# Vulnerabilities published in 2026


- [CVE-2026-80145](https://insights.sbomify.com/CVE-2026-80145/): Lantronix Autonomous Out-of-Band Devices CLI Command Injection via set cifs password (critical 9.4)
- [CVE-2026-80144](https://insights.sbomify.com/CVE-2026-80144/): Lantronix Autonomous Out-of-Band Devices CLI Command Injection via mfc eeprom write (critical 9.4)
- [CVE-2026-80143](https://insights.sbomify.com/CVE-2026-80143/): Lantronix Autonomous Out-of-Band Devices CLI Command Injection via mfc eeprom read (critical 9.4)
- [CVE-2026-8014](https://insights.sbomify.com/CVE-2026-8014/): Information disclosure in Chrome (medium 4.3)
- [CVE-2026-80138](https://insights.sbomify.com/CVE-2026-80138/): ClipBucket V5 5.5.1 through 5.5.3-#153 OS Command Injection via Installer php_cli_filepath Parameter (critical 9.2)
- [CVE-2026-80135](https://insights.sbomify.com/CVE-2026-80135/): Security feature bypass in Secure Connect Gateway 5.0 - Appliance (high 7.5)
- [CVE-2026-80134](https://insights.sbomify.com/CVE-2026-80134/): Hardcoded credentials in Secure Connect Gateway 5.0 - Appliance (high 7.7)
- [CVE-2026-80133](https://insights.sbomify.com/CVE-2026-80133/): Path traversal in Secure Connect Gateway 5.0 - Appliance (high 7.4)
- [CVE-2026-80132](https://insights.sbomify.com/CVE-2026-80132/): Auth bypass in Secure Connect Gateway 5.0 - Appliance (high 8.1)
- [CVE-2026-80131](https://insights.sbomify.com/CVE-2026-80131/): Path traversal in Secure Connect Gateway 5.0 - Appliance (high 7.4)
- [CVE-2026-80130](https://insights.sbomify.com/CVE-2026-80130/): Path traversal in Secure Connect Gateway 5.0 - Appliance (high 7.1)
- [CVE-2026-8013](https://insights.sbomify.com/CVE-2026-8013/): Information disclosure in Chrome (medium 4.3)
- [CVE-2026-80129](https://insights.sbomify.com/CVE-2026-80129/): Path traversal in Secure Connect Gateway 5.0 - Appliance (medium 6.5)
- [CVE-2026-80128](https://insights.sbomify.com/CVE-2026-80128/): Auth bypass in Secure Connect Gateway 5.0 - Appliance (medium 6.4)
- [CVE-2026-80127](https://insights.sbomify.com/CVE-2026-80127/): Command injection in Secure Connect Gateway 5.0 - Appliance (high 7.2)
- [CVE-2026-80126](https://insights.sbomify.com/CVE-2026-80126/): Other in Secure Connect Gateway 5.0 - Appliance (medium 6.5)
- [CVE-2026-80125](https://insights.sbomify.com/CVE-2026-80125/): Security feature bypass in Secure Connect Gateway 5.0 - Appliance (medium 5.9)
- [CVE-2026-80124](https://insights.sbomify.com/CVE-2026-80124/): Information disclosure in Secure Connect Gateway 5.0 - Appliance (medium 5.5)
- [CVE-2026-80123](https://insights.sbomify.com/CVE-2026-80123/): Server-side request forgery in Secure Connect Gateway 5.0 - Appliance (high 7.3)
- [CVE-2026-80122](https://insights.sbomify.com/CVE-2026-80122/): Security feature bypass in Secure Connect Gateway 5.0 - Appliance (high 7.3)
- [CVE-2026-8012](https://insights.sbomify.com/CVE-2026-8012/): Cross-site scripting in Chrome (medium 5.4)
- [CVE-2026-80119](https://insights.sbomify.com/CVE-2026-80119/): PassMark PerformanceTest, BurnInTest, and OSForensics Physical Memory Disclosure via DirectIo64.sys IOCTL (high 8.5)
- [CVE-2026-80118](https://insights.sbomify.com/CVE-2026-80118/): PassMark PerformanceTest, BurnInTest, and OSForensics Kernel Null Pointer Dereference via DirectIo64.sys IOCTL (high 8.4)
- [CVE-2026-80117](https://insights.sbomify.com/CVE-2026-80117/): PassMark PerformanceTest, BurnInTest, and OSForensics Arbitrary I/O Port Access via DirectIo64.sys (medium 6.9)
- [CVE-2026-80116](https://insights.sbomify.com/CVE-2026-80116/): PassMark PerformanceTest, BurnInTest, and OSForensics Privilege Escalation via DirectIo64.sys IOCTL (high 8.5)
- [CVE-2026-80115](https://insights.sbomify.com/CVE-2026-80115/): PassMark PerformanceTest, BurnInTest, and OSForensics Kernel Crash via DirectIo64.sys MSR Write IOCTL (medium 6.9)
- [CVE-2026-80114](https://insights.sbomify.com/CVE-2026-80114/): PassMark PerformanceTest, BurnInTest, and OSForensics Hard-coded Credentials Authentication Bypass via DirectIo64.sys (high 8.5)
- [CVE-2026-80113](https://insights.sbomify.com/CVE-2026-80113/): PassMark PerformanceTest, BurnInTest, and OSForensics Arbitrary Bit Clear via DirectIo64.sys IOCTL (medium 6.9)
- [CVE-2026-80112](https://insights.sbomify.com/CVE-2026-80112/): PassMark PerformanceTest, BurnInTest, and OSForensics Improper Access Control via DirectIo64.sys (high 8.5)
- [CVE-2026-80110](https://insights.sbomify.com/CVE-2026-80110/): Missing authorization in Red Hat Certificate System 9 (high 8.1)
- [CVE-2026-8011](https://insights.sbomify.com/CVE-2026-8011/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2026-80104](https://insights.sbomify.com/CVE-2026-80104/): DB-GPT 0.8.0 Path Traversal Arbitrary File Write via Skill Upload Filename (critical 9.3)
- [CVE-2026-80101](https://insights.sbomify.com/CVE-2026-80101/): Gimp: multiple heap out-of-bounds reads in xwd loader from unrelated width and bytes-per-line validation (medium 4.4)
- [CVE-2026-8010](https://insights.sbomify.com/CVE-2026-8010/): Security feature bypass in Chrome (medium 6.3)
- [CVE-2026-80099](https://insights.sbomify.com/CVE-2026-80099/): Auth bypass in WP Module Data (high 8.8)
- [CVE-2026-80098](https://insights.sbomify.com/CVE-2026-80098/): Copilot Studio Elevation of Privilege Vulnerability (critical 9.3)
- [CVE-2026-80097](https://insights.sbomify.com/CVE-2026-80097/): Microsoft Authenticator Elevation of Privilege Vulnerability (high 8.6)
- [CVE-2026-80096](https://insights.sbomify.com/CVE-2026-80096/): Windows Remote Desktop Services Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-80093](https://insights.sbomify.com/CVE-2026-80093/): Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-80092](https://insights.sbomify.com/CVE-2026-80092/): Microsoft Identity Web Elevation of Privilege Vulnerability (medium 5.3)
- [CVE-2026-80091](https://insights.sbomify.com/CVE-2026-80091/): Microsoft Office Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-80090](https://insights.sbomify.com/CVE-2026-80090/): Microsoft Office Word Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-8009](https://insights.sbomify.com/CVE-2026-8009/): Security feature bypass in Chrome (medium 5.0)
- [CVE-2026-80089](https://insights.sbomify.com/CVE-2026-80089/): Microsoft Office Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-80088](https://insights.sbomify.com/CVE-2026-80088/): Microsoft Office Word Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-80087](https://insights.sbomify.com/CVE-2026-80087/): Microsoft Office Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-80086](https://insights.sbomify.com/CVE-2026-80086/): Microsoft Office PowerPoint Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-80085](https://insights.sbomify.com/CVE-2026-80085/): Microsoft Office Word Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-80084](https://insights.sbomify.com/CVE-2026-80084/): Microsoft Office Outlook Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-80083](https://insights.sbomify.com/CVE-2026-80083/): Windows Hyper-V Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-80082](https://insights.sbomify.com/CVE-2026-80082/): Microsoft Office Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-80081](https://insights.sbomify.com/CVE-2026-80081/): Microsoft Office PowerPoint Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-80080](https://insights.sbomify.com/CVE-2026-80080/): Microsoft Office Word Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-8008](https://insights.sbomify.com/CVE-2026-8008/): Other in Chrome (medium 5.4)
- [CVE-2026-80079](https://insights.sbomify.com/CVE-2026-80079/): Microsoft Office Word Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-80078](https://insights.sbomify.com/CVE-2026-80078/): Microsoft Office Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-80077](https://insights.sbomify.com/CVE-2026-80077/): Remote Desktop Client Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-80076](https://insights.sbomify.com/CVE-2026-80076/): Microsoft Office Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-80075](https://insights.sbomify.com/CVE-2026-80075/): Windows Work Folders Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-80074](https://insights.sbomify.com/CVE-2026-80074/): Remote Desktop Client Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-80073](https://insights.sbomify.com/CVE-2026-80073/): Microsoft Office Outlook Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-80072](https://insights.sbomify.com/CVE-2026-80072/): User Registration & Membership < 5.2.8 - Unauthenticated Open Redirect via Login Redirect Parameters (medium 4.7)
- [CVE-2026-80071](https://insights.sbomify.com/CVE-2026-80071/): User Registration & Membership < 5.2.8 - Author+ Privilege Escalation to Administrator (high 7.2)
- [CVE-2026-8007](https://insights.sbomify.com/CVE-2026-8007/): Privilege escalation in Chrome (high 7.5)
- [CVE-2026-80069](https://insights.sbomify.com/CVE-2026-80069/): MasterStudy LMS WordPress Plugin < 3.7.50 Missing Authorization via stm_lms_send_test_email_ajax (medium 5.3)
- [CVE-2026-80067](https://insights.sbomify.com/CVE-2026-80067/): MasterStudy LMS WordPress Plugin < 3.7.50 Path Traversal via stm_lms_step Parameter (medium 5.3)
- [CVE-2026-8006](https://insights.sbomify.com/CVE-2026-8006/): Security feature bypass in Chrome (medium 5.4)
- [CVE-2026-80058](https://insights.sbomify.com/CVE-2026-80058/): Information disclosure in Secure Connect Gateway 5.0 - Appliance (medium 5.5)
- [CVE-2026-80057](https://insights.sbomify.com/CVE-2026-80057/): Hardcoded credentials in Secure Connect Gateway 5.0 - Appliance (medium 5.5)
- [CVE-2026-80056](https://insights.sbomify.com/CVE-2026-80056/): Information disclosure in Secure Connect Gateway 5.0 - Appliance (medium 5.5)
- [CVE-2026-80055](https://insights.sbomify.com/CVE-2026-80055/): Other in Secure Connect Gateway 5.0 - Appliance (medium 4.4)
- [CVE-2026-80054](https://insights.sbomify.com/CVE-2026-80054/): Misconfiguration in Secure Connect Gateway 5.0 - Appliance (medium 5.5)
- [CVE-2026-80051](https://insights.sbomify.com/CVE-2026-80051/): Denial of service in graphql-go (medium 5.9)
- [CVE-2026-80050](https://insights.sbomify.com/CVE-2026-80050/): ContiNew Admin through 4.1.0 Missing Authorization and File-Type Allowlist on Multipart Upload Endpoints (high 7.1)
- [CVE-2026-8005](https://insights.sbomify.com/CVE-2026-8005/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2026-80049](https://insights.sbomify.com/CVE-2026-80049/): Airbyte Platform through 2.0.0 Cross-Workspace Authorization Bypass via Caller-Supplied workspaceId (high 8.7)
- [CVE-2026-80048](https://insights.sbomify.com/CVE-2026-80048/): Sssd: sssd-kcm: local denial of service via excessive memory preallocation (medium 5.5)
- [CVE-2026-80047](https://insights.sbomify.com/CVE-2026-80047/): Hugging Face Transformers library writes remote code to disk prior to consent check (high 7.8)
- [CVE-2026-8004](https://insights.sbomify.com/CVE-2026-8004/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2026-8003](https://insights.sbomify.com/CVE-2026-8003/): Other in Chrome (medium 5.4)
- [CVE-2026-8002](https://insights.sbomify.com/CVE-2026-8002/): Use after free in Chrome (high 8.8)
- [CVE-2026-8001](https://insights.sbomify.com/CVE-2026-8001/): Use after free in Chrome (high 8.3)
- [CVE-2026-8000](https://insights.sbomify.com/CVE-2026-8000/): Code injection in Chrome (high 8.8)
- [CVE-2026-79996](https://insights.sbomify.com/CVE-2026-79996/): User Registration & Membership < 5.2.6 - Authenticated Privilege Escalation via Login Settings (high 7.2)
- [CVE-2026-79995](https://insights.sbomify.com/CVE-2026-79995/): User Registration & Membership < 5.2.5 - Subscriber+ Pending Email Change Cancellation via IDOR (medium 4.3)
- [CVE-2026-79994](https://insights.sbomify.com/CVE-2026-79994/): Docker Sandboxes UDS forwarder can reach arbitrary host Unix sockets through a symlink race (high 8.7)
- [CVE-2026-79993](https://insights.sbomify.com/CVE-2026-79993/): Missing authorization in Apache ZooKeeper (high 7.5)
- [CVE-2026-79992](https://insights.sbomify.com/CVE-2026-79992/): Emacs: emacs: command injection via crafted filenames in tramp (high 7.8)
- [CVE-2026-79991](https://insights.sbomify.com/CVE-2026-79991/): Authenticated SQL Injection via nested eager-loading criteria (high 7.1)
- [CVE-2026-79990](https://insights.sbomify.com/CVE-2026-79990/): GQL entry mutation `siteId` bypasses schema site scope, enabling cross-site content read/write/delete (high 8.7)
- [CVE-2026-7999](https://insights.sbomify.com/CVE-2026-7999/): Information disclosure in Chrome (medium 4.3)
- [CVE-2026-79989](https://insights.sbomify.com/CVE-2026-79989/): Arbitrary user password reset leading to administrator account takeover (high 8.7)
- [CVE-2026-79988](https://insights.sbomify.com/CVE-2026-79988/): Authenticated RCE through Twig sandbox escape (high 8.7)
- [CVE-2026-79987](https://insights.sbomify.com/CVE-2026-79987/): Low-privilege RCE through element-search eager loading (high 8.7)
- [CVE-2026-79986](https://insights.sbomify.com/CVE-2026-79986/): Path traversal in Apache Camel (high 7.4)
- [CVE-2026-79985](https://insights.sbomify.com/CVE-2026-79985/): Path traversal in Apache Camel (high 7.4)
- [CVE-2026-79984](https://insights.sbomify.com/CVE-2026-79984/): Path traversal in Apache Camel (high 7.4)
- [CVE-2026-79983](https://insights.sbomify.com/CVE-2026-79983/): Path traversal in Apache Camel (high 7.4)
- [CVE-2026-79982](https://insights.sbomify.com/CVE-2026-79982/): Memory corruption in zephyr (high 8.8)
- [CVE-2026-79981](https://insights.sbomify.com/CVE-2026-79981/): DNS resolver reuses a single UDP source port for all queries, easing off-path answer spoofing (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/351/