# Vulnerabilities published in 2026


- [CVE-2026-73450](https://insights.sbomify.com/CVE-2026-73450/): Security Advisory 0161 (high 7.0)
- [CVE-2026-7345](https://insights.sbomify.com/CVE-2026-7345/): Security feature bypass in Chrome (high 8.3)
- [CVE-2026-73449](https://insights.sbomify.com/CVE-2026-73449/): Auth bypass in EOS (medium 5.9)
- [CVE-2026-73447](https://insights.sbomify.com/CVE-2026-73447/): Security Advisory 0162 - gNSI Certz/Bootz OS Command Injection via Crafted Rotate Request (critical 9.4)
- [CVE-2026-73446](https://insights.sbomify.com/CVE-2026-73446/): Security Advisory 0160 (high 7.0)
- [CVE-2026-73445](https://insights.sbomify.com/CVE-2026-73445/): Security Advisory 0167 (medium 6.9)
- [CVE-2026-73444](https://insights.sbomify.com/CVE-2026-73444/): Auth bypass in EOS (medium 5.3)
- [CVE-2026-73443](https://insights.sbomify.com/CVE-2026-73443/): Security feature bypass in EOS (medium 5.3)
- [CVE-2026-73442](https://insights.sbomify.com/CVE-2026-73442/): Information disclosure in EOS (low 2.1)
- [CVE-2026-73440](https://insights.sbomify.com/CVE-2026-73440/): Security Advisory 0178 (low 2.3)
- [CVE-2026-7344](https://insights.sbomify.com/CVE-2026-7344/): Use after free in Chrome (high 8.8)
- [CVE-2026-73439](https://insights.sbomify.com/CVE-2026-73439/): Security Advisory 0164 (high 7.7)
- [CVE-2026-73438](https://insights.sbomify.com/CVE-2026-73438/): Security Advisory 0172 (high 7.0)
- [CVE-2026-73437](https://insights.sbomify.com/CVE-2026-73437/): Security feature bypass in EOS (medium 6.5)
- [CVE-2026-73436](https://insights.sbomify.com/CVE-2026-73436/): Security Advisory 0171 (medium 6.0)
- [CVE-2026-73435](https://insights.sbomify.com/CVE-2026-73435/): Security Advisory 0171 (high 7.0)
- [CVE-2026-73434](https://insights.sbomify.com/CVE-2026-73434/): Gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsing (medium 6.1)
- [CVE-2026-73433](https://insights.sbomify.com/CVE-2026-73433/): Integer overflow in Red Hat Enterprise Linux 10 (medium 6.6)
- [CVE-2026-73432](https://insights.sbomify.com/CVE-2026-73432/): Server-side request forgery in vulnerability-lookup (medium 5.1)
- [CVE-2026-73431](https://insights.sbomify.com/CVE-2026-73431/): Reusable Account Activation and Recovery Tokens Allow Repeated Account Takeover in vulnerability-lookup (high 8.8)
- [CVE-2026-73430](https://insights.sbomify.com/CVE-2026-73430/): Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB) (medium 5.3)
- [CVE-2026-7343](https://insights.sbomify.com/CVE-2026-7343/): Use after free in Chrome (high 7.5)
- [CVE-2026-73429](https://insights.sbomify.com/CVE-2026-73429/): Russh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS) (medium 5.3)
- [CVE-2026-73428](https://insights.sbomify.com/CVE-2026-73428/): Trix: Stored XSS via HTMLParser attribute injection on paste (medium 4.6)
- [CVE-2026-73427](https://insights.sbomify.com/CVE-2026-73427/): Trix: XSS via JSON deserialization bypass in drag-and-drop (Level0InputController) (low 2.1)
- [CVE-2026-73426](https://insights.sbomify.com/CVE-2026-73426/): Trix: Stored XSS vulnerability through serialized attributes (medium 4.6)
- [CVE-2026-73425](https://insights.sbomify.com/CVE-2026-73425/): @astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped (low 3.7)
- [CVE-2026-73424](https://insights.sbomify.com/CVE-2026-73424/): Astro: Unauthenticated path override in the @astrojs/vercel ISR function (medium 6.5)
- [CVE-2026-73423](https://insights.sbomify.com/CVE-2026-73423/): Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered (medium 5.1)
- [CVE-2026-73422](https://insights.sbomify.com/CVE-2026-73422/): Astro: Reflected XSS via unescaped View Transition animation properties (medium 5.3)
- [CVE-2026-73421](https://insights.sbomify.com/CVE-2026-73421/): Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error) (critical 9.1)
- [CVE-2026-73420](https://insights.sbomify.com/CVE-2026-73420/): NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass (critical 9.1)
- [CVE-2026-7342](https://insights.sbomify.com/CVE-2026-7342/): Use after free in Chrome (high 8.8)
- [CVE-2026-73419](https://insights.sbomify.com/CVE-2026-73419/): NextAuth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them (medium 6.8)
- [CVE-2026-73418](https://insights.sbomify.com/CVE-2026-73418/): NextAuth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers (high 7.5)
- [CVE-2026-73417](https://insights.sbomify.com/CVE-2026-73417/): JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`) (high 8.6)
- [CVE-2026-73416](https://insights.sbomify.com/CVE-2026-73416/): jupyterlab: PyPI extension blocklist package-name canonicalization bypass (medium 6.1)
- [CVE-2026-73415](https://insights.sbomify.com/CVE-2026-73415/): jupyterlab: Image viewer in JupyterLab allows XSS when opening malicious image in new browser tab (high 7.5)
- [CVE-2026-73414](https://insights.sbomify.com/CVE-2026-73414/): Shescape: Shell injection via unescaped parentheses on Windows with CMD (critical 9.2)
- [CVE-2026-73413](https://insights.sbomify.com/CVE-2026-73413/): Shescape: Quadratic-time denial of service in flag-protection (high 8.7)
- [CVE-2026-73412](https://insights.sbomify.com/CVE-2026-73412/): Shescape: Path disclosure on Unix with Zsh (medium 6.3)
- [CVE-2026-73411](https://insights.sbomify.com/CVE-2026-73411/): Shescape: Home-directory disclosure in assignment context on Unix with Dash (medium 6.3)
- [CVE-2026-73410](https://insights.sbomify.com/CVE-2026-73410/): Budibase: SSRF via DNS rebinding in the REST datasource integration (high 8.5)
- [CVE-2026-7341](https://insights.sbomify.com/CVE-2026-7341/): Use after free in Chrome (high 8.8)
- [CVE-2026-73409](https://insights.sbomify.com/CVE-2026-73409/): Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile (medium 5.1)
- [CVE-2026-73408](https://insights.sbomify.com/CVE-2026-73408/): Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector (high 7.6)
- [CVE-2026-73407](https://insights.sbomify.com/CVE-2026-73407/): Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak (bypass of CVE-2026-48152)) (critical 9.0)
- [CVE-2026-73406](https://insights.sbomify.com/CVE-2026-73406/): Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint (high 7.5)
- [CVE-2026-73405](https://insights.sbomify.com/CVE-2026-73405/): Authorization Bypass in SSE Pub/Sub Allows Unconfirmed Accounts to Access Stream Events in vulnerability-lookup (medium 5.3)
- [CVE-2026-73404](https://insights.sbomify.com/CVE-2026-73404/): WordPress MasterStudy LMS plugin <= 3.7.41 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-73403](https://insights.sbomify.com/CVE-2026-73403/): WordPress User Registration plugin <= 5.2.6 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-73402](https://insights.sbomify.com/CVE-2026-73402/): WordPress WP BASE Booking plugin <= 6.3.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-73401](https://insights.sbomify.com/CVE-2026-73401/): WordPress InstaWP Connect plugin <= 0.1.3.7 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-73400](https://insights.sbomify.com/CVE-2026-73400/): WordPress Restaurant Menu by MotoPress plugin <= 2.4.11 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-7340](https://insights.sbomify.com/CVE-2026-7340/): Integer overflow in Chrome (medium 4.3)
- [CVE-2026-73399](https://insights.sbomify.com/CVE-2026-73399/): WordPress Flutterwave WooCommerce plugin <= 3.3.0 - Broken Authentication vulnerability (medium 6.5)
- [CVE-2026-73398](https://insights.sbomify.com/CVE-2026-73398/): WordPress Piraeus Bank WooCommerce Payment Gateway plugin 3.2.0 - Broken Authentication vulnerability (medium 6.5)
- [CVE-2026-73397](https://insights.sbomify.com/CVE-2026-73397/): WordPress Youzify plugin <= 1.3.7 - Deserialization of untrusted data vulnerability (critical 9.8)
- [CVE-2026-73396](https://insights.sbomify.com/CVE-2026-73396/): WordPress MWB HubSpot for WooCommerce plugin <= 1.6.7 - Broken Authentication vulnerability (high 7.1)
- [CVE-2026-73395](https://insights.sbomify.com/CVE-2026-73395/): Missing authorization in Booking calendar, Appointment Booking System (medium 6.5)
- [CVE-2026-73394](https://insights.sbomify.com/CVE-2026-73394/): WordPress Stitch Express plugin <= 1.9.0 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-73393](https://insights.sbomify.com/CVE-2026-73393/): WordPress Subscribe2 plugin <= 10.46 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-73391](https://insights.sbomify.com/CVE-2026-73391/): WordPress Total Donations plugin <= 2.0.5 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-73390](https://insights.sbomify.com/CVE-2026-73390/): WordPress Total Donations plugin <= 2.0.5 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2026-7339](https://insights.sbomify.com/CVE-2026-7339/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-73389](https://insights.sbomify.com/CVE-2026-73389/): WordPress Kalles Addons plugin <= 1.0.6 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-73388](https://insights.sbomify.com/CVE-2026-73388/): WordPress Nikstore Core plugin <= 1.5 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-73387](https://insights.sbomify.com/CVE-2026-73387/): WordPress Resido theme <= 1.5 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-73386](https://insights.sbomify.com/CVE-2026-73386/): WordPress Track Geolocation Of Users Using Contact Form 7 plugin <= 3.0.2 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2026-73385](https://insights.sbomify.com/CVE-2026-73385/): WordPress Outranking plugin Options plugin <= 1.1.3 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-73384](https://insights.sbomify.com/CVE-2026-73384/): WordPress Pay with Contact Form 7 plugin <= 1.0.4 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2026-73383](https://insights.sbomify.com/CVE-2026-73383/): WordPress CTX Feed plugin <= 6.6.47 - Arbitrary File Download vulnerability (medium 4.9)
- [CVE-2026-73382](https://insights.sbomify.com/CVE-2026-73382/): WordPress Site Reviews plugin <= 8.2.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-73381](https://insights.sbomify.com/CVE-2026-73381/): WordPress Popup by Supsystic plugin <= 1.13.0 - Broken Authentication vulnerability (critical 9.1)
- [CVE-2026-73380](https://insights.sbomify.com/CVE-2026-73380/): WordPress Popup by Supsystic plugin <= 1.13.0 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-7338](https://insights.sbomify.com/CVE-2026-7338/): Use after free in Chrome (high 7.5)
- [CVE-2026-73379](https://insights.sbomify.com/CVE-2026-73379/): WordPress Contact Form by Supsystic plugin < 1.10.0 - Bypass Vulnerability vulnerability (medium 6.5)
- [CVE-2026-73378](https://insights.sbomify.com/CVE-2026-73378/): WordPress Contact Form by Supsystic plugin < 1.10.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-73377](https://insights.sbomify.com/CVE-2026-73377/): WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-73376](https://insights.sbomify.com/CVE-2026-73376/): WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-73375](https://insights.sbomify.com/CVE-2026-73375/): WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-73374](https://insights.sbomify.com/CVE-2026-73374/): Stored Cross-Site Scripting (XSS) via Unescaped CNA Reference Tags in vulnerability-lookup (medium 6.1)
- [CVE-2026-73373](https://insights.sbomify.com/CVE-2026-73373/): Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 (high 8.9)
- [CVE-2026-73372](https://insights.sbomify.com/CVE-2026-73372/): Missing authorization in Joomla! CMS (medium 5.1)
- [CVE-2026-73371](https://insights.sbomify.com/CVE-2026-73371/): Joomla! Core - [20260808] - Improper ACL checks for batch copy actions in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 (medium 5.1)
- [CVE-2026-73370](https://insights.sbomify.com/CVE-2026-73370/): Apache Syncope: Cross-Realm boundaries reconciliation bypass (critical 9.8)
- [CVE-2026-7337](https://insights.sbomify.com/CVE-2026-7337/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-73369](https://insights.sbomify.com/CVE-2026-73369/): Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94) (critical 10.0)
- [CVE-2026-73367](https://insights.sbomify.com/CVE-2026-73367/): WordPress Easy Google Maps plugin < 1.14.2 - Remote File Inclusion vulnerability (high 7.2)
- [CVE-2026-73366](https://insights.sbomify.com/CVE-2026-73366/): WordPress Easy Google Maps plugin <= 1.13.0 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-73365](https://insights.sbomify.com/CVE-2026-73365/): WordPress JetAppointment plugin <= 2.5.2 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-73364](https://insights.sbomify.com/CVE-2026-73364/): WordPress Flexible Subscriptions plugin <= 1.8.1 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-73363](https://insights.sbomify.com/CVE-2026-73363/): WordPress Taxi Booking Manager for WooCommerce plugin < 2.0.8 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-73362](https://insights.sbomify.com/CVE-2026-73362/): WordPress URL Shortify plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-73361](https://insights.sbomify.com/CVE-2026-73361/): WordPress Recipe Card Blocks for Gutenberg & Elementor plugin <= 3.4.18 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-73360](https://insights.sbomify.com/CVE-2026-73360/): WordPress Chaty Pro plugin <= 3.5.8 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-7336](https://insights.sbomify.com/CVE-2026-7336/): Use after free in Chrome (high 8.8)
- [CVE-2026-73359](https://insights.sbomify.com/CVE-2026-73359/): WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.3.9 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-73358](https://insights.sbomify.com/CVE-2026-73358/): WordPress Affiliates Manager plugin <= 2.9.53 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-73357](https://insights.sbomify.com/CVE-2026-73357/): WordPress GiveWP plugin < 4.16.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/401/