# Vulnerabilities published in 2026


- [CVE-2026-92753](https://insights.sbomify.com/CVE-2026-92753/): PatrowlManager through 1.8.4 Authorization Bypass via Events API (high 7.1)
- [CVE-2026-92752](https://insights.sbomify.com/CVE-2026-92752/): metasfresh Unauthorized Access via Document Attachments and Comments Endpoints (high 8.7)
- [CVE-2026-92751](https://insights.sbomify.com/CVE-2026-92751/): CMAK through 3.0.0.6 Cross-Site Request Forgery via Missing CSRF Filter (high 7.2)
- [CVE-2026-92750](https://insights.sbomify.com/CVE-2026-92750/): Harness through 3.3.0 Missing Access Control via infraproviders endpoint (high 7.1)
- [CVE-2026-92749](https://insights.sbomify.com/CVE-2026-92749/): SafeLine through 9.4.1 Authentication Bypass via Weak Session Secret (critical 9.2)
- [CVE-2026-92748](https://insights.sbomify.com/CVE-2026-92748/): BC Security Empire before 6.7.1 Path Traversal File Upload RCE (high 8.7)
- [CVE-2026-92747](https://insights.sbomify.com/CVE-2026-92747/): Cockpit-machines: cockpit-machines: sensitive data exposure of guest credentials via json argument in process list (medium 5.0)
- [CVE-2026-92746](https://insights.sbomify.com/CVE-2026-92746/): Cross-site scripting in Gutenverse – WordPress Blocks, Page Builder & Site Editor (medium 6.4)
- [CVE-2026-92745](https://insights.sbomify.com/CVE-2026-92745/): Cockpit-machines: cockpit-machines: information disclosure of rhsm offline token via process arguments (medium 5.0)
- [CVE-2026-92744](https://insights.sbomify.com/CVE-2026-92744/): Delinea Privilege Manager agent unauthenticated remote code execution vulnerability (high 8.7)
- [CVE-2026-9274](https://insights.sbomify.com/CVE-2026-9274/): Information Exposure Vulnerability in CP-Plus Wi-Fi Camera (medium 5.2)
- [CVE-2026-92730](https://insights.sbomify.com/CVE-2026-92730/): LimeSurvey Community Edition 7.0.14 - Reflected XSS in participant CSV import result via invalid attribute column name (high 7.4)
- [CVE-2026-9273](https://insights.sbomify.com/CVE-2026-9273/): Membership Plugin – Kadence Memberships <= 4.0.0 - Unauthenticated Password Reset Link Poisoning to Account Takeover (critical 9.3)
- [CVE-2026-92729](https://insights.sbomify.com/CVE-2026-92729/): SigNoz 0.88.0 through 0.141.0 - Missing Authentication on Trace Funnel Analytics Endpoints (high 8.8)
- [CVE-2026-92727](https://insights.sbomify.com/CVE-2026-92727/): EmbedPress <= 4.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slidesShow' Block Attribute (medium 6.4)
- [CVE-2026-92720](https://insights.sbomify.com/CVE-2026-92720/): Kubero through 3.1.1 Unauthenticated Notifications API Access (critical 9.3)
- [CVE-2026-9272](https://insights.sbomify.com/CVE-2026-9272/): Possibility of unintended database operations when querying data related to detected anomalies in Progress Flowmon ADS (high 8.7)
- [CVE-2026-92719](https://insights.sbomify.com/CVE-2026-92719/): Quickwit through 0.9.0 SSRF via SQS queue_url Parameter (high 8.7)
- [CVE-2026-92718](https://insights.sbomify.com/CVE-2026-92718/): Nuclei from 3.7.0 before 3.11.1 Template Signature Bypass via Modification-Time-Only Cache (high 7.0)
- [CVE-2026-92717](https://insights.sbomify.com/CVE-2026-92717/): Covenant through 0.6 Missing Authentication on the CovenantHub SignalR Hub (critical 9.3)
- [CVE-2026-92716](https://insights.sbomify.com/CVE-2026-92716/): Shuffle through 2.2.1 API Key Reset Cross-Tenant Privilege Escalation (high 8.6)
- [CVE-2026-92715](https://insights.sbomify.com/CVE-2026-92715/): Missing authorization in Tutor LMS – eLearning and online course solution (medium 4.3)
- [CVE-2026-92714](https://insights.sbomify.com/CVE-2026-92714/): Missing authorization in Download Manager (medium 6.5)
- [CVE-2026-92713](https://insights.sbomify.com/CVE-2026-92713/): Missing authorization in Modula Image Gallery – Photo Grid & Video Gallery (high 8.1)
- [CVE-2026-92712](https://insights.sbomify.com/CVE-2026-92712/): ReactPress <= 3.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'permalink' Parameter (medium 6.4)
- [CVE-2026-9271](https://insights.sbomify.com/CVE-2026-9271/): KeepInMind - Dashboard Notes < 0.8.4.2 - Contributor+ Stored XSS (medium 5.9)
- [CVE-2026-92709](https://insights.sbomify.com/CVE-2026-92709/): Rsyslog: DynFile Path Traversal → Arbitrary File Write as Root → RCE (high 8.1)
- [CVE-2026-92708](https://insights.sbomify.com/CVE-2026-92708/): devalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffers (high 7.5)
- [CVE-2026-92707](https://insights.sbomify.com/CVE-2026-92707/): MessagePack: Nested arrays can blow past buffer length limits (medium 5.3)
- [CVE-2026-92706](https://insights.sbomify.com/CVE-2026-92706/): Dark Reader: Ability to request icon-like bitmap data from certain local web servers (low 3.4)
- [CVE-2026-92705](https://insights.sbomify.com/CVE-2026-92705/): Aegisub executes arbitrary code through automatically loaded Automation scripts (high 7.8)
- [CVE-2026-92702](https://insights.sbomify.com/CVE-2026-92702/): Security feature bypass in cocos (critical 9.1)
- [CVE-2026-92701](https://insights.sbomify.com/CVE-2026-92701/): Security feature bypass in cocos (critical 9.1)
- [CVE-2026-92700](https://insights.sbomify.com/CVE-2026-92700/): Caddy: fileHidden() case-sensitive pattern bypass — exposes "hidden" files via case variation (medium 6.3)
- [CVE-2026-9270](https://insights.sbomify.com/CVE-2026-9270/): DataDog::DogStatsd versions through 0.07 for Perl allow metric injections (critical 9.1)
- [CVE-2026-92692](https://insights.sbomify.com/CVE-2026-92692/): Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated) (medium 6.9)
- [CVE-2026-9269](https://insights.sbomify.com/CVE-2026-9269/): Secure Copy Content Protection and Content Locking < 5.1.5 - Admin+ Stored XSS via ays_sccp_sub_icon_image Parameter (low 3.5)
- [CVE-2026-92682](https://insights.sbomify.com/CVE-2026-92682/): @neo4j/graphql: authorization relationship and connection filters invert the "none" quantifier (high 8.6)
- [CVE-2026-92681](https://insights.sbomify.com/CVE-2026-92681/): @neo4j/graphql: schema-level and type-level @authentication not enforced on top-level @cypher fields (critical 9.3)
- [CVE-2026-92680](https://insights.sbomify.com/CVE-2026-92680/): Araxis Merge insufficiently protected credentials (medium 6.8)
- [CVE-2026-9268](https://insights.sbomify.com/CVE-2026-9268/): Incorrect Authorization in GitLab (low 2.7)
- [CVE-2026-9267](https://insights.sbomify.com/CVE-2026-9267/): Memory corruption in Eclipse tinydtls (medium 6.9)
- [CVE-2026-92665](https://insights.sbomify.com/CVE-2026-92665/): Denial of service in PowerProtect Data Domain (medium 5.3)
- [CVE-2026-9266](https://insights.sbomify.com/CVE-2026-9266/): Weak cryptography in UC-1200A Series (high 7.0)
- [CVE-2026-9265](https://insights.sbomify.com/CVE-2026-9265/): Crypt::OpenSSL::PKCS12 versions before 1.96 for Perl permits a heap OOB read in print_attribute UTF8STRING path (critical 9.1)
- [CVE-2026-9264](https://insights.sbomify.com/CVE-2026-9264/): Cross-Site Scripting in SketchUp Dynamic Components (critical 9.3)
- [CVE-2026-9263](https://insights.sbomify.com/CVE-2026-9263/): Out-of-bounds read in Bluetooth Controller ISOAL framed RX reassembly leaks adjacent memory into host HCI ISO packets (medium 6.5)
- [CVE-2026-92629](https://insights.sbomify.com/CVE-2026-92629/): Missing authorization in Baiying PC Client (high 7.0)
- [CVE-2026-92628](https://insights.sbomify.com/CVE-2026-92628/): Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in GitLab (low 3.1)
- [CVE-2026-92627](https://insights.sbomify.com/CVE-2026-92627/): Heap Use-After-Free in H5T__conv_f_f (medium 4.6)
- [CVE-2026-92626](https://insights.sbomify.com/CVE-2026-92626/): Control iD iDSecure Unauthenticated Denial of Service (high 7.5)
- [CVE-2026-92625](https://insights.sbomify.com/CVE-2026-92625/): Control iD iDSecure Unauthenticated Denial of Service (high 7.5)
- [CVE-2026-92622](https://insights.sbomify.com/CVE-2026-92622/): Cross-site scripting in Strong Testimonials (medium 6.4)
- [CVE-2026-9262](https://insights.sbomify.com/CVE-2026-9262/): Misconfiguration in EOS Network Setting Tool for Windows (high 7.1)
- [CVE-2026-92619](https://insights.sbomify.com/CVE-2026-92619/): Booking Calendar <= 11.8.2 - Authenticated (Editor+) Privilege Escalation to 'data_name' Parameter (high 7.2)
- [CVE-2026-92616](https://insights.sbomify.com/CVE-2026-92616/): FileRise < 3.28.0 Privilege Escalation via WebDAV Session Inheritance (high 7.6)
- [CVE-2026-92615](https://insights.sbomify.com/CVE-2026-92615/): Flightctl: flightctl: package-global go-git https transport mutated per-repo -- cross-tenant tls-config bleed (medium 6.6)
- [CVE-2026-92612](https://insights.sbomify.com/CVE-2026-92612/): Memory corruption in Eclipse iceoryx™ (low 1.0)
- [CVE-2026-92611](https://insights.sbomify.com/CVE-2026-92611/): Auth bypass in Eclipse Ankaios (medium 4.8)
- [CVE-2026-9261](https://insights.sbomify.com/CVE-2026-9261/): Weak cryptography in EOS Network Setting Tool for Windows (high 7.6)
- [CVE-2026-92609](https://insights.sbomify.com/CVE-2026-92609/): Apache Qpid Broker-J: Missing HTTP-session renewal after successful authentication (critical 9.8)
- [CVE-2026-92608](https://insights.sbomify.com/CVE-2026-92608/): Apache Qpid Broker-J: Incomplete property conversion handling from AMQP 1.0 to AMQP 0-10 (high 7.5)
- [CVE-2026-92605](https://insights.sbomify.com/CVE-2026-92605/): IRIS through 2.4.29 Unauthorized Comment Access via Object ID (high 7.1)
- [CVE-2026-92604](https://insights.sbomify.com/CVE-2026-92604/): Scirius through 3.8.0 Arbitrary File Write via PCAP Upload (high 7.2)
- [CVE-2026-92603](https://insights.sbomify.com/CVE-2026-92603/): ContiNew Admin through 4.1.0 Unauthorized Message Deletion via UserMessageController (high 7.1)
- [CVE-2026-92602](https://insights.sbomify.com/CVE-2026-92602/): TDuck survey form through 5.3 Server-Side Request Forgery via Unvalidated Webhook URL (high 7.1)
- [CVE-2026-92601](https://insights.sbomify.com/CVE-2026-92601/): Guns through 8.3.5 Improper Access Control via SysNoticeController (high 7.1)
- [CVE-2026-92600](https://insights.sbomify.com/CVE-2026-92600/): Guns through 8.3.5 Information Disclosure via Missing Permission Check (high 7.1)
- [CVE-2026-9260](https://insights.sbomify.com/CVE-2026-9260/): Hardcoded credentials in EOS Network Setting Tool for Windows (medium 6.9)
- [CVE-2026-92599](https://insights.sbomify.com/CVE-2026-92599/): Joi before 17.13.7 and 18.2.6 ReDoS via isoDate (high 8.7)
- [CVE-2026-92598](https://insights.sbomify.com/CVE-2026-92598/): Nodemailer before 9.1.0 IDN/Punycode Domain Allow-list Bypass (high 8.3)
- [CVE-2026-92597](https://insights.sbomify.com/CVE-2026-92597/): Nodemailer before 9.1.0 Email Domain Validation Bypass via RFC 5322 Comment (high 8.3)
- [CVE-2026-92596](https://insights.sbomify.com/CVE-2026-92596/): Nodemailer before 9.1.0 Denial of Service via addressparser (high 8.7)
- [CVE-2026-92595](https://insights.sbomify.com/CVE-2026-92595/): Nodemailer before 9.1.1 Security Sandbox Bypass via resolveContent (medium 6.0)
- [CVE-2026-92594](https://insights.sbomify.com/CVE-2026-92594/): Craft CMS before 5.11.0 Unauthenticated PII Disclosure via GraphQL (high 8.7)
- [CVE-2026-92593](https://insights.sbomify.com/CVE-2026-92593/): Craft CMS 5.10.0 before 5.10.13 Authenticated Remote Code Execution (high 8.7)
- [CVE-2026-92592](https://insights.sbomify.com/CVE-2026-92592/): Craft CMS before 4.18.6 Remote Code Execution via signed cookie (high 8.7)
- [CVE-2026-92591](https://insights.sbomify.com/CVE-2026-92591/): Craft CMS 5.0.0 before 5.10.13 Environment Secret Exposure via Installer (high 8.2)
- [CVE-2026-92590](https://insights.sbomify.com/CVE-2026-92590/): Craft CMS 5.7.0 before 5.10.13 Stored XSS via Generated Fields (medium 5.1)
- [CVE-2026-9259](https://insights.sbomify.com/CVE-2026-9259/): Security feature bypass in EOS Network Setting Tool for Windows (high 7.1)
- [CVE-2026-92589](https://insights.sbomify.com/CVE-2026-92589/): Craft CMS 5.0.0 before 5.10.13 Broken Access Control via nested-elements/reorder (medium 5.3)
- [CVE-2026-92588](https://insights.sbomify.com/CVE-2026-92588/): n8n before 1.123.76 Improper Authorization via Source Control Push (medium 5.9)
- [CVE-2026-92587](https://insights.sbomify.com/CVE-2026-92587/): n8n before 1.123.76 Sandbox Escape via Git Relative URL (medium 5.3)
- [CVE-2026-92586](https://insights.sbomify.com/CVE-2026-92586/): AVideo through 29.0 Missing Authorization via comment API endpoint (medium 5.3)
- [CVE-2026-92585](https://insights.sbomify.com/CVE-2026-92585/): AVideo through 29.0 Missing Authorization Check via API Like Endpoint (medium 5.3)
- [CVE-2026-92584](https://insights.sbomify.com/CVE-2026-92584/): AVideo through 29.0 Stored Cross-Site Scripting via User-Agent Header (medium 5.3)
- [CVE-2026-92583](https://insights.sbomify.com/CVE-2026-92583/): AVideo through 29.0 Rate Limit Bypass via Non-Atomic Counter Increment (medium 6.9)
- [CVE-2026-92582](https://insights.sbomify.com/CVE-2026-92582/): AVideo through 29.0 Broken Access Control via videoAddNew.json.php CSRF Bypass (high 7.1)
- [CVE-2026-92581](https://insights.sbomify.com/CVE-2026-92581/): AVideo through 29.0 Like Counter Desynchronization via Array Parameter (medium 5.3)
- [CVE-2026-92580](https://insights.sbomify.com/CVE-2026-92580/): AVideo through 29.0 CloneSite Stored Shell Injection via SSH Password CSRF (high 8.7)
- [CVE-2026-9258](https://insights.sbomify.com/CVE-2026-9258/): Security feature bypass in EOS Network Setting Tool for Windows (high 7.1)
- [CVE-2026-92579](https://insights.sbomify.com/CVE-2026-92579/): AVideo through 29.0 Broken Access Control via CSRF Exemption Basename Collision (medium 5.3)
- [CVE-2026-92578](https://insights.sbomify.com/CVE-2026-92578/): WWBN AVideo through 29.0 Authentication Bypass via Stored Password Hash (critical 9.2)
- [CVE-2026-92577](https://insights.sbomify.com/CVE-2026-92577/): AVideo through 29.0 API get_api_video Broken Access Control via clean_title (high 8.7)
- [CVE-2026-92576](https://insights.sbomify.com/CVE-2026-92576/): HKUDS nanobot before 0.3.0 Server-Side Request Forgery via WebFetchTool (critical 9.2)
- [CVE-2026-92574](https://insights.sbomify.com/CVE-2026-92574/): Cri-o: cri-o checkpoint restore bypasses destination security context (high 8.8)
- [CVE-2026-92573](https://insights.sbomify.com/CVE-2026-92573/): Denial of service in Apache Qpid Broker-J (medium 6.5)
- [CVE-2026-92570](https://insights.sbomify.com/CVE-2026-92570/): reNgine through 2.2.0 Unauthorized Configuration File Read (high 7.1)
- [CVE-2026-92569](https://insights.sbomify.com/CVE-2026-92569/): Hippo4j through 1.5.0 SSRF via clientAddress Parameter (medium 5.3)
- [CVE-2026-92568](https://insights.sbomify.com/CVE-2026-92568/): MLRun through 1.11.0 Server-Side Request Forgery via Webhook (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/247/