# Vulnerabilities published in 2026


- [CVE-2026-79425](https://insights.sbomify.com/CVE-2026-79425/): An authenticated Server-Side Request Forgery (SSRF) in the /adminapi/file/online_upload component of CRMEB v6.0.0 allows attackers to scan i (high 8.1)
- [CVE-2026-79423](https://insights.sbomify.com/CVE-2026-79423/): An authenticated remote code execution (RCE) vulnerability in the admin_config.php component of seacms v13.6 allows attackers to execute arb (high 8.8)
- [CVE-2026-7942](https://insights.sbomify.com/CVE-2026-7942/): Integer overflow in Chrome (medium 4.3)
- [CVE-2026-79419](https://insights.sbomify.com/CVE-2026-79419/): Cross-site scripting in emxtecnologia:gestao x business suite (high 8.7)
- [CVE-2026-79418](https://insights.sbomify.com/CVE-2026-79418/): Cross-site scripting in emxtecnologia:gestao x business suite (high 8.7)
- [CVE-2026-79417](https://insights.sbomify.com/CVE-2026-79417/): Improper Access Control in ArgusMonitor.sys in Argotronic eGbR ArgusMonitor 7.4.02 and earlier allows local, low-privileged users to bypass (medium 5.3)
- [CVE-2026-79411](https://insights.sbomify.com/CVE-2026-79411/): Incorrect privilege assignment in the admin user-management component of Webkul Bagisto 2.4.9 allows an authenticated backend user holding o (high 8.8)
- [CVE-2026-79410](https://insights.sbomify.com/CVE-2026-79410/): Improper validation of the quantity parameter in the add-to-cart path of Webkul Bagisto v2.4.9 allows authenticated attackers to reduce thei (high 8.1)
- [CVE-2026-7941](https://insights.sbomify.com/CVE-2026-7941/): Cross-site scripting in Chrome (medium 4.4)
- [CVE-2026-79409](https://insights.sbomify.com/CVE-2026-79409/): An issue in Webkul Bagisto 2.4.9 allows a remote attacker to obtain sensitive information via the add-to-cart API and the downloadable fulfilment components. (medium 6.5)
- [CVE-2026-79408](https://insights.sbomify.com/CVE-2026-79408/): An OS command injection vulnerability in MetaGPT 0.8.1 allows an attacker to execute arbitrary commands via the path argument of RepoParser. (critical 9.8)
- [CVE-2026-79407](https://insights.sbomify.com/CVE-2026-79407/): A path traversal vulnerability in the SPO extension of MetaGPT 0.8.1 allows an attacker to read arbitrary files via the FILE_NAME value used (high 7.5)
- [CVE-2026-79406](https://insights.sbomify.com/CVE-2026-79406/): macrozheng mall quantity OmsCartItemServiceImpl.updateQuantity logic error (medium 5.3)
- [CVE-2026-79403](https://insights.sbomify.com/CVE-2026-79403/): An issue in Kilo Code before v7.4.1 allows a local attacker to execute arbitrary code via the permission/allow-everything endpoint (high 8.4)
- [CVE-2026-7940](https://insights.sbomify.com/CVE-2026-7940/): Use after free in Chrome (high 8.8)
- [CVE-2026-79396](https://insights.sbomify.com/CVE-2026-79396/): Use of hardcoded default credentials in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier stores static account credenti (critical 9.8)
- [CVE-2026-79395](https://insights.sbomify.com/CVE-2026-79395/): An improper authentication vulnerability in the WS-Security (wsse:UsernameToken) verification routine within the Sofia IPC daemon in Xiongma (critical 9.8)
- [CVE-2026-79394](https://insights.sbomify.com/CVE-2026-79394/): An insecure default configuration in the embedded Happytime RTSP server within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT (high 7.5)
- [CVE-2026-79393](https://insights.sbomify.com/CVE-2026-79393/): A heap-based buffer overflow vulnerability in the WS-Addressing Action transformation function in the Sofia IPC daemon in Xiongmai IP Camera (high 7.5)
- [CVE-2026-79391](https://insights.sbomify.com/CVE-2026-79391/): No authentication exists in the MQTT service of Trueview 6.0.23.4. (critical 9.8)
- [CVE-2026-79390](https://insights.sbomify.com/CVE-2026-79390/): Trueview TI8161 6.0.23.4 is vulnerable to information disclosure due to the transmission of MQTT communications in plaintext over TCP port 1883. (high 7.5)
- [CVE-2026-7939](https://insights.sbomify.com/CVE-2026-7939/): Cross-site scripting in Chrome (medium 5.4)
- [CVE-2026-79389](https://insights.sbomify.com/CVE-2026-79389/): Trueview T18161 S 6.0.23.4 contains an improper verification in MQTT command processing. (high 7.4)
- [CVE-2026-79387](https://insights.sbomify.com/CVE-2026-79387/): SQL injection vulnerability in PbootCMS versions 3.2.0 through 3.2.5 allows an authenticated user to modify arbitrary user account fields (i (medium 4.3)
- [CVE-2026-7938](https://insights.sbomify.com/CVE-2026-7938/): Use after free in Chrome (high 8.8)
- [CVE-2026-79379](https://insights.sbomify.com/CVE-2026-79379/): A buffer overflow in the SBC_DecodeFrames() function of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmware v3.x and earlier and fixed (medium 6.5)
- [CVE-2026-79378](https://insights.sbomify.com/CVE-2026-79378/): An issue in the btm_acl_handle() function of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmware v3.x and earlier allows attackers to c (high 7.5)
- [CVE-2026-79377](https://insights.sbomify.com/CVE-2026-79377/): A heap overflow in the a2dp_decoder_sbc.cpp component of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmware v3.x and earlier allows at (high 7.5)
- [CVE-2026-79376](https://insights.sbomify.com/CVE-2026-79376/): An issue in the l2cap_handle_data() function of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmware v3.x and earlier allows attackers t (high 8.8)
- [CVE-2026-7937](https://insights.sbomify.com/CVE-2026-7937/): Security feature bypass in Chrome (low 3.1)
- [CVE-2026-79363](https://insights.sbomify.com/CVE-2026-79363/): Cloudron 9.1.7 and 9.2 contain a stored cross-site scripting (XSS) vulnerability in the Branding Footer feature. (medium 5.9)
- [CVE-2026-79362](https://insights.sbomify.com/CVE-2026-79362/): Certain Woltlab products are affected by RCE via Cache Poisoning. (high 8.8)
- [CVE-2026-7935](https://insights.sbomify.com/CVE-2026-7935/): Other in Chrome (medium 5.4)
- [CVE-2026-79348](https://insights.sbomify.com/CVE-2026-79348/): KitchenAsty through 0.3.0 contains a broken object level authorization (IDOR) vulnerability in the reservations API. (medium 4.3)
- [CVE-2026-7934](https://insights.sbomify.com/CVE-2026-7934/): Security feature bypass in Chrome (medium 4.2)
- [CVE-2026-7933](https://insights.sbomify.com/CVE-2026-7933/): Memory corruption in Chrome (medium 4.3)
- [CVE-2026-79324](https://insights.sbomify.com/CVE-2026-79324/): Missing authorization in mageplaza:gdpr (high 7.5)
- [CVE-2026-79323](https://insights.sbomify.com/CVE-2026-79323/): Information disclosure in mageplaza:magefan blog (high 7.5)
- [CVE-2026-79322](https://insights.sbomify.com/CVE-2026-79322/): SQL injection in mageplaza:mageplaza blog (high 8.6)
- [CVE-2026-79320](https://insights.sbomify.com/CVE-2026-79320/): Stencil core 4.43.5 contains a DOM-based cross-site scripting (XSS) vulnerability in the component runtime. (medium 6.1)
- [CVE-2026-7932](https://insights.sbomify.com/CVE-2026-7932/): Security feature bypass in Chrome (medium 4.4)
- [CVE-2026-79319](https://insights.sbomify.com/CVE-2026-79319/): Stencil core 4.43.5 is vulnerable to Incorrect Access Control. (medium 5.3)
- [CVE-2026-79318](https://insights.sbomify.com/CVE-2026-79318/): web2py 3.2.2-stable (commit a7330a2bf21219fa77860b6665de927dd4f98e6d) is vulnerable to Directory Traversal in read_file()/write_file() (appl (medium 6.5)
- [CVE-2026-79317](https://insights.sbomify.com/CVE-2026-79317/): A session invalidation flaw exists in x-ui 0.3.2. (medium 4.8)
- [CVE-2026-79316](https://insights.sbomify.com/CVE-2026-79316/): An improper access control vulnerability exists in x-ui 0.3.2. (high 7.6)
- [CVE-2026-79315](https://insights.sbomify.com/CVE-2026-79315/): A reflected cross-site scripting vulnerability exists in x-ui 0.3.2. (medium 4.7)
- [CVE-2026-79314](https://insights.sbomify.com/CVE-2026-79314/): A horizontal privilege escalation vulnerability exists in x-ui 0.3.2. (high 8.8)
- [CVE-2026-79313](https://insights.sbomify.com/CVE-2026-79313/): webpy web.py 0.76 is vulnerable to Insufficient Session Expiration. (critical 9.8)
- [CVE-2026-79312](https://insights.sbomify.com/CVE-2026-79312/): webpy web.py 0.76 is vulnerable to Session Fixation. (medium 6.8)
- [CVE-2026-79311](https://insights.sbomify.com/CVE-2026-79311/): webpy web.py 0.76 is vulnerable to Cross Site Scripting (XSS) via render_jinja.__init__(). (medium 6.1)
- [CVE-2026-79310](https://insights.sbomify.com/CVE-2026-79310/): webpy web.py 0.76 is vulnerable to server-side template injection (SSTI). (high 8.5)
- [CVE-2026-7931](https://insights.sbomify.com/CVE-2026-7931/): Other in Chrome (medium 5.4)
- [CVE-2026-79306](https://insights.sbomify.com/CVE-2026-79306/): CyberPanel v1.9.1 contains a path traversal vulnerability in the compress method exposed through the /filemanager/controller endpoint. (medium 6.5)
- [CVE-2026-79304](https://insights.sbomify.com/CVE-2026-79304/): CyberPanel 1.9.1 contains a path traversal vulnerability in the readFileContents method of the /filemanager/controller endpoint. (medium 6.5)
- [CVE-2026-79303](https://insights.sbomify.com/CVE-2026-79303/): kaiten from 57.192.20 to before 57.214.26 is vulnerable to SQL Injection. (critical 9.9)
- [CVE-2026-79300](https://insights.sbomify.com/CVE-2026-79300/): Auth bypass in sesam (low 3.5)
- [CVE-2026-79298](https://insights.sbomify.com/CVE-2026-79298/): An issue in Howyar Technologies Inc SysReturn Versions prior to 11.3.034 and fixed in v.11.3.0.34 allows a local attcker to execute arbitrar (high 8.4)
- [CVE-2026-79294](https://insights.sbomify.com/CVE-2026-79294/): Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18 allows a remote attacker to execute arbitrary code via the H (medium 6.1)
- [CVE-2026-79293](https://insights.sbomify.com/CVE-2026-79293/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-79292](https://insights.sbomify.com/CVE-2026-79292/): Integer overflow in Chrome (high 8.3)
- [CVE-2026-79291](https://insights.sbomify.com/CVE-2026-79291/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-79290](https://insights.sbomify.com/CVE-2026-79290/): Use after free in Chrome (critical 9.6)
- [CVE-2026-7929](https://insights.sbomify.com/CVE-2026-7929/): Use after free in Chrome (high 7.5)
- [CVE-2026-79289](https://insights.sbomify.com/CVE-2026-79289/): Security feature bypass in Chrome (low 3.1)
- [CVE-2026-79288](https://insights.sbomify.com/CVE-2026-79288/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-79287](https://insights.sbomify.com/CVE-2026-79287/): Information disclosure in Chrome (medium 5.3)
- [CVE-2026-79286](https://insights.sbomify.com/CVE-2026-79286/): Missing authorization in Chrome (high 7.4)
- [CVE-2026-79285](https://insights.sbomify.com/CVE-2026-79285/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-79284](https://insights.sbomify.com/CVE-2026-79284/): Other in Chrome (medium 4.3)
- [CVE-2026-79283](https://insights.sbomify.com/CVE-2026-79283/): Other in Chrome (medium 5.4)
- [CVE-2026-79282](https://insights.sbomify.com/CVE-2026-79282/): Use after free in Chrome (critical 9.6)
- [CVE-2026-7928](https://insights.sbomify.com/CVE-2026-7928/): Use after free in Chrome (high 8.8)
- [CVE-2026-79276](https://insights.sbomify.com/CVE-2026-79276/): Privilege escalation in Chrome (medium 4.3)
- [CVE-2026-79275](https://insights.sbomify.com/CVE-2026-79275/): Use after free in Chrome (critical 9.6)
- [CVE-2026-79274](https://insights.sbomify.com/CVE-2026-79274/): Information disclosure in Chrome (medium 4.3)
- [CVE-2026-79273](https://insights.sbomify.com/CVE-2026-79273/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2026-79272](https://insights.sbomify.com/CVE-2026-79272/): Information disclosure in Chrome (low 3.1)
- [CVE-2026-79271](https://insights.sbomify.com/CVE-2026-79271/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-79270](https://insights.sbomify.com/CVE-2026-79270/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-7927](https://insights.sbomify.com/CVE-2026-7927/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-79269](https://insights.sbomify.com/CVE-2026-79269/): Information disclosure in Chrome (medium 4.3)
- [CVE-2026-79267](https://insights.sbomify.com/CVE-2026-79267/): Race condition in Chrome (medium 4.3)
- [CVE-2026-79266](https://insights.sbomify.com/CVE-2026-79266/): Use after free in Chrome (high 8.8)
- [CVE-2026-79265](https://insights.sbomify.com/CVE-2026-79265/): Information disclosure in Chrome (medium 5.3)
- [CVE-2026-79264](https://insights.sbomify.com/CVE-2026-79264/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2026-79263](https://insights.sbomify.com/CVE-2026-79263/): Race condition in Chrome (high 8.1)
- [CVE-2026-79262](https://insights.sbomify.com/CVE-2026-79262/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2026-79261](https://insights.sbomify.com/CVE-2026-79261/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2026-79260](https://insights.sbomify.com/CVE-2026-79260/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-7926](https://insights.sbomify.com/CVE-2026-7926/): Use after free in Chrome (high 8.8)
- [CVE-2026-79259](https://insights.sbomify.com/CVE-2026-79259/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2026-79258](https://insights.sbomify.com/CVE-2026-79258/): Missing authorization in Chrome (medium 6.5)
- [CVE-2026-79257](https://insights.sbomify.com/CVE-2026-79257/): Use after free in Chrome (critical 9.6)
- [CVE-2026-79256](https://insights.sbomify.com/CVE-2026-79256/): Code injection in Chrome (high 8.3)
- [CVE-2026-79255](https://insights.sbomify.com/CVE-2026-79255/): Security feature bypass in Chrome (low 3.1)
- [CVE-2026-79254](https://insights.sbomify.com/CVE-2026-79254/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2026-79253](https://insights.sbomify.com/CVE-2026-79253/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-79252](https://insights.sbomify.com/CVE-2026-79252/): Information disclosure in Chrome (medium 4.3)
- [CVE-2026-79251](https://insights.sbomify.com/CVE-2026-79251/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2026-79250](https://insights.sbomify.com/CVE-2026-79250/): Other in Chrome (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/356/