# Vulnerabilities published in 2026


- [CVE-2026-116856](https://insights.sbomify.com/CVE-2026-116856/): Missing authorization in Flexible Quantity – Measurement Price Calculator for WooCommerce (medium 5.3)
- [CVE-2026-116855](https://insights.sbomify.com/CVE-2026-116855/): WordPress My auctions allegro plugin <= 4.0.3 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-116850](https://insights.sbomify.com/CVE-2026-116850/): WordPress Happy Addons for Elementor plugin <= 3.50.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-11685](https://insights.sbomify.com/CVE-2026-11685/): Information disclosure in Chrome (medium 4.3)
- [CVE-2026-116849](https://insights.sbomify.com/CVE-2026-116849/): WordPress StreamCast plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-116848](https://insights.sbomify.com/CVE-2026-116848/): WordPress The Plus Addons for Elementor Page Builder Lite plugin <= 6.5.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-116846](https://insights.sbomify.com/CVE-2026-116846/): WordPress WP User Manager plugin <= 2.9.26 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-116844](https://insights.sbomify.com/CVE-2026-116844/): Fclairamb ftpserverlib through 0.32.4 Cleartext FTPES Data Transfer via PROT P (medium 6.3)
- [CVE-2026-116843](https://insights.sbomify.com/CVE-2026-116843/): Mistral Vibe before 3.0.3 RCE via Git Filter Drivers in Worktree Mode (high 8.7)
- [CVE-2026-116842](https://insights.sbomify.com/CVE-2026-116842/): DevilutionX 1.4.0 through 1.5.5 Heap Buffer Overflow via libmpq__archive_dup (medium 6.9)
- [CVE-2026-116841](https://insights.sbomify.com/CVE-2026-116841/): DevilutionX 1.4.0 through 1.5.5 Out-of-Bounds Read via libmpq Hash Table Lookup (medium 6.8)
- [CVE-2026-116840](https://insights.sbomify.com/CVE-2026-116840/): llama.cpp b5854 before b11275 Integer Overflow in gguf_init_from_reader (medium 6.9)
- [CVE-2026-11684](https://insights.sbomify.com/CVE-2026-11684/): Security feature bypass in Chrome (low 3.1)
- [CVE-2026-116839](https://insights.sbomify.com/CVE-2026-116839/): Cross-site request forgery in airMAX M (high 7.1)
- [CVE-2026-116838](https://insights.sbomify.com/CVE-2026-116838/): Cross-site request forgery in airMAX M (high 8.8)
- [CVE-2026-116837](https://insights.sbomify.com/CVE-2026-116837/): Memory corruption in LTU PTMP (high 8.8)
- [CVE-2026-116836](https://insights.sbomify.com/CVE-2026-116836/): Cross-site scripting in airMAX M (high 8.8)
- [CVE-2026-11683](https://insights.sbomify.com/CVE-2026-11683/): Use after free in Chrome (high 8.8)
- [CVE-2026-116829](https://insights.sbomify.com/CVE-2026-116829/): llama.cpp b10398 before b11301 Integer Overflow in gguf_init_from_reader (medium 6.9)
- [CVE-2026-116828](https://insights.sbomify.com/CVE-2026-116828/): YesWiki before 4.7.0 SQL Injection via despam.php INTERVAL operand (medium 6.9)
- [CVE-2026-116827](https://insights.sbomify.com/CVE-2026-116827/): YesWiki before 4.7.0 SSRF via copyUrlToLocalFile in Bazar CSV Import (high 8.2)
- [CVE-2026-116826](https://insights.sbomify.com/CVE-2026-116826/): YesWiki before 4.7.0 Authenticated SSRF via Page Duplication API downloadFile (high 8.2)
- [CVE-2026-116825](https://insights.sbomify.com/CVE-2026-116825/): YesWiki from 4.6.2 before 4.7.0 HTTP Signature Replay via ActivityPub Inbox (high 8.3)
- [CVE-2026-116824](https://insights.sbomify.com/CVE-2026-116824/): YesWiki before 4.7.0 Stored XSS via Referer Header in referrers_sites Handler (medium 5.3)
- [CVE-2026-116823](https://insights.sbomify.com/CVE-2026-116823/): YesWiki before 4.7.0 Reflected XSS via BazarField $_REQUEST Fallback (medium 5.3)
- [CVE-2026-116822](https://insights.sbomify.com/CVE-2026-116822/): YesWiki before 4.7.0 Template Traversal via BazarListeAction template Parameter (medium 6.9)
- [CVE-2026-116821](https://insights.sbomify.com/CVE-2026-116821/): YesWiki before 4.7.0 Read-ACL Bypass via SQL LIKE Wildcards in Usernames (high 7.1)
- [CVE-2026-116820](https://insights.sbomify.com/CVE-2026-116820/): YesWiki from 4.6.0 before 4.7.0 SQL Query Disclosure via showreq Parameter (medium 6.9)
- [CVE-2026-11682](https://insights.sbomify.com/CVE-2026-11682/): Security feature bypass in Chrome (high 8.3)
- [CVE-2026-116819](https://insights.sbomify.com/CVE-2026-116819/): OpenPanel before 3.0.0 Credential Disclosure via notification.rules Query (high 8.4)
- [CVE-2026-116818](https://insights.sbomify.com/CVE-2026-116818/): OpenPanel before 3.0.0 Unauthenticated ClickHouse SQL Injection via /live/visitors WebSocket (high 8.8)
- [CVE-2026-116817](https://insights.sbomify.com/CVE-2026-116817/): OpenPanel before 3.0.0 Missing Authentication on Worker Bull Board (medium 6.9)
- [CVE-2026-116816](https://insights.sbomify.com/CVE-2026-116816/): llama.cpp b5899 before b10261 Heap Out-of-Bounds Write via plamo2 Tokenizer (high 8.5)
- [CVE-2026-116815](https://insights.sbomify.com/CVE-2026-116815/): OpenPanel before 3.0.0 Improper ClickHouse Escaping in sankey.service.ts (medium 5.3)
- [CVE-2026-116814](https://insights.sbomify.com/CVE-2026-116814/): OpenPanel before 3.0.0 Sensitive Information Exposure via Application Logs (high 7.1)
- [CVE-2026-116813](https://insights.sbomify.com/CVE-2026-116813/): OpenPanel before 3.0.0 ClickHouse SQL Injection via conversion.service.ts (high 7.1)
- [CVE-2026-116812](https://insights.sbomify.com/CVE-2026-116812/): OpenPanel before 3.0.0 ClickHouse SQL Injection via cohort.preview profile filter (high 7.1)
- [CVE-2026-116811](https://insights.sbomify.com/CVE-2026-116811/): OpenPanel before 3.0.0 Sandbox Escape RCE via Webhook JavaScript Template (high 8.7)
- [CVE-2026-116810](https://insights.sbomify.com/CVE-2026-116810/): OpenPanel before 3.0.0 Missing Authorization via reference.getChartReferences (medium 6.9)
- [CVE-2026-11681](https://insights.sbomify.com/CVE-2026-11681/): Use after free in Chrome (high 8.8)
- [CVE-2026-116809](https://insights.sbomify.com/CVE-2026-116809/): OpenPanel before 3.0.0 Missing Authorization in event.bots tRPC Procedure (medium 6.9)
- [CVE-2026-116808](https://insights.sbomify.com/CVE-2026-116808/): OpenPanel before 3.0.0 ClickHouse SQL Injection via profile.values (high 8.6)
- [CVE-2026-116807](https://insights.sbomify.com/CVE-2026-116807/): OpenPanel before 3.0.0 ClickHouse SQL Injection via event.events tRPC Query (high 7.0)
- [CVE-2026-116806](https://insights.sbomify.com/CVE-2026-116806/): OpenPanel before 3.0.0 Privilege Escalation via onboarding.project tRPC Mutation (medium 5.3)
- [CVE-2026-116805](https://insights.sbomify.com/CVE-2026-116805/): OpenPanel before 3.0.0 Information Disclosure of Ingestion Secret Hashes via client.list (medium 5.3)
- [CVE-2026-116804](https://insights.sbomify.com/CVE-2026-116804/): DOMPurify from 3.4.4 before 3.4.17 SAFE_FOR_TEMPLATES Bypass via Shadow Root Content (medium 5.1)
- [CVE-2026-116803](https://insights.sbomify.com/CVE-2026-116803/): DOMPurify before 3.4.17 DOM XSS via IN_PLACE Hook-Detached Subtrees (medium 5.1)
- [CVE-2026-116802](https://insights.sbomify.com/CVE-2026-116802/): DOMPurify before 3.4.17 XSS via SMIL attributeName Guard Bypass in XHTML Mode (medium 5.1)
- [CVE-2026-116801](https://insights.sbomify.com/CVE-2026-116801/): Parse Server 9.0.0 before 9.10.5-alpha.6 ACL Bypass via $relatedTo Query (medium 5.3)
- [CVE-2026-116800](https://insights.sbomify.com/CVE-2026-116800/): WWBN AVideo before 29.5.0 Local PHP File Inclusion via Accept-Language Header (medium 6.9)
- [CVE-2026-11680](https://insights.sbomify.com/CVE-2026-11680/): Use after free in Chrome (high 8.8)
- [CVE-2026-1168](https://insights.sbomify.com/CVE-2026-1168/): Allocation of Resources Without Limits or Throttling in GitLab (high 7.5)
- [CVE-2026-116797](https://insights.sbomify.com/CVE-2026-116797/): Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute` (high 8.5)
- [CVE-2026-116796](https://insights.sbomify.com/CVE-2026-116796/): Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts (high 7.2)
- [CVE-2026-116795](https://insights.sbomify.com/CVE-2026-116795/): RE2JS: Quadratic-time denial of service in re2js lookbehind matching (high 7.5)
- [CVE-2026-116794](https://insights.sbomify.com/CVE-2026-116794/): Missing authorization in russh (high 8.3)
- [CVE-2026-11679](https://insights.sbomify.com/CVE-2026-11679/): Use after free in Chrome (high 8.3)
- [CVE-2026-11678](https://insights.sbomify.com/CVE-2026-11678/): Integer overflow in Chrome (medium 5.3)
- [CVE-2026-116778](https://insights.sbomify.com/CVE-2026-116778/): FOG: Authenticated low-privileged API user can modify Storage Nodes and reach root command execution (high 8.8)
- [CVE-2026-116776](https://insights.sbomify.com/CVE-2026-116776/): USB Test: Heap-based Buffer Overflow in getSectorSize via untrusted DISK_GEOMETRY.BytesPerSector leads to RCE/DoS (high 7.0)
- [CVE-2026-116775](https://insights.sbomify.com/CVE-2026-116775/): pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS) (low 2.3)
- [CVE-2026-116774](https://insights.sbomify.com/CVE-2026-116774/): russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang) (medium 4.3)
- [CVE-2026-116773](https://insights.sbomify.com/CVE-2026-116773/): russh's SSH client is susceptible to unbounded allocations via EXT_INFO packets (medium 4.3)
- [CVE-2026-11677](https://insights.sbomify.com/CVE-2026-11677/): Race condition in Chrome (high 8.3)
- [CVE-2026-116763](https://insights.sbomify.com/CVE-2026-116763/): Cross-site scripting in LiteSpeed Cache (medium 5.4)
- [CVE-2026-116761](https://insights.sbomify.com/CVE-2026-116761/): CMB2 <= 2.13.4 - Unauthenticated Stored Cross-Site Scripting via Grouped WYSIWYG Field via Front-End Form (medium 5.4)
- [CVE-2026-11676](https://insights.sbomify.com/CVE-2026-11676/): Security feature bypass in Chrome (high 8.3)
- [CVE-2026-116750](https://insights.sbomify.com/CVE-2026-116750/): SQL injection in VikRentCar Car Rental Management System (medium 6.5)
- [CVE-2026-11675](https://insights.sbomify.com/CVE-2026-11675/): Memory corruption in Chrome (low 3.1)
- [CVE-2026-116749](https://insights.sbomify.com/CVE-2026-116749/): Cross-site scripting in VikRentCar Car Rental Management System (medium 6.4)
- [CVE-2026-116748](https://insights.sbomify.com/CVE-2026-116748/): Transmission 4.0.0 before 4.1.3 Permissive CORS Leaks RPC Anti-CSRF Token (high 8.7)
- [CVE-2026-116747](https://insights.sbomify.com/CVE-2026-116747/): Kener 3.0.0 before 4.1.10 Authentication Bypass via Hardcoded Fallback JWT Secret (critical 9.2)
- [CVE-2026-116746](https://insights.sbomify.com/CVE-2026-116746/): QloApps 1.6.0 through 1.7.0 Unauthorized Hotel Review Submission via qlohotelreview (medium 6.9)
- [CVE-2026-116745](https://insights.sbomify.com/CVE-2026-116745/): QloApps through 1.7.0 Guest Order Disclosure via id_cart in Order Confirmation (medium 6.9)
- [CVE-2026-116744](https://insights.sbomify.com/CVE-2026-116744/): ntop nDPI through 6.0 Out-of-Bounds Read in SoftEther Dissector (medium 6.9)
- [CVE-2026-116743](https://insights.sbomify.com/CVE-2026-116743/): libyal libmsiecf through 20260525 Double Free via libmsiecf_url_values_read_data (medium 6.8)
- [CVE-2026-116742](https://insights.sbomify.com/CVE-2026-116742/): HTSlib through 1.24 Heap Out-of-Bounds Write via Truncated .gzi Index Count (medium 4.8)
- [CVE-2026-116741](https://insights.sbomify.com/CVE-2026-116741/): Speex through 1.2.1 Out-of-Bounds Write via speex_bits_read_whole_bytes (high 8.3)
- [CVE-2026-116740](https://insights.sbomify.com/CVE-2026-116740/): libcss through 0.9.2 NULL Pointer Dereference via Media-Query Parser (high 7.1)
- [CVE-2026-11674](https://insights.sbomify.com/CVE-2026-11674/): Use after free in Chrome (high 8.8)
- [CVE-2026-116739](https://insights.sbomify.com/CVE-2026-116739/): VMime through 0.9.2 Uninitialized Stack Memory Disclosure via uuencode Decoder (medium 5.3)
- [CVE-2026-116738](https://insights.sbomify.com/CVE-2026-116738/): VMime through 0.9.2 Stack-Based Buffer Overflow via uuencode Decoder (high 8.7)
- [CVE-2026-116737](https://insights.sbomify.com/CVE-2026-116737/): libphdi through 20260902 Heap Out-of-Bounds Read via Extent Data File Path (medium 6.9)
- [CVE-2026-116736](https://insights.sbomify.com/CVE-2026-116736/): libpff through 20260926 Heap Out-of-Bounds Read via libpff_table_read_values_array (medium 6.9)
- [CVE-2026-116735](https://insights.sbomify.com/CVE-2026-116735/): libpff through 20260926 Heap Out-of-Bounds Read via libpff_table_read_6c_record_entries (medium 6.9)
- [CVE-2026-116734](https://insights.sbomify.com/CVE-2026-116734/): flatcc through 0.6.4 Out-of-Bounds Read via verifier check_header (medium 6.3)
- [CVE-2026-116733](https://insights.sbomify.com/CVE-2026-116733/): flatcc through 0.6.4 Out-of-Bounds Read via __flatcc_json_parser_number (medium 6.3)
- [CVE-2026-116732](https://insights.sbomify.com/CVE-2026-116732/): libdwarf through 2.3.3 Heap Out-of-Bounds Read via dwarf_debug_addr_table (medium 4.8)
- [CVE-2026-116731](https://insights.sbomify.com/CVE-2026-116731/): Furnace through 0.6.8.3 Out-of-Bounds Write via FamiTracker GROOVES Block Import (medium 6.9)
- [CVE-2026-116730](https://insights.sbomify.com/CVE-2026-116730/): Furnace through 0.6.8.3 Out-of-Bounds Read via FamiTracker Module Import (medium 6.8)
- [CVE-2026-11673](https://insights.sbomify.com/CVE-2026-11673/): Use after free in Chrome (high 8.8)
- [CVE-2026-116729](https://insights.sbomify.com/CVE-2026-116729/): libfvde through 20260923 Heap Out-of-Bounds Read via libfvde_encrypted_metadata_read_type_0x001a (medium 4.8)
- [CVE-2026-116728](https://insights.sbomify.com/CVE-2026-116728/): libfvde through 20260923 Heap Out-of-Bounds Read via libfvde_encrypted_metadata_read_type_0x0024 (medium 6.8)
- [CVE-2026-116727](https://insights.sbomify.com/CVE-2026-116727/): gbsplay through 0.0.103 Heap Out-of-Bounds Read via vgm_open in gbs.c (medium 4.8)
- [CVE-2026-116726](https://insights.sbomify.com/CVE-2026-116726/): gbsplay through 0.0.103 Heap Out-of-Bounds Read via gbr_open GBR Title (medium 4.8)
- [CVE-2026-116725](https://insights.sbomify.com/CVE-2026-116725/): gbsplay through 0.0.103 Out-of-Bounds Read via mapper_map ROM Bank Index (medium 6.8)
- [CVE-2026-116724](https://insights.sbomify.com/CVE-2026-116724/): FLTK through 1.4.5 Heap Buffer Overflow via Fl_BMP_Image Integer Overflow (high 8.5)
- [CVE-2026-116723](https://insights.sbomify.com/CVE-2026-116723/): FLTK through 1.4.5 Stack Buffer Overflow via Fl_BMP_Image colors_used Field (high 8.5)
- [CVE-2026-11672](https://insights.sbomify.com/CVE-2026-11672/): Memory corruption in Chrome (high 8.3)
- [CVE-2026-11671](https://insights.sbomify.com/CVE-2026-11671/): Use after free in Chrome (critical 9.6)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/898/