# Vulnerabilities published in 2026


- [CVE-2026-10935](https://insights.sbomify.com/CVE-2026-10935/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-109349](https://insights.sbomify.com/CVE-2026-109349/): gix-pack before 0.75.0 Reachable Assertion DoS via Pack Version 3 Header (high 7.1)
- [CVE-2026-109348](https://insights.sbomify.com/CVE-2026-109348/): Gitoxide gix-mailmap before 0.35.0 CPU Denial of Service via .mailmap Parsing (medium 5.3)
- [CVE-2026-109347](https://insights.sbomify.com/CVE-2026-109347/): Adminer before 6.1.1 RCE via UTF-8 BOM SQLite ATTACH Bypass (high 8.6)
- [CVE-2026-109346](https://insights.sbomify.com/CVE-2026-109346/): better-auth 1.3.8-beta.3 before 1.7.0-rc.3 Device Authorization Phishing via /device (high 8.5)
- [CVE-2026-109345](https://insights.sbomify.com/CVE-2026-109345/): DOMPurify before 3.4.16 XSS via IN_PLACE Returned Rawtext Root (medium 5.1)
- [CVE-2026-109344](https://insights.sbomify.com/CVE-2026-109344/): DOMPurify from 3.4.13 before 3.4.16 DOM XSS via IN_PLACE afterSanitize Hooks (medium 5.1)
- [CVE-2026-109343](https://insights.sbomify.com/CVE-2026-109343/): SurrealDB before 3.3.0 Cross-Tenant Access via USE Statement (high 8.6)
- [CVE-2026-109342](https://insights.sbomify.com/CVE-2026-109342/): SurrealDB 3.0.0 before 3.3.0 Missing Authentication in revoke RPC Method (medium 5.3)
- [CVE-2026-109341](https://insights.sbomify.com/CVE-2026-109341/): SurrealDB before 3.3.0 Field Permission Bypass via PATCH copy/move/test Operations (high 7.1)
- [CVE-2026-109340](https://insights.sbomify.com/CVE-2026-109340/): SurrealDB 3.1.0 before 3.3.0 Authorization Bypass via REFERENCE ON DELETE CASCADE (medium 5.3)
- [CVE-2026-10934](https://insights.sbomify.com/CVE-2026-10934/): Use after free in Chrome (high 8.3)
- [CVE-2026-109339](https://insights.sbomify.com/CVE-2026-109339/): SurrealDB 3.1.0 before 3.3.0 Memory Exhaustion via Surrealism Module Output Buffering (medium 6.9)
- [CVE-2026-109338](https://insights.sbomify.com/CVE-2026-109338/): SurrealDB before 3.3.0 Denial of Service via Headers Non-ASCII Values (high 7.1)
- [CVE-2026-109337](https://insights.sbomify.com/CVE-2026-109337/): SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT WHERE Clause (medium 5.3)
- [CVE-2026-109336](https://insights.sbomify.com/CVE-2026-109336/): SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT $before/$after (medium 5.3)
- [CVE-2026-109335](https://insights.sbomify.com/CVE-2026-109335/): SurrealDB 3.0.0 before 3.3.0 Information Disclosure via COMPUTED Fields (high 7.1)
- [CVE-2026-109334](https://insights.sbomify.com/CVE-2026-109334/): SurrealDB before 3.3.0 Cross-Tenant Access via Surreal-NS/Surreal-DB Headers and RPC use (high 8.6)
- [CVE-2026-109333](https://insights.sbomify.com/CVE-2026-109333/): SurrealDB 3.0.0 before 3.3.0 Cross-Tenant Record Read via RETURN FETCH (high 7.1)
- [CVE-2026-109332](https://insights.sbomify.com/CVE-2026-109332/): Network-AI before 5.15.2 CORS Origin Validation Error in MCP SSE Transport (low 2.3)
- [CVE-2026-109331](https://insights.sbomify.com/CVE-2026-109331/): Network-AI 5.14.0 before 5.15.2 Deny Pattern Bypass via ClaudeHookBridge extractFullTarget (high 7.5)
- [CVE-2026-109330](https://insights.sbomify.com/CVE-2026-109330/): Network-AI 5.0.0 before 5.15.2 Cross-Site WebSocket Hijacking via DashboardServer (medium 5.3)
- [CVE-2026-10933](https://insights.sbomify.com/CVE-2026-10933/): Use after free in Chrome (high 8.3)
- [CVE-2026-109329](https://insights.sbomify.com/CVE-2026-109329/): Missing authorization in admidio (high 8.5)
- [CVE-2026-109328](https://insights.sbomify.com/CVE-2026-109328/): Admidio 5.0.0 before 5.0.15 Unauthenticated Stored XSS via Registration Name (medium 5.3)
- [CVE-2026-109327](https://insights.sbomify.com/CVE-2026-109327/): Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 Reflected XSS via system/redirect.php (medium 5.1)
- [CVE-2026-109326](https://insights.sbomify.com/CVE-2026-109326/): Grav before 2.1.7 Information Disclosure via Nested .git Directories (high 8.7)
- [CVE-2026-109325](https://insights.sbomify.com/CVE-2026-109325/): Grav from 2.0.22 before 2.1.7 Clockwork Profiler Authentication Bypass via Proxy (high 8.7)
- [CVE-2026-109324](https://insights.sbomify.com/CVE-2026-109324/): Grav before 2.1.7 Memory Exhaustion via Oversized Image Transforms (high 7.1)
- [CVE-2026-109323](https://insights.sbomify.com/CVE-2026-109323/): Grav Star Ratings 2.0.1 through 2.0.3 Missing Server-Side vote_access Authorization (medium 6.9)
- [CVE-2026-109322](https://insights.sbomify.com/CVE-2026-109322/): Grav Guestbook before 0.5.2 Stored XSS via AJAX Pagination and Admin Views (medium 5.3)
- [CVE-2026-109321](https://insights.sbomify.com/CVE-2026-109321/): Grav Login OAuth Plugin before 1.4.3 Predictable Local Credentials Authentication Bypass (critical 9.3)
- [CVE-2026-109320](https://insights.sbomify.com/CVE-2026-109320/): Grav API Plugin before 1.0.36 Disabled Account Session Access Bypass (medium 5.3)
- [CVE-2026-10932](https://insights.sbomify.com/CVE-2026-10932/): Use after free in Chrome (high 8.8)
- [CVE-2026-109319](https://insights.sbomify.com/CVE-2026-109319/): Grav Guestbook Plugin 0.5.0 and 0.5.1 Missing Authorization and CSRF in Moderation (medium 5.3)
- [CVE-2026-109318](https://insights.sbomify.com/CVE-2026-109318/): Grav Git Sync 1.0.2 through 3.4.12 Command Injection via Commit Author (high 8.7)
- [CVE-2026-109317](https://insights.sbomify.com/CVE-2026-109317/): Grav API Plugin before 1.0.36 Privilege Escalation via Scalar Access Grants (high 8.6)
- [CVE-2026-109316](https://insights.sbomify.com/CVE-2026-109316/): Grav Data Manager 1.4.0 through 1.4.5 Unauthenticated File Deletion via Admin (medium 6.9)
- [CVE-2026-109315](https://insights.sbomify.com/CVE-2026-109315/): Grav 2.0.22 before 2.1.7 Clockwork Debugger Token Disclosure via Twig Sandbox (high 7.1)
- [CVE-2026-109314](https://insights.sbomify.com/CVE-2026-109314/): Grav Login Plugin 1.2.0 before 3.9.9 Password Reset Token Disclosure via Reset Page (high 8.5)
- [CVE-2026-109313](https://insights.sbomify.com/CVE-2026-109313/): Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Remember-Me Cookie (high 8.6)
- [CVE-2026-109312](https://insights.sbomify.com/CVE-2026-109312/): Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Profile Update Form (high 8.6)
- [CVE-2026-109311](https://insights.sbomify.com/CVE-2026-109311/): vLLM before 0.29.0 Heap Overflow DoS via IAMF Audio Transcription Upload (high 7.1)
- [CVE-2026-109310](https://insights.sbomify.com/CVE-2026-109310/): SiYuan v3.1.12 before v3.8.6 Denial of Service via getDynamicIcon Template (high 7.1)
- [CVE-2026-10931](https://insights.sbomify.com/CVE-2026-10931/): Use after free in Chrome (critical 9.6)
- [CVE-2026-109309](https://insights.sbomify.com/CVE-2026-109309/): SiYuan v3.7.0 before v3.8.6 Arbitrary File Read via Plugin ResponseFile.Path (medium 6.9)
- [CVE-2026-109308](https://insights.sbomify.com/CVE-2026-109308/): Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 RCE via actionCacheUpdates Behavior Injection (high 8.7)
- [CVE-2026-109307](https://insights.sbomify.com/CVE-2026-109307/): Craft CMS 5.0.0 before 5.10.14 DOM XSS via returnUrl in 2FA Verification (low 2.1)
- [CVE-2026-109306](https://insights.sbomify.com/CVE-2026-109306/): Craft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licensed-edition (medium 6.0)
- [CVE-2026-109305](https://insights.sbomify.com/CVE-2026-109305/): Craft CMS 5.10.2 before 5.10.14 Twig Sandbox Bypass RCE via has some/has every (high 8.7)
- [CVE-2026-109304](https://insights.sbomify.com/CVE-2026-109304/): Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 Arbitrary File Read via Twig create() DOMDocument (medium 6.9)
- [CVE-2026-109303](https://insights.sbomify.com/CVE-2026-109303/): Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 protectedFields Bypass via Relation Count Query (medium 5.3)
- [CVE-2026-109302](https://insights.sbomify.com/CVE-2026-109302/): Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 GraphQL Schema Disclosure via Persisted Queries (medium 6.3)
- [CVE-2026-109301](https://insights.sbomify.com/CVE-2026-109301/): Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 Denial of Service via File Pointer Without URL (high 8.2)
- [CVE-2026-109300](https://insights.sbomify.com/CVE-2026-109300/): Open WebUI 0.6.31 before 0.11.4 Stored XSS via Tool-Call Embeds (medium 5.1)
- [CVE-2026-10930](https://insights.sbomify.com/CVE-2026-10930/): Memory corruption in Chrome (high 8.1)
- [CVE-2026-1093](https://insights.sbomify.com/CVE-2026-1093/): Cross-site scripting in WPFAQBlock– FAQ & Accordion Plugin For Gutenberg (medium 6.4)
- [CVE-2026-109299](https://insights.sbomify.com/CVE-2026-109299/): Open WebUI 0.9.0 before 0.11.4 Denial of Service via Recurrence Rule Validation (high 7.1)
- [CVE-2026-109298](https://insights.sbomify.com/CVE-2026-109298/): Open WebUI 0.11.0 before 0.11.4 Memory Exhaustion via Knowledge Search Regex (high 7.1)
- [CVE-2026-109297](https://insights.sbomify.com/CVE-2026-109297/): Open WebUI 0.11.0 before 0.11.4 Denial of Service via Automation Recurrence Rules (high 7.1)
- [CVE-2026-109296](https://insights.sbomify.com/CVE-2026-109296/): Open WebUI before 0.11.4 Missing Authorization via Backend Index on Model Routes (medium 5.3)
- [CVE-2026-109295](https://insights.sbomify.com/CVE-2026-109295/): Open WebUI 0.11.0 before 0.11.4 ReDoS via grep_knowledge_files Event Loop (medium 5.3)
- [CVE-2026-109294](https://insights.sbomify.com/CVE-2026-109294/): Open WebUI 0.6.42 before 0.11.4 Memory Exhaustion via Compressed Remote Image (high 7.1)
- [CVE-2026-109293](https://insights.sbomify.com/CVE-2026-109293/): Open WebUI 0.11.0 before 0.11.4 Tool Source Disclosure via Tool Export Endpoint (high 7.1)
- [CVE-2026-109292](https://insights.sbomify.com/CVE-2026-109292/): Open WebUI 0.6.27 before 0.11.4 Session Token Disclosure via OAuth-Mode Connections (high 7.6)
- [CVE-2026-109291](https://insights.sbomify.com/CVE-2026-109291/): Open WebUI 0.6.33 before 0.11.4 Stored XSS via Citation embed_url (high 8.5)
- [CVE-2026-109290](https://insights.sbomify.com/CVE-2026-109290/): Open WebUI 0.11.1 before 0.11.4 Stored XSS via DOCX Preview (high 8.4)
- [CVE-2026-10929](https://insights.sbomify.com/CVE-2026-10929/): Memory corruption in Chrome (high 8.3)
- [CVE-2026-109289](https://insights.sbomify.com/CVE-2026-109289/): Open WebUI 0.8.8 before 0.11.4 Improper Session Revocation via Terminal WebSocket (medium 5.3)
- [CVE-2026-109288](https://insights.sbomify.com/CVE-2026-109288/): Open WebUI before 0.11.4 Stored XSS via javascript: URLs in Markdown Links (high 7.2)
- [CVE-2026-109287](https://insights.sbomify.com/CVE-2026-109287/): Open WebUI 0.9.6 before 0.11.4 Information Disclosure via Unscoped Directory ID (medium 5.3)
- [CVE-2026-109286](https://insights.sbomify.com/CVE-2026-109286/): Open WebUI 0.7.0 before 0.11.4 Session Token Theft via SyncStatsModal (high 8.6)
- [CVE-2026-109285](https://insights.sbomify.com/CVE-2026-109285/): Open WebUI 0.6.0 before 0.11.4 Improper Access Control via Stale File Metadata (low 2.3)
- [CVE-2026-109284](https://insights.sbomify.com/CVE-2026-109284/): Open WebUI 0.11.0 before 0.11.4 Improper Authorization via Chat Fork Endpoint (medium 5.3)
- [CVE-2026-109283](https://insights.sbomify.com/CVE-2026-109283/): Open WebUI 0.11.1 before 0.11.4 Authorization Bypass via OAuth Token Exchange (medium 5.3)
- [CVE-2026-109282](https://insights.sbomify.com/CVE-2026-109282/): ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Undefined Behavior in INFO, JSON and YAML Encoders (low 2.0)
- [CVE-2026-109281](https://insights.sbomify.com/CVE-2026-109281/): ImageMagick 7.1.0-21 before 7.1.2-32 Heap Buffer Over-Read via -fx Option (medium 4.8)
- [CVE-2026-109280](https://insights.sbomify.com/CVE-2026-109280/): ImageMagick 7.1.0-20 before 7.1.2-32 Use After Free via -fx Option (low 2.0)
- [CVE-2026-10928](https://insights.sbomify.com/CVE-2026-10928/): Code injection in Chrome (high 8.8)
- [CVE-2026-109279](https://insights.sbomify.com/CVE-2026-109279/): ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Heap Buffer Overflow via Concurrent Security Policy Access (low 2.0)
- [CVE-2026-109278](https://insights.sbomify.com/CVE-2026-109278/): ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in Wavelet-Denoise Operation (medium 6.3)
- [CVE-2026-109277](https://insights.sbomify.com/CVE-2026-109277/): ImageMagick before 7.1.2-32 Policy Bypass via -script Operation (medium 4.8)
- [CVE-2026-109276](https://insights.sbomify.com/CVE-2026-109276/): ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Temporary File Leak in JNG Decoder (medium 6.9)
- [CVE-2026-109275](https://insights.sbomify.com/CVE-2026-109275/): ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Code Injection via MVG Decoder (medium 6.3)
- [CVE-2026-109274](https://insights.sbomify.com/CVE-2026-109274/): ImageMagick before 7.1.2-32 TOCTOU Symlink Race Path Policy Bypass via magick script (low 2.0)
- [CVE-2026-109273](https://insights.sbomify.com/CVE-2026-109273/): ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Information Disclosure in PostScript Decoder (medium 6.9)
- [CVE-2026-109272](https://insights.sbomify.com/CVE-2026-109272/): ImageMagick 7.1.1-31 before 7.1.2-32 Null Pointer Dereference in PostScript Decoder (medium 6.3)
- [CVE-2026-109271](https://insights.sbomify.com/CVE-2026-109271/): ImageMagick 7.1.2-30 before 7.1.2-32 Use After Free in WBINFO Decoder (medium 6.3)
- [CVE-2026-109270](https://insights.sbomify.com/CVE-2026-109270/): ImageMagick before 7.1.2-32 Memory Leak via -process Option (medium 4.8)
- [CVE-2026-10927](https://insights.sbomify.com/CVE-2026-10927/): Memory corruption in Chrome (high 8.3)
- [CVE-2026-109269](https://insights.sbomify.com/CVE-2026-109269/): ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Information Disclosure via JPEG Decoder (medium 6.9)
- [CVE-2026-109268](https://insights.sbomify.com/CVE-2026-109268/): ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Use After Free in PDF Writer via JPEG2000 (medium 6.3)
- [CVE-2026-109267](https://insights.sbomify.com/CVE-2026-109267/): ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Stack Overflow in MSL Decoder (medium 6.9)
- [CVE-2026-109266](https://insights.sbomify.com/CVE-2026-109266/): ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 XML Injection via CIP Encoder (medium 6.9)
- [CVE-2026-109265](https://insights.sbomify.com/CVE-2026-109265/): ImageMagick 7.1.1-7 before 7.1.2-32 Heap Buffer Over-Read via XMP Profile (medium 6.9)
- [CVE-2026-109264](https://insights.sbomify.com/CVE-2026-109264/): ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Stack Overflow in MVG Decoder (medium 6.3)
- [CVE-2026-109263](https://insights.sbomify.com/CVE-2026-109263/): ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in YUV Encoder (medium 6.3)
- [CVE-2026-109262](https://insights.sbomify.com/CVE-2026-109262/): ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in SVG Encoder (medium 6.9)
- [CVE-2026-109261](https://insights.sbomify.com/CVE-2026-109261/): ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in GIF Encoder (medium 6.3)
- [CVE-2026-109260](https://insights.sbomify.com/CVE-2026-109260/): ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in PNG Encoder (medium 6.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/944/