# Vulnerabilities published in 2026


- [CVE-2026-7650](https://insights.sbomify.com/CVE-2026-7650/): Cross-site scripting in E2Pdf – Export Pdf Tool for WordPress (medium 6.4)
- [CVE-2026-76499](https://insights.sbomify.com/CVE-2026-76499/): Other in Cisco Application Policy Infrastructure Controller (APIC) (critical 9.8)
- [CVE-2026-76498](https://insights.sbomify.com/CVE-2026-76498/): Missing authorization in Cisco Application Policy Infrastructure Controller (APIC) (critical 9.8)
- [CVE-2026-76497](https://insights.sbomify.com/CVE-2026-76497/): Cisco Expressway Series Software Hardening Release: October 2026 - Insecure Temporary File Vulnerabilities (medium 6.6)
- [CVE-2026-76496](https://insights.sbomify.com/CVE-2026-76496/): Cisco Expressway Series Software Hardening Release: October 2026 - Improper Link Resolution Vulnerabilities (high 7.0)
- [CVE-2026-76495](https://insights.sbomify.com/CVE-2026-76495/): Cisco Expressway Series Software Hardening Release: October 2026 - Incorrect Permission Assignment Vulnerabilities (high 7.8)
- [CVE-2026-76494](https://insights.sbomify.com/CVE-2026-76494/): Cisco Expressway Series Software Hardening Release: October 2026 - Code Injection Vulnerabilities (high 7.8)
- [CVE-2026-76493](https://insights.sbomify.com/CVE-2026-76493/): Cisco Expressway Series Software Hardening Release: October 2026 - Uncaught Exception Vulnerabilities (high 7.5)
- [CVE-2026-76492](https://insights.sbomify.com/CVE-2026-76492/): Cisco Expressway Series Software Hardening Release: October 2026 - NULL Pointer Vulnerabilities (high 7.5)
- [CVE-2026-76491](https://insights.sbomify.com/CVE-2026-76491/): Cisco Expressway Series Software Hardening Release: October 2026 - Denial of Service Vulnerabilities (high 7.5)
- [CVE-2026-76490](https://insights.sbomify.com/CVE-2026-76490/): Cisco Expressway Series Software Hardening Release: October 2026 - Out-of-bounds Write Vulnerabilities (high 8.6)
- [CVE-2026-7649](https://insights.sbomify.com/CVE-2026-7649/): ARMember <= 4.0.60 - Unauthenticated SQL Injection via 'orderby' Parameter (high 7.5)
- [CVE-2026-76489](https://insights.sbomify.com/CVE-2026-76489/): Multiple Cisco Products Snort 3 Generic File Processing Memory Exhaustion Denial of Service Vulnerability (medium 5.8)
- [CVE-2026-76488](https://insights.sbomify.com/CVE-2026-76488/): Cisco Application Policy Infrastructure Controller Authenticated Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-76487](https://insights.sbomify.com/CVE-2026-76487/): Cisco Unified Communications Manager Improper Access Control Vulnerability (medium 5.3)
- [CVE-2026-76486](https://insights.sbomify.com/CVE-2026-76486/): Cisco Nexus 3000 and 9000 Series Switches VXLAN OAM (NGOAM) Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-76485](https://insights.sbomify.com/CVE-2026-76485/): Cisco Nexus 3000 and 9000 Series Switches VXLAN OAM (NGOAM) Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-76484](https://insights.sbomify.com/CVE-2026-76484/): Cisco License On-Prem Security Hardening Release (high 8.8)
- [CVE-2026-76483](https://insights.sbomify.com/CVE-2026-76483/): Cisco License On-Prem Security Hardening Release (critical 9.1)
- [CVE-2026-76482](https://insights.sbomify.com/CVE-2026-76482/): Cisco License On-Prem Security Hardening Release (critical 10.0)
- [CVE-2026-76481](https://insights.sbomify.com/CVE-2026-76481/): Other in Cisco Emergency Responder (high 7.5)
- [CVE-2026-76480](https://insights.sbomify.com/CVE-2026-76480/): Cisco License On-Prem Security Hardening Release (critical 9.8)
- [CVE-2026-7648](https://insights.sbomify.com/CVE-2026-7648/): Business logic in LearnPress – WordPress LMS Plugin for Create and Sell Online Courses (medium 4.3)
- [CVE-2026-76479](https://insights.sbomify.com/CVE-2026-76479/): Cisco Unified Communications Products Hardening Release: October 2026 - Path Traversal Vulnerabilities (high 7.8)
- [CVE-2026-76478](https://insights.sbomify.com/CVE-2026-76478/): Cisco Unified Communications Products Hardening Release: October 2026 - Improper Access Control Vulnerabilities (high 8.8)
- [CVE-2026-76477](https://insights.sbomify.com/CVE-2026-76477/): Cisco Unified Communications Products Hardening Release: October 2026 - Injection Vulnerabilities (high 8.8)
- [CVE-2026-76476](https://insights.sbomify.com/CVE-2026-76476/): Cisco Unified Communications Products Hardening Release: October 2026 - Improper Input Validation Vulnerabilities (high 8.8)
- [CVE-2026-76475](https://insights.sbomify.com/CVE-2026-76475/): Cisco Unified Communications Products Hardening Release: October 2026 - Cross-site Scripting Vulnerabilities (critical 9.3)
- [CVE-2026-76474](https://insights.sbomify.com/CVE-2026-76474/): Cisco Unified Communications Products Hardening Release: October 2026 - Improper Authentication Vulnerabilities (critical 9.8)
- [CVE-2026-76473](https://insights.sbomify.com/CVE-2026-76473/): Other in Cisco Emergency Responder (critical 9.8)
- [CVE-2026-76472](https://insights.sbomify.com/CVE-2026-76472/): Cisco Meraki Security Hardening Release October 2026 - Improper Neutralization of Special Elements Vulnerabilities (high 8.8)
- [CVE-2026-76471](https://insights.sbomify.com/CVE-2026-76471/): Cisco NX-OS Software NX-API Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-76470](https://insights.sbomify.com/CVE-2026-76470/): Cisco Meraki Hardening Release - Incorrect Calculation Vulnerabilities (high 8.8)
- [CVE-2026-7647](https://insights.sbomify.com/CVE-2026-7647/): Profile Builder Pro <= 3.14.5 - Unauthenticated PHP Object Injection (high 8.1)
- [CVE-2026-76469](https://insights.sbomify.com/CVE-2026-76469/): Cisco Meraki Security Hardening Release: October 2026 Insufficient Control Flow Management Vulnerabilities (high 7.4)
- [CVE-2026-76468](https://insights.sbomify.com/CVE-2026-76468/): Cisco Meraki Hardening Release - Input Validation Vulnerabilities (high 8.2)
- [CVE-2026-76467](https://insights.sbomify.com/CVE-2026-76467/): Cisco Meraki Software Hardening Release - Resource Lifetime Management Vulnerabilities (high 7.5)
- [CVE-2026-76466](https://insights.sbomify.com/CVE-2026-76466/): Cisco Expressway Series Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-76465](https://insights.sbomify.com/CVE-2026-76465/): Cisco Nexus 3000 and 9000 Series Switches MPLS OAM Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-76464](https://insights.sbomify.com/CVE-2026-76464/): Cisco Meraki Hardening Release October 2026 - Buffer Management Vulnerabilities (critical 9.6)
- [CVE-2026-76463](https://insights.sbomify.com/CVE-2026-76463/): Cisco Meraki Security Hardening Release: October 2026 - Improper Access Control Vulnerabilities (high 8.8)
- [CVE-2026-76462](https://insights.sbomify.com/CVE-2026-76462/): Cisco Secure Client Privilege Escalation Vulnerability (medium 5.5)
- [CVE-2026-76461](https://insights.sbomify.com/CVE-2026-76461/): Cisco Secure Email Gateway SQL Injection (critical 9.8, exploited in the wild)
- [CVE-2026-76460](https://insights.sbomify.com/CVE-2026-76460/): Cisco Identity Services Engine Incorrect Use of Privileged APIs (critical 10.0, exploited in the wild)
- [CVE-2026-7646](https://insights.sbomify.com/CVE-2026-7646/): Langflow is affected by security vulnerabilities in Model Context Protocol features (medium 6.5)
- [CVE-2026-76459](https://insights.sbomify.com/CVE-2026-76459/): Cisco NX-OS Software Security Hardening Release: October 2026 - Out-of-bounds Write Vulnerabilities (critical 9.8)
- [CVE-2026-76458](https://insights.sbomify.com/CVE-2026-76458/): Other in Cisco NX-OS Software (high 8.6)
- [CVE-2026-76457](https://insights.sbomify.com/CVE-2026-76457/): Cisco NX-OS Software Security Hardening Release: October 2026 - Out-of-bounds Read Vulnerabilities (high 8.6)
- [CVE-2026-76456](https://insights.sbomify.com/CVE-2026-76456/): Cisco NX-OS Software Security Hardening Release: October 2026 - Improper Input Validation Vulnerabilities (high 8.6)
- [CVE-2026-76455](https://insights.sbomify.com/CVE-2026-76455/): Cisco NX-OS Software Security Hardening Release: October 2026 - Improper Access Control Vulnerabilities (critical 9.8)
- [CVE-2026-76454](https://insights.sbomify.com/CVE-2026-76454/): Cisco Smart Software Manager On-Prem Unauthenticated API Vulnerability (critical 9.1)
- [CVE-2026-76453](https://insights.sbomify.com/CVE-2026-76453/): Cisco NX-OS Software Security Hardening Release: October 2026 - Improper Neutralization Vulnerabilities (high 8.8)
- [CVE-2026-76452](https://insights.sbomify.com/CVE-2026-76452/): Cisco Smart Software Manager On-Prem SQL Injection Vulnerability (medium 4.9)
- [CVE-2026-76451](https://insights.sbomify.com/CVE-2026-76451/): Cisco Identity Services Engine Certificate Management SQL Injection Vulnerability (medium 4.9)
- [CVE-2026-76450](https://insights.sbomify.com/CVE-2026-76450/): Cisco Identity Services Engine SQL Injection Vulnerability (medium 4.9)
- [CVE-2026-7645](https://insights.sbomify.com/CVE-2026-7645/): ruvnet sublinear-time-solver MCP server.js export_state path traversal (medium 6.9)
- [CVE-2026-76449](https://insights.sbomify.com/CVE-2026-76449/): Cisco Identity Services Engine SQL Injection Vulnerability (medium 4.9)
- [CVE-2026-76448](https://insights.sbomify.com/CVE-2026-76448/): Cisco Identity Services Engine SQL Injection Vulnerability (medium 4.9)
- [CVE-2026-76447](https://insights.sbomify.com/CVE-2026-76447/): Cisco Identity Services Engine Certificate Reload Vulnerability (medium 5.3)
- [CVE-2026-76446](https://insights.sbomify.com/CVE-2026-76446/): Cisco Identity Services Engine External Entity Injection Vulnerability (medium 4.9)
- [CVE-2026-76445](https://insights.sbomify.com/CVE-2026-76445/): Multiple Cisco Products Snort 3 Denial of Service Vulnerability (medium 5.3)
- [CVE-2026-76444](https://insights.sbomify.com/CVE-2026-76444/): Cisco Identity Services Engine Information Disclosure Vulnerability (medium 5.3)
- [CVE-2026-76443](https://insights.sbomify.com/CVE-2026-76443/): Cisco Secure Email Gateway Security Hardening Release (critical 9.8)
- [CVE-2026-76442](https://insights.sbomify.com/CVE-2026-76442/): Cisco Secure Email Gateway Security Hardening Release (high 7.5)
- [CVE-2026-76441](https://insights.sbomify.com/CVE-2026-76441/): Cisco Secure Email Gateway Security Hardening Release (critical 9.8)
- [CVE-2026-76440](https://insights.sbomify.com/CVE-2026-76440/): Cisco Secure Email Gateway Security Hardening Release (critical 9.8)
- [CVE-2026-7644](https://insights.sbomify.com/CVE-2026-7644/): ChatGPTNextWeb NextChat actions.ts addMcpServer improper authorization (medium 6.9)
- [CVE-2026-76439](https://insights.sbomify.com/CVE-2026-76439/): Cisco Identity Services Engine Event Injection Vulnerability (medium 5.3)
- [CVE-2026-76438](https://insights.sbomify.com/CVE-2026-76438/): Cisco BroadWorks CommPilot Application Software Authorization Bypass Vulnerability (medium 6.5)
- [CVE-2026-76437](https://insights.sbomify.com/CVE-2026-76437/): Cisco Smart Software Manager On-Prem Command Injection Vulnerability (medium 4.9)
- [CVE-2026-76435](https://insights.sbomify.com/CVE-2026-76435/): Cisco Expressway Series Information Disclosure Vulnerability (medium 5.3)
- [CVE-2026-76434](https://insights.sbomify.com/CVE-2026-76434/): Cisco Identity Services Engine Arbitrary File Read Vulnerability (medium 4.9)
- [CVE-2026-76433](https://insights.sbomify.com/CVE-2026-76433/): Cisco Identity Services Engine Information Disclosure Vulnerability (medium 5.3)
- [CVE-2026-76432](https://insights.sbomify.com/CVE-2026-76432/): Cisco Identity Services Engine Arbitrary File Write Vulnerability (medium 4.9)
- [CVE-2026-76431](https://insights.sbomify.com/CVE-2026-76431/): Cisco Identity Services Engine Arbitrary File Deletion Vulnerability (medium 4.9)
- [CVE-2026-7643](https://insights.sbomify.com/CVE-2026-7643/): ChatGPTNextWeb NextChat API Endpoint Next.js cross-domain policy (medium 5.3)
- [CVE-2026-76428](https://insights.sbomify.com/CVE-2026-76428/): Cisco ISE Profiler SQL Injection Vulnerability (medium 4.9)
- [CVE-2026-76427](https://insights.sbomify.com/CVE-2026-76427/): Cisco ISE XML External Entity Injection Vulnerability (medium 4.9)
- [CVE-2026-76426](https://insights.sbomify.com/CVE-2026-76426/): Cisco ISE REST API SQL Injection Vulnerability (medium 4.9)
- [CVE-2026-76425](https://insights.sbomify.com/CVE-2026-76425/): Cisco ISE SQL Injection Vulnerability (high 7.6)
- [CVE-2026-76424](https://insights.sbomify.com/CVE-2026-76424/): Cisco ISE Arbitrary File Access Vulnerability (high 7.2)
- [CVE-2026-76423](https://insights.sbomify.com/CVE-2026-76423/): Cisco ISE API Authentication Bypass Vulnerability (critical 10.0)
- [CVE-2026-76420](https://insights.sbomify.com/CVE-2026-76420/): Cisco Secure Firewall Management Center Software Impersonated sftunnel Connection Vulnerability (critical 9.0)
- [CVE-2026-7642](https://insights.sbomify.com/CVE-2026-7642/): pskill9 website-downloader MCP index.ts download_website os command injection (medium 5.3)
- [CVE-2026-76418](https://insights.sbomify.com/CVE-2026-76418/): Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference (high 8.6, exploited in the wild)
- [CVE-2026-76413](https://insights.sbomify.com/CVE-2026-76413/): Cisco Secure Firewall Management Center Software Single Sign-On Token Forgery of Administrator Account Vulnerability (high 8.2)
- [CVE-2026-76412](https://insights.sbomify.com/CVE-2026-76412/): Cisco Secure Firewall Management Center Software Authenticated Privilege Escalation to Root Vulnerability (high 8.5)
- [CVE-2026-7641](https://insights.sbomify.com/CVE-2026-7641/): Privilege escalation in Import and export users and customers (high 8.8)
- [CVE-2026-76409](https://insights.sbomify.com/CVE-2026-76409/): Cisco Nexus Dashboard Software Security Hardening Release September 2026 - Improper Limitation of a Pathname (high 8.8)
- [CVE-2026-76408](https://insights.sbomify.com/CVE-2026-76408/): Improper Control of a Resource Through its Lifetime in Splunk SOAR (not scored)
- [CVE-2026-76407](https://insights.sbomify.com/CVE-2026-76407/): Improper Access Control in Splunk SOAR (not scored)
- [CVE-2026-76406](https://insights.sbomify.com/CVE-2026-76406/): Information Disclosure through REST API Authentication in Splunk SOAR (medium 5.9)
- [CVE-2026-76405](https://insights.sbomify.com/CVE-2026-76405/): Information Disclosure through Cleartext Storage in the App Key Value Store in the Splunk On-Call (VictorOps) app (medium 4.3)
- [CVE-2026-76404](https://insights.sbomify.com/CVE-2026-76404/): Remote Code Execution (RCE) through Deserialization of Untrusted Data in Splunk MCP Server app (critical 9.1)
- [CVE-2026-76403](https://insights.sbomify.com/CVE-2026-76403/): Improper Certificate Validation through HTTP Event Collector Kerberos Authentication in Splunk Connect for Kafka (high 7.4)
- [CVE-2026-76402](https://insights.sbomify.com/CVE-2026-76402/): Server-Side Request Forgery (SSRF) through the REST API in Splunk Connect for Kafka (high 8.2)
- [CVE-2026-76401](https://insights.sbomify.com/CVE-2026-76401/): Regular Expression Denial of Service (DoS) through the REST API in Splunk Connect for Kafka (medium 5.9)
- [CVE-2026-76400](https://insights.sbomify.com/CVE-2026-76400/): Denial of Service (DoS) through the REST API in Splunk Connect for Kafka (medium 5.9)
- [CVE-2026-7640](https://insights.sbomify.com/CVE-2026-7640/): WP Customer Area <= 8.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute (medium 6.4)
- [CVE-2026-76399](https://insights.sbomify.com/CVE-2026-76399/): Incorrect Permission Assignment for Scheduled Searches in Splunk AI Toolkit (high 8.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/377/