Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 944 of 1013.
- CVE-2026-10935 Memory corruption in Chrome
- CVE-2026-109349 gix-pack before 0.75.0 Reachable Assertion DoS via Pack Version 3 Header
- CVE-2026-109348 Gitoxide gix-mailmap before 0.35.0 CPU Denial of Service via .mailmap Parsing
- CVE-2026-109347 Adminer before 6.1.1 RCE via UTF-8 BOM SQLite ATTACH Bypass
- CVE-2026-109346 better-auth 1.3.8-beta.3 before 1.7.0-rc.3 Device Authorization Phishing via /device
- CVE-2026-109345 DOMPurify before 3.4.16 XSS via IN_PLACE Returned Rawtext Root
- CVE-2026-109344 DOMPurify from 3.4.13 before 3.4.16 DOM XSS via IN_PLACE afterSanitize Hooks
- CVE-2026-109343 SurrealDB before 3.3.0 Cross-Tenant Access via USE Statement
- CVE-2026-109342 SurrealDB 3.0.0 before 3.3.0 Missing Authentication in revoke RPC Method
- CVE-2026-109341 SurrealDB before 3.3.0 Field Permission Bypass via PATCH copy/move/test Operations
- CVE-2026-109340 SurrealDB 3.1.0 before 3.3.0 Authorization Bypass via REFERENCE ON DELETE CASCADE
- CVE-2026-10934 Use after free in Chrome
- CVE-2026-109339 SurrealDB 3.1.0 before 3.3.0 Memory Exhaustion via Surrealism Module Output Buffering
- CVE-2026-109338 SurrealDB before 3.3.0 Denial of Service via Headers Non-ASCII Values
- CVE-2026-109337 SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT WHERE Clause
- CVE-2026-109336 SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT $before/$after
- CVE-2026-109335 SurrealDB 3.0.0 before 3.3.0 Information Disclosure via COMPUTED Fields
- CVE-2026-109334 SurrealDB before 3.3.0 Cross-Tenant Access via Surreal-NS/Surreal-DB Headers and RPC use
- CVE-2026-109333 SurrealDB 3.0.0 before 3.3.0 Cross-Tenant Record Read via RETURN FETCH
- CVE-2026-109332 Network-AI before 5.15.2 CORS Origin Validation Error in MCP SSE Transport
- CVE-2026-109331 Network-AI 5.14.0 before 5.15.2 Deny Pattern Bypass via ClaudeHookBridge extractFullTarget
- CVE-2026-109330 Network-AI 5.0.0 before 5.15.2 Cross-Site WebSocket Hijacking via DashboardServer
- CVE-2026-10933 Use after free in Chrome
- CVE-2026-109329 Missing authorization in admidio
- CVE-2026-109328 Admidio 5.0.0 before 5.0.15 Unauthenticated Stored XSS via Registration Name
- CVE-2026-109327 Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 Reflected XSS via system/redirect.php
- CVE-2026-109326 Grav before 2.1.7 Information Disclosure via Nested .git Directories
- CVE-2026-109325 Grav from 2.0.22 before 2.1.7 Clockwork Profiler Authentication Bypass via Proxy
- CVE-2026-109324 Grav before 2.1.7 Memory Exhaustion via Oversized Image Transforms
- CVE-2026-109323 Grav Star Ratings 2.0.1 through 2.0.3 Missing Server-Side vote_access Authorization
- CVE-2026-109322 Grav Guestbook before 0.5.2 Stored XSS via AJAX Pagination and Admin Views
- CVE-2026-109321 Grav Login OAuth Plugin before 1.4.3 Predictable Local Credentials Authentication Bypass
- CVE-2026-109320 Grav API Plugin before 1.0.36 Disabled Account Session Access Bypass
- CVE-2026-10932 Use after free in Chrome
- CVE-2026-109319 Grav Guestbook Plugin 0.5.0 and 0.5.1 Missing Authorization and CSRF in Moderation
- CVE-2026-109318 Grav Git Sync 1.0.2 through 3.4.12 Command Injection via Commit Author
- CVE-2026-109317 Grav API Plugin before 1.0.36 Privilege Escalation via Scalar Access Grants
- CVE-2026-109316 Grav Data Manager 1.4.0 through 1.4.5 Unauthenticated File Deletion via Admin
- CVE-2026-109315 Grav 2.0.22 before 2.1.7 Clockwork Debugger Token Disclosure via Twig Sandbox
- CVE-2026-109314 Grav Login Plugin 1.2.0 before 3.9.9 Password Reset Token Disclosure via Reset Page
- CVE-2026-109313 Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Remember-Me Cookie
- CVE-2026-109312 Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Profile Update Form
- CVE-2026-109311 vLLM before 0.29.0 Heap Overflow DoS via IAMF Audio Transcription Upload
- CVE-2026-109310 SiYuan v3.1.12 before v3.8.6 Denial of Service via getDynamicIcon Template
- CVE-2026-10931 Use after free in Chrome
- CVE-2026-109309 SiYuan v3.7.0 before v3.8.6 Arbitrary File Read via Plugin ResponseFile.Path
- CVE-2026-109308 Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 RCE via actionCacheUpdates Behavior Injection
- CVE-2026-109307 Craft CMS 5.0.0 before 5.10.14 DOM XSS via returnUrl in 2FA Verification
- CVE-2026-109306 Craft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licensed-edition
- CVE-2026-109305 Craft CMS 5.10.2 before 5.10.14 Twig Sandbox Bypass RCE via has some/has every
- CVE-2026-109304 Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 Arbitrary File Read via Twig create() DOMDocument
- CVE-2026-109303 Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 protectedFields Bypass via Relation Count Query
- CVE-2026-109302 Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 GraphQL Schema Disclosure via Persisted Queries
- CVE-2026-109301 Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 Denial of Service via File Pointer Without URL
- CVE-2026-109300 Open WebUI 0.6.31 before 0.11.4 Stored XSS via Tool-Call Embeds
- CVE-2026-10930 Memory corruption in Chrome
- CVE-2026-1093 Cross-site scripting in WPFAQBlock– FAQ & Accordion Plugin For Gutenberg
- CVE-2026-109299 Open WebUI 0.9.0 before 0.11.4 Denial of Service via Recurrence Rule Validation
- CVE-2026-109298 Open WebUI 0.11.0 before 0.11.4 Memory Exhaustion via Knowledge Search Regex
- CVE-2026-109297 Open WebUI 0.11.0 before 0.11.4 Denial of Service via Automation Recurrence Rules
- CVE-2026-109296 Open WebUI before 0.11.4 Missing Authorization via Backend Index on Model Routes
- CVE-2026-109295 Open WebUI 0.11.0 before 0.11.4 ReDoS via grep_knowledge_files Event Loop
- CVE-2026-109294 Open WebUI 0.6.42 before 0.11.4 Memory Exhaustion via Compressed Remote Image
- CVE-2026-109293 Open WebUI 0.11.0 before 0.11.4 Tool Source Disclosure via Tool Export Endpoint
- CVE-2026-109292 Open WebUI 0.6.27 before 0.11.4 Session Token Disclosure via OAuth-Mode Connections
- CVE-2026-109291 Open WebUI 0.6.33 before 0.11.4 Stored XSS via Citation embed_url
- CVE-2026-109290 Open WebUI 0.11.1 before 0.11.4 Stored XSS via DOCX Preview
- CVE-2026-10929 Memory corruption in Chrome
- CVE-2026-109289 Open WebUI 0.8.8 before 0.11.4 Improper Session Revocation via Terminal WebSocket
- CVE-2026-109288 Open WebUI before 0.11.4 Stored XSS via javascript: URLs in Markdown Links
- CVE-2026-109287 Open WebUI 0.9.6 before 0.11.4 Information Disclosure via Unscoped Directory ID
- CVE-2026-109286 Open WebUI 0.7.0 before 0.11.4 Session Token Theft via SyncStatsModal
- CVE-2026-109285 Open WebUI 0.6.0 before 0.11.4 Improper Access Control via Stale File Metadata
- CVE-2026-109284 Open WebUI 0.11.0 before 0.11.4 Improper Authorization via Chat Fork Endpoint
- CVE-2026-109283 Open WebUI 0.11.1 before 0.11.4 Authorization Bypass via OAuth Token Exchange
- CVE-2026-109282 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Undefined Behavior in INFO, JSON and YAML Encoders
- CVE-2026-109281 ImageMagick 7.1.0-21 before 7.1.2-32 Heap Buffer Over-Read via -fx Option
- CVE-2026-109280 ImageMagick 7.1.0-20 before 7.1.2-32 Use After Free via -fx Option
- CVE-2026-10928 Code injection in Chrome
- CVE-2026-109279 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Heap Buffer Overflow via Concurrent Security Policy Access
- CVE-2026-109278 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in Wavelet-Denoise Operation
- CVE-2026-109277 ImageMagick before 7.1.2-32 Policy Bypass via -script Operation
- CVE-2026-109276 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Temporary File Leak in JNG Decoder
- CVE-2026-109275 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Code Injection via MVG Decoder
- CVE-2026-109274 ImageMagick before 7.1.2-32 TOCTOU Symlink Race Path Policy Bypass via magick script
- CVE-2026-109273 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Information Disclosure in PostScript Decoder
- CVE-2026-109272 ImageMagick 7.1.1-31 before 7.1.2-32 Null Pointer Dereference in PostScript Decoder
- CVE-2026-109271 ImageMagick 7.1.2-30 before 7.1.2-32 Use After Free in WBINFO Decoder
- CVE-2026-109270 ImageMagick before 7.1.2-32 Memory Leak via -process Option
- CVE-2026-10927 Memory corruption in Chrome
- CVE-2026-109269 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Information Disclosure via JPEG Decoder
- CVE-2026-109268 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Use After Free in PDF Writer via JPEG2000
- CVE-2026-109267 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Stack Overflow in MSL Decoder
- CVE-2026-109266 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 XML Injection via CIP Encoder
- CVE-2026-109265 ImageMagick 7.1.1-7 before 7.1.2-32 Heap Buffer Over-Read via XMP Profile
- CVE-2026-109264 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Stack Overflow in MVG Decoder
- CVE-2026-109263 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in YUV Encoder
- CVE-2026-109262 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in SVG Encoder
- CVE-2026-109261 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in GIF Encoder
- CVE-2026-109260 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in PNG Encoder