110375 WordPress Download Monitor plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-110374 WordPress Login with phone number plugin <= 1.8.77 - Broken Access Control vulnerability
- CVE-2026-110373 WordPress Login with phone number plugin <= 1.8.77 - Privilege Escalation vulnerability
- CVE-2026-110372 WordPress OttoKit plugin <= 1.1.40 - Privilege Escalation vulnerability
- CVE-2026-110371 WordPress Strong Testimonials plugin <= 3.3.12 - Broken Access Control vulnerability
- CVE-2026-110370 WordPress GS Pins for Pinterest plugin <= 1.9.2 - PHP Object Injection vulnerability
- CVE-2026-11037 Memory corruption in Chrome
- CVE-2026-110369 WordPress WordPress Team Members – GS Plugins plugin <= 2.8.2 - PHP Object Injection vulnerability
- CVE-2026-110367 WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access Control vulnerability
- CVE-2026-110366 WordPress Site Reviews plugin <= 8.3.4 - Broken Access Control vulnerability
- CVE-2026-110365 WordPress Advanced File Manager plugin <= 5.4.14 - Broken Access Control vulnerability
- CVE-2026-110364 Missing authorization in Flexible Quantity – Measurement Price Calculator for WooCommerce
- CVE-2026-110363 WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability
- CVE-2026-110362 WordPress PlanetStudio Payment Gateway plugin <= 1.3.3 - Broken Access Control vulnerability
- CVE-2026-110361 WordPress Infinite Uploads plugin <= 3.4.1 - Sensitive Data Exposure vulnerability
- CVE-2026-110360 WordPress Ajax Search Lite plugin <= 4.14.5 - Broken Access Control vulnerability
- CVE-2026-11036 Security feature bypass in Chrome
- CVE-2026-110359 Privilege escalation in Desktop Host
- CVE-2026-110354 Denial of service in HAProxy
- CVE-2026-110353 Denial of service in HAProxy
- CVE-2026-11035 Privilege escalation in Chrome
- CVE-2026-11034 Cross-site scripting in Chrome
- CVE-2026-11033 Information disclosure in Chrome
- CVE-2026-110324 Gitea private profile information disclosure through POST request
- CVE-2026-110322 HMS Networks PEAK-System PCAN Windows drivers Untrusted Pointer Dereference
- CVE-2026-11032 Information disclosure in Chrome
- CVE-2026-110314 WebSocket frames keep reaching the WebSock after a server-initiated close in Bandit
- CVE-2026-110311 Gitea draft release creation disclosing attachment metadata
- CVE-2026-110310 RSA PKCS#1 v1.5 padding oracle via legacy envelope key format downgrade in Amazon S3 Encryption Client for .NET
- CVE-2026-11031 Other in Chrome
- CVE-2026-110309 Langflow OSS is affected by multiple vulnerabilities
- CVE-2026-110306 fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding
- CVE-2026-11030 Use after free in Chrome
- CVE-2026-1103 AIKTP <= 5.0.04 - Missing Authorization to Authenticated (Subscriber+) Multiple Administrator Actions
- CVE-2026-110292 Missing authorization in PayPlug for WooCommerce (Official)
- CVE-2026-110290 Cross-site scripting in WebberZone Top 10 — Popular Posts
- CVE-2026-11029 Security feature bypass in Chrome