# Vulnerabilities published in 2026


- [CVE-2026-87141](https://insights.sbomify.com/CVE-2026-87141/): Missing authorization in Oracle Hyperion Data Relationship Management (high 7.7)
- [CVE-2026-87140](https://insights.sbomify.com/CVE-2026-87140/): Privilege escalation in Oracle Hyperion Data Relationship Management (high 7.5)
- [CVE-2026-8714](https://insights.sbomify.com/CVE-2026-8714/): Denial-of-Service Vulnerability in RTSP Input Handling on TP-Link's Tapo C520WS (high 7.1)
- [CVE-2026-87139](https://insights.sbomify.com/CVE-2026-87139/): Privilege escalation in Oracle Hyperion Data Relationship Management (high 7.5)
- [CVE-2026-87138](https://insights.sbomify.com/CVE-2026-87138/): Denial of service in Oracle Hyperion Data Relationship Management (high 7.5)
- [CVE-2026-87137](https://insights.sbomify.com/CVE-2026-87137/): Missing authorization in Oracle Hyperion Data Relationship Management (high 7.6)
- [CVE-2026-87136](https://insights.sbomify.com/CVE-2026-87136/): Missing authorization in Oracle Hyperion Data Relationship Management (high 7.5)
- [CVE-2026-87135](https://insights.sbomify.com/CVE-2026-87135/): Missing authorization in Oracle Hyperion Data Relationship Management (high 7.1)
- [CVE-2026-87134](https://insights.sbomify.com/CVE-2026-87134/): Missing authorization in Oracle Hyperion Data Relationship Management (high 7.7)
- [CVE-2026-87133](https://insights.sbomify.com/CVE-2026-87133/): Missing authorization in Oracle Hyperion Data Relationship Management (high 7.6)
- [CVE-2026-87132](https://insights.sbomify.com/CVE-2026-87132/): Cross-site request forgery in Oracle Hyperion Data Relationship Management (high 7.6)
- [CVE-2026-87131](https://insights.sbomify.com/CVE-2026-87131/): Missing authorization in Oracle Hyperion Data Relationship Management (high 7.6)
- [CVE-2026-87130](https://insights.sbomify.com/CVE-2026-87130/): Missing authorization in Oracle Hyperion Data Relationship Management (high 7.4)
- [CVE-2026-8713](https://insights.sbomify.com/CVE-2026-8713/): Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion via Form Entry Value (critical 9.1)
- [CVE-2026-87129](https://insights.sbomify.com/CVE-2026-87129/): Auth bypass in Oracle Hyperion Data Relationship Management (critical 9.1)
- [CVE-2026-87128](https://insights.sbomify.com/CVE-2026-87128/): Auth bypass in Oracle Hyperion Data Relationship Management (critical 9.1)
- [CVE-2026-87127](https://insights.sbomify.com/CVE-2026-87127/): Information disclosure in Oracle Purchasing (high 7.7)
- [CVE-2026-87126](https://insights.sbomify.com/CVE-2026-87126/): Denial of service in Oracle Report Manager (high 7.1)
- [CVE-2026-87125](https://insights.sbomify.com/CVE-2026-87125/): Missing authorization in Oracle Financials for Asia/Pacific (high 8.3)
- [CVE-2026-87124](https://insights.sbomify.com/CVE-2026-87124/): Missing authorization in Oracle iRecruitment (high 7.7)
- [CVE-2026-87123](https://insights.sbomify.com/CVE-2026-87123/): hbs vulnerable to Denial of Service via unhandled exception in async helper output escaping (medium 5.9)
- [CVE-2026-87121](https://insights.sbomify.com/CVE-2026-87121/): Out-of-bounds write in lwIP TCP/IP Stack MQTT Client Application (critical 9.3)
- [CVE-2026-8712](https://insights.sbomify.com/CVE-2026-8712/): Wyoming < 1.10.2 SSRF via uri Query Parameter (medium 6.9)
- [CVE-2026-87119](https://insights.sbomify.com/CVE-2026-87119/): Auth bypass in mpp (high 8.2)
- [CVE-2026-87118](https://insights.sbomify.com/CVE-2026-87118/): Botslab G980H Dashcams Out-of-bounds Write (medium 6.9)
- [CVE-2026-87117](https://insights.sbomify.com/CVE-2026-87117/): Apache Thrift: PHP `thrift_protocol` accelerator dereferences a missing container-element spec (high 8.7)
- [CVE-2026-87116](https://insights.sbomify.com/CVE-2026-87116/): Tanium addressed a server-side request forgery vulnerability in Threat Response. (medium 6.5)
- [CVE-2026-87115](https://insights.sbomify.com/CVE-2026-87115/): Path traversal in VikAppointments Services Booking Calendar (critical 9.1)
- [CVE-2026-87114](https://insights.sbomify.com/CVE-2026-87114/): Kube-compare: container:// reference extraction runs the image entrypoint and silently escalates to sudo (high 7.1)
- [CVE-2026-87113](https://insights.sbomify.com/CVE-2026-87113/): Tanium addressed an improper access controls vulnerability in Threat Response. (medium 6.3)
- [CVE-2026-87111](https://insights.sbomify.com/CVE-2026-87111/): User Registration PRO <= 6.2.9 - Unauthenticated Stored Cross-Site Scripting via HTTP Referer Header (high 7.2)
- [CVE-2026-87110](https://insights.sbomify.com/CVE-2026-87110/): Ops Manager Uncontrolled Resource Consumption in Monitoring Endpoints (medium 6.9)
- [CVE-2026-8711](https://insights.sbomify.com/CVE-2026-8711/): NGINX JavaScript vulnerability (critical 9.2)
- [CVE-2026-87109](https://insights.sbomify.com/CVE-2026-87109/): Ops Manager Sensitive MFA Enrollment Information Exposure in User Listings (medium 6.0)
- [CVE-2026-87108](https://insights.sbomify.com/CVE-2026-87108/): Ops Manager Improper Authorization in Daily Host Monitoring Retrieval (low 2.3)
- [CVE-2026-87107](https://insights.sbomify.com/CVE-2026-87107/): Consul vulnerable to an authorization bypass in the catalog deregistration path (medium 5.4)
- [CVE-2026-87106](https://insights.sbomify.com/CVE-2026-87106/): Consul vulnerable to a denial of service in the native RPC listener (medium 6.5)
- [CVE-2026-87105](https://insights.sbomify.com/CVE-2026-87105/): Tanium addressed a SQL injection vulnerability in Threat Response. (high 8.8)
- [CVE-2026-87103](https://insights.sbomify.com/CVE-2026-87103/): Security feature bypass in Acronis Cyber Protect 17 (high 7.4)
- [CVE-2026-87102](https://insights.sbomify.com/CVE-2026-87102/): Security feature bypass in Acronis Cyber Protect 17 (high 7.4)
- [CVE-2026-87101](https://insights.sbomify.com/CVE-2026-87101/): Security feature bypass in Acronis Cyber Protect 17 (medium 6.2)
- [CVE-2026-87100](https://insights.sbomify.com/CVE-2026-87100/): Security feature bypass in Acronis Cyber Protect 17 (low 3.6)
- [CVE-2026-87099](https://insights.sbomify.com/CVE-2026-87099/): Cross-site scripting in Acronis Cyber Protect 17 (medium 5.7)
- [CVE-2026-87098](https://insights.sbomify.com/CVE-2026-87098/): Missing authorization in Acronis Cyber Protect 17 (low 3.1)
- [CVE-2026-87097](https://insights.sbomify.com/CVE-2026-87097/): Information disclosure in Acronis Cyber Protect 17 (medium 5.3)
- [CVE-2026-87096](https://insights.sbomify.com/CVE-2026-87096/): Missing authorization in Acronis Cyber Infrastructure (low 3.3)
- [CVE-2026-87095](https://insights.sbomify.com/CVE-2026-87095/): Missing authorization in Acronis Cyber Infrastructure (critical 9.1)
- [CVE-2026-87093](https://insights.sbomify.com/CVE-2026-87093/): MOVEit Transfer Service Directory Writable by Local Users Enables Local Privilege Escalation (high 8.8)
- [CVE-2026-87091](https://insights.sbomify.com/CVE-2026-87091/): Welcart e-Commerce <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Settlement Notification Parameters (high 7.2)
- [CVE-2026-87090](https://insights.sbomify.com/CVE-2026-87090/): Consul vulnerable to an authorization bypass in the catalog node-write path (high 8.3)
- [CVE-2026-8709](https://insights.sbomify.com/CVE-2026-8709/): Privilege escalation in Progress MarkLogic Server REST document patch operation (critical 9.9)
- [CVE-2026-87088](https://insights.sbomify.com/CVE-2026-87088/): Tanium addressed an unauthorized code execution vulnerability in Enforce. (high 7.0)
- [CVE-2026-87086](https://insights.sbomify.com/CVE-2026-87086/): Tanium addressed a denial of service vulnerability in Provision. (high 7.5)
- [CVE-2026-87085](https://insights.sbomify.com/CVE-2026-87085/): Tanium addressed a SQL injection vulnerability in Provision. (medium 6.5)
- [CVE-2026-87084](https://insights.sbomify.com/CVE-2026-87084/): Tanium addressed a server-side request forgery vulnerability in Enforce. (high 7.7)
- [CVE-2026-87083](https://insights.sbomify.com/CVE-2026-87083/): tile-ai tilelang Kernel Cache kernel_cache.py KernelCache._load_kernel_from_disk deserialization (medium 5.1)
- [CVE-2026-87082](https://insights.sbomify.com/CVE-2026-87082/): Net::IDN::Punycode versions before 2.590 for Perl hang, crash or return a wrong label via unvalidated malformed UTF-8 in encode_punycode. (high 7.5)
- [CVE-2026-87081](https://insights.sbomify.com/CVE-2026-87081/): Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label before the length check in to_ascii. (high 7.5)
- [CVE-2026-87080](https://insights.sbomify.com/CVE-2026-87080/): Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decode_punycode. (critical 9.1)
- [CVE-2026-8708](https://insights.sbomify.com/CVE-2026-8708/): Genzel breadcrumbs <= 1.2 - Cross-Site Request Forgery to Settings Update via Plugin Settings Page (medium 4.3)
- [CVE-2026-87079](https://insights.sbomify.com/CVE-2026-87079/): Net::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion cost when decoding a long label in decode_punycode. (high 7.5)
- [CVE-2026-87078](https://insights.sbomify.com/CVE-2026-87078/): Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected label in decode_punycode. (critical 9.1)
- [CVE-2026-87076](https://insights.sbomify.com/CVE-2026-87076/): Tanium addressed an information disclosure vulnerability in Discover. (medium 6.5)
- [CVE-2026-87075](https://insights.sbomify.com/CVE-2026-87075/): Tanium addressed an improper access controls vulnerability in Comply. (high 8.1)
- [CVE-2026-87074](https://insights.sbomify.com/CVE-2026-87074/): Forminator Forms < 1.57.2.1 - Unauthenticated Arbitrary Recipient Email Sending with Attacker-Controlled Link (low 3.7)
- [CVE-2026-87073](https://insights.sbomify.com/CVE-2026-87073/): Tanium addressed an improper access controls vulnerability in Comply. (medium 6.5)
- [CVE-2026-87072](https://insights.sbomify.com/CVE-2026-87072/): Tanium addressed an improper access controls vulnerability in Comply. (high 7.1)
- [CVE-2026-87071](https://insights.sbomify.com/CVE-2026-87071/): Forminator Forms < 1.57.2.1 - Unauthenticated Post Meta Injection on Submitted Posts (medium 5.3)
- [CVE-2026-87070](https://insights.sbomify.com/CVE-2026-87070/): Forminator Forms < 1.57.2.1 - Unauthenticated Poll Vote Limit Bypass via IP Spoofing (medium 5.3)
- [CVE-2026-8707](https://insights.sbomify.com/CVE-2026-8707/): NS Product icon badge <= 1.2.4 - Reflected Cross-Site Scripting via PHP_SELF (medium 6.1)
- [CVE-2026-87069](https://insights.sbomify.com/CVE-2026-87069/): Forminator Forms < 1.57.2.1 - Subscriber+ Form Stripe Field Migration via migrate_stripe (low 3.1)
- [CVE-2026-87068](https://insights.sbomify.com/CVE-2026-87068/): Forminator Forms < 1.57.2.1 - Authenticated Privilege Escalation via Quiz Lead-Form Import (medium 6.6)
- [CVE-2026-87067](https://insights.sbomify.com/CVE-2026-87067/): Forminator Forms < 1.57.2.1 - Authenticated RCE via XML-RPC PHP Object Injection (high 8.5)
- [CVE-2026-8706](https://insights.sbomify.com/CVE-2026-8706/): Sensitive user data could be leaked to other applications through Reader mode (medium 6.5)
- [CVE-2026-8705](https://insights.sbomify.com/CVE-2026-8705/): ClearSale Total <= 3.4.2 - Unauthenticated SQL Injection (high 7.5)
- [CVE-2026-87048](https://insights.sbomify.com/CVE-2026-87048/): Tanium addressed an improper access controls vulnerability in Comply. (medium 5.4)
- [CVE-2026-87047](https://insights.sbomify.com/CVE-2026-87047/): Tanium addressed an improper access controls vulnerability in Comply. (medium 6.3)
- [CVE-2026-87046](https://insights.sbomify.com/CVE-2026-87046/): Tanium addressed an improper access controls vulnerability in Comply. (medium 4.3)
- [CVE-2026-8704](https://insights.sbomify.com/CVE-2026-8704/): Crypt::DSA versions through 1.19 for Perl use 2-args open, allowing existing files to be modified (medium 6.5)
- [CVE-2026-87037](https://insights.sbomify.com/CVE-2026-87037/): Tanium addressed an improper access controls vulnerability in Comply. (medium 5.4)
- [CVE-2026-87036](https://insights.sbomify.com/CVE-2026-87036/): Tanium addressed an improper access controls vulnerability in Comply. (high 8.1)
- [CVE-2026-87035](https://insights.sbomify.com/CVE-2026-87035/): Tanium addressed an information disclosure vulnerability in Comply. (medium 4.3)
- [CVE-2026-87034](https://insights.sbomify.com/CVE-2026-87034/): Tanium addressed a SQL injection vulnerability in Comply. (high 8.3)
- [CVE-2026-87033](https://insights.sbomify.com/CVE-2026-87033/): Tanium addressed an improper access controls vulnerability in Comply. (medium 5.4)
- [CVE-2026-87032](https://insights.sbomify.com/CVE-2026-87032/): Tanium addressed an information disclosure vulnerability in Tanium Server. (medium 4.3)
- [CVE-2026-87031](https://insights.sbomify.com/CVE-2026-87031/): Missing authorization in Concrete CMS (low 2.1)
- [CVE-2026-87030](https://insights.sbomify.com/CVE-2026-87030/): Tanium addressed a path traversal vulnerability in Comply. (high 8.5)
- [CVE-2026-8703](https://insights.sbomify.com/CVE-2026-8703/): Endless Scroll <= 1.0.0 - [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')] (medium 6.4)
- [CVE-2026-87029](https://insights.sbomify.com/CVE-2026-87029/): undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor (medium 5.9)
- [CVE-2026-87028](https://insights.sbomify.com/CVE-2026-87028/): Missing authorization in Concrete CMS (medium 5.3)
- [CVE-2026-87026](https://insights.sbomify.com/CVE-2026-87026/): Tanium addressed an improper access controls vulnerability in Threat Response. (low 3.8)
- [CVE-2026-87025](https://insights.sbomify.com/CVE-2026-87025/): Tanium addressed an improper access controls vulnerability in Comply. (medium 5.4)
- [CVE-2026-87024](https://insights.sbomify.com/CVE-2026-87024/): Tanium addressed a SQL injection vulnerability in Asset. (high 7.2)
- [CVE-2026-87023](https://insights.sbomify.com/CVE-2026-87023/): Tanium addressed a path traversal vulnerability in Comply. (high 8.5)
- [CVE-2026-87022](https://insights.sbomify.com/CVE-2026-87022/): Apache Tomcat: WebSocket message smuggling with per-message-deflate (high 7.5)
- [CVE-2026-87021](https://insights.sbomify.com/CVE-2026-87021/): Tanium addressed an unauthorized code execution vulnerability in Comply. (high 7.2)
- [CVE-2026-87020](https://insights.sbomify.com/CVE-2026-87020/): Orthanc DICOM Server Integer Overflow or Wraparound (high 7.2)
- [CVE-2026-8702](https://insights.sbomify.com/CVE-2026-8702/): GBI To Print <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'div' Shortcode Attribute (medium 6.4)
- [CVE-2026-87019](https://insights.sbomify.com/CVE-2026-87019/): Tanium addressed an improper access controls vulnerability in Comply. (medium 4.3)
- [CVE-2026-87018](https://insights.sbomify.com/CVE-2026-87018/): undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/293/