# Vulnerabilities published in 2026


- [CVE-2026-112955](https://insights.sbomify.com/CVE-2026-112955/): ApostropheCMS: Import archives can exhaust server storage and deny service (medium 6.5)
- [CVE-2026-112954](https://insights.sbomify.com/CVE-2026-112954/): ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API (medium 5.3)
- [CVE-2026-112953](https://insights.sbomify.com/CVE-2026-112953/): ApostropheCMS: Exposure of Sensitive Information via predictable export filenames (medium 6.0)
- [CVE-2026-112952](https://insights.sbomify.com/CVE-2026-112952/): ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user (medium 4.3)
- [CVE-2026-112951](https://insights.sbomify.com/CVE-2026-112951/): ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix (medium 5.4)
- [CVE-2026-112950](https://insights.sbomify.com/CVE-2026-112950/): Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix (medium 5.9)
- [CVE-2026-11295](https://insights.sbomify.com/CVE-2026-11295/): Privilege escalation in Chrome (high 8.8)
- [CVE-2026-112949](https://insights.sbomify.com/CVE-2026-112949/): Vitest: Code injection via unauthenticated manual mock registration (medium 4.7)
- [CVE-2026-112948](https://insights.sbomify.com/CVE-2026-112948/): Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file (medium 6.5)
- [CVE-2026-112947](https://insights.sbomify.com/CVE-2026-112947/): Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance` (medium 6.3)
- [CVE-2026-112946](https://insights.sbomify.com/CVE-2026-112946/): Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine (medium 6.3)
- [CVE-2026-112945](https://insights.sbomify.com/CVE-2026-112945/): Vite: Cross origin script execution through Vite custom middleware (low 2.1)
- [CVE-2026-112944](https://insights.sbomify.com/CVE-2026-112944/): launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors (medium 6.3)
- [CVE-2026-112943](https://insights.sbomify.com/CVE-2026-112943/): launch-editor: escapeCmdArgs() omits % escaping on Windows (medium 6.3)
- [CVE-2026-112942](https://insights.sbomify.com/CVE-2026-112942/): launch-editor: `fs.existsSync()` existence check can be bypassed on Windows (high 7.5)
- [CVE-2026-112941](https://insights.sbomify.com/CVE-2026-112941/): filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock (low 3.3)
- [CVE-2026-112940](https://insights.sbomify.com/CVE-2026-112940/): filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files (high 7.1)
- [CVE-2026-11294](https://insights.sbomify.com/CVE-2026-11294/): Other in Chrome (medium 4.3)
- [CVE-2026-112939](https://insights.sbomify.com/CVE-2026-112939/): filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker (medium 4.7)
- [CVE-2026-112937](https://insights.sbomify.com/CVE-2026-112937/): filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name (medium 6.1)
- [CVE-2026-112936](https://insights.sbomify.com/CVE-2026-112936/): filelock: ReadWriteLock follows a symlink at the lock path into SQLite (medium 6.1)
- [CVE-2026-112935](https://insights.sbomify.com/CVE-2026-112935/): filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders (medium 4.7)
- [CVE-2026-112934](https://insights.sbomify.com/CVE-2026-112934/): filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record (medium 6.1)
- [CVE-2026-11293](https://insights.sbomify.com/CVE-2026-11293/): Use after free in Chrome (critical 9.6)
- [CVE-2026-112921](https://insights.sbomify.com/CVE-2026-112921/): Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over from a previous request. (not scored)
- [CVE-2026-11292](https://insights.sbomify.com/CVE-2026-11292/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2026-112915](https://insights.sbomify.com/CVE-2026-112915/): filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout (medium 5.5)
- [CVE-2026-112914](https://insights.sbomify.com/CVE-2026-112914/): filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory (medium 5.3)
- [CVE-2026-112912](https://insights.sbomify.com/CVE-2026-112912/): filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker (low 2.5)
- [CVE-2026-112911](https://insights.sbomify.com/CVE-2026-112911/): filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion (medium 6.3)
- [CVE-2026-11291](https://insights.sbomify.com/CVE-2026-11291/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2026-112909](https://insights.sbomify.com/CVE-2026-112909/): filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path (medium 6.1)
- [CVE-2026-112906](https://insights.sbomify.com/CVE-2026-112906/): filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse (medium 4.7)
- [CVE-2026-112904](https://insights.sbomify.com/CVE-2026-112904/): Vvveb: Path Traversal in nextRestore() and nextBackup() (high 8.7)
- [CVE-2026-112901](https://insights.sbomify.com/CVE-2026-112901/): Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes (medium 6.9)
- [CVE-2026-112900](https://insights.sbomify.com/CVE-2026-112900/): Pillow: Argument Injection in Ghostscript call, potentially leading into RCE (critical 9.2)
- [CVE-2026-11290](https://insights.sbomify.com/CVE-2026-11290/): Integer overflow in Chrome (medium 5.0)
- [CVE-2026-1129](https://insights.sbomify.com/CVE-2026-1129/): Yonyou KSOA HTTP GET Parameter worksadd.jsp sql injection (medium 6.9)
- [CVE-2026-112898](https://insights.sbomify.com/CVE-2026-112898/): Pillow: Image.quantize() with empty palette leaks uninitialized stack memory (medium 6.9)
- [CVE-2026-112897](https://insights.sbomify.com/CVE-2026-112897/): Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips (high 8.7)
- [CVE-2026-112896](https://insights.sbomify.com/CVE-2026-112896/): Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read (high 8.8)
- [CVE-2026-112895](https://insights.sbomify.com/CVE-2026-112895/): Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310) (high 8.7)
- [CVE-2026-112894](https://insights.sbomify.com/CVE-2026-112894/): Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id) (high 8.7)
- [CVE-2026-112893](https://insights.sbomify.com/CVE-2026-112893/): Pillow: Invalid free in FreeType glyph rendering when a stroker is active (high 8.2)
- [CVE-2026-112892](https://insights.sbomify.com/CVE-2026-112892/): Pillow: MSP RLE decoder expands a tiny file into unbounded memory (high 8.7)
- [CVE-2026-112891](https://insights.sbomify.com/CVE-2026-112891/): Pillow: Quadratic GIF comment copying during save (medium 6.9)
- [CVE-2026-11289](https://insights.sbomify.com/CVE-2026-11289/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-112880](https://insights.sbomify.com/CVE-2026-112880/): CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney (low 2.1)
- [CVE-2026-11288](https://insights.sbomify.com/CVE-2026-11288/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-11287](https://insights.sbomify.com/CVE-2026-11287/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-112869](https://insights.sbomify.com/CVE-2026-112869/): WordPress We’re Open! plugin <= 2.6 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-112868](https://insights.sbomify.com/CVE-2026-112868/): WordPress H5P plugin <= 1.17.9 - Insecure Direct Object References (IDOR) vulnerability (medium 4.3)
- [CVE-2026-112867](https://insights.sbomify.com/CVE-2026-112867/): WordPress H5P plugin <= 1.17.9 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-112866](https://insights.sbomify.com/CVE-2026-112866/): WordPress Product Filter by WBW plugin <= 3.4.6 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-112865](https://insights.sbomify.com/CVE-2026-112865/): WordPress Royal Elementor Addons plugin <= 1.7.1069 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-112863](https://insights.sbomify.com/CVE-2026-112863/): WordPress KALLYAS theme <= 4.25.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-112862](https://insights.sbomify.com/CVE-2026-112862/): WordPress Participants Database plugin <= 2.7.8.5 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-112861](https://insights.sbomify.com/CVE-2026-112861/): WordPress Participants Database plugin <= 2.7.8.5 - Insecure Direct Object References (IDOR) vulnerability (medium 6.3)
- [CVE-2026-112860](https://insights.sbomify.com/CVE-2026-112860/): WordPress Participants Database plugin <= 2.7.8.5 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-11286](https://insights.sbomify.com/CVE-2026-11286/): Other in Chrome (medium 4.3)
- [CVE-2026-112859](https://insights.sbomify.com/CVE-2026-112859/): WordPress Little Birdies theme <= 1.3.16 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-112858](https://insights.sbomify.com/CVE-2026-112858/): WordPress Rhodos theme <= 1.3.3 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-112857](https://insights.sbomify.com/CVE-2026-112857/): WordPress Reprizo theme <= 1.0.8 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-112856](https://insights.sbomify.com/CVE-2026-112856/): WordPress Vagabonds theme <= 1.3.10 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-112855](https://insights.sbomify.com/CVE-2026-112855/): WordPress Redy theme <= 1.3.5 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-112854](https://insights.sbomify.com/CVE-2026-112854/): WordPress Holistic Center theme <= 1.2.6 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-112853](https://insights.sbomify.com/CVE-2026-112853/): WordPress Hallelujah theme <= 1.1.1 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-112852](https://insights.sbomify.com/CVE-2026-112852/): WordPress Helion theme <= 1.1.12 - PHP Object Injection vulnerability (high 8.1)
- [CVE-2026-112851](https://insights.sbomify.com/CVE-2026-112851/): WordPress HotLock theme <= 1.3.9 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-112850](https://insights.sbomify.com/CVE-2026-112850/): WordPress Your Dress theme <= 1.4.1 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-11285](https://insights.sbomify.com/CVE-2026-11285/): Other in Chrome (medium 4.3)
- [CVE-2026-112849](https://insights.sbomify.com/CVE-2026-112849/): WordPress Hostme v2 theme <= 7.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-112848](https://insights.sbomify.com/CVE-2026-112848/): WordPress Hostme v2 theme <= 7.0 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-112847](https://insights.sbomify.com/CVE-2026-112847/): WordPress ZenSoul theme <= 1.13 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-112846](https://insights.sbomify.com/CVE-2026-112846/): WordPress Save Life theme <= 1.2.14 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-112845](https://insights.sbomify.com/CVE-2026-112845/): WordPress Off-Canvas Sidebars & Menus (Slidebars) plugin <= 0.5.9 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-112844](https://insights.sbomify.com/CVE-2026-112844/): WordPress WP Event Solution plugin <= 4.1.26 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-112843](https://insights.sbomify.com/CVE-2026-112843/): WordPress Strong Testimonials plugin <= 3.3.14 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-112842](https://insights.sbomify.com/CVE-2026-112842/): WordPress Paid Member Subscriptions plugin <= 3.1.2 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-112840](https://insights.sbomify.com/CVE-2026-112840/): WordPress SureCart plugin <= 4.9.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-11284](https://insights.sbomify.com/CVE-2026-11284/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-112839](https://insights.sbomify.com/CVE-2026-112839/): WordPress Customer Coupons for WooCommerce plugin <= 1.3.14 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-112838](https://insights.sbomify.com/CVE-2026-112838/): WordPress VikRentCar plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-112837](https://insights.sbomify.com/CVE-2026-112837/): WordPress GamiPress plugin <= 8.0.7 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-112836](https://insights.sbomify.com/CVE-2026-112836/): WordPress VikRentCar plugin <= 1.4.8 - Cross Site Request Forgery (CSRF) vulnerability (high 8.8)
- [CVE-2026-112835](https://insights.sbomify.com/CVE-2026-112835/): WordPress VikRentCar plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-112834](https://insights.sbomify.com/CVE-2026-112834/): WordPress Seriously Simple Podcasting plugin <= 3.17.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-112833](https://insights.sbomify.com/CVE-2026-112833/): WordPress Seriously Simple Podcasting plugin <= 3.17.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-112832](https://insights.sbomify.com/CVE-2026-112832/): WordPress Rootblox plugin <= 1.0.6 - Local File Inclusion vulnerability (critical 9.8)
- [CVE-2026-11283](https://insights.sbomify.com/CVE-2026-11283/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-112829](https://insights.sbomify.com/CVE-2026-112829/): WordPress Booktics plugin <= 1.0.30 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-112828](https://insights.sbomify.com/CVE-2026-112828/): WordPress AI Engine plugin <= 3.8.6 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-112827](https://insights.sbomify.com/CVE-2026-112827/): WordPress HANDMADE – Dropshipping for Etsy and WooCommerce plugin <= 1.0.10 - Broken Access Control vulnerability (high 7.1)
- [CVE-2026-112826](https://insights.sbomify.com/CVE-2026-112826/): WordPress Falcon – WordPress Optimizations & Tweaks plugin <= 2.12.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-112825](https://insights.sbomify.com/CVE-2026-112825/): WordPress Car Rental Manager plugin <= 1.5.3 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-112824](https://insights.sbomify.com/CVE-2026-112824/): WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.9.7 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-112823](https://insights.sbomify.com/CVE-2026-112823/): WordPress WP User Manager plugin <= 2.9.25 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-112822](https://insights.sbomify.com/CVE-2026-112822/): WordPress Workreap Core plugin < 3.4.4 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-112821](https://insights.sbomify.com/CVE-2026-112821/): WordPress Knit Pay plugin <= 9.6.3.0 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-112820](https://insights.sbomify.com/CVE-2026-112820/): WordPress Academist Core plugin <= 1.4.1 - Local File Inclusion vulnerability (high 8.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/919/