# Vulnerabilities published in 2026


- [CVE-2026-79980](https://insights.sbomify.com/CVE-2026-79980/): Predictable and reused DHCPv4 transaction identifier allows spoofed DHCP replies to reconfigure gateway and DNS (medium 5.6)
- [CVE-2026-7998](https://insights.sbomify.com/CVE-2026-7998/): Other in Chrome (medium 5.4)
- [CVE-2026-79979](https://insights.sbomify.com/CVE-2026-79979/): Stale TLB entries after demand-paging page-out let arm64 user threads access reused physical frames (high 7.8)
- [CVE-2026-79978](https://insights.sbomify.com/CVE-2026-79978/): Out-of-bounds write in the ADXL345 sensor driver RTIO streaming FIFO read path (low 3.6)
- [CVE-2026-79977](https://insights.sbomify.com/CVE-2026-79977/): WireGuard peer endpoint learned from unauthenticated transport-data messages allows off-path tunnel hijack in Zephyr (high 8.2)
- [CVE-2026-79976](https://insights.sbomify.com/CVE-2026-79976/): NULL pointer dereference in the MCTP I2C+GPIO target binding triggerable by a peer I2C controller (high 7.1)
- [CVE-2026-79975](https://insights.sbomify.com/CVE-2026-79975/): Security feature bypass in Secure Connect Gateway 5.0 - Appliance (medium 5.5)
- [CVE-2026-79974](https://insights.sbomify.com/CVE-2026-79974/): Auth bypass in Secure Connect Gateway 5.0 - Appliance (medium 6.4)
- [CVE-2026-79973](https://insights.sbomify.com/CVE-2026-79973/): Race condition in Secure Connect Gateway 5.0 - Appliance (medium 6.3)
- [CVE-2026-79972](https://insights.sbomify.com/CVE-2026-79972/): SQL injection in Secure Connect Gateway 5.0 - Appliance (high 7.2)
- [CVE-2026-79971](https://insights.sbomify.com/CVE-2026-79971/): Cross-site scripting in Secure Connect Gateway 5.0 - Appliance (medium 5.3)
- [CVE-2026-79970](https://insights.sbomify.com/CVE-2026-79970/): Security feature bypass in Secure Connect Gateway 5.0 - Appliance (medium 5.6)
- [CVE-2026-7997](https://insights.sbomify.com/CVE-2026-7997/): Privilege escalation in Chrome (high 7.8)
- [CVE-2026-79969](https://insights.sbomify.com/CVE-2026-79969/): Race condition in Secure Connect Gateway 5.0 - Appliance (medium 5.3)
- [CVE-2026-79968](https://insights.sbomify.com/CVE-2026-79968/): Race condition in Secure Connect Gateway 5.0 - Appliance (medium 5.6)
- [CVE-2026-79967](https://insights.sbomify.com/CVE-2026-79967/): Security feature bypass in Secure Connect Gateway 5.0 - Appliance (medium 5.6)
- [CVE-2026-79966](https://insights.sbomify.com/CVE-2026-79966/): CWE-532: Insertion of Sensitive Information into Log File (low 3.3)
- [CVE-2026-79965](https://insights.sbomify.com/CVE-2026-79965/): Auth bypass in Secure Connect Gateway 5.0 - Appliance (medium 5.3)
- [CVE-2026-79964](https://insights.sbomify.com/CVE-2026-79964/): Other in Secure Connect Gateway 5.0 - Appliance (medium 5.3)
- [CVE-2026-79963](https://insights.sbomify.com/CVE-2026-79963/): Supply chain in Secure Connect Gateway 5.0 - Appliance (high 7.4)
- [CVE-2026-79962](https://insights.sbomify.com/CVE-2026-79962/): Race condition in Secure Connect Gateway 5.0 - Appliance (medium 5.3)
- [CVE-2026-79961](https://insights.sbomify.com/CVE-2026-79961/): Auth bypass in Secure Connect Gateway 5.0 - Appliance (medium 5.3)
- [CVE-2026-79960](https://insights.sbomify.com/CVE-2026-79960/): Gitea deploy key pushes acting as the repository owner (high 7.1)
- [CVE-2026-7996](https://insights.sbomify.com/CVE-2026-7996/): Other in Chrome (medium 4.2)
- [CVE-2026-79959](https://insights.sbomify.com/CVE-2026-79959/): Botslab G980H Dashcams Use of Hard-coded Credentials (high 7.0)
- [CVE-2026-79957](https://insights.sbomify.com/CVE-2026-79957/): ServiceNext Insecure Direct Object Reference via GetUsarios (high 8.1)
- [CVE-2026-79956](https://insights.sbomify.com/CVE-2026-79956/): Improper Sanitization leads to Command Injection in AOS-8 Web Interface (high 7.2)
- [CVE-2026-79955](https://insights.sbomify.com/CVE-2026-79955/): Unauthenticated Memory Corruption Vulnerability leads to Denial-of-Service in AOS-8 (high 7.5)
- [CVE-2026-79954](https://insights.sbomify.com/CVE-2026-79954/): NASA CryptoLib 1.5.0 - TC receive path accepts Security Associations from the wrong GVCID (high 8.7)
- [CVE-2026-79952](https://insights.sbomify.com/CVE-2026-79952/): Other in Secure Connect Gateway 5.0 - Appliance (medium 5.3)
- [CVE-2026-79950](https://insights.sbomify.com/CVE-2026-79950/): Hardcoded credentials in Secure Connect Gateway 5.0 - Appliance (high 7.5)
- [CVE-2026-7995](https://insights.sbomify.com/CVE-2026-7995/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-79947](https://insights.sbomify.com/CVE-2026-79947/): Command injection in Secure Connect Gateway 5.0 - Appliance (medium 5.5)
- [CVE-2026-79946](https://insights.sbomify.com/CVE-2026-79946/): Cross-site scripting in Secure Connect Gateway 5.0 - Appliance (medium 5.3)
- [CVE-2026-79945](https://insights.sbomify.com/CVE-2026-79945/): Command injection in Secure Connect Gateway 5.0 - Appliance (medium 5.5)
- [CVE-2026-79944](https://insights.sbomify.com/CVE-2026-79944/): Privilege escalation in Secure Connect Gateway 5.0 - Appliance (low 3.4)
- [CVE-2026-79943](https://insights.sbomify.com/CVE-2026-79943/): Security feature bypass in Secure Connect Gateway 5.0 - Appliance (medium 4.8)
- [CVE-2026-79942](https://insights.sbomify.com/CVE-2026-79942/): Privilege escalation in Secure Connect Gateway 5.0 - Appliance (low 3.4)
- [CVE-2026-79941](https://insights.sbomify.com/CVE-2026-79941/): Command injection in Secure Connect Gateway 5.0 - Appliance (medium 5.3)
- [CVE-2026-79940](https://insights.sbomify.com/CVE-2026-79940/): Missing authorization in iDRAC9 (medium 5.9)
- [CVE-2026-7994](https://insights.sbomify.com/CVE-2026-7994/): Privilege escalation in Chrome (high 7.8)
- [CVE-2026-79939](https://insights.sbomify.com/CVE-2026-79939/): Other in Cyber Recovery (medium 5.8)
- [CVE-2026-79938](https://insights.sbomify.com/CVE-2026-79938/): Auth bypass in Cyber Recovery (high 7.6)
- [CVE-2026-7993](https://insights.sbomify.com/CVE-2026-7993/): Other in Chrome (medium 4.2)
- [CVE-2026-79921](https://insights.sbomify.com/CVE-2026-79921/): amqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payload (high 8.9)
- [CVE-2026-79920](https://insights.sbomify.com/CVE-2026-79920/): Ajenti: Privilege escalation to root via unauthenticated/unauthorized plugin install task (critical 9.9)
- [CVE-2026-7992](https://insights.sbomify.com/CVE-2026-7992/): Code injection in Chrome (high 8.8)
- [CVE-2026-79919](https://insights.sbomify.com/CVE-2026-79919/): Security feature bypass in MaxKB (medium 6.3)
- [CVE-2026-79918](https://insights.sbomify.com/CVE-2026-79918/): MaxKB: Sandbox escape via unhooked fexecve (medium 6.3)
- [CVE-2026-79917](https://insights.sbomify.com/CVE-2026-79917/): MaxKB: Chat share-link endpoint missing owner check: a chat token can publish another user's conversation (medium 6.5)
- [CVE-2026-79916](https://insights.sbomify.com/CVE-2026-79916/): MaxKB AWS Bedrock model credential injection leads to remote code execution (critical 9.1)
- [CVE-2026-79913](https://insights.sbomify.com/CVE-2026-79913/): Cloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers (NAT64, IPv4-compatible, 6to4) reaching internal and cloud-metadata addresses (medium 6.5)
- [CVE-2026-79912](https://insights.sbomify.com/CVE-2026-79912/): TOTOLINK N600R cstecgi.cgi getCurrentTime command injection (medium 6.9)
- [CVE-2026-79911](https://insights.sbomify.com/CVE-2026-79911/): TOTOLINK N600R CGI cstecgi.cgi setSystemConfig stack-based overflow (critical 10.0)
- [CVE-2026-79910](https://insights.sbomify.com/CVE-2026-79910/): Acrobat Reader | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2026-7991](https://insights.sbomify.com/CVE-2026-7991/): Use after free in Chrome (high 8.8)
- [CVE-2026-79909](https://insights.sbomify.com/CVE-2026-79909/): Acrobat Reader | Use After Free (CWE-416) (high 7.8)
- [CVE-2026-79908](https://insights.sbomify.com/CVE-2026-79908/): Acrobat Reader | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-79907](https://insights.sbomify.com/CVE-2026-79907/): Acrobat Reader | Double Free (CWE-415) (high 7.8)
- [CVE-2026-79906](https://insights.sbomify.com/CVE-2026-79906/): Substance3D - Modeler | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-79905](https://insights.sbomify.com/CVE-2026-79905/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2026-79904](https://insights.sbomify.com/CVE-2026-79904/): Photoshop Mobile | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) (medium 5.0)
- [CVE-2026-79902](https://insights.sbomify.com/CVE-2026-79902/): Gimp: stack vla size underflow denial of service in seattle (medium 5.5)
- [CVE-2026-79901](https://insights.sbomify.com/CVE-2026-79901/): Predictable Active Directory service-account passwords in BoKS Manager (critical 9.9)
- [CVE-2026-79900](https://insights.sbomify.com/CVE-2026-79900/): Heap overflow in KSL checksum initialization (medium 6.5)
- [CVE-2026-7990](https://insights.sbomify.com/CVE-2026-7990/): Privilege escalation in Chrome (high 7.8)
- [CVE-2026-79899](https://insights.sbomify.com/CVE-2026-79899/): Fortra BoKS Manager bccgethostcert insecure temporary file vulnerability (high 7.9)
- [CVE-2026-79898](https://insights.sbomify.com/CVE-2026-79898/): Fortra BoKS Manager crlserver command injection vulnerability (critical 9.1)
- [CVE-2026-79896](https://insights.sbomify.com/CVE-2026-79896/): Fortra BoKS Manager boks_portmux TLS ClientHello out-of-bounds read vulnerability (high 7.5)
- [CVE-2026-79895](https://insights.sbomify.com/CVE-2026-79895/): Unauthenticated Remote Denial-of-Service (DoS) Vulnerabilities in AOS-10 (high 7.5)
- [CVE-2026-79894](https://insights.sbomify.com/CVE-2026-79894/): Unauthenticated Denial-of-Service (DoS) Vulnerability in the PAPI Protocol of AOS-8 (high 7.5)
- [CVE-2026-79893](https://insights.sbomify.com/CVE-2026-79893/): Unauthenticated Memory Corruption Vulnerabilities lead to Denial-of-Service in AOS-10 (high 7.5)
- [CVE-2026-79892](https://insights.sbomify.com/CVE-2026-79892/): Authenticated Local Memory Corruption Vulnerability leads to Arbitrary Code Execution in AOS-8 (high 7.8)
- [CVE-2026-79891](https://insights.sbomify.com/CVE-2026-79891/): Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-8 (high 8.1)
- [CVE-2026-79890](https://insights.sbomify.com/CVE-2026-79890/): Unauthenticated Command Injection Vulnerabilities in AOS-8 Accessed by the PAPI Protocol (high 8.1)
- [CVE-2026-7989](https://insights.sbomify.com/CVE-2026-7989/): Other in Chrome (medium 4.2)
- [CVE-2026-79889](https://insights.sbomify.com/CVE-2026-79889/): Multiple Unauthenticated Buffer Overflow vulnerabilities in AOS-8 Web Interface result in Remote Code Execution (high 8.1)
- [CVE-2026-79888](https://insights.sbomify.com/CVE-2026-79888/): Unauthenticated Buffer Overflow allows Remote Code Execution in web interface (high 8.1)
- [CVE-2026-79887](https://insights.sbomify.com/CVE-2026-79887/): Authentication Bypass in Web Interface of AOS-8 allows Remote Command Execution (RCE) (high 8.1)
- [CVE-2026-79886](https://insights.sbomify.com/CVE-2026-79886/): Unauthenticated Buffer Overflow Vulnerability leads to Denial-of-Service in AOS-8 (high 8.2)
- [CVE-2026-79885](https://insights.sbomify.com/CVE-2026-79885/): Unauthenticated File Write Vulnerability leads to Denial-of-Service in AOS-8 (high 8.2)
- [CVE-2026-79884](https://insights.sbomify.com/CVE-2026-79884/): Authentication Bypass leads to Sensitive Information Disclosure in AOS-8 (high 8.2)
- [CVE-2026-79883](https://insights.sbomify.com/CVE-2026-79883/): Memory corruption in ArubaOS (AOS) (high 8.3)
- [CVE-2026-79882](https://insights.sbomify.com/CVE-2026-79882/): Unauthenticated Adjacent Command Injection Vulnerability in the PAPI Protocol of AOS-10 (high 8.3)
- [CVE-2026-79881](https://insights.sbomify.com/CVE-2026-79881/): Authentication Bypass Leading to Remote Code Execution in AOS-8 (high 8.5)
- [CVE-2026-79880](https://insights.sbomify.com/CVE-2026-79880/): Authenticated Server-Side Request Forgery leads to Remote Code Execution in AOS-8 (high 8.7)
- [CVE-2026-7988](https://insights.sbomify.com/CVE-2026-7988/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-79879](https://insights.sbomify.com/CVE-2026-79879/): Unauthenticated Adjacent Memory Corruption Vulnerabilities lead to Remote Code Execution in AOS-10 (high 8.8)
- [CVE-2026-79878](https://insights.sbomify.com/CVE-2026-79878/): Command injection in ArubaOS (AOS) (high 8.8)
- [CVE-2026-79877](https://insights.sbomify.com/CVE-2026-79877/): Unauthenticated Adjacent Remote Code Execution Vulnerability in AOS-10 (high 8.8)
- [CVE-2026-79876](https://insights.sbomify.com/CVE-2026-79876/): Unauthenticated Adjacent Sensitive Information Disclosure in AOS-10 Wi-Fi Frame Processing (critical 9.3)
- [CVE-2026-79875](https://insights.sbomify.com/CVE-2026-79875/): Authentication Bypass in the PAPI Protocol of AOS-8 Allows Unauthorized Administrative Access (critical 9.3)
- [CVE-2026-79874](https://insights.sbomify.com/CVE-2026-79874/): Authentication Bypass in the API allows Administrative Access of AOS-10 (critical 9.3)
- [CVE-2026-79873](https://insights.sbomify.com/CVE-2026-79873/): Auth bypass in ArubaOS (AOS) (critical 9.3)
- [CVE-2026-79872](https://insights.sbomify.com/CVE-2026-79872/): Unauthenticated Buffer Overflow Vulnerability allows Remote Code Execution in AOS-10 and AOS-8 (critical 9.4)
- [CVE-2026-79871](https://insights.sbomify.com/CVE-2026-79871/): Unauthenticated Sensitive Information Disclosure in the Command Line Interface of AOS-10 (critical 9.6)
- [CVE-2026-79870](https://insights.sbomify.com/CVE-2026-79870/): Authentication Bypass leads to Unauthorized Access in AOS-8 (critical 9.6)
- [CVE-2026-7987](https://insights.sbomify.com/CVE-2026-7987/): Use after free in Chrome (high 8.8)
- [CVE-2026-79869](https://insights.sbomify.com/CVE-2026-79869/): Authentication Bypass Leading to Remote Code Execution in AOS-10 (critical 9.6)
- [CVE-2026-79868](https://insights.sbomify.com/CVE-2026-79868/): Authentication Bypass Vulnerabilities lead to Complete System Compromise in AOS-8 (critical 9.6)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/352/