# Vulnerabilities published in 2026


- [CVE-2026-7853](https://insights.sbomify.com/CVE-2026-7853/): D-Link DI-8100 HTTP auto_reboot.asp sprintf buffer overflow (critical 9.3)
- [CVE-2026-78529](https://insights.sbomify.com/CVE-2026-78529/): WordPress Alliance theme <= 3.11 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-78528](https://insights.sbomify.com/CVE-2026-78528/): WordPress BerqWP plugin <= 4.1.15 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-78526](https://insights.sbomify.com/CVE-2026-78526/): Microsoft Office Word Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-78525](https://insights.sbomify.com/CVE-2026-78525/): Microsoft Office Outlook Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-78524](https://insights.sbomify.com/CVE-2026-78524/): Microsoft Office Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-78523](https://insights.sbomify.com/CVE-2026-78523/): Windows DNS Server Denial of Service Vulnerability (medium 5.9)
- [CVE-2026-78522](https://insights.sbomify.com/CVE-2026-78522/): Microsoft Office Word Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-78521](https://insights.sbomify.com/CVE-2026-78521/): Microsoft Office Word Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-78520](https://insights.sbomify.com/CVE-2026-78520/): Microsoft Office Outlook Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-7852](https://insights.sbomify.com/CVE-2026-7852/): Unrestricted File Upload in Limatek's LimRAD NAC (critical 9.8)
- [CVE-2026-78519](https://insights.sbomify.com/CVE-2026-78519/): Microsoft Office Outlook Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-78518](https://insights.sbomify.com/CVE-2026-78518/): Microsoft Office Excel Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-78517](https://insights.sbomify.com/CVE-2026-78517/): Microsoft Office Word Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-78516](https://insights.sbomify.com/CVE-2026-78516/): Windows Storage Information Disclosure Vulnerability (medium 4.3)
- [CVE-2026-78515](https://insights.sbomify.com/CVE-2026-78515/): Microsoft Office Excel Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-78514](https://insights.sbomify.com/CVE-2026-78514/): Microsoft Office Word Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-78513](https://insights.sbomify.com/CVE-2026-78513/): Microsoft Office PowerPoint Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-78512](https://insights.sbomify.com/CVE-2026-78512/): Microsoft Office Word Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-78511](https://insights.sbomify.com/CVE-2026-78511/): Microsoft Office Word Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-78510](https://insights.sbomify.com/CVE-2026-78510/): Microsoft Outlook and Word Remote Code Execution Vulnerability (high 8.4)
- [CVE-2026-7851](https://insights.sbomify.com/CVE-2026-7851/): D-Link DI-8100 yyxz.asp sprintf stack-based overflow (high 8.6)
- [CVE-2026-78509](https://insights.sbomify.com/CVE-2026-78509/): Microsoft Office Outlook Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-78508](https://insights.sbomify.com/CVE-2026-78508/): Windows CD-ROM Driver Information Disclosure Vulnerability (medium 4.6)
- [CVE-2026-78507](https://insights.sbomify.com/CVE-2026-78507/): Microsoft Office Word Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-78506](https://insights.sbomify.com/CVE-2026-78506/): Microsoft Office Word Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-78505](https://insights.sbomify.com/CVE-2026-78505/): Microsoft Office Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-78504](https://insights.sbomify.com/CVE-2026-78504/): Microsoft Office Word Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-78503](https://insights.sbomify.com/CVE-2026-78503/): Microsoft Office Word Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-78502](https://insights.sbomify.com/CVE-2026-78502/): Microsoft Office Word Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-78501](https://insights.sbomify.com/CVE-2026-78501/): Microsoft 365 Copilot Business Chat Information Disclosure Vulnerability (high 8.6)
- [CVE-2026-78500](https://insights.sbomify.com/CVE-2026-78500/): Dimension Blind SSRF via Database Test Connection Feature (medium 5.1)
- [CVE-2026-7850](https://insights.sbomify.com/CVE-2026-7850/): WP Magnific Popup <= 1.0 - Author+ Stored XSS via href Attribute (medium 5.9)
- [CVE-2026-78499](https://insights.sbomify.com/CVE-2026-78499/): Dimension SSRF via FTP Server Test Connection (medium 5.1)
- [CVE-2026-78498](https://insights.sbomify.com/CVE-2026-78498/): Dimension Server-Side Request Forgery via Email Server Test Settings (medium 5.1)
- [CVE-2026-78497](https://insights.sbomify.com/CVE-2026-78497/): JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval. (high 8.4)
- [CVE-2026-78495](https://insights.sbomify.com/CVE-2026-78495/): Dimension Server-Side Request Forgery via Remote Backup Connection Test (medium 5.3)
- [CVE-2026-78494](https://insights.sbomify.com/CVE-2026-78494/): Security feature bypass in Secure Connect Gateway 5.0 - Appliance (high 7.4)
- [CVE-2026-78493](https://insights.sbomify.com/CVE-2026-78493/): Command injection in Secure Connect Gateway 5.0 - Appliance (medium 5.5)
- [CVE-2026-78492](https://insights.sbomify.com/CVE-2026-78492/): Security feature bypass in Secure Connect Gateway 5.0 - Appliance (high 7.4)
- [CVE-2026-78491](https://insights.sbomify.com/CVE-2026-78491/): Security feature bypass in Secure Connect Gateway 5.0 - Appliance (high 8.2)
- [CVE-2026-78490](https://insights.sbomify.com/CVE-2026-78490/): Auth bypass in Secure Connect Gateway 5.0 - Appliance (high 7.5)
- [CVE-2026-7849](https://insights.sbomify.com/CVE-2026-7849/): Command Injection in SCM (idledisconnect parameter) (critical 9.3)
- [CVE-2026-78489](https://insights.sbomify.com/CVE-2026-78489/): Security feature bypass in Secure Connect Gateway 5.0 - Appliance (medium 5.9)
- [CVE-2026-78488](https://insights.sbomify.com/CVE-2026-78488/): Command injection in Secure Connect Gateway 5.0 - Appliance (medium 6.5)
- [CVE-2026-78487](https://insights.sbomify.com/CVE-2026-78487/): Hardcoded credentials in Secure Connect Gateway 5.0 - Appliance (medium 5.5)
- [CVE-2026-78486](https://insights.sbomify.com/CVE-2026-78486/): Hardcoded credentials in Secure Connect Gateway 5.0 - Appliance (medium 4.4)
- [CVE-2026-78485](https://insights.sbomify.com/CVE-2026-78485/): Path traversal in Secure Connect Gateway 5.0 - Appliance (high 7.3)
- [CVE-2026-78484](https://insights.sbomify.com/CVE-2026-78484/): Command injection in Secure Connect Gateway 5.0 - Appliance (medium 5.5)
- [CVE-2026-78483](https://insights.sbomify.com/CVE-2026-78483/): Security feature bypass in Secure Connect Gateway 5.0 - Appliance (medium 5.9)
- [CVE-2026-78482](https://insights.sbomify.com/CVE-2026-78482/): Command injection in Secure Connect Gateway 5.0 - Appliance (medium 5.5)
- [CVE-2026-78481](https://insights.sbomify.com/CVE-2026-78481/): Hardcoded credentials in Secure Connect Gateway 5.0 - Appliance (medium 6.5)
- [CVE-2026-78480](https://insights.sbomify.com/CVE-2026-78480/): Auth bypass in Secure Connect Gateway 5.0 - Appliance (high 7.5)
- [CVE-2026-7848](https://insights.sbomify.com/CVE-2026-7848/): SQL Injection in Alior Bank raty PrestaShop module (high 8.6)
- [CVE-2026-78478](https://insights.sbomify.com/CVE-2026-78478/): Måne <= 1.7 - Unauthenticated Local File Inclusion (high 8.1)
- [CVE-2026-78475](https://insights.sbomify.com/CVE-2026-78475/): Gimp: unbounded stack vla and 21-byte stack over-read in pix (esm) loader (medium 6.1)
- [CVE-2026-78474](https://insights.sbomify.com/CVE-2026-78474/): Ni WooCommerce Sales Report < 4.2.0 - Unauthenticated Order and Customer Data Disclosure via 'btn_print' Parameter (medium 5.3)
- [CVE-2026-78472](https://insights.sbomify.com/CVE-2026-78472/): Ni WooCommerce Sales Report < 4.2.0 - Unauthenticated SQLi via 'sort' Parameter (high 8.6)
- [CVE-2026-78471](https://insights.sbomify.com/CVE-2026-78471/): Autoptimize <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name (medium 5.4)
- [CVE-2026-78470](https://insights.sbomify.com/CVE-2026-78470/): WP Project Manager Pro <= 4.0.1 - Authenticated (Subscriber+) SQL Injection (medium 6.5)
- [CVE-2026-7847](https://insights.sbomify.com/CVE-2026-7847/): chatchat-space Langchain-Chatchat Uploaded File openai_routes.py _get_file_id random values (low 2.1)
- [CVE-2026-78465](https://insights.sbomify.com/CVE-2026-78465/): Gimp: integer overflow in pcx loader (planes=4) leads to heap overflow on 32-bit (high 7.0)
- [CVE-2026-78464](https://insights.sbomify.com/CVE-2026-78464/): Windows MIDI Service Module Elevation of Privileges Vulnerability (high 7.0)
- [CVE-2026-78463](https://insights.sbomify.com/CVE-2026-78463/): Remote Desktop Client Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-78462](https://insights.sbomify.com/CVE-2026-78462/): Visual Studio Code Security Feature Bypass Vulnerability (high 8.8)
- [CVE-2026-78461](https://insights.sbomify.com/CVE-2026-78461/): Visual Studio Code Security Feature Bypass Vulnerability (high 7.4)
- [CVE-2026-7846](https://insights.sbomify.com/CVE-2026-7846/): chatchat-space Langchain-Chatchat OpenAI-Compatible File Upload API openai_routes.py files toctou (low 2.1)
- [CVE-2026-78459](https://insights.sbomify.com/CVE-2026-78459/): Microsoft Internet Information Services Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-78457](https://insights.sbomify.com/CVE-2026-78457/): Windows Security Health Service Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-78456](https://insights.sbomify.com/CVE-2026-78456/): SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-78455](https://insights.sbomify.com/CVE-2026-78455/): Xbox Information Disclosure Vulnerability (medium 4.3)
- [CVE-2026-78454](https://insights.sbomify.com/CVE-2026-78454/): Windows CD-ROM Driver Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-78453](https://insights.sbomify.com/CVE-2026-78453/): Microsoft Windows SCSI Class System File Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-78452](https://insights.sbomify.com/CVE-2026-78452/): Microsoft Windows SCSI Class System File Information Disclosure Vulnerability (medium 4.6)
- [CVE-2026-78451](https://insights.sbomify.com/CVE-2026-78451/): Microsoft Windows SCSI Class System File Elevation of Privilege Vulnerability (medium 6.8)
- [CVE-2026-78450](https://insights.sbomify.com/CVE-2026-78450/): Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability (high 8.1)
- [CVE-2026-7845](https://insights.sbomify.com/CVE-2026-7845/): chatchat-space Langchain-Chatchat Vision Chat Paste Image dialogue.py PIL.Image.tobytes weak hash (low 2.1)
- [CVE-2026-78449](https://insights.sbomify.com/CVE-2026-78449/): Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability (high 8.1)
- [CVE-2026-78448](https://insights.sbomify.com/CVE-2026-78448/): Windows Biometric Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-78447](https://insights.sbomify.com/CVE-2026-78447/): Windows Biometric Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-78446](https://insights.sbomify.com/CVE-2026-78446/): Windows Distributed File System (DFS) Remote Code Execution Vulnerability (high 7.5)
- [CVE-2026-78445](https://insights.sbomify.com/CVE-2026-78445/): Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-78444](https://insights.sbomify.com/CVE-2026-78444/): Microsoft Failover Cluster Remote Code Execution Vulnerability (high 8.1)
- [CVE-2026-78442](https://insights.sbomify.com/CVE-2026-78442/): Windows OLE DB Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-78441](https://insights.sbomify.com/CVE-2026-78441/): Windows OLE DB Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-7844](https://insights.sbomify.com/CVE-2026-7844/): chatchat-space Langchain-Chatchat Compatible File Service openai_routes.py delete_file missing authentication (medium 5.3)
- [CVE-2026-78439](https://insights.sbomify.com/CVE-2026-78439/): Microsoft Office Graphics Component Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-78438](https://insights.sbomify.com/CVE-2026-78438/): W3 Total Cache <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via LazyLoad Background Mutator (high 7.2)
- [CVE-2026-78437](https://insights.sbomify.com/CVE-2026-78437/): Apache Tomcat: HTTP/2 DoS via malformed request (high 7.3)
- [CVE-2026-78435](https://insights.sbomify.com/CVE-2026-78435/): Faveo Helpdesk Logo SettingsController.php unlink path traversal (medium 5.1)
- [CVE-2026-78434](https://insights.sbomify.com/CVE-2026-78434/): Faveo Helpdesk post-ticket-reply Endpoint FormController.php post_ticket_reply missing authentication (medium 6.9)
- [CVE-2026-78433](https://insights.sbomify.com/CVE-2026-78433/): Gitea private attachment disclosure through repository mismatch (medium 5.9)
- [CVE-2026-78430](https://insights.sbomify.com/CVE-2026-78430/): sworddut mcp-ffmpeg-helper Tool handlers.ts handleToolCall os command injection (medium 4.8)
- [CVE-2026-78428](https://insights.sbomify.com/CVE-2026-78428/): Auth bypass in neuvector (high 8.8)
- [CVE-2026-78427](https://insights.sbomify.com/CVE-2026-78427/): Admission Control Bypass via Hardcoded Sidecar Image Exemption (medium 5.3)
- [CVE-2026-78426](https://insights.sbomify.com/CVE-2026-78426/): Logout bypass via alternate JWT spelling (low 2.0)
- [CVE-2026-78425](https://insights.sbomify.com/CVE-2026-78425/): SAML Audience Confusion Allows Cross-SP Authentication (high 7.6)
- [CVE-2026-78424](https://insights.sbomify.com/CVE-2026-78424/): OS Command Injection in Packet-Capture (Sniffer) Filter leading to Remote Code Execution on Kubernetes Nodes (high 8.8)
- [CVE-2026-78422](https://insights.sbomify.com/CVE-2026-78422/): zbus_polkit: polkit authorization bypass via PID reuse due to incorrect D-Bus type for the subject UID (high 7.3)
- [CVE-2026-7842](https://insights.sbomify.com/CVE-2026-7842/): Infility Global < 2.15.20 - Editor+ SQL Injection via orderby Parameter (medium 6.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/362/