# Vulnerabilities published in 2026


- [CVE-2026-75107](https://insights.sbomify.com/CVE-2026-75107/): Grav Form Plugin before 9.1.19 Stored XSS via Field Properties (medium 5.1)
- [CVE-2026-75106](https://insights.sbomify.com/CVE-2026-75106/): OpnForm Editable Submission Secret Derivation via Empty Hashids Salt (critical 9.3)
- [CVE-2026-75105](https://insights.sbomify.com/CVE-2026-75105/): phpIPAM Temporary Subnet Share Information Disclosure via Address Parameter (high 8.7)
- [CVE-2026-75104](https://insights.sbomify.com/CVE-2026-75104/): Hugging Face Transformers Path Traversal via Checkpoint Index (medium 6.8)
- [CVE-2026-75103](https://insights.sbomify.com/CVE-2026-75103/): Crawlab Missing Authorization on Password Change Endpoint Allows Account Takeover (high 8.7)
- [CVE-2026-75101](https://insights.sbomify.com/CVE-2026-75101/): Missing authorization in Enterprise Server (medium 6.0)
- [CVE-2026-7510](https://insights.sbomify.com/CVE-2026-7510/): OWAP DefectDojo Benchmark/Engagement/Product/Survey authorization (medium 5.3)
- [CVE-2026-75099](https://insights.sbomify.com/CVE-2026-75099/): Apache Allura: Unauthenticated REST disclosure (medium 5.3)
- [CVE-2026-75098](https://insights.sbomify.com/CVE-2026-75098/): Product Designer App <= 1.1.3 - Unauthenticated Arbitrary File Read via 'svg' Parameter in pdapp-render-design (high 7.5)
- [CVE-2026-75095](https://insights.sbomify.com/CVE-2026-75095/): IBM Aspera Enterprise Webapps Denial of Service (high 7.5)
- [CVE-2026-75094](https://insights.sbomify.com/CVE-2026-75094/): COMFAST CF-N1-S CGI mbox-config sub_44B438 os command injection (critical 9.4)
- [CVE-2026-75093](https://insights.sbomify.com/CVE-2026-75093/): sonos tract ONNX Initializer Loader tensor.rs from_raw_dt_align buffer size (medium 5.3)
- [CVE-2026-75092](https://insights.sbomify.com/CVE-2026-75092/): Privilege escalation in Red Hat Enterprise Linux 8 (high 7.3)
- [CVE-2026-75091](https://insights.sbomify.com/CVE-2026-75091/): Quill Forms <= 5.7.1 - Unauthenticated Stored Cross-Site Scripting (high 7.2)
- [CVE-2026-75090](https://insights.sbomify.com/CVE-2026-75090/): EricLBuehler Mistral.rs GGUF Tokenizer gguf_tokenizer.rs convert_gguf_to_hf_tokenizer out-of-bounds (medium 5.3)
- [CVE-2026-7509](https://insights.sbomify.com/CVE-2026-7509/): KIA Subtitle <= 4.0.1 - [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')] (medium 6.4)
- [CVE-2026-75089](https://insights.sbomify.com/CVE-2026-75089/): PHPGurukul Complaint Management System check_availability.php sql injection (medium 6.9)
- [CVE-2026-75088](https://insights.sbomify.com/CVE-2026-75088/): itsourcecode Hospital Management System viewbilling.php sql injection (medium 5.3)
- [CVE-2026-75087](https://insights.sbomify.com/CVE-2026-75087/): itsourcecode Hospital Management System viewdepartment.php sql injection (medium 5.3)
- [CVE-2026-75086](https://insights.sbomify.com/CVE-2026-75086/): itsourcecode Hospital Management System viewroom.php sql injection (medium 5.3)
- [CVE-2026-75085](https://insights.sbomify.com/CVE-2026-75085/): Out-of-bounds read from received-frame length underflow in the STM32WBA IEEE 802.15.4 driver (medium 4.2)
- [CVE-2026-75084](https://insights.sbomify.com/CVE-2026-75084/): Out-of-bounds write in the TI CC1200 IEEE 802.15.4 driver from an unvalidated radio-supplied packet length (medium 6.8)
- [CVE-2026-75083](https://insights.sbomify.com/CVE-2026-75083/): Integer overflow in zephyr (medium 5.9)
- [CVE-2026-75082](https://insights.sbomify.com/CVE-2026-75082/): Webkul Bagisto Customer-Registration Notification Email register cross site scripting (medium 5.3)
- [CVE-2026-75081](https://insights.sbomify.com/CVE-2026-75081/): Webkul Bagisto store behavioral workflow (medium 5.3)
- [CVE-2026-75080](https://insights.sbomify.com/CVE-2026-75080/): SourceCodester Class and Exam Timetabling System edit_subject1.php sql injection (medium 6.9)
- [CVE-2026-7508](https://insights.sbomify.com/CVE-2026-7508/): Bootstrap CMS Page Creation show.blade.php code injection (medium 5.3)
- [CVE-2026-75079](https://insights.sbomify.com/CVE-2026-75079/): SourceCodester Class and Exam Timetabling System edit_subject2.php sql injection (medium 6.9)
- [CVE-2026-75078](https://insights.sbomify.com/CVE-2026-75078/): SourceCodester Class and Exam Timetabling System BSHRM1.php cross site scripting (medium 5.3)
- [CVE-2026-75077](https://insights.sbomify.com/CVE-2026-75077/): SourceCodester Class and Exam Timetabling System BSCE2.php cross site scripting (medium 5.3)
- [CVE-2026-75076](https://insights.sbomify.com/CVE-2026-75076/): IBM Aspera Enterprise Webapps Information Disclosure (medium 4.3)
- [CVE-2026-7507](https://insights.sbomify.com/CVE-2026-7507/): Org.keycloak/keycloak-services: session fixation in oidc login flow that can lead to account takeover (high 7.5)
- [CVE-2026-75063](https://insights.sbomify.com/CVE-2026-75063/): IBM Planning Analytics Local is affected by security vulnerabilities (medium 5.4)
- [CVE-2026-75062](https://insights.sbomify.com/CVE-2026-75062/): Eval Injection in google/langfun via default lf.query protocol (critical 9.2)
- [CVE-2026-75061](https://insights.sbomify.com/CVE-2026-75061/): IBM Planning Analytics Local is affected by security vulnerabilities (high 7.5)
- [CVE-2026-75060](https://insights.sbomify.com/CVE-2026-75060/): Auth bypass in PyCharm (high 8.4)
- [CVE-2026-7506](https://insights.sbomify.com/CVE-2026-7506/): SourceCodester Hotel Management System check sql injection (medium 6.9)
- [CVE-2026-75059](https://insights.sbomify.com/CVE-2026-75059/): Cross-site scripting in PyCharm (medium 4.4)
- [CVE-2026-75058](https://insights.sbomify.com/CVE-2026-75058/): XML external entity in IntelliJ IDEA (medium 5.5)
- [CVE-2026-75057](https://insights.sbomify.com/CVE-2026-75057/): Information disclosure in IntelliJ IDEA (medium 6.2)
- [CVE-2026-75056](https://insights.sbomify.com/CVE-2026-75056/): Command injection in IntelliJ IDEA (high 7.8)
- [CVE-2026-75055](https://insights.sbomify.com/CVE-2026-75055/): XML external entity in IntelliJ IDEA (medium 5.5)
- [CVE-2026-75054](https://insights.sbomify.com/CVE-2026-75054/): Server-side request forgery in IntelliJ IDEA (medium 6.3)
- [CVE-2026-75053](https://insights.sbomify.com/CVE-2026-75053/): Server-side request forgery in IntelliJ IDEA (medium 5.4)
- [CVE-2026-75052](https://insights.sbomify.com/CVE-2026-75052/): Command injection in IntelliJ IDEA (low 3.6)
- [CVE-2026-75051](https://insights.sbomify.com/CVE-2026-75051/): Missing authorization in YouTrack (high 8.1)
- [CVE-2026-75050](https://insights.sbomify.com/CVE-2026-75050/): Denial of service in YouTrack (high 7.1)
- [CVE-2026-7505](https://insights.sbomify.com/CVE-2026-7505/): nextlevelbuilder GoClaw/GoClaw Lite RPC improper authorization (medium 6.9)
- [CVE-2026-75049](https://insights.sbomify.com/CVE-2026-75049/): Missing authorization in YouTrack (medium 6.5)
- [CVE-2026-75048](https://insights.sbomify.com/CVE-2026-75048/): Cross-site scripting in YouTrack (high 8.2)
- [CVE-2026-75047](https://insights.sbomify.com/CVE-2026-75047/): Denial of service in YouTrack (medium 6.5)
- [CVE-2026-75046](https://insights.sbomify.com/CVE-2026-75046/): Missing authorization in YouTrack (medium 4.3)
- [CVE-2026-75045](https://insights.sbomify.com/CVE-2026-75045/): Auth bypass in YouTrack (critical 9.1)
- [CVE-2026-75044](https://insights.sbomify.com/CVE-2026-75044/): Missing authorization in YouTrack (high 8.1)
- [CVE-2026-7504](https://insights.sbomify.com/CVE-2026-7504/): Org.keycloak/keycloak-services: open redirect when using wildcard valid redirect uris in keycloak (high 8.1)
- [CVE-2026-75038](https://insights.sbomify.com/CVE-2026-75038/): Predictable temporary file in /tmp allows symlink attack in LACT (medium 6.9)
- [CVE-2026-75037](https://insights.sbomify.com/CVE-2026-75037/): Polkit authentication bypass in LACT (high 7.3)
- [CVE-2026-75036](https://insights.sbomify.com/CVE-2026-75036/): Fleet: DNS exfiltration via Sprig getHostByName in fleet.yaml Helm template preprocessing (medium 5.3)
- [CVE-2026-75035](https://insights.sbomify.com/CVE-2026-75035/): Rancher: ext.cattle.io/v1 Token store: cross-user token disclosure via label-selector scoping bypass (high 7.1)
- [CVE-2026-75034](https://insights.sbomify.com/CVE-2026-75034/): Rancher: SAML Assertion Replay (high 7.4)
- [CVE-2026-75033](https://insights.sbomify.com/CVE-2026-75033/): Rancher: Cross-Cluster Secret Leakage via Namespace projectId Annotation Spoofing (high 7.7)
- [CVE-2026-75032](https://insights.sbomify.com/CVE-2026-75032/): Bluez: bluez: out-of-bounds read in avrcp parse_media_element and parse_media_folder (medium 6.3)
- [CVE-2026-75031](https://insights.sbomify.com/CVE-2026-75031/): Code injection in Interchange (critical 9.8)
- [CVE-2026-75030](https://insights.sbomify.com/CVE-2026-75030/): Apache Syncope: Incomplete authorization checks for Group members deprovisioning (critical 9.8)
- [CVE-2026-7503](https://insights.sbomify.com/CVE-2026-7503/): code-projects for Plugin cstecgi.cgi setWiFiMultipleConfig buffer overflow (high 8.7)
- [CVE-2026-75029](https://insights.sbomify.com/CVE-2026-75029/): Message parser retains every identical singleton RDATA, enabling wire-to-work amplification (medium 5.3)
- [CVE-2026-75028](https://insights.sbomify.com/CVE-2026-75028/): WPCafe <= 3.0.18 - Authenticated (Contributor+) Local File Inclusion via 'food_menu_style' Elementor Widget Setting (high 7.5)
- [CVE-2026-75027](https://insights.sbomify.com/CVE-2026-75027/): Missing authorization in Themify Builder (medium 5.3)
- [CVE-2026-75025](https://insights.sbomify.com/CVE-2026-75025/): Mattermost Desktop local network access from server-rendered content (medium 4.7)
- [CVE-2026-75021](https://insights.sbomify.com/CVE-2026-75021/): fastify-cli vulnerable to remote code execution via ignored explicit Inspector bind address (high 8.1)
- [CVE-2026-75020](https://insights.sbomify.com/CVE-2026-75020/): Apache APISIX: ldap-auth plugin cross-subtree identity impersonation (high 7.0)
- [CVE-2026-7502](https://insights.sbomify.com/CVE-2026-7502/): LinkStackOrg LinkStack Management Endpoint UserController.php saveLink authorization (medium 5.3)
- [CVE-2026-75019](https://insights.sbomify.com/CVE-2026-75019/): Cozy Blocks <= 2.2.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via cozyHoverEffect Block Attribute (medium 6.4)
- [CVE-2026-75018](https://insights.sbomify.com/CVE-2026-75018/): Missing authorization in Custom Contact Forms (medium 4.3)
- [CVE-2026-75017](https://insights.sbomify.com/CVE-2026-75017/): Missing authorization in Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid (medium 4.3)
- [CVE-2026-75016](https://insights.sbomify.com/CVE-2026-75016/): Magazine Blocks <= 1.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'clientId' Block Attribute (medium 6.4)
- [CVE-2026-75015](https://insights.sbomify.com/CVE-2026-75015/): Apache Syncope: Nested secrets leak cleartext into audit records readable (medium 4.9)
- [CVE-2026-75014](https://insights.sbomify.com/CVE-2026-75014/): SourceCodester Pet Grooming Management Software get_barcode_data.php sql injection (medium 6.9)
- [CVE-2026-75013](https://insights.sbomify.com/CVE-2026-75013/): TOTOLINK EX1200L cstecgi.cgi setWizardCfg null pointer dereference (high 7.1)
- [CVE-2026-75012](https://insights.sbomify.com/CVE-2026-75012/): TOTOLINK EX1200L Password Configuration cstecgi.cgi setPasswordCfg null pointer dereference (high 7.1)
- [CVE-2026-75011](https://insights.sbomify.com/CVE-2026-75011/): kylecui NetForensicMCP index.js execAsync command injection (medium 5.3)
- [CVE-2026-75010](https://insights.sbomify.com/CVE-2026-75010/): Information disclosure in Webmail (medium 6.4)
- [CVE-2026-7501](https://insights.sbomify.com/CVE-2026-7501/): LinkStackOrg LinkStack UserController.php editPage cross site scripting (medium 5.1)
- [CVE-2026-75007](https://insights.sbomify.com/CVE-2026-75007/): Command injection in Webmail (medium 5.4)
- [CVE-2026-75006](https://insights.sbomify.com/CVE-2026-75006/): Server-side request forgery in Webmail (medium 5.8)
- [CVE-2026-75005](https://insights.sbomify.com/CVE-2026-75005/): Apache APISIX: Unauthenticated CPU-exhaustion DoS (high 8.7)
- [CVE-2026-75004](https://insights.sbomify.com/CVE-2026-75004/): Security feature bypass in Webmail (medium 4.3)
- [CVE-2026-75003](https://insights.sbomify.com/CVE-2026-75003/): Security feature bypass in Webmail (medium 5.8)
- [CVE-2026-75002](https://insights.sbomify.com/CVE-2026-75002/): Command injection in Webmail (high 7.1)
- [CVE-2026-75000](https://insights.sbomify.com/CVE-2026-75000/): Cross-site scripting in Webmail (medium 5.8)
- [CVE-2026-7500](https://insights.sbomify.com/CVE-2026-7500/): Keycloak has a Forced Browsing issue (medium 5.4)
- [CVE-2026-74999](https://insights.sbomify.com/CVE-2026-74999/): Cross-site scripting in Webmail (medium 5.4)
- [CVE-2026-74998](https://insights.sbomify.com/CVE-2026-74998/): Cross-site scripting in Webmail (high 7.2)
- [CVE-2026-74997](https://insights.sbomify.com/CVE-2026-74997/): Command injection in Webmail (high 8.8)
- [CVE-2026-74994](https://insights.sbomify.com/CVE-2026-74994/): inets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_auth (medium 6.0)
- [CVE-2026-74992](https://insights.sbomify.com/CVE-2026-74992/): Kirki < 6.2.3 - Editor+ Stored XSS via Font Zip Upload (medium 6.8)
- [CVE-2026-74991](https://insights.sbomify.com/CVE-2026-74991/): WPForms Lite 1.8.8.2 - 2.0.1.1 - Unauthenticated Stripe Refund and Subscription Cancellation via External PaymentIntent (medium 6.8)
- [CVE-2026-74990](https://insights.sbomify.com/CVE-2026-74990/): Internally found bugs fixed in Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154 (critical 9.8)
- [CVE-2026-74989](https://insights.sbomify.com/CVE-2026-74989/): Internally found bugs fixed in Firefox 154 (critical 9.8)
- [CVE-2026-74988](https://insights.sbomify.com/CVE-2026-74988/): Internally found bugs fixed in Firefox ESR 153.1 and Firefox 154 (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/387/