# Vulnerabilities published in 2026


- [CVE-2026-76210](https://insights.sbomify.com/CVE-2026-76210/): phpMyFAQ before v4.1.6 Local File Disclosure via PDF Export (high 7.1)
- [CVE-2026-7621](https://insights.sbomify.com/CVE-2026-7621/): SMTP2GO for WordPress <= 1.16.0 - Missing Authorization to Authenticated (Subscriber+) Log Read/Truncate (medium 4.3)
- [CVE-2026-76209](https://insights.sbomify.com/CVE-2026-76209/): phpMyFAQ before v4.1.6 Registration Bypass via API (medium 5.3)
- [CVE-2026-76208](https://insights.sbomify.com/CVE-2026-76208/): phpMyFAQ 3.1.0 through 4.1.6 Authentication Bypass via LDAP (high 8.8)
- [CVE-2026-76207](https://insights.sbomify.com/CVE-2026-76207/): phpMyFAQ before 4.1.7 2FA Bypass via Remember-Me Cookie (high 8.6)
- [CVE-2026-76206](https://insights.sbomify.com/CVE-2026-76206/): phpMyFAQ before 4.1.7 Information Disclosure via PDF Export (medium 6.9)
- [CVE-2026-76205](https://insights.sbomify.com/CVE-2026-76205/): phpMyFAQ before 4.1.7 SQL Injection via Glossary (high 8.6)
- [CVE-2026-76203](https://insights.sbomify.com/CVE-2026-76203/): CSS sanitizer bypass in Pentestify report themes allows forced outbound requests (medium 5.1)
- [CVE-2026-76202](https://insights.sbomify.com/CVE-2026-76202/): Adobe Commerce | Incorrect Authorization (CWE-863) (high 8.2)
- [CVE-2026-76201](https://insights.sbomify.com/CVE-2026-76201/): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (critical 9.3)
- [CVE-2026-76200](https://insights.sbomify.com/CVE-2026-76200/): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (critical 9.3)
- [CVE-2026-7620](https://insights.sbomify.com/CVE-2026-7620/): Missing authorization in Notification for Telegram (medium 4.3)
- [CVE-2026-76199](https://insights.sbomify.com/CVE-2026-76199/): Photoshop Desktop | Uncontrolled Search Path Element (CWE-427) (high 8.6)
- [CVE-2026-76198](https://insights.sbomify.com/CVE-2026-76198/): CAI Content Credentials | Improper Input Validation (CWE-20) (medium 5.5)
- [CVE-2026-76197](https://insights.sbomify.com/CVE-2026-76197/): Command injection in Adobe Campaign Classic (critical 10.0)
- [CVE-2026-76196](https://insights.sbomify.com/CVE-2026-76196/): Photoshop Mobile | Session Fixation (CWE-384) (high 7.4)
- [CVE-2026-76195](https://insights.sbomify.com/CVE-2026-76195/): Command injection in Adobe Campaign Classic (critical 10.0)
- [CVE-2026-76194](https://insights.sbomify.com/CVE-2026-76194/): CAI Content Credentials | Improper Input Validation (CWE-20) (medium 4.3)
- [CVE-2026-76193](https://insights.sbomify.com/CVE-2026-76193/): Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918) (critical 10.0)
- [CVE-2026-76192](https://insights.sbomify.com/CVE-2026-76192/): InDesign Desktop | NULL Pointer Dereference (CWE-476) (medium 5.5)
- [CVE-2026-76191](https://insights.sbomify.com/CVE-2026-76191/): Animate | Improper Control of Generation of Code ('Code Injection') (CWE-94) (high 8.2)
- [CVE-2026-76190](https://insights.sbomify.com/CVE-2026-76190/): ColdFusion | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95) (high 8.6)
- [CVE-2026-7619](https://insights.sbomify.com/CVE-2026-7619/): Charitable <= 1.8.10.4 - Authenticated (Custom+) SQL Injection via 's' Search Parameter (medium 6.5)
- [CVE-2026-76189](https://insights.sbomify.com/CVE-2026-76189/): CAI Content Credentials | Integer Underflow (Wrap or Wraparound) (CWE-191) (medium 6.2)
- [CVE-2026-76187](https://insights.sbomify.com/CVE-2026-76187/): Apache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWT (critical 9.8)
- [CVE-2026-76186](https://insights.sbomify.com/CVE-2026-76186/): Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identity (critical 9.1)
- [CVE-2026-76184](https://insights.sbomify.com/CVE-2026-76184/): Information disclosure in Eclipse Jetty (high 8.2)
- [CVE-2026-76183](https://insights.sbomify.com/CVE-2026-76183/): Apache Tomcat: Bypass of security constraints for WebSocket endpoints (critical 9.8)
- [CVE-2026-76182](https://insights.sbomify.com/CVE-2026-76182/): Other in Eclipse Jetty (medium 6.9)
- [CVE-2026-7618](https://insights.sbomify.com/CVE-2026-7618/): SQL injection in EnvíaloSimple: Email Marketing y Newsletters (medium 4.9)
- [CVE-2026-76179](https://insights.sbomify.com/CVE-2026-76179/): Ebyte NA111-M Use of GET Request Method With Sensitive Query Strings (critical 9.3)
- [CVE-2026-76178](https://insights.sbomify.com/CVE-2026-76178/): Multiple vulnerabilities in Ocsreports for OCS Inventory NG (critical 9.2)
- [CVE-2026-76177](https://insights.sbomify.com/CVE-2026-76177/): Multiple vulnerabilities in Ocsreports for OCS Inventory NG (high 7.1)
- [CVE-2026-76176](https://insights.sbomify.com/CVE-2026-76176/): Multiple vulnerabilities in Ocsreports for OCS Inventory NG (high 8.6)
- [CVE-2026-76175](https://insights.sbomify.com/CVE-2026-76175/): Multiple vulnerabilities in Ocsreports for OCS Inventory NG (high 8.6)
- [CVE-2026-76174](https://insights.sbomify.com/CVE-2026-76174/): Multiple vulnerabilities in Ocsreports for OCS Inventory NG (critical 9.4)
- [CVE-2026-76172](https://insights.sbomify.com/CVE-2026-76172/): fast-uri vulnerable to host confusion via percent-encoded scheme normalization (high 7.5)
- [CVE-2026-7617](https://insights.sbomify.com/CVE-2026-7617/): Missing authorization in Secufor OAuth (medium 5.3)
- [CVE-2026-76169](https://insights.sbomify.com/CVE-2026-76169/): fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers (high 7.5)
- [CVE-2026-76166](https://insights.sbomify.com/CVE-2026-76166/): Modcluster-core: mod_cluster advertise listener: unauthenticated dos via crafted multicast datagram (medium 4.3)
- [CVE-2026-76164](https://insights.sbomify.com/CVE-2026-76164/): Authenticated Server-Side Request Forgery in AIL Framework Crawler Allows Access to Internal Network Resources (high 7.1)
- [CVE-2026-76163](https://insights.sbomify.com/CVE-2026-76163/): named aborts on a TKEY query when the user configuration has no global options statement (high 7.5)
- [CVE-2026-7616](https://insights.sbomify.com/CVE-2026-7616/): Zawgyi Embed <= 2.1.1 - Cross-Site Request Forgery via 'zawgyi_forceCSS' Parameter (medium 4.3)
- [CVE-2026-76159](https://insights.sbomify.com/CVE-2026-76159/): Duplicati for Windows - Incorrect Permission Assignment for Critical Resource (high 7.0)
- [CVE-2026-76158](https://insights.sbomify.com/CVE-2026-76158/): Datiphy Data Management Center - External Control of File Name or Path (critical 9.3)
- [CVE-2026-76157](https://insights.sbomify.com/CVE-2026-76157/): Datiphy Data Management Center - Missing Authentication for Critical Function (high 8.8)
- [CVE-2026-76156](https://insights.sbomify.com/CVE-2026-76156/): Datiphy Data Management Center - Improper Neutralization of Special Elements used in an OS Command (critical 9.4)
- [CVE-2026-76155](https://insights.sbomify.com/CVE-2026-76155/): Datiphy Data Management Center - Use of Default Credentials (critical 9.3)
- [CVE-2026-76154](https://insights.sbomify.com/CVE-2026-76154/): CVE-2026-76154 CVE Record (high 7.3)
- [CVE-2026-76151](https://insights.sbomify.com/CVE-2026-76151/): Memory corruption in qt (medium 4.6)
- [CVE-2026-7615](https://insights.sbomify.com/CVE-2026-7615/): Widget Context <= 1.3.3 - Cross-Site Request Forgery to Settings Update via 'wl' Parameter (medium 4.3)
- [CVE-2026-76149](https://insights.sbomify.com/CVE-2026-76149/): Integer overflow in CorvusSKK (medium 4.6)
- [CVE-2026-76148](https://insights.sbomify.com/CVE-2026-76148/): Code injection in CorvusSKK (high 8.4)
- [CVE-2026-76147](https://insights.sbomify.com/CVE-2026-76147/): Genians, Inc Genian NAC/ZTNA Remote Code Execution (medium 5.9)
- [CVE-2026-76146](https://insights.sbomify.com/CVE-2026-76146/): Genians, Inc Genian SSL PNS OS Command Injection (high 8.4)
- [CVE-2026-76145](https://insights.sbomify.com/CVE-2026-76145/): Genians, Inc Genian SSL PNS Improper Privilege Management (high 7.5)
- [CVE-2026-76144](https://insights.sbomify.com/CVE-2026-76144/): Genians, Inc Genian SSL PNS Unrestricted File Upload (low 1.8)
- [CVE-2026-76143](https://insights.sbomify.com/CVE-2026-76143/): Genians, Inc Genian SSL PNS Multi Factor Authentication Bypass (high 7.3)
- [CVE-2026-76142](https://insights.sbomify.com/CVE-2026-76142/): Genians, Inc. Genian NAC/ZTNA Improper Access Control on the Internal Interface (critical 9.3)
- [CVE-2026-7614](https://insights.sbomify.com/CVE-2026-7614/): Old Posts Highlighter <= 1.0.3 - Cross-Site Request Forgery to Settings Update (medium 4.3)
- [CVE-2026-76139](https://insights.sbomify.com/CVE-2026-76139/): Supply chain in Red Hat Advanced Cluster Management for Kubernetes 2.11 (high 8.0)
- [CVE-2026-76137](https://insights.sbomify.com/CVE-2026-76137/): Missing authorization in VOCALOID6 (medium 4.8)
- [CVE-2026-76133](https://insights.sbomify.com/CVE-2026-76133/): Ebyte NA111-M Use of a Broken or Risky Cryptographic Algorithm (critical 9.3)
- [CVE-2026-76131](https://insights.sbomify.com/CVE-2026-76131/): Hardcoded credentials in VOCALOID6 (medium 6.9)
- [CVE-2026-7613](https://insights.sbomify.com/CVE-2026-7613/): Cost of Goods by PixelYourSite <= 1.2.12 - Unauthenticated Stored Cross-Site Scripting via Cost of Goods Import (high 7.2)
- [CVE-2026-76128](https://insights.sbomify.com/CVE-2026-76128/): Cross-site scripting in eCommerce Product Catalog (medium 6.4)
- [CVE-2026-7612](https://insights.sbomify.com/CVE-2026-7612/): itsourcecode Courier Management System edit_user.php sql injection (medium 5.1)
- [CVE-2026-76114](https://insights.sbomify.com/CVE-2026-76114/): Information disclosure in Secure Connect Gateway (SCG) Policy Manager (medium 5.9)
- [CVE-2026-76113](https://insights.sbomify.com/CVE-2026-76113/): Information disclosure in Terraform Provider for Redfish (medium 4.3)
- [CVE-2026-76111](https://insights.sbomify.com/CVE-2026-76111/): Privilege escalation in PowerStore 1000T (high 8.8)
- [CVE-2026-7611](https://insights.sbomify.com/CVE-2026-7611/): TRENDnet TEW-821DAP Firmware Update cameo_dev.sh platform_do_upgrade_cameo_dev data authenticity (medium 6.3)
- [CVE-2026-76105](https://insights.sbomify.com/CVE-2026-76105/): Weak cryptography in Container Storage Modules (high 7.7)
- [CVE-2026-76104](https://insights.sbomify.com/CVE-2026-76104/): Misconfiguration in ObjectScale (medium 5.5)
- [CVE-2026-7610](https://insights.sbomify.com/CVE-2026-7610/): TRENDnet TEW-821DAP Firmware Update ssi cleartext transmission (medium 6.3)
- [CVE-2026-76098](https://insights.sbomify.com/CVE-2026-76098/): Mistune has Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown (high 7.5)
- [CVE-2026-7609](https://insights.sbomify.com/CVE-2026-7609/): TRENDnet TEW-821DAP Firmware Udpate diagnostic tools_diagnostic os command injection (medium 5.3)
- [CVE-2026-76089](https://insights.sbomify.com/CVE-2026-76089/): Formie: Missing authorization on sent notification resend modal exposes submission PII (high 7.7)
- [CVE-2026-76087](https://insights.sbomify.com/CVE-2026-76087/): Formie: Unauthenticated users can overwrite incomplete submissions via submit action (high 8.2)
- [CVE-2026-76086](https://insights.sbomify.com/CVE-2026-76086/): Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials (high 8.5)
- [CVE-2026-76083](https://insights.sbomify.com/CVE-2026-76083/): Redash: JSON data source query URL can bypass base URL restriction (medium 4.9)
- [CVE-2026-76081](https://insights.sbomify.com/CVE-2026-76081/): ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions (medium 5.5)
- [CVE-2026-7608](https://insights.sbomify.com/CVE-2026-7608/): TRENDnet TEW-821DAP tools_diagnostic os command injection (medium 5.1)
- [CVE-2026-76074](https://insights.sbomify.com/CVE-2026-76074/): Missing authorization in AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress (medium 4.3)
- [CVE-2026-76073](https://insights.sbomify.com/CVE-2026-76073/): Label Studio through 1.23.0 Cross-Organization Annotation Access via Unscoped AnnotationAPI Queryset (high 8.7)
- [CVE-2026-76072](https://insights.sbomify.com/CVE-2026-76072/): Continue CLI through 1.5.47 Incomplete Destructive Command Denylist in Headless and Auto Mode (high 8.3)
- [CVE-2026-76071](https://insights.sbomify.com/CVE-2026-76071/): Netis NC63 V3.0.0.3327 Stack Buffer Overflow via destHost Parameter (critical 9.3)
- [CVE-2026-76070](https://insights.sbomify.com/CVE-2026-76070/): Netis NC63 V3.0.0.3327 Stack Buffer Overflow via Login Password Parameter (critical 9.3)
- [CVE-2026-7607](https://insights.sbomify.com/CVE-2026-7607/): TRENDnet TEW-821DAP Firmware Udpate auto_update_firmware buffer overflow (high 8.7)
- [CVE-2026-76066](https://insights.sbomify.com/CVE-2026-76066/): IntentKit 2.6.3 Executor Tool Authorization Bypass via ToolNode (high 8.7)
- [CVE-2026-76063](https://insights.sbomify.com/CVE-2026-76063/): FundEngine <= 1.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wfp_featured_video_url' Parameter (medium 6.4)
- [CVE-2026-76061](https://insights.sbomify.com/CVE-2026-76061/): Cri-o: cri-o: bind_mount_prefix intermediate-symlink prefix bypass (medium 5.5)
- [CVE-2026-76060](https://insights.sbomify.com/CVE-2026-76060/): OS Command Injection in PayRange API (high 8.7)
- [CVE-2026-7606](https://insights.sbomify.com/CVE-2026-7606/): TRENDnet TEW-821DAP Firmware Update new_gui_update_firmware data authenticity (medium 6.3)
- [CVE-2026-76059](https://insights.sbomify.com/CVE-2026-76059/): Code injection in Langflow OSS (high 8.8)
- [CVE-2026-76058](https://insights.sbomify.com/CVE-2026-76058/): Missing authorization in PayPal Brasil para WooCommerce (medium 5.3)
- [CVE-2026-76057](https://insights.sbomify.com/CVE-2026-76057/): Missing authorization in AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress (medium 4.3)
- [CVE-2026-76055](https://insights.sbomify.com/CVE-2026-76055/): Command injection in blackduck-c-cpp (high 7.5)
- [CVE-2026-76054](https://insights.sbomify.com/CVE-2026-76054/): Information disclosure in blackduck-c-cpp (high 7.1)
- [CVE-2026-76053](https://insights.sbomify.com/CVE-2026-76053/): TranslatePress <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser (high 7.2)
- [CVE-2026-76050](https://insights.sbomify.com/CVE-2026-76050/): SourceCodester Simple Online Food Ordering System ajax.php delete_menu sql injection (medium 6.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/380/