# Vulnerabilities published in 2026


- [CVE-2026-19151](https://insights.sbomify.com/CVE-2026-19151/): Use after free in Chrome (high 8.8)
- [CVE-2026-19150](https://insights.sbomify.com/CVE-2026-19150/): Security feature bypass in Chrome (high 8.8)
- [CVE-2026-1915](https://insights.sbomify.com/CVE-2026-1915/): Simple Plyr <= 0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'poster' Shortcode Attribute (medium 6.4)
- [CVE-2026-19149](https://insights.sbomify.com/CVE-2026-19149/): Use after free in Chrome (critical 9.6)
- [CVE-2026-19148](https://insights.sbomify.com/CVE-2026-19148/): Memory corruption in Chrome (high 8.3)
- [CVE-2026-19147](https://insights.sbomify.com/CVE-2026-19147/): Use after free in Chrome (high 8.3)
- [CVE-2026-19146](https://insights.sbomify.com/CVE-2026-19146/): Information disclosure in Chrome (medium 5.3)
- [CVE-2026-19145](https://insights.sbomify.com/CVE-2026-19145/): Use after free in Chrome (high 8.8)
- [CVE-2026-19144](https://insights.sbomify.com/CVE-2026-19144/): Use after free in Chrome (high 8.8)
- [CVE-2026-19143](https://insights.sbomify.com/CVE-2026-19143/): Security feature bypass in Chrome (high 8.6)
- [CVE-2026-19142](https://insights.sbomify.com/CVE-2026-19142/): Use after free in Chrome (high 7.5)
- [CVE-2026-19141](https://insights.sbomify.com/CVE-2026-19141/): Use after free in Chrome (high 8.3)
- [CVE-2026-19140](https://insights.sbomify.com/CVE-2026-19140/): Use after free in Chrome (high 8.3)
- [CVE-2026-1914](https://insights.sbomify.com/CVE-2026-1914/): FuseDesk <= 6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'emailtext' Shortcode Attribute (medium 6.4)
- [CVE-2026-19139](https://insights.sbomify.com/CVE-2026-19139/): Race condition in Chrome (high 7.4)
- [CVE-2026-19138](https://insights.sbomify.com/CVE-2026-19138/): Memory corruption in Chrome (high 8.3)
- [CVE-2026-19137](https://insights.sbomify.com/CVE-2026-19137/): Use after free in Chrome (high 8.3)
- [CVE-2026-19136](https://insights.sbomify.com/CVE-2026-19136/): Command injection in Tianxi AI Agent PC Application (high 8.4)
- [CVE-2026-19135](https://insights.sbomify.com/CVE-2026-19135/): OpenNMS JEXL sandbox bypass in Measurements REST API allows ROLE_USER to load arbitrary classes (medium 5.4)
- [CVE-2026-19130](https://insights.sbomify.com/CVE-2026-19130/): Missing authorization in multicluster engine for Kubernetes 2.10 (medium 5.8)
- [CVE-2026-1913](https://insights.sbomify.com/CVE-2026-1913/): Cross-site scripting in Gallagher Website Design (medium 6.4)
- [CVE-2026-19127](https://insights.sbomify.com/CVE-2026-19127/): Insufficient verification of lifetime-deal redemption codes allows forgery of permanent paid subscriptions (medium 6.5)
- [CVE-2026-19125](https://insights.sbomify.com/CVE-2026-19125/): EthPress <= 2.3.5 - Unauthenticated Authentication Bypass (high 8.1)
- [CVE-2026-1912](https://insights.sbomify.com/CVE-2026-1912/): Citations tools <= 0.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'code' Shortcode Attribute (medium 6.4)
- [CVE-2026-19118](https://insights.sbomify.com/CVE-2026-19118/): Race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution (high 7.7)
- [CVE-2026-19117](https://insights.sbomify.com/CVE-2026-19117/): Delinea Secret Server FIDO2 credential registration authentication bypass vulnerability (critical 9.8)
- [CVE-2026-19116](https://insights.sbomify.com/CVE-2026-19116/): WP User Frontend < 4.3.11 - Subscriber+ PHP Object Injection via Frontend Post Edit Form (high 8.8)
- [CVE-2026-19113](https://insights.sbomify.com/CVE-2026-19113/): Unauthenticated denial of service via unbounded request body processing (medium 5.3)
- [CVE-2026-19111](https://insights.sbomify.com/CVE-2026-19111/): Insecure direct object reference in Strands Agents Tools memory tool namespace isolation (high 8.6)
- [CVE-2026-19110](https://insights.sbomify.com/CVE-2026-19110/): DataGear Chart Name HtmlTplDashboardWidgetHtmlRenderer.java HtmlTplDashboardWidgetHtmlRenderer cross site scripting (medium 4.8)
- [CVE-2026-1911](https://insights.sbomify.com/CVE-2026-1911/): Twitter Feeds <= 1.0.0 - Authenticated (Contributor+) Cross-Site Scripting via 'tweet_title' Shortcode Attribute (medium 6.4)
- [CVE-2026-19108](https://insights.sbomify.com/CVE-2026-19108/): MZ Automation libiec61850 URCB Revalidation reporting.c deleteDataSetValuesShadowBuffer use after free (medium 4.8)
- [CVE-2026-1910](https://insights.sbomify.com/CVE-2026-1910/): UpMenu <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'upmenu-menu' Shortcode 'lang' Attribute (medium 6.4)
- [CVE-2026-19094](https://insights.sbomify.com/CVE-2026-19094/): Tutor LMS < 4.0.6 - Unauthenticated SQLi via 'offset' and 'item_per_page' Parameters (medium 5.3)
- [CVE-2026-19093](https://insights.sbomify.com/CVE-2026-19093/): Tutor LMS < 4.0.6 - Instructor+ Arbitrary File Read via Video Path (medium 6.8)
- [CVE-2026-19092](https://insights.sbomify.com/CVE-2026-19092/): Tutor LMS < 4.0.6 - Unauthenticated Arbitrary Zero-Argument Function Invocation via Template Variable Shadowing (critical 9.8)
- [CVE-2026-19091](https://insights.sbomify.com/CVE-2026-19091/): Path traversal in GeoDirectory – WP Business Directory Plugin and Classified Listings Directory (high 8.1)
- [CVE-2026-1909](https://insights.sbomify.com/CVE-2026-1909/): WaveSurfer-WP <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'src' Shortcode Attribute (medium 6.4)
- [CVE-2026-19089](https://insights.sbomify.com/CVE-2026-19089/): Product Input Fields for WooCommerce < 2.0.2 - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2026-19088](https://insights.sbomify.com/CVE-2026-19088/): ShopEngine < 4.9.3 - Customer PII Disclosure via Forced Authentication (medium 5.4)
- [CVE-2026-19087](https://insights.sbomify.com/CVE-2026-19087/): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (medium 4.4)
- [CVE-2026-19086](https://insights.sbomify.com/CVE-2026-19086/): IBM i is Affected By Multiple Vulnerabilities in PASE [, ] (low 3.3)
- [CVE-2026-19085](https://insights.sbomify.com/CVE-2026-19085/): Copy & Delete Posts < 1.5.6 - Author+ Password-Protected Post Content Disclosure (low 2.7)
- [CVE-2026-19084](https://insights.sbomify.com/CVE-2026-19084/): Shared Files < 1.7.70 - Unauthenticated Arbitrary File Read (high 7.5)
- [CVE-2026-19083](https://insights.sbomify.com/CVE-2026-19083/): IDOR in AKIN Software's OctoCloud (high 8.8)
- [CVE-2026-19082](https://insights.sbomify.com/CVE-2026-19082/): Information disclosure in Imager (high 7.5)
- [CVE-2026-19081](https://insights.sbomify.com/CVE-2026-19081/): Missing authorization in Gastromenum Ticket and QR Menu System (medium 4.3)
- [CVE-2026-19080](https://insights.sbomify.com/CVE-2026-19080/): Username Enumeration in Menulux Software's Menulux Portal (high 7.5)
- [CVE-2026-1908](https://insights.sbomify.com/CVE-2026-1908/): Cross-site scripting in Integration with Hubspot Forms (medium 6.4)
- [CVE-2026-19079](https://insights.sbomify.com/CVE-2026-19079/): Policycoreutils: policycoreutils: toctou race condition in fixfiles allows arbitrary selinux label manipulation (medium 4.4)
- [CVE-2026-19078](https://insights.sbomify.com/CVE-2026-19078/): Ose-oauth-server: oauth-server: open redirect vulnerability enables phishing via unvalidated parameter. (medium 4.3)
- [CVE-2026-19077](https://insights.sbomify.com/CVE-2026-19077/): Copy & Delete Posts < 1.5.5 - Authenticated Arbitrary Post Deletion via Missing Object-Level Authorization (medium 6.5)
- [CVE-2026-19076](https://insights.sbomify.com/CVE-2026-19076/): Auth bypass in Mattermost (medium 4.4)
- [CVE-2026-19075](https://insights.sbomify.com/CVE-2026-19075/): All-in-One Video Gallery < 4.9.2 - Subscriber+ Server-Side Request Forgery via 'vdl' Parameter (medium 5.0)
- [CVE-2026-19074](https://insights.sbomify.com/CVE-2026-19074/): Advanced Classifieds & Directory Pro < 3.4.3 - Unauthenticated Non-Public Listing Custom Field Disclosure (medium 5.3)
- [CVE-2026-19073](https://insights.sbomify.com/CVE-2026-19073/): Order Sync with Zendesk for WooCommerce < 2.2.3 - Unauthenticated Customer Order Data Disclosure (medium 5.3)
- [CVE-2026-19072](https://insights.sbomify.com/CVE-2026-19072/): Velociraptor Investigator reaches SuperUser via hunt EffectivePrincipal (critical 9.9)
- [CVE-2026-19071](https://insights.sbomify.com/CVE-2026-19071/): itsourcecode Hospital Management System viewappointment.php sql injection (medium 5.3)
- [CVE-2026-19070](https://insights.sbomify.com/CVE-2026-19070/): itsourcecode Hospital Management System viewadmin.php sql injection (medium 5.3)
- [CVE-2026-1907](https://insights.sbomify.com/CVE-2026-1907/): SQL Injection in Clustering Communication (Hybrid Mode) (high 7.5)
- [CVE-2026-19069](https://insights.sbomify.com/CVE-2026-19069/): itsourcecode Hospital Management System treatmentrecord.php sql injection (medium 5.3)
- [CVE-2026-19068](https://insights.sbomify.com/CVE-2026-19068/): itsourcecode Hospital Management System treatmentdetail.php sql injection (medium 5.3)
- [CVE-2026-19067](https://insights.sbomify.com/CVE-2026-19067/): itsourcecode Hospital Management System treatment.php sql injection (medium 5.3)
- [CVE-2026-19066](https://insights.sbomify.com/CVE-2026-19066/): SourceCodester Online Examination & Learning Management System view_students.php authorization (medium 5.3)
- [CVE-2026-19065](https://insights.sbomify.com/CVE-2026-19065/): SourceCodester Online Examination & Learning Management System upload_files.php unrestricted upload (medium 5.3)
- [CVE-2026-19064](https://insights.sbomify.com/CVE-2026-19064/): SourceCodester Online Examination & Learning Management System view.php authorization (medium 5.3)
- [CVE-2026-19062](https://insights.sbomify.com/CVE-2026-19062/): chiuwingyan house selectall.action sql injection (medium 6.9)
- [CVE-2026-19061](https://insights.sbomify.com/CVE-2026-19061/): Insta InstaKNXServiceApp Firmware Update CreateWebClientAndDownloadFileList data authenticity (medium 6.3)
- [CVE-2026-19060](https://insights.sbomify.com/CVE-2026-19060/): FoundationAgents MetaGPT code injection (medium 4.8)
- [CVE-2026-1906](https://insights.sbomify.com/CVE-2026-1906/): Missing authorization in PDF Invoices & Packing Slips for WooCommerce (medium 4.3)
- [CVE-2026-19059](https://insights.sbomify.com/CVE-2026-19059/): FoundationAgents MetaGPT editor.py read path traversal (medium 4.8)
- [CVE-2026-19058](https://insights.sbomify.com/CVE-2026-19058/): FoundationAgents MetaGPT data_interpreter.py DataInterpreter code injection (medium 4.8)
- [CVE-2026-19057](https://insights.sbomify.com/CVE-2026-19057/): Stored XSS in Gastromenum's Gastromenum Ticket and QR Menu System (medium 5.4)
- [CVE-2026-19056](https://insights.sbomify.com/CVE-2026-19056/): ProSolution WP Client < 2.0.11 - Reflected XSS via 'page' Parameter (high 7.1)
- [CVE-2026-19055](https://insights.sbomify.com/CVE-2026-19055/): ProSolution WP Client < 2.0.11 - Reflected XSS via Multiple Parameters (high 7.1)
- [CVE-2026-19054](https://insights.sbomify.com/CVE-2026-19054/): Lspace-io lspace-server Repositories File API repository.ts deleteFile path traversal (medium 4.8)
- [CVE-2026-19053](https://insights.sbomify.com/CVE-2026-19053/): ProSolution WP Client < 2.0.6 - Unauthenticated Blind SQLi via 'jobID' Parameter (critical 9.1)
- [CVE-2026-19052](https://insights.sbomify.com/CVE-2026-19052/): ProSolution WP Client < 2.0.9 - Subscriber+ proSol_ajaxTablesync and proSol_ajaxClearlog Calls (medium 4.3)
- [CVE-2026-19051](https://insights.sbomify.com/CVE-2026-19051/): Plaintext Storage of User Credentials in Menulux Software's Menulux Portal (high 7.1)
- [CVE-2026-19050](https://insights.sbomify.com/CVE-2026-19050/): ProSolution WP Client < 2.0.9 - Subscriber+ SSRF via proSol_url_validate (medium 6.4)
- [CVE-2026-1905](https://insights.sbomify.com/CVE-2026-1905/): Sphere Manager <= 1.0.2 - Authenticated (Contributor+) Cross-Site Scripting via 'width' Shortcode Attribute (medium 6.4)
- [CVE-2026-19049](https://insights.sbomify.com/CVE-2026-19049/): ProSolution WP Client < 2.0.9 - Unauthenticated SQLi and Plugin Data Deletion via 'removesite' Cookie (high 8.6)
- [CVE-2026-19047](https://insights.sbomify.com/CVE-2026-19047/): NocteDefensor LudusMCP ludus_cli_execute cliWrapper.ts executeCommand command injection (medium 4.8)
- [CVE-2026-19046](https://insights.sbomify.com/CVE-2026-19046/): NocteDefensor LudusMCP ludus_environment_guides_search ludusEnvironmentGuidesSearch.ts path traversal (medium 4.8)
- [CVE-2026-19045](https://insights.sbomify.com/CVE-2026-19045/): NocteDefensor LudusMCP get_credential_from_user secretDialog.ts SecretDialog.showSecretDialog command injection (medium 4.8)
- [CVE-2026-19044](https://insights.sbomify.com/CVE-2026-19044/): LeeSinLiang godot-mcp create_scene/add_node index.ts executeOperation command injection (medium 4.8)
- [CVE-2026-19043](https://insights.sbomify.com/CVE-2026-19043/): Authorization Bypass Critical POS Management Functions in Menulux Software's Menulux Portal (medium 4.3)
- [CVE-2026-19042](https://insights.sbomify.com/CVE-2026-19042/): Command Injection in TeamViewer Desktop Client for Linux through Chat Link Handling (high 8.8)
- [CVE-2026-19041](https://insights.sbomify.com/CVE-2026-19041/): MissionSquad mcp-api NPM Package Version packages.ts this.packageService.installPackage command injection (medium 5.3)
- [CVE-2026-19040](https://insights.sbomify.com/CVE-2026-19040/): MissionSquad mcp-api dcrClients.ts server-side request forgery (medium 5.3)
- [CVE-2026-1904](https://insights.sbomify.com/CVE-2026-1904/): Cross-site scripting in Simple Wp colorfull Accordion (medium 6.4)
- [CVE-2026-19039](https://insights.sbomify.com/CVE-2026-19039/): Kino-Kafkaesque ssh-mcp-server SSH index.ts ssh_exec command injection (medium 4.8)
- [CVE-2026-19038](https://insights.sbomify.com/CVE-2026-19038/): MonomythDevelopment la-forge-mcp screenshot_element Tool index.ts screenshotElement path traversal (medium 5.3)
- [CVE-2026-19037](https://insights.sbomify.com/CVE-2026-19037/): WonderTrader Internal Limit Order Book Cache MatchEngine.cpp update_lob behavioral workflow (medium 5.3)
- [CVE-2026-19036](https://insights.sbomify.com/CVE-2026-19036/): Shibby Tomato wanoptions sub_40F88C os command injection (high 8.6)
- [CVE-2026-19035](https://insights.sbomify.com/CVE-2026-19035/): Shibby Tomato qoslimit new_qoslimit_start os command injection (high 8.6)
- [CVE-2026-19034](https://insights.sbomify.com/CVE-2026-19034/): Shibby Tomato qoslimittc_stop.sh new_qoslimit_stop os command injection (high 8.6)
- [CVE-2026-19033](https://insights.sbomify.com/CVE-2026-19033/): Unauthenticated IXFR deltas are applied to the live zone before TSIG verification (medium 6.5)
- [CVE-2026-19032](https://insights.sbomify.com/CVE-2026-19032/): jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path (medium 5.3)
- [CVE-2026-1903](https://insights.sbomify.com/CVE-2026-1903/): Cross-site scripting in Ravelry Designs Widget (medium 6.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/827/