# Vulnerabilities published in 2026


- [CVE-2026-92138](https://insights.sbomify.com/CVE-2026-92138/): Auth bypass in Jenkins Bitbucket Server Integration Plugin (medium 4.2)
- [CVE-2026-92137](https://insights.sbomify.com/CVE-2026-92137/): Path traversal in Jenkins Robot Framework Plugin (high 8.8)
- [CVE-2026-92136](https://insights.sbomify.com/CVE-2026-92136/): Cross-site scripting in Jenkins OWASP Dependency-Check Plugin (high 8.0)
- [CVE-2026-92135](https://insights.sbomify.com/CVE-2026-92135/): Cross-site scripting in Jenkins Coverage Plugin (high 8.0)
- [CVE-2026-92134](https://insights.sbomify.com/CVE-2026-92134/): Cross-site scripting in Jenkins Warnings Plugin (high 8.0)
- [CVE-2026-92133](https://insights.sbomify.com/CVE-2026-92133/): Information disclosure in Jenkins GitLab Plugin (medium 5.4)
- [CVE-2026-92132](https://insights.sbomify.com/CVE-2026-92132/): Server-side request forgery in Jenkins Gradle Plugin (medium 5.4)
- [CVE-2026-92131](https://insights.sbomify.com/CVE-2026-92131/): Path traversal in Jenkins Pipeline: Groovy Libraries Plugin (medium 4.2)
- [CVE-2026-92130](https://insights.sbomify.com/CVE-2026-92130/): Missing authorization in Jenkins Pipeline: Multibranch Plugin (low 3.1)
- [CVE-2026-9213](https://insights.sbomify.com/CVE-2026-9213/): Insufficient input validation in certain NETGEAR routers (medium 6.9)
- [CVE-2026-92129](https://insights.sbomify.com/CVE-2026-92129/): Security feature bypass in Jenkins Script Security Plugin (high 7.5)
- [CVE-2026-92128](https://insights.sbomify.com/CVE-2026-92128/): Code injection in Jenkins Script Security Plugin (high 7.5)
- [CVE-2026-92127](https://insights.sbomify.com/CVE-2026-92127/): Code injection in Jenkins Script Security Plugin (high 8.0)
- [CVE-2026-92126](https://insights.sbomify.com/CVE-2026-92126/): Code injection in Jenkins Script Security Plugin (high 7.2)
- [CVE-2026-92125](https://insights.sbomify.com/CVE-2026-92125/): Code injection in Jenkins Script Security Plugin (high 8.8)
- [CVE-2026-92124](https://insights.sbomify.com/CVE-2026-92124/): Security feature bypass in Jenkins Script Security Plugin (high 8.8)
- [CVE-2026-92123](https://insights.sbomify.com/CVE-2026-92123/): Security feature bypass in Jenkins Script Security Plugin (high 8.8)
- [CVE-2026-92122](https://insights.sbomify.com/CVE-2026-92122/): Security feature bypass in Jenkins Script Security Plugin (high 8.8)
- [CVE-2026-92121](https://insights.sbomify.com/CVE-2026-92121/): Apache WSS4J: WS-SecurityPolicy signature checks skipped in the streaming code after an STR-Transform reference (high 7.5)
- [CVE-2026-92120](https://insights.sbomify.com/CVE-2026-92120/): Apache Allura: Oauth1 Replay Attack (critical 9.1)
- [CVE-2026-9212](https://insights.sbomify.com/CVE-2026-9212/): Insufficient authentication and input validation in certain NETGEAR products (medium 5.6)
- [CVE-2026-92119](https://insights.sbomify.com/CVE-2026-92119/): Apache Allura: REST API Mass Assignment (critical 9.1)
- [CVE-2026-92116](https://insights.sbomify.com/CVE-2026-92116/): Apache Allura: OAuth1 missing callback validation (critical 9.1)
- [CVE-2026-92115](https://insights.sbomify.com/CVE-2026-92115/): Command injection in WP Photo Album Plus (high 8.8)
- [CVE-2026-92114](https://insights.sbomify.com/CVE-2026-92114/): a2ui-project a2ui Basic Catalog safe_regex.ts redos (medium 6.9)
- [CVE-2026-9211](https://insights.sbomify.com/CVE-2026-9211/): Certain NETGEAR routers allow unauthenticated users to gain control of the router (medium 5.2)
- [CVE-2026-92106](https://insights.sbomify.com/CVE-2026-92106/): lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS (low 2.3)
- [CVE-2026-92103](https://insights.sbomify.com/CVE-2026-92103/): Mint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max_frame_size (medium 6.3)
- [CVE-2026-9210](https://insights.sbomify.com/CVE-2026-9210/): Certain NETGEAR routers allow authenticated administrators to gain unintended control of the router (medium 4.9)
- [CVE-2026-92099](https://insights.sbomify.com/CVE-2026-92099/): WPGraphQL Smart Cache < 2.3.2 - Unauthenticated Persisted Query Registration and Alias Squatting (medium 6.5)
- [CVE-2026-92098](https://insights.sbomify.com/CVE-2026-92098/): Cross-site scripting in Webheadcoder Multi-Step Forms for Contact Form 7 (medium 6.1)
- [CVE-2026-92097](https://insights.sbomify.com/CVE-2026-92097/): Click to Chat <= 4.44 - Unauthenticated Arbitrary Shortcode Execution via REQUEST_URI via {url} Placeholder (critical 9.1)
- [CVE-2026-92092](https://insights.sbomify.com/CVE-2026-92092/): Supply chain in Red Hat OpenShift Container Platform 4 (high 7.4)
- [CVE-2026-92091](https://insights.sbomify.com/CVE-2026-92091/): Jwcrypto: jwcrypto: denial of service via o(n^2) duplicate check on unbounded jwk key_ops array (medium 5.9)
- [CVE-2026-9209](https://insights.sbomify.com/CVE-2026-9209/): mJobTime 15.7.3.32 Unauthenticated SQL Execution RCE via Login.aspx (critical 9.3)
- [CVE-2026-92088](https://insights.sbomify.com/CVE-2026-92088/): Privilege escalation in upKeeper Instant Privilege Access (high 8.6)
- [CVE-2026-92087](https://insights.sbomify.com/CVE-2026-92087/): @fastify/auth vulnerable to Authorization Bypass via order-dependent evaluation of composed auth (high 8.1)
- [CVE-2026-92086](https://insights.sbomify.com/CVE-2026-92086/): MW WP Form <= 5.1.7 - Unauthenticated Sensitive Information Exposure in 'post_id' Parameter (medium 5.3)
- [CVE-2026-92085](https://insights.sbomify.com/CVE-2026-92085/): Stored XSS in TMT Machine's Talassoft Industrial Management Software (medium 5.4)
- [CVE-2026-92084](https://insights.sbomify.com/CVE-2026-92084/): Code injection in Beaver Builder Page Builder – Drag and Drop Website Builder (critical 9.1)
- [CVE-2026-92082](https://insights.sbomify.com/CVE-2026-92082/): Payara Server is vulnerable to brute-force login attacks due to the absence of a limit on failed login attempts (medium 6.3)
- [CVE-2026-92081](https://insights.sbomify.com/CVE-2026-92081/): fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses (medium 5.9)
- [CVE-2026-9208](https://insights.sbomify.com/CVE-2026-9208/): Tanium addressed an unauthorized code execution vulnerability in Connect. (high 8.8)
- [CVE-2026-92079](https://insights.sbomify.com/CVE-2026-92079/): Mitigation bypass in the Widget: Win32 component (critical 9.1)
- [CVE-2026-92078](https://insights.sbomify.com/CVE-2026-92078/): Denial-of-service in the Security component (medium 6.5)
- [CVE-2026-92077](https://insights.sbomify.com/CVE-2026-92077/): Denial-of-service in the SVG component (medium 6.5)
- [CVE-2026-92076](https://insights.sbomify.com/CVE-2026-92076/): Incorrect boundary conditions in the Networking component (high 8.8)
- [CVE-2026-92075](https://insights.sbomify.com/CVE-2026-92075/): Mitigation bypass in the Networking component (critical 9.1)
- [CVE-2026-92074](https://insights.sbomify.com/CVE-2026-92074/): Mitigation bypass in the Popup Blocker component (high 8.8)
- [CVE-2026-92073](https://insights.sbomify.com/CVE-2026-92073/): Privilege escalation in the Enterprise Policies component (high 8.8)
- [CVE-2026-92072](https://insights.sbomify.com/CVE-2026-92072/): Incorrect boundary conditions in the Safe Browsing component (high 8.0)
- [CVE-2026-92071](https://insights.sbomify.com/CVE-2026-92071/): Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component (critical 9.6)
- [CVE-2026-92070](https://insights.sbomify.com/CVE-2026-92070/): Information disclosure in the Networking component (medium 4.3)
- [CVE-2026-9207](https://insights.sbomify.com/CVE-2026-9207/): Tanium addressed an unauthorized code execution vulnerability in Connect. (high 8.8)
- [CVE-2026-92069](https://insights.sbomify.com/CVE-2026-92069/): Spoofing issue in the DOM: Navigation component (medium 5.4)
- [CVE-2026-92068](https://insights.sbomify.com/CVE-2026-92068/): Site isolation issue in the Reader Mode component (medium 5.4)
- [CVE-2026-92067](https://insights.sbomify.com/CVE-2026-92067/): Use-after-free in the Widget: Gtk component (high 8.8)
- [CVE-2026-92066](https://insights.sbomify.com/CVE-2026-92066/): Sandbox escape in the Profile Backup component (critical 9.8)
- [CVE-2026-92065](https://insights.sbomify.com/CVE-2026-92065/): Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component (high 8.8)
- [CVE-2026-92064](https://insights.sbomify.com/CVE-2026-92064/): Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component (high 8.8)
- [CVE-2026-92063](https://insights.sbomify.com/CVE-2026-92063/): Denial-of-service in the Audio/Video component (medium 6.5)
- [CVE-2026-92062](https://insights.sbomify.com/CVE-2026-92062/): Privilege escalation in the Session Restore component (high 8.8)
- [CVE-2026-92061](https://insights.sbomify.com/CVE-2026-92061/): Incorrect boundary conditions in the Security: Process Sandboxing component (critical 9.8)
- [CVE-2026-92060](https://insights.sbomify.com/CVE-2026-92060/): Use-after-free in the Internationalization component (high 8.8)
- [CVE-2026-92059](https://insights.sbomify.com/CVE-2026-92059/): Incorrect boundary conditions in the DOM: Editor component (critical 9.3)
- [CVE-2026-92058](https://insights.sbomify.com/CVE-2026-92058/): Use-after-free in the Graphics component (high 8.8)
- [CVE-2026-92057](https://insights.sbomify.com/CVE-2026-92057/): Mitigation bypass in the Enterprise Policies component (critical 9.1)
- [CVE-2026-92056](https://insights.sbomify.com/CVE-2026-92056/): Use-after-free in the Graphics: Text component (high 8.8)
- [CVE-2026-92055](https://insights.sbomify.com/CVE-2026-92055/): Privilege escalation in the DevTools component (high 8.8)
- [CVE-2026-92054](https://insights.sbomify.com/CVE-2026-92054/): Privilege escalation in the Memory component (high 8.8)
- [CVE-2026-92053](https://insights.sbomify.com/CVE-2026-92053/): Privilege escalation in the Graphics: CanvasWebGL component (high 8.8)
- [CVE-2026-92052](https://insights.sbomify.com/CVE-2026-92052/): Privilege escalation due to uninitialized memory in the Graphics: CanvasWebGL component (high 8.8)
- [CVE-2026-92051](https://insights.sbomify.com/CVE-2026-92051/): Spoofing issue due to invalid pointer in the Graphics component (critical 9.1)
- [CVE-2026-92050](https://insights.sbomify.com/CVE-2026-92050/): Sandbox escape due to race condition in the XPConnect component (critical 9.1)
- [CVE-2026-9205](https://insights.sbomify.com/CVE-2026-9205/): Langflow is affected by weaknesses in secret handling and sensitive configuration access (high 7.4)
- [CVE-2026-92049](https://insights.sbomify.com/CVE-2026-92049/): Use-after-free in the Widget: Win32 component (high 8.8)
- [CVE-2026-92048](https://insights.sbomify.com/CVE-2026-92048/): Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component (critical 9.0)
- [CVE-2026-92047](https://insights.sbomify.com/CVE-2026-92047/): Privilege escalation in the Crash Reporting component (high 8.8)
- [CVE-2026-92046](https://insights.sbomify.com/CVE-2026-92046/): Use-after-free in the Graphics component (high 8.8)
- [CVE-2026-92045](https://insights.sbomify.com/CVE-2026-92045/): Sandbox escape due to incorrect boundary conditions in the WebRTC component (critical 9.6)
- [CVE-2026-92044](https://insights.sbomify.com/CVE-2026-92044/): Information disclosure in the Networking: HTTP component (high 7.5)
- [CVE-2026-92043](https://insights.sbomify.com/CVE-2026-92043/): Privilege escalation due to incorrect boundary conditions in the Audio/Video component (high 8.8)
- [CVE-2026-92042](https://insights.sbomify.com/CVE-2026-92042/): Race condition in the DOM: Content Processes component (high 7.5)
- [CVE-2026-92041](https://insights.sbomify.com/CVE-2026-92041/): Mitigation bypass in the DOM: Networking component (critical 9.1)
- [CVE-2026-92040](https://insights.sbomify.com/CVE-2026-92040/): Use-after-free in the JavaScript: WebAssembly component (high 8.8)
- [CVE-2026-9204](https://insights.sbomify.com/CVE-2026-9204/): Server-Side Request Forgery (SSRF) in GitLab (medium 5.3)
- [CVE-2026-92039](https://insights.sbomify.com/CVE-2026-92039/): Mitigation bypass in the DOM: Notifications component (medium 6.3)
- [CVE-2026-92038](https://insights.sbomify.com/CVE-2026-92038/): Mitigation bypass in the Remote Settings Client component (critical 9.1)
- [CVE-2026-92037](https://insights.sbomify.com/CVE-2026-92037/): Incorrect boundary conditions in the DOM: Animation component (critical 9.8)
- [CVE-2026-92036](https://insights.sbomify.com/CVE-2026-92036/): Incorrect boundary conditions in the Networking: HTTP component (critical 9.8)
- [CVE-2026-92035](https://insights.sbomify.com/CVE-2026-92035/): Sandbox escape due to incorrect boundary conditions in the Graphics component (critical 9.6)
- [CVE-2026-92034](https://insights.sbomify.com/CVE-2026-92034/): Site isolation issue in the Graphics component (critical 9.1)
- [CVE-2026-92033](https://insights.sbomify.com/CVE-2026-92033/): Privilege escalation in Firefox for Android (high 8.8)
- [CVE-2026-92032](https://insights.sbomify.com/CVE-2026-92032/): Sandbox escape due to invalid pointer in the Graphics component (critical 9.6)
- [CVE-2026-92031](https://insights.sbomify.com/CVE-2026-92031/): Information disclosure in the Graphics: ImageLib component (medium 6.5)
- [CVE-2026-92030](https://insights.sbomify.com/CVE-2026-92030/): Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component (medium 5.4)
- [CVE-2026-9203](https://insights.sbomify.com/CVE-2026-9203/): Server-side request forgery in Progress MarkLogic Server (high 8.5)
- [CVE-2026-92029](https://insights.sbomify.com/CVE-2026-92029/): Use-after-free in the SVG component (high 8.8)
- [CVE-2026-92028](https://insights.sbomify.com/CVE-2026-92028/): Use-after-free in the DOM: Core & HTML component (high 8.8)
- [CVE-2026-92027](https://insights.sbomify.com/CVE-2026-92027/): Use-after-free in the DOM: Streams component (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/251/