# Vulnerabilities published in 2026


- [CVE-2026-61425](https://insights.sbomify.com/CVE-2026-61425/): Joomla Extension - balbooa.com - Authentication bypass in Gridbox < 1.6.0 (critical 9.4)
- [CVE-2026-61424](https://insights.sbomify.com/CVE-2026-61424/): Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds < 3.11.2 (critical 10.0)
- [CVE-2026-61422](https://insights.sbomify.com/CVE-2026-61422/): Apache CloudStack: Authenticated pre-validation SSRF in registerTemplate (medium 4.3)
- [CVE-2026-61421](https://insights.sbomify.com/CVE-2026-61421/): Hardcoded credentials in Container Storage Modules (critical 9.8)
- [CVE-2026-6142](https://insights.sbomify.com/CVE-2026-6142/): tushar-2223 Hotel Management System roomdelete.php sql injection (medium 6.9)
- [CVE-2026-61419](https://insights.sbomify.com/CVE-2026-61419/): Missing authorization in ThinOS 10 (high 7.8)
- [CVE-2026-61413](https://insights.sbomify.com/CVE-2026-61413/): Privilege escalation in Secure Connect Gateway (SCG) Policy Manager (medium 6.8)
- [CVE-2026-61411](https://insights.sbomify.com/CVE-2026-61411/): Information disclosure in Container Storage Modules (high 7.7)
- [CVE-2026-61410](https://insights.sbomify.com/CVE-2026-61410/): Missing authorization in Secure Connect Gateway 5.0 - Appliance (critical 9.4)
- [CVE-2026-6141](https://insights.sbomify.com/CVE-2026-6141/): danielmiessler Personal_AI_Infrastructure parse_url.ts os command injection (medium 5.3)
- [CVE-2026-61409](https://insights.sbomify.com/CVE-2026-61409/): Command injection in Secure Connect Gateway (SCG) 5.0 Application (high 7.3)
- [CVE-2026-61407](https://insights.sbomify.com/CVE-2026-61407/): Privilege escalation in Watchdog Timer Driver (high 8.8)
- [CVE-2026-61400](https://insights.sbomify.com/CVE-2026-61400/): Apache CloudStack: Get and Run Diagnostics Command Injection (high 8.8)
- [CVE-2026-6140](https://insights.sbomify.com/CVE-2026-6140/): Totolink A7100RU CGI cstecgi.cgi UploadFirmwareFile os command injection (critical 9.3)
- [CVE-2026-61399](https://insights.sbomify.com/CVE-2026-61399/): Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Lock User Function in UI (medium 4.8)
- [CVE-2026-61398](https://insights.sbomify.com/CVE-2026-61398/): Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Instance Reset Password Function in UI (critical 9.1)
- [CVE-2026-61397](https://insights.sbomify.com/CVE-2026-61397/): Apache CloudStack: OAuth2 Token Cross-Request Leak (high 7.5)
- [CVE-2026-61392](https://insights.sbomify.com/CVE-2026-61392/): Information disclosure in DS-2CD Series (medium 5.3)
- [CVE-2026-61391](https://insights.sbomify.com/CVE-2026-61391/): Memory corruption in DS-2CD Series (high 7.2)
- [CVE-2026-61390](https://insights.sbomify.com/CVE-2026-61390/): Memory corruption in DS-2CD Series (high 7.7)
- [CVE-2026-6139](https://insights.sbomify.com/CVE-2026-6139/): Totolink A7100RU CGI cstecgi.cgi UploadOpenVpnCert os command injection (critical 9.3)
- [CVE-2026-61389](https://insights.sbomify.com/CVE-2026-61389/): AutomationDirect Productivity Suite Out-of-bounds Write (high 7.3)
- [CVE-2026-61387](https://insights.sbomify.com/CVE-2026-61387/): Denial of service in Eclipse Milo (medium 6.9)
- [CVE-2026-6138](https://insights.sbomify.com/CVE-2026-6138/): Totolink A7100RU CGI cstecgi.cgi setAccessDeviceCfg os command injection (critical 9.3)
- [CVE-2026-61378](https://insights.sbomify.com/CVE-2026-61378/): AutomationDirect Productivity Suite Divide By Zero (medium 6.8)
- [CVE-2026-61376](https://insights.sbomify.com/CVE-2026-61376/): Command injection in WAB-I1750-PS (high 8.6)
- [CVE-2026-61374](https://insights.sbomify.com/CVE-2026-61374/): Apache Thrift: Java TSaslTransport post-auth data-frame missing size limit (high 7.1)
- [CVE-2026-61373](https://insights.sbomify.com/CVE-2026-61373/): Apache Thrift: Java TSaslNonblockingServer pre-auth unbounded SASL frame allocation (high 8.7)
- [CVE-2026-61372](https://insights.sbomify.com/CVE-2026-61372/): Apache Jena Fuseki: Web requests using SPARQL Update can escape file restrictions (high 7.5)
- [CVE-2026-61371](https://insights.sbomify.com/CVE-2026-61371/): Microsoft AVML before 0.17.0 could follow a symlink when opening a destination output path on Unix, allowing truncation/overwrite of the symlink target. (high 7.5)
- [CVE-2026-6137](https://insights.sbomify.com/CVE-2026-6137/): Tenda F451 AdvSetWan fromAdvSetWan stack-based overflow (high 8.7)
- [CVE-2026-61368](https://insights.sbomify.com/CVE-2026-61368/): Windows Hyper-V Information Disclosure Vulnerability (medium 5.0)
- [CVE-2026-61367](https://insights.sbomify.com/CVE-2026-61367/): Windows Remote Desktop Services Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-61366](https://insights.sbomify.com/CVE-2026-61366/): Windows Network Connection Broker Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-61365](https://insights.sbomify.com/CVE-2026-61365/): Windows Remote Desktop Services Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-61364](https://insights.sbomify.com/CVE-2026-61364/): Windows Remote Desktop Services Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-61363](https://insights.sbomify.com/CVE-2026-61363/): Remote Desktop Client Remote Code Execution Vulnerability (high 7.5)
- [CVE-2026-61361](https://insights.sbomify.com/CVE-2026-61361/): Windows DHCP Client Remote Code Execution Vulnerability (high 7.0)
- [CVE-2026-61360](https://insights.sbomify.com/CVE-2026-61360/): Windows GDI Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-6136](https://insights.sbomify.com/CVE-2026-6136/): Tenda F451 L7Im frmL7ImForm stack-based overflow (high 8.7)
- [CVE-2026-61359](https://insights.sbomify.com/CVE-2026-61359/): Windows Storage Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-61358](https://insights.sbomify.com/CVE-2026-61358/): Windows Accessibility Infrastructure (ATBroker.exe) Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-61357](https://insights.sbomify.com/CVE-2026-61357/): Application Information Services Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-61356](https://insights.sbomify.com/CVE-2026-61356/): Windows Remote Desktop Services Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-61355](https://insights.sbomify.com/CVE-2026-61355/): Windows Sensor Data Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-61353](https://insights.sbomify.com/CVE-2026-61353/): Windows Telephony Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-61352](https://insights.sbomify.com/CVE-2026-61352/): Remote Desktop Client Remote Code Execution Vulnerability (high 7.5)
- [CVE-2026-61350](https://insights.sbomify.com/CVE-2026-61350/): Windows NTFS Information Disclosure Vulnerability (medium 4.6)
- [CVE-2026-6135](https://insights.sbomify.com/CVE-2026-6135/): Tenda F451 SetIpBind fromSetIpBind stack-based overflow (high 8.7)
- [CVE-2026-61349](https://insights.sbomify.com/CVE-2026-61349/): Windows Work Folder Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-61348](https://insights.sbomify.com/CVE-2026-61348/): Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-61347](https://insights.sbomify.com/CVE-2026-61347/): Windows Event Logging Service Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-61346](https://insights.sbomify.com/CVE-2026-61346/): Windows Graphics Kernel Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-61345](https://insights.sbomify.com/CVE-2026-61345/): Microsoft Remote Registry Service Denial of Service Vulnerability (medium 6.5)
- [CVE-2026-61344](https://insights.sbomify.com/CVE-2026-61344/): Superior Court of California Hearing Reminder Service unauthenticated information disclosure (medium 6.9)
- [CVE-2026-61343](https://insights.sbomify.com/CVE-2026-61343/): LibreBooking path traversal (high 8.6)
- [CVE-2026-61342](https://insights.sbomify.com/CVE-2026-61342/): Missing authorization in Oracle Hyperion Calculation Manager (medium 5.3)
- [CVE-2026-61341](https://insights.sbomify.com/CVE-2026-61341/): Missing authorization in Siebel CRM Cloud Applications (high 8.8)
- [CVE-2026-61340](https://insights.sbomify.com/CVE-2026-61340/): Missing authorization in Oracle MES for Process Manufacturing (high 8.2)
- [CVE-2026-6134](https://insights.sbomify.com/CVE-2026-6134/): Tenda F451 qossetting fromqossetting stack-based overflow (high 8.7)
- [CVE-2026-61339](https://insights.sbomify.com/CVE-2026-61339/): Missing authorization in Siebel CRM Cloud Applications (high 7.3)
- [CVE-2026-61338](https://insights.sbomify.com/CVE-2026-61338/): Missing authorization in Oracle Contracts Integration (high 8.1)
- [CVE-2026-61337](https://insights.sbomify.com/CVE-2026-61337/): Missing authorization in Oracle Lease and Finance Management (high 7.5)
- [CVE-2026-61336](https://insights.sbomify.com/CVE-2026-61336/): Privilege escalation in Oracle Lease and Finance Management (high 7.2)
- [CVE-2026-61335](https://insights.sbomify.com/CVE-2026-61335/): Missing authorization in Oracle Product Workbench (high 8.1)
- [CVE-2026-61334](https://insights.sbomify.com/CVE-2026-61334/): Missing authorization in Oracle Price Protection (high 7.1)
- [CVE-2026-61333](https://insights.sbomify.com/CVE-2026-61333/): Missing authorization in Oracle Product Workbench (high 8.1)
- [CVE-2026-61332](https://insights.sbomify.com/CVE-2026-61332/): Missing authorization in Siebel CRM Cloud Applications (high 8.7)
- [CVE-2026-61331](https://insights.sbomify.com/CVE-2026-61331/): Missing authorization in Oracle Financials Common Modules (high 7.7)
- [CVE-2026-61330](https://insights.sbomify.com/CVE-2026-61330/): Missing authorization in Siebel CRM Cloud Applications (high 8.8)
- [CVE-2026-6133](https://insights.sbomify.com/CVE-2026-6133/): Tenda F451 SafeUrlFilter fromSafeUrlFilter stack-based overflow (high 8.7)
- [CVE-2026-61329](https://insights.sbomify.com/CVE-2026-61329/): Missing authorization in Oracle Price Protection (high 8.1)
- [CVE-2026-61328](https://insights.sbomify.com/CVE-2026-61328/): Missing authorization in Oracle Cost Management (medium 6.6)
- [CVE-2026-61327](https://insights.sbomify.com/CVE-2026-61327/): Missing authorization in Oracle Bills of Material (high 8.1)
- [CVE-2026-61326](https://insights.sbomify.com/CVE-2026-61326/): Missing authorization in Siebel CRM Cloud Applications (high 8.5)
- [CVE-2026-61325](https://insights.sbomify.com/CVE-2026-61325/): Missing authorization in Oracle Advanced Benefits (high 7.6)
- [CVE-2026-61324](https://insights.sbomify.com/CVE-2026-61324/): Missing authorization in Oracle Advanced Benefits (high 7.7)
- [CVE-2026-61323](https://insights.sbomify.com/CVE-2026-61323/): Missing authorization in Oracle Advanced Benefits (medium 6.5)
- [CVE-2026-61322](https://insights.sbomify.com/CVE-2026-61322/): Auth bypass in TeleSales (high 8.8)
- [CVE-2026-61321](https://insights.sbomify.com/CVE-2026-61321/): Missing authorization in Siebel CRM Cloud Applications (high 8.1)
- [CVE-2026-61320](https://insights.sbomify.com/CVE-2026-61320/): Auth bypass in Oracle Payables (high 8.8)
- [CVE-2026-6132](https://insights.sbomify.com/CVE-2026-6132/): Totolink A7100RU CGI cstecgi.cgi setLedCfg os command injection (critical 9.3)
- [CVE-2026-61319](https://insights.sbomify.com/CVE-2026-61319/): Missing authorization in Oracle U.S. Federal Financials (high 8.8)
- [CVE-2026-61318](https://insights.sbomify.com/CVE-2026-61318/): Missing authorization in Siebel CRM Cloud Applications (critical 9.8)
- [CVE-2026-61317](https://insights.sbomify.com/CVE-2026-61317/): Missing authorization in Siebel CRM Cloud Applications (critical 9.9)
- [CVE-2026-61316](https://insights.sbomify.com/CVE-2026-61316/): Information disclosure in Oracle EDI Gateway (medium 4.3)
- [CVE-2026-61315](https://insights.sbomify.com/CVE-2026-61315/): Information disclosure in Oracle EDI Gateway (medium 4.3)
- [CVE-2026-61314](https://insights.sbomify.com/CVE-2026-61314/): Missing authorization in Oracle EDI Gateway (high 7.2)
- [CVE-2026-61313](https://insights.sbomify.com/CVE-2026-61313/): Missing authorization in Oracle Hyperion Calculation Manager (medium 6.7)
- [CVE-2026-61312](https://insights.sbomify.com/CVE-2026-61312/): Missing authorization in Oracle Product Hub (high 8.5)
- [CVE-2026-61311](https://insights.sbomify.com/CVE-2026-61311/): Auth bypass in Oracle Product Hub (high 8.8)
- [CVE-2026-61310](https://insights.sbomify.com/CVE-2026-61310/): Missing authorization in Oracle Product Hub (high 8.1)
- [CVE-2026-6131](https://insights.sbomify.com/CVE-2026-6131/): Totolink A7100RU CGI cstecgi.cgi setTracerouteCfg os command injection (critical 9.3)
- [CVE-2026-61309](https://insights.sbomify.com/CVE-2026-61309/): Missing authorization in Oracle In-Memory Cost Management for Discrete Industries (high 7.5)
- [CVE-2026-61308](https://insights.sbomify.com/CVE-2026-61308/): Missing authorization in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition (medium 6.8)
- [CVE-2026-61307](https://insights.sbomify.com/CVE-2026-61307/): Auth bypass in PeopleSoft Enterprise CC Common Application Objects (high 8.1)
- [CVE-2026-61306](https://insights.sbomify.com/CVE-2026-61306/): Missing authorization in Oracle Complex Maintenance, Repair and Overhaul (high 7.1)
- [CVE-2026-61305](https://insights.sbomify.com/CVE-2026-61305/): Missing authorization in Oracle BI Publisher (high 8.3)
- [CVE-2026-61304](https://insights.sbomify.com/CVE-2026-61304/): Missing authorization in Oracle Price Protection (medium 6.3)
- [CVE-2026-61303](https://insights.sbomify.com/CVE-2026-61303/): Information disclosure in Oracle EDI Gateway (low 1.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/495/