# Vulnerabilities published in 2026


- [CVE-2026-84270](https://insights.sbomify.com/CVE-2026-84270/): Gvfs: mtp: out-of-bounds read in do_read() (medium 4.3)
- [CVE-2026-8427](https://insights.sbomify.com/CVE-2026-8427/): Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file removeFavoriteFolder($id) (low 2.3)
- [CVE-2026-84269](https://insights.sbomify.com/CVE-2026-84269/): Gvfs: afp: heap-based buffer overflow in dsi read path (medium 6.5)
- [CVE-2026-84268](https://insights.sbomify.com/CVE-2026-84268/): Gvfs: sftp: heap-based buffer overflow in read_reply() (high 8.8)
- [CVE-2026-84267](https://insights.sbomify.com/CVE-2026-84267/): Gvfs: sftp: uninitialized heap disclosure in read_string() (medium 4.3)
- [CVE-2026-84261](https://insights.sbomify.com/CVE-2026-84261/): click5 CRM add-on to Contact Form 7 <= 1.0.4 - Unauthenticated Stored XSS via post_notifications (high 8.8)
- [CVE-2026-84260](https://insights.sbomify.com/CVE-2026-84260/): click5 CRM add-on to Gravity Forms <= 1.0.3 - Unauthenticated Stored XSS via post_notifications (high 8.8)
- [CVE-2026-8426](https://insights.sbomify.com/CVE-2026-8426/): Concrete CMS does not validate a CSRF token before processing requests to `/dashboard/extend/update/prepare_remote_upgrade/<remoteMPID>` (high 7.5)
- [CVE-2026-84259](https://insights.sbomify.com/CVE-2026-84259/): click5 CRM add-on to WPForms <= 1.0.3 - Unauthenticated Stored XSS via post_notifications (high 8.8)
- [CVE-2026-84258](https://insights.sbomify.com/CVE-2026-84258/): click5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Stored XSS via post_notifications (high 8.8)
- [CVE-2026-84256](https://insights.sbomify.com/CVE-2026-84256/): Command injection in OpenVPN (high 7.7)
- [CVE-2026-84254](https://insights.sbomify.com/CVE-2026-84254/): click5 CRM add-on to Contact Form 7 <= 1.0.4 - Unauthenticated Arbitrary Options Update (critical 9.8)
- [CVE-2026-84253](https://insights.sbomify.com/CVE-2026-84253/): click5 CRM add-on to Gravity Forms <= 1.0.3 - Unauthenticated Arbitrary Options Update (critical 9.8)
- [CVE-2026-84252](https://insights.sbomify.com/CVE-2026-84252/): click5 CRM add-on to WPForms <= 1.0.3 - Unauthenticated Arbitrary Options Update (critical 9.8)
- [CVE-2026-84251](https://insights.sbomify.com/CVE-2026-84251/): click5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Arbitrary Options Update (critical 9.8)
- [CVE-2026-84250](https://insights.sbomify.com/CVE-2026-84250/): IBM Guardium Data Protection Hard-coded Credentials (high 8.4)
- [CVE-2026-8425](https://insights.sbomify.com/CVE-2026-8425/): Notify Odoo <= 1.0.1 - Cross-Site Request Forgery to Settings Update (medium 4.3)
- [CVE-2026-84249](https://insights.sbomify.com/CVE-2026-84249/): IBM Guardium Data Protection is affected by vulnerability (critical 9.8)
- [CVE-2026-84247](https://insights.sbomify.com/CVE-2026-84247/): IBM Guardium Data Protection is affected by multiple vulnerabilities. (high 8.1)
- [CVE-2026-84246](https://insights.sbomify.com/CVE-2026-84246/): Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection (high 8.1)
- [CVE-2026-84245](https://insights.sbomify.com/CVE-2026-84245/): IBM Guardium Data Protection Privilege Escalation (high 7.8)
- [CVE-2026-84244](https://insights.sbomify.com/CVE-2026-84244/): IBM Guardium Data Protection Cross-Site Scripting (critical 9.3)
- [CVE-2026-84241](https://insights.sbomify.com/CVE-2026-84241/): IBM Guardium Data Protection is affected by multiple vulnerabilities. (high 8.1)
- [CVE-2026-8424](https://insights.sbomify.com/CVE-2026-8424/): Remove Yellow BGBOX <= 1.0 - Cross-Site Request Forgery (medium 4.3)
- [CVE-2026-84239](https://insights.sbomify.com/CVE-2026-84239/): IBM Guardium Data Protection is affected by multiple vulnerabilities. (high 7.6)
- [CVE-2026-84238](https://insights.sbomify.com/CVE-2026-84238/): WordPress YITH Request a Quote for WooCommerce Premium plugin < 4.46.0 - Broken Access Control vulnerability (critical 9.8)
- [CVE-2026-84235](https://insights.sbomify.com/CVE-2026-84235/): Rockwell Automation 1756-ENBT Denial of Service Vulnerability (high 8.7)
- [CVE-2026-84233](https://insights.sbomify.com/CVE-2026-84233/): Rpm: command execution via macro expansion in `rpmuncompress -x` for crafted `.gem` filenames (high 7.0)
- [CVE-2026-84232](https://insights.sbomify.com/CVE-2026-84232/): Pulpcore: python-pulpcore: stored cross-site scripting via inline rendering of uploaded html/svg content (medium 5.4)
- [CVE-2026-84230](https://insights.sbomify.com/CVE-2026-84230/): IBM Guardium Data Protection is affected by multiple vulnerabilities (high 7.5)
- [CVE-2026-8423](https://insights.sbomify.com/CVE-2026-8423/): JaviBola Custom Theme Test <= 2.0.5 - Cross-Site Request Forgery (medium 4.3)
- [CVE-2026-84226](https://insights.sbomify.com/CVE-2026-84226/): Privilege escalation in OpenVPN (high 8.5)
- [CVE-2026-84225](https://insights.sbomify.com/CVE-2026-84225/): Kirki 6.0.0 - 6.2.5 - Authenticated Collaboration Comment Status Modification via IDOR (low 2.2)
- [CVE-2026-84224](https://insights.sbomify.com/CVE-2026-84224/): Kirki < 6.3.2 - Editor+ Blind SSRF via Remote Template URL (medium 4.1)
- [CVE-2026-84223](https://insights.sbomify.com/CVE-2026-84223/): Kirki 6.0.0 - 6.3.0 - Author+ Stored XSS via Unsanitized SVG Upload (medium 6.8)
- [CVE-2026-84222](https://insights.sbomify.com/CVE-2026-84222/): Kirki 6.2.1 - 6.2.5 - Unauthenticated Non-Public Post Content Disclosure via 'kirki_data' Parameter (medium 5.3)
- [CVE-2026-84221](https://insights.sbomify.com/CVE-2026-84221/): Kirki 6.0.0 - 6.2.5 - Editor+ SQLi via Content Manager Field ID (medium 6.8)
- [CVE-2026-84220](https://insights.sbomify.com/CVE-2026-84220/): Kirki < 6.3.2 - Unauthenticated Arbitrary Shortcode Execution via Comments Collection (medium 4.8)
- [CVE-2026-8422](https://insights.sbomify.com/CVE-2026-8422/): Remove meta boxes per user role <= 1.01 - Cross-Site Request Forgery to Settings Update (medium 4.3)
- [CVE-2026-84219](https://insights.sbomify.com/CVE-2026-84219/): Kirki 6.2.1 - 6.2.5 - Unauthenticated Stored XSS via HTML Entity Decoding (high 7.5)
- [CVE-2026-84218](https://insights.sbomify.com/CVE-2026-84218/): Org.jolokia/jolokia-core: incomplete jndi denylist in jolokia jsr-160 proxy (bypass of cve-2018-1000130 fix) (high 8.1)
- [CVE-2026-84217](https://insights.sbomify.com/CVE-2026-84217/): WordPress Classified Listing plugin <= 6.1.3 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-84215](https://insights.sbomify.com/CVE-2026-84215/): WordPress Timetics plugin <= 1.0.61 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-8421](https://insights.sbomify.com/CVE-2026-8421/): Concrete CMS 9.5.0 and below is vulnerable to CSRF on install_package() with conditional token bypass leading to RCE (high 7.5)
- [CVE-2026-84209](https://insights.sbomify.com/CVE-2026-84209/): IBM Guardium Data Protection is affected by multiple vulnerabilities. (high 8.1)
- [CVE-2026-84208](https://insights.sbomify.com/CVE-2026-84208/): AVideo User_Location Plugin Unauthenticated SQL Injection (high 8.7)
- [CVE-2026-84207](https://insights.sbomify.com/CVE-2026-84207/): Heym before 0.0.98 SSRF via WebSocket endpoints (medium 5.3)
- [CVE-2026-84206](https://insights.sbomify.com/CVE-2026-84206/): Snipe-IT before 8.7.0 Authorization Bypass via Bulk Restore (medium 5.3)
- [CVE-2026-84205](https://insights.sbomify.com/CVE-2026-84205/): GROWI through 8.0.2 Authorization Bypass Through User-Controlled Key on apiv3 Revision Retrieval (high 7.1)
- [CVE-2026-84204](https://insights.sbomify.com/CVE-2026-84204/): GROWI through 8.0.2 Missing Authorization on apiv3 Attachment Retrieval (high 7.1)
- [CVE-2026-84203](https://insights.sbomify.com/CVE-2026-84203/): Memos 0.26.0 through 0.30.0 Insufficient Session Expiration on Password Change (high 8.6)
- [CVE-2026-84202](https://insights.sbomify.com/CVE-2026-84202/): ModelScope through 1.40.0 Unsafe YAML Deserialization in Model Config Loading (high 8.7)
- [CVE-2026-84201](https://insights.sbomify.com/CVE-2026-84201/): appium-mcp-server through 0.1.61 Path Traversal in write_file and write_files_batch (medium 6.9)
- [CVE-2026-84200](https://insights.sbomify.com/CVE-2026-84200/): Kyverno before v1.13.0 Policy Bypass via Multiple Exceptions (critical 9.4)
- [CVE-2026-8420](https://insights.sbomify.com/CVE-2026-8420/): BLOGCHAT Chat System <= 1.3.6.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Update (medium 6.1)
- [CVE-2026-84199](https://insights.sbomify.com/CVE-2026-84199/): Kyverno before 1.16.2 SSRF via APICall Feature (medium 6.9)
- [CVE-2026-84198](https://insights.sbomify.com/CVE-2026-84198/): Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection (high 8.1)
- [CVE-2026-84197](https://insights.sbomify.com/CVE-2026-84197/): Security feature bypass in Eclipse Ditto (critical 9.2)
- [CVE-2026-84196](https://insights.sbomify.com/CVE-2026-84196/): Kyverno before 1.18.0 Server-Side Request Forgery via apiCall (high 8.3)
- [CVE-2026-84195](https://insights.sbomify.com/CVE-2026-84195/): Kyverno before 1.16.4 Credential Leak via apiCall (high 8.3)
- [CVE-2026-84194](https://insights.sbomify.com/CVE-2026-84194/): LibreNMS 23.10.0 before 26.4.0 OS Command Injection via Hostname (high 8.6)
- [CVE-2026-84193](https://insights.sbomify.com/CVE-2026-84193/): LibreNMS through 26.2.0 Stored Cross-Site Scripting via SNMP (medium 5.8)
- [CVE-2026-84192](https://insights.sbomify.com/CVE-2026-84192/): LibreNMS before 26.3.1 Stored XSS via SNMP/Syslog Data (high 7.1)
- [CVE-2026-84191](https://insights.sbomify.com/CVE-2026-84191/): LibreNMS before 26.5.0 Stored XSS via SNMP VRF fields (medium 5.3)
- [CVE-2026-84190](https://insights.sbomify.com/CVE-2026-84190/): LibreNMS before 26.5.0 Remote Code Execution via AboutController (high 8.7)
- [CVE-2026-8419](https://insights.sbomify.com/CVE-2026-8419/): Amazon Scraper <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Update (medium 4.3)
- [CVE-2026-84189](https://insights.sbomify.com/CVE-2026-84189/): LibreNMS before 26.7.0 Stored XSS via Oxidized API (critical 9.2)
- [CVE-2026-84188](https://insights.sbomify.com/CVE-2026-84188/): librenms before 26.7.0 Stored XSS via graph_descr settings (medium 4.8)
- [CVE-2026-84187](https://insights.sbomify.com/CVE-2026-84187/): AVideo on_publish.php Missing Authentication Check via RTMP Callback (high 8.8)
- [CVE-2026-84186](https://insights.sbomify.com/CVE-2026-84186/): Incorrect access control in PrestaShop (medium 6.9)
- [CVE-2026-84185](https://insights.sbomify.com/CVE-2026-84185/): Jwcrypto: jwcrypto: general json jws kid binding bypass during jwkset verification (medium 5.9)
- [CVE-2026-84181](https://insights.sbomify.com/CVE-2026-84181/): Apache Camel: Camel-Shiro Authentication Bypass via Skipped Credential Verification on Subject Reuse (medium 5.9)
- [CVE-2026-84180](https://insights.sbomify.com/CVE-2026-84180/): Apache Camel: Camel-Knative Information Disclosure via Unmuted Consumer Exceptions (medium 5.3)
- [CVE-2026-8418](https://insights.sbomify.com/CVE-2026-8418/): Games Catalog <= 1.2.0 - Cross-Site Request Forgery to Arbitrary Game/Post Deletion (medium 4.3)
- [CVE-2026-84179](https://insights.sbomify.com/CVE-2026-84179/): Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Merged Daemon Configuration via the Topology Page (medium 6.5)
- [CVE-2026-84178](https://insights.sbomify.com/CVE-2026-84178/): Apache Camel: Camel-OAuth Login Cross-Site Request Forgery via Missing State Binding in the Authorization Code Flow (medium 6.1)
- [CVE-2026-84176](https://insights.sbomify.com/CVE-2026-84176/): Apache Camel: Camel-Platform-HTTP-Vertx Cross-Origin Credential Exposure via Wildcard Origin Reflection (medium 6.5)
- [CVE-2026-84175](https://insights.sbomify.com/CVE-2026-84175/): Server-side request forgery in Eclipse Ditto (medium 5.3)
- [CVE-2026-84173](https://insights.sbomify.com/CVE-2026-84173/): Missing authorization in Eclipse Ankaios (high 8.3)
- [CVE-2026-84171](https://insights.sbomify.com/CVE-2026-84171/): WP Images Upload on Piclect <= 1.0 - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2026-8417](https://insights.sbomify.com/CVE-2026-8417/): Concrete CMS 9.5.0 and below is vulnerable to CSRF in do_update() in the package update controller (high 7.5)
- [CVE-2026-84169](https://insights.sbomify.com/CVE-2026-84169/): UPI QR Code Payment Gateway <= 1.4.3 - Unauthenticated Cross-Order Payment-Status Forgery (medium 5.3)
- [CVE-2026-84168](https://insights.sbomify.com/CVE-2026-84168/): Easy Hide Login < 1.7 - Login Page Protection Bypass / Hidden URL Disclosure (medium 5.3)
- [CVE-2026-84167](https://insights.sbomify.com/CVE-2026-84167/): Hotel Booking <= 3.8 - Subscriber+ Booking Order PII Disclosure via IDOR (medium 4.3)
- [CVE-2026-84166](https://insights.sbomify.com/CVE-2026-84166/): Hotel Booking <= 3.8 - Booking Order Creation, Deletion, and Modification via CSRF (medium 4.3)
- [CVE-2026-84165](https://insights.sbomify.com/CVE-2026-84165/): Lack of authorisation in OpenNebula by OpenNebula Systems (high 8.7)
- [CVE-2026-8416](https://insights.sbomify.com/CVE-2026-8416/): Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file addFavoriteFolder($id) (low 2.3)
- [CVE-2026-84154](https://insights.sbomify.com/CVE-2026-84154/): Code injection in GEOVIA Geospatial Data Manager (critical 9.9)
- [CVE-2026-84153](https://insights.sbomify.com/CVE-2026-84153/): Xinhu Rainrock RockOA index.php toaddval sql injection (medium 5.3)
- [CVE-2026-84151](https://insights.sbomify.com/CVE-2026-84151/): The Post Grid < 7.9.5 - Contributor+ Stored HTML/iframe Injection via wp_kses_post Allow-List Widening (low 3.5)
- [CVE-2026-84150](https://insights.sbomify.com/CVE-2026-84150/): Directorist < 8.9.5 - Subscriber+ Cross-User Favorites Read and Write via REST Favorites Endpoint (medium 5.4)
- [CVE-2026-8415](https://insights.sbomify.com/CVE-2026-8415/): Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/express/association/reorder (low 2.3)
- [CVE-2026-84149](https://insights.sbomify.com/CVE-2026-84149/): Information Disclosure Vulnerability in Manacle Technologies ERP System (critical 9.2)
- [CVE-2026-84148](https://insights.sbomify.com/CVE-2026-84148/): Insecure Direct Object Reference Vulnerability in Manacle Technologies ERP System (critical 9.2)
- [CVE-2026-84147](https://insights.sbomify.com/CVE-2026-84147/): Remote Code Execution Vulnerability in Manacle Technologies ERP System (critical 10.0)
- [CVE-2026-84146](https://insights.sbomify.com/CVE-2026-84146/): Xpro Elementor Addons < 1.7.8 - Unauthenticated Draft/Private Product Disclosure via Quick View (medium 5.3)
- [CVE-2026-84145](https://insights.sbomify.com/CVE-2026-84145/): Internally found bugs fixed in Thunderbird 155, Thunderbird ESR 153.2 and Thunderbird ESR 140.15 (high 7.5)
- [CVE-2026-84144](https://insights.sbomify.com/CVE-2026-84144/): Internally found bugs fixed in Thunderbird 155 and Thunderbird ESR 153.2 (high 7.5)
- [CVE-2026-84143](https://insights.sbomify.com/CVE-2026-84143/): Internally found bugs fixed in Thunderbird 155, Thunderbird ESR 153.2 and Thunderbird ESR 140.15 (critical 9.8)
- [CVE-2026-84142](https://insights.sbomify.com/CVE-2026-84142/): Internally found bugs fixed in Thunderbird 155 (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/317/