# Vulnerabilities published in 2026


- [CVE-2026-68104](https://insights.sbomify.com/CVE-2026-68104/): drm/amdgpu: invoke pm_genpd_remove() before freeing genpd (high 7.8)
- [CVE-2026-68103](https://insights.sbomify.com/CVE-2026-68103/): drm/amdgpu: reject mapping a reserved doorbell to a new queue (high 7.1)
- [CVE-2026-68102](https://insights.sbomify.com/CVE-2026-68102/): drm/amdgpu: fix aperture mapping leak (not scored)
- [CVE-2026-68100](https://insights.sbomify.com/CVE-2026-68100/): ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl (high 8.1)
- [CVE-2026-6810](https://insights.sbomify.com/CVE-2026-6810/): Missing authorization in Booking Calendar Contact Form (medium 5.3)
- [CVE-2026-68099](https://insights.sbomify.com/CVE-2026-68099/): ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL (not scored)
- [CVE-2026-68098](https://insights.sbomify.com/CVE-2026-68098/): ksmbd: bound DACL dedup walk to copied ACEs (high 8.8)
- [CVE-2026-68097](https://insights.sbomify.com/CVE-2026-68097/): ksmbd: validate ACE size against SID sub-authorities (high 8.8)
- [CVE-2026-68096](https://insights.sbomify.com/CVE-2026-68096/): audit: fix recursive locking deadlock in audit_dupe_exe() (high 7.5)
- [CVE-2026-68095](https://insights.sbomify.com/CVE-2026-68095/): fuse-uring: fix race between registration and connection abortion (not scored)
- [CVE-2026-68094](https://insights.sbomify.com/CVE-2026-68094/): sched_ext: Preserve rq tracking across local DSQ dispatch (not scored)
- [CVE-2026-68093](https://insights.sbomify.com/CVE-2026-68093/): KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug (not scored)
- [CVE-2026-68092](https://insights.sbomify.com/CVE-2026-68092/): time/jiffies: Register jiffies clocksource before usage (not scored)
- [CVE-2026-68091](https://insights.sbomify.com/CVE-2026-68091/): HID: wacom: stop hardware after post-start probe failures (high 8.8)
- [CVE-2026-68090](https://insights.sbomify.com/CVE-2026-68090/): debugobjects: Plug race against a concurrent OOM disable (not scored)
- [CVE-2026-6809](https://insights.sbomify.com/CVE-2026-6809/): Social Post Embed <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Threads Embed (medium 6.4)
- [CVE-2026-68089](https://insights.sbomify.com/CVE-2026-68089/): iio: core: fix uninitialized data in debugfs (not scored)
- [CVE-2026-68088](https://insights.sbomify.com/CVE-2026-68088/): usb: gadget: function: rndis: add length check to response query (not scored)
- [CVE-2026-68087](https://insights.sbomify.com/CVE-2026-68087/): HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush() (not scored)
- [CVE-2026-68086](https://insights.sbomify.com/CVE-2026-68086/): mm/khugepaged: write all dirty file folios when collapsing (not scored)
- [CVE-2026-68085](https://insights.sbomify.com/CVE-2026-68085/): Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (high 8.0)
- [CVE-2026-68084](https://insights.sbomify.com/CVE-2026-68084/): staging: vme_user: fix location monitor leak in tsi148 bridge (not scored)
- [CVE-2026-68083](https://insights.sbomify.com/CVE-2026-68083/): ksmbd: fix path resolution in ksmbd_vfs_kern_path_create (critical 9.1)
- [CVE-2026-68082](https://insights.sbomify.com/CVE-2026-68082/): libceph: fix two unsafe bare decodes in decode_lockers() (critical 9.8)
- [CVE-2026-68081](https://insights.sbomify.com/CVE-2026-68081/): KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (not scored)
- [CVE-2026-68080](https://insights.sbomify.com/CVE-2026-68080/): Apache Qpid Broker-J: Unbounded echo flow responses can lead to denial of service (medium 6.5)
- [CVE-2026-6808](https://insights.sbomify.com/CVE-2026-6808/): Pricing Tables for WP <= 1.1.0 - Reflected Cross-Site Scripting via 'page' Parameter (medium 6.1)
- [CVE-2026-68079](https://insights.sbomify.com/CVE-2026-68079/): Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay (critical 9.8)
- [CVE-2026-68078](https://insights.sbomify.com/CVE-2026-68078/): Apache Qpid Broker-J: Unable to govern the maximum number of transfer frames per incoming delivery (medium 6.5)
- [CVE-2026-68077](https://insights.sbomify.com/CVE-2026-68077/): Apache Qpid Broker-J: Unbounded disposition range handling can lead to denial of service (medium 6.5)
- [CVE-2026-68076](https://insights.sbomify.com/CVE-2026-68076/): Apache Airflow: Connections test API: team-scope guard bypass resolves another team's environment Connection (medium 5.4)
- [CVE-2026-68075](https://insights.sbomify.com/CVE-2026-68075/): Apache Qpid Broker-J: Incoming session flow control window can be exceeded (medium 6.5)
- [CVE-2026-68074](https://insights.sbomify.com/CVE-2026-68074/): Apache Qpid Broker-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustion (high 7.5)
- [CVE-2026-68073](https://insights.sbomify.com/CVE-2026-68073/): Apache Qpid Broker-J: Unbounded type nesting can lead to pre-authentication stack overflow (high 7.5)
- [CVE-2026-68070](https://insights.sbomify.com/CVE-2026-68070/): Missing Authentication for Critical Function in Digital Watchdog VMAX DVR and NVR Product Lineups (high 8.7)
- [CVE-2026-6807](https://insights.sbomify.com/CVE-2026-6807/): NSA GRASSMARLIN Improper Restriction of XML External Entity Reference (medium 5.5)
- [CVE-2026-68068](https://insights.sbomify.com/CVE-2026-68068/): Toptech TMS7 and TopHAT SQL Injection (high 8.5)
- [CVE-2026-68067](https://insights.sbomify.com/CVE-2026-68067/): Mira Hormone Monitor, Mira Android App Weak Authentication (critical 9.3)
- [CVE-2026-68062](https://insights.sbomify.com/CVE-2026-68062/): Path traversal in SKYMEC IT Manager (medium 5.8)
- [CVE-2026-68060](https://insights.sbomify.com/CVE-2026-68060/): Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication (high 7.5)
- [CVE-2026-6806](https://insights.sbomify.com/CVE-2026-6806/): Motors <= 1.4.109 - Unauthenticated Blind SQL Injection via 'stm_lat'/'stm_lng' Parameters (high 7.5)
- [CVE-2026-6805](https://insights.sbomify.com/CVE-2026-6805/): Vulnerability on Cryptobox external sharing feature (medium 6.9)
- [CVE-2026-6804](https://insights.sbomify.com/CVE-2026-6804/): Missing authorization in AI Copilot – Content Generator (medium 5.3)
- [CVE-2026-6803](https://insights.sbomify.com/CVE-2026-6803/): Missing authorization in AI Copilot – Content Generator (medium 5.3)
- [CVE-2026-6802](https://insights.sbomify.com/CVE-2026-6802/): Missing authorization in Easy Upload Files During Checkout (medium 5.3)
- [CVE-2026-6801](https://insights.sbomify.com/CVE-2026-6801/): Context Blog <= 1.3.5 - Unauthenticated Sensitive Information Exposure via 'postID' Parameter (medium 5.3)
- [CVE-2026-68006](https://insights.sbomify.com/CVE-2026-68006/): An issue in Puma v.5.0.0 and before v.8.0.3 allows an attacker to execute arbitrary code via the ext/puma_http11/http11_parser.rl file (critical 9.1)
- [CVE-2026-68005](https://insights.sbomify.com/CVE-2026-68005/): An issue in ACME mini_httpd 1.30 and prior allows a remote attacker to cause a denial of service via the HTTP request header parser in the h (high 7.5)
- [CVE-2026-68004](https://insights.sbomify.com/CVE-2026-68004/): An issue in OSSRS SRS (Simple Realtime Server) <v5.0.213 allows a remote attacker to execute arbitrary code via RTMP publish authorization, (critical 9.8)
- [CVE-2026-68000](https://insights.sbomify.com/CVE-2026-68000/): The front-end interface /cms/category/list of MCMS <=6.2.0 is vulnerable to SQL injection. (critical 9.8)
- [CVE-2026-6800](https://insights.sbomify.com/CVE-2026-6800/): FastBots <= 1.0.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings (medium 4.4)
- [CVE-2026-67993](https://insights.sbomify.com/CVE-2026-67993/): basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f contains a login cross-site request forgery issue in the static credentials callback. (high 8.8)
- [CVE-2026-67991](https://insights.sbomify.com/CVE-2026-67991/): crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-of-service condition (high 7.5)
- [CVE-2026-67990](https://insights.sbomify.com/CVE-2026-67990/): basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f disables Rails CSRF protection for its Alertmanager and Prometheus proxy controllers. (medium 5.4)
- [CVE-2026-6799](https://insights.sbomify.com/CVE-2026-6799/): Comfast CF-N1-S Endpoint mbox-config command injection (medium 5.3)
- [CVE-2026-67989](https://insights.sbomify.com/CVE-2026-67989/): crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-of-service condition (high 7.5)
- [CVE-2026-67987](https://insights.sbomify.com/CVE-2026-67987/): crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains polynomial-time regular expression denial-of-service conditions i (high 7.5)
- [CVE-2026-67986](https://insights.sbomify.com/CVE-2026-67986/): amazing-print/amazing_print at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby code injection condition in AwesomeMethodArray#grep. (high 8.4)
- [CVE-2026-6798](https://insights.sbomify.com/CVE-2026-6798/): Missing authorization in 2Download Connector for 2DL Hosted Checkout (medium 5.3)
- [CVE-2026-67979](https://insights.sbomify.com/CVE-2026-67979/): Incorrect access control in the Executive Services dynamic application start path component of NASA cFS v7.0.1 allows attackers to execute a (critical 9.1)
- [CVE-2026-67978](https://insights.sbomify.com/CVE-2026-67978/): An issue in the SBN UDP interface of NASA cFS v7.0.1 allows attackers to cause a Denial of Service (DoS) via transmitting a crafted SBN frame. (high 7.5)
- [CVE-2026-67977](https://insights.sbomify.com/CVE-2026-67977/): An integer overflow in the Svc::FileDownlink::SendPartial component of fprime framework v4.2.2 allows attackers to cause a Denial of Service (high 7.5)
- [CVE-2026-67976](https://insights.sbomify.com/CVE-2026-67976/): The Ref::SignalGen component of fprime framework v4.2.2 does not validate the safety of user-controlled parameters, allowing attackers to ca (high 7.5)
- [CVE-2026-67975](https://insights.sbomify.com/CVE-2026-67975/): Incorrect access control in NASA cFS v7.0.1 allows attackers to arbitrarily remove low-index subscriptions and add new streams via sending T (high 7.5)
- [CVE-2026-67974](https://insights.sbomify.com/CVE-2026-67974/): A parser boundary flaw in the Software Bus Network (SBN) application's peer subscription message handling in NASA cFS v7.0.1 allows attacker (high 7.5)
- [CVE-2026-67973](https://insights.sbomify.com/CVE-2026-67973/): An issue in the CFDP receive path of NASA cFS v7.0.1 allows attackers to cause a Denial of Service (DoS) via replaying final CFDP PDUs. (high 7.5)
- [CVE-2026-67972](https://insights.sbomify.com/CVE-2026-67972/): An issue in the CF_CFDP_RecvMd() component of NASA cFS v7.0.1 allows attackers to contrl where received content and data is stored, possibly (high 7.5)
- [CVE-2026-67970](https://insights.sbomify.com/CVE-2026-67970/): Incorrect access control in the DS_SetDestPathCmd() component of NASA cFS v7.0.1 allows attackers to access sensitive components via a path traversal. (high 7.5)
- [CVE-2026-6797](https://insights.sbomify.com/CVE-2026-6797/): Sanluan PublicCMS DocToHtmlUtils.java ZipSecureFile.setMinflateRatio resource consumption (medium 5.3)
- [CVE-2026-67969](https://insights.sbomify.com/CVE-2026-67969/): An issue in the HS_MonitorApplications() component of NASA cFS v7.0.1 allows attackers to force the processor to reset via supplying a craft (high 7.5)
- [CVE-2026-67967](https://insights.sbomify.com/CVE-2026-67967/): Buffer Overflow vulnerability in Tenda W20E V16.01.0.6(2782) allows an attacker to execute arbitrary code. (critical 9.8)
- [CVE-2026-67966](https://insights.sbomify.com/CVE-2026-67966/): Tenda W20E V16.01.0.6(2782) /goform/telnet endpoint allows unauthenticated remote attackers to activate the Telnet daemon and obtain root shell access. (critical 9.8)
- [CVE-2026-67965](https://insights.sbomify.com/CVE-2026-67965/): An issue in Tneda W20E v.16.01.0.6(2782) allows a remote attacker to execute arbitrary code via the url_need_login function (critical 9.8)
- [CVE-2026-67961](https://insights.sbomify.com/CVE-2026-67961/): An issue in O2OA v.10.0.2 allows a local attacker to execute arbitrary code via the the sandbox mechanism of the Invoke script execution. (high 7.8)
- [CVE-2026-67960](https://insights.sbomify.com/CVE-2026-67960/): An issue in PbootCMS v.3.2.15 allows an attacker to execute arbitrary code via the MemberController.php, UserController.php, CommentControll (critical 9.8)
- [CVE-2026-6796](https://insights.sbomify.com/CVE-2026-6796/): Sanluan PublicCMS Failed Login LoginAdminController.java log_login cleartext storage in file (medium 5.3)
- [CVE-2026-6795](https://insights.sbomify.com/CVE-2026-6795/): Open Redirect in DivvyDrive Information Technologies' DivvyDrive (critical 9.6)
- [CVE-2026-6794](https://insights.sbomify.com/CVE-2026-6794/): Multiple Vulnerabilities in IBM Concert Software (high 7.8)
- [CVE-2026-6793](https://insights.sbomify.com/CVE-2026-6793/): Stored XSS in Bifra Engineering's Q-smart NexT Poll (medium 5.4)
- [CVE-2026-67926](https://insights.sbomify.com/CVE-2026-67926/): An issue in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the files Parameter in JeecgBoot AI Chat Module (critical 9.8)
- [CVE-2026-67925](https://insights.sbomify.com/CVE-2026-67925/): Cross Site Scripting vulnerability in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the endpoint /airag/chat/uplo (medium 6.1)
- [CVE-2026-67921](https://insights.sbomify.com/CVE-2026-67921/): Cross-Site Request Forgery (CSRF) vulnerability exists in Halo CMS versions up to 2.25.4 via the CorsConfigurer.java and the CsrfConfigurer.java components. (critical 9.3)
- [CVE-2026-67920](https://insights.sbomify.com/CVE-2026-67920/): An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the run.halo.app.migration.impl.MigrationServiceImpl.restoreW (high 8.8)
- [CVE-2026-6792](https://insights.sbomify.com/CVE-2026-6792/): Improper Authorization in Universal Sotware's FlexCity (medium 6.5)
- [CVE-2026-67919](https://insights.sbomify.com/CVE-2026-67919/): An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the PluginEndpoint.java, installFromUri method, and DefaultPl (critical 9.8)
- [CVE-2026-67918](https://insights.sbomify.com/CVE-2026-67918/): Directory Traversal vulnerability in hermes-studio v.0.6.26 allows a remote attacker to obtain sensitive information via the validatePath fu (high 7.5)
- [CVE-2026-67917](https://insights.sbomify.com/CVE-2026-67917/): zuraCast versions up to and including 0.23.7 contain a SQL injection vulnerability in the backup restore functionality. (critical 9.8)
- [CVE-2026-6791](https://insights.sbomify.com/CVE-2026-6791/): Potential stack-based buffer clash during tilde expansion in wordexp (medium 6.6)
- [CVE-2026-6790](https://insights.sbomify.com/CVE-2026-6790/): Eclipse Jetty: HTTP Authority/Host mismatch (medium 5.3)
- [CVE-2026-6788](https://insights.sbomify.com/CVE-2026-6788/): Uncontrolled search path in PluginLauncher allows SYSTEM code execution in WatchGuard Agent (high 8.5)
- [CVE-2026-67873](https://insights.sbomify.com/CVE-2026-67873/): A heap-based buffer overflow exists in lib60870-C 2.4.0 in the server-side FileSegment ASDU encoding path. (critical 9.8)
- [CVE-2026-67872](https://insights.sbomify.com/CVE-2026-67872/): An issue in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the event monitored-item queue resize handling (high 7.5)
- [CVE-2026-67871](https://insights.sbomify.com/CVE-2026-67871/): Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the AddNodes, address_space_ (high 7.5)
- [CVE-2026-67870](https://insights.sbomify.com/CVE-2026-67870/): In open62541 v1.5.5, the server-side AddReferences implementation contains an incomplete validation flaw for non-local ExpandedNodeId targets. (critical 9.8)
- [CVE-2026-6787](https://insights.sbomify.com/CVE-2026-6787/): Usage of a hard-coded cryptographic key in WatchGuard Agent allows inclusion of code into existing process (high 8.5)
- [CVE-2026-67869](https://insights.sbomify.com/CVE-2026-67869/): Buffer Overflow vulnerability in open62541 v1.5.5 allows a remote attacker to cause a denial of service via the Service_Call validates input (high 7.5)
- [CVE-2026-67868](https://insights.sbomify.com/CVE-2026-67868/): A heap-based out-of-bounds write vulnerability exists in S2OPC 1.7.3 in server-side EventFilter handling during CreateMonitoredItems processing. (critical 9.8)
- [CVE-2026-67867](https://insights.sbomify.com/CVE-2026-67867/): Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the Alarm/Conditions wrapper (high 7.5)
- [CVE-2026-67866](https://insights.sbomify.com/CVE-2026-67866/): Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the LockedStaMac_ProcessMsg_ (high 7.5)
- [CVE-2026-67865](https://insights.sbomify.com/CVE-2026-67865/): S2OPC 1.7.3 contains an out-of-bounds read in RepublishResponse handling. (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/447/