# Vulnerabilities published in 2026


- [CVE-2026-11670](https://insights.sbomify.com/CVE-2026-11670/): Use after free in Chrome (high 8.8)
- [CVE-2026-116696](https://insights.sbomify.com/CVE-2026-116696/): russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages (low 3.3)
- [CVE-2026-116695](https://insights.sbomify.com/CVE-2026-116695/): Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass (medium 5.3)
- [CVE-2026-116694](https://insights.sbomify.com/CVE-2026-116694/): OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation (medium 6.3)
- [CVE-2026-116693](https://insights.sbomify.com/CVE-2026-116693/): dd-trace: ReDOS in URL query string obfuscation (high 8.7)
- [CVE-2026-116692](https://insights.sbomify.com/CVE-2026-116692/): MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules (critical 9.8)
- [CVE-2026-116691](https://insights.sbomify.com/CVE-2026-116691/): MLflow CrewAI autologging records LLM provider API keys in logged trace spans (medium 6.5)
- [CVE-2026-116690](https://insights.sbomify.com/CVE-2026-116690/): MLflow: Arbitrary file read on unauthenticated MLflow servers via prompt model version source (high 7.5)
- [CVE-2026-11669](https://insights.sbomify.com/CVE-2026-11669/): Memory corruption in Chrome (medium 5.3)
- [CVE-2026-116689](https://insights.sbomify.com/CVE-2026-116689/): follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects (medium 5.9)
- [CVE-2026-116688](https://insights.sbomify.com/CVE-2026-116688/): CKEditor: Cross-site scripting (XSS) in the engine package (high 8.1)
- [CVE-2026-116687](https://insights.sbomify.com/CVE-2026-116687/): CKEditor: Cross-site scripting (XSS) in the engine package (low 3.1)
- [CVE-2026-116686](https://insights.sbomify.com/CVE-2026-116686/): Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas (medium 6.5)
- [CVE-2026-116685](https://insights.sbomify.com/CVE-2026-116685/): Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies (medium 5.9)
- [CVE-2026-116684](https://insights.sbomify.com/CVE-2026-116684/): Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server (medium 6.8)
- [CVE-2026-116683](https://insights.sbomify.com/CVE-2026-116683/): CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values (high 7.1)
- [CVE-2026-116682](https://insights.sbomify.com/CVE-2026-116682/): FileBrowser Quantum: Symlink following escapes user scope allowing arbitrary file read outside the served directory (high 8.6)
- [CVE-2026-116680](https://insights.sbomify.com/CVE-2026-116680/): Homebox generic notifier SSRF via HTTP redirect after URL validation (medium 6.4)
- [CVE-2026-11668](https://insights.sbomify.com/CVE-2026-11668/): Information disclosure in Chrome (medium 4.3)
- [CVE-2026-116679](https://insights.sbomify.com/CVE-2026-116679/): Neko: Authorization bypass in legacy WebRTC input handling (medium 5.4)
- [CVE-2026-116678](https://insights.sbomify.com/CVE-2026-116678/): Vaultwarden: Icon endpoint SSRF fix bypass via second-stage favicon IP literal URLs (medium 5.8)
- [CVE-2026-116677](https://insights.sbomify.com/CVE-2026-116677/): OpenWISP Controller CA CRL REST API does not scope requests to managed organizations (medium 5.3)
- [CVE-2026-116676](https://insights.sbomify.com/CVE-2026-116676/): Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan (high 8.8)
- [CVE-2026-116675](https://insights.sbomify.com/CVE-2026-116675/): TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization (high 8.5)
- [CVE-2026-116674](https://insights.sbomify.com/CVE-2026-116674/): systeminformation: Prototype pollution in `networkStats()` via the interface name (medium 6.5)
- [CVE-2026-116673](https://insights.sbomify.com/CVE-2026-116673/): systeminformation: Path traversal in Linux networkStats() allows symlink-based file disclosure outside /sys/class/net (low 3.3)
- [CVE-2026-116672](https://insights.sbomify.com/CVE-2026-116672/): Authlib RFC 7592 examples omit registration-access-token client binding (high 8.8)
- [CVE-2026-116671](https://insights.sbomify.com/CVE-2026-116671/): Infinite loop in Xpdf due to missing validation in JPEG 2000 decoder (low 2.1)
- [CVE-2026-11667](https://insights.sbomify.com/CVE-2026-11667/): Memory corruption in Chrome (high 7.5)
- [CVE-2026-116662](https://insights.sbomify.com/CVE-2026-116662/): Tanium addressed a compression bomb vulnerability in Enforce. (high 7.5)
- [CVE-2026-116660](https://insights.sbomify.com/CVE-2026-116660/): Tanium addressed an improper access controls vulnerability in Enforce. (medium 4.3)
- [CVE-2026-11666](https://insights.sbomify.com/CVE-2026-11666/): Other in Chrome (medium 5.4)
- [CVE-2026-116659](https://insights.sbomify.com/CVE-2026-116659/): Tanium addressed an uncontrolled resource consumption vulnerability in Enforce. (medium 4.3)
- [CVE-2026-116658](https://insights.sbomify.com/CVE-2026-116658/): Tanium addressed a denial of service vulnerability in Enforce. (medium 6.5)
- [CVE-2026-116657](https://insights.sbomify.com/CVE-2026-116657/): Tanium addressed a denial of service vulnerability in Enforce. (medium 5.3)
- [CVE-2026-116656](https://insights.sbomify.com/CVE-2026-116656/): Tanium addressed an uncontrolled resource consumption vulnerability in Enforce. (high 7.5)
- [CVE-2026-11665](https://insights.sbomify.com/CVE-2026-11665/): Memory corruption in Chrome (medium 4.3)
- [CVE-2026-116649](https://insights.sbomify.com/CVE-2026-116649/): Tanium addressed an improper output sanitization vulnerability in Enforce. (high 7.1)
- [CVE-2026-116647](https://insights.sbomify.com/CVE-2026-116647/): Tanium addressed an improper output sanitization vulnerability in Comply. (high 7.1)
- [CVE-2026-116641](https://insights.sbomify.com/CVE-2026-116641/): The DB Tools trust certificates issued by recoverable eMudhra intermediate CAs (high 7.6)
- [CVE-2026-116640](https://insights.sbomify.com/CVE-2026-116640/): Saruf-Ratul HR-Payroll-Management-System chat.php cross site scripting (medium 5.1)
- [CVE-2026-11664](https://insights.sbomify.com/CVE-2026-11664/): Use after free in Chrome (high 8.8)
- [CVE-2026-116639](https://insights.sbomify.com/CVE-2026-116639/): MD-MAFUJUL-HASAN Online-Payroll-Management-System chat.php cross site scripting (medium 5.1)
- [CVE-2026-116638](https://insights.sbomify.com/CVE-2026-116638/): The Windows Recovery Environment (WinRE) in Windows 10 and 11 may allow an attacker to bypass firmware security controls, including administ (not scored)
- [CVE-2026-116634](https://insights.sbomify.com/CVE-2026-116634/): OmniRoute 3.8.50 before 3.8.52 Missing Authentication via /api/sync/tokens (high 8.2)
- [CVE-2026-116632](https://insights.sbomify.com/CVE-2026-116632/): Facetime protocol handler enabled spoofing (medium 5.4)
- [CVE-2026-116631](https://insights.sbomify.com/CVE-2026-116631/): External protocol handler (tel:) address bar spoof (medium 5.4)
- [CVE-2026-11663](https://insights.sbomify.com/CVE-2026-11663/): Use after free in Chrome (high 8.3)
- [CVE-2026-116627](https://insights.sbomify.com/CVE-2026-116627/): Cross-site scripting in PowerShell Universal (not scored)
- [CVE-2026-116623](https://insights.sbomify.com/CVE-2026-116623/): code-projects Simple Content Management System Admin welcome.php authorization (medium 6.9)
- [CVE-2026-116620](https://insights.sbomify.com/CVE-2026-116620/): Tencent RapidJSON Regex stream.h Take out-of-bounds (medium 6.9)
- [CVE-2026-11662](https://insights.sbomify.com/CVE-2026-11662/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-116613](https://insights.sbomify.com/CVE-2026-116613/): Missing authorization in Animated Text Block – Add Typing and Looping Text Effects (high 7.5)
- [CVE-2026-116612](https://insights.sbomify.com/CVE-2026-116612/): Code injection in gst-editing-services (high 7.8)
- [CVE-2026-116610](https://insights.sbomify.com/CVE-2026-116610/): Missing authorization in Clean Login (medium 4.3)
- [CVE-2026-11661](https://insights.sbomify.com/CVE-2026-11661/): Use after free in Chrome (high 8.3)
- [CVE-2026-116609](https://insights.sbomify.com/CVE-2026-116609/): SQL injection in WP Visitor Statistics (Real Time Traffic) (medium 6.5)
- [CVE-2026-116608](https://insights.sbomify.com/CVE-2026-116608/): DAMO Academy VideoLLaMA2 Model Loading __init__.py load_pretrained_model integrity check (medium 5.3)
- [CVE-2026-116605](https://insights.sbomify.com/CVE-2026-116605/): SourceCodester Online Food Ordering System order.php client-side enforcement of server-side security (medium 6.9)
- [CVE-2026-116604](https://insights.sbomify.com/CVE-2026-116604/): SourceCodester Online Food Ordering System delete_admin.php missing authentication (medium 6.9)
- [CVE-2026-116603](https://insights.sbomify.com/CVE-2026-116603/): SourceCodester Online Food Ordering System add_food.php unrestricted upload (medium 5.1)
- [CVE-2026-116602](https://insights.sbomify.com/CVE-2026-116602/): SourceCodester Online Food Ordering System delete.php unlink path traversal (medium 6.9)
- [CVE-2026-11660](https://insights.sbomify.com/CVE-2026-11660/): Security feature bypass in Chrome (high 8.3)
- [CVE-2026-1166](https://insights.sbomify.com/CVE-2026-1166/): Open Redirect Vulnerability in Hitachi Ops Center Administrator (medium 4.3)
- [CVE-2026-116596](https://insights.sbomify.com/CVE-2026-116596/): CVE-2026-116596 (not scored)
- [CVE-2026-116593](https://insights.sbomify.com/CVE-2026-116593/): Apache Kafka: Kafka Connect configuration provider values exposed via validation REST API endpoint (not scored)
- [CVE-2026-116591](https://insights.sbomify.com/CVE-2026-116591/): compress zstd: Panic on two-block frames (high 8.7)
- [CVE-2026-116590](https://insights.sbomify.com/CVE-2026-116590/): snappy-java: JVM crash from unchecked ranges in Snappy.arrayCopy and SnappyOutputStream.rawWrite (medium 5.9)
- [CVE-2026-11659](https://insights.sbomify.com/CVE-2026-11659/): Integer overflow in Chrome (critical 9.6)
- [CVE-2026-116589](https://insights.sbomify.com/CVE-2026-116589/): Datadog dd-trace-py: IAST instrumentation can lead to application DOS (high 8.2)
- [CVE-2026-116588](https://insights.sbomify.com/CVE-2026-116588/): Datadog dd-trace-py: ReDOS in URL query string obfuscation (high 8.7)
- [CVE-2026-116587](https://insights.sbomify.com/CVE-2026-116587/): Go JOSE: DoS when parsing JWKs that contain RSA keys (high 7.5)
- [CVE-2026-116586](https://insights.sbomify.com/CVE-2026-116586/): Go JOSE: Panics in JSON parsing (medium 6.9)
- [CVE-2026-116585](https://insights.sbomify.com/CVE-2026-116585/): Go JOSE: Panic during CBC-HMAC processing (medium 6.9)
- [CVE-2026-116584](https://insights.sbomify.com/CVE-2026-116584/): Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length (high 7.5)
- [CVE-2026-116583](https://insights.sbomify.com/CVE-2026-116583/): Seroval: Code injection through a typed array's own constructor property (medium 5.3)
- [CVE-2026-116582](https://insights.sbomify.com/CVE-2026-116582/): Seroval: Script injection through RegExp sources in serialized output (medium 4.7)
- [CVE-2026-116581](https://insights.sbomify.com/CVE-2026-116581/): Seroval: fromJSON deserializer trusts sequence doneAt (unauthenticated event-loop DoS) (high 7.5)
- [CVE-2026-116580](https://insights.sbomify.com/CVE-2026-116580/): Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check (high 7.3)
- [CVE-2026-11658](https://insights.sbomify.com/CVE-2026-11658/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-116579](https://insights.sbomify.com/CVE-2026-116579/): Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566) (medium 5.9)
- [CVE-2026-116578](https://insights.sbomify.com/CVE-2026-116578/): Tornado: Open redirect in RedirectHandler via protocol-relative URLs (low 2.1)
- [CVE-2026-116577](https://insights.sbomify.com/CVE-2026-116577/): Tornado: Quadratic CPU usage when parsing HTTP headers with line folding (medium 5.3)
- [CVE-2026-116576](https://insights.sbomify.com/CVE-2026-116576/): systeminformation: Windows command injection in services() through Unicode quotation marks (high 7.8)
- [CVE-2026-116575](https://insights.sbomify.com/CVE-2026-116575/): Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope) (medium 6.3)
- [CVE-2026-11657](https://insights.sbomify.com/CVE-2026-11657/): Use after free in Chrome (high 8.8)
- [CVE-2026-116566](https://insights.sbomify.com/CVE-2026-116566/): socket.getaddrinfo() accepts embedded null bytes in host and port (medium 5.3)
- [CVE-2026-11656](https://insights.sbomify.com/CVE-2026-11656/): Use after free in Chrome (high 8.3)
- [CVE-2026-116556](https://insights.sbomify.com/CVE-2026-116556/): Argilla TextField.vue cross site scripting (medium 4.8)
- [CVE-2026-116555](https://insights.sbomify.com/CVE-2026-116555/): Argilla Sandbox.vue cross site scripting (medium 4.8)
- [CVE-2026-116554](https://insights.sbomify.com/CVE-2026-116554/): Argilla Settings SettingsInfo.vue Dataset.from_disk cross site scripting (medium 5.1)
- [CVE-2026-11655](https://insights.sbomify.com/CVE-2026-11655/): Integer overflow in Chrome (high 8.3)
- [CVE-2026-116544](https://insights.sbomify.com/CVE-2026-116544/): Open5GS 2.6.1 through 2.8.0 Out-of-Bounds Read via parse_scheme_output (medium 6.3)
- [CVE-2026-116543](https://insights.sbomify.com/CVE-2026-116543/): Open5GS 1.3.0 through 2.8.0 Heap Out-of-Bounds Write via SBI Multipart Parser (high 8.7)
- [CVE-2026-116542](https://insights.sbomify.com/CVE-2026-116542/): Netty netty-tcnative before 2.0.84.Final SNI Hostname Spoofing via Modified UTF-8 Decoding (medium 6.9)
- [CVE-2026-116541](https://insights.sbomify.com/CVE-2026-116541/): netty-tcnative before 2.0.84.Final Denial of Service via BIO Write Overcount (high 8.2)
- [CVE-2026-116540](https://insights.sbomify.com/CVE-2026-116540/): netty-tcnative 2.0.66.Final before 2.0.84.Final Use-After-Free in Session Ticket Callback (high 8.2)
- [CVE-2026-11654](https://insights.sbomify.com/CVE-2026-11654/): Use after free in Chrome (critical 9.6)
- [CVE-2026-116539](https://insights.sbomify.com/CVE-2026-116539/): Netty netty-tcnative before 2.0.84.Final Heap Buffer Overflow via OpenSSL BIO (high 8.2)
- [CVE-2026-116538](https://insights.sbomify.com/CVE-2026-116538/): HtmlSanitizer before 9.2.1039 XSS via SanitizeDom Body and HTML Attributes (low 2.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/899/