# Vulnerabilities published in 2026


- [CVE-2026-84141](https://insights.sbomify.com/CVE-2026-84141/): Integer overflow in the Graphics: ImageLib component (critical 9.8)
- [CVE-2026-84140](https://insights.sbomify.com/CVE-2026-84140/): Site isolation issue in the DOM: Navigation component (critical 9.8)
- [CVE-2026-8414](https://insights.sbomify.com/CVE-2026-8414/): Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event/duplicate (low 2.3)
- [CVE-2026-84139](https://insights.sbomify.com/CVE-2026-84139/): Clickjacking issue in the DOM: Events component (critical 9.8)
- [CVE-2026-84138](https://insights.sbomify.com/CVE-2026-84138/): Denial-of-service in the PDF Viewer component (high 7.5)
- [CVE-2026-84137](https://insights.sbomify.com/CVE-2026-84137/): Spoofing issue in the DOM: Core & HTML component (critical 9.8)
- [CVE-2026-84136](https://insights.sbomify.com/CVE-2026-84136/): Other issue in the DOM: Navigation component (critical 9.8)
- [CVE-2026-84135](https://insights.sbomify.com/CVE-2026-84135/): Other issue in Firefox Focus for Android (critical 9.8)
- [CVE-2026-84134](https://insights.sbomify.com/CVE-2026-84134/): Other issue in the Profile Backup component (critical 9.8)
- [CVE-2026-84133](https://insights.sbomify.com/CVE-2026-84133/): Site isolation issue in the DOM: Push Subscriptions component (critical 9.8)
- [CVE-2026-84132](https://insights.sbomify.com/CVE-2026-84132/): Information disclosure in the Networking: HTTP component (high 7.5)
- [CVE-2026-84131](https://insights.sbomify.com/CVE-2026-84131/): Privilege escalation due to invalid pointer in the Graphics component (high 8.8)
- [CVE-2026-84130](https://insights.sbomify.com/CVE-2026-84130/): Information disclosure in the Graphics: WebGPU component (high 7.5)
- [CVE-2026-8413](https://insights.sbomify.com/CVE-2026-8413/): Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/design (low 2.3)
- [CVE-2026-84129](https://insights.sbomify.com/CVE-2026-84129/): Site isolation issue in the DOM: Navigation component (critical 9.8)
- [CVE-2026-84128](https://insights.sbomify.com/CVE-2026-84128/): Privilege escalation in the WebDriver BiDi component (high 8.8)
- [CVE-2026-84127](https://insights.sbomify.com/CVE-2026-84127/): Information disclosure in the WebExtensions component in Firefox for Android (medium 4.3)
- [CVE-2026-84126](https://insights.sbomify.com/CVE-2026-84126/): Incorrect boundary conditions in the Layout: Grid component (medium 4.3)
- [CVE-2026-84125](https://insights.sbomify.com/CVE-2026-84125/): Use-after-free in the DOM: Core & HTML component (medium 5.4)
- [CVE-2026-84124](https://insights.sbomify.com/CVE-2026-84124/): Use-after-free in the DOM: Core & HTML component (medium 5.4)
- [CVE-2026-84123](https://insights.sbomify.com/CVE-2026-84123/): Privilege escalation due to use-after-free in the Graphics: WebGPU component (high 8.8)
- [CVE-2026-84122](https://insights.sbomify.com/CVE-2026-84122/): Use-after-free in the Audio/Video component (medium 5.4)
- [CVE-2026-84121](https://insights.sbomify.com/CVE-2026-84121/): Sandbox escape due to use-after-free in the DOM: Security component (critical 9.6)
- [CVE-2026-84120](https://insights.sbomify.com/CVE-2026-84120/): Use-after-free in the Audio/Video component (medium 5.4)
- [CVE-2026-8412](https://insights.sbomify.com/CVE-2026-8412/): Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/cache (low 2.3)
- [CVE-2026-84119](https://insights.sbomify.com/CVE-2026-84119/): Sandbox escape due to use-after-free in the DOM: Navigation component (critical 9.6)
- [CVE-2026-84118](https://insights.sbomify.com/CVE-2026-84118/): Use-after-free in the JavaScript: GC component (medium 5.4)
- [CVE-2026-84117](https://insights.sbomify.com/CVE-2026-84117/): Privilege escalation in Firefox for Android (high 8.8)
- [CVE-2026-84115](https://insights.sbomify.com/CVE-2026-84115/): Cleo Harmony JWT Refresh Token connections privileges management (medium 6.9)
- [CVE-2026-84114](https://insights.sbomify.com/CVE-2026-84114/): Cleo Harmony SAML Authentication LocalUserUtil.getNativeUserByAssertions improper authentication (medium 5.3)
- [CVE-2026-84113](https://insights.sbomify.com/CVE-2026-84113/): Quentn WP < 1.2.15 - Admin+ SQLi via 'orderby'/'order' Parameter (medium 4.1)
- [CVE-2026-84111](https://insights.sbomify.com/CVE-2026-84111/): Chanjet CRM jxf_dump_table.php sql injection (medium 6.9)
- [CVE-2026-84110](https://insights.sbomify.com/CVE-2026-84110/): Releasit Releasit COD Form & Upsells OTP Validation client-side enforcement of server-side security (medium 6.9)
- [CVE-2026-8411](https://insights.sbomify.com/CVE-2026-8411/): Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/delete (low 2.3)
- [CVE-2026-84109](https://insights.sbomify.com/CVE-2026-84109/): Xinhu Rainrock RockOA webmainAction.php getOrder sql injection (medium 5.3)
- [CVE-2026-84108](https://insights.sbomify.com/CVE-2026-84108/): IBM Guardium Data Protection is affected by multiple vulnerabilities. (high 8.1)
- [CVE-2026-84106](https://insights.sbomify.com/CVE-2026-84106/): IBM Guardium Data Protection is affected by multiple vulnerabilities. (high 8.9)
- [CVE-2026-84105](https://insights.sbomify.com/CVE-2026-84105/): IBM Guardium Data Protection is affected by multiple vulnerabilities. (high 7.7)
- [CVE-2026-8410](https://insights.sbomify.com/CVE-2026-8410/): Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/bulk/delete (low 2.3)
- [CVE-2026-84099](https://insights.sbomify.com/CVE-2026-84099/): Deserialization in wpstorecart (high 8.1)
- [CVE-2026-84098](https://insights.sbomify.com/CVE-2026-84098/): Directorist 3.1.0 - 8.9.4 - Subscriber+ Arbitrary Listing Deletion via remove_listing (medium 6.5)
- [CVE-2026-84097](https://insights.sbomify.com/CVE-2026-84097/): WP Review Slider Pro < 12.7.12 - Subscriber+ SQLi via Stored Template Filter (medium 6.5)
- [CVE-2026-84096](https://insights.sbomify.com/CVE-2026-84096/): WP Review Slider Pro < 12.7.12 - Subscriber+ Stored XSS via Review Form Fields (high 8.0)
- [CVE-2026-84095](https://insights.sbomify.com/CVE-2026-84095/): WP Review Slider Pro < 12.7.12 - Subscriber+ Stored XSS via Review Import (high 8.0)
- [CVE-2026-84091](https://insights.sbomify.com/CVE-2026-84091/): SUMIT Payment Gateway for WooCommerce < 4.0.0 - Unauthenticated Payment Confirmation Forgery via bit IPN (medium 5.3)
- [CVE-2026-8409](https://insights.sbomify.com/CVE-2026-8409/): Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/delete (low 2.3)
- [CVE-2026-84089](https://insights.sbomify.com/CVE-2026-84089/): IBM Guardium Data Protection is affected by multiple vulnerabilities. (high 7.8)
- [CVE-2026-84088](https://insights.sbomify.com/CVE-2026-84088/): Xpro Elementor Addons < 1.7.9 - Contributor+ Stored XSS via Interactive Circle Widget (medium 6.8)
- [CVE-2026-84086](https://insights.sbomify.com/CVE-2026-84086/): IBM Guardium Data Protection is affected by multiple vulnerabilities. (high 7.2)
- [CVE-2026-84085](https://insights.sbomify.com/CVE-2026-84085/): IBM Guardium Data Protection is affected by multiple vulnerabilities. (high 8.1)
- [CVE-2026-84084](https://insights.sbomify.com/CVE-2026-84084/): IBM Guardium Data Protection is affected by multiple vulnerabilities. (high 8.8)
- [CVE-2026-84083](https://insights.sbomify.com/CVE-2026-84083/): IBM Guardium Data Protection is affected by multiple vulnerabilities. (high 7.8)
- [CVE-2026-84082](https://insights.sbomify.com/CVE-2026-84082/): IBM Guardium Data Protection is affected by multiple vulnerabilities. (critical 9.8)
- [CVE-2026-84081](https://insights.sbomify.com/CVE-2026-84081/): IBM Guardium Data Protection is affected by multiple vulnerabilities. (high 8.1)
- [CVE-2026-84078](https://insights.sbomify.com/CVE-2026-84078/): IBM Guardium Data Protection is affected by multiple vulnerabilities. (critical 9.9)
- [CVE-2026-84077](https://insights.sbomify.com/CVE-2026-84077/): IBM Guardium Data Protection is affected by multiple vulnerabilities. (high 8.1)
- [CVE-2026-84076](https://insights.sbomify.com/CVE-2026-84076/): IBM Guardium Data Protection is affected by multiple vulnerabilities. (high 7.6)
- [CVE-2026-84075](https://insights.sbomify.com/CVE-2026-84075/): IBM Guardium Data Protection is affected by multiple vulnerabilities. (critical 9.9)
- [CVE-2026-84074](https://insights.sbomify.com/CVE-2026-84074/): IBM Guardium Data Protection is affected by multiple vulnerabilities. (high 8.9)
- [CVE-2026-84073](https://insights.sbomify.com/CVE-2026-84073/): IBM Guardium Data Protection is affected by multiple vulnerabilities. (critical 9.1)
- [CVE-2026-84071](https://insights.sbomify.com/CVE-2026-84071/): IBM Guardium Data Protection is affected by multiple vulnerabilities. (high 7.2)
- [CVE-2026-84070](https://insights.sbomify.com/CVE-2026-84070/): IBM Guardium Data Protection is affected by multiple vulnerabilities. (high 8.9)
- [CVE-2026-8407](https://insights.sbomify.com/CVE-2026-8407/): Missing authorization in Server (medium 4.3)
- [CVE-2026-84069](https://insights.sbomify.com/CVE-2026-84069/): WebFacing Email Accounts for cPanel 5.3 - 5.3.6 - Unauthenticated LFI via assets/index.php (medium 5.3)
- [CVE-2026-84068](https://insights.sbomify.com/CVE-2026-84068/): Quentn WP 1.2.13 - 1.2.14 - Unauthenticated SQLi via 'qntn_wp' Parameter (high 8.6)
- [CVE-2026-84066](https://insights.sbomify.com/CVE-2026-84066/): Directorist < 8.9 - Subscriber+ Arbitrary Post Meta Write via atbdp_post_attachment_upload (low 3.1)
- [CVE-2026-84064](https://insights.sbomify.com/CVE-2026-84064/): IBM Guardium Data Protection is affected by multiple vulnerabilities. (critical 9.9)
- [CVE-2026-84063](https://insights.sbomify.com/CVE-2026-84063/): File upload in BurgerEditor (high 8.5)
- [CVE-2026-84062](https://insights.sbomify.com/CVE-2026-84062/): Missing authorization in BurgerEditor (medium 5.3)
- [CVE-2026-84061](https://insights.sbomify.com/CVE-2026-84061/): zhongyu09 OpenChatBI generate_sql.py _validate_sql_safety sql injection (medium 5.3)
- [CVE-2026-8406](https://insights.sbomify.com/CVE-2026-8406/): openSIS Classic 9.3 - Insecure Direct Object Reference in Sent Mail (high 7.1)
- [CVE-2026-84059](https://insights.sbomify.com/CVE-2026-84059/): ICP DAS UA-2200/UA-5200 CGI ArmAngstromInstructionSet command injection (medium 5.3)
- [CVE-2026-84058](https://insights.sbomify.com/CVE-2026-84058/): Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection (high 8.1)
- [CVE-2026-84057](https://insights.sbomify.com/CVE-2026-84057/): IBM Guardium Data Protection is affected by multiple vulnerabilities. (high 8.1)
- [CVE-2026-8405](https://insights.sbomify.com/CVE-2026-8405/): IBM Guardium Data Protection is affected by Exposure of Sensitive Information vulnerability (medium 6.5)
- [CVE-2026-84048](https://insights.sbomify.com/CVE-2026-84048/): File upload in JoomGallery extension for Joomla (medium 6.3)
- [CVE-2026-84047](https://insights.sbomify.com/CVE-2026-84047/): Album Cover Finder <= 0.7.0 - Unauthenticated SQLi via and_action (high 8.6)
- [CVE-2026-84046](https://insights.sbomify.com/CVE-2026-84046/): Directorist < 8.9.5 - Subscriber+ SSRF via Avatar URL (medium 5.0)
- [CVE-2026-84045](https://insights.sbomify.com/CVE-2026-84045/): E-cab Taxi Booking Manager for Woocommerce < 2.0.5 - Unauthenticated Price Manipulation via mptbm_add_to_cart (medium 5.3)
- [CVE-2026-84044](https://insights.sbomify.com/CVE-2026-84044/): Restaurant Menu and Food Ordering < 2.4.12 - Unauthenticated Payment Bypass via Forged PayPal IPN (medium 5.3)
- [CVE-2026-84043](https://insights.sbomify.com/CVE-2026-84043/): ePayco Payment Gateway for WooCommerce < 8.4.7 - Unauthenticated Payment Confirmation Bypass (medium 5.3)
- [CVE-2026-84042](https://insights.sbomify.com/CVE-2026-84042/): Crun: crun: rootful krun with passt executes container payload as host root (high 7.8)
- [CVE-2026-8404](https://insights.sbomify.com/CVE-2026-8404/): Potential exposure of private data via case-sensitive Cache-Control directives in UpdateCacheMiddleware (low 2.3)
- [CVE-2026-84036](https://insights.sbomify.com/CVE-2026-84036/): IBM Guardium Data Protection is affected by multiple vulnerabilities. (high 7.4)
- [CVE-2026-84035](https://insights.sbomify.com/CVE-2026-84035/): Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection (high 8.1)
- [CVE-2026-84034](https://insights.sbomify.com/CVE-2026-84034/): IBM Guardium Data Protection is affected by multiple vulnerabilities. (high 8.8)
- [CVE-2026-84032](https://insights.sbomify.com/CVE-2026-84032/): IBM Guardium Data Protection is affected by multiple vulnerabilities (medium 5.6)
- [CVE-2026-84031](https://insights.sbomify.com/CVE-2026-84031/): IBM Guardium Data Protection is affected by multiple vulnerabilities. (critical 9.0)
- [CVE-2026-8403](https://insights.sbomify.com/CVE-2026-8403/): Stored XSS in Exagate's SYSGUARD 6001 (medium 6.1)
- [CVE-2026-84028](https://insights.sbomify.com/CVE-2026-84028/): Bold Page Builder < 5.9.9 - Contributor+ Stored XSS via Slider Elements' additional_settings (medium 6.8)
- [CVE-2026-84027](https://insights.sbomify.com/CVE-2026-84027/): Directorist 8.9.1 - 8.9.4 - Subscriber+ Paid Order and Payment Record Forgery via REST Orders Endpoint (medium 4.3)
- [CVE-2026-84026](https://insights.sbomify.com/CVE-2026-84026/): Directorist 8.1 - 8.9.4 - Unauthenticated Sensitive Data Disclosure via REST Users Endpoint (medium 5.3)
- [CVE-2026-84025](https://insights.sbomify.com/CVE-2026-84025/): Missing authorization in BEAR (low 2.2)
- [CVE-2026-84024](https://insights.sbomify.com/CVE-2026-84024/): BEAR - Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Meta Field Configuration Update via CSRF (medium 4.3)
- [CVE-2026-84023](https://insights.sbomify.com/CVE-2026-84023/): BEAR - Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Taxonomy Term Modification via CSRF (medium 6.5)
- [CVE-2026-84022](https://insights.sbomify.com/CVE-2026-84022/): Bold Page Builder < 5.9.8 - Contributor+ Stored XSS via Multiple Shortcode Element Attributes (medium 6.8)
- [CVE-2026-84021](https://insights.sbomify.com/CVE-2026-84021/): Bold Page Builder < 5.9.8 - Contributor+ Stored XSS via bt_bb_button/bt_bb_headline/bt_bb_icon URL (medium 6.8)
- [CVE-2026-84020](https://insights.sbomify.com/CVE-2026-84020/): Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-8402](https://insights.sbomify.com/CVE-2026-8402/): SQLi in Exagate's SYSGUARD 6001 (critical 9.8)
- [CVE-2026-84019](https://insights.sbomify.com/CVE-2026-84019/): Windows Advanced Rasterization Platform Elevation of Privilege Vulnerability (high 7.0)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/318/