# Vulnerabilities published in 2026


- [CVE-2026-78935](https://insights.sbomify.com/CVE-2026-78935/): Memory corruption in Chrome (critical 9.6)
- [CVE-2026-78934](https://insights.sbomify.com/CVE-2026-78934/): Race condition in Chrome (high 8.3)
- [CVE-2026-78915](https://insights.sbomify.com/CVE-2026-78915/): Race condition in Chrome (high 7.5)
- [CVE-2026-78914](https://insights.sbomify.com/CVE-2026-78914/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-78913](https://insights.sbomify.com/CVE-2026-78913/): Use after free in Chrome (high 8.1)
- [CVE-2026-78912](https://insights.sbomify.com/CVE-2026-78912/): Other in Chrome (medium 5.4)
- [CVE-2026-78911](https://insights.sbomify.com/CVE-2026-78911/): Missing authorization in Chrome (high 8.3)
- [CVE-2026-78910](https://insights.sbomify.com/CVE-2026-78910/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-78909](https://insights.sbomify.com/CVE-2026-78909/): Use after free in Chrome (critical 9.6)
- [CVE-2026-78908](https://insights.sbomify.com/CVE-2026-78908/): Information disclosure in Chrome (medium 4.3)
- [CVE-2026-78907](https://insights.sbomify.com/CVE-2026-78907/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-78906](https://insights.sbomify.com/CVE-2026-78906/): Race condition in Chrome (high 7.5)
- [CVE-2026-78905](https://insights.sbomify.com/CVE-2026-78905/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-78904](https://insights.sbomify.com/CVE-2026-78904/): Memory corruption in Chrome (critical 9.6)
- [CVE-2026-78903](https://insights.sbomify.com/CVE-2026-78903/): Security feature bypass in Chrome (low 3.1)
- [CVE-2026-78902](https://insights.sbomify.com/CVE-2026-78902/): Cross Site Scripting vulnerability in Netgate pfSense 26.03.1-RELEASE allows an attacker to execute arbitrary code via the pfBlockerNG packa (medium 6.1)
- [CVE-2026-78901](https://insights.sbomify.com/CVE-2026-78901/): Race condition in Chrome (high 7.5)
- [CVE-2026-78900](https://insights.sbomify.com/CVE-2026-78900/): Other in Chrome (critical 9.6)
- [CVE-2026-7890](https://insights.sbomify.com/CVE-2026-7890/): Concrete CMS 9.5.0 is vulnerable to SSRF via RSS Displayer Block (low 2.1)
- [CVE-2026-78899](https://insights.sbomify.com/CVE-2026-78899/): Use after free in Chrome (high 8.8)
- [CVE-2026-78898](https://insights.sbomify.com/CVE-2026-78898/): Security feature bypass in Chrome (medium 5.4)
- [CVE-2026-78897](https://insights.sbomify.com/CVE-2026-78897/): Missing authorization in Chrome (medium 6.5)
- [CVE-2026-78896](https://insights.sbomify.com/CVE-2026-78896/): Information disclosure in Chrome (medium 4.3)
- [CVE-2026-78895](https://insights.sbomify.com/CVE-2026-78895/): Information disclosure in Chrome (medium 4.3)
- [CVE-2026-78894](https://insights.sbomify.com/CVE-2026-78894/): Race condition in Chrome (low 3.1)
- [CVE-2026-78893](https://insights.sbomify.com/CVE-2026-78893/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-78892](https://insights.sbomify.com/CVE-2026-78892/): Security feature bypass in Chrome (high 7.1)
- [CVE-2026-78891](https://insights.sbomify.com/CVE-2026-78891/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-78887](https://insights.sbomify.com/CVE-2026-78887/): liketrek TREK Journey Photo Proxy validateShareTokenForAsset authorization (medium 6.3)
- [CVE-2026-78886](https://insights.sbomify.com/CVE-2026-78886/): liketrek TREK Public Journey Photo Proxy journey-public.controller.ts path traversal (medium 6.3)
- [CVE-2026-78885](https://insights.sbomify.com/CVE-2026-78885/): liketrek TREK OIDC Service oidcService.ts findOrCreateUser improper authentication (medium 6.3)
- [CVE-2026-7888](https://insights.sbomify.com/CVE-2026-7888/): Concrete CMS is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components (high 8.4)
- [CVE-2026-7887](https://insights.sbomify.com/CVE-2026-7887/): For Concrete CMS 9.5.0 and below, OAuth 2.0 Authorization-Code Handler Bypasses Account Status (low 2.3)
- [CVE-2026-78864](https://insights.sbomify.com/CVE-2026-78864/): liketrek TREK Journey Entry Update journey.controller.t journeyService.updateEntry sql injection (medium 5.3)
- [CVE-2026-78863](https://insights.sbomify.com/CVE-2026-78863/): liketrek TREK Pre-2FA mfa_token authService.ts loginUser improper authentication (medium 5.3)
- [CVE-2026-78862](https://insights.sbomify.com/CVE-2026-78862/): An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the UART serial interface on the printed circuit board (P (medium 6.8)
- [CVE-2026-78861](https://insights.sbomify.com/CVE-2026-78861/): An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via a hardcoded 512-bit RSA Private Key (high 7.7)
- [CVE-2026-78860](https://insights.sbomify.com/CVE-2026-78860/): An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the storage of information in plaintext (high 7.8)
- [CVE-2026-7886](https://insights.sbomify.com/CVE-2026-7886/): Concrete CMS 9.5.0 and below is vulnerable to IDOR in AddMessage/UpdateMessage via attachments[] parameter (low 2.3)
- [CVE-2026-78851](https://insights.sbomify.com/CVE-2026-78851/): Directory Traversal vulnerability in Grav CMS 2.0.3 through 2.0.6 allows a remote attacker to obtain sensitive information via the GravExten (medium 6.5)
- [CVE-2026-78850](https://insights.sbomify.com/CVE-2026-78850/): An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the SiteContentDetector / SitesManager component. (medium 5.0)
- [CVE-2026-78849](https://insights.sbomify.com/CVE-2026-78849/): Cross Site Scripting vulnerability in Netgate pfSense Plus software versions <= 26.03 pfSense CE software versions <= 2.8.1 allows a remote (medium 5.4)
- [CVE-2026-78847](https://insights.sbomify.com/CVE-2026-78847/): An issue in gray-matter All versions (verified on 4.0.3) allows the JavaScript engine in lib/engines.js using eval() to parse front matter w (critical 9.8)
- [CVE-2026-78846](https://insights.sbomify.com/CVE-2026-78846/): Multiple AiDot devices are vulnerable to a heap-based buffer overflow via SSDP location header parsing. (critical 9.8)
- [CVE-2026-78845](https://insights.sbomify.com/CVE-2026-78845/): Aidot products Linkind Matter Smart Plug 1.01.32, OREiN Matter Smart Light Bulb 3.15.21, and Linkind Wi-Fi Smart Light Bulb 3.30.17 are vuln (not scored)
- [CVE-2026-7884](https://insights.sbomify.com/CVE-2026-7884/): IBM Cognos Analytics versions 12.0.4 and 12.1.3 is affected by security vulnerabilities (medium 5.4)
- [CVE-2026-78839](https://insights.sbomify.com/CVE-2026-78839/): An arbitrary file upload vulnerability in AppNitro MachForm v30 allows attackers to execute arbitrary code via uploading a crafted .phar file. (high 8.1)
- [CVE-2026-78838](https://insights.sbomify.com/CVE-2026-78838/): A reflected cross-site scripting (XSS) vulnerability in the grid_datasource.php component of AppNitro MachForm v30 allows attackers to execu (medium 6.5)
- [CVE-2026-78837](https://insights.sbomify.com/CVE-2026-78837/): A SQL injection vulnerability in the ap_form_{id} parameter in AppNitro MachForm v30 allows attackers to access sensitive database informati (high 7.5)
- [CVE-2026-78835](https://insights.sbomify.com/CVE-2026-78835/): Rocket Software Rocket Remote Desktop 18.0.8583.1 is vulnerable to Insufficiently Protected Credentials. (critical 9.8)
- [CVE-2026-78834](https://insights.sbomify.com/CVE-2026-78834/): A code execution vulnerability exists in CMSimple 5.22 in the CoAuthors plugin. (high 8.8)
- [CVE-2026-7882](https://insights.sbomify.com/CVE-2026-7882/): Concrete CMS 9.5.0 and below is vulnerable to CSRF via the DeleteFile controller (low 2.3)
- [CVE-2026-7881](https://insights.sbomify.com/CVE-2026-7881/): Concrete CMS 9.5.0 and below is vulnerable to IDOR in the Express Entry Detail block (medium 6.3)
- [CVE-2026-78807](https://insights.sbomify.com/CVE-2026-78807/): An issue in wpa_supplicant all versions before v.2.12 allows a local attacker to bypass proper network context and AKMP matching for PMKSA c (high 7.1)
- [CVE-2026-78806](https://insights.sbomify.com/CVE-2026-78806/): An issue in Matter Standard Specification-Implementation gap v1.5.1 Matter Project Chip V1.5.1 allows a local attacker to obtain sensitive i (medium 5.5)
- [CVE-2026-78802](https://insights.sbomify.com/CVE-2026-78802/): An issue in SKYWORTH DIGITAL CO.,LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to execute arbitrary code. (critical 9.8)
- [CVE-2026-78801](https://insights.sbomify.com/CVE-2026-78801/): An issue in SKYWORTH DIGITAL CO., LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to obtain sensitiv (medium 4.3)
- [CVE-2026-78799](https://insights.sbomify.com/CVE-2026-78799/): Directory Traversal vulnerability in Quanxun Huiju Network Technology (Beijing) Co., Ltd IK-Q3000 Enterprise-grade Wi-Fi 6 wireless router E (critical 9.8)
- [CVE-2026-78797](https://insights.sbomify.com/CVE-2026-78797/): An issue in iStoreOS istoreos-24.10.7 and before allows a remote attacker to execute arbitrary code via the task_id in tasks-lib.lua. (critical 9.8)
- [CVE-2026-78796](https://insights.sbomify.com/CVE-2026-78796/): An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114.024540 and before allows a remote attacker to (critical 9.8)
- [CVE-2026-78795](https://insights.sbomify.com/CVE-2026-78795/): An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114.024540 and before allows a remote attacker to (high 7.5)
- [CVE-2026-7879](https://insights.sbomify.com/CVE-2026-7879/): Concrete CMS 9.5.0 and below is vulnerable to File Download Authorization Bypass in submit_password() (medium 6.3)
- [CVE-2026-7877](https://insights.sbomify.com/CVE-2026-7877/): Cross-site scripting in WP Recipe Maker Premium (medium 6.4)
- [CVE-2026-7876](https://insights.sbomify.com/CVE-2026-7876/): Authentication bypass vulnerability found in Aspera High-Speed Transfer Server for Cloud Pak for Integration (critical 9.1)
- [CVE-2026-7875](https://insights.sbomify.com/CVE-2026-7875/): NanoClaw Host/Container Filesystem Boundary Vulnerability via Outbound Attachment Handling (critical 9.3)
- [CVE-2026-78745](https://insights.sbomify.com/CVE-2026-78745/): An issue in HiDPT/ Weyon HiDPTAndroid Hi3751V350 Hi3751V352E_DMO allows a remote attacker to execute arbitrary code via the Android Debug Br (critical 9.8)
- [CVE-2026-78742](https://insights.sbomify.com/CVE-2026-78742/): Silverpeas Core <=6.4.6 is vulnerable to Cross Site Scripting (XSS) via the Multimedia library application introduction. (medium 6.1)
- [CVE-2026-78741](https://insights.sbomify.com/CVE-2026-78741/): Silverpeas Core <=6.4.6 is vulnerable to Cross Site Scripting (XSS) in the wysiwyg-CKEditor image upload feature. (medium 6.1)
- [CVE-2026-7874](https://insights.sbomify.com/CVE-2026-7874/): Weak Cryptographic Key Derivation Exposed All Stored Credentials (critical 9.1)
- [CVE-2026-78738](https://insights.sbomify.com/CVE-2026-78738/): Silverpeas Core 6.4.6 is vulnerable to Cross Site Scripting (XSS) via the Document management file upload feature. (medium 6.1)
- [CVE-2026-7873](https://insights.sbomify.com/CVE-2026-7873/): Code Injection Vulnerability in Code Validation Endpoint (critical 9.9)
- [CVE-2026-7872](https://insights.sbomify.com/CVE-2026-7872/): Path Traversal Vulnerability in File Component Leading to Arbitrary File Read and Authentication Bypass (high 7.5)
- [CVE-2026-7871](https://insights.sbomify.com/CVE-2026-7871/): Insecure Deserialization in Redis Cache Backend (critical 9.8)
- [CVE-2026-78701](https://insights.sbomify.com/CVE-2026-78701/): 389-ds-base: 389-ds-base: cve-2026-11610 incomplete fix may introduce a connection-stall dos (medium 6.5)
- [CVE-2026-7870](https://insights.sbomify.com/CVE-2026-7870/): IBM i is Affected by Privilege Escalation [] (high 8.8)
- [CVE-2026-78699](https://insights.sbomify.com/CVE-2026-78699/): rename_tenant returns :ok on a failed rename, enabling cross-tenant access in AshPostgres (high 7.2)
- [CVE-2026-78693](https://insights.sbomify.com/CVE-2026-78693/): Incomplete redaction re-attaches the original error path in AshGraphql, leaking internal field names (medium 6.9)
- [CVE-2026-78691](https://insights.sbomify.com/CVE-2026-78691/): Unescaped backslash allows LIKE wildcard injection in AshSql string search (low 2.1)
- [CVE-2026-7869](https://insights.sbomify.com/CVE-2026-7869/): Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement (medium 5.4)
- [CVE-2026-78689](https://insights.sbomify.com/CVE-2026-78689/): NGINX ngx_http_js_module vulnerablility (critical 9.2)
- [CVE-2026-78685](https://insights.sbomify.com/CVE-2026-78685/): Le-yan｜Medical Practice Management System - Remote Code Execution (high 8.6)
- [CVE-2026-78684](https://insights.sbomify.com/CVE-2026-78684/): vLLM before 0.27.0 Denial of Service via DeepStream Backend (medium 6.9)
- [CVE-2026-78683](https://insights.sbomify.com/CVE-2026-78683/): NLTK before 3.10.0 Remote Code Execution via Unsafe Pickle Deserialization (critical 9.4)
- [CVE-2026-78682](https://insights.sbomify.com/CVE-2026-78682/): NLTK before 3.10.3 SSRF Protection Bypass via Proxy (high 8.7)
- [CVE-2026-78681](https://insights.sbomify.com/CVE-2026-78681/): NLTK before 3.10.3 Entity Expansion DoS via ElementTree (high 8.7)
- [CVE-2026-78680](https://insights.sbomify.com/CVE-2026-78680/): NLTK before 3.10.3 Arbitrary Code Execution via Graphviz dot Binary (high 8.5)
- [CVE-2026-7868](https://insights.sbomify.com/CVE-2026-7868/): This Power System update is being released to address incorrect authorization (medium 6.5)
- [CVE-2026-78679](https://insights.sbomify.com/CVE-2026-78679/): GitPython before 3.1.59 Arbitrary File Read via TagReference.create (high 7.1)
- [CVE-2026-78678](https://insights.sbomify.com/CVE-2026-78678/): GitPython before 3.1.59 Arbitrary File Read via Repo.blame() (high 7.1)
- [CVE-2026-78677](https://insights.sbomify.com/CVE-2026-78677/): GitPython before 3.1.59 Path Traversal via separate-git-dir (high 8.7)
- [CVE-2026-78676](https://insights.sbomify.com/CVE-2026-78676/): GitPython before 3.1.59 Remote Code Execution via Config Injection (critical 9.3)
- [CVE-2026-78675](https://insights.sbomify.com/CVE-2026-78675/): GitPython before 3.1.59 Local File Content Disclosure via .gitmodules (high 8.6)
- [CVE-2026-78674](https://insights.sbomify.com/CVE-2026-78674/): Remote Code Execution via BPMN System REST APIs in Multiple WSO2 Products Permits Arbitrary Command Execution (high 8.8)
- [CVE-2026-78673](https://insights.sbomify.com/CVE-2026-78673/): Maximo AI Service Improper Input Validation (high 7.5)
- [CVE-2026-7867](https://insights.sbomify.com/CVE-2026-7867/): Udisks2: udisks2: local privilege escalation via as-user option spoofing (high 7.8)
- [CVE-2026-78669](https://insights.sbomify.com/CVE-2026-78669/): Excessive CPU consumption from repeated initial window changes in net/http (high 7.5)
- [CVE-2026-78667](https://insights.sbomify.com/CVE-2026-78667/): Lack of limit on size of parsed Range headers in net/http (high 7.5)
- [CVE-2026-78663](https://insights.sbomify.com/CVE-2026-78663/): Double flow control refund on HTTP/2 server streams in net/http (critical 9.1)
- [CVE-2026-78662](https://insights.sbomify.com/CVE-2026-78662/): Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh (high 7.5)
- [CVE-2026-78661](https://insights.sbomify.com/CVE-2026-78661/): Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/360/