# Vulnerabilities published in 2026


- [CVE-2026-116531](https://insights.sbomify.com/CVE-2026-116531/): HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunk. (not scored)
- [CVE-2026-11653](https://insights.sbomify.com/CVE-2026-11653/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-11652](https://insights.sbomify.com/CVE-2026-11652/): Use after free in Chrome (high 8.3)
- [CVE-2026-116516](https://insights.sbomify.com/CVE-2026-116516/): Insufficient length validation when parsing Zoom chat transcriptions (medium 6.5)
- [CVE-2026-116515](https://insights.sbomify.com/CVE-2026-116515/): itsourcecode Online Book Store book.php sql injection (medium 5.3)
- [CVE-2026-116514](https://insights.sbomify.com/CVE-2026-116514/): itsourcecode Airline Reservation System book_flight.php cross site scripting (medium 5.3)
- [CVE-2026-11651](https://insights.sbomify.com/CVE-2026-11651/): Use after free in Chrome (critical 9.6)
- [CVE-2026-116508](https://insights.sbomify.com/CVE-2026-116508/): TOTOLINK A950RG Device-Information CGI infostat.cgi sub_402340 stack-based overflow (critical 10.0)
- [CVE-2026-116507](https://insights.sbomify.com/CVE-2026-116507/): TOTOLINK A950RG global.so getLanguageCfg information disclosure (medium 6.9)
- [CVE-2026-116506](https://insights.sbomify.com/CVE-2026-116506/): TOTOLINK A950RG firewall.so apmib_set command injection (critical 9.4)
- [CVE-2026-116505](https://insights.sbomify.com/CVE-2026-116505/): TOTOLINK A950RG device-information udhcpd.leases getDeviceInfo command injection (critical 9.4)
- [CVE-2026-116504](https://insights.sbomify.com/CVE-2026-116504/): TOTOLINK A950RG Cloud Upgrade upgrade.so setCloudUpgradeFW command injection (critical 9.4)
- [CVE-2026-116502](https://insights.sbomify.com/CVE-2026-116502/): turboderp-org ExLlamaV2 GPTQ Index q_matrix.cu make_sequential out-of-bounds write (medium 4.8)
- [CVE-2026-11650](https://insights.sbomify.com/CVE-2026-11650/): Use after free in Chrome (high 8.8)
- [CVE-2026-1165](https://insights.sbomify.com/CVE-2026-1165/): Popup Box <= 6.1.1 - Cross-Site Request Forgery to Popup Status Change (medium 4.3)
- [CVE-2026-116497](https://insights.sbomify.com/CVE-2026-116497/): Gssproxy: gssproxy: null pointer dereference in gssx_init_sec_context crashes daemon (medium 5.5)
- [CVE-2026-116492](https://insights.sbomify.com/CVE-2026-116492/): Frappe CRM before 1.89.1 Missing Authorization via Phone Lookup API (high 7.1)
- [CVE-2026-11649](https://insights.sbomify.com/CVE-2026-11649/): Use after free in Chrome (high 8.8)
- [CVE-2026-116489](https://insights.sbomify.com/CVE-2026-116489/): Timescale pgvectorscale before 0.9.1 Type Confusion via Unqualified DiskANN Operator Classes (high 7.7)
- [CVE-2026-116488](https://insights.sbomify.com/CVE-2026-116488/): NXP MCUXpresso SDK USB Middleware before 2.13.0 Heap Overflow via Host Class Drivers (high 7.0)
- [CVE-2026-116487](https://insights.sbomify.com/CVE-2026-116487/): NXP MCUXpresso SDK USB Middleware before 2.13.0 RNDIS Out-of-Bounds Read (medium 5.1)
- [CVE-2026-116486](https://insights.sbomify.com/CVE-2026-116486/): Objenesis before 3.6 Type Confusion via Class Name Instantiator Cache (low 2.0)
- [CVE-2026-116485](https://insights.sbomify.com/CVE-2026-116485/): danmu_api before 1.21.7 Authentication Bypass via Default Token in Env Endpoints (critical 9.3)
- [CVE-2026-116482](https://insights.sbomify.com/CVE-2026-116482/): subhajitkhan online-clinic-management-system patientregistration.php cross site scripting (medium 5.1)
- [CVE-2026-11648](https://insights.sbomify.com/CVE-2026-11648/): Use after free in Chrome (high 8.8)
- [CVE-2026-116479](https://insights.sbomify.com/CVE-2026-116479/): a2aproject a2a-java JSON-RPC Error getMessage information exposure (medium 5.3)
- [CVE-2026-116478](https://insights.sbomify.com/CVE-2026-116478/): a2aproject a2a-go Push Notification agentexec.go CreateExecutor information exposure (medium 6.9)
- [CVE-2026-116477](https://insights.sbomify.com/CVE-2026-116477/): a2aproject a2a-dotnet Parser A2AJsonRpcProcessor.cs A2AJsonRpcProcessor.ProcessRequestAsync information exposure (medium 5.3)
- [CVE-2026-116476](https://insights.sbomify.com/CVE-2026-116476/): a2aproject a2a-dotnet TaskProjection TaskProjection.ApplyStatus race condition (medium 5.3)
- [CVE-2026-116471](https://insights.sbomify.com/CVE-2026-116471/): BKWLD Decoy Authorization Policy Policy.php privileges management (medium 5.3)
- [CVE-2026-11647](https://insights.sbomify.com/CVE-2026-11647/): Use after free in Chrome (high 8.3)
- [CVE-2026-116469](https://insights.sbomify.com/CVE-2026-116469/): MISP Guard Case-Sensitive Policy Bypass Allows Unauthorized Feed Data Forwarding (high 7.1)
- [CVE-2026-116467](https://insights.sbomify.com/CVE-2026-116467/): ggml-org llama.cpp Mirostat Sampler llama-sampler.cpp assertion (medium 6.9)
- [CVE-2026-116463](https://insights.sbomify.com/CVE-2026-116463/): FastStone Image Viewer Box-Average Downsampler FUN_0062d96c out-of-bounds (medium 5.3)
- [CVE-2026-116461](https://insights.sbomify.com/CVE-2026-116461/): Omega Solution Restro POS sale-invoice logic error (medium 5.3)
- [CVE-2026-11646](https://insights.sbomify.com/CVE-2026-11646/): Use after free in Chrome (high 8.8)
- [CVE-2026-11645](https://insights.sbomify.com/CVE-2026-11645/): Google Chromium V8 Out-of-Bounds Read and Write (high 8.8, exploited in the wild)
- [CVE-2026-11644](https://insights.sbomify.com/CVE-2026-11644/): Use after free in Chrome (high 7.5)
- [CVE-2026-11643](https://insights.sbomify.com/CVE-2026-11643/): Use after free in Chrome (high 8.1)
- [CVE-2026-11642](https://insights.sbomify.com/CVE-2026-11642/): Use after free in Chrome (high 8.3)
- [CVE-2026-11641](https://insights.sbomify.com/CVE-2026-11641/): Use after free in Chrome (high 7.5)
- [CVE-2026-116409](https://insights.sbomify.com/CVE-2026-116409/): WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.6 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-116408](https://insights.sbomify.com/CVE-2026-116408/): WordPress Gallery PhotoBlocks plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-116406](https://insights.sbomify.com/CVE-2026-116406/): WordPress Webba Booking plugin <= 6.5.4 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-116404](https://insights.sbomify.com/CVE-2026-116404/): WordPress Redux Framework plugin <= 4.5.16 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-116403](https://insights.sbomify.com/CVE-2026-116403/): WordPress Easy Digital Downloads plugin <= 3.7.1 - Race Condition vulnerability (medium 5.9)
- [CVE-2026-116402](https://insights.sbomify.com/CVE-2026-116402/): WordPress SureForms plugin <= 2.12.9 - Content Injection vulnerability (medium 5.3)
- [CVE-2026-116400](https://insights.sbomify.com/CVE-2026-116400/): WordPress Button Block plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-11640](https://insights.sbomify.com/CVE-2026-11640/): Integer overflow in Chrome (high 8.3)
- [CVE-2026-1164](https://insights.sbomify.com/CVE-2026-1164/): Easy Voice Mail <= 1.2.5 - Unauthenticated Stored Cross-Site Scripting via 'message' (medium 6.1)
- [CVE-2026-116399](https://insights.sbomify.com/CVE-2026-116399/): WordPress InstaWP Connect plugin <= 0.1.4.2 - Cross Site Request Forgery (CSRF) vulnerability (high 8.8)
- [CVE-2026-116398](https://insights.sbomify.com/CVE-2026-116398/): WordPress Content Slider Block plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-116396](https://insights.sbomify.com/CVE-2026-116396/): WordPress Amelia plugin <= 2.4.12 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-116395](https://insights.sbomify.com/CVE-2026-116395/): WordPress LightBox Block plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-116394](https://insights.sbomify.com/CVE-2026-116394/): WordPress WpEvently plugin <= 5.7.9 - Content Injection vulnerability (medium 5.3)
- [CVE-2026-116393](https://insights.sbomify.com/CVE-2026-116393/): WordPress Optima Express + MarketBoost IDX Plugin plugin <= 8.7.8 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-116392](https://insights.sbomify.com/CVE-2026-116392/): WordPress Accordion plugin <= 2.3.25 - PHP Object Injection vulnerability (high 7.2)
- [CVE-2026-116391](https://insights.sbomify.com/CVE-2026-116391/): WordPress GS Logo Slider plugin <= 3.8.9 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-116390](https://insights.sbomify.com/CVE-2026-116390/): WordPress Filter Everything — WordPress & WooCommerce Filters plugin <= 1.9.7 - PHP Object Injection vulnerability (high 7.2)
- [CVE-2026-11639](https://insights.sbomify.com/CVE-2026-11639/): Use after free in Chrome (high 7.5)
- [CVE-2026-116389](https://insights.sbomify.com/CVE-2026-116389/): WordPress Phoenix Media Rename plugin <= 3.13.5 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-116388](https://insights.sbomify.com/CVE-2026-116388/): WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-116387](https://insights.sbomify.com/CVE-2026-116387/): WordPress SureForms plugin <= 2.12.9 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-116385](https://insights.sbomify.com/CVE-2026-116385/): Bdtask Garage 24 Garage Management Software Profile edit_profile cross site scripting (medium 5.1)
- [CVE-2026-116384](https://insights.sbomify.com/CVE-2026-116384/): Bdtask Garage 24 Garage Management Software Backend improper authorization (medium 5.3)
- [CVE-2026-11638](https://insights.sbomify.com/CVE-2026-11638/): Use after free in Chrome (critical 9.6)
- [CVE-2026-116372](https://insights.sbomify.com/CVE-2026-116372/): MISP mispguard: Feed responses with 2xx status codes other than 200 bypass filtering rules (high 7.7)
- [CVE-2026-116371](https://insights.sbomify.com/CVE-2026-116371/): Akuvox Akubela HyPanel PS51 login improper authentication (medium 5.3)
- [CVE-2026-116370](https://insights.sbomify.com/CVE-2026-116370/): 2K Games Sid Meier's Civilization VI Lua sandbox loadstring type confusion (medium 5.3)
- [CVE-2026-11637](https://insights.sbomify.com/CVE-2026-11637/): Use after free in Chrome (high 8.8)
- [CVE-2026-116369](https://insights.sbomify.com/CVE-2026-116369/): Sunwood-ai-labs github-kanban-mcp-server issue-handlers.ts handleListIssues os command injection (medium 5.3)
- [CVE-2026-116368](https://insights.sbomify.com/CVE-2026-116368/): DeepSeek Harness Browser Auth browser-auth.ts improper authorization (medium 6.9)
- [CVE-2026-116367](https://insights.sbomify.com/CVE-2026-116367/): DeepSeek Harness sandbox.ts createContext (medium 5.3)
- [CVE-2026-11636](https://insights.sbomify.com/CVE-2026-11636/): Use after free in Chrome (high 7.5)
- [CVE-2026-11635](https://insights.sbomify.com/CVE-2026-11635/): Use after free in Chrome (high 8.3)
- [CVE-2026-116340](https://insights.sbomify.com/CVE-2026-116340/): Missing authorization in astron-agent (medium 5.3)
- [CVE-2026-11634](https://insights.sbomify.com/CVE-2026-11634/): Use after free in Chrome (critical 9.6)
- [CVE-2026-116339](https://insights.sbomify.com/CVE-2026-116339/): iFlytek astron-agent DDL Whitelist exec_ddl.py incomplete blacklist (medium 6.9)
- [CVE-2026-11633](https://insights.sbomify.com/CVE-2026-11633/): Use after free in Chrome (high 8.8)
- [CVE-2026-11632](https://insights.sbomify.com/CVE-2026-11632/): Use after free in Chrome (high 7.5)
- [CVE-2026-11631](https://insights.sbomify.com/CVE-2026-11631/): Use after free in Chrome (high 8.3)
- [CVE-2026-11630](https://insights.sbomify.com/CVE-2026-11630/): Use after free in Chrome (high 8.8)
- [CVE-2026-1163](https://insights.sbomify.com/CVE-2026-1163/): Insufficient Session Expiration in parisneo/lollms (medium 4.1)
- [CVE-2026-11629](https://insights.sbomify.com/CVE-2026-11629/): Use after free in Chrome (high 8.8)
- [CVE-2026-116285](https://insights.sbomify.com/CVE-2026-116285/): HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. (not scored)
- [CVE-2026-116284](https://insights.sbomify.com/CVE-2026-116284/): Kameleo Local API user-info information disclosure (medium 5.3)
- [CVE-2026-116283](https://insights.sbomify.com/CVE-2026-116283/): Kameleo Local API profiles information disclosure (medium 5.3)
- [CVE-2026-116282](https://insights.sbomify.com/CVE-2026-116282/): Kameleo Cookie Controller w.cs CookieController.ListCookies information disclosure (medium 5.3)
- [CVE-2026-116281](https://insights.sbomify.com/CVE-2026-116281/): Kameleo Profile Controller t.cs ListProfiles information disclosure (medium 4.8)
- [CVE-2026-116280](https://insights.sbomify.com/CVE-2026-116280/): Kameleo Proxy Validation f.cs InternalController.TestProxy server-side request forgery (medium 5.1)
- [CVE-2026-11628](https://insights.sbomify.com/CVE-2026-11628/): Use after free in Chrome (medium 6.8)
- [CVE-2026-116275](https://insights.sbomify.com/CVE-2026-116275/): AllenAI AllenNLP Registrable Configuration Machinery registrable.py Registrable.resolve_class_name code injection (medium 5.3)
- [CVE-2026-116274](https://insights.sbomify.com/CVE-2026-116274/): JIZHICMS Front-end Order OrderController.php pay improper authorization (medium 5.3)
- [CVE-2026-116273](https://insights.sbomify.com/CVE-2026-116273/): MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustion. (not scored)
- [CVE-2026-116272](https://insights.sbomify.com/CVE-2026-116272/): MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested comment. (not scored)
- [CVE-2026-116271](https://insights.sbomify.com/CVE-2026-116271/): MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users r (not scored)
- [CVE-2026-116270](https://insights.sbomify.com/CVE-2026-116270/): MIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated "=?" sequences in decode_mimewords (not scored)
- [CVE-2026-116269](https://insights.sbomify.com/CVE-2026-116269/): MIME::Field::ParamVal versions before 5.521 for Perl turn an RFC 2231 filename with a hyphenated language tag into an empty recommended filename. (not scored)
- [CVE-2026-116268](https://insights.sbomify.com/CVE-2026-116268/): MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parameters (not scored)
- [CVE-2026-116267](https://insights.sbomify.com/CVE-2026-116267/): MIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented error messages from a truncated, deeply nested message. (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/900/