Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 947 of 1013.
- CVE-2026-108927 itsourcecode Baptism Information Management System pbaptism.php sql injection
- CVE-2026-108926 itsourcecode Baptism Information Management System ebaptism.php sql injection
- CVE-2026-108925 Cohesity - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
- CVE-2026-108924 getkirby Kirby Dynamic Option Generation OptionsQuery.php resolve authorization
- CVE-2026-108923 1024-lab smart-admin Support Config Query queryByKey access control
- CVE-2026-108922 KusalkaSilva Learning-Management-System upload_save.php getimagesize unrestricted upload
- CVE-2026-108921 Missing authorization in Learning-Management-System
- CVE-2026-108920 SourceCodester Drug Recommendation System Admin Record Tables user_record.php cross site scripting
- CVE-2026-10892 Memory corruption in Chrome
- CVE-2026-108919 SourceCodester Drug Recommendation System Student Registration add_student.php cross site scripting
- CVE-2026-108918 Edimax BR-6208AC formWlanMP command injection
- CVE-2026-108917 Edimax BR-6208AC formAutoFWupgrade command injection
- CVE-2026-108916 Edimax BR-6208AC formAccept command injection
- CVE-2026-108915 Edimax BR-6208AC formWlanMP buffer overflow
- CVE-2026-108914 Edimax BR-6208AC formWlSiteSurvey buffer overflow
- CVE-2026-108913 Code injection in Omarchy
- CVE-2026-10891 Use after free in Chrome
- CVE-2026-108909 Netcore NR268 CGI Endpoint cross-site request forgery
- CVE-2026-108908 Netcore NR268 Web UI l7_call_board_user_set.cgi eval cross site scripting
- CVE-2026-108907 Netcore NR268 CGI Execution user_ok improper authentication
- CVE-2026-108906 Netcore NR268 filter_arp_put_file.cgi filter_arp_put_file_cgi out-of-bounds
- CVE-2026-108905 pH7Builder before 18.6.0 Hard-Coded API Key Bypass via Host Header
- CVE-2026-108904 pH7Builder before 18.5.0 Sensitive Data Exposure via Member API UserController
- CVE-2026-108903 pH7Builder before 19.3.0 CAPTCHA Bypass via Client-Chosen Form ID
- CVE-2026-108902 pH7Builder before 18.5.0 Path Traversal Arbitrary File Deletion via picture_link
- CVE-2026-108901 Shenzhen HCC Technology MPOS M6 PLUS Display QR Code Rendering ui layer
- CVE-2026-108900 Exponent CMS XML-RPC xmlrpc.php userLogin sql injection
- CVE-2026-10890 Use after free in Chrome
- CVE-2026-1089 User‑Controlled HTTP Header In Fortra's GoAnywhere MFT Allows Arbitrary DNS Lookups
- CVE-2026-108899 tobychui zoraxy Path Exception Matcher authProviders.go handleBasicAuth improper authorization
- CVE-2026-108898 Netis WF2409E Wireless Settings cross site scripting
- CVE-2026-108897 Smart Media4U Technology SHAREit App WebView JS Bridge syncInvoke routine
- CVE-2026-108896 Linksys E1700 setLinksysIpv6 os command injection
- CVE-2026-108895 Linksys E1700 setDMZ os command injection
- CVE-2026-108894 Linksys E1700 Static Route addStaticRoute os command injection
- CVE-2026-108893 Linksys E1700 setVlan stack-based overflow
- CVE-2026-108892 Linksys E1700 Mac Filter ssid1MACFilter stack-based overflow
- CVE-2026-108891 JeecgBoot through 3.9.5 Missing Authorization via /sys/user/getUserDetailByUserId
- CVE-2026-108890 BlackBeltTechnology pi-agent-dashboard Terminal terminal-handler.ts terminalManager.spawn improper authorization
- CVE-2026-10889 Memory corruption in Chrome
- CVE-2026-108889 Missing authorization in Cloud Billing
- CVE-2026-108888 JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartRole/exportXls
- CVE-2026-108887 JeecgBoot through 3.9.5 Missing Authorization via /sys/comment/exportXls
- CVE-2026-108886 JeecgBoot through 3.9.5 Missing Authorization via /sys/user/queryChildrenByUsername
- CVE-2026-108885 JeecgBoot through 3.9.5 Missing Authorization via /sys/message/sysMessage/delete
- CVE-2026-108884 JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate Delete Endpoint
- CVE-2026-108883 JeecgBoot through 3.9.5 Missing Authorization via /sys/thirdApp/editThirdAppConfig
- CVE-2026-108882 JeecgBoot through 3.9.5 Missing Authorization via /sys/position/removePositionUser
- CVE-2026-108881 JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/getTenantPackInfo
- CVE-2026-108880 JeecgBoot through 3.9.5 Missing Authorization via /sys/dict/editDictByLowAppId
- CVE-2026-10888 Use after free in Chrome
- CVE-2026-108879 JeecgBoot through 3.9.5 IDOR via /airag/api/getChatVariable Username Parameter
- CVE-2026-108878 JeecgBoot through 3.9.5 Missing Authorization via /airag/app/queryById
- CVE-2026-108877 JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/delete
- CVE-2026-108876 JeecgBoot through 3.9.5 Missing Authorization via /sys/user/putCancelQuit
- CVE-2026-108875 JeecgBoot through 3.9.5 Missing Authorization via /sys/user/addSysUserGroup
- CVE-2026-108874 JeecgBoot through 3.9.5 Missing Authorization via /sys/user/changeDepartChargePerson
- CVE-2026-108873 JeecgBoot through 3.9.5 Missing Authorization via /sys/user/doUpdateDepartInfo
- CVE-2026-108872 JeecgBoot through 3.9.5 Missing Authorization via /sys/user/batchEditUsers
- CVE-2026-108871 JeecgBoot through 3.9.5 Missing Authorization via POST /sys/sysDepartRole/datarule
- CVE-2026-108870 JeecgBoot through 3.9.5 Missing Authorization via POST /sys/role/datarule
- CVE-2026-10887 Use after free in Chrome
- CVE-2026-108869 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendSysAnnouncement
- CVE-2026-108868 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendBusTemplateAnnouncement
- CVE-2026-108867 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserRoleSetById
- CVE-2026-108866 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserAuths
- CVE-2026-108865 AmoyLab Unla through 0.10.0 OAuth2 Authentication Bypass via /authorize
- CVE-2026-108864 iFlytek Astron Agent through 1.1.2 Authorization Bypass via /workflow/v1/resume Endpoint
- CVE-2026-108863 Katanemo Plano through 0.4.37 Missing Authentication on Envoy Admin Interface
- CVE-2026-108862 APIPark through 1.9.7-beta IDOR via application authorization endpoints
- CVE-2026-108861 Odoo MCP 1.0.0 through 1.3.2 Information Disclosure via execute_method Tool
- CVE-2026-108860 BotSharp through 5.2.0 Authentication Bypass via Hard-Coded JWT Signing Key
- CVE-2026-10886 Use after free in Chrome
- CVE-2026-108859 mcp-go through 1.2.1 Denial of Service via Unbounded POST Body Buffering
- CVE-2026-108858 Predibase LoRAX through 0.12.1 API Token Exposure via Router Logs
- CVE-2026-108857 Hugging Face Text Embeddings Inference through 1.9.4 Cleartext API Key Logging
- CVE-2026-108856 UnicomAI Wanwu through 0.6.5 Authorization Bypass via /v1/appspace/app/key AppKey Minting
- CVE-2026-108855 UnicomAI Wanwu through 0.6.5 Missing Authorization via DELETE /v1/appspace/app/publish
- CVE-2026-108854 Wanwu before 0.6.3 IDOR AppKey Deletion via DELETE /v1/appspace/app/key
- CVE-2026-108853 UnicomAI Wanwu before 0.6.3 IDOR via DELETE /v1/appspace/app
- CVE-2026-108852 Deep Chat through 2.5.1 XSS via Markdown Link Validation Bypass
- CVE-2026-108851 phpMyFAQ through 4.1.10 Missing Authorization via MCP Server faq_search Tool
- CVE-2026-108850 Company Research Agent through 2.2.0 SSRF via /generate-pdf ReportLab Markup
- CVE-2026-10885 Use after free in Chrome
- CVE-2026-10884 Use after free in Chrome
- CVE-2026-108839 thClaws through 0.141.0 Symlink Following File Write via POST /v1/inputs
- CVE-2026-108837 Apache Kylin: Potential computed-column resource exhaustion
- CVE-2026-108836 Ollama Pull API name.go IsValid server-side request forgery
- CVE-2026-108835 Yungengxin Yun Jia Security Guard kgameprotect.sys sub_14000885C privileges management
- CVE-2026-108834 Cairo-dock Glx-Dock Query Parameter ww_page.php cross site scripting
- CVE-2026-108833 Apache Kylin: default startup profile miss security settings
- CVE-2026-108831 meetecho janus-gateway Admin API admin.js hard-coded credentials
- CVE-2026-108830 meetecho janus-gateway VideoRoom janus_videoroom.c race condition
- CVE-2026-10883 Memory corruption in Chrome
- CVE-2026-108829 Zen Cart Module Configuration modules.php sql injection
- CVE-2026-108828 Zen Cart Admin Panel configuration.php eval sql injection
- CVE-2026-108827 Zen Cart Administrative Module Management general.php zen_call_function code injection
- CVE-2026-108826 Zen Cart PayPal IPN paypaldp.php zen_db_perform sql injection
- CVE-2026-108825 yangzongzhuan RuoYi authDataScope checkRoleAllowed privileges management
- CVE-2026-108824 DataEase Utils.java Utils.buildCalcField sql injection