# Vulnerabilities published in 2026


- [CVE-2026-20269](https://insights.sbomify.com/CVE-2026-20269/): Cisco IOS XE Software Security Hardening Release (high 8.6)
- [CVE-2026-20268](https://insights.sbomify.com/CVE-2026-20268/): Cisco IOS XE Software Security Hardening Release (high 8.6)
- [CVE-2026-20267](https://insights.sbomify.com/CVE-2026-20267/): Cisco IOS XE Software Security Hardening Release (critical 9.0)
- [CVE-2026-20266](https://insights.sbomify.com/CVE-2026-20266/): OS Command Injection in the btool Configuration Helper in Splunk AI Toolkit (critical 9.1)
- [CVE-2026-20265](https://insights.sbomify.com/CVE-2026-20265/): Insecure Default Domain Allowlist in Splunk AI Toolkit (medium 4.3)
- [CVE-2026-20263](https://insights.sbomify.com/CVE-2026-20263/): Cisco IOS XE Software Blocks Extensible Exchange Protocol Denial of Service Vulnerability (high 8.6)
- [CVE-2026-20262](https://insights.sbomify.com/CVE-2026-20262/): Cisco Catalyst SD-WAN Manager Directory or Path Traversal (medium 6.5, exploited in the wild)
- [CVE-2026-20260](https://insights.sbomify.com/CVE-2026-20260/): Log Injection through HTTP Request Paths in Splunk SOAR (medium 4.3)
- [CVE-2026-2026](https://insights.sbomify.com/CVE-2026-2026/): Improper Access Control Allows Denial of Service (medium 5.4)
- [CVE-2026-20259](https://insights.sbomify.com/CVE-2026-20259/): Improper Access Control in Splunk Enterprise (medium 5.5)
- [CVE-2026-20258](https://insights.sbomify.com/CVE-2026-20258/): Stored Cross-Site Scripting (XSS) through Classic Dashboard in Splunk Enterprise (high 7.1)
- [CVE-2026-20257](https://insights.sbomify.com/CVE-2026-20257/): Improper Input Validation through Classic Dashboard CSS in Splunk Enterprise (medium 5.7)
- [CVE-2026-20256](https://insights.sbomify.com/CVE-2026-20256/): Improper Input Validation through Protocol-Relative URL in Classic Dashboards in Splunk Enterprise (medium 5.7)
- [CVE-2026-20255](https://insights.sbomify.com/CVE-2026-20255/): Improper Input Validation through Classic Dashboards in Splunk Enterprise (medium 5.7)
- [CVE-2026-20254](https://insights.sbomify.com/CVE-2026-20254/): Information Disclosure through External Content Restriction Bypass in Splunk Enterprise (medium 5.7)
- [CVE-2026-20253](https://insights.sbomify.com/CVE-2026-20253/): Splunk Enterprise Missing Authentication for Critical Function (critical 9.8, exploited in the wild)
- [CVE-2026-20252](https://insights.sbomify.com/CVE-2026-20252/): Server-Side Request Forgery (SSRF) through Dashboard Studio PDF Export in Splunk Enterprise (high 7.6)
- [CVE-2026-20251](https://insights.sbomify.com/CVE-2026-20251/): Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway (high 8.8)
- [CVE-2026-20250](https://insights.sbomify.com/CVE-2026-20250/): Denial of service in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software (high 8.6)
- [CVE-2026-2025](https://insights.sbomify.com/CVE-2026-2025/): Mail Mint < 1.19.5 - Unauthenticated Emails Disclosure (high 7.5)
- [CVE-2026-20249](https://insights.sbomify.com/CVE-2026-20249/): Denial of service in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software (high 8.6)
- [CVE-2026-20248](https://insights.sbomify.com/CVE-2026-20248/): Denial of service in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software (medium 6.8)
- [CVE-2026-20247](https://insights.sbomify.com/CVE-2026-20247/): Cisco Identity Services Engine Unauthenticated SQL Injection Vulnerability (high 7.5)
- [CVE-2026-20246](https://insights.sbomify.com/CVE-2026-20246/): Cisco Umbrella Virtual Appliance Privilege Escalation Vulnerability (medium 6.0)
- [CVE-2026-20245](https://insights.sbomify.com/CVE-2026-20245/): Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output (high 7.8, exploited in the wild)
- [CVE-2026-20244](https://insights.sbomify.com/CVE-2026-20244/): ClamAV DMG File Processing Denial of Service Vulnerability (high 7.5)
- [CVE-2026-20243](https://insights.sbomify.com/CVE-2026-20243/): ClamAV ALZ Archive Processing Denial of Service Vulnerability (high 7.5)
- [CVE-2026-20242](https://insights.sbomify.com/CVE-2026-20242/): Cisco Secure Firewall Management Center Software Java Deserialization Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-20240](https://insights.sbomify.com/CVE-2026-20240/): Denial of Service through coldToFrozen.sh Script in Splunk Enterprise (high 7.1)
- [CVE-2026-2024](https://insights.sbomify.com/CVE-2026-2024/): PhotoStack Gallery <= 0.4.1 - Unauthenticated SQL Injection via 'postid' Parameter (high 7.5)
- [CVE-2026-20239](https://insights.sbomify.com/CVE-2026-20239/): Sensitive Information Disclosure through Log Files in Splunk Enterprise (high 7.5)
- [CVE-2026-20238](https://insights.sbomify.com/CVE-2026-20238/): Improper Access Control through Role Inheritance in Splunk AI Toolkit app (medium 6.5)
- [CVE-2026-20237](https://insights.sbomify.com/CVE-2026-20237/): Cisco Identity Services Engine Hardening Release - Input Validation Vulnerabilities (critical 9.1)
- [CVE-2026-20236](https://insights.sbomify.com/CVE-2026-20236/): Multiple Cisco Products Snort 3 Software Hardening Release: October 2026 (high 7.5)
- [CVE-2026-20235](https://insights.sbomify.com/CVE-2026-20235/): Cisco Identity Services Engine Information Disclosure Vulnerability (medium 4.9)
- [CVE-2026-20234](https://insights.sbomify.com/CVE-2026-20234/): Cisco Identity Services Engine Hardening Release - Insuffiencently Protected Credential Vulnerabilities (critical 9.9)
- [CVE-2026-20233](https://insights.sbomify.com/CVE-2026-20233/): Cisco Webex Meetings Cross-Site Scripting Vulnerability (medium 6.1)
- [CVE-2026-20232](https://insights.sbomify.com/CVE-2026-20232/): Cisco Industrial Ethernet 1000 Series Switches Stored Cross-Site Scripting Vulnerability (medium 5.4)
- [CVE-2026-20231](https://insights.sbomify.com/CVE-2026-20231/): Other in Cisco Secure Workload (critical 9.9)
- [CVE-2026-20230](https://insights.sbomify.com/CVE-2026-20230/): Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) (high 8.6, exploited in the wild)
- [CVE-2026-2023](https://insights.sbomify.com/CVE-2026-2023/): WP Plugin Info Card <= 6.2.0 - Cross-Site Request Forgery to Arbitrary Custom Plugin Entry Creation (medium 4.3)
- [CVE-2026-20224](https://insights.sbomify.com/CVE-2026-20224/): Cisco Catalyst SD-WAN Manager XML External Entity Injection Vulnerability (high 8.6)
- [CVE-2026-20223](https://insights.sbomify.com/CVE-2026-20223/): Cisco Secure Workload Unauthorized API Access Vulnerability (critical 10.0)
- [CVE-2026-20222](https://insights.sbomify.com/CVE-2026-20222/): Denial of service in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software (high 7.4)
- [CVE-2026-20221](https://insights.sbomify.com/CVE-2026-20221/): Multiple Cisco Products Snort 3 Generic Routing Encapsulation Denial of Service Vulnerabilities (medium 5.8)
- [CVE-2026-20220](https://insights.sbomify.com/CVE-2026-20220/): Cisco Crosswork Network Controller Remote Code Execution Vulnerability (medium 6.3)
- [CVE-2026-2022](https://insights.sbomify.com/CVE-2026-2022/): Smart Forms <= 2.6.99 - Missing Authorization to Authenticated (Subscriber+) Campaign Data Exposure (medium 4.3)
- [CVE-2026-20219](https://insights.sbomify.com/CVE-2026-20219/): Missing authorization in Cisco Slido (medium 5.4)
- [CVE-2026-20218](https://insights.sbomify.com/CVE-2026-20218/): Memory corruption in Cisco Open Source Snort3 (medium 5.8)
- [CVE-2026-20217](https://insights.sbomify.com/CVE-2026-20217/): ClamAV PESpin File Format Processing Out-of-Bounds Memory Corruption Vulnerability (high 7.5)
- [CVE-2026-20216](https://insights.sbomify.com/CVE-2026-20216/): ClamAV InstallShield File Format Processing Resource Exhaustion Vulnerability (high 7.5)
- [CVE-2026-20215](https://insights.sbomify.com/CVE-2026-20215/): ClamAV 7Zip File Format Processing Out-of-Bounds Memory Corruption Vulnerability (high 7.5)
- [CVE-2026-20214](https://insights.sbomify.com/CVE-2026-20214/): ClamAV FSG File Format Processing Out-of-Bounds Memory Corruption Vulnerability (high 7.5)
- [CVE-2026-20213](https://insights.sbomify.com/CVE-2026-20213/): ClamAV PE File Format Processing Out-of-Bounds Memory Corruption Vulnerability (high 7.5)
- [CVE-2026-20212](https://insights.sbomify.com/CVE-2026-20212/): Cisco Nexus 3000 and 9000 Series Switches Silicon One Hardware Abstraction Layer Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-20211](https://insights.sbomify.com/CVE-2026-20211/): Cisco Identity Services Engine Remote Code Execution Vulnerability (critical 9.1)
- [CVE-2026-20210](https://insights.sbomify.com/CVE-2026-20210/): Cisco Catalyst SD-WAN Manager Privilege Escalation Vulnerability (medium 5.4)
- [CVE-2026-2021](https://insights.sbomify.com/CVE-2026-2021/): Cross-site scripting in Slideshow Gallery LITE (medium 6.4)
- [CVE-2026-20209](https://insights.sbomify.com/CVE-2026-20209/): Cisco Catalyst SD-WAN Manager Privilege Escalation Vulnerability (medium 5.4)
- [CVE-2026-20206](https://insights.sbomify.com/CVE-2026-20206/): Cisco ThousandEyes BrowserBot Command Injection Vulnerability (medium 6.3)
- [CVE-2026-20205](https://insights.sbomify.com/CVE-2026-20205/): Sensitive Information Disclosure in ''_internal'' index in Splunk MCP Server app (high 7.2)
- [CVE-2026-20204](https://insights.sbomify.com/CVE-2026-20204/): Improper Handling and Insufficient Isolation of Specific Temporary Files in Splunk Enterprise (high 7.1)
- [CVE-2026-20203](https://insights.sbomify.com/CVE-2026-20203/): Improper Access Control in Data Model Acceleration in Splunk Enterprise (medium 4.3)
- [CVE-2026-20202](https://insights.sbomify.com/CVE-2026-20202/): Improper Input Validation during User Account Creation in Splunk Enterprise (medium 6.6)
- [CVE-2026-20200](https://insights.sbomify.com/CVE-2026-20200/): Cisco Integrated Management Controller Argument Injection and Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-2020](https://insights.sbomify.com/CVE-2026-2020/): JS Archive List <= 6.1.7 - Authenticated (Contributor+) PHP Object Injection via 'included' Shortcode Attribute (high 7.5)
- [CVE-2026-20199](https://insights.sbomify.com/CVE-2026-20199/): Command injection in Cisco ThousandEyes Enterprise Agent (medium 4.7)
- [CVE-2026-20198](https://insights.sbomify.com/CVE-2026-20198/): Cisco Integrated Management Controller Cross-Site Scripting Vulnerability (medium 4.8)
- [CVE-2026-20197](https://insights.sbomify.com/CVE-2026-20197/): Multiple Cisco Products Snort 3 Teredo Protocol Denial of Service Vulnerability (medium 5.8)
- [CVE-2026-20195](https://insights.sbomify.com/CVE-2026-20195/): Cisco Identity Services Engine Observable Response Discrepancy Vulnerability (medium 5.3)
- [CVE-2026-20194](https://insights.sbomify.com/CVE-2026-20194/): Cisco Identity Services Engine Hardening Release - Incorrect Resource Transfer Vulnerabilities (critical 9.1)
- [CVE-2026-20193](https://insights.sbomify.com/CVE-2026-20193/): Cisco Identity Services Engine Authentication Bypass Vulnerability (medium 4.3)
- [CVE-2026-20192](https://insights.sbomify.com/CVE-2026-20192/): Cisco Identity Services Engine Hardening Release - Access Control Vulnerabilities (critical 10.0)
- [CVE-2026-20191](https://insights.sbomify.com/CVE-2026-20191/): Cisco Catalyst Center Arbitrary File Read Vulnerability (high 7.5)
- [CVE-2026-20190](https://insights.sbomify.com/CVE-2026-20190/): Cisco Identity Services Engine Information Disclosure Vulnerability (high 7.5)
- [CVE-2026-2019](https://insights.sbomify.com/CVE-2026-2019/): Cart All In One For WooCommerce <= 1.1.21 - Authenticated (Administrator+) Code Injection via 'sc_assign_page' Setting (high 7.2)
- [CVE-2026-20189](https://insights.sbomify.com/CVE-2026-20189/): Cisco Prime Infrastructure Information Disclosure Vulnerability (medium 4.3)
- [CVE-2026-20188](https://insights.sbomify.com/CVE-2026-20188/): Cisco Crosswork Network Controller and Cisco Network Services Orchestrator Advisory (not scored)
- [CVE-2026-20187](https://insights.sbomify.com/CVE-2026-20187/): Cisco RoomOS Security Hardening Release - Exceptional Conditions Handling Vulnerabilities (high 7.5)
- [CVE-2026-20186](https://insights.sbomify.com/CVE-2026-20186/): Cisco Identity Services Engine Multiple Authenticated Remote Code Execution Vulnerability (critical 9.9)
- [CVE-2026-20185](https://insights.sbomify.com/CVE-2026-20185/): Cisco SG350 and SG350X Series Managed Switches SNMP Denial of Service Vunerability (high 7.7)
- [CVE-2026-20184](https://insights.sbomify.com/CVE-2026-20184/): Cisco Webex Meetings Certificate Validation Vulnerability (critical 9.8)
- [CVE-2026-20182](https://insights.sbomify.com/CVE-2026-20182/): Cisco Catalyst SD-WAN Controller Authentication Bypass (critical 10.0, exploited in the wild)
- [CVE-2026-20181](https://insights.sbomify.com/CVE-2026-20181/): Cisco Identity Services Engine Remote Code Execution Vulnerability (critical 9.1)
- [CVE-2026-20180](https://insights.sbomify.com/CVE-2026-20180/): Cisco Identity Services Engine Multiple Remote Code Execution Vulnerability (critical 9.9)
- [CVE-2026-2018](https://insights.sbomify.com/CVE-2026-2018/): itsourcecode School Management System controller.php sql injection (medium 6.9)
- [CVE-2026-20179](https://insights.sbomify.com/CVE-2026-20179/): Multiple Cisco Products Snort 3 Generic Routing Encapsulation Denial of Service Vulnerabilities (medium 5.8)
- [CVE-2026-20178](https://insights.sbomify.com/CVE-2026-20178/): Open redirect in Cisco Webex App (medium 4.3)
- [CVE-2026-20177](https://insights.sbomify.com/CVE-2026-20177/): Cisco Industrial Ethernet 1000 Series Switches Denial of Service Vulnerability (medium 5.3)
- [CVE-2026-20176](https://insights.sbomify.com/CVE-2026-20176/): Cisco Identity Services Engine Remote Code Execution Vulnerability (critical 9.1)
- [CVE-2026-20175](https://insights.sbomify.com/CVE-2026-20175/): Cisco Finesse File Inclusion Vulnerability (medium 6.1)
- [CVE-2026-20174](https://insights.sbomify.com/CVE-2026-20174/): Cisco Nexus Dashboard Insights Arbitrary File Write Vulnerability (medium 4.9)
- [CVE-2026-20173](https://insights.sbomify.com/CVE-2026-20173/): Cisco NX-OS Software Denial of Service Vulnerability (medium 5.8)
- [CVE-2026-20172](https://insights.sbomify.com/CVE-2026-20172/): Cisco Enterprise Chat and Email Lite Agent File Upload Vulnerability (medium 4.3)
- [CVE-2026-20171](https://insights.sbomify.com/CVE-2026-20171/): Cisco Nexus 3000 and 9000 Series Border Gateway Protocol Denial of Service Vulnerability (medium 6.8)
- [CVE-2026-20170](https://insights.sbomify.com/CVE-2026-20170/): Cross-site scripting in Cisco Webex Contact Center (medium 6.1)
- [CVE-2026-2017](https://insights.sbomify.com/CVE-2026-2017/): IP-COM W30AP POST Request wx3auth R7WebsSecurityHandler stack-based overflow (critical 9.3)
- [CVE-2026-20169](https://insights.sbomify.com/CVE-2026-20169/): Cisco IoT Field Network Director Command Injection Vulnerability (medium 6.4)
- [CVE-2026-20168](https://insights.sbomify.com/CVE-2026-20168/): Cisco IoT Field Network Director Path Traversal Vulnerability (medium 6.5)
- [CVE-2026-20167](https://insights.sbomify.com/CVE-2026-20167/): Cisco IoT Field Network Director Remote Device Denial of Service Vulnerability (high 7.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/817/