# Vulnerabilities published in 2026


- [CVE-2026-119136](https://insights.sbomify.com/CVE-2026-119136/): Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Async-Entrypoint Enforcement Bypass (medium 5.9)
- [CVE-2026-119135](https://insights.sbomify.com/CVE-2026-119135/): Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via StreamReader Type Mismatch (medium 5.9)
- [CVE-2026-119134](https://insights.sbomify.com/CVE-2026-119134/): Denial of service in wasmtime (medium 6.9)
- [CVE-2026-119133](https://insights.sbomify.com/CVE-2026-119133/): Wasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Misaligned VMContext via Exception Tags (low 2.1)
- [CVE-2026-119132](https://insights.sbomify.com/CVE-2026-119132/): Wasmtime 49.0.0 before 49.0.3 Host Panic via Overlapping String Transcode in Fused Adapter (medium 5.9)
- [CVE-2026-119131](https://insights.sbomify.com/CVE-2026-119131/): Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via wasi-http (medium 6.9)
- [CVE-2026-119130](https://insights.sbomify.com/CVE-2026-119130/): Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 HTTP Request Target Smuggling (low 2.1)
- [CVE-2026-11913](https://insights.sbomify.com/CVE-2026-11913/): Mother May I - Critical - Unsupported - SA-CONTRIB-2026-045 (critical 9.8)
- [CVE-2026-119129](https://insights.sbomify.com/CVE-2026-119129/): ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 Account Takeover via Device Authorization Approval (high 8.6)
- [CVE-2026-119128](https://insights.sbomify.com/CVE-2026-119128/): ZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck Cookie (critical 9.1)
- [CVE-2026-119127](https://insights.sbomify.com/CVE-2026-119127/): ZITADEL 4.0.0 before 4.19.5 Account Takeover via Login V2 Host Header Injection (high 8.6)
- [CVE-2026-119126](https://insights.sbomify.com/CVE-2026-119126/): Security feature bypass in parse-server (low 2.3)
- [CVE-2026-119125](https://insights.sbomify.com/CVE-2026-119125/): Parse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 Information Disclosure via beforeSave Reverted Fields (low 2.3)
- [CVE-2026-119124](https://insights.sbomify.com/CVE-2026-119124/): ImageMagick before 7.1.2-34 Heap Buffer Overflow via -morph Option (medium 4.8)
- [CVE-2026-119123](https://insights.sbomify.com/CVE-2026-119123/): ImageMagick before 7.1.2-34 Stack Overflow in TIFF Decoder (medium 6.3)
- [CVE-2026-119122](https://insights.sbomify.com/CVE-2026-119122/): Crawl4AI before 0.9.5 Blind SSRF via CacheValidator Freshness Check (medium 6.9)
- [CVE-2026-119121](https://insights.sbomify.com/CVE-2026-119121/): Crawl4AI 0.9.0 before 0.9.5 JavaScript Injection via css_selector and wait_for (medium 5.3)
- [CVE-2026-119120](https://insights.sbomify.com/CVE-2026-119120/): Crawl4AI 0.9.0 before 0.9.5 Untrusted Model Loading via CosineStrategy model_name (high 7.7)
- [CVE-2026-11912](https://insights.sbomify.com/CVE-2026-11912/): Missing authorization in Simple File List (high 7.5)
- [CVE-2026-119119](https://insights.sbomify.com/CVE-2026-119119/): Crawl4AI before 0.9.5 Denial of Service via Unbounded CrawlerRunConfig Delay Fields (high 8.7)
- [CVE-2026-119118](https://insights.sbomify.com/CVE-2026-119118/): Crawl4AI before 0.9.5 Improper Certificate Validation via Hard-coded Chromium Flags (high 8.3)
- [CVE-2026-119115](https://insights.sbomify.com/CVE-2026-119115/): Incorrect authorization in issuer resolution in AWS Private CA Connector for Kubernetes (high 8.4)
- [CVE-2026-11911](https://insights.sbomify.com/CVE-2026-11911/): Simple File List <= 6.3.7 - Unauthenticated Arbitrary File Deletion via Path Traversal in 'eeSubFolder' Parameter (high 7.5)
- [CVE-2026-1191](https://insights.sbomify.com/CVE-2026-1191/): JavaScript Notifier <= 1.2.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings (medium 4.4)
- [CVE-2026-11909](https://insights.sbomify.com/CVE-2026-11909/): Examples for Developers - Moderately critical - Access bypass - SA-CONTRIB-2026-044 (low 3.3)
- [CVE-2026-11908](https://insights.sbomify.com/CVE-2026-11908/): Tagify - Moderately critical - Cross-site scripting (XSS) - SA-CONTRIB-2026-043 (medium 5.4)
- [CVE-2026-11907](https://insights.sbomify.com/CVE-2026-11907/): Missing authorization in Stream – Activity Log & Audit Trail (medium 6.5)
- [CVE-2026-11906](https://insights.sbomify.com/CVE-2026-11906/): Denial of service in Db2 (medium 6.5)
- [CVE-2026-119054](https://insights.sbomify.com/CVE-2026-119054/): Multiple Pages Generator by Themeisle before 4.2.5 Stored XSS via Shortcode base-url (medium 5.1)
- [CVE-2026-119053](https://insights.sbomify.com/CVE-2026-119053/): lwIP 2.0.0 through 2.2.1 SNMP Agent Out-of-Bounds Read via snmp_pbuf_stream_writeto() (medium 6.9)
- [CVE-2026-119052](https://insights.sbomify.com/CVE-2026-119052/): llama.cpp b2877 before b11935 ggml-rpc Server DoS via Oversized recv_msg Length (high 8.7)
- [CVE-2026-119051](https://insights.sbomify.com/CVE-2026-119051/): flat through 6.0.1 Denial of Service via unflatten() Numeric Array Index Keys (high 8.2)
- [CVE-2026-119050](https://insights.sbomify.com/CVE-2026-119050/): Agno through 3.1.11 Code Execution via PandasTools Unsafe Reflection (critical 9.2)
- [CVE-2026-11905](https://insights.sbomify.com/CVE-2026-11905/): Missing authorization in Elementor Website Builder – more than just a page builder (medium 4.3)
- [CVE-2026-119049](https://insights.sbomify.com/CVE-2026-119049/): FreeMail before 5.3.2 Authorization Bypass via /api/create Mailbox Claiming (high 7.2)
- [CVE-2026-119048](https://insights.sbomify.com/CVE-2026-119048/): JeeSite 5.11.0 through 5.19.1 IDOR in AI CMS Chat Module (low 2.3)
- [CVE-2026-11904](https://insights.sbomify.com/CVE-2026-11904/): Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access (medium 5.3)
- [CVE-2026-11903](https://insights.sbomify.com/CVE-2026-11903/): Stored XSS in MOVEit Transfer Ad Hoc module (high 8.0)
- [CVE-2026-119028](https://insights.sbomify.com/CVE-2026-119028/): oapi-codegen 2.0.0 before 2.8.1 Code Injection via Non-String Enum Values (high 8.7)
- [CVE-2026-119027](https://insights.sbomify.com/CVE-2026-119027/): oapi-codegen 2.5.0 before 2.8.1 Code Injection via servers[].x-go-name Extension (high 7.7)
- [CVE-2026-119025](https://insights.sbomify.com/CVE-2026-119025/): open 7.2.0 before 11.0.0 OS Command Injection via PowerShell on Windows (high 7.7)
- [CVE-2026-11901](https://insights.sbomify.com/CVE-2026-11901/): Business logic in WP Hotel Booking (medium 5.3)
- [CVE-2026-11900](https://insights.sbomify.com/CVE-2026-11900/): Missing authorization in Ad Inserter – Ad Manager & AdSense Ads (medium 4.3)
- [CVE-2026-1190](https://insights.sbomify.com/CVE-2026-1190/): Keycloak's missing timestamp validation allows attackers to extend SAML response validity periods (low 3.1)
- [CVE-2026-11899](https://insights.sbomify.com/CVE-2026-11899/): Missing authorization in PDF Builder for WooCommerce. Create invoices,packing slips and more (medium 4.3)
- [CVE-2026-118989](https://insights.sbomify.com/CVE-2026-118989/): WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 SSRF via Redirects (medium 5.1)
- [CVE-2026-118984](https://insights.sbomify.com/CVE-2026-118984/): OmniRoute 3.8.0 before 3.8.52 Unverified Password Change via /api/settings/require-login (high 7.0)
- [CVE-2026-11898](https://insights.sbomify.com/CVE-2026-11898/): White Label CMS <= 2.7.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via Import Settings (medium 4.4)
- [CVE-2026-11897](https://insights.sbomify.com/CVE-2026-11897/): IBM WebSphere Application Server Liberty is affected by a denial of service vulnerability with HTTP/2 (high 7.5)
- [CVE-2026-11896](https://insights.sbomify.com/CVE-2026-11896/): Missing authorization in My Calendar – Accessible Event Manager (medium 5.3)
- [CVE-2026-11895](https://insights.sbomify.com/CVE-2026-11895/): Cross-site scripting in HT Mega Addons for Elementor – Elementor Widgets & Template Builder (medium 6.4)
- [CVE-2026-11894](https://insights.sbomify.com/CVE-2026-11894/): Double-free / use-after-free in Realtek BEE Bluetooth HCI driver `send()` error paths (medium 5.9)
- [CVE-2026-11893](https://insights.sbomify.com/CVE-2026-11893/): Double free / use-after-free in Bouffalo Lab HCI driver send() error paths (hci_bflb) (medium 5.9)
- [CVE-2026-11891](https://insights.sbomify.com/CVE-2026-11891/): Mali GPU Userspace Driver allows access to already freed memory (medium 5.1)
- [CVE-2026-118905](https://insights.sbomify.com/CVE-2026-118905/): nvm_ls lets an untrusted version string inject sed commands, executing arbitrary commands with GNU sed (high 7.1)
- [CVE-2026-11890](https://insights.sbomify.com/CVE-2026-11890/): Missing authorization in Devolutions Server (medium 4.3)
- [CVE-2026-1189](https://insights.sbomify.com/CVE-2026-1189/): Cross-site scripting in LeadBI Plugin for WordPress (medium 6.4)
- [CVE-2026-11889](https://insights.sbomify.com/CVE-2026-11889/): SALTO ProAccess Space Authorization Bypass Through User-Controlled Key (high 7.1)
- [CVE-2026-11888](https://insights.sbomify.com/CVE-2026-11888/): Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access (medium 6.4)
- [CVE-2026-11887](https://insights.sbomify.com/CVE-2026-11887/): Salon Booking System < 10.30.20 - Subscriber+ Booking Approval Bypass (medium 4.3)
- [CVE-2026-11885](https://insights.sbomify.com/CVE-2026-11885/): Power System update in Buffer Copy (high 8.4)
- [CVE-2026-11884](https://insights.sbomify.com/CVE-2026-11884/): Memory corruption in Red Hat Directory Server 11 (medium 6.5)
- [CVE-2026-11883](https://insights.sbomify.com/CVE-2026-11883/): WebAuthn Provider for Two Factor < 2.5.6 - 2FA Bypass (high 7.2)
- [CVE-2026-11882](https://insights.sbomify.com/CVE-2026-11882/): Builderall for WordPress < 3.0.2 - Unauthenticated OAuth Access Token Poisoning via Public REST Routes (low 3.7)
- [CVE-2026-11881](https://insights.sbomify.com/CVE-2026-11881/): Fluent Forms < 6.2.6 - Contributor+ Stored XSS via Date/Time Field (medium 6.1)
- [CVE-2026-118804](https://insights.sbomify.com/CVE-2026-118804/): Bricks Broken Access Control via query_result Endpoint (high 7.5)
- [CVE-2026-118803](https://insights.sbomify.com/CVE-2026-118803/): Bricks Theme Unauthenticated Dynamic Data Tag Injection via query_result (high 7.5)
- [CVE-2026-11880](https://insights.sbomify.com/CVE-2026-11880/): Fluent Forms < 6.2.1 - Subscriber+ Subscription Cancellation via IDOR (low 3.1)
- [CVE-2026-1188](https://insights.sbomify.com/CVE-2026-1188/): Memory corruption in Eclipse OMR (medium 6.9)
- [CVE-2026-11879](https://insights.sbomify.com/CVE-2026-11879/): Arbitrary code execution in MobaXterm Personal Edition (Portable) (high 8.5)
- [CVE-2026-118782](https://insights.sbomify.com/CVE-2026-118782/): Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count (high 7.5)
- [CVE-2026-118781](https://insights.sbomify.com/CVE-2026-118781/): Denial of service in forge (low 2.9)
- [CVE-2026-118780](https://insights.sbomify.com/CVE-2026-118780/): Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store (low 3.7)
- [CVE-2026-11878](https://insights.sbomify.com/CVE-2026-11878/): Reflected Cross-Site Scripting vulnerability in OpenText Access Manager (high 8.2)
- [CVE-2026-118779](https://insights.sbomify.com/CVE-2026-118779/): Forge: Regular expression denial of service in PEM decoding (pem.decode) (high 7.5)
- [CVE-2026-118778](https://insights.sbomify.com/CVE-2026-118778/): Forge: TLS client crash when the server sends no certificate (medium 5.9)
- [CVE-2026-118777](https://insights.sbomify.com/CVE-2026-118777/): Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie (medium 4.8)
- [CVE-2026-118776](https://insights.sbomify.com/CVE-2026-118776/): Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption (low 3.7)
- [CVE-2026-118775](https://insights.sbomify.com/CVE-2026-118775/): Forge: ASN.1 OID first arc truncation in asn1.oidToDer (low 3.7)
- [CVE-2026-118774](https://insights.sbomify.com/CVE-2026-118774/): Forge: Certificate signature verified with the issuer's RSA signature scheme (low 3.7)
- [CVE-2026-118773](https://insights.sbomify.com/CVE-2026-118773/): Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal (medium 6.3)
- [CVE-2026-118772](https://insights.sbomify.com/CVE-2026-118772/): joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service (high 7.5)
- [CVE-2026-11877](https://insights.sbomify.com/CVE-2026-11877/): Missing Authorization Vulnerability in OpenText Access Manager (medium 6.3)
- [CVE-2026-118769](https://insights.sbomify.com/CVE-2026-118769/): Botan: Integer overflow when reporting block size in FFI can cause memory corruption (critical 9.2)
- [CVE-2026-118768](https://insights.sbomify.com/CVE-2026-118768/): Botan: CLI utility `ocsp_check` accepts unauthenticated responses (medium 5.9)
- [CVE-2026-118767](https://insights.sbomify.com/CVE-2026-118767/): Botan: Python binding bcrypt APIs truncate passwords containing embedded NULs (medium 4.8)
- [CVE-2026-118766](https://insights.sbomify.com/CVE-2026-118766/): Botan: Online OCSP redirects enable blind requests to internal HTTP services (medium 6.1)
- [CVE-2026-118765](https://insights.sbomify.com/CVE-2026-118765/): Botan: AutoSeeded_RNG can become reinitialized from predictable data after clearing state (high 7.3)
- [CVE-2026-118764](https://insights.sbomify.com/CVE-2026-118764/): minimatch: potential denial of service via globparts amplification (high 8.7)
- [CVE-2026-118763](https://insights.sbomify.com/CVE-2026-118763/): @sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location (high 7.4)
- [CVE-2026-118762](https://insights.sbomify.com/CVE-2026-118762/): Monkeytype: fork PR can execute code with elevated GITHUB_TOKEN (critical 9.3)
- [CVE-2026-118761](https://insights.sbomify.com/CVE-2026-118761/): Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory (high 7.5)
- [CVE-2026-118760](https://insights.sbomify.com/CVE-2026-118760/): Kubeflow Pipelines: Missing namespace authorization permits cross-tenant artifact reads (medium 6.5)
- [CVE-2026-11876](https://insights.sbomify.com/CVE-2026-11876/): Missing Authorization in get_deployed_stack Endpoint in zenml-io/zenml (medium 5.0)
- [CVE-2026-118759](https://insights.sbomify.com/CVE-2026-118759/): Missing authorization in pipelines (high 7.5)
- [CVE-2026-118758](https://insights.sbomify.com/CVE-2026-118758/): Kubeflow: Unauthenticated path traversal to arbitrary file read on ml-pipeline-ui via the volume artifact source (high 7.5)
- [CVE-2026-118757](https://insights.sbomify.com/CVE-2026-118757/): PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 Missing Authorization via update_fees (medium 6.9)
- [CVE-2026-118756](https://insights.sbomify.com/CVE-2026-118756/): gopass before 1.17.0 Path Traversal via fs Storage Prune and IsDir (medium 6.7)
- [CVE-2026-118755](https://insights.sbomify.com/CVE-2026-118755/): Volmarg Personal Management System through 2.1.0 OS Command Injection via Storage Folder Path (high 8.6)
- [CVE-2026-118754](https://insights.sbomify.com/CVE-2026-118754/): Dolibarr ERP CRM before 24.0.2 Missing Authorization via public recruitment view.php (medium 6.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/890/