# Vulnerabilities published in 2026


- [CVE-2026-118538](https://insights.sbomify.com/CVE-2026-118538/): a2ui-project a2ui Renderer root.js Root.renderComponentTree dynamically-determined object attributes (medium 5.1)
- [CVE-2026-118537](https://insights.sbomify.com/CVE-2026-118537/): a2ui Image Player/Video Player/Audio Player Image.js input validation (medium 5.3)
- [CVE-2026-11853](https://insights.sbomify.com/CVE-2026-11853/): Path traversal in debusine (medium 6.5)
- [CVE-2026-11852](https://insights.sbomify.com/CVE-2026-11852/): Missing authorization in debusine (medium 6.5)
- [CVE-2026-118510](https://insights.sbomify.com/CVE-2026-118510/): Laravel MongoDB `whereDoesntHave` misses deny records for numeric string IDs (high 7.7)
- [CVE-2026-11851](https://insights.sbomify.com/CVE-2026-11851/): SQL injection in Router (medium 5.9)
- [CVE-2026-11850](https://insights.sbomify.com/CVE-2026-11850/): Krb5: krb5: integer underflow in berval2tl_data() leads to heap out-of-bounds read (medium 5.0)
- [CVE-2026-1185](https://insights.sbomify.com/CVE-2026-1185/): Code injection in AXIS OS (medium 5.4)
- [CVE-2026-11849](https://insights.sbomify.com/CVE-2026-11849/): IEI Integration Corp｜iRM-IEI Remote Management - Hard-coded Credentials (critical 9.3)
- [CVE-2026-118485](https://insights.sbomify.com/CVE-2026-118485/): Axel Download Accelerator Path Traversal via URL Filename Decoding (high 7.0)
- [CVE-2026-11848](https://insights.sbomify.com/CVE-2026-11848/): IEI Integration Corp｜ iRM-IEI Remote Management - Missing Authentication (high 7.9)
- [CVE-2026-118477](https://insights.sbomify.com/CVE-2026-118477/): KaliFast Project Management Platform ei_git_repo_url OS Command Injection (high 8.7)
- [CVE-2026-11847](https://insights.sbomify.com/CVE-2026-11847/): Integration Corp｜iVEC-IEI Virtualization Edge Computer - Arbitrary File Deletion (medium 5.3)
- [CVE-2026-11846](https://insights.sbomify.com/CVE-2026-11846/): IEI Integration Corp｜iVEC-IEI Virtualization Edge Computer - Arbitrary File Deletion (high 7.2)
- [CVE-2026-11845](https://insights.sbomify.com/CVE-2026-11845/): IEI Integration Corp｜iVEC-IEI Virtualization Edge Computer - OS Command Injection (high 8.6)
- [CVE-2026-11844](https://insights.sbomify.com/CVE-2026-11844/): IEI Integration Corp｜iVEC-IEI Virtualization Edge Computer - Arbitrary File Read (medium 6.9)
- [CVE-2026-118435](https://insights.sbomify.com/CVE-2026-118435/): Memory corruption in escargot (medium 5.4)
- [CVE-2026-118426](https://insights.sbomify.com/CVE-2026-118426/): Missing authorization in Octopus Server (medium 5.3)
- [CVE-2026-118425](https://insights.sbomify.com/CVE-2026-118425/): Keycloak-services: keycloak-services: redirect uri domain allowlist bypass via dns resolution to loopback (medium 6.8)
- [CVE-2026-11841](https://insights.sbomify.com/CVE-2026-11841/): CVE-2026-11841 (critical 9.4)
- [CVE-2026-11840](https://insights.sbomify.com/CVE-2026-11840/): SQL Injection (high 8.8)
- [CVE-2026-1184](https://insights.sbomify.com/CVE-2026-1184/): Deserialization of Untrusted Data in GitLab (medium 6.5)
- [CVE-2026-11839](https://insights.sbomify.com/CVE-2026-11839/): Arbitrary File Upload in Basarsoft's Rotaban (critical 9.9)
- [CVE-2026-118384](https://insights.sbomify.com/CVE-2026-118384/): Memory corruption in mtools (medium 6.1)
- [CVE-2026-11838](https://insights.sbomify.com/CVE-2026-11838/): Improper Authorization in Yordam Informatics' Library Reservation System (medium 4.3)
- [CVE-2026-118378](https://insights.sbomify.com/CVE-2026-118378/): Tabularis before 0.28.0 SQL Injection via MCP describe_table table_name (high 8.5)
- [CVE-2026-118377](https://insights.sbomify.com/CVE-2026-118377/): mews/pos through 2.0.0 Missing Hash Verification in 3D Pay and 3D Host Callbacks (high 8.7)
- [CVE-2026-118376](https://insights.sbomify.com/CVE-2026-118376/): WeKnora before 0.8.2 SSRF Guard Bypass via NAT64 IPv6 Addresses (medium 6.0)
- [CVE-2026-118375](https://insights.sbomify.com/CVE-2026-118375/): llama.cpp b8841 before b11865 Stack-based Buffer Overflow via ggml-rpc RDMA rdma_recv() (critical 9.2)
- [CVE-2026-118374](https://insights.sbomify.com/CVE-2026-118374/): LibreSSL ocspcheck through 4.4.0 Memory Exhaustion via Unbounded OCSP HTTP Response (high 8.2)
- [CVE-2026-118373](https://insights.sbomify.com/CVE-2026-118373/): LibreSSL ocspcheck through 4.4.0 Cleartext Transmission of OCSP Requests via url2host() (medium 6.3)
- [CVE-2026-118372](https://insights.sbomify.com/CVE-2026-118372/): LibreSSL ocspcheck through 4.4.0 CRLF Injection via AIA OCSP URL Path (medium 6.3)
- [CVE-2026-118371](https://insights.sbomify.com/CVE-2026-118371/): LibreSSL through 4.4.0 CRLF Injection via OCSP_sendreq_new() Request Line (medium 6.3)
- [CVE-2026-118370](https://insights.sbomify.com/CVE-2026-118370/): libexpat through 2.9.0 Integer Overflow in storeAtts via attIndex and nPrefixes (high 8.2)
- [CVE-2026-11837](https://insights.sbomify.com/CVE-2026-11837/): Ansible-collection-ansible-posix: ansible.posix authorized_key: local privilege escalation via symlink-following chown (high 7.3)
- [CVE-2026-11836](https://insights.sbomify.com/CVE-2026-11836/): Production Debug-Unlock Token Verification Missing Device Binding (low 1.8)
- [CVE-2026-118359](https://insights.sbomify.com/CVE-2026-118359/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-118358](https://insights.sbomify.com/CVE-2026-118358/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-118357](https://insights.sbomify.com/CVE-2026-118357/): Use after free in Chrome (high 8.8)
- [CVE-2026-118356](https://insights.sbomify.com/CVE-2026-118356/): Use after free in Chrome (high 8.8)
- [CVE-2026-118355](https://insights.sbomify.com/CVE-2026-118355/): Code injection in Chrome (critical 9.6)
- [CVE-2026-118354](https://insights.sbomify.com/CVE-2026-118354/): Other in Chrome (high 8.8)
- [CVE-2026-118353](https://insights.sbomify.com/CVE-2026-118353/): Use after free in Chrome (high 8.8)
- [CVE-2026-118352](https://insights.sbomify.com/CVE-2026-118352/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-118351](https://insights.sbomify.com/CVE-2026-118351/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-118350](https://insights.sbomify.com/CVE-2026-118350/): Use after free in Chrome (high 8.8)
- [CVE-2026-11835](https://insights.sbomify.com/CVE-2026-11835/): Caliptra Update-Reset Secure-Boot Bypass via Attacker-Chosen AXI Staging Address (TOCTOU) (medium 5.6)
- [CVE-2026-118349](https://insights.sbomify.com/CVE-2026-118349/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-118348](https://insights.sbomify.com/CVE-2026-118348/): Other in Chrome (high 8.8)
- [CVE-2026-118347](https://insights.sbomify.com/CVE-2026-118347/): Use after free in Chrome (high 8.8)
- [CVE-2026-118346](https://insights.sbomify.com/CVE-2026-118346/): Use after free in Chrome (high 8.8)
- [CVE-2026-118345](https://insights.sbomify.com/CVE-2026-118345/): Use after free in Chrome (high 8.8)
- [CVE-2026-118344](https://insights.sbomify.com/CVE-2026-118344/): Use after free in Chrome (high 8.8)
- [CVE-2026-118343](https://insights.sbomify.com/CVE-2026-118343/): Other in Chrome (high 8.8)
- [CVE-2026-118342](https://insights.sbomify.com/CVE-2026-118342/): Memory corruption in Chrome (critical 9.6)
- [CVE-2026-118341](https://insights.sbomify.com/CVE-2026-118341/): Use after free in Chrome (high 8.8)
- [CVE-2026-118340](https://insights.sbomify.com/CVE-2026-118340/): Memory corruption in Chrome (critical 9.6)
- [CVE-2026-11834](https://insights.sbomify.com/CVE-2026-11834/): Unauthenticated Command Injection via DHCP Option Handling in Multiple TP-Link Routers (high 8.7)
- [CVE-2026-118339](https://insights.sbomify.com/CVE-2026-118339/): Use after free in Chrome (high 8.8)
- [CVE-2026-118338](https://insights.sbomify.com/CVE-2026-118338/): Use after free in Chrome (high 8.8)
- [CVE-2026-118337](https://insights.sbomify.com/CVE-2026-118337/): Security feature bypass in Chrome (not scored)
- [CVE-2026-118336](https://insights.sbomify.com/CVE-2026-118336/): Other in Chrome (high 8.8)
- [CVE-2026-118335](https://insights.sbomify.com/CVE-2026-118335/): Other in Chrome (high 8.8)
- [CVE-2026-118334](https://insights.sbomify.com/CVE-2026-118334/): Use after free in Chrome (high 8.8)
- [CVE-2026-118333](https://insights.sbomify.com/CVE-2026-118333/): Missing authorization in Chrome (not scored)
- [CVE-2026-118332](https://insights.sbomify.com/CVE-2026-118332/): Other in Chrome (critical 9.6)
- [CVE-2026-118331](https://insights.sbomify.com/CVE-2026-118331/): Other in Chrome (high 8.8)
- [CVE-2026-118330](https://insights.sbomify.com/CVE-2026-118330/): Use after free in Chrome (high 8.8)
- [CVE-2026-11833](https://insights.sbomify.com/CVE-2026-11833/): Information disclosure in CI Server (high 8.2)
- [CVE-2026-118329](https://insights.sbomify.com/CVE-2026-118329/): Other in Chrome (high 8.8)
- [CVE-2026-118328](https://insights.sbomify.com/CVE-2026-118328/): Other in Chrome (high 8.8)
- [CVE-2026-118327](https://insights.sbomify.com/CVE-2026-118327/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-118322](https://insights.sbomify.com/CVE-2026-118322/): Memory corruption in Chrome (medium 4.3)
- [CVE-2026-118321](https://insights.sbomify.com/CVE-2026-118321/): Other in Chrome (critical 9.6)
- [CVE-2026-118320](https://insights.sbomify.com/CVE-2026-118320/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-11832](https://insights.sbomify.com/CVE-2026-11832/): Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a predictable nonce (critical 9.1)
- [CVE-2026-118319](https://insights.sbomify.com/CVE-2026-118319/): Memory corruption in Chrome (medium 4.3)
- [CVE-2026-118318](https://insights.sbomify.com/CVE-2026-118318/): Information disclosure in Chrome (medium 4.3)
- [CVE-2026-118317](https://insights.sbomify.com/CVE-2026-118317/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-118316](https://insights.sbomify.com/CVE-2026-118316/): Other in Chrome (critical 9.6)
- [CVE-2026-118315](https://insights.sbomify.com/CVE-2026-118315/): Other in Chrome (high 8.8)
- [CVE-2026-118314](https://insights.sbomify.com/CVE-2026-118314/): Other in Chrome (high 8.8)
- [CVE-2026-118313](https://insights.sbomify.com/CVE-2026-118313/): Use after free in Chrome (high 8.8)
- [CVE-2026-118312](https://insights.sbomify.com/CVE-2026-118312/): Memory corruption in Chrome (critical 9.6)
- [CVE-2026-118311](https://insights.sbomify.com/CVE-2026-118311/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-118310](https://insights.sbomify.com/CVE-2026-118310/): Other in Chrome (critical 9.6)
- [CVE-2026-11831](https://insights.sbomify.com/CVE-2026-11831/): IBM MQ Heap-based Buffer Overflow (medium 5.4)
- [CVE-2026-118309](https://insights.sbomify.com/CVE-2026-118309/): Other in Chrome (critical 9.6)
- [CVE-2026-118308](https://insights.sbomify.com/CVE-2026-118308/): Use after free in Chrome (critical 9.6)
- [CVE-2026-118307](https://insights.sbomify.com/CVE-2026-118307/): Use after free in Chrome (high 8.8)
- [CVE-2026-118306](https://insights.sbomify.com/CVE-2026-118306/): Memory corruption in Chrome (critical 9.6)
- [CVE-2026-118305](https://insights.sbomify.com/CVE-2026-118305/): Memory corruption in Chrome (critical 9.6)
- [CVE-2026-118304](https://insights.sbomify.com/CVE-2026-118304/): Other in Chrome (high 8.8)
- [CVE-2026-1183](https://insights.sbomify.com/CVE-2026-1183/): HTML injection in multiple Botble products (medium 5.1)
- [CVE-2026-11829](https://insights.sbomify.com/CVE-2026-11829/): IBM MQ Buffer Overflow (medium 6.5)
- [CVE-2026-11828](https://insights.sbomify.com/CVE-2026-11828/): IBM MQ Buffer Overflow (medium 5.9)
- [CVE-2026-118276](https://insights.sbomify.com/CVE-2026-118276/): a2ui-project a2ui Parser expression_parser.ts formatString resource consumption (medium 5.1)
- [CVE-2026-118275](https://insights.sbomify.com/CVE-2026-118275/): a2ui-project a2ui Resolver data-context.ts DataContext.resolveSignal resource consumption (medium 6.9)
- [CVE-2026-118274](https://insights.sbomify.com/CVE-2026-118274/): a2ui-project a2ui Binder generic-binder.ts resource consumption (medium 5.3)
- [CVE-2026-118273](https://insights.sbomify.com/CVE-2026-118273/): a2ui-project a2ui data-model.ts DataModel.set resource consumption (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/892/