# Vulnerabilities published in 2026


- [CVE-2026-21675](https://insights.sbomify.com/CVE-2026-21675/): iccDEV has a Use After Free vulnerability in CIccCmm class via improper hint manager object deletion (critical 9.8)
- [CVE-2026-21674](https://insights.sbomify.com/CVE-2026-21674/): iccDEV has a Memory Leak in its CIccProfileXml::ParseTag() Error Path (low 3.3)
- [CVE-2026-21673](https://insights.sbomify.com/CVE-2026-21673/): iccDEV has Integer Overflow/Underflow in CIccXmlArrayType::ParseTextCountNum() (high 7.8)
- [CVE-2026-21672](https://insights.sbomify.com/CVE-2026-21672/): Privilege escalation in Backup and Replication (high 8.8)
- [CVE-2026-21671](https://insights.sbomify.com/CVE-2026-21671/): Code injection in Software Appliance (critical 9.1)
- [CVE-2026-21670](https://insights.sbomify.com/CVE-2026-21670/): Information disclosure in Backup and Replication (high 7.7)
- [CVE-2026-2167](https://insights.sbomify.com/CVE-2026-2167/): Totolink WA300 cstecgi.cgi setAPNetwork os command injection (medium 5.3)
- [CVE-2026-21669](https://insights.sbomify.com/CVE-2026-21669/): Code injection in Backup and Replication (critical 10.0)
- [CVE-2026-21668](https://insights.sbomify.com/CVE-2026-21668/): Missing authorization in Backup and Replication (high 8.8)
- [CVE-2026-21667](https://insights.sbomify.com/CVE-2026-21667/): Missing authorization in Backup and Replication (critical 10.0)
- [CVE-2026-21666](https://insights.sbomify.com/CVE-2026-21666/): Missing authorization in Backup and Replication (critical 10.0)
- [CVE-2026-21665](https://insights.sbomify.com/CVE-2026-21665/): Deserialization in Originate Loans Peripherals (formerly Velocity Services) -- Print Service component (high 7.7)
- [CVE-2026-21664](https://insights.sbomify.com/CVE-2026-21664/): Cross-site scripting in Revive Adserver (medium 6.1)
- [CVE-2026-21663](https://insights.sbomify.com/CVE-2026-21663/): Cross-site scripting in Revive Adserver (medium 6.1)
- [CVE-2026-21662](https://insights.sbomify.com/CVE-2026-21662/): FMS Employee Allows Upload of Unrestricted Files (medium 4.8)
- [CVE-2026-21661](https://insights.sbomify.com/CVE-2026-21661/): AC2000 Uncontrolled Search Path Element (high 8.4)
- [CVE-2026-21660](https://insights.sbomify.com/CVE-2026-21660/): Johnson Controls-Frick Quantum HD-Hardcoded Email Credentials Saved as Plaintext in Firmware (medium 6.9)
- [CVE-2026-2166](https://insights.sbomify.com/CVE-2026-2166/): code-projects Online Reviewer System Login index.php sql injection (medium 6.9)
- [CVE-2026-21659](https://insights.sbomify.com/CVE-2026-21659/): Path traversal in Frick Controls Quantum HD (high 8.7)
- [CVE-2026-21658](https://insights.sbomify.com/CVE-2026-21658/): Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution (high 8.8)
- [CVE-2026-21657](https://insights.sbomify.com/CVE-2026-21657/): Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution (high 8.8)
- [CVE-2026-21656](https://insights.sbomify.com/CVE-2026-21656/): Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution (high 8.8)
- [CVE-2026-21655](https://insights.sbomify.com/CVE-2026-21655/): C-CURE 9000 and Victor application server - Deserialization of Untrusted Data (high 8.7)
- [CVE-2026-21654](https://insights.sbomify.com/CVE-2026-21654/): Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution (high 8.8)
- [CVE-2026-21653](https://insights.sbomify.com/CVE-2026-21653/): CCure and Victor Application Server - Server Side Request Forgery (high 7.2)
- [CVE-2026-2165](https://insights.sbomify.com/CVE-2026-2165/): detronetdip E-commerce Account Creation Endpoint add_seller.php missing authentication (medium 6.9)
- [CVE-2026-21643](https://insights.sbomify.com/CVE-2026-21643/): Fortinet FortiClient EMS SQL Injection (critical 9.1, exploited in the wild)
- [CVE-2026-21642](https://insights.sbomify.com/CVE-2026-21642/): Cross-site scripting in Revive Adserver (medium 6.1)
- [CVE-2026-21641](https://insights.sbomify.com/CVE-2026-21641/): Missing authorization in Revive Adserver (high 7.1)
- [CVE-2026-21640](https://insights.sbomify.com/CVE-2026-21640/): Code injection in Revive Adserver (low 2.7)
- [CVE-2026-2164](https://insights.sbomify.com/CVE-2026-2164/): detronetdip E-commerce addadhar.php unrestricted upload (medium 6.9)
- [CVE-2026-21639](https://insights.sbomify.com/CVE-2026-21639/): Command injection in airFiber AF60 (high 8.8)
- [CVE-2026-21638](https://insights.sbomify.com/CVE-2026-21638/): Command injection in UBB (high 8.8)
- [CVE-2026-21637](https://insights.sbomify.com/CVE-2026-21637/): Denial of service in node (medium 5.9)
- [CVE-2026-21636](https://insights.sbomify.com/CVE-2026-21636/): Security feature bypass in node (medium 5.8)
- [CVE-2026-21635](https://insights.sbomify.com/CVE-2026-21635/): Missing authorization in UniFi Connect EV Station Lite (medium 5.3)
- [CVE-2026-21634](https://insights.sbomify.com/CVE-2026-21634/): Memory corruption in UniFi Protect Application (medium 6.5)
- [CVE-2026-21633](https://insights.sbomify.com/CVE-2026-21633/): Auth bypass in UniFi Protect Application (high 8.8)
- [CVE-2026-21632](https://insights.sbomify.com/CVE-2026-21632/): Joomla! Core - [20260304] - XSS vectors in various article title outputs (medium 5.9)
- [CVE-2026-21631](https://insights.sbomify.com/CVE-2026-21631/): Joomla! Core - [20260303] - XSS vector in com_associations comparison view (medium 5.9)
- [CVE-2026-21630](https://insights.sbomify.com/CVE-2026-21630/): Joomla! Core - [20260302] - SQL injection in com_content articles webservice endpoint (medium 6.9)
- [CVE-2026-2163](https://insights.sbomify.com/CVE-2026-2163/): D-Link DIR-600 ssdp.cgi command injection (medium 5.1)
- [CVE-2026-21629](https://insights.sbomify.com/CVE-2026-21629/): Joomla! Core - [20260301] - ACL hardening in com_ajax (medium 6.3)
- [CVE-2026-21628](https://insights.sbomify.com/CVE-2026-21628/): Extension - astroidframe.work - Unauthenticated Remote Code Execution in Astroid Framework 2.0.0 - 3.3.10 for Joomla (critical 10.0)
- [CVE-2026-21627](https://insights.sbomify.com/CVE-2026-21627/): Missing authorization in Advanced Custom Fields (critical 9.5)
- [CVE-2026-21626](https://insights.sbomify.com/CVE-2026-21626/): Extension - stackideas.com - Information disclosure in post custom fields in EasyDiscuss 1.0.0-5.0.15 for Joomla (critical 9.2)
- [CVE-2026-21625](https://insights.sbomify.com/CVE-2026-21625/): Extension - stackideas.com - Lack of mime type validation in EasyDiscuss component 1.0.0-5.0.15 for Joomla (medium 4.8)
- [CVE-2026-21624](https://insights.sbomify.com/CVE-2026-21624/): Extension - stackideas.com - Persistent XSS in EasyDiscuss component 1.0.0-5.0.15 for Joomla (critical 9.4)
- [CVE-2026-21623](https://insights.sbomify.com/CVE-2026-21623/): Extension - stackideas.com - Persistent XSS in EasyDiscuss component 1.0.0-5.0.15 for Joomla (critical 9.4)
- [CVE-2026-21622](https://insights.sbomify.com/CVE-2026-21622/): Password Reset Tokens Do Not Expire (critical 9.5)
- [CVE-2026-21621](https://insights.sbomify.com/CVE-2026-21621/): Improper Scope Enforcement in OAuth client_credentials Flow Allows Read-Only API Key to Escalate to Full Access (high 7.0)
- [CVE-2026-21620](https://insights.sbomify.com/CVE-2026-21620/): TFTP Path Traversal (low 2.3)
- [CVE-2026-2162](https://insights.sbomify.com/CVE-2026-2162/): itsourcecode News Portal Project aboutus.php sql injection (medium 5.1)
- [CVE-2026-21619](https://insights.sbomify.com/CVE-2026-21619/): Unsafe Deserialization of Erlang Terms in hex_core (low 2.0)
- [CVE-2026-21618](https://insights.sbomify.com/CVE-2026-21618/): Cross-site scripting (XSS) in OAuth Device Authorization screen (high 8.5)
- [CVE-2026-2161](https://insights.sbomify.com/CVE-2026-2161/): itsourcecode Directory Management System forget-password.php sql injection (medium 6.9)
- [CVE-2026-2160](https://insights.sbomify.com/CVE-2026-2160/): SourceCodester Simple Responsive Tourism Website Master.php cross site scripting (medium 5.3)
- [CVE-2026-2159](https://insights.sbomify.com/CVE-2026-2159/): SourceCodester Simple Responsive Tourism Website Registration Master.php cross site scripting (medium 5.3)
- [CVE-2026-21589](https://insights.sbomify.com/CVE-2026-21589/): Atlassian Multiple Products Files or Directories Accessible to External Parties (critical 9.3, exploited in the wild)
- [CVE-2026-21588](https://insights.sbomify.com/CVE-2026-21588/): Denial of service in Confluence Data Center (high 7.1)
- [CVE-2026-21587](https://insights.sbomify.com/CVE-2026-21587/): Missing authorization in Jira Service Management Data Center (high 7.1)
- [CVE-2026-21586](https://insights.sbomify.com/CVE-2026-21586/): Missing authorization in Confluence Data Center (high 7.1)
- [CVE-2026-21584](https://insights.sbomify.com/CVE-2026-21584/): Missing authorization in Bamboo Data Center (high 7.6)
- [CVE-2026-21582](https://insights.sbomify.com/CVE-2026-21582/): Auth bypass in Crowd Data Center (high 8.8)
- [CVE-2026-21580](https://insights.sbomify.com/CVE-2026-21580/): Cross-site scripting in Confluence Data Center (high 8.6)
- [CVE-2026-2158](https://insights.sbomify.com/CVE-2026-2158/): code-projects Student Web Portal check_user.php sql injection (medium 6.9)
- [CVE-2026-21579](https://insights.sbomify.com/CVE-2026-21579/): Information disclosure in Confluence Data Center (high 8.2)
- [CVE-2026-21577](https://insights.sbomify.com/CVE-2026-21577/): Denial of service in Confluence Data Center (high 7.1)
- [CVE-2026-21575](https://insights.sbomify.com/CVE-2026-21575/): Code injection in Sourcetree for Mac (high 7.1)
- [CVE-2026-21571](https://insights.sbomify.com/CVE-2026-21571/): Command injection in Bamboo Data Center (critical 9.4)
- [CVE-2026-21570](https://insights.sbomify.com/CVE-2026-21570/): Code injection in Bamboo Data Center (high 8.6)
- [CVE-2026-2157](https://insights.sbomify.com/CVE-2026-2157/): D-Link DIR-823X set_static_route_table sub_4175CC os command injection (high 8.6)
- [CVE-2026-21569](https://insights.sbomify.com/CVE-2026-21569/): XML external entity in Crowd Data Center (high 7.9)
- [CVE-2026-2156](https://insights.sbomify.com/CVE-2026-2156/): code-projects Online Student Management System Announcement Management index.php cross site scripting (medium 4.8)
- [CVE-2026-21555](https://insights.sbomify.com/CVE-2026-21555/): Denial of service in UDX710 (high 7.5)
- [CVE-2026-21554](https://insights.sbomify.com/CVE-2026-21554/): Denial of service in UDX710 (high 7.5)
- [CVE-2026-21553](https://insights.sbomify.com/CVE-2026-21553/): Denial of service in T8100/T9100/T8200/T8300 (high 7.5)
- [CVE-2026-21552](https://insights.sbomify.com/CVE-2026-21552/): Denial of service in T8100/T9100/T8200/T8300 (high 7.5)
- [CVE-2026-21551](https://insights.sbomify.com/CVE-2026-21551/): Denial of service in T8100/T9100/T8200/T8300 (high 7.5)
- [CVE-2026-21550](https://insights.sbomify.com/CVE-2026-21550/): Denial of service in T8100/T9100/T8200/T8300 (high 7.5)
- [CVE-2026-2155](https://insights.sbomify.com/CVE-2026-2155/): D-Link DIR-823X Configuration set_dmz sub_4208A0 os command injection (high 8.6)
- [CVE-2026-21549](https://insights.sbomify.com/CVE-2026-21549/): Denial of service in T8100/T9100/T8200/T8300 (high 7.5)
- [CVE-2026-21548](https://insights.sbomify.com/CVE-2026-21548/): Denial of service in T8100/T9100/T8200/T8300 (high 7.5)
- [CVE-2026-2154](https://insights.sbomify.com/CVE-2026-2154/): Cross-site scripting in Patients Waiting Area Queue Management System (medium 5.3)
- [CVE-2026-21537](https://insights.sbomify.com/CVE-2026-21537/): Microsoft Defender for Endpoint Linux Extension Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-21536](https://insights.sbomify.com/CVE-2026-21536/): Microsoft Devices Pricing Program Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-21535](https://insights.sbomify.com/CVE-2026-21535/): Microsoft Teams Information Disclosure Vulnerability (high 8.2)
- [CVE-2026-21533](https://insights.sbomify.com/CVE-2026-21533/): Microsoft Windows Improper Privilege Management (high 7.8, exploited in the wild)
- [CVE-2026-21532](https://insights.sbomify.com/CVE-2026-21532/): Azure Function Information Disclosure Vulnerability (high 8.2)
- [CVE-2026-21531](https://insights.sbomify.com/CVE-2026-21531/): Azure SDK for Python Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-21530](https://insights.sbomify.com/CVE-2026-21530/): Windows Rich Text Edit Elevation of Privilege Vulnerability (medium 6.7)
- [CVE-2026-2153](https://insights.sbomify.com/CVE-2026-2153/): mwielgoszewski doorman views.py is_safe_url redirect (medium 5.3)
- [CVE-2026-21529](https://insights.sbomify.com/CVE-2026-21529/): Azure HDInsight Spoofing Vulnerability (medium 5.7)
- [CVE-2026-21528](https://insights.sbomify.com/CVE-2026-21528/): Azure IoT Explorer Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-21527](https://insights.sbomify.com/CVE-2026-21527/): Microsoft Exchange Server Spoofing Vulnerability (medium 6.5)
- [CVE-2026-21525](https://insights.sbomify.com/CVE-2026-21525/): Microsoft Windows NULL Pointer Dereference (medium 6.2, exploited in the wild)
- [CVE-2026-21524](https://insights.sbomify.com/CVE-2026-21524/): Azure Data Explorer Information Disclosure Vulnerability (high 7.4)
- [CVE-2026-21523](https://insights.sbomify.com/CVE-2026-21523/): GitHub Copilot and Visual Studio Code Remote Code Execution Vulnerability (high 8.0)
- [CVE-2026-21522](https://insights.sbomify.com/CVE-2026-21522/): Microsoft ACI Confidential Containers Elevation of Privilege Vulnerability (medium 6.7)
- [CVE-2026-21521](https://insights.sbomify.com/CVE-2026-21521/): Word Copilot Information Disclosure Vulnerability (high 7.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/805/