Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 943 of 1013.
- CVE-2026-109468 ASP.NET Core Denial of Service Vulnerability
- CVE-2026-109461 Microsoft Authentication Library (MSAL) for Node.js Information Disclosure Vulnerability
- CVE-2026-10946 Memory corruption in Chrome
- CVE-2026-109453 Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulnerability
- CVE-2026-10945 Use after free in Chrome
- CVE-2026-109449 Symfony: Unbounded Nesting in the Expression Parser Lets Untrusted Expressions Crash the Process
- CVE-2026-109448 psqlODBC SQLBindParameter heap memory corruption when binding more than 32767 parameters
- CVE-2026-109447 Privilege escalation in User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
- CVE-2026-109444 OpenSRE through 0.1.2026.10.19 Approval Gate Bypass via shell_run Prompt Injection
- CVE-2026-109443 JoySafeter through 1.0.0 Authenticated RCE via Copilot Standard Mode Shell
- CVE-2026-109442 piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agent exec_shell
- CVE-2026-109441 LangAlpha through 2026.09.07 Cross-Tenant Sandbox Exposure via Shared Docker Bridge
- CVE-2026-109440 LangAlpha through 2026.09.07 Indirect Prompt Injection RCE via Bash and ExecuteCode
- CVE-2026-10944 Security feature bypass in Chrome
- CVE-2026-109439 Lantronix XPress-DR 8.1.0.0 Unauthenticated Configuration Write via UDP 30718
- CVE-2026-109438 3proxy 0.9.7 - 1.0.1 Uninitialized Stack Memory Disclosure via SOCKS4
- CVE-2026-109437 Cognition < 0.13.0 Unauthenticated RCE via Local Shell Backend
- CVE-2026-109434 Sleipnir Browser < 3.9.0 Fullscreen Address Bar Spoofing
- CVE-2026-109433 Camunda Broken Access Control via Cockpit
- CVE-2026-109432 Camunda Expression Injection via orQueries RCE
- CVE-2026-109431 Camunda Missing Authorization in Task Sub-Resources
- CVE-2026-109430 Ellucian WebAdvisor 3.2 Unauthenticated XXE Injection
- CVE-2026-10943 Use after free in Chrome
- CVE-2026-109429 Mistral Vibe < 2.25.4 Bash Permission Bypass via ${var@P} Prompt-Transform
- CVE-2026-109428 Mistral Vibe < 2.25.5 Permission Bypass via Bash Line Continuation
- CVE-2026-109427 Telegram-Stremio 5.1.0 Broken Object Authorization via Stream IDs
- CVE-2026-109426 Telegram-Stremio 5.1.0 Insecure Session Storage via encode_string
- CVE-2026-109425 Tink-go 2.8.0 Keyset Validation Bypass via NewHandleWithNoSecrets
- CVE-2026-109424 NetEase Cloud Music Weak Encryption via eapi/xeapi
- CVE-2026-109423 NetEase Cloud Music TLS Certificate Validation Bypass
- CVE-2026-109422 NetEase Cloud Music RCE via os.navigateExternal IPC
- CVE-2026-10942 Privilege escalation in Chrome
- CVE-2026-109415 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- CVE-2026-109414 Vitepos <= 3.6.1 - Authenticated (Vendor+) SQL Injection via 'src_by[].val' Parameter via 'bt' Operator
- CVE-2026-109413 Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process
- CVE-2026-109412 Information disclosure in Neurons Patch for Intune
- CVE-2026-109411 Samba: access control bypass via vfs_ceph_rgw case-insensitive open
- CVE-2026-109410 macrozheng mall mall-admin/mall-portal moneyInfo OmsOrderServiceImpl.updateMoneyInfo calculation
- CVE-2026-10941 Memory corruption in Chrome
- CVE-2026-109409 HBAI-Ltd Toonflow-app Open Folder Endpoint openFolder.ts child_process.exec command injection
- CVE-2026-109407 macrozheng mall Coupon Redemption generateOrder race condition
- CVE-2026-109406 macrozheng mall mall-portal generateOrder OmsPortalOrderServiceImpl logic error
- CVE-2026-109405 conductor-oss conductor KafkaPublishTask.java KafkaPublishTask.start server-side request forgery
- CVE-2026-109404 conductor-oss conductor Agentspan Agent Runtime AgentController.java server-side request forgery
- CVE-2026-109403 conductor-oss conductor Agent Card Fetching A2AService.java A2AService.getAgentCard server-side request forgery
- CVE-2026-109402 conductor-oss conductor MCP Service MCPService.java MCPService.listTools server-side request forgery
- CVE-2026-109401 Information disclosure in WP Mail Logging
- CVE-2026-109400 Privilege escalation in InstaWP Connect – 1-click WP Staging & Migration
- CVE-2026-10940 Race condition in Chrome
- CVE-2026-1094 Improper Validation of Unsafe Equivalence in Input in GitLab
- CVE-2026-109399 SWUpdate through 2026.05.1 CMS Signature Verification Bypass via Embedded Intermediates
- CVE-2026-109398 Gumlet php-image-resize before 3.0.1 Denial of Service via Decompression Bombs
- CVE-2026-109397 Thelia before 3.1.2 and 3.2.x before 3.2.1 File Upload RCE via Filename Trailing Space
- CVE-2026-109396 Thelia before 3.1.2 and 3.2.x before 3.2.1 CSV Formula Injection via Exports
- CVE-2026-109395 Ning compress-lzf before 1.2.0 Out-of-Bounds Memory Access via UnsafeChunkDecoder
- CVE-2026-109394 Thirty bees through 1.7.0 Account Takeover via PasswordController Guest Checkout
- CVE-2026-109393 QloApps through 1.7.0 Insecure Direct Object Reference in Back-Office AJAX Handlers
- CVE-2026-109392 Pimcore through 2026.3.1 Stored XSS via ExternalImage Field Version Preview
- CVE-2026-109391 Square Squash through commit e73f280 Unauthenticated YAML Deserialization via Symbolication API
- CVE-2026-109390 Memory corruption in AnyDesk
- CVE-2026-10939 Use after free in Chrome
- CVE-2026-109388 Cross-site scripting in HivePress – Business Directory, Listings & Classified Ads Plugin
- CVE-2026-109385 UiChemy <= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slot Link URL
- CVE-2026-109384 File upload in The Innovative Form Builder – IvyForms
- CVE-2026-109383 undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent
- CVE-2026-109382 Missing authorization in WSP MCP – Free MCP Plugin for WordPress: Connect Claude, ChatGPT & AI Agents
- CVE-2026-109381 Event Booking Manager for WooCommerce <= 5.7.8 - Authenticated (Shop Manager+) Privilege Escalation to 'page' Parameter
- CVE-2026-109380 modern-tar 0.3.5 through 0.8.5 Memory Exhaustion via Malformed Octal Size Field
- CVE-2026-10938 Security feature bypass in Chrome
- CVE-2026-109379 Cockpit CMS 2.14.1 Account Enumeration via Timing Discrepancy in /auth/check
- CVE-2026-109378 SPIP before 4.4.18 SSRF via HTTP Redirects in recuperer_url
- CVE-2026-109377 ERPNext 9.0.0 through 16.50.0 Missing Authorization in Batch Lookup Methods
- CVE-2026-109376 ERPNext 15.55.0 through 16.50.0 Incorrect Authorization via get_timesheet_html
- CVE-2026-109375 Vercel deepsec before 1.1.17 Arbitrary File Write via Symlink in Sandbox Tarball Extraction
- CVE-2026-109374 ZITADEL 3.0.0 before 4.19.2 Privilege Escalation via OIDC Token Exchange Impersonation
- CVE-2026-109373 ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session Cookie
- CVE-2026-109372 ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion
- CVE-2026-109371 ZITADEL 3.0.0 before 4.18.0 Unauthenticated Username Change via Login V1
- CVE-2026-109370 Cross-site scripting in Document Embedder – let visitors read files without downloading
- CVE-2026-10937 Security feature bypass in Chrome
- CVE-2026-109369 Missing authorization in WP Booking System – Booking Calendar
- CVE-2026-109368 Missing authorization in WP Booking System – Booking Calendar
- CVE-2026-109366 Zebra before 6.4.0 Gossiped Block Drop via Forged Coinbase scriptSig Height
- CVE-2026-109365 Zebra before 6.4.0 Denial of Service via Same-Hash Forged Block Bodies
- CVE-2026-109364 Zebra 2.3.0 before 6.4.0 Peer Ban Bypass via Exact-IP Keying
- CVE-2026-109363 Zebra 6.4.0 before 6.4.2 Denial of Service via Malformed v6 Transaction
- CVE-2026-109362 Heym v0.0.5 before v0.0.113 Broken Access Control via Workflow Execution Tokens
- CVE-2026-109361 MONAI 1.2.0 before 1.6.1 Insecure Deserialization RCE via nnUNetV2Runner postprocessing_file Path
- CVE-2026-109360 MONAI 0.4.0 before 1.6.1 RCE via SENet Pretrained Weights Over Plaintext HTTP
- CVE-2026-10936 Memory corruption in Chrome
- CVE-2026-109359 Contrast 1.8.0 before 1.24.1 Mesh CA Key Cross-Manifest Exposure via Peer Recovery
- CVE-2026-109358 Edgeless Systems Contrast 1.8.0 before 1.24.1 World-Writable Containerd Config Privilege Escalation
- CVE-2026-109357 LibreNMS before 26.9.0 LDAP Filter Injection Authentication Bypass via Authorization Header
- CVE-2026-109356 LibreNMS before 26.9.0 Missing Authorization in Port Purge via PortsController
- CVE-2026-109355 LibreNMS before 26.9.0 Stored XSS via Tools Oxidized Node List
- CVE-2026-109354 LibreNMS before 26.9.0 Path Traversal via NFSen channel Parameter
- CVE-2026-109353 LibreNMS before 26.9.0 SQL Injection via notification_id in notifications.inc.php
- CVE-2026-109352 LibreNMS before 26.9.0 Stored XSS via wireless sensor description
- CVE-2026-109351 Gitoxide gix-pack before 0.75.0 Denial of Service via Pack Header Object Count
- CVE-2026-109350 Gitoxide gix-pack before 0.75.0 Denial of Service via OFS_DELTA Base Distance