# Vulnerabilities published in 2026


- [CVE-2026-80530](https://insights.sbomify.com/CVE-2026-80530/): xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (high 7.1)
- [CVE-2026-8053](https://insights.sbomify.com/CVE-2026-8053/): FlatBSON Duplicate Field Index Drift (high 8.7)
- [CVE-2026-80529](https://insights.sbomify.com/CVE-2026-80529/): xfs: don't swallow dquot recovery verification errors (not scored)
- [CVE-2026-80528](https://insights.sbomify.com/CVE-2026-80528/): ceph: avoid fs reclaim while using current->journal_info (critical 9.8)
- [CVE-2026-80527](https://insights.sbomify.com/CVE-2026-80527/): ceph: fix hanging __ceph_get_caps() with stale mds_wanted (high 7.5)
- [CVE-2026-80526](https://insights.sbomify.com/CVE-2026-80526/): ASoC: tas2562: Validate values for volume writes (high 7.8)
- [CVE-2026-80525](https://insights.sbomify.com/CVE-2026-80525/): ASoC: SOF: ipc4-topology: Refresh copier IPC payload before widget setup (not scored)
- [CVE-2026-80524](https://insights.sbomify.com/CVE-2026-80524/): optee: ffa: Add NULL check in optee_ffa_lend_protmem (not scored)
- [CVE-2026-80523](https://insights.sbomify.com/CVE-2026-80523/): clk: spacemit: k3: set hdma clock as critical (high 7.1)
- [CVE-2026-80522](https://insights.sbomify.com/CVE-2026-80522/): crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (high 7.8)
- [CVE-2026-80521](https://insights.sbomify.com/CVE-2026-80521/): af_unix: Unlink scc_entry in unix_del_edge(). (high 7.8)
- [CVE-2026-80520](https://insights.sbomify.com/CVE-2026-80520/): ovpn: fix NULL dereference when killing missing key (high 7.5)
- [CVE-2026-8052](https://insights.sbomify.com/CVE-2026-8052/): Nomad's exec2 task driver vulnerable to arbitrary file read/write on client host through symlink attack (medium 6.0)
- [CVE-2026-80519](https://insights.sbomify.com/CVE-2026-80519/): ovpn: finish crypto callback cleanup before peer release (critical 9.8)
- [CVE-2026-80518](https://insights.sbomify.com/CVE-2026-80518/): WP Ultimate CSV Importer < 9.2 - Unauthenticated Imported Data Disclosure via Predictable Log Path (low 3.7)
- [CVE-2026-80517](https://insights.sbomify.com/CVE-2026-80517/): WP Ultimate CSV Importer 7.17 - 9.1 - Admin+ Stored XSS via ZIP Import SVG Upload (low 3.5)
- [CVE-2026-80515](https://insights.sbomify.com/CVE-2026-80515/): Auth bypass in Eclipse Arrowhead (high 8.9)
- [CVE-2026-80514](https://insights.sbomify.com/CVE-2026-80514/): wpForo Forum 3.0.0 - 3.1.5 - Unauthenticated AI Credit Exhaustion via IP Rate Limit Bypass (medium 5.3)
- [CVE-2026-80513](https://insights.sbomify.com/CVE-2026-80513/): wpForo Forum < 3.1.6 - Subscriber+ PHP Object Injection via Profile Fields (high 7.5)
- [CVE-2026-8051](https://insights.sbomify.com/CVE-2026-8051/): Command injection in Virtual Traffic Manager (high 7.2)
- [CVE-2026-8050](https://insights.sbomify.com/CVE-2026-8050/): CVE-2026-8050 (high 7.5)
- [CVE-2026-80494](https://insights.sbomify.com/CVE-2026-80494/): Yogeta WP Cloud <= 1.0 - Unauthenticated Arbitrary File Download (high 8.6)
- [CVE-2026-80491](https://insights.sbomify.com/CVE-2026-80491/): SAMO Forms <= 1.0.0 - Unauthenticated SQLi (high 8.6)
- [CVE-2026-80490](https://insights.sbomify.com/CVE-2026-80490/): Algorithm::AhoCorasick::XS versions through 0.04 for Perl read the haystack string length before the scalar is stringified. (not scored)
- [CVE-2026-8049](https://insights.sbomify.com/CVE-2026-8049/): CVE-2026-8049 (medium 5.3)
- [CVE-2026-80489](https://insights.sbomify.com/CVE-2026-80489/): EUC_JISX0213 decoding may hang on crafted input (medium 5.9)
- [CVE-2026-80488](https://insights.sbomify.com/CVE-2026-80488/): WP Ultimate CSV Importer < 9.0 - Admin+ SQLi via AIOSEO Import Fields (medium 4.1)
- [CVE-2026-8048](https://insights.sbomify.com/CVE-2026-8048/): My Email Shortcode <= 0.91 - [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')] (medium 6.4)
- [CVE-2026-8047](https://insights.sbomify.com/CVE-2026-8047/): Out-of-bounds Write in CODESYS Control (high 8.7)
- [CVE-2026-80469](https://insights.sbomify.com/CVE-2026-80469/): CVE-2026-80469 (high 8.3)
- [CVE-2026-80467](https://insights.sbomify.com/CVE-2026-80467/): Privilege escalation in Advanced Custom Fields: Extended (high 8.1)
- [CVE-2026-80465](https://insights.sbomify.com/CVE-2026-80465/): Auth bypass in Mendix SAML (Mendix 10 compatible) (high 8.8)
- [CVE-2026-80464](https://insights.sbomify.com/CVE-2026-80464/): API Tool Runner SSRF in HAVELSAN's Sef - AI Chatbot Platform (medium 4.9)
- [CVE-2026-80463](https://insights.sbomify.com/CVE-2026-80463/): Apache bRPC: Unbounded Memory Accumulation in Stream Message Reassembly (not scored)
- [CVE-2026-80462](https://insights.sbomify.com/CVE-2026-80462/): Privilege Escalation in Progress Chef Automate (critical 10.0)
- [CVE-2026-8046](https://insights.sbomify.com/CVE-2026-8046/): Incorrect Authorization in CODESYS Control (high 7.2)
- [CVE-2026-8045](https://insights.sbomify.com/CVE-2026-8045/): XML external entity in EcoStruxure™ IT Data Center Expert (high 7.1)
- [CVE-2026-80444](https://insights.sbomify.com/CVE-2026-80444/): Unauthenticated Open Redirect Vulnerability in Abis Technology's AVESİS (medium 5.4)
- [CVE-2026-80443](https://insights.sbomify.com/CVE-2026-80443/): Insecure TLS Certificate Validation in API Tool Runner in HAVELSAN's Sef - AI Chatbot Platform (high 7.4)
- [CVE-2026-80442](https://insights.sbomify.com/CVE-2026-80442/): IBM Guardium Data Protection is affected by multiple vulnerabilities. (critical 9.9)
- [CVE-2026-80441](https://insights.sbomify.com/CVE-2026-80441/): IBM Guardium Data Protection is affected by multiple vulnerabilities. (critical 9.8)
- [CVE-2026-80440](https://insights.sbomify.com/CVE-2026-80440/): Hustle < 7.8.14.2 - Unauthenticated Arbitrary Shortcode Execution via Success Message Placeholders (medium 4.8)
- [CVE-2026-8044](https://insights.sbomify.com/CVE-2026-8044/): Command injection in EcoStruxure™ IT Data Center Expert (Formerly known as StruxureWare Data Center Expert) (high 8.6)
- [CVE-2026-80439](https://insights.sbomify.com/CVE-2026-80439/): Code injection in Redirection for Contact Form 7 (medium 4.8)
- [CVE-2026-80438](https://insights.sbomify.com/CVE-2026-80438/): Missing authorization in Ninja Forms (medium 5.9)
- [CVE-2026-80437](https://insights.sbomify.com/CVE-2026-80437/): Ninja Forms 3.14.10 - 3.15.1 - Unauthenticated Arbitrary Shortcode Execution via IP and Referer Merge Tags (medium 4.8)
- [CVE-2026-80436](https://insights.sbomify.com/CVE-2026-80436/): DataStage on Cloud Pak for Data has several vulnerabilities due to open source software (high 8.5)
- [CVE-2026-80434](https://insights.sbomify.com/CVE-2026-80434/): DataStage on Cloud Pak for Data has several vulnerabilities due to open source software (high 7.4)
- [CVE-2026-80433](https://insights.sbomify.com/CVE-2026-80433/): WordPress SureFeedback Client Site plugin <= 1.2.12 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2026-80432](https://insights.sbomify.com/CVE-2026-80432/): Missing authorization in kitty (medium 6.0)
- [CVE-2026-80431](https://insights.sbomify.com/CVE-2026-80431/): Out-of-bounds write in the kitty text sizing protocol allows termination of the terminal process (medium 6.8)
- [CVE-2026-80430](https://insights.sbomify.com/CVE-2026-80430/): Path traversal in kitty (medium 4.6)
- [CVE-2026-8043](https://insights.sbomify.com/CVE-2026-8043/): Path traversal in Xtraction (critical 9.6)
- [CVE-2026-80428](https://insights.sbomify.com/CVE-2026-80428/): ILIAS PHP Object Injection via Shibboleth Logout (critical 9.3)
- [CVE-2026-80427](https://insights.sbomify.com/CVE-2026-80427/): bestzip before 2.2.6 and 3.0.x before 3.0.2 Argument Injection via Missing Option Delimiter (high 8.6)
- [CVE-2026-80426](https://insights.sbomify.com/CVE-2026-80426/): FiftyOne before 1.21.0 Stored Cross-Site Scripting via Unescaped Field Description (high 7.0)
- [CVE-2026-80425](https://insights.sbomify.com/CVE-2026-80425/): DataStage on Cloud Pak for Data has several vulnerabilities (high 8.8)
- [CVE-2026-80424](https://insights.sbomify.com/CVE-2026-80424/): DataStage on Cloud Pak for Data has several vulnerabilities due to open source software (critical 9.1)
- [CVE-2026-80423](https://insights.sbomify.com/CVE-2026-80423/): DataStage on Cloud Pak for Data has several vulnerabilities (high 8.8)
- [CVE-2026-8042](https://insights.sbomify.com/CVE-2026-8042/): Github Shortcode <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2026-80412](https://insights.sbomify.com/CVE-2026-80412/): DataStage on Cloud Pak for Data has several vulnerabilities (high 8.8)
- [CVE-2026-8040](https://insights.sbomify.com/CVE-2026-8040/): faq shortocde <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'color' Shortcode Attribute (medium 6.4)
- [CVE-2026-8039](https://insights.sbomify.com/CVE-2026-8039/): Fancy Testimonials <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2026-80381](https://insights.sbomify.com/CVE-2026-80381/): Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection (critical 9.8)
- [CVE-2026-80380](https://insights.sbomify.com/CVE-2026-80380/): DataStage on Cloud Pak for Data has several vulnerabilities due to open source software (high 7.1)
- [CVE-2026-8038](https://insights.sbomify.com/CVE-2026-8038/): Faces of Users <= 0.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'default' Shortcode Attribute (medium 6.4)
- [CVE-2026-80379](https://insights.sbomify.com/CVE-2026-80379/): DataStage on Cloud Pak for Data has several vulnerabilities (high 8.8)
- [CVE-2026-80378](https://insights.sbomify.com/CVE-2026-80378/): DataStage on Cloud Pak for Data has several vulnerabilities due to open source software (high 8.5)
- [CVE-2026-8037](https://insights.sbomify.com/CVE-2026-8037/): Progress LoadMaster Command Injection (critical 9.6, exploited in the wild)
- [CVE-2026-8036](https://insights.sbomify.com/CVE-2026-8036/): Local privilege escalation in NI-PAL (high 8.4)
- [CVE-2026-80359](https://insights.sbomify.com/CVE-2026-80359/): Missing authorization in Boot Optimized Server Storage (BOSS) (medium 6.8)
- [CVE-2026-80358](https://insights.sbomify.com/CVE-2026-80358/): Missing authorization in Boot Optimized Server Storage (BOSS) (medium 5.1)
- [CVE-2026-80357](https://insights.sbomify.com/CVE-2026-80357/): Missing authorization in Boot Optimized Server Storage (BOSS) (high 7.0)
- [CVE-2026-80356](https://insights.sbomify.com/CVE-2026-80356/): Information disclosure in OpenManage Server Administrator Managed Node (Patch) for Windows (high 7.3)
- [CVE-2026-80355](https://insights.sbomify.com/CVE-2026-80355/): Cross-site request forgery in OpenManage Server Administrator Managed Node (Patch) for Windows (medium 5.4)
- [CVE-2026-80354](https://insights.sbomify.com/CVE-2026-80354/): Apache Camel K: Camel K Builder trait mavenProfiles ValueSources resolve tenant-named secrets in operator namespace (high 8.1)
- [CVE-2026-80353](https://insights.sbomify.com/CVE-2026-80353/): Race condition in Apache Tomcat (high 8.1)
- [CVE-2026-80352](https://insights.sbomify.com/CVE-2026-80352/): Apache Camel K: Camel K Master trait serviceAccountName YAML injection lets CR author apply arbitrary objects (critical 9.8)
- [CVE-2026-80351](https://insights.sbomify.com/CVE-2026-80351/): Apache Camel K: Camel K Tenant repositories reach Maven execution inside operator pod (critical 9.8)
- [CVE-2026-80350](https://insights.sbomify.com/CVE-2026-80350/): OneUptime before 12.0.7 Server-Side Request Forgery via IPv4-Mapped IPv6 Webhook URL (high 7.1)
- [CVE-2026-8035](https://insights.sbomify.com/CVE-2026-8035/): NULL pointer dereference in NI-PAL (medium 6.9)
- [CVE-2026-80349](https://insights.sbomify.com/CVE-2026-80349/): TarsWeb through 3.0.14 Authentication Bypass via Spoofed X-Forwarded-For and uid Parameter (critical 9.3)
- [CVE-2026-80348](https://insights.sbomify.com/CVE-2026-80348/): TarsWeb through 3.0.16 Missing Authorization on Patch Deploy, Download and Delete Endpoints (high 8.7)
- [CVE-2026-80347](https://insights.sbomify.com/CVE-2026-80347/): mcp-fetch through 1.6.3 Server-Side Request Forgery via Unstripped IPv6 Literal Brackets (high 8.7)
- [CVE-2026-80346](https://insights.sbomify.com/CVE-2026-80346/): StarRocks through 4.0.13 Missing Authorization on DROP MATERIALIZED VIEW for Legacy Synchronous Materialized Views (high 7.1)
- [CVE-2026-80344](https://insights.sbomify.com/CVE-2026-80344/): Apache Camel: Camel-AS2 Server-Side Request Forgery and Credential Disclosure via Asynchronous MDN Delivery Address (high 8.2)
- [CVE-2026-80343](https://insights.sbomify.com/CVE-2026-80343/): Apache Camel: Camel-Netty-HTTP Security Constraint Bypass via Case-Sensitive Context-Path Matching (high 8.2)
- [CVE-2026-80342](https://insights.sbomify.com/CVE-2026-80342/): Payment Plugins for PayPal WooCommerce < 2.0.27 - Unauthenticated Payment Hijacking via Unvalidated PayPal Order ID (medium 6.5)
- [CVE-2026-80341](https://insights.sbomify.com/CVE-2026-80341/): Payment Plugins for PayPal WooCommerce < 2.0.26 - Subscriber+ Stored Payment Method Assignment via IDOR (medium 5.9)
- [CVE-2026-80340](https://insights.sbomify.com/CVE-2026-80340/): Payment Plugins for PayPal WooCommerce < 2.0.26 - Unauthenticated Customer PII Disclosure via order-pay (medium 5.3)
- [CVE-2026-8034](https://insights.sbomify.com/CVE-2026-8034/): Server-side request forgery vulnerability in GitHub Enterprise Server notebook viewer via URL parser confusion (high 7.9)
- [CVE-2026-80339](https://insights.sbomify.com/CVE-2026-80339/): Payment Plugins for Stripe WooCommerce < 4.0.12 - Unauthenticated Customer PII Disclosure via order-pay (medium 5.3)
- [CVE-2026-80338](https://insights.sbomify.com/CVE-2026-80338/): CMB2 < 2.13.0 - Subscriber+ Arbitrary Option Corruption via oEmbed Handler (medium 6.8)
- [CVE-2026-80337](https://insights.sbomify.com/CVE-2026-80337/): Unauthorized Cross-Chatbot Tool Invocation in HAVELSAN's Sef - AI Chatbot Platform (medium 5.3)
- [CVE-2026-80333](https://insights.sbomify.com/CVE-2026-80333/): Solace Extra < 1.7.2 - Unauthenticated Non-Published Post Content Disclosure via Preview Routes (medium 5.3)
- [CVE-2026-8033](https://insights.sbomify.com/CVE-2026-8033/): PicoTronica e-Clinic Healthcare System ECHS Response Header v2 information disclosure (medium 6.9)
- [CVE-2026-80327](https://insights.sbomify.com/CVE-2026-80327/): Open Redirect in PingGateway Fragment Filter (medium 5.1)
- [CVE-2026-8032](https://insights.sbomify.com/CVE-2026-8032/): PicoTronica e-Clinic Healthcare System ECHS echs.js hard-coded credentials (medium 6.9)
- [CVE-2026-80312](https://insights.sbomify.com/CVE-2026-80312/): Apache Camel: Camel-OAuth Authentication Bypass via Fail-Open Processors (high 8.2)
- [CVE-2026-80311](https://insights.sbomify.com/CVE-2026-80311/): Stripe Payment Forms by WP Full Pay < 8.5.5 - Cross-Customer Subscription Cancellation via IDOR (medium 4.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/349/