# Vulnerabilities published in 2026


- [CVE-2026-82120](https://insights.sbomify.com/CVE-2026-82120/): Heap-based Buffer Overflow Vulnerability in HiRDB (critical 9.8)
- [CVE-2026-8212](https://insights.sbomify.com/CVE-2026-8212/): OSGeo gdal SWapi.c SWSDfldsrch heap-based overflow (medium 4.8)
- [CVE-2026-82119](https://insights.sbomify.com/CVE-2026-82119/): OS Command Injection Vulnerability in HiRDB (critical 9.8)
- [CVE-2026-82118](https://insights.sbomify.com/CVE-2026-82118/): Stack-based Buffer Overflow Vulnerability in HiRDB (critical 9.8)
- [CVE-2026-82117](https://insights.sbomify.com/CVE-2026-82117/): Authentication Bypass by Spoofing Vulnerability in HiRDB (critical 9.8)
- [CVE-2026-82116](https://insights.sbomify.com/CVE-2026-82116/): Missing Authentication for Critical Function Vulnerability in HiRDB (critical 9.8)
- [CVE-2026-82112](https://insights.sbomify.com/CVE-2026-82112/): houtini-ai houtini-lm code_task_files index.ts path traversal (medium 5.1)
- [CVE-2026-82111](https://insights.sbomify.com/CVE-2026-82111/): iswalle getnote-mcp upload_image index.ts fs.readFileSync path traversal (medium 5.3)
- [CVE-2026-82110](https://insights.sbomify.com/CVE-2026-82110/): DataStage on Cloud Pak for Data Path Traversal (critical 9.6)
- [CVE-2026-8211](https://insights.sbomify.com/CVE-2026-8211/): codelibs Fess JSP File AdminDesignAction.java update code injection (medium 5.1)
- [CVE-2026-82108](https://insights.sbomify.com/CVE-2026-82108/): DataStage on Cloud Pak for Data Code Injection (high 8.8)
- [CVE-2026-82107](https://insights.sbomify.com/CVE-2026-82107/): DataStage on Cloud Pak for Data has several vulnerabilities due to open source software (critical 9.6)
- [CVE-2026-82103](https://insights.sbomify.com/CVE-2026-82103/): DataStage on Cloud Pak for Data Information Disclosure (critical 9.6)
- [CVE-2026-82101](https://insights.sbomify.com/CVE-2026-82101/): DataStage on Cloud Pak for Data Path Traversal (critical 9.6)
- [CVE-2026-82100](https://insights.sbomify.com/CVE-2026-82100/): DataStage on Cloud Pak for Data has several vulnerabilities due to open source software (critical 9.6)
- [CVE-2026-8210](https://insights.sbomify.com/CVE-2026-8210/): aandrew-me tgpt Update helper.go helper.Update command injection (medium 4.8)
- [CVE-2026-82099](https://insights.sbomify.com/CVE-2026-82099/): DataStage on Cloud Pak for Data has several vulnerabilities due to open source software (high 8.8)
- [CVE-2026-82098](https://insights.sbomify.com/CVE-2026-82098/): DataStage on Cloud Pak for Data has several vulnerabilities due to open source software (high 8.8)
- [CVE-2026-82097](https://insights.sbomify.com/CVE-2026-82097/): DataStage on Cloud Pak for Data has several vulnerabilities due to open source software (high 8.8)
- [CVE-2026-82096](https://insights.sbomify.com/CVE-2026-82096/): DataStage on Cloud Pak for Data Command Injection (high 8.8)
- [CVE-2026-82095](https://insights.sbomify.com/CVE-2026-82095/): DataStage on Cloud Pak for Data has several vulnerabilities due to open source software (high 8.8)
- [CVE-2026-82094](https://insights.sbomify.com/CVE-2026-82094/): DataStage on Cloud Pak for Data has several vulnerabilities (high 7.1)
- [CVE-2026-82093](https://insights.sbomify.com/CVE-2026-82093/): DataStage on Cloud Pak for Data has several vulnerabilities (high 8.8)
- [CVE-2026-82092](https://insights.sbomify.com/CVE-2026-82092/): DataStage on Cloud Pak for Data has several vulnerabilities due to open source software (high 8.8)
- [CVE-2026-82090](https://insights.sbomify.com/CVE-2026-82090/): Cross-site scripting in Pocket (critical 9.2)
- [CVE-2026-8209](https://insights.sbomify.com/CVE-2026-8209/): Path traversal in gibbon (medium 6.9)
- [CVE-2026-82089](https://insights.sbomify.com/CVE-2026-82089/): Cross-site scripting in android-app (high 8.8)
- [CVE-2026-82082](https://insights.sbomify.com/CVE-2026-82082/): Green-Computing｜NUMail - OS Command Injection (critical 9.3)
- [CVE-2026-82081](https://insights.sbomify.com/CVE-2026-82081/): Server-side request forgery in wallabag (medium 6.4)
- [CVE-2026-8208](https://insights.sbomify.com/CVE-2026-8208/): Code injection in gibbon (high 8.9)
- [CVE-2026-82079](https://insights.sbomify.com/CVE-2026-82079/): Potential Leakage of Nintendo Switch System Information Through a Proximity-Based Remote Attack (high 7.0)
- [CVE-2026-82078](https://insights.sbomify.com/CVE-2026-82078/): PaperCut NG/MF Unsafe Reflection (critical 9.4, exploited in the wild)
- [CVE-2026-82077](https://insights.sbomify.com/CVE-2026-82077/): PaperCut NG/MF: Remote Code Execution via Scan2Fax (high 7.3)
- [CVE-2026-82076](https://insights.sbomify.com/CVE-2026-82076/): Integer Overflow in Query Planner Leads to Unbounded Memory Allocation and Denial of Service in MongoDB Server (high 7.1)
- [CVE-2026-82075](https://insights.sbomify.com/CVE-2026-82075/): Uncontrolled Resource Consumption in MongoDB Sharded Cluster Router Allows Unauthenticated Denial of Service (high 8.7)
- [CVE-2026-82074](https://insights.sbomify.com/CVE-2026-82074/): Incorrect Authorization in MongoDB Server Aggregation Framework Allows Unauthorized Read Access to Collection Data (high 7.1)
- [CVE-2026-82073](https://insights.sbomify.com/CVE-2026-82073/): Missing authorization in MongoDB Server (high 7.1)
- [CVE-2026-82072](https://insights.sbomify.com/CVE-2026-82072/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-82071](https://insights.sbomify.com/CVE-2026-82071/): Insufficient Validation of Storage Engine Configuration Options in MongoDB Server Leads to Out-of-Bounds Write (high 7.2)
- [CVE-2026-82070](https://insights.sbomify.com/CVE-2026-82070/): Insufficiently Protected Credentials in MongoDB Server Diagnostic Reporting Interface (high 7.1)
- [CVE-2026-8207](https://insights.sbomify.com/CVE-2026-8207/): SQL injection in gibbon (high 7.0)
- [CVE-2026-82069](https://insights.sbomify.com/CVE-2026-82069/): Improper Redaction of Query Literals in MongoDB Server Query Statistics Serialization on Sharded Cluster Router (medium 5.1)
- [CVE-2026-82068](https://insights.sbomify.com/CVE-2026-82068/): Persistent Fatal Assertion Crash in MongoDB Server via Crafted Retryable Write Commands Leads to Denial of Service (high 7.1)
- [CVE-2026-82067](https://insights.sbomify.com/CVE-2026-82067/): Auth bypass in MongoDB Server (critical 9.2)
- [CVE-2026-82066](https://insights.sbomify.com/CVE-2026-82066/): Heap Out-of-Bounds Read in MongoDB Server Query Planning Component (medium 5.3)
- [CVE-2026-82065](https://insights.sbomify.com/CVE-2026-82065/): Denial of service in MongoDB Server (high 7.1)
- [CVE-2026-82064](https://insights.sbomify.com/CVE-2026-82064/): Denial of service in MongoDB Server (high 8.7)
- [CVE-2026-82063](https://insights.sbomify.com/CVE-2026-82063/): Use-After-Free in MongoDB Server Cursor Management Component Leads to Denial of Service (medium 6.0)
- [CVE-2026-82062](https://insights.sbomify.com/CVE-2026-82062/): Missing authorization in MongoDB Server (high 7.0)
- [CVE-2026-82061](https://insights.sbomify.com/CVE-2026-82061/): Use-After-Free in MongoDB Server Query Execution Memory Tracking Subsystem Leads to Denial of Service (high 7.2)
- [CVE-2026-82060](https://insights.sbomify.com/CVE-2026-82060/): Other in MongoDB Server (low 2.3)
- [CVE-2026-8206](https://insights.sbomify.com/CVE-2026-8206/): Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password' (critical 9.8)
- [CVE-2026-82059](https://insights.sbomify.com/CVE-2026-82059/): Denial of service in MongoDB Server (medium 6.0)
- [CVE-2026-82058](https://insights.sbomify.com/CVE-2026-82058/): Unhandled Exception in MongoDB Server JSON Schema Validation Error Generation Leads to Denial of Service (high 7.1)
- [CVE-2026-82057](https://insights.sbomify.com/CVE-2026-82057/): Memory corruption in MongoDB Server (high 7.1)
- [CVE-2026-82056](https://insights.sbomify.com/CVE-2026-82056/): Race Condition in MongoDB Server Text Index Query Parsing Leads to Heap Use-After-Free and Denial of Service (medium 6.0)
- [CVE-2026-82055](https://insights.sbomify.com/CVE-2026-82055/): Null Pointer Dereference in MongoDB Server 2dsphere Index Key Generation Leads to Denial of Service (high 7.1)
- [CVE-2026-82054](https://insights.sbomify.com/CVE-2026-82054/): Uncontrolled Resource Consumption in MongoDB Server JSON Pointer Parser Leads to Denial of Service (high 7.1)
- [CVE-2026-82053](https://insights.sbomify.com/CVE-2026-82053/): Improper Session Handling in MongoDB Server LDAP Authorization Integration Leads to Incorrect Role Assignment (high 7.6)
- [CVE-2026-82052](https://insights.sbomify.com/CVE-2026-82052/): $regexFindAll may crash mongod server when byte-matching multi-byte UTF-8 chars (high 7.1)
- [CVE-2026-8205](https://insights.sbomify.com/CVE-2026-8205/): Concrete CMS is vulnerable to authorization bypass in the Calendar Block (medium 6.3)
- [CVE-2026-82049](https://insights.sbomify.com/CVE-2026-82049/): tarfile extraction filters allow file modification and content disclosure via hard link to symlink (high 8.4)
- [CVE-2026-82045](https://insights.sbomify.com/CVE-2026-82045/): UTMStack < 11.2.16 JPQL Injection via searchPropertyValues (high 7.1)
- [CVE-2026-82044](https://insights.sbomify.com/CVE-2026-82044/): UTMStack < 11.2.16 Server-Side Request Forgery via downloadPdf (medium 6.3)
- [CVE-2026-82043](https://insights.sbomify.com/CVE-2026-82043/): UTMStack < 11.2.16 Account Enumeration via Password Reset Endpoint (medium 6.9)
- [CVE-2026-82042](https://insights.sbomify.com/CVE-2026-82042/): UTMStack < 11.2.16 Authentication Bypass via InternalApiKeyFilter (critical 9.3)
- [CVE-2026-82041](https://insights.sbomify.com/CVE-2026-82041/): UTMStack < 11.2.16 Missing Authorization via Command WebSocket (medium 6.5)
- [CVE-2026-82040](https://insights.sbomify.com/CVE-2026-82040/): UTMStack < 11.2.16 SSRF via IdentityProviderService (medium 5.3)
- [CVE-2026-8204](https://insights.sbomify.com/CVE-2026-8204/): Concrete CMS 9.5.0 and below is vulnerable to Authorization Bypass in the Calendar Event Frontend Dialog (medium 6.3)
- [CVE-2026-82039](https://insights.sbomify.com/CVE-2026-82039/): UTMStack < 11.2.16 SQL Injection via searchGroupsByFilter (high 8.7)
- [CVE-2026-82035](https://insights.sbomify.com/CVE-2026-82035/): PyMuPDF 1.28.2 Path Traversal via extract_objects() Font Branch (high 7.1)
- [CVE-2026-8203](https://insights.sbomify.com/CVE-2026-8203/): Concrete CMS 9.5.0 and below has Stored XSS on the height parameter (high 7.3)
- [CVE-2026-82028](https://insights.sbomify.com/CVE-2026-82028/): Magistrala < 1.0.0 SQL Injection via format Parameter in Reader API (high 8.7)
- [CVE-2026-82026](https://insights.sbomify.com/CVE-2026-82026/): Radar < 1.12.2 Missing Authorization via /api/local-terminal (high 8.7)
- [CVE-2026-82024](https://insights.sbomify.com/CVE-2026-82024/): LearnPress WordPress Plugin < 4.4.6 Stored XSS via Quiz Question Answer Titles (medium 5.1)
- [CVE-2026-82023](https://insights.sbomify.com/CVE-2026-82023/): LearnPress WordPress Plugin < 4.4.6 Broken Object-Level Authorization via Quiz Answer Insert (medium 5.3)
- [CVE-2026-82021](https://insights.sbomify.com/CVE-2026-82021/): Hermes Agent 0.18.2 < 0.19.0 MCP Catalog Supply Chain RCE via Mutable Branch Reference (critical 9.0)
- [CVE-2026-82020](https://insights.sbomify.com/CVE-2026-82020/): Hermes Agent 0.16.0 < 0.17.0 Credential Store Overwrite via File-Write Tool (high 7.6)
- [CVE-2026-8202](https://insights.sbomify.com/CVE-2026-8202/): Post-authentication CPU utilization DoS via $trim/$ltrim/$rtrim operators (medium 5.3)
- [CVE-2026-82019](https://insights.sbomify.com/CVE-2026-82019/): TripleLift video-bundle.js DOM-based XSS via postMessage (low 2.3)
- [CVE-2026-82018](https://insights.sbomify.com/CVE-2026-82018/): IGEL OS 12 / 11 Secure Boot Bypass via Unsigned igel.conf File (medium 6.8)
- [CVE-2026-82017](https://insights.sbomify.com/CVE-2026-82017/): IGEL OS 12 / 11 Boot Registry Parameter Injection via Unsigned Configuration Area (high 8.6)
- [CVE-2026-82013](https://insights.sbomify.com/CVE-2026-82013/): Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918) (critical 9.9)
- [CVE-2026-82011](https://insights.sbomify.com/CVE-2026-82011/): SQL injection in Adobe Campaign Classic (critical 9.1)
- [CVE-2026-82010](https://insights.sbomify.com/CVE-2026-82010/): SQL injection in Adobe Campaign Classic (critical 9.9)
- [CVE-2026-8201](https://insights.sbomify.com/CVE-2026-8201/): Use-After-Free in MongoDB FLE Query Analysis When Processing Positional Projections on Encrypted Fields (medium 6.1)
- [CVE-2026-82009](https://insights.sbomify.com/CVE-2026-82009/): SQL injection in Adobe Campaign Classic (critical 9.1)
- [CVE-2026-82008](https://insights.sbomify.com/CVE-2026-82008/): Adobe Campaign Classic (ACC) | Improper Input Validation (CWE-20) (critical 9.9)
- [CVE-2026-82007](https://insights.sbomify.com/CVE-2026-82007/): Photoshop Desktop | Integer Overflow or Wraparound (CWE-190) (high 7.8)
- [CVE-2026-82006](https://insights.sbomify.com/CVE-2026-82006/): Photoshop Desktop | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2026-82005](https://insights.sbomify.com/CVE-2026-82005/): Photoshop Desktop | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-82004](https://insights.sbomify.com/CVE-2026-82004/): Command injection in Adobe Campaign Classic (critical 10.0)
- [CVE-2026-82003](https://insights.sbomify.com/CVE-2026-82003/): Adobe Campaign Classic (ACC) | Improper Input Validation (CWE-20) (high 8.5)
- [CVE-2026-82001](https://insights.sbomify.com/CVE-2026-82001/): Acrobat Reader | Uncontrolled Resource Consumption (CWE-400) (medium 5.5)
- [CVE-2026-82000](https://insights.sbomify.com/CVE-2026-82000/): Adobe Experience Manager Forms JEE | Server-Side Request Forgery (SSRF) (CWE-918) (critical 9.6)
- [CVE-2026-8200](https://insights.sbomify.com/CVE-2026-8200/): Schema validation log messages may not redact user data (medium 4.8)
- [CVE-2026-81999](https://insights.sbomify.com/CVE-2026-81999/): Adobe Experience Manager Forms JEE | Server-Side Request Forgery (SSRF) (CWE-918) (high 8.7)
- [CVE-2026-81998](https://insights.sbomify.com/CVE-2026-81998/): Substance3D - Modeler | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-81997](https://insights.sbomify.com/CVE-2026-81997/): Acrobat Reader | Incorrect Authorization (CWE-863) (medium 6.3)
- [CVE-2026-81996](https://insights.sbomify.com/CVE-2026-81996/): Acrobat Reader | Incorrect Authorization (CWE-863) (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/336/