Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 941 of 1013.
- CVE-2026-109727 Use-after-free in the Audio/Video component
- CVE-2026-109726 Use-after-free in the SVG component
- CVE-2026-109725 Use-after-free in the DOM: Core & HTML component
- CVE-2026-109724 Use-after-free in the DOM: Core & HTML component
- CVE-2026-109723 Integer overflow in the Layout: Text and Fonts component
- CVE-2026-109722 JIT miscompilation in the JavaScript Engine: JIT component
- CVE-2026-109721 Incorrect boundary conditions in the JavaScript Engine: JIT component
- CVE-2026-109720 JIT miscompilation in the JavaScript: WebAssembly component
- CVE-2026-10972 Use after free in Chrome
- CVE-2026-109719 Race condition, use-after-free in the Graphics: CanvasWebGL component
- CVE-2026-109718 Use-after-free in the XML component
- CVE-2026-109717 Use-after-free in the DOM: Bindings (WebIDL) component
- CVE-2026-109716 Incorrect boundary conditions in the JavaScript Engine component
- CVE-2026-109715 Incorrect boundary conditions in the JavaScript Engine component
- CVE-2026-109714 Incorrect boundary conditions in the Layout component
- CVE-2026-109713 Use-after-free in the Crash Reporting component
- CVE-2026-109712 Sandbox escape due to uninitialized memory in the Graphics component
- CVE-2026-109711 Use-after-free in the Graphics: Canvas2D component
- CVE-2026-109710 Use-after-free in the Graphics: Text component
- CVE-2026-10971 Security feature bypass in Chrome
- CVE-2026-109709 Information disclosure, privilege escalation in the Security: Process Sandboxing component
- CVE-2026-109708 Sandbox escape due to incorrect boundary conditions in the Networking component
- CVE-2026-109707 Sandbox escape due to use-after-free in the Networking component
- CVE-2026-109706 Use-after-free in the Storage: IndexedDB component
- CVE-2026-109705 Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component
- CVE-2026-109704 Privilege escalation in the Application Update component
- CVE-2026-109703 WordPress WPGraphQL plugin <= 2.23.1 - Sensitive Data Exposure vulnerability
- CVE-2026-109702 WordPress Social Share Buttons plugin <= 1.31 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-109701 WordPress PAYCOMET for WooCommerce plugin <= 5.45 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-109700 WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.15.2 - Broken Access Control vulnerability
- CVE-2026-10970 Security feature bypass in Chrome
- CVE-2026-1097 Cross-site scripting in ThemeRuby Multi Authors – Assign Multiple Writers to Posts
- CVE-2026-109699 WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability
- CVE-2026-109698 WordPress Mang Board WP plugin <= 2.4.4 - SQL Injection vulnerability
- CVE-2026-109697 WordPress SureCart plugin <= 4.9.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-109696 WordPress FluentBoards plugin <= 2.1.0 - Broken Access Control vulnerability
- CVE-2026-109695 WordPress FluentCart plugin <= 1.7.1 - Sensitive Data Exposure vulnerability
- CVE-2026-109694 WordPress Fluent CRM plugin <= 3.2.5 - Privilege Escalation vulnerability
- CVE-2026-109693 WordPress Fluent CRM plugin <= 3.2.5 - Privilege Escalation vulnerability
- CVE-2026-109692 WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability
- CVE-2026-109691 WordPress Prime Slider – Addons For Elementor plugin <= 4.7.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-10969 Privilege escalation in Chrome
- CVE-2026-109689 WordPress Sunshine Photo Cart plugin <= 3.7.4 - Broken Access Control vulnerability
- CVE-2026-109688 WordPress Link Whisper Free plugin <= 0.9.7 - SQL Injection vulnerability
- CVE-2026-109687 WordPress Link Whisper Free plugin <= 0.9.7 - SQL Injection vulnerability
- CVE-2026-109686 WordPress Link Whisper Free plugin <= 0.9.7 - PHP Object Injection vulnerability
- CVE-2026-109685 WordPress Link Whisper Free plugin <= 0.9.7 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-109684 WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability
- CVE-2026-109682 Metasploit Framework HTTP Redirect Server-Side Request Forgery
- CVE-2026-109681 Metasploit Framework FTP PASV Response SSRF
- CVE-2026-109680 FreeRDP 3.18.0 before 3.32.0 Heap Out-of-Bounds Write via ARM Redirected Username
- CVE-2026-10968 Information disclosure in Chrome
- CVE-2026-109679 FreeRDP 3.0.0-beta4 before 3.32.0 NULL Pointer Crash via ARM Response
- CVE-2026-109678 FreeRDP 3.0.0-beta1 before 3.32.0 Reachable Assertion via Emulated SCardStatusA
- CVE-2026-109677 FreeRDP 2.0.0-beta1 before 3.28.0 Out-of-Bounds Read via LocateCardsByATRA Handler
- CVE-2026-109676 FreeRDP 3.0.0-beta1 before 3.32.0 Use-After-Free via Smartcard Connect
- CVE-2026-109675 Frappe Suite before commit 2697564 Broken Access Control in Mail Mailbox and Quota APIs
- CVE-2026-109674 Frappe ERPNext before 16.6.0 SQL Injection via Missing Input Validation
- CVE-2026-109673 Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record Names
- CVE-2026-109672 Frappe ERPNext before 15.118.0 Missing Authorization Exposes Financial Data
- CVE-2026-109671 Frappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pages
- CVE-2026-109670 Frappe ERPNext before 15.110.0 Stored XSS via Item Record Name
- CVE-2026-10967 Use after free in Chrome
- CVE-2026-109669 Frappe ERPNext before 15.110.0 Missing Authorization Allows Unauthorized Status Modification
- CVE-2026-109668 Frappe ERPNext before 15.110.0 Missing Authorization in Party Record Endpoints
- CVE-2026-109667 Frappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record Creation
- CVE-2026-109666 Frappe ERPNext before 15.110.0 Missing Authorization in Inventory Record Endpoints
- CVE-2026-109665 Frappe ERPNext before 15.108.0 Missing Authorization Allows Master Record Deactivation
- CVE-2026-109664 Frappe ERPNext before 15.112.0 Missing Authorization Allows Arbitrary Record Modification
- CVE-2026-109663 Frappe ERPNext before 15.113.0 SQL Injection via Unvalidated Endpoint Parameters
- CVE-2026-109662 Frappe ERPNext before 15.112.0 Stored XSS via Public Portal Form
- CVE-2026-109661 Frappe ERPNext before 15.116.0 Missing Authorization Exposes Financial Data
- CVE-2026-109660 Frappe ERPNext before 15.112.0 Missing Authorization in Production Record Endpoints
- CVE-2026-10966 Security feature bypass in Chrome
- CVE-2026-109659 Frappe ERPNext before 15.113.0 Missing Authorization Exposes Financial Data
- CVE-2026-109658 Frappe ERPNext before 15.115.0 Missing Authorization on Endpoints
- CVE-2026-109657 Frappe ERPNext 16.x before 16.27.0 Stored XSS via Unescaped Record Name
- CVE-2026-109656 Frappe ERPNext before 15.118.2 Unauthorized Item Master Data Access
- CVE-2026-109655 Frappe ERPNext before 15.115.0 Missing Authorization in Inventory Endpoints
- CVE-2026-109654 Frappe ERPNext before 15.119.0 Missing Authorization in Transactional Email Endpoints
- CVE-2026-109653 Frappe ERPNext before 15.119.0 Stored XSS Leading to Account Takeover
- CVE-2026-109652 Frappe ERPNext before 15.119.1 Server-Side Template Injection via Message Fields
- CVE-2026-109651 Frappe ERPNext before 15.112.0 Server-Side Request Forgery via Configuration Field
- CVE-2026-109650 Frappe ERPNext before 15.112.0 Missing Authorization Exposes Personal Data
- CVE-2026-10965 Integer overflow in Chrome
- CVE-2026-109649 Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests
- CVE-2026-109648 Frappe ERPNext before 15.106.0 SQL Injection via Missing Input Validation
- CVE-2026-109647 Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation
- CVE-2026-109646 Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation
- CVE-2026-109645 Frappe ERPNext before 15.119.0 Unauthorized Record Creation via Missing Authorization
- CVE-2026-109644 Frappe ERPNext before 15.119.0 Unauthorized Access to Valuation Data
- CVE-2026-109643 Frappe ERPNext before 15.111.0 Missing Authorization Exposes Project Data
- CVE-2026-109642 Frappe ERPNext before 15.110.0 Missing Authorization in Certain Endpoints
- CVE-2026-109641 Frappe ERPNext before 15.110.0 Missing Authorization in Record Creation Endpoints
- CVE-2026-109640 Frappe ERPNext before 16.22.0 Missing Authorization Allows Unauthorized Record Modification
- CVE-2026-10964 Integer overflow in Chrome
- CVE-2026-109639 Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests
- CVE-2026-109638 Frappe ERPNext before 15.110.0 SQL Injection via Missing Input Validation
- CVE-2026-109637 Frappe ERPNext before 16.14.0 Missing Authorization Allows Master Data Modification
- CVE-2026-109636 Frappe ERPNext before 15.115.0 Missing Authorization Exposes Financial Data