# Vulnerabilities published in 2026


- [CVE-2026-85109](https://insights.sbomify.com/CVE-2026-85109/): Tenda HG10 Boa Web Server formLogin buffer overflow (critical 9.3)
- [CVE-2026-85107](https://insights.sbomify.com/CVE-2026-85107/): NousResearch hermes-agent Electron Main Process main.ts resourceBufferFromUrl allocation of resources (medium 5.3)
- [CVE-2026-85106](https://insights.sbomify.com/CVE-2026-85106/): NousResearch hermes-agent Link Title Fetch index.tsx fetchLinkTitle server-side request forgery (medium 5.3)
- [CVE-2026-85105](https://insights.sbomify.com/CVE-2026-85105/): NousResearch hermes-agent Session Management s71.py _sess_nowait authorization (medium 6.9)
- [CVE-2026-85104](https://insights.sbomify.com/CVE-2026-85104/): Brain stimulation parameters can be modified via Bluetooth in Sooma (medium 5.3)
- [CVE-2026-85103](https://insights.sbomify.com/CVE-2026-85103/): Heap-based Buffer Overflow in VPN Certificate ASN.1 Decoding (critical 9.8)
- [CVE-2026-85102](https://insights.sbomify.com/CVE-2026-85102/): Check Point Multiple Products Improper Certificate Validation (critical 9.8, exploited in the wild)
- [CVE-2026-85100](https://insights.sbomify.com/CVE-2026-85100/): 2FastLabs agent-squad Streaming Agent Response Workflow orchestrator.ts AgentSquad.routeRequest resource consumption (medium 5.3)
- [CVE-2026-8510](https://insights.sbomify.com/CVE-2026-8510/): Integer overflow in Chrome (high 7.5)
- [CVE-2026-85097](https://insights.sbomify.com/CVE-2026-85097/): Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter (critical 9.8)
- [CVE-2026-85094](https://insights.sbomify.com/CVE-2026-85094/): Information disclosure in Canva (high 8.8)
- [CVE-2026-85093](https://insights.sbomify.com/CVE-2026-85093/): Cheshire Cat AI Memory Collection Endpoint Information Disclosure (high 7.1)
- [CVE-2026-85092](https://insights.sbomify.com/CVE-2026-85092/): LiME through 1.12.0 Arbitrary File Overwrite via Symlink Following (medium 5.2)
- [CVE-2026-85091](https://insights.sbomify.com/CVE-2026-85091/): zlib 1.3.1.2 through 1.3.2 Heap Buffer Overflow via gz_vacate (high 8.3)
- [CVE-2026-85090](https://insights.sbomify.com/CVE-2026-85090/): FreeRDP before 3.31.0 Heap Out-of-Bounds Read via AVC444 (medium 5.3)
- [CVE-2026-8509](https://insights.sbomify.com/CVE-2026-8509/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-85089](https://insights.sbomify.com/CVE-2026-85089/): FreeRDP before 3.31.0 Information Disclosure via uninitialized heap memory (high 7.1)
- [CVE-2026-85088](https://insights.sbomify.com/CVE-2026-85088/): Security feature bypass in Apache Thrift (medium 6.9)
- [CVE-2026-85087](https://insights.sbomify.com/CVE-2026-85087/): Apache Thrift: Python ≥3.12 host-name check silently becomes a no-op (medium 6.9)
- [CVE-2026-85086](https://insights.sbomify.com/CVE-2026-85086/): Apache Thrift: Perl TLS client disables certificate verification by default (medium 6.9)
- [CVE-2026-85085](https://insights.sbomify.com/CVE-2026-85085/): Code injection in Canva (critical 9.6)
- [CVE-2026-85084](https://insights.sbomify.com/CVE-2026-85084/): Out-of-bounds write in TizenFX MediaBufferBase indexer setter due to missing bounds check (medium 6.3)
- [CVE-2026-85083](https://insights.sbomify.com/CVE-2026-85083/): CareCam Pro IP Cameras Use of Hard-coded Credentials (high 7.0)
- [CVE-2026-85082](https://insights.sbomify.com/CVE-2026-85082/): Maple Media Root Browser Classic 3.3.0 - OS command injection through crafted SQLite filenames (high 8.5)
- [CVE-2026-85081](https://insights.sbomify.com/CVE-2026-85081/): Multiple elFinder Plugins - DOM-based XSS via postMessage Origin Bypass (high 7.5)
- [CVE-2026-85080](https://insights.sbomify.com/CVE-2026-85080/): Authenticated Denial-of-Service in Zigbee GetGroupMembership Handling (medium 6.0)
- [CVE-2026-8508](https://insights.sbomify.com/CVE-2026-8508/): Auth bypass in WAX650S firmware (medium 6.5)
- [CVE-2026-85079](https://insights.sbomify.com/CVE-2026-85079/): Out-of-bounds write in Zigbee Simple_Desc_req handling (high 7.5)
- [CVE-2026-85078](https://insights.sbomify.com/CVE-2026-85078/): sanic chunked trailer request smuggling allows hidden second request execution (medium 6.5)
- [CVE-2026-85077](https://insights.sbomify.com/CVE-2026-85077/): Sanic: HTTP response header injection via missing CR/LF validation in Sanic HTTP/1.1 responses (high 8.2)
- [CVE-2026-8507](https://insights.sbomify.com/CVE-2026-8507/): Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl have out-of-bounds (OOB) write flaws (critical 9.8)
- [CVE-2026-85063](https://insights.sbomify.com/CVE-2026-85063/): node-csv: Prototype replacement still reachable via columns path (medium 6.9)
- [CVE-2026-85062](https://insights.sbomify.com/CVE-2026-85062/): Colord: Slow rejection of oversized malformed color strings (medium 6.9)
- [CVE-2026-85061](https://insights.sbomify.com/CVE-2026-85061/): MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip (critical 10.0)
- [CVE-2026-85058](https://insights.sbomify.com/CVE-2026-85058/): Moquette: Missing Authorization in io.moquette:moquette-broker (high 7.5)
- [CVE-2026-85057](https://insights.sbomify.com/CVE-2026-85057/): ZITADEL: Actions V1 sandbox escape: host file read via require() (high 8.7)
- [CVE-2026-85056](https://insights.sbomify.com/CVE-2026-85056/): ZITADEL: MFA bypass via session reuse in Login V2 (high 8.2)
- [CVE-2026-85055](https://insights.sbomify.com/CVE-2026-85055/): Twenty: Field-level read bypass (high 7.1)
- [CVE-2026-85053](https://insights.sbomify.com/CVE-2026-85053/): Security feature bypass in Chrome (high 8.8)
- [CVE-2026-85052](https://insights.sbomify.com/CVE-2026-85052/): Memory corruption in Chrome (low 3.1)
- [CVE-2026-85051](https://insights.sbomify.com/CVE-2026-85051/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-85050](https://insights.sbomify.com/CVE-2026-85050/): Memory corruption in Chrome (critical 9.6)
- [CVE-2026-8505](https://insights.sbomify.com/CVE-2026-8505/): Authentication Bypass in Webhook Endpoints Allowed Unauthorized Flow Execution (critical 9.8)
- [CVE-2026-85049](https://insights.sbomify.com/CVE-2026-85049/): Use after free in Chrome (high 8.8)
- [CVE-2026-85048](https://insights.sbomify.com/CVE-2026-85048/): Use after free in Chrome (high 8.3)
- [CVE-2026-85047](https://insights.sbomify.com/CVE-2026-85047/): Other in Chrome (critical 9.6)
- [CVE-2026-85046](https://insights.sbomify.com/CVE-2026-85046/): Google Chromium V8 Type Confusion (high 8.8, exploited in the wild)
- [CVE-2026-85045](https://insights.sbomify.com/CVE-2026-85045/): Race condition in Chrome (high 7.5)
- [CVE-2026-85044](https://insights.sbomify.com/CVE-2026-85044/): Use after free in Chrome (medium 6.5)
- [CVE-2026-85043](https://insights.sbomify.com/CVE-2026-85043/): Security feature bypass in Chrome (critical 9.1)
- [CVE-2026-85042](https://insights.sbomify.com/CVE-2026-85042/): Use after free in Chrome (critical 9.6)
- [CVE-2026-85040](https://insights.sbomify.com/CVE-2026-85040/): ZhongBangKeJi CRMEB Custom Scheduled Task Feature save eval os command injection (medium 5.1)
- [CVE-2026-85038](https://insights.sbomify.com/CVE-2026-85038/): B2BKing < 5.2.40 - Unauthenticated B2B Group Assignment and Approval Bypass via Registration Role Selection (medium 5.3)
- [CVE-2026-85037](https://insights.sbomify.com/CVE-2026-85037/): Sunshine Photo Cart < 3.7 - Unauthenticated Price Manipulation via IDOR (medium 5.3)
- [CVE-2026-85031](https://insights.sbomify.com/CVE-2026-85031/): TOTOLINK CP450 cstecgi.cgi buffer overflow (critical 9.4)
- [CVE-2026-85030](https://insights.sbomify.com/CVE-2026-85030/): HKUDS AI-Trader selfRegister API Endpoint routes_agent.py logic error (medium 6.3)
- [CVE-2026-8503](https://insights.sbomify.com/CVE-2026-8503/): Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids (medium 6.5)
- [CVE-2026-85029](https://insights.sbomify.com/CVE-2026-85029/): IBM Guardium Data Protection is affected by multiple vulnerabilities. (high 7.5)
- [CVE-2026-85028](https://insights.sbomify.com/CVE-2026-85028/): Creation of Temporary File in Directory with Insecure Permissions in AWS FPGA Development Kit (high 7.3)
- [CVE-2026-85025](https://insights.sbomify.com/CVE-2026-85025/): Missing authorization in Langflow OSS (critical 9.8)
- [CVE-2026-85024](https://insights.sbomify.com/CVE-2026-85024/): undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression (medium 5.9)
- [CVE-2026-85022](https://insights.sbomify.com/CVE-2026-85022/): langgenius dify WebApp Sign-In mail-and-password-auth.tsx router.replace cross site scripting (medium 5.1)
- [CVE-2026-85021](https://insights.sbomify.com/CVE-2026-85021/): langgenius dify Splash Layout splash.tsx router.replace cross site scripting (medium 5.3)
- [CVE-2026-8502](https://insights.sbomify.com/CVE-2026-8502/): LearnPress <= 4.3.6 - Unauthenticated Sensitive Information Exposure via 'c_status' and 'return_type' Parameters (medium 5.3)
- [CVE-2026-85017](https://insights.sbomify.com/CVE-2026-85017/): Unlimited Elements For Elementor < 2.0.20 - Subscriber+ PHP Object Injection (high 7.5)
- [CVE-2026-85016](https://insights.sbomify.com/CVE-2026-85016/): Unlimited Elements For Elementor < 2.0.21 - Contributor+ Stored XSS via Icon Library Parameter (medium 6.8)
- [CVE-2026-85015](https://insights.sbomify.com/CVE-2026-85015/): Unlimited Elements For Elementor < 2.0.21 - Authenticated Arbitrary File Write via Path Traversal (medium 6.6)
- [CVE-2026-85014](https://insights.sbomify.com/CVE-2026-85014/): undici vulnerable to Denial of Service via WebSocketStream unclean close (medium 5.9)
- [CVE-2026-85013](https://insights.sbomify.com/CVE-2026-85013/): Command injection in Red Hat Enterprise Linux 10 (high 7.3)
- [CVE-2026-85012](https://insights.sbomify.com/CVE-2026-85012/): OS command injection in the Amazon CodeCatalyst blueprints SDK (high 8.5)
- [CVE-2026-85010](https://insights.sbomify.com/CVE-2026-85010/): RestroPress < 3.4.6 - Unauthenticated Price Manipulation via Cart Add-ons (medium 5.3)
- [CVE-2026-8501](https://insights.sbomify.com/CVE-2026-8501/): CVE-2026-8501 (high 7.8)
- [CVE-2026-85009](https://insights.sbomify.com/CVE-2026-85009/): RestroPress <= 3.4.6 - Unauthenticated Order Enumeration and Order Note Modification via Payment Recovery (medium 6.5)
- [CVE-2026-85008](https://insights.sbomify.com/CVE-2026-85008/): undici vulnerable to caching and replay of unsafe HTTP method responses (low 3.7)
- [CVE-2026-85007](https://insights.sbomify.com/CVE-2026-85007/): YT Player < 2.1.4 - Contributor+ Missing Authorization via ytp_ajax (low 3.8)
- [CVE-2026-85006](https://insights.sbomify.com/CVE-2026-85006/): Happy Addons for Elementor < 3.50.0 - Contributor+ Stored XSS via Creative Button Widget (medium 6.8)
- [CVE-2026-85005](https://insights.sbomify.com/CVE-2026-85005/): Popup Maker WP 1.2.2.1 - 1.4.5 - Subscriber+ Zero-Argument PHP Callable Invocation via Missing Authorization (medium 5.4)
- [CVE-2026-85004](https://insights.sbomify.com/CVE-2026-85004/): Popup Maker WP <= 1.4.5 - Subscriber+ Missing Authorization via sgpm_connect (medium 4.3)
- [CVE-2026-85002](https://insights.sbomify.com/CVE-2026-85002/): EmbedPress < 4.6.7 - Contributor+ Stored XSS via Instagram Carousel Block Attributes (medium 6.8)
- [CVE-2026-85001](https://insights.sbomify.com/CVE-2026-85001/): EmbedPress 4.4.9 - 4.6.6 - Contributor+ Stored XSS via Elementor Widget showTitle Attribute (medium 6.8)
- [CVE-2026-85000](https://insights.sbomify.com/CVE-2026-85000/): EmbedPress < 4.6.8 - Unauthenticated YouTube API Quota Consumption and Database Bloating (medium 5.3)
- [CVE-2026-8500](https://insights.sbomify.com/CVE-2026-8500/): Web::Passwd versions through 0.03 for Perl is vulnerable to RCE (critical 9.8)
- [CVE-2026-84999](https://insights.sbomify.com/CVE-2026-84999/): Pie Register Premium <= 3.8.4.0 - Unauthenticated Arbitrary File Upload via piereg_file_upload AJAX Handler (critical 9.8)
- [CVE-2026-84997](https://insights.sbomify.com/CVE-2026-84997/): react/http: A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU (high 7.5)
- [CVE-2026-84994](https://insights.sbomify.com/CVE-2026-84994/): Qwik: Crashing any Qwik Server via Resource thenable (high 8.7)
- [CVE-2026-84993](https://insights.sbomify.com/CVE-2026-84993/): MikroORM: SQL injection via unvalidated order direction in orderBy (medium 6.5)
- [CVE-2026-84992](https://insights.sbomify.com/CVE-2026-84992/): md-editor-v3: XSS via fenced-code language rendering bypass (medium 6.1)
- [CVE-2026-84990](https://insights.sbomify.com/CVE-2026-84990/): ntopng: Missing Authorization on System Configuration Backup Download and Listing (high 8.8)
- [CVE-2026-8499](https://insights.sbomify.com/CVE-2026-8499/): Auth bypass in Helpfulcrowd Product Reviews (medium 5.3)
- [CVE-2026-84989](https://insights.sbomify.com/CVE-2026-84989/): ntopng's Missing Authorization in REST API Allows Non-Admin Users to Delete and Rename Arbitrary Tags (high 7.1)
- [CVE-2026-84975](https://insights.sbomify.com/CVE-2026-84975/): Security feature bypass in pjproject (high 7.4)
- [CVE-2026-84971](https://insights.sbomify.com/CVE-2026-84971/): Persistent client crash loop via undersized FLE2 insert-update ciphertext in decryption path (high 7.1)
- [CVE-2026-84970](https://insights.sbomify.com/CVE-2026-84970/): Heap over-read or silent misparse via 32-bit truncation of JSON length in BSON JSON parser (medium 5.9)
- [CVE-2026-8497](https://insights.sbomify.com/CVE-2026-8497/): Security feature bypass in Password Manager (high 7.4)
- [CVE-2026-84969](https://insights.sbomify.com/CVE-2026-84969/): Heap overflow via truncated base64 encoding of binary fields in length-limited JSON output (medium 6.3)
- [CVE-2026-84968](https://insights.sbomify.com/CVE-2026-84968/): Heap out-of-bounds read via corrupt nested BSON in field path error message (medium 6.9)
- [CVE-2026-84967](https://insights.sbomify.com/CVE-2026-84967/): Arbitrary command execution via shell-expanded connection string in Launch MongoDB Shell terminal (medium 5.1)
- [CVE-2026-84966](https://insights.sbomify.com/CVE-2026-84966/): BSON element injection via NUL-embedded document keys in builder append (medium 5.9)
- [CVE-2026-84965](https://insights.sbomify.com/CVE-2026-84965/): Heap write primitive via size round-up wrap during JSON parsing on 32-bit builds (medium 5.9)
- [CVE-2026-84964](https://insights.sbomify.com/CVE-2026-84964/): Heap corruption via OCSP request double free from crafted multi-URL certificate in TLS client (high 8.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/310/