# Vulnerabilities published in 2026


- [CVE-2026-97686](https://insights.sbomify.com/CVE-2026-97686/): VxWorks 7 Memory Resource leak (medium 5.5)
- [CVE-2026-97685](https://insights.sbomify.com/CVE-2026-97685/): LimeSurvey Community Edition 7.3.0 - Cross-survey object authorization bypass in REST survey patch operations (high 7.1)
- [CVE-2026-97680](https://insights.sbomify.com/CVE-2026-97680/): Langflow OSS is affected by multiple vulnerabilities (high 8.3)
- [CVE-2026-97679](https://insights.sbomify.com/CVE-2026-97679/): Langflow OSS is affected by multiple vulnerabilities (high 8.8)
- [CVE-2026-97678](https://insights.sbomify.com/CVE-2026-97678/): Langflow OSS is affected by multiple vulnerabilities (high 8.8)
- [CVE-2026-97676](https://insights.sbomify.com/CVE-2026-97676/): Langflow OSS is affected by multiple vulnerabilities (high 8.8)
- [CVE-2026-97674](https://insights.sbomify.com/CVE-2026-97674/): Langflow OSS is affected by multiple vulnerabilities (high 8.1)
- [CVE-2026-97673](https://insights.sbomify.com/CVE-2026-97673/): Langflow OSS is affected by multiple vulnerabilities (high 8.8)
- [CVE-2026-97671](https://insights.sbomify.com/CVE-2026-97671/): Langflow OSS is affected by multiple vulnerabilities (medium 6.5)
- [CVE-2026-97670](https://insights.sbomify.com/CVE-2026-97670/): Missing authorization in Avada (Fusion) Builder (critical 9.1)
- [CVE-2026-9767](https://insights.sbomify.com/CVE-2026-9767/): The School Management <= 5.4 - Authenticated (Custom+) SQL Injection via 'order[0][dir]' Parameter (medium 6.5)
- [CVE-2026-97668](https://insights.sbomify.com/CVE-2026-97668/): Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated SQL Injection via Guest Persistent Cart meta_value (critical 9.8)
- [CVE-2026-97667](https://insights.sbomify.com/CVE-2026-97667/): Nexus Repository 3 - Stored Cross-Site Scripting in Browse UI (medium 5.1)
- [CVE-2026-97666](https://insights.sbomify.com/CVE-2026-97666/): Nexus Repository 3 - Unsafe Reflection in ExtDirect Repository Endpoint (medium 6.9)
- [CVE-2026-97665](https://insights.sbomify.com/CVE-2026-97665/): Nexus Repository 3 - Missing Authorization on NuGet Symbol Package Upload (high 7.1)
- [CVE-2026-97663](https://insights.sbomify.com/CVE-2026-97663/): Customer Reviews for WooCommerce <= 5.122.0 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name (high 7.2)
- [CVE-2026-97662](https://insights.sbomify.com/CVE-2026-97662/): Command injection in security-agent-mcp-server (medium 6.9)
- [CVE-2026-97661](https://insights.sbomify.com/CVE-2026-97661/): Business Essentials for Contact Form 7 <= 1.2.1 - Unauthenticated Stored Cross-Site Scripting via 'gateway' Form Field (high 7.2)
- [CVE-2026-97660](https://insights.sbomify.com/CVE-2026-97660/): Cross-site scripting in WPC Product Options for WooCommerce (high 7.2)
- [CVE-2026-9766](https://insights.sbomify.com/CVE-2026-9766/): Missing authorization in Empik for Woocommerce (medium 4.3)
- [CVE-2026-97657](https://insights.sbomify.com/CVE-2026-97657/): Auth bypass in Abandoned Cart Pro for WooCommerce (critical 9.8)
- [CVE-2026-97655](https://insights.sbomify.com/CVE-2026-97655/): Langflow OSS is affected by multiple vulnerabilities (high 8.8)
- [CVE-2026-97652](https://insights.sbomify.com/CVE-2026-97652/): WP Statistics <= 14.16.14 - Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter Key (medium 6.1)
- [CVE-2026-97650](https://insights.sbomify.com/CVE-2026-97650/): ningzichun student-management-system addLog.php echo cross site scripting (medium 5.3)
- [CVE-2026-9765](https://insights.sbomify.com/CVE-2026-9765/): CVE-2026-9765 CVE Record (high 7.1)
- [CVE-2026-97649](https://insights.sbomify.com/CVE-2026-97649/): ningzichun student-management-system example_lite.sql default credentials (medium 5.1)
- [CVE-2026-97648](https://insights.sbomify.com/CVE-2026-97648/): ningzichun student-management-system cross-site request forgery (medium 5.3)
- [CVE-2026-97647](https://insights.sbomify.com/CVE-2026-97647/): ningzichun student-management-system editLog.php authorization (medium 6.9)
- [CVE-2026-97646](https://insights.sbomify.com/CVE-2026-97646/): ningzichun student-management-system getStudent.php authorization (medium 6.9)
- [CVE-2026-97644](https://insights.sbomify.com/CVE-2026-97644/): Privilege escalation in Groundhogg — CRM, Newsletters, and Marketing Automation (high 8.8)
- [CVE-2026-97643](https://insights.sbomify.com/CVE-2026-97643/): Cross-site scripting in GiveWP – Donation Plugin and Fundraising Platform (medium 6.4)
- [CVE-2026-97641](https://insights.sbomify.com/CVE-2026-97641/): Relevanssi <= 4.28.3 - Unauthenticated Stored Cross-Site Scripting via Comment Content (high 7.2)
- [CVE-2026-97640](https://insights.sbomify.com/CVE-2026-97640/): Cross-site scripting in WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) (high 7.2)
- [CVE-2026-97637](https://insights.sbomify.com/CVE-2026-97637/): JSON API Auth <= 3.1.2 - Unauthenticated Authentication Bypass via Cached 'generate_auth_cookie' Response (critical 9.8)
- [CVE-2026-97636](https://insights.sbomify.com/CVE-2026-97636/): Apache Airflow HashiCorp provider: HashiCorp Vault secrets backend: team-scope guard bypass via user-controlled key (medium 6.5)
- [CVE-2026-97635](https://insights.sbomify.com/CVE-2026-97635/): Agent Zero Web UI XSS (high 8.6)
- [CVE-2026-97634](https://insights.sbomify.com/CVE-2026-97634/): Event Tickets and Registration <= 5.29.5 - Authenticated (Contributor+) SQL Injection via 'orderby' Parameter (medium 6.5)
- [CVE-2026-97631](https://insights.sbomify.com/CVE-2026-97631/): Pre-boot RCE in EDK II PXE driver (critical 9.5)
- [CVE-2026-97630](https://insights.sbomify.com/CVE-2026-97630/): Cross-site scripting in FV Flowplayer Video Player (medium 6.4)
- [CVE-2026-97629](https://insights.sbomify.com/CVE-2026-97629/): NGINX ngx_http_ssl_module vulnerability (high 8.3)
- [CVE-2026-97627](https://insights.sbomify.com/CVE-2026-97627/): Command injection in ADX1004 (high 8.6)
- [CVE-2026-97626](https://insights.sbomify.com/CVE-2026-97626/): Gitea profile feed disclosure bypassing user visibility (medium 4.3)
- [CVE-2026-97621](https://insights.sbomify.com/CVE-2026-97621/): drm/rockchip: analogix_dp: fix unchecked bound endpoint name length (not scored)
- [CVE-2026-97620](https://insights.sbomify.com/CVE-2026-97620/): drm/xe: Flush LSC untyped L1 dataport cache after rcs/ccs batches (not scored)
- [CVE-2026-9762](https://insights.sbomify.com/CVE-2026-9762/): IBM® Data Server driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc url is under user control (high 7.8)
- [CVE-2026-97619](https://insights.sbomify.com/CVE-2026-97619/): io_uring/rw: end write accounting from ->ki_complete (not scored)
- [CVE-2026-97618](https://insights.sbomify.com/CVE-2026-97618/): io_uring/net: don't overconsume buffers when using MSG_TRUNC (not scored)
- [CVE-2026-97617](https://insights.sbomify.com/CVE-2026-97617/): ring-buffer: Check resize_disabled before publishing the new subbuf order (not scored)
- [CVE-2026-97616](https://insights.sbomify.com/CVE-2026-97616/): net/sched: act_api: release all action references on NEWACTION failure (not scored)
- [CVE-2026-97615](https://insights.sbomify.com/CVE-2026-97615/): net: bridge: use option bits for CFM/MRP frame handlers (not scored)
- [CVE-2026-97614](https://insights.sbomify.com/CVE-2026-97614/): net: dsa: tag_brcm: legacy FCS: request needed tailroom (not scored)
- [CVE-2026-97613](https://insights.sbomify.com/CVE-2026-97613/): net: mana: Reserve extra CQ slot for the fence completion CQE (not scored)
- [CVE-2026-97612](https://insights.sbomify.com/CVE-2026-97612/): net: mpls: clear inner_protocol when the last label is popped (high 7.8)
- [CVE-2026-97611](https://insights.sbomify.com/CVE-2026-97611/): net: openvswitch: fix use-after-free of the flow table mask array (high 7.8)
- [CVE-2026-97610](https://insights.sbomify.com/CVE-2026-97610/): netfs: Fix uninitialized return value in netfs_unbuffered_write() (not scored)
- [CVE-2026-97609](https://insights.sbomify.com/CVE-2026-97609/): netfilter: cttimeout: prevent UAF during module unload (high 7.0)
- [CVE-2026-97608](https://insights.sbomify.com/CVE-2026-97608/): netfilter: nf_log: unregister loggers before per-net teardown (high 7.0)
- [CVE-2026-97607](https://insights.sbomify.com/CVE-2026-97607/): vdpa: ifcvf: Put device on unsupported feature error (not scored)
- [CVE-2026-97606](https://insights.sbomify.com/CVE-2026-97606/): fs: autofs: fix memory leak in autofs_fill_super() (not scored)
- [CVE-2026-97605](https://insights.sbomify.com/CVE-2026-97605/): erofs: preserve LZMA decoders on resize failure (not scored)
- [CVE-2026-97604](https://insights.sbomify.com/CVE-2026-97604/): fbdev: vfb: defer cleanup until the last reference (not scored)
- [CVE-2026-97603](https://insights.sbomify.com/CVE-2026-97603/): idpf: disable DIM work before freeing q_vectors (not scored)
- [CVE-2026-97602](https://insights.sbomify.com/CVE-2026-97602/): inet: frags: invalidate queues before flushing them (high 7.8)
- [CVE-2026-97601](https://insights.sbomify.com/CVE-2026-97601/): ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink (not scored)
- [CVE-2026-97600](https://insights.sbomify.com/CVE-2026-97600/): ieee802154: cc2520: fix FIFOP work use-after-free (not scored)
- [CVE-2026-97599](https://insights.sbomify.com/CVE-2026-97599/): ieee802154: hwsim: serialize pib updates to fix double-free (not scored)
- [CVE-2026-97598](https://insights.sbomify.com/CVE-2026-97598/): ipv4: fib: bound automatic table ID allocation (not scored)
- [CVE-2026-97597](https://insights.sbomify.com/CVE-2026-97597/): ipv6: flowlabel: cap duplicate leases per socket (not scored)
- [CVE-2026-97596](https://insights.sbomify.com/CVE-2026-97596/): ipvs: reject invalid states in connection template sync records (not scored)
- [CVE-2026-97595](https://insights.sbomify.com/CVE-2026-97595/): mac802154: fix use-after-free of sdata via queued RX frames (high 7.5)
- [CVE-2026-97594](https://insights.sbomify.com/CVE-2026-97594/): landlock: Fix use-after-free of the source's parent directory (high 7.8)
- [CVE-2026-97593](https://insights.sbomify.com/CVE-2026-97593/): iommu/s390: Fix NULL dereference in iova_to_phys() with ZPCI_TABLE_TYPE_RFX (not scored)
- [CVE-2026-97592](https://insights.sbomify.com/CVE-2026-97592/): s390/crypto: Fix missing scrub of temp buffers with AES ctr and gcm algorithm (not scored)
- [CVE-2026-97591](https://insights.sbomify.com/CVE-2026-97591/): s390/crypto: Fix handling of EBUSY in PHMAC when req is pushed to crypto engine (not scored)
- [CVE-2026-97590](https://insights.sbomify.com/CVE-2026-97590/): s390/crypto: Fix missing scrub of temp buffers with PAES algorithm (not scored)
- [CVE-2026-9759](https://insights.sbomify.com/CVE-2026-9759/): NULL Pointer Dereference in Wireshark (medium 5.5)
- [CVE-2026-97589](https://insights.sbomify.com/CVE-2026-97589/): s390/crypto: Fix wrong return code to engine in asynch callbacks (high 7.0)
- [CVE-2026-97588](https://insights.sbomify.com/CVE-2026-97588/): s390/crypto: Map EBUSY to EIO when key conversion fails repeatedly (not scored)
- [CVE-2026-97587](https://insights.sbomify.com/CVE-2026-97587/): perf: RISC-V: store available counter mask as bitmap (not scored)
- [CVE-2026-97586](https://insights.sbomify.com/CVE-2026-97586/): afs: Fix missing kunmap in afs_dir_search_bucket() (not scored)
- [CVE-2026-97585](https://insights.sbomify.com/CVE-2026-97585/): afs: Fix double-unmap of directory block (not scored)
- [CVE-2026-97584](https://insights.sbomify.com/CVE-2026-97584/): afs: Fix incorrect free in candidate cleanup in afs_lookup_server() (high 7.8)
- [CVE-2026-97583](https://insights.sbomify.com/CVE-2026-97583/): afs: Clear stale peer app data after address list changes (high 7.5)
- [CVE-2026-97582](https://insights.sbomify.com/CVE-2026-97582/): hwmon: (gpio-fan) Fix use-after-free in alarm work (not scored)
- [CVE-2026-97581](https://insights.sbomify.com/CVE-2026-97581/): media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity (not scored)
- [CVE-2026-97580](https://insights.sbomify.com/CVE-2026-97580/): media: rkvdec: bound HEVC tile loops and PPS id to the array capacity (high 7.8)
- [CVE-2026-9758](https://insights.sbomify.com/CVE-2026-9758/): Improper Certificate Validation in S2OPC (high 7.3)
- [CVE-2026-97579](https://insights.sbomify.com/CVE-2026-97579/): media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity (high 7.8)
- [CVE-2026-97578](https://insights.sbomify.com/CVE-2026-97578/): media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer (high 7.8)
- [CVE-2026-97577](https://insights.sbomify.com/CVE-2026-97577/): media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity (high 7.8)
- [CVE-2026-97576](https://insights.sbomify.com/CVE-2026-97576/): media: v4l2-ctrls: validate HEVC tile counts (high 7.8)
- [CVE-2026-97575](https://insights.sbomify.com/CVE-2026-97575/): media: v4l2-ctrls: validate AV1 tile counts (high 7.8)
- [CVE-2026-97574](https://insights.sbomify.com/CVE-2026-97574/): bnxt_en: Don't free the live ring's TPA state on queue restart failure (not scored)
- [CVE-2026-97573](https://insights.sbomify.com/CVE-2026-97573/): bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset() (high 8.1)
- [CVE-2026-97572](https://insights.sbomify.com/CVE-2026-97572/): bnxt_en: Propagate RX ring init failures in bnxt_init_nic() (not scored)
- [CVE-2026-97571](https://insights.sbomify.com/CVE-2026-97571/): bnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc() (not scored)
- [CVE-2026-97570](https://insights.sbomify.com/CVE-2026-97570/): bnxt_en: Bound SW TPA IDs to prevent crashes (high 8.1)
- [CVE-2026-9757](https://insights.sbomify.com/CVE-2026-9757/): GEO my WP <= 4.5.5 - Unauthenticated SQL Injection via 'swlatlng' / 'nelatlng' Parameters (high 7.5)
- [CVE-2026-97569](https://insights.sbomify.com/CVE-2026-97569/): bnxt_en: Prevent queue stop with deferred completions (not scored)
- [CVE-2026-97568](https://insights.sbomify.com/CVE-2026-97568/): mptcp: syncookies: remember the request backup flag (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/216/