# Vulnerabilities published in 2026


- [CVE-2026-77765](https://insights.sbomify.com/CVE-2026-77765/): Better Payment < 2.3.4 - Unauthenticated Payment Amount Manipulation (medium 5.3)
- [CVE-2026-77764](https://insights.sbomify.com/CVE-2026-77764/): GamiPress < 7.9.9.6 - Subscriber+ Arbitrary User Points and Achievement Award via Watch-Video Listeners (medium 4.3)
- [CVE-2026-77763](https://insights.sbomify.com/CVE-2026-77763/): Path traversal in juicefs (high 7.1)
- [CVE-2026-77762](https://insights.sbomify.com/CVE-2026-77762/): Apache Tomcat: Stale HPACK emitter injects trailers into recycled pooled Request (high 8.1)
- [CVE-2026-77761](https://insights.sbomify.com/CVE-2026-77761/): Cross-Document Parser State Contamination in misp-stix (medium 6.3)
- [CVE-2026-7776](https://insights.sbomify.com/CVE-2026-7776/): Boundary Workers Vulnerable to Denial of Service During TLS Handshake (high 7.5)
- [CVE-2026-77759](https://insights.sbomify.com/CVE-2026-77759/): IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial records (high 8.7)
- [CVE-2026-77758](https://insights.sbomify.com/CVE-2026-77758/): Information disclosure in Stripe Payment Forms by WP Full Pay (medium 5.3)
- [CVE-2026-77757](https://insights.sbomify.com/CVE-2026-77757/): Directorist 8.5 - 8.9.2 - Subscriber+ Arbitrary Image Move via REST v2 Listing Submission (medium 5.4)
- [CVE-2026-77756](https://insights.sbomify.com/CVE-2026-77756/): Apache Tomcat: Transfer-Encoding honored for HTTP/1.0 requests (low 3.7)
- [CVE-2026-77755](https://insights.sbomify.com/CVE-2026-77755/): Denial of Service in MISP-STIX Import via Malformed or Oversized STIX Documents in misp-stix library (high 8.7)
- [CVE-2026-77754](https://insights.sbomify.com/CVE-2026-77754/): Kirki < 6.0.14 - Unauthenticated User and Comment Author Email Disclosure via kirki_get_apis (medium 5.3)
- [CVE-2026-77753](https://insights.sbomify.com/CVE-2026-77753/): Temporary Login Without Password < 1.9.9 - Authenticated Temporary Access Revocation Bypass via Application Passwords (medium 5.5)
- [CVE-2026-77752](https://insights.sbomify.com/CVE-2026-77752/): Temporary Login Without Password 1.5 - 1.9.8 - Multisite Subsite Admin+ Network Super Admin Privilege Escalation (high 7.2)
- [CVE-2026-77751](https://insights.sbomify.com/CVE-2026-77751/): Path Traversal in MISP Object Template Resolution During STIX Import and Export in misp-stix library (high 8.8)
- [CVE-2026-7775](https://insights.sbomify.com/CVE-2026-7775/): Cross-site Scripting Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway (medium 5.5)
- [CVE-2026-7774](https://insights.sbomify.com/CVE-2026-7774/): tarfile.data_filter path traversal bypass allows writing outside the extraction directory (medium 6.9)
- [CVE-2026-77711](https://insights.sbomify.com/CVE-2026-77711/): Information disclosure in Eclipse Jetty (high 8.2)
- [CVE-2026-77710](https://insights.sbomify.com/CVE-2026-77710/): STIX2 Parser Confusion and Mass Assignment Allow Unauthorized MISP Attribute Metadata Injection in misp-stix library (medium 6.9)
- [CVE-2026-7771](https://insights.sbomify.com/CVE-2026-7771/): Denial of service in Db2 (medium 5.5)
- [CVE-2026-77707](https://insights.sbomify.com/CVE-2026-77707/): TLS Certificate Validation Disabled for Keycloak Connections in HAVELSAN's Liman Render Engine (medium 5.9)
- [CVE-2026-77705](https://insights.sbomify.com/CVE-2026-77705/): Amelia < 2.4.10 - Amelia Manager+ WordPress Account Takeover (high 7.2)
- [CVE-2026-77704](https://insights.sbomify.com/CVE-2026-77704/): Amelia 1.2.32 - 2.4.8 - Amelia Customer+ Appointment Status Update and Self-Approval (low 2.7)
- [CVE-2026-77703](https://insights.sbomify.com/CVE-2026-77703/): SSH Host Key Verification Bypass in HAVELSAN's Liman Render Engine (medium 5.9)
- [CVE-2026-77702](https://insights.sbomify.com/CVE-2026-77702/): Eventin < 4.1.24 - Unauthenticated Ticket Price Rewrite via order_token (medium 5.3)
- [CVE-2026-77701](https://insights.sbomify.com/CVE-2026-77701/): WCFM Marketplace < 3.8.2 - Unauthenticated Refund Request Creation on Guest Orders (medium 5.3)
- [CVE-2026-7770](https://insights.sbomify.com/CVE-2026-7770/): Code injection in i Access Family (high 8.8)
- [CVE-2026-77699](https://insights.sbomify.com/CVE-2026-77699/): Privilege Escalation (medium 5.0)
- [CVE-2026-77698](https://insights.sbomify.com/CVE-2026-77698/): Privilege Escalation (medium 5.7)
- [CVE-2026-77697](https://insights.sbomify.com/CVE-2026-77697/): Privilege Escalation (medium 6.3)
- [CVE-2026-77696](https://insights.sbomify.com/CVE-2026-77696/): Timing Side-Channel in SM2 Signature Generation (low 3.7)
- [CVE-2026-77695](https://insights.sbomify.com/CVE-2026-77695/): Woo Refund And Exchange Lite < 4.6.4 - Unauthenticated Guest Order Message Disclosure and Manipulation (medium 6.5)
- [CVE-2026-77694](https://insights.sbomify.com/CVE-2026-77694/): Eventin < 4.1.19 - Unauthenticated Order Completion Without Payment via order_token (medium 5.3)
- [CVE-2026-77693](https://insights.sbomify.com/CVE-2026-77693/): Order Tip for WooCommerce < 1.6.0 - Shop Manager+ Arbitrary File Deletion via delete_exported_csv_file_ajax (high 8.7)
- [CVE-2026-77692](https://insights.sbomify.com/CVE-2026-77692/): Unauthenticated remote crash of named via a single DoH SIG(0) request (high 7.5)
- [CVE-2026-7769](https://insights.sbomify.com/CVE-2026-7769/): SQL injection Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway (high 8.1)
- [CVE-2026-77689](https://insights.sbomify.com/CVE-2026-77689/): Amelia Pro 9.0 - 9.8 - Unauthenticated Payment Bypass (medium 5.3)
- [CVE-2026-77686](https://insights.sbomify.com/CVE-2026-77686/): Dolibarr Account card.php improper authorization (medium 5.3)
- [CVE-2026-77684](https://insights.sbomify.com/CVE-2026-77684/): Bluetooth Classic HFP Hands-Free: TX buffer leak on RFCOMM disconnect leads to permanent Bluetooth denial of service (medium 5.7)
- [CVE-2026-77683](https://insights.sbomify.com/CVE-2026-77683/): Comfast CF-N1-S mbox-config system command injection (critical 9.4)
- [CVE-2026-77681](https://insights.sbomify.com/CVE-2026-77681/): CodeAstro Online Job Portal update-profile.php unrestricted upload (medium 5.3)
- [CVE-2026-77680](https://insights.sbomify.com/CVE-2026-77680/): Libsoup3: libsoup: quadratic cpu denial of service in http range coalescing after cve-2025-32907 fix (medium 5.3)
- [CVE-2026-7768](https://insights.sbomify.com/CVE-2026-7768/): @fastify/accepts-serializer vulnerable to Denial of Service via Unbounded Accept Header Cache Growth (high 7.5)
- [CVE-2026-7767](https://insights.sbomify.com/CVE-2026-7767/): URL Redirection to Untrusted Site ('Open Redirect') in GitLab (medium 5.8)
- [CVE-2026-7766](https://insights.sbomify.com/CVE-2026-7766/): Path Traversal in Kenik cameras (high 8.3)
- [CVE-2026-77658](https://insights.sbomify.com/CVE-2026-77658/): Dia: dia: stack buffer overflow in bus object via unvalidated handle count in project files (high 7.8)
- [CVE-2026-77654](https://insights.sbomify.com/CVE-2026-77654/): Local Privilege Escalation via Misconfigured Sudoers Entry in Horizon Security Analyzer (medium 6.1)
- [CVE-2026-77652](https://insights.sbomify.com/CVE-2026-77652/): Dia: dia: heap buffer overflow in wpg colormap parser via out-of-bounds palette index (high 7.8)
- [CVE-2026-77651](https://insights.sbomify.com/CVE-2026-77651/): Supply chain in arrayref (critical 9.8)
- [CVE-2026-77650](https://insights.sbomify.com/CVE-2026-77650/): Supply chain in append-only-vec (critical 9.8)
- [CVE-2026-7765](https://insights.sbomify.com/CVE-2026-7765/): User Messages widget leaked issuer messages on shared dashboards (medium 6.3)
- [CVE-2026-77649](https://insights.sbomify.com/CVE-2026-77649/): Supply chain in internment (critical 9.8)
- [CVE-2026-77648](https://insights.sbomify.com/CVE-2026-77648/): Server-side request forgery in Glance (low 2.2)
- [CVE-2026-77647](https://insights.sbomify.com/CVE-2026-77647/): Code injection in SPIP (critical 9.8)
- [CVE-2026-77646](https://insights.sbomify.com/CVE-2026-77646/): Server Side Request Forgery (SSRF) vulnerability reported in Windchill (high 7.7)
- [CVE-2026-77645](https://insights.sbomify.com/CVE-2026-77645/): Critical Remote Code Execution (RCE) vulnerability reported in Windchill (critical 9.2)
- [CVE-2026-77644](https://insights.sbomify.com/CVE-2026-77644/): Critical Bypass Access Control Vulnerability Reported for Windchill Risk and Reliability (WRR) Enterprise Edition (critical 9.3)
- [CVE-2026-77643](https://insights.sbomify.com/CVE-2026-77643/): Cross-site scripting in xapian-core (medium 4.4)
- [CVE-2026-77642](https://insights.sbomify.com/CVE-2026-77642/): Memory corruption in Tor (high 7.5)
- [CVE-2026-77641](https://insights.sbomify.com/CVE-2026-77641/): Use after free in Tor (medium 6.5)
- [CVE-2026-77640](https://insights.sbomify.com/CVE-2026-77640/): Denial of service in Tor (low 3.7)
- [CVE-2026-7764](https://insights.sbomify.com/CVE-2026-7764/): Out-of-bounds read in morse.ko Vendor IE processing (medium 6.8)
- [CVE-2026-77639](https://insights.sbomify.com/CVE-2026-77639/): Security feature bypass in Tor (medium 5.3)
- [CVE-2026-77638](https://insights.sbomify.com/CVE-2026-77638/): Race condition in Tor (high 8.9)
- [CVE-2026-77637](https://insights.sbomify.com/CVE-2026-77637/): Cloudreve: Privilege Scope Bypass: State-Mutating Admin Operations Accessible via Read-Only OAuth Scope (low 3.8)
- [CVE-2026-77635](https://insights.sbomify.com/CVE-2026-77635/): CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver (critical 9.2)
- [CVE-2026-77634](https://insights.sbomify.com/CVE-2026-77634/): CakePHP: SmtpTransport vulnerable to CRLF header injection (high 8.2)
- [CVE-2026-77633](https://insights.sbomify.com/CVE-2026-77633/): Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of service (high 7.1)
- [CVE-2026-77630](https://insights.sbomify.com/CVE-2026-77630/): pupnp: Denial of service via blocking DNS resolution in parse_uri()/GENA callback parsing (high 7.5)
- [CVE-2026-7763](https://insights.sbomify.com/CVE-2026-7763/): Heap buffer overflow in morse.ko TIM IE processing (critical 9.8)
- [CVE-2026-77621](https://insights.sbomify.com/CVE-2026-77621/): Vector: Arbitrary file write in the file sink via templated path (path traversal). (critical 9.3)
- [CVE-2026-77620](https://insights.sbomify.com/CVE-2026-77620/): Denial of service in vector (high 8.7)
- [CVE-2026-7762](https://insights.sbomify.com/CVE-2026-7762/): Heap buffer overflow in dot11ah.ko S1G Capabilities IE processing (critical 9.8)
- [CVE-2026-77619](https://insights.sbomify.com/CVE-2026-77619/): Vector: Unauthenticated denial of service in the `logstash` source via unbounded memory allocation. (high 8.7)
- [CVE-2026-77616](https://insights.sbomify.com/CVE-2026-77616/): Semantic MediaWiki affected by reflected XSS in `Special:Ask` via a forged cursor pagination token (medium 6.1)
- [CVE-2026-77615](https://insights.sbomify.com/CVE-2026-77615/): Paella Player: Stored XSS via caption cue text (high 8.7)
- [CVE-2026-77614](https://insights.sbomify.com/CVE-2026-77614/): Opencast: Session fixation in login enables account takeover via crafted link (high 8.8)
- [CVE-2026-77611](https://insights.sbomify.com/CVE-2026-77611/): Missing authorization in seaweedfs (high 7.1)
- [CVE-2026-77610](https://insights.sbomify.com/CVE-2026-77610/): Semantic MediaWiki has a query debug output XSS (`DebugFormatter`) (medium 6.1)
- [CVE-2026-7761](https://insights.sbomify.com/CVE-2026-7761/): Ultimate Member <= 2.11.4 - Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure (high 8.8)
- [CVE-2026-77609](https://insights.sbomify.com/CVE-2026-77609/): Semantic MediaWiki has an open redirect in Special:URIResolver (medium 6.1)
- [CVE-2026-77608](https://insights.sbomify.com/CVE-2026-77608/): Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters) (medium 6.1)
- [CVE-2026-77607](https://insights.sbomify.com/CVE-2026-77607/): Semantic MediaWiki affected by Special:Ask table `sep` parameter reflected XSS (medium 6.1)
- [CVE-2026-77606](https://insights.sbomify.com/CVE-2026-77606/): Semantic MediaWiki has reflected XSS in Special:Ask plain table headers (medium 6.1)
- [CVE-2026-77605](https://insights.sbomify.com/CVE-2026-77605/): Notepad++ “Run by system” executes *.txt.cmd when user selected *.txt (target confusion → command execution) (high 7.8)
- [CVE-2026-77602](https://insights.sbomify.com/CVE-2026-77602/): OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites) (critical 9.9)
- [CVE-2026-77601](https://insights.sbomify.com/CVE-2026-77601/): OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting (high 8.8)
- [CVE-2026-77587](https://insights.sbomify.com/CVE-2026-77587/): Use after free in Tor (medium 5.9)
- [CVE-2026-77586](https://insights.sbomify.com/CVE-2026-77586/): MongoDB Connector for BI Unescaped Object Names in Generated SHOW CREATE Output (high 8.5)
- [CVE-2026-77585](https://insights.sbomify.com/CVE-2026-77585/): Improper Validation of SSH Target in Okta Privileged Access Client (medium 5.3)
- [CVE-2026-77584](https://insights.sbomify.com/CVE-2026-77584/): Use after free in Tor (high 7.0)
- [CVE-2026-77582](https://insights.sbomify.com/CVE-2026-77582/): Tinyauth: User enumeration attack by timing oracle (medium 6.9)
- [CVE-2026-77581](https://insights.sbomify.com/CVE-2026-77581/): BentoPDF: SSRF in cors-proxy-worker.js via DNS-based hostname allowlist bypass (high 8.6)
- [CVE-2026-77573](https://insights.sbomify.com/CVE-2026-77573/): Weblate: DNS rebinding in VCS operations allows server-side request forgery (low 3.5)
- [CVE-2026-77572](https://insights.sbomify.com/CVE-2026-77572/): Information disclosure in VeraCrypt (low 3.3)
- [CVE-2026-77567](https://insights.sbomify.com/CVE-2026-77567/): Filament: App-based MFA can be bypassed when recovery codes are enabled (high 8.1)
- [CVE-2026-77564](https://insights.sbomify.com/CVE-2026-77564/): Talos Linux: Support bundle does not redact registry credentials (low 3.3)
- [CVE-2026-77561](https://insights.sbomify.com/CVE-2026-77561/): Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service (medium 5.3)
- [CVE-2026-77560](https://insights.sbomify.com/CVE-2026-77560/): Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for (high 8.1)
- [CVE-2026-77558](https://insights.sbomify.com/CVE-2026-77558/): Memory corruption in Cloud Gateways (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/368/