# Vulnerabilities published in 2026


- [CVE-2026-76654](https://insights.sbomify.com/CVE-2026-76654/): Subpath symlinking on Windows nodes permits NTLM coercion (medium 5.8)
- [CVE-2026-76653](https://insights.sbomify.com/CVE-2026-76653/): Missing Authentication in VPN Configuration Management in TP-Link TL-MR6400 and Archer MR600 (medium 5.3)
- [CVE-2026-76652](https://insights.sbomify.com/CVE-2026-76652/): Authenticated Directory Traversal Vulnerability in File Upload Functionality in TP-Link TL-MR6400 and Archer MR600 (medium 4.8)
- [CVE-2026-76651](https://insights.sbomify.com/CVE-2026-76651/): Pre-Authentication Multipart Boundary Buffer Overflow in HTTP Service in TP-Link TL-WR841N (medium 5.3)
- [CVE-2026-76650](https://insights.sbomify.com/CVE-2026-76650/): Pre-Authentication NULL Pointer Dereference in UPnP SOAP State Variable Query Processing in TP-Link TL-WR841N (medium 5.3)
- [CVE-2026-7665](https://insights.sbomify.com/CVE-2026-7665/): Missing authorization in Essential Addons for Elementor – Popular Elementor Templates & Widgets (medium 5.3)
- [CVE-2026-76649](https://insights.sbomify.com/CVE-2026-76649/): Pre-Authentication NULL Pointer Dereference in UPnP SOAP Action Request Processing in TP-Link TL-WR841N (medium 5.3)
- [CVE-2026-76648](https://insights.sbomify.com/CVE-2026-76648/): Missing authorization in Red Hat Ansible Automation Platform 2 (high 8.5)
- [CVE-2026-76647](https://insights.sbomify.com/CVE-2026-76647/): Leantime JSON-RPC API contains a missing authorization vulnerability (high 8.8)
- [CVE-2026-76646](https://insights.sbomify.com/CVE-2026-76646/): Apache MyFaces: Denial of Service via Unbounded Request Parsing (high 7.5)
- [CVE-2026-76642](https://insights.sbomify.com/CVE-2026-76642/): util-linux libmount Privilege Escalation via Failed Mount Helper (high 8.5)
- [CVE-2026-76641](https://insights.sbomify.com/CVE-2026-76641/): Expat Out-of-Bounds Read via dtdCopy (high 8.7)
- [CVE-2026-76640](https://insights.sbomify.com/CVE-2026-76640/): Unitree G1 EDU 1.5.2 BLE GATT RCE via WiFi Provisioning Stack (high 7.7)
- [CVE-2026-7664](https://insights.sbomify.com/CVE-2026-7664/): Unauthenticated Flow Execution via Webhook Endpoint in Langflow OSS (critical 9.8)
- [CVE-2026-76639](https://insights.sbomify.com/CVE-2026-76639/): Unitree G1 EDU 1.5.2 Unauthenticated RCE via DDS Bridge and Path Traversal (high 8.7)
- [CVE-2026-76635](https://insights.sbomify.com/CVE-2026-76635/): baserCMS < 5.3.0 SQL Injection and Code Injection via BcDatabaseService.php (high 8.6)
- [CVE-2026-76634](https://insights.sbomify.com/CVE-2026-76634/): WeGIA < 3.9.2 Insecure Direct Object Reference via profile_funcionario.php (high 7.1)
- [CVE-2026-76633](https://insights.sbomify.com/CVE-2026-76633/): WeGIA < 3.9.2 Authorization Bypass Password Change via alterarSenha (high 8.6)
- [CVE-2026-7663](https://insights.sbomify.com/CVE-2026-7663/): Unauthenticated Cross-User MCP Resource Access and Tool Execution via Streamable Transport Authorization Bypass (critical 9.1)
- [CVE-2026-7662](https://insights.sbomify.com/CVE-2026-7662/): Cross-site scripting in Plugin Name: ePaperFlip Publisher (medium 6.4)
- [CVE-2026-76614](https://insights.sbomify.com/CVE-2026-76614/): OpenEMR < 8.3.0 Path Traversal Information Disclosure via EDI Archive Restore (medium 5.3)
- [CVE-2026-76613](https://insights.sbomify.com/CVE-2026-76613/): Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40 (high 8.6)
- [CVE-2026-76612](https://insights.sbomify.com/CVE-2026-76612/): Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo < 4.1.66 (high 8.6)
- [CVE-2026-76611](https://insights.sbomify.com/CVE-2026-76611/): Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo < 4.1.66 (medium 6.9)
- [CVE-2026-76610](https://insights.sbomify.com/CVE-2026-76610/): Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo < 4.1.65 (medium 6.9)
- [CVE-2026-7661](https://insights.sbomify.com/CVE-2026-7661/): Bootstrap Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'box' Shortcode (medium 6.4)
- [CVE-2026-76609](https://insights.sbomify.com/CVE-2026-76609/): Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik < 4.7.2 (medium 6.9)
- [CVE-2026-76608](https://insights.sbomify.com/CVE-2026-76608/): Joomla Extension - fabrikar.com - Unauthenticated disclosure of any commenter's email address in Fabrik < 4.7.2 (medium 6.9)
- [CVE-2026-76607](https://insights.sbomify.com/CVE-2026-76607/): Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik < 4.7.2 (critical 10.0)
- [CVE-2026-76606](https://insights.sbomify.com/CVE-2026-76606/): Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik < 4.7.2 (critical 10.0)
- [CVE-2026-76605](https://insights.sbomify.com/CVE-2026-76605/): Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik < 4.7.2 (critical 10.0)
- [CVE-2026-76604](https://insights.sbomify.com/CVE-2026-76604/): Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik < 4.7.2 (critical 10.0)
- [CVE-2026-76603](https://insights.sbomify.com/CVE-2026-76603/): Joomla Extension - fabrikar.com - Unauthenticated row disclosure via form.inlineedit in Fabrik < 4.7.2 (medium 6.9)
- [CVE-2026-76602](https://insights.sbomify.com/CVE-2026-76602/): Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.2 (critical 9.3)
- [CVE-2026-76601](https://insights.sbomify.com/CVE-2026-76601/): Joomla Extension - fabrikar.com - Unauthenticated row reordering in Fabrik < 4.7.2 (medium 6.9)
- [CVE-2026-76600](https://insights.sbomify.com/CVE-2026-76600/): Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik < 4.7.2 (medium 6.9)
- [CVE-2026-7660](https://insights.sbomify.com/CVE-2026-7660/): Easy Updates Manager <= 9.0.20 - Reflected Cross-Site Scripting via 'paged' Parameter (medium 6.1)
- [CVE-2026-76599](https://insights.sbomify.com/CVE-2026-76599/): Joomla Extension - fabrikar.com - Unauthenticated database table list and table-prefix disclosure in Fabrik < 4.7.2 (high 8.7)
- [CVE-2026-76598](https://insights.sbomify.com/CVE-2026-76598/): Joomla Extension - fabrikar.com - Unauthenticated arbitrary directory listing via onAjax_getFolders in Fabrik < 4.7.2 (high 8.7)
- [CVE-2026-76597](https://insights.sbomify.com/CVE-2026-76597/): File upload in Fabrik extension for Joomla (high 8.7)
- [CVE-2026-76596](https://insights.sbomify.com/CVE-2026-76596/): Joomla Extension - fabrikar.com - Unauthenticated table truncation via list.doempty in Fabrik < 4.7.2 (high 8.7)
- [CVE-2026-76591](https://insights.sbomify.com/CVE-2026-76591/): TRENDnet TEW-755AP ssi email.cgi log_email_server command injection (medium 5.3)
- [CVE-2026-76590](https://insights.sbomify.com/CVE-2026-76590/): TRENDnet TEW-755AP ssi wan.cgi stack-based overflow (critical 9.4)
- [CVE-2026-7659](https://insights.sbomify.com/CVE-2026-7659/): Advanced Social Media Icons <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'social' Shortcode (medium 6.4)
- [CVE-2026-76589](https://insights.sbomify.com/CVE-2026-76589/): TRENDnet TEW-755AP mycli FUN_401000 stack-based overflow (critical 9.4)
- [CVE-2026-76587](https://insights.sbomify.com/CVE-2026-76587/): IBM Planning Analytics Buffer Overflow (high 8.8)
- [CVE-2026-76586](https://insights.sbomify.com/CVE-2026-76586/): BookingPress 1.5.6 - 1.6.2 - Unauthenticated Booking Price Manipulation via PayPal Payment Confirmation (high 7.5)
- [CVE-2026-76585](https://insights.sbomify.com/CVE-2026-76585/): Customer Reviews for WooCommerce < 5.118.0 - Unauthenticated Stored XSS via 'comment' Parameter (high 8.8)
- [CVE-2026-76584](https://insights.sbomify.com/CVE-2026-76584/): TRENDnet TV-IP751WIC alphapd set_time.cgi stack-based overflow (critical 9.4)
- [CVE-2026-76583](https://insights.sbomify.com/CVE-2026-76583/): TRENDnet TV-IP751WIC alphapd set_time.cgi command injection (medium 5.3)
- [CVE-2026-76582](https://insights.sbomify.com/CVE-2026-76582/): TRENDnet TEW-821DAP ssi ping.cgi system command injection (medium 5.3)
- [CVE-2026-76581](https://insights.sbomify.com/CVE-2026-76581/): WPMU DEV Dashboard <= 5.0.1 - Authentication Bypass to Administrator via SSO HMAC Canonicalization Confusion (critical 9.8)
- [CVE-2026-7658](https://insights.sbomify.com/CVE-2026-7658/): Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement (medium 6.5)
- [CVE-2026-76579](https://insights.sbomify.com/CVE-2026-76579/): LiteSpeed Cache <= 7.9 - Reflected Cross-Site Scripting via ESI 'esi' Parameter (medium 4.7)
- [CVE-2026-76578](https://insights.sbomify.com/CVE-2026-76578/): Ipa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials via the self-managed-token aci (critical 9.8)
- [CVE-2026-76576](https://insights.sbomify.com/CVE-2026-76576/): yangzongzhuan RuoYi-Vue Common Download Endpoint CommonController.java resourceDownload path traversal (medium 5.3)
- [CVE-2026-76574](https://insights.sbomify.com/CVE-2026-76574/): code-projects Hospital Information System User Login UsersController.php login sql injection (medium 6.9)
- [CVE-2026-76573](https://insights.sbomify.com/CVE-2026-76573/): Pods <= 3.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'not_found' Shortcode Attribute (medium 6.4)
- [CVE-2026-76572](https://insights.sbomify.com/CVE-2026-76572/): pkp pkp-lib XSLTransformer.php _transformPHP xml external entity reference (medium 5.1)
- [CVE-2026-76571](https://insights.sbomify.com/CVE-2026-76571/): Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.2 (critical 9.3)
- [CVE-2026-76570](https://insights.sbomify.com/CVE-2026-76570/): Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables < 1.21.1 (critical 10.0)
- [CVE-2026-7657](https://insights.sbomify.com/CVE-2026-7657/): Langflow OSS is affected by server-side request forgery in provider validation and API request functionality (medium 6.5)
- [CVE-2026-76569](https://insights.sbomify.com/CVE-2026-76569/): Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4 (medium 5.3)
- [CVE-2026-76565](https://insights.sbomify.com/CVE-2026-76565/): Joomla Extension - phoca.cz - Reflected XSS via price_from & price_to filter parameters in Phoca Cart 5.0.0-6.1.7 (medium 5.3)
- [CVE-2026-76564](https://insights.sbomify.com/CVE-2026-76564/): Joomla Extension - phoca.cz - Stored XSS via User-Agent header in Admin Order View in Phoca Cart 5.0.0-6.1.7 (high 8.6)
- [CVE-2026-76562](https://insights.sbomify.com/CVE-2026-76562/): Sidebar Manager Light <= 1.18 - Unauthenticated Stored Cross-Site Scripting via 'sbm_description' Parameter (high 7.2)
- [CVE-2026-76561](https://insights.sbomify.com/CVE-2026-76561/): Command injection in Red Hat Certificate System 9 (high 7.2)
- [CVE-2026-76560](https://insights.sbomify.com/CVE-2026-76560/): 389-ds-base: 389-ds: anonymous ldap client can defeat selfdn aci bind-rule checks via empty bind dn (high 7.5)
- [CVE-2026-7656](https://insights.sbomify.com/CVE-2026-7656/): Broken IPv6 Neighbor Discovery input validation allows spoofed RA/NS/NA acceptance in Zephyr net stack (high 8.1)
- [CVE-2026-76559](https://insights.sbomify.com/CVE-2026-76559/): WP Import Export Lite < 3.9.33 - Admin+ SSRF via Import URL Handling (medium 4.1)
- [CVE-2026-76558](https://insights.sbomify.com/CVE-2026-76558/): WP Import Export Lite < 3.9.33 - Contributor+ Stored DOM XSS via Custom Field Names (medium 6.8)
- [CVE-2026-76557](https://insights.sbomify.com/CVE-2026-76557/): WP Import Export Lite < 3.9.33 - Authenticated SQLi via Import Options (medium 6.8)
- [CVE-2026-76556](https://insights.sbomify.com/CVE-2026-76556/): WP Import Export Lite < 3.9.33 - Authenticated SQLi via Export Filter Rules (medium 6.8)
- [CVE-2026-76555](https://insights.sbomify.com/CVE-2026-76555/): WP Import Export Lite < 3.9.33 - Authenticated Sensitive File Disclosure via Existing File Import Path Traversal (medium 6.8)
- [CVE-2026-76554](https://insights.sbomify.com/CVE-2026-76554/): WP Import Export Lite < 3.9.35 - Authenticated Privilege Escalation via User Import (high 7.2)
- [CVE-2026-76553](https://insights.sbomify.com/CVE-2026-76553/): WP Import Export Lite < 3.9.33 - Authenticated Arbitrary Directory Deletion via Template Path Traversal (medium 6.5)
- [CVE-2026-76552](https://insights.sbomify.com/CVE-2026-76552/): WP Import Export Lite < 3.9.33 - Authenticated Arbitrary File Upload via Remote Image Import (high 8.8)
- [CVE-2026-76551](https://insights.sbomify.com/CVE-2026-76551/): WP Import Export Lite < 3.9.33 - Authenticated RCE via Export Field PHP Function (high 7.2)
- [CVE-2026-76550](https://insights.sbomify.com/CVE-2026-76550/): WP Import Export Lite < 3.9.34 - Authenticated RCE via Export Template Path Traversal (high 7.2)
- [CVE-2026-7655](https://insights.sbomify.com/CVE-2026-7655/): SureCart <= 4.2.3 - Unauthenticated Linked WordPress Account Takeover via Forged customer.updated Webhook (high 8.1)
- [CVE-2026-76549](https://insights.sbomify.com/CVE-2026-76549/): UpdraftPlus < 1.26.7 - Backup Restoration via CSRF (medium 5.9)
- [CVE-2026-76548](https://insights.sbomify.com/CVE-2026-76548/): Profile Builder < 4.0.1 - Unauthenticated Unpublished Content and Media Modification via Front-End Upload Auth Bypass (high 8.2)
- [CVE-2026-76547](https://insights.sbomify.com/CVE-2026-76547/): Profile Builder < 4.0.1 - Admin+ PHP Object Injection via Import/Export (medium 6.6)
- [CVE-2026-76546](https://insights.sbomify.com/CVE-2026-76546/): Profile Builder < 4.0.1 - Contributor+ Stored XSS via Format Date Shortcode (medium 6.8)
- [CVE-2026-7654](https://insights.sbomify.com/CVE-2026-7654/): Deserialization in Admin Columns (high 8.8)
- [CVE-2026-76531](https://insights.sbomify.com/CVE-2026-76531/): Files or Directories Accessible to External Parties in Splunk SOAR (critical 9.9)
- [CVE-2026-76530](https://insights.sbomify.com/CVE-2026-76530/): Use of Non-Canonical URL Paths for Authorization Decisions in Splunk SOAR (high 8.8)
- [CVE-2026-7653](https://insights.sbomify.com/CVE-2026-7653/): r-huijts mcp-server-rijksmuseum MCP index.ts open_image_in_browser os command injection (medium 5.3)
- [CVE-2026-76529](https://insights.sbomify.com/CVE-2026-76529/): Improper Protection of Alternate Path in Splunk SOAR (not scored)
- [CVE-2026-76528](https://insights.sbomify.com/CVE-2026-76528/): Protection Mechanism Failure in Splunk SOAR (not scored)
- [CVE-2026-76527](https://insights.sbomify.com/CVE-2026-76527/): Improper Check or Handling of Exceptional Conditions in Splunk SOAR (critical 9.8)
- [CVE-2026-76526](https://insights.sbomify.com/CVE-2026-76526/): Improper Neutralization in Splunk SOAR (high 8.8)
- [CVE-2026-76524](https://insights.sbomify.com/CVE-2026-76524/): Open Source Snort 3 Control Channel Socket Aribitrary Command Execution Vulnerability (high 7.8)
- [CVE-2026-7652](https://insights.sbomify.com/CVE-2026-7652/): LatePoint <= 5.5.0 - Unauthenticated Account Takeover via Weak Password Recovery Mechanism (medium 5.3)
- [CVE-2026-76519](https://insights.sbomify.com/CVE-2026-76519/): Cisco Secure Email Gateway Relative Path Traversal (critical 9.8, exploited in the wild)
- [CVE-2026-7651](https://insights.sbomify.com/CVE-2026-7651/): Missing authorization in User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder (medium 5.3)
- [CVE-2026-76505](https://insights.sbomify.com/CVE-2026-76505/): Cisco IOS XR Software for ASR 9000 Series Routers IPv4 Unicast Packets Denial of Service Vulnerability (high 7.5)
- [CVE-2026-76504](https://insights.sbomify.com/CVE-2026-76504/): Cisco Catalyst SD-WAN Manager Hex Encoding (critical 9.8, exploited in the wild)
- [CVE-2026-76501](https://insights.sbomify.com/CVE-2026-76501/): Cisco Nexus 9000 Series Switches SRv6 OAM (NGOAM) Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-76500](https://insights.sbomify.com/CVE-2026-76500/): Other in Cisco Application Policy Infrastructure Controller (APIC) (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/376/