# Vulnerabilities published in 2026


- [CVE-2026-95337](https://insights.sbomify.com/CVE-2026-95337/): Other in Chrome (medium 5.4)
- [CVE-2026-95336](https://insights.sbomify.com/CVE-2026-95336/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-95335](https://insights.sbomify.com/CVE-2026-95335/): Use after free in Chrome (high 8.3)
- [CVE-2026-95334](https://insights.sbomify.com/CVE-2026-95334/): Other in Chrome (high 8.3)
- [CVE-2026-95333](https://insights.sbomify.com/CVE-2026-95333/): Use after free in Chrome (high 8.1)
- [CVE-2026-95332](https://insights.sbomify.com/CVE-2026-95332/): Information disclosure in Chrome (medium 4.7)
- [CVE-2026-95331](https://insights.sbomify.com/CVE-2026-95331/): Memory corruption in Chrome (critical 9.6)
- [CVE-2026-95330](https://insights.sbomify.com/CVE-2026-95330/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-9533](https://insights.sbomify.com/CVE-2026-9533/): Totolink CA750-PoE Setting cstecgi.cgi recvUpgradeNewFw os command injection (medium 5.3)
- [CVE-2026-95329](https://insights.sbomify.com/CVE-2026-95329/): Memory corruption in Chrome (critical 9.6)
- [CVE-2026-95328](https://insights.sbomify.com/CVE-2026-95328/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-95327](https://insights.sbomify.com/CVE-2026-95327/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-95326](https://insights.sbomify.com/CVE-2026-95326/): Security feature bypass in Chrome (high 8.4)
- [CVE-2026-95325](https://insights.sbomify.com/CVE-2026-95325/): Use after free in Chrome (critical 9.6)
- [CVE-2026-95324](https://insights.sbomify.com/CVE-2026-95324/): Information disclosure in Chrome (low 3.4)
- [CVE-2026-95323](https://insights.sbomify.com/CVE-2026-95323/): Other in Chrome (medium 5.4)
- [CVE-2026-95322](https://insights.sbomify.com/CVE-2026-95322/): Memory corruption in Chrome (high 8.3)
- [CVE-2026-95321](https://insights.sbomify.com/CVE-2026-95321/): Other in Chrome (medium 5.4)
- [CVE-2026-95320](https://insights.sbomify.com/CVE-2026-95320/): Missing authorization in Chrome (medium 5.4)
- [CVE-2026-9532](https://insights.sbomify.com/CVE-2026-9532/): Totolink CA750-PoE Setting cstecgi.cgi setUploadUserData os command injection (medium 5.3)
- [CVE-2026-95319](https://insights.sbomify.com/CVE-2026-95319/): Use after free in Chrome (high 8.3)
- [CVE-2026-95318](https://insights.sbomify.com/CVE-2026-95318/): Memory corruption in Chrome (critical 9.6)
- [CVE-2026-95317](https://insights.sbomify.com/CVE-2026-95317/): Missing authorization in Chrome (low 3.1)
- [CVE-2026-95316](https://insights.sbomify.com/CVE-2026-95316/): Information disclosure in Chrome (low 2.9)
- [CVE-2026-95315](https://insights.sbomify.com/CVE-2026-95315/): Use after free in Chrome (high 7.8)
- [CVE-2026-95314](https://insights.sbomify.com/CVE-2026-95314/): Security feature bypass in Chrome (high 8.1)
- [CVE-2026-95313](https://insights.sbomify.com/CVE-2026-95313/): Use after free in Chrome (critical 9.6)
- [CVE-2026-95312](https://insights.sbomify.com/CVE-2026-95312/): Information disclosure in Chrome (low 3.1)
- [CVE-2026-95311](https://insights.sbomify.com/CVE-2026-95311/): Memory corruption in Chrome (critical 9.6)
- [CVE-2026-95310](https://insights.sbomify.com/CVE-2026-95310/): Use after free in Chrome (critical 9.6)
- [CVE-2026-9531](https://insights.sbomify.com/CVE-2026-9531/): Totolink CA750-PoE Setting cstecgi.cgi setUpgradeUboot os command injection (medium 5.3)
- [CVE-2026-95309](https://insights.sbomify.com/CVE-2026-95309/): Other in Chrome (medium 5.4)
- [CVE-2026-95308](https://insights.sbomify.com/CVE-2026-95308/): Integer overflow in Chrome (low 3.4)
- [CVE-2026-95307](https://insights.sbomify.com/CVE-2026-95307/): Other in Chrome (medium 5.4)
- [CVE-2026-95306](https://insights.sbomify.com/CVE-2026-95306/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-95305](https://insights.sbomify.com/CVE-2026-95305/): Other in Chrome (medium 4.8)
- [CVE-2026-95304](https://insights.sbomify.com/CVE-2026-95304/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-95303](https://insights.sbomify.com/CVE-2026-95303/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-95302](https://insights.sbomify.com/CVE-2026-95302/): Missing authorization in Chrome (low 2.9)
- [CVE-2026-95301](https://insights.sbomify.com/CVE-2026-95301/): Missing authorization in Chrome (high 8.1)
- [CVE-2026-95300](https://insights.sbomify.com/CVE-2026-95300/): Missing authorization in Chrome (medium 4.8)
- [CVE-2026-9530](https://insights.sbomify.com/CVE-2026-9530/): GNU LibreDWG Dwgbmp Utility decode.c read_2004_compressed_section out-of-bounds (medium 4.8)
- [CVE-2026-95299](https://insights.sbomify.com/CVE-2026-95299/): Use after free in Chrome (critical 9.6)
- [CVE-2026-95298](https://insights.sbomify.com/CVE-2026-95298/): Use after free in Chrome (high 7.8)
- [CVE-2026-95297](https://insights.sbomify.com/CVE-2026-95297/): Missing authorization in Chrome (medium 6.5)
- [CVE-2026-95296](https://insights.sbomify.com/CVE-2026-95296/): Missing authorization in Chrome (medium 4.3)
- [CVE-2026-95295](https://insights.sbomify.com/CVE-2026-95295/): Information disclosure in Chrome (medium 4.6)
- [CVE-2026-95294](https://insights.sbomify.com/CVE-2026-95294/): Other in Chrome (medium 5.4)
- [CVE-2026-95293](https://insights.sbomify.com/CVE-2026-95293/): Information disclosure in Chrome (medium 4.7)
- [CVE-2026-95292](https://insights.sbomify.com/CVE-2026-95292/): Security feature bypass in Chrome (medium 4.8)
- [CVE-2026-95291](https://insights.sbomify.com/CVE-2026-95291/): Other in Chrome (medium 5.4)
- [CVE-2026-95290](https://insights.sbomify.com/CVE-2026-95290/): Missing authorization in Chrome (medium 5.4)
- [CVE-2026-9529](https://insights.sbomify.com/CVE-2026-9529/): GNU LibreDWG Dwggrep Utility dwggrep.c match_BLOCK_HEADER null pointer dereference (medium 4.8)
- [CVE-2026-95289](https://insights.sbomify.com/CVE-2026-95289/): Missing authorization in Chrome (medium 4.3)
- [CVE-2026-95288](https://insights.sbomify.com/CVE-2026-95288/): Other in Chrome (medium 5.4)
- [CVE-2026-95287](https://insights.sbomify.com/CVE-2026-95287/): Missing authorization in Chrome (medium 5.4)
- [CVE-2026-95286](https://insights.sbomify.com/CVE-2026-95286/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-95285](https://insights.sbomify.com/CVE-2026-95285/): Missing authorization in Chrome (high 8.4)
- [CVE-2026-95284](https://insights.sbomify.com/CVE-2026-95284/): Memory corruption in Chrome (critical 9.6)
- [CVE-2026-95283](https://insights.sbomify.com/CVE-2026-95283/): Memory corruption in Chrome (critical 9.6)
- [CVE-2026-95282](https://insights.sbomify.com/CVE-2026-95282/): Use after free in Chrome (high 8.8)
- [CVE-2026-95281](https://insights.sbomify.com/CVE-2026-95281/): Memory corruption in Chrome (critical 9.6)
- [CVE-2026-95280](https://insights.sbomify.com/CVE-2026-95280/): Race condition in Chrome (high 7.5)
- [CVE-2026-9528](https://insights.sbomify.com/CVE-2026-9528/): itsourcecode Electronic Judging System delete_judge.php sql injection (medium 6.9)
- [CVE-2026-95279](https://insights.sbomify.com/CVE-2026-95279/): Other in Chrome (medium 5.4)
- [CVE-2026-95278](https://insights.sbomify.com/CVE-2026-95278/): Missing authorization in Chrome (high 8.4)
- [CVE-2026-95277](https://insights.sbomify.com/CVE-2026-95277/): Use after free in Chrome (critical 9.6)
- [CVE-2026-95276](https://insights.sbomify.com/CVE-2026-95276/): Other in Chrome (high 8.3)
- [CVE-2026-95275](https://insights.sbomify.com/CVE-2026-95275/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-95274](https://insights.sbomify.com/CVE-2026-95274/): Code injection in Chrome (high 8.3)
- [CVE-2026-95273](https://insights.sbomify.com/CVE-2026-95273/): dgtlmoon changedetection.io visual_selector_data flask_app.py static_content path traversal (medium 5.3)
- [CVE-2026-95272](https://insights.sbomify.com/CVE-2026-95272/): dgtlmoon changedetection.io Screenshot flask_app.py static_content path traversal (medium 6.3)
- [CVE-2026-95271](https://insights.sbomify.com/CVE-2026-95271/): dgtlmoon changedetection.io Authentication Hook flask_app.py check_authentication improper authentication (medium 6.9)
- [CVE-2026-95270](https://insights.sbomify.com/CVE-2026-95270/): dgtlmoon changedetection.io Hash Comparison flask_app.py check_password timing discrepancy (medium 6.3)
- [CVE-2026-9527](https://insights.sbomify.com/CVE-2026-9527/): itsourcecode Electronic Judging System judges.php cross site scripting (medium 5.3)
- [CVE-2026-95265](https://insights.sbomify.com/CVE-2026-95265/): Feehi CMS 2.1.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the UEditor catchimage endpoint. (high 7.5)
- [CVE-2026-95264](https://insights.sbomify.com/CVE-2026-95264/): Feehi CMS 2.1.1 is vulnerable to Directory Traversal. (medium 6.5)
- [CVE-2026-95263](https://insights.sbomify.com/CVE-2026-95263/): Feehi CMS 2.1.1 is vulnerable to Incorrect Access Control. (high 7.2)
- [CVE-2026-9526](https://insights.sbomify.com/CVE-2026-9526/): itsourcecode Electronic Judging System edit_team.php sql injection (medium 6.9)
- [CVE-2026-9525](https://insights.sbomify.com/CVE-2026-9525/): itsourcecode Electronic Judging System edit_judge.php sql injection (medium 6.9)
- [CVE-2026-9524](https://insights.sbomify.com/CVE-2026-9524/): xianrendzw EasyReport REST Endpoint execute sql injection (medium 5.3)
- [CVE-2026-9523](https://insights.sbomify.com/CVE-2026-9523/): SQL injection in EEMS Enterprise Power Operation and Maintenance Cloud Platform (medium 6.9)
- [CVE-2026-9522](https://insights.sbomify.com/CVE-2026-9522/): Missing authorization in Server (medium 5.4)
- [CVE-2026-95210](https://insights.sbomify.com/CVE-2026-95210/): Improper certificate validation in gnutls v3.8.13 causes the application to accept certificates containing invalid extensions. (medium 4.8)
- [CVE-2026-9521](https://insights.sbomify.com/CVE-2026-9521/): fraillt bitsery std_smart_ptr.h loadFromSharedState improper validation of specified type of input (medium 6.3)
- [CVE-2026-95209](https://insights.sbomify.com/CVE-2026-95209/): An issue in gnutls v3.8.13 causes legitimate CA certificates to be rejected, leading to a Denial of Service (DoS). (medium 5.9)
- [CVE-2026-95208](https://insights.sbomify.com/CVE-2026-95208/): An issue in the ConfirmNameConstraints() function (wolfcrypt/src/asn.c) of wolfSSL v5.9.1 and v5.9.2 allows attackers to cause a Denial of S (high 7.5)
- [CVE-2026-9520](https://insights.sbomify.com/CVE-2026-9520/): blitz-js blitz Sign-in LoginForm.tsx cross site scripting (medium 5.3)
- [CVE-2026-9519](https://insights.sbomify.com/CVE-2026-9519/): stonith404 pingvin-share Sign-in Auto-Redirect signIn.tsx getServerSideProps cross site scripting (medium 5.3)
- [CVE-2026-95184](https://insights.sbomify.com/CVE-2026-95184/): Improper certificate validation in gnutls v3.8.13 causes the application to reject legitimate certificates for valid users, leading to a Denial of Service (DoS). (medium 5.9)
- [CVE-2026-95183](https://insights.sbomify.com/CVE-2026-95183/): An issue in the context-compaction feature of DeepSeek Harness (dsh) commit c291e796 allows attackers to execute a prompt injection attack v (high 8.8)
- [CVE-2026-95182](https://insights.sbomify.com/CVE-2026-95182/): An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening craf (critical 10.0)
- [CVE-2026-95180](https://insights.sbomify.com/CVE-2026-95180/): An issue in Justson agentweb-core v5.1.6-androidx and earlier allows a local attacker to obtain sensitive information and launch non-exporte (medium 5.5)
- [CVE-2026-9518](https://insights.sbomify.com/CVE-2026-9518/): hemant6488 CodeIgniter-StudentManagementSystem Students Controller view_students.php addStudent cross site scripting (medium 5.3)
- [CVE-2026-95179](https://insights.sbomify.com/CVE-2026-95179/): An issue in lottie-android 6.7.1 and earlier (and master) allows a remote attacker to cause a denial of service via a crafted Lottie animati (high 7.5)
- [CVE-2026-9517](https://insights.sbomify.com/CVE-2026-9517/): hemant6488 CodeIgniter-StudentManagementSystem Student Management addStudentView access control (medium 6.9)
- [CVE-2026-95168](https://insights.sbomify.com/CVE-2026-95168/): An issue in nvbn thefuck v.3.32 allows a local attacker to execute arbitrary code via the get_rules_import_paths in thefuck/corrector.py and (high 7.8)
- [CVE-2026-95166](https://insights.sbomify.com/CVE-2026-95166/): In Bacularis v1.0.0 - 6.5.1 when adding a new pool, the LabelFormat field allows for a Cross Site Scripting (XSS) payload. (medium 5.4)
- [CVE-2026-95165](https://insights.sbomify.com/CVE-2026-95165/): Bacularis 5.4.0 - 6.5.1 is vulnerable to Cross Site Scripting (XSS) in the Organization name field. (medium 6.1)
- [CVE-2026-9516](https://insights.sbomify.com/CVE-2026-9516/): Denial of service in Cpanel::JSON::XS (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/230/