# Vulnerabilities published in 2026


- [CVE-2026-100174](https://insights.sbomify.com/CVE-2026-100174/): Stored Cross-Site Scripting (XSS) in AIL Framework Tag Selector via Unescaped Tag Names (medium 5.1)
- [CVE-2026-100172](https://insights.sbomify.com/CVE-2026-100172/): Cross-site scripting in ail framework (high 8.5)
- [CVE-2026-10017](https://insights.sbomify.com/CVE-2026-10017/): Memory corruption in Chrome (high 8.3)
- [CVE-2026-100169](https://insights.sbomify.com/CVE-2026-100169/): Account pre-hijacking in the Prowler API through email based social account linking without verification (high 7.6)
- [CVE-2026-100164](https://insights.sbomify.com/CVE-2026-100164/): User Enumeration in Rolantis Information Technologies' Agentis (high 7.5)
- [CVE-2026-100163](https://insights.sbomify.com/CVE-2026-100163/): Auth bypass in Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress (high 7.4)
- [CVE-2026-100161](https://insights.sbomify.com/CVE-2026-100161/): Cross-site scripting in Photo Reviews for WooCommerce (high 7.2)
- [CVE-2026-10016](https://insights.sbomify.com/CVE-2026-10016/): Use after free in Chrome (high 8.8)
- [CVE-2026-100159](https://insights.sbomify.com/CVE-2026-100159/): Popup Box 6.4.1 - 6.4.2 - Unauthenticated Arbitrary Shortcode Execution via Client-IP / X-Forwarded-For HTTP Headers (medium 4.8)
- [CVE-2026-100158](https://insights.sbomify.com/CVE-2026-100158/): Cross-site scripting in SQL Chart Builder (medium 6.4)
- [CVE-2026-100157](https://insights.sbomify.com/CVE-2026-100157/): Code injection in WP Ultimate Review (medium 6.5)
- [CVE-2026-100153](https://insights.sbomify.com/CVE-2026-100153/): NewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via URL Request Tracking (urlrequested field) (high 7.2)
- [CVE-2026-100152](https://insights.sbomify.com/CVE-2026-100152/): All in One SEO <= 5.0.2 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Query Parameter (medium 6.5)
- [CVE-2026-10015](https://insights.sbomify.com/CVE-2026-10015/): Integer overflow in Chrome (high 8.8)
- [CVE-2026-100149](https://insights.sbomify.com/CVE-2026-100149/): Information disclosure in WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons (medium 5.3)
- [CVE-2026-100148](https://insights.sbomify.com/CVE-2026-100148/): Cross-site scripting in Rich Showcase for Google Reviews (medium 6.4)
- [CVE-2026-100147](https://insights.sbomify.com/CVE-2026-100147/): FunnelKit <= 3.16.0.5 - Unauthenticated Stored Cross-Site Scripting via Order Fields (shipping/billing) (high 7.2)
- [CVE-2026-100145](https://insights.sbomify.com/CVE-2026-100145/): Synchrony Financing 1.0.5 - 1.1.1 - Unauthenticated Order Takeover via admin_order_callback REST Route (medium 6.5)
- [CVE-2026-100143](https://insights.sbomify.com/CVE-2026-100143/): FluentCart < 1.6.5 - Unauthenticated Guest Customer Account Takeover via Checkout Email (medium 6.5)
- [CVE-2026-100142](https://insights.sbomify.com/CVE-2026-100142/): FluentCart < 2.2.0 - Unauthenticated Customer Address Disclosure via IDOR (medium 5.3)
- [CVE-2026-10014](https://insights.sbomify.com/CVE-2026-10014/): Use after free in Chrome (high 8.3)
- [CVE-2026-100139](https://insights.sbomify.com/CVE-2026-100139/): CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400) (high 7.5)
- [CVE-2026-100138](https://insights.sbomify.com/CVE-2026-100138/): CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400) (high 7.5)
- [CVE-2026-100137](https://insights.sbomify.com/CVE-2026-100137/): CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400) (high 7.5)
- [CVE-2026-100136](https://insights.sbomify.com/CVE-2026-100136/): CAI Content Credentials | Integer Overflow or Wraparound (CWE-190) (high 7.5)
- [CVE-2026-100135](https://insights.sbomify.com/CVE-2026-100135/): CAI Content Credentials | Improper Input Validation (CWE-20) (high 7.5)
- [CVE-2026-100134](https://insights.sbomify.com/CVE-2026-100134/): Acrobat for Edge | Out-of-bounds Write (CWE-787) (high 8.8)
- [CVE-2026-100133](https://insights.sbomify.com/CVE-2026-100133/): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (critical 9.3)
- [CVE-2026-100132](https://insights.sbomify.com/CVE-2026-100132/): Acrobat for Edge | Out-of-bounds Read (CWE-125) (medium 4.3)
- [CVE-2026-100131](https://insights.sbomify.com/CVE-2026-100131/): Substance3D - Sampler | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2026-100130](https://insights.sbomify.com/CVE-2026-100130/): Substance3D - Sampler | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2026-10013](https://insights.sbomify.com/CVE-2026-10013/): Use after free in Chrome (high 8.8)
- [CVE-2026-100129](https://insights.sbomify.com/CVE-2026-100129/): Bridge | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-100128](https://insights.sbomify.com/CVE-2026-100128/): Bridge | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-100127](https://insights.sbomify.com/CVE-2026-100127/): Bridge | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-100126](https://insights.sbomify.com/CVE-2026-100126/): Bridge | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2026-100125](https://insights.sbomify.com/CVE-2026-100125/): CAI Content Credentials | Improper Input Validation (CWE-20) (medium 5.9)
- [CVE-2026-100124](https://insights.sbomify.com/CVE-2026-100124/): CAI Content Credentials | Improper Input Validation (CWE-20) (high 7.5)
- [CVE-2026-100123](https://insights.sbomify.com/CVE-2026-100123/): CAI Content Credentials | Improper Certificate Validation (CWE-295) (high 7.5)
- [CVE-2026-100122](https://insights.sbomify.com/CVE-2026-100122/): CAI Content Credentials | Improper Certificate Validation (CWE-295) (high 7.5)
- [CVE-2026-100121](https://insights.sbomify.com/CVE-2026-100121/): CAI Content Credentials | Improper Certificate Validation (CWE-295) (high 7.5)
- [CVE-2026-100120](https://insights.sbomify.com/CVE-2026-100120/): CAI Content Credentials | Improper Input Validation (CWE-20) (high 7.5)
- [CVE-2026-10012](https://insights.sbomify.com/CVE-2026-10012/): Use after free in Chrome (high 8.3)
- [CVE-2026-100119](https://insights.sbomify.com/CVE-2026-100119/): CAI Content Credentials | Improper Input Validation (CWE-20) (high 7.5)
- [CVE-2026-100118](https://insights.sbomify.com/CVE-2026-100118/): CAI Content Credentials | Improper Certificate Validation (CWE-295) (high 7.5)
- [CVE-2026-100117](https://insights.sbomify.com/CVE-2026-100117/): CAI Content Credentials | Improper Input Validation (CWE-20) (high 7.5)
- [CVE-2026-100116](https://insights.sbomify.com/CVE-2026-100116/): CAI Content Credentials | Improper Certificate Validation (CWE-295) (medium 5.9)
- [CVE-2026-100115](https://insights.sbomify.com/CVE-2026-100115/): CAI Content Credentials | Improper Access Control (CWE-284) (high 7.5)
- [CVE-2026-100114](https://insights.sbomify.com/CVE-2026-100114/): CAI Content Credentials | Improper Access Control (CWE-284) (high 7.5)
- [CVE-2026-100113](https://insights.sbomify.com/CVE-2026-100113/): CAI Content Credentials | Improper Input Validation (CWE-20) (high 7.5)
- [CVE-2026-100112](https://insights.sbomify.com/CVE-2026-100112/): Photoshop Desktop | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-100111](https://insights.sbomify.com/CVE-2026-100111/): Photoshop Desktop | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-10011](https://insights.sbomify.com/CVE-2026-10011/): Information disclosure in Chrome (low 3.1)
- [CVE-2026-100108](https://insights.sbomify.com/CVE-2026-100108/): Social Share Buttons <= 1.30 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'share_url' Network Setting (medium 6.4)
- [CVE-2026-100107](https://insights.sbomify.com/CVE-2026-100107/): Cross-site scripting in Kubio AI Page Builder (high 7.2)
- [CVE-2026-100106](https://insights.sbomify.com/CVE-2026-100106/): FiboSearch <= 1.34.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'purchased_plan' Parameter (medium 6.4)
- [CVE-2026-100105](https://insights.sbomify.com/CVE-2026-100105/): Alerting contact point authorization bypass via schema downgrade (high 7.7)
- [CVE-2026-100104](https://insights.sbomify.com/CVE-2026-100104/): Server-Side Request Forgery (SSRF) in GitLab (low 3.5)
- [CVE-2026-100103](https://insights.sbomify.com/CVE-2026-100103/): Authentication bypass via default auth token in P4Search (critical 10.0)
- [CVE-2026-100102](https://insights.sbomify.com/CVE-2026-100102/): RCE via exposed JDWP debug agent in P4Search (critical 9.5)
- [CVE-2026-10010](https://insights.sbomify.com/CVE-2026-10010/): Security feature bypass in Chrome (medium 5.0)
- [CVE-2026-1001](https://insights.sbomify.com/CVE-2026-1001/): Domoticz < 2026.1 Stored XSS via Hardware Configuration Endpoint (medium 4.8)
- [CVE-2026-10009](https://insights.sbomify.com/CVE-2026-10009/): Integer overflow in Chrome (high 7.5)
- [CVE-2026-10008](https://insights.sbomify.com/CVE-2026-10008/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-100079](https://insights.sbomify.com/CVE-2026-100079/): usb: typec: ucsi: unregister debugfs entries on teardown (medium 5.5)
- [CVE-2026-100078](https://insights.sbomify.com/CVE-2026-100078/): wifi: iwlwifi: mei: pass correct argument to function (medium 5.5)
- [CVE-2026-100077](https://insights.sbomify.com/CVE-2026-100077/): drm/msm: Recover HW before retire hung submit (medium 5.5)
- [CVE-2026-100076](https://insights.sbomify.com/CVE-2026-100076/): staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths (medium 5.5)
- [CVE-2026-100075](https://insights.sbomify.com/CVE-2026-100075/): RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters (critical 9.8)
- [CVE-2026-100074](https://insights.sbomify.com/CVE-2026-100074/): bpf: Mark bpf_refcount field as unique (medium 5.5)
- [CVE-2026-100073](https://insights.sbomify.com/CVE-2026-100073/): ext4: fix transaction overflow during writeback (medium 5.5)
- [CVE-2026-100072](https://insights.sbomify.com/CVE-2026-100072/): ACPI: platform: Use acpi_bus_get_primary_device() (high 7.8)
- [CVE-2026-100071](https://insights.sbomify.com/CVE-2026-100071/): net: hsr: free learned nodes on device setup failure (medium 5.5)
- [CVE-2026-100070](https://insights.sbomify.com/CVE-2026-100070/): netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet (medium 5.5)
- [CVE-2026-10007](https://insights.sbomify.com/CVE-2026-10007/): Use after free in Chrome (high 8.8)
- [CVE-2026-10006](https://insights.sbomify.com/CVE-2026-10006/): Race condition in Chrome (high 7.5)
- [CVE-2026-10005](https://insights.sbomify.com/CVE-2026-10005/): Use after free in Chrome (high 7.5)
- [CVE-2026-10004](https://insights.sbomify.com/CVE-2026-10004/): Other in Chrome (medium 5.4)
- [CVE-2026-10003](https://insights.sbomify.com/CVE-2026-10003/): Use after free in Chrome (high 7.5)
- [CVE-2026-10002](https://insights.sbomify.com/CVE-2026-10002/): Use after free in Chrome (high 8.8)
- [CVE-2026-10001](https://insights.sbomify.com/CVE-2026-10001/): Use after free in Chrome (high 8.3)
- [CVE-2026-10000](https://insights.sbomify.com/CVE-2026-10000/): Use after free in Chrome (high 8.3)
- [CVE-2026-1000](https://insights.sbomify.com/CVE-2026-1000/): MailerLite - WooCommerce integration <= 3.1.3 - Missing Authorization to Data Deletion (medium 6.5)
- [CVE-2026-0999](https://insights.sbomify.com/CVE-2026-0999/): Authentication bypass via userID login when email and username login are disabled (medium 5.4)
- [CVE-2026-0998](https://insights.sbomify.com/CVE-2026-0998/): Mattermost Zoom Plugin allows unauthorized meeting creation and post modification via insufficient API access controls (medium 4.3)
- [CVE-2026-0997](https://insights.sbomify.com/CVE-2026-0997/): Mattermost Zoom Plugin channel preference API lacks authorization checks (medium 4.3)
- [CVE-2026-0996](https://insights.sbomify.com/CVE-2026-0996/): Fluent Forms <= 6.1.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via AI Form Builder Module (medium 6.4)
- [CVE-2026-0995](https://insights.sbomify.com/CVE-2026-0995/): Race condition in C1 Pro (low 3.6)
- [CVE-2026-0994](https://insights.sbomify.com/CVE-2026-0994/): Denial of Service in Python Protobuf (high 8.2)
- [CVE-2026-0993](https://insights.sbomify.com/CVE-2026-0993/): SODOLA SL902-SWTGW124AS Buffer Overflow DoS via Multipart Boundary Parser (high 8.7)
- [CVE-2026-0992](https://insights.sbomify.com/CVE-2026-0992/): Libxml2: libxml2: denial of service via crafted xml catalogs (low 2.9)
- [CVE-2026-0990](https://insights.sbomify.com/CVE-2026-0990/): Libxml2: libxml2: denial of service via uncontrolled recursion in xml catalog processing (medium 5.9)
- [CVE-2026-0989](https://insights.sbomify.com/CVE-2026-0989/): Libxml2: unbounded relaxng include recursion leading to stack overflow (low 3.7)
- [CVE-2026-0988](https://insights.sbomify.com/CVE-2026-0988/): Glib: glib: denial of service via integer overflow in g_buffered_input_stream_peek() (low 3.7)
- [CVE-2026-0983](https://insights.sbomify.com/CVE-2026-0983/): Denial of service vulnerability in M-Files Server (high 7.1)
- [CVE-2026-0980](https://insights.sbomify.com/CVE-2026-0980/): Rubyipmi: red hat satellite: remote code execution in rubyipmi via malicious bmc username (high 8.3)
- [CVE-2026-0977](https://insights.sbomify.com/CVE-2026-0977/): IBM CICS Transaction Gateway for Multiplatforms Information Disclosure (medium 5.1)
- [CVE-2026-0976](https://insights.sbomify.com/CVE-2026-0976/): Org.keycloak/keycloak-quarkus-server: keycloak: proxy bypass due to improper handling of matrix parameters in url paths (low 3.7)
- [CVE-2026-0975](https://insights.sbomify.com/CVE-2026-0975/): DIAView - Command Injection Vulnerability (high 7.8)
- [CVE-2026-0974](https://insights.sbomify.com/CVE-2026-0974/): Orderable <= 1.20.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/1005/