# Vulnerabilities published in 2026


- [CVE-2026-62670](https://insights.sbomify.com/CVE-2026-62670/): Missing authorization in grav-plugin-flex-objects (medium 6.3)
- [CVE-2026-6267](https://insights.sbomify.com/CVE-2026-6267/): Insertion of Sensitive Information Into Sent Data in GitLab (high 8.5)
- [CVE-2026-62669](https://insights.sbomify.com/CVE-2026-62669/): Grav Login Plugin: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge (high 7.4)
- [CVE-2026-62668](https://insights.sbomify.com/CVE-2026-62668/): Grav API Plugin: Webhook SSRF via Unrestricted cURL Protocols (critical 9.4)
- [CVE-2026-62667](https://insights.sbomify.com/CVE-2026-62667/): Grav API Plugin : API Key 'scopes' Never Enforced - Delegated Least-Privilege Keys Carry Full User ACL (high 8.1)
- [CVE-2026-62666](https://insights.sbomify.com/CVE-2026-62666/): Privilege escalation in grav-plugin-api (high 8.8)
- [CVE-2026-62664](https://insights.sbomify.com/CVE-2026-62664/): FileRise: Authenticated path traversal in createFolder allows arbitrary directory creation outside the upload root (medium 5.4)
- [CVE-2026-62663](https://insights.sbomify.com/CVE-2026-62663/): Banks: Arbitrary File Read via Path Traversal in Media Filters (image/audio/video/document) (high 7.5)
- [CVE-2026-6266](https://insights.sbomify.com/CVE-2026-6266/): Aap-controller: aap-gateway: account hijacking and unauthorized access via unverified email linking (high 8.3)
- [CVE-2026-62659](https://insights.sbomify.com/CVE-2026-62659/): Authenticated users can make unauthorized changes on NETGEAR WAX333 Access Points (medium 4.3)
- [CVE-2026-62658](https://insights.sbomify.com/CVE-2026-62658/): Post-authentication Command Injection Vulnerability in certain Nighthawk RAX series models (medium 4.7)
- [CVE-2026-62657](https://insights.sbomify.com/CVE-2026-62657/): Certificate validation vulnerability in NETGEAR Gaming Router and certain Nighthawk models (medium 4.9)
- [CVE-2026-62656](https://insights.sbomify.com/CVE-2026-62656/): Post-authenticated command injection vulnerability found in certain NETGEAR RAX models (medium 5.4)
- [CVE-2026-62655](https://insights.sbomify.com/CVE-2026-62655/): A DoS vulnerability due to stack overflow exists in certain NETGEAR Orbi models (medium 5.7)
- [CVE-2026-62654](https://insights.sbomify.com/CVE-2026-62654/): Security feature bypass in Reyrolle 7SR5 (high 7.0)
- [CVE-2026-62653](https://insights.sbomify.com/CVE-2026-62653/): Memory corruption in Reyrolle 7SR5 (high 7.0)
- [CVE-2026-62652](https://insights.sbomify.com/CVE-2026-62652/): Information disclosure in Reyrolle 7SR5 (medium 6.9)
- [CVE-2026-62650](https://insights.sbomify.com/CVE-2026-62650/): Auth bypass in Reyrolle 7SR5 (high 8.7)
- [CVE-2026-6265](https://insights.sbomify.com/CVE-2026-6265/): Local Privilege Escalation in Cerberus FTP Server =< 2025.4.2 (high 7.3)
- [CVE-2026-62649](https://insights.sbomify.com/CVE-2026-62649/): Denial of service in Reyrolle 7SR5 (high 8.7)
- [CVE-2026-62648](https://insights.sbomify.com/CVE-2026-62648/): Memory corruption in Reyrolle 7SR5 (high 8.7)
- [CVE-2026-62647](https://insights.sbomify.com/CVE-2026-62647/): Weak cryptography in Reyrolle 7SR5 (critical 9.3)
- [CVE-2026-62646](https://insights.sbomify.com/CVE-2026-62646/): Weak cryptography in Reyrolle 7SR5 (critical 9.1)
- [CVE-2026-62645](https://insights.sbomify.com/CVE-2026-62645/): Auth bypass in Reyrolle 7SR5 (critical 9.3)
- [CVE-2026-62644](https://insights.sbomify.com/CVE-2026-62644/): Auth bypass in Webmail (medium 6.4)
- [CVE-2026-62643](https://insights.sbomify.com/CVE-2026-62643/): Server-side request forgery in Webmail (high 7.2)
- [CVE-2026-62642](https://insights.sbomify.com/CVE-2026-62642/): Denial of service in Webmail (medium 4.3)
- [CVE-2026-62641](https://insights.sbomify.com/CVE-2026-62641/): Denial of service in Webmail (medium 4.3)
- [CVE-2026-62640](https://insights.sbomify.com/CVE-2026-62640/): Missing authorization in Oracle Reports Developer (critical 9.8)
- [CVE-2026-6264](https://insights.sbomify.com/CVE-2026-6264/): Critical Security fix for the Talend JobServer and Talend Runtime (critical 9.8)
- [CVE-2026-62639](https://insights.sbomify.com/CVE-2026-62639/): Missing authorization in Oracle Reports Developer (critical 9.8)
- [CVE-2026-62638](https://insights.sbomify.com/CVE-2026-62638/): Missing authorization in Oracle Reports Developer (critical 9.1)
- [CVE-2026-62637](https://insights.sbomify.com/CVE-2026-62637/): Missing authorization in Oracle Reports Developer (critical 9.3)
- [CVE-2026-62636](https://insights.sbomify.com/CVE-2026-62636/): Missing authorization in Oracle Reports Developer (high 8.6)
- [CVE-2026-62635](https://insights.sbomify.com/CVE-2026-62635/): Missing authorization in Oracle Reports Developer (critical 9.8)
- [CVE-2026-62634](https://insights.sbomify.com/CVE-2026-62634/): Missing authorization in Oracle Reports Developer (critical 9.8)
- [CVE-2026-62633](https://insights.sbomify.com/CVE-2026-62633/): Missing authorization in Oracle Reports Developer (critical 9.8)
- [CVE-2026-62632](https://insights.sbomify.com/CVE-2026-62632/): Missing authorization in Oracle Reports Developer (critical 9.8)
- [CVE-2026-62631](https://insights.sbomify.com/CVE-2026-62631/): Missing authorization in Oracle Reports Developer (high 8.8)
- [CVE-2026-62630](https://insights.sbomify.com/CVE-2026-62630/): Missing authorization in Oracle Reports Developer (critical 9.8)
- [CVE-2026-62629](https://insights.sbomify.com/CVE-2026-62629/): Missing authorization in Oracle Reports Developer (critical 9.4)
- [CVE-2026-62628](https://insights.sbomify.com/CVE-2026-62628/): Missing authorization in Oracle Reports Developer (high 8.6)
- [CVE-2026-62627](https://insights.sbomify.com/CVE-2026-62627/): Missing authorization in Oracle Reports Developer (high 7.1)
- [CVE-2026-62626](https://insights.sbomify.com/CVE-2026-62626/): Missing authorization in Oracle Reports Developer (critical 9.8)
- [CVE-2026-62625](https://insights.sbomify.com/CVE-2026-62625/): Missing authorization in Oracle Reports Developer (high 8.6)
- [CVE-2026-62624](https://insights.sbomify.com/CVE-2026-62624/): Missing authorization in Oracle Reports Developer (critical 9.8)
- [CVE-2026-62623](https://insights.sbomify.com/CVE-2026-62623/): Missing authorization in Oracle Reports Developer (high 8.8)
- [CVE-2026-62622](https://insights.sbomify.com/CVE-2026-62622/): Missing authorization in Oracle Reports Developer (critical 9.8)
- [CVE-2026-62621](https://insights.sbomify.com/CVE-2026-62621/): Missing authorization in Oracle Reports Developer (critical 9.8)
- [CVE-2026-62620](https://insights.sbomify.com/CVE-2026-62620/): Missing authorization in Oracle Reports Developer (high 8.6)
- [CVE-2026-6262](https://insights.sbomify.com/CVE-2026-6262/): Betheme <= 28.4 - Authenticated (Contributor+) Arbitrary File Deletion via 'mfn-icon-upload' (medium 6.5)
- [CVE-2026-62619](https://insights.sbomify.com/CVE-2026-62619/): Missing authorization in Oracle Reports Developer (high 8.8)
- [CVE-2026-62618](https://insights.sbomify.com/CVE-2026-62618/): Missing authorization in Oracle Reports Developer (critical 9.3)
- [CVE-2026-62617](https://insights.sbomify.com/CVE-2026-62617/): Missing authorization in Oracle Reports Developer (critical 9.8)
- [CVE-2026-62616](https://insights.sbomify.com/CVE-2026-62616/): Missing authorization in Oracle Reports Developer (high 7.2)
- [CVE-2026-62615](https://insights.sbomify.com/CVE-2026-62615/): Missing authorization in Oracle Reports Developer (high 8.5)
- [CVE-2026-62614](https://insights.sbomify.com/CVE-2026-62614/): Missing authorization in Oracle Reports Developer (critical 9.8)
- [CVE-2026-62613](https://insights.sbomify.com/CVE-2026-62613/): Missing authorization in Oracle Reports Developer (critical 9.3)
- [CVE-2026-62612](https://insights.sbomify.com/CVE-2026-62612/): Missing authorization in Oracle Reports Developer (high 8.8)
- [CVE-2026-62611](https://insights.sbomify.com/CVE-2026-62611/): Missing authorization in Oracle Reports Developer (critical 9.8)
- [CVE-2026-62610](https://insights.sbomify.com/CVE-2026-62610/): Missing authorization in Oracle Reports Developer (critical 9.1)
- [CVE-2026-6261](https://insights.sbomify.com/CVE-2026-6261/): Betheme <= 28.4 - Authenticated (Author+) Arbitrary File Upload to Remote Code Execution via Icon Pack Upload (high 8.8)
- [CVE-2026-62609](https://insights.sbomify.com/CVE-2026-62609/): Missing authorization in Oracle Reports Developer (critical 9.8)
- [CVE-2026-62608](https://insights.sbomify.com/CVE-2026-62608/): Missing authorization in Oracle Reports Developer (critical 9.9)
- [CVE-2026-62607](https://insights.sbomify.com/CVE-2026-62607/): Missing authorization in Oracle Customer Care (high 8.7)
- [CVE-2026-62606](https://insights.sbomify.com/CVE-2026-62606/): Missing authorization in Oracle Hyperion Calculation Manager (low 3.1)
- [CVE-2026-62605](https://insights.sbomify.com/CVE-2026-62605/): Missing authorization in Oracle Partner Management (high 8.2)
- [CVE-2026-62604](https://insights.sbomify.com/CVE-2026-62604/): Missing authorization in Oracle Hyperion Calculation Manager (low 3.1)
- [CVE-2026-62603](https://insights.sbomify.com/CVE-2026-62603/): Missing authorization in Oracle Hyperion Calculation Manager (medium 5.4)
- [CVE-2026-62602](https://insights.sbomify.com/CVE-2026-62602/): Missing authorization in Oracle Hyperion Calculation Manager (high 8.0)
- [CVE-2026-62601](https://insights.sbomify.com/CVE-2026-62601/): Missing authorization in Oracle Sales (high 7.1)
- [CVE-2026-62600](https://insights.sbomify.com/CVE-2026-62600/): Missing authorization in Oracle Sales (high 8.1)
- [CVE-2026-62599](https://insights.sbomify.com/CVE-2026-62599/): Missing authorization in Oracle Trading Community (high 8.6)
- [CVE-2026-62598](https://insights.sbomify.com/CVE-2026-62598/): Missing authorization in Oracle Hyperion Calculation Manager (high 8.2)
- [CVE-2026-62597](https://insights.sbomify.com/CVE-2026-62597/): Missing authorization in Oracle Enterprise Manager Base Platform (medium 6.5)
- [CVE-2026-62596](https://insights.sbomify.com/CVE-2026-62596/): Missing authorization in Siebel CRM Integration (high 8.5)
- [CVE-2026-62595](https://insights.sbomify.com/CVE-2026-62595/): Missing authorization in Siebel CRM Integration (high 8.1)
- [CVE-2026-62594](https://insights.sbomify.com/CVE-2026-62594/): Missing authorization in Siebel CRM Integration (high 7.7)
- [CVE-2026-62593](https://insights.sbomify.com/CVE-2026-62593/): Missing authorization in Siebel CRM Integration (high 7.7)
- [CVE-2026-62592](https://insights.sbomify.com/CVE-2026-62592/): Missing authorization in Siebel CRM Integration (critical 9.8)
- [CVE-2026-62591](https://insights.sbomify.com/CVE-2026-62591/): Missing authorization in Siebel CRM Integration (high 8.1)
- [CVE-2026-62590](https://insights.sbomify.com/CVE-2026-62590/): Missing authorization in Siebel CRM Integration (high 8.5)
- [CVE-2026-62589](https://insights.sbomify.com/CVE-2026-62589/): Missing authorization in Siebel CRM Integration (high 8.7)
- [CVE-2026-62588](https://insights.sbomify.com/CVE-2026-62588/): Missing authorization in Siebel CRM Integration (critical 9.9)
- [CVE-2026-62587](https://insights.sbomify.com/CVE-2026-62587/): Missing authorization in Siebel CRM Administration (high 7.1)
- [CVE-2026-62586](https://insights.sbomify.com/CVE-2026-62586/): Missing authorization in Siebel CRM Administration (high 8.6)
- [CVE-2026-62585](https://insights.sbomify.com/CVE-2026-62585/): Missing authorization in Siebel CRM Administration (critical 9.8)
- [CVE-2026-62584](https://insights.sbomify.com/CVE-2026-62584/): Missing authorization in Oracle Hyperion Infrastructure Technology (medium 4.0)
- [CVE-2026-62583](https://insights.sbomify.com/CVE-2026-62583/): Other in Oracle Hyperion Infrastructure Technology (low 3.0)
- [CVE-2026-62582](https://insights.sbomify.com/CVE-2026-62582/): Missing authorization in Oracle Hyperion Calculation Manager (critical 9.6)
- [CVE-2026-62581](https://insights.sbomify.com/CVE-2026-62581/): Missing authorization in Oracle Hyperion Infrastructure Technology (high 7.8)
- [CVE-2026-62580](https://insights.sbomify.com/CVE-2026-62580/): Missing authorization in Oracle Hyperion Calculation Manager (low 2.6)
- [CVE-2026-62579](https://insights.sbomify.com/CVE-2026-62579/): Missing authorization in Oracle Hyperion Infrastructure Technology (medium 5.3)
- [CVE-2026-62578](https://insights.sbomify.com/CVE-2026-62578/): Missing authorization in Oracle Hyperion Calculation Manager (medium 6.5)
- [CVE-2026-62577](https://insights.sbomify.com/CVE-2026-62577/): Missing authorization in Oracle Hyperion Infrastructure Technology (low 3.3)
- [CVE-2026-62576](https://insights.sbomify.com/CVE-2026-62576/): Missing authorization in Oracle Hyperion Infrastructure Technology (medium 6.5)
- [CVE-2026-62575](https://insights.sbomify.com/CVE-2026-62575/): Missing authorization in Oracle Hyperion Infrastructure Technology (medium 4.7)
- [CVE-2026-62574](https://insights.sbomify.com/CVE-2026-62574/): Privilege escalation in Oracle GraalVM Enterprise Edition (high 7.8)
- [CVE-2026-62573](https://insights.sbomify.com/CVE-2026-62573/): Missing authorization in Oracle Hyperion Infrastructure Technology (medium 5.5)
- [CVE-2026-62572](https://insights.sbomify.com/CVE-2026-62572/): Missing authorization in Oracle Hyperion Infrastructure Technology (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/485/