# Vulnerabilities published in 2026


- [CVE-2026-113727](https://insights.sbomify.com/CVE-2026-113727/): OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs (high 7.4)
- [CVE-2026-113726](https://insights.sbomify.com/CVE-2026-113726/): virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST (high 7.8)
- [CVE-2026-113725](https://insights.sbomify.com/CVE-2026-113725/): virtualenv bash activate runs commands from an environment name with a backslash before $ (high 7.8)
- [CVE-2026-113724](https://insights.sbomify.com/CVE-2026-113724/): virtualenv: Deletion recovery can change a symlink target's mode (medium 4.5)
- [CVE-2026-113723](https://insights.sbomify.com/CVE-2026-113723/): virtualenv: Bash prompt values can change meaning under older compatibility modes (high 7.1)
- [CVE-2026-113722](https://insights.sbomify.com/CVE-2026-113722/): virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax (high 7.8)
- [CVE-2026-113721](https://insights.sbomify.com/CVE-2026-113721/): virtualenv: Generated files can follow existing destination links (medium 4.5)
- [CVE-2026-113720](https://insights.sbomify.com/CVE-2026-113720/): virtualenv: Seeded files retain permissions from an older cache (medium 4.4)
- [CVE-2026-11372](https://insights.sbomify.com/CVE-2026-11372/): IBM TRIRIGA Cross-Site Scripting Vulnerability (medium 5.4)
- [CVE-2026-113719](https://insights.sbomify.com/CVE-2026-113719/): virtualenv: Seed replacement does not contain metadata deletion paths (medium 4.5)
- [CVE-2026-113718](https://insights.sbomify.com/CVE-2026-113718/): virtualenv: Xonsh activation literals depend on the script decoding codec (high 7.1)
- [CVE-2026-113717](https://insights.sbomify.com/CVE-2026-113717/): virtualenv: Pip seeding with download omits wheel digest verification (low 2.3)
- [CVE-2026-113716](https://insights.sbomify.com/CVE-2026-113716/): virtualenv: Builtin creation follows linked environment directories (medium 4.5)
- [CVE-2026-113715](https://insights.sbomify.com/CVE-2026-113715/): virtualenv: Venv configuration readback can reinterpret path boundaries (low 2.0)
- [CVE-2026-113714](https://insights.sbomify.com/CVE-2026-113714/): virtualenv: Downloaded wheel selection and caching precede verification (low 2.3)
- [CVE-2026-113713](https://insights.sbomify.com/CVE-2026-113713/): virtualenv: Temporary app-data can leave dangling seed package links (medium 4.4)
- [CVE-2026-113712](https://insights.sbomify.com/CVE-2026-113712/): Cachet has Stored XSS in Incident Component (medium 4.8)
- [CVE-2026-113711](https://insights.sbomify.com/CVE-2026-113711/): ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export (high 7.5)
- [CVE-2026-113710](https://insights.sbomify.com/CVE-2026-113710/): ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing (medium 5.9)
- [CVE-2026-11371](https://insights.sbomify.com/CVE-2026-11371/): BetterDocs < 4.5.5 - Unauthenticated Stored XSS via AI Doc Summarizer Prompt Injection (medium 6.1)
- [CVE-2026-113709](https://insights.sbomify.com/CVE-2026-113709/): Argo CD: A Kustomize Helm config home can run commands in the repo-server (critical 9.9)
- [CVE-2026-113708](https://insights.sbomify.com/CVE-2026-113708/): Argo CD: A Kustomize remote ref can run commands in the repo-server (critical 9.9)
- [CVE-2026-113707](https://insights.sbomify.com/CVE-2026-113707/): a2aproject a2a-rs inmemory.rs update race condition (medium 5.3)
- [CVE-2026-113706](https://insights.sbomify.com/CVE-2026-113706/): a2aproject a2a-rs inmemory.rs information disclosure (medium 5.1)
- [CVE-2026-113705](https://insights.sbomify.com/CVE-2026-113705/): a2aproject a2a-rs error.rs information exposure (medium 6.9)
- [CVE-2026-113704](https://insights.sbomify.com/CVE-2026-113704/): a2aproject a2a-rs Push Notification push_notification_sender.rs HttpPushSender server-side request forgery (medium 6.9)
- [CVE-2026-113703](https://insights.sbomify.com/CVE-2026-113703/): SuggestArr before 3.0.0 Authentication Bypass via X-Forwarded-For Spoofing (critical 9.1)
- [CVE-2026-11370](https://insights.sbomify.com/CVE-2026-11370/): WP Meta SEO <= 4.5.18 - Authenticated (Contributor+) Server-Side Request Forgery via 'new_link' Parameter (medium 6.4)
- [CVE-2026-1137](https://insights.sbomify.com/CVE-2026-1137/): UTT 进取 520W formWebAuthGlobalConfig strcpy buffer overflow (high 8.7)
- [CVE-2026-113697](https://insights.sbomify.com/CVE-2026-113697/): Reflected Cross-Site Scripting in BMC Helix Operations Management (medium 4.8)
- [CVE-2026-113696](https://insights.sbomify.com/CVE-2026-113696/): Improper Authorization in BMC ITSM SmartIT Change Approvals (medium 5.3)
- [CVE-2026-113695](https://insights.sbomify.com/CVE-2026-113695/): Reflected Cross-Site Scripting in BMC ITSM SmartIT (medium 4.8)
- [CVE-2026-113694](https://insights.sbomify.com/CVE-2026-113694/): Improper Authorization in BMC ITSM SmartIT Attachments (medium 5.3)
- [CVE-2026-113693](https://insights.sbomify.com/CVE-2026-113693/): System Account Credential Disclosure in BMC ITSM (medium 5.3)
- [CVE-2026-113692](https://insights.sbomify.com/CVE-2026-113692/): Path Traversal in BMC ITSM (medium 6.9)
- [CVE-2026-113691](https://insights.sbomify.com/CVE-2026-113691/): Stored Cross-Site Scripting in BMC ITSM Knowledge Articles (medium 5.1)
- [CVE-2026-113690](https://insights.sbomify.com/CVE-2026-113690/): Stored Cross-Site Scripting in BMC ITSM Attachments (medium 4.8)
- [CVE-2026-11369](https://insights.sbomify.com/CVE-2026-11369/): IDOR in Comment API Allows Cross-Process Comment Read and Write (high 7.1)
- [CVE-2026-113689](https://insights.sbomify.com/CVE-2026-113689/): Stored Cross-Site Scripting in BMC ITSM Work Notes (medium 5.1)
- [CVE-2026-113688](https://insights.sbomify.com/CVE-2026-113688/): Server-Side Request Forgery in BMC ITSM SmartIT (medium 5.3)
- [CVE-2026-113683](https://insights.sbomify.com/CVE-2026-113683/): VPL for Moodle before 5.0.0 Reflected XSS via similarity/diff.php filename (medium 5.1)
- [CVE-2026-113682](https://insights.sbomify.com/CVE-2026-113682/): Networknt light-4j 2.1.5 before 2.4.0 Authentication Bypass via Empty LDAP Password (critical 9.1)
- [CVE-2026-113681](https://insights.sbomify.com/CVE-2026-113681/): Integer overflow in OpenImageIO (medium 6.8)
- [CVE-2026-113680](https://insights.sbomify.com/CVE-2026-113680/): HarfBuzz 8.0.0 through 14.6.0 WebAssembly Shaper NULL Pointer Dereference DoS (medium 6.8)
- [CVE-2026-11368](https://insights.sbomify.com/CVE-2026-11368/): Use-after-free in Bluetooth host ATT TX completion on disconnect mid-transfer (high 7.1)
- [CVE-2026-113679](https://insights.sbomify.com/CVE-2026-113679/): HarfBuzz 8.0.0 through 14.6.0 Out-of-Bounds Write via WebAssembly font_glyph_to_string (high 7.3)
- [CVE-2026-113678](https://insights.sbomify.com/CVE-2026-113678/): Froxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic Cron (critical 9.4)
- [CVE-2026-113677](https://insights.sbomify.com/CVE-2026-113677/): Froxlor 0.10.0 before 2.3.15 Missing Authorization via SubDomains.delete API (medium 5.3)
- [CVE-2026-113676](https://insights.sbomify.com/CVE-2026-113676/): Froxlor 0.10.0 before 2.3.15 Authorization Bypass via Admins.get API (medium 5.3)
- [CVE-2026-113674](https://insights.sbomify.com/CVE-2026-113674/): GeoDirectory < 2.8.194 - Unauthenticated Guest-Submitted Listing Modification (low 3.7)
- [CVE-2026-113673](https://insights.sbomify.com/CVE-2026-113673/): GeoDirectory < 2.8.194 - Admin+ RCE via DB Text Export (high 7.2)
- [CVE-2026-113672](https://insights.sbomify.com/CVE-2026-113672/): Argo CD: A Jsonnet import can read files from the repo-server (critical 9.9)
- [CVE-2026-113671](https://insights.sbomify.com/CVE-2026-113671/): ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF (medium 4.3)
- [CVE-2026-11367](https://insights.sbomify.com/CVE-2026-11367/): PixMagix <= 1.7.2 - Authenticated (Author+) Path Traversal in 'layers[].id' Parameter (medium 6.5)
- [CVE-2026-113669](https://insights.sbomify.com/CVE-2026-113669/): ApostropheCMS: Cross-domain session token in URL confers session takeover (medium 5.3)
- [CVE-2026-113668](https://insights.sbomify.com/CVE-2026-113668/): ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure) (medium 5.3)
- [CVE-2026-113667](https://insights.sbomify.com/CVE-2026-113667/): ApostropheCMS: CAPTCHA response token not URL-encoded (medium 5.3)
- [CVE-2026-113666](https://insights.sbomify.com/CVE-2026-113666/): ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service (high 7.1)
- [CVE-2026-113665](https://insights.sbomify.com/CVE-2026-113665/): ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints (low 3.7)
- [CVE-2026-113664](https://insights.sbomify.com/CVE-2026-113664/): ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test (medium 5.3)
- [CVE-2026-113662](https://insights.sbomify.com/CVE-2026-113662/): ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document (medium 5.4)
- [CVE-2026-113661](https://insights.sbomify.com/CVE-2026-113661/): ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs (medium 5.4)
- [CVE-2026-113660](https://insights.sbomify.com/CVE-2026-113660/): ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers (medium 4.3)
- [CVE-2026-11366](https://insights.sbomify.com/CVE-2026-11366/): MonsterInsights < 11.1.0 - Unauthenticated Measurement Protocol Secret Update via Empty-Key HMAC Bypass (low 3.7)
- [CVE-2026-113659](https://insights.sbomify.com/CVE-2026-113659/): ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users (medium 6.1)
- [CVE-2026-113658](https://insights.sbomify.com/CVE-2026-113658/): ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory (high 7.5)
- [CVE-2026-113657](https://insights.sbomify.com/CVE-2026-113657/): ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS) (low 3.7)
- [CVE-2026-113656](https://insights.sbomify.com/CVE-2026-113656/): ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS (medium 5.3)
- [CVE-2026-113655](https://insights.sbomify.com/CVE-2026-113655/): ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization (medium 4.3)
- [CVE-2026-113654](https://insights.sbomify.com/CVE-2026-113654/): ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render (medium 5.3)
- [CVE-2026-113653](https://insights.sbomify.com/CVE-2026-113653/): ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public) (medium 6.9)
- [CVE-2026-113652](https://insights.sbomify.com/CVE-2026-113652/): ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true) (medium 5.6)
- [CVE-2026-113651](https://insights.sbomify.com/CVE-2026-113651/): ApostropheCMS: Path traversal in uploadfs (low 3.3)
- [CVE-2026-113650](https://insights.sbomify.com/CVE-2026-113650/): ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced) (medium 5.3)
- [CVE-2026-113649](https://insights.sbomify.com/CVE-2026-113649/): ApostropheCMS: Import API bypasses publication roles for protected content (medium 6.5)
- [CVE-2026-113648](https://insights.sbomify.com/CVE-2026-113648/): ApostropheCMS: Missing Authentication in `cleanExport` Route (low 3.1)
- [CVE-2026-113644](https://insights.sbomify.com/CVE-2026-113644/): iofogctl command injection via Controller provisioning response (medium 5.5)
- [CVE-2026-113643](https://insights.sbomify.com/CVE-2026-113643/): EspoCRM PDF Rendering Pipeline ImageSourceProvider.php get authorization (medium 5.3)
- [CVE-2026-11364](https://insights.sbomify.com/CVE-2026-11364/): Missing authorization in Product Specifications for Woocommerce (medium 4.3)
- [CVE-2026-11363](https://insights.sbomify.com/CVE-2026-11363/): Ninja Forms <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection via Form Import (medium 6.6)
- [CVE-2026-113620](https://insights.sbomify.com/CVE-2026-113620/): Eclipse ioFog operator WebSocket accepts an unverified JWT (critical 9.8)
- [CVE-2026-11362](https://insights.sbomify.com/CVE-2026-11362/): DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tags (critical 9.8)
- [CVE-2026-113619](https://insights.sbomify.com/CVE-2026-113619/): Eclipse ioFog renders request templates before authentication (high 7.5)
- [CVE-2026-113617](https://insights.sbomify.com/CVE-2026-113617/): Automated Import Products to Cart < 1.0.4 - Subscriber+ Arbitrary File Read and Deletion via Path Traversal (critical 9.9)
- [CVE-2026-113616](https://insights.sbomify.com/CVE-2026-113616/): LogixFast Auth < 1.0.4 - Unauthenticated Account Takeover via Password Reset (critical 9.8)
- [CVE-2026-113613](https://insights.sbomify.com/CVE-2026-113613/): FlexGet before 3.20.7 Path Traversal (Zip Slip) via decompress plugin (critical 9.2)
- [CVE-2026-113612](https://insights.sbomify.com/CVE-2026-113612/): SparkyFitness before 0.17.0 Missing Authorization via food-variants DELETE Endpoint (medium 5.3)
- [CVE-2026-113611](https://insights.sbomify.com/CVE-2026-113611/): Outline before 1.8.0 Information Disclosure via Orphaned Webhook Subscriptions (medium 6.9)
- [CVE-2026-113610](https://insights.sbomify.com/CVE-2026-113610/): Xen Orchestra before 6.9.0 Authorization Bypass via user.set API (medium 5.3)
- [CVE-2026-11361](https://insights.sbomify.com/CVE-2026-11361/): Formidable Forms < 6.32.1 - Unauthenticated Payment Bypass via PayPal APPROVAL_PENDING Subscription Status (medium 5.9)
- [CVE-2026-113609](https://insights.sbomify.com/CVE-2026-113609/): Bandisoft Bandizip before 7.47 Mark-of-the-Web Bypass for PowerShell Scripts (medium 4.8)
- [CVE-2026-113608](https://insights.sbomify.com/CVE-2026-113608/): Configurable Reports block for Moodle before 5.3.1 SQL Injection via filter_var (medium 6.0)
- [CVE-2026-113607](https://insights.sbomify.com/CVE-2026-113607/): Configurable Reports block for Moodle before 5.3.0 Authorization Bypass via get_report_data (high 7.1)
- [CVE-2026-113606](https://insights.sbomify.com/CVE-2026-113606/): Stirling-PDF 3.0.0 through 3.2.0 Authorization Bypass via Processing Folders (high 7.1)
- [CVE-2026-113605](https://insights.sbomify.com/CVE-2026-113605/): Stirling-PDF 2.13.2 through 3.2.0 H2 SQL Denylist Bypass via import-database (high 8.6)
- [CVE-2026-113604](https://insights.sbomify.com/CVE-2026-113604/): Ghidra 10.2 through 12.1.4 Denial of Service via ELF Loader Extended Header Counts (medium 6.8)
- [CVE-2026-113603](https://insights.sbomify.com/CVE-2026-113603/): x402 @x402/extensions 2.3.1 through 2.28.0 SIWX Payment Bypass via PaymentPayload.resource (medium 6.9)
- [CVE-2026-113602](https://insights.sbomify.com/CVE-2026-113602/): json-smart through 2.6.0 Strict-Mode Validation Bypass via 0x1A Character (medium 6.9)
- [CVE-2026-113601](https://insights.sbomify.com/CVE-2026-113601/): Memos before 0.27.0 Missing Authorization via ActivityService ListActivities/GetActivity (medium 5.3)
- [CVE-2026-113600](https://insights.sbomify.com/CVE-2026-113600/): Fat Free CRM before 0.26.0 IDOR via CommentsController update and destroy (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/913/