# Vulnerabilities published in 2026


- [CVE-2026-79663](https://insights.sbomify.com/CVE-2026-79663/): Ech0 before 4.7.3 Stored XSS via RSS feed tag names (medium 4.8)
- [CVE-2026-79662](https://insights.sbomify.com/CVE-2026-79662/): Ech0 before 4.7.3 OAuth Redirect URI Validation Bypass (high 8.8)
- [CVE-2026-79661](https://insights.sbomify.com/CVE-2026-79661/): Ech0 before 4.7.3 Unauthenticated fav_count Modification (medium 6.9)
- [CVE-2026-79660](https://insights.sbomify.com/CVE-2026-79660/): Ech0 before 4.7.3 Email Disclosure via Public API (medium 6.9)
- [CVE-2026-7966](https://insights.sbomify.com/CVE-2026-7966/): Security feature bypass in Chrome (low 3.1)
- [CVE-2026-79659](https://insights.sbomify.com/CVE-2026-79659/): Ech0 before 4.7.3 Server-Side Request Forgery via fetchPeerConnectInfo (high 8.3)
- [CVE-2026-79658](https://insights.sbomify.com/CVE-2026-79658/): Ech0 before 5.0.1 Denial of Service via Accept-Language (high 8.7)
- [CVE-2026-79657](https://insights.sbomify.com/CVE-2026-79657/): NLTK before 3.10.3 Remote Code Execution via Unsafe Pickle Deserialization (critical 9.3)
- [CVE-2026-79656](https://insights.sbomify.com/CVE-2026-79656/): OAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors (medium 6.0)
- [CVE-2026-79655](https://insights.sbomify.com/CVE-2026-79655/): Path traversal in Red Hat Enterprise Linux 10 (high 7.8)
- [CVE-2026-79654](https://insights.sbomify.com/CVE-2026-79654/): Ketello: katello content view history api cross-organization authorization bypass (medium 4.3)
- [CVE-2026-79653](https://insights.sbomify.com/CVE-2026-79653/): Path traversal in Eclipse SW360 (medium 6.0)
- [CVE-2026-79652](https://insights.sbomify.com/CVE-2026-79652/): Keycloak-services: keycloak-services: jwt bearer authorization grant does not enforce consentrequired (medium 5.9)
- [CVE-2026-79651](https://insights.sbomify.com/CVE-2026-79651/): Keycloak-services: keycloak-services: unauthenticated dos via unbounded locale caching (high 7.5)
- [CVE-2026-79650](https://insights.sbomify.com/CVE-2026-79650/): Apache CXF: OIDC RP Open Redirect (medium 6.1)
- [CVE-2026-7965](https://insights.sbomify.com/CVE-2026-7965/): Information disclosure in Chrome (low 3.1)
- [CVE-2026-79645](https://insights.sbomify.com/CVE-2026-79645/): Auth bypass in Secure Connect Gateway 5.0 - Appliance (high 8.2)
- [CVE-2026-79644](https://insights.sbomify.com/CVE-2026-79644/): Security feature bypass in Secure Connect Gateway 5.0 - Appliance (high 7.4)
- [CVE-2026-79643](https://insights.sbomify.com/CVE-2026-79643/): Auth bypass in Secure Connect Gateway 5.0 - Appliance (high 7.3)
- [CVE-2026-79642](https://insights.sbomify.com/CVE-2026-79642/): Security feature bypass in Secure Connect Gateway 5.0 - Appliance (medium 5.6)
- [CVE-2026-79641](https://insights.sbomify.com/CVE-2026-79641/): Command injection in Secure Connect Gateway 5.0 - Appliance (high 7.5)
- [CVE-2026-79640](https://insights.sbomify.com/CVE-2026-79640/): SQL injection in Secure Connect Gateway 5.0 - Appliance (medium 5.4)
- [CVE-2026-7964](https://insights.sbomify.com/CVE-2026-7964/): Other in Chrome (medium 4.2)
- [CVE-2026-79639](https://insights.sbomify.com/CVE-2026-79639/): Security feature bypass in Secure Connect Gateway 5.0 - Appliance (high 7.6)
- [CVE-2026-79638](https://insights.sbomify.com/CVE-2026-79638/): Cross-site scripting in Secure Connect Gateway 5.0 - Appliance (medium 5.3)
- [CVE-2026-79637](https://insights.sbomify.com/CVE-2026-79637/): Security feature bypass in Secure Connect Gateway 5.0 - Appliance (high 7.7)
- [CVE-2026-79636](https://insights.sbomify.com/CVE-2026-79636/): Security feature bypass in Secure Connect Gateway 5.0 - Appliance (high 7.0)
- [CVE-2026-79635](https://insights.sbomify.com/CVE-2026-79635/): Server-side request forgery in Secure Connect Gateway 5.0 - Appliance (high 7.3)
- [CVE-2026-79633](https://insights.sbomify.com/CVE-2026-79633/): Apache Answer: Missing Authorization Allows Mutations of Non-Public Content (not scored)
- [CVE-2026-79632](https://insights.sbomify.com/CVE-2026-79632/): WPFunnels < 3.13.0 - Unauthenticated Arbitrary Recipient Email Sending via wpfnl_shortcode_optin_submission (medium 5.3)
- [CVE-2026-79631](https://insights.sbomify.com/CVE-2026-79631/): WPFunnels < 3.13.0 - Unauthenticated Order and Opt-In PII Disclosure via Web-Accessible Log Files (medium 5.3)
- [CVE-2026-79630](https://insights.sbomify.com/CVE-2026-79630/): WPFunnels < 3.13.0 - Unauthenticated Price Manipulation via Order Bump Product ID Substitution (medium 5.3)
- [CVE-2026-7963](https://insights.sbomify.com/CVE-2026-7963/): Security feature bypass in Chrome (high 8.3)
- [CVE-2026-79627](https://insights.sbomify.com/CVE-2026-79627/): Advanced File Manager 5.4.13 - 5.4.14 - Authenticated Stored XSS via SVG Sanitiser Content-Sniff Bypass (high 7.1)
- [CVE-2026-79625](https://insights.sbomify.com/CVE-2026-79625/): Improper Synchronization in Monitoring in CODESYS Control Runtime (high 7.2)
- [CVE-2026-79624](https://insights.sbomify.com/CVE-2026-79624/): Apache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session Revocation (not scored)
- [CVE-2026-79623](https://insights.sbomify.com/CVE-2026-79623/): FishCodeTech Muteki Default Local Worker Backend settings.json os command injection (medium 5.3)
- [CVE-2026-79622](https://insights.sbomify.com/CVE-2026-79622/): dekdee adobe-xd-mcp file-access-from-request Endpoint xd-parser.ts path traversal (medium 6.9)
- [CVE-2026-79621](https://insights.sbomify.com/CVE-2026-79621/): CatalogX < 6.1.3 - Unauthenticated Email Content Injection via Shared Transient (medium 4.3)
- [CVE-2026-79620](https://insights.sbomify.com/CVE-2026-79620/): Apache Answer: Improper Authorization Allows Disclosure of Non-Public Question Metadata (not scored)
- [CVE-2026-7962](https://insights.sbomify.com/CVE-2026-7962/): Security feature bypass in Chrome (medium 5.4)
- [CVE-2026-79619](https://insights.sbomify.com/CVE-2026-79619/): OpenZFS: user-namespace capability check allows unprivileged local authorization bypass (high 7.3)
- [CVE-2026-79618](https://insights.sbomify.com/CVE-2026-79618/): WP User Frontend < 4.3.12 - Subscriber+ Post Creation via Subscription-Gated Form (medium 4.3)
- [CVE-2026-79617](https://insights.sbomify.com/CVE-2026-79617/): Improper Access Control Leading to Display Exposure in TÜBİTAK BİLGEM's Pardus LightDM Greeter (high 7.1)
- [CVE-2026-79616](https://insights.sbomify.com/CVE-2026-79616/): Out-of-bounds read vulnerability in Context2D.path and PathSvg.path properties impacts Qt Quick (low 0.6)
- [CVE-2026-79615](https://insights.sbomify.com/CVE-2026-79615/): Quiz And Survey Master < 11.2.4 - Contributor+ Cross-Quiz Question Bank and Answer Key Disclosure via IDOR (low 2.7)
- [CVE-2026-79613](https://insights.sbomify.com/CVE-2026-79613/): Apache Answer: Disclosure of Comments on Non-Public Content Through Public Profiles (not scored)
- [CVE-2026-79611](https://insights.sbomify.com/CVE-2026-79611/): VMX: VMentry failure with branch tracing and blocked states (medium 5.5)
- [CVE-2026-79610](https://insights.sbomify.com/CVE-2026-79610/): grant-table: double version change race (high 8.8)
- [CVE-2026-7961](https://insights.sbomify.com/CVE-2026-7961/): Information disclosure in Chrome (medium 4.3)
- [CVE-2026-79609](https://insights.sbomify.com/CVE-2026-79609/): x86: XPTI may break on huge-memory systems (high 8.8)
- [CVE-2026-79608](https://insights.sbomify.com/CVE-2026-79608/): x86/AMD: ineffectual Zenbleed workaround (critical 9.8)
- [CVE-2026-79607](https://insights.sbomify.com/CVE-2026-79607/): Xenstore: Guests can crash xenstored during Live Update (medium 5.5)
- [CVE-2026-79603](https://insights.sbomify.com/CVE-2026-79603/): Unconditionally do TLB flushing ahead of page scrubbing (medium 4.3)
- [CVE-2026-79602](https://insights.sbomify.com/CVE-2026-79602/): x86: improper handling of HVM emulation return codes (high 8.8)
- [CVE-2026-7960](https://insights.sbomify.com/CVE-2026-7960/): Race condition in Chrome (medium 5.3)
- [CVE-2026-79592](https://insights.sbomify.com/CVE-2026-79592/): An out-of-bounds read vulnerability exists in the xls_dumpSummary() function of libxls 1.6.3 due to insufficient validation of file-controll (high 7.5)
- [CVE-2026-79591](https://insights.sbomify.com/CVE-2026-79591/): A heap-buffer-overflow and use-after-free vulnerability exists in the xls_getCSS() function of libxls 1.6.3 due to insufficient validation o (high 7.8)
- [CVE-2026-79590](https://insights.sbomify.com/CVE-2026-79590/): A NULL pointer dereference vulnerability exists in the Prism parser component of mruby 4.0.0. (medium 6.5)
- [CVE-2026-7959](https://insights.sbomify.com/CVE-2026-7959/): Security feature bypass in Chrome (low 3.1)
- [CVE-2026-79589](https://insights.sbomify.com/CVE-2026-79589/): The WIFI4 N300 router (Model: T1 Pro) v1.0.0 by U-speed contains an insecure access control flaw that allows an attacker to gain unauthenticated root shell. (not scored)
- [CVE-2026-79588](https://insights.sbomify.com/CVE-2026-79588/): U-speed WIFI4 N300 T1 Pro v1.0.0 is vulnerable to Cleartext transmission of administration credentials over HTTP. (medium 4.3)
- [CVE-2026-7958](https://insights.sbomify.com/CVE-2026-7958/): Cross-site scripting in Chrome (medium 5.4)
- [CVE-2026-79577](https://insights.sbomify.com/CVE-2026-79577/): An issue in the /cas/login component of sso-master v1.0.0 allows attackers to authenticate into the application without a password via sendi (critical 9.8)
- [CVE-2026-79576](https://insights.sbomify.com/CVE-2026-79576/): An issue in the Single-Sign On (SSO) component of Digital-Infrastructure v9.6.7 allows attackers to authenticate as any user, including the (critical 9.8)
- [CVE-2026-79575](https://insights.sbomify.com/CVE-2026-79575/): The JWT signing secret in yfexam-exam v2.0 is derived from the username and the current month instead of a random server-side key, making th (high 7.5)
- [CVE-2026-79574](https://insights.sbomify.com/CVE-2026-79574/): An issue in the gateway server of mpush v0.8.1 allows attackers to execute arbitrary code via sending a crafted broadcast message. (critical 9.8)
- [CVE-2026-79573](https://insights.sbomify.com/CVE-2026-79573/): L-ONE v1.0.0 was discovered to contain multiple SQL injection vulnerabilities in the /attachment/getBusinessUploadList component via the bus (medium 6.5)
- [CVE-2026-79572](https://insights.sbomify.com/CVE-2026-79572/): An XXE (XML External Entity) vulnerability in the level-rule module of Distribution Management v1.0.0 allows attackers to read sensitive fil (high 7.5)
- [CVE-2026-79571](https://insights.sbomify.com/CVE-2026-79571/): Incorrect access control in the SellerAuthorizeAspect component of springboot-project v1.0.0 allows unauthenticated attackers to access all (critical 9.1)
- [CVE-2026-79570](https://insights.sbomify.com/CVE-2026-79570/): mfish-nocode-pro v1.0.0 was discovered to contain a SQL injection vulnerability in the tableName parameter at /sys/dbConnect/data. (critical 9.8)
- [CVE-2026-7957](https://insights.sbomify.com/CVE-2026-7957/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-79569](https://insights.sbomify.com/CVE-2026-79569/): Movie_Recommend v1.0.0 was discovered to contain a SQL injection vulnerability in the sort parameter at /loadingmore. (critical 9.8)
- [CVE-2026-7956](https://insights.sbomify.com/CVE-2026-7956/): Use after free in Chrome (high 8.3)
- [CVE-2026-79551](https://insights.sbomify.com/CVE-2026-79551/): Tenda Technology Co., Ltd NVR_4H CH3 v2.1 V27.5.58.6 was discovered to contain a hardcoded cryptographic key. (high 7.5)
- [CVE-2026-7955](https://insights.sbomify.com/CVE-2026-7955/): Information disclosure in Chrome (medium 5.3)
- [CVE-2026-7954](https://insights.sbomify.com/CVE-2026-7954/): Race condition in Chrome (low 3.1)
- [CVE-2026-79538](https://insights.sbomify.com/CVE-2026-79538/): metatool-ai MetaMCP up to and including 2.4.22 is vulnerable to Code Execution in the internal MCP inspector proxy endpoint GET /mcp-proxy/s (critical 9.8)
- [CVE-2026-79537](https://insights.sbomify.com/CVE-2026-79537/): metatool-ai MetaMCP through 2.4.22 contains an insecure direct object reference (IDOR) in the MCP transport session dispatch. (critical 9.1)
- [CVE-2026-79536](https://insights.sbomify.com/CVE-2026-79536/): bytebase dbhub v1.2.0 was discovered to contain a SQL injection vulnerability in the /utils/sql-parser.ts component. (critical 9.1)
- [CVE-2026-79535](https://insights.sbomify.com/CVE-2026-79535/): mbailey VoiceMode <= 8.10.1 is vulnerable to OS Command Injection. (medium 6.3)
- [CVE-2026-79534](https://insights.sbomify.com/CVE-2026-79534/): mark3labs mcp-filesystem-server v0.11.1 is vulnerable to Directory Traversal due to an improper link resolution in validatePath (filesystems (medium 5.9)
- [CVE-2026-7953](https://insights.sbomify.com/CVE-2026-7953/): Cross-site scripting in Chrome (medium 6.1)
- [CVE-2026-79522](https://insights.sbomify.com/CVE-2026-79522/): Memory corruption in gpac:gpac (medium 6.5)
- [CVE-2026-7952](https://insights.sbomify.com/CVE-2026-7952/): Security feature bypass in Chrome (medium 4.2)
- [CVE-2026-79516](https://insights.sbomify.com/CVE-2026-79516/): An out-of-bounds read in the stbsp_vsnprintf function (stb_sprintf.h) of nothings stb commit 31c1ad3 allows attackers to cause a Denial of S (medium 4.0)
- [CVE-2026-79515](https://insights.sbomify.com/CVE-2026-79515/): An out-of-bounds read in the stbtt_GetGlyphShape component of nothings stb commit 31c1ad3 allows attackers to cause a Denial of Service (DoS (medium 4.3)
- [CVE-2026-79514](https://insights.sbomify.com/CVE-2026-79514/): Memory corruption in gpac:gpac (medium 6.5)
- [CVE-2026-79513](https://insights.sbomify.com/CVE-2026-79513/): Denial of service in gpac:gpac (medium 6.5)
- [CVE-2026-7951](https://insights.sbomify.com/CVE-2026-7951/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-7950](https://insights.sbomify.com/CVE-2026-7950/): Memory corruption in Chrome (medium 5.4)
- [CVE-2026-7949](https://insights.sbomify.com/CVE-2026-7949/): Memory corruption in Chrome (low 3.1)
- [CVE-2026-79483](https://insights.sbomify.com/CVE-2026-79483/): FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint. (medium 5.3)
- [CVE-2026-7948](https://insights.sbomify.com/CVE-2026-7948/): Race condition in Chrome (high 7.5)
- [CVE-2026-7947](https://insights.sbomify.com/CVE-2026-7947/): Other in Chrome (medium 4.2)
- [CVE-2026-7946](https://insights.sbomify.com/CVE-2026-7946/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2026-7945](https://insights.sbomify.com/CVE-2026-7945/): Security feature bypass in Chrome (low 3.1)
- [CVE-2026-7944](https://insights.sbomify.com/CVE-2026-7944/): Security feature bypass in Chrome (low 3.1)
- [CVE-2026-7943](https://insights.sbomify.com/CVE-2026-7943/): Memory corruption in Chrome (medium 4.2)
- [CVE-2026-79426](https://insights.sbomify.com/CVE-2026-79426/): An arbitrary file deletion vulnerability in the /adminapi/file/video_data_save component of CRMEB v6.0.0 allows authenticated attackers to d (high 7.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/355/