Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 938 of 1013.
- CVE-2026-110162 Use after free in Chrome
- CVE-2026-110161 Use after free in Chrome
- CVE-2026-110160 Missing authorization in Chrome
- CVE-2026-11016 Security feature bypass in Chrome
- CVE-2026-110159 Missing authorization in Chrome
- CVE-2026-110158 Use after free in Chrome
- CVE-2026-110157 Use after free in Chrome
- CVE-2026-110156 Code injection in Chrome
- CVE-2026-110155 Memory corruption in Chrome
- CVE-2026-110154 Use after free in Chrome
- CVE-2026-110153 Use after free in Chrome
- CVE-2026-110152 Memory corruption in Chrome
- CVE-2026-110151 Use after free in Chrome
- CVE-2026-110150 Privilege escalation in Chrome
- CVE-2026-11015 Memory corruption in Chrome
- CVE-2026-110149 Use after free in Chrome
- CVE-2026-110148 Use after free in Chrome
- CVE-2026-110147 Use after free in Chrome
- CVE-2026-110146 Information disclosure in Chrome
- CVE-2026-110145 Use after free in Chrome
- CVE-2026-110144 Missing authorization in Chrome
- CVE-2026-110143 Information disclosure in Chrome
- CVE-2026-110142 Use after free in Chrome
- CVE-2026-110141 Information disclosure in Chrome
- CVE-2026-110140 Memory corruption in Chrome
- CVE-2026-11014 Security feature bypass in Chrome
- CVE-2026-110139 Use after free in Chrome
- CVE-2026-110138 Use after free in Chrome
- CVE-2026-110137 Use after free in Chrome
- CVE-2026-110136 Use after free in Chrome
- CVE-2026-110135 OTP Login & Register Woocommerce < 2.7.3 - Unauthenticated Account Takeover via OTP Brute Force
- CVE-2026-110131 ThriveX-Server through 4.0 Missing Authorization via Article Retrieval Endpoints
- CVE-2026-110130 Dockhand before 1.0.45 Authentication Bypass via Static-Asset Check
- CVE-2026-11013 Information disclosure in Chrome
- CVE-2026-110129 fuintCatering through commit 122c9e6 IDOR via /clientApi/refund/detail
- CVE-2026-110128 fuint through commit 4c4bc8a Missing Authentication via /clientApi/order/detail
- CVE-2026-110127 waynboot-mall through 2.0.0 IDOR via Mobile Cart Endpoints
- CVE-2026-110126 waynboot-mall through 2.0.0 IDOR via Mobile Address Endpoints
- CVE-2026-110125 waynboot-mall through 2.0.0 IDOR via Mobile Order Endpoints
- CVE-2026-110124 FastBee through 2.1.0 IDOR via DeviceController /iot/device Endpoints
- CVE-2026-110123 Makunet maku-boot 4.3.0 through 5.0.0 Missing Authorization via Mail and SMS Config Endpoints
- CVE-2026-110122 PickMall lilishop through 4.4 IDOR via Goods Freight Endpoint
- CVE-2026-110121 PickMall lilishop through 4.4 IDOR via Goods Edit Endpoint
- CVE-2026-110120 yshopmall through 2.0.0 IDOR via After-Sales API in StoreAfterSalesController
- CVE-2026-11012 Use after free in Chrome
- CVE-2026-110119 yshopmall through 2.0.0 IDOR via Member Address API in UserAddressController
- CVE-2026-110118 WorkFlow-Engine through 9.6.11 Missing Authorization via flowableui buttonOperation Endpoints
- CVE-2026-110117 SmartAdmin through 3.30.0 Missing Authorization via AdminProtectController
- CVE-2026-110116 Digital-Infrastructure 9.6.5 through 9.6.11 Path Traversal via fileManager storeFile
- CVE-2026-110115 Digital-Infrastructure 9.6.5 through 9.6.11 Path Traversal via fileManager retrieveFileStream
- CVE-2026-110114 oms-erp through PRE Missing Authentication via skyer-goods es-test Endpoints
- CVE-2026-110113 PublicCMS through V6.202608.a IDOR via tradeAddress/save Endpoint
- CVE-2026-110112 Dockhand before 1.0.50 OIDC Privilege Escalation via Missing Token Claim Validation
- CVE-2026-110111 Xen Orchestra before 6.9.0 Privilege Escalation via Prototype Pollution in vm.importFromEsxi
- CVE-2026-110110 JetLinks Community through 2.10.0 Missing Authorization via Alarm Enable/Disable Endpoints
- CVE-2026-11011 Security feature bypass in Chrome
- CVE-2026-110109 JetLinks Community through 2.10.0 Missing Authorization via Product-Level Transparent Codec Save
- CVE-2026-110108 MateCloud through 5.0.8 Missing Authorization via /api/v1/admin/storage API
- CVE-2026-110107 RuoYi-Cloud-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId}
- CVE-2026-110106 RuoYi-Vue-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId}
- CVE-2026-110105 B3log Symphony through 3.6.4 Missing Authorization in Admin Console Routes
- CVE-2026-110104 novel through 3.5.0 Unsalted MD5 Password Storage
- CVE-2026-110103 bbs-go through 4.4.6 Stored XSS via Image Upload Content-Type
- CVE-2026-110102 powerlevel10k through 1.20.0 Download of Code Without Integrity Check in gitstatus Installer
- CVE-2026-110101 Koillection through 1.8.4 Stored XSS via Datum File Attachment Uploads
- CVE-2026-110100 Jorani before 1.0.4 Missing Authorization and SSRF via Contracts::import()
- CVE-2026-11010 Use after free in Chrome
- CVE-2026-1101 Improper Validation of Specified Quantity in Input in GitLab
- CVE-2026-110099 Jorani before 1.0.4 Missing Authorization in HR Export Actions
- CVE-2026-110098 Jorani before 1.0.4 Insecure Direct Object Reference in Leave and Overtime Requests
- CVE-2026-110097 Ikaros 1.2.0 through 1.2.5 TOTP Authentication Bypass via Temp Token
- CVE-2026-110095 fast-uri vulnerable to improper path equivalence in relative reference normalization
- CVE-2026-11009 Use after free in Chrome
- CVE-2026-110084 Adobe Experience Manager | XML Injection (aka Blind XPath Injection) (CWE-91)
- CVE-2026-110083 SQL injection in Adobe Experience Manager 6.5
- CVE-2026-110082 Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)
- CVE-2026-110081 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-110080 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- CVE-2026-11008 Information disclosure in Chrome
- CVE-2026-110079 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- CVE-2026-110078 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- CVE-2026-110077 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- CVE-2026-110076 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- CVE-2026-110075 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- CVE-2026-110074 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- CVE-2026-110073 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-110071 Mang Board <= 2.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' Shortcode Attribute
- CVE-2026-110070 Modern Events Calendar Lite < 7.36.4 - Subscriber+ Arbitrary Post Modification via IDOR
- CVE-2026-11007 Information disclosure in Chrome
- CVE-2026-110069 Missing authorization in Modern Events Calendar Lite
- CVE-2026-110063 VM Inspector for Azure Virtual Machines Elevation of Privilege Vulnerability
- CVE-2026-11006 Memory corruption in Chrome
- CVE-2026-11005 Memory corruption in Chrome
- CVE-2026-11004 Memory corruption in Chrome
- CVE-2026-110039 Smush < 4.3.4 - Admin+ Network-Wide Plugin Settings Update on Multisite
- CVE-2026-110037 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-110036 Device-mapper-persistent-data: device-mapper-persistent-data: denial of service via crafted block indices
- CVE-2026-110035 Salon Booking System < 10.31.11 - Subscriber+ Coupon Code Disclosure via Discounts REST Route
- CVE-2026-110034 Salon Booking System < 10.31.11 - Unauthenticated Negative Booking Total via Discount Code
- CVE-2026-110033 Salon Booking System < 10.31.11 - Salon Staff+ Stored XSS and SSRF via Salon REST 'image_url'