# Vulnerabilities published in 2026


- [CVE-2026-39356](https://insights.sbomify.com/CVE-2026-39356/): SQL Injection via escapeName() in all Drizzle ORM SQL dialects (high 7.5)
- [CVE-2026-39355](https://insights.sbomify.com/CVE-2026-39355/): Missing authorization in genealogy (critical 10.0)
- [CVE-2026-39354](https://insights.sbomify.com/CVE-2026-39354/): Scoold has an Authenticated Arbitrary Question Overwrite via Client-Controlled postId in POST /questions/ask (medium 6.5)
- [CVE-2026-39353](https://insights.sbomify.com/CVE-2026-39353/): InvoicePlane: Remote Code Execution via Writable Templates Directory (critical 9.1)
- [CVE-2026-39352](https://insights.sbomify.com/CVE-2026-39352/): Frappe has an Arbitrary File Read via Path Traversal in render_include (high 8.7)
- [CVE-2026-39351](https://insights.sbomify.com/CVE-2026-39351/): Frappe allows unrestricted Doctype access via API exploit (medium 6.9)
- [CVE-2026-39350](https://insights.sbomify.com/CVE-2026-39350/): Istio AuthorizationPolicy Incorrect Regex Matching of Dots in serviceAccounts Fields Allows Policy Bypass (medium 5.4)
- [CVE-2026-3935](https://insights.sbomify.com/CVE-2026-3935/): Other in Chrome (medium 4.3)
- [CVE-2026-39349](https://insights.sbomify.com/CVE-2026-39349/): OrangeHRM Uses AES-ECB for Sensitive Data Encryption Enables Pattern Disclosure (low 2.1)
- [CVE-2026-39348](https://insights.sbomify.com/CVE-2026-39348/): Missing authorization in orangehrm (medium 5.3)
- [CVE-2026-39347](https://insights.sbomify.com/CVE-2026-39347/): OrangeHRM's Self‑Appraisal Submission of Admin Users Can Be Modified After Completion (medium 5.1)
- [CVE-2026-39346](https://insights.sbomify.com/CVE-2026-39346/): OrangeHRM has Improper Access Control Allowing Access to Disabled Modules via URL Encoding (medium 5.3)
- [CVE-2026-39345](https://insights.sbomify.com/CVE-2026-39345/): OrangeHRM Affected by Arbitrary File Read via Path Traversal in Email Template Loader (medium 4.6)
- [CVE-2026-39344](https://insights.sbomify.com/CVE-2026-39344/): Reflected XSS the login page through the 'username' parameter (high 8.1)
- [CVE-2026-39343](https://insights.sbomify.com/CVE-2026-39343/): ChurchCRM has a SQL Injection in Event Type Editor (Admin) (high 7.2)
- [CVE-2026-39342](https://insights.sbomify.com/CVE-2026-39342/): ChurchCRM has a SQL injection searchwhat parameter via QueryView.php (critical 9.4)
- [CVE-2026-39341](https://insights.sbomify.com/CVE-2026-39341/): SQL injection in ChurchCRM.0 (high 8.1)
- [CVE-2026-39340](https://insights.sbomify.com/CVE-2026-39340/): ChurchCRM has a SQL Injection in PropertyTypeEditor.php via Incorrect Sanitizer Substitution (high 8.1)
- [CVE-2026-3934](https://insights.sbomify.com/CVE-2026-3934/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-39339](https://insights.sbomify.com/CVE-2026-39339/): ChurchCRM has an API Authentication Bypass (critical 9.1)
- [CVE-2026-39338](https://insights.sbomify.com/CVE-2026-39338/): ChurchCRM has Blind XSS via Global Search – Administrative Cookie Session Exfiltration (high 8.6)
- [CVE-2026-39337](https://insights.sbomify.com/CVE-2026-39337/): ChurchCRM Affected by Unauthenticated RCE in Install Wizard (critical 10.0)
- [CVE-2026-39336](https://insights.sbomify.com/CVE-2026-39336/): ChurchCRM has Stored XSS from unescaped config values in HTML attributes (medium 6.1)
- [CVE-2026-39335](https://insights.sbomify.com/CVE-2026-39335/): ChurchCRM has Stored XSS via Unescaped data-* Attributes in Group/Family Controls (medium 6.1)
- [CVE-2026-39334](https://insights.sbomify.com/CVE-2026-39334/): ChurchCRM has a Blind SQL injection in SettingsIndividual.php (high 8.8)
- [CVE-2026-39333](https://insights.sbomify.com/CVE-2026-39333/): ChurchCRM has Reflected XSS in DateStart/DateEnd parameters in FindFundRaiser.php (high 8.7)
- [CVE-2026-39332](https://insights.sbomify.com/CVE-2026-39332/): ChurchCRM has Reflected Cross-Site Scripting (XSS) in GeoPage.php (high 8.7)
- [CVE-2026-39331](https://insights.sbomify.com/CVE-2026-39331/): ChurchCRM has an API Authorization Bypass Allows Authenticated User to Deactivate, Modify, and Spam Arbitrary Families (high 8.1)
- [CVE-2026-39330](https://insights.sbomify.com/CVE-2026-39330/): ChurchCRM has a Blind SQL injection in PropertyAssign.php (high 8.8)
- [CVE-2026-39329](https://insights.sbomify.com/CVE-2026-39329/): ChurchCRM has a Blind SQL injection in EventNames.php (high 8.8)
- [CVE-2026-39328](https://insights.sbomify.com/CVE-2026-39328/): ChurchCRM has Stored XSS in Social Profile Fields (high 8.9)
- [CVE-2026-39327](https://insights.sbomify.com/CVE-2026-39327/): ChurchCRM has a SQL injection in MemberRoleChange.php (high 8.8)
- [CVE-2026-39326](https://insights.sbomify.com/CVE-2026-39326/): ChurchCRM has a Blind SQL injection in PropertyTypeEditor.php (high 8.8)
- [CVE-2026-39325](https://insights.sbomify.com/CVE-2026-39325/): ChurchCRM has a Blind SQL injection in SettingsUser.php (high 7.2)
- [CVE-2026-39324](https://insights.sbomify.com/CVE-2026-39324/): Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization (critical 9.3)
- [CVE-2026-39322](https://insights.sbomify.com/CVE-2026-39322/): PolarLearn: Any password authenticates banned accounts and grants API access (critical 9.2)
- [CVE-2026-39321](https://insights.sbomify.com/CVE-2026-39321/): Parse Server has a login timing side-channel reveals user existence (medium 6.3)
- [CVE-2026-39320](https://insights.sbomify.com/CVE-2026-39320/): Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription Paths (high 7.5)
- [CVE-2026-3932](https://insights.sbomify.com/CVE-2026-3932/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-39319](https://insights.sbomify.com/CVE-2026-39319/): ChurchCRM has a Second Order SQLI via FundRaiserEditor.php (high 8.8)
- [CVE-2026-39318](https://insights.sbomify.com/CVE-2026-39318/): ChurchCRM has a DDL SQL Injection in GroupPropsFormRowOps.php (high 8.8)
- [CVE-2026-39316](https://insights.sbomify.com/CVE-2026-39316/): CUPS has a use-after-free in `cupsdDeleteTemporaryPrinters` via dangling subscription pointer (medium 4.0)
- [CVE-2026-39315](https://insights.sbomify.com/CVE-2026-39315/): Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe() (medium 6.1)
- [CVE-2026-39314](https://insights.sbomify.com/CVE-2026-39314/): CUPS has an integer underflow in `_ppdCreateFromIPP` causes root cupsd crash via negative `job-password-supported` (medium 4.0)
- [CVE-2026-39313](https://insights.sbomify.com/CVE-2026-39313/): MCP-Framework: Unbounded memory allocation in readRequestBody allows denial of service via HTTP transport (high 8.7)
- [CVE-2026-39312](https://insights.sbomify.com/CVE-2026-39312/): Pre-Auth EAP-TLS DoS on SoftEther VPN Developer Edition (high 7.5)
- [CVE-2026-39311](https://insights.sbomify.com/CVE-2026-39311/): Trilium Notes: Stored XSS Leads to Unauthorized Remote Code Execution (RCE) via Unsanitized SVG Attachments (medium 6.8)
- [CVE-2026-39310](https://insights.sbomify.com/CVE-2026-39310/): Trilium Notes: Authentication Bypass in Clipper API for Electron (Desktop) Builds (high 8.6)
- [CVE-2026-3931](https://insights.sbomify.com/CVE-2026-3931/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-39309](https://insights.sbomify.com/CVE-2026-39309/): Trilium Notes: macOS TCC Bypass via Prompt Spoofing (medium 5.5)
- [CVE-2026-39308](https://insights.sbomify.com/CVE-2026-39308/): PraisonAI recipe registry publish path traversal allows out-of-root file write (high 7.1)
- [CVE-2026-39307](https://insights.sbomify.com/CVE-2026-39307/): PraisonAI has an Arbitrary File Write (Zip Slip) in Templates Extraction (high 8.1)
- [CVE-2026-39306](https://insights.sbomify.com/CVE-2026-39306/): PraisonAI recipe registry pull path traversal writes files outside the chosen output directory (high 7.3)
- [CVE-2026-39305](https://insights.sbomify.com/CVE-2026-39305/): Arbitrary File Write / Path Traversal in Action Orchestrator (critical 9.0)
- [CVE-2026-39304](https://insights.sbomify.com/CVE-2026-39304/): Apache ActiveMQ: Denial of Service via Out of Memory vulnerability (high 7.5)
- [CVE-2026-3930](https://insights.sbomify.com/CVE-2026-3930/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-39292](https://insights.sbomify.com/CVE-2026-39292/): Falco Solutions PHPPageBuilder v0.31.0 contains an unrestricted file upload vulnerability in the pagemanager/pagebuilder module that allows (high 7.3)
- [CVE-2026-3929](https://insights.sbomify.com/CVE-2026-3929/): Information disclosure in Chrome (low 3.1)
- [CVE-2026-3928](https://insights.sbomify.com/CVE-2026-3928/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2026-39276](https://insights.sbomify.com/CVE-2026-39276/): Path traversal in emlog:emlog (high 7.2)
- [CVE-2026-39275](https://insights.sbomify.com/CVE-2026-39275/): Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code via the item.php, f (medium 6.1)
- [CVE-2026-3927](https://insights.sbomify.com/CVE-2026-3927/): Other in Chrome (medium 4.3)
- [CVE-2026-3926](https://insights.sbomify.com/CVE-2026-3926/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-39255](https://insights.sbomify.com/CVE-2026-39255/): Buffer Overflow vulnerability in SteelSeries GG (macOS) v.107.0.0 allows a remote attacker to execute arbitrary code via the libSSEdevice.dy (critical 9.8)
- [CVE-2026-39254](https://insights.sbomify.com/CVE-2026-39254/): Buffer Overflow vulnerability in SteelSeries GG (macOS) v.107.0.0 allows a remote attacker to execute arbitrary code via the libSSEdevice.dy (critical 9.8)
- [CVE-2026-39253](https://insights.sbomify.com/CVE-2026-39253/): An issue in Pivotal CRM v.6.6.04.08 allows a remote attacker to execute arbitrary code via the Pivotal.Core.Common.dll and Pivotal.Engine.Cl (high 8.1)
- [CVE-2026-39250](https://insights.sbomify.com/CVE-2026-39250/): An authorization vulnerability exists in Innoshop 0.6.0. (high 7.3)
- [CVE-2026-3925](https://insights.sbomify.com/CVE-2026-3925/): Other in Chrome (medium 4.3)
- [CVE-2026-39246](https://insights.sbomify.com/CVE-2026-39246/): Path traversal in decompress project:decompress (high 7.5)
- [CVE-2026-39245](https://insights.sbomify.com/CVE-2026-39245/): Path traversal in decompress project:decompress (medium 6.2)
- [CVE-2026-39244](https://insights.sbomify.com/CVE-2026-39244/): adm-zip: Crafted ZIP file triggers 4GB memory allocation (high 7.5)
- [CVE-2026-39243](https://insights.sbomify.com/CVE-2026-39243/): decompress allows arbitrary hardlink creation during archive extraction (medium 5.5)
- [CVE-2026-3924](https://insights.sbomify.com/CVE-2026-3924/): Use after free in Chrome (high 7.5)
- [CVE-2026-3923](https://insights.sbomify.com/CVE-2026-3923/): Use after free in Chrome (high 8.8)
- [CVE-2026-39229](https://insights.sbomify.com/CVE-2026-39229/): Bolt CMS through 3.7.0 allows SQL Injection in the 'order' parameter of the content listing pages. (medium 6.5)
- [CVE-2026-3922](https://insights.sbomify.com/CVE-2026-3922/): Use after free in Chrome (high 8.8)
- [CVE-2026-3921](https://insights.sbomify.com/CVE-2026-3921/): Use after free in Chrome (high 8.8)
- [CVE-2026-3920](https://insights.sbomify.com/CVE-2026-3920/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-39199](https://insights.sbomify.com/CVE-2026-39199/): Memory corruption in Snes9X (low 2.9)
- [CVE-2026-39197](https://insights.sbomify.com/CVE-2026-39197/): An issue in the /util/http/prelude.rs endpoint of Datadog, Inc Vector v0.54.0 allows attackers to cause a Denial of Service (DoS) via a craf (medium 6.5)
- [CVE-2026-39196](https://insights.sbomify.com/CVE-2026-39196/): Datadog, Inc Vector v0.54.0 was discovered to contain a SQL injection vulnerability in the set_uri_query parameter in the KeyPartitioner::partition function. (critical 9.8)
- [CVE-2026-3919](https://insights.sbomify.com/CVE-2026-3919/): Use after free in Chrome (high 8.8)
- [CVE-2026-3918](https://insights.sbomify.com/CVE-2026-3918/): Use after free in Chrome (high 8.8)
- [CVE-2026-39179](https://insights.sbomify.com/CVE-2026-39179/): A SQL injection vulnerability in SOGo before 5.12.7 allows authenticated users to execute arbitrary SQL statements via the newPassword param (medium 6.3)
- [CVE-2026-39178](https://insights.sbomify.com/CVE-2026-39178/): A SQL injection vulnerability in SOGo before 5.12.7 allows authenticated users to execute arbitrary SQL statements via the search parameter (medium 6.3)
- [CVE-2026-39170](https://insights.sbomify.com/CVE-2026-39170/): SemCms 5.0 is vulnerable to Cross Site Request Forgery (CSRF) via crafted POST request to /admin/semcms_user.php. (medium 6.3)
- [CVE-2026-3917](https://insights.sbomify.com/CVE-2026-3917/): Use after free in Chrome (high 8.8)
- [CVE-2026-39169](https://insights.sbomify.com/CVE-2026-39169/): SEMCMS 5.0 is vulnerable to unauthorized access in SEMCMS_copy.php. (high 7.5)
- [CVE-2026-3916](https://insights.sbomify.com/CVE-2026-3916/): Memory corruption in Chrome (critical 9.6)
- [CVE-2026-39155](https://insights.sbomify.com/CVE-2026-39155/): Knot DNS before 3.4.10 and 3.5.x before 3.5.4 contains a vulnerability in mod-onlinesign where the next NSEC owner name can be computed incorrectly. (medium 6.5)
- [CVE-2026-3915](https://insights.sbomify.com/CVE-2026-3915/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-3914](https://insights.sbomify.com/CVE-2026-3914/): Integer overflow in Chrome (high 8.8)
- [CVE-2026-3913](https://insights.sbomify.com/CVE-2026-3913/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-3912](https://insights.sbomify.com/CVE-2026-3912/): TIBCO ActiveMatrix BusinessWorks Injection Vulnerability (high 8.7)
- [CVE-2026-39118](https://insights.sbomify.com/CVE-2026-39118/): An issue in Iru, Inc Kandji Agent before v.4.7.5(5374) allows a local attacker to escalate privileges via a client validation gap to invoke (high 8.4)
- [CVE-2026-39117](https://insights.sbomify.com/CVE-2026-39117/): An issue in AltumCode 66Uptime before v.54.0.0 and 66Uptime ping-servers plugin before v.2.0.0 allows a remote attacker to execute arbitrary (critical 9.8)
- [CVE-2026-39113](https://insights.sbomify.com/CVE-2026-39113/): Buffer Overflow vulnerability in SQLite affected version source snapshots/builds containing Fossil check-in 8bdc0d485e3ad0c7a1e818da66f10695 (medium 4.0)
- [CVE-2026-39112](https://insights.sbomify.com/CVE-2026-39112/): Cross Site Scripting vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 in the visname paramete (medium 5.4)
- [CVE-2026-39111](https://insights.sbomify.com/CVE-2026-39111/): SQL Injection vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 in the email parameter of the (high 7.5)
- [CVE-2026-39110](https://insights.sbomify.com/CVE-2026-39110/): SQL Injection vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 in the contactno parameter of (high 8.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/679/