# Vulnerabilities published in 2026


- [CVE-2026-112397](https://insights.sbomify.com/CVE-2026-112397/): Pillow: Out-of-bounds access in _imagingmorph on a zero-width image (high 8.7)
- [CVE-2026-112396](https://insights.sbomify.com/CVE-2026-112396/): Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer (medium 5.9)
- [CVE-2026-112395](https://insights.sbomify.com/CVE-2026-112395/): Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290) (medium 6.5)
- [CVE-2026-112394](https://insights.sbomify.com/CVE-2026-112394/): Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size (medium 6.3)
- [CVE-2026-112393](https://insights.sbomify.com/CVE-2026-112393/): Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO (critical 9.2)
- [CVE-2026-112392](https://insights.sbomify.com/CVE-2026-112392/): Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images (high 8.2)
- [CVE-2026-112391](https://insights.sbomify.com/CVE-2026-112391/): Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree() (medium 6.3)
- [CVE-2026-112390](https://insights.sbomify.com/CVE-2026-112390/): Pillow: Infinite loop in MIC n_frames when the embedded TIFF (high 8.2)
- [CVE-2026-11239](https://insights.sbomify.com/CVE-2026-11239/): Privilege escalation in Chrome (high 7.5)
- [CVE-2026-112381](https://insights.sbomify.com/CVE-2026-112381/): Apache Traffic Server: Nullptr dereference in net_write_io on a POST half-close with chunked response (high 8.2)
- [CVE-2026-112380](https://insights.sbomify.com/CVE-2026-112380/): Missing authorization in the WhatsApp channel in Kiro Crew (critical 9.0)
- [CVE-2026-11238](https://insights.sbomify.com/CVE-2026-11238/): Information disclosure in Chrome (medium 5.9)
- [CVE-2026-112379](https://insights.sbomify.com/CVE-2026-112379/): WordPress Contact Form Email plugin <= 1.3.68 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-112378](https://insights.sbomify.com/CVE-2026-112378/): Use of Less Trusted Source in GitLab (medium 4.3)
- [CVE-2026-112377](https://insights.sbomify.com/CVE-2026-112377/): CCC Attestation SIG attested-tls-poc through commit 731ca82 Attestation Relay Attack (critical 9.1)
- [CVE-2026-112375](https://insights.sbomify.com/CVE-2026-112375/): Apache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterConfigs (not scored)
- [CVE-2026-112373](https://insights.sbomify.com/CVE-2026-112373/): H3C Magic NX15 usrlist sub_416874 stack-based overflow (high 7.1)
- [CVE-2026-112372](https://insights.sbomify.com/CVE-2026-112372/): H3C Magic NX15 upload importprofile path traversal (medium 5.1)
- [CVE-2026-112371](https://insights.sbomify.com/CVE-2026-112371/): H3C Magic NX15 RPC esps write code injection (critical 9.4)
- [CVE-2026-112370](https://insights.sbomify.com/CVE-2026-112370/): H3C Magic NX15 usrlist sub_416874 os command injection (critical 9.4)
- [CVE-2026-11237](https://insights.sbomify.com/CVE-2026-11237/): Other in Chrome (high 8.3)
- [CVE-2026-112368](https://insights.sbomify.com/CVE-2026-112368/): Unbounded Recursion in phongo_bson_visit_document/visit_array: (high 8.2)
- [CVE-2026-112366](https://insights.sbomify.com/CVE-2026-112366/): Picomatch through 4.0.7 ReDoS via single-branch repeated extglob patterns (high 8.7)
- [CVE-2026-112363](https://insights.sbomify.com/CVE-2026-112363/): Crawl4AI 0.8.7 through 0.9.5 SSRF Bypass via SSLCertificate.from_url URL Userinfo (medium 6.9)
- [CVE-2026-112362](https://insights.sbomify.com/CVE-2026-112362/): @fastify/express vulnerable to path-scoped middleware bypass via absolute-form request targets (critical 9.1)
- [CVE-2026-112361](https://insights.sbomify.com/CVE-2026-112361/): Dolibarr CSP document.php protection mechanism (medium 5.3)
- [CVE-2026-112360](https://insights.sbomify.com/CVE-2026-112360/): Netis EAP930 CGI Endpoint debug return200 backdoor (high 8.9)
- [CVE-2026-11236](https://insights.sbomify.com/CVE-2026-11236/): Security feature bypass in Chrome (high 8.3)
- [CVE-2026-112359](https://insights.sbomify.com/CVE-2026-112359/): WordPress WPMobile.App plugin <= 11.86 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-112358](https://insights.sbomify.com/CVE-2026-112358/): TiBillet Lespass APIv1 serializers.py get_img_from_url server-side request forgery (low 2.1)
- [CVE-2026-112357](https://insights.sbomify.com/CVE-2026-112357/): GFI KerioConnect KOFF < 10.0.9p2 Privilege Escalation (high 8.5)
- [CVE-2026-112356](https://insights.sbomify.com/CVE-2026-112356/): GFI KerioConnect < 10.0.9p2 XSS via Link Auto-Formatter (medium 5.1)
- [CVE-2026-112355](https://insights.sbomify.com/CVE-2026-112355/): MembershipWorks WordPress Plugin < 6.17 Information Disclosure via WordPress REST API (high 8.7)
- [CVE-2026-112353](https://insights.sbomify.com/CVE-2026-112353/): GFI KerioConnect < 10.0.8p2 Stored XSS via SVG Attachment (medium 6.2)
- [CVE-2026-112352](https://insights.sbomify.com/CVE-2026-112352/): Sunhillo SureLine Authentication Bypass via Session Cookie (critical 9.1)
- [CVE-2026-112351](https://insights.sbomify.com/CVE-2026-112351/): Sunhillo SureLine OS Command Injection via networkDiag.cgi (high 8.7)
- [CVE-2026-112350](https://insights.sbomify.com/CVE-2026-112350/): Sunhillo SureLine Path Traversal via radarUpdater.cgi (high 8.7)
- [CVE-2026-11235](https://insights.sbomify.com/CVE-2026-11235/): Security feature bypass in Chrome (high 8.8)
- [CVE-2026-112346](https://insights.sbomify.com/CVE-2026-112346/): OpenHands Software Agent SDK < 1.52.0 Unauthenticated Sandbox Agent Server RCE (critical 9.3)
- [CVE-2026-112345](https://insights.sbomify.com/CVE-2026-112345/): TTLock Android App < 9.8.260718 Hardcoded BLE Pairing Key Exposure (high 8.6)
- [CVE-2026-112344](https://insights.sbomify.com/CVE-2026-112344/): Syncplify Server! 6.0.0 < 8.8.0 Symbolic Link Jail Escape (high 7.6)
- [CVE-2026-112343](https://insights.sbomify.com/CVE-2026-112343/): Syncplify Server! < 8.8.0 Permission Override Bypass via Path Casing (high 8.6)
- [CVE-2026-112342](https://insights.sbomify.com/CVE-2026-112342/): Tandoor Recipes < 2.7.0 Cross-Space Permission Cache Poisoning (high 7.1)
- [CVE-2026-11234](https://insights.sbomify.com/CVE-2026-11234/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2026-112333](https://insights.sbomify.com/CVE-2026-112333/): GFI Archiver < 15.14 Stored XSS via MailInsights.aspx (medium 5.1)
- [CVE-2026-112332](https://insights.sbomify.com/CVE-2026-112332/): Motor.NET < 0.19.0 Denial of Service via JsonNet Deserialization (high 8.7)
- [CVE-2026-112331](https://insights.sbomify.com/CVE-2026-112331/): Motor.NET < 0.19.0 Kafka Denial of Service via Structured CloudEvent Mapping (high 8.7)
- [CVE-2026-112330](https://insights.sbomify.com/CVE-2026-112330/): Motor.NET < 0.19.0 RabbitMQ Denial of Service via CloudEvents Headers (high 8.7)
- [CVE-2026-11233](https://insights.sbomify.com/CVE-2026-11233/): Security feature bypass in Chrome (medium 4.7)
- [CVE-2026-112329](https://insights.sbomify.com/CVE-2026-112329/): Sensei LMS 4.26.4 Broken Access Control via save_new_message (medium 5.3)
- [CVE-2026-112328](https://insights.sbomify.com/CVE-2026-112328/): Sensei LMS 4.26.4 Broken Access Control via add_new_module_term AJAX (medium 5.3)
- [CVE-2026-112327](https://insights.sbomify.com/CVE-2026-112327/): WordPress Amelia plugin <= 2.4.11 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-112326](https://insights.sbomify.com/CVE-2026-112326/): Improper Cleanup on Thrown Exception in GitLab (low 3.1)
- [CVE-2026-11232](https://insights.sbomify.com/CVE-2026-11232/): Other in Chrome (medium 5.4)
- [CVE-2026-112313](https://insights.sbomify.com/CVE-2026-112313/): WordPress ACF Extended plugin <= 0.9.2.7 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-112312](https://insights.sbomify.com/CVE-2026-112312/): WordPress ACF Extended plugin <= 0.9.2.7 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-112311](https://insights.sbomify.com/CVE-2026-112311/): WordPress ACF Extended plugin <= 0.9.2.7 - Arbitrary File Deletion vulnerability (medium 6.5)
- [CVE-2026-112310](https://insights.sbomify.com/CVE-2026-112310/): docling-core 2.5.0 before 2.103.0 Local File Disclosure via Plain Path ImageRef (medium 5.3)
- [CVE-2026-11231](https://insights.sbomify.com/CVE-2026-11231/): Code injection in Chrome (high 8.1)
- [CVE-2026-112309](https://insights.sbomify.com/CVE-2026-112309/): @rvf/set-get before 7.0.4 Prototype Pollution via setPath Inherited Methods (high 8.7)
- [CVE-2026-112308](https://insights.sbomify.com/CVE-2026-112308/): crewai-tools through 1.15.28 SSRF via SeleniumScrapingTool (high 8.3)
- [CVE-2026-112307](https://insights.sbomify.com/CVE-2026-112307/): sqlparse through 0.6.0 PHP Code Injection via output_format='php' (high 8.4)
- [CVE-2026-112306](https://insights.sbomify.com/CVE-2026-112306/): NocoBase plugin-collection-sql through 2.2.28 SQL Injection via sqlCollection:setFields (high 8.6)
- [CVE-2026-112305](https://insights.sbomify.com/CVE-2026-112305/): Semaphore UI through 2.19.16 RCE via Task Environment Ansible Variable Override (high 8.7)
- [CVE-2026-112304](https://insights.sbomify.com/CVE-2026-112304/): docTR through 1.1.0 Unsafe Deserialization RCE via load_pretrained_params() (high 7.7)
- [CVE-2026-112303](https://insights.sbomify.com/CVE-2026-112303/): GDevelop through 5.6.284 Cookie Leak via LocalFileDownloader Resource URLs (medium 5.3)
- [CVE-2026-112302](https://insights.sbomify.com/CVE-2026-112302/): kiwilan php-archive Extraction ArchiveZip.php extract path traversal (medium 5.3)
- [CVE-2026-112301](https://insights.sbomify.com/CVE-2026-112301/): orbitale imagemagick-php Command.php font os command injection (medium 6.9)
- [CVE-2026-112300](https://insights.sbomify.com/CVE-2026-112300/): DiffSK configobj __init__.py _sectionmarker redos (medium 6.9)
- [CVE-2026-11230](https://insights.sbomify.com/CVE-2026-11230/): Use after free in Chrome (high 8.8)
- [CVE-2026-1123](https://insights.sbomify.com/CVE-2026-1123/): Yonyou KSOA HTTP GET Parameter work_mod.jsp sql injection (medium 6.9)
- [CVE-2026-112299](https://insights.sbomify.com/CVE-2026-112299/): smrealms smr Album Website AlbumEditProcessor.php isUrlReachable server-side request forgery (medium 5.3)
- [CVE-2026-112297](https://insights.sbomify.com/CVE-2026-112297/): ptbsare anx-calibre-manager LLM Configuration llm.py LLMClient.chat server-side request forgery (medium 5.3)
- [CVE-2026-112296](https://insights.sbomify.com/CVE-2026-112296/): FlyCms through commit edfdf724 Default Super Administrator Credentials (critical 9.3)
- [CVE-2026-112295](https://insights.sbomify.com/CVE-2026-112295/): FlyCms through commit edfdf724 Mass Assignment via /ucenter/account_update (medium 5.3)
- [CVE-2026-112294](https://insights.sbomify.com/CVE-2026-112294/): FlyCms through commit edfdf724 Missing Authorization via Action Counter Endpoint (medium 5.3)
- [CVE-2026-112293](https://insights.sbomify.com/CVE-2026-112293/): BoxyHQ SaaS Starter Kit through 1.6.0 Missing Authorization on Team Payment API (medium 5.3)
- [CVE-2026-112292](https://insights.sbomify.com/CVE-2026-112292/): CheckCle through 1.6.0 Missing Authorization via Empty PocketBase API Rules (critical 9.3)
- [CVE-2026-112291](https://insights.sbomify.com/CVE-2026-112291/): Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 Missing Authorization via Task API (medium 6.9)
- [CVE-2026-112290](https://insights.sbomify.com/CVE-2026-112290/): MI6 @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 DOM XSS via ic-tree-item (low 2.3)
- [CVE-2026-11229](https://insights.sbomify.com/CVE-2026-11229/): Privilege escalation in Chrome (medium 6.1)
- [CVE-2026-112289](https://insights.sbomify.com/CVE-2026-112289/): Koalixcrm through 1.14.0 Stored XSS via Task Title in Django Admin (medium 5.1)
- [CVE-2026-112288](https://insights.sbomify.com/CVE-2026-112288/): Krayin CRM 2.2.5 before 2.2.7 SSRF Filter Bypass via DNS Rebinding (low 2.1)
- [CVE-2026-112287](https://insights.sbomify.com/CVE-2026-112287/): Krayin CRM before 2.2.7 Broken Object Level Authorization in Mail Module (high 7.1)
- [CVE-2026-112286](https://insights.sbomify.com/CVE-2026-112286/): Krayin CRM before 2.2.7 IDOR via Quote Search and Lead-Products Endpoints (high 7.1)
- [CVE-2026-112285](https://insights.sbomify.com/CVE-2026-112285/): Thelia before 3.1.5 and 3.2.4 Coupon Usage Limit Bypass via Pay-Later Orders (medium 5.3)
- [CVE-2026-112284](https://insights.sbomify.com/CVE-2026-112284/): libaribcaption 1.1.0 through 1.1.2 Out-of-Bounds Read via DecoderImpl::HandleGLGR (medium 4.8)
- [CVE-2026-112283](https://insights.sbomify.com/CVE-2026-112283/): libbluray through 1.5.1 Uncontrolled Memory Allocation via _parse_extent_start_points (medium 6.8)
- [CVE-2026-112282](https://insights.sbomify.com/CVE-2026-112282/): VideoLAN libbluray through 1.5.1 Out-of-Bounds Read via clpi_access_point (medium 6.8)
- [CVE-2026-112281](https://insights.sbomify.com/CVE-2026-112281/): libaribb24 through 1.0.3 Stack Buffer Overflow via decoder_handle_csi (medium 6.9)
- [CVE-2026-112280](https://insights.sbomify.com/CVE-2026-112280/): libaribb24 (aribb24) through 1.0.3 Heap Buffer Overflow via parse_data_unit_statement_body (medium 6.9)
- [CVE-2026-11228](https://insights.sbomify.com/CVE-2026-11228/): Other in Chrome (medium 4.3)
- [CVE-2026-112279](https://insights.sbomify.com/CVE-2026-112279/): rdesktop through 1.9.0 Heap Out-of-Bounds Read via process_bmpcache2 (high 7.1)
- [CVE-2026-112278](https://insights.sbomify.com/CVE-2026-112278/): rdesktop through 1.9.0 Heap Out-of-Bounds Read via process_raw_bmpcache (high 7.1)
- [CVE-2026-112277](https://insights.sbomify.com/CVE-2026-112277/): rdesktop through 1.9.0 Heap Out-of-Bounds Read via process_plane (high 7.1)
- [CVE-2026-112276](https://insights.sbomify.com/CVE-2026-112276/): Netpbm through 11.16.00 Heap Out-of-Bounds Read via rasttopnm Colormap (medium 6.9)
- [CVE-2026-112275](https://insights.sbomify.com/CVE-2026-112275/): Netpbm through 11.16.00 Heap Out-of-Bounds Write via rasttopnm pr_load_image (medium 6.9)
- [CVE-2026-112274](https://insights.sbomify.com/CVE-2026-112274/): libtins through 4.6 Out-of-Bounds Read via DNS::soa_record::init (medium 6.3)
- [CVE-2026-112273](https://insights.sbomify.com/CVE-2026-112273/): libtins through 4.6 Heap Out-of-Bounds Read via DNS::compose_name (medium 6.9)
- [CVE-2026-112272](https://insights.sbomify.com/CVE-2026-112272/): libdisplay-info 0.4.0 Heap Out-of-Bounds Read via DisplayID v2 Parser (medium 6.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/923/