# Vulnerabilities published in 2026


- [CVE-2026-85443](https://insights.sbomify.com/CVE-2026-85443/): MOOS core-moos through 10.4.0 MOOSDB Accept Loop Denial of Service (high 8.7)
- [CVE-2026-85442](https://insights.sbomify.com/CVE-2026-85442/): MOOS core-moos through 10.4.0 MOOSDB Denial of Service via Unbounded Packet Allocation (high 8.7)
- [CVE-2026-85441](https://insights.sbomify.com/CVE-2026-85441/): MOOS core-moos through 10.4.0 MOOSDB Denial of Service via Negative Serialized String Length (high 8.7)
- [CVE-2026-85440](https://insights.sbomify.com/CVE-2026-85440/): MOOS core-moos through 10.4.0 MOOSDB Pre-Authentication Heap Overflow via Negative Packet Length (critical 9.3)
- [CVE-2026-8544](https://insights.sbomify.com/CVE-2026-8544/): Use after free in Chrome (high 8.8)
- [CVE-2026-85439](https://insights.sbomify.com/CVE-2026-85439/): MOOS-IvP through 24.8.1 alogsplit Command Injection via Input Pathname (high 8.5)
- [CVE-2026-85438](https://insights.sbomify.com/CVE-2026-85438/): MOOS-IvP through 24.8.1 Out-of-Bounds Write via Unvalidated IvP Payload Counts (critical 9.3)
- [CVE-2026-85437](https://insights.sbomify.com/CVE-2026-85437/): MOOS-IvP through 24.8.1 Buffer Overflow in IvP Function String Decoders (critical 9.3)
- [CVE-2026-85436](https://insights.sbomify.com/CVE-2026-85436/): MOOS essential-moos through 10.0.1 pMOOSBridge Heap Corruption via Negative UDP Length (high 8.7)
- [CVE-2026-85435](https://insights.sbomify.com/CVE-2026-85435/): MOOS-IvP through 24.8.1 uFldNodeBroker Unauthenticated Shore Route Enrollment (critical 9.3)
- [CVE-2026-85434](https://insights.sbomify.com/CVE-2026-85434/): MOOS-IvP through 24.8.1 uFldShoreBroker Bridge Route Injection via Unverified Node Ping (critical 9.3)
- [CVE-2026-85433](https://insights.sbomify.com/CVE-2026-85433/): MOOS essential-moos through 10.0.1 pShare Unauthorized Runtime Route Reconfiguration (critical 9.3)
- [CVE-2026-85432](https://insights.sbomify.com/CVE-2026-85432/): MOOS core-moos through 10.4.0 MOOSDB Message Source Spoofing via Wire Identity (high 8.8)
- [CVE-2026-85431](https://insights.sbomify.com/CVE-2026-85431/): MOOS essential-moos through 10.0.1 pMOOSBridge Unauthenticated UDP Packet Injection (high 8.7)
- [CVE-2026-85430](https://insights.sbomify.com/CVE-2026-85430/): MOOS essential-moos through 10.0.1 pShare Unauthenticated UDP Datagram Republishing (high 8.8)
- [CVE-2026-8543](https://insights.sbomify.com/CVE-2026-8543/): Memory corruption in Chrome (medium 5.3)
- [CVE-2026-85429](https://insights.sbomify.com/CVE-2026-85429/): MOOS-IvP through 24.8.1 uFldNodeComms Node Message Source Spoofing (high 8.7)
- [CVE-2026-85428](https://insights.sbomify.com/CVE-2026-85428/): MOOS core-moos through 10.4.0 MOOSDB HTTP Server Unauthenticated Variable Write (critical 9.3)
- [CVE-2026-85427](https://insights.sbomify.com/CVE-2026-85427/): MOOS essential-moos through 10.0.1 pAntler Remote Code Execution via Unauthenticated MISSION_FILE (critical 9.2)
- [CVE-2026-85426](https://insights.sbomify.com/CVE-2026-85426/): MOOS-IvP through 24.8.1 uMemWatch Command Injection via MOOS Client Names (critical 9.3)
- [CVE-2026-85425](https://insights.sbomify.com/CVE-2026-85425/): MOOS-IvP through 24.8.1 iSay Command Injection via SAY_MOOS (critical 9.3)
- [CVE-2026-85424](https://insights.sbomify.com/CVE-2026-85424/): MOOS core-moos through 10.4.0 Missing Authentication for MOOSDB Publish, Subscribe and DB_CLEAR (critical 9.3)
- [CVE-2026-85423](https://insights.sbomify.com/CVE-2026-85423/): Missing authorization in Brocade Active Support Connectivity Gateway (high 8.6)
- [CVE-2026-85422](https://insights.sbomify.com/CVE-2026-85422/): Hardcoded credentials in Brocade Active Support Connectivity Gateway (high 8.4)
- [CVE-2026-85421](https://insights.sbomify.com/CVE-2026-85421/): Missing authorization in Brocade Active Support Connectivity Gateway (high 8.7)
- [CVE-2026-8542](https://insights.sbomify.com/CVE-2026-8542/): Use after free in Chrome (high 8.3)
- [CVE-2026-85418](https://insights.sbomify.com/CVE-2026-85418/): Orbit Fox < 3.0.9 - Contributor+ Stored XSS via Beaver Builder Pricing Table Widget (medium 5.4)
- [CVE-2026-85417](https://insights.sbomify.com/CVE-2026-85417/): Incomplete property masking in the SANnav logging subsystem (medium 6.4)
- [CVE-2026-85415](https://insights.sbomify.com/CVE-2026-85415/): Audio Player Block 1.1.0 - 1.6.2 - Contributor+ Stored XSS via Audio Download URL (medium 6.8)
- [CVE-2026-85414](https://insights.sbomify.com/CVE-2026-85414/): Cross-site scripting in Gallery : FooGallery (medium 6.4)
- [CVE-2026-85410](https://insights.sbomify.com/CVE-2026-85410/): Missing authorization in Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits (high 8.1)
- [CVE-2026-8541](https://insights.sbomify.com/CVE-2026-8541/): Memory corruption in Chrome (medium 5.3)
- [CVE-2026-85409](https://insights.sbomify.com/CVE-2026-85409/): Eleveo Quality Management Questionnaire Service QuestionnaireService.runDataExportNow path traversal (medium 5.3)
- [CVE-2026-85408](https://insights.sbomify.com/CVE-2026-85408/): Eleveo Quality Management Conversation events dynamically-determined object attributes (medium 5.3)
- [CVE-2026-85407](https://insights.sbomify.com/CVE-2026-85407/): Eleveo Quality Management Conversation events denial of service (medium 5.3)
- [CVE-2026-85406](https://insights.sbomify.com/CVE-2026-85406/): Eleveo Quality Management Conversation Review cross site scripting (medium 5.1)
- [CVE-2026-85405](https://insights.sbomify.com/CVE-2026-85405/): Eleveo Call Recording Software roleAddAction.do cross site scripting (medium 5.1)
- [CVE-2026-85403](https://insights.sbomify.com/CVE-2026-85403/): code-projects Doctor Appointment System contactus.php sql injection (medium 6.9)
- [CVE-2026-85402](https://insights.sbomify.com/CVE-2026-85402/): code-projects Doctor Appointment System booking.php sql injection (medium 6.9)
- [CVE-2026-85401](https://insights.sbomify.com/CVE-2026-85401/): Dolibarr Legacy File Manager config.inc.php access control (medium 5.3)
- [CVE-2026-85400](https://insights.sbomify.com/CVE-2026-85400/): TYPO3 CMS - Missing Authorization in lowlevel commands (high 7.5)
- [CVE-2026-8540](https://insights.sbomify.com/CVE-2026-8540/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-85399](https://insights.sbomify.com/CVE-2026-85399/): code-projects Hospital Information System PrespController.php getSinglePresp sql injection (medium 6.9)
- [CVE-2026-85398](https://insights.sbomify.com/CVE-2026-85398/): code-projects Hospital Information System viewReq.php viewReq sql injection (medium 6.9)
- [CVE-2026-85397](https://insights.sbomify.com/CVE-2026-85397/): code-projects Hospital Information System addReq.php findBySearch sql injection (medium 6.9)
- [CVE-2026-85396](https://insights.sbomify.com/CVE-2026-85396/): rubyzip before 3.4.0 Path Traversal in Zip::Entry#extract via Sibling-Directory Prefix (high 8.7)
- [CVE-2026-85395](https://insights.sbomify.com/CVE-2026-85395/): UnoPim before 2.1.3 Missing Authorization on Integration Management Routes (high 7.1)
- [CVE-2026-85394](https://insights.sbomify.com/CVE-2026-85394/): python-jose through 3.5.0 Algorithm Confusion via DER-encoded Public Key as HMAC Secret (critical 9.3)
- [CVE-2026-85393](https://insights.sbomify.com/CVE-2026-85393/): node-forge through 1.4.0 RSA PKCS#1 v1.5 Signature Forgery via Nested DigestAlgorithm Padding (high 8.7)
- [CVE-2026-85392](https://insights.sbomify.com/CVE-2026-85392/): Peppermint through 0.5.5 Authorization Bypass on the User Logout Endpoint (medium 5.3)
- [CVE-2026-85391](https://insights.sbomify.com/CVE-2026-85391/): Peppermint through 0.5.5 Use of Hard-coded JWT Signing Secret in docker-compose.yml (critical 9.3)
- [CVE-2026-85390](https://insights.sbomify.com/CVE-2026-85390/): Checkmate through 3.11.0 Missing Authorization on Maintenance Window, Notification, and Check Deletion Routes (high 7.1)
- [CVE-2026-8539](https://insights.sbomify.com/CVE-2026-8539/): Cross-site scripting in Chrome (medium 5.4)
- [CVE-2026-85389](https://insights.sbomify.com/CVE-2026-85389/): Worklenz before 3.0.0 Authorization Bypass on Task-Scoped Endpoints (high 7.1)
- [CVE-2026-85388](https://insights.sbomify.com/CVE-2026-85388/): Worklenz through 3.0.0 SQL Injection via the sort-field Query Parameter (high 8.6)
- [CVE-2026-85387](https://insights.sbomify.com/CVE-2026-85387/): Concrete CMS before 9.5.4 allows a deactivated user to retain OAuth-authenticated REST API access (low 2.0)
- [CVE-2026-85386](https://insights.sbomify.com/CVE-2026-85386/): Cross-site scripting in Concrete CMS (high 7.3)
- [CVE-2026-85385](https://insights.sbomify.com/CVE-2026-85385/): Concrete CMS below 9.5.4 is vulnerable to Stored XSS via User Timezone Field (high 7.7)
- [CVE-2026-85384](https://insights.sbomify.com/CVE-2026-85384/): Authenticated Stack-Based Buffer Overflow in RE210 AC750 Configuration Import (high 8.5)
- [CVE-2026-85383](https://insights.sbomify.com/CVE-2026-85383/): itsourcecode Sales and Inventory System inv_del.php sql injection (medium 5.3)
- [CVE-2026-85382](https://insights.sbomify.com/CVE-2026-85382/): light0011 cms Chapter Content Output oneChapter.tpl htmlspecialchars_decode cross site scripting (medium 5.3)
- [CVE-2026-85381](https://insights.sbomify.com/CVE-2026-85381/): light0011 cms Chapter Controller ChapterController.class.php authorization (medium 6.9)
- [CVE-2026-85380](https://insights.sbomify.com/CVE-2026-85380/): light0011 cms UEditor controller.php catchimage server-side request forgery (medium 6.9)
- [CVE-2026-8538](https://insights.sbomify.com/CVE-2026-8538/): Denial of service in Chrome (medium 5.3)
- [CVE-2026-85379](https://insights.sbomify.com/CVE-2026-85379/): light0011 cms Query Builder ChapterController.class.php searchChapter sql injection (medium 6.9)
- [CVE-2026-85378](https://insights.sbomify.com/CVE-2026-85378/): light0011 cms Chapter Controller ChapterController.class.php _initialize authorization (medium 6.9)
- [CVE-2026-85377](https://insights.sbomify.com/CVE-2026-85377/): Windows CD-ROM Driver Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-85376](https://insights.sbomify.com/CVE-2026-85376/): Windows Print Spooler Components Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-85375](https://insights.sbomify.com/CVE-2026-85375/): Windows Universal Plug and Play (UPnP) Device Host Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-85374](https://insights.sbomify.com/CVE-2026-85374/): Windows Installer Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-85373](https://insights.sbomify.com/CVE-2026-85373/): Windows Universal Plug and Play (UPnP) Device Host Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-85372](https://insights.sbomify.com/CVE-2026-85372/): Windows Kernel Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-85371](https://insights.sbomify.com/CVE-2026-85371/): Network Policy Server (NPS) Remote Code Execution Vulnerability (high 8.1)
- [CVE-2026-85370](https://insights.sbomify.com/CVE-2026-85370/): WebDAV Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-8537](https://insights.sbomify.com/CVE-2026-8537/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2026-85369](https://insights.sbomify.com/CVE-2026-85369/): Windows Hyper-V Elevation of Privilege Vulnerability (high 8.2)
- [CVE-2026-85368](https://insights.sbomify.com/CVE-2026-85368/): Windows TCP/IP Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-85367](https://insights.sbomify.com/CVE-2026-85367/): Windows Cash Drawer Protocol Provider Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-85366](https://insights.sbomify.com/CVE-2026-85366/): Windows Installer Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-85365](https://insights.sbomify.com/CVE-2026-85365/): Servicing Stack Updates Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-85364](https://insights.sbomify.com/CVE-2026-85364/): Windows Installer Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-85363](https://insights.sbomify.com/CVE-2026-85363/): .NET Framework Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-85362](https://insights.sbomify.com/CVE-2026-85362/): Windows Management Instrumentation Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-85361](https://insights.sbomify.com/CVE-2026-85361/): Windows Installer Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-85360](https://insights.sbomify.com/CVE-2026-85360/): Windows Kernel Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-8536](https://insights.sbomify.com/CVE-2026-8536/): Security feature bypass in Chrome (low 3.1)
- [CVE-2026-85359](https://insights.sbomify.com/CVE-2026-85359/): Windows Performance Monitor Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-85358](https://insights.sbomify.com/CVE-2026-85358/): Windows Installer Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-85357](https://insights.sbomify.com/CVE-2026-85357/): Windows Phone Service Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-85356](https://insights.sbomify.com/CVE-2026-85356/): Windows Volume Manager Extension Driver Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-85355](https://insights.sbomify.com/CVE-2026-85355/): Windows Common Log File System Driver Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-85354](https://insights.sbomify.com/CVE-2026-85354/): Windows Error Reporting Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-85353](https://insights.sbomify.com/CVE-2026-85353/): Windows Print Spooler Components Information Disclosure Vulnerability (high 7.5)
- [CVE-2026-85352](https://insights.sbomify.com/CVE-2026-85352/): Windows Device Association Service Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-85350](https://insights.sbomify.com/CVE-2026-85350/): UpsellWP < 2.2.10 - Unauthenticated Price Manipulation via Frequently Bought Together (medium 5.3)
- [CVE-2026-8535](https://insights.sbomify.com/CVE-2026-8535/): Memory corruption in Chrome (medium 5.3)
- [CVE-2026-85349](https://insights.sbomify.com/CVE-2026-85349/): FluentBoards < 2.0.15 - Subscriber+ Private Board Membership Disclosure via IDOR (medium 4.3)
- [CVE-2026-85348](https://insights.sbomify.com/CVE-2026-85348/): GDPR Data Request Form 1.5 - 1.7.1 - DPO Email Update via CSRF (medium 4.3)
- [CVE-2026-85345](https://insights.sbomify.com/CVE-2026-85345/): FV Player 7.5.44.7212 - 7.5.54.7212 - Contributor+ SSRF via retrieve_video_data (medium 4.1)
- [CVE-2026-85343](https://insights.sbomify.com/CVE-2026-85343/): Windows Hyper-V Elevation of Privilege Vulnerability (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/307/