# Vulnerabilities published in 2026


- [CVE-2026-118753](https://insights.sbomify.com/CVE-2026-118753/): FreeImage (danoli3 fork) before 3.19.25 Heap Buffer Overflow via GIF_PLAYBACK Compositing (high 8.5)
- [CVE-2026-118752](https://insights.sbomify.com/CVE-2026-118752/): FreeImage before 3.19.22 Heap Buffer Overflow via IFF/LBM PBM RLE Decoder (high 8.5)
- [CVE-2026-11875](https://insights.sbomify.com/CVE-2026-11875/): WP Support Plus Responsive Ticket System <= 9.1.2 - Unauthenticated Support Ticket Access via Session Cookie Forgery (medium 5.3)
- [CVE-2026-11873](https://insights.sbomify.com/CVE-2026-11873/): Information disclosure in Red Hat Certificate System 9 (medium 6.5)
- [CVE-2026-11872](https://insights.sbomify.com/CVE-2026-11872/): Clever Mega Menu for Visual Composer <= 1.0.1 - Subscriber+ Menu Item Meta Update via save_clever_menu_item (medium 4.3)
- [CVE-2026-11871](https://insights.sbomify.com/CVE-2026-11871/): Team Showcase Supreme < 9.3 - Unauthenticated Sensitive Data Disclosure via wpm_6310_team_member_details (medium 5.3)
- [CVE-2026-11870](https://insights.sbomify.com/CVE-2026-11870/): Hide My WP Ghost < 7.0.05 - IP Address Spoofing via Trusted Proxy Headers Leading to Protection Mechanism Bypass (medium 5.4)
- [CVE-2026-1187](https://insights.sbomify.com/CVE-2026-1187/): ZoomifyWP Free <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'filename' Shortcode Attribute (medium 6.4)
- [CVE-2026-118694](https://insights.sbomify.com/CVE-2026-118694/): python-markdown2 through 2.5.5 Denial of Service via Unclosed Inline Link Destinations (high 8.7)
- [CVE-2026-118693](https://insights.sbomify.com/CVE-2026-118693/): CherryTree through 1.7.2 Local File Disclosure via Embedded-File Filename Path (medium 5.6)
- [CVE-2026-118692](https://insights.sbomify.com/CVE-2026-118692/): CherryTree through 1.7.2 OS Command Injection via Custom Web Link Action (high 7.1)
- [CVE-2026-118691](https://insights.sbomify.com/CVE-2026-118691/): xianyu-auto-reply-fix through 2.0.7 Unauthenticated Message Sending via /send-message (medium 6.3)
- [CVE-2026-118690](https://insights.sbomify.com/CVE-2026-118690/): Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs (critical 9.3)
- [CVE-2026-11869](https://insights.sbomify.com/CVE-2026-11869/): WP DSGVO Tools (GDPR) < 3.1.40 - Unauthenticated Sensitive Information Disclosure via Subject Access Request (medium 5.3)
- [CVE-2026-118689](https://insights.sbomify.com/CVE-2026-118689/): OvenMediaEngine through 0.21.0 OVT Relay DoS via Oversized payload_length (high 8.7)
- [CVE-2026-118688](https://insights.sbomify.com/CVE-2026-118688/): Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Sandbox Escape via Symlink Rename (high 8.8)
- [CVE-2026-118687](https://insights.sbomify.com/CVE-2026-118687/): Auth bypass in coder (high 8.3)
- [CVE-2026-118686](https://insights.sbomify.com/CVE-2026-118686/): EspoCRM before 9.3.11 and 10.0.8 Unauthenticated Denial of Service via Password-Redaction Regex (high 8.7)
- [CVE-2026-118685](https://insights.sbomify.com/CVE-2026-118685/): ToolJet 3.20.2-lts before 3.20.242-lts Signup Bypass via SignupDisableGuard (medium 6.9)
- [CVE-2026-118684](https://insights.sbomify.com/CVE-2026-118684/): MONAI before 1.6.1 Missing Integrity Verification via check_hash in Downloads (high 8.2)
- [CVE-2026-118683](https://insights.sbomify.com/CVE-2026-118683/): MONAI 1.2.0 before 1.6.1 Code Execution via bundle configs/logging.conf (high 8.6)
- [CVE-2026-118682](https://insights.sbomify.com/CVE-2026-118682/): ClashMi through 1.0.32.1801 Disabled TLS Certificate Validation Enables Update MITM (high 7.7)
- [CVE-2026-118681](https://insights.sbomify.com/CVE-2026-118681/): go-chi chi before 5.5.0 Authentication Bypass via SupressNotFound Middleware (medium 6.3)
- [CVE-2026-118680](https://insights.sbomify.com/CVE-2026-118680/): SiYuan 3.8.7 through 3.8.8 Path Traversal via GLOBALROOT Alias (medium 5.9)
- [CVE-2026-11868](https://insights.sbomify.com/CVE-2026-11868/): WP Travel < 11.7.1 - Unauthenticated Arbitrary Booking Cancellation (medium 5.3)
- [CVE-2026-118679](https://insights.sbomify.com/CVE-2026-118679/): n8n before 1.123.83, 2.41.4, and 2.42.1 Slack Token Exfiltration via Slack Trigger (medium 6.9)
- [CVE-2026-118678](https://insights.sbomify.com/CVE-2026-118678/): n8n before 2.41.4 and 2.42.1 Prototype Pollution DoS via Workflow History Compaction (high 7.1)
- [CVE-2026-118677](https://insights.sbomify.com/CVE-2026-118677/): n8n before 2.41.4 and 2.42.1 Local Gateway Deep-Link Silent Re-pairing to Attacker Instance (medium 5.9)
- [CVE-2026-118676](https://insights.sbomify.com/CVE-2026-118676/): n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass (medium 5.1)
- [CVE-2026-118675](https://insights.sbomify.com/CVE-2026-118675/): n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Guard Bypass via Execute Sub-workflow (medium 5.1)
- [CVE-2026-118673](https://insights.sbomify.com/CVE-2026-118673/): KeePassXC: Out-of-bounds write in browser integration response encryption with oversized database responses (medium 4.1)
- [CVE-2026-11867](https://insights.sbomify.com/CVE-2026-11867/): Missing authorization in Frontend Admin by DynamiApps (medium 6.5)
- [CVE-2026-118669](https://insights.sbomify.com/CVE-2026-118669/): OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client (high 8.4)
- [CVE-2026-118668](https://insights.sbomify.com/CVE-2026-118668/): LangGraph JavaScript custom authentication may permit cross-user Store access (high 8.6)
- [CVE-2026-118667](https://insights.sbomify.com/CVE-2026-118667/): LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requests (medium 4.3)
- [CVE-2026-118666](https://insights.sbomify.com/CVE-2026-118666/): GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller (medium 6.0)
- [CVE-2026-118665](https://insights.sbomify.com/CVE-2026-118665/): GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications (high 8.2)
- [CVE-2026-118664](https://insights.sbomify.com/CVE-2026-118664/): decode-uri-component: Denial of service via quadratic replacement of percent-encoded runs (high 8.2)
- [CVE-2026-118663](https://insights.sbomify.com/CVE-2026-118663/): @hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths (medium 5.3)
- [CVE-2026-118662](https://insights.sbomify.com/CVE-2026-118662/): Vite: `server.fs.deny` bypassed with queries (medium 6.9)
- [CVE-2026-118661](https://insights.sbomify.com/CVE-2026-118661/): Happy DOM: Cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies (medium 6.5)
- [CVE-2026-118660](https://insights.sbomify.com/CVE-2026-118660/): Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML (high 8.6)
- [CVE-2026-11866](https://insights.sbomify.com/CVE-2026-11866/): LatePoint < 5.6.3 - Multiple Privileged Actions via CSRF (medium 5.4)
- [CVE-2026-118659](https://insights.sbomify.com/CVE-2026-118659/): @happy-dom/server-renderer: ServerRendererServer Target-Origin Bypass SSRF / Open Proxy (high 7.5)
- [CVE-2026-118658](https://insights.sbomify.com/CVE-2026-118658/): Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto (medium 4.7)
- [CVE-2026-118657](https://insights.sbomify.com/CVE-2026-118657/): Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers (medium 5.9)
- [CVE-2026-118656](https://insights.sbomify.com/CVE-2026-118656/): Echo: Open Redirect via Control-Character Prefix Defeating sanitizeURI (medium 6.1)
- [CVE-2026-118655](https://insights.sbomify.com/CVE-2026-118655/): Echo: Static Middleware Double-Unescape Path Traversal (medium 5.9)
- [CVE-2026-118654](https://insights.sbomify.com/CVE-2026-118654/): Echo static file middleware route protection bypass via encoded dot-dot traversal (medium 5.9)
- [CVE-2026-118653](https://insights.sbomify.com/CVE-2026-118653/): Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration (medium 5.3)
- [CVE-2026-118652](https://insights.sbomify.com/CVE-2026-118652/): Echo: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob (medium 6.1)
- [CVE-2026-118651](https://insights.sbomify.com/CVE-2026-118651/): Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default (medium 5.3)
- [CVE-2026-118650](https://insights.sbomify.com/CVE-2026-118650/): Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path (high 7.5)
- [CVE-2026-118649](https://insights.sbomify.com/CVE-2026-118649/): n8n before 2.43.5 and 2.44.1 Authorization Bypass via Crafted Workflow ID in Data Tables (high 8.7)
- [CVE-2026-118648](https://insights.sbomify.com/CVE-2026-118648/): n8n before 1.123.85, 2.43.5, and 2.44.1 Stored XSS via Webhook Responses Missing Sandbox Policy (high 8.4)
- [CVE-2026-118647](https://insights.sbomify.com/CVE-2026-118647/): n8n before 1.123.85, 2.43.5, and 2.44.1 SeaTable Trigger API Token Exposure via Execution Data (medium 5.3)
- [CVE-2026-118646](https://insights.sbomify.com/CVE-2026-118646/): n8n before 1.123.85, 2.43.5, and 2.44.1 ReDoS via Read/Write Files Node (high 7.1)
- [CVE-2026-118645](https://insights.sbomify.com/CVE-2026-118645/): n8n before 1.123.85, 2.43.5, and 2.44.1 Filter Injection via Quick Base Node Where Parameter (high 7.0)
- [CVE-2026-118644](https://insights.sbomify.com/CVE-2026-118644/): n8n before 2.41.5 and 2.42.2 Credential Theft via Error-Workflow Context Inheritance (medium 5.1)
- [CVE-2026-118643](https://insights.sbomify.com/CVE-2026-118643/): n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Exposure via Node Execution Error Data (medium 5.3)
- [CVE-2026-118642](https://insights.sbomify.com/CVE-2026-118642/): n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass via Inline Sub-Workflows (medium 5.1)
- [CVE-2026-118641](https://insights.sbomify.com/CVE-2026-118641/): n8n before 1.123.85, 2.43.5, and 2.44.1 OData $filter Injection via Outlook and SharePoint Nodes (medium 6.9)
- [CVE-2026-118640](https://insights.sbomify.com/CVE-2026-118640/): n8n before 1.123.85, 2.43.5, and 2.44.1 Chat Hub Authorization Bypass (medium 5.3)
- [CVE-2026-11864](https://insights.sbomify.com/CVE-2026-11864/): Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026. (medium 6.5)
- [CVE-2026-118633](https://insights.sbomify.com/CVE-2026-118633/): Path traversal in SG UTM (critical 9.2)
- [CVE-2026-118619](https://insights.sbomify.com/CVE-2026-118619/): Ultralytics Google Drive Download Path Traversal Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-118618](https://insights.sbomify.com/CVE-2026-118618/): Ultralytics parse_model Code Injection Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-118617](https://insights.sbomify.com/CVE-2026-118617/): Ultralytics load_dataset_cache_file Deserialization of Untrusted Data Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-118616](https://insights.sbomify.com/CVE-2026-118616/): Ultralytics parse_model Code Injection Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-118615](https://insights.sbomify.com/CVE-2026-118615/): Ultralytics torch_safe_load Command Injection Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-118614](https://insights.sbomify.com/CVE-2026-118614/): Ultralytics check_det_dataset Code Injection Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-118613](https://insights.sbomify.com/CVE-2026-118613/): Ultralytics torch_load Deserialization of Untrusted Data Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-118611](https://insights.sbomify.com/CVE-2026-118611/): Alpine iLX-F511 Bluetooth OBEX Packet Handling Heap-based Buffer Overflow Remote Code Execution Vulnerability (medium 6.8)
- [CVE-2026-118610](https://insights.sbomify.com/CVE-2026-118610/): Alpine iLX-F511 Android Auto Service Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-11861](https://insights.sbomify.com/CVE-2026-11861/): Freeipa: idm: ipa: freeipa: obtaining tgs with impersonating cname through trust relationships (critical 9.6)
- [CVE-2026-118609](https://insights.sbomify.com/CVE-2026-118609/): Alpine iLX-F511 Android Auto Connection Handler Stack-based Buffer Overflow Remote Code Execution Vulnerability (medium 6.8)
- [CVE-2026-118608](https://insights.sbomify.com/CVE-2026-118608/): Alpine iLX-F511 libanwbtstack.so prh_rfcomm_cc_process_test Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.5)
- [CVE-2026-118607](https://insights.sbomify.com/CVE-2026-118607/): Alpine iLX-F511 diagapp Command Injection Vulnerability (medium 6.8)
- [CVE-2026-118606](https://insights.sbomify.com/CVE-2026-118606/): Alpine iLX-F511 Framework Service Exposed Dangerous Function Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-118605](https://insights.sbomify.com/CVE-2026-118605/): Alpine iLX-F511 prh_sdp_service_search_decode Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 8.0)
- [CVE-2026-118604](https://insights.sbomify.com/CVE-2026-118604/): Alpine iLX-F511 Framework Service Stack-based Buffer Overflow Remote Code Execution Vulnerability (medium 6.8)
- [CVE-2026-118603](https://insights.sbomify.com/CVE-2026-118603/): Alpine iLX-F511 vCard Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 8.0)
- [CVE-2026-118602](https://insights.sbomify.com/CVE-2026-118602/): Alpine iLX-F511 Fiv.System Exposed Dangerous Method Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2026-118601](https://insights.sbomify.com/CVE-2026-118601/): Alpine iLX-F511 SSH Hard-Coded Credentials Remote Code Execution Vulnerability (medium 6.3)
- [CVE-2026-11860](https://insights.sbomify.com/CVE-2026-11860/): Insecure Deserialisation via Plaintext HTTP leading to Remote Code Execution in Quick.CMS (high 7.5)
- [CVE-2026-1186](https://insights.sbomify.com/CVE-2026-1186/): Path Traversal in EAP Legislator (high 8.6)
- [CVE-2026-118590](https://insights.sbomify.com/CVE-2026-118590/): nipy nibabel Header volumeutils.py array_from_file memory allocation (medium 6.9)
- [CVE-2026-11859](https://insights.sbomify.com/CVE-2026-11859/): HTML injection in the Canarytoken links email (low 2.0)
- [CVE-2026-118589](https://insights.sbomify.com/CVE-2026-118589/): nschloe meshio VTK Reader _vtk_42.py memory allocation (medium 6.9)
- [CVE-2026-118586](https://insights.sbomify.com/CVE-2026-118586/): dfm feedfinder2 feedfinder2.py find_feeds server-side request forgery (medium 6.9)
- [CVE-2026-118585](https://insights.sbomify.com/CVE-2026-118585/): configuroweb inventariobasico Add Product addlist.php cross site scripting (medium 5.1)
- [CVE-2026-118581](https://insights.sbomify.com/CVE-2026-118581/): NoSQL injection via mismatched BSON size prefix in raw document splice to the wire protocol (medium 6.9)
- [CVE-2026-11858](https://insights.sbomify.com/CVE-2026-11858/): Missing authorization in Quanos SCHEMA ST4 Client Update Service allows arbitrary file overwrite as SYSTEM (high 8.4)
- [CVE-2026-118579](https://insights.sbomify.com/CVE-2026-118579/): D-Link DIR-505 Web Management CGI secmark1524.cgi main backdoor (critical 9.3)
- [CVE-2026-118578](https://insights.sbomify.com/CVE-2026-118578/): maotoumao MusicFreeDesktop Request Forwarder information disclosure (medium 5.3)
- [CVE-2026-118577](https://insights.sbomify.com/CVE-2026-118577/): maotoumao MusicFreeDesktop Request Forwarder server-side request forgery (medium 5.3)
- [CVE-2026-11857](https://insights.sbomify.com/CVE-2026-11857/): Insecure .NET Remoting deserialization in Quanos SCHEMA ST4 Client Update Service allows local privilege escalation (high 8.4)
- [CVE-2026-11856](https://insights.sbomify.com/CVE-2026-11856/): cross-origin Digest auth state leak (critical 9.8)
- [CVE-2026-11855](https://insights.sbomify.com/CVE-2026-11855/): Simple Membership < 4.7.5 - Unauthenticated Stored XSS via Stripe Webhook API Version (high 8.8)
- [CVE-2026-11854](https://insights.sbomify.com/CVE-2026-11854/): Cross-Site Scripting via Authentication Endpoint Error Message in Multiple WSO2 Products (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/891/