# Vulnerabilities published in 2026


- [CVE-2026-111313](https://insights.sbomify.com/CVE-2026-111313/): JobOps through 0.13.1 SSRF via POST /api/manual-jobs/fetch (high 7.1)
- [CVE-2026-111312](https://insights.sbomify.com/CVE-2026-111312/): OpenHealth through 0.2.0 Missing Authentication via /api/health-data/[id] Route (critical 9.2)
- [CVE-2026-111311](https://insights.sbomify.com/CVE-2026-111311/): File upload in DoubleScale CRM | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More (high 8.8)
- [CVE-2026-11131](https://insights.sbomify.com/CVE-2026-11131/): Use after free in Chrome (critical 9.6)
- [CVE-2026-11130](https://insights.sbomify.com/CVE-2026-11130/): Use after free in Chrome (high 8.8)
- [CVE-2026-11129](https://insights.sbomify.com/CVE-2026-11129/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-111284](https://insights.sbomify.com/CVE-2026-111284/): Aureus ERP through 1.6.0 Stored XSS via Time Off Holiday Action Modal (medium 5.1)
- [CVE-2026-111283](https://insights.sbomify.com/CVE-2026-111283/): BMC Helix Network Management 26.3.00 before 26.3.01 Authentication Bypass via SAML Configuration (critical 9.5)
- [CVE-2026-111282](https://insights.sbomify.com/CVE-2026-111282/): iso14229 before 0.10.1 Out-of-Bounds Read via Handle_0x38_RequestFileTransfer (high 8.8)
- [CVE-2026-111281](https://insights.sbomify.com/CVE-2026-111281/): Jooan JA-A12 Unauthenticated Root RCE via SetDiagMode Hard-Coded Credentials (critical 9.3)
- [CVE-2026-111280](https://insights.sbomify.com/CVE-2026-111280/): snap7 through 1.4.3 Out-of-Bounds Write via TSnap7MicroClient::opReadArea (high 8.3)
- [CVE-2026-11128](https://insights.sbomify.com/CVE-2026-11128/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-111279](https://insights.sbomify.com/CVE-2026-111279/): Dragonfly through 2.0.2 Unbounded Memory Allocation via Negative COUNT in HRANDFIELD, ZRANDMEMBER and SRANDMEMBER (high 8.7)
- [CVE-2026-111278](https://insights.sbomify.com/CVE-2026-111278/): NivoCart through 2.5.1 CAPTCHA Bypass via Answer Disclosed in Page HTML (medium 6.9)
- [CVE-2026-111277](https://insights.sbomify.com/CVE-2026-111277/): NivoCart through 2.5.1 Guest Order Invoice Disclosure via account/order/download (high 8.7)
- [CVE-2026-111275](https://insights.sbomify.com/CVE-2026-111275/): nifti_clib through 3.0.1 Stack Out-of-Bounds Access via nifti_convert_n2hdr2nim (medium 6.9)
- [CVE-2026-111274](https://insights.sbomify.com/CVE-2026-111274/): unarr through 1.1.1 Heap Out-of-Bounds Read via zip_parse_extra_fields (medium 6.8)
- [CVE-2026-111273](https://insights.sbomify.com/CVE-2026-111273/): unarr through 1.1.1 Off-by-One Heap Buffer Overflow via tar_get_name (medium 6.9)
- [CVE-2026-111272](https://insights.sbomify.com/CVE-2026-111272/): LibRaw through 0.22.2 Heap Out-of-Bounds Read via parseNikonMakernote ShotInfo (medium 6.8)
- [CVE-2026-111271](https://insights.sbomify.com/CVE-2026-111271/): libmodplug through 0.8.9.1 Heap Out-of-Bounds Read via CSoundFile::ReadAMS2 (medium 6.8)
- [CVE-2026-111270](https://insights.sbomify.com/CVE-2026-111270/): libmodplug through 0.8.9.1 Heap Out-of-Bounds Write via CSoundFile::ReadDSM (medium 6.9)
- [CVE-2026-11127](https://insights.sbomify.com/CVE-2026-11127/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-111269](https://insights.sbomify.com/CVE-2026-111269/): libical through 4.0.6 Heap Out-of-Bounds Read via icalvalue_decode_ical_string (medium 6.9)
- [CVE-2026-11126](https://insights.sbomify.com/CVE-2026-11126/): Information disclosure in Chrome (medium 4.3)
- [CVE-2026-111255](https://insights.sbomify.com/CVE-2026-111255/): File upload in affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display (high 7.5)
- [CVE-2026-111252](https://insights.sbomify.com/CVE-2026-111252/): OpenNMS denial of service via XML entity expansion (medium 6.5)
- [CVE-2026-11125](https://insights.sbomify.com/CVE-2026-11125/): Use after free in Chrome (high 8.8)
- [CVE-2026-11124](https://insights.sbomify.com/CVE-2026-11124/): Integer overflow in Chrome (high 8.8)
- [CVE-2026-111237](https://insights.sbomify.com/CVE-2026-111237/): Ultralytics FastSAM AutoBackend Model Loading autobackend.py session.get_modelmeta.custom_metadata_map eval injection (medium 4.8)
- [CVE-2026-111235](https://insights.sbomify.com/CVE-2026-111235/): OpenNMS REST authorization bypass via non-canonical HTTP method (critical 9.1)
- [CVE-2026-111234](https://insights.sbomify.com/CVE-2026-111234/): SimplePie through 1.9.0 Local File Read via file:// Redirect (high 8.2)
- [CVE-2026-111233](https://insights.sbomify.com/CVE-2026-111233/): Netgate pfSense CE 2.7.1 through 2.9.0 Reflected XSS via firewall_rules.php (low 2.3)
- [CVE-2026-111232](https://insights.sbomify.com/CVE-2026-111232/): Netgate pfSense CE 2.3.0 through 2.9.0 Stored XSS via Separator Color (medium 4.8)
- [CVE-2026-111231](https://insights.sbomify.com/CVE-2026-111231/): Netgate pfSense CE through 2.9.0 Authorization Bypass via config_restore() and config_install() (high 8.6)
- [CVE-2026-111230](https://insights.sbomify.com/CVE-2026-111230/): Netgate pfSense CE through 2.9.0 Local File Read via Dynamic DNS Update URL (medium 6.9)
- [CVE-2026-11123](https://insights.sbomify.com/CVE-2026-11123/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-111229](https://insights.sbomify.com/CVE-2026-111229/): Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via Captive Portal HA Sync (high 8.6)
- [CVE-2026-111228](https://insights.sbomify.com/CVE-2026-111228/): Netgate pfSense CE 2.7.1 through 2.9.0 CRLF Injection via services_unbound_advanced.php (medium 5.1)
- [CVE-2026-111227](https://insights.sbomify.com/CVE-2026-111227/): Netgate pfSense CE through 2.9.0 CRLF Injection via services_unbound_acls.php (medium 5.1)
- [CVE-2026-111226](https://insights.sbomify.com/CVE-2026-111226/): Netgate pfSense CE 2.4.5 through 2.9.0 OS Command Injection via system_advanced_admin.php (high 8.6)
- [CVE-2026-111225](https://insights.sbomify.com/CVE-2026-111225/): Netgate pfSense CE 2.5.0 through 2.9.0 OS Command Injection via openvpn.learn-address.sh (low 2.3)
- [CVE-2026-111224](https://insights.sbomify.com/CVE-2026-111224/): Netgate pfSense CE through 2.9.0 OS Command Injection via openvpn.connect_async.sh (high 7.7)
- [CVE-2026-111223](https://insights.sbomify.com/CVE-2026-111223/): Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via IPsec Mobile Login Banner (high 8.6)
- [CVE-2026-111222](https://insights.sbomify.com/CVE-2026-111222/): Netgate pfSense CE through 2.9.0 php.ini Injection via Timezone Setting (high 7.5)
- [CVE-2026-111221](https://insights.sbomify.com/CVE-2026-111221/): Netgate pfSense CE through 2.9.0 Command Injection via RADIUS Secret mpd.conf Injection (high 7.5)
- [CVE-2026-111220](https://insights.sbomify.com/CVE-2026-111220/): Netgate pfSense CE through 2.9.0 Crontab Injection via PPP Periodic Reset ptpid (high 8.6)
- [CVE-2026-11122](https://insights.sbomify.com/CVE-2026-11122/): Cross-site scripting in Chrome (medium 6.1)
- [CVE-2026-111219](https://insights.sbomify.com/CVE-2026-111219/): Netgate pfSense CE through 2.9.0 Command Injection via PPPoE Server Username (high 7.5)
- [CVE-2026-111218](https://insights.sbomify.com/CVE-2026-111218/): Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper Limiters (high 8.6)
- [CVE-2026-111217](https://insights.sbomify.com/CVE-2026-111217/): Netgate pfSense CE through 2.9.0 OS Command Injection via CARP VHID (high 8.6)
- [CVE-2026-111216](https://insights.sbomify.com/CVE-2026-111216/): Netgate pfSense CE through 2.9.0 OS Command Injection via Gateway Monitor IP (high 8.6)
- [CVE-2026-111215](https://insights.sbomify.com/CVE-2026-111215/): Netgate pfSense CE through 2.9.0 OS Command Injection via Wireless Parent Interface (high 8.6)
- [CVE-2026-111214](https://insights.sbomify.com/CVE-2026-111214/): Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.php (high 8.6)
- [CVE-2026-111213](https://insights.sbomify.com/CVE-2026-111213/): Missing authorization in Travelly – Tour & Travel Booking Manager for WooCommerce (medium 4.3)
- [CVE-2026-111212](https://insights.sbomify.com/CVE-2026-111212/): Code injection in Medical-SAM-Adapter (low 2.4)
- [CVE-2026-111210](https://insights.sbomify.com/CVE-2026-111210/): bitcoinj Payment Request PaymentSession.java url.openConnection server-side request forgery (medium 6.9)
- [CVE-2026-11121](https://insights.sbomify.com/CVE-2026-11121/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-11120](https://insights.sbomify.com/CVE-2026-11120/): Security feature bypass in Chrome (critical 9.6)
- [CVE-2026-1112](https://insights.sbomify.com/CVE-2026-1112/): Sanluan PublicCMS Trade Address Deletion Endpoint TradeAddressController.java delete improper authorization (medium 5.3)
- [CVE-2026-11119](https://insights.sbomify.com/CVE-2026-11119/): Security feature bypass in Chrome (critical 9.6)
- [CVE-2026-111184](https://insights.sbomify.com/CVE-2026-111184/): NoMachine Named Pipe Incorrect Permission Assignment Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2026-111183](https://insights.sbomify.com/CVE-2026-111183/): GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-111181](https://insights.sbomify.com/CVE-2026-111181/): body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body (high 7.5)
- [CVE-2026-11118](https://insights.sbomify.com/CVE-2026-11118/): Use after free in Chrome (high 8.8)
- [CVE-2026-111178](https://insights.sbomify.com/CVE-2026-111178/): WP Booking System <= 2.1.0.1 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter (medium 4.9)
- [CVE-2026-111172](https://insights.sbomify.com/CVE-2026-111172/): @casl/ability 6.7.5 before 7.0.2 Prototype Pollution via rulesToFields setByPath (medium 6.0)
- [CVE-2026-111171](https://insights.sbomify.com/CVE-2026-111171/): Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 CCIP-Read SSRF Bypass (medium 6.3)
- [CVE-2026-111170](https://insights.sbomify.com/CVE-2026-111170/): kedro-datasets 9.3.0 through 9.6.0 Path Traversal via MatplotlibDataset Plot Name (high 7.1)
- [CVE-2026-11117](https://insights.sbomify.com/CVE-2026-11117/): Use after free in Chrome (high 8.8)
- [CVE-2026-111169](https://insights.sbomify.com/CVE-2026-111169/): La Suite Docs through 6.0.1 Authorization Bypass via Comment Thread Creation (low 2.3)
- [CVE-2026-111168](https://insights.sbomify.com/CVE-2026-111168/): LibreDesk before 2.9.0-rc.8 Stored XSS via SVG Upload Content-Type Parameter (medium 5.1)
- [CVE-2026-111167](https://insights.sbomify.com/CVE-2026-111167/): GNU LibreDWG through 0.14.8612 Out-of-Bounds Read in acds_private AcDs Decoder (medium 6.9)
- [CVE-2026-111166](https://insights.sbomify.com/CVE-2026-111166/): libmikmod through 3.3.15 Heap Out-of-Bounds Read via IMF_Load (medium 6.8)
- [CVE-2026-111165](https://insights.sbomify.com/CVE-2026-111165/): libmikmod through 3.3.15 Out-of-Bounds Read in MTM_Load via Channel Count (medium 6.8)
- [CVE-2026-111164](https://insights.sbomify.com/CVE-2026-111164/): UADE through 3.05 Out-of-Bounds Read in uade_filemagic via Short Module (medium 6.8)
- [CVE-2026-111163](https://insights.sbomify.com/CVE-2026-111163/): WildMIDI through 0.5.0 Heap Out-of-Bounds Read via _WM_ParseNewHmi (medium 6.8)
- [CVE-2026-111162](https://insights.sbomify.com/CVE-2026-111162/): WildMIDI through 0.5.0 Heap Out-of-Bounds Read via _WM_ParseNewHmp (medium 6.9)
- [CVE-2026-111161](https://insights.sbomify.com/CVE-2026-111161/): libADLMIDI 1.6.2 through 1.6.2.1 Stack Out-of-Bounds Write via BW_MidiSequencer noteStates (medium 6.9)
- [CVE-2026-111160](https://insights.sbomify.com/CVE-2026-111160/): LightLLM through 1.2.0 Unauthenticated DoS via pd_kv_trans_params Deserialization (high 8.7)
- [CVE-2026-11116](https://insights.sbomify.com/CVE-2026-11116/): Use after free in Chrome (high 8.8)
- [CVE-2026-111159](https://insights.sbomify.com/CVE-2026-111159/): libewf through 20260924 Heap Out-of-Bounds Read via L01 Extended Attribute Parsing (medium 6.9)
- [CVE-2026-111158](https://insights.sbomify.com/CVE-2026-111158/): EarthScope libmseed through 3.5.4 Heap Out-of-Bounds Read via ms3_detect (medium 6.8)
- [CVE-2026-111157](https://insights.sbomify.com/CVE-2026-111157/): SoX through 14.4.2 Heap Out-of-Bounds Write via MS ADPCM WAV Decoding (medium 6.9)
- [CVE-2026-111156](https://insights.sbomify.com/CVE-2026-111156/): libTiMidity through 0.2.8 Out-of-Bounds Access via SoundFont Preset Header (medium 6.9)
- [CVE-2026-111155](https://insights.sbomify.com/CVE-2026-111155/): libTiMidity through 0.2.8 Out-of-Bounds Read via SoundFont Loader sndfont.c (medium 6.9)
- [CVE-2026-111154](https://insights.sbomify.com/CVE-2026-111154/): libTiMidity through 0.2.8 Stack Out-of-Bounds Write via parse_gen in SoundFont Loader (medium 6.9)
- [CVE-2026-111153](https://insights.sbomify.com/CVE-2026-111153/): Game Music Emu (libgme) through 0.6.5 Out-of-Bounds Read via Classic_Emu::mute_voices_ (medium 6.8)
- [CVE-2026-111152](https://insights.sbomify.com/CVE-2026-111152/): Game Music Emu (libgme) through 0.6.5 Heap Out-of-Bounds Read via AY Loader (medium 6.8)
- [CVE-2026-111151](https://insights.sbomify.com/CVE-2026-111151/): OpenJPH through 0.32.0 Heap Out-of-Bounds Write in HTJ2K Cleanup-Pass Decoder (medium 6.9)
- [CVE-2026-111150](https://insights.sbomify.com/CVE-2026-111150/): ValleyBell libvgm through commit a6eed945 Heap Out-of-Bounds Read via DecompressDataBlk (medium 6.8)
- [CVE-2026-11115](https://insights.sbomify.com/CVE-2026-11115/): Use after free in Chrome (high 7.3)
- [CVE-2026-111149](https://insights.sbomify.com/CVE-2026-111149/): FreeImage through 3.19.23 Heap Out-of-Bounds Read via PICT Unpack32Bits (medium 6.9)
- [CVE-2026-111148](https://insights.sbomify.com/CVE-2026-111148/): libsidplayfp through 3.1.1 Heap Out-of-Bounds Read via SidTuneBase::acceptSidTune (medium 6.8)
- [CVE-2026-111147](https://insights.sbomify.com/CVE-2026-111147/): Libyal libesedb through 20260704 Heap Out-of-Bounds Read via libesedb_record_get_multi_value (medium 6.9)
- [CVE-2026-111146](https://insights.sbomify.com/CVE-2026-111146/): ytnef through 2.1.2 Heap Out-of-Bounds Read via MAPIPrint in lib/ytnef.c (medium 6.9)
- [CVE-2026-111145](https://insights.sbomify.com/CVE-2026-111145/): ytnef through 2.1.2 Heap Out-of-Bounds Read via DecompressRTF (medium 6.9)
- [CVE-2026-111144](https://insights.sbomify.com/CVE-2026-111144/): libansilove 1.3.0 through 1.4.2 NULL Pointer Dereference via ansilove_xbin (medium 6.8)
- [CVE-2026-111143](https://insights.sbomify.com/CVE-2026-111143/): Ansilove libansilove through 1.4.2 Out-of-Bounds Read via ansilove_xbin RLE Decoding (medium 6.8)
- [CVE-2026-111142](https://insights.sbomify.com/CVE-2026-111142/): Zziplib through 0.13.80 Out-of-Bounds Read via zzip_disk_findfirst (medium 6.8)
- [CVE-2026-111141](https://insights.sbomify.com/CVE-2026-111141/): zziplib through 0.13.80 Out-of-Bounds Read via __zzip_parse_root_directory ZIP64 Parsing (medium 5.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/931/