# Vulnerabilities published in 2026


- [CVE-2026-111652](https://insights.sbomify.com/CVE-2026-111652/): Engineercms through 2.0.5 Missing Authorization via AttachController.Attachment (medium 6.9)
- [CVE-2026-111651](https://insights.sbomify.com/CVE-2026-111651/): Risesoft Digital-Infrastructure through 9.6.11 Cross-Tenant Data Exposure via DownloadController (high 7.1)
- [CVE-2026-111650](https://insights.sbomify.com/CVE-2026-111650/): ChronoFrame through 1.0.0 Missing Authentication via Setup Wizard API (high 8.8)
- [CVE-2026-11165](https://insights.sbomify.com/CVE-2026-11165/): Use after free in Chrome (critical 9.6)
- [CVE-2026-111649](https://insights.sbomify.com/CVE-2026-111649/): Rocboss paopao-ce through 0.6.0-alpha.3 IDOR via DownloadAttachment Endpoint (high 7.1)
- [CVE-2026-111648](https://insights.sbomify.com/CVE-2026-111648/): BuildAdmin through 2.3.9 IDOR via routine/adminInfo/edit id Parameter (medium 5.1)
- [CVE-2026-111647](https://insights.sbomify.com/CVE-2026-111647/): PickMall lilishop through 5.0.0 IDOR via /buyer/trade/receipt/{id} (medium 5.3)
- [CVE-2026-111646](https://insights.sbomify.com/CVE-2026-111646/): SurveyKing before 1.13.0 Unauthenticated File Download via /api/public/preview (high 8.2)
- [CVE-2026-111645](https://insights.sbomify.com/CVE-2026-111645/): MrDoc through 1.1.1 Missing Authorization via api/import_local_doc/ Endpoint (medium 5.3)
- [CVE-2026-111644](https://insights.sbomify.com/CVE-2026-111644/): Misaka Danmu Server through 2.8.9 Missing Authentication on /api/ui Routes (medium 6.9)
- [CVE-2026-111643](https://insights.sbomify.com/CVE-2026-111643/): Misaka Danmu Server through 2.8.9 Authentication Bypass via Config-History Rollback (critical 9.3)
- [CVE-2026-111642](https://insights.sbomify.com/CVE-2026-111642/): FastapiAdmin through 3.0 Hard-Coded JWT Secret Privilege Escalation (high 8.7)
- [CVE-2026-111641](https://insights.sbomify.com/CVE-2026-111641/): FastapiAdmin through 3.0 Authentication Bypass via Auto-Login Endpoints (critical 9.3)
- [CVE-2026-111640](https://insights.sbomify.com/CVE-2026-111640/): DooTask through 1.9.66 Missing Authorization in OKR Comment Dialogs (medium 5.3)
- [CVE-2026-11164](https://insights.sbomify.com/CVE-2026-11164/): Use after free in Chrome (high 8.8)
- [CVE-2026-111639](https://insights.sbomify.com/CVE-2026-111639/): bbs-go through 4.4.6 Account Takeover via Google One Tap Login (high 8.6)
- [CVE-2026-111638](https://insights.sbomify.com/CVE-2026-111638/): sshportal through 1.19.5 Missing Authorization in 'key show' Command Exposes Private Keys (high 8.3)
- [CVE-2026-111637](https://insights.sbomify.com/CVE-2026-111637/): NexoPOS through 6.2.4 Unauthenticated Transaction Disclosure via /api/fields Endpoint (medium 6.9)
- [CVE-2026-111636](https://insights.sbomify.com/CVE-2026-111636/): OpenBMB StaffDeck through 0.5.6 Authentication Bypass via Hard-Coded Session Secret (critical 9.2)
- [CVE-2026-111635](https://insights.sbomify.com/CVE-2026-111635/): Helical Insight through 7.0.0 Path Traversal via /getExternalResource (medium 5.3)
- [CVE-2026-111634](https://insights.sbomify.com/CVE-2026-111634/): Helical Insight through 7.0.0 SQL Injection via /executeDatasource (high 8.6)
- [CVE-2026-111633](https://insights.sbomify.com/CVE-2026-111633/): ZKEACMS through 4.4 Authentication Bypass via Hard-Coded JWT Signing Key (high 8.8)
- [CVE-2026-111632](https://insights.sbomify.com/CVE-2026-111632/): Aureus ERP through 1.6.0 Multi-Company Authorization Bypass via company_id (medium 5.3)
- [CVE-2026-111631](https://insights.sbomify.com/CVE-2026-111631/): Distributor before 2.3.2 Missing Authorization in External Connection AJAX Actions (medium 5.3)
- [CVE-2026-111630](https://insights.sbomify.com/CVE-2026-111630/): abp-next-admin 10.2.0 through 10.6.0 IDOR in AIManagement Chat Conversations (medium 5.3)
- [CVE-2026-11163](https://insights.sbomify.com/CVE-2026-11163/): Use after free in Chrome (critical 9.6)
- [CVE-2026-111629](https://insights.sbomify.com/CVE-2026-111629/): IoTSharp through 3.6.1 Cross-Tenant Data Exposure via Customers and Devices APIs (medium 5.3)
- [CVE-2026-111628](https://insights.sbomify.com/CVE-2026-111628/): 10up Distributor before 2.3.2 PHP Object Injection via set_meta() (low 2.3)
- [CVE-2026-111627](https://insights.sbomify.com/CVE-2026-111627/): HestiaCP before 1.10.5 Protected Admin Bypass via Cron Job Creation (high 8.6)
- [CVE-2026-111626](https://insights.sbomify.com/CVE-2026-111626/): Webreaper Damselfly through 4.5.3 Missing Authentication on REST API Controllers (critical 9.3)
- [CVE-2026-111625](https://insights.sbomify.com/CVE-2026-111625/): 10up Distributor before 2.3.2 Missing Authorization via dt_push AJAX Action (medium 5.3)
- [CVE-2026-111624](https://insights.sbomify.com/CVE-2026-111624/): Umbraco CMS before 17.7.1 and 18.2.1 Missing Authorization on SignalR Hubs (medium 6.3)
- [CVE-2026-111623](https://insights.sbomify.com/CVE-2026-111623/): Xiaozhi-esp32-server-java through 6.1.0 Authentication Bypass via OTA Endpoint Token Issuance (medium 6.3)
- [CVE-2026-111622](https://insights.sbomify.com/CVE-2026-111622/): smart-sso through 2.1.1 OAuth2 Authorization Code Theft via Unvalidated redirectUri (high 7.6)
- [CVE-2026-111621](https://insights.sbomify.com/CVE-2026-111621/): TDuck Survey Form through 5.3 Missing Authorization via /user/form/setting/{key} (medium 5.3)
- [CVE-2026-111620](https://insights.sbomify.com/CVE-2026-111620/): O2OA through 10.0.2-ce Cross-Work Attachment Read via Attachment Download Endpoint (medium 6.0)
- [CVE-2026-11162](https://insights.sbomify.com/CVE-2026-11162/): Information disclosure in Chrome (medium 4.3)
- [CVE-2026-111619](https://insights.sbomify.com/CVE-2026-111619/): FilePress through 3.0.1 SQL Injection via asc Parameter in filelist.php (high 7.1)
- [CVE-2026-111618](https://insights.sbomify.com/CVE-2026-111618/): CoAI through 4.0.0 Unauthenticated Path Traversal via Archive Download Endpoints (medium 6.9)
- [CVE-2026-111617](https://insights.sbomify.com/CVE-2026-111617/): WHartTest through 2.8.1 Missing Authentication on UI-Automation WebSocket Endpoints (medium 6.9)
- [CVE-2026-111616](https://insights.sbomify.com/CVE-2026-111616/): Oqtane Framework through 10.2.6 Cross-Site Settings Disclosure via Setting API (medium 6.9)
- [CVE-2026-111615](https://insights.sbomify.com/CVE-2026-111615/): Mall4cloud through 4.0 IDOR Exposing Buyer Addresses via order_addr Endpoint (high 7.1)
- [CVE-2026-111614](https://insights.sbomify.com/CVE-2026-111614/): DataCap through 2025.1.1 IDOR via BaseController.getInfoForPath Exposes Credentials (high 7.1)
- [CVE-2026-111613](https://insights.sbomify.com/CVE-2026-111613/): AllData through 0.7.1 Unauthenticated JDBC Injection via /jobJdbcDatasource/test (high 8.7)
- [CVE-2026-111612](https://insights.sbomify.com/CVE-2026-111612/): netdisk-fast-download through 0.4.8 Credential Disclosure via /v2/randomAuth (high 8.7)
- [CVE-2026-111611](https://insights.sbomify.com/CVE-2026-111611/): roncoo-education through 25.0.0-RELEASE IDOR via Order Pay Cancel and Continue Endpoints (medium 5.3)
- [CVE-2026-111610](https://insights.sbomify.com/CVE-2026-111610/): B3log Solo through 4.4.0 Missing Authorization in ArticleConsole (medium 5.3)
- [CVE-2026-11161](https://insights.sbomify.com/CVE-2026-11161/): Information disclosure in Chrome (medium 4.3)
- [CVE-2026-111609](https://insights.sbomify.com/CVE-2026-111609/): PKP Open Journal Systems through 3.5.0-5 Cross-Journal Subscription IDOR via updateSubscription (medium 5.1)
- [CVE-2026-111608](https://insights.sbomify.com/CVE-2026-111608/): Jeepay through 3.2.9 IDOR via DELETE /api/divisionReceivers/{recordId} (low 2.3)
- [CVE-2026-111607](https://insights.sbomify.com/CVE-2026-111607/): Jeepay through 3.2.9 IDOR via POST /api/mch/payConfigs (high 7.1)
- [CVE-2026-111606](https://insights.sbomify.com/CVE-2026-111606/): Huly Platform through 0.7.432 Account Takeover via mergeSpecifiedPersons RPC (high 8.6)
- [CVE-2026-111605](https://insights.sbomify.com/CVE-2026-111605/): Jpom through 2.11.12 Cross-Workspace Authorization Bypass via SshFileController (high 8.6)
- [CVE-2026-111604](https://insights.sbomify.com/CVE-2026-111604/): eladmin through 2.7 Broken Access Control via /api/users Update and Delete (medium 5.1)
- [CVE-2026-111603](https://insights.sbomify.com/CVE-2026-111603/): PlayEdu through 2.3 Missing Authorization via Student CourseController Endpoints (medium 5.3)
- [CVE-2026-111602](https://insights.sbomify.com/CVE-2026-111602/): Information disclosure in Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress (low 3.7)
- [CVE-2026-111601](https://insights.sbomify.com/CVE-2026-111601/): Hippoo Mobile App for WooCommerce <= 1.12.0 - Reflected Cross-Site Scripting via 'token_id' Parameter (medium 6.1)
- [CVE-2026-11160](https://insights.sbomify.com/CVE-2026-11160/): Memory corruption in Chrome (medium 6.5)
- [CVE-2026-1116](https://insights.sbomify.com/CVE-2026-1116/): Cross-site Scripting (XSS) in parisneo/lollms (high 8.2)
- [CVE-2026-111596](https://insights.sbomify.com/CVE-2026-111596/): Kliken: Ads + Pixel for Meta < 1.2.3 - Unauthenticated Order Data Disclosure via IDOR (medium 5.3)
- [CVE-2026-111594](https://insights.sbomify.com/CVE-2026-111594/): InterSystems Corporation InterSystems IRIS for Health Cleartext Transmission of Sensitive Information (critical 9.2)
- [CVE-2026-111590](https://insights.sbomify.com/CVE-2026-111590/): SSRF in Harbor webhook delivery allows ProjectAdmin to reach internal services (not scored)
- [CVE-2026-11159](https://insights.sbomify.com/CVE-2026-11159/): Information disclosure in Chrome (medium 4.3)
- [CVE-2026-111585](https://insights.sbomify.com/CVE-2026-111585/): Integer Overflow in TeamViewer Remote Control Screen Decompression Leading to Heap-Based Buffer Overflow (high 8.8)
- [CVE-2026-111584](https://insights.sbomify.com/CVE-2026-111584/): Local Privilege Escalation via Race Condition in TeamViewer Patch Management for Windows (high 7.3)
- [CVE-2026-111583](https://insights.sbomify.com/CVE-2026-111583/): Local Privilege Escalation during Advanced Asset Management Installation in TeamViewer Client for Windows (high 7.3)
- [CVE-2026-111582](https://insights.sbomify.com/CVE-2026-111582/): Local Privilege Escalation via DLL Hijacking in TeamViewer Monitoring for Windows (high 7.3)
- [CVE-2026-111581](https://insights.sbomify.com/CVE-2026-111581/): Libblockdev: libblockdev: argument injection in ntfs/vfat label-setting helpers via udisks2 setlabel() d-bus method (low 3.3)
- [CVE-2026-11158](https://insights.sbomify.com/CVE-2026-11158/): Security feature bypass in Chrome (high 8.6)
- [CVE-2026-111577](https://insights.sbomify.com/CVE-2026-111577/): GoSMTP < 1.2.5 - Plugin Activator+ Privilege Escalation via SMTP Settings (high 7.2)
- [CVE-2026-111574](https://insights.sbomify.com/CVE-2026-111574/): Redirection for Contact Form 7 2.2.7 - 3.2.11 - Unauthenticated Stored XSS via Lead Debug Metabox (high 7.5)
- [CVE-2026-11157](https://insights.sbomify.com/CVE-2026-11157/): Cross-site scripting in Chrome (medium 5.4)
- [CVE-2026-11156](https://insights.sbomify.com/CVE-2026-11156/): Information disclosure in Chrome (medium 4.3)
- [CVE-2026-111555](https://insights.sbomify.com/CVE-2026-111555/): Luksmeta: missing slot-range validation permits out-of-gap device i/o (medium 6.0)
- [CVE-2026-111551](https://insights.sbomify.com/CVE-2026-111551/): Apache Kafka: Denial of service in Kafka Streams and client deserializers via unbounded memory allocation (not scored)
- [CVE-2026-11155](https://insights.sbomify.com/CVE-2026-11155/): Information disclosure in Chrome (medium 4.3)
- [CVE-2026-111548](https://insights.sbomify.com/CVE-2026-111548/): Memory corruption in NPort W2150A-W4/W2250A-W4 Series (medium 5.3)
- [CVE-2026-11154](https://insights.sbomify.com/CVE-2026-11154/): Use after free in Chrome (high 7.5)
- [CVE-2026-11153](https://insights.sbomify.com/CVE-2026-11153/): Information disclosure in Chrome (critical 9.1)
- [CVE-2026-11152](https://insights.sbomify.com/CVE-2026-11152/): Use after free in Chrome (critical 9.6)
- [CVE-2026-11151](https://insights.sbomify.com/CVE-2026-11151/): Security feature bypass in Chrome (high 7.5)
- [CVE-2026-11150](https://insights.sbomify.com/CVE-2026-11150/): Cross-site scripting in Chrome (medium 6.1)
- [CVE-2026-1115](https://insights.sbomify.com/CVE-2026-1115/): Stored XSS in parisneo/lollms (critical 9.6)
- [CVE-2026-111497](https://insights.sbomify.com/CVE-2026-111497/): Google Brotli Unchecked Return Value (critical 9.2, exploited in the wild)
- [CVE-2026-111496](https://insights.sbomify.com/CVE-2026-111496/): Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuation (not scored)
- [CVE-2026-11149](https://insights.sbomify.com/CVE-2026-11149/): Privilege escalation in Chrome (high 7.5)
- [CVE-2026-11148](https://insights.sbomify.com/CVE-2026-11148/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-111472](https://insights.sbomify.com/CVE-2026-111472/): SQL injection in TSG Profleet (critical 9.3)
- [CVE-2026-11147](https://insights.sbomify.com/CVE-2026-11147/): Use after free in Chrome (high 8.8)
- [CVE-2026-111461](https://insights.sbomify.com/CVE-2026-111461/): SMS upgrade argument reaches system() unescaped in OnCell G3150A-LTE Series (high 7.5)
- [CVE-2026-111460](https://insights.sbomify.com/CVE-2026-111460/): Static HTTPS private key and CA private key in firmware in OnCell G3150A-LTE Series (high 7.7)
- [CVE-2026-11146](https://insights.sbomify.com/CVE-2026-11146/): Security feature bypass in Chrome (critical 9.6)
- [CVE-2026-111459](https://insights.sbomify.com/CVE-2026-111459/): Unauthenticated server-supplied OpenVPN configuration in Moxa Remote Connect Suite (MRC Client) (high 7.6)
- [CVE-2026-111458](https://insights.sbomify.com/CVE-2026-111458/): ssldump Heap Buffer Overflow in FAN/1 X.509 Fingerprint Formatting (medium 6.8)
- [CVE-2026-111451](https://insights.sbomify.com/CVE-2026-111451/): Command injection in Wheels CLI (high 7.8)
- [CVE-2026-111450](https://insights.sbomify.com/CVE-2026-111450/): Information disclosure in Wheels (medium 5.9)
- [CVE-2026-11145](https://insights.sbomify.com/CVE-2026-11145/): Race condition in Chrome (medium 5.3)
- [CVE-2026-111449](https://insights.sbomify.com/CVE-2026-111449/): Race condition in Wheels (medium 5.9)
- [CVE-2026-111448](https://insights.sbomify.com/CVE-2026-111448/): Path traversal in Wheels (low 3.7)
- [CVE-2026-111447](https://insights.sbomify.com/CVE-2026-111447/): Business logic in Wheels (high 8.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/929/