# Vulnerabilities published in 2026


- [CVE-2026-78660](https://insights.sbomify.com/CVE-2026-78660/): HTTP/2 transport accepts malformed framing-related headers in net/http (high 7.5)
- [CVE-2026-7866](https://insights.sbomify.com/CVE-2026-7866/): Stack-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Buffers. (critical 10.0)
- [CVE-2026-78659](https://insights.sbomify.com/CVE-2026-78659/): HTTP/2 server memory exhaustion due to Trailer headers in net/http (high 7.5)
- [CVE-2026-78658](https://insights.sbomify.com/CVE-2026-78658/): IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to an information disclosure vulnerability (medium 6.5)
- [CVE-2026-78657](https://insights.sbomify.com/CVE-2026-78657/): SigmaForms Pro <= 1.4.11 - Unauthenticated Arbitrary File Deletion via Path Traversal in File Upload Field (critical 9.8)
- [CVE-2026-78656](https://insights.sbomify.com/CVE-2026-78656/): itsourcecode Sales and Inventory System cust_del.php sql injection (medium 5.3)
- [CVE-2026-78655](https://insights.sbomify.com/CVE-2026-78655/): Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie be (critical 9.1)
- [CVE-2026-78654](https://insights.sbomify.com/CVE-2026-78654/): cleverbrush framework/deep deepExtend.ts deepExtend prototype pollution (medium 6.9)
- [CVE-2026-7865](https://insights.sbomify.com/CVE-2026-7865/): Hidden Console Command (high 7.4)
- [CVE-2026-7864](https://insights.sbomify.com/CVE-2026-7864/): Exposure of Sensitive Information to an Unauthorized Actor (medium 6.9)
- [CVE-2026-78638](https://insights.sbomify.com/CVE-2026-78638/): peerigon unzip-crx/unzip-crx-3 Archive Extraction index.js unzip path traversal (medium 4.8)
- [CVE-2026-78637](https://insights.sbomify.com/CVE-2026-78637/): Fdawgs node-poppler Argument Injection index.js pdfUnite argument injection (medium 6.9)
- [CVE-2026-78635](https://insights.sbomify.com/CVE-2026-78635/): Improper Input Validation in the Okta Privileged Access SSH Client URL Handler Argument (medium 5.0)
- [CVE-2026-78633](https://insights.sbomify.com/CVE-2026-78633/): Denial of Service in Okta RADIUS Agent Packet Parser (medium 6.5)
- [CVE-2026-78632](https://insights.sbomify.com/CVE-2026-78632/): Insecure Default File Permissions in Okta RADIUS Agent Windows Installer (medium 5.3)
- [CVE-2026-78631](https://insights.sbomify.com/CVE-2026-78631/): Improper Restriction of Sensitive Information in Okta Hyperdrive Agent Logging (medium 5.3)
- [CVE-2026-78630](https://insights.sbomify.com/CVE-2026-78630/): Improper Input Neutralization in Okta Access Gateway SNMP Configuration Processing (medium 6.7)
- [CVE-2026-7863](https://insights.sbomify.com/CVE-2026-7863/): OS Command Injection in TUBITAK BILGEM's Pardus Software (high 8.4)
- [CVE-2026-78629](https://insights.sbomify.com/CVE-2026-78629/): Improper Authentication Verification in the Okta Hyperdrive Agent MFA Response Handling (medium 5.6)
- [CVE-2026-78628](https://insights.sbomify.com/CVE-2026-78628/): Improper Input Validation in the Okta Credential Provider for Windows (medium 6.0)
- [CVE-2026-78627](https://insights.sbomify.com/CVE-2026-78627/): Improper Credential Protection in Okta Hyperdrive Integration Installer Logging (high 7.3)
- [CVE-2026-78626](https://insights.sbomify.com/CVE-2026-78626/): Improper Input Sanitization in Okta Access Gateway Protected Rules (high 8.1)
- [CVE-2026-78625](https://insights.sbomify.com/CVE-2026-78625/): Insufficient Validation of Dashboard Application Labels in Okta Access Gateway Dashboard Site Configuration (medium 6.7)
- [CVE-2026-78624](https://insights.sbomify.com/CVE-2026-78624/): Improper Path Validation in Okta Access Gateway Backup and Restore Functionality (medium 4.9)
- [CVE-2026-78623](https://insights.sbomify.com/CVE-2026-78623/): Improper Handling of SAML Assertion Attributes in Okta Access Gateway Advanced Mode Datastores (high 7.7)
- [CVE-2026-78622](https://insights.sbomify.com/CVE-2026-78622/): Improper Link Resolution in Okta Verify for Windows Uninstaller Data Removal (medium 6.0)
- [CVE-2026-78620](https://insights.sbomify.com/CVE-2026-78620/): Improper Path Validation in Okta Access Gateway Kerberos Configuration Handling (medium 5.9)
- [CVE-2026-7862](https://insights.sbomify.com/CVE-2026-7862/): Eupago Gateway For Woocommerce < 4.7.2 - Unauthenticated Arbitrary Refund Initiation (high 8.6)
- [CVE-2026-78619](https://insights.sbomify.com/CVE-2026-78619/): Punk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code at the two-factor challenge because totp_use_recover (critical 9.8)
- [CVE-2026-78618](https://insights.sbomify.com/CVE-2026-78618/): Dimension Business Logic Flaw Allows Chained Backend Object Operations (medium 6.9)
- [CVE-2026-78617](https://insights.sbomify.com/CVE-2026-78617/): WatchGuard Dimension Web UI Authentication Brute-Force Due to Missing Rate Limiting (medium 6.3)
- [CVE-2026-78616](https://insights.sbomify.com/CVE-2026-78616/): Dimension Stored XSS via Trusted CA Certificate Configuration (medium 4.8)
- [CVE-2026-78615](https://insights.sbomify.com/CVE-2026-78615/): WatchGuard Dimension Reflected DOM-Based XSS in Report Detail Page (medium 4.6)
- [CVE-2026-78614](https://insights.sbomify.com/CVE-2026-78614/): Dimension SQL Injection in Audit Report (high 8.6)
- [CVE-2026-78613](https://insights.sbomify.com/CVE-2026-78613/): Dimension SQL Injection in Log Viewer (high 8.6)
- [CVE-2026-78612](https://insights.sbomify.com/CVE-2026-78612/): Dimension SQL Injection in Scheduled Report (high 8.6)
- [CVE-2026-78610](https://insights.sbomify.com/CVE-2026-78610/): Dimension CSRF Vulnerability in Administrator Passphrase Change Endpoint (high 8.4)
- [CVE-2026-7861](https://insights.sbomify.com/CVE-2026-7861/): Code Injection in Next4Biz's CSM (Customer Service Management) (critical 9.8)
- [CVE-2026-78609](https://insights.sbomify.com/CVE-2026-78609/): Incorrect Authorization in Elastic Cloud on Kubernetes Leading to Unauthorized Modification of Data (medium 5.4)
- [CVE-2026-78608](https://insights.sbomify.com/CVE-2026-78608/): Missing Authorization in Kibana Leading to Information Disclosure (medium 6.5)
- [CVE-2026-78607](https://insights.sbomify.com/CVE-2026-78607/): Missing Authorization in Elasticsearch Leading to Information Disclosure (medium 5.4)
- [CVE-2026-78606](https://insights.sbomify.com/CVE-2026-78606/): Incorrect Authorization in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data (medium 4.2)
- [CVE-2026-78605](https://insights.sbomify.com/CVE-2026-78605/): Information disclosure in Elasticsearch (medium 5.9)
- [CVE-2026-78604](https://insights.sbomify.com/CVE-2026-78604/): Incorrect Permission Assignment for Critical Resource in Elastic Agent Leading to Local Privilege Escalation to SYSTEM (high 7.8)
- [CVE-2026-78603](https://insights.sbomify.com/CVE-2026-78603/): Missing Authorization in Kibana Leading to Unauthorized Disclosure of Fleet Deployment Metadata (medium 4.3)
- [CVE-2026-78602](https://insights.sbomify.com/CVE-2026-78602/): Path traversal in Elastic Maps Server (medium 5.3)
- [CVE-2026-78601](https://insights.sbomify.com/CVE-2026-78601/): Missing Authorization in Kibana Leading to Unauthorized Elasticsearch Index Data Exposure (medium 5.5)
- [CVE-2026-78600](https://insights.sbomify.com/CVE-2026-78600/): Incomplete Cleanup in Elastic Cloud on Kubernetes Leading to Unauthorized Cross-Namespace Credential Retention (low 3.5)
- [CVE-2026-7860](https://insights.sbomify.com/CVE-2026-7860/): Possible information disclosure of environment variables in Vaadin Build Plugins via Failed Frontend Build (low 1.6)
- [CVE-2026-78599](https://insights.sbomify.com/CVE-2026-78599/): Stored Path Traversal in Kibana Leading to Unauthorized Deletion of Internal Resources (medium 6.5)
- [CVE-2026-78598](https://insights.sbomify.com/CVE-2026-78598/): Incorrect Authorization in Kibana Leading to Unauthorized Cross-Space Exposure of Machine Learning Job Data (medium 5.4)
- [CVE-2026-78597](https://insights.sbomify.com/CVE-2026-78597/): Missing Authorization in Kibana Entity Store Leading to Unauthorized API Key Creation (medium 4.3)
- [CVE-2026-78596](https://insights.sbomify.com/CVE-2026-78596/): Missing Authorization in Kibana Leading to Unauthorized Cross-Space Write Operations (medium 4.3)
- [CVE-2026-78595](https://insights.sbomify.com/CVE-2026-78595/): Missing Authorization in Kibana Fleet Plugin Leading to Cross-Space Agent Data Disclosure (medium 4.3)
- [CVE-2026-78594](https://insights.sbomify.com/CVE-2026-78594/): Improper Handling of Highly Compressed Data in APM Server Leading to Persistent Denial of Service (medium 4.9)
- [CVE-2026-78593](https://insights.sbomify.com/CVE-2026-78593/): Improper Control of Generation of Code in Kibana Leading to Privilege Escalation (medium 4.3)
- [CVE-2026-78592](https://insights.sbomify.com/CVE-2026-78592/): Path traversal in Kibana (high 7.3)
- [CVE-2026-78591](https://insights.sbomify.com/CVE-2026-78591/): Path traversal in Kibana (medium 6.3)
- [CVE-2026-78590](https://insights.sbomify.com/CVE-2026-78590/): Path traversal in Kibana (high 7.3)
- [CVE-2026-7859](https://insights.sbomify.com/CVE-2026-7859/): Motors Car Dealership & Classified Listings < 1.4.110 - Unauthenticated Post-Meta Write via stm_ajax_add_a_car_media (medium 5.3)
- [CVE-2026-78588](https://insights.sbomify.com/CVE-2026-78588/): Allocation of Resources Without Limits or Throttling in Filebeat Leading to Denial of Service (medium 6.5)
- [CVE-2026-78587](https://insights.sbomify.com/CVE-2026-78587/): Incorrect Authorization in Fleet Server Leading to Denial of Service of Agent Upload Operations (low 3.1)
- [CVE-2026-78586](https://insights.sbomify.com/CVE-2026-78586/): Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service (medium 6.5)
- [CVE-2026-78584](https://insights.sbomify.com/CVE-2026-78584/): Observable Response Discrepancy in Kibana Leading to Cross-Space Information Disclosure (medium 4.3)
- [CVE-2026-78583](https://insights.sbomify.com/CVE-2026-78583/): Incorrect Authorization in Kibana Leading to Privilege Escalation (high 8.1)
- [CVE-2026-78582](https://insights.sbomify.com/CVE-2026-78582/): Missing Authorization in Kibana Leading to Unauthorized Deletion of Data (medium 6.5)
- [CVE-2026-78581](https://insights.sbomify.com/CVE-2026-78581/): Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Data Modification in Kibana (medium 4.2)
- [CVE-2026-7858](https://insights.sbomify.com/CVE-2026-7858/): Deserialization in Magic Collaboration Studio (critical 9.8)
- [CVE-2026-78579](https://insights.sbomify.com/CVE-2026-78579/): Improper Input Sanitization in Okta Access Gateway LDAP Datastore Filter Interpolation (medium 6.8)
- [CVE-2026-78578](https://insights.sbomify.com/CVE-2026-78578/): Missing authorization in Tapo C120 v1 (high 7.1)
- [CVE-2026-78577](https://insights.sbomify.com/CVE-2026-78577/): Unauthenticated Onboarding Scan Information Disclosure in TP-Link Tapo C120 & C200 (medium 5.3)
- [CVE-2026-78575](https://insights.sbomify.com/CVE-2026-78575/): Command injection in Langflow OSS (high 8.8)
- [CVE-2026-78574](https://insights.sbomify.com/CVE-2026-78574/): Improper Assembly Resolution in Okta Hyperdrive Integration Plugin Registry Handling (high 7.5)
- [CVE-2026-78573](https://insights.sbomify.com/CVE-2026-78573/): IBM ContextForge MCP Gateway is affected by use of default credentials (critical 9.8)
- [CVE-2026-78571](https://insights.sbomify.com/CVE-2026-78571/): Code injection in Langflow OSS (high 8.8)
- [CVE-2026-7857](https://insights.sbomify.com/CVE-2026-7857/): D-Link DI-8100 CGI user_group.asp sprintf buffer overflow (high 8.6)
- [CVE-2026-78569](https://insights.sbomify.com/CVE-2026-78569/): Code injection in Langflow OSS (high 8.8)
- [CVE-2026-78560](https://insights.sbomify.com/CVE-2026-78560/): Improper Authentication Validation in Okta Access Gateway Pass-Through Authentication Source (medium 4.8)
- [CVE-2026-7856](https://insights.sbomify.com/CVE-2026-7856/): D-Link DI-8100 Web Management url_member.asp buffer overflow (high 8.6)
- [CVE-2026-78557](https://insights.sbomify.com/CVE-2026-78557/): Cross-site scripting in Industrial Edge App Publisher (high 7.7)
- [CVE-2026-78556](https://insights.sbomify.com/CVE-2026-78556/): Security feature bypass in Industrial Edge App Publisher (high 7.6)
- [CVE-2026-78555](https://insights.sbomify.com/CVE-2026-78555/): RansomLook API Key Disclosure Through /admin/apikeys HTML Source (critical 9.4)
- [CVE-2026-78553](https://insights.sbomify.com/CVE-2026-78553/): Insecure Flask Secret-Key File Permissions Allow Local Administrator Session Forgery in RansomLook (high 7.0)
- [CVE-2026-78552](https://insights.sbomify.com/CVE-2026-78552/): Validation Bypass in Okta Access Gateway Custom Directives (medium 6.0)
- [CVE-2026-78551](https://insights.sbomify.com/CVE-2026-78551/): RansomLook Login Endpoint Allows Timing-Based Username Enumeration and Unthrottled Authentication Attempts (high 8.8)
- [CVE-2026-78550](https://insights.sbomify.com/CVE-2026-78550/): Improper Input Handling in Okta Access Gateway Management Console Exception Handler (medium 6.6)
- [CVE-2026-7855](https://insights.sbomify.com/CVE-2026-7855/): D-Link DI-8100 HTTP Request tggl.asp tggl_asp buffer overflow (high 8.7)
- [CVE-2026-78547](https://insights.sbomify.com/CVE-2026-78547/): Out-of-Bounds Write (medium 4.4)
- [CVE-2026-78546](https://insights.sbomify.com/CVE-2026-78546/): Out-of-Bounds Read (medium 4.8)
- [CVE-2026-78545](https://insights.sbomify.com/CVE-2026-78545/): Improper Input Sanitization in Okta Access Gateway Application Label Configuration (medium 6.6)
- [CVE-2026-78543](https://insights.sbomify.com/CVE-2026-78543/): IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs (medium 5.3)
- [CVE-2026-78541](https://insights.sbomify.com/CVE-2026-78541/): Command Injection in Parent Control of TP-Link Archer BE3600 v1 (high 8.5)
- [CVE-2026-7854](https://insights.sbomify.com/CVE-2026-7854/): D-Link DI-8100 POST Parameter url_rule.asp url_rule_asp buffer overflow (critical 9.3)
- [CVE-2026-78536](https://insights.sbomify.com/CVE-2026-78536/): WordPress Robokassa payment gateway for Woocommerce plugin <= 1.8.9 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-78535](https://insights.sbomify.com/CVE-2026-78535/): WordPress Photolia theme <= 1.0.3 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-78534](https://insights.sbomify.com/CVE-2026-78534/): WordPress Educavo theme <= 3.4.2 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-78533](https://insights.sbomify.com/CVE-2026-78533/): WordPress Qwery theme <= 3.6.1 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-78532](https://insights.sbomify.com/CVE-2026-78532/): WordPress LMS theme <= 8.3 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-78531](https://insights.sbomify.com/CVE-2026-78531/): WordPress Jacqueline theme <= 2.22 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-78530](https://insights.sbomify.com/CVE-2026-78530/): WordPress FoodBakery theme <= 4.6 - Arbitrary File Deletion vulnerability (high 7.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/361/