# Vulnerabilities published in 2026


- [CVE-2026-118272](https://insights.sbomify.com/CVE-2026-118272/): a2ui-project a2ui Error data-context.ts DataContext.dispatchExpressionError information exposure (medium 5.3)
- [CVE-2026-118271](https://insights.sbomify.com/CVE-2026-118271/): a2ui-project a2ui data-context Resolver data-context.ts resource consumption (medium 5.3)
- [CVE-2026-11827](https://insights.sbomify.com/CVE-2026-11827/): Insufficiently Protected Credentials in GitLab (medium 4.9)
- [CVE-2026-118266](https://insights.sbomify.com/CVE-2026-118266/): Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method (medium 5.3)
- [CVE-2026-118265](https://insights.sbomify.com/CVE-2026-118265/): Echo: X-Real-IP extractor trusts the header value instead of the sending peer (medium 5.3)
- [CVE-2026-118264](https://insights.sbomify.com/CVE-2026-118264/): Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls (critical 9.1)
- [CVE-2026-118263](https://insights.sbomify.com/CVE-2026-118263/): Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests (medium 6.3)
- [CVE-2026-118262](https://insights.sbomify.com/CVE-2026-118262/): Echo: WebSocket proxy can retain connections and handlers after client disconnect (high 8.2)
- [CVE-2026-118261](https://insights.sbomify.com/CVE-2026-118261/): Echo: Decompress permits unbounded gzip expansion in v4 (high 8.2)
- [CVE-2026-118260](https://insights.sbomify.com/CVE-2026-118260/): Echo: BodyDump captures request and response bodies without size limits in v4 (high 8.2)
- [CVE-2026-11826](https://insights.sbomify.com/CVE-2026-11826/): OpenPLC_v3 Heap-Based Buffer Overflow in Modbus Master getData() (high 8.7)
- [CVE-2026-118259](https://insights.sbomify.com/CVE-2026-118259/): opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing (medium 5.3)
- [CVE-2026-118258](https://insights.sbomify.com/CVE-2026-118258/): i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string (low 3.7)
- [CVE-2026-118257](https://insights.sbomify.com/CVE-2026-118257/): Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages (high 7.2)
- [CVE-2026-118256](https://insights.sbomify.com/CVE-2026-118256/): Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list (low 2.1)
- [CVE-2026-118255](https://insights.sbomify.com/CVE-2026-118255/): Highcharts Grid: javascript: URL in credits.href runs script on click (high 8.4)
- [CVE-2026-118254](https://insights.sbomify.com/CVE-2026-118254/): Highcharts Grid: pagination language options are parsed as HTML (high 8.6)
- [CVE-2026-118253](https://insights.sbomify.com/CVE-2026-118253/): Highcharts Dashboards: fullscreen labels are parsed as HTML (high 8.4)
- [CVE-2026-118252](https://insights.sbomify.com/CVE-2026-118252/): Highcharts Dashboards: sidebar component labels are parsed as HTML (high 8.4)
- [CVE-2026-118251](https://insights.sbomify.com/CVE-2026-118251/): Highcharts: javascript: URL in credits.href runs script on click (high 8.4)
- [CVE-2026-118250](https://insights.sbomify.com/CVE-2026-118250/): Highcharts: dotted series.keys paths write to Object.prototype (high 7.2)
- [CVE-2026-118249](https://insights.sbomify.com/CVE-2026-118249/): Highcharts: series column construction writes to Object.prototype (high 7.2)
- [CVE-2026-118248](https://insights.sbomify.com/CVE-2026-118248/): Highcharts Dashboards: editableOptions.propertyPath writes to Object.prototype (medium 6.9)
- [CVE-2026-118247](https://insights.sbomify.com/CVE-2026-118247/): Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column. (medium 6.9)
- [CVE-2026-118246](https://insights.sbomify.com/CVE-2026-118246/): Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes (high 8.4)
- [CVE-2026-118245](https://insights.sbomify.com/CVE-2026-118245/): Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespace (high 8.6)
- [CVE-2026-118244](https://insights.sbomify.com/CVE-2026-118244/): Highcharts Core: AST `DOMParser` fallback assigns unsanitized markup to `innerHTML` during print (high 7.2)
- [CVE-2026-118243](https://insights.sbomify.com/CVE-2026-118243/): Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype` (medium 5.3)
- [CVE-2026-118242](https://insights.sbomify.com/CVE-2026-118242/): Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>` (high 8.5)
- [CVE-2026-11824](https://insights.sbomify.com/CVE-2026-11824/): SQLite before 3.53.2 Heap Buffer Overflow via FTS5 fts5ChunkIterate (high 8.5)
- [CVE-2026-11823](https://insights.sbomify.com/CVE-2026-11823/): BookingPress Appointment Booking Pro <= 5.7.1 - Unauthenticated SQL Injection via 'store_service_date' Parameter (high 7.5)
- [CVE-2026-11822](https://insights.sbomify.com/CVE-2026-11822/): SQLite before 3.53.2 Memory Corruption in FTS5 Extension (high 8.5)
- [CVE-2026-11821](https://insights.sbomify.com/CVE-2026-11821/): Missing authorization in Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce (medium 5.4)
- [CVE-2026-11820](https://insights.sbomify.com/CVE-2026-11820/): Information disclosure in Red Hat Enterprise Linux 10 (medium 6.5)
- [CVE-2026-1182](https://insights.sbomify.com/CVE-2026-1182/): Improper Removal of Sensitive Information Before Storage or Transfer in GitLab (medium 4.3)
- [CVE-2026-118192](https://insights.sbomify.com/CVE-2026-118192/): JoomSport <= 5.7.11 - Authenticated (Contributor+) SQL Injection via 'team_id' Shortcode Attribute (medium 6.5)
- [CVE-2026-11819](https://insights.sbomify.com/CVE-2026-11819/): Community.general: community.general keyring_info — os keyring passphrase returned in plaintext (medium 5.5)
- [CVE-2026-118180](https://insights.sbomify.com/CVE-2026-118180/): Matrix homeserver could redirect the chat session to a local file or network share (not scored)
- [CVE-2026-11818](https://insights.sbomify.com/CVE-2026-11818/): WPCafe <= 3.0.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via REST API (medium 5.4)
- [CVE-2026-118179](https://insights.sbomify.com/CVE-2026-118179/): Request forgery via news: links (not scored)
- [CVE-2026-118178](https://insights.sbomify.com/CVE-2026-118178/): RSS feed could redirect its subscription to a local file or network share (not scored)
- [CVE-2026-118177](https://insights.sbomify.com/CVE-2026-118177/): Calendar discovery accepted local file and remote network share locations (not scored)
- [CVE-2026-118176](https://insights.sbomify.com/CVE-2026-118176/): Bypass of remote UNC path restriction in mailbox: URLs (not scored)
- [CVE-2026-118175](https://insights.sbomify.com/CVE-2026-118175/): Content of other messages could be included when replying to a crafted message (not scored)
- [CVE-2026-118174](https://insights.sbomify.com/CVE-2026-118174/): Displaying a message could load an attacker-chosen URL through an OpenPGP key attachment (not scored)
- [CVE-2026-118173](https://insights.sbomify.com/CVE-2026-118173/): MISP Guard Incomplete Tag Validation Allows Non-Allowed Taxonomy Tags to Bypass Feed Policy Enforcement (medium 6.1)
- [CVE-2026-118172](https://insights.sbomify.com/CVE-2026-118172/): CVE-2026-118172 (not scored)
- [CVE-2026-118171](https://insights.sbomify.com/CVE-2026-118171/): CVE-2026-118171 (not scored)
- [CVE-2026-118170](https://insights.sbomify.com/CVE-2026-118170/): CVE-2026-118170 (not scored)
- [CVE-2026-11817](https://insights.sbomify.com/CVE-2026-11817/): CVE-2026-11817 CVE Record (medium 5.3)
- [CVE-2026-118169](https://insights.sbomify.com/CVE-2026-118169/): Hustle <= 7.8.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'cta_label' Parameter (medium 4.9)
- [CVE-2026-118164](https://insights.sbomify.com/CVE-2026-118164/): If-So Dynamic Content <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'repeater' Parameter (medium 6.4)
- [CVE-2026-11816](https://insights.sbomify.com/CVE-2026-11816/): Path Traversal in keras-team/keras (high 8.1)
- [CVE-2026-11815](https://insights.sbomify.com/CVE-2026-11815/): Insecure Deserialization via MITM in Layer 7 Policy Manager (medium 5.3)
- [CVE-2026-11814](https://insights.sbomify.com/CVE-2026-11814/): Command injection vulnerability in certain NETGEAR Nighthawk and Orbi routers (medium 4.9)
- [CVE-2026-118132](https://insights.sbomify.com/CVE-2026-118132/): CVE-2026-118132 (not scored)
- [CVE-2026-118131](https://insights.sbomify.com/CVE-2026-118131/): CVE-2026-118131 (not scored)
- [CVE-2026-11813](https://insights.sbomify.com/CVE-2026-11813/): Privilege escalation in FileZ Client (high 8.5)
- [CVE-2026-118129](https://insights.sbomify.com/CVE-2026-118129/): jeremyckahn Chitchatter PostMessage Bootstrap.tsx isConfigMessageEvent improper authentication (medium 5.3)
- [CVE-2026-118128](https://insights.sbomify.com/CVE-2026-118128/): a2aproject a2a-js Task Status Update result_manager.ts ResultManager.applyStatusUpdate race condition (medium 6.9)
- [CVE-2026-11812](https://insights.sbomify.com/CVE-2026-11812/): UpdateHub: race condition on shared context causes out-of-bounds write and DoS (low 2.5)
- [CVE-2026-11811](https://insights.sbomify.com/CVE-2026-11811/): Socket file-descriptor leak in UpdateHub OTA client start_coap_client() leading to resource-exhaustion DoS (low 3.7)
- [CVE-2026-11810](https://insights.sbomify.com/CVE-2026-11810/): NULL-pointer dereference in UpdateHub OTA agent on empty inner metadata array (remote DoS) (high 7.5)
- [CVE-2026-1181](https://insights.sbomify.com/CVE-2026-1181/): Altium 365 Over-Permissive CORS Configuration Allows Credentialed Cross-Origin Workspace Access (critical 9.0)
- [CVE-2026-118097](https://insights.sbomify.com/CVE-2026-118097/): WordPress Flash & HTML5 Video plugin <= 2.14.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-118095](https://insights.sbomify.com/CVE-2026-118095/): WordPress Media LIbrary Assistant plugin <= 3.42 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-118094](https://insights.sbomify.com/CVE-2026-118094/): WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-118093](https://insights.sbomify.com/CVE-2026-118093/): WordPress Product Feed Manager plugin <= 7.14.1 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-118092](https://insights.sbomify.com/CVE-2026-118092/): WordPress MasterStudy LMS plugin <= 3.7.55 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-118091](https://insights.sbomify.com/CVE-2026-118091/): WordPress WPFunnels plugin <= 3.13.5 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-11809](https://insights.sbomify.com/CVE-2026-11809/): UpdateHub probe: uninitialized-heap out-of-bounds read of network-supplied metadata (low 3.7)
- [CVE-2026-118088](https://insights.sbomify.com/CVE-2026-118088/): WordPress WPFunnels plugin <= 3.13.5 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-118087](https://insights.sbomify.com/CVE-2026-118087/): WordPress Site Reviews plugin <= 8.3.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-118085](https://insights.sbomify.com/CVE-2026-118085/): WordPress GlobalPayments WooCommerce plugin <= 1.23.3 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-118084](https://insights.sbomify.com/CVE-2026-118084/): WordPress Hotel Booking plugin <= 3.8 - Insecure Direct Object References (IDOR) vulnerability (medium 6.5)
- [CVE-2026-118083](https://insights.sbomify.com/CVE-2026-118083/): WordPress WP Crowdfunding plugin <= 2.2.2 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2026-118082](https://insights.sbomify.com/CVE-2026-118082/): WordPress Buddyboss Platform plugin <= 3.5.0 - Privilege Escalation vulnerability (high 8.8)
- [CVE-2026-118081](https://insights.sbomify.com/CVE-2026-118081/): WordPress 10Web Social Photo Feed plugin <= 1.5.6 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-118080](https://insights.sbomify.com/CVE-2026-118080/): WordPress Social Snap plugin <= 1.5.4 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-118079](https://insights.sbomify.com/CVE-2026-118079/): WordPress FV Flowplayer Video Player plugin <= 8.3.4 - PHP Object Injection vulnerability (high 7.2)
- [CVE-2026-118078](https://insights.sbomify.com/CVE-2026-118078/): WordPress Product Catalog Feed by PixelYourSite plugin <= 3.1.4 - PHP Object Injection vulnerability (high 7.2)
- [CVE-2026-118077](https://insights.sbomify.com/CVE-2026-118077/): WordPress Sastra Essential Addons for Elementor plugin <= 1.2.3 - PHP Object Injection vulnerability (high 7.2)
- [CVE-2026-118076](https://insights.sbomify.com/CVE-2026-118076/): WordPress Frisbii Pay plugin <= 1.8.19 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-118075](https://insights.sbomify.com/CVE-2026-118075/): WordPress WP Media folders plugin <= 1.1.10 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-118074](https://insights.sbomify.com/CVE-2026-118074/): WordPress Finale Lite plugin <= 2.21.0 - PHP Object Injection vulnerability (high 7.2)
- [CVE-2026-118073](https://insights.sbomify.com/CVE-2026-118073/): WordPress News Kit Elementor Addons plugin <= 1.5.0 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-11807](https://insights.sbomify.com/CVE-2026-11807/): Eda-server: websocket missing authorization allows credential theft via activation_id spoofing (critical 9.6)
- [CVE-2026-11806](https://insights.sbomify.com/CVE-2026-11806/): IBM WebSphere Application Server Liberty is affected by a an arbitrary file read vulnerability (high 7.2)
- [CVE-2026-118040](https://insights.sbomify.com/CVE-2026-118040/): Improper Signature and Certificate Validation in Telerik Document Processing Libraries RadPdfProcessing (high 7.5)
- [CVE-2026-11804](https://insights.sbomify.com/CVE-2026-11804/): Program Module Vulnerability (medium 5.2)
- [CVE-2026-118039](https://insights.sbomify.com/CVE-2026-118039/): XML External Entity Reference in Telerik Document Processing Libraries SVG Image Processing (high 7.5)
- [CVE-2026-118038](https://insights.sbomify.com/CVE-2026-118038/): Path Traversal in Telerik Document Processing Libraries AI Agent Tools (high 7.1)
- [CVE-2026-118037](https://insights.sbomify.com/CVE-2026-118037/): Denial of service in Telerik Document Processing Libraries (high 7.5)
- [CVE-2026-118036](https://insights.sbomify.com/CVE-2026-118036/): Denial of service in Telerik Document Processing Libraries (high 7.5)
- [CVE-2026-118035](https://insights.sbomify.com/CVE-2026-118035/): Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadWordsProcessing (high 7.5)
- [CVE-2026-118030](https://insights.sbomify.com/CVE-2026-118030/): Keycloak-services: keycloak-services: hotp race condition allows single otp code reuse across concurrent logins (medium 4.2)
- [CVE-2026-11803](https://insights.sbomify.com/CVE-2026-11803/): PDF File Parsing Vulnerabilities in Certain Autodesk Desktop Products (high 7.8)
- [CVE-2026-118029](https://insights.sbomify.com/CVE-2026-118029/): Unverified ownership of the default Athena query result location in AWS SDK for pandas (medium 5.9)
- [CVE-2026-118027](https://insights.sbomify.com/CVE-2026-118027/): Frame poisoning in the Layout component (not scored)
- [CVE-2026-118026](https://insights.sbomify.com/CVE-2026-118026/): Invalid pointer in the JavaScript: GC component (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/893/