# Vulnerabilities published in 2026


- [CVE-2026-75933](https://insights.sbomify.com/CVE-2026-75933/): Jet Admin Stored XSS (high 8.5)
- [CVE-2026-75932](https://insights.sbomify.com/CVE-2026-75932/): Jet Admin tenant isolation failure (critical 9.2)
- [CVE-2026-75931](https://insights.sbomify.com/CVE-2026-75931/): fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references (high 7.5)
- [CVE-2026-75930](https://insights.sbomify.com/CVE-2026-75930/): Missing authorization in FundEngine – Donation and Crowdfunding Platform (medium 4.3)
- [CVE-2026-7593](https://insights.sbomify.com/CVE-2026-7593/): Sunwood-ai-labs command-executor-mcp-server MCP index.ts execute_command os command injection (medium 6.9)
- [CVE-2026-75928](https://insights.sbomify.com/CVE-2026-75928/): Brushfire unauthenticated information disclosure (medium 6.9)
- [CVE-2026-75927](https://insights.sbomify.com/CVE-2026-75927/): Privilege escalation in User Role Editor – PublishPress Capabilities: Access Control and User Roles (high 7.2)
- [CVE-2026-75926](https://insights.sbomify.com/CVE-2026-75926/): Hugo 0.162.0 to 0.164.x - Node Permission Model Bypass via Default TailwindCSS Child-Process Grant (critical 9.3)
- [CVE-2026-75925](https://insights.sbomify.com/CVE-2026-75925/): IXON VPN Client CRLF Injection (critical 9.4)
- [CVE-2026-75924](https://insights.sbomify.com/CVE-2026-75924/): Privilege escalation in Multicluster Engine for Kubernetes (high 8.7)
- [CVE-2026-75922](https://insights.sbomify.com/CVE-2026-75922/): Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATH_INFO written unencoded to the upstream request line. (medium 5.3)
- [CVE-2026-75921](https://insights.sbomify.com/CVE-2026-75921/): File upload in Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits (high 7.2)
- [CVE-2026-75920](https://insights.sbomify.com/CVE-2026-75920/): phpMyFAQ before 4.1.6 Information Disclosure via Backup ZIP (medium 6.0)
- [CVE-2026-7592](https://insights.sbomify.com/CVE-2026-7592/): itsourcecode Courier Management System edit_staff.php sql injection (medium 6.9)
- [CVE-2026-75919](https://insights.sbomify.com/CVE-2026-75919/): phpMyFAQ before 4.1.7 Authentication Bypass via Setup API (medium 6.9)
- [CVE-2026-75918](https://insights.sbomify.com/CVE-2026-75918/): phpMyFAQ before 4.1.7 Authentication Bypass via Tracking File (high 8.7)
- [CVE-2026-75917](https://insights.sbomify.com/CVE-2026-75917/): SiYuan before v3.7.4 XSS-to-RCE via pathName.ts (critical 9.3)
- [CVE-2026-75916](https://insights.sbomify.com/CVE-2026-75916/): SiYuan XSS-to-RCE via unescaped block metadata in hint popup (critical 9.3)
- [CVE-2026-75915](https://insights.sbomify.com/CVE-2026-75915/): CodeWhale before 0.8.64 Environment Variable Leak via js_execution (high 8.7)
- [CVE-2026-75914](https://insights.sbomify.com/CVE-2026-75914/): CodeWhale before 0.8.64 Path Traversal via image_analyze symlink (high 8.7)
- [CVE-2026-75913](https://insights.sbomify.com/CVE-2026-75913/): CodeWhale before 0.8.64 Argument Injection via git_show (high 8.5)
- [CVE-2026-75912](https://insights.sbomify.com/CVE-2026-75912/): CodeWhale before 0.8.64 Argument Injection via git_blame (high 8.3)
- [CVE-2026-75911](https://insights.sbomify.com/CVE-2026-75911/): CodeWhale before 0.8.64 Remote Code Execution via allow_shell (high 8.5)
- [CVE-2026-75910](https://insights.sbomify.com/CVE-2026-75910/): Incorrect privilege assignment in the Amazon aws-athena-query-federation ClickHouse connector deployment template (high 7.1)
- [CVE-2026-7591](https://insights.sbomify.com/CVE-2026-7591/): TimBroddin astro-mcp-server MCP Tool Query Construction index.ts sql injection (medium 5.3)
- [CVE-2026-75908](https://insights.sbomify.com/CVE-2026-75908/): Missing authorization in Newsletters (medium 4.3)
- [CVE-2026-75907](https://insights.sbomify.com/CVE-2026-75907/): CVE-2026-75907 (high 7.5)
- [CVE-2026-75905](https://insights.sbomify.com/CVE-2026-75905/): Missing authorization in WP Recipe Maker (medium 4.3)
- [CVE-2026-75904](https://insights.sbomify.com/CVE-2026-75904/): libmodplug <= 0.8.9.1 - Out-of-Bounds Read in pat_smplooped via Crafted MIDI File (medium 4.8)
- [CVE-2026-75903](https://insights.sbomify.com/CVE-2026-75903/): Vulnity Security <= 1.4.3 - Unauthenticated Authentication Bypass to Administrator via Exposed Pairing Credentials (high 8.1)
- [CVE-2026-75900](https://insights.sbomify.com/CVE-2026-75900/): Swtpm: swtpm: out-of-bounds read in swtpm_nvram_checkheader due to sizeof(pointer) vs sizeof(struct) mismatch (medium 6.1)
- [CVE-2026-7590](https://insights.sbomify.com/CVE-2026-7590/): eyal-gor p_69_branch_monkey_mcp Preview Endpoint advanced.py os command injection (medium 6.9)
- [CVE-2026-75899](https://insights.sbomify.com/CVE-2026-75899/): fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding (high 7.5)
- [CVE-2026-75898](https://insights.sbomify.com/CVE-2026-75898/): RAGFlow < 0.26.3 - Server-Side Request Forgery via Agent Invoke Component (high 8.4)
- [CVE-2026-75897](https://insights.sbomify.com/CVE-2026-75897/): Uncontrolled Resource Consumption in Capabilities Route in OpenSearch Dashboards (high 8.7)
- [CVE-2026-75896](https://insights.sbomify.com/CVE-2026-75896/): Use of Hard-coded LDAP Credentials in TÜBİTAK BİLGEM's Liderahenk (critical 9.1)
- [CVE-2026-75895](https://insights.sbomify.com/CVE-2026-75895/): Out of bounds read at smpp34_unpack() (high 7.5)
- [CVE-2026-75894](https://insights.sbomify.com/CVE-2026-75894/): Reachable assertion at ranap_handle_co_dt() (high 7.5)
- [CVE-2026-75893](https://insights.sbomify.com/CVE-2026-75893/): Heap based buffer overflow at ipaccess_proxy_read_msg() (high 7.5)
- [CVE-2026-75892](https://insights.sbomify.com/CVE-2026-75892/): Out of bounds write in PDP ctx GSN-Address decode (medium 6.5)
- [CVE-2026-75891](https://insights.sbomify.com/CVE-2026-75891/): Deserialization in Kirki – Freeform Page Builder, Website Builder & Customizer (high 8.8)
- [CVE-2026-7589](https://insights.sbomify.com/CVE-2026-7589/): ghantakiran splunk-mcp-integration CSV Export csv_export.py create_csv_export path traversal (medium 6.9)
- [CVE-2026-75889](https://insights.sbomify.com/CVE-2026-75889/): CVE-2026-75889 CVE Record (high 7.7)
- [CVE-2026-75888](https://insights.sbomify.com/CVE-2026-75888/): Openshift/console: openshift/console: authenticated ssrf via helm chart url fetch (high 7.7)
- [CVE-2026-75887](https://insights.sbomify.com/CVE-2026-75887/): Openshift/console: openshift/console: unauthenticated path traversal in i18n locale handler (high 7.5)
- [CVE-2026-75886](https://insights.sbomify.com/CVE-2026-75886/): Misconfiguration in Red Hat OpenShift Container Platform 4 (high 7.2)
- [CVE-2026-75885](https://insights.sbomify.com/CVE-2026-75885/): Openshift/console: openshift/console: unauthenticated ssrf and resource exhaustion via devfile parser endpoint (critical 9.3)
- [CVE-2026-75884](https://insights.sbomify.com/CVE-2026-75884/): Awx: awx: privilege escalation to openshift namespace via pod_spec_override injection in container groups (critical 9.1)
- [CVE-2026-75883](https://insights.sbomify.com/CVE-2026-75883/): PPPD buffer overflow in PEAP response code (medium 6.8)
- [CVE-2026-75881](https://insights.sbomify.com/CVE-2026-75881/): IBM Maximo Application Suite - IoT Component Denial of Service (high 7.5)
- [CVE-2026-75880](https://insights.sbomify.com/CVE-2026-75880/): Apache Artemis, Apache ActiveMQ Artemis: Message selector wildcard handling could lead to denial of service (medium 6.5)
- [CVE-2026-7588](https://insights.sbomify.com/CVE-2026-7588/): ggerve coding-standards-mcp server.py get_best_practices path traversal (medium 6.9)
- [CVE-2026-75878](https://insights.sbomify.com/CVE-2026-75878/): IBM Sterling File Gateway is Vulnerable to Authentication Bypass (critical 9.1)
- [CVE-2026-75877](https://insights.sbomify.com/CVE-2026-75877/): TRENDnet TV-IP751WIC alphapd FUN_0043372C stack-based overflow (critical 9.4)
- [CVE-2026-75876](https://insights.sbomify.com/CVE-2026-75876/): xianrendzw EasyReport Move Operations ModuleController.java sql injection (medium 5.3)
- [CVE-2026-75875](https://insights.sbomify.com/CVE-2026-75875/): Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection (critical 9.8)
- [CVE-2026-75874](https://insights.sbomify.com/CVE-2026-75874/): Sandbox escape in the Remote Settings Client component (critical 10.0)
- [CVE-2026-75873](https://insights.sbomify.com/CVE-2026-75873/): Zella Theme < 2.6.3 - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2026-75872](https://insights.sbomify.com/CVE-2026-75872/): HTML Injection in MailerUp double opt-in verification email (medium 6.9)
- [CVE-2026-75871](https://insights.sbomify.com/CVE-2026-75871/): Server-Side Request Forgery (SSRF) in GitLab AI Gateway (high 8.2)
- [CVE-2026-75870](https://insights.sbomify.com/CVE-2026-75870/): Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret. (critical 9.1)
- [CVE-2026-7587](https://insights.sbomify.com/CVE-2026-7587/): Open5GS AMF nsmf-handler.c amf_nsmf_pdusession_handle_update_sm_context denial of service (medium 5.3)
- [CVE-2026-75866](https://insights.sbomify.com/CVE-2026-75866/): Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types because no auth (critical 9.1)
- [CVE-2026-75865](https://insights.sbomify.com/CVE-2026-75865/): WPLP Cookie Consent <= 4.4.1 - Unauthenticated Arbitrary File Upload via 'upload-logo' REST Endpoint (critical 9.8)
- [CVE-2026-75863](https://insights.sbomify.com/CVE-2026-75863/): Photoshop Desktop | Integer Overflow or Wraparound (CWE-190) (high 7.8)
- [CVE-2026-75862](https://insights.sbomify.com/CVE-2026-75862/): Photoshop Desktop | Integer Overflow or Wraparound (CWE-190) (high 7.8)
- [CVE-2026-75861](https://insights.sbomify.com/CVE-2026-75861/): Ultimate Gift Cards for WooCommerce < 3.2.10 - Subscriber+ Gift Card Theft and Destruction via Unauthorized Redemption (medium 6.5)
- [CVE-2026-75860](https://insights.sbomify.com/CVE-2026-75860/): JSON Options <= 0.0.4 - Unauthenticated Arbitrary Options Update (critical 9.8)
- [CVE-2026-7586](https://insights.sbomify.com/CVE-2026-7586/): Open5GS AMF nudm-handler.c ogs_id_get_value denial of service (medium 5.3)
- [CVE-2026-75859](https://insights.sbomify.com/CVE-2026-75859/): CodeWhale before 0.8.64 Arbitrary File Read via instructions (high 8.7)
- [CVE-2026-75858](https://insights.sbomify.com/CVE-2026-75858/): CodeWhale rlm_eval before 0.8.64 Remote Code Execution (high 8.5)
- [CVE-2026-75857](https://insights.sbomify.com/CVE-2026-75857/): CodeWhale before 0.8.64 Privilege Escalation via exec_shell_interact (high 7.3)
- [CVE-2026-75856](https://insights.sbomify.com/CVE-2026-75856/): CodeWhale before 0.8.64 SSRF Bypass via DNS Pinning TOCTOU (critical 9.2)
- [CVE-2026-75855](https://insights.sbomify.com/CVE-2026-75855/): ArcadeDB before 26.8.1 Path Traversal via create/drop database (high 8.4)
- [CVE-2026-75854](https://insights.sbomify.com/CVE-2026-75854/): ArcadeDB Redis Wire-Protocol Plugin Missing Authentication (critical 9.3)
- [CVE-2026-75853](https://insights.sbomify.com/CVE-2026-75853/): ArcadeDB Gremlin Wire Protocol Authorization Bypass Cross-Database (high 8.7)
- [CVE-2026-75852](https://insights.sbomify.com/CVE-2026-75852/): ArcadeDB MongoDB wire protocol authentication bypass cross-database (critical 9.3)
- [CVE-2026-75851](https://insights.sbomify.com/CVE-2026-75851/): ArcadeDB before 26.8.1 Authentication Bypass via Async Command (critical 9.4)
- [CVE-2026-75850](https://insights.sbomify.com/CVE-2026-75850/): ArcadeDB before 26.8.1 Per-Type ACL Bypass via Batch Handlers (low 2.3)
- [CVE-2026-7585](https://insights.sbomify.com/CVE-2026-7585/): Open5GS AMF nudm-handler.c amf_nudm_sdm_handle_provisioned denial of service (medium 5.3)
- [CVE-2026-75847](https://insights.sbomify.com/CVE-2026-75847/): Sensitive attribute values stored in a non-sensitive public changes map in AshPaperTrail (medium 5.9)
- [CVE-2026-75846](https://insights.sbomify.com/CVE-2026-75846/): ArcadeDB before 26.8.1 Unauthorized Function Deletion via DELETE FUNCTION (high 7.1)
- [CVE-2026-75845](https://insights.sbomify.com/CVE-2026-75845/): ArcadeDB 26.4.2 before 26.8.1 Authorization Bypass via set_server_setting (medium 5.3)
- [CVE-2026-75844](https://insights.sbomify.com/CVE-2026-75844/): ArcadeDB before 26.8.1 SSRF via IMPORT DATABASE validator bypass (high 7.1)
- [CVE-2026-75843](https://insights.sbomify.com/CVE-2026-75843/): ArcadeDB before 26.8.1 Privilege Escalation via gRPC Transaction (critical 9.4)
- [CVE-2026-75842](https://insights.sbomify.com/CVE-2026-75842/): ArcadeDB before 26.8.1 Arbitrary File Read via LOAD CSV (high 8.3)
- [CVE-2026-75841](https://insights.sbomify.com/CVE-2026-75841/): ArcadeDB before 26.8.1 Denial of Service via range() (medium 5.3)
- [CVE-2026-75840](https://insights.sbomify.com/CVE-2026-75840/): ArcadeDB before 26.8.1 Arbitrary File Read via Unescaped Regex (high 8.7)
- [CVE-2026-7584](https://insights.sbomify.com/CVE-2026-7584/): Arbitrary Code Execution via Unsafe Deserialization in LabOne Q (high 8.4)
- [CVE-2026-75839](https://insights.sbomify.com/CVE-2026-75839/): ArcadeDB before 26.8.1 Information Disclosure via Cluster Endpoints (medium 5.3)
- [CVE-2026-75838](https://insights.sbomify.com/CVE-2026-75838/): DOMPurify before 3.4.13 Cross-Site Scripting via IN_PLACE hook (medium 5.1)
- [CVE-2026-75837](https://insights.sbomify.com/CVE-2026-75837/): Grav before 2.0.14 Privilege Escalation via Group Access Field (critical 9.3)
- [CVE-2026-75836](https://insights.sbomify.com/CVE-2026-75836/): Grav API Plugin before 1.0.14 Missing Authorization (high 8.7)
- [CVE-2026-75835](https://insights.sbomify.com/CVE-2026-75835/): Grav API Plugin before 1.0.14 Missing Authorization (critical 9.3)
- [CVE-2026-75834](https://insights.sbomify.com/CVE-2026-75834/): Grav before 2.0.14 Stored XSS via Invalid UTF-8 Byte (medium 5.1)
- [CVE-2026-75833](https://insights.sbomify.com/CVE-2026-75833/): Grav API Plugin Open Redirect via Backslash Bypass (high 8.6)
- [CVE-2026-75832](https://insights.sbomify.com/CVE-2026-75832/): Grav API Plugin before 1.0.14 Authorization Bypass (critical 9.3)
- [CVE-2026-75831](https://insights.sbomify.com/CVE-2026-75831/): Grav before 2.0.15 Stored XSS via audio/video source URL (medium 5.1)
- [CVE-2026-75830](https://insights.sbomify.com/CVE-2026-75830/): grav-plugin-api before 1.0.15 Path Traversal via batchCopy (high 7.1)
- [CVE-2026-7583](https://insights.sbomify.com/CVE-2026-7583/): Open5GS BSF context.c bsf_sess_find_by_ipv6prefix denial of service (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/382/