# Vulnerabilities published in 2026


- [CVE-2026-82269](https://insights.sbomify.com/CVE-2026-82269/): Gophish Account Lockout and Forced Password Change Bypassable via API Key (high 8.6)
- [CVE-2026-82268](https://insights.sbomify.com/CVE-2026-82268/): Qwen-Agent Server-Side Request Forgery via Caller-Supplied Document URL (high 8.7)
- [CVE-2026-82267](https://insights.sbomify.com/CVE-2026-82267/): Komodo Resource Identifier Disclosure and Audit Log Pollution Before Permission Check (medium 5.3)
- [CVE-2026-82266](https://insights.sbomify.com/CVE-2026-82266/): Redpanda Admin API Unauthenticated Superuser Access via Default Configuration (critical 9.3)
- [CVE-2026-82265](https://insights.sbomify.com/CVE-2026-82265/): Zipkin Unauthenticated Spring Boot Actuator Endpoints Exposure (medium 6.9)
- [CVE-2026-82264](https://insights.sbomify.com/CVE-2026-82264/): Duplicacy Path Traversal during Restore via Unsanitized Snapshot Paths (medium 6.1)
- [CVE-2026-82263](https://insights.sbomify.com/CVE-2026-82263/): Logto Server-Side Request Forgery via OIDC SSO Connector Issuer URL (high 8.2)
- [CVE-2026-82262](https://insights.sbomify.com/CVE-2026-82262/): Logto Server-Side Request Forgery via webhook test endpoint (high 8.2)
- [CVE-2026-82261](https://insights.sbomify.com/CVE-2026-82261/): SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization (high 8.7)
- [CVE-2026-82260](https://insights.sbomify.com/CVE-2026-82260/): SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserialization (high 8.7)
- [CVE-2026-8226](https://insights.sbomify.com/CVE-2026-8226/): Open5GS types.c ogs_pcc_rule_install_flow_from_media denial of service (medium 6.9)
- [CVE-2026-82259](https://insights.sbomify.com/CVE-2026-82259/): SvelteKit 2.49.0 before 2.53.3 Denial of Service via form (high 8.7)
- [CVE-2026-82258](https://insights.sbomify.com/CVE-2026-82258/): SvelteKit 2.38.0 before 2.60.1 Cross-User Data Disclosure via query.batch (medium 5.9)
- [CVE-2026-82257](https://insights.sbomify.com/CVE-2026-82257/): SvelteKit before 2.69.1 Prototype Pollution via File Input (medium 5.3)
- [CVE-2026-82256](https://insights.sbomify.com/CVE-2026-82256/): SvelteKit before 2.69.1 Denial of Service via Remote Form (medium 6.9)
- [CVE-2026-82255](https://insights.sbomify.com/CVE-2026-82255/): gitoxide 0.25.4 HTTP Credential Leak via Redirect (high 7.6)
- [CVE-2026-82254](https://insights.sbomify.com/CVE-2026-82254/): gitoxide before 0.69.0 Denial of Service via gix-pack (high 8.7)
- [CVE-2026-82253](https://insights.sbomify.com/CVE-2026-82253/): gitoxide before 0.82.0 Path Traversal via Submodule Name Validation Bypass (high 8.7)
- [CVE-2026-82252](https://insights.sbomify.com/CVE-2026-82252/): gitoxide before 0.52.1 Repository Boundary Violation via symlinked .gitmodules (high 8.7)
- [CVE-2026-82251](https://insights.sbomify.com/CVE-2026-82251/): gitoxide before 0.52.1 Path Traversal via Submodule Name (high 8.7)
- [CVE-2026-82250](https://insights.sbomify.com/CVE-2026-82250/): gitoxide gix-packetline before 0.21.5 Denial of Service (high 7.1)
- [CVE-2026-8225](https://insights.sbomify.com/CVE-2026-8225/): Open5GS delete Endpoint sm-sm.c pcf_npcf_smpolicycontrol_handle_delete denial of service (medium 6.9)
- [CVE-2026-82249](https://insights.sbomify.com/CVE-2026-82249/): gitoxide before 0.38.2 Credential Helper Protocol Field Injection (low 2.3)
- [CVE-2026-82248](https://insights.sbomify.com/CVE-2026-82248/): gitoxide before 0.33.0 Path Traversal via symlink following (medium 6.0)
- [CVE-2026-82247](https://insights.sbomify.com/CVE-2026-82247/): gitoxide before 0.37.1 HTTP Basic credential leak via URL parsing (high 8.7)
- [CVE-2026-82246](https://insights.sbomify.com/CVE-2026-82246/): Budibase Server before 3.41.3 SSRF via Query Import (high 7.1)
- [CVE-2026-82245](https://insights.sbomify.com/CVE-2026-82245/): Budibase before 3.41.3 Missing Authorization License Management (high 7.2)
- [CVE-2026-82244](https://insights.sbomify.com/CVE-2026-82244/): Budibase before 3.41.3 Remote Code Execution via Plugin eval() (critical 9.4)
- [CVE-2026-82243](https://insights.sbomify.com/CVE-2026-82243/): Budibase Server before 3.41.3 SSRF with Credential Leakage (high 8.3)
- [CVE-2026-82242](https://insights.sbomify.com/CVE-2026-82242/): Budibase before 3.41.3 Cross-Application Resource Injection via Missing Authorization (high 8.3)
- [CVE-2026-82241](https://insights.sbomify.com/CVE-2026-82241/): Budibase backend-core SSRF via incomplete default blacklist (high 7.1)
- [CVE-2026-82240](https://insights.sbomify.com/CVE-2026-82240/): Budibase before 3.41.3 Privilege Escalation via User Update API (high 8.6)
- [CVE-2026-8224](https://insights.sbomify.com/CVE-2026-8224/): Open5GS PCF context.c pcf_sess_set_ipv6prefix denial of service (medium 6.9)
- [CVE-2026-82239](https://insights.sbomify.com/CVE-2026-82239/): Budibase before 3.41.3 Authorization Bypass via datasources/query (high 8.6)
- [CVE-2026-82238](https://insights.sbomify.com/CVE-2026-82238/): filebrowser 2.24.0 Race Condition via TUS concurrent PATCH uploads (low 2.3)
- [CVE-2026-82237](https://insights.sbomify.com/CVE-2026-82237/): filebrowser through 2.63.23 Stale Share Link via File Rename (low 2.3)
- [CVE-2026-82236](https://insights.sbomify.com/CVE-2026-82236/): File Browser 2.63.6 through 2.63.23 Share Link Exposure via File Deletion (low 2.3)
- [CVE-2026-82235](https://insights.sbomify.com/CVE-2026-82235/): filebrowser through 2.63.23 Denial of Service via named pipes (high 8.2)
- [CVE-2026-82234](https://insights.sbomify.com/CVE-2026-82234/): SiYuan before v3.8.1 SSRF via DNS-Rebinding TOCTOU (high 8.4)
- [CVE-2026-82233](https://insights.sbomify.com/CVE-2026-82233/): SiYuan before v3.8.1 Path Traversal via asset.upload (medium 6.9)
- [CVE-2026-82232](https://insights.sbomify.com/CVE-2026-82232/): Apache Syncope: SQL injection via sort parameter in Task search (critical 9.8)
- [CVE-2026-82231](https://insights.sbomify.com/CVE-2026-82231/): Apache bRPC: Malformed Thrift T_EXCEPTION reply causes process termination in Thrift client (not scored)
- [CVE-2026-82230](https://insights.sbomify.com/CVE-2026-82230/): Apache bRPC: Stack Exhaustion via Unbounded Recursion in mcpack2pb Parser (high 7.5)
- [CVE-2026-8223](https://insights.sbomify.com/CVE-2026-8223/): Open5GS sm-policies Endpoint pcf_sess_sbi_discover_and_send denial of service (medium 6.9)
- [CVE-2026-82229](https://insights.sbomify.com/CVE-2026-82229/): WordPress WordPress Social Login and Register plugin <= 7.8.2 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-82228](https://insights.sbomify.com/CVE-2026-82228/): WordPress SiteGround Security plugin <= 1.6.6 - 2FA Bypass vulnerability (high 8.1)
- [CVE-2026-82227](https://insights.sbomify.com/CVE-2026-82227/): WordPress WPBulky plugin <= 1.2.2 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-82226](https://insights.sbomify.com/CVE-2026-82226/): WordPress Tickera plugin <= 3.6.0.2 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-82225](https://insights.sbomify.com/CVE-2026-82225/): WordPress RegistrationMagic plugin <= 6.0.9.8 - Broken Authentication vulnerability (high 7.4)
- [CVE-2026-82224](https://insights.sbomify.com/CVE-2026-82224/): WordPress SliceWP plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-82223](https://insights.sbomify.com/CVE-2026-82223/): WordPress WP Event SOlution plugin <= 4.1.22 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-82222](https://insights.sbomify.com/CVE-2026-82222/): WordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution (RCE) vulnerability (critical 10.0)
- [CVE-2026-82221](https://insights.sbomify.com/CVE-2026-82221/): WordPress RegistrationMagic plugin <= 6.0.9.8 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-82220](https://insights.sbomify.com/CVE-2026-82220/): WordPress Forminator plugin <= 1.57.1 - Other vulnerability Type vulnerability (medium 5.3)
- [CVE-2026-8222](https://insights.sbomify.com/CVE-2026-8222/): Open5GS sm-policies Endpoint nbsf-handler.c pcf_nbsf_management_handle_register denial of service (medium 6.9)
- [CVE-2026-82217](https://insights.sbomify.com/CVE-2026-82217/): Path traversal in Eclipse Theia (high 8.8)
- [CVE-2026-82215](https://insights.sbomify.com/CVE-2026-82215/): WC PayPay Gateway 0.5 - 0.9.3 - Unauthenticated Payment Bypass via Unverified Webhook (medium 5.9)
- [CVE-2026-82213](https://insights.sbomify.com/CVE-2026-82213/): Nexi XPay Build 7.6.1 - 7.6.2 - Unauthenticated Saved Payment Token Disclosure via IDOR (medium 5.3)
- [CVE-2026-82212](https://insights.sbomify.com/CVE-2026-82212/): Nexi XPay Build <= 7.6.2 - Unauthenticated Payment Bypass via NPG Notification Handler (high 7.5)
- [CVE-2026-82211](https://insights.sbomify.com/CVE-2026-82211/): Nexi XPay Build <= 7.6.2 - Unauthenticated Payment Completion and Order Key Disclosure (high 8.2)
- [CVE-2026-82210](https://insights.sbomify.com/CVE-2026-82210/): Apache bRPC: Remote denial of service (crash) via malformed stream feedback frames (not scored)
- [CVE-2026-8221](https://insights.sbomify.com/CVE-2026-8221/): Devs Palace ERP Online item-save cross site scripting (medium 4.8)
- [CVE-2026-82209](https://insights.sbomify.com/CVE-2026-82209/): domain-scoped PSL domain cookie (high 8.2)
- [CVE-2026-82208](https://insights.sbomify.com/CVE-2026-82208/): wolfSSL CA-cache hit overrides callback (high 7.5)
- [CVE-2026-8220](https://insights.sbomify.com/CVE-2026-8220/): Devs Palace ERP Online customer-save cross site scripting (medium 4.8)
- [CVE-2026-82195](https://insights.sbomify.com/CVE-2026-82195/): 10Web Booster < 2.34.0 - Unauthenticated Connection Secret Disclosure and Deletion (medium 6.5)
- [CVE-2026-82194](https://insights.sbomify.com/CVE-2026-82194/): WPvivid Backup & Migration < 0.9.134 - Admin+ Arbitrary File Deletion via Path Traversal (medium 5.5)
- [CVE-2026-82193](https://insights.sbomify.com/CVE-2026-82193/): WPvivid Backup & Migration < 0.9.134 - Admin+ File Write Outside the Backup Directory via Path Traversal (medium 5.5)
- [CVE-2026-82191](https://insights.sbomify.com/CVE-2026-82191/): Other in J2Store extension for Joomla (medium 5.3)
- [CVE-2026-82190](https://insights.sbomify.com/CVE-2026-82190/): Weak cryptography in J2Store extension for Joomla (medium 6.3)
- [CVE-2026-8219](https://insights.sbomify.com/CVE-2026-8219/): Devs Palace ERP Online supplier-save cross site scripting (medium 4.8)
- [CVE-2026-82189](https://insights.sbomify.com/CVE-2026-82189/): Business logic in J2Store extension for Joomla (high 8.7)
- [CVE-2026-82187](https://insights.sbomify.com/CVE-2026-82187/): WooCommerce Online Product Designer 1.7.0 - < 2.15.0 - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2026-82186](https://insights.sbomify.com/CVE-2026-82186/): WPLP Cookie Consent < 4.4.2 - Admin+ SQLi via 'offset' Parameter (medium 4.1)
- [CVE-2026-82185](https://insights.sbomify.com/CVE-2026-82185/): WPLP Cookie Consent < 4.4.2 - Subscriber+ Banner Settings Overwrite and A/B Test Data Reset (medium 4.3)
- [CVE-2026-82184](https://insights.sbomify.com/CVE-2026-82184/): WPLP Cookie Consent < 4.4.2 - Unauthenticated IAB TCF Consent Option Update (medium 5.3)
- [CVE-2026-82183](https://insights.sbomify.com/CVE-2026-82183/): OAuth Single Sign On 6.25.0 - 7.0.0 - Unauthenticated Account Takeover via Unverified Steam OpenID Assertion (high 8.1)
- [CVE-2026-82182](https://insights.sbomify.com/CVE-2026-82182/): WPvivid Backup & Migration < 0.9.133 - Admin+ SQLi via Upload Cleaner Isolation (medium 4.1)
- [CVE-2026-82181](https://insights.sbomify.com/CVE-2026-82181/): Le-yan｜Medical Practice Management System - Sensitive Data in URL (medium 6.8)
- [CVE-2026-82180](https://insights.sbomify.com/CVE-2026-82180/): Auth bypass in Eclipse Arrowhead (critical 9.5)
- [CVE-2026-8218](https://insights.sbomify.com/CVE-2026-8218/): Devs Palace ERP Online purchase_return_save cross site scripting (medium 4.8)
- [CVE-2026-8217](https://insights.sbomify.com/CVE-2026-8217/): Industrial Application Software IAS Canias ERP RMI Runtime.getRuntime.exec os command injection (medium 5.3)
- [CVE-2026-82166](https://insights.sbomify.com/CVE-2026-82166/): Missing authorization in Application Store (high 8.8)
- [CVE-2026-82165](https://insights.sbomify.com/CVE-2026-82165/): Misconfiguration in Command | Integration Suite for System Center (medium 5.5)
- [CVE-2026-82164](https://insights.sbomify.com/CVE-2026-82164/): Misconfiguration in Trusted Device Client, (high 7.1)
- [CVE-2026-82163](https://insights.sbomify.com/CVE-2026-82163/): Misconfiguration in Command | Intel vPro Out of Band (medium 5.5)
- [CVE-2026-82162](https://insights.sbomify.com/CVE-2026-82162/): Privilege escalation in Command | Configure (DCC) (high 7.4)
- [CVE-2026-8216](https://insights.sbomify.com/CVE-2026-8216/): Auth bypass in Canias ERP (medium 6.9)
- [CVE-2026-82157](https://insights.sbomify.com/CVE-2026-82157/): Security feature bypass in ThinOS 10 (high 8.3)
- [CVE-2026-82153](https://insights.sbomify.com/CVE-2026-82153/): Information disclosure in OS Recovery Tool (low 2.2)
- [CVE-2026-8215](https://insights.sbomify.com/CVE-2026-8215/): Industrial Application Software IAS Canias ERP RMI iasRequestFileEvent path traversal (medium 6.9)
- [CVE-2026-8214](https://insights.sbomify.com/CVE-2026-8214/): Industrial Application Software IAS Canias ERP RMI doAction improper authentication (medium 6.9)
- [CVE-2026-8213](https://insights.sbomify.com/CVE-2026-8213/): OSGeo gdal Grid File GDapi.c GDSDfldsrch heap-based overflow (medium 4.8)
- [CVE-2026-82127](https://insights.sbomify.com/CVE-2026-82127/): Schema & Structured Data for WP & AMP < 1.67 - Editor+ Stored XSS via Taxonomy Term Fields (low 3.5)
- [CVE-2026-82126](https://insights.sbomify.com/CVE-2026-82126/): Missing authorization in Schema & Structured Data for WP & AMP (low 2.7)
- [CVE-2026-82125](https://insights.sbomify.com/CVE-2026-82125/): Schema & Structured Data for WP & AMP 1.46 - 1.65 - Unauthenticated Non-Public Comment Content Disclosure via IDOR (medium 5.3)
- [CVE-2026-82124](https://insights.sbomify.com/CVE-2026-82124/): Information disclosure in Schema & Structured Data for WP & AMP (medium 5.3)
- [CVE-2026-82123](https://insights.sbomify.com/CVE-2026-82123/): WordPress Loops & Logic - Reflected XSS (medium 6.5)
- [CVE-2026-82122](https://insights.sbomify.com/CVE-2026-82122/): Stack-based Buffer Overflow Vulnerability in HiRDB (critical 9.4)
- [CVE-2026-82121](https://insights.sbomify.com/CVE-2026-82121/): Origin Validation Error Vulnerability in HiRDB (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/335/