# Vulnerabilities published in 2026


- [CVE-2026-28944](https://insights.sbomify.com/CVE-2026-28944/): Memory corruption in Safari (high 7.5)
- [CVE-2026-28943](https://insights.sbomify.com/CVE-2026-28943/): Information disclosure in iOS and iPadOS (high 7.5)
- [CVE-2026-28942](https://insights.sbomify.com/CVE-2026-28942/): Use after free in Safari (medium 6.5)
- [CVE-2026-28941](https://insights.sbomify.com/CVE-2026-28941/): Memory corruption in iOS and iPadOS (high 7.1)
- [CVE-2026-28940](https://insights.sbomify.com/CVE-2026-28940/): Memory corruption in iOS and iPadOS (high 8.8)
- [CVE-2026-2894](https://insights.sbomify.com/CVE-2026-2894/): funadmin forget.html getMember information disclosure (medium 6.9)
- [CVE-2026-28938](https://insights.sbomify.com/CVE-2026-28938/): Information disclosure in iOS and iPadOS (high 7.5)
- [CVE-2026-28937](https://insights.sbomify.com/CVE-2026-28937/): Missing authorization in macOS (medium 5.5)
- [CVE-2026-28936](https://insights.sbomify.com/CVE-2026-28936/): Denial of service in iOS and iPadOS (high 7.5)
- [CVE-2026-28935](https://insights.sbomify.com/CVE-2026-28935/): Memory corruption in iOS and iPadOS (high 7.5)
- [CVE-2026-28934](https://insights.sbomify.com/CVE-2026-28934/): Memory corruption in macOS (medium 6.5)
- [CVE-2026-28933](https://insights.sbomify.com/CVE-2026-28933/): Use after free in macOS (medium 5.5)
- [CVE-2026-28932](https://insights.sbomify.com/CVE-2026-28932/): Denial of service in macOS (medium 5.5)
- [CVE-2026-28931](https://insights.sbomify.com/CVE-2026-28931/): Memory corruption in iOS and iPadOS (high 8.8)
- [CVE-2026-28930](https://insights.sbomify.com/CVE-2026-28930/): Missing authorization in macOS (high 7.5)
- [CVE-2026-2893](https://insights.sbomify.com/CVE-2026-2893/): Page and Post Clone <= 6.3 - Authenticated (Contributor+) SQL Injection via 'meta_key' Parameter (medium 6.5)
- [CVE-2026-28929](https://insights.sbomify.com/CVE-2026-28929/): Security feature bypass in iOS and iPadOS (high 7.5)
- [CVE-2026-28928](https://insights.sbomify.com/CVE-2026-28928/): Use after free in iOS and iPadOS (critical 9.8)
- [CVE-2026-28926](https://insights.sbomify.com/CVE-2026-28926/): Race condition in macOS (high 7.0)
- [CVE-2026-28925](https://insights.sbomify.com/CVE-2026-28925/): Memory corruption in macOS (high 7.5)
- [CVE-2026-28924](https://insights.sbomify.com/CVE-2026-28924/): Race condition in macOS (high 7.5)
- [CVE-2026-28923](https://insights.sbomify.com/CVE-2026-28923/): Information disclosure in macOS (high 8.8)
- [CVE-2026-28922](https://insights.sbomify.com/CVE-2026-28922/): Information disclosure in macOS (medium 6.5)
- [CVE-2026-28920](https://insights.sbomify.com/CVE-2026-28920/): Information disclosure in iOS and iPadOS (medium 6.5)
- [CVE-2026-2892](https://insights.sbomify.com/CVE-2026-2892/): Otter Blocks <= 3.1.4 - Improper Authorization to Unauthenticated Purchase Verification Bypass via Forged Cookie (high 7.5)
- [CVE-2026-28919](https://insights.sbomify.com/CVE-2026-28919/): Privilege escalation in macOS (high 7.8)
- [CVE-2026-28918](https://insights.sbomify.com/CVE-2026-28918/): Memory corruption in iOS and iPadOS (medium 6.5)
- [CVE-2026-28917](https://insights.sbomify.com/CVE-2026-28917/): Denial of service in Safari (medium 4.3)
- [CVE-2026-28915](https://insights.sbomify.com/CVE-2026-28915/): Path traversal in macOS (high 7.8)
- [CVE-2026-28914](https://insights.sbomify.com/CVE-2026-28914/): Security feature bypass in macOS (medium 5.5)
- [CVE-2026-28913](https://insights.sbomify.com/CVE-2026-28913/): Memory corruption in Safari (high 7.5)
- [CVE-2026-28912](https://insights.sbomify.com/CVE-2026-28912/): Privilege escalation in macOS (high 7.8)
- [CVE-2026-28911](https://insights.sbomify.com/CVE-2026-28911/): Memory corruption in macOS (critical 9.8)
- [CVE-2026-28910](https://insights.sbomify.com/CVE-2026-28910/): Missing authorization in macOS (low 3.3)
- [CVE-2026-2891](https://insights.sbomify.com/CVE-2026-2891/): Poly Voice Devices (CCX, Trio, Edge E) – Potential Denial of Service (high 8.2)
- [CVE-2026-28909](https://insights.sbomify.com/CVE-2026-28909/): Information disclosure in macOS (medium 6.5)
- [CVE-2026-28908](https://insights.sbomify.com/CVE-2026-28908/): Denial of service in macOS (high 7.5)
- [CVE-2026-28907](https://insights.sbomify.com/CVE-2026-28907/): Security feature bypass in Safari (high 8.1)
- [CVE-2026-28906](https://insights.sbomify.com/CVE-2026-28906/): Information disclosure in iOS and iPadOS (high 7.5)
- [CVE-2026-28905](https://insights.sbomify.com/CVE-2026-28905/): Memory corruption in Safari (high 7.5)
- [CVE-2026-28904](https://insights.sbomify.com/CVE-2026-28904/): Memory corruption in Safari (high 7.5)
- [CVE-2026-28903](https://insights.sbomify.com/CVE-2026-28903/): Memory corruption in Safari (medium 6.5)
- [CVE-2026-28902](https://insights.sbomify.com/CVE-2026-28902/): Memory corruption in Safari (medium 6.5)
- [CVE-2026-28901](https://insights.sbomify.com/CVE-2026-28901/): Memory corruption in Safari (medium 4.3)
- [CVE-2026-28900](https://insights.sbomify.com/CVE-2026-28900/): Security feature bypass in macOS (medium 5.5)
- [CVE-2026-2890](https://insights.sbomify.com/CVE-2026-2890/): Formidable Forms <= 6.28 - Missing Authorization to Unauthenticated Payment Integrity Bypass via PaymentIntent Reuse (high 7.5)
- [CVE-2026-28899](https://insights.sbomify.com/CVE-2026-28899/): Security feature bypass in macOS (medium 5.5)
- [CVE-2026-28898](https://insights.sbomify.com/CVE-2026-28898/): SwiftNIO HTTP/2: HTTP/2-to-HTTP/1 Request Smuggling via unvalidated :path pseudo-header in HTTP2ToHTTP1Codec (medium 5.3)
- [CVE-2026-28897](https://insights.sbomify.com/CVE-2026-28897/): Memory corruption in iOS and iPadOS (medium 6.2)
- [CVE-2026-28896](https://insights.sbomify.com/CVE-2026-28896/): Memory corruption in iOS and iPadOS (high 7.7)
- [CVE-2026-28895](https://insights.sbomify.com/CVE-2026-28895/): Security feature bypass in iOS and iPadOS (medium 4.6)
- [CVE-2026-28894](https://insights.sbomify.com/CVE-2026-28894/): Denial of service in iOS and iPadOS (high 7.5)
- [CVE-2026-28893](https://insights.sbomify.com/CVE-2026-28893/): Information disclosure in macOS (low 3.3)
- [CVE-2026-28892](https://insights.sbomify.com/CVE-2026-28892/): Security feature bypass in macOS (medium 5.5)
- [CVE-2026-28891](https://insights.sbomify.com/CVE-2026-28891/): Race condition in macOS (high 8.1)
- [CVE-2026-28890](https://insights.sbomify.com/CVE-2026-28890/): Memory corruption in Xcode (medium 5.5)
- [CVE-2026-2889](https://insights.sbomify.com/CVE-2026-2889/): CCExtractor mp4.c processmp4 use after free (medium 4.8)
- [CVE-2026-28889](https://insights.sbomify.com/CVE-2026-28889/): Privilege escalation in Xcode (medium 6.2)
- [CVE-2026-28888](https://insights.sbomify.com/CVE-2026-28888/): Race condition in macOS (medium 5.1)
- [CVE-2026-28886](https://insights.sbomify.com/CVE-2026-28886/): Null dereference in iOS and iPadOS (medium 5.9)
- [CVE-2026-28883](https://insights.sbomify.com/CVE-2026-28883/): Use after free in Safari (high 7.5)
- [CVE-2026-28882](https://insights.sbomify.com/CVE-2026-28882/): Information disclosure in iOS and iPadOS (medium 4.0)
- [CVE-2026-28881](https://insights.sbomify.com/CVE-2026-28881/): Information disclosure in macOS (medium 5.3)
- [CVE-2026-28880](https://insights.sbomify.com/CVE-2026-28880/): Information disclosure in iOS and iPadOS (medium 6.5)
- [CVE-2026-2888](https://insights.sbomify.com/CVE-2026-2888/): Formidable Forms <= 6.28 - Unauthenticated Payment Amount Manipulation via 'item_meta' Parameter (medium 5.3)
- [CVE-2026-28879](https://insights.sbomify.com/CVE-2026-28879/): Use after free in iOS and iPadOS (medium 6.5)
- [CVE-2026-28878](https://insights.sbomify.com/CVE-2026-28878/): Information disclosure in iOS and iPadOS (medium 6.5)
- [CVE-2026-28877](https://insights.sbomify.com/CVE-2026-28877/): Missing authorization in iOS and iPadOS (medium 5.5)
- [CVE-2026-28876](https://insights.sbomify.com/CVE-2026-28876/): Path traversal in iOS and iPadOS (high 7.5)
- [CVE-2026-28875](https://insights.sbomify.com/CVE-2026-28875/): Memory corruption in iOS and iPadOS (high 7.5)
- [CVE-2026-28874](https://insights.sbomify.com/CVE-2026-28874/): Denial of service in iOS and iPadOS (high 7.5)
- [CVE-2026-28873](https://insights.sbomify.com/CVE-2026-28873/): Security feature bypass in iOS and iPadOS (high 7.5)
- [CVE-2026-28872](https://insights.sbomify.com/CVE-2026-28872/): Denial of service in iOS and iPadOS (high 7.5)
- [CVE-2026-28871](https://insights.sbomify.com/CVE-2026-28871/): Cross-site scripting in Safari (medium 4.3)
- [CVE-2026-28870](https://insights.sbomify.com/CVE-2026-28870/): Information disclosure in iOS and iPadOS (medium 5.5)
- [CVE-2026-2887](https://insights.sbomify.com/CVE-2026-2887/): aardappel lobster idents.h TypeName recursion (medium 4.8)
- [CVE-2026-28868](https://insights.sbomify.com/CVE-2026-28868/): Information disclosure in iOS and iPadOS (medium 5.5)
- [CVE-2026-28867](https://insights.sbomify.com/CVE-2026-28867/): Information disclosure in iOS and iPadOS (medium 6.2)
- [CVE-2026-28866](https://insights.sbomify.com/CVE-2026-28866/): Path traversal in iOS and iPadOS (medium 6.2)
- [CVE-2026-28865](https://insights.sbomify.com/CVE-2026-28865/): Auth bypass in iOS and iPadOS (high 7.5)
- [CVE-2026-28864](https://insights.sbomify.com/CVE-2026-28864/): Missing authorization in iOS and iPadOS (low 3.3)
- [CVE-2026-28863](https://insights.sbomify.com/CVE-2026-28863/): Information disclosure in iOS and iPadOS (medium 6.5)
- [CVE-2026-28862](https://insights.sbomify.com/CVE-2026-28862/): Information disclosure in macOS (medium 5.3)
- [CVE-2026-28861](https://insights.sbomify.com/CVE-2026-28861/): Security feature bypass in Safari (medium 4.3)
- [CVE-2026-28860](https://insights.sbomify.com/CVE-2026-28860/): Other in iOS and iPadOS (high 7.5)
- [CVE-2026-2886](https://insights.sbomify.com/CVE-2026-2886/): Tenda A21 SetOnlineDevName set_device_name stack-based overflow (high 8.7)
- [CVE-2026-28859](https://insights.sbomify.com/CVE-2026-28859/): Memory corruption in Safari (medium 4.3)
- [CVE-2026-28858](https://insights.sbomify.com/CVE-2026-28858/): Memory corruption in iOS and iPadOS (critical 9.8)
- [CVE-2026-28857](https://insights.sbomify.com/CVE-2026-28857/): Memory corruption in Safari (medium 6.5)
- [CVE-2026-28856](https://insights.sbomify.com/CVE-2026-28856/): Auth bypass in iOS and iPadOS (medium 4.6)
- [CVE-2026-28855](https://insights.sbomify.com/CVE-2026-28855/): Missing authorization in iOS and iPadOS (high 7.5)
- [CVE-2026-28854](https://insights.sbomify.com/CVE-2026-28854/): Security feature bypass in macOS (high 7.5)
- [CVE-2026-28853](https://insights.sbomify.com/CVE-2026-28853/): Privilege escalation in macOS (high 7.8)
- [CVE-2026-28852](https://insights.sbomify.com/CVE-2026-28852/): Memory corruption in iOS and iPadOS (medium 5.5)
- [CVE-2026-28850](https://insights.sbomify.com/CVE-2026-28850/): Missing authorization in macOS (medium 5.5)
- [CVE-2026-2885](https://insights.sbomify.com/CVE-2026-2885/): D-Link DWR-M960 formIpv6Setup sub_469104 stack-based overflow (high 8.7)
- [CVE-2026-28849](https://insights.sbomify.com/CVE-2026-28849/): Security feature bypass in macOS (medium 5.5)
- [CVE-2026-28848](https://insights.sbomify.com/CVE-2026-28848/): Memory corruption in macOS (high 7.5)
- [CVE-2026-28847](https://insights.sbomify.com/CVE-2026-28847/): Memory corruption in Safari (high 8.8)
- [CVE-2026-28846](https://insights.sbomify.com/CVE-2026-28846/): Memory corruption in iOS and iPadOS (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/741/