# Vulnerabilities published in 2026


- [CVE-2026-106235](https://insights.sbomify.com/CVE-2026-106235/): Use after free in Chrome (high 8.8)
- [CVE-2026-106234](https://insights.sbomify.com/CVE-2026-106234/): Use after free in Chrome (critical 9.6)
- [CVE-2026-106233](https://insights.sbomify.com/CVE-2026-106233/): Use after free in Chrome (high 8.3)
- [CVE-2026-106232](https://insights.sbomify.com/CVE-2026-106232/): Other in Chrome (medium 5.4)
- [CVE-2026-106231](https://insights.sbomify.com/CVE-2026-106231/): Information disclosure in Chrome (medium 4.7)
- [CVE-2026-106230](https://insights.sbomify.com/CVE-2026-106230/): Information disclosure in Chrome (medium 5.3)
- [CVE-2026-10623](https://insights.sbomify.com/CVE-2026-10623/): Missing authorization in PressPrimer Quiz – AI Quiz Maker, Exam Builder & LMS Assessment Plugin (medium 4.3)
- [CVE-2026-106229](https://insights.sbomify.com/CVE-2026-106229/): Security feature bypass in Chrome (medium 5.4)
- [CVE-2026-106228](https://insights.sbomify.com/CVE-2026-106228/): Other in Chrome (high 8.3)
- [CVE-2026-106227](https://insights.sbomify.com/CVE-2026-106227/): Use after free in Chrome (critical 9.6)
- [CVE-2026-106226](https://insights.sbomify.com/CVE-2026-106226/): Other in Chrome (medium 4.2)
- [CVE-2026-106225](https://insights.sbomify.com/CVE-2026-106225/): Missing authorization in Chrome (high 8.8)
- [CVE-2026-106224](https://insights.sbomify.com/CVE-2026-106224/): Missing authorization in Chrome (low 3.1)
- [CVE-2026-106223](https://insights.sbomify.com/CVE-2026-106223/): Information disclosure in Chrome (medium 4.7)
- [CVE-2026-106222](https://insights.sbomify.com/CVE-2026-106222/): Missing authorization in Chrome (medium 5.9)
- [CVE-2026-106221](https://insights.sbomify.com/CVE-2026-106221/): Security feature bypass in Chrome (high 8.3)
- [CVE-2026-106220](https://insights.sbomify.com/CVE-2026-106220/): Information disclosure in Chrome (high 8.8)
- [CVE-2026-10622](https://insights.sbomify.com/CVE-2026-10622/): CVE-2026-10622 (high 8.2)
- [CVE-2026-106219](https://insights.sbomify.com/CVE-2026-106219/): Path traversal in TeamCity (medium 6.5)
- [CVE-2026-106218](https://insights.sbomify.com/CVE-2026-106218/): Code injection in TeamCity (high 8.8)
- [CVE-2026-106217](https://insights.sbomify.com/CVE-2026-106217/): Missing authorization in Chrome (medium 4.3)
- [CVE-2026-106216](https://insights.sbomify.com/CVE-2026-106216/): Cross-site request forgery in Chrome (medium 5.4)
- [CVE-2026-106215](https://insights.sbomify.com/CVE-2026-106215/): Information disclosure in Chrome (medium 4.7)
- [CVE-2026-106214](https://insights.sbomify.com/CVE-2026-106214/): Information disclosure in Chrome (medium 5.3)
- [CVE-2026-106213](https://insights.sbomify.com/CVE-2026-106213/): Race condition in Chrome (medium 4.3)
- [CVE-2026-106212](https://insights.sbomify.com/CVE-2026-106212/): Missing authorization in Chrome (high 8.8)
- [CVE-2026-106211](https://insights.sbomify.com/CVE-2026-106211/): Use after free in Chrome (critical 9.6)
- [CVE-2026-106210](https://insights.sbomify.com/CVE-2026-106210/): Information disclosure in Chrome (low 3.1)
- [CVE-2026-10621](https://insights.sbomify.com/CVE-2026-10621/): CVE-2026-10621 (high 7.5)
- [CVE-2026-106209](https://insights.sbomify.com/CVE-2026-106209/): Other in Chrome (medium 5.4)
- [CVE-2026-106208](https://insights.sbomify.com/CVE-2026-106208/): Missing authorization in Chrome (medium 6.5)
- [CVE-2026-106207](https://insights.sbomify.com/CVE-2026-106207/): Race condition in Chrome (high 8.8)
- [CVE-2026-106206](https://insights.sbomify.com/CVE-2026-106206/): Information disclosure in Chrome (medium 5.9)
- [CVE-2026-106205](https://insights.sbomify.com/CVE-2026-106205/): Missing authorization in Chrome (high 8.1)
- [CVE-2026-106204](https://insights.sbomify.com/CVE-2026-106204/): Use after free in Chrome (high 8.8)
- [CVE-2026-106203](https://insights.sbomify.com/CVE-2026-106203/): Information disclosure in Chrome (high 8.8)
- [CVE-2026-106202](https://insights.sbomify.com/CVE-2026-106202/): Information disclosure in Chrome (medium 4.7)
- [CVE-2026-106201](https://insights.sbomify.com/CVE-2026-106201/): Race condition in Chrome (high 8.8)
- [CVE-2026-106200](https://insights.sbomify.com/CVE-2026-106200/): Use after free in Chrome (high 8.8)
- [CVE-2026-10620](https://insights.sbomify.com/CVE-2026-10620/): code-projects Student Admission System index.php sql injection (medium 6.9)
- [CVE-2026-1062](https://insights.sbomify.com/CVE-2026-1062/): xiweicheng TMS HtmlUtil.java summary server-side request forgery (medium 5.3)
- [CVE-2026-106199](https://insights.sbomify.com/CVE-2026-106199/): Security feature bypass in Chrome (high 8.2)
- [CVE-2026-106198](https://insights.sbomify.com/CVE-2026-106198/): Missing authorization in Chrome (high 8.2)
- [CVE-2026-106197](https://insights.sbomify.com/CVE-2026-106197/): Use after free in Chrome (critical 9.6)
- [CVE-2026-106196](https://insights.sbomify.com/CVE-2026-106196/): Missing authorization in Chrome (high 7.6)
- [CVE-2026-106195](https://insights.sbomify.com/CVE-2026-106195/): Security feature bypass in Chrome (critical 9.1)
- [CVE-2026-106194](https://insights.sbomify.com/CVE-2026-106194/): Missing authorization in Chrome (high 8.3)
- [CVE-2026-106193](https://insights.sbomify.com/CVE-2026-106193/): Use after free in Chrome (high 8.8)
- [CVE-2026-106192](https://insights.sbomify.com/CVE-2026-106192/): Information disclosure in Chrome (medium 4.6)
- [CVE-2026-106191](https://insights.sbomify.com/CVE-2026-106191/): Missing authorization in Chrome (high 8.3)
- [CVE-2026-106190](https://insights.sbomify.com/CVE-2026-106190/): Use after free in Chrome (high 8.8)
- [CVE-2026-10619](https://insights.sbomify.com/CVE-2026-10619/): sayan365 student-management-system improper authentication (medium 6.9)
- [CVE-2026-106189](https://insights.sbomify.com/CVE-2026-106189/): Code injection in Chrome (high 7.3)
- [CVE-2026-106188](https://insights.sbomify.com/CVE-2026-106188/): Security feature bypass in Chrome (medium 6.1)
- [CVE-2026-106187](https://insights.sbomify.com/CVE-2026-106187/): Missing authorization in Chrome (medium 4.2)
- [CVE-2026-106186](https://insights.sbomify.com/CVE-2026-106186/): Other in Chrome (high 8.6)
- [CVE-2026-106185](https://insights.sbomify.com/CVE-2026-106185/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-106184](https://insights.sbomify.com/CVE-2026-106184/): Information disclosure in Chrome (medium 4.3)
- [CVE-2026-106183](https://insights.sbomify.com/CVE-2026-106183/): Missing authorization in Chrome (medium 5.9)
- [CVE-2026-106182](https://insights.sbomify.com/CVE-2026-106182/): Other in Chrome (medium 5.4)
- [CVE-2026-106181](https://insights.sbomify.com/CVE-2026-106181/): Information disclosure in Chrome (medium 5.3)
- [CVE-2026-106180](https://insights.sbomify.com/CVE-2026-106180/): Information disclosure in Chrome (low 3.1)
- [CVE-2026-10618](https://insights.sbomify.com/CVE-2026-10618/): Hugo 0.93.0 through 0.165.0 Stored Cross-Site Scripting via Unescaped Code-Fence Attribute Values (medium 4.8)
- [CVE-2026-106179](https://insights.sbomify.com/CVE-2026-106179/): Other in Chrome (medium 5.4)
- [CVE-2026-106177](https://insights.sbomify.com/CVE-2026-106177/): HP Sure Click Kernel Buffer Overflow (medium 6.4)
- [CVE-2026-106176](https://insights.sbomify.com/CVE-2026-106176/): Missing authorization in FortiSIEM (low 3.4)
- [CVE-2026-106175](https://insights.sbomify.com/CVE-2026-106175/): Memory corruption in FortiOS (low 2.1)
- [CVE-2026-106174](https://insights.sbomify.com/CVE-2026-106174/): Denial of service in FortiOS (medium 6.7)
- [CVE-2026-106173](https://insights.sbomify.com/CVE-2026-106173/): Path traversal in FortiSIEM (critical 9.4)
- [CVE-2026-106172](https://insights.sbomify.com/CVE-2026-106172/): Hardcoded credentials in FortiSandbox (medium 4.9)
- [CVE-2026-106171](https://insights.sbomify.com/CVE-2026-106171/): Command injection in FortiManager (medium 5.3)
- [CVE-2026-106170](https://insights.sbomify.com/CVE-2026-106170/): Denial of service in FortiSandbox (medium 4.8)
- [CVE-2026-10617](https://insights.sbomify.com/CVE-2026-10617/): nextlevelbuilder GoClaw Webhook Verification auth.go resolveAuth missing authentication (medium 6.9)
- [CVE-2026-106166](https://insights.sbomify.com/CVE-2026-106166/): NEX-Forms 9.2.1 - 9.2.5 - Unauthenticated Arbitrary Form Entry Modification via 'nf_set_entry_update_id' Parameter (medium 5.3)
- [CVE-2026-106164](https://insights.sbomify.com/CVE-2026-106164/): Infinite Loop in Telerik Document Processing XLS Import (high 7.3)
- [CVE-2026-106163](https://insights.sbomify.com/CVE-2026-106163/): Cross-site Scripting (XSS) in Kendo UI for jQuery FileBrowser and ImageBrowser (medium 6.5)
- [CVE-2026-106162](https://insights.sbomify.com/CVE-2026-106162/): Cross-Site Scripting in FileManager Drag Hints in Kendo UI for jQuery (medium 4.7)
- [CVE-2026-106161](https://insights.sbomify.com/CVE-2026-106161/): Cross-Site Scripting via Badge Text Binding in Kendo UI for jQuery (medium 5.4)
- [CVE-2026-106160](https://insights.sbomify.com/CVE-2026-106160/): Prototype Pollution via Model.accept and kendo.setter in Kendo UI for jQuery (medium 5.4)
- [CVE-2026-10616](https://insights.sbomify.com/CVE-2026-10616/): nextlevelbuilder GoClaw Team Task Completion team_tasks_lifecycle.go TeamTasksTool.executeComplete authorization (medium 5.3)
- [CVE-2026-106159](https://insights.sbomify.com/CVE-2026-106159/): Cross-Site Scripting via ToolBar ButtonGroup URLs in Kendo UI for jQuery (medium 4.7)
- [CVE-2026-106158](https://insights.sbomify.com/CVE-2026-106158/): Cross-Site Scripting via Scheduler Resource Colors in Kendo UI for jQuery (medium 4.7)
- [CVE-2026-106157](https://insights.sbomify.com/CVE-2026-106157/): Cross-Site Scripting via PanelBar Item URLs in Kendo UI for jQuery (medium 4.7)
- [CVE-2026-106155](https://insights.sbomify.com/CVE-2026-106155/): Stored Cross-site Scripting (XSS) in Telerik Report Server Web Report Viewers (high 8.9)
- [CVE-2026-106153](https://insights.sbomify.com/CVE-2026-106153/): Cross-site Scripting (XSS) in Kendo UI for jQuery Calendar and MultiViewCalendar (medium 5.4)
- [CVE-2026-106151](https://insights.sbomify.com/CVE-2026-106151/): Cross-Site Scripting in Validator Validation Messages in Kendo UI for jQuery (medium 5.4)
- [CVE-2026-106150](https://insights.sbomify.com/CVE-2026-106150/): Cross-site Scripting (XSS) in Kendo UI for jQuery Splitter, Window, and Tooltip (medium 5.4)
- [CVE-2026-106149](https://insights.sbomify.com/CVE-2026-106149/): Cross-site Scripting (XSS) in Kendo UI for jQuery Menu (medium 5.4)
- [CVE-2026-106148](https://insights.sbomify.com/CVE-2026-106148/): Cross-Site Scripting via TabStrip, Menu, and PanelBar Image URLs in Kendo UI for jQuery (medium 5.4)
- [CVE-2026-106147](https://insights.sbomify.com/CVE-2026-106147/): Cross-Site Scripting via ListBox Bound Text in Kendo UI for jQuery (medium 5.4)
- [CVE-2026-106145](https://insights.sbomify.com/CVE-2026-106145/): Privilege Escalation in Telerik Report Server Service-Agent Hub (high 7.1)
- [CVE-2026-106139](https://insights.sbomify.com/CVE-2026-106139/): Cross-Site Scripting via Chart Tooltip in Kendo UI for Vue (medium 5.4)
- [CVE-2026-106138](https://insights.sbomify.com/CVE-2026-106138/): Cross-Site Scripting via Chart Tooltip in KendoReact (medium 5.4)
- [CVE-2026-106126](https://insights.sbomify.com/CVE-2026-106126/): Command Injection (critical 9.4)
- [CVE-2026-106123](https://insights.sbomify.com/CVE-2026-106123/): RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load() (medium 5.7)
- [CVE-2026-106122](https://insights.sbomify.com/CVE-2026-106122/): RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers (medium 6.0)
- [CVE-2026-106121](https://insights.sbomify.com/CVE-2026-106121/): RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS (medium 4.9)
- [CVE-2026-106120](https://insights.sbomify.com/CVE-2026-106120/): LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, `.first`/`.last`, negative index, and for-loop iteration (medium 6.0)
- [CVE-2026-106119](https://insights.sbomify.com/CVE-2026-106119/): LangChain: MongoDBChatMessageHistory query injection can allow cross-session access (medium 6.0)
- [CVE-2026-106118](https://insights.sbomify.com/CVE-2026-106118/): ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB write (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/964/