# Vulnerabilities published in 2026


- [CVE-2026-110162](https://insights.sbomify.com/CVE-2026-110162/): Use after free in Chrome (high 8.8)
- [CVE-2026-110161](https://insights.sbomify.com/CVE-2026-110161/): Use after free in Chrome (critical 9.6)
- [CVE-2026-110160](https://insights.sbomify.com/CVE-2026-110160/): Missing authorization in Chrome (medium 4.2)
- [CVE-2026-11016](https://insights.sbomify.com/CVE-2026-11016/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-110159](https://insights.sbomify.com/CVE-2026-110159/): Missing authorization in Chrome (critical 9.6)
- [CVE-2026-110158](https://insights.sbomify.com/CVE-2026-110158/): Use after free in Chrome (high 8.3)
- [CVE-2026-110157](https://insights.sbomify.com/CVE-2026-110157/): Use after free in Chrome (high 8.8)
- [CVE-2026-110156](https://insights.sbomify.com/CVE-2026-110156/): Code injection in Chrome (high 8.3)
- [CVE-2026-110155](https://insights.sbomify.com/CVE-2026-110155/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-110154](https://insights.sbomify.com/CVE-2026-110154/): Use after free in Chrome (high 8.8)
- [CVE-2026-110153](https://insights.sbomify.com/CVE-2026-110153/): Use after free in Chrome (high 8.8)
- [CVE-2026-110152](https://insights.sbomify.com/CVE-2026-110152/): Memory corruption in Chrome (critical 9.6)
- [CVE-2026-110151](https://insights.sbomify.com/CVE-2026-110151/): Use after free in Chrome (high 8.8)
- [CVE-2026-110150](https://insights.sbomify.com/CVE-2026-110150/): Privilege escalation in Chrome (medium 5.5)
- [CVE-2026-11015](https://insights.sbomify.com/CVE-2026-11015/): Memory corruption in Chrome (high 8.1)
- [CVE-2026-110149](https://insights.sbomify.com/CVE-2026-110149/): Use after free in Chrome (critical 9.6)
- [CVE-2026-110148](https://insights.sbomify.com/CVE-2026-110148/): Use after free in Chrome (high 8.8)
- [CVE-2026-110147](https://insights.sbomify.com/CVE-2026-110147/): Use after free in Chrome (high 8.8)
- [CVE-2026-110146](https://insights.sbomify.com/CVE-2026-110146/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-110145](https://insights.sbomify.com/CVE-2026-110145/): Use after free in Chrome (high 8.3)
- [CVE-2026-110144](https://insights.sbomify.com/CVE-2026-110144/): Missing authorization in Chrome (critical 9.6)
- [CVE-2026-110143](https://insights.sbomify.com/CVE-2026-110143/): Information disclosure in Chrome (medium 4.3)
- [CVE-2026-110142](https://insights.sbomify.com/CVE-2026-110142/): Use after free in Chrome (critical 9.6)
- [CVE-2026-110141](https://insights.sbomify.com/CVE-2026-110141/): Information disclosure in Chrome (low 3.1)
- [CVE-2026-110140](https://insights.sbomify.com/CVE-2026-110140/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-11014](https://insights.sbomify.com/CVE-2026-11014/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-110139](https://insights.sbomify.com/CVE-2026-110139/): Use after free in Chrome (high 8.8)
- [CVE-2026-110138](https://insights.sbomify.com/CVE-2026-110138/): Use after free in Chrome (high 8.3)
- [CVE-2026-110137](https://insights.sbomify.com/CVE-2026-110137/): Use after free in Chrome (high 8.8)
- [CVE-2026-110136](https://insights.sbomify.com/CVE-2026-110136/): Use after free in Chrome (critical 9.6)
- [CVE-2026-110135](https://insights.sbomify.com/CVE-2026-110135/): OTP Login & Register Woocommerce < 2.7.3 - Unauthenticated Account Takeover via OTP Brute Force (high 7.4)
- [CVE-2026-110131](https://insights.sbomify.com/CVE-2026-110131/): ThriveX-Server through 4.0 Missing Authorization via Article Retrieval Endpoints (medium 6.9)
- [CVE-2026-110130](https://insights.sbomify.com/CVE-2026-110130/): Dockhand before 1.0.45 Authentication Bypass via Static-Asset Check (critical 10.0)
- [CVE-2026-11013](https://insights.sbomify.com/CVE-2026-11013/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-110129](https://insights.sbomify.com/CVE-2026-110129/): fuintCatering through commit 122c9e6 IDOR via /clientApi/refund/detail (high 7.1)
- [CVE-2026-110128](https://insights.sbomify.com/CVE-2026-110128/): fuint through commit 4c4bc8a Missing Authentication via /clientApi/order/detail (high 8.7)
- [CVE-2026-110127](https://insights.sbomify.com/CVE-2026-110127/): waynboot-mall through 2.0.0 IDOR via Mobile Cart Endpoints (medium 5.3)
- [CVE-2026-110126](https://insights.sbomify.com/CVE-2026-110126/): waynboot-mall through 2.0.0 IDOR via Mobile Address Endpoints (medium 5.3)
- [CVE-2026-110125](https://insights.sbomify.com/CVE-2026-110125/): waynboot-mall through 2.0.0 IDOR via Mobile Order Endpoints (medium 5.3)
- [CVE-2026-110124](https://insights.sbomify.com/CVE-2026-110124/): FastBee through 2.1.0 IDOR via DeviceController /iot/device Endpoints (high 8.6)
- [CVE-2026-110123](https://insights.sbomify.com/CVE-2026-110123/): Makunet maku-boot 4.3.0 through 5.0.0 Missing Authorization via Mail and SMS Config Endpoints (high 7.1)
- [CVE-2026-110122](https://insights.sbomify.com/CVE-2026-110122/): PickMall lilishop through 4.4 IDOR via Goods Freight Endpoint (medium 5.3)
- [CVE-2026-110121](https://insights.sbomify.com/CVE-2026-110121/): PickMall lilishop through 4.4 IDOR via Goods Edit Endpoint (high 7.1)
- [CVE-2026-110120](https://insights.sbomify.com/CVE-2026-110120/): yshopmall through 2.0.0 IDOR via After-Sales API in StoreAfterSalesController (medium 5.3)
- [CVE-2026-11012](https://insights.sbomify.com/CVE-2026-11012/): Use after free in Chrome (high 8.3)
- [CVE-2026-110119](https://insights.sbomify.com/CVE-2026-110119/): yshopmall through 2.0.0 IDOR via Member Address API in UserAddressController (high 7.1)
- [CVE-2026-110118](https://insights.sbomify.com/CVE-2026-110118/): WorkFlow-Engine through 9.6.11 Missing Authorization via flowableui buttonOperation Endpoints (high 7.1)
- [CVE-2026-110117](https://insights.sbomify.com/CVE-2026-110117/): SmartAdmin through 3.30.0 Missing Authorization via AdminProtectController (high 7.1)
- [CVE-2026-110116](https://insights.sbomify.com/CVE-2026-110116/): Digital-Infrastructure 9.6.5 through 9.6.11 Path Traversal via fileManager storeFile (high 8.8)
- [CVE-2026-110115](https://insights.sbomify.com/CVE-2026-110115/): Digital-Infrastructure 9.6.5 through 9.6.11 Path Traversal via fileManager retrieveFileStream (high 8.7)
- [CVE-2026-110114](https://insights.sbomify.com/CVE-2026-110114/): oms-erp through PRE Missing Authentication via skyer-goods es-test Endpoints (medium 6.9)
- [CVE-2026-110113](https://insights.sbomify.com/CVE-2026-110113/): PublicCMS through V6.202608.a IDOR via tradeAddress/save Endpoint (medium 5.3)
- [CVE-2026-110112](https://insights.sbomify.com/CVE-2026-110112/): Dockhand before 1.0.50 OIDC Privilege Escalation via Missing Token Claim Validation (critical 9.2)
- [CVE-2026-110111](https://insights.sbomify.com/CVE-2026-110111/): Xen Orchestra before 6.9.0 Privilege Escalation via Prototype Pollution in vm.importFromEsxi (high 7.7)
- [CVE-2026-110110](https://insights.sbomify.com/CVE-2026-110110/): JetLinks Community through 2.10.0 Missing Authorization via Alarm Enable/Disable Endpoints (medium 5.3)
- [CVE-2026-11011](https://insights.sbomify.com/CVE-2026-11011/): Security feature bypass in Chrome (high 8.1)
- [CVE-2026-110109](https://insights.sbomify.com/CVE-2026-110109/): JetLinks Community through 2.10.0 Missing Authorization via Product-Level Transparent Codec Save (high 7.1)
- [CVE-2026-110108](https://insights.sbomify.com/CVE-2026-110108/): MateCloud through 5.0.8 Missing Authorization via /api/v1/admin/storage API (high 8.6)
- [CVE-2026-110107](https://insights.sbomify.com/CVE-2026-110107/): RuoYi-Cloud-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId} (low 2.3)
- [CVE-2026-110106](https://insights.sbomify.com/CVE-2026-110106/): RuoYi-Vue-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId} (low 2.3)
- [CVE-2026-110105](https://insights.sbomify.com/CVE-2026-110105/): B3log Symphony through 3.6.4 Missing Authorization in Admin Console Routes (medium 6.9)
- [CVE-2026-110104](https://insights.sbomify.com/CVE-2026-110104/): novel through 3.5.0 Unsalted MD5 Password Storage (high 8.2)
- [CVE-2026-110103](https://insights.sbomify.com/CVE-2026-110103/): bbs-go through 4.4.6 Stored XSS via Image Upload Content-Type (medium 5.1)
- [CVE-2026-110102](https://insights.sbomify.com/CVE-2026-110102/): powerlevel10k through 1.20.0 Download of Code Without Integrity Check in gitstatus Installer (high 7.7)
- [CVE-2026-110101](https://insights.sbomify.com/CVE-2026-110101/): Koillection through 1.8.4 Stored XSS via Datum File Attachment Uploads (medium 5.1)
- [CVE-2026-110100](https://insights.sbomify.com/CVE-2026-110100/): Jorani before 1.0.4 Missing Authorization and SSRF via Contracts::import() (medium 5.3)
- [CVE-2026-11010](https://insights.sbomify.com/CVE-2026-11010/): Use after free in Chrome (high 8.3)
- [CVE-2026-1101](https://insights.sbomify.com/CVE-2026-1101/): Improper Validation of Specified Quantity in Input in GitLab (medium 6.5)
- [CVE-2026-110099](https://insights.sbomify.com/CVE-2026-110099/): Jorani before 1.0.4 Missing Authorization in HR Export Actions (medium 5.3)
- [CVE-2026-110098](https://insights.sbomify.com/CVE-2026-110098/): Jorani before 1.0.4 Insecure Direct Object Reference in Leave and Overtime Requests (medium 5.3)
- [CVE-2026-110097](https://insights.sbomify.com/CVE-2026-110097/): Ikaros 1.2.0 through 1.2.5 TOTP Authentication Bypass via Temp Token (high 8.6)
- [CVE-2026-110095](https://insights.sbomify.com/CVE-2026-110095/): fast-uri vulnerable to improper path equivalence in relative reference normalization (low 3.7)
- [CVE-2026-11009](https://insights.sbomify.com/CVE-2026-11009/): Use after free in Chrome (critical 9.6)
- [CVE-2026-110084](https://insights.sbomify.com/CVE-2026-110084/): Adobe Experience Manager | XML Injection (aka Blind XPath Injection) (CWE-91) (high 7.1)
- [CVE-2026-110083](https://insights.sbomify.com/CVE-2026-110083/): SQL injection in Adobe Experience Manager 6.5 (high 7.1)
- [CVE-2026-110082](https://insights.sbomify.com/CVE-2026-110082/): Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) (medium 5.4)
- [CVE-2026-110081](https://insights.sbomify.com/CVE-2026-110081/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2026-110080](https://insights.sbomify.com/CVE-2026-110080/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-11008](https://insights.sbomify.com/CVE-2026-11008/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-110079](https://insights.sbomify.com/CVE-2026-110079/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-110078](https://insights.sbomify.com/CVE-2026-110078/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-110077](https://insights.sbomify.com/CVE-2026-110077/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-110076](https://insights.sbomify.com/CVE-2026-110076/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-110075](https://insights.sbomify.com/CVE-2026-110075/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-110074](https://insights.sbomify.com/CVE-2026-110074/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-110073](https://insights.sbomify.com/CVE-2026-110073/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2026-110071](https://insights.sbomify.com/CVE-2026-110071/): Mang Board <= 2.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' Shortcode Attribute (medium 6.4)
- [CVE-2026-110070](https://insights.sbomify.com/CVE-2026-110070/): Modern Events Calendar Lite < 7.36.4 - Subscriber+ Arbitrary Post Modification via IDOR (medium 6.5)
- [CVE-2026-11007](https://insights.sbomify.com/CVE-2026-11007/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-110069](https://insights.sbomify.com/CVE-2026-110069/): Missing authorization in Modern Events Calendar Lite (medium 4.3)
- [CVE-2026-110063](https://insights.sbomify.com/CVE-2026-110063/): VM Inspector for Azure Virtual Machines Elevation of Privilege Vulnerability (critical 10.0)
- [CVE-2026-11006](https://insights.sbomify.com/CVE-2026-11006/): Memory corruption in Chrome (medium 6.5)
- [CVE-2026-11005](https://insights.sbomify.com/CVE-2026-11005/): Memory corruption in Chrome (medium 5.3)
- [CVE-2026-11004](https://insights.sbomify.com/CVE-2026-11004/): Memory corruption in Chrome (medium 5.3)
- [CVE-2026-110039](https://insights.sbomify.com/CVE-2026-110039/): Smush < 4.3.4 - Admin+ Network-Wide Plugin Settings Update on Multisite (low 2.7)
- [CVE-2026-110037](https://insights.sbomify.com/CVE-2026-110037/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2026-110036](https://insights.sbomify.com/CVE-2026-110036/): Device-mapper-persistent-data: device-mapper-persistent-data: denial of service via crafted block indices (low 3.3)
- [CVE-2026-110035](https://insights.sbomify.com/CVE-2026-110035/): Salon Booking System < 10.31.11 - Subscriber+ Coupon Code Disclosure via Discounts REST Route (medium 4.3)
- [CVE-2026-110034](https://insights.sbomify.com/CVE-2026-110034/): Salon Booking System < 10.31.11 - Unauthenticated Negative Booking Total via Discount Code (low 3.7)
- [CVE-2026-110033](https://insights.sbomify.com/CVE-2026-110033/): Salon Booking System < 10.31.11 - Salon Staff+ Stored XSS and SSRF via Salon REST 'image_url' (medium 6.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/938/