# Vulnerabilities published in 2026


- [CVE-2026-9178](https://insights.sbomify.com/CVE-2026-9178/): WP Forms Connector <= 1.8 - Missing Authorization to Unauthenticated Information Exposure via 'user/list' REST Endpoint (high 7.5)
- [CVE-2026-91779](https://insights.sbomify.com/CVE-2026-91779/): GNU Binutils Eh Frame elf-eh-frame.c _bfd_elf_eh_frame_section_offset null pointer dereference (medium 4.8)
- [CVE-2026-91778](https://insights.sbomify.com/CVE-2026-91778/): Missing authorization in Octopus Server (high 7.2)
- [CVE-2026-91777](https://insights.sbomify.com/CVE-2026-91777/): jackson-databind: quadratic forward-reference completion in Collection and Map deserializers (high 7.5)
- [CVE-2026-91776](https://insights.sbomify.com/CVE-2026-91776/): jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID (high 7.5)
- [CVE-2026-91775](https://insights.sbomify.com/CVE-2026-91775/): LimeSurvey Community Edition 7.0.14 - Reflected XSS through unescaped LSS survey-import warnings (high 7.4)
- [CVE-2026-91774](https://insights.sbomify.com/CVE-2026-91774/): Yao through v1.0.0-rc22 Missing Authorization via OpenAPI team endpoint (medium 5.3)
- [CVE-2026-91773](https://insights.sbomify.com/CVE-2026-91773/): Soft Serve 0.7.1 through 0.11.6 Information Disclosure via LFS Locks (medium 5.3)
- [CVE-2026-91772](https://insights.sbomify.com/CVE-2026-91772/): Halo through 2.26.1 Open Redirect via Unvalidated URI Parameter (medium 5.3)
- [CVE-2026-91771](https://insights.sbomify.com/CVE-2026-91771/): Weights & Biases wandb before 0.29.0 Path Traversal via File Download (high 8.7)
- [CVE-2026-91770](https://insights.sbomify.com/CVE-2026-91770/): IceHRM before 36.0.0 Broken Access Control via Employee ID (high 7.1)
- [CVE-2026-9177](https://insights.sbomify.com/CVE-2026-9177/): Server-Side Template Injection in SecureTransport's Apache Velocity mail templates (critical 9.4)
- [CVE-2026-91769](https://insights.sbomify.com/CVE-2026-91769/): TLS Hostname Verification Falls Back to CN After SAN Mismatch (medium 4.3)
- [CVE-2026-91768](https://insights.sbomify.com/CVE-2026-91768/): IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes) (medium 6.5)
- [CVE-2026-91767](https://insights.sbomify.com/CVE-2026-91767/): Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN (medium 6.5)
- [CVE-2026-91766](https://insights.sbomify.com/CVE-2026-91766/): Cross-origin credential leak in HTTP stream wrapper redirects (medium 5.9)
- [CVE-2026-91765](https://insights.sbomify.com/CVE-2026-91765/): SOAP: Unbounded Recursion in Server-Side cleanup_xml_node (high 7.5)
- [CVE-2026-9176](https://insights.sbomify.com/CVE-2026-9176/): IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities (medium 6.7)
- [CVE-2026-91752](https://insights.sbomify.com/CVE-2026-91752/): GNU libextractor before 1.15 Stack Overflow via OLE2 (high 8.7)
- [CVE-2026-91751](https://insights.sbomify.com/CVE-2026-91751/): Flextype CMS through 1.0.0-alpha.3 Path Traversal via Entries REST API (high 7.2)
- [CVE-2026-91750](https://insights.sbomify.com/CVE-2026-91750/): WeKnora before 0.7.0 SSRF via Unvalidated HTTP Redirects (high 7.1)
- [CVE-2026-9175](https://insights.sbomify.com/CVE-2026-9175/): Devs Accounting <= 1.2.0 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'id' Parameter (medium 5.3)
- [CVE-2026-91749](https://insights.sbomify.com/CVE-2026-91749/): Use after free in Chrome (critical 9.6)
- [CVE-2026-91748](https://insights.sbomify.com/CVE-2026-91748/): Race condition in Chrome (high 8.3)
- [CVE-2026-91747](https://insights.sbomify.com/CVE-2026-91747/): Use after free in Chrome (low 3.1)
- [CVE-2026-91746](https://insights.sbomify.com/CVE-2026-91746/): Integer overflow in Chrome (medium 4.3)
- [CVE-2026-91745](https://insights.sbomify.com/CVE-2026-91745/): Use after free in Chrome (high 8.8)
- [CVE-2026-91744](https://insights.sbomify.com/CVE-2026-91744/): Race condition in Chrome (medium 5.3)
- [CVE-2026-91743](https://insights.sbomify.com/CVE-2026-91743/): Race condition in Chrome (high 8.3)
- [CVE-2026-91742](https://insights.sbomify.com/CVE-2026-91742/): Security feature bypass in Chrome (medium 4.8)
- [CVE-2026-91741](https://insights.sbomify.com/CVE-2026-91741/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-91740](https://insights.sbomify.com/CVE-2026-91740/): Information disclosure in Chrome (medium 4.3)
- [CVE-2026-91739](https://insights.sbomify.com/CVE-2026-91739/): Missing authorization in Chrome (medium 4.2)
- [CVE-2026-91738](https://insights.sbomify.com/CVE-2026-91738/): Other in Chrome (critical 9.6)
- [CVE-2026-91737](https://insights.sbomify.com/CVE-2026-91737/): Use after free in Chrome (high 8.8)
- [CVE-2026-91736](https://insights.sbomify.com/CVE-2026-91736/): Use after free in Chrome (high 8.8)
- [CVE-2026-91735](https://insights.sbomify.com/CVE-2026-91735/): Missing authorization in Chrome (high 8.3)
- [CVE-2026-91734](https://insights.sbomify.com/CVE-2026-91734/): Missing authorization in Chrome (high 7.4)
- [CVE-2026-91733](https://insights.sbomify.com/CVE-2026-91733/): Information disclosure in Chrome (high 8.3)
- [CVE-2026-91732](https://insights.sbomify.com/CVE-2026-91732/): Missing authorization in Chrome (low 3.1)
- [CVE-2026-91731](https://insights.sbomify.com/CVE-2026-91731/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-91730](https://insights.sbomify.com/CVE-2026-91730/): Information disclosure in Chrome (low 3.1)
- [CVE-2026-91729](https://insights.sbomify.com/CVE-2026-91729/): Use after free in Chrome (critical 9.6)
- [CVE-2026-91728](https://insights.sbomify.com/CVE-2026-91728/): Integer overflow in Chrome (critical 9.6)
- [CVE-2026-91727](https://insights.sbomify.com/CVE-2026-91727/): Code injection in Chrome (high 8.1)
- [CVE-2026-91726](https://insights.sbomify.com/CVE-2026-91726/): Memory corruption in Chrome (medium 4.7)
- [CVE-2026-91725](https://insights.sbomify.com/CVE-2026-91725/): Information disclosure in Chrome (medium 5.3)
- [CVE-2026-91724](https://insights.sbomify.com/CVE-2026-91724/): Use after free in Chrome (high 8.3)
- [CVE-2026-91723](https://insights.sbomify.com/CVE-2026-91723/): Race condition in Chrome (medium 4.2)
- [CVE-2026-91722](https://insights.sbomify.com/CVE-2026-91722/): Use after free in Chrome (high 8.8)
- [CVE-2026-91721](https://insights.sbomify.com/CVE-2026-91721/): Use after free in Chrome (high 8.8)
- [CVE-2026-91720](https://insights.sbomify.com/CVE-2026-91720/): Information disclosure in Chrome (medium 4.7)
- [CVE-2026-9172](https://insights.sbomify.com/CVE-2026-9172/): Devs Accounting <= 1.2.0 - Missing Authorization to Unauthenticated Account Deletion via /delete-account/ REST Endpoint (medium 5.3)
- [CVE-2026-91719](https://insights.sbomify.com/CVE-2026-91719/): Code injection in Chrome (medium 4.3)
- [CVE-2026-91718](https://insights.sbomify.com/CVE-2026-91718/): Use after free in Chrome (critical 9.6)
- [CVE-2026-91717](https://insights.sbomify.com/CVE-2026-91717/): Missing authorization in Chrome (medium 5.1)
- [CVE-2026-91716](https://insights.sbomify.com/CVE-2026-91716/): Use after free in Chrome (critical 9.6)
- [CVE-2026-91715](https://insights.sbomify.com/CVE-2026-91715/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-91714](https://insights.sbomify.com/CVE-2026-91714/): Information disclosure in Chrome (medium 5.3)
- [CVE-2026-91713](https://insights.sbomify.com/CVE-2026-91713/): Missing authorization in Chrome (medium 4.2)
- [CVE-2026-91712](https://insights.sbomify.com/CVE-2026-91712/): Race condition in Chrome (high 8.3)
- [CVE-2026-91711](https://insights.sbomify.com/CVE-2026-91711/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-91710](https://insights.sbomify.com/CVE-2026-91710/): Use after free in Chrome (critical 9.6)
- [CVE-2026-9171](https://insights.sbomify.com/CVE-2026-9171/): Vulnerabilities in IBM WebSphere Application affects IBM PowerVM Novalink. (high 7.5)
- [CVE-2026-91709](https://insights.sbomify.com/CVE-2026-91709/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-91708](https://insights.sbomify.com/CVE-2026-91708/): Race condition in Chrome (low 3.1)
- [CVE-2026-91707](https://insights.sbomify.com/CVE-2026-91707/): Missing authorization in Divi (medium 5.3)
- [CVE-2026-9170](https://insights.sbomify.com/CVE-2026-9170/): IBM HTTP Server is affected by multiple vulnerabilities (critical 9.8)
- [CVE-2026-9169](https://insights.sbomify.com/CVE-2026-9169/): LUCID Vision Labs: DLL Search Order Hijacking in Arena SDK 1.0.80.49 on Windows (high 8.8)
- [CVE-2026-91668](https://insights.sbomify.com/CVE-2026-91668/): Privilege escalation in Oracle Data Integrator (high 8.8)
- [CVE-2026-91665](https://insights.sbomify.com/CVE-2026-91665/): Auth bypass in Oracle Essbase (critical 9.8)
- [CVE-2026-91664](https://insights.sbomify.com/CVE-2026-91664/): Denial of service in Oracle Essbase (high 7.5)
- [CVE-2026-91663](https://insights.sbomify.com/CVE-2026-91663/): Missing authorization in Oracle Essbase (critical 9.9)
- [CVE-2026-91662](https://insights.sbomify.com/CVE-2026-91662/): Missing authorization in Oracle Essbase (medium 6.4)
- [CVE-2026-91661](https://insights.sbomify.com/CVE-2026-91661/): Information disclosure in Oracle Essbase (high 7.7)
- [CVE-2026-91660](https://insights.sbomify.com/CVE-2026-91660/): Denial of service in Oracle Essbase (medium 4.3)
- [CVE-2026-9166](https://insights.sbomify.com/CVE-2026-9166/): LFI in GIS Informatics' GisLab Laboratory Management System (high 7.5)
- [CVE-2026-91659](https://insights.sbomify.com/CVE-2026-91659/): Missing authorization in Oracle Essbase (high 7.7)
- [CVE-2026-91658](https://insights.sbomify.com/CVE-2026-91658/): Missing authorization in Oracle Essbase (critical 9.9)
- [CVE-2026-91657](https://insights.sbomify.com/CVE-2026-91657/): Information disclosure in Oracle Essbase (medium 4.3)
- [CVE-2026-91656](https://insights.sbomify.com/CVE-2026-91656/): Missing authorization in Oracle Essbase (critical 9.1)
- [CVE-2026-91655](https://insights.sbomify.com/CVE-2026-91655/): Missing authorization in Oracle Essbase (critical 9.1)
- [CVE-2026-91654](https://insights.sbomify.com/CVE-2026-91654/): Missing authorization in Oracle Essbase (medium 6.3)
- [CVE-2026-91653](https://insights.sbomify.com/CVE-2026-91653/): Missing authorization in Oracle Essbase (high 8.5)
- [CVE-2026-91652](https://insights.sbomify.com/CVE-2026-91652/): Information disclosure in Oracle Essbase (medium 5.0)
- [CVE-2026-91651](https://insights.sbomify.com/CVE-2026-91651/): Missing authorization in Oracle Essbase (high 8.5)
- [CVE-2026-91650](https://insights.sbomify.com/CVE-2026-91650/): Information disclosure in Oracle Essbase (low 3.7)
- [CVE-2026-9165](https://insights.sbomify.com/CVE-2026-9165/): Stackrox: stackrox: unbounded graphql query depth allows authenticated denial of service (high 7.7)
- [CVE-2026-91649](https://insights.sbomify.com/CVE-2026-91649/): Privilege escalation in Oracle Essbase (medium 6.0)
- [CVE-2026-91648](https://insights.sbomify.com/CVE-2026-91648/): Information disclosure in Oracle Essbase (medium 5.3)
- [CVE-2026-91647](https://insights.sbomify.com/CVE-2026-91647/): Missing authorization in Oracle Essbase (high 8.1)
- [CVE-2026-91646](https://insights.sbomify.com/CVE-2026-91646/): Missing authorization in Oracle Essbase (medium 5.6)
- [CVE-2026-91645](https://insights.sbomify.com/CVE-2026-91645/): Information disclosure in Oracle Essbase (medium 5.3)
- [CVE-2026-91644](https://insights.sbomify.com/CVE-2026-91644/): Missing authorization in Oracle Essbase (critical 9.3)
- [CVE-2026-91643](https://insights.sbomify.com/CVE-2026-91643/): Information disclosure in Oracle Essbase (medium 5.3)
- [CVE-2026-91642](https://insights.sbomify.com/CVE-2026-91642/): Missing authorization in Oracle Essbase (high 7.3)
- [CVE-2026-91641](https://insights.sbomify.com/CVE-2026-91641/): Information disclosure in Oracle Essbase (medium 5.0)
- [CVE-2026-91640](https://insights.sbomify.com/CVE-2026-91640/): Information disclosure in Oracle Essbase (medium 5.0)
- [CVE-2026-91639](https://insights.sbomify.com/CVE-2026-91639/): Information disclosure in Oracle Essbase (high 7.7)
- [CVE-2026-91638](https://insights.sbomify.com/CVE-2026-91638/): Missing authorization in Oracle Essbase (critical 9.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/254/