# Vulnerabilities published in 2026


- [CVE-2026-81893](https://insights.sbomify.com/CVE-2026-81893/): Gdk-pixbuf: gdk-pixbuf: invalid write in jpeg icc profile parser on error recovery (medium 4.7)
- [CVE-2026-81892](https://insights.sbomify.com/CVE-2026-81892/): EasyAdmin custom-action dispatcher bypasses access_control on other routes (high 8.1)
- [CVE-2026-81891](https://insights.sbomify.com/CVE-2026-81891/): elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE) (high 8.1)
- [CVE-2026-81890](https://insights.sbomify.com/CVE-2026-81890/): elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections (medium 5.4)
- [CVE-2026-8189](https://insights.sbomify.com/CVE-2026-8189/): Wavlink NU516U1 adm.cgi wzdrepeater os command injection (medium 5.3)
- [CVE-2026-81889](https://insights.sbomify.com/CVE-2026-81889/): elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback (high 8.6)
- [CVE-2026-81888](https://insights.sbomify.com/CVE-2026-81888/): @hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking (medium 5.4)
- [CVE-2026-81887](https://insights.sbomify.com/CVE-2026-81887/): Livewire DOM-based cross-site scripting during client-side state handling (medium 5.1)
- [CVE-2026-81886](https://insights.sbomify.com/CVE-2026-81886/): radare2: Uncontrolled memory allocation in radare2 dmp64 parser (medium 5.5)
- [CVE-2026-81885](https://insights.sbomify.com/CVE-2026-81885/): radare2: Infinite relocation-chain loop causes denial of service in radare2 NE parser (medium 5.5)
- [CVE-2026-81884](https://insights.sbomify.com/CVE-2026-81884/): radare2: Heap out-of-bounds read in radare2 Mach-O LC_DATA_IN_CODE parser (low 2.5)
- [CVE-2026-81883](https://insights.sbomify.com/CVE-2026-81883/): radare2: Out-of-bounds Read at the end of string in the LUA 5.3 bytecode (low 3.3)
- [CVE-2026-81882](https://insights.sbomify.com/CVE-2026-81882/): radare2: Missing string termination causes heap out-of-bounds read in radare2 bplist parser (low 3.3)
- [CVE-2026-81881](https://insights.sbomify.com/CVE-2026-81881/): radare2: Heap out-of-bounds read in radare2 Mach-O Swift metadata parser (low 3.3)
- [CVE-2026-81880](https://insights.sbomify.com/CVE-2026-81880/): radare2: Uncontrolled resource consumption in radare2 PEF loader (medium 5.5)
- [CVE-2026-8188](https://insights.sbomify.com/CVE-2026-8188/): Wavlink NU516U1 adm.cgi change_wifi_password os command injection (medium 5.3)
- [CVE-2026-81879](https://insights.sbomify.com/CVE-2026-81879/): radare2: Heap out-of-bounds read in radare2 ELF PN_XNUM handling (medium 5.5)
- [CVE-2026-81878](https://insights.sbomify.com/CVE-2026-81878/): radare2: Integer overflow causes heap out-of-bounds write in radare2 PYC parser (medium 5.5)
- [CVE-2026-81876](https://insights.sbomify.com/CVE-2026-81876/): HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service (high 7.5)
- [CVE-2026-81875](https://insights.sbomify.com/CVE-2026-81875/): HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service (high 7.5)
- [CVE-2026-81872](https://insights.sbomify.com/CVE-2026-81872/): OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full (medium 6.3)
- [CVE-2026-81871](https://insights.sbomify.com/CVE-2026-81871/): OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning (medium 6.3)
- [CVE-2026-81870](https://insights.sbomify.com/CVE-2026-81870/): OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs (low 2.0)
- [CVE-2026-8187](https://insights.sbomify.com/CVE-2026-8187/): Open5GS UPF gtp-path.c _gtpv1_u_recv_cb resource consumption (medium 6.9)
- [CVE-2026-81869](https://insights.sbomify.com/CVE-2026-81869/): OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation (medium 5.1)
- [CVE-2026-81868](https://insights.sbomify.com/CVE-2026-81868/): Steeltoe: Header-forwarded client cert lacks proof of private-key possession (medium 6.5)
- [CVE-2026-81867](https://insights.sbomify.com/CVE-2026-81867/): Deserialization of Untrusted Data in Application Integration allows Remote Code Execution (critical 9.4)
- [CVE-2026-81866](https://insights.sbomify.com/CVE-2026-81866/): Apache NiFi: Missing Authorization for Assets and Secrets Referenced by Connector Configuration (low 0.5)
- [CVE-2026-81862](https://insights.sbomify.com/CVE-2026-81862/): Information disclosure in Apache Airflow Teradata provider (medium 6.5)
- [CVE-2026-81861](https://insights.sbomify.com/CVE-2026-81861/): Information disclosure in SCADAPack 32 (medium 5.9)
- [CVE-2026-8186](https://insights.sbomify.com/CVE-2026-8186/): Open5GS NF client.c ogs_sbi_client_send_via_scp_or_sepp out-of-bounds (medium 6.9)
- [CVE-2026-81859](https://insights.sbomify.com/CVE-2026-81859/): Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026. (medium 6.2)
- [CVE-2026-81858](https://insights.sbomify.com/CVE-2026-81858/): IBM i is Affected By A Denial of Service Vulnerability in Host Servers (medium 5.4)
- [CVE-2026-81856](https://insights.sbomify.com/CVE-2026-81856/): Terminal escape sequence injection in Hex via unneutralized server-supplied output (low 2.3)
- [CVE-2026-81855](https://insights.sbomify.com/CVE-2026-81855/): Wärtsilä FOS-Onboard Use of Hard-coded Cryptographic Key (critical 9.3)
- [CVE-2026-81853](https://insights.sbomify.com/CVE-2026-81853/): AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle (low 2.3)
- [CVE-2026-81852](https://insights.sbomify.com/CVE-2026-81852/): AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass (low 2.1)
- [CVE-2026-81851](https://insights.sbomify.com/CVE-2026-81851/): Fireware OS Heap-Based Buffer Overflow in iked Allows Denial of Service (medium 6.9)
- [CVE-2026-8185](https://insights.sbomify.com/CVE-2026-8185/): UGREEN CM933 Administrative missing authentication (medium 5.3)
- [CVE-2026-81849](https://insights.sbomify.com/CVE-2026-81849/): Path traversal in the aws:downloadContent plugin in amazon-ssm-agent (high 8.7)
- [CVE-2026-81848](https://insights.sbomify.com/CVE-2026-81848/): cyberchitta scrapling-fetch-mcp _fetcher.py s_fetch_pattern server-side request forgery (medium 5.1)
- [CVE-2026-81847](https://insights.sbomify.com/CVE-2026-81847/): MAA-AI MaaMCP pipeline_tools.py load_pipeline path traversal (medium 5.1)
- [CVE-2026-81846](https://insights.sbomify.com/CVE-2026-81846/): runZero MCP 'Findings summaries' Data Leak (low 3.5)
- [CVE-2026-81845](https://insights.sbomify.com/CVE-2026-81845/): arben-adm mcp-sequential-thinking Import Session/Export Session server.py export_session path traversal (medium 5.3)
- [CVE-2026-81842](https://insights.sbomify.com/CVE-2026-81842/): Library panel can be moved into a folder without library panel create permission (medium 4.3)
- [CVE-2026-81841](https://insights.sbomify.com/CVE-2026-81841/): Paused shared dashboard access tokens still expose data source configuration (medium 5.3)
- [CVE-2026-81839](https://insights.sbomify.com/CVE-2026-81839/): Incorrect Authorization in GitLab (high 7.7)
- [CVE-2026-81838](https://insights.sbomify.com/CVE-2026-81838/): Zip Slip Arbitrary File Write in AWS diagram-as-code (awsdac) (medium 6.8)
- [CVE-2026-81837](https://insights.sbomify.com/CVE-2026-81837/): RooCodeInc Roo-Code ApplyPatchTool ApplyPatchTool.ts path.resolve path traversal (medium 5.3)
- [CVE-2026-81836](https://insights.sbomify.com/CVE-2026-81836/): RooCodeInc Roo-Code OAuth Callback oauth.ts cleartext transmission (medium 6.3)
- [CVE-2026-81835](https://insights.sbomify.com/CVE-2026-81835/): RooCodeInc Roo-Code MCP Integration Trust Model malicious_mcp_server.py fetch_instructions code injection (medium 5.1)
- [CVE-2026-81834](https://insights.sbomify.com/CVE-2026-81834/): RooCodeInc Roo-Code README File ExecaTerminalProcess code injection (medium 5.3)
- [CVE-2026-81833](https://insights.sbomify.com/CVE-2026-81833/): RooCodeInc Roo-Code CodeIndexManager helpers.ts optimizeQuery code injection (medium 5.1)
- [CVE-2026-81832](https://insights.sbomify.com/CVE-2026-81832/): IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs (high 7.7)
- [CVE-2026-81830](https://insights.sbomify.com/CVE-2026-81830/): Security feature bypass in OpenVPN (medium 5.6)
- [CVE-2026-8183](https://insights.sbomify.com/CVE-2026-8183/): Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement (high 7.7)
- [CVE-2026-81829](https://insights.sbomify.com/CVE-2026-81829/): Server-side request forgery in Exploit Intelligence (medium 5.3)
- [CVE-2026-81827](https://insights.sbomify.com/CVE-2026-81827/): Flowintel Login Email Validation Bypass Allows Log Injection via Crafted Email Input (medium 6.9)
- [CVE-2026-81826](https://insights.sbomify.com/CVE-2026-81826/): Flowintel Fails to Invalidate Active Sessions After Password Change (critical 9.1)
- [CVE-2026-81825](https://insights.sbomify.com/CVE-2026-81825/): Simple Ajax Chat <= 20260811 - Unauthenticated Stored Cross-Site Scripting (high 7.2)
- [CVE-2026-81824](https://insights.sbomify.com/CVE-2026-81824/): AVEVA Pipeline Integrity Monitor cross-site scripting (medium 6.3)
- [CVE-2026-81823](https://insights.sbomify.com/CVE-2026-81823/): AVEVA Pipeline Integrity Monitor Missing Authorization (medium 6.9)
- [CVE-2026-81822](https://insights.sbomify.com/CVE-2026-81822/): AVEVA Pipeline Integrity Monitor Use of a Broken or Risky Cryptographic Algorithm (high 8.3)
- [CVE-2026-81821](https://insights.sbomify.com/CVE-2026-81821/): AVEVA Pipeline Integrity Monitor Use of hard-coded cryptographic key (high 8.3)
- [CVE-2026-81820](https://insights.sbomify.com/CVE-2026-81820/): Flowintel HTML Injection in MISP Case History Timeline via Crafted Object Attributes (medium 5.1)
- [CVE-2026-8182](https://insights.sbomify.com/CVE-2026-8182/): Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling (high 8.8)
- [CVE-2026-81819](https://insights.sbomify.com/CVE-2026-81819/): Flowintel Missing Authorization Allows Regular API Users to View Other Users’ Task Assignments (medium 5.3)
- [CVE-2026-81818](https://insights.sbomify.com/CVE-2026-81818/): Flowintel Organization Administrator Can Reset Full Administrator Password and Escalate Privileges (high 8.6)
- [CVE-2026-81817](https://insights.sbomify.com/CVE-2026-81817/): Flowintel Missing Task-to-Case Authorization Allows Cross-Case Task Modification (high 7.2)
- [CVE-2026-81814](https://insights.sbomify.com/CVE-2026-81814/): Flowintel Stored XSS in Calendar via Malicious Case Title (medium 5.1)
- [CVE-2026-81813](https://insights.sbomify.com/CVE-2026-81813/): Elementor < 4.3.5 - Contributor+ Stored XSS via SVG CDATA Sanitizer Bypass (medium 6.8)
- [CVE-2026-81812](https://insights.sbomify.com/CVE-2026-81812/): Elementor < 4.3.5 - Author+ Stored XSS via SVG Upload (medium 6.4)
- [CVE-2026-81810](https://insights.sbomify.com/CVE-2026-81810/): Privilege escalation in All-in-One WP Migration and Backup (high 7.2)
- [CVE-2026-8181](https://insights.sbomify.com/CVE-2026-8181/): Burst Statistics 3.4.0 - 3.4.1.1 - Authentication Bypass to Admin Account Takeover (critical 9.8)
- [CVE-2026-81809](https://insights.sbomify.com/CVE-2026-81809/): Paytm Payment Gateway < 2.8.9 - Unauthenticated SQLi via Payment Callback (high 7.5)
- [CVE-2026-81807](https://insights.sbomify.com/CVE-2026-81807/): Simple Ajax Chat < 20260827 - Unauthenticated Stored XSS via Chat Message Linkification (high 8.8)
- [CVE-2026-81806](https://insights.sbomify.com/CVE-2026-81806/): WordPress Hide My WP Ghost plugin <= 7.0.09 - Server Side Request Forgery (SSRF) vulnerability (high 7.2)
- [CVE-2026-81805](https://insights.sbomify.com/CVE-2026-81805/): WordPress SiteSkite plugin <= 2.1.5 - Privilege Escalation vulnerability (high 8.1)
- [CVE-2026-81804](https://insights.sbomify.com/CVE-2026-81804/): WordPress ZHBackup – Backup, Restore & Migration plugin <= 2.4.2 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2026-81803](https://insights.sbomify.com/CVE-2026-81803/): WordPress RepairBuddy plugin <= 4.1224 - Remote Code Execution (RCE) vulnerability (high 7.5)
- [CVE-2026-81802](https://insights.sbomify.com/CVE-2026-81802/): WordPress WpEvently plugin <= 5.6.0 - Insecure Direct Object References (IDOR) vulnerability (medium 6.5)
- [CVE-2026-81801](https://insights.sbomify.com/CVE-2026-81801/): WordPress WP-Stateless plugin <= 4.4.1 - Settings Change vulnerability (high 8.1)
- [CVE-2026-81800](https://insights.sbomify.com/CVE-2026-81800/): WordPress Verified Reviews (Avis Vérifiés) plugin <= 2.4.6 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-8180](https://insights.sbomify.com/CVE-2026-8180/): Multiple vulnerabilities in Aspera applications. (high 7.5)
- [CVE-2026-81799](https://insights.sbomify.com/CVE-2026-81799/): WordPress Return Refund and Exchange For WooCommerce plugin <= 4.6.4 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-81798](https://insights.sbomify.com/CVE-2026-81798/): WordPress Easy Appointments plugin <= 4.0.2.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-81797](https://insights.sbomify.com/CVE-2026-81797/): WordPress Buzz Stone | Magazine & Viral Blog WordPress Theme theme <= 1.0.2 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-81796](https://insights.sbomify.com/CVE-2026-81796/): WordPress WP Travel plugin <= 12.0.3 - Broken Authentication vulnerability (high 7.3)
- [CVE-2026-81795](https://insights.sbomify.com/CVE-2026-81795/): WordPress Page Visits Counter – Lite plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-81794](https://insights.sbomify.com/CVE-2026-81794/): WordPress Shirt Product Designer for WooCommerce plugin 1.0.4 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-81793](https://insights.sbomify.com/CVE-2026-81793/): WordPress Salon booking system plugin <= 10.31.9 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-81792](https://insights.sbomify.com/CVE-2026-81792/): WordPress Product Catalog Enquiry for WooCommerce by MultiVendorX plugin <= 6.1.5 - Privilege Escalation vulnerability (medium 6.5)
- [CVE-2026-81791](https://insights.sbomify.com/CVE-2026-81791/): WordPress EventON plugin <= 2.5.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-81790](https://insights.sbomify.com/CVE-2026-81790/): WordPress Csomagpontok és szállítási címkék WooCommerce-hez plugin < 4.2.8 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-8179](https://insights.sbomify.com/CVE-2026-8179/): Multiple vulnerabilities in Aspera applications. (high 8.8)
- [CVE-2026-81789](https://insights.sbomify.com/CVE-2026-81789/): WordPress Advanced Product Fields Extended for WooCommerce plugin <= 3.1.6 - Arbitrary File Deletion vulnerability (high 8.6)
- [CVE-2026-81788](https://insights.sbomify.com/CVE-2026-81788/): WordPress IMPress for IDX Broker plugin <= 3.3.0 - Broken Access Control vulnerability (medium 6.3)
- [CVE-2026-81787](https://insights.sbomify.com/CVE-2026-81787/): WordPress IMPress for IDX Broker plugin <= 3.3.0 - Broken Authentication vulnerability (medium 6.5)
- [CVE-2026-81786](https://insights.sbomify.com/CVE-2026-81786/): WordPress Thank You Page Customizer for WooCommerce plugin <= 1.2.2 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-81785](https://insights.sbomify.com/CVE-2026-81785/): WordPress BuddyForms plugin <= 2.9.0 - Broken Access Control vulnerability (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/338/