# Vulnerabilities published in 2026


- [CVE-2026-111140](https://insights.sbomify.com/CVE-2026-111140/): libregf through 20260526 Heap Out-of-Bounds Read via libregf_value_item_read_value_data (medium 6.9)
- [CVE-2026-11114](https://insights.sbomify.com/CVE-2026-11114/): Use after free in Chrome (critical 9.6)
- [CVE-2026-111139](https://insights.sbomify.com/CVE-2026-111139/): NetSurf libnsbmp through 0.1.7 Out-of-Bounds Read via bmp_decode_mask (medium 6.8)
- [CVE-2026-111138](https://insights.sbomify.com/CVE-2026-111138/): NetSurf libnsbmp through 0.1.7 Out-of-Bounds Read in RLE8 and RLE4 Decoders (medium 6.8)
- [CVE-2026-111137](https://insights.sbomify.com/CVE-2026-111137/): libsmi through 0.5.0 Out-of-Bounds Write via smiValueAsString OCTET STRING DEFVAL (medium 6.9)
- [CVE-2026-111136](https://insights.sbomify.com/CVE-2026-111136/): libInstPatch through 1.1.7 Heap Out-of-Bounds Write via ipatch_sf2_gen_is_valid (medium 6.9)
- [CVE-2026-111135](https://insights.sbomify.com/CVE-2026-111135/): libfwsi through 20260522 Heap Out-of-Bounds Read via libfwsi_mtp_volume_values_read_data (medium 6.9)
- [CVE-2026-111134](https://insights.sbomify.com/CVE-2026-111134/): libfwsi through 20260522 Heap Out-of-Bounds Read via libfwsi_mtp_file_entry_values_read_data (medium 6.9)
- [CVE-2026-111133](https://insights.sbomify.com/CVE-2026-111133/): libfsapfs through 20260921 Heap Out-of-Bounds Read via libfsapfs_key_encrypted_key_read_data (medium 6.9)
- [CVE-2026-111132](https://insights.sbomify.com/CVE-2026-111132/): GNOME libgxps through 0.3.2 Heap Out-of-Bounds Read via path_geometry_start_element (medium 6.9)
- [CVE-2026-111131](https://insights.sbomify.com/CVE-2026-111131/): libxmp through 4.7.4 Stack Out-of-Bounds Read via P61A Depacker (medium 6.9)
- [CVE-2026-111130](https://insights.sbomify.com/CVE-2026-111130/): OpenSlide through 4.0.1 Heap Out-of-Bounds Read via MIRAX get_tile_position (medium 6.9)
- [CVE-2026-11113](https://insights.sbomify.com/CVE-2026-11113/): Security feature bypass in Chrome (critical 9.6)
- [CVE-2026-111129](https://insights.sbomify.com/CVE-2026-111129/): Assimp through 6.0.5 NULL Pointer Dereference via Ogre Animation Track (medium 6.8)
- [CVE-2026-111128](https://insights.sbomify.com/CVE-2026-111128/): Assimp through 6.0.5 NULL Pointer Dereference via Ogre Importer Bone Assignment (medium 6.8)
- [CVE-2026-111127](https://insights.sbomify.com/CVE-2026-111127/): catdoc through 0.95 Out-of-Bounds Read via xls2csv copy_unicode_string (medium 6.9)
- [CVE-2026-111126](https://insights.sbomify.com/CVE-2026-111126/): catdoc through 0.95 Out-of-Bounds Read in xls2csv MULRK Record Handler (medium 6.9)
- [CVE-2026-111125](https://insights.sbomify.com/CVE-2026-111125/): CFITSIO through 4.7.0 Heap Out-of-Bounds Read via HCOMPRESS input_nnybble (medium 6.9)
- [CVE-2026-111124](https://insights.sbomify.com/CVE-2026-111124/): CFITSIO through 4.7.0 Heap Out-of-Bounds Read via Negative ZDITHER0 Seed (medium 6.9)
- [CVE-2026-111123](https://insights.sbomify.com/CVE-2026-111123/): FluidSynth through 2.6.1 Out-of-Bounds Write via SoundFont Modulator Destination (medium 6.9)
- [CVE-2026-111122](https://insights.sbomify.com/CVE-2026-111122/): Cross-site scripting in SiteOrigin CSS (high 7.2)
- [CVE-2026-111120](https://insights.sbomify.com/CVE-2026-111120/): Cross-site request forgery in VikRentCar Car Rental Management System (high 8.8)
- [CVE-2026-11112](https://insights.sbomify.com/CVE-2026-11112/): Security feature bypass in Chrome (critical 9.6)
- [CVE-2026-111115](https://insights.sbomify.com/CVE-2026-111115/): Apache Kafka: Broker OutOfMemoryError via tagged-field allocation amplification in flexible protocol request parsing (not scored)
- [CVE-2026-111114](https://insights.sbomify.com/CVE-2026-111114/): Nexter Extension <= 4.7.11 - Authenticated (Subscriber+) Privilege Escalation to 'reset-view' Parameter (high 7.5)
- [CVE-2026-111111](https://insights.sbomify.com/CVE-2026-111111/): Cross-site scripting in Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons (high 7.2)
- [CVE-2026-111110](https://insights.sbomify.com/CVE-2026-111110/): Cross-site scripting in Payment forms, Buy now buttons, and Invoicing System | GetPaid (high 7.2)
- [CVE-2026-11111](https://insights.sbomify.com/CVE-2026-11111/): Memory corruption in Chrome (high 8.1)
- [CVE-2026-111108](https://insights.sbomify.com/CVE-2026-111108/): Apache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readers (not scored)
- [CVE-2026-111107](https://insights.sbomify.com/CVE-2026-111107/): Fireware OS NULL Pointer Dereference in Management Interface Allows Unauthenticated Denial of Service (high 8.7)
- [CVE-2026-111106](https://insights.sbomify.com/CVE-2026-111106/): Mail Mint <= 1.31.4 - Authenticated (Custom+) SQL Injection via 'filters' Parameter (medium 6.5)
- [CVE-2026-111105](https://insights.sbomify.com/CVE-2026-111105/): Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability (high 7.0)
- [CVE-2026-111103](https://insights.sbomify.com/CVE-2026-111103/): HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits in Bandit (high 8.2)
- [CVE-2026-111101](https://insights.sbomify.com/CVE-2026-111101/): HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit (high 8.7)
- [CVE-2026-111100](https://insights.sbomify.com/CVE-2026-111100/): Kiloview E3 NDI Encoder Missing Authentication for Critical Function (medium 6.9)
- [CVE-2026-11110](https://insights.sbomify.com/CVE-2026-11110/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-1111](https://insights.sbomify.com/CVE-2026-1111/): Sanluan PublicCMS Task Template Management TaskTemplateAdminController.java save path traversal (medium 5.1)
- [CVE-2026-111096](https://insights.sbomify.com/CVE-2026-111096/): Cross-site scripting in TeamCity (medium 6.7)
- [CVE-2026-111095](https://insights.sbomify.com/CVE-2026-111095/): Cross-site scripting in TeamCity (high 8.0)
- [CVE-2026-111094](https://insights.sbomify.com/CVE-2026-111094/): Deserialization in TeamCity (high 8.1)
- [CVE-2026-111093](https://insights.sbomify.com/CVE-2026-111093/): Path traversal in Datalore (high 7.5)
- [CVE-2026-111092](https://insights.sbomify.com/CVE-2026-111092/): Missing authorization in YouTrack (medium 6.5)
- [CVE-2026-111091](https://insights.sbomify.com/CVE-2026-111091/): Code injection in Junie CLI (high 7.8)
- [CVE-2026-111090](https://insights.sbomify.com/CVE-2026-111090/): Improper Signature Verification of Firmware Update Files (high 7.8)
- [CVE-2026-11109](https://insights.sbomify.com/CVE-2026-11109/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-111088](https://insights.sbomify.com/CVE-2026-111088/): Stored XSS in the VPN logs monitor (medium 6.5)
- [CVE-2026-11108](https://insights.sbomify.com/CVE-2026-11108/): Privilege escalation in Chrome (high 8.8)
- [CVE-2026-111079](https://insights.sbomify.com/CVE-2026-111079/): Goose: goose: shell history and environment leak via terminal integration (high 7.4)
- [CVE-2026-111075](https://insights.sbomify.com/CVE-2026-111075/): Integer overflow in Eclipse OpenJ9 (high 8.7)
- [CVE-2026-111074](https://insights.sbomify.com/CVE-2026-111074/): Integer overflow in Eclipse OpenJ9 (high 8.7)
- [CVE-2026-111073](https://insights.sbomify.com/CVE-2026-111073/): Denial of service in Apache Kafka (not scored)
- [CVE-2026-11107](https://insights.sbomify.com/CVE-2026-11107/): Other in Chrome (medium 4.3)
- [CVE-2026-111069](https://insights.sbomify.com/CVE-2026-111069/): GeoDirectory <= 2.8.192 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'twitterusername' Custom Field (medium 6.4)
- [CVE-2026-111068](https://insights.sbomify.com/CVE-2026-111068/): DesignSetGo <= 2.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tagName' Block Attribute (medium 4.4)
- [CVE-2026-111066](https://insights.sbomify.com/CVE-2026-111066/): AIOHTTP: File descriptor exhaustion in multipart requests (high 8.2)
- [CVE-2026-111065](https://insights.sbomify.com/CVE-2026-111065/): AIOHTTP: Connector pool exhaustion via Max-Age overflow (medium 6.9)
- [CVE-2026-111064](https://insights.sbomify.com/CVE-2026-111064/): aiohttp server lacks an initial request/header timeout (high 8.2)
- [CVE-2026-111063](https://insights.sbomify.com/CVE-2026-111063/): AIOHTTP: Secure attribute not enforced for shared cookie (medium 6.3)
- [CVE-2026-111061](https://insights.sbomify.com/CVE-2026-111061/): russh agent server converts constraint records into unbounded never-rolled-back tasks (medium 4.3)
- [CVE-2026-11106](https://insights.sbomify.com/CVE-2026-11106/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-111059](https://insights.sbomify.com/CVE-2026-111059/): Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTML (medium 6.1)
- [CVE-2026-111058](https://insights.sbomify.com/CVE-2026-111058/): Mercury: Unauthenticated Remote Code Execution via /api/kernels (critical 9.8)
- [CVE-2026-111057](https://insights.sbomify.com/CVE-2026-111057/): Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass (critical 10.0)
- [CVE-2026-111056](https://insights.sbomify.com/CVE-2026-111056/): FOSSBilling: Unauthenticated client account enumeration via guest signup endpoint (medium 6.9)
- [CVE-2026-111053](https://insights.sbomify.com/CVE-2026-111053/): FOSSBilling: Unauthenticated attacker can probe existence of arbitrary files via guest/system/template_exists (medium 6.9)
- [CVE-2026-11105](https://insights.sbomify.com/CVE-2026-11105/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-111046](https://insights.sbomify.com/CVE-2026-111046/): FOSSBilling: Low-privileged staff can read and modify configuration of deactivated extensions (low 2.3)
- [CVE-2026-111045](https://insights.sbomify.com/CVE-2026-111045/): CLI Bridge: High-severity sandbox escape via dangling symlink (high 7.5)
- [CVE-2026-111044](https://insights.sbomify.com/CVE-2026-111044/): Disabled Sunshine clients can bypass revocation with a derived client certificate (high 7.6)
- [CVE-2026-111041](https://insights.sbomify.com/CVE-2026-111041/): AI Engine < 3.7.9 - Editor+ Arbitrary Post Modification via update_media_metadata and approve_media (medium 4.9)
- [CVE-2026-11104](https://insights.sbomify.com/CVE-2026-11104/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-111032](https://insights.sbomify.com/CVE-2026-111032/): Welcart e-Commerce < 2.12.6 - Author+ Arbitrary Product SKU Update and Disclosure via item_sku_ajax (low 3.8)
- [CVE-2026-111031](https://insights.sbomify.com/CVE-2026-111031/): Welcart e-Commerce < 2.12.6 - Unauthenticated Open Redirect via 'usces_referer' Parameter (medium 4.7)
- [CVE-2026-11103](https://insights.sbomify.com/CVE-2026-11103/): Privilege escalation in Chrome (high 7.8)
- [CVE-2026-111027](https://insights.sbomify.com/CVE-2026-111027/): Welcart e-Commerce < 2.12.6 - Editor+ SQLi via 'log_id' Parameter (medium 6.8)
- [CVE-2026-111021](https://insights.sbomify.com/CVE-2026-111021/): Persian WooCommerce SMS 7.2.0 - 7.3.1 - Reflected XSS via 'pwsms_mobiles' Parameter (high 7.1)
- [CVE-2026-11102](https://insights.sbomify.com/CVE-2026-11102/): Code injection in Chrome (high 8.8)
- [CVE-2026-11101](https://insights.sbomify.com/CVE-2026-11101/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-11100](https://insights.sbomify.com/CVE-2026-11100/): Use after free in Chrome (critical 9.6)
- [CVE-2026-1110](https://insights.sbomify.com/CVE-2026-1110/): cijliu librtsp rtsp_parse_method buffer overflow (medium 4.8)
- [CVE-2026-110985](https://insights.sbomify.com/CVE-2026-110985/): Auth bypass in Apache Kafka (not scored)
- [CVE-2026-110983](https://insights.sbomify.com/CVE-2026-110983/): WP Photo Album Plus < 9.3.04.004 - Photo Comment Deletion via CSRF (medium 4.3)
- [CVE-2026-110982](https://insights.sbomify.com/CVE-2026-110982/): AI Engine < 3.8.6 - Editor+ Arbitrary Post Title and Excerpt Update via update_post_title and update_post_excerpt (medium 4.9)
- [CVE-2026-110981](https://insights.sbomify.com/CVE-2026-110981/): WP Photo Album Plus < 9.2.11.002 - Reflected XSS via 'wppa-cat' Parameter (high 7.1)
- [CVE-2026-11098](https://insights.sbomify.com/CVE-2026-11098/): Information disclosure in Chrome (medium 5.3)
- [CVE-2026-110976](https://insights.sbomify.com/CVE-2026-110976/): AI Engine < 3.7.9 - Editor+ Arbitrary Post Deletion via reject_media (medium 4.9)
- [CVE-2026-110975](https://insights.sbomify.com/CVE-2026-110975/): Autotune: kruize/autotune: kruize/autotune: datasources credential disclosure (high 7.4)
- [CVE-2026-110974](https://insights.sbomify.com/CVE-2026-110974/): Uncontrolled Recursion on Nested JSON Allows Denial of Service in android-json (medium 6.3)
- [CVE-2026-11097](https://insights.sbomify.com/CVE-2026-11097/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-11096](https://insights.sbomify.com/CVE-2026-11096/): Memory corruption in Chrome (medium 6.5)
- [CVE-2026-110958](https://insights.sbomify.com/CVE-2026-110958/): Wavlink WN530HG4B api.cgi heap-based overflow (critical 10.0)
- [CVE-2026-110957](https://insights.sbomify.com/CVE-2026-110957/): Wavlink WL-WN530BE2-A Login Processing api.cgi sub_12580 os command injection (critical 10.0)
- [CVE-2026-110956](https://insights.sbomify.com/CVE-2026-110956/): asVereinbase < 1.1.8 - Unauthenticated Authentication Bypass via 2FA Validation (critical 9.8)
- [CVE-2026-110952](https://insights.sbomify.com/CVE-2026-110952/): Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by default (not scored)
- [CVE-2026-11095](https://insights.sbomify.com/CVE-2026-11095/): Security feature bypass in Chrome (critical 9.6)
- [CVE-2026-11094](https://insights.sbomify.com/CVE-2026-11094/): Use after free in Chrome (critical 9.6)
- [CVE-2026-110938](https://insights.sbomify.com/CVE-2026-110938/): JITServer: Multiple Denial of Service vulnerabilities via out-of-bounds heap reads during message and reply parsing (high 8.7)
- [CVE-2026-110936](https://insights.sbomify.com/CVE-2026-110936/): Siemens Software Center Uncontrolled Search Path Element (high 8.4, exploited in the wild)
- [CVE-2026-110934](https://insights.sbomify.com/CVE-2026-110934/): Memory corruption in Vyond (medium 4.4)
- [CVE-2026-110933](https://insights.sbomify.com/CVE-2026-110933/): Denial of service in Vyond (medium 4.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/932/