# Vulnerabilities published in 2026


- [CVE-2026-113949](https://insights.sbomify.com/CVE-2026-113949/): Memory corruption in Safari (not scored)
- [CVE-2026-113948](https://insights.sbomify.com/CVE-2026-113948/): Security feature bypass in macOS (not scored)
- [CVE-2026-113947](https://insights.sbomify.com/CVE-2026-113947/): Privilege escalation in macOS (high 8.8)
- [CVE-2026-113946](https://insights.sbomify.com/CVE-2026-113946/): Memory corruption in macOS (not scored)
- [CVE-2026-113945](https://insights.sbomify.com/CVE-2026-113945/): Memory corruption in macOS (not scored)
- [CVE-2026-113944](https://insights.sbomify.com/CVE-2026-113944/): Memory corruption in macOS (not scored)
- [CVE-2026-113943](https://insights.sbomify.com/CVE-2026-113943/): Memory corruption in macOS (medium 6.5)
- [CVE-2026-113942](https://insights.sbomify.com/CVE-2026-113942/): Memory corruption in macOS (not scored)
- [CVE-2026-113941](https://insights.sbomify.com/CVE-2026-113941/): Memory corruption in macOS (not scored)
- [CVE-2026-113940](https://insights.sbomify.com/CVE-2026-113940/): Memory corruption in macOS (not scored)
- [CVE-2026-113939](https://insights.sbomify.com/CVE-2026-113939/): Memory corruption in macOS (medium 6.5)
- [CVE-2026-113938](https://insights.sbomify.com/CVE-2026-113938/): Memory corruption in macOS (not scored)
- [CVE-2026-113937](https://insights.sbomify.com/CVE-2026-113937/): Memory corruption in macOS (not scored)
- [CVE-2026-113936](https://insights.sbomify.com/CVE-2026-113936/): Memory corruption in macOS (not scored)
- [CVE-2026-113935](https://insights.sbomify.com/CVE-2026-113935/): Memory corruption in macOS (not scored)
- [CVE-2026-113934](https://insights.sbomify.com/CVE-2026-113934/): Memory corruption in macOS (not scored)
- [CVE-2026-11393](https://insights.sbomify.com/CVE-2026-11393/): Code injection via improper triple-quote escaping in AgentCore CLI Bedrock Agent import (high 8.8)
- [CVE-2026-11392](https://insights.sbomify.com/CVE-2026-11392/): WP Hotel Booking <= 2.3.1 - Reflected Cross-Site Scripting via 'check_in_date' and 'check_out_date' Parameters (medium 6.1)
- [CVE-2026-113915](https://insights.sbomify.com/CVE-2026-113915/): Race condition in iOS and iPadOS (not scored)
- [CVE-2026-113914](https://insights.sbomify.com/CVE-2026-113914/): Missing authorization in iOS and iPadOS (medium 5.5)
- [CVE-2026-113913](https://insights.sbomify.com/CVE-2026-113913/): Information disclosure in iOS and iPadOS (medium 6.5)
- [CVE-2026-113912](https://insights.sbomify.com/CVE-2026-113912/): Memory corruption in iOS and iPadOS (high 7.1)
- [CVE-2026-113910](https://insights.sbomify.com/CVE-2026-113910/): Information disclosure in iOS and iPadOS (not scored)
- [CVE-2026-11391](https://insights.sbomify.com/CVE-2026-11391/): Tanium addressed a SQL injection vulnerability in Patch. (medium 6.3)
- [CVE-2026-113909](https://insights.sbomify.com/CVE-2026-113909/): Memory corruption in iOS and iPadOS (not scored)
- [CVE-2026-113908](https://insights.sbomify.com/CVE-2026-113908/): Information disclosure in iOS and iPadOS (medium 5.5)
- [CVE-2026-113907](https://insights.sbomify.com/CVE-2026-113907/): Memory corruption in iOS and iPadOS (medium 6.1)
- [CVE-2026-113906](https://insights.sbomify.com/CVE-2026-113906/): Null dereference in iOS and iPadOS (not scored)
- [CVE-2026-113904](https://insights.sbomify.com/CVE-2026-113904/): Use after free in Safari (not scored)
- [CVE-2026-113903](https://insights.sbomify.com/CVE-2026-113903/): Use after free in Safari (not scored)
- [CVE-2026-113901](https://insights.sbomify.com/CVE-2026-113901/): Use after free in Safari (not scored)
- [CVE-2026-113900](https://insights.sbomify.com/CVE-2026-113900/): Race condition in macOS (not scored)
- [CVE-2026-11390](https://insights.sbomify.com/CVE-2026-11390/): Cross-site scripting in News Kit Addons For Elementor (medium 6.4)
- [CVE-2026-1139](https://insights.sbomify.com/CVE-2026-1139/): UTT 进取 520W ConfigExceptMSN strcpy buffer overflow (high 8.7)
- [CVE-2026-113899](https://insights.sbomify.com/CVE-2026-113899/): Denial of service in macOS (not scored)
- [CVE-2026-113898](https://insights.sbomify.com/CVE-2026-113898/): Security feature bypass in iOS and iPadOS (not scored)
- [CVE-2026-113897](https://insights.sbomify.com/CVE-2026-113897/): Security feature bypass in Safari (not scored)
- [CVE-2026-113896](https://insights.sbomify.com/CVE-2026-113896/): Race condition in iOS and iPadOS (medium 4.7)
- [CVE-2026-11389](https://insights.sbomify.com/CVE-2026-11389/): Memory corruption in Connext Professional (medium 6.8)
- [CVE-2026-113881](https://insights.sbomify.com/CVE-2026-113881/): Fireware OS Stack Buffer Overflow in VPN Network Access Enforcement Allows Unprivileged Code Execution (medium 6.1)
- [CVE-2026-11388](https://insights.sbomify.com/CVE-2026-11388/): Double Free vulnerability in RTI Connext Professional (Core Libraries) allows File Manipulation. (medium 6.9)
- [CVE-2026-113877](https://insights.sbomify.com/CVE-2026-113877/): HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions. (not scored)
- [CVE-2026-113876](https://insights.sbomify.com/CVE-2026-113876/): SmileCDR HAPI FHIR unauthorized read (medium 5.3)
- [CVE-2026-113875](https://insights.sbomify.com/CVE-2026-113875/): SmileCDR HAPI FHIR unauthorized read via subscription (low 2.3)
- [CVE-2026-113874](https://insights.sbomify.com/CVE-2026-113874/): SmileCDR HAPI FHIR trusted tenant partition override (high 8.6)
- [CVE-2026-113873](https://insights.sbomify.com/CVE-2026-113873/): SmileCDR HAPI FHIR improper data decompression (high 8.7)
- [CVE-2026-113872](https://insights.sbomify.com/CVE-2026-113872/): multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown (high 7.5)
- [CVE-2026-113870](https://insights.sbomify.com/CVE-2026-113870/): Improper Encoding of Server-Supplied JavaScript Values in MongoDB Compass BSON Parsing (high 8.6)
- [CVE-2026-11387](https://insights.sbomify.com/CVE-2026-11387/): SMS Alert <= 3.9.5 - Unauthenticated Privilege Escalation via Arbitrary Password Reset (critical 9.8)
- [CVE-2026-113869](https://insights.sbomify.com/CVE-2026-113869/): Use-after-free in S/MIME decryption during a security device password prompt (medium 5.4)
- [CVE-2026-113868](https://insights.sbomify.com/CVE-2026-113868/): Uninitialized memory disclosure and out-of-bounds read in POP3 and SMTP NTLM authentication (medium 5.3)
- [CVE-2026-113867](https://insights.sbomify.com/CVE-2026-113867/): Stanza injection in XMPP chat (critical 9.1)
- [CVE-2026-113866](https://insights.sbomify.com/CVE-2026-113866/): Account password sent unencrypted during Exchange account setup (medium 5.9)
- [CVE-2026-11386](https://insights.sbomify.com/CVE-2026-11386/): ubuntu-pro-client Input Validation Vulnerability Leading to Arbitrary APT Directive Injection and Remote Code Execution (critical 9.0)
- [CVE-2026-11383](https://insights.sbomify.com/CVE-2026-11383/): Cross-site Scripting in IBM WebSphere Application Server shipped with Tivoli System Automation Application Manager (medium 5.4)
- [CVE-2026-113813](https://insights.sbomify.com/CVE-2026-113813/): PayPlug for WooCommerce 2.8.0 - 3.1.0 - Unauthenticated Arbitrary Order Deletion, Modification and Disclosure (medium 6.5)
- [CVE-2026-113812](https://insights.sbomify.com/CVE-2026-113812/): Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates. (not scored)
- [CVE-2026-113811](https://insights.sbomify.com/CVE-2026-113811/): Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory exhaustion via a never-cleared failure shift cache in search. (not scored)
- [CVE-2026-113810](https://insights.sbomify.com/CVE-2026-113810/): Stored XSS on SNS Enrollment Portal (high 7.0)
- [CVE-2026-11381](https://insights.sbomify.com/CVE-2026-11381/): IBM MQ for HPE NonStop is vulnerable to a denial of service issue (high 8.8)
- [CVE-2026-113808](https://insights.sbomify.com/CVE-2026-113808/): Stored XSS on SNS Enrollment Portal (high 7.1)
- [CVE-2026-113802](https://insights.sbomify.com/CVE-2026-113802/): Wavlink WL-WN530BE1-A Unauthenticated OS Command Injection in ioos protocol.csp ovpn_file Handler (critical 9.3)
- [CVE-2026-113800](https://insights.sbomify.com/CVE-2026-113800/): Electron: HID and USB permission checks can be attributed to the wrong origin (medium 5.4)
- [CVE-2026-11380](https://insights.sbomify.com/CVE-2026-11380/): Cross-site scripting in JetWidgets For Elementor (medium 6.4)
- [CVE-2026-1138](https://insights.sbomify.com/CVE-2026-1138/): UTT 进取 520W ConfigExceptQQ strcpy buffer overflow (high 8.7)
- [CVE-2026-113799](https://insights.sbomify.com/CVE-2026-113799/): Slack Morphism verifier errors disclose valid HMACs in the logs (medium 5.3)
- [CVE-2026-113798](https://insights.sbomify.com/CVE-2026-113798/): Electron: Pointer lock permission requests can be attributed to the wrong frame (medium 5.4)
- [CVE-2026-113797](https://insights.sbomify.com/CVE-2026-113797/): Electron: Extension tabs.query returns tab URLs and titles without the tabs permission (low 3.1)
- [CVE-2026-113796](https://insights.sbomify.com/CVE-2026-113796/): Electron: SameSite cookie restrictions are not applied to windows opened from links (medium 4.2)
- [CVE-2026-113795](https://insights.sbomify.com/CVE-2026-113795/): pypdf: Possible large memory usage for streams with multiple filters (medium 6.0)
- [CVE-2026-113794](https://insights.sbomify.com/CVE-2026-113794/): pypdf: Possible infinite loop when hitting EOF in standard xref table (medium 6.0)
- [CVE-2026-113793](https://insights.sbomify.com/CVE-2026-113793/): pypdf: Possible infinite loop when removing tree items (medium 6.0)
- [CVE-2026-113792](https://insights.sbomify.com/CVE-2026-113792/): pypdf: Possible infinite loop in PdfWriter.find_outline_item (medium 6.0)
- [CVE-2026-113791](https://insights.sbomify.com/CVE-2026-113791/): pypdf: Possible large memory usage when parsing content streams (medium 6.0)
- [CVE-2026-113790](https://insights.sbomify.com/CVE-2026-113790/): pypdf: Possible large memory usage when parsing arrays and dictionaries (medium 6.0)
- [CVE-2026-11379](https://insights.sbomify.com/CVE-2026-11379/): Incorrect Authorization in GitLab (medium 5.3)
- [CVE-2026-113789](https://insights.sbomify.com/CVE-2026-113789/): pypdf: Possible long runtimes/large memory usage when retrieving form fields (medium 6.0)
- [CVE-2026-113788](https://insights.sbomify.com/CVE-2026-113788/): Lagoon core ssh service vulnerable to remote code execution (critical 9.4)
- [CVE-2026-113787](https://insights.sbomify.com/CVE-2026-113787/): odf-kit: HTML injection leading to XSS in odtToHtml() via unescaped style attribute values (medium 6.1)
- [CVE-2026-113786](https://insights.sbomify.com/CVE-2026-113786/): pypdf: Unvalidated JPEG image data loading (low 2.3)
- [CVE-2026-11378](https://insights.sbomify.com/CVE-2026-11378/): IBM MQ queue manager is vulnerable to remote code execution (high 8.8)
- [CVE-2026-113779](https://insights.sbomify.com/CVE-2026-113779/): pfSense REST API package Vulnerable to Privilege Escalation via Scoped HA Settings Sync Permission (high 8.8)
- [CVE-2026-113776](https://insights.sbomify.com/CVE-2026-113776/): virtualenv activation scripts run code from a path that contains a placeholder name (high 7.8)
- [CVE-2026-113775](https://insights.sbomify.com/CVE-2026-113775/): Dynamic Library Loading Process Control in Autodesk Fusion Desktop (high 7.8)
- [CVE-2026-11375](https://insights.sbomify.com/CVE-2026-11375/): IBM MQ queue manager is vulnerable to remote code execution (high 8.8)
- [CVE-2026-113744](https://insights.sbomify.com/CVE-2026-113744/): Tenda AC19 httpd Web Management Service SetFirewallCfg formSetFirewallCfg stack-based overflow (critical 10.0)
- [CVE-2026-113743](https://insights.sbomify.com/CVE-2026-113743/): Tenstorrent tt-metal load_checkpoints.py load_hf_state_dict_filtered path traversal (medium 5.3)
- [CVE-2026-113741](https://insights.sbomify.com/CVE-2026-113741/): itsourcecode Online Cake Ordering System 404.php cross site scripting (medium 5.3)
- [CVE-2026-113740](https://insights.sbomify.com/CVE-2026-113740/): itsourcecode Online Cake Ordering System deletecustomer.php sql injection (medium 5.3)
- [CVE-2026-11374](https://insights.sbomify.com/CVE-2026-11374/): Account Takeover via Predictable SSO Ticket Generation (critical 9.0)
- [CVE-2026-113738](https://insights.sbomify.com/CVE-2026-113738/): R6410418 Jackrong-llm-finetuning-guide MTP weight_map qwen_mtp_gguf_pipeline.py extract_mtp_heads path traversal (medium 5.3)
- [CVE-2026-113737](https://insights.sbomify.com/CVE-2026-113737/): R6410418 Jackrong-llm-finetuning-guide qwen_mtp_gguf_pipeline.py validate_indexed_tensors path traversal (medium 5.1)
- [CVE-2026-113736](https://insights.sbomify.com/CVE-2026-113736/): D-Link DHP-W610AV HNAP Login defaultvalue.xml login_prepare_hnap empty password (critical 9.3)
- [CVE-2026-113735](https://insights.sbomify.com/CVE-2026-113735/): D-Link DCS-6501LH aoni_ipc mydlink_set_root_pwd weak credentials (medium 6.3)
- [CVE-2026-113732](https://insights.sbomify.com/CVE-2026-113732/): virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote (high 7.8)
- [CVE-2026-113731](https://insights.sbomify.com/CVE-2026-113731/): djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool (low 3.3)
- [CVE-2026-113730](https://insights.sbomify.com/CVE-2026-113730/): OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies (medium 5.6)
- [CVE-2026-11373](https://insights.sbomify.com/CVE-2026-11373/): Net::Statsite::Client versions through 1.1.0 for Perl allow metric injections (critical 9.1)
- [CVE-2026-113729](https://insights.sbomify.com/CVE-2026-113729/): Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization (high 7.5)
- [CVE-2026-113728](https://insights.sbomify.com/CVE-2026-113728/): Bulwark Webmail: DNS-rebinding SSRF in public iCalendar fetch endpoint (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/912/