# Vulnerabilities published in 2026


- [CVE-2026-111897](https://insights.sbomify.com/CVE-2026-111897/): phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass in Attachment Administration Endpoints (high 7.1)
- [CVE-2026-111896](https://insights.sbomify.com/CVE-2026-111896/): phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG Upload Sanitizer Bypass (medium 5.1)
- [CVE-2026-111895](https://insights.sbomify.com/CVE-2026-111895/): phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta Account Takeover via Entra ID preferred_username (high 7.6)
- [CVE-2026-111894](https://insights.sbomify.com/CVE-2026-111894/): phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Stored XSS via iframe data: URI (medium 5.1)
- [CVE-2026-111893](https://insights.sbomify.com/CVE-2026-111893/): phpMyFAQ 4.2.0-alpha before 4.2.0-beta Privilege Escalation via Group Category Restrictions API (high 8.5)
- [CVE-2026-111892](https://insights.sbomify.com/CVE-2026-111892/): phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Rate Limiting on Password-Reset Endpoints (medium 6.9)
- [CVE-2026-111891](https://insights.sbomify.com/CVE-2026-111891/): phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via Group Permissions API (high 7.0)
- [CVE-2026-111890](https://insights.sbomify.com/CVE-2026-111890/): phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via updateUserRights (high 7.0)
- [CVE-2026-11189](https://insights.sbomify.com/CVE-2026-11189/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-111889](https://insights.sbomify.com/CVE-2026-111889/): phpMyFAQ 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Authorization via Admin Dashboard (medium 5.3)
- [CVE-2026-111888](https://insights.sbomify.com/CVE-2026-111888/): phpMyFAQ 4.0.0 before 4.1.9 Incorrect Authorization via news update API (medium 5.1)
- [CVE-2026-111887](https://insights.sbomify.com/CVE-2026-111887/): phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Account Enumeration via Guest Comment Endpoint (medium 6.9)
- [CVE-2026-111886](https://insights.sbomify.com/CVE-2026-111886/): phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta 2FA Brute-Force via remove-twofactor Endpoint (high 7.1)
- [CVE-2026-111885](https://insights.sbomify.com/CVE-2026-111885/): phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Authorization via deleteGroup API (high 7.0)
- [CVE-2026-111884](https://insights.sbomify.com/CVE-2026-111884/): Auth bypass in phpMyFAQ (high 8.7)
- [CVE-2026-111883](https://insights.sbomify.com/CVE-2026-111883/): Locust through 2.46.7 CSRF via Web UI /stop and /stats/reset (medium 5.3)
- [CVE-2026-111882](https://insights.sbomify.com/CVE-2026-111882/): phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta TOTP 2FA Bypass via SSO Callbacks (high 8.6)
- [CVE-2026-111881](https://insights.sbomify.com/CVE-2026-111881/): FreeRDP 3.14.1 before 3.32.0 Integer Underflow in BMP Writer via Clipboard (high 7.2)
- [CVE-2026-111880](https://insights.sbomify.com/CVE-2026-111880/): FreeRDP 2.0.0 before 3.32.0 Heap Out-of-Bounds Write via NTLM MIC Offset (high 8.3)
- [CVE-2026-11188](https://insights.sbomify.com/CVE-2026-11188/): Use after free in Chrome (high 8.8)
- [CVE-2026-111879](https://insights.sbomify.com/CVE-2026-111879/): DBI versions before 1.656 for Perl hang on a later open of a DBD::DBM table because a failed open_data does not release the table's lock. (not scored)
- [CVE-2026-111877](https://insights.sbomify.com/CVE-2026-111877/): dext34-morgan Books4Cash search.php cross site scripting (medium 5.3)
- [CVE-2026-111876](https://insights.sbomify.com/CVE-2026-111876/): alexpasmantier television entry.rs output command injection (medium 4.8)
- [CVE-2026-111875](https://insights.sbomify.com/CVE-2026-111875/): David-Crty Databasement Scheduled Restore SaveScheduledRestoreRequest.php authorization (medium 5.1)
- [CVE-2026-111874](https://insights.sbomify.com/CVE-2026-111874/): OpenCATS Career Portal CareersUI.php processLogin excessive authentication (medium 6.3)
- [CVE-2026-111873](https://insights.sbomify.com/CVE-2026-111873/): itsmeravitejak Online-Examination-System AJAX Endpoint exammanger.php topicslist sql injection (medium 6.9)
- [CVE-2026-111872](https://insights.sbomify.com/CVE-2026-111872/): itsmeravitejak Online-Examination-System database.php getreport sql injection (medium 6.9)
- [CVE-2026-111871](https://insights.sbomify.com/CVE-2026-111871/): itsmeravitejak Online-Examination-System subjectsdb.php sql injection (medium 6.9)
- [CVE-2026-111870](https://insights.sbomify.com/CVE-2026-111870/): itsmeravitejak Online-Examination-System admin.php isAdmin missing authentication (medium 6.9)
- [CVE-2026-11187](https://insights.sbomify.com/CVE-2026-11187/): Security feature bypass in Chrome (medium 6.3)
- [CVE-2026-111869](https://insights.sbomify.com/CVE-2026-111869/): makeplane API Endpoint reliance on untrusted inputs in a security decision (medium 6.9)
- [CVE-2026-111868](https://insights.sbomify.com/CVE-2026-111868/): datastax pulsar-jms PulsarObjectMessage.java decode deserialization (medium 5.3)
- [CVE-2026-111866](https://insights.sbomify.com/CVE-2026-111866/): nemoTyrant manong func.php arr2sql sql injection (medium 6.9)
- [CVE-2026-111865](https://insights.sbomify.com/CVE-2026-111865/): THU-MIG yoloe AutoBackend Model Loading autobackend.py eval eval injection (medium 4.8)
- [CVE-2026-111862](https://insights.sbomify.com/CVE-2026-111862/): Rank Math SEO PRO 3.0.123 - Unauthenticated Embedded Malicious Code (critical 9.8)
- [CVE-2026-11186](https://insights.sbomify.com/CVE-2026-11186/): Cross-site scripting in Chrome (medium 6.1)
- [CVE-2026-111855](https://insights.sbomify.com/CVE-2026-111855/): Path traversal in 3 Series MDO (high 7.5)
- [CVE-2026-111854](https://insights.sbomify.com/CVE-2026-111854/): Path traversal in 3 Series MDO (high 8.1)
- [CVE-2026-111853](https://insights.sbomify.com/CVE-2026-111853/): Command injection in 3 Series MDO (high 8.8)
- [CVE-2026-111852](https://insights.sbomify.com/CVE-2026-111852/): WordPress Ajax Search Lite plugin <= 4.14.6 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-111851](https://insights.sbomify.com/CVE-2026-111851/): WordPress Royal Elementor Addons plugin <= 1.7.1068 - Arbitrary Code Execution vulnerability (high 7.6)
- [CVE-2026-111850](https://insights.sbomify.com/CVE-2026-111850/): WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-11185](https://insights.sbomify.com/CVE-2026-11185/): Use after free in Chrome (high 8.1)
- [CVE-2026-111849](https://insights.sbomify.com/CVE-2026-111849/): WordPress WpTravelly plugin <= 2.3.5 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-111848](https://insights.sbomify.com/CVE-2026-111848/): WordPress Geo Mashup plugin <= 1.13.22 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-111847](https://insights.sbomify.com/CVE-2026-111847/): WordPress MarketKing plugin <= 2.1.72 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-111845](https://insights.sbomify.com/CVE-2026-111845/): WordPress YITH WooCommerce Product Bundles plugin <= 2.29.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-111844](https://insights.sbomify.com/CVE-2026-111844/): WordPress Brizy plugin 2.8.23 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-111843](https://insights.sbomify.com/CVE-2026-111843/): WordPress Rootblox plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-111842](https://insights.sbomify.com/CVE-2026-111842/): WordPress Sunshine Photo Cart plugin <= 3.7.5 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-111841](https://insights.sbomify.com/CVE-2026-111841/): WordPress FunnelKit Automations plugin <= 3.8.5.2 - Cross Site Request Forgery (CSRF) vulnerability (high 8.8)
- [CVE-2026-111840](https://insights.sbomify.com/CVE-2026-111840/): WordPress Paid Videochat Turnkey Site plugin <= 7.5.14 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-11184](https://insights.sbomify.com/CVE-2026-11184/): Security feature bypass in Chrome (medium 6.3)
- [CVE-2026-111839](https://insights.sbomify.com/CVE-2026-111839/): WordPress Broadcast Live Video plugin <= 7.3.7 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-111838](https://insights.sbomify.com/CVE-2026-111838/): WordPress ThemeHunk Customizer plugin <= 2.8.7 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-111837](https://insights.sbomify.com/CVE-2026-111837/): WordPress Contest Gallery plugin <= 34.0.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-111836](https://insights.sbomify.com/CVE-2026-111836/): WordPress FluentCommunity plugin <= 2.11.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-111835](https://insights.sbomify.com/CVE-2026-111835/): WordPress BjornTech Swish for WooCommerce plugin <= 3.7.8 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-111834](https://insights.sbomify.com/CVE-2026-111834/): WordPress Mang Board WP plugin <= 2.4.4 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2026-111833](https://insights.sbomify.com/CVE-2026-111833/): WordPress weForms plugin <= 1.6.28 - Arbitrary File Deletion vulnerability (high 7.5)
- [CVE-2026-111832](https://insights.sbomify.com/CVE-2026-111832/): WordPress WP Mailster plugin <= 1.9.1.0 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2026-111831](https://insights.sbomify.com/CVE-2026-111831/): WordPress FluentForm plugin <= 6.2.15 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-111830](https://insights.sbomify.com/CVE-2026-111830/): WordPress WP Mailster plugin <= 1.9.1.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-11183](https://insights.sbomify.com/CVE-2026-11183/): Memory corruption in Chrome (medium 6.5)
- [CVE-2026-111829](https://insights.sbomify.com/CVE-2026-111829/): WordPress WP Mailster plugin <= 1.9.1.0 - Local File Inclusion vulnerability (medium 6.5)
- [CVE-2026-111828](https://insights.sbomify.com/CVE-2026-111828/): WordPress Classified Listing plugin <= 6.1.5 - Direct static code injection vulnerability (medium 4.3)
- [CVE-2026-111823](https://insights.sbomify.com/CVE-2026-111823/): Auth bypass in mage-ai (critical 9.8)
- [CVE-2026-111820](https://insights.sbomify.com/CVE-2026-111820/): Analytics Insights <= 6.3.12 - Unauthenticated Stored Cross-Site Scripting via GA4 Realtime Page Title (high 7.2)
- [CVE-2026-11182](https://insights.sbomify.com/CVE-2026-11182/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-111817](https://insights.sbomify.com/CVE-2026-111817/): Apache Traffic Server: Dropping chunked trailers stalls a passthrough transfer until timeout (medium 6.9)
- [CVE-2026-111816](https://insights.sbomify.com/CVE-2026-111816/): Other in Apache Traffic Server (critical 9.2)
- [CVE-2026-111815](https://insights.sbomify.com/CVE-2026-111815/): Apache Traffic Server: TLS session ticket resumption bypasses per-SNI verify_client STRICT enforcement (high 7.8)
- [CVE-2026-111814](https://insights.sbomify.com/CVE-2026-111814/): Security feature bypass in Apache Traffic Server (high 7.8)
- [CVE-2026-111813](https://insights.sbomify.com/CVE-2026-111813/): Command injection in Apache Traffic Server (critical 10.0)
- [CVE-2026-111812](https://insights.sbomify.com/CVE-2026-111812/): Apache Traffic Server: origin_server_auth signs client-controlled AWS headers under the proxy's IAM credentials (high 7.0)
- [CVE-2026-111811](https://insights.sbomify.com/CVE-2026-111811/): Apache Traffic Server: tsmemcache plugin exposes the shared proxy cache over the network with no authentication (critical 9.4)
- [CVE-2026-111810](https://insights.sbomify.com/CVE-2026-111810/): Apache Traffic Server: Unthrottled per-header diagnostic logging enables a log-flood denial of service (high 8.7)
- [CVE-2026-11181](https://insights.sbomify.com/CVE-2026-11181/): Security feature bypass in Chrome (medium 6.3)
- [CVE-2026-111809](https://insights.sbomify.com/CVE-2026-111809/): Apache Traffic Server: HEAD requests carrying Content-Length or Transfer-Encoding enable request smuggling (medium 6.9)
- [CVE-2026-111808](https://insights.sbomify.com/CVE-2026-111808/): Apache Traffic Server: HTTP/2 DATA frame padding underflow lets a client trigger backend worker-pool exhaustion (high 7.7)
- [CVE-2026-111805](https://insights.sbomify.com/CVE-2026-111805/): Apache Traffic Server: HTTP/2 Content-Length truncation lets a client trigger backend worker-pool exhaustion (high 7.7)
- [CVE-2026-111804](https://insights.sbomify.com/CVE-2026-111804/): Apache Traffic Server: wasm plugin has a use-after-free and forwards unvalidated guest metric IDs (high 8.8)
- [CVE-2026-111802](https://insights.sbomify.com/CVE-2026-111802/): Nautilus: nautilus: arbitrary file deletion via trash symlink (medium 6.6)
- [CVE-2026-11180](https://insights.sbomify.com/CVE-2026-11180/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-1118](https://insights.sbomify.com/CVE-2026-1118/): itsourcecode Society Management System add_activity.php sql injection (medium 5.3)
- [CVE-2026-111793](https://insights.sbomify.com/CVE-2026-111793/): Security feature bypass in Webtop Media Transcoder (medium 4.3)
- [CVE-2026-11179](https://insights.sbomify.com/CVE-2026-11179/): Security feature bypass in Chrome (high 8.8)
- [CVE-2026-11178](https://insights.sbomify.com/CVE-2026-11178/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2026-11177](https://insights.sbomify.com/CVE-2026-11177/): Use after free in Chrome (high 8.8)
- [CVE-2026-111767](https://insights.sbomify.com/CVE-2026-111767/): MCP TypeScript SDK: Experimental tasks were not tied to the session that created them (high 8.6)
- [CVE-2026-111766](https://insights.sbomify.com/CVE-2026-111766/): markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled (low 3.7)
- [CVE-2026-111765](https://insights.sbomify.com/CVE-2026-111765/): A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix (high 7.5)
- [CVE-2026-111764](https://insights.sbomify.com/CVE-2026-111764/): A2A Java SDK has a fail-open default task authorization (high 7.5)
- [CVE-2026-111763](https://insights.sbomify.com/CVE-2026-111763/): A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirect (medium 5.7)
- [CVE-2026-111762](https://insights.sbomify.com/CVE-2026-111762/): A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failure (medium 5.7)
- [CVE-2026-111761](https://insights.sbomify.com/CVE-2026-111761/): A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery (medium 5.8)
- [CVE-2026-11176](https://insights.sbomify.com/CVE-2026-11176/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-111759](https://insights.sbomify.com/CVE-2026-111759/): markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes (high 7.5)
- [CVE-2026-111758](https://insights.sbomify.com/CVE-2026-111758/): markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0) (high 7.5)
- [CVE-2026-111757](https://insights.sbomify.com/CVE-2026-111757/): Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/927/