# Vulnerabilities published in 2026


- [CVE-2026-111446](https://insights.sbomify.com/CVE-2026-111446/): Missing authorization in Wheels (high 8.6)
- [CVE-2026-111445](https://insights.sbomify.com/CVE-2026-111445/): Missing authorization in Wheels (high 8.1)
- [CVE-2026-111444](https://insights.sbomify.com/CVE-2026-111444/): SQL injection in Wheels (critical 9.8)
- [CVE-2026-111443](https://insights.sbomify.com/CVE-2026-111443/): Security feature bypass in Wheels (medium 6.5)
- [CVE-2026-111442](https://insights.sbomify.com/CVE-2026-111442/): Cross-site scripting in Backdrop (medium 5.3)
- [CVE-2026-111441](https://insights.sbomify.com/CVE-2026-111441/): HLL 反序列化 lenTotal/lenUsed 校验缺失导致堆越界写 (high 8.1)
- [CVE-2026-111440](https://insights.sbomify.com/CVE-2026-111440/): JDBC LogFactory 任意类加载/构造导致潜在 RCE (high 7.0)
- [CVE-2026-11144](https://insights.sbomify.com/CVE-2026-11144/): Use after free in Chrome (high 8.8)
- [CVE-2026-111439](https://insights.sbomify.com/CVE-2026-111439/): pg_read_binary_file_blocks 缺少初始用户权限校验，普通用户可读取 relation 文件块 (medium 4.3)
- [CVE-2026-111438](https://insights.sbomify.com/CVE-2026-111438/): check_hba_replication 认证与访问控制绕过 (medium 6.5)
- [CVE-2026-11143](https://insights.sbomify.com/CVE-2026-11143/): Memory corruption in Chrome (medium 6.5)
- [CVE-2026-111422](https://insights.sbomify.com/CVE-2026-111422/): Apache Airflow SSH provider: SSHRemoteJobOperator: `environment` values are executed as shell on the remote host (high 8.8)
- [CVE-2026-11142](https://insights.sbomify.com/CVE-2026-11142/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-111419](https://insights.sbomify.com/CVE-2026-111419/): Hardcoded API Token in Foxit Official Website (high 8.6)
- [CVE-2026-111418](https://insights.sbomify.com/CVE-2026-111418/): SSRF and JavaScript Execution in the Foxit Official Website's HTML-to-PDF Service (high 7.5)
- [CVE-2026-111417](https://insights.sbomify.com/CVE-2026-111417/): Cross-user Document Access on Foxit Official Website's HTML-to-PDF Service (high 7.5)
- [CVE-2026-111414](https://insights.sbomify.com/CVE-2026-111414/): WordPress JetElements For Elementor plugin <= 2.9.2.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-111413](https://insights.sbomify.com/CVE-2026-111413/): WordPress aThemeArt theme Helper plugin <= 1.0.8 - Cross Site Request Forgery (CSRF) vulnerability (high 8.8)
- [CVE-2026-111411](https://insights.sbomify.com/CVE-2026-111411/): WordPress FunnelKit Automations plugin <= 3.8.5.2 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-111410](https://insights.sbomify.com/CVE-2026-111410/): WordPress e2pdf plugin <= 1.32.57 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-11141](https://insights.sbomify.com/CVE-2026-11141/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-111409](https://insights.sbomify.com/CVE-2026-111409/): WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.61.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-111408](https://insights.sbomify.com/CVE-2026-111408/): WordPress Quiz And Survey Master plugin <= 11.2.7 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-111407](https://insights.sbomify.com/CVE-2026-111407/): WordPress Tutor LMS plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-111406](https://insights.sbomify.com/CVE-2026-111406/): WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2026-111405](https://insights.sbomify.com/CVE-2026-111405/): WordPress MapSVG plugin <= 8.16.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-111404](https://insights.sbomify.com/CVE-2026-111404/): WordPress Photo Reviews for WooCommerce plugin <= 1.2.31 - Race Condition vulnerability (low 3.7)
- [CVE-2026-111402](https://insights.sbomify.com/CVE-2026-111402/): WordPress Newsletters plugin <= 4.18.1 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-111401](https://insights.sbomify.com/CVE-2026-111401/): WordPress Tailored Tools plugin <= 3.0.3 - Cross Site Request Forgery (CSRF) vulnerability (medium 6.5)
- [CVE-2026-111400](https://insights.sbomify.com/CVE-2026-111400/): WordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-11140](https://insights.sbomify.com/CVE-2026-11140/): Memory corruption in Chrome (medium 6.5)
- [CVE-2026-1114](https://insights.sbomify.com/CVE-2026-1114/): Improper Access Control via Weak JWT Token in parisneo/lollms (critical 9.8)
- [CVE-2026-111399](https://insights.sbomify.com/CVE-2026-111399/): WordPress MapSVG plugin <= 8.16.1 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-111398](https://insights.sbomify.com/CVE-2026-111398/): WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Deletion vulnerability (high 7.7)
- [CVE-2026-111397](https://insights.sbomify.com/CVE-2026-111397/): WordPress MapSVG plugin <= 8.16.1 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-111396](https://insights.sbomify.com/CVE-2026-111396/): WordPress Advanced Post Manager plugin <= 4.5.6 - Broken Access Control vulnerability (high 7.1)
- [CVE-2026-111392](https://insights.sbomify.com/CVE-2026-111392/): SGLang through 0.5.21 KV Cache Poisoning via mm_hashes in /generate (medium 6.3)
- [CVE-2026-111391](https://insights.sbomify.com/CVE-2026-111391/): SGLang 0.5.10 through 0.5.22 Code Injection via Debug Dumper Filter (critical 9.2)
- [CVE-2026-111390](https://insights.sbomify.com/CVE-2026-111390/): Erupt through 2.3.0 HQL Injection via linkTreeVal in Data Table API (medium 6.0)
- [CVE-2026-11139](https://insights.sbomify.com/CVE-2026-11139/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-111389](https://insights.sbomify.com/CVE-2026-111389/): Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation (high 8.3)
- [CVE-2026-111388](https://insights.sbomify.com/CVE-2026-111388/): Frappe before 16.33.0 restrict_ip Allowlist Bypass via API Key, OAuth Authentication (medium 5.3)
- [CVE-2026-111387](https://insights.sbomify.com/CVE-2026-111387/): Nezha 2.2.5 before 2.3.15 Information Disclosure via DDNS List Endpoint (high 7.1)
- [CVE-2026-111386](https://insights.sbomify.com/CVE-2026-111386/): Nezha 1.7.0 before 2.3.15 Cross-Tenant Server-ID Enumeration via getServerConfig (medium 5.3)
- [CVE-2026-111385](https://insights.sbomify.com/CVE-2026-111385/): Nezha 2.1.0 before 2.3.15 Host Header Injection via MCP Transfer Tools (medium 6.3)
- [CVE-2026-111384](https://insights.sbomify.com/CVE-2026-111384/): Nezha 1.0.0 before 2.3.15 Memory Exhaustion via File Manager WebSocket (high 7.1)
- [CVE-2026-111383](https://insights.sbomify.com/CVE-2026-111383/): Nezha 2.0.13 before 2.3.15 Denial of Service via /api/v1/ws/transfer WebSocket (high 7.1)
- [CVE-2026-111382](https://insights.sbomify.com/CVE-2026-111382/): FreeRDP before 3.32.0 Heap Out-of-Bounds Write in AVC444 YUV444 Combine (high 8.7)
- [CVE-2026-111381](https://insights.sbomify.com/CVE-2026-111381/): FreeRDP before 3.32.0 Heap Buffer Overflow via Persistent Cache v2 Parser (high 7.0)
- [CVE-2026-111380](https://insights.sbomify.com/CVE-2026-111380/): FreeRDP 3.29.0 before 3.32.0 Heap Overflow via audin Apple Backends (high 8.7)
- [CVE-2026-11138](https://insights.sbomify.com/CVE-2026-11138/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-111379](https://insights.sbomify.com/CVE-2026-111379/): FreeRDP before 3.32.0 Heap Buffer Overflow via persistent_cache_read_entry_v3 (high 7.0)
- [CVE-2026-111378](https://insights.sbomify.com/CVE-2026-111378/): FreeRDP 3.0.0 before 3.32.0 Unauthenticated Memory Exhaustion via NLA Frame Parser (high 8.7)
- [CVE-2026-111377](https://insights.sbomify.com/CVE-2026-111377/): FreeRDP 2.0.0 before 3.32.0 Memory Exhaustion via Static Channel Reassembly (high 7.1)
- [CVE-2026-111376](https://insights.sbomify.com/CVE-2026-111376/): FreeRDP 3.30.0 before 3.32.0 Heap Over-Read via Windows cliprdr FILECONTENTS_SIZE (low 2.3)
- [CVE-2026-111375](https://insights.sbomify.com/CVE-2026-111375/): FreeRDP 3.0.0 before 3.32.0 Out-of-Bounds Read via RAIL Window Title (medium 6.3)
- [CVE-2026-111374](https://insights.sbomify.com/CVE-2026-111374/): FreeRDP from 3.30.0 before 3.32.0 Resource Exhaustion via rdpecam StartStreamsRequest (medium 6.0)
- [CVE-2026-111373](https://insights.sbomify.com/CVE-2026-111373/): FreeRDP before 3.32.0 NULL Dereference via Zero-Length WebSocket Ping (medium 6.9)
- [CVE-2026-111372](https://insights.sbomify.com/CVE-2026-111372/): Missing authorization in AI ChatBot for WooCommerce – WoowBot (medium 4.3)
- [CVE-2026-11137](https://insights.sbomify.com/CVE-2026-11137/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-111369](https://insights.sbomify.com/CVE-2026-111369/): ClassroomIO through 1.0.0 Incorrect Authorization via Lesson Update and Delete Routes (high 7.1)
- [CVE-2026-111368](https://insights.sbomify.com/CVE-2026-111368/): ClassroomIO through 1.0.0 IDOR via Course Submission Update, Grade and Delete Routes (medium 6.1)
- [CVE-2026-111367](https://insights.sbomify.com/CVE-2026-111367/): BillionMail through 4.9 Forgeable JWTs via Default Signing Key (medium 6.9)
- [CVE-2026-111366](https://insights.sbomify.com/CVE-2026-111366/): cool-admin-midway through 8.0.0 Authorization Bypass via /admin/sys/user Endpoints (high 8.6)
- [CVE-2026-111365](https://insights.sbomify.com/CVE-2026-111365/): cool-admin-midway through 8.0.0 Missing Authorization via System Role Endpoints (high 7.0)
- [CVE-2026-111364](https://insights.sbomify.com/CVE-2026-111364/): MinDoc through 2.2-beta.2 IDOR via /api/:key/content/:id GET Branch (high 7.1)
- [CVE-2026-111363](https://insights.sbomify.com/CVE-2026-111363/): BISHENG through 3.0.0-beta4 IDOR via /api/v1/knowledge/file_bbox (high 7.1)
- [CVE-2026-11136](https://insights.sbomify.com/CVE-2026-11136/): Use after free in Chrome (high 8.8)
- [CVE-2026-111359](https://insights.sbomify.com/CVE-2026-111359/): CRMEB 5.6.1 through 6.0.0 IDOR via giftDetail and receiveGift (high 7.1)
- [CVE-2026-111358](https://insights.sbomify.com/CVE-2026-111358/): SendPortal sendportal-core through 4.0.1 Cross-Workspace Tag Attachment via Subscriber Form (medium 5.3)
- [CVE-2026-111357](https://insights.sbomify.com/CVE-2026-111357/): Privilege escalation in Connect Secure (high 7.0)
- [CVE-2026-111356](https://insights.sbomify.com/CVE-2026-111356/): MacCMS v10 through 2026.1000.4056 Account Takeover via Password Recovery Brute-Force (critical 9.1)
- [CVE-2026-111355](https://insights.sbomify.com/CVE-2026-111355/): zhontai Admin.Core through 10.1.0 Authorization Bypass via User and Organization By-ID Endpoints (medium 5.3)
- [CVE-2026-111354](https://insights.sbomify.com/CVE-2026-111354/): crmeb_java through 3.1 Authorization Bypass via Front Order Express and Refund Endpoints (low 2.3)
- [CVE-2026-111353](https://insights.sbomify.com/CVE-2026-111353/): Peppermint through 0.5.5 Missing Authorization via Time-Tracking and Attachment Upload Endpoints (medium 5.3)
- [CVE-2026-111352](https://insights.sbomify.com/CVE-2026-111352/): ThinkCMF through 8.0.1 Incorrect Authorization in Admin REST API (high 8.7)
- [CVE-2026-111351](https://insights.sbomify.com/CVE-2026-111351/): metasfresh through 5.175 Authorization Bypass via /rest/api/board REST API (low 2.3)
- [CVE-2026-111350](https://insights.sbomify.com/CVE-2026-111350/): Papermark through 0.22.0 Missing Authorization in Data Room Viewer Group API (low 2.3)
- [CVE-2026-11135](https://insights.sbomify.com/CVE-2026-11135/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-111349](https://insights.sbomify.com/CVE-2026-111349/): Craftplan through 0.7.5 Missing Authorization via CRM Customer JSON:API and GraphQL (medium 6.9)
- [CVE-2026-111348](https://insights.sbomify.com/CVE-2026-111348/): Likeshop through 3.5.1 IDOR via AfterSale API Refund Endpoints (medium 5.3)
- [CVE-2026-111347](https://insights.sbomify.com/CVE-2026-111347/): go-ldap-admin through 0.6.2 Hard-Coded RSA Private Key via /base/decryptpwd (high 8.2)
- [CVE-2026-111346](https://insights.sbomify.com/CVE-2026-111346/): ZenTao PMS through 22.6 Authorization Bypass via action::editComment (medium 5.3)
- [CVE-2026-111345](https://insights.sbomify.com/CVE-2026-111345/): Trudesk through 1.2.11 Authorization Bypass via GET /api/v1/messages/conversation/:id (medium 5.3)
- [CVE-2026-111344](https://insights.sbomify.com/CVE-2026-111344/): APITable through 1.14.0-beta Authorization Bypass via GET /node/{nodeId}/description (medium 5.3)
- [CVE-2026-111343](https://insights.sbomify.com/CVE-2026-111343/): pig through 4.1.1 Missing Authorization via GET /admin/user/details/{id} (medium 5.3)
- [CVE-2026-11134](https://insights.sbomify.com/CVE-2026-11134/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-111332](https://insights.sbomify.com/CVE-2026-111332/): OxiCloud 0.9.1 through 0.9.3 Incorrect Authorization via Share Ring Cookie (medium 6.3)
- [CVE-2026-111331](https://insights.sbomify.com/CVE-2026-111331/): Dokploy through 0.30.8 Cross-Organization Authorization Bypass via port tRPC Router (medium 5.3)
- [CVE-2026-111330](https://insights.sbomify.com/CVE-2026-111330/): JuggleIM im-server through 1.8.16 Weak Password Hashing via Unsalted SHA-1 (high 8.2)
- [CVE-2026-11133](https://insights.sbomify.com/CVE-2026-11133/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-111329](https://insights.sbomify.com/CVE-2026-111329/): JuggleIM im-server through 1.8.16 Default Admin Credentials in Admin Console (critical 9.3)
- [CVE-2026-111324](https://insights.sbomify.com/CVE-2026-111324/): rustdesk-api through 2.7 Authorization Bypass via POST /api/sysinfo (medium 6.9)
- [CVE-2026-111323](https://insights.sbomify.com/CVE-2026-111323/): RedAmon through 7.0.1 Unauthenticated SSRF via /tradecraft/verify Endpoint (medium 6.9)
- [CVE-2026-111322](https://insights.sbomify.com/CVE-2026-111322/): Archon 0.2.13 through 0.11.1 Missing Authentication via /api/* Control API (critical 9.3)
- [CVE-2026-111321](https://insights.sbomify.com/CVE-2026-111321/): TaskingAI through 0.3.0 SSRF via OpenAPI servers[0].url in Actions (medium 5.3)
- [CVE-2026-111320](https://insights.sbomify.com/CVE-2026-111320/): ValueCell through 0.1.20 Unauthenticated SSRF via /api/v1/models/check (medium 6.9)
- [CVE-2026-11132](https://insights.sbomify.com/CVE-2026-11132/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-111318](https://insights.sbomify.com/CVE-2026-111318/): Cross-site scripting in HT Mega Addons for Elementor – Elementor Widgets & Template Builder (medium 5.4)
- [CVE-2026-111314](https://insights.sbomify.com/CVE-2026-111314/): affiliate-toolkit <= 3.9.2 - Unauthenticated Stored Cross-Site Scripting via 'atkp_product_producturl' Parameter (high 7.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/930/