Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 939 of 1013.
- CVE-2026-110032 Salon Booking System < 10.31.11 - Salon Staff+ Administrator Role Demotion via Customer Editor
- CVE-2026-110031 Privilege escalation in Salon Booking System
- CVE-2026-110030 Hide Price Until Login < 1.1.2 - Unauthenticated Account Creation via Guest Registration
- CVE-2026-11003 Use after free in Chrome
- CVE-2026-110029 Squeeze < 1.8.1 - Subscriber+ Missing Authorization via squeeze_restore_attachment
- CVE-2026-110026 Tasty Recipes Lite 1.2 - 1.2.10 - Contributor+ Taxonomy Term Creation, Renaming and Deletion
- CVE-2026-110025 slackero phpwcms Extension Check cnt23.article.inc.php unrestricted upload
- CVE-2026-110024 @fastify/jwt vulnerable to missing token expiration when per-call options drop global defaults
- CVE-2026-110020 Missing authorization in Rich Showcase for Google Reviews
- CVE-2026-11002 Use after free in Chrome
- CVE-2026-110019 Missing authorization in Bulk Page Generator – LPagery
- CVE-2026-110018 aBlocks <= 2.17.0 - Authenticated (Contributor+) Privilege Escalation to 'roleSlug' Block Attribute
- CVE-2026-110017 Cross-site scripting in Quick PayPal Payments: Payment Button & Form
- CVE-2026-110015 Salon Booking System < 10.31.9 - Administrator Account Creation via CSRF
- CVE-2026-110014 Salon Booking System < 10.31.9 - Unauthenticated Booking Creation with Arbitrary Customer ID and Status
- CVE-2026-110013 Salon Booking System < 10.31.9 - Unauthenticated Salon REST API Access via Predictable Access-Token
- CVE-2026-110012 Salon Booking System < 10.31.3 - Subscriber+ Booking PII Disclosure via REST bookings/upcoming
- CVE-2026-110011 Missing authorization in MB Custom Post Types & Custom Taxonomies
- CVE-2026-110010 MB Custom Post Types & Custom Taxonomies 2.0.2 - 2.12.2 - Unauthenticated Settings Reset via 'mbcpt-force' Parameter
- CVE-2026-11001 Other in Chrome
- CVE-2026-110008 @fastify/oauth2 vulnerable to Login CSRF via OAuth state cookie not cleared after callback
- CVE-2026-110005 Moghtech Komodo contains an OS command injection vulnerability
- CVE-2026-110002 Snazzy Social Media Feed <= 2.5 - Unauthenticated Arbitrary File Upload via 'pluginURL' Parameter
- CVE-2026-11000 Use after free in Chrome
- CVE-2026-109999 AI Marketing Expert <= 1.2.8 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'name' Parameter
- CVE-2026-109998 Mang Board <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting via 'content' Parameter via content_reply AJAX
- CVE-2026-109995 Advanced Views <= 3.9.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content
- CVE-2026-109990 Cross-site scripting in Flying Scripts: Delay JavaScript to Improve Site Speed & Performance
- CVE-2026-10999 Integer overflow in Chrome
- CVE-2026-109989 Themify Popup <= 1.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via 'popup_width_unit' Parameter
- CVE-2026-109988 Cross-site scripting in Product Addons for Woocommerce – Product Options with Custom Fields
- CVE-2026-109987 PixelYourSite (Free & Pro) - Unauthenticated Stored XSS via Cookie
- CVE-2026-109985 Cross-site scripting in xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN
- CVE-2026-109983 YMC Filter <= 3.12.19 - Authenticated (Author+) Stored DOM-Based Cross-Site Scripting via 'post_title' Parameter
- CVE-2026-109982 MB Custom Post Types & Custom Taxonomies < 2.12.2 - Subscriber+ Missing Authorization via CPT UI Migration
- CVE-2026-109980 Missing authorization in Related Posts for WordPress
- CVE-2026-10998 Memory corruption in Chrome
- CVE-2026-109979 Missing authorization in Related Posts for WordPress
- CVE-2026-109978 Cross-site scripting in Cozy Blocks – Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox
- CVE-2026-109976 Clevis: clevis: integer underflow in pkcs#11 data socket handler crashes daemon on unbound client connection
- CVE-2026-109975 Cozy Blocks <= 2.2.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon.view' Block Attribute
- CVE-2026-109974 Cross-site scripting in All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos
- CVE-2026-109972 s2Member <= 261011 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date_format' Shortcode Attribute
- CVE-2026-109971 Clevis: clevis: pkcs#11 token pin exposed on command line via pkcs11-tool
- CVE-2026-109970 Clevis: clevis: pkcs#11 token pin written to world-readable file
- CVE-2026-10997 Security feature bypass in Chrome
- CVE-2026-109969 Clevis: clevis: no authentication on pkcs#11 af_unix sockets allows key injection under permissive umask
- CVE-2026-109968 Clevis: clevis: pkcs#11 luks passphrase logged in plaintext to world-readable file
- CVE-2026-109967 yt-dlp-web-ui through 4.0.0 NULL Pointer Dereference DoS via Service.Formats
- CVE-2026-109966 yt-dlp-web-ui through 4.0.0 Argument Injection via Service.Formats JSON-RPC Method
- CVE-2026-109965 Serena before 2.0.0 Symlink Following in File Tools Allows Access Outside Project Root
- CVE-2026-109964 ImageMagick before 7.1.2-33 and 6.9.13-58 Heap Buffer Underwrite in PICT Decoder
- CVE-2026-109963 Froxlor before 2.3.14 IDOR in Email Template Editor via admin_templates.php
- CVE-2026-109962 Froxlor 0.10.0 before 2.3.14 Missing Authorization in MysqlServer and Cronjobs API
- CVE-2026-109961 Froxlor 0.10.0 before 2.3.14 Newline Injection via Ftps.add additional_members
- CVE-2026-109960 Froxlor 2.0.0 before 2.3.14 Stored XSS via Customer Theme Value
- CVE-2026-10996 Security feature bypass in Chrome
- CVE-2026-109959 EspoCRM 4.0.0 before 10.0.7 Field-Level Security Bypass via Note Read Endpoint
- CVE-2026-109958 EspoCRM 4.0.0 before 10.0.7 Field-Level Access Bypass via Address-Book Search
- CVE-2026-109957 EspoCRM before 10.0.7 IDOR via Import attachmentId Parameter
- CVE-2026-109956 NLTK through 3.10.3 Path Traversal via WekaClassifier Model Path
- CVE-2026-109955 Hono 4.12.4 before 4.13.11 Middleware Bypass via serveStatic Double Decoding
- CVE-2026-109954 Parse Server 9.0.0 before 9.10.2-alpha.5 Transactional Batch Request Write Interference
- CVE-2026-109953 FreeRDP 3.0.0 before 3.32.0 Cleartext Credential Disclosure via /restricted-admin
- CVE-2026-109952 FreeRDP 3.0.0 before 3.32.0 Security Protocol Downgrade via Negotiation Response
- CVE-2026-109951 FreeRDP 3.17.1 before 3.32.0 Heap Buffer Over-Read via Proxy DRDYNVC Channel Name
- CVE-2026-109950 FreeRDP 3.0.0 before 3.32.0 Heap Out-of-Bounds Read via RD Gateway Messages
- CVE-2026-10995 Memory corruption in Chrome
- CVE-2026-109949 FreeRDP 3.0.0 before 3.32.0 PIN Brute-Force via Virtual Smartcard
- CVE-2026-109948 FreeRDP 3.0.0 before 3.32.0 Memory Disclosure via SCardTransmit Smartcard Redirection
- CVE-2026-109947 FreeRDP 3.20.1 before 3.32.0 Unbounded Allocation via drive_process_irp_read
- CVE-2026-109946 FreeRDP 3.11.0 before 3.32.0 Reachable Assertion via AVC444 Odd Region Width
- CVE-2026-109945 FreeRDP 3.0.0 before 3.32.0 Smartcard Use-After-Free via Concurrent Disconnect and Transmit
- CVE-2026-109944 FreeRDP 3.0.0 before 3.32.0 Reachable Assertion via Stale Smartcard Handle
- CVE-2026-109943 FreeRDP 3.29.0 before 3.32.0 Double Free via Async-Update Polygon Order
- CVE-2026-109942 FreeRDP 2.3.0 before 3.32.0 NULL Pointer Dereference via RD Gateway Close Channel Packet
- CVE-2026-109941 FreeRDP 2.3.0 before 3.32.0 Infinite Loop via RD Gateway Chunked Response
- CVE-2026-109940 FreeRDP 3.0.0-beta1 before 3.32.0 Stack Buffer Overflow via PKCS#11 Key Name
- CVE-2026-10994 Information disclosure in Chrome
- CVE-2026-109939 FreeRDP 3.27.1 before 3.32.0 NULL Pointer Dereference via Cache Bitmap V3 Order
- CVE-2026-109938 FreeRDP 3.11.0 before 3.32.0 Integer Overflow via Mapped Video Geometry Update
- CVE-2026-109937 Otter Blocks < 3.2.3 - Unauthenticated Open Redirect via Stripe Checkout Block
- CVE-2026-109936 Otter Blocks < 3.2.8 - Unauthenticated Stored XSS via Dynamic Content Render Filter
- CVE-2026-109935 Otter Blocks < 3.2.8 - Unauthenticated Restricted Block Content Disclosure via REST API
- CVE-2026-109934 Otter Blocks 3.1.1 - 3.2.7 - Unauthenticated Non-Public Content Disclosure via REST API
- CVE-2026-109933 Otter Blocks < 3.2.8 - Contributor+ Stored XSS via Block Style Attributes
- CVE-2026-109932 undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering
- CVE-2026-109931 Infility Global < 2.16.25 - Unauthenticated Google Translate API Key Update
- CVE-2026-109930 MAIO < 7.3.22 - Unauthenticated Crawl Analytics Disclosure via Hardcoded API Key
- CVE-2026-10993 Memory corruption in Chrome
- CVE-2026-109927 CM HIPAA Forms < 3.3.2 - hipaa_forms+ Privilege Escalation via cm_hipaa_update_user_role
- CVE-2026-109926 Productive Commerce < 1.1.49 - Subscriber+ Arbitrary Plugin Activation
- CVE-2026-109924 undici vulnerable to Denial of Service via unbounded memory in the EventSource parser
- CVE-2026-10992 Information disclosure in Chrome
- CVE-2026-10991 Use after free in Chrome
- CVE-2026-109901 WordPress CP Multi View Event Calendar plugin <= 1.4.41 - SQL Injection vulnerability
- CVE-2026-10990 Use after free in Chrome
- CVE-2026-1099 Cross-site scripting in Administrative Shortcodes
- CVE-2026-109898 WordPress WP Event Solution plugin <= 4.1.25 - Broken Access Control vulnerability
- CVE-2026-109897 WordPress Strong Testimonials plugin <= 3.3.12 - Broken Access Control vulnerability