# Vulnerabilities published in 2026


- [CVE-2026-17686](https://insights.sbomify.com/CVE-2026-17686/): Security feature bypass in Chrome (high 8.1)
- [CVE-2026-17685](https://insights.sbomify.com/CVE-2026-17685/): Use after free in Chrome (high 8.8)
- [CVE-2026-17684](https://insights.sbomify.com/CVE-2026-17684/): Security feature bypass in Chrome (critical 9.6)
- [CVE-2026-17683](https://insights.sbomify.com/CVE-2026-17683/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-17682](https://insights.sbomify.com/CVE-2026-17682/): Integer overflow in Chrome (critical 9.6)
- [CVE-2026-17681](https://insights.sbomify.com/CVE-2026-17681/): Security feature bypass in Chrome (critical 9.6)
- [CVE-2026-17680](https://insights.sbomify.com/CVE-2026-17680/): Memory corruption in Chrome (critical 9.6)
- [CVE-2026-1768](https://insights.sbomify.com/CVE-2026-1768/): Missing authorization in Devolutions Server (medium 4.3)
- [CVE-2026-17679](https://insights.sbomify.com/CVE-2026-17679/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-17678](https://insights.sbomify.com/CVE-2026-17678/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-17677](https://insights.sbomify.com/CVE-2026-17677/): Security feature bypass in Chrome (high 8.8)
- [CVE-2026-17676](https://insights.sbomify.com/CVE-2026-17676/): Security feature bypass in Chrome (critical 9.6)
- [CVE-2026-17675](https://insights.sbomify.com/CVE-2026-17675/): Memory corruption in Chrome (critical 9.6)
- [CVE-2026-17674](https://insights.sbomify.com/CVE-2026-17674/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-17673](https://insights.sbomify.com/CVE-2026-17673/): Integer overflow in Chrome (critical 9.6)
- [CVE-2026-17672](https://insights.sbomify.com/CVE-2026-17672/): Security feature bypass in Chrome (critical 9.6)
- [CVE-2026-17671](https://insights.sbomify.com/CVE-2026-17671/): Security feature bypass in Chrome (critical 9.6)
- [CVE-2026-17670](https://insights.sbomify.com/CVE-2026-17670/): Use after free in Chrome (critical 9.6)
- [CVE-2026-1767](https://insights.sbomify.com/CVE-2026-1767/): Memory corruption in Red Hat Enterprise Linux 10 (medium 5.6)
- [CVE-2026-17669](https://insights.sbomify.com/CVE-2026-17669/): Security feature bypass in Chrome (critical 9.6)
- [CVE-2026-17668](https://insights.sbomify.com/CVE-2026-17668/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-17667](https://insights.sbomify.com/CVE-2026-17667/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-17666](https://insights.sbomify.com/CVE-2026-17666/): Weak cryptography in Chrome (critical 9.1)
- [CVE-2026-17665](https://insights.sbomify.com/CVE-2026-17665/): Use after free in Chrome (high 8.8)
- [CVE-2026-17664](https://insights.sbomify.com/CVE-2026-17664/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-17663](https://insights.sbomify.com/CVE-2026-17663/): Security feature bypass in Chrome (high 8.3)
- [CVE-2026-17662](https://insights.sbomify.com/CVE-2026-17662/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2026-17661](https://insights.sbomify.com/CVE-2026-17661/): Use after free in Chrome (high 8.8)
- [CVE-2026-17660](https://insights.sbomify.com/CVE-2026-17660/): Security feature bypass in Chrome (high 8.3)
- [CVE-2026-1766](https://insights.sbomify.com/CVE-2026-1766/): Memory corruption in Red Hat Enterprise Linux 10 (medium 5.6)
- [CVE-2026-17659](https://insights.sbomify.com/CVE-2026-17659/): Security feature bypass in Chrome (medium 4.2)
- [CVE-2026-17658](https://insights.sbomify.com/CVE-2026-17658/): Use after free in Chrome (high 8.8)
- [CVE-2026-17657](https://insights.sbomify.com/CVE-2026-17657/): Use after free in Chrome (high 8.3)
- [CVE-2026-17656](https://insights.sbomify.com/CVE-2026-17656/): Use after free in Chrome (critical 9.6)
- [CVE-2026-17655](https://insights.sbomify.com/CVE-2026-17655/): Security feature bypass in Chrome (critical 9.6)
- [CVE-2026-17654](https://insights.sbomify.com/CVE-2026-17654/): Race condition in Chrome (high 7.8)
- [CVE-2026-17653](https://insights.sbomify.com/CVE-2026-17653/): Use after free in Chrome (high 8.3)
- [CVE-2026-17652](https://insights.sbomify.com/CVE-2026-17652/): Use after free in Chrome (critical 9.6)
- [CVE-2026-17651](https://insights.sbomify.com/CVE-2026-17651/): Security feature bypass in Chrome (critical 9.6)
- [CVE-2026-17650](https://insights.sbomify.com/CVE-2026-17650/): Use after free in Chrome (high 8.3)
- [CVE-2026-1765](https://insights.sbomify.com/CVE-2026-1765/): Memory corruption in Red Hat Enterprise Linux 10 (medium 5.6)
- [CVE-2026-17649](https://insights.sbomify.com/CVE-2026-17649/): IBM i is Affected By Multiple Vulnerabilities in NetServer (medium 5.3)
- [CVE-2026-17647](https://insights.sbomify.com/CVE-2026-17647/): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (high 8.8)
- [CVE-2026-17646](https://insights.sbomify.com/CVE-2026-17646/): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (high 8.5)
- [CVE-2026-17645](https://insights.sbomify.com/CVE-2026-17645/): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (critical 9.1)
- [CVE-2026-17644](https://insights.sbomify.com/CVE-2026-17644/): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (high 8.8)
- [CVE-2026-17643](https://insights.sbomify.com/CVE-2026-17643/): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (high 8.8)
- [CVE-2026-17642](https://insights.sbomify.com/CVE-2026-17642/): IBM i is Affected By Remote Code Execution Vulnerabilities [, ] (high 8.8)
- [CVE-2026-1764](https://insights.sbomify.com/CVE-2026-1764/): Memory corruption in Red Hat Enterprise Linux 10 (medium 5.6)
- [CVE-2026-17639](https://insights.sbomify.com/CVE-2026-17639/): Certain HP Smart Tank All in One – Potential Denial of Service (medium 6.9)
- [CVE-2026-17637](https://insights.sbomify.com/CVE-2026-17637/): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (high 8.8)
- [CVE-2026-17636](https://insights.sbomify.com/CVE-2026-17636/): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (high 8.8)
- [CVE-2026-17635](https://insights.sbomify.com/CVE-2026-17635/): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (critical 9.1)
- [CVE-2026-17633](https://insights.sbomify.com/CVE-2026-17633/): Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling (high 8.5)
- [CVE-2026-17632](https://insights.sbomify.com/CVE-2026-17632/): Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling (high 8.8)
- [CVE-2026-17631](https://insights.sbomify.com/CVE-2026-17631/): Langflow OSS is affected by server-side request forgery due to missing URL validation in flow components (medium 5.0)
- [CVE-2026-17630](https://insights.sbomify.com/CVE-2026-17630/): Langflow is affected by security vulnerabilities in Model Context Protocol features (high 7.2)
- [CVE-2026-1763](https://insights.sbomify.com/CVE-2026-1763/): Enervista UR Setup DLL Hijacking (medium 4.6)
- [CVE-2026-17628](https://insights.sbomify.com/CVE-2026-17628/): Langflow is affected by improper authentication due to missing password verification in the password reset endpoint (medium 5.4)
- [CVE-2026-17627](https://insights.sbomify.com/CVE-2026-17627/): Langflow is affected by improper authorization due to missing access control on the voice-mode WebSocket endpoint (medium 4.9)
- [CVE-2026-17626](https://insights.sbomify.com/CVE-2026-17626/): Langflow is affected by security vulnerabilities in Model Context Protocol features (high 8.8)
- [CVE-2026-17625](https://insights.sbomify.com/CVE-2026-17625/): Langflow is affected by OS Command Injection in Model Context Protocol features (high 7.2)
- [CVE-2026-17624](https://insights.sbomify.com/CVE-2026-17624/): Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling (high 8.5)
- [CVE-2026-17623](https://insights.sbomify.com/CVE-2026-17623/): Langflow is affected OS Command Injection in Model Context Protocol features (high 8.8)
- [CVE-2026-17622](https://insights.sbomify.com/CVE-2026-17622/): Path traversal in Langflow OSS (medium 6.5)
- [CVE-2026-17621](https://insights.sbomify.com/CVE-2026-17621/): Path traversal in Langflow OSS (medium 5.4)
- [CVE-2026-17620](https://insights.sbomify.com/CVE-2026-17620/): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (medium 5.3)
- [CVE-2026-1762](https://insights.sbomify.com/CVE-2026-1762/): Enervista UR Setup Directory Traversal Vulnerability (low 2.9)
- [CVE-2026-17619](https://insights.sbomify.com/CVE-2026-17619/): The IBM Platform RTM is affected by an SQL injection vulnerability (high 8.6)
- [CVE-2026-17618](https://insights.sbomify.com/CVE-2026-17618/): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (high 7.3)
- [CVE-2026-17617](https://insights.sbomify.com/CVE-2026-17617/): Server-Side Request Forgery (SSRF) in IBM Application Gateway Operator (high 8.5)
- [CVE-2026-17616](https://insights.sbomify.com/CVE-2026-17616/): Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access (medium 6.8)
- [CVE-2026-17615](https://insights.sbomify.com/CVE-2026-17615/): Resteasy-core: resteasy sourceprovider remote unauthenticated file read (high 7.5)
- [CVE-2026-17614](https://insights.sbomify.com/CVE-2026-17614/): Wildfly-core: path traversal on wildfly domain controller (medium 4.4)
- [CVE-2026-17613](https://insights.sbomify.com/CVE-2026-17613/): CVE-2026-17613 (high 7.5)
- [CVE-2026-17612](https://insights.sbomify.com/CVE-2026-17612/): Audit Log Exposure through Unauthorized Access (medium 6.9)
- [CVE-2026-17610](https://insights.sbomify.com/CVE-2026-17610/): RAIL 802.15.4 Mux missing ACK can lead to DoS (medium 6.0)
- [CVE-2026-1761](https://insights.sbomify.com/CVE-2026-1761/): Libsoup: stack-based buffer overflow in libsoup multipart response parsingmultipart http response (high 8.6)
- [CVE-2026-17609](https://insights.sbomify.com/CVE-2026-17609/): Super Forms <= 6.3.316 - Unauthenticated Arbitrary Directory Deletion via 'data[...][files][][subdir]' Parameter (critical 9.1)
- [CVE-2026-17608](https://insights.sbomify.com/CVE-2026-17608/): WP Compress <= 7.10.09 - Cross-Site Request Forgery to Arbitrary Options Deletion (medium 6.5)
- [CVE-2026-17607](https://insights.sbomify.com/CVE-2026-17607/): WP Inventory Manager <= 2.5.1 - Authenticated (Contributor+) SQL Injection via 'where' Shortcode Attribute (medium 6.5)
- [CVE-2026-17605](https://insights.sbomify.com/CVE-2026-17605/): Path traversal in Payment forms, Buy now buttons, and Invoicing System | GetPaid (medium 6.6)
- [CVE-2026-17604](https://insights.sbomify.com/CVE-2026-17604/): Kirki <= 6.1.1 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameter (medium 4.9)
- [CVE-2026-17603](https://insights.sbomify.com/CVE-2026-17603/): Nexus Repository 3 - HikariCP connectionInitSql Injection RCE via DataStore Configuration API (high 8.7)
- [CVE-2026-17602](https://insights.sbomify.com/CVE-2026-17602/): SSL Zen <= 4.7.42 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'file_name' Parameter (medium 4.9)
- [CVE-2026-17601](https://insights.sbomify.com/CVE-2026-17601/): Nexus Repository 3 - Wildcard Privilege Update Self-Escalation to Administrator (high 8.9)
- [CVE-2026-17600](https://insights.sbomify.com/CVE-2026-17600/): Nexus Repository 3 - Session Not Invalidated on User Account Deletion or Deactivation (high 8.7)
- [CVE-2026-1760](https://insights.sbomify.com/CVE-2026-1760/): Libsoup: soupserver: denial of service via http request smuggling (medium 5.3)
- [CVE-2026-17599](https://insights.sbomify.com/CVE-2026-17599/): Nexus Repository 3 - Unverified Onboarding State on change-admin-password Endpoint (medium 6.9)
- [CVE-2026-17598](https://insights.sbomify.com/CVE-2026-17598/): Nexus Repository 3 - Improper Input Validation in Scheduled Task Configuration (medium 5.3)
- [CVE-2026-17597](https://insights.sbomify.com/CVE-2026-17597/): Nexus Repository 3 - Server-Side Request Forgery via Email Configuration Verification (medium 5.1)
- [CVE-2026-17596](https://insights.sbomify.com/CVE-2026-17596/): Nexus Repository 3 - Stored Cross-Site Scripting (XSS) via Blob Store Name (medium 6.3)
- [CVE-2026-17595](https://insights.sbomify.com/CVE-2026-17595/): Nexus Repository 3 - JEXL Content Selector Sandbox Property-Read Bypass (medium 5.3)
- [CVE-2026-17594](https://insights.sbomify.com/CVE-2026-17594/): Nexus Repository 3 - Authorization Bypass in Repository Creation (high 8.2)
- [CVE-2026-17593](https://insights.sbomify.com/CVE-2026-17593/): Nexus Repository - Arbitrary Class Instantiation via Unsafe Realm Configuration (high 7.2)
- [CVE-2026-17591](https://insights.sbomify.com/CVE-2026-17591/): Libarchive: libarchive: use-after-free via aliased mac metadata copy (low 3.6)
- [CVE-2026-1759](https://insights.sbomify.com/CVE-2026-1759/): Privilege escalation in GateManager (medium 6.5)
- [CVE-2026-17589](https://insights.sbomify.com/CVE-2026-17589/): Shopping Cart & eCommerce Store <= 5.9.2 - Authenticated (Administrator+) SQL Injection via 'product_order' Parameter (medium 4.9)
- [CVE-2026-17587](https://insights.sbomify.com/CVE-2026-17587/): Missing authorization in My Agile Privacy® – CMP, Cookie Consent & Privacy Tools (medium 5.3)
- [CVE-2026-17586](https://insights.sbomify.com/CVE-2026-17586/): Cross-site scripting in VK All in One Expansion Unit (medium 6.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/840/