# Vulnerabilities published in 2026


- [CVE-2026-92882](https://insights.sbomify.com/CVE-2026-92882/): Redact SNMP community, SNMPv3 pass phrases, and IPMI password in host config REST API GET responses (low 2.3)
- [CVE-2026-92881](https://insights.sbomify.com/CVE-2026-92881/): vgmstream AWB parser awb.c init_vgmstream_awb_memory divide by zero (medium 5.3)
- [CVE-2026-92880](https://insights.sbomify.com/CVE-2026-92880/): vgmstream EA SCHl parser vadpcm_decoder.c vadpcm_read_coefs_be out-of-bounds write (medium 5.3)
- [CVE-2026-92879](https://insights.sbomify.com/CVE-2026-92879/): vgmstream mus_acm.c parse_mus resource consumption (medium 5.3)
- [CVE-2026-92877](https://insights.sbomify.com/CVE-2026-92877/): XML external entity in jaxb-ri (core) (high 8.3)
- [CVE-2026-92876](https://insights.sbomify.com/CVE-2026-92876/): IBM Maximo Application Suite - IoT Component Denial of Service (high 7.5)
- [CVE-2026-92874](https://insights.sbomify.com/CVE-2026-92874/): Incorrect Authorization in GitLab (medium 5.4)
- [CVE-2026-92873](https://insights.sbomify.com/CVE-2026-92873/): Auth bypass in Pgpool-II (medium 6.9)
- [CVE-2026-92872](https://insights.sbomify.com/CVE-2026-92872/): Information disclosure in Pgpool-II (medium 5.3)
- [CVE-2026-92871](https://insights.sbomify.com/CVE-2026-92871/): Null dereference in Pgpool-II (high 8.7)
- [CVE-2026-92870](https://insights.sbomify.com/CVE-2026-92870/): Memory corruption in Pgpool-II (high 8.7)
- [CVE-2026-92869](https://insights.sbomify.com/CVE-2026-92869/): Memory corruption in Pgpool-II (high 7.1)
- [CVE-2026-92868](https://insights.sbomify.com/CVE-2026-92868/): Security feature bypass in Pgpool-II (medium 6.9)
- [CVE-2026-92867](https://insights.sbomify.com/CVE-2026-92867/): Memory corruption in Pgpool-II (high 8.7)
- [CVE-2026-92862](https://insights.sbomify.com/CVE-2026-92862/): Other in Ticket Ryutsu Center (medium 4.6)
- [CVE-2026-92861](https://insights.sbomify.com/CVE-2026-92861/): Hardcoded credentials in Ticket Ryutsu Center (medium 5.1)
- [CVE-2026-92860](https://insights.sbomify.com/CVE-2026-92860/): rcourtman Pulse Quick Security Setup quick-setup fmt.Sprintf input validation (critical 9.4)
- [CVE-2026-92853](https://insights.sbomify.com/CVE-2026-92853/): Out-of-bounds Read via a Zero-length TLS 1.3 Certificate Message in NetX Secure (high 8.7)
- [CVE-2026-92843](https://insights.sbomify.com/CVE-2026-92843/): Out-of-bounds Read via the TLS 1.3 Certificate extensions_length in NetX Secure (high 8.7)
- [CVE-2026-92842](https://insights.sbomify.com/CVE-2026-92842/): OOB read / info leak in convert.* stream filters when line-break-chars contains NUL (medium 5.9)
- [CVE-2026-9284](https://insights.sbomify.com/CVE-2026-9284/): Missing authorization in WooCommerce PayPal Payments (high 8.2)
- [CVE-2026-92839](https://insights.sbomify.com/CVE-2026-92839/): Other in Canva (medium 4.3)
- [CVE-2026-92838](https://insights.sbomify.com/CVE-2026-92838/): GeoVision GV-Remote E-Map dll hijacking vulnerability (high 7.8)
- [CVE-2026-92834](https://insights.sbomify.com/CVE-2026-92834/): Apache Thrift: C++ WebSocket server transport does not read a full request length (medium 6.3)
- [CVE-2026-92832](https://insights.sbomify.com/CVE-2026-92832/): IBM Aspera Enterprise Webapps Information Disclosure (medium 5.1)
- [CVE-2026-92829](https://insights.sbomify.com/CVE-2026-92829/): Missing authorization in Blog2Social: Social Media Auto Post & Scheduler (medium 4.3)
- [CVE-2026-92826](https://insights.sbomify.com/CVE-2026-92826/): EWWW Image Optimizer <= 8.7.7 - Reflected Cross-Site Scripting via REQUEST_URI Parameter Key (medium 6.1)
- [CVE-2026-92824](https://insights.sbomify.com/CVE-2026-92824/): Libmodulemd: libmodulemd: out-of-bounds read when emitting rpm-map artifacts (medium 6.2)
- [CVE-2026-92823](https://insights.sbomify.com/CVE-2026-92823/): Libmodulemd: libmodulemd: missing decompressed-size limit when parsing compressed yaml (medium 6.2)
- [CVE-2026-92822](https://insights.sbomify.com/CVE-2026-92822/): Libmodulemd: libmodulemd: unbounded recursion when parsing nested xmd yaml (medium 6.2)
- [CVE-2026-92821](https://insights.sbomify.com/CVE-2026-92821/): Sssd: sssd: access control bypass via premature ldap access rule evaluation (medium 6.8)
- [CVE-2026-92820](https://insights.sbomify.com/CVE-2026-92820/): Ninja Forms - File Uploads <= 3.3.34 - Unauthenticated Arbitrary File Upload (high 8.1)
- [CVE-2026-9282](https://insights.sbomify.com/CVE-2026-9282/): W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read via 'f_array[]' Parameter (high 7.5)
- [CVE-2026-92817](https://insights.sbomify.com/CVE-2026-92817/): Inductive Automation Ignition Software Incorrect Authorization (high 8.7)
- [CVE-2026-92816](https://insights.sbomify.com/CVE-2026-92816/): ComfyUI before 0.30.0 Path Traversal via dataset save nodes (high 8.5)
- [CVE-2026-92815](https://insights.sbomify.com/CVE-2026-92815/): changedetection.io through 0.60.6 SSRF via browser-step Goto URL (high 8.7)
- [CVE-2026-92814](https://insights.sbomify.com/CVE-2026-92814/): changedetection.io through 0.60.6 Cross-Site Scripting via watch_title (low 2.3)
- [CVE-2026-92813](https://insights.sbomify.com/CVE-2026-92813/): Metabase through 0.63.18 SSRF via GeoJSON URL validation bypass (medium 6.9)
- [CVE-2026-92812](https://insights.sbomify.com/CVE-2026-92812/): Decap CMS < 3.11.0 Path Traversal via Sibling Directory Prefix Matching (critical 9.3)
- [CVE-2026-92811](https://insights.sbomify.com/CVE-2026-92811/): browserless 1.44.0 through 2.56.7 File Protocol Restriction Bypass (high 7.1)
- [CVE-2026-92810](https://insights.sbomify.com/CVE-2026-92810/): PrestaShop blockwishlist through 3.0.2 Information Disclosure (medium 5.3)
- [CVE-2026-9281](https://insights.sbomify.com/CVE-2026-9281/): Cross-site scripting in Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits (medium 6.4)
- [CVE-2026-92809](https://insights.sbomify.com/CVE-2026-92809/): PrestaShop psgdpr through 1.4.3 GDPR Log Forgery (medium 5.3)
- [CVE-2026-92808](https://insights.sbomify.com/CVE-2026-92808/): Server-Side Request Forgery in Altium Enterprise Server UnifiedLogin Service Allows Unauthenticated System Compromise (critical 10.0)
- [CVE-2026-92807](https://insights.sbomify.com/CVE-2026-92807/): Code injection in Save as PDF Plugin by PDFCrowd (high 8.8)
- [CVE-2026-92806](https://insights.sbomify.com/CVE-2026-92806/): phpList before 3.6.17 Cross-Site Request Forgery via massremove.php (high 7.2)
- [CVE-2026-92805](https://insights.sbomify.com/CVE-2026-92805/): UVdesk Community Skeleton through 1.1.8 Missing Authentication on the Installation Wizard (critical 9.3)
- [CVE-2026-92804](https://insights.sbomify.com/CVE-2026-92804/): Nango through 0.70.4 Server-Side Request Forgery via Configuration (high 7.1)
- [CVE-2026-92803](https://insights.sbomify.com/CVE-2026-92803/): LibreTranslate through 1.9.6 Missing Access Check on the download_file Route (medium 6.9)
- [CVE-2026-92802](https://insights.sbomify.com/CVE-2026-92802/): kan through 0.6.0 Authorization Bypass via GitHub Project Import (medium 5.3)
- [CVE-2026-92801](https://insights.sbomify.com/CVE-2026-92801/): cc-connect through 1.5.0 User Allowlist Bypass via Feishu Card Actions (high 8.7)
- [CVE-2026-92800](https://insights.sbomify.com/CVE-2026-92800/): Docs before 5.4.1 Stale Collaboration Session After Access Revocation (high 7.6)
- [CVE-2026-9280](https://insights.sbomify.com/CVE-2026-9280/): Ad Inserter <= 2.8.15 - Reflected Cross-Site Scripting via URL Parameters in iframe Mode (medium 6.1)
- [CVE-2026-92799](https://insights.sbomify.com/CVE-2026-92799/): Auth bypass in Online Scheduling and Appointment Booking System – Bookly (medium 5.3)
- [CVE-2026-92798](https://insights.sbomify.com/CVE-2026-92798/): Code injection in User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder (high 8.1)
- [CVE-2026-92797](https://insights.sbomify.com/CVE-2026-92797/): Memberpress <= 1.14.1 - Cross-Site Request Forgery via 'user_email' Parameter (high 8.8)
- [CVE-2026-92796](https://insights.sbomify.com/CVE-2026-92796/): Manticore Search 27.0.0 before 28.4.4 Multi-Statement Authorization Bypass (high 8.7)
- [CVE-2026-92795](https://insights.sbomify.com/CVE-2026-92795/): Coze Studio through 0.5.1 Server-Side Request Forgery via Plugin (high 7.1)
- [CVE-2026-92794](https://insights.sbomify.com/CVE-2026-92794/): OpenSign through 2.41.3 Information Disclosure via getDocument (high 8.7)
- [CVE-2026-92793](https://insights.sbomify.com/CVE-2026-92793/): GoAdmin through 1.2.26 Authorization Bypass via Query Parameter (high 8.6)
- [CVE-2026-92792](https://insights.sbomify.com/CVE-2026-92792/): OpenNHP through 1.0.2 Authentication Bypass via Fallback Verifier (high 8.7)
- [CVE-2026-92791](https://insights.sbomify.com/CVE-2026-92791/): Uber Kraken through 0.1.29 Path Traversal via tag parameter (high 8.7)
- [CVE-2026-92790](https://insights.sbomify.com/CVE-2026-92790/): Higress before 2.2.4 Rate Limit Bypass via Malformed Cookie Header (medium 6.9)
- [CVE-2026-9279](https://insights.sbomify.com/CVE-2026-9279/): Shell command injection in Logseq (high 8.7)
- [CVE-2026-92789](https://insights.sbomify.com/CVE-2026-92789/): Graylog through 7.1.4 Server-Side Request Forgery via HTTP Redirect (high 7.1)
- [CVE-2026-92788](https://insights.sbomify.com/CVE-2026-92788/): Coze Studio through 0.5.1 Cross-Tenant Database Access via Workflow SQL Node (high 8.7)
- [CVE-2026-92787](https://insights.sbomify.com/CVE-2026-92787/): Feast through 0.66.0 Authentication Bypass via Unverified Token (critical 9.3)
- [CVE-2026-92786](https://insights.sbomify.com/CVE-2026-92786/): LightGBM through 4.7.0 Out-of-Bounds Write via Crafted Model (high 8.5)
- [CVE-2026-92785](https://insights.sbomify.com/CVE-2026-92785/): Angel through 3.3.0 Unauthenticated Kryo Deserialization of Arbitrary Classes (critical 9.2)
- [CVE-2026-92784](https://insights.sbomify.com/CVE-2026-92784/): @refinedev/inferencer through 7.0.0 Code Injection via API Field Names (high 7.7)
- [CVE-2026-92783](https://insights.sbomify.com/CVE-2026-92783/): Yeti through 2.11.0 Missing Authorization on RBAC Relationship Deletion (high 7.2)
- [CVE-2026-92782](https://insights.sbomify.com/CVE-2026-92782/): Chroma through 1.5.9 Authorization Bypass via Collection Identifier (high 8.6)
- [CVE-2026-92781](https://insights.sbomify.com/CVE-2026-92781/): Builder.io Gen2 SDKs through 5.2.11 Prototype Pollution via builder.userAttributes (medium 5.3)
- [CVE-2026-92780](https://insights.sbomify.com/CVE-2026-92780/): KnowStreaming through 3.4.1 Missing Authorization on the REST API (high 8.7)
- [CVE-2026-9278](https://insights.sbomify.com/CVE-2026-9278/): Form Builder CP < 1.2.47 - Editor+ Stored XSS via form_structure (medium 5.4)
- [CVE-2026-92779](https://insights.sbomify.com/CVE-2026-92779/): Builder.io Gen2 SDKs through 5.2.11 Prototype Pollution via Bindings (high 7.2)
- [CVE-2026-92778](https://insights.sbomify.com/CVE-2026-92778/): CMAK through 3.0.0.6 Feature Gate Bypass via HTML Form Routes (medium 5.3)
- [CVE-2026-92777](https://insights.sbomify.com/CVE-2026-92777/): Security feature bypass in Idea Tab Pro (TB373FU) (medium 5.4)
- [CVE-2026-92776](https://insights.sbomify.com/CVE-2026-92776/): Wiki.js through 2.5.314 Path Prefix Matching Authorization Bypass (high 8.6)
- [CVE-2026-92775](https://insights.sbomify.com/CVE-2026-92775/): Wiki.js through 2.5.314 Server-Side Request Forgery via Image Prefetch (high 7.1)
- [CVE-2026-92774](https://insights.sbomify.com/CVE-2026-92774/): Wiki.js through 2.5.314 Authorization Bypass via GraphQL Tag Omission (medium 5.3)
- [CVE-2026-92773](https://insights.sbomify.com/CVE-2026-92773/): Trigger.dev before 4.6.0 GitHub App Installation Takeover (high 7.1)
- [CVE-2026-92772](https://insights.sbomify.com/CVE-2026-92772/): Leantime before 3.9.6 Unauthorized Plugin Installation via HTMX (high 7.1)
- [CVE-2026-92771](https://insights.sbomify.com/CVE-2026-92771/): Twenty before 2.35.0 Permission Bypass via groupBy-with-records Query (high 7.1)
- [CVE-2026-92770](https://insights.sbomify.com/CVE-2026-92770/): Harbor through 2.15.2 Scanner Credential Disclosure via Query Parameter (high 7.1)
- [CVE-2026-9277](https://insights.sbomify.com/CVE-2026-9277/): shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op` (critical 9.2)
- [CVE-2026-92768](https://insights.sbomify.com/CVE-2026-92768/): Cockpit-machines: cockpit-machines: sensitive data exposure via command-line arguments (medium 5.5)
- [CVE-2026-92767](https://insights.sbomify.com/CVE-2026-92767/): Cross-site scripting in Twenty20 Image Before-After (medium 6.4)
- [CVE-2026-92766](https://insights.sbomify.com/CVE-2026-92766/): Vitepos <= 3.5.1 - Unauthenticated SQL Injection via 'src_by' Parameter (high 7.5)
- [CVE-2026-92765](https://insights.sbomify.com/CVE-2026-92765/): ArcherySec through 2.0.6 Information Disclosure via WebScanVulnList (high 7.1)
- [CVE-2026-92764](https://insights.sbomify.com/CVE-2026-92764/): OpenCVE 2.4.0 < 3.1.0 Organization API Ignores Token Scope (medium 5.3)
- [CVE-2026-92763](https://insights.sbomify.com/CVE-2026-92763/): Rundeck through 6.2.1 Authorization Bypass via Project Import (high 8.6)
- [CVE-2026-92762](https://insights.sbomify.com/CVE-2026-92762/): Pelican Panel before 1.0.0-beta35 Authorization Bypass via Startup (high 8.7)
- [CVE-2026-92761](https://insights.sbomify.com/CVE-2026-92761/): WebVirtCloud Missing Authorization on Instance Control Actions (high 8.7)
- [CVE-2026-92760](https://insights.sbomify.com/CVE-2026-92760/): Shlink through 5.1.6 Mercure Token Authorization Bypass (high 7.1)
- [CVE-2026-92759](https://insights.sbomify.com/CVE-2026-92759/): SecObserve before 1.59.1 Information Disclosure via API Configuration (high 7.1)
- [CVE-2026-92758](https://insights.sbomify.com/CVE-2026-92758/): Logs may collect sensitive information (medium 5.7)
- [CVE-2026-92757](https://insights.sbomify.com/CVE-2026-92757/): Malformed connection string may disable field level encryption (medium 6.8)
- [CVE-2026-92756](https://insights.sbomify.com/CVE-2026-92756/): Combining encryption settings may disable encryption (medium 6.8)
- [CVE-2026-92754](https://insights.sbomify.com/CVE-2026-92754/): PatrowlManager through 1.8.4 Improper Access Control via users API (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/246/