Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 937 of 1013.
- CVE-2026-110287 Missing authorization in Server
- CVE-2026-110285 WP Stripe Checkout < 1.2.2.62 - Unauthenticated Forged Payment Completion via an Unset Webhook Signing Secret
- CVE-2026-110284 LifterLMS <= 10.3.1 - Authenticated (Contributor+) Local File Inclusion via 'lifterlms_checkout' Shortcode Attributes
- CVE-2026-11028 Use after free in Chrome
- CVE-2026-110270 OW2 ASM 3.0 before 9.11 Exponential Memory Allocation in JSRInlinerAdapter
- CVE-2026-11027 Information disclosure in Chrome
- CVE-2026-110268 Post Export Import with Media <= 1.17.2 - Authenticated (Administrator+) Path Traversal via 'theme_slug' Parameter
- CVE-2026-110264 Integer Overflow or Wraparound in GitLab
- CVE-2026-110263 OW2 ASM 3.0 before 9.11 Uncontrolled Recursion in SignatureReader
- CVE-2026-110262 OW2 ASM 3.1 before 9.11 Excessive Memory Allocation in AdviceAdapter
- CVE-2026-110261 OW2 ASM 3.0 before 9.11 Excessive CPU Consumption via ClassWriter COMPUTE_FRAMES
- CVE-2026-110260 OW2 ASM 3.0 before 9.11 Quadratic Memory Allocation via Exception Handlers
- CVE-2026-11026 Security feature bypass in Chrome
- CVE-2026-110259 OW2 ASM 3.0 before 9.11 Uncontrolled Recursion via ClassWriter.replaceAsmInstructions()
- CVE-2026-110258 OW2 ASM 3.0 before 9.11 Excessive Memory Allocation via Multiple RET Instructions
- CVE-2026-110257 OW2 ASM 5.0 before 9.11 Excessive Memory Allocation via BootstrapMethods Attribute
- CVE-2026-110256 Dockhand before 1.0.19 Username Enumeration via LDAP Injection in tryLdapAuth
- CVE-2026-110255 Dockhand before 1.0.43 SSRF via /api/templates/compose Endpoint
- CVE-2026-110254 Dockhand before 1.0.45 SSRF via IPv6 Transition Address Bypass in ipCategory
- CVE-2026-110253 weForms <= 1.6.28 - Unauthenticated Limited Media File Deletion via 'wpuf_files' Parameter
- CVE-2026-110252 WPeMatico RSS Feed Fetcher <= 2.9 - Unauthenticated Stored Cross-Site Scripting via RSS Feed Content Import
- CVE-2026-11025 Security feature bypass in Chrome
- CVE-2026-110249 Denial-of-service in the Exchange email component
- CVE-2026-110248 Insertion of sensitive information into log files in Amazon SageMaker Python SDK git_utils[.]py
- CVE-2026-110247 Integer overflow in libmime buffer growth could lead to heap corruption
- CVE-2026-110245 Langflow OSS is affected by multiple vulnerabilities
- CVE-2026-110244 Langflow OSS is affected by multiple vulnerabilities
- CVE-2026-110243 Kiloview E3 NDI Encoder OS Command Injection
- CVE-2026-110240 Lancet through 2.3.9 SSRF Protection Bypass via netutil.IsInternalIP
- CVE-2026-11024 Memory corruption in Chrome
- CVE-2026-110239 Rapyd Admin before 9.20.0 Stored XSS via rich-text Component
- CVE-2026-110238 Rapyd Admin 9.0.0 before 9.20.0 Authorization Bypass via UsersModalEditEmbed Component
- CVE-2026-110237 Vifm 0.8.1-beta through 0.14.4 Unverified IPC FIFO Ownership Allows Cross-User Command Execution
- CVE-2026-110236 KDE Dolphin 24.08.0 through 26.08.2 OS Command Injection via Crafted Folder Name
- CVE-2026-110235 MP Manager through 1.1.0 Path Traversal via Archive Extraction sanitizeEntryName Bypass
- CVE-2026-110234 Elio through 1.13.0 Insecure Temporary File Creation in External Preview Command Capture
- CVE-2026-110233 rovr through 0.10.3 OS Command Injection via Unquoted Path to cmd.exe
- CVE-2026-110232 Fossify File Manager through 1.6.2 Zip Slip Path Traversal via DecompressActivity
- CVE-2026-110231 muCommander through 1.6.2 Path Traversal via Archive Extraction to FTP/SFTP
- CVE-2026-110230 XBackBone through 3.8.2 Missing Authorization via Upload Vanity Endpoint
- CVE-2026-11023 Security feature bypass in Chrome
- CVE-2026-110229 QloApps through 1.7.0 Missing Hotel Access Restriction in Credit Slips
- CVE-2026-110228 wallabag 2.6.13 through 2.6.14 Stored XSS via Failed HTML Import Upload
- CVE-2026-110227 WordPress Restricted Site Access plugin <= 7.6.2 - Broken Access Control vulnerability
- CVE-2026-110226 QloApps through 1.7.0 Authorization Bypass via id_hotel in Room Type Creation
- CVE-2026-110225 Shaarli through 0.16.9 SSRF via Thumbnail Retrieval update-thumbnail Route
- CVE-2026-110224 QloApps through 1.7.0 Reflected XSS via Search Alias Validation Errors
- CVE-2026-110223 Kavita 0.9.0 through 0.9.1.4 SSRF Blocklist Bypass via upload-cbl-file Endpoint
- CVE-2026-110222 Razorpay IFSC Ruby gem through 2.0.62 SSRF via IFSC lookup
- CVE-2026-110221 QloApps through 1.7.0 Reflected XSS via Advanced Price Rule Name and Impact Value
- CVE-2026-110220 Kubeflow Model Registry through 0.3.17 SSRF via InferenceService Controller URL Annotation
- CVE-2026-11022 Security feature bypass in Chrome
- CVE-2026-110219 QloApps through 1.7.0 Reflected XSS via Additional Facility Price Field
- CVE-2026-110218 Aureus ERP through 1.6.0 Unpublished Blog Post Disclosure via Direct URL
- CVE-2026-110217 vhr through commit 03abbd3 Information Disclosure of Operator Password Hashes via GET /chat/hrs
- CVE-2026-110216 youlai-boot through 2.21.1 Missing Authorization in User Status Update Endpoint
- CVE-2026-110215 youlai-boot through 2.21.1 Missing Authorization in Role Menu Assignment Allows Privilege Escalation
- CVE-2026-110214 Snowy 3.6.5 Hard-coded Download Signature Key Allows Unauthenticated File Download
- CVE-2026-110213 ai-fusion-video through 1.2.0 Insecure Direct Object Reference in Generation Task Item Endpoints
- CVE-2026-110212 ai-fusion-video through 1.2.0 Path Traversal in Media Upload subDir Parameter
- CVE-2026-110211 SkillHub through 0.2.22 Missing Authorization in CLI Skill Delete Endpoint
- CVE-2026-110210 Phase Console through 2.77.3 Missing Authorization via secretHistory GraphQL Query
- CVE-2026-11021 Security feature bypass in Chrome
- CVE-2026-110209 ai-fusion-video through 1.2.0 Missing Authorization in Configuration Read Endpoints Exposes Stored Credentials
- CVE-2026-110208 Wukong AICRM through 20260610 Missing Authorization in System Configuration APIs Exposes Stored AI Provider Keys
- CVE-2026-110207 Wukong AICRM through 20260610 Missing Authorization in User and Role Management APIs
- CVE-2026-110206 Roo-Code through 3.54.0 Auto-Approve Bypass via Command Substitution at Command Position
- CVE-2026-110205 Roo-Code through 3.54.0 Auto-Approve Bypass via Glob Token Discarding Command Substitution
- CVE-2026-110204 Roo-Code through 3.54.0 Auto-Approve Bypass via Funsub Command Substitution
- CVE-2026-110203 Roo-Code through 3.54.0 Auto-Approve Bypass via Quote Masking Desynchronization
- CVE-2026-110202 Roo-Code through 3.54.0 Auto-Approve Bypass via Redirect Operator Stripping
- CVE-2026-110200 Langflow OSS is affected by multiple vulnerabilities
- CVE-2026-11020 Information disclosure in Chrome
- CVE-2026-1102 Allocation of Resources Without Limits or Throttling in GitLab
- CVE-2026-110196 Langflow OSS is affected by multiple vulnerabilities
- CVE-2026-110193 Langflow OSS is affected by multiple vulnerabilities
- CVE-2026-110192 Langflow OSS is affected by multiple vulnerabilities
- CVE-2026-110191 Missing authorization in Product Delivery Date for WooCommerce
- CVE-2026-110190 Langflow OSS is affected by multiple vulnerabilities
- CVE-2026-11019 Security feature bypass in Chrome
- CVE-2026-110186 Langflow OSS is affected by multiple vulnerabilities
- CVE-2026-110185 Path traversal in Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More
- CVE-2026-110184 Newsmatic <= 1.5.0 - Unauthenticated SQL Injection via 'slug' Parameter
- CVE-2026-110183 PostgreSQL Anonymizer: statistics can expose some of the original data after statistic masking
- CVE-2026-110182 PostgreSQL Anonymizer: anon.partial() and anon.partial_email() can reveal the whole data
- CVE-2026-110181 PostgreSQL Anonymizer: Function declared with SQL-standard syntax leak anonymized data
- CVE-2026-110180 fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization
- CVE-2026-11018 Security feature bypass in Chrome
- CVE-2026-110179 affiliate-toolkit < 3.8.9 - Editor+ SQL Injection via orderby Parameter
- CVE-2026-110172 Use after free in Chrome
- CVE-2026-110171 Use after free in Chrome
- CVE-2026-110170 Use after free in Chrome
- CVE-2026-11017 Security feature bypass in Chrome
- CVE-2026-110169 Use after free in Chrome
- CVE-2026-110168 Use after free in Chrome
- CVE-2026-110167 Use after free in Chrome
- CVE-2026-110166 Memory corruption in Chrome
- CVE-2026-110165 Use after free in Chrome
- CVE-2026-110164 Use after free in Chrome
- CVE-2026-110163 Use after free in Chrome