# Vulnerabilities published in 2026


- [CVE-2026-28630](https://insights.sbomify.com/CVE-2026-28630/): Other in Android (low 3.3)
- [CVE-2026-2863](https://insights.sbomify.com/CVE-2026-2863/): feng_ha_ha/megagao ssm-erp/production_ssm FileServiceImpl.java deleteFile path traversal (medium 5.3)
- [CVE-2026-28627](https://insights.sbomify.com/CVE-2026-28627/): Security feature bypass in Android (medium 4.3)
- [CVE-2026-28626](https://insights.sbomify.com/CVE-2026-28626/): Privilege escalation in Android (high 7.3)
- [CVE-2026-28625](https://insights.sbomify.com/CVE-2026-28625/): Privilege escalation in Android (high 7.8)
- [CVE-2026-28624](https://insights.sbomify.com/CVE-2026-28624/): Privilege escalation in Android (high 7.8)
- [CVE-2026-28623](https://insights.sbomify.com/CVE-2026-28623/): Missing authorization in Android (low 3.3)
- [CVE-2026-28622](https://insights.sbomify.com/CVE-2026-28622/): Missing authorization in Android (low 3.3)
- [CVE-2026-28620](https://insights.sbomify.com/CVE-2026-28620/): Missing authorization in Android (high 7.8)
- [CVE-2026-2862](https://insights.sbomify.com/CVE-2026-2862/): Security Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access (medium 5.3)
- [CVE-2026-28618](https://insights.sbomify.com/CVE-2026-28618/): Memory corruption in Android (high 8.8)
- [CVE-2026-28617](https://insights.sbomify.com/CVE-2026-28617/): Denial of service in Android (medium 5.5)
- [CVE-2026-28616](https://insights.sbomify.com/CVE-2026-28616/): Privilege escalation in Android (high 7.8)
- [CVE-2026-28615](https://insights.sbomify.com/CVE-2026-28615/): Missing authorization in Android (critical 10.0)
- [CVE-2026-28614](https://insights.sbomify.com/CVE-2026-28614/): Privilege escalation in Android (high 7.8)
- [CVE-2026-28613](https://insights.sbomify.com/CVE-2026-28613/): Privilege escalation in Android (high 7.3)
- [CVE-2026-28612](https://insights.sbomify.com/CVE-2026-28612/): Privilege escalation in Android (high 7.8)
- [CVE-2026-28611](https://insights.sbomify.com/CVE-2026-28611/): Missing authorization in Android (high 7.8)
- [CVE-2026-2861](https://insights.sbomify.com/CVE-2026-2861/): Foswiki Changes/Viewfile/Oops information disclosure (medium 6.9)
- [CVE-2026-28609](https://insights.sbomify.com/CVE-2026-28609/): Memory corruption in Android (high 8.8)
- [CVE-2026-28607](https://insights.sbomify.com/CVE-2026-28607/): Privilege escalation in Android (high 7.8)
- [CVE-2026-28606](https://insights.sbomify.com/CVE-2026-28606/): Auth bypass in Android (critical 9.8)
- [CVE-2026-28604](https://insights.sbomify.com/CVE-2026-28604/): Use after free in Android (high 7.5)
- [CVE-2026-28603](https://insights.sbomify.com/CVE-2026-28603/): Privilege escalation in Android (high 7.8)
- [CVE-2026-28602](https://insights.sbomify.com/CVE-2026-28602/): Privilege escalation in Android (high 7.8)
- [CVE-2026-28600](https://insights.sbomify.com/CVE-2026-28600/): Privilege escalation in Android (high 7.8)
- [CVE-2026-2860](https://insights.sbomify.com/CVE-2026-2860/): feng_ha_ha/megagao ssm-erp/production_ssm EmployeeController.java improper authorization (medium 5.3)
- [CVE-2026-28599](https://insights.sbomify.com/CVE-2026-28599/): Privilege escalation in Android (high 7.8)
- [CVE-2026-28596](https://insights.sbomify.com/CVE-2026-28596/): Denial of service in Android (medium 5.5)
- [CVE-2026-28594](https://insights.sbomify.com/CVE-2026-28594/): Use after free in Android (high 7.8)
- [CVE-2026-28593](https://insights.sbomify.com/CVE-2026-28593/): Security feature bypass in Android (high 7.8)
- [CVE-2026-28590](https://insights.sbomify.com/CVE-2026-28590/): Weak cryptography in Android (high 7.8)
- [CVE-2026-2859](https://insights.sbomify.com/CVE-2026-2859/): Unauthenticated Host Enumeration via Observable Response Discrepancy on Deploy Agent Endpoint (medium 6.3)
- [CVE-2026-28587](https://insights.sbomify.com/CVE-2026-28587/): Missing authorization in Android (critical 10.0)
- [CVE-2026-28586](https://insights.sbomify.com/CVE-2026-28586/): Missing authorization in Android (low 3.3)
- [CVE-2026-28584](https://insights.sbomify.com/CVE-2026-28584/): Business logic in Android (medium 5.5)
- [CVE-2026-28583](https://insights.sbomify.com/CVE-2026-28583/): Memory corruption in Android (high 7.8)
- [CVE-2026-28582](https://insights.sbomify.com/CVE-2026-28582/): Missing authorization in Android (low 3.3)
- [CVE-2026-28581](https://insights.sbomify.com/CVE-2026-28581/): Business logic in Android (medium 4.0)
- [CVE-2026-28580](https://insights.sbomify.com/CVE-2026-28580/): Memory corruption in Android (high 7.8)
- [CVE-2026-2858](https://insights.sbomify.com/CVE-2026-2858/): wren-lang wren Source File wren_compiler.c peekChar out-of-bounds (medium 4.8)
- [CVE-2026-28578](https://insights.sbomify.com/CVE-2026-28578/): Denial of service in Android (medium 5.5)
- [CVE-2026-28577](https://insights.sbomify.com/CVE-2026-28577/): Other in Android (high 7.8)
- [CVE-2026-28576](https://insights.sbomify.com/CVE-2026-28576/): SQL injection in Android (critical 10.0)
- [CVE-2026-28575](https://insights.sbomify.com/CVE-2026-28575/): Denial of service in Android (critical 10.0)
- [CVE-2026-28573](https://insights.sbomify.com/CVE-2026-28573/): Missing authorization in Android (critical 10.0)
- [CVE-2026-28572](https://insights.sbomify.com/CVE-2026-28572/): Other in Android (high 7.8)
- [CVE-2026-28571](https://insights.sbomify.com/CVE-2026-28571/): WordPress FormyChat plugin <= 2.15.7 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-28570](https://insights.sbomify.com/CVE-2026-28570/): WordPress Vavo Core plugin <= 2.3.0 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-2857](https://insights.sbomify.com/CVE-2026-2857/): D-Link DWR-M960 Port Forwarding Configuration Endpoint formPortFw sub_423E00 stack-based overflow (high 8.7)
- [CVE-2026-28569](https://insights.sbomify.com/CVE-2026-28569/): WordPress SSL Zen plugin <= 4.7.43 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-28568](https://insights.sbomify.com/CVE-2026-28568/): WordPress Quill Forms plugin <= 5.7.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-28567](https://insights.sbomify.com/CVE-2026-28567/): WordPress WP Sort Order plugin <= 1.3.5 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-28564](https://insights.sbomify.com/CVE-2026-28564/): Apache IoTDB: REST Basic Authentication Accepts Stale Cached Credentials (critical 9.8)
- [CVE-2026-28563](https://insights.sbomify.com/CVE-2026-28563/): Apache Airflow: DAG authorization bypass (medium 4.3)
- [CVE-2026-28562](https://insights.sbomify.com/CVE-2026-28562/): wpForo Forum 2.4.14 SQL Injection via Topics ORDER BY Parameter (high 8.8)
- [CVE-2026-28561](https://insights.sbomify.com/CVE-2026-28561/): wpForo Forum 2.4.14 Stored XSS via Unescaped Forum Description in Templates (medium 4.8)
- [CVE-2026-28560](https://insights.sbomify.com/CVE-2026-28560/): wpForo Forum 2.4.14 Stored XSS via Unsafe JSON Encoding in Inline Script (medium 4.8)
- [CVE-2026-2856](https://insights.sbomify.com/CVE-2026-2856/): D-Link DWR-M960 Filter Configuration Endpoint formFilter sub_424AFC stack-based overflow (high 8.7)
- [CVE-2026-28559](https://insights.sbomify.com/CVE-2026-28559/): wpForo Forum 2.4.14 Information Disclosure via Global RSS Feed (medium 6.9)
- [CVE-2026-28558](https://insights.sbomify.com/CVE-2026-28558/): wpForo Forum 2.4.14 Stored XSS via SVG Avatar File Upload (medium 5.1)
- [CVE-2026-28557](https://insights.sbomify.com/CVE-2026-28557/): wpForo Forum < 2.4.16 Privilege Escalation via Role Synchronization Handler (high 7.1)
- [CVE-2026-28556](https://insights.sbomify.com/CVE-2026-28556/): wpForo Forum 2.4.14 Missing Authorization via Topic Management Form Handlers (medium 5.3)
- [CVE-2026-28555](https://insights.sbomify.com/CVE-2026-28555/): wpForo Forum 2.4.14 Missing Authorization via Topic Close AJAX Handler (medium 5.3)
- [CVE-2026-28554](https://insights.sbomify.com/CVE-2026-28554/): wpForo Forum 2.4.14 Missing Authorization via Post Approval AJAX Handler (medium 5.3)
- [CVE-2026-28553](https://insights.sbomify.com/CVE-2026-28553/): Missing authorization in EMUI (medium 6.9)
- [CVE-2026-28552](https://insights.sbomify.com/CVE-2026-28552/): Memory corruption in EMUI (medium 6.5)
- [CVE-2026-28551](https://insights.sbomify.com/CVE-2026-28551/): Race condition in HarmonyOS (medium 4.7)
- [CVE-2026-28550](https://insights.sbomify.com/CVE-2026-28550/): Race condition in HarmonyOS (medium 4.0)
- [CVE-2026-2855](https://insights.sbomify.com/CVE-2026-2855/): D-Link DWR-M960 DDNS Settings formDdns sub_4648F0 stack-based overflow (high 8.7)
- [CVE-2026-28549](https://insights.sbomify.com/CVE-2026-28549/): Race condition in HarmonyOS (medium 6.6)
- [CVE-2026-28548](https://insights.sbomify.com/CVE-2026-28548/): Privilege escalation in EMUI (high 7.1)
- [CVE-2026-28547](https://insights.sbomify.com/CVE-2026-28547/): Memory corruption in HarmonyOS (medium 6.8)
- [CVE-2026-28546](https://insights.sbomify.com/CVE-2026-28546/): Memory corruption in HarmonyOS (medium 5.9)
- [CVE-2026-28545](https://insights.sbomify.com/CVE-2026-28545/): Race condition in HarmonyOS (medium 5.9)
- [CVE-2026-28544](https://insights.sbomify.com/CVE-2026-28544/): Race condition in HarmonyOS (medium 6.2)
- [CVE-2026-28543](https://insights.sbomify.com/CVE-2026-28543/): Race condition in HarmonyOS (medium 4.4)
- [CVE-2026-28542](https://insights.sbomify.com/CVE-2026-28542/): Security feature bypass in EMUI (high 7.3)
- [CVE-2026-28541](https://insights.sbomify.com/CVE-2026-28541/): Missing authorization in HarmonyOS (medium 4.0)
- [CVE-2026-28540](https://insights.sbomify.com/CVE-2026-28540/): Memory corruption in HarmonyOS (medium 4.0)
- [CVE-2026-2854](https://insights.sbomify.com/CVE-2026-2854/): D-Link DWR-M960 NTP Configuration Endpoint formNtp sub_4611CC stack-based overflow (high 8.7)
- [CVE-2026-28539](https://insights.sbomify.com/CVE-2026-28539/): Other in HarmonyOS (medium 6.2)
- [CVE-2026-28538](https://insights.sbomify.com/CVE-2026-28538/): Path traversal in HarmonyOS (medium 5.9)
- [CVE-2026-28537](https://insights.sbomify.com/CVE-2026-28537/): Memory corruption in HarmonyOS (medium 5.1)
- [CVE-2026-28536](https://insights.sbomify.com/CVE-2026-28536/): Auth bypass in HarmonyOS (critical 9.6)
- [CVE-2026-28532](https://insights.sbomify.com/CVE-2026-28532/): FRRouting < 10.5.3 Integer Overflow in OSPF TLV Parser Functions (medium 6.0)
- [CVE-2026-2853](https://insights.sbomify.com/CVE-2026-2853/): D-Link DWR-M960 System Log Configuration Endpoint formSysLog sub_462E14 stack-based overflow (high 8.7)
- [CVE-2026-28529](https://insights.sbomify.com/CVE-2026-28529/): cryptodev-linux <= 1.14 get_userbuf Use After Free LPE (high 8.5)
- [CVE-2026-28528](https://insights.sbomify.com/CVE-2026-28528/): BlueKitchen BTstack < 1.8.1 AVRCP Browsing Target GET_FOLDER_ITEMS Handler OOB Read / Undefined Behavior (low 2.1)
- [CVE-2026-28527](https://insights.sbomify.com/CVE-2026-28527/): BlueKitchen BTstack < 1.8.1 AVRCP Controller GET_PLAYER_APPLICATION_SETTING_*_TEXT Handlers OOB Read (low 2.1)
- [CVE-2026-28526](https://insights.sbomify.com/CVE-2026-28526/): BlueKitchen BTstack < 1.8.1 AVRCP Controller LIST_PLAYER_APPLICATION_SETTING_* Handlers OOB Read (low 2.1)
- [CVE-2026-28525](https://insights.sbomify.com/CVE-2026-28525/): SWUpdate Integer Underflow in Multipart Upload Parser (high 8.2)
- [CVE-2026-28522](https://insights.sbomify.com/CVE-2026-28522/): arduino-TuyaOpen WiFiUDP Null Pointer Dereference Denial of Service (high 7.1)
- [CVE-2026-28521](https://insights.sbomify.com/CVE-2026-28521/): arduino-TuyaOpen TuyaIoT Out-of-Bounds Memory Read Information Disclosure (high 7.0)
- [CVE-2026-28520](https://insights.sbomify.com/CVE-2026-28520/): arduino-TuyaOpen WiFiMulti Single-Byte Buffer Overflow Remote Code Execution (high 8.6)
- [CVE-2026-2852](https://insights.sbomify.com/CVE-2026-2852/): yeqifu warehouse Sales Endpoint SalesController.java deleteSales access control (medium 5.3)
- [CVE-2026-28519](https://insights.sbomify.com/CVE-2026-28519/): arduino-TuyaOpen DnsServer Heap-Based Buffer Overflow Remote Code Execution (high 8.7)
- [CVE-2026-28518](https://insights.sbomify.com/CVE-2026-28518/): OpenViking .ovpack Import ZIP Slip Path Traversal (high 8.4)
- [CVE-2026-28517](https://insights.sbomify.com/CVE-2026-28517/): openDCIM <= 23.04 OS Command Injection via dot Configuration Parameter (critical 9.3)
- [CVE-2026-28516](https://insights.sbomify.com/CVE-2026-28516/): openDCIM <= 23.04 SQL Injection in Config::UpdateParameter (critical 9.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/744/