# Vulnerabilities published in 2026


- [CVE-2026-92567](https://insights.sbomify.com/CVE-2026-92567/): TDuck survey form through 5.0 Unauthorized Data Modification (high 7.1)
- [CVE-2026-92566](https://insights.sbomify.com/CVE-2026-92566/): DataGear through 6.0.0 Unauthenticated SSRF via HTTP Dataset Preview (high 8.8)
- [CVE-2026-92565](https://insights.sbomify.com/CVE-2026-92565/): Rallly before 4.15.0 Information Disclosure via polls.get (medium 6.9)
- [CVE-2026-92564](https://insights.sbomify.com/CVE-2026-92564/): Denial of service in Apache Qpid Broker-J (high 7.5)
- [CVE-2026-92561](https://insights.sbomify.com/CVE-2026-92561/): Booking Calendar <= 11.8.2 - Reflected Cross-Site Scripting via 'options' Parameter (medium 6.1)
- [CVE-2026-92560](https://insights.sbomify.com/CVE-2026-92560/): Denial of service in Apache Qpid Broker-J (high 7.5)
- [CVE-2026-9256](https://insights.sbomify.com/CVE-2026-9256/): NGINX ngx_http_rewrite_module vulnerability (critical 9.2)
- [CVE-2026-92559](https://insights.sbomify.com/CVE-2026-92559/): IBM App Connect Enterprise is vulnerable to a credential exposure (critical 9.8)
- [CVE-2026-92555](https://insights.sbomify.com/CVE-2026-92555/): Database Credentials Disclosure in AKIN Software's AKINSOFT WOLVOX Control Panel (critical 9.8)
- [CVE-2026-92554](https://insights.sbomify.com/CVE-2026-92554/): ShopLentor <= 3.5.1 - Reflected Cross-Site Scripting via Query-String Parameter Name (medium 6.1)
- [CVE-2026-92553](https://insights.sbomify.com/CVE-2026-92553/): YaySMTP <= 2.7.7 - Authenticated (Subscriber+) Arbitrary File Upload via Attachment Filename Extension (high 8.8)
- [CVE-2026-92551](https://insights.sbomify.com/CVE-2026-92551/): Cross-site scripting in Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress (medium 6.1)
- [CVE-2026-92550](https://insights.sbomify.com/CVE-2026-92550/): Denial of service in Apache Qpid Broker-J (high 7.5)
- [CVE-2026-9255](https://insights.sbomify.com/CVE-2026-9255/): Tool Execution Without Authorization via Piped Stdin in Kiro CLI (high 8.4)
- [CVE-2026-92548](https://insights.sbomify.com/CVE-2026-92548/): WP Popular Posts <= 7.4.2 - Unauthenticated Information Disclosure in 'post_type' and 'context' Parameters (medium 5.3)
- [CVE-2026-92546](https://insights.sbomify.com/CVE-2026-92546/): Authentication Bypass with X-Agentic-Ally-Token in Keepnet Labs Agentic AI / Agentic Ally (high 7.5)
- [CVE-2026-92543](https://insights.sbomify.com/CVE-2026-92543/): Docker Engine insecure-registry fallback via malicious DNS responses (high 7.6)
- [CVE-2026-92542](https://insights.sbomify.com/CVE-2026-92542/): Blind VXLAN injection into encrypted overlay networks from cluster peer (medium 6.9)
- [CVE-2026-92541](https://insights.sbomify.com/CVE-2026-92541/): Import and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via Frontend Importer (high 7.2)
- [CVE-2026-92540](https://insights.sbomify.com/CVE-2026-92540/): Privilege escalation in Import and export users and customers (high 7.2)
- [CVE-2026-9254](https://insights.sbomify.com/CVE-2026-9254/): Command Injection Vulnerability in Parent Control of Multiple TP-Link Archer Devices (high 8.7)
- [CVE-2026-92539](https://insights.sbomify.com/CVE-2026-92539/): Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise (medium 6.7)
- [CVE-2026-92538](https://insights.sbomify.com/CVE-2026-92538/): LearnPress <= 4.4.7 - Reflected DOM-Based Cross-Site Scripting via 'orderby' Parameter (medium 6.1)
- [CVE-2026-92537](https://insights.sbomify.com/CVE-2026-92537/): Information disclosure in Newsletter – Send awesome emails from WordPress (medium 5.3)
- [CVE-2026-92536](https://insights.sbomify.com/CVE-2026-92536/): Code injection in Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress (high 8.8)
- [CVE-2026-92533](https://insights.sbomify.com/CVE-2026-92533/): Path Traversal in BugTracker.NET (high 7.1)
- [CVE-2026-92532](https://insights.sbomify.com/CVE-2026-92532/): Unrestricted Upload of File with Dangerous Type in BugTracker.NET (high 7.5)
- [CVE-2026-92531](https://insights.sbomify.com/CVE-2026-92531/): Improper Neutralization of Special Elements used in an OS Command in BugTracker.NET (high 7.5)
- [CVE-2026-92530](https://insights.sbomify.com/CVE-2026-92530/): Use of Less Trusted Source in GitLab (medium 4.3)
- [CVE-2026-9253](https://insights.sbomify.com/CVE-2026-9253/): Cross-site scripting in WP Cost Estimation & Payment Forms Builder (high 7.2)
- [CVE-2026-92529](https://insights.sbomify.com/CVE-2026-92529/): Incorrect Authorization in GitLab (medium 4.3)
- [CVE-2026-92528](https://insights.sbomify.com/CVE-2026-92528/): Incorrect Authorization in GitLab (medium 4.2)
- [CVE-2026-92527](https://insights.sbomify.com/CVE-2026-92527/): chatwoot Shopify OAuth callbacks_controller.rb server-side request forgery (medium 5.3)
- [CVE-2026-92526](https://insights.sbomify.com/CVE-2026-92526/): itsourcecode Leave Management System index.php sql injection (medium 5.3)
- [CVE-2026-92525](https://insights.sbomify.com/CVE-2026-92525/): RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[] (high 7.1)
- [CVE-2026-92524](https://insights.sbomify.com/CVE-2026-92524/): irqchip/gic-v3-its: Prevent leak in its_vpe_irq_domain_alloc() (not scored)
- [CVE-2026-92523](https://insights.sbomify.com/CVE-2026-92523/): RDMA/nldev: validate dynamic counter attribute length (not scored)
- [CVE-2026-92522](https://insights.sbomify.com/CVE-2026-92522/): ACPI: processor: validate MADT IOAPIC entry bounds (high 7.3)
- [CVE-2026-92521](https://insights.sbomify.com/CVE-2026-92521/): ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root (not scored)
- [CVE-2026-92520](https://insights.sbomify.com/CVE-2026-92520/): bpf: Zero queue and stack outputs on lock failure (not scored)
- [CVE-2026-92519](https://insights.sbomify.com/CVE-2026-92519/): riscv, bpf: Fix memory leak in bpf_jit_free (not scored)
- [CVE-2026-92518](https://insights.sbomify.com/CVE-2026-92518/): riscv, bpf: Fix kernel stack corruption in tailcall with CFI (high 7.8)
- [CVE-2026-92517](https://insights.sbomify.com/CVE-2026-92517/): bpf, riscv: Fix extable handling for arena load_acquire (not scored)
- [CVE-2026-92516](https://insights.sbomify.com/CVE-2026-92516/): bpf: Fix offset warn check for bpf_res_spin_lock (not scored)
- [CVE-2026-92515](https://insights.sbomify.com/CVE-2026-92515/): bpf: Preserve unique-field state across nested structs (not scored)
- [CVE-2026-92514](https://insights.sbomify.com/CVE-2026-92514/): RDMA/erdma: Fix CEQ tasklet use-after-free on removal (not scored)
- [CVE-2026-92513](https://insights.sbomify.com/CVE-2026-92513/): RDMA/mana_ib: drain QP references after partial table insertion (not scored)
- [CVE-2026-92512](https://insights.sbomify.com/CVE-2026-92512/): RDMA/core: Fix use after free in ib_query_qp() (not scored)
- [CVE-2026-92511](https://insights.sbomify.com/CVE-2026-92511/): RDMA/core: Fix potential use after free in ib_destroy_cq_user() (high 7.8)
- [CVE-2026-92510](https://insights.sbomify.com/CVE-2026-92510/): RDMA/core: Fix potential use after free in ib_destroy_srq_user() (high 7.8)
- [CVE-2026-9251](https://insights.sbomify.com/CVE-2026-9251/): Missing authorization in Server (medium 5.4)
- [CVE-2026-92509](https://insights.sbomify.com/CVE-2026-92509/): RDMA/core: Fix potential use after free in counter_release() (not scored)
- [CVE-2026-92508](https://insights.sbomify.com/CVE-2026-92508/): RDMA/core: Fix potential use after free in ib_free_cq() (high 7.8)
- [CVE-2026-92507](https://insights.sbomify.com/CVE-2026-92507/): RDMA/core: Fix potential use after free in ib_dealloc_pd_user() (high 7.8)
- [CVE-2026-92506](https://insights.sbomify.com/CVE-2026-92506/): firmware: arm_scmi: Fix requested device removal race (not scored)
- [CVE-2026-92505](https://insights.sbomify.com/CVE-2026-92505/): iommu/amd: Fix undefined behavior in devid_write debugfs function (not scored)
- [CVE-2026-92504](https://insights.sbomify.com/CVE-2026-92504/): thermal: intel: int3400: clean up ODVP on probe failures (high 7.0)
- [CVE-2026-92503](https://insights.sbomify.com/CVE-2026-92503/): ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find() (not scored)
- [CVE-2026-92502](https://insights.sbomify.com/CVE-2026-92502/): ext4: clear stale xarray tags on folios skipped during writeback (not scored)
- [CVE-2026-92501](https://insights.sbomify.com/CVE-2026-92501/): ext4: drain in-flight DIO before buffered write fallback (not scored)
- [CVE-2026-92500](https://insights.sbomify.com/CVE-2026-92500/): ext4: use fsdata to track inline data write state and fix race (not scored)
- [CVE-2026-92499](https://insights.sbomify.com/CVE-2026-92499/): ext4: validate readdir offset before accessing dirent (not scored)
- [CVE-2026-92498](https://insights.sbomify.com/CVE-2026-92498/): wifi: ath6kl: avoid buffer overreads in WMI event handlers (not scored)
- [CVE-2026-92497](https://insights.sbomify.com/CVE-2026-92497/): wifi: ath12k: Avoid buffer overread in ath12k_wmi_op_rx() (not scored)
- [CVE-2026-92496](https://insights.sbomify.com/CVE-2026-92496/): wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() (not scored)
- [CVE-2026-92495](https://insights.sbomify.com/CVE-2026-92495/): RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap (not scored)
- [CVE-2026-92494](https://insights.sbomify.com/CVE-2026-92494/): ext4: fix buffer_head leak in ext4_init_orphan_info (not scored)
- [CVE-2026-92493](https://insights.sbomify.com/CVE-2026-92493/): cpufreq: amd-pstate-ut: Skip tests when amd-pstate driver is not active (not scored)
- [CVE-2026-92492](https://insights.sbomify.com/CVE-2026-92492/): cpufreq/amd-pstate: handle missing policy in dynamic EPP callbacks (not scored)
- [CVE-2026-92491](https://insights.sbomify.com/CVE-2026-92491/): firmware: arm_scmi: Roll back partial protocol table registration (not scored)
- [CVE-2026-92490](https://insights.sbomify.com/CVE-2026-92490/): firmware: arm_scmi: Unrequest devices if driver registration fails (not scored)
- [CVE-2026-9249](https://insights.sbomify.com/CVE-2026-9249/): Auth bypass in Server (low 3.1)
- [CVE-2026-92489](https://insights.sbomify.com/CVE-2026-92489/): xfrm: Fix skb double-free in xfrm_dev_direct_output() (critical 9.8)
- [CVE-2026-92488](https://insights.sbomify.com/CVE-2026-92488/): RDMA/erdma: complete object teardown when the destroy command fails (high 7.0)
- [CVE-2026-92487](https://insights.sbomify.com/CVE-2026-92487/): exfat: fix valid_size extension over a shared writable mapping (not scored)
- [CVE-2026-92486](https://insights.sbomify.com/CVE-2026-92486/): bpf: Fix CFI mismatch in task work callback (not scored)
- [CVE-2026-92485](https://insights.sbomify.com/CVE-2026-92485/): bpf: Fix WARNING in bpf_tracing_link_release (high 7.8)
- [CVE-2026-92484](https://insights.sbomify.com/CVE-2026-92484/): cxl/region: Fix use-after-free in find_pos_and_ways() error path (not scored)
- [CVE-2026-92483](https://insights.sbomify.com/CVE-2026-92483/): liveupdate: Remember FLB retrieve() status (not scored)
- [CVE-2026-92482](https://insights.sbomify.com/CVE-2026-92482/): pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip (not scored)
- [CVE-2026-92481](https://insights.sbomify.com/CVE-2026-92481/): pinctrl: mediatek: free EINT resources on unbind (not scored)
- [CVE-2026-92480](https://insights.sbomify.com/CVE-2026-92480/): scsi: ufs: core: Validate string descriptors (not scored)
- [CVE-2026-9248](https://insights.sbomify.com/CVE-2026-9248/): Missing authorization in Server (low 2.6)
- [CVE-2026-92479](https://insights.sbomify.com/CVE-2026-92479/): scsi: ufs: Avoid NULL CQE dereference when reporting invalid tags (not scored)
- [CVE-2026-92478](https://insights.sbomify.com/CVE-2026-92478/): scsi: ufs: core: Validate connected lane counts (not scored)
- [CVE-2026-92477](https://insights.sbomify.com/CVE-2026-92477/): scsi: ufs: debugfs: Reserve space for a string terminator (not scored)
- [CVE-2026-92476](https://insights.sbomify.com/CVE-2026-92476/): crypto: keembay - Initialize completion before requesting IRQ (not scored)
- [CVE-2026-92475](https://insights.sbomify.com/CVE-2026-92475/): GPAC downloader.c wait_for_header_and_parse out-of-bounds (medium 4.8)
- [CVE-2026-92474](https://insights.sbomify.com/CVE-2026-92474/): GPAC Proto Link mpeg4_inline.c gf_inline_get_proto_lib use after free (medium 4.8)
- [CVE-2026-92473](https://insights.sbomify.com/CVE-2026-92473/): GPAC BIFS commands.c gf_sg_command_del use after free (medium 4.8)
- [CVE-2026-92472](https://insights.sbomify.com/CVE-2026-92472/): GPAC MP4Box base_scenegraph.c gf_node_deactivate_ex use after free (medium 4.8)
- [CVE-2026-92470](https://insights.sbomify.com/CVE-2026-92470/): Missing Authorization in GitLab (high 7.7)
- [CVE-2026-9247](https://insights.sbomify.com/CVE-2026-9247/): Security feature bypass in Server (low 2.4)
- [CVE-2026-92469](https://insights.sbomify.com/CVE-2026-92469/): microservices-platform through 6.0.0 Arbitrary File Deletion via Missing Ownership Check (high 7.2)
- [CVE-2026-92468](https://insights.sbomify.com/CVE-2026-92468/): microservices-platform through 6.0.0 Arbitrary Elasticsearch Index Read via search-center (high 7.1)
- [CVE-2026-92467](https://insights.sbomify.com/CVE-2026-92467/): microservices-platform through 6.0.0 Unverified Password Change via /users/password (high 8.7)
- [CVE-2026-92466](https://insights.sbomify.com/CVE-2026-92466/): microservices-platform through 6.0.0 Missing Authorization via Disabled URL Permission Checking (high 8.7)
- [CVE-2026-92465](https://insights.sbomify.com/CVE-2026-92465/): WordPress WP Mega Menu plugin <= 1.4.2 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-92464](https://insights.sbomify.com/CVE-2026-92464/): Adobe Commerce | Improper Input Validation (CWE-20) (critical 9.1)
- [CVE-2026-92463](https://insights.sbomify.com/CVE-2026-92463/): yshop-crm through 2.1.3 Missing Authorization via Disabled Annotation on System User Listing (high 7.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/248/