# Vulnerabilities published in 2026


- [CVE-2026-9121](https://insights.sbomify.com/CVE-2026-9121/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-91209](https://insights.sbomify.com/CVE-2026-91209/): Other in Oracle Solaris (medium 4.2)
- [CVE-2026-91208](https://insights.sbomify.com/CVE-2026-91208/): Denial of service in Oracle Solaris (medium 5.1)
- [CVE-2026-91206](https://insights.sbomify.com/CVE-2026-91206/): Apache Roller: Reflected XSS in the optional LDAP comment authenticator (medium 6.1)
- [CVE-2026-91205](https://insights.sbomify.com/CVE-2026-91205/): Cockpit-files: cockpit-files: local attacker can hijack file ownership via symlink race (medium 6.0)
- [CVE-2026-91204](https://insights.sbomify.com/CVE-2026-91204/): Apache Roller: Stored javascript: URI in HTML comments (medium 6.1)
- [CVE-2026-91203](https://insights.sbomify.com/CVE-2026-91203/): Cockpit-files: cockpit-files: arbitrary file ownership and permission modification via symlink race condition (medium 6.0)
- [CVE-2026-91202](https://insights.sbomify.com/CVE-2026-91202/): Cockpit-files: cockpit-files: arbitrary file ownership change via symlink following in privileged paste (medium 6.1)
- [CVE-2026-91201](https://insights.sbomify.com/CVE-2026-91201/): DocsGPT through 0.20.0 OAuth Token Disclosure via Wildcard postMessage (medium 5.3)
- [CVE-2026-91200](https://insights.sbomify.com/CVE-2026-91200/): DevSpace through 6.3.21 Path Traversal via tar extraction (high 8.7)
- [CVE-2026-9120](https://insights.sbomify.com/CVE-2026-9120/): Use after free in Chrome (high 8.8)
- [CVE-2026-91199](https://insights.sbomify.com/CVE-2026-91199/): Refly through 1.1.0 Server-Side Request Forgery via scrape endpoint (medium 5.3)
- [CVE-2026-91198](https://insights.sbomify.com/CVE-2026-91198/): GrowthBook through 5.0.1 Information Disclosure via Public Endpoints (medium 6.9)
- [CVE-2026-91197](https://insights.sbomify.com/CVE-2026-91197/): Flowable flowable-engine through 8.0.0 XXE via ProcessDiagramLayoutFactory (high 7.1)
- [CVE-2026-91191](https://insights.sbomify.com/CVE-2026-91191/): Lantronix G520 Series Cellular Gateway Improper Verification of Cryptographic Signature (high 7.7)
- [CVE-2026-9119](https://insights.sbomify.com/CVE-2026-9119/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-91189](https://insights.sbomify.com/CVE-2026-91189/): Integer overflow in Eclipse ThreadX - GUIX (high 7.1)
- [CVE-2026-91187](https://insights.sbomify.com/CVE-2026-91187/): Improper Verification of Cryptographic Signature in dashbit nimble_zta Cloudflare strategy (critical 9.3)
- [CVE-2026-91186](https://insights.sbomify.com/CVE-2026-91186/): PNG decoder: a duplicate IHDR chunk after IDAT resizes the image after allocation, causing a heap out-of-bounds write (high 8.4)
- [CVE-2026-91184](https://insights.sbomify.com/CVE-2026-91184/): NGINX Gateway Fabric vulnerability (high 8.7)
- [CVE-2026-91181](https://insights.sbomify.com/CVE-2026-91181/): Data Retention Teams Endpoint Leaks Private Team Invite ID (medium 6.5)
- [CVE-2026-9118](https://insights.sbomify.com/CVE-2026-9118/): Use after free in Chrome (high 8.8)
- [CVE-2026-9117](https://insights.sbomify.com/CVE-2026-9117/): Memory corruption in Chrome (high 7.5)
- [CVE-2026-91167](https://insights.sbomify.com/CVE-2026-91167/): Missing authorization in warpgate (medium 6.0)
- [CVE-2026-91166](https://insights.sbomify.com/CVE-2026-91166/): Warpgate: Web SSH stores a jump host's key against the target's address, so it validates as the target (medium 5.7)
- [CVE-2026-91165](https://insights.sbomify.com/CVE-2026-91165/): Warpgate: Markup injection in SSO form_post return page via unencoded redirect/error values (low 2.4)
- [CVE-2026-91164](https://insights.sbomify.com/CVE-2026-91164/): Warpgate: API tokens bypass the user's allowed_ip_ranges restriction (medium 4.3)
- [CVE-2026-91161](https://insights.sbomify.com/CVE-2026-91161/): OpenWA: VIEWER API keys can read WhatsApp group invite codes (medium 6.4)
- [CVE-2026-91160](https://insights.sbomify.com/CVE-2026-91160/): OpenWA: A read-only API key can receive a session pairing QR over the WebSocket event stream (high 8.2)
- [CVE-2026-9116](https://insights.sbomify.com/CVE-2026-9116/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2026-91159](https://insights.sbomify.com/CVE-2026-91159/): Discourse: Stored oEmbed HTML injection via allowed iframe (high 7.7)
- [CVE-2026-91157](https://insights.sbomify.com/CVE-2026-91157/): Discourse: Media uploads remain publicly accessible after category permissions are restricted (high 7.5)
- [CVE-2026-91156](https://insights.sbomify.com/CVE-2026-91156/): Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users (high 7.5)
- [CVE-2026-91154](https://insights.sbomify.com/CVE-2026-91154/): Missing authentication in Ecommerce Template product cache revalidation allows unauthenticated denial of service (medium 6.9)
- [CVE-2026-91153](https://insights.sbomify.com/CVE-2026-91153/): Information disclosure in Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI (medium 5.3)
- [CVE-2026-91152](https://insights.sbomify.com/CVE-2026-91152/): Everest Forms <= 3.6.2 - Reflected Cross-Site Scripting via 'evf_toast_type' Parameter (medium 6.1)
- [CVE-2026-9115](https://insights.sbomify.com/CVE-2026-9115/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2026-91149](https://insights.sbomify.com/CVE-2026-91149/): Cockpit: cockpit: denial of service via unbounded connection thread spawning (high 7.5)
- [CVE-2026-91147](https://insights.sbomify.com/CVE-2026-91147/): Cockpit: cockpit: denial of service in `cockpit-ws` due to url-root handling without a trailing slash (medium 5.9)
- [CVE-2026-91146](https://insights.sbomify.com/CVE-2026-91146/): Takahe through 0.11.0 Cross-Site Scripting via javascript: URL Scheme (medium 5.3)
- [CVE-2026-91145](https://insights.sbomify.com/CVE-2026-91145/): Activiti through 7.1.0.M6 Expression Injection via Mail Task (high 7.1)
- [CVE-2026-91144](https://insights.sbomify.com/CVE-2026-91144/): ZFile through 5.0.5 Share Entry Filter Bypass via Download Endpoint (high 8.7)
- [CVE-2026-91143](https://insights.sbomify.com/CVE-2026-91143/): goproxy through 15.3 Authentication Bypass via CONNECT (medium 6.9)
- [CVE-2026-91142](https://insights.sbomify.com/CVE-2026-91142/): Cockpit: cockpit: unauthorized modification of login records via integer overflow (low 3.6)
- [CVE-2026-91140](https://insights.sbomify.com/CVE-2026-91140/): OS command injection in Progress Software Autonomous REST Connector GenAI Agents (critical 9.6)
- [CVE-2026-9114](https://insights.sbomify.com/CVE-2026-9114/): Use after free in Chrome (high 8.8)
- [CVE-2026-91137](https://insights.sbomify.com/CVE-2026-91137/): Apache Thrift: PHP `thrift_protocol` accelerator: zero-byte container elements (high 8.7)
- [CVE-2026-91136](https://insights.sbomify.com/CVE-2026-91136/): Divi Plus <= 2.4.0 - Unauthenticated Arbitrary File Read via 'svg_image' Parameter (high 7.5)
- [CVE-2026-91135](https://insights.sbomify.com/CVE-2026-91135/): Apache Thrift: C++ `THeaderTransport::transform()` heap buffer overflow (write direction) (critical 9.2)
- [CVE-2026-91134](https://insights.sbomify.com/CVE-2026-91134/): Discourse: Block post iframes whose encoded userinfo bypasses the allowed_iframes allowlist (medium 5.4)
- [CVE-2026-91133](https://insights.sbomify.com/CVE-2026-91133/): Discourse: Escape LIKE metacharacters in upload paths to prevent disclosure (medium 6.5)
- [CVE-2026-91132](https://insights.sbomify.com/CVE-2026-91132/): Discourse: Wildcard iframe origin allowlist bypass via authority separators (medium 4.3)
- [CVE-2026-91130](https://insights.sbomify.com/CVE-2026-91130/): Home Assistant: XSS in Statistics Graph Card (critical 9.3)
- [CVE-2026-9113](https://insights.sbomify.com/CVE-2026-9113/): Memory corruption in Chrome (medium 4.3)
- [CVE-2026-91129](https://insights.sbomify.com/CVE-2026-91129/): Home Assistant: mDNS Server-Side Request Forgery (medium 5.4)
- [CVE-2026-91127](https://insights.sbomify.com/CVE-2026-91127/): File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer (high 8.2)
- [CVE-2026-91123](https://insights.sbomify.com/CVE-2026-91123/): Discourse: Reject literal backslash path separators in iframe src traversal guard (high 7.2)
- [CVE-2026-91122](https://insights.sbomify.com/CVE-2026-91122/): Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users (high 8.7)
- [CVE-2026-91121](https://insights.sbomify.com/CVE-2026-91121/): Discourse: Chat upload filenames rendered as raw HTML in excerpts (medium 5.0)
- [CVE-2026-91120](https://insights.sbomify.com/CVE-2026-91120/): Discourse: Stored HTML injection in video notification emails (medium 5.4)
- [CVE-2026-9112](https://insights.sbomify.com/CVE-2026-9112/): Use after free in Chrome (high 8.8)
- [CVE-2026-91119](https://insights.sbomify.com/CVE-2026-91119/): Discourse: Encode action_code_who in mention URLs (medium 6.4)
- [CVE-2026-9111](https://insights.sbomify.com/CVE-2026-9111/): Use after free in Chrome (high 8.8)
- [CVE-2026-91109](https://insights.sbomify.com/CVE-2026-91109/): Missing authorization in Simply Schedule Appointments (medium 6.5)
- [CVE-2026-91108](https://insights.sbomify.com/CVE-2026-91108/): Missing authorization in Alt Text AI – Automatically generate image alt text for SEO and accessibility (medium 4.3)
- [CVE-2026-91107](https://insights.sbomify.com/CVE-2026-91107/): openSIS Classic 9.3 - Insecure Direct Object Reference (IDOR) (critical 9.3)
- [CVE-2026-91106](https://insights.sbomify.com/CVE-2026-91106/): HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities (critical 9.3)
- [CVE-2026-91105](https://insights.sbomify.com/CVE-2026-91105/): HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities (high 8.6)
- [CVE-2026-91104](https://insights.sbomify.com/CVE-2026-91104/): HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities (critical 9.3)
- [CVE-2026-91103](https://insights.sbomify.com/CVE-2026-91103/): HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities (medium 5.1)
- [CVE-2026-91102](https://insights.sbomify.com/CVE-2026-91102/): HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities (high 8.4)
- [CVE-2026-91101](https://insights.sbomify.com/CVE-2026-91101/): HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities (medium 5.1)
- [CVE-2026-91100](https://insights.sbomify.com/CVE-2026-91100/): HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities (medium 6.8)
- [CVE-2026-9110](https://insights.sbomify.com/CVE-2026-9110/): Other in Chrome (medium 4.2)
- [CVE-2026-91099](https://insights.sbomify.com/CVE-2026-91099/): HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities (medium 5.1)
- [CVE-2026-91098](https://insights.sbomify.com/CVE-2026-91098/): HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities (high 8.6)
- [CVE-2026-91097](https://insights.sbomify.com/CVE-2026-91097/): HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities (high 7.0)
- [CVE-2026-91096](https://insights.sbomify.com/CVE-2026-91096/): Use after free in proxygen (high 7.5)
- [CVE-2026-91095](https://insights.sbomify.com/CVE-2026-91095/): Use after free in proxygen (medium 5.3)
- [CVE-2026-91093](https://insights.sbomify.com/CVE-2026-91093/): HP One Agent Software – Security Update (high 8.5)
- [CVE-2026-91092](https://insights.sbomify.com/CVE-2026-91092/): Missing authorization in wpForo Forum (medium 4.3)
- [CVE-2026-91091](https://insights.sbomify.com/CVE-2026-91091/): GPAC Node Insertion base_scenegraph.c gf_node_list_insert_child memory corruption (medium 5.3)
- [CVE-2026-91090](https://insights.sbomify.com/CVE-2026-91090/): GPAC base_scenegraph.c gf_node_activate_ex stack-based overflow (low 2.4)
- [CVE-2026-9109](https://insights.sbomify.com/CVE-2026-9109/): GPTranslate <= 2.31 - Unauthenticated Stored Cross-Site Scripting via REST API Translation Storage (high 7.2)
- [CVE-2026-91089](https://insights.sbomify.com/CVE-2026-91089/): GPAC base_scenegraph.c gf_node_get_name_and_id use after free (medium 5.3)
- [CVE-2026-91088](https://insights.sbomify.com/CVE-2026-91088/): GPAC URL url.c gf_url_concatenate_ex heap-based overflow (low 2.4)
- [CVE-2026-91087](https://insights.sbomify.com/CVE-2026-91087/): GPAC Compositor media_object.c gf_mo_get_od_id use after free (medium 6.9)
- [CVE-2026-91086](https://insights.sbomify.com/CVE-2026-91086/): GPAC MPEG Video Reframer reframe_mpgvid.c mpgviddmx_process heap-based overflow (medium 5.3)
- [CVE-2026-91085](https://insights.sbomify.com/CVE-2026-91085/): Apache Karaf: config:install missing ACL entry allows privilege escalation to admin (medium 6.3)
- [CVE-2026-91081](https://insights.sbomify.com/CVE-2026-91081/): Docs through 5.6.1 SSRF via Unauthenticated cors-proxy Endpoint (medium 6.9)
- [CVE-2026-91080](https://insights.sbomify.com/CVE-2026-91080/): webhook through 2.8.3 Memory Exhaustion via Oversized Request Body (high 8.7)
- [CVE-2026-9108](https://insights.sbomify.com/CVE-2026-9108/): Studio 5000 Logix Designer® – Multiple Vulnerabilities (medium 5.4)
- [CVE-2026-91079](https://insights.sbomify.com/CVE-2026-91079/): Huly Platform through 0.7.426 SSRF via Print Service (medium 6.3)
- [CVE-2026-91078](https://insights.sbomify.com/CVE-2026-91078/): TillKit < 1.0.5 - Unauthenticated POS Takeover via Hard-Coded Default Manager PIN (high 8.2)
- [CVE-2026-91077](https://insights.sbomify.com/CVE-2026-91077/): Missing authorization in Event Booking Manager for WooCommerce (low 2.7)
- [CVE-2026-91076](https://insights.sbomify.com/CVE-2026-91076/): Robokassa payment for WooCommerce < 1.9.0 - Unauthenticated Arbitrary Order Status Change to Failed (medium 5.3)
- [CVE-2026-91074](https://insights.sbomify.com/CVE-2026-91074/): BSK PDF Manager <= 3.8.1 - Contributor+ SQLi via tags_specific Shortcode Attribute (medium 6.8)
- [CVE-2026-91073](https://insights.sbomify.com/CVE-2026-91073/): Subscribe Forms 1.4.1 - 1.6.2 - Author+ Stored XSS via Attention Effect Form Setting (medium 6.8)
- [CVE-2026-91072](https://insights.sbomify.com/CVE-2026-91072/): EWWW Image Optimizer < 8.8.0 - Admin+ WebP File Rename and Deletion via Unrestricted Path in WebP Migration Handler (medium 4.4)
- [CVE-2026-9107](https://insights.sbomify.com/CVE-2026-9107/): Cross-site scripting in Kali Forms — Contact Form & Drag-and-Drop Builder (medium 6.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/259/