# Vulnerabilities published in 2026


- [CVE-2026-8031](https://insights.sbomify.com/CVE-2026-8031/): PicoTronica e-Clinic Healthcare System ECHS API Endpoint patient-records missing authentication (medium 6.9)
- [CVE-2026-8030](https://insights.sbomify.com/CVE-2026-8030/): Missing Authorization in GitLab (medium 4.3)
- [CVE-2026-80298](https://insights.sbomify.com/CVE-2026-80298/): SQL Injection in HAVELSAN's Sef - AI Chatbot Platform (high 8.8)
- [CVE-2026-8029](https://insights.sbomify.com/CVE-2026-8029/): SQL Injection Vulnerability in ZTE SmartLife App (low 3.9)
- [CVE-2026-8028](https://insights.sbomify.com/CVE-2026-8028/): FlowiseAI Flowise Endpoint account.service.ts verify information disclosure (medium 6.3)
- [CVE-2026-80276](https://insights.sbomify.com/CVE-2026-80276/): Comelit 1456B gateway exposes remote configuration password via unauthenticated management interface (high 7.5)
- [CVE-2026-80275](https://insights.sbomify.com/CVE-2026-80275/): Comelit 1456B gateway allows low priviledge user to overwrite installer password via unauthorized endpoint (high 8.8)
- [CVE-2026-80274](https://insights.sbomify.com/CVE-2026-80274/): Validating resolver can abort while caching a mismatched NOQNAME proof (high 7.5)
- [CVE-2026-8027](https://insights.sbomify.com/CVE-2026-8027/): FlowiseAI Flowise User Controller authorization (medium 5.3)
- [CVE-2026-8026](https://insights.sbomify.com/CVE-2026-8026/): FlowiseAI Flowise API Response account.service.ts login information disclosure (medium 6.3)
- [CVE-2026-80255](https://insights.sbomify.com/CVE-2026-80255/): secure cookie attribute bypass with tab (high 7.5)
- [CVE-2026-80254](https://insights.sbomify.com/CVE-2026-80254/): Missing authorization in ShizenBox2 (edge-app) (high 7.1)
- [CVE-2026-80253](https://insights.sbomify.com/CVE-2026-80253/): Auth bypass in ShizenBox2 (dev-conf) (high 7.0)
- [CVE-2026-8025](https://insights.sbomify.com/CVE-2026-8025/): SQLi in MOSK Informatics' CBS Platform (critical 9.8)
- [CVE-2026-8024](https://insights.sbomify.com/CVE-2026-8024/): Deserialization vulnerability in ibaPDA and ibaDatCoordinator (critical 9.3)
- [CVE-2026-80239](https://insights.sbomify.com/CVE-2026-80239/): Information disclosure in Secure Connect Gateway 5.0 - Appliance (low 2.4)
- [CVE-2026-80238](https://insights.sbomify.com/CVE-2026-80238/): Privilege escalation in Secure Connect Gateway 5.0 - Appliance (critical 9.3)
- [CVE-2026-80237](https://insights.sbomify.com/CVE-2026-80237/): Thinking Software Technology｜Efence - Arbitrary File Upload (high 8.7)
- [CVE-2026-80236](https://insights.sbomify.com/CVE-2026-80236/): Thinking Software Technology｜Efence - SQL Injection (high 8.8)
- [CVE-2026-80235](https://insights.sbomify.com/CVE-2026-80235/): Thinking Software Technology｜EFence - Arbitrary File Upload (critical 9.3)
- [CVE-2026-80234](https://insights.sbomify.com/CVE-2026-80234/): CAYIN Technology｜CAYIN CMS-WS/CMS-SE - Missing Authentication (medium 6.9)
- [CVE-2026-80233](https://insights.sbomify.com/CVE-2026-80233/): CAYIN Technology｜CAYIN CMS-WS/CMS-SE/SMP - Arbitrary File Upload (high 8.6)
- [CVE-2026-80231](https://insights.sbomify.com/CVE-2026-80231/): native CA store conn reuse (high 7.5)
- [CVE-2026-80230](https://insights.sbomify.com/CVE-2026-80230/): OpenSSL pinning bypass (high 7.5)
- [CVE-2026-8023](https://insights.sbomify.com/CVE-2026-8023/): Path traversal in zephyr (high 7.5)
- [CVE-2026-80229](https://insights.sbomify.com/CVE-2026-80229/): OpenSSL provider use-after-free (high 7.5)
- [CVE-2026-80227](https://insights.sbomify.com/CVE-2026-80227/): SQL string_trim removes only spaces, diverging from in-memory trimming in AshSql (low 2.1)
- [CVE-2026-80225](https://insights.sbomify.com/CVE-2026-80225/): Possible degradation of service from continuous queries on the same TCP/DoT connection (medium 5.3)
- [CVE-2026-80223](https://insights.sbomify.com/CVE-2026-80223/): Cross-tenant subscription disclosure in AshGraphql authorizes notifications in memory without a tenant-scoped read (high 7.1)
- [CVE-2026-8022](https://insights.sbomify.com/CVE-2026-8022/): Information disclosure in Chrome (low 3.1)
- [CVE-2026-80218](https://insights.sbomify.com/CVE-2026-80218/): Sign-in token minted for one resource accepted by another in AshAuthentication (high 7.6)
- [CVE-2026-80217](https://insights.sbomify.com/CVE-2026-80217/): Command injection in FF-RFI078I4 (high 8.7)
- [CVE-2026-80214](https://insights.sbomify.com/CVE-2026-80214/): LibreNMS Virtualisation Discovery Module RCE (high 8.6)
- [CVE-2026-80213](https://insights.sbomify.com/CVE-2026-80213/): Other in resolv (medium 4.0)
- [CVE-2026-80212](https://insights.sbomify.com/CVE-2026-80212/): Denial of service in resolv (high 7.5)
- [CVE-2026-80211](https://insights.sbomify.com/CVE-2026-80211/): FrontAccounting through 2.4.20 Use of Unsalted MD5 for Password Storage (high 8.2)
- [CVE-2026-80210](https://insights.sbomify.com/CVE-2026-80210/): FrontAccounting through 2.4.20 Cross-Site Request Forgery on Financial Transaction Forms (high 7.1)
- [CVE-2026-8021](https://insights.sbomify.com/CVE-2026-8021/): Cross-site scripting in Chrome (medium 4.2)
- [CVE-2026-80209](https://insights.sbomify.com/CVE-2026-80209/): Fonoster through 0.22.7 Incorrect Authorization in the Identity UpdateWorkspace Handler (medium 5.3)
- [CVE-2026-80208](https://insights.sbomify.com/CVE-2026-80208/): APITable through 1.13.0-beta.1 Missing Authentication on the Internal Account Closure Endpoints (high 8.8)
- [CVE-2026-80207](https://insights.sbomify.com/CVE-2026-80207/): APITable through 1.13.0-beta.1 Missing Authentication on the Internal Notification Create Endpoint (medium 6.9)
- [CVE-2026-80206](https://insights.sbomify.com/CVE-2026-80206/): NLTK 3.10.2 Regular Expression Denial of Service via tgrep (high 8.2)
- [CVE-2026-80205](https://insights.sbomify.com/CVE-2026-80205/): NLTK before 3.10.0 ReDoS via Text.findall() unvalidated regex (high 8.7)
- [CVE-2026-80204](https://insights.sbomify.com/CVE-2026-80204/): Grav before 1.0.18 Authentication Bypass via Scoped API Key (critical 9.3)
- [CVE-2026-80203](https://insights.sbomify.com/CVE-2026-80203/): Grav before 1.0.18 Authentication Bypass via Scoped API Key (critical 9.3)
- [CVE-2026-80202](https://insights.sbomify.com/CVE-2026-80202/): Kimai before 2.56.0 Authorization Bypass via TimesheetVoter (critical 9.3)
- [CVE-2026-80201](https://insights.sbomify.com/CVE-2026-80201/): Kimai before 2.53.0 API Token Leakage via Invoice Template (low 2.0)
- [CVE-2026-80200](https://insights.sbomify.com/CVE-2026-80200/): Kimai before 2.53.0 Open Redirect via RelayState (medium 5.3)
- [CVE-2026-8020](https://insights.sbomify.com/CVE-2026-8020/): Information disclosure in Chrome (medium 5.3)
- [CVE-2026-80199](https://insights.sbomify.com/CVE-2026-80199/): Kimai before 2.54.0 Username Enumeration via Timing Oracle (medium 6.3)
- [CVE-2026-80198](https://insights.sbomify.com/CVE-2026-80198/): Kimai before 2.56.0 Information Disclosure via config() Twig Function (high 8.7)
- [CVE-2026-80197](https://insights.sbomify.com/CVE-2026-80197/): Kimai before 2.57.0 Improper Authorization via Favorite Endpoints (high 8.7)
- [CVE-2026-80196](https://insights.sbomify.com/CVE-2026-80196/): Kimai before 2.58.0 Authentication Bypass via Password Reset Link (high 8.7)
- [CVE-2026-80195](https://insights.sbomify.com/CVE-2026-80195/): Kimai before 2.63.0 Team Membership Removal via API (high 8.7)
- [CVE-2026-80194](https://insights.sbomify.com/CVE-2026-80194/): Kimai before 2.64.0 Missing Authorization via ProjectViewController export (high 8.7)
- [CVE-2026-80193](https://insights.sbomify.com/CVE-2026-80193/): Kimai before 2.62.0 Authorization Bypass via QuickEntry (high 8.7)
- [CVE-2026-80192](https://insights.sbomify.com/CVE-2026-80192/): better-auth SSO before 1.6.27 Domain Ownership Authentication Bypass (high 8.6)
- [CVE-2026-80191](https://insights.sbomify.com/CVE-2026-80191/): GROWI before 8.0.2 Missing Authorization on Attachment Retrieval for Unauthenticated Requests (high 8.7)
- [CVE-2026-80190](https://insights.sbomify.com/CVE-2026-80190/): Apache Allura: Stored XSS via code repositories (medium 6.1)
- [CVE-2026-8019](https://insights.sbomify.com/CVE-2026-8019/): Security feature bypass in Chrome (medium 5.4)
- [CVE-2026-80189](https://insights.sbomify.com/CVE-2026-80189/): LeafWiki 0.10.0 through 0.12.0 Uncontrolled Resource Consumption via Unbounded ZIP Extraction (high 7.1)
- [CVE-2026-80186](https://insights.sbomify.com/CVE-2026-80186/): Bluez: stack overflow in name2utf8 causes dos and potential code execution (high 7.6)
- [CVE-2026-80185](https://insights.sbomify.com/CVE-2026-80185/): Bluez: sdp-xml: bluez 5.86: unprivileged-local and adjacent-le-peer leads to arbitrary code execution as root (medium 5.7)
- [CVE-2026-80184](https://insights.sbomify.com/CVE-2026-80184/): Security feature bypass in Keystone (high 7.6)
- [CVE-2026-80183](https://insights.sbomify.com/CVE-2026-80183/): Missing authorization in Keystone (high 7.1)
- [CVE-2026-80182](https://insights.sbomify.com/CVE-2026-80182/): Security feature bypass in Keystone (high 7.6)
- [CVE-2026-80181](https://insights.sbomify.com/CVE-2026-80181/): Apache Allura: Server-side request forgery (critical 9.1)
- [CVE-2026-80180](https://insights.sbomify.com/CVE-2026-80180/): Apache Allura: Stored XSS via markdown HTML processing (medium 6.1)
- [CVE-2026-8018](https://insights.sbomify.com/CVE-2026-8018/): Security feature bypass in Chrome (high 8.1)
- [CVE-2026-80179](https://insights.sbomify.com/CVE-2026-80179/): Jwcrypto: jwcrypto: denial of service via malformed jwe tokens (medium 5.9)
- [CVE-2026-80178](https://insights.sbomify.com/CVE-2026-80178/): Privilege escalation in Secure Connect Gateway 5.0 - Appliance (medium 5.5)
- [CVE-2026-80177](https://insights.sbomify.com/CVE-2026-80177/): SQL injection in Secure Connect Gateway 5.0 - Appliance (medium 6.5)
- [CVE-2026-80176](https://insights.sbomify.com/CVE-2026-80176/): Information disclosure in Secure Connect Gateway 5.0 - Appliance (medium 4.7)
- [CVE-2026-80175](https://insights.sbomify.com/CVE-2026-80175/): Information disclosure in Secure Connect Gateway 5.0 - Appliance (low 3.3)
- [CVE-2026-80174](https://insights.sbomify.com/CVE-2026-80174/): Auth bypass in Secure Connect Gateway 5.0 - Appliance (medium 5.3)
- [CVE-2026-80172](https://insights.sbomify.com/CVE-2026-80172/): Auth bypass in Secure Connect Gateway 5.0 - Appliance (critical 9.8)
- [CVE-2026-80171](https://insights.sbomify.com/CVE-2026-80171/): Weak cryptography in Secure Connect Gateway 5.0 - Appliance (medium 4.7)
- [CVE-2026-80170](https://insights.sbomify.com/CVE-2026-80170/): Hardcoded credentials in Secure Connect Gateway 5.0 - Appliance (medium 6.5)
- [CVE-2026-8017](https://insights.sbomify.com/CVE-2026-8017/): Information disclosure in Chrome (low 3.1)
- [CVE-2026-80169](https://insights.sbomify.com/CVE-2026-80169/): Information disclosure in Secure Connect Gateway 5.0 - Appliance (low 3.3)
- [CVE-2026-80167](https://insights.sbomify.com/CVE-2026-80167/): Hardcoded credentials in Secure Connect Gateway 5.0 - Appliance (medium 5.5)
- [CVE-2026-80166](https://insights.sbomify.com/CVE-2026-80166/): Privilege escalation in Secure Connect Gateway 5.0 - Appliance (high 7.8)
- [CVE-2026-80164](https://insights.sbomify.com/CVE-2026-80164/): Security feature bypass in Secure Connect Gateway 5.0 - Appliance (high 7.4)
- [CVE-2026-80162](https://insights.sbomify.com/CVE-2026-80162/): Acrobat Reader | Use After Free (CWE-416) (medium 5.5)
- [CVE-2026-80161](https://insights.sbomify.com/CVE-2026-80161/): Acrobat Reader | Access of Resource Using Incompatible Type ('Type Confusion') (CWE-843) (high 7.8)
- [CVE-2026-80160](https://insights.sbomify.com/CVE-2026-80160/): Acrobat Reader | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2026-8016](https://insights.sbomify.com/CVE-2026-8016/): Use after free in Chrome (high 8.8)
- [CVE-2026-80159](https://insights.sbomify.com/CVE-2026-80159/): Acrobat Reader | Untrusted Search Path (CWE-426) (medium 4.0)
- [CVE-2026-80158](https://insights.sbomify.com/CVE-2026-80158/): Information disclosure in Red Hat Ceph Storage 5 (medium 5.5)
- [CVE-2026-80156](https://insights.sbomify.com/CVE-2026-80156/): Lantronix Autonomous Out-of-Band Devices Arbitrary File Write via Upload Filename Validation Bypass (critical 9.4)
- [CVE-2026-80155](https://insights.sbomify.com/CVE-2026-80155/): Lantronix Autonomous Out-of-Band Devices Unauthenticated Authentication Bypass via snprintf Path Truncation (critical 10.0)
- [CVE-2026-80154](https://insights.sbomify.com/CVE-2026-80154/): Lantronix Autonomous Out-of-Band Devices Predictable Session Token with Validation Bypass (high 8.9)
- [CVE-2026-80152](https://insights.sbomify.com/CVE-2026-80152/): Lantronix Autonomous Out-of-Band Devices OS Command Injection via set script schedule (critical 9.4)
- [CVE-2026-80151](https://insights.sbomify.com/CVE-2026-80151/): Lantronix Autonomous Out-of-Band Devices OS Command Injection via set nfs download (critical 9.4)
- [CVE-2026-80150](https://insights.sbomify.com/CVE-2026-80150/): Lantronix Autonomous Out-of-Band Devices WebTelnet SSRF via rooturl Parameter (high 7.7)
- [CVE-2026-8015](https://insights.sbomify.com/CVE-2026-8015/): Other in Chrome (medium 5.4)
- [CVE-2026-80149](https://insights.sbomify.com/CVE-2026-80149/): Lantronix Autonomous Out-of-Band Devices WebSSH SSRF via rooturl Parameter (high 7.7)
- [CVE-2026-80148](https://insights.sbomify.com/CVE-2026-80148/): Lantronix Autonomous Out-of-Band Devices WebSSH SSRF via Username Truncation (high 7.7)
- [CVE-2026-80147](https://insights.sbomify.com/CVE-2026-80147/): Lantronix Autonomous Out-of-Band Devices Stack-Based Buffer Overflow via mfc eeprom write (critical 9.4)
- [CVE-2026-80146](https://insights.sbomify.com/CVE-2026-80146/): Lantronix Autonomous Out-of-Band Devices Stack-Based Buffer Overflow via mfc eeprom read (critical 9.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/350/