# Vulnerabilities published in 2026


- [CVE-2026-110675](https://insights.sbomify.com/CVE-2026-110675/): Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allow_barekey in decode_hv. (high 8.1)
- [CVE-2026-110674](https://insights.sbomify.com/CVE-2026-110674/): Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hv. (medium 6.5)
- [CVE-2026-110673](https://insights.sbomify.com/CVE-2026-110673/): Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag. (high 7.5)
- [CVE-2026-110672](https://insights.sbomify.com/CVE-2026-110672/): Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv. (high 7.5)
- [CVE-2026-110670](https://insights.sbomify.com/CVE-2026-110670/): cemtan sar2html Archive Processing sar2html.py updateDb sql injection (medium 6.9)
- [CVE-2026-11067](https://insights.sbomify.com/CVE-2026-11067/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-110669](https://insights.sbomify.com/CVE-2026-110669/): cemtan sar2html sar2html.py deleteAll missing authentication (medium 6.9)
- [CVE-2026-110668](https://insights.sbomify.com/CVE-2026-110668/): cemtan sar2html sar2html.py index sql injection (medium 6.9)
- [CVE-2026-110667](https://insights.sbomify.com/CVE-2026-110667/): cemtan sar2html sar2html.py hard-coded credentials (medium 6.9)
- [CVE-2026-110666](https://insights.sbomify.com/CVE-2026-110666/): cemtan sar2html File Upload sar2html.py updateDb path traversal (medium 6.9)
- [CVE-2026-110664](https://insights.sbomify.com/CVE-2026-110664/): Premium Packages <= 7.2.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Order Notes (medium 6.4)
- [CVE-2026-110662](https://insights.sbomify.com/CVE-2026-110662/): Cross-site scripting in MxChat – AI Chatbot & Content Generation for WordPress (high 7.2)
- [CVE-2026-110661](https://insights.sbomify.com/CVE-2026-110661/): CGNS through 4.5.2 Stack Out-of-Bounds Read via ADFI_read_node_header (medium 4.8)
- [CVE-2026-110660](https://insights.sbomify.com/CVE-2026-110660/): vgmstream through r2117 Stack Out-of-Bounds Read via G.722.1/Siren14 Decoder (medium 4.8)
- [CVE-2026-11066](https://insights.sbomify.com/CVE-2026-11066/): Security feature bypass in Chrome (critical 9.6)
- [CVE-2026-110659](https://insights.sbomify.com/CVE-2026-110659/): ELFIO through 3.12 NULL Pointer Dereference via relocation_section_accessor get_entry (medium 6.8)
- [CVE-2026-110658](https://insights.sbomify.com/CVE-2026-110658/): Sofia-SIP through 1.13.18 Heap Out-of-Bounds Read via msg_multipart_parse (medium 6.9)
- [CVE-2026-110657](https://insights.sbomify.com/CVE-2026-110657/): Khronos NNEF-Tools nnef through 1.0.10 and nnef-tools through 1.0.11 Path Traversal via Variable Label (medium 4.8)
- [CVE-2026-110656](https://insights.sbomify.com/CVE-2026-110656/): miniupnpc through 2.3.3 Heap Out-of-Bounds Read via minixml parseelt (low 2.3)
- [CVE-2026-110655](https://insights.sbomify.com/CVE-2026-110655/): miniupnpc through 2.3.3 Heap Out-of-Bounds Read via minixml parseatt (low 2.3)
- [CVE-2026-110654](https://insights.sbomify.com/CVE-2026-110654/): libzvbi through 0.2.45 Out-of-Bounds Write via Teletext DRCS convert_drcs (medium 6.9)
- [CVE-2026-110653](https://insights.sbomify.com/CVE-2026-110653/): Appointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter (critical 9.1)
- [CVE-2026-110652](https://insights.sbomify.com/CVE-2026-110652/): ONLYOFFICE DocumentServer before 10.0.0 SSRF via downloadfile isInJwtToken Bypass (medium 6.3)
- [CVE-2026-110651](https://insights.sbomify.com/CVE-2026-110651/): Swift Performance Lite < 2.3.7.4 - Author+ SQLi via Image Optimizer (medium 6.8)
- [CVE-2026-110650](https://insights.sbomify.com/CVE-2026-110650/): Thumbnail through 1.5 OS Command Injection via generate_thumbnail File Paths (critical 9.3)
- [CVE-2026-11065](https://insights.sbomify.com/CVE-2026-11065/): Use after free in Chrome (critical 9.6)
- [CVE-2026-110649](https://insights.sbomify.com/CVE-2026-110649/): Stills before 25.24.2 OS Command Injection via Media File Names (critical 9.3)
- [CVE-2026-110648](https://insights.sbomify.com/CVE-2026-110648/): @offactory/compress-fonts before 1.1.1 OS Command Injection via Font File Names (high 8.5)
- [CVE-2026-110647](https://insights.sbomify.com/CVE-2026-110647/): Turnpress through 0.4.2 OS Command Injection via Crafted .docx File Names (high 8.5)
- [CVE-2026-110646](https://insights.sbomify.com/CVE-2026-110646/): Beganovich snappdf 1.1.0 before 6.1.0 OS Command Injection on Windows via setUrl() (critical 9.2)
- [CVE-2026-110645](https://insights.sbomify.com/CVE-2026-110645/): Video-stitch before 2.0.0-beta.1 OS Command Injection via concat() and cut() (critical 9.3)
- [CVE-2026-110644](https://insights.sbomify.com/CVE-2026-110644/): nodejs-whisper through 0.3.1 OS Command Injection via convertToWavType (critical 9.3)
- [CVE-2026-110643](https://insights.sbomify.com/CVE-2026-110643/): transcribe2texts through 1.0.6 OS Command Injection via transcribeAudio audioPath (critical 9.3)
- [CVE-2026-110642](https://insights.sbomify.com/CVE-2026-110642/): xhtml2pdf before 0.2.19 OS Command Injection via startViewer File Name (high 8.5)
- [CVE-2026-110641](https://insights.sbomify.com/CVE-2026-110641/): @runnerty/executor-decompress through 3.1.1 OS Command Injection via Archive File Name (high 8.7)
- [CVE-2026-110640](https://insights.sbomify.com/CVE-2026-110640/): Whisper-node through 1.1.1 OS Command Injection via filePath and language (critical 9.3)
- [CVE-2026-11064](https://insights.sbomify.com/CVE-2026-11064/): Race condition in Chrome (medium 6.5)
- [CVE-2026-110639](https://insights.sbomify.com/CVE-2026-110639/): @mborne/extract before 0.2.1 OS Command Injection via archivePath and targetDir (critical 9.3)
- [CVE-2026-110638](https://insights.sbomify.com/CVE-2026-110638/): doc-recog through 1.1.6 OS Command Injection via DocData._readPDF File Path (critical 9.3)
- [CVE-2026-110637](https://insights.sbomify.com/CVE-2026-110637/): buildebooks before 0.2.2 OS Command Injection via kindlegen EPUB File Name (high 8.5)
- [CVE-2026-110636](https://insights.sbomify.com/CVE-2026-110636/): pypdftk through 0.5 OS Command Injection via PDF and Output Paths (critical 9.3)
- [CVE-2026-110635](https://insights.sbomify.com/CVE-2026-110635/): webp-converter before 3.0.0 OS Command Injection via File Names and Options (critical 9.3)
- [CVE-2026-110634](https://insights.sbomify.com/CVE-2026-110634/): git-diff before 2.0.7 OS Command Injection via gitDiff Input Strings (critical 9.3)
- [CVE-2026-110633](https://insights.sbomify.com/CVE-2026-110633/): MyReport Updater through 2.1.1 Local Privilege Escalation via Updater Service (high 8.5)
- [CVE-2026-110632](https://insights.sbomify.com/CVE-2026-110632/): Report One MyReport Updater through 2.1.1 Unauthenticated gRPC Service RCE (critical 9.2)
- [CVE-2026-110631](https://insights.sbomify.com/CVE-2026-110631/): Komodo through 2.3.3 Periphery Agent Unauthenticated RCE via Default Configuration (critical 9.3)
- [CVE-2026-110630](https://insights.sbomify.com/CVE-2026-110630/): VentureDrake Laravel CRM before 2.4.0 Privilege Escalation via Unscoped Role Assignment (high 7.0)
- [CVE-2026-11063](https://insights.sbomify.com/CVE-2026-11063/): Security feature bypass in Chrome (critical 9.6)
- [CVE-2026-110629](https://insights.sbomify.com/CVE-2026-110629/): VentureDrake Laravel CRM before 2.4.0 Missing Authorization via Livewire Actions (high 7.1)
- [CVE-2026-110628](https://insights.sbomify.com/CVE-2026-110628/): Kan 0.5.5 through 0.6.0 Unauthenticated SSRF via /api/download/attatchment (critical 9.2)
- [CVE-2026-110627](https://insights.sbomify.com/CVE-2026-110627/): ClipBucket v5 through 5.5.3-#206 Reflected XSS via add_todo val Parameter (low 2.1)
- [CVE-2026-110626](https://insights.sbomify.com/CVE-2026-110626/): ClipBucket v5 through 5.5.3-#206 Reflected XSS via edit_language in language_settings.php (medium 5.1)
- [CVE-2026-110625](https://insights.sbomify.com/CVE-2026-110625/): ClipBucket v5 through 5.5.3-#206 Reflected XSS via type Parameter in flagged_item.php (medium 5.1)
- [CVE-2026-110624](https://insights.sbomify.com/CVE-2026-110624/): Papermerge Core through 3.5.3 Missing Authorization via /tags/all and /document-types/all (low 2.3)
- [CVE-2026-110623](https://insights.sbomify.com/CVE-2026-110623/): Papermerge Core through 3.5.3 Missing Authorization in Shared Nodes API (high 7.7)
- [CVE-2026-110622](https://insights.sbomify.com/CVE-2026-110622/): Papermerge Core through 3.5.3 Missing Authorization in Page Management and OCR Endpoints (high 7.7)
- [CVE-2026-110621](https://insights.sbomify.com/CVE-2026-110621/): Swetrix Cloud before 5.1.0 Missing Authorization via POST /project/organisation/:orgId (high 8.7)
- [CVE-2026-110620](https://insights.sbomify.com/CVE-2026-110620/): Formbricks before 4.9.0 Cross-Organization IDOR in Server Actions via organizationId (medium 6.1)
- [CVE-2026-11062](https://insights.sbomify.com/CVE-2026-11062/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2026-110619](https://insights.sbomify.com/CVE-2026-110619/): frp 0.41.0 through 0.71.1 Missing Authentication for pprof Debug Endpoints (medium 6.3)
- [CVE-2026-110618](https://insights.sbomify.com/CVE-2026-110618/): SmsForwarder through 3.5.0 Missing Authentication in HTTP Server Remote Control API (high 8.6)
- [CVE-2026-110617](https://insights.sbomify.com/CVE-2026-110617/): we-mp-rss through 1.5.3 Missing Authorization via Export File Download Endpoint (medium 6.3)
- [CVE-2026-110616](https://insights.sbomify.com/CVE-2026-110616/): NullHub through 2026.5.29 Missing Authentication for /api Management API (critical 9.2)
- [CVE-2026-110615](https://insights.sbomify.com/CVE-2026-110615/): jshERP through 3.6 Missing Authorization via /user/batchSetStatus (high 7.1)
- [CVE-2026-110614](https://insights.sbomify.com/CVE-2026-110614/): Yiuman citrus through 0.15.0 ORDER BY SQL Injection via sortBy Parameter (high 7.1)
- [CVE-2026-110613](https://insights.sbomify.com/CVE-2026-110613/): youlai-mall through commit 9f62de8 Order Information Disclosure via App Order List (high 7.1)
- [CVE-2026-110612](https://insights.sbomify.com/CVE-2026-110612/): vlife through 2.0.1 Authentication Bypass via Hardcoded JWT Secret in TokenUtil (critical 9.3)
- [CVE-2026-110611](https://insights.sbomify.com/CVE-2026-110611/): REBUILD through 4.5.0 Authorization Bypass via aibot2 Chat Endpoints chatid (medium 6.0)
- [CVE-2026-110610](https://insights.sbomify.com/CVE-2026-110610/): ruoyi-vue-pro through 2026.09 SSRF via Midjourney referImageUrl and notify imageUrl (medium 5.3)
- [CVE-2026-11061](https://insights.sbomify.com/CVE-2026-11061/): Memory corruption in Chrome (critical 9.6)
- [CVE-2026-110609](https://insights.sbomify.com/CVE-2026-110609/): Dromara Skyeye through commit 65d3ddcede70 SQL Injection via keyword Parameter (high 7.1)
- [CVE-2026-110608](https://insights.sbomify.com/CVE-2026-110608/): BizSpring Shop through commit cf22d39daaf1 IDOR via /member/order Cancel and Receive (medium 5.3)
- [CVE-2026-110607](https://insights.sbomify.com/CVE-2026-110607/): BizSpring Shop through commit cf22d39daaf1 Payment Bypass via test_post_pay Endpoint (high 7.1)
- [CVE-2026-110606](https://insights.sbomify.com/CVE-2026-110606/): LibreCAD libdxfrw through LC2.2.0 Stack Out-of-Bounds Read via dwgReader18::readFileHeader (medium 4.8)
- [CVE-2026-110605](https://insights.sbomify.com/CVE-2026-110605/): libschrift through 0.10.2 Divide by Zero via unitsPerEm in draw_line (medium 6.8)
- [CVE-2026-110604](https://insights.sbomify.com/CVE-2026-110604/): Mini-XML 4.0.0 through 4.0.6 Stack Out-of-Bounds Write via mxml_strtod() (low 2.0)
- [CVE-2026-110603](https://insights.sbomify.com/CVE-2026-110603/): LASzip through 3.5.0 Invalid Free via Truncated VLR Header in laszip_read_header (medium 5.8)
- [CVE-2026-110602](https://insights.sbomify.com/CVE-2026-110602/): libmspack through 0.11alpha Uninitialized Pointer Free via kwajd_open Error Path (medium 5.8)
- [CVE-2026-110601](https://insights.sbomify.com/CVE-2026-110601/): libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 Heap Out-of-Bounds Write via GIF (medium 5.8)
- [CVE-2026-110600](https://insights.sbomify.com/CVE-2026-110600/): xlsxio through 0.2.37 NULL Pointer Dereference via Worksheet Relationship Without Id (medium 6.8)
- [CVE-2026-11060](https://insights.sbomify.com/CVE-2026-11060/): Use after free in Chrome (high 8.8)
- [CVE-2026-1106](https://insights.sbomify.com/CVE-2026-1106/): Chamilo LMS Legal Consent SocialController.php deleteLegal improper authorization (medium 5.3)
- [CVE-2026-110599](https://insights.sbomify.com/CVE-2026-110599/): L-SMASH through 2.14.5 Double Free in HEVC and H.264 Importer Probe (medium 6.9)
- [CVE-2026-110598](https://insights.sbomify.com/CVE-2026-110598/): Libyal libpff through 20260926 heap out-of-bounds read via libpff_record_entry_get_multi_value (medium 6.9)
- [CVE-2026-110597](https://insights.sbomify.com/CVE-2026-110597/): Tinyexr through 3.2.0 Heap Out-of-Bounds Read via ParseEXRMultipartHeaderFromMemory (medium 6.9)
- [CVE-2026-110596](https://insights.sbomify.com/CVE-2026-110596/): quirc through 1.2 Denial of Service via find_alignment_pattern Spiral Search (medium 6.8)
- [CVE-2026-110595](https://insights.sbomify.com/CVE-2026-110595/): BottleCRM 0.45 through 1.14.5 Memory Exhaustion via Contact and Case CSV Import (medium 5.3)
- [CVE-2026-110594](https://insights.sbomify.com/CVE-2026-110594/): BottleCRM 0.43 through 1.14.5 ReDoS via Case Routing Rule Regex (medium 6.9)
- [CVE-2026-110593](https://insights.sbomify.com/CVE-2026-110593/): BottleCRM through 1.14.5 Server-Side Template Injection via Account Email create_mail (medium 5.3)
- [CVE-2026-110592](https://insights.sbomify.com/CVE-2026-110592/): BottleCRM 0.30 through 1.14.5 HTML Injection via Custom Invoice PDF Template (medium 5.1)
- [CVE-2026-110591](https://insights.sbomify.com/CVE-2026-110591/): OW2 ASM 1.4.3 before 9.11 Excessive Resource Consumption via Analyzer (medium 6.8)
- [CVE-2026-110590](https://insights.sbomify.com/CVE-2026-110590/): Missing authorization in Klarna for WooCommerce (high 7.5)
- [CVE-2026-11059](https://insights.sbomify.com/CVE-2026-11059/): Use after free in Chrome (high 8.8)
- [CVE-2026-11058](https://insights.sbomify.com/CVE-2026-11058/): Integer overflow in Chrome (high 7.5)
- [CVE-2026-11057](https://insights.sbomify.com/CVE-2026-11057/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-11056](https://insights.sbomify.com/CVE-2026-11056/): Security feature bypass in Chrome (critical 9.6)
- [CVE-2026-11055](https://insights.sbomify.com/CVE-2026-11055/): Use after free in Chrome (high 8.8)
- [CVE-2026-110541](https://insights.sbomify.com/CVE-2026-110541/): Command injection in PowerProtect Data Domain (high 7.2)
- [CVE-2026-110540](https://insights.sbomify.com/CVE-2026-110540/): Missing authorization in PowerProtect Data Domain Management Center (high 7.1)
- [CVE-2026-11054](https://insights.sbomify.com/CVE-2026-11054/): Use after free in Chrome (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/935/