# Vulnerabilities published in 2026


- [CVE-2026-100294](https://insights.sbomify.com/CVE-2026-100294/): Use of Hard-coded Credentials in Anjvision YSSD-RTMP-H5 (high 8.7)
- [CVE-2026-100293](https://insights.sbomify.com/CVE-2026-100293/): Improper verification of cryptographic signature in Anjvision YSSD-RTMP-H5 (high 8.7)
- [CVE-2026-100292](https://insights.sbomify.com/CVE-2026-100292/): Improper neutralization of special elements used in an OS command ('OS command injection') in Anjvision YSSD-RTMP-H5 (high 8.7)
- [CVE-2026-100291](https://insights.sbomify.com/CVE-2026-100291/): Initialization of a resource with an insecure default in Anjvision YSSD-RTMP-H5 (critical 9.3)
- [CVE-2026-10029](https://insights.sbomify.com/CVE-2026-10029/): Missing authorization in Event Koi Lite – Events Calendar, Event Management, RSVP, and Tickets (medium 5.3)
- [CVE-2026-100289](https://insights.sbomify.com/CVE-2026-100289/): Missing authorization in Server (medium 5.0)
- [CVE-2026-100288](https://insights.sbomify.com/CVE-2026-100288/): Information disclosure in Server (high 7.2)
- [CVE-2026-100287](https://insights.sbomify.com/CVE-2026-100287/): Missing authorization in Server (medium 5.4)
- [CVE-2026-100286](https://insights.sbomify.com/CVE-2026-100286/): Missing authorization in Server (medium 6.5)
- [CVE-2026-100280](https://insights.sbomify.com/CVE-2026-100280/): Missing authorization in YouTrack (low 3.1)
- [CVE-2026-10028](https://insights.sbomify.com/CVE-2026-10028/): Denial of service in Red Hat Enterprise Linux 10 (medium 4.3)
- [CVE-2026-100279](https://insights.sbomify.com/CVE-2026-100279/): Information disclosure in YouTrack (medium 6.5)
- [CVE-2026-100278](https://insights.sbomify.com/CVE-2026-100278/): Missing authorization in YouTrack (medium 4.9)
- [CVE-2026-100277](https://insights.sbomify.com/CVE-2026-100277/): Auth bypass in YouTrack (high 8.9)
- [CVE-2026-100276](https://insights.sbomify.com/CVE-2026-100276/): Missing authorization in YouTrack (medium 5.9)
- [CVE-2026-100275](https://insights.sbomify.com/CVE-2026-100275/): Cross-site scripting in YouTrack (medium 6.9)
- [CVE-2026-100274](https://insights.sbomify.com/CVE-2026-100274/): Denial of service in YouTrack (medium 6.5)
- [CVE-2026-100273](https://insights.sbomify.com/CVE-2026-100273/): Missing authorization in YouTrack (high 8.2)
- [CVE-2026-100272](https://insights.sbomify.com/CVE-2026-100272/): Missing authorization in YouTrack (medium 4.9)
- [CVE-2026-100271](https://insights.sbomify.com/CVE-2026-100271/): Missing authorization in YouTrack (low 2.7)
- [CVE-2026-100270](https://insights.sbomify.com/CVE-2026-100270/): Missing authorization in YouTrack (low 3.3)
- [CVE-2026-10027](https://insights.sbomify.com/CVE-2026-10027/): IBM MQ queue manager is vulnerable to unauthenticated remote code execution (high 8.1)
- [CVE-2026-100269](https://insights.sbomify.com/CVE-2026-100269/): Missing authorization in YouTrack (medium 4.3)
- [CVE-2026-100268](https://insights.sbomify.com/CVE-2026-100268/): Missing authorization in YouTrack (high 7.7)
- [CVE-2026-100267](https://insights.sbomify.com/CVE-2026-100267/): Denial of service in YouTrack (medium 5.9)
- [CVE-2026-100266](https://insights.sbomify.com/CVE-2026-100266/): Missing authorization in Hub (high 7.7)
- [CVE-2026-100265](https://insights.sbomify.com/CVE-2026-100265/): Supply chain in Rider (medium 4.8)
- [CVE-2026-100264](https://insights.sbomify.com/CVE-2026-100264/): Information disclosure in YouTrack (low 2.7)
- [CVE-2026-100263](https://insights.sbomify.com/CVE-2026-100263/): Cross-site scripting in YouTrack (medium 4.7)
- [CVE-2026-100262](https://insights.sbomify.com/CVE-2026-100262/): Missing authorization in YouTrack (high 7.6)
- [CVE-2026-100261](https://insights.sbomify.com/CVE-2026-100261/): Missing authorization in YouTrack (medium 5.4)
- [CVE-2026-100260](https://insights.sbomify.com/CVE-2026-100260/): Auth bypass in YouTrack (medium 5.3)
- [CVE-2026-10026](https://insights.sbomify.com/CVE-2026-10026/): CTX Feed Pro <= 7.6.12 - Authenticated (Administrator+) Remote Code Execution (high 7.2)
- [CVE-2026-100259](https://insights.sbomify.com/CVE-2026-100259/): Missing authorization in YouTrack (medium 4.3)
- [CVE-2026-100258](https://insights.sbomify.com/CVE-2026-100258/): Missing authorization in YouTrack (medium 4.3)
- [CVE-2026-100257](https://insights.sbomify.com/CVE-2026-100257/): Server-side request forgery in YouTrack (medium 4.3)
- [CVE-2026-100256](https://insights.sbomify.com/CVE-2026-100256/): Code injection in IntelliJ IDEA (high 7.8)
- [CVE-2026-100255](https://insights.sbomify.com/CVE-2026-100255/): Auth bypass in TeamCity (high 8.1)
- [CVE-2026-100254](https://insights.sbomify.com/CVE-2026-100254/): Command injection in TeamCity (high 8.8)
- [CVE-2026-100253](https://insights.sbomify.com/CVE-2026-100253/): Code injection in TeamCity (high 8.8)
- [CVE-2026-100251](https://insights.sbomify.com/CVE-2026-100251/): Wormhole.app SSRF (medium 6.9)
- [CVE-2026-10025](https://insights.sbomify.com/CVE-2026-10025/): IBM QRadar SIEM has an XML External Entity (XXE) injection vulnerability (high 8.2)
- [CVE-2026-100248](https://insights.sbomify.com/CVE-2026-100248/): Business logic in Cosmowarp Contract (high 8.4)
- [CVE-2026-100245](https://insights.sbomify.com/CVE-2026-100245/): Stored XSS on Wikibase Special:SetSiteLink via unescaped system message (medium 6.1)
- [CVE-2026-100244](https://insights.sbomify.com/CVE-2026-100244/): Information disclosure in Mediawiki - CentralAuth Extension (high 7.5)
- [CVE-2026-100243](https://insights.sbomify.com/CVE-2026-100243/): Stored XSS in WikiSEO author and image properties on action=info (medium 6.1)
- [CVE-2026-100242](https://insights.sbomify.com/CVE-2026-100242/): DataTransfer depends on phpspreadsheet version vulnerable to CVE-2026-59933 (XLS/OLE memory exhaustion) (high 7.5)
- [CVE-2026-100241](https://insights.sbomify.com/CVE-2026-100241/): Private change tags exposed to anonymous users via revision-tags-change events (high 7.5)
- [CVE-2026-100240](https://insights.sbomify.com/CVE-2026-100240/): TemplateSandbox does not check read permissions for the page being previewed (critical 9.1)
- [CVE-2026-10024](https://insights.sbomify.com/CVE-2026-10024/): Cross-site scripting in TinyMCE shortcode Addon (medium 6.4)
- [CVE-2026-100238](https://insights.sbomify.com/CVE-2026-100238/): Flow colon-separator and flow-guidedtour-optin-welcome-description messages allow stored XSS (medium 6.1)
- [CVE-2026-100237](https://insights.sbomify.com/CVE-2026-100237/): Stored i18n XSS in the Flow integration of Thanks (medium 6.1)
- [CVE-2026-100236](https://insights.sbomify.com/CVE-2026-100236/): Dpdk: dpdk: heap out-of-bounds read/write in gso header copy (high 8.6)
- [CVE-2026-100232](https://insights.sbomify.com/CVE-2026-100232/): Command injection in Network Security Manager (NSM) (high 7.2)
- [CVE-2026-100231](https://insights.sbomify.com/CVE-2026-100231/): Memory corruption in Red Hat Enterprise Linux 10 (medium 6.1)
- [CVE-2026-100230](https://insights.sbomify.com/CVE-2026-100230/): Path traversal in Input Leap (medium 5.3)
- [CVE-2026-10023](https://insights.sbomify.com/CVE-2026-10023/): Missing authorization in Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy (medium 4.3)
- [CVE-2026-100229](https://insights.sbomify.com/CVE-2026-100229/): Memory corruption in Red Hat Enterprise Linux 10 (medium 6.5)
- [CVE-2026-100227](https://insights.sbomify.com/CVE-2026-100227/): Apache CXF: XML Signature wrapping in JAX-RS XML Security (high 7.5)
- [CVE-2026-100225](https://insights.sbomify.com/CVE-2026-100225/): Windows Storage Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-100222](https://insights.sbomify.com/CVE-2026-100222/): Network Policy Server (NPS) Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-100220](https://insights.sbomify.com/CVE-2026-100220/): Windows Media Video Decoder Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-10022](https://insights.sbomify.com/CVE-2026-10022/): Memory corruption in Chrome (high 7.5)
- [CVE-2026-100219](https://insights.sbomify.com/CVE-2026-100219/): Microsoft QUIC Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-100218](https://insights.sbomify.com/CVE-2026-100218/): Remote Desktop Gateway Service Remote Code Execution Vulnerability (high 8.1)
- [CVE-2026-100217](https://insights.sbomify.com/CVE-2026-100217/): Windows Group Policy Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-100216](https://insights.sbomify.com/CVE-2026-100216/): Windows Storage Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-100215](https://insights.sbomify.com/CVE-2026-100215/): Microsoft Graphics Component Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-100214](https://insights.sbomify.com/CVE-2026-100214/): Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-100212](https://insights.sbomify.com/CVE-2026-100212/): Microsoft Office Excel Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-100211](https://insights.sbomify.com/CVE-2026-100211/): Microsoft Office Excel Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-100210](https://insights.sbomify.com/CVE-2026-100210/): Microsoft Office Excel Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-10021](https://insights.sbomify.com/CVE-2026-10021/): Other in Chrome (high 8.8)
- [CVE-2026-100209](https://insights.sbomify.com/CVE-2026-100209/): Microsoft Office Excel Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-100208](https://insights.sbomify.com/CVE-2026-100208/): Microsoft Office Outlook Remote Code Execution Vulnerability (high 7.5)
- [CVE-2026-100207](https://insights.sbomify.com/CVE-2026-100207/): Azure CycleCloud Remote Code Execution Vulnerability (high 7.3)
- [CVE-2026-100205](https://insights.sbomify.com/CVE-2026-100205/): SysInternals Elevation of Privilege Vulnerability (high 7.1)
- [CVE-2026-100203](https://insights.sbomify.com/CVE-2026-100203/): Windows Update Service Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-100202](https://insights.sbomify.com/CVE-2026-100202/): Windows Message Queuing Queue Manager Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-100201](https://insights.sbomify.com/CVE-2026-100201/): Windows Client License Service Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-100200](https://insights.sbomify.com/CVE-2026-100200/): Windows Update Service Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-10020](https://insights.sbomify.com/CVE-2026-10020/): Security feature bypass in Chrome (high 8.3)
- [CVE-2026-1002](https://insights.sbomify.com/CVE-2026-1002/): Eclipse Vert.x Web static handler file access denial (medium 6.9)
- [CVE-2026-100196](https://insights.sbomify.com/CVE-2026-100196/): LazyLoad Plugin <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content (high 7.2)
- [CVE-2026-100193](https://insights.sbomify.com/CVE-2026-100193/): Tutor LMS <= 4.1.0 - Reflected Cross-Site Scripting via 'tab' Parameter (medium 4.7)
- [CVE-2026-100192](https://insights.sbomify.com/CVE-2026-100192/): X-SpringBoot through 6.0 Credential Exposure via Unauthenticated Endpoint (medium 6.9)
- [CVE-2026-100190](https://insights.sbomify.com/CVE-2026-100190/): Stored Cross-Site Scripting (XSS) via Crawler Capture Import in AIL Framework showDomain Page (medium 6.3)
- [CVE-2026-10019](https://insights.sbomify.com/CVE-2026-10019/): Integer overflow in Chrome (medium 4.3)
- [CVE-2026-100187](https://insights.sbomify.com/CVE-2026-100187/): AIL Framework Onion Module: Non-Onion URL Accepted as Crawler Task Due to Bypassed Domain Validation (medium 6.9)
- [CVE-2026-100186](https://insights.sbomify.com/CVE-2026-100186/): User Profile Builder <= 4.0.3 - Unauthenticated Stored Cross-Site Scripting via First Name Field (high 7.2)
- [CVE-2026-100185](https://insights.sbomify.com/CVE-2026-100185/): Cross-site scripting in Directorist: AI-Powered Business Directory, Listings & Classified Ads (medium 6.4)
- [CVE-2026-100184](https://insights.sbomify.com/CVE-2026-100184/): Cross-site scripting in Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More (medium 4.7)
- [CVE-2026-100182](https://insights.sbomify.com/CVE-2026-100182/): Download Monitor <= 5.2.10 - Unauthenticated Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor (high 7.2)
- [CVE-2026-100180](https://insights.sbomify.com/CVE-2026-100180/): Jeg Kit for Elementor <= 3.2.19 - Unauthenticated Stored Cross-Site Scripting via Comment (medium 5.4)
- [CVE-2026-10018](https://insights.sbomify.com/CVE-2026-10018/): Integer overflow in Chrome (medium 6.5)
- [CVE-2026-100179](https://insights.sbomify.com/CVE-2026-100179/): Calculated Fields Form <= 5.5.1.3 - Reflected DOM-Based Cross-Site Scripting via 'x' URL Parameter via setChoices() (medium 6.1)
- [CVE-2026-100178](https://insights.sbomify.com/CVE-2026-100178/): WPAdverts <= 2.3.4 - Unauthenticated Stored Cross-Site Scripting via 'adverts_location' Parameter (high 7.2)
- [CVE-2026-100177](https://insights.sbomify.com/CVE-2026-100177/): Ail Framework Crawler: Missing Cookiejar Authorization Check Allows Cross-Organization Cookiejar Attachment (medium 6.3)
- [CVE-2026-100176](https://insights.sbomify.com/CVE-2026-100176/): Stored Cross-Site Scripting (XSS) in AIL Framework Username Timeline Tooltip (high 8.5)
- [CVE-2026-100175](https://insights.sbomify.com/CVE-2026-100175/): Postie <= 1.9.87 - Unauthenticated Stored Cross-Site Scripting via Email Body URL Autolink (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/1004/