Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 946 of 1013.
- CVE-2026-109147 WP Booking System < 2.1.0.3 - Reflected XSS via 'booking_id' Parameter
- CVE-2026-109145 User Rights Access Manager <= 1.1.3 - Unauthenticated Privilege Escalation via AJAX Registration Handler
- CVE-2026-109144 wbond certvalidator Certificate Path Builder resource consumption
- CVE-2026-109143 calcom cal.com/cal.diy Credentials delete credentials.delete privileges management
- CVE-2026-10914 Use after free in Chrome
- CVE-2026-109131 Cross-site scripting in Red Hat Ansible Automation Platform 2
- CVE-2026-10913 Use after free in Chrome
- CVE-2026-109126 IBM Verify Identity Access and IBM Security Verify Access Hard-coded Credentials
- CVE-2026-109125 Possible cache poisoning vulnerability via a cache side-channel exposed by 'unwanted-reply-threshold'
- CVE-2026-109122 Kiloview E3 NDI Encoder OS Command Injection
- CVE-2026-10912 Security feature bypass in Chrome
- CVE-2026-109119 Missing Authorization in rdiffweb
- CVE-2026-109118 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in rdiffweb
- CVE-2026-109116 AdithyaYelloju Restaurant-Management-System Order Management mysqli_query authorization
- CVE-2026-109115 AdithyaYelloju Restaurant-Management-System Password Reset forgot3.php sql injection
- CVE-2026-109114 AdithyaYelloju Restaurant-Management-System Login Form login.php improper authentication
- CVE-2026-109110 Wavlink WL-WN592AX6 wmapd system os command injection
- CVE-2026-10911 Security feature bypass in Chrome
- CVE-2026-109109 Wavlink WL-WN530BE1-A Settings Export CGI ExportAllSettings.cgi strcpy stack-based overflow
- CVE-2026-109108 Wavlink WL-WN530BE1-A uploadVpn.cgi popen os command injection
- CVE-2026-109107 Wavlink WL-WN592AX6 upload.cgi main null pointer dereference
- CVE-2026-109106 Polaris Office App Document Intake com.infraware.service.m.n.a path traversal
- CVE-2026-10910 Memory corruption in Chrome
- CVE-2026-109090 libXi XGetDeviceControl DEVICE_ENABLE Heap Buffer Overflow
- CVE-2026-10909 Use after free in Chrome
- CVE-2026-109089 libXi XGetDeviceControl Control Type Mismatch Heap Buffer Overflow
- CVE-2026-109088 libXtst RECORD EnableContext Reply Endless Loop
- CVE-2026-109082 Keycloak-services: keycloak-services: ciba confidential-only contract not enforced for public clients
- CVE-2026-109080 SQL injection in Night Shift bulk license plate search allows cross-organization data access
- CVE-2026-10908 Use after free in Chrome
- CVE-2026-10907 Memory corruption in Chrome
- CVE-2026-10906 Use after free in Chrome
- CVE-2026-10905 Use after free in Chrome
- CVE-2026-10904 Code injection in Chrome
- CVE-2026-10903 Use after free in Chrome
- CVE-2026-10902 Use after free in Chrome
- CVE-2026-10901 Use after free in Chrome
- CVE-2026-10900 Use after free in Chrome
- CVE-2026-1090 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- CVE-2026-10899 Use after free in Chrome
- CVE-2026-108985 Memory corruption in libnfs
- CVE-2026-108984 GV-ASManager Web Server Buffer Overflow Vulnerability
- CVE-2026-108983 GV-ASManager Web Server Command Injection Vulnerability
- CVE-2026-108982 Security feature bypass in VeraCrypt
- CVE-2026-108981 Path traversal in ngx cache purge
- CVE-2026-108980 Path traversal in Blinko
- CVE-2026-10898 Memory corruption in Chrome
- CVE-2026-108978 Memory corruption in rlottie
- CVE-2026-108976 Command injection in Emacs
- CVE-2026-108975 SourceCodester Library Management System add_admin.php move_uploaded_file unrestricted upload
- CVE-2026-108974 SourceCodester E-Learning System Users.php save_users unrestricted upload
- CVE-2026-108973 SourceCodester Contact Tracing System Users.php move_uploaded_file unrestricted upload
- CVE-2026-108972 SourceCodester Human Resource Management System Employee Endpoint employee.php session_start improper authentication
- CVE-2026-108971 D-Link DCS-930L Emergency HTTP Recovery Server bootloader_region.bin mpfd_decode signature verification
- CVE-2026-108970 itsmeravitejak Online-Examination-System Registration Form database.php addNewUser sql injection
- CVE-2026-10897 Memory corruption in Chrome
- CVE-2026-108969 itsmeravitejak Online-Examination-System Session session.php checkLogin comparison
- CVE-2026-108968 SourceCodester Performance Indicator System sales_history.php sql injection
- CVE-2026-108967 SourceCodester Performance Indicator System edit_credit.php sql injection
- CVE-2026-108966 SourceCodester Performance Indicator System product.php sql injection
- CVE-2026-108965 SourceCodester Performance Indicator System edit_quantity.php sql injection
- CVE-2026-108964 SourceCodester Performance Indicator System addproduct.php sql injection
- CVE-2026-108963 Command injection in databasement
- CVE-2026-108962 storyicon comfyui_segment_anything GroundingDINO Model Loading slconfig.py SLConfig._file2dict code injection
- CVE-2026-108961 PaddlePaddle PaddleX Preprocessor processors.py NormalizeImage.__init__ code injection
- CVE-2026-108960 Tiiny-AI PowerInfer FFN GPU-split Loader ggml-cuda.cu create_striped_mat_to_gpu out-of-bounds
- CVE-2026-10896 Use after free in Chrome
- CVE-2026-108959 itsourcecode Online Cake Ordering System addtransacdetail.php sql injection
- CVE-2026-108958 TensorLayer HDF5 Loading utils.py load_hdf5_graph deserialization
- CVE-2026-108957 TinyLLaVA TinyLLaVA_Factory TinyLlavaConfig configuration_tinyllava.py _load_text_config code injection
- CVE-2026-108956 code-projects Online Reviewer System User Update btn_functions.php sql injection
- CVE-2026-108955 Tiiny-AI PowerInfer GGUF ggml.c gguf_init_from_file out-of-bounds
- CVE-2026-108954 Memory corruption in sherpa-onnx
- CVE-2026-108953 mac-shell-mcp before 2.0.0 OS Command Injection via execute_command Arguments
- CVE-2026-108952 RT-Thread through 5.3.0 Memory Corruption via USB CDC VCOM Driver
- CVE-2026-108951 LavaLite CMS through 10.1.2 Authorization Bypass via User Update API
- CVE-2026-108950 Open Source Social Network (OSSN) through 10.1 Missing Authorization via Album Photo Routes
- CVE-2026-10895 Use after free in Chrome
- CVE-2026-108948 code-projects Online Reviewer System User Profile Update btn_functions.php dynamically-determined object attributes
- CVE-2026-108947 yoshitomo-matsubara torchdistill main_util.py load_ckpt deserialization
- CVE-2026-108945 iMoonLab yolov13 AutoBackend Model Loading autobackend.py eval code injection
- CVE-2026-108944 repository RAE Config-Driven Model Instantiation model_utils.py get_obj_from_str code injection
- CVE-2026-108943 ModelTC LightX2V Tokenizer cosmos3_runner.py AutoTokenizer.from_pretrained code injection
- CVE-2026-108942 Cross-site scripting in clarity-upscaler
- CVE-2026-108941 Linketic CityGaussian Sidecar Parsing common.py parse_cfg_args code injection
- CVE-2026-108940 EricLBuehler Mistral.rs handlers.rs calibration_apply path traversal
- CVE-2026-10894 Use after free in Chrome
- CVE-2026-108939 EricLBuehler mistral.rs media_source.rs is_global_ip server-side request forgery
- CVE-2026-108938 code-projects Matrimonial System matrimony.sql file access
- CVE-2026-108937 code-projects Online Ticket Reservation System medallion.sql file information disclosure
- CVE-2026-108936 Edimax BR-6208AC QoS Page formQoS cross site scripting
- CVE-2026-108935 Edimax BR-6208AC Port Forwarding formPortFw cross site scripting
- CVE-2026-108934 Edimax BR-6208AC HTTP Blocking formUrlb cross site scripting
- CVE-2026-108933 Edimax BR-6208AC formFilter cross site scripting
- CVE-2026-108932 Netcore NR268 DHCP Hostname filter_hosts_dump.cgi eval cross site scripting
- CVE-2026-108931 Netcore NR268 DHCP dhcp_dynamicip_show.cgi eval cross site scripting
- CVE-2026-108930 Netcore NR268 DDNS ddns_wan_list_show.cgi ddns_wan_list_show information disclosure
- CVE-2026-10893 Use after free in Chrome
- CVE-2026-108929 Netcore NR268 DDNS DDNSset.cgi execvp argument injection
- CVE-2026-108928 itsourcecode Online Admission System sum.php sql injection