# Vulnerabilities published in 2026


- [CVE-2026-85679](https://insights.sbomify.com/CVE-2026-85679/): Extendify <= 3.1.6 - Unauthenticated Stored Cross-Site Scripting via 'styles.blocks' Block Type Key (high 7.2)
- [CVE-2026-85678](https://insights.sbomify.com/CVE-2026-85678/): AI Builder 2.4.1 - 2.7.7 - Contributor+ Stored XSS via Post JavaScript (medium 6.8)
- [CVE-2026-85677](https://insights.sbomify.com/CVE-2026-85677/): Gutenverse News < 3.3.3 - Unauthenticated Stored XSS via Comment Content (high 8.8)
- [CVE-2026-85676](https://insights.sbomify.com/CVE-2026-85676/): Dub Open Redirect via Unrestricted redir_url Parameter (medium 5.3)
- [CVE-2026-85675](https://insights.sbomify.com/CVE-2026-85675/): OWL DocumentProcessingToolkit Server-Side Request Forgery via URL Fetching (high 8.7)
- [CVE-2026-85674](https://insights.sbomify.com/CVE-2026-85674/): aider 0.86.2 Remote Code Execution via .aider.conf.yml (high 8.5)
- [CVE-2026-85673](https://insights.sbomify.com/CVE-2026-85673/): LLaMA-Factory SSRF Guard Bypass via Redirect and DNS Rebinding (high 8.7)
- [CVE-2026-85672](https://insights.sbomify.com/CVE-2026-85672/): zerox 1.1.20 OS Command Injection via Document URL File Extension (critical 9.3)
- [CVE-2026-85671](https://insights.sbomify.com/CVE-2026-85671/): QAnything 2.0.0 Unauthenticated Cross-User File Disclosure (high 8.7)
- [CVE-2026-85670](https://insights.sbomify.com/CVE-2026-85670/): tokenizers BpeBuilder Buffer Overflow via merge token (high 7.1)
- [CVE-2026-8567](https://insights.sbomify.com/CVE-2026-8567/): Integer overflow in Chrome (medium 4.3)
- [CVE-2026-85669](https://insights.sbomify.com/CVE-2026-85669/): potpie through 2.0.0 Missing Ownership Check via code-changes sync (high 7.1)
- [CVE-2026-85668](https://insights.sbomify.com/CVE-2026-85668/): Xinference 3.3.0 Unauthenticated Arbitrary-Path File Read via /v1/models/llm/auto-register (high 8.7)
- [CVE-2026-85667](https://insights.sbomify.com/CVE-2026-85667/): xiaobei through 5.5.2 Unauthenticated Webhook Message Injection (critical 9.3)
- [CVE-2026-85666](https://insights.sbomify.com/CVE-2026-85666/): ogx 1.3.1 Server-Side Request Forgery via MCP tool server_url (high 8.7)
- [CVE-2026-85665](https://insights.sbomify.com/CVE-2026-85665/): Bruno through 4.1.0 Arbitrary File Read via Unconfined Body File Path (high 7.1)
- [CVE-2026-85664](https://insights.sbomify.com/CVE-2026-85664/): Chroma 1.5.9 Unbounded HNSW Index Parameters Memory Exhaustion (high 8.7)
- [CVE-2026-85663](https://insights.sbomify.com/CVE-2026-85663/): Aim 3.29.1 Remote Code Execution via Unauthenticated Method Dispatch (critical 9.3)
- [CVE-2026-85662](https://insights.sbomify.com/CVE-2026-85662/): Marqo 2.26.0 Server-Side Request Forgery via Media URLs (medium 6.9)
- [CVE-2026-85661](https://insights.sbomify.com/CVE-2026-85661/): excel-mcp-server 0.1.8 Arbitrary File Read/Write via stdio mode (critical 9.3)
- [CVE-2026-85660](https://insights.sbomify.com/CVE-2026-85660/): cli-mcp-server 0.2.5 Command Allowlist Bypass via Shell Substitution (critical 9.2)
- [CVE-2026-8566](https://insights.sbomify.com/CVE-2026-8566/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2026-85659](https://insights.sbomify.com/CVE-2026-85659/): PilotPress <= 2.0.43 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover via 'username' Parameter (high 8.8)
- [CVE-2026-85658](https://insights.sbomify.com/CVE-2026-85658/): Code injection in Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress (high 8.1)
- [CVE-2026-85657](https://insights.sbomify.com/CVE-2026-85657/): Cross-site scripting in Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors (medium 5.4)
- [CVE-2026-85656](https://insights.sbomify.com/CVE-2026-85656/): OS command injection in Amazon log4j-cve-2021-44228-hotpatch (high 8.5)
- [CVE-2026-85655](https://insights.sbomify.com/CVE-2026-85655/): Missing authorization in Enable Media Replace (medium 4.3)
- [CVE-2026-85654](https://insights.sbomify.com/CVE-2026-85654/): Code injection in the CDK generator in Amazon awslabs.dynamodb-mcp-server (high 7.1)
- [CVE-2026-85653](https://insights.sbomify.com/CVE-2026-85653/): Cross-site scripting in Contextual Related Posts (medium 6.4)
- [CVE-2026-85652](https://insights.sbomify.com/CVE-2026-85652/): Photo Gallery by 10Web <= 1.8.44 - Authenticated (Author+) SQL Injection via 'album_id' Shortcode Attribute (medium 6.5)
- [CVE-2026-85651](https://insights.sbomify.com/CVE-2026-85651/): Trigger.dev before 4.5.2 Unauthorized Environment Access via Run Replay (high 8.4)
- [CVE-2026-85650](https://insights.sbomify.com/CVE-2026-85650/): Trigger.dev before 4.5.2 Server-Side Request Forgery via webhook alert-channel (medium 5.3)
- [CVE-2026-8565](https://insights.sbomify.com/CVE-2026-8565/): Other in Chrome (medium 4.7)
- [CVE-2026-85649](https://insights.sbomify.com/CVE-2026-85649/): Security feature bypass in software-actualizer (high 7.9)
- [CVE-2026-85645](https://insights.sbomify.com/CVE-2026-85645/): Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.46 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2026-85644](https://insights.sbomify.com/CVE-2026-85644/): XS::Parse::Infix versions from 0.40 through 0.49 for Perl treat a number as an array reference (high 7.5)
- [CVE-2026-85643](https://insights.sbomify.com/CVE-2026-85643/): code-projects Online Shopping System adduser.php mysqli_query sql injection (medium 5.1)
- [CVE-2026-85642](https://insights.sbomify.com/CVE-2026-85642/): Formidable Forms 6.5 - 6.35 - Unauthenticated Payment Gateway Connect Verification DoS (high 7.5)
- [CVE-2026-85641](https://insights.sbomify.com/CVE-2026-85641/): Formidable Forms 6.34 - Unauthenticated Stored Content Injection via 'updated_by' Parameter (medium 4.3)
- [CVE-2026-85640](https://insights.sbomify.com/CVE-2026-85640/): Privilege Escalation (medium 6.3)
- [CVE-2026-8564](https://insights.sbomify.com/CVE-2026-8564/): Other in Chrome (medium 4.2)
- [CVE-2026-85639](https://insights.sbomify.com/CVE-2026-85639/): jofpin trape Telemetry Endpoint user.py race condition (medium 6.3)
- [CVE-2026-85638](https://insights.sbomify.com/CVE-2026-85638/): jofpin trape user.py authorization (medium 6.9)
- [CVE-2026-85637](https://insights.sbomify.com/CVE-2026-85637/): jofpin trape Admin Endpoint sockets.py join_room missing authentication (medium 6.9)
- [CVE-2026-85636](https://insights.sbomify.com/CVE-2026-85636/): jofpin trape Login Endpoint stats.py missing authentication (medium 6.9)
- [CVE-2026-85634](https://insights.sbomify.com/CVE-2026-85634/): Wildfly-core: wildfly-core: deployer rbac role privilege escalation via path traversal in deployment name (high 8.8)
- [CVE-2026-85630](https://insights.sbomify.com/CVE-2026-85630/): HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the process_attrs method. (medium 6.1)
- [CVE-2026-8563](https://insights.sbomify.com/CVE-2026-8563/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2026-85628](https://insights.sbomify.com/CVE-2026-85628/): Cleartext Transmission of Sensitive Information in the Pairing Process vulnerability (high 7.0)
- [CVE-2026-85626](https://insights.sbomify.com/CVE-2026-85626/): git-mcp-server 2.15.1 Argument Injection via Git Ref Parameters (high 8.7)
- [CVE-2026-85625](https://insights.sbomify.com/CVE-2026-85625/): sift 17.1.3 Prototype Pollution Remote Code Execution via $where (critical 9.2)
- [CVE-2026-85624](https://insights.sbomify.com/CVE-2026-85624/): Blinko 1.8.7 Cross-User Private Note Disclosure via noteReferenceList (high 7.1)
- [CVE-2026-85623](https://insights.sbomify.com/CVE-2026-85623/): goose 1.37.0 Arbitrary Command Execution via Recipe Extensions (high 8.7)
- [CVE-2026-85622](https://insights.sbomify.com/CVE-2026-85622/): AppFlowy-Cloud through 0.9.64 Cross-Workspace Collab Read via WebSocket (medium 6.0)
- [CVE-2026-85621](https://insights.sbomify.com/CVE-2026-85621/): LobeChat 2.2.1 Webhook Signature Verification Bypass QQ Feishu (medium 6.9)
- [CVE-2026-85620](https://insights.sbomify.com/CVE-2026-85620/): Postgres MCP Pro 0.3.0 Restricted-Mode Bypass via FROM-Clause Function (critical 9.2)
- [CVE-2026-8562](https://insights.sbomify.com/CVE-2026-8562/): Information disclosure in Chrome (medium 4.3)
- [CVE-2026-85619](https://insights.sbomify.com/CVE-2026-85619/): AppFlowy-Cloud 0.9.64 Cross-Workspace Collab Access via HTTP API (high 7.7)
- [CVE-2026-85618](https://insights.sbomify.com/CVE-2026-85618/): ConvertX 0.17.0 Arbitrary File Read via LaTeX Input Directives (high 7.1)
- [CVE-2026-85617](https://insights.sbomify.com/CVE-2026-85617/): snipe-it before 8.6.3 Authorization Bypass via Bulk Delete (high 8.7)
- [CVE-2026-85616](https://insights.sbomify.com/CVE-2026-85616/): Snipe-IT before 8.6.2 Authorization Bypass via Checkout-Acceptance (high 8.4)
- [CVE-2026-85615](https://insights.sbomify.com/CVE-2026-85615/): Openpanel before 2.3.0 Cross-Tenant IDOR via report.getLayouts (medium 5.3)
- [CVE-2026-85614](https://insights.sbomify.com/CVE-2026-85614/): OpenPanel API before 2.3.0 Unauthenticated SSRF via site-checker (critical 9.2)
- [CVE-2026-85613](https://insights.sbomify.com/CVE-2026-85613/): OpenPanel before 2.3.0 Unauthenticated XSS via SVG Favicon Proxy (high 8.4)
- [CVE-2026-85612](https://insights.sbomify.com/CVE-2026-85612/): OpenPanel before 2.3.0 SSRF via favicon and og endpoints (high 8.7)
- [CVE-2026-85611](https://insights.sbomify.com/CVE-2026-85611/): OpenPanel before 2.3.0 Cross-Tenant BOLA via report procedures (medium 5.3)
- [CVE-2026-85610](https://insights.sbomify.com/CVE-2026-85610/): OpenPanel before 2.3.0 Remote Code Execution via chart formulas (high 8.7)
- [CVE-2026-8561](https://insights.sbomify.com/CVE-2026-8561/): Other in Chrome (medium 5.4)
- [CVE-2026-85609](https://insights.sbomify.com/CVE-2026-85609/): Openpanel before 2.3.0 SSRF via Site Checker Endpoint (medium 6.9)
- [CVE-2026-85608](https://insights.sbomify.com/CVE-2026-85608/): Douyin_TikTok_Download_API 4.1.2 SSRF via url parameter (high 8.7)
- [CVE-2026-85607](https://insights.sbomify.com/CVE-2026-85607/): Blinko 1.8.7 Cross-User AI Conversation Read and Write via message tRPC Router (high 8.7)
- [CVE-2026-85606](https://insights.sbomify.com/CVE-2026-85606/): firecrawl-mcp-server 3.20.2 Arbitrary Local File Read via filePath (high 8.7)
- [CVE-2026-85605](https://insights.sbomify.com/CVE-2026-85605/): Slink before 1.12.3 Missing Authorization on Image Comment Endpoints (medium 6.9)
- [CVE-2026-85604](https://insights.sbomify.com/CVE-2026-85604/): Grav before 2.0.18 Remote Code Execution via sort filter (high 8.7)
- [CVE-2026-85603](https://insights.sbomify.com/CVE-2026-85603/): Grav Admin Plugin Path Traversal via Save As Language Code (high 7.1)
- [CVE-2026-85602](https://insights.sbomify.com/CVE-2026-85602/): Grav Form Plugin before 9.1.20 reCAPTCHA v3 Authentication Bypass (critical 9.3)
- [CVE-2026-85601](https://insights.sbomify.com/CVE-2026-85601/): Grav Admin before 2.0.20 Cross-Site Scripting via marked.js (medium 5.1)
- [CVE-2026-85600](https://insights.sbomify.com/CVE-2026-85600/): Grav Admin before 2.0.21 Stored XSS via username (medium 5.1)
- [CVE-2026-8560](https://insights.sbomify.com/CVE-2026-8560/): Memory corruption in Chrome (medium 4.3)
- [CVE-2026-85599](https://insights.sbomify.com/CVE-2026-85599/): Grav Shortcode Core before 6.2.5 Stored XSS via unescaped parameters (medium 5.1)
- [CVE-2026-85598](https://insights.sbomify.com/CVE-2026-85598/): Grav 2.0.0 through 2.0.17 Stored XSS via Modular Pages (medium 5.1)
- [CVE-2026-85597](https://insights.sbomify.com/CVE-2026-85597/): Traefik before v2.11.55 and v3.0.0 through v3.7.10 mTLS Bypass via TLS Option Conflict (high 8.2)
- [CVE-2026-85596](https://insights.sbomify.com/CVE-2026-85596/): Traefik v3.7 Authentication Bypass via TLS Option Conflict (high 8.2)
- [CVE-2026-85595](https://insights.sbomify.com/CVE-2026-85595/): Traefik before v2.11.55 and v3.0.0 through v3.7.10 Authentication Bypass via digestAuth (critical 9.3)
- [CVE-2026-85594](https://insights.sbomify.com/CVE-2026-85594/): Traefik v3.7.1 crossProviderNamespaces Bypass via Service Middleware (high 7.0)
- [CVE-2026-85593](https://insights.sbomify.com/CVE-2026-85593/): phpMyFAQ before 4.1.8 Stored XSS via html_entity_decode (medium 5.1)
- [CVE-2026-85592](https://insights.sbomify.com/CVE-2026-85592/): phpMyFAQ before 4.1.8 Authorization Bypass via question/create (medium 6.3)
- [CVE-2026-85591](https://insights.sbomify.com/CVE-2026-85591/): phpMyFAQ before 4.1.8 Authentication Bypass via Unverified Password Change (high 7.1)
- [CVE-2026-85590](https://insights.sbomify.com/CVE-2026-85590/): phpMyFAQ before 4.1.8 Authentication Bypass via Two-Factor Disable (high 7.1)
- [CVE-2026-8559](https://insights.sbomify.com/CVE-2026-8559/): Integer overflow in Chrome (medium 4.3)
- [CVE-2026-85589](https://insights.sbomify.com/CVE-2026-85589/): phpMyFAQ before 4.2.0-alpha.2 Missing Authorization via Dashboard API (medium 5.3)
- [CVE-2026-85588](https://insights.sbomify.com/CVE-2026-85588/): phpMyFAQ before 4.1.8 TOTP Secret Exposure via Data Export (medium 5.3)
- [CVE-2026-85587](https://insights.sbomify.com/CVE-2026-85587/): phpMyFAQ before 4.1.8 Incorrect Authorization via Admin Pages (medium 5.3)
- [CVE-2026-85586](https://insights.sbomify.com/CVE-2026-85586/): phpMyFAQ before 4.1.8 CAPTCHA Bypass via store parameter (medium 6.9)
- [CVE-2026-85585](https://insights.sbomify.com/CVE-2026-85585/): SiYuan before v3.8.2 Unbounded Memory Consumption via ControlConcurrency (high 8.7)
- [CVE-2026-85584](https://insights.sbomify.com/CVE-2026-85584/): SiYuan before v3.8.2 Denial of Service via Auth Throttle (high 8.7)
- [CVE-2026-85583](https://insights.sbomify.com/CVE-2026-85583/): SiYuan before v3.8.2 Path Traversal via symlink in file API (high 7.1)
- [CVE-2026-85582](https://insights.sbomify.com/CVE-2026-85582/): SiYuan before v3.8.2 Unbounded Session Creation via Basic Auth (high 7.1)
- [CVE-2026-85581](https://insights.sbomify.com/CVE-2026-85581/): SiYuan before v3.8.2 Denial of Service via unauthenticated UI-process registration (high 8.7)
- [CVE-2026-85580](https://insights.sbomify.com/CVE-2026-85580/): SiYuan before v3.8.2 Path Guard Bypass via Case Mismatch (high 7.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/305/