# Vulnerabilities published in 2026


- [CVE-2026-82857](https://insights.sbomify.com/CVE-2026-82857/): hulumi before v1.3.2 Privilege Escalation via IAM Policy (critical 9.3)
- [CVE-2026-82856](https://insights.sbomify.com/CVE-2026-82856/): @hulumi/policies before 1.3.2 OIDC Trust Policy Bypass (critical 9.3)
- [CVE-2026-82855](https://insights.sbomify.com/CVE-2026-82855/): @hulumi/policies before 1.3.2 Evidence Validation Bypass (critical 9.3)
- [CVE-2026-82854](https://insights.sbomify.com/CVE-2026-82854/): Nodemailer before 8.0.4 SMTP Command Injection via envelope.size (critical 9.3)
- [CVE-2026-82853](https://insights.sbomify.com/CVE-2026-82853/): Nodemailer before 8.0.5 SMTP Command Injection via CRLF (medium 6.9)
- [CVE-2026-82852](https://insights.sbomify.com/CVE-2026-82852/): WordPress MapSVG plugin <= 8.15.0 - Server Side Request Forgery (SSRF) vulnerability (medium 5.4)
- [CVE-2026-82851](https://insights.sbomify.com/CVE-2026-82851/): Masteriyo LMS 1.14.0 - 3.4.0 - Instructor+ Arbitrary Post Disclosure via IDOR (low 2.7)
- [CVE-2026-82850](https://insights.sbomify.com/CVE-2026-82850/): Masteriyo LMS < 3.4.2 - Subscriber+ Quiz Answer Key Disclosure (medium 4.3)
- [CVE-2026-8285](https://insights.sbomify.com/CVE-2026-8285/): OTP Bypass in Universal Sotware's FlexCity (medium 4.3)
- [CVE-2026-82849](https://insights.sbomify.com/CVE-2026-82849/): Masteriyo LMS < 3.4.2 - Subscriber+ Arbitrary User Course Progress Disclosure via IDOR (medium 4.3)
- [CVE-2026-82848](https://insights.sbomify.com/CVE-2026-82848/): Masteriyo LMS 1.3.1 - 2.3.3 - Unauthenticated Course Enrollment Disclosure (medium 5.3)
- [CVE-2026-82847](https://insights.sbomify.com/CVE-2026-82847/): Masteriyo LMS < 3.4.1 - Instructor+ Stored XSS via Course Highlights (medium 6.8)
- [CVE-2026-82846](https://insights.sbomify.com/CVE-2026-82846/): Masteriyo LMS 1.18.0 - 2.3.3 - Instructor+ Stored XSS via Course Custom Fields (medium 6.8)
- [CVE-2026-82845](https://insights.sbomify.com/CVE-2026-82845/): Masteriyo LMS < 3.4.1 - Subscriber+ PHP Object Injection (critical 9.9)
- [CVE-2026-82844](https://insights.sbomify.com/CVE-2026-82844/): WPForms Lite 1.10.0.1 - 2.0.2.1 - Unauthenticated Payment Bypass via PayPal Commerce (medium 5.3)
- [CVE-2026-82843](https://insights.sbomify.com/CVE-2026-82843/): WP OAuth Server < 6.4.0 - Subscriber+ Cross-User Account Takeover via OIDC ID Token Substitution (critical 9.0)
- [CVE-2026-82842](https://insights.sbomify.com/CVE-2026-82842/): SAML Single Sign On < 6.0.0 - Unauthenticated Privilege Escalation via Account Matching (high 8.1)
- [CVE-2026-82841](https://insights.sbomify.com/CVE-2026-82841/): UpdraftPlus 1.23.8 - 1.26.7 - Subscriber+ Remote Storage Credential Disclosure via Migration Notice (medium 5.3)
- [CVE-2026-8284](https://insights.sbomify.com/CVE-2026-8284/): Open Redirect in Universal Sotware's FlexCity (medium 6.1)
- [CVE-2026-82838](https://insights.sbomify.com/CVE-2026-82838/): Default webserver configuration with incorrect CSP (medium 6.4)
- [CVE-2026-82837](https://insights.sbomify.com/CVE-2026-82837/): Insertion of Sensitive Information Into Sent Data in GitLab (medium 5.3)
- [CVE-2026-82835](https://insights.sbomify.com/CVE-2026-82835/): caoqianming django-vue-admin file access control (medium 5.3)
- [CVE-2026-82834](https://insights.sbomify.com/CVE-2026-82834/): Missing authorization in Auto Labeling Pipeline Module to Annotate a Document Automatically (medium 5.3)
- [CVE-2026-82833](https://insights.sbomify.com/CVE-2026-82833/): Missing authorization in Auto Labeling Pipeline Module to Annotate a Document Automatically (medium 5.3)
- [CVE-2026-82832](https://insights.sbomify.com/CVE-2026-82832/): IBM Guardium Data Protection is affected by multiple vulnerabilities. (critical 9.6)
- [CVE-2026-82829](https://insights.sbomify.com/CVE-2026-82829/): Hidden accounts or hard-coded credentials may permit unauthorized access without the legitimate authentication process (critical 9.3)
- [CVE-2026-82828](https://insights.sbomify.com/CVE-2026-82828/): Missing authorization in Hitachi Coding Software Suite (high 8.7)
- [CVE-2026-82827](https://insights.sbomify.com/CVE-2026-82827/): Hardcoded credentials in Hitachi Coding Software Suite (critical 9.3)
- [CVE-2026-82826](https://insights.sbomify.com/CVE-2026-82826/): Authentication information or sensitive data may be intercepted in transit (high 8.7)
- [CVE-2026-82825](https://insights.sbomify.com/CVE-2026-82825/): Missing authorization in Hitachi Coding Software Suite (critical 9.3)
- [CVE-2026-82824](https://insights.sbomify.com/CVE-2026-82824/): Path traversal may allow arbitrary files to be viewed, created, modified, or deleted (critical 9.3)
- [CVE-2026-82821](https://insights.sbomify.com/CVE-2026-82821/): FLVMeta AMF Object Parsing amf.c amf_object_get null pointer dereference (medium 5.3)
- [CVE-2026-82820](https://insights.sbomify.com/CVE-2026-82820/): FLVMeta AMF String Processing amf.c amf_string_new heap-based overflow (medium 5.3)
- [CVE-2026-82819](https://insights.sbomify.com/CVE-2026-82819/): Universal Naming Convention (UNC) Path Injection in Cerberus FTP Server (high 7.1)
- [CVE-2026-82818](https://insights.sbomify.com/CVE-2026-82818/): dibo-software diboot Tenant Resource Assignment resource access control (medium 5.3)
- [CVE-2026-82817](https://insights.sbomify.com/CVE-2026-82817/): dibo-software diboot Tenant Administrator Management API admin access control (medium 5.3)
- [CVE-2026-82816](https://insights.sbomify.com/CVE-2026-82816/): dibo-software diboot AI Session Endpoint ai-session authorization (medium 5.3)
- [CVE-2026-82815](https://insights.sbomify.com/CVE-2026-82815/): MegaEase EaseProbe Middleware server.go realIP access control (medium 6.9)
- [CVE-2026-82814](https://insights.sbomify.com/CVE-2026-82814/): Duplicator <= 1.5.17 and Duplicator Pro <= 4.6.10 - Unauthenticated PHP Object Injection (high 8.8)
- [CVE-2026-82813](https://insights.sbomify.com/CVE-2026-82813/): BEN Group TubeBuddy for YouTube Extension tubebuddymaster1.js TBGlobal.GetToken data authenticity (medium 5.3)
- [CVE-2026-82811](https://insights.sbomify.com/CVE-2026-82811/): Toggl OÜ Toggl Track Extension postMessage origin validation (medium 5.3)
- [CVE-2026-82810](https://insights.sbomify.com/CVE-2026-82810/): Information disclosure in 2FA Authenticator Extension (medium 4.8)
- [CVE-2026-82809](https://insights.sbomify.com/CVE-2026-82809/): vidIQ Vision for YouTube Extension postMessage window.addEventListener information disclosure (medium 5.3)
- [CVE-2026-82808](https://insights.sbomify.com/CVE-2026-82808/): Inbox Foundry ActiveInbox Extension Google OAuth Client Secret service-worker.production-esm.js hard-coded credentials (medium 6.9)
- [CVE-2026-82807](https://insights.sbomify.com/CVE-2026-82807/): ieungSoft Ultra RAMDisk Pro Kernel Driver URDSCSI.sys privileges management (critical 9.3)
- [CVE-2026-82806](https://insights.sbomify.com/CVE-2026-82806/): Apache APISIX: cross-request permission pollution via static permission list mutation (medium 5.3)
- [CVE-2026-82805](https://insights.sbomify.com/CVE-2026-82805/): Typora Mermaid Rendering cross site scripting (medium 5.3)
- [CVE-2026-82804](https://insights.sbomify.com/CVE-2026-82804/): Apache DolphinScheduler: Command Injection in the Alert Script Plugin (high 8.8)
- [CVE-2026-82803](https://insights.sbomify.com/CVE-2026-82803/): armink struct2json JSON Deserialization s2jdef.h S2J_STRUCT_GET_string_ELEMENT null pointer dereference (medium 6.9)
- [CVE-2026-82802](https://insights.sbomify.com/CVE-2026-82802/): NASA earthdata-search granules Endpoint handler.js OpenSearchGranuleSearchLambda server-side request forgery (medium 6.9)
- [CVE-2026-82801](https://insights.sbomify.com/CVE-2026-82801/): NASA earthdata-search scale Endpoint handler.js scaleImage server-side request forgery (medium 6.9)
- [CVE-2026-8280](https://insights.sbomify.com/CVE-2026-8280/): Allocation of Resources Without Limits or Throttling in GitLab (medium 6.5)
- [CVE-2026-82797](https://insights.sbomify.com/CVE-2026-82797/): Denial of service in rlottie (medium 5.5)
- [CVE-2026-82796](https://insights.sbomify.com/CVE-2026-82796/): Cross-site scripting in SV-CPT-MC310 (medium 5.1)
- [CVE-2026-82795](https://insights.sbomify.com/CVE-2026-82795/): Cross-site scripting in SV-CPT-MC310 (medium 5.1)
- [CVE-2026-82794](https://insights.sbomify.com/CVE-2026-82794/): Command injection in SV-CPT-MC310 (high 8.7)
- [CVE-2026-82793](https://insights.sbomify.com/CVE-2026-82793/): File upload in CAN-2-USB (high 8.6)
- [CVE-2026-82792](https://insights.sbomify.com/CVE-2026-82792/): Cross-site scripting in CAN-2-USB (medium 4.8)
- [CVE-2026-82791](https://insights.sbomify.com/CVE-2026-82791/): Command injection in CAN-2-USB (high 8.7)
- [CVE-2026-82790](https://insights.sbomify.com/CVE-2026-82790/): Cross-site scripting in PC-HELPER Wireless I/O DIO-0404RY-LWF (medium 4.8)
- [CVE-2026-8279](https://insights.sbomify.com/CVE-2026-8279/): Masteriyo LMS <= 2.2.0 - Missing Authorization to Unauthenticated Arbitrary Course Progress Deletion (medium 5.3)
- [CVE-2026-82789](https://insights.sbomify.com/CVE-2026-82789/): Code injection in CONPROSYS HMI System(CHS) (high 8.7)
- [CVE-2026-82788](https://insights.sbomify.com/CVE-2026-82788/): Cross-site scripting in CPSL-08P1EN (medium 5.1)
- [CVE-2026-82787](https://insights.sbomify.com/CVE-2026-82787/): Auth bypass in CPSL-08P1EN (high 8.7)
- [CVE-2026-82786](https://insights.sbomify.com/CVE-2026-82786/): Information disclosure in Remote I/O Coupler Unit (Server Type) CPSN-MCB271-* (high 8.2)
- [CVE-2026-82785](https://insights.sbomify.com/CVE-2026-82785/): Memory corruption in Remote I/O Coupler Unit (Server Type) CPSN-MCB271-* (medium 5.3)
- [CVE-2026-82784](https://insights.sbomify.com/CVE-2026-82784/): Missing authorization in Remote I/O Coupler Unit (Server Type) CPSN-MCB271-* (medium 6.9)
- [CVE-2026-82783](https://insights.sbomify.com/CVE-2026-82783/): Information disclosure in Programmable Remote I/O Coupler Unit (Software PLC Type) CPSN-PCB271-S1-041 (medium 4.1)
- [CVE-2026-82782](https://insights.sbomify.com/CVE-2026-82782/): Memory corruption in Programmable Remote I/O Coupler Unit (Software PLC Type) CPSN-PCB271-S1-041 (medium 5.3)
- [CVE-2026-82781](https://insights.sbomify.com/CVE-2026-82781/): Cross-site scripting in Programmable Remote I/O Coupler Unit (Software PLC Type) CPSN-PCB271-S1-041 (medium 5.1)
- [CVE-2026-82780](https://insights.sbomify.com/CVE-2026-82780/): File upload in CPS-TM341G5MB-ADSC1-931 (high 8.7)
- [CVE-2026-82779](https://insights.sbomify.com/CVE-2026-82779/): Command injection in CPS-TM341G5MB-ADSC1-931 (high 8.7)
- [CVE-2026-82778](https://insights.sbomify.com/CVE-2026-82778/): Information disclosure in Configurable type CPS-PCS341[][]-DS1-1201 (medium 5.3)
- [CVE-2026-82777](https://insights.sbomify.com/CVE-2026-82777/): Command injection in Configurable type CPS-PCS341[][]-DS1-1201 (high 8.7)
- [CVE-2026-82776](https://insights.sbomify.com/CVE-2026-82776/): Cross-site scripting in Configurable type CPS-PCS341[][]-DS1-1201 (medium 5.1)
- [CVE-2026-82775](https://insights.sbomify.com/CVE-2026-82775/): Information disclosure in M2M Controller Configurable type CPS-MCS341* (medium 5.3)
- [CVE-2026-82774](https://insights.sbomify.com/CVE-2026-82774/): Command injection in M2M Controller Configurable type CPS-MCS341* (high 8.7)
- [CVE-2026-82773](https://insights.sbomify.com/CVE-2026-82773/): Cross-site scripting in M2M Controller Configurable type CPS-MCS341* (medium 5.1)
- [CVE-2026-82772](https://insights.sbomify.com/CVE-2026-82772/): Memory corruption in ECE1000 (high 8.7)
- [CVE-2026-82771](https://insights.sbomify.com/CVE-2026-82771/): Cross-site scripting in ECE1000 (medium 4.8)
- [CVE-2026-82770](https://insights.sbomify.com/CVE-2026-82770/): Memory corruption in RP-WAH-SR1 (high 8.7)
- [CVE-2026-82769](https://insights.sbomify.com/CVE-2026-82769/): Cross-site scripting in RP-WAH-SR1 (medium 4.8)
- [CVE-2026-82768](https://insights.sbomify.com/CVE-2026-82768/): Path traversal in SGA1000 (high 8.6)
- [CVE-2026-82767](https://insights.sbomify.com/CVE-2026-82767/): Cross-site scripting in SGA1000 (medium 4.8)
- [CVE-2026-82766](https://insights.sbomify.com/CVE-2026-82766/): Command injection in SGA1000 (high 8.7)
- [CVE-2026-82765](https://insights.sbomify.com/CVE-2026-82765/): Path traversal in FXA3000 (high 8.6)
- [CVE-2026-82764](https://insights.sbomify.com/CVE-2026-82764/): Cross-site request forgery in ECE1000 (medium 5.1)
- [CVE-2026-82763](https://insights.sbomify.com/CVE-2026-82763/): Cross-site scripting in FXA3000 (medium 4.8)
- [CVE-2026-82762](https://insights.sbomify.com/CVE-2026-82762/): Command injection in FXA3000 (high 8.7)
- [CVE-2026-82761](https://insights.sbomify.com/CVE-2026-82761/): Magic link single-use tokens replayable via TOCTOU race in AshAuthentication (critical 9.1)
- [CVE-2026-82760](https://insights.sbomify.com/CVE-2026-82760/): Superlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-in (high 8.2)
- [CVE-2026-8276](https://insights.sbomify.com/CVE-2026-8276/): bettercap MySQL Server mysql_server.go integer coercion (medium 6.3)
- [CVE-2026-82759](https://insights.sbomify.com/CVE-2026-82759/): Reversible IP address pseudonymisation in AshAuthentication audit log hash mode (low 1.8)
- [CVE-2026-82758](https://insights.sbomify.com/CVE-2026-82758/): Auth bypass in ash authentication oauth2 server (medium 6.3)
- [CVE-2026-82757](https://insights.sbomify.com/CVE-2026-82757/): ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addresses as public, allowing SSRF (medium 6.3)
- [CVE-2026-82756](https://insights.sbomify.com/CVE-2026-82756/): Other in ash authentication oauth2 server (medium 6.3)
- [CVE-2026-82755](https://insights.sbomify.com/CVE-2026-82755/): Information disclosure in ash authentication oauth2 server (medium 6.3)
- [CVE-2026-82754](https://insights.sbomify.com/CVE-2026-82754/): ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controls (medium 6.3)
- [CVE-2026-82753](https://insights.sbomify.com/CVE-2026-82753/): Denial of service in ash authentication oauth2 server (high 8.2)
- [CVE-2026-82752](https://insights.sbomify.com/CVE-2026-82752/): Ash string length constraints count graphemes, so a combining-mark string of any size passes max_length (medium 5.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/330/