# Vulnerabilities published in 2026


- [GHSA-2jx3-ff3v-j7jj](https://insights.sbomify.com/GHSA-2jx3-ff3v-j7jj/): yara-x: Unvalidated deserialization in safe `Rules::deserialize` allows memory corruption and UB (not scored)
- [GHSA-2jx3-65f3-xr8r](https://insights.sbomify.com/GHSA-2jx3-65f3-xr8r/): `OTPHP\Factory::loadFromProvisioningUri()` parses an attacker-supplied `otpauth://` URI and forwards **every** query key to `OTP: (not scored)
- [GHSA-2j22-pr5w-6gq8](https://insights.sbomify.com/GHSA-2j22-pr5w-6gq8/): Loofah has improper detection of disallowed URIs via `allowed_uri?` (not scored)
- [GHSA-2hm8-rqrm-xfjq](https://insights.sbomify.com/GHSA-2hm8-rqrm-xfjq/): OpenClaw's owner-only gateway tool access checks were incomplete in specific authenticated DM flows (not scored)
- [GHSA-2g87-pp6c-29x5](https://insights.sbomify.com/GHSA-2g87-pp6c-29x5/): aiohttp: Multiple instances of excessive or unbounded memory/CPU use (not scored)
- [GHSA-2ch6-x3g4-7759](https://insights.sbomify.com/GHSA-2ch6-x3g4-7759/): OpenClaw's commands.allowFrom sender authorization accepted conversation identifiers via ctx.From (not scored)
- [GHSA-2ccx-cjjh-r2j8](https://insights.sbomify.com/GHSA-2ccx-cjjh-r2j8/): MediaMTX affected by CVE-2026-27143 due to vulnerable dependency (not scored)
- [GHSA-2c85-rfcc-g74j](https://insights.sbomify.com/GHSA-2c85-rfcc-g74j/): Karate Mock Server RCE via embedded expression evaluation of request-derived data (not scored)
- [GHSA-2c6h-4899-wjxr](https://insights.sbomify.com/GHSA-2c6h-4899-wjxr/): Multiple soundness issues in `scaly` safe APIs (not scored)
- [GHSA-29h2-jr22-frmh](https://insights.sbomify.com/GHSA-29h2-jr22-frmh/): Impact Two locations consume an encrypted handle returned by an untrusted external party and use it without verifying that the party is ACL-authorized on it. (not scored)
- [GHSA-2944-57xv-2682](https://insights.sbomify.com/GHSA-2944-57xv-2682/): @asymmetric-effort/specifyjs: `data:` URI allowed without size restriction (not scored)
- [GHSA-28xx-pppm-vqff](https://insights.sbomify.com/GHSA-28xx-pppm-vqff/): Impact Transactions were NOT committed despite the explicit `options.WithCommit` flag using table service client. (not scored)
- [GHSA-2858-xg23-26fp](https://insights.sbomify.com/GHSA-2858-xg23-26fp/): OpenClaw: Node camera URL payload host-binding bypass allowed gateway fetch pivots (not scored)
- [GHSA-27qh-8cxx-2cr5](https://insights.sbomify.com/GHSA-27qh-8cxx-2cr5/): AWS SDK for PHP has CloudFront Policy Document Injection via Special Characters (not scored)
- [GHSA-27jp-wm6q-gp25](https://insights.sbomify.com/GHSA-27jp-wm6q-gp25/): sqlparse: formatting list of tuples leads to denial of service (not scored)
- [GHSA-27f5-xjrr-q9ff](https://insights.sbomify.com/GHSA-27f5-xjrr-q9ff/): Malware in @opensearch-project/opensearch (not scored)
- [GHSA-26wg-9xf2-q495](https://insights.sbomify.com/GHSA-26wg-9xf2-q495/): Novu has a XSS sanitization bypass (not scored)
- [GHSA-26w7-cxv4-gfx2](https://insights.sbomify.com/GHSA-26w7-cxv4-gfx2/): Astro: Remote code execution through AVIF image optimization (not scored)
- [GHSA-26gq-grmh-6xm6](https://insights.sbomify.com/GHSA-26gq-grmh-6xm6/): Gogs vulnerable to Stored XSS via Mermaid diagrams (not scored)
- [GHSA-2625-rw7m-5q5x](https://insights.sbomify.com/GHSA-2625-rw7m-5q5x/): Hubuum client library (Rust): Sensitive data may be exposed through default diagnostics (not scored)
- [GHSA-258c-965c-p3hc](https://insights.sbomify.com/GHSA-258c-965c-p3hc/): Daptin's Session Management Vulnerability Leads to Insufficient Session Expiration After Password Change (not scored)
- [GHSA-253c-mchw-3w2r](https://insights.sbomify.com/GHSA-253c-mchw-3w2r/): Two independent quadratic paths in the `linkify: true` handling. (not scored)
- [GHSA-248h-974q-xrc2](https://insights.sbomify.com/GHSA-248h-974q-xrc2/): axonflow-sdk-java: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification (not scored)
- [GHSA-2464-fhr4-w9xw](https://insights.sbomify.com/GHSA-2464-fhr4-w9xw/): Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used (not scored)
- [GHSA-22w5-2fxg-vrwx](https://insights.sbomify.com/GHSA-22w5-2fxg-vrwx/): Impact Unauthenticated denial of service. (not scored)
- [GHSA-22w3-693w-x895](https://insights.sbomify.com/GHSA-22w3-693w-x895/): webauthn-rs-core/webauthn-authenticator-rs: Origin validation mismatch possible when subdomains are allowed (not scored)
- [GHSA-22vx-2x23-98w6](https://insights.sbomify.com/GHSA-22vx-2x23-98w6/): OpenSearch vulnerable to improper authorization for Rollover Requests (not scored)
- [DRUPAL-CORE-2026-013](https://insights.sbomify.com/DRUPAL-CORE-2026-013/): The Drupal project uses the [CKEditor](https://github.com/ckeditor/ckeditor5) library for WYSIWYG editing. (not scored)
- [DRUPAL-CONTRIB-2026-265](https://insights.sbomify.com/DRUPAL-CONTRIB-2026-265/): This module enables you to use the Stripe Connect API to quickly configure your Drupal Commerce store to take payments via multiple Stripe APIs. (not scored)
- [DRUPAL-CONTRIB-2026-246](https://insights.sbomify.com/DRUPAL-CONTRIB-2026-246/): TinyPNG uses smart lossy compression techniques to reduce the file size of your PNG files. (not scored)
- [CVE-2026-99999](https://insights.sbomify.com/CVE-2026-99999/): ipv4: validate checksum_start before completing checksum (critical 9.3)
- [CVE-2026-9999](https://insights.sbomify.com/CVE-2026-9999/): Privilege escalation in Chrome (high 8.8)
- [CVE-2026-9998](https://insights.sbomify.com/CVE-2026-9998/): Integer overflow in Chrome (high 8.3)
- [CVE-2026-9997](https://insights.sbomify.com/CVE-2026-9997/): Use after free in Chrome (high 8.3)
- [CVE-2026-9996](https://insights.sbomify.com/CVE-2026-9996/): Memory corruption in Chrome (medium 6.5)
- [CVE-2026-9995](https://insights.sbomify.com/CVE-2026-9995/): Use after free in Chrome (high 8.8)
- [CVE-2026-9994](https://insights.sbomify.com/CVE-2026-9994/): Use after free in Chrome (high 8.3)
- [CVE-2026-9993](https://insights.sbomify.com/CVE-2026-9993/): Use after free in Chrome (high 8.3)
- [CVE-2026-9992](https://insights.sbomify.com/CVE-2026-9992/): Use after free in Chrome (high 8.8)
- [CVE-2026-9991](https://insights.sbomify.com/CVE-2026-9991/): Information disclosure in Chrome (low 3.1)
- [CVE-2026-9990](https://insights.sbomify.com/CVE-2026-9990/): Use after free in Chrome (high 7.5)
- [CVE-2026-9989](https://insights.sbomify.com/CVE-2026-9989/): Security feature bypass in Chrome (medium 6.3)
- [CVE-2026-9988](https://insights.sbomify.com/CVE-2026-9988/): Use after free in Chrome (high 8.3)
- [CVE-2026-9987](https://insights.sbomify.com/CVE-2026-9987/): Code injection in Chrome (high 7.8)
- [CVE-2026-9986](https://insights.sbomify.com/CVE-2026-9986/): Other in Chrome (medium 4.2)
- [CVE-2026-9985](https://insights.sbomify.com/CVE-2026-9985/): Information disclosure in Chrome (medium 5.3)
- [CVE-2026-9984](https://insights.sbomify.com/CVE-2026-9984/): Use after free in Chrome (high 8.8)
- [CVE-2026-9983](https://insights.sbomify.com/CVE-2026-9983/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-9982](https://insights.sbomify.com/CVE-2026-9982/): Security feature bypass in Chrome (high 8.3)
- [CVE-2026-9981](https://insights.sbomify.com/CVE-2026-9981/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-9980](https://insights.sbomify.com/CVE-2026-9980/): Security feature bypass in Chrome (medium 5.0)
- [CVE-2026-9979](https://insights.sbomify.com/CVE-2026-9979/): Security feature bypass in Chrome (medium 5.0)
- [CVE-2026-9978](https://insights.sbomify.com/CVE-2026-9978/): Use after free in Chrome (high 8.8)
- [CVE-2026-9977](https://insights.sbomify.com/CVE-2026-9977/): Security feature bypass in Chrome (high 8.3)
- [CVE-2026-9976](https://insights.sbomify.com/CVE-2026-9976/): Code injection in Chrome (high 8.8)
- [CVE-2026-9975](https://insights.sbomify.com/CVE-2026-9975/): Memory corruption in Chrome (high 8.3)
- [CVE-2026-9974](https://insights.sbomify.com/CVE-2026-9974/): Memory corruption in Chrome (high 8.3)
- [CVE-2026-9973](https://insights.sbomify.com/CVE-2026-9973/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-9972](https://insights.sbomify.com/CVE-2026-9972/): Memory corruption in Chrome (high 8.3)
- [CVE-2026-9971](https://insights.sbomify.com/CVE-2026-9971/): Cross-site scripting in Chrome (medium 5.4)
- [CVE-2026-9970](https://insights.sbomify.com/CVE-2026-9970/): Use after free in Chrome (high 8.3)
- [CVE-2026-9969](https://insights.sbomify.com/CVE-2026-9969/): Other in Chrome (high 8.8)
- [CVE-2026-9968](https://insights.sbomify.com/CVE-2026-9968/): Integer overflow in Chrome (high 8.8)
- [CVE-2026-9967](https://insights.sbomify.com/CVE-2026-9967/): Memory corruption in Chrome (critical 9.6)
- [CVE-2026-9966](https://insights.sbomify.com/CVE-2026-9966/): Integer overflow in Chrome (high 8.3)
- [CVE-2026-9965](https://insights.sbomify.com/CVE-2026-9965/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-9964](https://insights.sbomify.com/CVE-2026-9964/): Use after free in Chrome (high 8.1)
- [CVE-2026-9963](https://insights.sbomify.com/CVE-2026-9963/): Memory corruption in Chrome (high 7.5)
- [CVE-2026-9962](https://insights.sbomify.com/CVE-2026-9962/): Use after free in Chrome (high 8.8)
- [CVE-2026-9961](https://insights.sbomify.com/CVE-2026-9961/): Use after free in Chrome (high 8.8)
- [CVE-2026-9960](https://insights.sbomify.com/CVE-2026-9960/): Integer overflow in Chrome (high 7.5)
- [CVE-2026-9959](https://insights.sbomify.com/CVE-2026-9959/): Race condition in Chrome (low 3.1)
- [CVE-2026-9958](https://insights.sbomify.com/CVE-2026-9958/): Use after free in Chrome (high 8.8)
- [CVE-2026-9957](https://insights.sbomify.com/CVE-2026-9957/): Use after free in Chrome (high 8.8)
- [CVE-2026-9956](https://insights.sbomify.com/CVE-2026-9956/): Use after free in Chrome (high 7.5)
- [CVE-2026-9955](https://insights.sbomify.com/CVE-2026-9955/): Information disclosure in Chrome (medium 4.3)
- [CVE-2026-9954](https://insights.sbomify.com/CVE-2026-9954/): Use after free in Chrome (high 7.5)
- [CVE-2026-9953](https://insights.sbomify.com/CVE-2026-9953/): Memory corruption in Chrome (medium 6.5)
- [CVE-2026-9952](https://insights.sbomify.com/CVE-2026-9952/): Use after free in Chrome (high 8.8)
- [CVE-2026-9951](https://insights.sbomify.com/CVE-2026-9951/): Use after free in Chrome (high 8.3)
- [CVE-2026-9950](https://insights.sbomify.com/CVE-2026-9950/): Security feature bypass in Chrome (low 3.1)
- [CVE-2026-9949](https://insights.sbomify.com/CVE-2026-9949/): Use after free in Chrome (high 8.3)
- [CVE-2026-9948](https://insights.sbomify.com/CVE-2026-9948/): Use after free in Chrome (high 8.3)
- [CVE-2026-9947](https://insights.sbomify.com/CVE-2026-9947/): Use after free in Chrome (high 8.8)
- [CVE-2026-9946](https://insights.sbomify.com/CVE-2026-9946/): Use after free in Chrome (high 8.3)
- [CVE-2026-9945](https://insights.sbomify.com/CVE-2026-9945/): Use after free in Chrome (high 8.8)
- [CVE-2026-9944](https://insights.sbomify.com/CVE-2026-9944/): Information disclosure in Chrome (low 3.1)
- [CVE-2026-9943](https://insights.sbomify.com/CVE-2026-9943/): Memory corruption in Chrome (medium 4.3)
- [CVE-2026-9942](https://insights.sbomify.com/CVE-2026-9942/): Memory corruption in Chrome (medium 5.0)
- [CVE-2026-9941](https://insights.sbomify.com/CVE-2026-9941/): Use after free in Chrome (high 8.8)
- [CVE-2026-9940](https://insights.sbomify.com/CVE-2026-9940/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-9939](https://insights.sbomify.com/CVE-2026-9939/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-9938](https://insights.sbomify.com/CVE-2026-9938/): Code injection in Chrome (high 8.8)
- [CVE-2026-9937](https://insights.sbomify.com/CVE-2026-9937/): Use after free in Chrome (high 8.3)
- [CVE-2026-9936](https://insights.sbomify.com/CVE-2026-9936/): Use after free in Chrome (high 8.3)
- [CVE-2026-9935](https://insights.sbomify.com/CVE-2026-9935/): Information disclosure in Chrome (medium 4.3)
- [CVE-2026-9934](https://insights.sbomify.com/CVE-2026-9934/): Use after free in Chrome (high 7.5)
- [CVE-2026-9933](https://insights.sbomify.com/CVE-2026-9933/): Use after free in Chrome (high 7.5)
- [CVE-2026-9932](https://insights.sbomify.com/CVE-2026-9932/): Use after free in Chrome (high 8.3)
- [CVE-2026-9931](https://insights.sbomify.com/CVE-2026-9931/): Use after free in Chrome (high 8.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/199/