# Vulnerabilities published in 2026


- [CVE-2026-74271](https://insights.sbomify.com/CVE-2026-74271/): power: supply: core: fix supplied_from allocations (not scored)
- [CVE-2026-74270](https://insights.sbomify.com/CVE-2026-74270/): handshake: Require admin permission for DONE command (high 7.8)
- [CVE-2026-7427](https://insights.sbomify.com/CVE-2026-7427/): Allocation of Resources Without Limits or Throttling in GitLab (medium 5.3)
- [CVE-2026-74269](https://insights.sbomify.com/CVE-2026-74269/): bnxt: fix head underflow on XDP head-grow (critical 9.8)
- [CVE-2026-74268](https://insights.sbomify.com/CVE-2026-74268/): tcp: clear sock_ops cb flags before force-closing a child socket (critical 9.8)
- [CVE-2026-74267](https://insights.sbomify.com/CVE-2026-74267/): net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen (critical 9.8)
- [CVE-2026-74266](https://insights.sbomify.com/CVE-2026-74266/): net/sched: sch_dualpi2: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen (not scored)
- [CVE-2026-74265](https://insights.sbomify.com/CVE-2026-74265/): net: mana: initialize gdma queue id to INVALID_QUEUE_ID (not scored)
- [CVE-2026-74264](https://insights.sbomify.com/CVE-2026-74264/): net: watchdog: fix refcount tracking races (high 7.8)
- [CVE-2026-74263](https://insights.sbomify.com/CVE-2026-74263/): net: wwan: t7xx: check skb_clone in control TX (not scored)
- [CVE-2026-74262](https://insights.sbomify.com/CVE-2026-74262/): kcm: use WRITE_ONCE() when changing lower socket callbacks (high 7.8)
- [CVE-2026-74261](https://insights.sbomify.com/CVE-2026-74261/): ALSA: seq: avoid stale FIFO cells during resize (not scored)
- [CVE-2026-74260](https://insights.sbomify.com/CVE-2026-74260/): netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (high 7.8)
- [CVE-2026-7426](https://insights.sbomify.com/CVE-2026-7426/): Out-of-Bounds Write via Unsanitized Prefix Length in Router Advertisement Processing in FreeRTOS-Plus-TCP (medium 6.1)
- [CVE-2026-74258](https://insights.sbomify.com/CVE-2026-74258/): bpf: Guard __get_user acesss with access_ok for uprobe_multi data (high 7.8)
- [CVE-2026-74257](https://insights.sbomify.com/CVE-2026-74257/): sockmap: Fix use-after-free in udp_bpf_recvmsg() (high 7.8)
- [CVE-2026-74256](https://insights.sbomify.com/CVE-2026-74256/): bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check (high 8.4)
- [CVE-2026-74255](https://insights.sbomify.com/CVE-2026-74255/): tipc: fix UAF in tipc_l2_send_msg() (critical 9.8)
- [CVE-2026-74254](https://insights.sbomify.com/CVE-2026-74254/): Joomla Extension - joomlack.fr - SQL injection in Page Builder CK < 3.6.5 (critical 9.3)
- [CVE-2026-74253](https://insights.sbomify.com/CVE-2026-74253/): Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer < 16.0.0 (critical 10.0)
- [CVE-2026-74252](https://insights.sbomify.com/CVE-2026-74252/): Joomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 (high 8.6)
- [CVE-2026-74251](https://insights.sbomify.com/CVE-2026-74251/): Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6 (critical 9.3)
- [CVE-2026-74250](https://insights.sbomify.com/CVE-2026-74250/): Other in Ironic (medium 6.3)
- [CVE-2026-7425](https://insights.sbomify.com/CVE-2026-7425/): Out-of-Bounds Read in Router Advertisement Option Parser in FreeRTOS-Plus-TCP (medium 6.0)
- [CVE-2026-74248](https://insights.sbomify.com/CVE-2026-74248/): Missing authorization in Octavia (medium 4.3)
- [CVE-2026-74247](https://insights.sbomify.com/CVE-2026-74247/): Quay: ssrf via build archive_url in quay build api (medium 4.2)
- [CVE-2026-74245](https://insights.sbomify.com/CVE-2026-74245/): Quay: unauthenticated exported logs download in quay (medium 5.9)
- [CVE-2026-74244](https://insights.sbomify.com/CVE-2026-74244/): Quay: stripe webhook accepts forged events without signature verification in quay (medium 5.9)
- [CVE-2026-74243](https://insights.sbomify.com/CVE-2026-74243/): Quay: unauthenticated secscan notification endpoint in quay when psk is unset (medium 6.5)
- [CVE-2026-74242](https://insights.sbomify.com/CVE-2026-74242/): Quay: repository notification uuid idor in quay api (medium 5.3)
- [CVE-2026-74241](https://insights.sbomify.com/CVE-2026-74241/): Quay: ldap referral filter injection in quay external ldap authentication (medium 4.8)
- [CVE-2026-74240](https://insights.sbomify.com/CVE-2026-74240/): Quay: jwt claim validation bypasses in quay federated robot and sso authentication (medium 5.4)
- [CVE-2026-7424](https://insights.sbomify.com/CVE-2026-7424/): Integer Underflow in DHCPv6 Sub-Option Parser in FreeRTOS-Plus-TCP (high 7.2)
- [CVE-2026-74239](https://insights.sbomify.com/CVE-2026-74239/): XenForo < 2.3.13 Path Traversal via Style Archive Importer on Windows (high 8.6)
- [CVE-2026-74238](https://insights.sbomify.com/CVE-2026-74238/): TIER IV Nebula 1.2.0 Heap Out-of-Bounds Read via VLP32 UDP Decoder (high 8.7)
- [CVE-2026-74237](https://insights.sbomify.com/CVE-2026-74237/): GFI Exinda AI / ClearView < 7.6.5 Argument Injection via Tools Iperf Client (high 7.1)
- [CVE-2026-74236](https://insights.sbomify.com/CVE-2026-74236/): GFI Exinda AI / ClearView < 7.6.5 Path Traversal via Diagnostic File Deletion Handler (high 7.0)
- [CVE-2026-74235](https://insights.sbomify.com/CVE-2026-74235/): GFI Exinda AI / ClearView < 7.6.5 Path Traversal via Configuration Download Handler (medium 6.9)
- [CVE-2026-74233](https://insights.sbomify.com/CVE-2026-74233/): Zbtlink MQWrt infosrvd Command Injection (critical 9.3)
- [CVE-2026-74232](https://insights.sbomify.com/CVE-2026-74232/): Zbtlink MQWrt yunmgrd Cloud C2 Implant (critical 9.3)
- [CVE-2026-7423](https://insights.sbomify.com/CVE-2026-7423/): Integer Underflow in ICMP Echo Reply Processing in FreeRTOS-Plus-TCP (medium 6.0)
- [CVE-2026-74225](https://insights.sbomify.com/CVE-2026-74225/): U-Boot before 2026.10-rc5 Out-of-Bounds Write via DHCPv6 (high 7.1)
- [CVE-2026-74222](https://insights.sbomify.com/CVE-2026-74222/): U-Boot before 2026.10-rc5 Use-After-Free in lwIP wget Receive Callback (high 8.8)
- [CVE-2026-74221](https://insights.sbomify.com/CVE-2026-74221/): U-Boot before 2026.10-rc5 Buffer Overflow via NFS READLINK (high 8.8)
- [CVE-2026-74220](https://insights.sbomify.com/CVE-2026-74220/): U-Boot before 2026.10-rc5 Buffer Overflow via NFS READ Reply (high 8.8)
- [CVE-2026-7422](https://insights.sbomify.com/CVE-2026-7422/): MAC Address Validation Bypass in FreeRTOS-Plus-TCP IPv4 and IPv6 Packet Processing (high 7.1)
- [CVE-2026-7421](https://insights.sbomify.com/CVE-2026-7421/): Passeum Ticketing <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'shop_name' Setting (medium 4.4)
- [CVE-2026-7420](https://insights.sbomify.com/CVE-2026-7420/): UTT HiPER 1250GW ConfigAdvideo strcpy buffer overflow (high 8.7)
- [CVE-2026-7419](https://insights.sbomify.com/CVE-2026-7419/): UTT HiPER 1250GW formTaskEdit_ap strcpy buffer overflow (high 8.7)
- [CVE-2026-7418](https://insights.sbomify.com/CVE-2026-7418/): UTT HiPER 1250GW NTP strcpy buffer overflow (high 8.7)
- [CVE-2026-7417](https://insights.sbomify.com/CVE-2026-7417/): Algovate xhs-mcp MCP mcp.server.ts xhs_publish_content server-side request forgery (medium 6.9)
- [CVE-2026-7416](https://insights.sbomify.com/CVE-2026-7416/): PolarVista xcode-mcp-server MCP index.ts run_tests os command injection (medium 6.9)
- [CVE-2026-7415](https://insights.sbomify.com/CVE-2026-7415/): Open MQTT orchestration without read/write ACLs in Yarbo robot firmware (critical 9.8)
- [CVE-2026-7414](https://insights.sbomify.com/CVE-2026-7414/): Hardcoded credentials in Yarbo robot firmware (critical 9.8)
- [CVE-2026-7413](https://insights.sbomify.com/CVE-2026-7413/): Persistent undocumented backdoor access in Yarbo robot (high 7.2)
- [CVE-2026-7412](https://insights.sbomify.com/CVE-2026-7412/): Eclipse BaSyx Java Server SDK vulnerable to Server-Side Request Forgery (high 8.6)
- [CVE-2026-7411](https://insights.sbomify.com/CVE-2026-7411/): Eclipse BaSyx Java Server SDK vulnerable to Path Traversal (critical 10.0)
- [CVE-2026-7410](https://insights.sbomify.com/CVE-2026-7410/): SourceCodester Pizzafy Ecommerce System ajax.php add_to_cart sql injection (medium 5.3)
- [CVE-2026-7409](https://insights.sbomify.com/CVE-2026-7409/): SourceCodester Pizzafy Ecommerce System ajax.php save_user sql injection (medium 5.1)
- [CVE-2026-7408](https://insights.sbomify.com/CVE-2026-7408/): SourceCodester Pizzafy Ecommerce System ajax.php save_menu sql injection (medium 5.1)
- [CVE-2026-7407](https://insights.sbomify.com/CVE-2026-7407/): SourceCodester Pizzafy Ecommerce System Setting ajax.php save_settings sql injection (medium 5.1)
- [CVE-2026-7406](https://insights.sbomify.com/CVE-2026-7406/): BMP File Parsing Untrusted Pointer Dereference in certain Autodesk products (high 7.8)
- [CVE-2026-7405](https://insights.sbomify.com/CVE-2026-7405/): TIF File Parsing Out-of-Bounds Read in certain Autodesk products (medium 5.5)
- [CVE-2026-74049](https://insights.sbomify.com/CVE-2026-74049/): Apache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE) (medium 6.1)
- [CVE-2026-74048](https://insights.sbomify.com/CVE-2026-74048/): Apache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up (medium 6.5)
- [CVE-2026-74047](https://insights.sbomify.com/CVE-2026-74047/): Wazuh 4.0.0 before 4.14.8 authd.pass Disclosure via Agent 000 Config Endpoint (high 7.1)
- [CVE-2026-74046](https://insights.sbomify.com/CVE-2026-74046/): Wazuh 4.4.0 < 4.14.7 DoS via fdecompress_files() Zip Bomb (medium 6.9)
- [CVE-2026-74045](https://insights.sbomify.com/CVE-2026-74045/): Wazuh 3.12.0 before 4.14.8 Heap Buffer Overflow in wazuh-analysisd FIM Decoder (high 7.1)
- [CVE-2026-74044](https://insights.sbomify.com/CVE-2026-74044/): Wazuh 4.0.0 < 4.14.6 Path Traversal Arbitrary Directory Deletion via Cluster Hello (high 7.0)
- [CVE-2026-74043](https://insights.sbomify.com/CVE-2026-74043/): Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster Upload Functions (high 8.5)
- [CVE-2026-74041](https://insights.sbomify.com/CVE-2026-74041/): Wazuh 4.14.3 < 4.14.8 / 4.10.4 Remote Command Validation Bypass via Case Mismatch (high 8.6)
- [CVE-2026-74040](https://insights.sbomify.com/CVE-2026-74040/): Wazuh 3.9.0 before 4.14.8 Arbitrary File Overwrite RCE via process_files_from_worker (critical 9.4)
- [CVE-2026-7404](https://insights.sbomify.com/CVE-2026-7404/): getsimpletool mcpo-simple-server base_manager.py delete_shared_prompt path traversal (medium 6.9)
- [CVE-2026-74039](https://insights.sbomify.com/CVE-2026-74039/): Wazuh 4.0.0 < 4.14.7 API DoS via Deeply Nested JSON auth_context (high 7.1)
- [CVE-2026-74038](https://insights.sbomify.com/CVE-2026-74038/): Wazuh 4.0.0 < 4.14.6 Path Traversal DoS via Agent Enrollment (high 7.0)
- [CVE-2026-74037](https://insights.sbomify.com/CVE-2026-74037/): Wazuh 4.0.0 before 4.14.8 Session Invalidation Bypass in check_token (high 8.6)
- [CVE-2026-74036](https://insights.sbomify.com/CVE-2026-74036/): Wazuh 4.3.0 before 4.14.8 Remote Code Execution via SCA Command Policies (high 8.6)
- [CVE-2026-74035](https://insights.sbomify.com/CVE-2026-74035/): Wazuh 4.6.0 before 4.14.8 Authentication Bypass via Empty Password in update_user (high 8.6)
- [CVE-2026-74034](https://insights.sbomify.com/CVE-2026-74034/): Wazuh 4.1.0 before 4.14.8 Arbitrary File Read via upgrade_custom Command (high 8.7)
- [CVE-2026-74033](https://insights.sbomify.com/CVE-2026-74033/): Wazuh from 4.1.1 before 4.14.8 Path Traversal in CDB List Cluster Handlers (high 8.4)
- [CVE-2026-74032](https://insights.sbomify.com/CVE-2026-74032/): Wazuh 4.0.0 before 4.14.8 RBAC Authorization Bypass via /security/actions (medium 5.3)
- [CVE-2026-74031](https://insights.sbomify.com/CVE-2026-74031/): Wazuh 4.1.1 before 4.14.8 Path Traversal File Deletion via Rule/Decoder Delete Helpers (high 7.0)
- [CVE-2026-74030](https://insights.sbomify.com/CVE-2026-74030/): Wazuh 3.9.0 before 4.14.8 Memory Exhaustion via SCA YAML Alias Expansion (medium 6.9)
- [CVE-2026-7403](https://insights.sbomify.com/CVE-2026-7403/): geldata gel-mcp server.py fetch_rule path traversal (medium 6.9)
- [CVE-2026-74021](https://insights.sbomify.com/CVE-2026-74021/): WordPress Chaplin theme <= 2.6.8 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-74020](https://insights.sbomify.com/CVE-2026-74020/): WordPress Koji theme <= 2.2.1 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-7402](https://insights.sbomify.com/CVE-2026-7402/): Improper Rate Limiting in MeWare Software's PDKS (high 8.1)
- [CVE-2026-74019](https://insights.sbomify.com/CVE-2026-74019/): WordPress EPROLO Dropshipping plugin <= 2.4.2 - Broken Access Control vulnerability (high 7.1)
- [CVE-2026-74018](https://insights.sbomify.com/CVE-2026-74018/): WordPress Warehouse Cargo theme <= 2.6.9 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2026-74017](https://insights.sbomify.com/CVE-2026-74017/): WordPress User Registration plugin <= 5.2.7 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-74016](https://insights.sbomify.com/CVE-2026-74016/): WordPress Smart Cleaning theme <= 4.8.6 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2026-74015](https://insights.sbomify.com/CVE-2026-74015/): WordPress Readabler plugin < 2.0.18 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-74014](https://insights.sbomify.com/CVE-2026-74014/): WordPress IT Residence theme <= 3.2.1 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2026-74013](https://insights.sbomify.com/CVE-2026-74013/): WordPress eShipper Commerce plugin <= 2.16.13 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-74012](https://insights.sbomify.com/CVE-2026-74012/): WordPress TaxoPress plugin <= 3.51.0 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-74011](https://insights.sbomify.com/CVE-2026-74011/): WordPress InfiniteWP Client plugin <= 1.13.9 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-74010](https://insights.sbomify.com/CVE-2026-74010/): WordPress bbPress plugin <= 2.6.14 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-7401](https://insights.sbomify.com/CVE-2026-7401/): Cross-site scripting in CET Automated Grading System with AI Predictive Analytics (medium 5.3)
- [CVE-2026-74009](https://insights.sbomify.com/CVE-2026-74009/): WordPress Razorpay for WooCommerce plugin <= 4.8.7 - Insecure Direct Object References (IDOR) vulnerability (medium 5.3)
- [CVE-2026-74008](https://insights.sbomify.com/CVE-2026-74008/): WordPress Shortcodes and extra features for Phlox theme plugin <= 2.17.24 - Sensitive Data Exposure vulnerability (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/395/