# Vulnerabilities published in 2026


- [CVE-2026-10926](https://insights.sbomify.com/CVE-2026-10926/): Use after free in Chrome (high 8.8)
- [CVE-2026-109259](https://insights.sbomify.com/CVE-2026-109259/): ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Information Disclosure in TGA Decoder (medium 6.9)
- [CVE-2026-109258](https://insights.sbomify.com/CVE-2026-109258/): ImageMagick 7.1.0-20 before 7.1.2-32 Invalid Memory Free in FX Operation (low 2.0)
- [CVE-2026-109257](https://insights.sbomify.com/CVE-2026-109257/): FreeRDP before 3.32.0 Double Free via NSCodec plane growth failure (high 8.2)
- [CVE-2026-109256](https://insights.sbomify.com/CVE-2026-109256/): FreeRDP 3.10.0 through 3.32.2 Heap Buffer Overflow in WinPR PNG Conversion (medium 6.0)
- [CVE-2026-109255](https://insights.sbomify.com/CVE-2026-109255/): FreeRDP 3.0.0 before 3.32.0 heap buffer overflow via license_check_stream_length (medium 6.1)
- [CVE-2026-109254](https://insights.sbomify.com/CVE-2026-109254/): FreeRDP 2.1.0 before 3.32.0 Use-After-Free via rdpsnd Disconnect Path (medium 6.0)
- [CVE-2026-109253](https://insights.sbomify.com/CVE-2026-109253/): FreeRDP 3.9.0 before 3.32.0 RDPEAR NDR Scalar Out-of-Bounds Read (medium 6.0)
- [CVE-2026-109252](https://insights.sbomify.com/CVE-2026-109252/): FreeRDP from 3.9.0 before 3.32.0 RDPEAR NULL Pointer Dereference via KERB_RPC_INTERNAL_NAME (medium 6.0)
- [CVE-2026-109251](https://insights.sbomify.com/CVE-2026-109251/): FreeRDP before 3.32.0 Out-of-Bounds Write via MS-RDPEGT Video Geometry (medium 6.0)
- [CVE-2026-109250](https://insights.sbomify.com/CVE-2026-109250/): FreeRDP 3.0.0 before 3.32.0 Heap Buffer Overflow via PKCS#11 collect_keys() (high 7.0)
- [CVE-2026-10925](https://insights.sbomify.com/CVE-2026-10925/): Memory corruption in Chrome (high 8.3)
- [CVE-2026-109249](https://insights.sbomify.com/CVE-2026-109249/): FreeRDP 3.0.0 before 3.32.0 Heap Out-of-Bounds Read via Remote Assistance File Parsing (medium 6.8)
- [CVE-2026-109248](https://insights.sbomify.com/CVE-2026-109248/): FreeRDP 3.0.0 before 3.32.0 Heap Out-of-Bounds Read via WinPR Clipboard cFileName (medium 6.9)
- [CVE-2026-109247](https://insights.sbomify.com/CVE-2026-109247/): FreeRDP before 3.32.0 Path Traversal via Clipboard cFileName (low 2.1)
- [CVE-2026-109246](https://insights.sbomify.com/CVE-2026-109246/): FreeRDP before 3.32.0 Shadow Server Divide-by-Zero via Frame Acknowledge PDU (high 7.1)
- [CVE-2026-109245](https://insights.sbomify.com/CVE-2026-109245/): FreeRDP 3.0.0 before 3.32.0 Improper Certificate Validation in freerdp_http_request (high 7.4)
- [CVE-2026-109244](https://insights.sbomify.com/CVE-2026-109244/): FreeRDP 2.0.0 before 3.32.0 Insecure Private Key Permissions in winpr-makecert (medium 6.8)
- [CVE-2026-109243](https://insights.sbomify.com/CVE-2026-109243/): FreeRDP 3.0.0 before 3.32.0 Insecure Permissions on Soft-Smartcard Private Key File (medium 4.1)
- [CVE-2026-109242](https://insights.sbomify.com/CVE-2026-109242/): FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 Uninitialized Heap Disclosure via Progressive Codec Tile Upgrade (high 7.1)
- [CVE-2026-109241](https://insights.sbomify.com/CVE-2026-109241/): FreeRDP before 3.32.0 NULL Dereference in Video Redirection Channel (low 2.3)
- [CVE-2026-109240](https://insights.sbomify.com/CVE-2026-109240/): FreeRDP 3.11.0 before 3.32.1 Reachable Assertion DoS via urb_isoch_transfer (low 2.3)
- [CVE-2026-10924](https://insights.sbomify.com/CVE-2026-10924/): Integer overflow in Chrome (high 8.3)
- [CVE-2026-109239](https://insights.sbomify.com/CVE-2026-109239/): Crawl4AI before 0.9.4 Blind SSRF via RobotsParser.can_fetch robots.txt Fetch (medium 6.9)
- [CVE-2026-109238](https://insights.sbomify.com/CVE-2026-109238/): Crawl4AI 0.7.0 before 0.9.4 SSRF via link_preview_config URL Seeder (critical 9.2)
- [CVE-2026-109237](https://insights.sbomify.com/CVE-2026-109237/): Crawl4AI 0.9.0 before 0.9.4 Untrusted Config Gate Bypass Leaks Environment Variables (high 8.6)
- [CVE-2026-109236](https://insights.sbomify.com/CVE-2026-109236/): Auth bypass in Customer Email Verification for WooCommerce (medium 4.8)
- [CVE-2026-109232](https://insights.sbomify.com/CVE-2026-109232/): Cross-site scripting in Salon Booking System – Appointment Booking for Salons, Barbershops & Spas (high 7.2)
- [CVE-2026-10923](https://insights.sbomify.com/CVE-2026-10923/): Use after free in Chrome (high 8.8)
- [CVE-2026-109229](https://insights.sbomify.com/CVE-2026-109229/): SGLang through 0.5.21 Decompression Bomb DoS via NanoNemotronVLImageProcessor (high 8.7)
- [CVE-2026-109228](https://insights.sbomify.com/CVE-2026-109228/): SGLang through 0.5.21 Resource Budget Bypass via GLM-V Video Parameters (high 8.7)
- [CVE-2026-109227](https://insights.sbomify.com/CVE-2026-109227/): SGLang through 0.5.21 Memory Exhaustion DoS via Qwen-VL Video Preprocessing (high 8.7)
- [CVE-2026-109226](https://insights.sbomify.com/CVE-2026-109226/): SGLang through 0.5.21 Audio Decompression Amplification via load_audio (high 8.7)
- [CVE-2026-109225](https://insights.sbomify.com/CVE-2026-109225/): SGLang through 0.5.21 Memory Exhaustion DoS via /v1/audio/transcriptions Upload (high 8.7)
- [CVE-2026-109224](https://insights.sbomify.com/CVE-2026-109224/): SureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via sc-cart-loader 'template' Attribute in Comment (high 7.2)
- [CVE-2026-109221](https://insights.sbomify.com/CVE-2026-109221/): Path traversal in Groundhogg — CRM, Newsletters, and Marketing Automation (high 8.1)
- [CVE-2026-10922](https://insights.sbomify.com/CVE-2026-10922/): Security feature bypass in Chrome (high 8.8)
- [CVE-2026-109219](https://insights.sbomify.com/CVE-2026-109219/): Mang Board - 2.4.4 - Unauthenticated Arbitrary File Upload via 'image_path' Parameter (critical 9.8)
- [CVE-2026-109218](https://insights.sbomify.com/CVE-2026-109218/): Contact Manager <= 9.1.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename Blacklist Bypass (critical 9.8)
- [CVE-2026-109216](https://insights.sbomify.com/CVE-2026-109216/): Meta Box <= 5.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Background Field Array Keys (medium 4.9)
- [CVE-2026-109215](https://insights.sbomify.com/CVE-2026-109215/): Cross-site scripting in LiteSpeed Cache (medium 6.4)
- [CVE-2026-10921](https://insights.sbomify.com/CVE-2026-10921/): Integer overflow in Chrome (high 8.3)
- [CVE-2026-109209](https://insights.sbomify.com/CVE-2026-109209/): Cross-site scripting in All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos (medium 6.4)
- [CVE-2026-109208](https://insights.sbomify.com/CVE-2026-109208/): LearnPress <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' Parameters (high 7.2)
- [CVE-2026-109207](https://insights.sbomify.com/CVE-2026-109207/): RSS Aggregator by Feedzy <= 5.2.11 - Unauthenticated Stored Cross-Site Scripting via RSS media:thumbnail URL (high 7.2)
- [CVE-2026-109206](https://insights.sbomify.com/CVE-2026-109206/): LogicalDOC Community Edition through 9.3 Username Enumeration via AvatarServlet (medium 6.9)
- [CVE-2026-109205](https://insights.sbomify.com/CVE-2026-109205/): LogicalDOC Community Edition through 9.3 Unauthenticated Upload Disk Exhaustion via UploadServlet (high 8.7)
- [CVE-2026-109204](https://insights.sbomify.com/CVE-2026-109204/): LogicalDOC Community Edition through 9.3 Forced Password Reset via Unbound PswRecovery Ticket (medium 5.3)
- [CVE-2026-109203](https://insights.sbomify.com/CVE-2026-109203/): LogicalDOC Community Edition through 9.3 Missing Authorization via ConvertPdf Servlet (high 7.1)
- [CVE-2026-109202](https://insights.sbomify.com/CVE-2026-109202/): LogicalDOC Community Edition through 9.3 Missing Authorization via zip-export Servlet (high 7.1)
- [CVE-2026-109201](https://insights.sbomify.com/CVE-2026-109201/): LogicalDOC Community Edition through 9.3 Missing Authorization in DocumentService (high 8.7)
- [CVE-2026-109200](https://insights.sbomify.com/CVE-2026-109200/): LogicalDOC Community Edition through 9.3 SSRF via XMLConverter xml-stylesheet href (medium 5.3)
- [CVE-2026-10920](https://insights.sbomify.com/CVE-2026-10920/): Security feature bypass in Chrome (high 8.3)
- [CVE-2026-1092](https://insights.sbomify.com/CVE-2026-1092/): Improper Validation of Specified Quantity in Input in GitLab (high 7.5)
- [CVE-2026-109199](https://insights.sbomify.com/CVE-2026-109199/): LogicalDOC Community Edition through 9.3 Code Injection via Velocity sendAsEmail Template (high 8.7)
- [CVE-2026-109198](https://insights.sbomify.com/CVE-2026-109198/): Anti-Spam by CleanTalk <= 6.89.1 - Unauthenticated Stored Cross-Site Scripting via 'user_email' Registration Parameter (high 7.2)
- [CVE-2026-109195](https://insights.sbomify.com/CVE-2026-109195/): Quay: repository auto-prune policy uuid idor in quay api (low 3.1)
- [CVE-2026-109194](https://insights.sbomify.com/CVE-2026-109194/): Quay: build trigger uuid idor in quay api (medium 6.4)
- [CVE-2026-109193](https://insights.sbomify.com/CVE-2026-109193/): HivePress <= 1.7.32 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value (high 7.2)
- [CVE-2026-109191](https://insights.sbomify.com/CVE-2026-109191/): Image Hub <= 1.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure in Admin Page HTML (medium 4.3)
- [CVE-2026-109190](https://insights.sbomify.com/CVE-2026-109190/): conductor-oss conductor API Tool Configuration ListApiToolsTask.java ListApiToolsTask.start server-side request forgery (medium 5.3)
- [CVE-2026-10919](https://insights.sbomify.com/CVE-2026-10919/): Use after free in Chrome (high 8.3)
- [CVE-2026-109189](https://insights.sbomify.com/CVE-2026-109189/): Server-side request forgery in MeterSphere (medium 5.3)
- [CVE-2026-109188](https://insights.sbomify.com/CVE-2026-109188/): jshERP through 3.6 Missing Authorization in Master Data Add and Import Endpoints (medium 5.3)
- [CVE-2026-109187](https://insights.sbomify.com/CVE-2026-109187/): jshERP through 3.6 Information Disclosure via /platformConfig/getInfoByKey (high 7.1)
- [CVE-2026-109186](https://insights.sbomify.com/CVE-2026-109186/): jshERP through 3.6 Mass Assignment via PUT /user/update (high 8.7)
- [CVE-2026-109185](https://insights.sbomify.com/CVE-2026-109185/): jshERP through 3.6 Privilege Escalation via PUT /user/updateUser (high 8.7)
- [CVE-2026-109184](https://insights.sbomify.com/CVE-2026-109184/): jshERP through 3.6 Data Scope Bypass via /account/findAccountInOutList (medium 5.3)
- [CVE-2026-109183](https://insights.sbomify.com/CVE-2026-109183/): jshERP through 3.6 Approval Bypass via addDepotHeadAndDetail Status Parameter (medium 5.3)
- [CVE-2026-109182](https://insights.sbomify.com/CVE-2026-109182/): jshERP through 3.6 Incorrect Authorization via /supplier/exportExcel (medium 5.3)
- [CVE-2026-109181](https://insights.sbomify.com/CVE-2026-109181/): jshERP through 3.6 Authorization Bypass via purchaseStatus in /depotHead/list (medium 5.3)
- [CVE-2026-109180](https://insights.sbomify.com/CVE-2026-109180/): jshERP through 3.6 Authorization Bypass via User-Controlled Warehouse IDs (medium 5.3)
- [CVE-2026-10918](https://insights.sbomify.com/CVE-2026-10918/): Use after free in Chrome (high 8.3)
- [CVE-2026-109179](https://insights.sbomify.com/CVE-2026-109179/): jshERP through 3.6 Missing Authorization via /log/list and /log/info (medium 5.3)
- [CVE-2026-109178](https://insights.sbomify.com/CVE-2026-109178/): jshERP through 3.6 Missing Authorization via /log Audit Endpoints (medium 5.3)
- [CVE-2026-109177](https://insights.sbomify.com/CVE-2026-109177/): MoguBlog through 6.2 Broken Access Control via networkDisk moveFile and edit (medium 5.3)
- [CVE-2026-109176](https://insights.sbomify.com/CVE-2026-109176/): MoguBlog through 6.2 IDOR Allows Deleting Other Administrators' Network-Disk Files (medium 5.3)
- [CVE-2026-109175](https://insights.sbomify.com/CVE-2026-109175/): MoguBlog through 6.2 Broken Access Control via /networkDisk/getFileList (medium 5.3)
- [CVE-2026-109174](https://insights.sbomify.com/CVE-2026-109174/): MoguBlog through 6.2 Credential Disclosure via /oauth/getSystemConfig (high 7.1)
- [CVE-2026-109173](https://insights.sbomify.com/CVE-2026-109173/): yshop-crm through 2.1.3 Missing Authorization via invoice check endpoint (medium 5.3)
- [CVE-2026-109172](https://insights.sbomify.com/CVE-2026-109172/): yshop-crm through 2.1.3 Missing Authorization via contract-receivables check endpoint (medium 5.3)
- [CVE-2026-109171](https://insights.sbomify.com/CVE-2026-109171/): yshop-crm through 2.1.3 Missing Authorization via /admin-api/crm/contract/check (medium 5.3)
- [CVE-2026-109170](https://insights.sbomify.com/CVE-2026-109170/): LogicalDOC Community Edition through 9.3 HQL Injection via documents.xml indexed Parameter (high 7.1)
- [CVE-2026-10917](https://insights.sbomify.com/CVE-2026-10917/): Security feature bypass in Chrome (high 8.3)
- [CVE-2026-109169](https://insights.sbomify.com/CVE-2026-109169/): LogicalDOC Community Edition through 9.3 SQL Injection via tags.xml firstLetter (high 7.1)
- [CVE-2026-109168](https://insights.sbomify.com/CVE-2026-109168/): lamp-cloud through 5.10.1 IDOR via /anyone/appendix/listFileByBizId (high 7.1)
- [CVE-2026-109167](https://insights.sbomify.com/CVE-2026-109167/): TDuck survey form through 6.0 Authorization Bypass via User-Controlled Theme ID in POST /user/form/theme/save (medium 5.3)
- [CVE-2026-109166](https://insights.sbomify.com/CVE-2026-109166/): lamp-cloud through 5.10.1 IDOR via /anyone/file/findUrlById (high 7.1)
- [CVE-2026-109165](https://insights.sbomify.com/CVE-2026-109165/): TDuck survey form through 6.0 Authorization Bypass via User-Controlled Form Key in POST /user/form/item/batch/create (medium 5.3)
- [CVE-2026-109164](https://insights.sbomify.com/CVE-2026-109164/): Missing authorization in tduck-survey-form (high 7.1)
- [CVE-2026-109162](https://insights.sbomify.com/CVE-2026-109162/): TYPO3 CMS - Security Misconfiguration in Form Framework (medium 6.3)
- [CVE-2026-109160](https://insights.sbomify.com/CVE-2026-109160/): PublicCMS pay Endpoint SafeConfigComponent.java SafeConfigComponent.getSafeUrl redirect (medium 5.3)
- [CVE-2026-10916](https://insights.sbomify.com/CVE-2026-10916/): Cross-site scripting in Chrome (medium 6.1)
- [CVE-2026-109157](https://insights.sbomify.com/CVE-2026-109157/): TRENDnet TEW-432BRP formTcpipSetup stack-based overflow (critical 9.4)
- [CVE-2026-109156](https://insights.sbomify.com/CVE-2026-109156/): SeldonIO MLServer environment_tarball env.py _extract_env path traversal (medium 5.3)
- [CVE-2026-109155](https://insights.sbomify.com/CVE-2026-109155/): DeepPavlov Model Download untar path traversal (medium 5.3)
- [CVE-2026-109153](https://insights.sbomify.com/CVE-2026-109153/): MosaicML Composer Checkpoint Extraction checkpoint.py tarball.extractall path traversal (medium 5.3)
- [CVE-2026-109152](https://insights.sbomify.com/CVE-2026-109152/): jbardin scp.py SCP Receive _recv_pushd path traversal (medium 5.3)
- [CVE-2026-10915](https://insights.sbomify.com/CVE-2026-10915/): Use after free in Chrome (high 8.3)
- [CVE-2026-109149](https://insights.sbomify.com/CVE-2026-109149/): beautifier js-beautify memory allocation (medium 6.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/945/