# Vulnerabilities published in 2026


- [CVE-2026-67100](https://insights.sbomify.com/CVE-2026-67100/): HCL BigFix Service Management is affected by multiple security vulnerabilities. (critical 9.8)
- [CVE-2026-6710](https://insights.sbomify.com/CVE-2026-6710/): Skysa Text Ticker App <= 1.4 - Cross-Site Request Forgery to Settings Modification via 'Save Settings' Form (medium 4.3)
- [CVE-2026-6709](https://insights.sbomify.com/CVE-2026-6709/): Missing authorization in Coinbase Commerce for Contact Form 7 (medium 4.3)
- [CVE-2026-67080](https://insights.sbomify.com/CVE-2026-67080/): HCL BigFix AEX is affected by multiple security vulnerabilities. (medium 6.5)
- [CVE-2026-6708](https://insights.sbomify.com/CVE-2026-6708/): Missing authorization in HEL Online Classroom: AI-powered Online Classrooms (medium 5.3)
- [CVE-2026-67079](https://insights.sbomify.com/CVE-2026-67079/): HCL BigFix AEX is affected by multiple security vulnerabilities. (medium 6.4)
- [CVE-2026-67077](https://insights.sbomify.com/CVE-2026-67077/): HCL BigFix AEX is affected by multiple security vulnerabilities. (medium 4.2)
- [CVE-2026-67075](https://insights.sbomify.com/CVE-2026-67075/): HCL Digital Experience is affected by improper input sanitation (medium 6.5)
- [CVE-2026-67074](https://insights.sbomify.com/CVE-2026-67074/): HCL BigFix AEX is affected by multiple security vulnerabilities. (critical 9.1)
- [CVE-2026-67073](https://insights.sbomify.com/CVE-2026-67073/): HCL BigFix AEX is affected by multiple security vulnerabilities. (high 8.6)
- [CVE-2026-67071](https://insights.sbomify.com/CVE-2026-67071/): Information disclosure in HCL DevOps Deploy / HCL Launch (medium 6.5)
- [CVE-2026-6706](https://insights.sbomify.com/CVE-2026-6706/): Missing authorization in Server (medium 6.5)
- [CVE-2026-6704](https://insights.sbomify.com/CVE-2026-6704/): Blog Settings <= 1.0 - Reflected Cross-Site Scripting via 'page' Parameter (medium 6.1)
- [CVE-2026-6703](https://insights.sbomify.com/CVE-2026-6703/): Missing authorization in Responsive Blocks – Page Builder for Blocks & Patterns (medium 4.3)
- [CVE-2026-6702](https://insights.sbomify.com/CVE-2026-6702/): Publish 2 Ping.fm <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'wpPingPingKey' Parameter (medium 6.1)
- [CVE-2026-6701](https://insights.sbomify.com/CVE-2026-6701/): addfreespace <= 0.1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Page (medium 4.3)
- [CVE-2026-6700](https://insights.sbomify.com/CVE-2026-6700/): DX Sources <= 2.0.1 - Cross-Site Request Forgery to Settings Update (medium 4.3)
- [CVE-2026-6696](https://insights.sbomify.com/CVE-2026-6696/): Zingaya Click-to-Call <= 1.0 - Reflected Cross-Site Scripting via 'email' Parameter (medium 6.1)
- [CVE-2026-6695](https://insights.sbomify.com/CVE-2026-6695/): Gimp: gimp: remote code execution via crafted paa file (medium 5.5)
- [CVE-2026-6694](https://insights.sbomify.com/CVE-2026-6694/): Gimp: gimp file-png plugin: denial of service via oversized apng trns chunk (medium 5.5)
- [CVE-2026-66922](https://insights.sbomify.com/CVE-2026-66922/): Pivotick Prototype-Key Collision in Tree Layout and Cycle Detection Allows Graph Manipulation and Denial of Service (medium 5.1)
- [CVE-2026-66921](https://insights.sbomify.com/CVE-2026-66921/): Pivotick - Stored DOM-Based Cross-Site Scripting via Unescaped Markdown Node References (medium 6.3)
- [CVE-2026-66920](https://insights.sbomify.com/CVE-2026-66920/): Pivotick - Stack Exhaustion Denial of Service via Deep or Cyclic Graph Data (high 8.2)
- [CVE-2026-6692](https://insights.sbomify.com/CVE-2026-6692/): Slider Revolution 7.0.0 - 7.0.10 - Authenticated (Subscriber+) Arbitrary File Upload via _get_media_url (high 8.8)
- [CVE-2026-66919](https://insights.sbomify.com/CVE-2026-66919/): Stored DOM-Based Cross-Site Scripting in Node Modal Headers (medium 6.9)
- [CVE-2026-66918](https://insights.sbomify.com/CVE-2026-66918/): DOM-Based Cross-Site Scripting via Unsanitized SVG Node Icons (high 8.2)
- [CVE-2026-66917](https://insights.sbomify.com/CVE-2026-66917/): Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery < 4.4.0 (high 8.6)
- [CVE-2026-66916](https://insights.sbomify.com/CVE-2026-66916/): Joomla Extension - joomgalleryfriends.net - Password-Protected Category Bypass via JSON Format in JoomGallery < 4.4.0 (medium 6.9)
- [CVE-2026-66915](https://insights.sbomify.com/CVE-2026-66915/): Joomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabrik < 4.7.2 (critical 10.0)
- [CVE-2026-66914](https://insights.sbomify.com/CVE-2026-66914/): Joomla Extension - seblod.com - Unauthenticated path traversal in SEBLOD < 3.30.0, < 4.7.0, < 6.0.1 (critical 9.2)
- [CVE-2026-66913](https://insights.sbomify.com/CVE-2026-66913/): Zip Bomb in Lookyloo Capture Upload Allows Denial of Service (medium 6.9)
- [CVE-2026-66912](https://insights.sbomify.com/CVE-2026-66912/): Stored Cross-Site Scripting in Zimbra (medium 5.3)
- [CVE-2026-66911](https://insights.sbomify.com/CVE-2026-66911/): Stored Cross-Site Scripting in Zimbra (medium 5.3)
- [CVE-2026-6691](https://insights.sbomify.com/CVE-2026-6691/): MongoDB C Driver Cyrus SASL Canonicalization Buffer Overflow (high 8.6)
- [CVE-2026-66909](https://insights.sbomify.com/CVE-2026-66909/): Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage (critical 9.8)
- [CVE-2026-66908](https://insights.sbomify.com/CVE-2026-66908/): Apache Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never validated, so any unexpired token signed by a trusted key was accepted (high 7.5)
- [CVE-2026-66907](https://insights.sbomify.com/CVE-2026-66907/): Apache Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining the result (high 7.5)
- [CVE-2026-66906](https://insights.sbomify.com/CVE-2026-66906/): Apache Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir (critical 9.1)
- [CVE-2026-66902](https://insights.sbomify.com/CVE-2026-66902/): Command injection in Google::Auth (critical 9.8)
- [CVE-2026-66901](https://insights.sbomify.com/CVE-2026-66901/): Server-side request forgery in Google::Auth (high 7.5)
- [CVE-2026-6690](https://insights.sbomify.com/CVE-2026-6690/): LifePress <= 2.2.2 - Unauthenticated Stored Cross-Site Scripting via 'n' Parameter via lp_update_mds AJAX Action (high 7.2)
- [CVE-2026-66898](https://insights.sbomify.com/CVE-2026-66898/): Path traversal via unvalidated instance name in backup tarball restore enables root file write / RCE (critical 9.9)
- [CVE-2026-66897](https://insights.sbomify.com/CVE-2026-66897/): Instance template path traversal allows arbitrary host file write as root (critical 9.9)
- [CVE-2026-66890](https://insights.sbomify.com/CVE-2026-66890/): Use of Hard-coded Credentials in Digital Watchdog VMAX DVR and NVR Product Lineups (critical 9.4)
- [CVE-2026-6689](https://insights.sbomify.com/CVE-2026-6689/): Mattermost doesn't enforce PermissionInviteUser when setting AllowOpenInvite or AllowedDomains during team creation (medium 4.3)
- [CVE-2026-66887](https://insights.sbomify.com/CVE-2026-66887/): Missing Authorization in Digital Watchdog VMAX DVR and NVR Product Lineups (critical 9.4)
- [CVE-2026-66885](https://insights.sbomify.com/CVE-2026-66885/): Livebook Teams identity callback lacks state binding, allowing login CSRF (medium 6.8)
- [CVE-2026-66884](https://insights.sbomify.com/CVE-2026-66884/): Cross-site request forgery in oidcc plug (low 2.1)
- [CVE-2026-66883](https://insights.sbomify.com/CVE-2026-66883/): Oidcc.Plug.Authorize user agent session binding inert due to case-sensitive header lookup (medium 6.3)
- [CVE-2026-66882](https://insights.sbomify.com/CVE-2026-66882/): Reflected XSS in AshAuthentication confirmation and magic link interaction forms (low 2.1)
- [CVE-2026-66881](https://insights.sbomify.com/CVE-2026-66881/): Path traversal in imported file_entries name allows arbitrary file write via URL-type entry download (high 7.0)
- [CVE-2026-6688](https://insights.sbomify.com/CVE-2026-6688/): FatFs Buffer Overflow via Unbounded LFN Filename Copy (high 7.6)
- [CVE-2026-66878](https://insights.sbomify.com/CVE-2026-66878/): Missing authorization in Red Hat Advanced Cluster Management for Kubernetes 2.11 (high 7.7)
- [CVE-2026-66877](https://insights.sbomify.com/CVE-2026-66877/): Gitea fork workflow approval bypass through concurrency cancellation (high 8.1)
- [CVE-2026-66875](https://insights.sbomify.com/CVE-2026-66875/): Mira Hormone Monitor, Mira Android App Missing authentication for critical function (high 8.7)
- [CVE-2026-66874](https://insights.sbomify.com/CVE-2026-66874/): Gitea required Actions check bypass through skipped workflows (medium 6.5)
- [CVE-2026-6687](https://insights.sbomify.com/CVE-2026-6687/): FatFs Stack Buffer Overflow via Uncapped exFAT Label Length (high 7.6)
- [CVE-2026-6686](https://insights.sbomify.com/CVE-2026-6686/): FatFs Use of Uninitialized Clusters After Seek Past EOF (medium 4.6)
- [CVE-2026-66859](https://insights.sbomify.com/CVE-2026-66859/): Apache Thrift: c_glib multiplexed processor crashes on a message it cannot route (high 8.7)
- [CVE-2026-66858](https://insights.sbomify.com/CVE-2026-66858/): Denial of service in Apache Thrift (high 8.7)
- [CVE-2026-66853](https://insights.sbomify.com/CVE-2026-66853/): Gitea restricted-user organization metadata disclosure (medium 4.3)
- [CVE-2026-66849](https://insights.sbomify.com/CVE-2026-66849/): Gitea restricted-user package visibility bypass (medium 4.3)
- [CVE-2026-66843](https://insights.sbomify.com/CVE-2026-66843/): html_sanitize_ex HTML5 scrubber keeps attacker-supplied `<object>` elements, allowing untrusted content embedding (low 2.3)
- [CVE-2026-66842](https://insights.sbomify.com/CVE-2026-66842/): BIG-IP and BIG-IQ Configuration utility vulnerability (high 8.7)
- [CVE-2026-66840](https://insights.sbomify.com/CVE-2026-66840/): Information disclosure in XING CPTrans-ME-X (high 8.7)
- [CVE-2026-6684](https://insights.sbomify.com/CVE-2026-6684/): FatFs Infinite Loop in GPT Partition Scan (medium 4.6)
- [CVE-2026-66839](https://insights.sbomify.com/CVE-2026-66839/): Privilege escalation in NetKids iMark (high 8.4)
- [CVE-2026-66838](https://insights.sbomify.com/CVE-2026-66838/): SQL injection via the :comment option in Postgrex.stream/4 (medium 5.9)
- [CVE-2026-66837](https://insights.sbomify.com/CVE-2026-66837/): Apache Thrift: PHP accelerator sizes a stack buffer from a wire-controlled string length (high 8.7)
- [CVE-2026-66835](https://insights.sbomify.com/CVE-2026-66835/): httpd mod_auth directory protection bypassed by a doubled slash in the request path (high 8.2)
- [CVE-2026-66832](https://insights.sbomify.com/CVE-2026-66832/): Mira Hormone Monitor, Mira Android App Use of GET request method with sensitive query strings (medium 6.9)
- [CVE-2026-6683](https://insights.sbomify.com/CVE-2026-6683/): FatFs Divide-by-Zero in exFAT Sync (medium 4.6)
- [CVE-2026-66829](https://insights.sbomify.com/CVE-2026-66829/): html_sanitize_ex HTML5 scrubber keeps attacker-supplied meta refresh, allowing forced cross-origin redirection (low 2.3)
- [CVE-2026-66825](https://insights.sbomify.com/CVE-2026-66825/): Cross-Site Scripting via Unsafe URL Schemes in Pivotick Property Links (medium 6.9)
- [CVE-2026-66824](https://insights.sbomify.com/CVE-2026-66824/): Stored Cross-Site Scripting via Unsafe Capture Tree JSON Embedding (critical 9.2)
- [CVE-2026-66822](https://insights.sbomify.com/CVE-2026-66822/): .NET Information Disclosure Vulnerability (medium 5.9)
- [CVE-2026-66820](https://insights.sbomify.com/CVE-2026-66820/): SQL Server Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-6682](https://insights.sbomify.com/CVE-2026-6682/): FatFs Integer Overflow in FAT32 Volume Mount (high 7.6)
- [CVE-2026-66819](https://insights.sbomify.com/CVE-2026-66819/): Microsoft SQL Server Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-66818](https://insights.sbomify.com/CVE-2026-66818/): Microsoft SQL Server Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-66816](https://insights.sbomify.com/CVE-2026-66816/): Microsoft SQL Server Security Feature Bypass Vulnerability (medium 6.5)
- [CVE-2026-66814](https://insights.sbomify.com/CVE-2026-66814/): Microsoft SQL Server Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-66810](https://insights.sbomify.com/CVE-2026-66810/): Microsoft Office Word Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-6681](https://insights.sbomify.com/CVE-2026-6681/): PKCS#7 decode ignores caller output buffer size, writing past buffer bounds (low 1.0)
- [CVE-2026-66809](https://insights.sbomify.com/CVE-2026-66809/): Microsoft Office Graphics Component Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-66808](https://insights.sbomify.com/CVE-2026-66808/): Microsoft SharePoint Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-66807](https://insights.sbomify.com/CVE-2026-66807/): Microsoft Office Graphics Component Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-66806](https://insights.sbomify.com/CVE-2026-66806/): Microsoft Office Word Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-66805](https://insights.sbomify.com/CVE-2026-66805/): Microsoft SharePoint Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-66804](https://insights.sbomify.com/CVE-2026-66804/): Microsoft Windows Cross Device Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-66803](https://insights.sbomify.com/CVE-2026-66803/): Azure Cosmos DB Remote Code Execution Vulnerability (critical 10.0)
- [CVE-2026-66802](https://insights.sbomify.com/CVE-2026-66802/): Windows Device Health Attestation (DHA) Remote Code Execution Vulnerability (high 8.1)
- [CVE-2026-66800](https://insights.sbomify.com/CVE-2026-66800/): Azure Data Factory Information Disclosure Vulnerability (high 8.6)
- [CVE-2026-66799](https://insights.sbomify.com/CVE-2026-66799/): Windows Key Guard Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-66798](https://insights.sbomify.com/CVE-2026-66798/): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (medium 4.3)
- [CVE-2026-66797](https://insights.sbomify.com/CVE-2026-66797/): Apache CloudStack: Unauthorised comment creation and disclosure (medium 5.4)
- [CVE-2026-66795](https://insights.sbomify.com/CVE-2026-66795/): Auth bypass in multicluster engine for Kubernetes 2.10 (critical 9.9)
- [CVE-2026-66794](https://insights.sbomify.com/CVE-2026-66794/): Cluster-proxy-addon: cluster-proxy-addon: unauthenticated ssrf to arbitrary managed-cluster services via public route (critical 9.3)
- [CVE-2026-66793](https://insights.sbomify.com/CVE-2026-66793/): Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2.11 (high 8.8)
- [CVE-2026-66792](https://insights.sbomify.com/CVE-2026-66792/): Privilege escalation in Multicluster Global Hub 1.4.9 (critical 9.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/452/