# Vulnerabilities published in 2026


- [CVE-2026-109468](https://insights.sbomify.com/CVE-2026-109468/): ASP.NET Core Denial of Service Vulnerability (high 7.5)
- [CVE-2026-109461](https://insights.sbomify.com/CVE-2026-109461/): Microsoft Authentication Library (MSAL) for Node.js Information Disclosure Vulnerability (medium 5.9)
- [CVE-2026-10946](https://insights.sbomify.com/CVE-2026-10946/): Memory corruption in Chrome (high 7.5)
- [CVE-2026-109453](https://insights.sbomify.com/CVE-2026-109453/): Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-10945](https://insights.sbomify.com/CVE-2026-10945/): Use after free in Chrome (high 8.8)
- [CVE-2026-109449](https://insights.sbomify.com/CVE-2026-109449/): Symfony: Unbounded Nesting in the Expression Parser Lets Untrusted Expressions Crash the Process (high 8.7)
- [CVE-2026-109448](https://insights.sbomify.com/CVE-2026-109448/): psqlODBC SQLBindParameter heap memory corruption when binding more than 32767 parameters (medium 5.9)
- [CVE-2026-109447](https://insights.sbomify.com/CVE-2026-109447/): Privilege escalation in User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor (high 8.1)
- [CVE-2026-109444](https://insights.sbomify.com/CVE-2026-109444/): OpenSRE through 0.1.2026.10.19 Approval Gate Bypass via shell_run Prompt Injection (critical 9.3)
- [CVE-2026-109443](https://insights.sbomify.com/CVE-2026-109443/): JoySafeter through 1.0.0 Authenticated RCE via Copilot Standard Mode Shell (high 8.7)
- [CVE-2026-109442](https://insights.sbomify.com/CVE-2026-109442/): piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agent exec_shell (critical 9.3)
- [CVE-2026-109441](https://insights.sbomify.com/CVE-2026-109441/): LangAlpha through 2026.09.07 Cross-Tenant Sandbox Exposure via Shared Docker Bridge (medium 6.9)
- [CVE-2026-109440](https://insights.sbomify.com/CVE-2026-109440/): LangAlpha through 2026.09.07 Indirect Prompt Injection RCE via Bash and ExecuteCode (high 8.7)
- [CVE-2026-10944](https://insights.sbomify.com/CVE-2026-10944/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-109439](https://insights.sbomify.com/CVE-2026-109439/): Lantronix XPress-DR 8.1.0.0 Unauthenticated Configuration Write via UDP 30718 (critical 9.3)
- [CVE-2026-109438](https://insights.sbomify.com/CVE-2026-109438/): 3proxy 0.9.7 - 1.0.1 Uninitialized Stack Memory Disclosure via SOCKS4 (medium 6.3)
- [CVE-2026-109437](https://insights.sbomify.com/CVE-2026-109437/): Cognition < 0.13.0 Unauthenticated RCE via Local Shell Backend (critical 9.2)
- [CVE-2026-109434](https://insights.sbomify.com/CVE-2026-109434/): Sleipnir Browser < 3.9.0 Fullscreen Address Bar Spoofing (medium 5.1)
- [CVE-2026-109433](https://insights.sbomify.com/CVE-2026-109433/): Camunda Broken Access Control via Cockpit (medium 6.0)
- [CVE-2026-109432](https://insights.sbomify.com/CVE-2026-109432/): Camunda Expression Injection via orQueries RCE (critical 9.3)
- [CVE-2026-109431](https://insights.sbomify.com/CVE-2026-109431/): Camunda Missing Authorization in Task Sub-Resources (high 8.6)
- [CVE-2026-109430](https://insights.sbomify.com/CVE-2026-109430/): Ellucian WebAdvisor 3.2 Unauthenticated XXE Injection (high 8.7)
- [CVE-2026-10943](https://insights.sbomify.com/CVE-2026-10943/): Use after free in Chrome (high 8.8)
- [CVE-2026-109429](https://insights.sbomify.com/CVE-2026-109429/): Mistral Vibe < 2.25.4 Bash Permission Bypass via ${var@P} Prompt-Transform (high 8.7)
- [CVE-2026-109428](https://insights.sbomify.com/CVE-2026-109428/): Mistral Vibe < 2.25.5 Permission Bypass via Bash Line Continuation (high 8.7)
- [CVE-2026-109427](https://insights.sbomify.com/CVE-2026-109427/): Telegram-Stremio 5.1.0 Broken Object Authorization via Stream IDs (high 7.1)
- [CVE-2026-109426](https://insights.sbomify.com/CVE-2026-109426/): Telegram-Stremio 5.1.0 Insecure Session Storage via encode_string (high 8.2)
- [CVE-2026-109425](https://insights.sbomify.com/CVE-2026-109425/): Tink-go 2.8.0 Keyset Validation Bypass via NewHandleWithNoSecrets (medium 6.9)
- [CVE-2026-109424](https://insights.sbomify.com/CVE-2026-109424/): NetEase Cloud Music Weak Encryption via eapi/xeapi (high 8.2)
- [CVE-2026-109423](https://insights.sbomify.com/CVE-2026-109423/): NetEase Cloud Music TLS Certificate Validation Bypass (critical 9.1)
- [CVE-2026-109422](https://insights.sbomify.com/CVE-2026-109422/): NetEase Cloud Music RCE via os.navigateExternal IPC (critical 9.2)
- [CVE-2026-10942](https://insights.sbomify.com/CVE-2026-10942/): Privilege escalation in Chrome (high 7.8)
- [CVE-2026-109415](https://insights.sbomify.com/CVE-2026-109415/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2026-109414](https://insights.sbomify.com/CVE-2026-109414/): Vitepos <= 3.6.1 - Authenticated (Vendor+) SQL Injection via 'src_by[].val' Parameter via 'bt' Operator (medium 6.5)
- [CVE-2026-109413](https://insights.sbomify.com/CVE-2026-109413/): Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process (high 8.7)
- [CVE-2026-109412](https://insights.sbomify.com/CVE-2026-109412/): Information disclosure in Neurons Patch for Intune (critical 9.9)
- [CVE-2026-109411](https://insights.sbomify.com/CVE-2026-109411/): Samba: access control bypass via vfs_ceph_rgw case-insensitive open (high 8.1)
- [CVE-2026-109410](https://insights.sbomify.com/CVE-2026-109410/): macrozheng mall mall-admin/mall-portal moneyInfo OmsOrderServiceImpl.updateMoneyInfo calculation (medium 4.8)
- [CVE-2026-10941](https://insights.sbomify.com/CVE-2026-10941/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-109409](https://insights.sbomify.com/CVE-2026-109409/): HBAI-Ltd Toonflow-app Open Folder Endpoint openFolder.ts child_process.exec command injection (medium 4.8)
- [CVE-2026-109407](https://insights.sbomify.com/CVE-2026-109407/): macrozheng mall Coupon Redemption generateOrder race condition (low 2.3)
- [CVE-2026-109406](https://insights.sbomify.com/CVE-2026-109406/): macrozheng mall mall-portal generateOrder OmsPortalOrderServiceImpl logic error (medium 5.3)
- [CVE-2026-109405](https://insights.sbomify.com/CVE-2026-109405/): conductor-oss conductor KafkaPublishTask.java KafkaPublishTask.start server-side request forgery (medium 6.9)
- [CVE-2026-109404](https://insights.sbomify.com/CVE-2026-109404/): conductor-oss conductor Agentspan Agent Runtime AgentController.java server-side request forgery (medium 6.9)
- [CVE-2026-109403](https://insights.sbomify.com/CVE-2026-109403/): conductor-oss conductor Agent Card Fetching A2AService.java A2AService.getAgentCard server-side request forgery (medium 6.9)
- [CVE-2026-109402](https://insights.sbomify.com/CVE-2026-109402/): conductor-oss conductor MCP Service MCPService.java MCPService.listTools server-side request forgery (medium 5.3)
- [CVE-2026-109401](https://insights.sbomify.com/CVE-2026-109401/): Information disclosure in WP Mail Logging (low 2.7)
- [CVE-2026-109400](https://insights.sbomify.com/CVE-2026-109400/): Privilege escalation in InstaWP Connect – 1-click WP Staging & Migration (high 7.5)
- [CVE-2026-10940](https://insights.sbomify.com/CVE-2026-10940/): Race condition in Chrome (high 8.3)
- [CVE-2026-1094](https://insights.sbomify.com/CVE-2026-1094/): Improper Validation of Unsafe Equivalence in Input in GitLab (medium 4.6)
- [CVE-2026-109399](https://insights.sbomify.com/CVE-2026-109399/): SWUpdate through 2026.05.1 CMS Signature Verification Bypass via Embedded Intermediates (critical 9.2)
- [CVE-2026-109398](https://insights.sbomify.com/CVE-2026-109398/): Gumlet php-image-resize before 3.0.1 Denial of Service via Decompression Bombs (high 8.7)
- [CVE-2026-109397](https://insights.sbomify.com/CVE-2026-109397/): Thelia before 3.1.2 and 3.2.x before 3.2.1 File Upload RCE via Filename Trailing Space (high 8.6)
- [CVE-2026-109396](https://insights.sbomify.com/CVE-2026-109396/): Thelia before 3.1.2 and 3.2.x before 3.2.1 CSV Formula Injection via Exports (low 2.3)
- [CVE-2026-109395](https://insights.sbomify.com/CVE-2026-109395/): Ning compress-lzf before 1.2.0 Out-of-Bounds Memory Access via UnsafeChunkDecoder (high 8.8)
- [CVE-2026-109394](https://insights.sbomify.com/CVE-2026-109394/): Thirty bees through 1.7.0 Account Takeover via PasswordController Guest Checkout (critical 9.1)
- [CVE-2026-109393](https://insights.sbomify.com/CVE-2026-109393/): QloApps through 1.7.0 Insecure Direct Object Reference in Back-Office AJAX Handlers (medium 5.3)
- [CVE-2026-109392](https://insights.sbomify.com/CVE-2026-109392/): Pimcore through 2026.3.1 Stored XSS via ExternalImage Field Version Preview (medium 5.1)
- [CVE-2026-109391](https://insights.sbomify.com/CVE-2026-109391/): Square Squash through commit e73f280 Unauthenticated YAML Deserialization via Symbolication API (critical 9.2)
- [CVE-2026-109390](https://insights.sbomify.com/CVE-2026-109390/): Memory corruption in AnyDesk (critical 9.8)
- [CVE-2026-10939](https://insights.sbomify.com/CVE-2026-10939/): Use after free in Chrome (high 8.8)
- [CVE-2026-109388](https://insights.sbomify.com/CVE-2026-109388/): Cross-site scripting in HivePress – Business Directory, Listings & Classified Ads Plugin (medium 6.4)
- [CVE-2026-109385](https://insights.sbomify.com/CVE-2026-109385/): UiChemy <= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slot Link URL (medium 6.4)
- [CVE-2026-109384](https://insights.sbomify.com/CVE-2026-109384/): File upload in The Innovative Form Builder – IvyForms (high 8.8)
- [CVE-2026-109383](https://insights.sbomify.com/CVE-2026-109383/): undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent (high 7.4)
- [CVE-2026-109382](https://insights.sbomify.com/CVE-2026-109382/): Missing authorization in WSP MCP – Free MCP Plugin for WordPress: Connect Claude, ChatGPT & AI Agents (medium 6.5)
- [CVE-2026-109381](https://insights.sbomify.com/CVE-2026-109381/): Event Booking Manager for WooCommerce <= 5.7.8 - Authenticated (Shop Manager+) Privilege Escalation to 'page' Parameter (high 7.2)
- [CVE-2026-109380](https://insights.sbomify.com/CVE-2026-109380/): modern-tar 0.3.5 through 0.8.5 Memory Exhaustion via Malformed Octal Size Field (high 8.7)
- [CVE-2026-10938](https://insights.sbomify.com/CVE-2026-10938/): Security feature bypass in Chrome (high 8.1)
- [CVE-2026-109379](https://insights.sbomify.com/CVE-2026-109379/): Cockpit CMS 2.14.1 Account Enumeration via Timing Discrepancy in /auth/check (medium 6.9)
- [CVE-2026-109378](https://insights.sbomify.com/CVE-2026-109378/): SPIP before 4.4.18 SSRF via HTTP Redirects in recuperer_url (medium 5.3)
- [CVE-2026-109377](https://insights.sbomify.com/CVE-2026-109377/): ERPNext 9.0.0 through 16.50.0 Missing Authorization in Batch Lookup Methods (medium 5.3)
- [CVE-2026-109376](https://insights.sbomify.com/CVE-2026-109376/): ERPNext 15.55.0 through 16.50.0 Incorrect Authorization via get_timesheet_html (medium 5.3)
- [CVE-2026-109375](https://insights.sbomify.com/CVE-2026-109375/): Vercel deepsec before 1.1.17 Arbitrary File Write via Symlink in Sandbox Tarball Extraction (medium 4.9)
- [CVE-2026-109374](https://insights.sbomify.com/CVE-2026-109374/): ZITADEL 3.0.0 before 4.19.2 Privilege Escalation via OIDC Token Exchange Impersonation (medium 5.1)
- [CVE-2026-109373](https://insights.sbomify.com/CVE-2026-109373/): ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session Cookie (critical 9.2)
- [CVE-2026-109372](https://insights.sbomify.com/CVE-2026-109372/): ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion (critical 9.3)
- [CVE-2026-109371](https://insights.sbomify.com/CVE-2026-109371/): ZITADEL 3.0.0 before 4.18.0 Unauthenticated Username Change via Login V1 (high 8.8)
- [CVE-2026-109370](https://insights.sbomify.com/CVE-2026-109370/): Cross-site scripting in Document Embedder – let visitors read files without downloading (medium 6.4)
- [CVE-2026-10937](https://insights.sbomify.com/CVE-2026-10937/): Security feature bypass in Chrome (high 8.1)
- [CVE-2026-109369](https://insights.sbomify.com/CVE-2026-109369/): Missing authorization in WP Booking System – Booking Calendar (medium 6.8)
- [CVE-2026-109368](https://insights.sbomify.com/CVE-2026-109368/): Missing authorization in WP Booking System – Booking Calendar (medium 6.5)
- [CVE-2026-109366](https://insights.sbomify.com/CVE-2026-109366/): Zebra before 6.4.0 Gossiped Block Drop via Forged Coinbase scriptSig Height (medium 6.3)
- [CVE-2026-109365](https://insights.sbomify.com/CVE-2026-109365/): Zebra before 6.4.0 Denial of Service via Same-Hash Forged Block Bodies (medium 6.3)
- [CVE-2026-109364](https://insights.sbomify.com/CVE-2026-109364/): Zebra 2.3.0 before 6.4.0 Peer Ban Bypass via Exact-IP Keying (medium 6.9)
- [CVE-2026-109363](https://insights.sbomify.com/CVE-2026-109363/): Zebra 6.4.0 before 6.4.2 Denial of Service via Malformed v6 Transaction (high 8.7)
- [CVE-2026-109362](https://insights.sbomify.com/CVE-2026-109362/): Heym v0.0.5 before v0.0.113 Broken Access Control via Workflow Execution Tokens (medium 5.3)
- [CVE-2026-109361](https://insights.sbomify.com/CVE-2026-109361/): MONAI 1.2.0 before 1.6.1 Insecure Deserialization RCE via nnUNetV2Runner postprocessing_file Path (high 7.0)
- [CVE-2026-109360](https://insights.sbomify.com/CVE-2026-109360/): MONAI 0.4.0 before 1.6.1 RCE via SENet Pretrained Weights Over Plaintext HTTP (high 7.7)
- [CVE-2026-10936](https://insights.sbomify.com/CVE-2026-10936/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-109359](https://insights.sbomify.com/CVE-2026-109359/): Contrast 1.8.0 before 1.24.1 Mesh CA Key Cross-Manifest Exposure via Peer Recovery (high 8.7)
- [CVE-2026-109358](https://insights.sbomify.com/CVE-2026-109358/): Edgeless Systems Contrast 1.8.0 before 1.24.1 World-Writable Containerd Config Privilege Escalation (high 8.5)
- [CVE-2026-109357](https://insights.sbomify.com/CVE-2026-109357/): LibreNMS before 26.9.0 LDAP Filter Injection Authentication Bypass via Authorization Header (critical 9.2)
- [CVE-2026-109356](https://insights.sbomify.com/CVE-2026-109356/): LibreNMS before 26.9.0 Missing Authorization in Port Purge via PortsController (medium 5.3)
- [CVE-2026-109355](https://insights.sbomify.com/CVE-2026-109355/): LibreNMS before 26.9.0 Stored XSS via Tools Oxidized Node List (medium 5.3)
- [CVE-2026-109354](https://insights.sbomify.com/CVE-2026-109354/): LibreNMS before 26.9.0 Path Traversal via NFSen channel Parameter (medium 5.3)
- [CVE-2026-109353](https://insights.sbomify.com/CVE-2026-109353/): LibreNMS before 26.9.0 SQL Injection via notification_id in notifications.inc.php (high 7.1)
- [CVE-2026-109352](https://insights.sbomify.com/CVE-2026-109352/): LibreNMS before 26.9.0 Stored XSS via wireless sensor description (medium 5.3)
- [CVE-2026-109351](https://insights.sbomify.com/CVE-2026-109351/): Gitoxide gix-pack before 0.75.0 Denial of Service via Pack Header Object Count (high 7.1)
- [CVE-2026-109350](https://insights.sbomify.com/CVE-2026-109350/): Gitoxide gix-pack before 0.75.0 Denial of Service via OFS_DELTA Base Distance (high 7.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/943/