# Vulnerabilities published in 2026


- [CVE-2026-111756](https://insights.sbomify.com/CVE-2026-111756/): follow-redirects array-form headers bypass cross-origin credential stripping (high 8.2)
- [CVE-2026-111755](https://insights.sbomify.com/CVE-2026-111755/): follow-redirects sensitiveHeaders regex escaping can expose credential headers (high 8.2)
- [CVE-2026-111750](https://insights.sbomify.com/CVE-2026-111750/): AIOHTTP: Pure-Python parser request smuggling (medium 6.3)
- [CVE-2026-11175](https://insights.sbomify.com/CVE-2026-11175/): Other in Chrome (high 8.8)
- [CVE-2026-111749](https://insights.sbomify.com/CVE-2026-111749/): AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies (low 2.3)
- [CVE-2026-111748](https://insights.sbomify.com/CVE-2026-111748/): AIOHTTP: Absolute-form request targets can spoof Request.scheme (medium 6.3)
- [CVE-2026-11174](https://insights.sbomify.com/CVE-2026-11174/): Security feature bypass in Chrome (medium 5.3)
- [CVE-2026-111739](https://insights.sbomify.com/CVE-2026-111739/): Auth bypass in All-In-One Security (AIOS) (high 7.5)
- [CVE-2026-111738](https://insights.sbomify.com/CVE-2026-111738/): Speed Optimizer < 7.8.5 - Admin+ Network Option Update via enable-option/disable-option (medium 5.5)
- [CVE-2026-111737](https://insights.sbomify.com/CVE-2026-111737/): Speed Optimizer < 7.8.5 - Admin+ Stored XSS via DNS Prefetch and Font Preload URL Lists (low 3.5)
- [CVE-2026-111736](https://insights.sbomify.com/CVE-2026-111736/): NULL pointer dereference on implicit read of user specific record index (high 8.7)
- [CVE-2026-111735](https://insights.sbomify.com/CVE-2026-111735/): Integer underflow leads to out-of-bounds read in pf_cpm_c_data_ind() (high 7.1)
- [CVE-2026-111734](https://insights.sbomify.com/CVE-2026-111734/): Missing length validation of EtherType, VLAN and FrameID fields in pf_eth_recv() (high 7.1)
- [CVE-2026-111733](https://insights.sbomify.com/CVE-2026-111733/): NULL pointer dereference on implicit read of AR specific record index (high 8.7)
- [CVE-2026-111732](https://insights.sbomify.com/CVE-2026-111732/): Out-of-bounds write when parsing AR Vendor Block requests (critical 9.3)
- [CVE-2026-111731](https://insights.sbomify.com/CVE-2026-111731/): Infinite loop when reading PDPortDataCheck record of subslot 0 (high 8.7)
- [CVE-2026-111730](https://insights.sbomify.com/CVE-2026-111730/): Out-of-bounds write in CheckPeers block parser due to unvalidated peer station name length (high 7.2)
- [CVE-2026-11173](https://insights.sbomify.com/CVE-2026-11173/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-111728](https://insights.sbomify.com/CVE-2026-111728/): Seanime v3.10.3 Argument Injection via TranscodeHwAccelCustomSettings (medium 5.3)
- [CVE-2026-111727](https://insights.sbomify.com/CVE-2026-111727/): Cross-site scripting in Appointment Booking Calendar (medium 6.4)
- [CVE-2026-111726](https://insights.sbomify.com/CVE-2026-111726/): Themify Builder <= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'visible' Shortcode Attribute (medium 6.4)
- [CVE-2026-111723](https://insights.sbomify.com/CVE-2026-111723/): LingGuo-Drama through commit 8a6924a Broken Access Control via /admin/v1/admins API (high 8.7)
- [CVE-2026-111722](https://insights.sbomify.com/CVE-2026-111722/): LingGuo-Drama through commit 8a6924a IDOR via /admin/v1/projects/:id API (high 8.6)
- [CVE-2026-111721](https://insights.sbomify.com/CVE-2026-111721/): Open WES through 1.0.0 Broken Access Control via GlobalGatewayFilter Warehouse Scoping (medium 5.3)
- [CVE-2026-111720](https://insights.sbomify.com/CVE-2026-111720/): fish-island-backend through commit 7c61b78 SSRF via /api/web/parse (medium 6.9)
- [CVE-2026-11172](https://insights.sbomify.com/CVE-2026-11172/): Other in Chrome (high 8.8)
- [CVE-2026-111719](https://insights.sbomify.com/CVE-2026-111719/): Roncoo-pay through commit 9428382 Information Disclosure via /f2fPay/order/query (high 8.2)
- [CVE-2026-111718](https://insights.sbomify.com/CVE-2026-111718/): AipexBase through commit 690adb9 SQL Injection via /api/data/invoke (high 7.1)
- [CVE-2026-111717](https://insights.sbomify.com/CVE-2026-111717/): Arkon through 0.9.2 Missing Authorization via Skills Versions API (medium 5.3)
- [CVE-2026-111716](https://insights.sbomify.com/CVE-2026-111716/): Arkon through 0.9.2 Broken Access Control via Sources By-ID Routes (medium 5.3)
- [CVE-2026-111715](https://insights.sbomify.com/CVE-2026-111715/): Arkon through 0.9.2 Missing Authorization via Wiki Graph Neighborhood API (medium 5.3)
- [CVE-2026-111714](https://insights.sbomify.com/CVE-2026-111714/): tarteaucitron.js before 1.37.0 ReDoS via Unescaped Cookie Name in cookie.purge (low 2.3)
- [CVE-2026-111713](https://insights.sbomify.com/CVE-2026-111713/): tarteaucitron.js before 1.37.0 XSS via getElemAttr Attribute Validation Mismatch (medium 5.1)
- [CVE-2026-111712](https://insights.sbomify.com/CVE-2026-111712/): Netcore NR256CN through 1.5.140116 Authentication Bypass via CGI Path Prefix (medium 6.9)
- [CVE-2026-111711](https://insights.sbomify.com/CVE-2026-111711/): Netcore NR256CN through 1.5.140116 Pre-Auth Stack Overflow via Boa user_ok() (critical 9.3)
- [CVE-2026-111710](https://insights.sbomify.com/CVE-2026-111710/): Netcore NR256CN through 1.5.140116 Boa Web Server NULL Pointer Dereference DoS (high 8.7)
- [CVE-2026-11171](https://insights.sbomify.com/CVE-2026-11171/): Integer overflow in Chrome (high 8.8)
- [CVE-2026-111709](https://insights.sbomify.com/CVE-2026-111709/): WhaTicket Community through commit cf04795 IDOR via /tickets/:ticketId and /messages/:ticketId (medium 5.3)
- [CVE-2026-111708](https://insights.sbomify.com/CVE-2026-111708/): WhaTicket Community through commit cf04795 Admin Self-Registration via /auth/signup (critical 9.3)
- [CVE-2026-111707](https://insights.sbomify.com/CVE-2026-111707/): 99AI through 4.3.0 IDOR via /api/chatLog/querySingleChat Chat Message Disclosure (medium 6.9)
- [CVE-2026-111706](https://insights.sbomify.com/CVE-2026-111706/): 99AI through 4.3.0 Unauthenticated Information Disclosure via chatLog exportExcel (high 8.7)
- [CVE-2026-111705](https://insights.sbomify.com/CVE-2026-111705/): Fuint through commit 57ec018 IDOR via bookId in myBookDetail (medium 5.3)
- [CVE-2026-111704](https://insights.sbomify.com/CVE-2026-111704/): LangChat through commit 2a6285a Missing Authentication on REST API Controllers (critical 9.3)
- [CVE-2026-111703](https://insights.sbomify.com/CVE-2026-111703/): yshop-crm through 2.1.3 IDOR via CRM customer by-id endpoints (medium 5.3)
- [CVE-2026-111702](https://insights.sbomify.com/CVE-2026-111702/): ChatOllama through commit 96c3ce5 IDOR Exposes Private Knowledge Bases (high 8.7)
- [CVE-2026-111701](https://insights.sbomify.com/CVE-2026-111701/): OtterMind Nubase through 0.1.4 Missing Authentication in Storage Object API (high 8.3)
- [CVE-2026-111700](https://insights.sbomify.com/CVE-2026-111700/): WebVella ERP through 1.8.8 SQL Injection via EQL Query API (high 7.1)
- [CVE-2026-11170](https://insights.sbomify.com/CVE-2026-11170/): Privilege escalation in Chrome (high 8.1)
- [CVE-2026-1117](https://insights.sbomify.com/CVE-2026-1117/): Improper Access Control in parisneo/lollms (high 8.2)
- [CVE-2026-111699](https://insights.sbomify.com/CVE-2026-111699/): Niefy wx-api through 0.8.2 Authentication Bypass via Unverified openid Cookie (medium 6.3)
- [CVE-2026-111698](https://insights.sbomify.com/CVE-2026-111698/): HUIZHI ChargeOS cloud through 3.0.9 Unpaid Wallet Credit via /pay/xcxRecharge (high 7.1)
- [CVE-2026-111697](https://insights.sbomify.com/CVE-2026-111697/): HUIZHI ChargeOS cloud through 3.0.9 IDOR via hcp-mp Member and Order APIs (high 7.1)
- [CVE-2026-111696](https://insights.sbomify.com/CVE-2026-111696/): data-platform-open through commit efeacd3 Hardcoded AES Key for Datasource Passwords (high 7.1)
- [CVE-2026-111695](https://insights.sbomify.com/CVE-2026-111695/): Shaiwz data-platform-open through commit efeacd3 IDOR in Datasource API (high 7.1)
- [CVE-2026-111694](https://insights.sbomify.com/CVE-2026-111694/): qKnow through 2.4.3 Missing Authentication via /flyflow Workflow Endpoints (medium 6.9)
- [CVE-2026-111693](https://insights.sbomify.com/CVE-2026-111693/): DataBuff ai-apm-web through 0.1.10 Hard-Coded Default Admin Credentials (critical 9.3)
- [CVE-2026-111692](https://insights.sbomify.com/CVE-2026-111692/): DataBuff ai-apm-web through 0.1.10 Authentication Bypass via Hardcoded HMAC Secret (critical 9.3)
- [CVE-2026-111691](https://insights.sbomify.com/CVE-2026-111691/): WIMOOR through commit ec86736 Authentication Bypass via Forged X-USERINFO Header (critical 9.1)
- [CVE-2026-111690](https://insights.sbomify.com/CVE-2026-111690/): Simple Admin Core through 1.8.7 Hard-Coded JWT Secret Authentication Bypass (critical 9.3)
- [CVE-2026-11169](https://insights.sbomify.com/CVE-2026-11169/): Cross-site scripting in Chrome (high 8.1)
- [CVE-2026-111689](https://insights.sbomify.com/CVE-2026-111689/): XBoot through 3.3.4 Authorization Bypass via getByDepartmentId Endpoint (medium 5.3)
- [CVE-2026-111688](https://insights.sbomify.com/CVE-2026-111688/): Exrick XBoot through 3.3.4 Data-Scope Bypass via openDataFilter Parameter (medium 5.3)
- [CVE-2026-111687](https://insights.sbomify.com/CVE-2026-111687/): WeRSS (we-mp-rss) through 1.5.3 RCE via template Parameter in /rss Endpoint (critical 9.3)
- [CVE-2026-111686](https://insights.sbomify.com/CVE-2026-111686/): IceCMS through 4.1.5 SQL Injection via /WebArticle/findarticlesbynum (high 8.7)
- [CVE-2026-111685](https://insights.sbomify.com/CVE-2026-111685/): IceCMS through 4.1.5 SQL Injection via /WebResource/findresourcebynum (high 8.7)
- [CVE-2026-111684](https://insights.sbomify.com/CVE-2026-111684/): Magistrala through 1.0.0 Cross-Tenant Authorization Bypass in Certs Service (high 7.2)
- [CVE-2026-111683](https://insights.sbomify.com/CVE-2026-111683/): Allegro Ralph through 20260902.1 Missing Authorization in Data Center Rack API (medium 5.3)
- [CVE-2026-111682](https://insights.sbomify.com/CVE-2026-111682/): EFAK 5.0.0 through 5.1.0 Missing Authorization via /api/model-config Exposes API Keys (high 7.1)
- [CVE-2026-111681](https://insights.sbomify.com/CVE-2026-111681/): EFAK through 5.1.0 Privilege Escalation via /api/users REST API (high 8.7)
- [CVE-2026-111680](https://insights.sbomify.com/CVE-2026-111680/): APIPark through 1.9.7-beta Cross-Team Authorization Bypass via Team Query Parameter (high 7.2)
- [CVE-2026-11168](https://insights.sbomify.com/CVE-2026-11168/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-111679](https://insights.sbomify.com/CVE-2026-111679/): Ekko Studio through 0.7.36 Missing Authorization via /api/auth/locked-ips (medium 5.3)
- [CVE-2026-111678](https://insights.sbomify.com/CVE-2026-111678/): Antiword through 0.37 Stack Out-of-Bounds Read via prop8.c FKP Parsing (medium 4.8)
- [CVE-2026-111677](https://insights.sbomify.com/CVE-2026-111677/): Antiword through 0.37 Heap Out-of-Bounds Read via vGet8LstInfo in prop8.c (medium 6.8)
- [CVE-2026-111676](https://insights.sbomify.com/CVE-2026-111676/): Faveo Helpdesk through 2.0.3 Broken Access Control via /ticket/tooltip Endpoint (medium 5.3)
- [CVE-2026-111675](https://insights.sbomify.com/CVE-2026-111675/): Course-tencent-cloud through 2.0.1 Verification Code Brute Force Account Takeover (critical 9.1)
- [CVE-2026-111674](https://insights.sbomify.com/CVE-2026-111674/): Tbed through 20240319 Missing Authorization via setImgFileName Endpoint (medium 5.3)
- [CVE-2026-111673](https://insights.sbomify.com/CVE-2026-111673/): IceCMS through 4.1.5 Missing Authentication via /User Administrative Endpoints (critical 9.3)
- [CVE-2026-111672](https://insights.sbomify.com/CVE-2026-111672/): Cube-studio through 2026.09.01 IDOR via Pipeline View and Copy Endpoints (medium 5.3)
- [CVE-2026-111671](https://insights.sbomify.com/CVE-2026-111671/): Cube-studio through 2026.09.01 IDOR via Notebook and Serving Lifecycle Endpoints (high 7.1)
- [CVE-2026-111670](https://insights.sbomify.com/CVE-2026-111670/): ClickVisual through 1.1.2 Missing Authorization in apiv2 Report Module (medium 5.3)
- [CVE-2026-11167](https://insights.sbomify.com/CVE-2026-11167/): Security feature bypass in Chrome (critical 9.6)
- [CVE-2026-111669](https://insights.sbomify.com/CVE-2026-111669/): ZR.Admin.NET through 3.8.2 SQL Injection via PagerInfo.Sort ORDER BY (high 7.1)
- [CVE-2026-111668](https://insights.sbomify.com/CVE-2026-111668/): AIHelms through 0.1.25 Missing Authorization in Efficiency Analytics API (medium 5.3)
- [CVE-2026-111667](https://insights.sbomify.com/CVE-2026-111667/): REBUILD through 4.5.0 Missing Authorization via /project/comments/list Endpoint (medium 5.3)
- [CVE-2026-111666](https://insights.sbomify.com/CVE-2026-111666/): Steedos Platform through 3.0.15-beta.51 Cross-Tenant Information Disclosure via Reports API (medium 5.3)
- [CVE-2026-111665](https://insights.sbomify.com/CVE-2026-111665/): Piranha CMS through 12.2 Missing Authorization in Manager Language API (medium 5.3)
- [CVE-2026-111664](https://insights.sbomify.com/CVE-2026-111664/): Safing Portmaster before 2.2.5 Unauthenticated Forced Downgrade via /api/v1/updates/from-url (medium 4.8)
- [CVE-2026-111663](https://insights.sbomify.com/CVE-2026-111663/): Chaskiq through 2.0.3 SSRF via createUrlUpload GraphQL Mutation (critical 9.2)
- [CVE-2026-111662](https://insights.sbomify.com/CVE-2026-111662/): Chaskiq through 2.0.3 Unauthenticated SSRF via /oembed Endpoint (medium 6.9)
- [CVE-2026-111661](https://insights.sbomify.com/CVE-2026-111661/): waynboot-mall through 2.0.0 Missing Authentication via /callback/email Mail Endpoint (medium 6.9)
- [CVE-2026-111660](https://insights.sbomify.com/CVE-2026-111660/): waynboot-mall through 2.0.0 Missing Authentication via /callback/order/unpaid (medium 6.9)
- [CVE-2026-11166](https://insights.sbomify.com/CVE-2026-11166/): Cross-site scripting in Chrome (medium 6.8)
- [CVE-2026-111659](https://insights.sbomify.com/CVE-2026-111659/): Waynboot-mall through 2.0.0 Unauthenticated Order Forgery via /callback/order/submit (medium 6.9)
- [CVE-2026-111658](https://insights.sbomify.com/CVE-2026-111658/): SiteServer SSCMS through 7.4.0 Cross-Site Authorization Bypass via Channels API (medium 5.1)
- [CVE-2026-111657](https://insights.sbomify.com/CVE-2026-111657/): BeikeShop through 2.0.0.31 IDOR via RMA mark_as_shipped Endpoint (medium 5.3)
- [CVE-2026-111656](https://insights.sbomify.com/CVE-2026-111656/): ChatWiki through 2.9.6 Cross-Tenant IDOR via Form Filter Management Endpoints (medium 5.3)
- [CVE-2026-111655](https://insights.sbomify.com/CVE-2026-111655/): ThinkAdmin think-plugs-admin through 1.0.81 IDOR via admin/file.edit (medium 5.1)
- [CVE-2026-111654](https://insights.sbomify.com/CVE-2026-111654/): FastBee through 2.1.0 IDOR via /iot/group By-ID Endpoints (medium 5.3)
- [CVE-2026-111653](https://insights.sbomify.com/CVE-2026-111653/): 53AIHub through 0.5.3 Missing Authentication via PUT /api/enterprises/:id (medium 6.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/928/