# Vulnerabilities published in 2026


- [CVE-2026-77237](https://insights.sbomify.com/CVE-2026-77237/): Missing type validation in xQueueAddToSet in FreeRTOS-Kernel (high 8.2)
- [CVE-2026-77236](https://insights.sbomify.com/CVE-2026-77236/): Missing size validation in SecureContext_AllocateContext in FreeRTOS-Kernel (high 8.3)
- [CVE-2026-77235](https://insights.sbomify.com/CVE-2026-77235/): Missing privilege check in SecureContext_FreeContext in FreeRTOS-Kernel (high 8.3)
- [CVE-2026-77234](https://insights.sbomify.com/CVE-2026-77234/): Improper input validation in FreeRTOS-Kernel timer command handling (critical 9.3)
- [CVE-2026-77233](https://insights.sbomify.com/CVE-2026-77233/): Cross-site scripting in iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more (high 7.2)
- [CVE-2026-7723](https://insights.sbomify.com/CVE-2026-7723/): PrefectHQ prefect WebSocket Endpoint in missing authentication (medium 6.9)
- [CVE-2026-77226](https://insights.sbomify.com/CVE-2026-77226/): Camunda 7.24.0 < 7.24.15 Incorrect Authorization via SetupResource Endpoint (critical 9.2)
- [CVE-2026-77220](https://insights.sbomify.com/CVE-2026-77220/): PDFio < 1.6.5 Dangling Pointer via Dictionary String-Formatting (high 7.1)
- [CVE-2026-7722](https://insights.sbomify.com/CVE-2026-7722/): PrefectHQ prefect Health Check API health endswith improper authentication (medium 6.9)
- [CVE-2026-77219](https://insights.sbomify.com/CVE-2026-77219/): GNU Emacs < 31.0.91 Heap Over-Read via PBM/PPM/PGM Image Loader (medium 6.9)
- [CVE-2026-77218](https://insights.sbomify.com/CVE-2026-77218/): PLANET GS-4210-16P2S V3 Stack Buffer Overflow via dispatcher.cgi Credential Handlers (medium 6.9)
- [CVE-2026-77217](https://insights.sbomify.com/CVE-2026-77217/): PLANET GS-4210-16P2S V3 Stack Buffer Overflow and NULL Pointer Dereference via dispatcher.cgi RADIUS Handlers (medium 6.9)
- [CVE-2026-77214](https://insights.sbomify.com/CVE-2026-77214/): libexpat Heap Buffer Over-read in xmlparse.c via XML_ParseBuffer (high 8.3)
- [CVE-2026-7721](https://insights.sbomify.com/CVE-2026-7721/): Totolink WA300 cstecgi.cgi NTPSyncWithHost command injection (medium 5.3)
- [CVE-2026-77207](https://insights.sbomify.com/CVE-2026-77207/): Null Pointer Dereference in PKCS#7 bundle with no certificates (high 7.5)
- [CVE-2026-77206](https://insights.sbomify.com/CVE-2026-77206/): IKEv2 pre-authentication Null Pointer Dereference in EAP code (high 7.5)
- [CVE-2026-77205](https://insights.sbomify.com/CVE-2026-77205/): Denial of Service via sending bogus X.509 certificates (low 3.7)
- [CVE-2026-77203](https://insights.sbomify.com/CVE-2026-77203/): Groups <= 4.6.0 - Authenticated (Subscriber+) Privilege Escalation via 'groups_join' Shortcode (high 8.8)
- [CVE-2026-7720](https://insights.sbomify.com/CVE-2026-7720/): Totolink WA300 POST Request cstecgi.cgi setLanguageCfg command injection (medium 5.3)
- [CVE-2026-77194](https://insights.sbomify.com/CVE-2026-77194/): Auth bypass in Simple Membership (medium 5.3)
- [CVE-2026-77193](https://insights.sbomify.com/CVE-2026-77193/): Path traversal in eesy ID2WP – Publish InDesign HTML5 (high 7.5)
- [CVE-2026-77191](https://insights.sbomify.com/CVE-2026-77191/): Security feature bypass in EOS (low 2.1)
- [CVE-2026-77190](https://insights.sbomify.com/CVE-2026-77190/): Security Advisory 0177 (medium 6.0)
- [CVE-2026-7719](https://insights.sbomify.com/CVE-2026-7719/): Totolink WA300 POST Request cstecgi.cgi loginauth buffer overflow (critical 9.3)
- [CVE-2026-77189](https://insights.sbomify.com/CVE-2026-77189/): Charitable <= 1.8.12.1 - Authenticated (Contributor+) SQL Injection via 'order' Shortcode Attribute (medium 6.5)
- [CVE-2026-77188](https://insights.sbomify.com/CVE-2026-77188/): Cross-site scripting in Waitlist Woocommerce ( Back in stock notifier ) (medium 6.4)
- [CVE-2026-77187](https://insights.sbomify.com/CVE-2026-77187/): Cross-site scripting in My Calendar – Accessible Event Manager (medium 6.4)
- [CVE-2026-77186](https://insights.sbomify.com/CVE-2026-77186/): My Calendar <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fallback' Shortcode Attribute (medium 6.4)
- [CVE-2026-77185](https://insights.sbomify.com/CVE-2026-77185/): Apache MINA SSHD: Asynchronous authentication can bypass signature verification (critical 9.1)
- [CVE-2026-77184](https://insights.sbomify.com/CVE-2026-77184/): MongoDB Connector for BI Incomplete Escaping of Stored Metadata in Generated SHOW CREATE Output (medium 5.6)
- [CVE-2026-77183](https://insights.sbomify.com/CVE-2026-77183/): FooSales <= 1.43.0 - Authenticated (Custom+) Privilege Escalation via create_update_customer REST Endpoint (high 8.8)
- [CVE-2026-77181](https://insights.sbomify.com/CVE-2026-77181/): Apache Syncope: ClientApp update entitlement not effective (critical 9.8)
- [CVE-2026-77180](https://insights.sbomify.com/CVE-2026-77180/): NGINX Ingress Controller vulnerability (high 8.7)
- [CVE-2026-7718](https://insights.sbomify.com/CVE-2026-7718/): Totolink WA300 POST Request cstecgi.cgi setWebWlanIdx command injection (medium 5.3)
- [CVE-2026-77179](https://insights.sbomify.com/CVE-2026-77179/): Docker Sandboxes guest can write arbitrary macOS host files via a symlink in the virtio-fs stored-path fallback (critical 9.4)
- [CVE-2026-77178](https://insights.sbomify.com/CVE-2026-77178/): Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause an out-of-bounds write in the host OS in pcnetReceiveNoSync in DevPCNet.cpp (critical 9.1)
- [CVE-2026-77177](https://insights.sbomify.com/CVE-2026-77177/): Open GenAI Stack (aka ogx-ai) 2026-06-11, as used in the Meta AI backend for WhatsApp and other products, allows code execution because prom (critical 9.8)
- [CVE-2026-77176](https://insights.sbomify.com/CVE-2026-77176/): Kata-containers: insufficient validation of createcontainer mount and storage rules in genpolicy (high 8.1)
- [CVE-2026-77173](https://insights.sbomify.com/CVE-2026-77173/): Information disclosure in Files Confidential (medium 4.3)
- [CVE-2026-77172](https://insights.sbomify.com/CVE-2026-77172/): Security feature bypass in Server (medium 5.3)
- [CVE-2026-77171](https://insights.sbomify.com/CVE-2026-77171/): Missing authorization in Collectives (low 3.5)
- [CVE-2026-77170](https://insights.sbomify.com/CVE-2026-77170/): Missing authorization in Deck (medium 4.3)
- [CVE-2026-7717](https://insights.sbomify.com/CVE-2026-7717/): Totolink WA300 POST Request cstecgi.cgi UploadCustomModule buffer overflow (high 8.7)
- [CVE-2026-77169](https://insights.sbomify.com/CVE-2026-77169/): Missing authorization in Team Folders (medium 6.5)
- [CVE-2026-77167](https://insights.sbomify.com/CVE-2026-77167/): Denial of service in server (high 7.5)
- [CVE-2026-77166](https://insights.sbomify.com/CVE-2026-77166/): Other in Collectives (low 2.4)
- [CVE-2026-77165](https://insights.sbomify.com/CVE-2026-77165/): Business logic in Server (medium 6.5)
- [CVE-2026-77164](https://insights.sbomify.com/CVE-2026-77164/): Server-side request forgery in Server (medium 6.2)
- [CVE-2026-77161](https://insights.sbomify.com/CVE-2026-77161/): Smart Marketing SMS and Newsletters Forms <= 5.1.24 - Authenticated (Subscriber+) SQL Injection via Parameter Name (medium 6.5)
- [CVE-2026-7716](https://insights.sbomify.com/CVE-2026-7716/): code-projects Gym Management System In PHP/Windows NT index.php sql injection (medium 5.3)
- [CVE-2026-77159](https://insights.sbomify.com/CVE-2026-77159/): Libvirt: unsafe chown in qemutpmemulatorpreparehost() allows arbitrary file ownership change via symlink (medium 5.5)
- [CVE-2026-77157](https://insights.sbomify.com/CVE-2026-77157/): ast-cli: Auto-update downloads are not verified against a checksum before execution (medium 6.3)
- [CVE-2026-77156](https://insights.sbomify.com/CVE-2026-77156/): ast-cli: Path traversal in tar extraction on Linux/macOS allows writes outside the install directory (medium 6.3)
- [CVE-2026-77151](https://insights.sbomify.com/CVE-2026-77151/): lin-snow Ech0 crypto.go MD5Encrypt risky encryption (medium 6.3)
- [CVE-2026-77150](https://insights.sbomify.com/CVE-2026-77150/): Unlimited Elements For Elementor <= 2.0.16 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2026-7715](https://insights.sbomify.com/CVE-2026-7715/): ravenwits mcp-server-arangodb MCP tools.ts arango_backup path traversal (medium 5.3)
- [CVE-2026-77148](https://insights.sbomify.com/CVE-2026-77148/): Comfast CF-N1-S Web Management mbox-config sub_44B50C stack-based overflow (critical 9.4)
- [CVE-2026-77147](https://insights.sbomify.com/CVE-2026-77147/): Apache Syncope: Groovy Sandbox escape for empty CommandArgs (medium 6.5)
- [CVE-2026-77146](https://insights.sbomify.com/CVE-2026-77146/): Broken Access Control in extension "femanager" (femanager) (high 8.3)
- [CVE-2026-77145](https://insights.sbomify.com/CVE-2026-77145/): Broken Access Control in extension "Events 2" (events2) (high 7.1)
- [CVE-2026-77144](https://insights.sbomify.com/CVE-2026-77144/): Broken Access Control in extension "Events 2" (events2) (high 7.1)
- [CVE-2026-77143](https://insights.sbomify.com/CVE-2026-77143/): Broken Access Control in extension "Forum" (pforum) (high 8.8)
- [CVE-2026-77142](https://insights.sbomify.com/CVE-2026-77142/): Broken Access Control in extension "Industry Directory" (yellowpages2) (high 8.8)
- [CVE-2026-77141](https://insights.sbomify.com/CVE-2026-77141/): Broken Access Control in extension "Club Directory" (clubdirectory) (high 8.8)
- [CVE-2026-77140](https://insights.sbomify.com/CVE-2026-77140/): Broken Access Control in extension "Telephone Directory" (telephonedirectory) (high 8.7)
- [CVE-2026-7714](https://insights.sbomify.com/CVE-2026-7714/): crocodilestick Calibre-Web-Automated Admin Endpoint cwa_functions.py missing authentication (medium 6.9)
- [CVE-2026-77139](https://insights.sbomify.com/CVE-2026-77139/): Path Traversal in extension "Mask" (mask) (medium 6.0)
- [CVE-2026-77138](https://insights.sbomify.com/CVE-2026-77138/): Remote Code Execution in extension "HTML5 Video Player vs. Powermail" (html5videoplayer_powermail) (critical 9.3)
- [CVE-2026-77137](https://insights.sbomify.com/CVE-2026-77137/): SQL Injection in extension "Forms Export" (frp_form_answers) (high 7.7)
- [CVE-2026-77136](https://insights.sbomify.com/CVE-2026-77136/): Server-Side Template Injection in extension "powermail" (powermail) (critical 9.5)
- [CVE-2026-77135](https://insights.sbomify.com/CVE-2026-77135/): Information Disclosure in extension "femanager" (femanager) (high 8.2)
- [CVE-2026-77134](https://insights.sbomify.com/CVE-2026-77134/): Broken Access Control in extension "femanager" (femanager) (high 8.3)
- [CVE-2026-77133](https://insights.sbomify.com/CVE-2026-77133/): Broken Access Control in extension "femanager" (femanager) (medium 6.0)
- [CVE-2026-77132](https://insights.sbomify.com/CVE-2026-77132/): TYPO3 CMS - Information Disclosure via Backend Localization Wizard (medium 5.3)
- [CVE-2026-77131](https://insights.sbomify.com/CVE-2026-77131/): Cleartext Transmission of Sensitive Information in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy) (medium 5.3)
- [CVE-2026-77130](https://insights.sbomify.com/CVE-2026-77130/): Insufficient Session Expiration in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy) (medium 5.3)
- [CVE-2026-7713](https://insights.sbomify.com/CVE-2026-7713/): crocodilestick Calibre-Web-Automated Kobo auth-token Route kobo_auth.py generate_auth_token improper authorization (medium 5.3)
- [CVE-2026-77129](https://insights.sbomify.com/CVE-2026-77129/): Server-Side Template Injection in extension "Event management and registration" (sf_event_mgt) (high 7.7)
- [CVE-2026-77128](https://insights.sbomify.com/CVE-2026-77128/): Broken Access Control in extension "Event management and registration" (sf_event_mgt) (medium 6.3)
- [CVE-2026-77127](https://insights.sbomify.com/CVE-2026-77127/): Information Disclosure in extension "Modules" (modules) (medium 6.0)
- [CVE-2026-77125](https://insights.sbomify.com/CVE-2026-77125/): Nexus Repository 3 - Incorrect Authorization on Blobstore Group Endpoints (high 7.1)
- [CVE-2026-77124](https://insights.sbomify.com/CVE-2026-77124/): Nexus Repository 3 - Script Execution Disable Setting Not Enforced (high 7.5)
- [CVE-2026-77123](https://insights.sbomify.com/CVE-2026-77123/): Nexus Repository 3 - Webhook Secret Disclosure via Capability Read API (medium 6.0)
- [CVE-2026-77122](https://insights.sbomify.com/CVE-2026-77122/): Missing authorization in Nexus Repository 3 (medium 5.3)
- [CVE-2026-77121](https://insights.sbomify.com/CVE-2026-77121/): Nexus Repository 3 - Denial of Service via Unbounded Maven POM Metadata Fields (medium 5.3)
- [CVE-2026-77120](https://insights.sbomify.com/CVE-2026-77120/): Command injection in PowerLogic T300 (high 8.7)
- [CVE-2026-7712](https://insights.sbomify.com/CVE-2026-7712/): MindsDB Pickle pickle.loads deserialization (medium 5.3)
- [CVE-2026-77119](https://insights.sbomify.com/CVE-2026-77119/): NSEC3 insecure-referral proof can use unrelated cached NSEC3 RRsets (medium 5.9)
- [CVE-2026-77118](https://insights.sbomify.com/CVE-2026-77118/): Out-of-bounds write in GraphicsMagick PCD decoder (high 8.4)
- [CVE-2026-77117](https://insights.sbomify.com/CVE-2026-77117/): SHIFT_JISX0213 decoding may hang on crafted input (medium 5.9)
- [CVE-2026-77116](https://insights.sbomify.com/CVE-2026-77116/): Brave Popup Builder < 0.8.6 - Subscriber+ Unpublished Popup Disclosure via Preview (medium 4.3)
- [CVE-2026-77115](https://insights.sbomify.com/CVE-2026-77115/): Brave Popup Builder < 0.8.6 - Unauthenticated Reflected XSS via UTM Parameters (high 7.1)
- [CVE-2026-77114](https://insights.sbomify.com/CVE-2026-77114/): Document Gallery <= 5.1.1 - Unauthenticated Stored Cross-Site Scripting (high 7.2)
- [CVE-2026-77113](https://insights.sbomify.com/CVE-2026-77113/): Path Traversal Vulnerability in apport-unpack (medium 6.7)
- [CVE-2026-77112](https://insights.sbomify.com/CVE-2026-77112/): SSRF Leading to JWT Token Disclosure in Global IT Informatics' Weoll (medium 6.5)
- [CVE-2026-77111](https://insights.sbomify.com/CVE-2026-77111/): Adobe Commerce | Incorrect Authorization (CWE-863) (high 8.7)
- [CVE-2026-77110](https://insights.sbomify.com/CVE-2026-77110/): Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) (high 7.6)
- [CVE-2026-7711](https://insights.sbomify.com/CVE-2026-7711/): MindsDB Engine proc_wrapper.py exec unrestricted upload (medium 6.9)
- [CVE-2026-77109](https://insights.sbomify.com/CVE-2026-77109/): Adobe Commerce | Incorrect Authorization (CWE-863) (high 8.6)
- [CVE-2026-77108](https://insights.sbomify.com/CVE-2026-77108/): Adobe Commerce | Incorrect Authorization (CWE-863) (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/371/