# Vulnerabilities published in 2026


- [CVE-2026-78181](https://insights.sbomify.com/CVE-2026-78181/): ractivejs ractive Keypath Ractive#set prototype pollution (medium 6.9)
- [CVE-2026-78180](https://insights.sbomify.com/CVE-2026-78180/): alibaba-fusion next deepMerge index.tsx ConfigProvider.getContextProps prototype pollution (medium 6.9)
- [CVE-2026-7818](https://insights.sbomify.com/CVE-2026-7818/): pgAdmin 4: Unsafe deserialization (CWE-502) in file-backed session manager leads to remote code execution (high 7.3)
- [CVE-2026-78179](https://insights.sbomify.com/CVE-2026-78179/): rexrainbow phaser3-rex-notes BehaviorTree Blackboard Data SetValue.js SetValue prototype pollution (medium 5.3)
- [CVE-2026-78178](https://insights.sbomify.com/CVE-2026-78178/): jQWidgets jqx-all.js jqxBaseFramework.extend prototype pollution (medium 6.9)
- [CVE-2026-78177](https://insights.sbomify.com/CVE-2026-78177/): TanStack devtools-vite Development Devtools Event Bus package-manager.ts installPackage os command injection (low 2.0)
- [CVE-2026-78175](https://insights.sbomify.com/CVE-2026-78175/): Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution (high 8.8)
- [CVE-2026-78174](https://insights.sbomify.com/CVE-2026-78174/): WatchGuard Dimension Session Hijack via Exposed Session Tokens in Diagnostic Logs (critical 9.3)
- [CVE-2026-78172](https://insights.sbomify.com/CVE-2026-78172/): Themify – WooCommerce Product Filter <= 1.5.5 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2026-78171](https://insights.sbomify.com/CVE-2026-78171/): itsourcecode Sales and Inventory System processlogin.php sql injection (medium 6.9)
- [CVE-2026-78170](https://insights.sbomify.com/CVE-2026-78170/): UTT HiPER 1200GW formConfigFastDirectionW strcpy buffer overflow (high 8.7)
- [CVE-2026-7817](https://insights.sbomify.com/CVE-2026-7817/): pgAdmin 4: Local file inclusion and server-side request forgery in LLM API configuration endpoints (high 7.1)
- [CVE-2026-78169](https://insights.sbomify.com/CVE-2026-78169/): UTT HiPER 1250GW HTTP Request aspRemoteApConfTempSend strcpy stack-based overflow (critical 9.4)
- [CVE-2026-78168](https://insights.sbomify.com/CVE-2026-78168/): EFM ipTIME T24000M Session Validation httpcon_check_session_url improper authentication (critical 9.3)
- [CVE-2026-78167](https://insights.sbomify.com/CVE-2026-78167/): EFM ipTIME T16000M Session Validation httpcon_check_session_url improper authentication (critical 10.0)
- [CVE-2026-78166](https://insights.sbomify.com/CVE-2026-78166/): provectus kafka-ui Groovy Code MessagesController.java executeSmartFilterTest code injection (medium 5.3)
- [CVE-2026-78165](https://insights.sbomify.com/CVE-2026-78165/): Apache Camel: Camel-Spring-Redis Unfiltered Java Deserialization of Redis Payloads (high 8.8)
- [CVE-2026-78164](https://insights.sbomify.com/CVE-2026-78164/): Apache Camel: HTTP producers resolve property placeholders in message-supplied URI override headers (high 8.2)
- [CVE-2026-78163](https://insights.sbomify.com/CVE-2026-78163/): Server-side request forgery in Apache Camel (medium 5.9)
- [CVE-2026-78162](https://insights.sbomify.com/CVE-2026-78162/): Apache Camel: Camel-Hazelcast Managed Instances Missing Java Deserialization Filter (Incomplete Fix for CVE-2026-43865) (critical 10.0)
- [CVE-2026-78161](https://insights.sbomify.com/CVE-2026-78161/): warmcat libwebsockets LECP CBOR Recording lecp.c report_raw_cbor out-of-bounds write (medium 6.9)
- [CVE-2026-78160](https://insights.sbomify.com/CVE-2026-78160/): Dolibarr ERP User Notes note.php authorization (medium 5.3)
- [CVE-2026-7816](https://insights.sbomify.com/CVE-2026-7816/): pgAdmin 4: OS command injection in Import/Export query export via psql metacommand breakout (high 8.7)
- [CVE-2026-78159](https://insights.sbomify.com/CVE-2026-78159/): Code injection in The Events Calendar (critical 9.8)
- [CVE-2026-78158](https://insights.sbomify.com/CVE-2026-78158/): Open5GS AMF UEContextReleaseRequest Path improper authorization (medium 5.3)
- [CVE-2026-78157](https://insights.sbomify.com/CVE-2026-78157/): Open5GS Rx AA-Request pcrf-rx-path.c pcrf_rx_aar_cb out-of-bounds (medium 5.3)
- [CVE-2026-78156](https://insights.sbomify.com/CVE-2026-78156/): Open5GS S6a Authentication-Information-Request hss-s6a-path.c hss_ogs_diam_s6a_air_cb heap-based overflow (medium 5.3)
- [CVE-2026-78155](https://insights.sbomify.com/CVE-2026-78155/): Untrusted Search Path in StackGres (critical 9.9)
- [CVE-2026-78153](https://insights.sbomify.com/CVE-2026-78153/): Restrict User Access 2.6 - 2.8 - Unauthenticated Content Protection Bypass via REST API Route Normalization (medium 5.3)
- [CVE-2026-78152](https://insights.sbomify.com/CVE-2026-78152/): SureRank 1.6.2 - 1.10.0 - Unauthenticated Author Email Disclosure via Person Schema (medium 5.3)
- [CVE-2026-78151](https://insights.sbomify.com/CVE-2026-78151/): FormLayer < 1.0.9 - Unauthenticated Form Configuration Disclosure via Form Submission Response (medium 5.3)
- [CVE-2026-78150](https://insights.sbomify.com/CVE-2026-78150/): Missing authorization in Smart Post (low 2.7)
- [CVE-2026-7815](https://insights.sbomify.com/CVE-2026-7815/): pgAdmin 4: SQL injection in Maintenance tool option values leading to remote code execution (high 8.7)
- [CVE-2026-78149](https://insights.sbomify.com/CVE-2026-78149/): Missing authorization in Smart Post (medium 5.3)
- [CVE-2026-78148](https://insights.sbomify.com/CVE-2026-78148/): ggml-org llama.cpp ggml-RPC Server ggml-rpc.cpp graph_compute null pointer dereference (medium 6.9)
- [CVE-2026-78147](https://insights.sbomify.com/CVE-2026-78147/): ggml-org llama.cpp ggml-RPC Server ggml-rpc.cpp deserialize_tensor deserialization (medium 6.9)
- [CVE-2026-78146](https://insights.sbomify.com/CVE-2026-78146/): Noptin < 4.3.3 - Unauthenticated Subscriber PII and confirm_key Disclosure via Actions Page (medium 6.5)
- [CVE-2026-78145](https://insights.sbomify.com/CVE-2026-78145/): CTFd __init__.py _is_safe_url redirect (medium 5.3)
- [CVE-2026-78144](https://insights.sbomify.com/CVE-2026-78144/): code-projects Barangay Resident Profiling Management System Boarder Management boarders.php authorization (medium 5.3)
- [CVE-2026-78143](https://insights.sbomify.com/CVE-2026-78143/): code-projects Barangay Resident Profiling Management System Resident Search Functionality residents.php sql injection (medium 6.9)
- [CVE-2026-78142](https://insights.sbomify.com/CVE-2026-78142/): code-projects Barangay Resident Profiling Management System Restore/Delete archived_records.php authorization (medium 5.3)
- [CVE-2026-78141](https://insights.sbomify.com/CVE-2026-78141/): Tenda CH22 exeCommand formexeCommand command injection (medium 5.3)
- [CVE-2026-78140](https://insights.sbomify.com/CVE-2026-78140/): Dromara UJCMS web-file-template Endpoint WebFileTemplateController.java update special elements in template engine (medium 5.1)
- [CVE-2026-7814](https://insights.sbomify.com/CVE-2026-7814/): pgAdmin 4: Stored XSS via crafted PostgreSQL object names in Browser Tree and Explain Visualizer (medium 4.8)
- [CVE-2026-78139](https://insights.sbomify.com/CVE-2026-78139/): Notifima < 3.1.4 - Subscriber+ Stock Alert Unsubscription via IDOR (medium 4.3)
- [CVE-2026-78138](https://insights.sbomify.com/CVE-2026-78138/): Finale Lite < 2.21.0 - Subscriber+ Campaign Configuration Disclosure via wcct_quick_view_html (medium 4.3)
- [CVE-2026-78137](https://insights.sbomify.com/CVE-2026-78137/): Business logic in StoreGrowth (high 7.5)
- [CVE-2026-78136](https://insights.sbomify.com/CVE-2026-78136/): Code injection in CHIRP (high 7.8)
- [CVE-2026-78135](https://insights.sbomify.com/CVE-2026-78135/): Auth bypass in strongSwan (medium 5.6)
- [CVE-2026-78134](https://insights.sbomify.com/CVE-2026-78134/): Auth bypass in strongSwan (high 7.1)
- [CVE-2026-78133](https://insights.sbomify.com/CVE-2026-78133/): Use after free in strongSwan (high 7.5)
- [CVE-2026-78132](https://insights.sbomify.com/CVE-2026-78132/): Denial of service in strongSwan (high 7.5)
- [CVE-2026-78131](https://insights.sbomify.com/CVE-2026-78131/): Denial of service in strongSwan (low 3.7)
- [CVE-2026-78130](https://insights.sbomify.com/CVE-2026-78130/): Null dereference in strongSwan (high 7.5)
- [CVE-2026-7813](https://insights.sbomify.com/CVE-2026-7813/): pgAdmin 4: Cross-user data access and shared-server privilege escalation in server mode (critical 9.4)
- [CVE-2026-78129](https://insights.sbomify.com/CVE-2026-78129/): Denial of service in strongSwan (medium 5.9)
- [CVE-2026-78127](https://insights.sbomify.com/CVE-2026-78127/): Denial of service in strongSwan (low 3.7)
- [CVE-2026-78126](https://insights.sbomify.com/CVE-2026-78126/): Null dereference in strongSwan (medium 5.9)
- [CVE-2026-78125](https://insights.sbomify.com/CVE-2026-78125/): LearnPress – Sepay Payment < 4.0.3 - Unauthenticated Order Status Disclosure (medium 5.3)
- [CVE-2026-78124](https://insights.sbomify.com/CVE-2026-78124/): Denial of service in strongSwan (low 3.7)
- [CVE-2026-78123](https://insights.sbomify.com/CVE-2026-78123/): Use after free in strongSwan (medium 5.9)
- [CVE-2026-78122](https://insights.sbomify.com/CVE-2026-78122/): docker-socket-proxy through 0.5.0 Insufficient Access Control Granularity Exposes Container Filesystems (high 8.3)
- [CVE-2026-7812](https://insights.sbomify.com/CVE-2026-7812/): 54yyyu code-mcp MCP Tool server.py git_operation command injection (medium 6.9)
- [CVE-2026-78119](https://insights.sbomify.com/CVE-2026-78119/): Memory corruption in zephyr (medium 6.3)
- [CVE-2026-78118](https://insights.sbomify.com/CVE-2026-78118/): Race condition in zephyr (high 7.0)
- [CVE-2026-78117](https://insights.sbomify.com/CVE-2026-78117/): Race condition in zephyr (medium 4.2)
- [CVE-2026-78116](https://insights.sbomify.com/CVE-2026-78116/): Double free of an RTIO submission in the Broadcom AFBR-S50 sensor driver data-evaluation error path (medium 5.2)
- [CVE-2026-78115](https://insights.sbomify.com/CVE-2026-78115/): SourceCodester Class and Exam Timetabling System User Account Update edit_user_account.php improper authorization (medium 5.3)
- [CVE-2026-78112](https://insights.sbomify.com/CVE-2026-78112/): itsourcecode Hospital Management System Project in PHP viewservicetype.php sql injection (medium 5.3)
- [CVE-2026-7811](https://insights.sbomify.com/CVE-2026-7811/): 54yyyu code-mcp MCP File server.py is_safe_path path traversal (medium 6.9)
- [CVE-2026-78103](https://insights.sbomify.com/CVE-2026-78103/): Dimension Log Server Configuration Lock Bypass Vulnerability (medium 5.1)
- [CVE-2026-7810](https://insights.sbomify.com/CVE-2026-7810/): UsamaK98 python-notebook-mcp server.py add_cell path traversal (medium 6.9)
- [CVE-2026-78088](https://insights.sbomify.com/CVE-2026-78088/): Contest Gallery <= 32.0.1 - Unauthenticated Arbitrary File Upload via 'baseUrlForFacebook' Parameter (high 8.8)
- [CVE-2026-78087](https://insights.sbomify.com/CVE-2026-78087/): VK Blocks <= 1.126.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Group Block 'linkToPost' Feature (medium 6.4)
- [CVE-2026-78085](https://insights.sbomify.com/CVE-2026-78085/): Joomla Extension - joomshaper.com - Path Traversal in Gallery Image Management in SP Property < 4.1.4 (medium 6.9)
- [CVE-2026-78084](https://insights.sbomify.com/CVE-2026-78084/): Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property < 4.1.4 (medium 6.9)
- [CVE-2026-78083](https://insights.sbomify.com/CVE-2026-78083/): Cross-site request forgery in SP Property extension for Joomla (high 7.1)
- [CVE-2026-78082](https://insights.sbomify.com/CVE-2026-78082/): SQL injection in SP Property extension for Joomla (critical 9.3)
- [CVE-2026-78081](https://insights.sbomify.com/CVE-2026-78081/): Cross-site request forgery in J2Store extension for Joomla (high 7.1)
- [CVE-2026-78080](https://insights.sbomify.com/CVE-2026-78080/): Joomla Extension - feenders.de - Unauthenticated SQL injection in JooDatabase Lite < 5.1.0 (critical 9.3)
- [CVE-2026-7808](https://insights.sbomify.com/CVE-2026-7808/): justhtml before 1.16.0 Multiple Security Issues via Sanitization (critical 9.3)
- [CVE-2026-78079](https://insights.sbomify.com/CVE-2026-78079/): Joomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate < 2.2.10 (medium 5.3)
- [CVE-2026-78078](https://insights.sbomify.com/CVE-2026-78078/): Joomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate < 2.2.10 (high 8.9)
- [CVE-2026-78077](https://insights.sbomify.com/CVE-2026-78077/): Cross-site scripting in Helix Ultimate extension for Joomla (high 8.6)
- [CVE-2026-78076](https://insights.sbomify.com/CVE-2026-78076/): Missing authorization in Helix Ultimate extension for Joomla (medium 5.1)
- [CVE-2026-78075](https://insights.sbomify.com/CVE-2026-78075/): Joomla Extension - joomshaper.com - Broken Object-Level Authorization in Blog Image Deletion in Helix Ultimate < 2.2.10 (medium 5.1)
- [CVE-2026-78074](https://insights.sbomify.com/CVE-2026-78074/): Missing authorization in Custom API for Joomla (free) extension for Joomla (high 8.8)
- [CVE-2026-78073](https://insights.sbomify.com/CVE-2026-78073/): Joomla Extension - j2commerce.com - Reflected XSS attribute in All Video Share 1.0.0-4.5.0 (medium 5.3)
- [CVE-2026-78072](https://insights.sbomify.com/CVE-2026-78072/): Joomla Extension - Jefferson49 - Unauthenticated blind SQLi in Sexy Polling Reloaded < 5.6.1 (high 8.7)
- [CVE-2026-78071](https://insights.sbomify.com/CVE-2026-78071/): Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0-8.19.5, 9.0.0-10.12.0 (high 7.5)
- [CVE-2026-78070](https://insights.sbomify.com/CVE-2026-78070/): Joomla Extension - digital-peak.com - Authenticated, privileged blind SQL injection in DP Calendar 5.5.0 - 10.11.2 (medium 6.9)
- [CVE-2026-7807](https://insights.sbomify.com/CVE-2026-7807/): SmarterTools SmarterMail < Build 9560 Server Local File Inclusion via the /api/v1/report/summary/{type} API (high 8.7)
- [CVE-2026-78069](https://insights.sbomify.com/CVE-2026-78069/): Missing authorization in J2Store extension for Joomla (critical 9.5)
- [CVE-2026-78068](https://insights.sbomify.com/CVE-2026-78068/): Cross-site scripting in Table Field Add-on for ACF and SCF (medium 6.4)
- [CVE-2026-78066](https://insights.sbomify.com/CVE-2026-78066/): Apache bRPC: Resource Exhaustion via Unbounded Decompression and Unvalidated Wire-Declared Sizes (not scored)
- [CVE-2026-78065](https://insights.sbomify.com/CVE-2026-78065/): Missing authorization in J2Store extension for Joomla (high 7.1)
- [CVE-2026-78064](https://insights.sbomify.com/CVE-2026-78064/): Missing authorization in J2Store extension for Joomla (high 8.8)
- [CVE-2026-78063](https://insights.sbomify.com/CVE-2026-78063/): Tenda CH22 editFileName formeditFileName command injection (medium 5.3)
- [CVE-2026-78062](https://insights.sbomify.com/CVE-2026-78062/): vas3k TaxHacker JWT Secret config.ts envSchema.parse hard-coded credentials (medium 6.9)
- [CVE-2026-78061](https://insights.sbomify.com/CVE-2026-78061/): vas3k TaxHacker Email Sync imap-client.ts buildImapConfig server-side request forgery (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/365/