# Vulnerabilities published in 2026


- [CVE-2026-78417](https://insights.sbomify.com/CVE-2026-78417/): Security feature bypass in Remote Desktop Manager (medium 4.3)
- [CVE-2026-78416](https://insights.sbomify.com/CVE-2026-78416/): Authenticated RCE via `condition.config` JSON cleanse bypass (high 8.7)
- [CVE-2026-78415](https://insights.sbomify.com/CVE-2026-78415/): IBM Sterling Secure Proxy is vulnerable to multiple issues (medium 5.4)
- [CVE-2026-78414](https://insights.sbomify.com/CVE-2026-78414/): Cross-site scripting in Nx Witness VMS Web Administration allows session token exfiltration via a rogue peer site name (high 8.0)
- [CVE-2026-78413](https://insights.sbomify.com/CVE-2026-78413/): Velociraptor privilege escalation via SysmonLogForward client monitoring artifact (medium 5.5)
- [CVE-2026-78412](https://insights.sbomify.com/CVE-2026-78412/): WatchEvent API streams another organization's live events (medium 4.9)
- [CVE-2026-78411](https://insights.sbomify.com/CVE-2026-78411/): Velociraptor Server Metadata update with Insufficient Permission Check (medium 6.5)
- [CVE-2026-78410](https://insights.sbomify.com/CVE-2026-78410/): Util-linux: util-linux: restricted bind mounts do not pin the source, allowing x-mount.owner/group/mode redirection (high 7.8)
- [CVE-2026-7841](https://insights.sbomify.com/CVE-2026-7841/): GV-ASWeb Remote Code Execution (RCE) vulnerability (high 8.8)
- [CVE-2026-78409](https://insights.sbomify.com/CVE-2026-78409/): Util-linux: util-linux: x-mount.subdir detached-tree resolution can escape via intermediate symlinks (high 7.0)
- [CVE-2026-78408](https://insights.sbomify.com/CVE-2026-78408/): Util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority (high 7.9)
- [CVE-2026-78407](https://insights.sbomify.com/CVE-2026-78407/): Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access (medium 5.4)
- [CVE-2026-78406](https://insights.sbomify.com/CVE-2026-78406/): Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access (critical 9.8)
- [CVE-2026-78404](https://insights.sbomify.com/CVE-2026-78404/): IBM® Db2® is vulnerable to local privilege escalation via the db2pd utility (medium 6.5)
- [CVE-2026-78401](https://insights.sbomify.com/CVE-2026-78401/): Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access (critical 9.8)
- [CVE-2026-7840](https://insights.sbomify.com/CVE-2026-7840/): UltraVNC repeater HTTP server global buffer overflow via long URI (pre-auth RCE) (critical 9.3)
- [CVE-2026-78399](https://insights.sbomify.com/CVE-2026-78399/): Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access (medium 6.5)
- [CVE-2026-78397](https://insights.sbomify.com/CVE-2026-78397/): Link Library < 7.9.6 - Unauthenticated SSRF via Reciprocal Link Validation (medium 4.0)
- [CVE-2026-78396](https://insights.sbomify.com/CVE-2026-78396/): Link Library < 7.10.0 - Unauthenticated Link Contact and Submitter Information Disclosure (medium 5.3)
- [CVE-2026-78395](https://insights.sbomify.com/CVE-2026-78395/): Link Library < 7.10.0 - Unauthenticated Link Submission Login Requirement Bypass (medium 5.3)
- [CVE-2026-78394](https://insights.sbomify.com/CVE-2026-78394/): Link Library < 7.9.6 - Contributor+ Path Traversal via 'filepath' Parameter (medium 4.1)
- [CVE-2026-78393](https://insights.sbomify.com/CVE-2026-78393/): Link Library < 7.9.6 - Reflected XSS via 'link_tags' and 'link_price' Sort and Breadcrumb Links (medium 6.1)
- [CVE-2026-78392](https://insights.sbomify.com/CVE-2026-78392/): Link Library < 7.9.6 - Contributor+ Stored XSS via 'link_target' Parameter (medium 6.8)
- [CVE-2026-78391](https://insights.sbomify.com/CVE-2026-78391/): Stored Cross-Site Scripting via Untrusted Cryptocurrency Address Rendering in RansomLook (high 8.8)
- [CVE-2026-7839](https://insights.sbomify.com/CVE-2026-7839/): UltraVNC repeater ships hardcoded default admin password allowing unauthenticated admin access (critical 9.1)
- [CVE-2026-78388](https://insights.sbomify.com/CVE-2026-78388/): Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access (medium 4.3)
- [CVE-2026-78387](https://insights.sbomify.com/CVE-2026-78387/): RansomLook Missing Authorization in Web Configuration Editor Allows Application Configuration Modification (critical 9.4)
- [CVE-2026-78386](https://insights.sbomify.com/CVE-2026-78386/): Unauthenticated Disclosure of Scraping Credentials and Bypass Configuration via RansomLook API (high 8.7)
- [CVE-2026-78385](https://insights.sbomify.com/CVE-2026-78385/): RansomLook Analysis PDF Generation Allows Server-Side Request Forgery and Arbitrary Local File Access (high 8.2)
- [CVE-2026-78384](https://insights.sbomify.com/CVE-2026-78384/): Apache CXF: Unbounded DEFLATE Decompression in CXF JOSE/JWE and SAML Processing (Decompression Bomb) (high 7.5)
- [CVE-2026-78383](https://insights.sbomify.com/CVE-2026-78383/): Apache Tomcat: AJP DoS via missing request body (high 7.5)
- [CVE-2026-78381](https://insights.sbomify.com/CVE-2026-78381/): RansomLook Arbitrary File Read via Path Traversal in Post screen Field (high 8.2)
- [CVE-2026-78380](https://insights.sbomify.com/CVE-2026-78380/): Private Group and Market Posts Disclosed Through Public Notification Channels in RansomLook (high 8.7)
- [CVE-2026-7838](https://insights.sbomify.com/CVE-2026-7838/): UltraVNC viewer heap buffer overflow via integer overflow in RFB connection-failure reason length (high 8.7)
- [CVE-2026-78379](https://insights.sbomify.com/CVE-2026-78379/): Consent bypass in python_repl tool via batch kwargs forwarding in Amazon Strands Agents Tools (critical 9.2)
- [CVE-2026-78378](https://insights.sbomify.com/CVE-2026-78378/): Redis Glob Pattern Injection Allows Unauthorized Enumeration of Private Ransomlook Data (medium 6.9)
- [CVE-2026-78377](https://insights.sbomify.com/CVE-2026-78377/): Open Redirect in Yordam Informatics's Library Automation System (medium 6.1)
- [CVE-2026-78376](https://insights.sbomify.com/CVE-2026-78376/): Webkitgtk: use-after-free of jscvalue function parameters (high 8.8)
- [CVE-2026-78375](https://insights.sbomify.com/CVE-2026-78375/): SQL injection in SP Page Builder (Free and Pro) extension for Joomla (high 8.6)
- [CVE-2026-78374](https://insights.sbomify.com/CVE-2026-78374/): Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension < 2.3.0 (medium 6.9)
- [CVE-2026-78372](https://insights.sbomify.com/CVE-2026-78372/): RansomLook Missing Authorization Allows Disclosure of Private Group and Ransom Note Data (critical 9.2)
- [CVE-2026-78371](https://insights.sbomify.com/CVE-2026-78371/): File Uploads Addon for WooCommerce 1.7.2 - 1.7.5 - Unauthenticated Customer Uploaded File Disclosure (medium 5.9)
- [CVE-2026-78370](https://insights.sbomify.com/CVE-2026-78370/): RansomLook Unauthenticated Database Export Exposes Private Data (critical 9.2)
- [CVE-2026-7837](https://insights.sbomify.com/CVE-2026-7837/): TOCTOU with root privilege in ad_flush (low 3.7)
- [CVE-2026-78369](https://insights.sbomify.com/CVE-2026-78369/): Missing Authentication Allows Unauthorized Creation of Crypto Groups in RansomLook (high 8.8)
- [CVE-2026-78367](https://insights.sbomify.com/CVE-2026-78367/): Rpm: rpmbuild gettarspec() crafted tar member name → macro injection (high 7.0)
- [CVE-2026-78365](https://insights.sbomify.com/CVE-2026-78365/): IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification (critical 9.3)
- [CVE-2026-78364](https://insights.sbomify.com/CVE-2026-78364/): MW WP Form < 5.1.6 - Editor+ Stored XSS via Inquiry Data List (low 3.5)
- [CVE-2026-78363](https://insights.sbomify.com/CVE-2026-78363/): MW WP Form < 5.1.5 - Unauthenticated Arbitrary Shortcode Execution via Completion Message Merge Tags (medium 4.8)
- [CVE-2026-78362](https://insights.sbomify.com/CVE-2026-78362/): SEO Flow by LupsOnline 3.0.0 - 3.0.2 - Unauthenticated Privilege Escalation via API Key Authentication (critical 9.8)
- [CVE-2026-78361](https://insights.sbomify.com/CVE-2026-78361/): zipMoney(Zip Co) Payments Plugin for WooCommerce < 2.4.0 - Unauthenticated Arbitrary Option Deletion (critical 9.1)
- [CVE-2026-7836](https://insights.sbomify.com/CVE-2026-7836/): hextoint macro uppercase bug (low 3.1)
- [CVE-2026-78359](https://insights.sbomify.com/CVE-2026-78359/): Duplicate Identity / Identity Shadowing across CustomerUser backends (medium 5.4)
- [CVE-2026-78358](https://insights.sbomify.com/CVE-2026-78358/): Cross-Site Request Forgery in Administrative Actions (medium 4.3)
- [CVE-2026-78357](https://insights.sbomify.com/CVE-2026-78357/): Insufficient Session Revocation for JWT Authentication (critical 9.1)
- [CVE-2026-78356](https://insights.sbomify.com/CVE-2026-78356/): Unauthenticated Disclosure of Agent Frontend Configuration (medium 5.3)
- [CVE-2026-78355](https://insights.sbomify.com/CVE-2026-78355/): Path Traversal in SendSupportBundle allows File Deletion Outside the Intended Directory (high 8.7)
- [CVE-2026-7835](https://insights.sbomify.com/CVE-2026-7835/): Format string argument mismatch (low 3.1)
- [CVE-2026-78341](https://insights.sbomify.com/CVE-2026-78341/): Privilege escalation in Secure Connect Gateway (SCG) Policy Manager (medium 6.5)
- [CVE-2026-78340](https://insights.sbomify.com/CVE-2026-78340/): Path traversal in Secure Connect Gateway (SCG) Policy Manager (medium 6.3)
- [CVE-2026-7834](https://insights.sbomify.com/CVE-2026-7834/): EFM ipTIME NAS1dual misc_main.cgi get_csrf_whites stack-based overflow (critical 9.3)
- [CVE-2026-78339](https://insights.sbomify.com/CVE-2026-78339/): Misconfiguration in Secure Connect Gateway (SCG) Policy Manager (medium 6.3)
- [CVE-2026-78337](https://insights.sbomify.com/CVE-2026-78337/): Unrestricted upload of file with dangerous type in Prospero Flow CRM allows stored cross-site scripting via SVG (medium 4.8)
- [CVE-2026-78336](https://insights.sbomify.com/CVE-2026-78336/): Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user (high 7.5)
- [CVE-2026-78335](https://insights.sbomify.com/CVE-2026-78335/): Incorrect Authorization in GitLab (medium 4.2)
- [CVE-2026-78334](https://insights.sbomify.com/CVE-2026-78334/): Apache bRPC: Missing Authentication for Streaming RPC Frames (not scored)
- [CVE-2026-78333](https://insights.sbomify.com/CVE-2026-78333/): 12 Step Meeting List 3.17 - 3.19.16 - Unauthenticated Stored XSS via Geocode Event Log (high 8.8)
- [CVE-2026-78330](https://insights.sbomify.com/CVE-2026-78330/): Apache Syncope: Privilege escalation for admin user via JWT authentication (critical 9.8)
- [CVE-2026-7833](https://insights.sbomify.com/CVE-2026-7833/): EFM ipTIME C200 ApplyRestore Endpoint iux_set.cgi sub_408F90 command injection (high 8.6)
- [CVE-2026-78329](https://insights.sbomify.com/CVE-2026-78329/): Apache Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes (critical 9.8)
- [CVE-2026-78328](https://insights.sbomify.com/CVE-2026-78328/): Privilege escalation in Network Security Manager (NSM) (critical 9.1)
- [CVE-2026-78327](https://insights.sbomify.com/CVE-2026-78327/): Command injection in Network Security Manager (NSM) (critical 9.1)
- [CVE-2026-78325](https://insights.sbomify.com/CVE-2026-78325/): XSS in Standard Notes on Android via Malicious Google Keep and Evernote HTML Import (medium 6.9)
- [CVE-2026-78323](https://insights.sbomify.com/CVE-2026-78323/): Jss: jss: jsstrustmanager does not verify nss trust flags on ca certificates (medium 6.5)
- [CVE-2026-78322](https://insights.sbomify.com/CVE-2026-78322/): File-roller: file-roller: stack buffer overflow in parse_progress_line for 7z and rar handlers (medium 6.5)
- [CVE-2026-78321](https://insights.sbomify.com/CVE-2026-78321/): DJI Drone HTTP Media Server Denial of Service via Connection Pool Exhaustion (medium 6.0)
- [CVE-2026-7832](https://insights.sbomify.com/CVE-2026-7832/): IObit Advanced SystemCare Service ASC.exe symlink (high 7.3)
- [CVE-2026-78319](https://insights.sbomify.com/CVE-2026-78319/): TOCTOU Vulnerability in file exchange (critical 9.3)
- [CVE-2026-78318](https://insights.sbomify.com/CVE-2026-78318/): Apache Syncope: Unauthenticated reflected XSS in Console and Enduser (medium 6.1)
- [CVE-2026-78317](https://insights.sbomify.com/CVE-2026-78317/): DIAEnergie - SQL Injection (high 8.8)
- [CVE-2026-78316](https://insights.sbomify.com/CVE-2026-78316/): DIAEnergie - SQL Injection (high 8.8)
- [CVE-2026-78315](https://insights.sbomify.com/CVE-2026-78315/): DIAEnergie - SQL Injection (high 8.8)
- [CVE-2026-78314](https://insights.sbomify.com/CVE-2026-78314/): DIAEnergie - SQL Injection (high 8.8)
- [CVE-2026-78313](https://insights.sbomify.com/CVE-2026-78313/): Improper Access Control in DIAEnergie (medium 6.5)
- [CVE-2026-78312](https://insights.sbomify.com/CVE-2026-78312/): Path Traversal in DIAEnergie (critical 9.1)
- [CVE-2026-78311](https://insights.sbomify.com/CVE-2026-78311/): SQL Injection in DIAEnergie (high 8.8)
- [CVE-2026-78310](https://insights.sbomify.com/CVE-2026-78310/): Authorization Bypass Through User-Controlled Key in DIAEnergie (medium 4.3)
- [CVE-2026-7831](https://insights.sbomify.com/CVE-2026-7831/): UltraVNC viewer off-by-one stack overflow in ServerInit desktop name parsing (high 7.5)
- [CVE-2026-78309](https://insights.sbomify.com/CVE-2026-78309/): SQL Injection in DIAEnergie (high 8.8)
- [CVE-2026-78308](https://insights.sbomify.com/CVE-2026-78308/): Authentication Bypass in DIAEnergie (critical 9.8)
- [CVE-2026-78306](https://insights.sbomify.com/CVE-2026-78306/): DJI Drone Bluetooth Interface Unauthenticated DUML Command Execution (high 8.5)
- [CVE-2026-78303](https://insights.sbomify.com/CVE-2026-78303/): Business logic in SP Property extension for Joomla (medium 6.9)
- [CVE-2026-78302](https://insights.sbomify.com/CVE-2026-78302/): Cross-site scripting in SP Property extension for Joomla (high 8.6)
- [CVE-2026-78301](https://insights.sbomify.com/CVE-2026-78301/): Out-of-zone database nodes can become authoritative zone cuts (medium 5.8)
- [CVE-2026-7830](https://insights.sbomify.com/CVE-2026-7830/): UltraVNC MS-Logon II uses 64-bit Diffie-Hellman and seeded libc rand() enabling credential interception (high 7.4)
- [CVE-2026-78299](https://insights.sbomify.com/CVE-2026-78299/): Path traversal in Eclipse Embedded CDT (C/C++ Development Tools) (critical 9.1)
- [CVE-2026-78296](https://insights.sbomify.com/CVE-2026-78296/): WordPress FluentAuth plugin <= 2.1.2 - Email Verification Bypass vulnerability (medium 5.3)
- [CVE-2026-78295](https://insights.sbomify.com/CVE-2026-78295/): WordPress Xagio SEO plugin <= 7.1.0.43 - Cross Site Request Forgery (CSRF) vulnerability (high 8.8)
- [CVE-2026-78294](https://insights.sbomify.com/CVE-2026-78294/): WordPress Geo Mashup plugin <= 1.13.21 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-78293](https://insights.sbomify.com/CVE-2026-78293/): WordPress WP w3all phpBB plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability (high 7.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/363/