# Vulnerabilities published in 2026


- [CVE-2026-112008](https://insights.sbomify.com/CVE-2026-112008/): libmng through 2.0.3 Heap Buffer Overflow via ORDR Chunk Reader mng_read_ordr (medium 6.9)
- [CVE-2026-112007](https://insights.sbomify.com/CVE-2026-112007/): Schism Tracker through 20260524 Heap Out-of-Bounds Write via ULT Loader (medium 6.9)
- [CVE-2026-112006](https://insights.sbomify.com/CVE-2026-112006/): OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 Improper Certificate Validation (high 8.3)
- [CVE-2026-112005](https://insights.sbomify.com/CVE-2026-112005/): WhoDB 0.104.0 before 0.135.0 Arbitrary File Read/Write via DuckDB Query Editor (critical 9.2)
- [CVE-2026-112004](https://insights.sbomify.com/CVE-2026-112004/): Teable before 2026-10-12T12-45-53Z.3331 Authorization Bypass via Folder Rename Endpoint (low 2.3)
- [CVE-2026-112003](https://insights.sbomify.com/CVE-2026-112003/): ProjectSend 2.0.0 before 2.7.0 Path Validation Bypass via Orphan File Import/Delete (medium 6.0)
- [CVE-2026-112002](https://insights.sbomify.com/CVE-2026-112002/): ProjectSend 2.5.0 before 2.7.0 Unverified Password Change via /settings/password (high 7.6)
- [CVE-2026-112001](https://insights.sbomify.com/CVE-2026-112001/): ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token Abilities (high 8.6)
- [CVE-2026-112000](https://insights.sbomify.com/CVE-2026-112000/): Vanus 0.8.0 through 0.9.0 Missing Authorization in Gateway Streaming RPCs (high 7.2)
- [CVE-2026-11200](https://insights.sbomify.com/CVE-2026-11200/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-1120](https://insights.sbomify.com/CVE-2026-1120/): Yonyou KSOA HTTP GET Parameter del_work.jsp sql injection (medium 6.9)
- [CVE-2026-111999](https://insights.sbomify.com/CVE-2026-111999/): Vanus 0.8.0 through 0.9.0 Missing Authentication via Gateway CloudEvents HTTP Receiver (high 8.7)
- [CVE-2026-111998](https://insights.sbomify.com/CVE-2026-111998/): Vanus 0.8.0 through 0.9.0 Default Admin Credentials via Gateway (critical 9.3)
- [CVE-2026-111997](https://insights.sbomify.com/CVE-2026-111997/): ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process (medium 6.3)
- [CVE-2026-111993](https://insights.sbomify.com/CVE-2026-111993/): Soarkey StudentManagement AdminDao.java UserDao.login cleartext storage (medium 4.8)
- [CVE-2026-111992](https://insights.sbomify.com/CVE-2026-111992/): itsmeravitejak Online-Examination-System Exam exam.php startExam sql injection (medium 5.3)
- [CVE-2026-111991](https://insights.sbomify.com/CVE-2026-111991/): WongKinYiu yolov9 ONNX Metadata common.py DetectMultiBackend.__init__ code injection (medium 5.3)
- [CVE-2026-111990](https://insights.sbomify.com/CVE-2026-111990/): kishan0725 Hospital Management System Appointment Cancellation admin-panel.php mysqli_query sql injection (medium 6.9)
- [CVE-2026-11199](https://insights.sbomify.com/CVE-2026-11199/): Information disclosure in Chrome (medium 5.9)
- [CVE-2026-111988](https://insights.sbomify.com/CVE-2026-111988/): dyad-sh dyad OAuth Callback cross-site request forgery (medium 5.3)
- [CVE-2026-111987](https://insights.sbomify.com/CVE-2026-111987/): Cross-site scripting in stable-diffusion-webui (medium 5.3)
- [CVE-2026-111986](https://insights.sbomify.com/CVE-2026-111986/): AUTOMATIC1111 stable-diffusion-webui Model Instantiation sd_models.py get_obj_from_str code injection (medium 5.3)
- [CVE-2026-111985](https://insights.sbomify.com/CVE-2026-111985/): Denial of service in stable-diffusion-webui (medium 5.3)
- [CVE-2026-111984](https://insights.sbomify.com/CVE-2026-111984/): AUTOMATIC1111 stable-diffusion-webui Card Builder ui_extra_networks.py create_item_html cross site scripting (medium 5.3)
- [CVE-2026-111982](https://insights.sbomify.com/CVE-2026-111982/): Profile Builder < 4.0.5 - Multisite Subsite Admin+ Network Super Admin Account Takeover via Edit Profile Email Change (high 7.2)
- [CVE-2026-111981](https://insights.sbomify.com/CVE-2026-111981/): GiveWP < 4.19.0.1 - Authenticated Arbitrary Donor Address Modification via donor_manage_addresses (low 2.7)
- [CVE-2026-111980](https://insights.sbomify.com/CVE-2026-111980/): GiveWP < 4.19.0.1 - Give Worker+ Arbitrary Page Modification via Campaign Page Capability Grant (medium 5.5)
- [CVE-2026-11198](https://insights.sbomify.com/CVE-2026-11198/): Security feature bypass in Chrome (critical 9.6)
- [CVE-2026-111979](https://insights.sbomify.com/CVE-2026-111979/): GiveWP < 4.19.0.1 - Give Worker+ Stored XSS via Form Template Primary Color (medium 6.8)
- [CVE-2026-111978](https://insights.sbomify.com/CVE-2026-111978/): GiveWP < 4.19.0.1 - Give Manager+ Path Traversal via Core Settings Import (medium 6.0)
- [CVE-2026-111976](https://insights.sbomify.com/CVE-2026-111976/): GiveWP < 4.19.0.1 - Unauthenticated Unpublished Donation Form Disclosure via Form View Route (medium 5.3)
- [CVE-2026-111974](https://insights.sbomify.com/CVE-2026-111974/): GiveWP < 4.19.0.1 - Unauthenticated Donation Amount Restriction Bypass via Currency (medium 5.3)
- [CVE-2026-111972](https://insights.sbomify.com/CVE-2026-111972/): Photo Engine < 6.5.8 - Author+ Arbitrary Attachment Deletion via IDOR (medium 4.9)
- [CVE-2026-111971](https://insights.sbomify.com/CVE-2026-111971/): Photo Engine < 6.5.8 - Author+ Stored XSS via Collection Name (medium 6.8)
- [CVE-2026-11197](https://insights.sbomify.com/CVE-2026-11197/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-111967](https://insights.sbomify.com/CVE-2026-111967/): MP3 Audio Player by Sonaar 5.9 - 5.15 - Contributor+ Stored XSS via Shortcode Attribute (medium 6.8)
- [CVE-2026-111966](https://insights.sbomify.com/CVE-2026-111966/): Profile Builder < 4.0.5 - Contributor+ Stored XSS via redirect_url Shortcode Attribute (medium 6.8)
- [CVE-2026-111965](https://insights.sbomify.com/CVE-2026-111965/): Profile Builder 4.0.0 - 4.0.4 - Subscriber+ Comment reCAPTCHA Bypass (medium 4.3)
- [CVE-2026-111961](https://insights.sbomify.com/CVE-2026-111961/): Missing authorization in Royal MCP (low 3.8)
- [CVE-2026-111960](https://insights.sbomify.com/CVE-2026-111960/): Royal MCP 1.4.38 - 1.5.9 - Subscriber+ Non-Public Post Disclosure via wp_search Ability (medium 4.3)
- [CVE-2026-11196](https://insights.sbomify.com/CVE-2026-11196/): Memory corruption in Chrome (medium 6.5)
- [CVE-2026-111958](https://insights.sbomify.com/CVE-2026-111958/): Royal MCP < 1.5.7 - Authentication Bypass via Preview Link Token (high 7.5)
- [CVE-2026-111957](https://insights.sbomify.com/CVE-2026-111957/): SUMIT Payment Gateway for WooCommerce < 4.0.0 - Unauthenticated Payment Confirmation Forgery via Redirect Callback (medium 5.3)
- [CVE-2026-111956](https://insights.sbomify.com/CVE-2026-111956/): WholesaleX < 3.0.9 - Unauthenticated Imported User CSV Disclosure (medium 5.9)
- [CVE-2026-111955](https://insights.sbomify.com/CVE-2026-111955/): WholesaleX < 3.0.9 - Unauthenticated Account Activation and Administrator Approval Bypass (medium 6.5)
- [CVE-2026-11195](https://insights.sbomify.com/CVE-2026-11195/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-111949](https://insights.sbomify.com/CVE-2026-111949/): miniOrange 2FA 6.2.9 - 6.3.0 - 2FA Bypass via Passkey Second-Factor Rebinding (high 7.5)
- [CVE-2026-111948](https://insights.sbomify.com/CVE-2026-111948/): Profile Builder < 4.0.1 - Reflected XSS via Unconfirmed Emails Row Actions (high 7.1)
- [CVE-2026-111947](https://insights.sbomify.com/CVE-2026-111947/): Easy Pricing Tables < 4.1.3 - Contributor+ Arbitrary Post Clone and Publish via Legacy Table Duplication (medium 5.5)
- [CVE-2026-111946](https://insights.sbomify.com/CVE-2026-111946/): Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header (medium 5.3)
- [CVE-2026-111943](https://insights.sbomify.com/CVE-2026-111943/): Distrust compromised intermediate certificates in crypto/x509 (not scored)
- [CVE-2026-111942](https://insights.sbomify.com/CVE-2026-111942/): hrisikeshpal Blood_Bank_Management_System abs.php cross site scripting (medium 5.3)
- [CVE-2026-11194](https://insights.sbomify.com/CVE-2026-11194/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-111939](https://insights.sbomify.com/CVE-2026-111939/): Frappe Helpdesk before 1.26.0 Authorization Bypass via raised_by in Ticket Creation (medium 5.1)
- [CVE-2026-111938](https://insights.sbomify.com/CVE-2026-111938/): Frappe CRM before 1.74.0 Missing Authorization via add_note_to_call_log (medium 5.3)
- [CVE-2026-111937](https://insights.sbomify.com/CVE-2026-111937/): Frappe CRM before 1.81.2 Missing Authorization on CRM Notification Records (medium 5.3)
- [CVE-2026-111936](https://insights.sbomify.com/CVE-2026-111936/): Sigma File Manager through 2.2.0 SSRF via Extension Download Commands (medium 5.3)
- [CVE-2026-111935](https://insights.sbomify.com/CVE-2026-111935/): NoteGen through 0.38.3 Local File Disclosure via Chat Image Analysis (low 2.1)
- [CVE-2026-111934](https://insights.sbomify.com/CVE-2026-111934/): Coder before 2.34.7 IP Spoofing via X-Forwarded-For Header (medium 6.3)
- [CVE-2026-111933](https://insights.sbomify.com/CVE-2026-111933/): Coder before 2.34.2 User Enumeration via Login Placeholder Hash (medium 6.3)
- [CVE-2026-111932](https://insights.sbomify.com/CVE-2026-111932/): Coder before 2.34.2 Stored HTML Injection via Appearance Settings (medium 4.8)
- [CVE-2026-111931](https://insights.sbomify.com/CVE-2026-111931/): Coder 2.0.0 before 2.34.8 Open Redirect via Workspace App Proxy (medium 5.3)
- [CVE-2026-111930](https://insights.sbomify.com/CVE-2026-111930/): Coder from 2.26.0 before 2.34.8 Information Disclosure via Workspace ACL Endpoint (medium 5.3)
- [CVE-2026-11193](https://insights.sbomify.com/CVE-2026-11193/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-111929](https://insights.sbomify.com/CVE-2026-111929/): Coder 2.30.0 before 2.34.8 Cross-Organization File Disclosure via DownloadFile RPC (medium 6.0)
- [CVE-2026-111928](https://insights.sbomify.com/CVE-2026-111928/): Coder 2.0.0 before 2.34.8 Authorization Bypass via User-Level ACL in RBAC Policy (medium 5.3)
- [CVE-2026-111927](https://insights.sbomify.com/CVE-2026-111927/): Coder before 2.35.4 Credential Theft via Workspace Proxy Hostname Prefix Match (high 8.7)
- [CVE-2026-111926](https://insights.sbomify.com/CVE-2026-111926/): Coder from 2.10.0 before 2.34.8 Information Disclosure via Agent /debug/manifest (medium 4.8)
- [CVE-2026-111925](https://insights.sbomify.com/CVE-2026-111925/): Mopidy before 4.0.5 Path Traversal via File Backend library.lookup (medium 6.9)
- [CVE-2026-111924](https://insights.sbomify.com/CVE-2026-111924/): Fleet before 4.83.0 Denial of Service via Unbounded Gzip Decompression (high 8.7)
- [CVE-2026-111923](https://insights.sbomify.com/CVE-2026-111923/): Fleet before 4.89.0 Unauthenticated DoS via Apple MDM Enrollment Plist Parsing (high 8.7)
- [CVE-2026-111922](https://insights.sbomify.com/CVE-2026-111922/): Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting Localhost Origins (high 7.2)
- [CVE-2026-111921](https://insights.sbomify.com/CVE-2026-111921/): Vikunja 0.13.0 before 2.7.0 Incorrect Authorization in Link Share Deletion (medium 5.3)
- [CVE-2026-111920](https://insights.sbomify.com/CVE-2026-111920/): Vikunja 2.6.0 Broken Access Control via Inherited Project Permissions (medium 5.3)
- [CVE-2026-11192](https://insights.sbomify.com/CVE-2026-11192/): Other in Chrome (medium 4.3)
- [CVE-2026-111919](https://insights.sbomify.com/CVE-2026-111919/): Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via Webhooks (high 7.1)
- [CVE-2026-111918](https://insights.sbomify.com/CVE-2026-111918/): Vikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Writes via Saved Filter Creation (medium 5.3)
- [CVE-2026-111917](https://insights.sbomify.com/CVE-2026-111917/): Vikunja 2.3.0 before 2.7.0 WebSocket Authentication Ignores Session Revocation (high 7.1)
- [CVE-2026-111916](https://insights.sbomify.com/CVE-2026-111916/): Admidio before 5.0.16 Information Disclosure via rss/links.php Weblinks Feed (medium 6.9)
- [CVE-2026-111915](https://insights.sbomify.com/CVE-2026-111915/): Yank Note before 3.93.1 Path Traversal via /api/help Endpoint (high 8.2)
- [CVE-2026-111914](https://insights.sbomify.com/CVE-2026-111914/): Admidio 5.0.11 before 5.0.16 Broken Access Control via inventory_data.php (high 7.1)
- [CVE-2026-111913](https://insights.sbomify.com/CVE-2026-111913/): Admidio 5.0.0 before 5.0.16 Authorization Bypass via pdfl Mode in lists_show.php (medium 5.3)
- [CVE-2026-111912](https://insights.sbomify.com/CVE-2026-111912/): Admidio 5.0.0 before 5.0.16 IDOR via Forum Topic Update (high 7.1)
- [CVE-2026-111911](https://insights.sbomify.com/CVE-2026-111911/): phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injection (critical 9.3)
- [CVE-2026-111910](https://insights.sbomify.com/CVE-2026-111910/): phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Authorization Bypass via attachment.php Downloads (high 7.1)
- [CVE-2026-11191](https://insights.sbomify.com/CVE-2026-11191/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-111909](https://insights.sbomify.com/CVE-2026-111909/): phpMyFAQ before 4.1.9 Missing Authorization Allows Superadmin Deletion via deleteUser API (high 7.2)
- [CVE-2026-111908](https://insights.sbomify.com/CVE-2026-111908/): phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta BOLA in FAQ Update via REST API (high 8.7)
- [CVE-2026-111907](https://insights.sbomify.com/CVE-2026-111907/): phpMyFAQ 4.0.0 before 4.1.9 CSRF via /admin/api/update-database (high 7.1)
- [CVE-2026-111906](https://insights.sbomify.com/CVE-2026-111906/): phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta CSRF in Elasticsearch/OpenSearch Admin API Index Operations (high 7.1)
- [CVE-2026-111905](https://insights.sbomify.com/CVE-2026-111905/): phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta IDOR Leaks TOTP Secret via /admin/api/user/data (high 7.0)
- [CVE-2026-111904](https://insights.sbomify.com/CVE-2026-111904/): phpMyFAQ 4.2.0-alpha before 4.2.0-beta Information Disclosure via open-questions API (medium 6.9)
- [CVE-2026-111903](https://insights.sbomify.com/CVE-2026-111903/): phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG DTD Entity Bypass (medium 5.1)
- [CVE-2026-111902](https://insights.sbomify.com/CVE-2026-111902/): phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass via Comments and Attachments API (medium 6.9)
- [CVE-2026-111901](https://insights.sbomify.com/CVE-2026-111901/): phpMyFAQ 4.2.0-alpha before 4.2.0-beta Unauthenticated DoS via API Pagination (high 8.7)
- [CVE-2026-111900](https://insights.sbomify.com/CVE-2026-111900/): phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Draft FAQ Attachment Disclosure via attachment.php (medium 5.3)
- [CVE-2026-11190](https://insights.sbomify.com/CVE-2026-11190/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-1119](https://insights.sbomify.com/CVE-2026-1119/): itsourcecode Society Management System delete_activity.php sql injection (medium 6.9)
- [CVE-2026-111899](https://insights.sbomify.com/CVE-2026-111899/): KitchenOwl through 0.7.10 SSRF via Recipe Import scrapeKitchenOwl Fetch (medium 5.3)
- [CVE-2026-111898](https://insights.sbomify.com/CVE-2026-111898/): phpMyFAQ 4.2.0-alpha before 4.2.0-beta Account Takeover via Keycloak Implicit Account Linking (high 7.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/926/