# Vulnerabilities published in 2026


- [CVE-2026-11282](https://insights.sbomify.com/CVE-2026-11282/): Security feature bypass in Chrome (critical 9.6)
- [CVE-2026-11281](https://insights.sbomify.com/CVE-2026-11281/): Integer overflow in Chrome (medium 5.0)
- [CVE-2026-11280](https://insights.sbomify.com/CVE-2026-11280/): Other in Chrome (medium 4.3)
- [CVE-2026-1128](https://insights.sbomify.com/CVE-2026-1128/): WP eCommerce <= 3.15.1 - Coupon Deletion via CSRF (medium 4.3)
- [CVE-2026-11279](https://insights.sbomify.com/CVE-2026-11279/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-112787](https://insights.sbomify.com/CVE-2026-112787/): OpenCATS before 0.10.0 Missing Authorization in Reports Module EEO Reports (medium 5.3)
- [CVE-2026-112786](https://insights.sbomify.com/CVE-2026-112786/): OpenCATS before 0.10.0 Missing Authorization via Import Revert Action (medium 5.3)
- [CVE-2026-112785](https://insights.sbomify.com/CVE-2026-112785/): OpenCATS before 0.10.0 Missing Authorization in Saved-List AJAX Endpoints (medium 5.3)
- [CVE-2026-112784](https://insights.sbomify.com/CVE-2026-112784/): OpenCATS before 0.10.0 Missing Authorization via ajax/testEmailSettings.php (medium 5.3)
- [CVE-2026-112783](https://insights.sbomify.com/CVE-2026-112783/): OpenCATS before 0.10.0 Missing Authorization via Activity AJAX Endpoints (medium 5.3)
- [CVE-2026-112782](https://insights.sbomify.com/CVE-2026-112782/): Grav before 1.7.53.5 and 2.2.2 Image Pixel Limit Bypass Denial of Service (high 8.7)
- [CVE-2026-112781](https://insights.sbomify.com/CVE-2026-112781/): Grav 2.0.0 before 2.2.2 Information Disclosure via Form config-*@ Directives (high 8.7)
- [CVE-2026-112780](https://insights.sbomify.com/CVE-2026-112780/): Grav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Flex Form replace-name@ (critical 9.3)
- [CVE-2026-11278](https://insights.sbomify.com/CVE-2026-11278/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-112779](https://insights.sbomify.com/CVE-2026-112779/): Grav API Plugin before 1.0.42 Cache Exhaustion and Page Permission Bypass (critical 9.3)
- [CVE-2026-112778](https://insights.sbomify.com/CVE-2026-112778/): Traefik before 2.11.46, 3.6.17, and 3.7.1 Cross-Namespace Resource Reference via Kubernetes Annotations (medium 6.4)
- [CVE-2026-112777](https://insights.sbomify.com/CVE-2026-112777/): Craft CMS before 4.18.8 and 5.11.0 Twig create() Blocklist Bypass Leading to RCE (high 8.7)
- [CVE-2026-112776](https://insights.sbomify.com/CVE-2026-112776/): Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via Mutations (critical 9.3)
- [CVE-2026-112775](https://insights.sbomify.com/CVE-2026-112775/): Craft CMS 5.0.0 before 5.11.0 Verification Code Reuse via users/set-password (high 8.7)
- [CVE-2026-112774](https://insights.sbomify.com/CVE-2026-112774/): Craft CMS 5.8.0 before 5.11.0 Admin RCE via ContentBlock Field Layout (high 8.7)
- [CVE-2026-112773](https://insights.sbomify.com/CVE-2026-112773/): Craft CMS 5.0.0 before 5.11.0 RCE via Twig Sandbox Behavior Injection (high 8.7)
- [CVE-2026-112772](https://insights.sbomify.com/CVE-2026-112772/): Craft CMS 5.0.0 before 5.11.0 RCE via Asset::getMimeType Transform Injection (high 8.7)
- [CVE-2026-112771](https://insights.sbomify.com/CVE-2026-112771/): Craft CMS before 4.18.8 and 5.11.0 Twig Sandbox Allowlist Bypass via Array Filters (high 7.1)
- [CVE-2026-112770](https://insights.sbomify.com/CVE-2026-112770/): Craft CMS before 4.18.8 and 5.11.0 Authenticated RCE via Twig group Filter Array-Callable (high 8.7)
- [CVE-2026-11277](https://insights.sbomify.com/CVE-2026-11277/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2026-112769](https://insights.sbomify.com/CVE-2026-112769/): Parse Server before 8.6.98 and 9.x before 9.10.3-alpha.1 Session Class-Level Permission Bypass (low 2.3)
- [CVE-2026-112768](https://insights.sbomify.com/CVE-2026-112768/): Parse Server before 8.6.99 and 9.x before 9.10.3-alpha.2 Information Disclosure via User Update (medium 6.9)
- [CVE-2026-11276](https://insights.sbomify.com/CVE-2026-11276/): Security feature bypass in Chrome (medium 5.1)
- [CVE-2026-11275](https://insights.sbomify.com/CVE-2026-11275/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-11274](https://insights.sbomify.com/CVE-2026-11274/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2026-11273](https://insights.sbomify.com/CVE-2026-11273/): Cross-site scripting in Chrome (medium 6.1)
- [CVE-2026-11272](https://insights.sbomify.com/CVE-2026-11272/): Privilege escalation in Chrome (high 8.8)
- [CVE-2026-112712](https://insights.sbomify.com/CVE-2026-112712/): @fastify/middie vulnerable to path-scoped middleware bypass via scope prefix mismatch (critical 9.1)
- [CVE-2026-112710](https://insights.sbomify.com/CVE-2026-112710/): Fireware OS Heap Buffer Overflow in AD Authentication Service Allows Pre-Authentication Remote Code Execution (critical 9.2)
- [CVE-2026-11271](https://insights.sbomify.com/CVE-2026-11271/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-112709](https://insights.sbomify.com/CVE-2026-112709/): Fireware OS Heap Buffer Overflow in AD Authentication Service Allows Pre-Authentication Remote Code Execution (critical 9.2)
- [CVE-2026-112708](https://insights.sbomify.com/CVE-2026-112708/): Race condition in macOS (medium 5.3)
- [CVE-2026-112707](https://insights.sbomify.com/CVE-2026-112707/): Information disclosure in iOS and iPadOS (not scored)
- [CVE-2026-112706](https://insights.sbomify.com/CVE-2026-112706/): Missing authorization in iOS and iPadOS (medium 5.5)
- [CVE-2026-112705](https://insights.sbomify.com/CVE-2026-112705/): Memory corruption in iOS and iPadOS (not scored)
- [CVE-2026-112704](https://insights.sbomify.com/CVE-2026-112704/): Security feature bypass in macOS (not scored)
- [CVE-2026-112701](https://insights.sbomify.com/CVE-2026-112701/): Missing authorization in iOS and iPadOS (medium 5.5)
- [CVE-2026-11270](https://insights.sbomify.com/CVE-2026-11270/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-1127](https://insights.sbomify.com/CVE-2026-1127/): Timeline Event History <= 3.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2026-112699](https://insights.sbomify.com/CVE-2026-112699/): Memory corruption in Safari (not scored)
- [CVE-2026-112698](https://insights.sbomify.com/CVE-2026-112698/): Memory corruption in iOS and iPadOS (not scored)
- [CVE-2026-112697](https://insights.sbomify.com/CVE-2026-112697/): Use after free in Safari (not scored)
- [CVE-2026-112696](https://insights.sbomify.com/CVE-2026-112696/): Memory corruption in iOS and iPadOS (not scored)
- [CVE-2026-112695](https://insights.sbomify.com/CVE-2026-112695/): Use after free in Safari (not scored)
- [CVE-2026-112693](https://insights.sbomify.com/CVE-2026-112693/): Use after free in Safari (not scored)
- [CVE-2026-112692](https://insights.sbomify.com/CVE-2026-112692/): Missing authorization in iOS and iPadOS (not scored)
- [CVE-2026-112691](https://insights.sbomify.com/CVE-2026-112691/): Memory corruption in iOS and iPadOS (not scored)
- [CVE-2026-112690](https://insights.sbomify.com/CVE-2026-112690/): Security feature bypass in iOS and iPadOS (not scored)
- [CVE-2026-11269](https://insights.sbomify.com/CVE-2026-11269/): Code injection in Chrome (high 7.1)
- [CVE-2026-112689](https://insights.sbomify.com/CVE-2026-112689/): Memory corruption in iOS and iPadOS (not scored)
- [CVE-2026-112688](https://insights.sbomify.com/CVE-2026-112688/): Memory corruption in iOS and iPadOS (high 8.8)
- [CVE-2026-112687](https://insights.sbomify.com/CVE-2026-112687/): Memory corruption in iOS and iPadOS (not scored)
- [CVE-2026-112686](https://insights.sbomify.com/CVE-2026-112686/): Race condition in Safari (not scored)
- [CVE-2026-112685](https://insights.sbomify.com/CVE-2026-112685/): Missing authorization in iOS and iPadOS (medium 5.5)
- [CVE-2026-112684](https://insights.sbomify.com/CVE-2026-112684/): Denial of service in Safari (not scored)
- [CVE-2026-112683](https://insights.sbomify.com/CVE-2026-112683/): Memory corruption in iOS and iPadOS (not scored)
- [CVE-2026-112682](https://insights.sbomify.com/CVE-2026-112682/): Denial of service in iOS and iPadOS (not scored)
- [CVE-2026-112681](https://insights.sbomify.com/CVE-2026-112681/): Information disclosure in iOS and iPadOS (not scored)
- [CVE-2026-112680](https://insights.sbomify.com/CVE-2026-112680/): Memory corruption in Safari (not scored)
- [CVE-2026-11268](https://insights.sbomify.com/CVE-2026-11268/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-112679](https://insights.sbomify.com/CVE-2026-112679/): Use after free in iOS and iPadOS (not scored)
- [CVE-2026-112678](https://insights.sbomify.com/CVE-2026-112678/): Missing authorization in iOS and iPadOS (medium 5.5)
- [CVE-2026-112677](https://insights.sbomify.com/CVE-2026-112677/): Privilege escalation in macOS (not scored)
- [CVE-2026-112676](https://insights.sbomify.com/CVE-2026-112676/): Missing authorization in iOS and iPadOS (not scored)
- [CVE-2026-112675](https://insights.sbomify.com/CVE-2026-112675/): Missing authorization in macOS (medium 5.5)
- [CVE-2026-112673](https://insights.sbomify.com/CVE-2026-112673/): Memory corruption in Safari (not scored)
- [CVE-2026-112672](https://insights.sbomify.com/CVE-2026-112672/): Security feature bypass in macOS (not scored)
- [CVE-2026-112671](https://insights.sbomify.com/CVE-2026-112671/): Denial of service in iOS and iPadOS (not scored)
- [CVE-2026-112670](https://insights.sbomify.com/CVE-2026-112670/): Memory corruption in macOS (not scored)
- [CVE-2026-11267](https://insights.sbomify.com/CVE-2026-11267/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2026-112669](https://insights.sbomify.com/CVE-2026-112669/): Race condition in Safari (not scored)
- [CVE-2026-112668](https://insights.sbomify.com/CVE-2026-112668/): Privilege escalation in macOS (not scored)
- [CVE-2026-112666](https://insights.sbomify.com/CVE-2026-112666/): Use after free in Safari (not scored)
- [CVE-2026-112665](https://insights.sbomify.com/CVE-2026-112665/): Information disclosure in iOS and iPadOS (not scored)
- [CVE-2026-112660](https://insights.sbomify.com/CVE-2026-112660/): Security feature bypass in iOS and iPadOS (not scored)
- [CVE-2026-11266](https://insights.sbomify.com/CVE-2026-11266/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2026-112659](https://insights.sbomify.com/CVE-2026-112659/): Memory corruption in Safari (high 8.8)
- [CVE-2026-112658](https://insights.sbomify.com/CVE-2026-112658/): Information disclosure in iOS and iPadOS (medium 5.5)
- [CVE-2026-112656](https://insights.sbomify.com/CVE-2026-112656/): Memory corruption in iOS and iPadOS (not scored)
- [CVE-2026-112655](https://insights.sbomify.com/CVE-2026-112655/): Use after free in Safari (high 8.8)
- [CVE-2026-112654](https://insights.sbomify.com/CVE-2026-112654/): Use after free in Safari (not scored)
- [CVE-2026-112653](https://insights.sbomify.com/CVE-2026-112653/): Use after free in Safari (not scored)
- [CVE-2026-112652](https://insights.sbomify.com/CVE-2026-112652/): Security feature bypass in iOS and iPadOS (not scored)
- [CVE-2026-112651](https://insights.sbomify.com/CVE-2026-112651/): Use after free in Safari (high 8.8)
- [CVE-2026-11265](https://insights.sbomify.com/CVE-2026-11265/): Information disclosure in Chrome (high 7.5)
- [CVE-2026-112647](https://insights.sbomify.com/CVE-2026-112647/): Security feature bypass in macOS (not scored)
- [CVE-2026-112646](https://insights.sbomify.com/CVE-2026-112646/): Memory corruption in iOS and iPadOS (medium 6.5)
- [CVE-2026-112642](https://insights.sbomify.com/CVE-2026-112642/): Memory corruption in iOS and iPadOS (not scored)
- [CVE-2026-112640](https://insights.sbomify.com/CVE-2026-112640/): Use after free in Safari (not scored)
- [CVE-2026-11264](https://insights.sbomify.com/CVE-2026-11264/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2026-112639](https://insights.sbomify.com/CVE-2026-112639/): Use after free in Safari (not scored)
- [CVE-2026-112638](https://insights.sbomify.com/CVE-2026-112638/): Memory corruption in iOS and iPadOS (not scored)
- [CVE-2026-112637](https://insights.sbomify.com/CVE-2026-112637/): Use after free in Safari (high 8.8)
- [CVE-2026-112634](https://insights.sbomify.com/CVE-2026-112634/): Memory corruption in iOS and iPadOS (medium 6.5)
- [CVE-2026-112633](https://insights.sbomify.com/CVE-2026-112633/): Memory corruption in iOS and iPadOS (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/920/