# Vulnerabilities published in 2026


- [CVE-2026-114115](https://insights.sbomify.com/CVE-2026-114115/): Vyper 0.3.8 through 0.5.0b1 Memory Misread via Ternary Nested Array Selection (medium 6.3)
- [CVE-2026-114114](https://insights.sbomify.com/CVE-2026-114114/): Vyper through 0.5.0b1 Literal Value Substitution via Multi-byte Characters (medium 6.0)
- [CVE-2026-114113](https://insights.sbomify.com/CVE-2026-114113/): Sharp before 0.35.0 Multiple Vulnerabilities via Bundled libvips Image Decoders (high 8.4)
- [CVE-2026-114112](https://insights.sbomify.com/CVE-2026-114112/): Sharp before 0.35.4 RCE via bundled libheif AVIF decoding (high 8.9)
- [CVE-2026-114111](https://insights.sbomify.com/CVE-2026-114111/): Sharp before 0.35.5 RCE via librsvg Dependency Memory Vulnerability (high 8.9)
- [CVE-2026-114110](https://insights.sbomify.com/CVE-2026-114110/): Astral uv before 0.11.6 Arbitrary File Deletion via Wheel RECORD Entries (high 8.7)
- [CVE-2026-11411](https://insights.sbomify.com/CVE-2026-11411/): iAI Lab PDF AI App chatpdf.pro getExternalCacheDir path traversal (medium 4.8)
- [CVE-2026-114109](https://insights.sbomify.com/CVE-2026-114109/): uv before 0.11.15 Arbitrary File Write via Entry Point Names (high 8.7)
- [CVE-2026-114108](https://insights.sbomify.com/CVE-2026-114108/): HKUDS Vibe-Trading before 0.1.7 Missing Authentication in FastAPI Server Enabling RCE (critical 9.3)
- [CVE-2026-114107](https://insights.sbomify.com/CVE-2026-114107/): HKUDS Vibe-Trading 0.1.0 before 0.1.7 Indirect Prompt Injection RCE via BashTool and BackgroundRunTool (high 8.7)
- [CVE-2026-114106](https://insights.sbomify.com/CVE-2026-114106/): HKUDS Vibe-Trading 0.1.0 before 0.1.7 Path Traversal via read_document and safe_user_path (high 8.7)
- [CVE-2026-114105](https://insights.sbomify.com/CVE-2026-114105/): Adm-zip before 0.6.1 Privilege Escalation via keepOriginalPermission Setuid Bits (medium 6.9)
- [CVE-2026-114104](https://insights.sbomify.com/CVE-2026-114104/): adm-zip before 0.6.1 Duplicate ZIP Entry Name Validation Bypass (high 8.2)
- [CVE-2026-114103](https://insights.sbomify.com/CVE-2026-114103/): adm-zip 0.6.0 Decompression Bomb Guard Bypass via getDataAsync() (medium 6.9)
- [CVE-2026-114102](https://insights.sbomify.com/CVE-2026-114102/): adm-zip before 0.6.1 Denial of Service via inflateAsync Unhandled Error Event (high 8.7)
- [CVE-2026-114101](https://insights.sbomify.com/CVE-2026-114101/): Coraza before 3.8.1 Multipart filename* Charset Handling FILES Rule Bypass (medium 6.3)
- [CVE-2026-114100](https://insights.sbomify.com/CVE-2026-114100/): Coraza from 3.0.4 before 3.8.1 Request Body Inspection Bypass via Content-Type (medium 6.9)
- [CVE-2026-11410](https://insights.sbomify.com/CVE-2026-11410/): OS Command Injection in BigPond Cable (BPA) Configuration in TP-Link TL-WR940N (high 8.5)
- [CVE-2026-1141](https://insights.sbomify.com/CVE-2026-1141/): PHPGurukul News Portal Add Sub-Admin add-subadmins.php improper authorization (medium 5.3)
- [CVE-2026-114099](https://insights.sbomify.com/CVE-2026-114099/): Coraza 3.0.0 before 3.8.1 WAF Bypass via JSON Key Collision (medium 6.9)
- [CVE-2026-114098](https://insights.sbomify.com/CVE-2026-114098/): Dulwich 0.22.5 before 1.2.8 Path Traversal via Stash Pop Symlinks (high 7.3)
- [CVE-2026-114097](https://insights.sbomify.com/CVE-2026-114097/): Dulwich 0.23.1 before 1.2.8 Symlink Path Traversal via filter_branch Index Filter (high 7.3)
- [CVE-2026-114096](https://insights.sbomify.com/CVE-2026-114096/): Dulwich 0.24.0 before 1.2.8 Symlink Write-Through via porcelain.checkout paths (high 7.3)
- [CVE-2026-114095](https://insights.sbomify.com/CVE-2026-114095/): Dulwich before 1.2.9 Infinite Loop DoS via Pack.resolve_object (high 7.1)
- [CVE-2026-114094](https://insights.sbomify.com/CVE-2026-114094/): Dulwich before 1.2.9 Arbitrary File Write via DOS drive letter paths (high 8.7)
- [CVE-2026-114093](https://insights.sbomify.com/CVE-2026-114093/): Trigger.dev before 4.5.6 Cross-Site Request Forgery via /logout Endpoint (medium 5.3)
- [CVE-2026-114092](https://insights.sbomify.com/CVE-2026-114092/): Trigger.dev before 4.5.0 Missing Authentication in Dashboard Run Replay Action (high 8.3)
- [CVE-2026-114091](https://insights.sbomify.com/CVE-2026-114091/): Trigger.dev before 4.5.0 Cross-Tenant Run Payload Disclosure via API Replay Route (medium 6.0)
- [CVE-2026-114090](https://insights.sbomify.com/CVE-2026-114090/): Trigger.dev CLI 3.0.0 before 4.5.4 Missing Authentication in MCP Server (high 7.6)
- [CVE-2026-11409](https://insights.sbomify.com/CVE-2026-11409/): OS Command Injection in IPv6 PPPoE Configuration in TP-Link TL-WR940N (high 8.5)
- [CVE-2026-114089](https://insights.sbomify.com/CVE-2026-114089/): Trigger.dev before 4.5.2 CLI Auth-Code Phishing Leading to PAT Takeover (high 8.7)
- [CVE-2026-114088](https://insights.sbomify.com/CVE-2026-114088/): Trigger.dev before 4.5.4 Hardcoded Coordinator Secret Authentication Bypass via Socket.IO (high 8.3)
- [CVE-2026-114087](https://insights.sbomify.com/CVE-2026-114087/): Trigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default Secrets (critical 9.2)
- [CVE-2026-114086](https://insights.sbomify.com/CVE-2026-114086/): Trigger.dev before 4.5.5 Unauthenticated Realtime Stream Data Injection via Streams Endpoint (medium 6.9)
- [CVE-2026-114085](https://insights.sbomify.com/CVE-2026-114085/): Trigger.dev through 4.7.6 Missing Authentication in Supervisor Workload API (high 8.8)
- [CVE-2026-114084](https://insights.sbomify.com/CVE-2026-114084/): Trigger.dev before 4.5.6 SQL Injection via tags in Realtime Runs API (high 8.3)
- [CVE-2026-114083](https://insights.sbomify.com/CVE-2026-114083/): Trigger.dev before 4.5.0-rc.3 Path Traversal via Packets Presigned URL Endpoints (high 8.6)
- [CVE-2026-114082](https://insights.sbomify.com/CVE-2026-114082/): Trigger.dev before 4.6.2 Overly Broad Realtime Session Stream Credentials (high 7.2)
- [CVE-2026-114081](https://insights.sbomify.com/CVE-2026-114081/): Trigger.dev before 4.5.6 Cross-Tenant SQL Injection via TSQL Window-Function Name (high 8.3)
- [CVE-2026-114080](https://insights.sbomify.com/CVE-2026-114080/): Trigger.dev before 4.5.2 Blind SSRF via Alert-Channel Webhook URL (medium 5.3)
- [CVE-2026-11408](https://insights.sbomify.com/CVE-2026-11408/): vertex-app vertex Log Viewer Endpoint LogMod.js os command injection (medium 5.3)
- [CVE-2026-114079](https://insights.sbomify.com/CVE-2026-114079/): Trigger.dev before 4.5.6 Cross-Environment Deployment Cancel via Cancel Endpoint (medium 5.3)
- [CVE-2026-114078](https://insights.sbomify.com/CVE-2026-114078/): Trigger.dev before 4.5.6 Cross-Organization Schedule Deletion via Unscoped friendlyId Lookup (high 7.2)
- [CVE-2026-114077](https://insights.sbomify.com/CVE-2026-114077/): Trigger.dev before 4.5.6 Cross-Tenant Deployment Hijack via createDeploymentBackgroundWorkerV4 (medium 6.1)
- [CVE-2026-114076](https://insights.sbomify.com/CVE-2026-114076/): Trigger.dev before 4.5.2 Blind SSRF via Alert Channel Webhook URL (medium 5.3)
- [CVE-2026-114075](https://insights.sbomify.com/CVE-2026-114075/): Trigger.dev before 4.5.12 Authorization Bypass via Alert Channels API (medium 5.3)
- [CVE-2026-114074](https://insights.sbomify.com/CVE-2026-114074/): Trigger.dev before 4.5.10 Webhook SSRF Protection Bypass via 198.18.0.0/15 Range (medium 5.3)
- [CVE-2026-114073](https://insights.sbomify.com/CVE-2026-114073/): Trigger.dev CLI before 4.5.9 Secret Exposure via Debug Deployment Logs (medium 6.8)
- [CVE-2026-114072](https://insights.sbomify.com/CVE-2026-114072/): Trigger.dev before 4.5.12 CSRF via Slack OAuth Callback State (medium 5.3)
- [CVE-2026-114071](https://insights.sbomify.com/CVE-2026-114071/): Trigger.dev before 4.5.12 Authorization Bypass via Waitpoint Complete Route (low 2.3)
- [CVE-2026-114070](https://insights.sbomify.com/CVE-2026-114070/): Trigger.dev 4.5.0 before 4.6.0 Dashboard Agent User Token Disclosure via Session Records (medium 5.1)
- [CVE-2026-11407](https://insights.sbomify.com/CVE-2026-11407/): Pimcore CMS 12.3.8 Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed (high 8.6)
- [CVE-2026-114069](https://insights.sbomify.com/CVE-2026-114069/): Trigger.dev before 4.6.0 Root Secret Disclosure via envvars API Endpoint (high 8.6)
- [CVE-2026-114068](https://insights.sbomify.com/CVE-2026-114068/): Trigger.dev before 4.6.0 Missing Authorization via Waitpoint Token Wait Endpoint (high 7.2)
- [CVE-2026-114067](https://insights.sbomify.com/CVE-2026-114067/): Trigger.dev 4.5.0 before 4.6.2 Improper Authorization via snapshot-url Session Route (high 7.1)
- [CVE-2026-114066](https://insights.sbomify.com/CVE-2026-114066/): Trigger.dev before 4.7.0 Missing Authorization via Batch parentRunId Waitpoints (high 7.2)
- [CVE-2026-114065](https://insights.sbomify.com/CVE-2026-114065/): Trigger.dev before 4.7.3 Tenant Filtering Bypass via Query Table Placeholders (high 7.1)
- [CVE-2026-114064](https://insights.sbomify.com/CVE-2026-114064/): Snipe-IT before 8.7.0 SSRF Port Scanning via Webhook Testing Endpoint (medium 5.1)
- [CVE-2026-114063](https://insights.sbomify.com/CVE-2026-114063/): SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite preview on Windows (high 8.7)
- [CVE-2026-114062](https://insights.sbomify.com/CVE-2026-114062/): SvelteKit before 3.0.0 SSRF via Redirects in Server-Side Self-Fetch Fallbacks (medium 6.9)
- [CVE-2026-114061](https://insights.sbomify.com/CVE-2026-114061/): SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages (low 2.3)
- [CVE-2026-114060](https://insights.sbomify.com/CVE-2026-114060/): SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions (low 2.1)
- [CVE-2026-11406](https://insights.sbomify.com/CVE-2026-11406/): GL.iNet MT3000 OpenVPN Client Import Workflow ovpnclient.sh command injection (medium 5.3)
- [CVE-2026-114059](https://insights.sbomify.com/CVE-2026-114059/): ArcadeDB before 26.10.1 RCE via Gremlin Groovy Engine Missing Authorization (high 7.7)
- [CVE-2026-114058](https://insights.sbomify.com/CVE-2026-114058/): ArcadeDB from 26.2.1 before 26.10.1 Missing Authorization via Bolt Protocol (medium 5.3)
- [CVE-2026-114057](https://insights.sbomify.com/CVE-2026-114057/): ArcadeDB 26.2.1 before 26.10.1 Bolt SHOW DATABASES Information Disclosure (medium 5.3)
- [CVE-2026-114056](https://insights.sbomify.com/CVE-2026-114056/): ArcadeDB from 26.8.1 before 26.10.1 Authorization Bypass via ALTER TYPE WITH (medium 5.3)
- [CVE-2026-114055](https://insights.sbomify.com/CVE-2026-114055/): vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm_processor_kwargs (high 8.7)
- [CVE-2026-114054](https://insights.sbomify.com/CVE-2026-114054/): vLLM before 0.31.0 Cross-Request Cache Aliasing via EXIF ImageID and Prefix-Cache Keys (high 7.1)
- [CVE-2026-114053](https://insights.sbomify.com/CVE-2026-114053/): vLLM 0.7.3 before 0.31.0 RCE via mm_processor_kwargs.code_revision (critical 9.2)
- [CVE-2026-114052](https://insights.sbomify.com/CVE-2026-114052/): vLLM 0.25.0 before 0.31.0 MOSS-Audio Memory Exhaustion via /tokenize mm_processor_kwargs (high 8.7)
- [CVE-2026-114051](https://insights.sbomify.com/CVE-2026-114051/): vLLM before 0.31.0 Denial of Service via min_tokens in /inference/v1/generate (high 7.1)
- [CVE-2026-114050](https://insights.sbomify.com/CVE-2026-114050/): vLLM before 0.31.0 Remote Engine Crash via Forged Multimodal UUID (high 7.1)
- [CVE-2026-11405](https://insights.sbomify.com/CVE-2026-11405/): Hardcoded credentials in firmware (critical 9.8)
- [CVE-2026-114049](https://insights.sbomify.com/CVE-2026-114049/): vLLM before 0.31.0 Stale allowed_token_ids Mask via InputBatch.condense (medium 6.3)
- [CVE-2026-114048](https://insights.sbomify.com/CVE-2026-114048/): WWBN AVideo before 24.0 CSRF via Legacy Playlist and Video Endpoints (medium 5.1)
- [CVE-2026-114047](https://insights.sbomify.com/CVE-2026-114047/): FreeRDP 2.0.0 before 3.32.0 Proxy Improper TLS Certificate Validation (high 7.6)
- [CVE-2026-114046](https://insights.sbomify.com/CVE-2026-114046/): FreeRDP 3.0.0 before 3.32.0 null-pointer dereference via emulated smartcard (high 7.1)
- [CVE-2026-114045](https://insights.sbomify.com/CVE-2026-114045/): FreeRDP before 3.32.1 Heap Buffer Overflow via rdpsnd_server_select_format (high 8.7)
- [CVE-2026-114044](https://insights.sbomify.com/CVE-2026-114044/): FreeRDP before 3.32.1 Android Client Heap OOB Read via Graphics Pipeline (medium 6.9)
- [CVE-2026-114043](https://insights.sbomify.com/CVE-2026-114043/): Vulnerability in FreeRDP (high 7.1)
- [CVE-2026-114042](https://insights.sbomify.com/CVE-2026-114042/): FreeRDP 3.32.0 Use-After-Free via drdynvc Virtual Channel PDU (high 7.1)
- [CVE-2026-114041](https://insights.sbomify.com/CVE-2026-114041/): FreeRDP before 3.32.1 Heap Out-of-Bounds Read via RD Gateway Consent Message (medium 6.9)
- [CVE-2026-114040](https://insights.sbomify.com/CVE-2026-114040/): DT42 BerryNet Model Package Metadata dlmodelmgr.py DLModelManager.get_model_meta path traversal (medium 5.1)
- [CVE-2026-11404](https://insights.sbomify.com/CVE-2026-11404/): Cesanta Mongoose Out-of-Bounds Read in MG_TLS_BUILTIN ClientHello Session ID Parsing (high 8.7)
- [CVE-2026-114039](https://insights.sbomify.com/CVE-2026-114039/): projectworlds Advanced Library Management System report_search.php mysqli_query sql injection (medium 5.3)
- [CVE-2026-114038](https://insights.sbomify.com/CVE-2026-114038/): Device-mapper-multipath: device-mapper-multipath: information disclosure via malformed format string (medium 5.1)
- [CVE-2026-11403](https://insights.sbomify.com/CVE-2026-11403/): Nexus Repository Manager - Insufficient Entropy in Format-Specific API Key Generation (high 8.7)
- [CVE-2026-11402](https://insights.sbomify.com/CVE-2026-11402/): Services Section Block <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Block Attribute (medium 6.4)
- [CVE-2026-11401](https://insights.sbomify.com/CVE-2026-11401/): Privilege Escalation in AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL (high 8.6)
- [CVE-2026-11400](https://insights.sbomify.com/CVE-2026-11400/): Privilege Escalation in AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL (high 8.6)
- [CVE-2026-1140](https://insights.sbomify.com/CVE-2026-1140/): UTT 进取 520W ConfigExceptAli strcpy buffer overflow (high 8.7)
- [CVE-2026-11399](https://insights.sbomify.com/CVE-2026-11399/): Missing authorization in Helpdesk Support Ticket System for WooCommerce (medium 4.3)
- [CVE-2026-11398](https://insights.sbomify.com/CVE-2026-11398/): Missing authorization in LatePoint – Calendar Booking Plugin for Appointments and Events (medium 5.3)
- [CVE-2026-11397](https://insights.sbomify.com/CVE-2026-11397/): WP Import Export Lite <= 3.9.30 - Authenticated (Administrator+) Server-Side Request Forgery via 'file_url' Parameter (medium 5.5)
- [CVE-2026-113957](https://insights.sbomify.com/CVE-2026-113957/): Security feature bypass in container (not scored)
- [CVE-2026-113952](https://insights.sbomify.com/CVE-2026-113952/): Security feature bypass in Safari (not scored)
- [CVE-2026-113951](https://insights.sbomify.com/CVE-2026-113951/): Command injection in Container (not scored)
- [CVE-2026-113950](https://insights.sbomify.com/CVE-2026-113950/): Memory corruption in iOS and iPadOS (not scored)
- [CVE-2026-11395](https://insights.sbomify.com/CVE-2026-11395/): CF7 to Webhook <= 5.0.0 - Unauthenticated Server-Side Request Forgery via CF7 Field Placeholder in Webhook URL Host (high 7.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/911/