# Vulnerabilities published in 2026


- [CVE-2026-96277](https://insights.sbomify.com/CVE-2026-96277/): Apache Thrift: Ruby `SimpleServer` ends `serve()` on any non-Transport/Protocol exception (high 8.7)
- [CVE-2026-96276](https://insights.sbomify.com/CVE-2026-96276/): Flatpak: flatpak: arbitrary write in host context via flatpak build-init (medium 6.5)
- [CVE-2026-96275](https://insights.sbomify.com/CVE-2026-96275/): Flatpak: flatpak: arbitrary write access as root via extra-data extraction (high 8.8)
- [CVE-2026-96274](https://insights.sbomify.com/CVE-2026-96274/): Uncaught exception in Baicells Nova 430H (high 8.3)
- [CVE-2026-96273](https://insights.sbomify.com/CVE-2026-96273/): Ghidra before 12.1.4 Denial of Service via Unreleased Lock in OptionsDB (medium 6.8)
- [CVE-2026-96272](https://insights.sbomify.com/CVE-2026-96272/): ClipBucket v5 before 5.5.3-#182 SQL Injection via search_result.php (high 8.7)
- [CVE-2026-96271](https://insights.sbomify.com/CVE-2026-96271/): Photoview through 2.4.0 Authorization Bypass via shareAlbum (high 7.1)
- [CVE-2026-96270](https://insights.sbomify.com/CVE-2026-96270/): Ultimate Member <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'form_id' Parameter (high 7.2)
- [CVE-2026-9627](https://insights.sbomify.com/CVE-2026-9627/): UTT HiPER 1200GW Web Management setSysAdm strcpy buffer overflow (high 8.7)
- [CVE-2026-96269](https://insights.sbomify.com/CVE-2026-96269/): Code injection in Emacs (high 7.5)
- [CVE-2026-96268](https://insights.sbomify.com/CVE-2026-96268/): Cross-site scripting in Awesome Support – WordPress HelpDesk & Support Plugin (medium 6.4)
- [CVE-2026-96267](https://insights.sbomify.com/CVE-2026-96267/): WP Visitor Statistics (Real Time Traffic) <= 8.7 - Unauthenticated SQL Injection via 'fullRef' Parameter (high 7.5)
- [CVE-2026-96266](https://insights.sbomify.com/CVE-2026-96266/): IBM Power Systems Firmware Buffer Overflow (high 8.2)
- [CVE-2026-96265](https://insights.sbomify.com/CVE-2026-96265/): IBM Power Systems Firmware Improper Memory Buffer Restriction (high 8.2)
- [CVE-2026-96264](https://insights.sbomify.com/CVE-2026-96264/): IBM Power Systems Firmware Buffer Overflow (high 8.2)
- [CVE-2026-96263](https://insights.sbomify.com/CVE-2026-96263/): IBM Power Systems Firmware Buffer Overflow (high 8.2)
- [CVE-2026-96262](https://insights.sbomify.com/CVE-2026-96262/): IBM Power Systems Firmware Buffer Overflow (high 8.2)
- [CVE-2026-96261](https://insights.sbomify.com/CVE-2026-96261/): IBM Power Systems Firmware Buffer Overflow (high 7.3)
- [CVE-2026-96260](https://insights.sbomify.com/CVE-2026-96260/): Mattermost server missing request body size limit on plugin routes allows denial of service by an authenticated user (medium 6.5)
- [CVE-2026-9626](https://insights.sbomify.com/CVE-2026-9626/): JSON API User <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'content' Parameter (medium 6.4)
- [CVE-2026-96259](https://insights.sbomify.com/CVE-2026-96259/): Mattermost server-side request forgery via OAuth endpoints configurable by a System Administrator (medium 5.5)
- [CVE-2026-96258](https://insights.sbomify.com/CVE-2026-96258/): onSite internet GmbH Auktion NG Auktionssoftware Public Password Reset Endpoint forgotpasswd.html cross site scripting (medium 5.3)
- [CVE-2026-96257](https://insights.sbomify.com/CVE-2026-96257/): Fast FAC1203R Gigabit Edition Device Discovery Service copy_msg_element stack-based overflow (critical 10.0)
- [CVE-2026-96256](https://insights.sbomify.com/CVE-2026-96256/): Gutenberg Essential Blocks <= 6.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'marker' Attribute (medium 6.4)
- [CVE-2026-96255](https://insights.sbomify.com/CVE-2026-96255/): Payments for Hubtel < 1.0.2 - Unauthenticated Payment Gateway Credentials Disclosure via Debug Log (high 7.5)
- [CVE-2026-96254](https://insights.sbomify.com/CVE-2026-96254/): Windows USB Print Driver Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-96253](https://insights.sbomify.com/CVE-2026-96253/): Windows USB Print Driver Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-96252](https://insights.sbomify.com/CVE-2026-96252/): Active Directory Federation Services (AD FS) Spoofing Vulnerability (critical 9.1)
- [CVE-2026-96251](https://insights.sbomify.com/CVE-2026-96251/): Microsoft PowerShell Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-96250](https://insights.sbomify.com/CVE-2026-96250/): Windows USB Print Driver Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-9625](https://insights.sbomify.com/CVE-2026-9625/): RSLinx Classic® - Multiple Vulnerabilities (high 8.7)
- [CVE-2026-96249](https://insights.sbomify.com/CVE-2026-96249/): Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-96248](https://insights.sbomify.com/CVE-2026-96248/): Windows Host Guardian Service Denial of Service Vulnerability (high 7.5)
- [CVE-2026-96247](https://insights.sbomify.com/CVE-2026-96247/): Windows Kernel-Mode Drivers Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-96246](https://insights.sbomify.com/CVE-2026-96246/): Network Policy Server (NPS) Information Disclosure Vulnerability (high 7.5)
- [CVE-2026-96245](https://insights.sbomify.com/CVE-2026-96245/): Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability (high 7.5)
- [CVE-2026-96244](https://insights.sbomify.com/CVE-2026-96244/): Windows Internal System User Profile Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-96243](https://insights.sbomify.com/CVE-2026-96243/): Windows WalletService Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-9624](https://insights.sbomify.com/CVE-2026-9624/): RSLinx Classic® - Multiple Vulnerabilities (high 8.7)
- [CVE-2026-96238](https://insights.sbomify.com/CVE-2026-96238/): .NET Security Feature Bypass Vulnerability (medium 6.5)
- [CVE-2026-96237](https://insights.sbomify.com/CVE-2026-96237/): .NET Remote Code Execution Vulnerability (high 7.5)
- [CVE-2026-96236](https://insights.sbomify.com/CVE-2026-96236/): ASP.NET Core Denial of Service Vulnerability (high 7.5)
- [CVE-2026-96235](https://insights.sbomify.com/CVE-2026-96235/): .NET Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-96234](https://insights.sbomify.com/CVE-2026-96234/): .NET Information Disclosure Vulnerability (medium 5.3)
- [CVE-2026-96233](https://insights.sbomify.com/CVE-2026-96233/): ASP.NET Core Denial of Service Vulnerability (high 7.5)
- [CVE-2026-96232](https://insights.sbomify.com/CVE-2026-96232/): .NET Information Disclosure Vulnerability (high 7.5)
- [CVE-2026-96231](https://insights.sbomify.com/CVE-2026-96231/): .NET Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-96230](https://insights.sbomify.com/CVE-2026-96230/): ASP.NET Core Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-96229](https://insights.sbomify.com/CVE-2026-96229/): .NET Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-96228](https://insights.sbomify.com/CVE-2026-96228/): SSL Wireless SMS Notification <= 3.8.1 - Unauthenticated Authentication Bypass to Account Takeover (high 8.1)
- [CVE-2026-96227](https://insights.sbomify.com/CVE-2026-96227/): Piotnet Forms <= 1.0.30 - Unauthenticated Stored XSS via File Upload (high 8.8)
- [CVE-2026-96225](https://insights.sbomify.com/CVE-2026-96225/): .NET Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-96224](https://insights.sbomify.com/CVE-2026-96224/): .NET Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-96223](https://insights.sbomify.com/CVE-2026-96223/): Windows Hyper-V Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-96222](https://insights.sbomify.com/CVE-2026-96222/): Active Directory Federation Services (AD FS) Spoofing Vulnerability (high 7.4)
- [CVE-2026-96220](https://insights.sbomify.com/CVE-2026-96220/): Windows Assigned Access Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-9622](https://insights.sbomify.com/CVE-2026-9622/): RSLinx Classic® - Multiple Vulnerabilities (high 8.7)
- [CVE-2026-96219](https://insights.sbomify.com/CVE-2026-96219/): Windows Local Security Authority Subsystem Service (LSASS) Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-96218](https://insights.sbomify.com/CVE-2026-96218/): Windows Update Stack Tampering Vulnerability (medium 5.5)
- [CVE-2026-96217](https://insights.sbomify.com/CVE-2026-96217/): Windows NTFS Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-96216](https://insights.sbomify.com/CVE-2026-96216/): Windows Kernel Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-96215](https://insights.sbomify.com/CVE-2026-96215/): Windows Autopilot Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-9621](https://insights.sbomify.com/CVE-2026-9621/): RSLinx Classic® - Multiple Vulnerabilities (critical 9.2)
- [CVE-2026-96209](https://insights.sbomify.com/CVE-2026-96209/): Windows Network File System Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-96207](https://insights.sbomify.com/CVE-2026-96207/): Microsoft Partner Center Elevation of Privilege Vulnerability (critical 10.0)
- [CVE-2026-96206](https://insights.sbomify.com/CVE-2026-96206/): Windows Subsystem for Linux Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-96204](https://insights.sbomify.com/CVE-2026-96204/): Azure Arc Elevation of Privilege Vulnerability (medium 6.5)
- [CVE-2026-96203](https://insights.sbomify.com/CVE-2026-96203/): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-96202](https://insights.sbomify.com/CVE-2026-96202/): Windows Raw Image Extension Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-96200](https://insights.sbomify.com/CVE-2026-96200/): Payments for Hubtel < 1.0.2 - Unauthenticated Payment Confirmation Forgery via Delayed Payment Callback (medium 5.3)
- [CVE-2026-9620](https://insights.sbomify.com/CVE-2026-9620/): WP Latest Posts <= 5.0.11 - Authenticated (Author+) Stored Cross-Site Scripting via Post Content Image src Attribute (medium 6.4)
- [CVE-2026-96199](https://insights.sbomify.com/CVE-2026-96199/): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-96198](https://insights.sbomify.com/CVE-2026-96198/): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-96196](https://insights.sbomify.com/CVE-2026-96196/): Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability (high 8.8)
- [CVE-2026-96192](https://insights.sbomify.com/CVE-2026-96192/): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-9619](https://insights.sbomify.com/CVE-2026-9619/): Missing authorization in Reviews and Rating – Docplanner (medium 4.3)
- [CVE-2026-96188](https://insights.sbomify.com/CVE-2026-96188/): Microsoft PowerToys Elevation of Privilege Vulnerability (high 7.3)
- [CVE-2026-96187](https://insights.sbomify.com/CVE-2026-96187/): Microsoft Edge (Chromium-based) Information Disclosure Vulnerability (high 7.4)
- [CVE-2026-96186](https://insights.sbomify.com/CVE-2026-96186/): Microsoft Windows Media Foundation Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-96185](https://insights.sbomify.com/CVE-2026-96185/): Microsoft Exchange Online Remote Code Execution Vulnerability (high 7.5)
- [CVE-2026-96183](https://insights.sbomify.com/CVE-2026-96183/): Windows Health and Optimized Experiences Service Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-9618](https://insights.sbomify.com/CVE-2026-9618/): PeachPay <= 1.120.46 - Cross-Site Request Forgery to Stripe Unlink (medium 4.3)
- [CVE-2026-96173](https://insights.sbomify.com/CVE-2026-96173/): Payments for Hubtel < 1.0.2 - Unauthenticated Order Key Disclosure via IDOR (medium 5.3)
- [CVE-2026-9617](https://insights.sbomify.com/CVE-2026-9617/): PostgreSQL Anonymizer: malicious column name allows SQL injection via anon.k_anonymity() function (medium 6.8)
- [CVE-2026-9616](https://insights.sbomify.com/CVE-2026-9616/): Missing authorization in Generate Security.txt (medium 4.3)
- [CVE-2026-9615](https://insights.sbomify.com/CVE-2026-9615/): Missing authorization in Flex Import (medium 4.3)
- [CVE-2026-9614](https://insights.sbomify.com/CVE-2026-9614/): Missing authorization in Neurons for ITSM (Cloud) (high 8.8)
- [CVE-2026-9613](https://insights.sbomify.com/CVE-2026-9613/): Missing authorization in Datalogics Ecommerce Delivery – Datalogics (medium 4.3)
- [CVE-2026-9612](https://insights.sbomify.com/CVE-2026-9612/): WhatsOrder <= 1.0.1 - Unauthenticated Sensitive Information Exposure via Predictable Invoice File URLs (medium 5.3)
- [CVE-2026-96119](https://insights.sbomify.com/CVE-2026-96119/): IBM i is Affected By An Improper Control of Code Generation Vulnerability in HTTP Server Administration GUI (critical 9.9)
- [CVE-2026-96118](https://insights.sbomify.com/CVE-2026-96118/): Windows Graphics Kernel Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-96113](https://insights.sbomify.com/CVE-2026-96113/): Windows Domain Name Service Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-96108](https://insights.sbomify.com/CVE-2026-96108/): Desktop Window Manager Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-9610](https://insights.sbomify.com/CVE-2026-9610/): Multiple Vulnerabilities in IBM Datacap (low 2.3)
- [CVE-2026-96096](https://insights.sbomify.com/CVE-2026-96096/): Windows Media Player Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-9609](https://insights.sbomify.com/CVE-2026-9609/): QianFox FoxCMS Admin.php edit password recovery (medium 5.1)
- [CVE-2026-9608](https://insights.sbomify.com/CVE-2026-9608/): QianFox FoxCMS Administrator Backend edit cross site scripting (medium 4.8)
- [CVE-2026-96071](https://insights.sbomify.com/CVE-2026-96071/): Windows Media Remote Code Execution Vulnerability (high 7.5)
- [CVE-2026-9607](https://insights.sbomify.com/CVE-2026-9607/): itsourcecode Courier Management System parcel_list.php sql injection (medium 5.3)
- [CVE-2026-9606](https://insights.sbomify.com/CVE-2026-9606/): itsourcecode Courier Management System manage_user.php sql injection (medium 6.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/226/