Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 942 of 1013.
- CVE-2026-109635 Frappe ERPNext before 15.105.0 Missing Authorization in Document Creation Endpoints
- CVE-2026-109634 Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoints
- CVE-2026-109633 Frappe ERPNext before 15.119.1 Stored XSS via Public Booking Page
- CVE-2026-109632 Frappe ERPNext before 15.121.0 Missing Authorization on Certain Endpoints
- CVE-2026-109631 Frappe ERPNext before 15.119.1 SQL Injection via Missing Validation
- CVE-2026-109630 Frappe ERPNext before 15.121.0 Missing Authorization in Endpoints
- CVE-2026-10963 Integer overflow in Chrome
- CVE-2026-109629 Frappe ERPNext before 15.121.3 Missing Authorization in Transactional Email Endpoint
- CVE-2026-109628 Frappe ERPNext before 15.121.0 Unauthorized Status Modification via Missing Authorization
- CVE-2026-109627 Frappe ERPNext before 15.120.0 Missing Authorization Exposes Financial Data
- CVE-2026-109626 Frappe ERPNext before 16.34.2 SQL Injection via Multiple Endpoints
- CVE-2026-109625 Frappe ERPNext before 15.121.3 Missing Authorization Exposes Financial Data
- CVE-2026-109624 Frappe ERPNext before 15.120.0 Missing Authorization Exposes Personal Data
- CVE-2026-109623 Frappe ERPNext before 15.121.1 Unauthorized Document Modification via Missing Authorization
- CVE-2026-109622 Frappe ERPNext before 15.121.0 Unauthorized Document Modification via Missing Authorization
- CVE-2026-109621 Frappe ERPNext before 15.120.0 Unauthorized Party Record Access via Permission Bypass
- CVE-2026-109620 SourceCodester Online Reviewer System index.php prepare sql injection
- CVE-2026-10962 Memory corruption in Chrome
- CVE-2026-109619 PHP Stale Internal Request-State
- CVE-2026-109618 PHP Memory Corruption
- CVE-2026-109617 Frappe ERPNext before 15.121.0 Missing Authorization in Record Creation Endpoints
- CVE-2026-109616 Frappe ERPNext before 15.121.3 Missing Authorization Allows Unauthorized Data Modification
- CVE-2026-109615 Frappe ERPNext before 15.121.0 Missing Authorization in Document Creation Endpoints
- CVE-2026-109614 Frappe ERPNext before 16.34.0 Missing Authorization Exposes Financial Data
- CVE-2026-109613 Frappe ERPNext before 15.121.0 Missing Authorization Allows Unauthorized Status Modification
- CVE-2026-109612 Frappe ERPNext before 15.120.0 Stored XSS via Report View
- CVE-2026-109611 Frappe ERPNext before 15.121.0 Missing Authorization in Certain Endpoints
- CVE-2026-109610 Frappe ERPNext before 15.119.1 Missing Authorization Allows Unauthorized Document Modification
- CVE-2026-10961 Use after free in Chrome
- CVE-2026-109609 Frappe ERPNext before 15.119.1 SQL Injection via Missing Input Validation
- CVE-2026-109608 Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoint Input
- CVE-2026-109607 SourceCodester Online Exam System Login Endpoint loginExe.php sql injection
- CVE-2026-109606 SourceCodester Art Gallery Management System Account Creation admin_class.php save_user sql injection
- CVE-2026-109605 SourceCodester Simple Cafe Billing System User Management admin_class.php save_user improper authorization
- CVE-2026-109604 ERPNext before 15.112.0 Stored XSS via Tool View Record Names
- CVE-2026-109603 Frappe Framework before 16.17.0 Authenticated SSRF and LFI via pdfkit
- CVE-2026-109602 Frappe before v16.31.0 Stored XSS via Dashboard Chart Filters
- CVE-2026-109601 Frappe Framework before v16.30.0 Arbitrary File Read via Outgoing Email HTML
- CVE-2026-109600 Frappe before 16.31.0 Improper Access Control in Document Follow Notifications
- CVE-2026-10960 Memory corruption in Chrome
- CVE-2026-1096 Best-wp-google-map <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'latitude' Shortcode Attribute
- CVE-2026-109599 Frappe before 15.113.3 Missing Authorization Allows Unauthorized Record Modification
- CVE-2026-109598 Frappe before 16.33.0 Broken Authorization via send_sms Endpoint
- CVE-2026-109597 Hugo v0.60.0 before v0.167.0 Stored XSS via Table of Contents Heading IDs
- CVE-2026-109596 Hugo from v0.162.0 before v0.167.0 Symlink File Disclosure via Nested Mount Ancestor
- CVE-2026-109595 Hugo v0.84.0 before v0.167.0 Path Traversal via js.Build ESBuild Resolver
- CVE-2026-109590 Cross-site scripting in Travelly – Tour & Travel Booking Manager for WooCommerce
- CVE-2026-10959 Use after free in Chrome
- CVE-2026-109588 Numeric truncation in the MPU buffer authorization check in FreeRTOS-Kernel
- CVE-2026-109587 Incorrect authorization in the Arm Cortex-R82 MPU port in FreeRTOS-Kernel
- CVE-2026-109584 HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit
- CVE-2026-10958 Use after free in Chrome
- CVE-2026-109576 HMS Networks PEAK-System PCAN Windows drivers Out-of-bounds Write
- CVE-2026-109575 Auth bypass in Data Plane API CE
- CVE-2026-109574 Hugo before v0.167.0 Path Traversal via css.Sass Import Fallback
- CVE-2026-109573 phpMyFAQ before 4.1.9 SQL Injection via api/autocomplete Search Endpoint
- CVE-2026-109572 Open WebUI 0.8.6 before 0.11.4 Privilege Escalation via Terminal Proxy
- CVE-2026-109571 Fire-Boltt BSW013 firmware through V0.0.8 Unauthenticated Heart Rate Disclosure via BLE
- CVE-2026-109570 Fire-Boltt BSW013 through V0.0.8 Unauthenticated BLE Notification Injection
- CVE-2026-10957 Use after free in Chrome
- CVE-2026-109569 sandboxed.sh through 1.3.0 Container Escape via nsenter Missing Root Namespace
- CVE-2026-109568 Shaark 1.2.13 through 1.2.44 Missing Authorization via API Update and Delete Routes
- CVE-2026-109567 Rapyd Admin from 9.0.0 before 9.20.0 Privilege Escalation via UsersEdit Component
- CVE-2026-109566 Rapyd Admin 9.0.0 before 9.20.0 Hard-Coded Super-Admin Credentials via AuthSeeder
- CVE-2026-109565 Rapyd Admin 9.4.0 before 9.20.0 Stored XSS via select-list Component
- CVE-2026-109564 LearnHouse before 1.4.0 Missing Authorization via Playground Duplicate Endpoint
- CVE-2026-109563 N3.js before 2.11.1 ReDoS via N3Lexer Numeric-Literal Regex
- CVE-2026-109562 SnapOtter 1.15.10 through 2.2.0 Missing Authorization via Upload and Preview API
- CVE-2026-109561 goose from 1.28.0 before 1.44.0 Manual Approval Bypass via Read-Only Tool Annotations
- CVE-2026-109560 Continue CLI through 1.5.47 Bash Permission Rule Bypass via Command Chaining
- CVE-2026-10956 Use after free in Chrome
- CVE-2026-109559 EdgeEver Desktop 1.6.26 through 1.112.0 Navigation Allowlist Bypass via will-navigate
- CVE-2026-109558 EdgeEver 1.6.0 through 1.112.0 Stored XSS via TemplatesPane Template Preview
- CVE-2026-109557 EdgeEver through 1.112.0 Stored XSS via setMemoDragPreview Drag Preview
- CVE-2026-109556 EdgeEver Desktop 1.92.0 through 1.112.0 Local Program Execution via ACP IPC
- CVE-2026-109553 Gitea SSH certificate principal impersonation of other users
- CVE-2026-10955 Memory corruption in Chrome
- CVE-2026-10954 Use after free in Chrome
- CVE-2026-10953 Use after free in Chrome
- CVE-2026-109527 Model Context Protocol Python SDK HTTP and OAuth endpoints allow memory exhaustion through unbounded request bodies
- CVE-2026-109526 HBAI-Ltd Toonflow-app exportData Endpoint information disclosure
- CVE-2026-109525 girishsaraf Online-Appointment-Booking-System submit2 changebookingstatus.php authorization
- CVE-2026-109524 girishsaraf Online-Appointment-Booking-System Admin Display Pages showdoctor.php authorization
- CVE-2026-109523 girishsaraf Online-Appointment-Booking-System AJAX Endpoint getclinic.php sql injection
- CVE-2026-109522 girishsaraf Online-Appointment-Booking-System Admin CRUD Endpoint deleteclinic.php sql injection
- CVE-2026-109521 girishsaraf Online-Appointment-Booking-System changebookingstatus.php sql injection
- CVE-2026-109520 Colorful iGameCenter Dispatch AMDRyzenMasterDriver.sys MmMapIoSpace privilege defined with unsafe actions
- CVE-2026-10952 Use after free in Chrome
- CVE-2026-109519 YouTransfer Template Rendering template path traversal
- CVE-2026-109516 Auth bypass in Bot for Telegram on WooCommerce
- CVE-2026-109515 MailOptin <= 1.2.78.6 - Unauthenticated Privilege Escalation to 'form_custom_field_mappings' Parameter
- CVE-2026-109513 NotificationX <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via 'name' Parameter via popup-submit REST Route
- CVE-2026-109512 Mang Board <= 2.4.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'content' Parameter
- CVE-2026-10951 Use after free in Chrome
- CVE-2026-109506 Improper Authentication in Multiple TP-Link WiFi Repeaters
- CVE-2026-10950 Security feature bypass in Chrome
- CVE-2026-1095 Canto Testimonials <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fx' Shortcode Attribute
- CVE-2026-10949 Memory corruption in Chrome
- CVE-2026-10948 Use after free in Chrome
- CVE-2026-10947 Use after free in Chrome