# Vulnerabilities published in 2026


- [CVE-2026-20166](https://insights.sbomify.com/CVE-2026-20166/): Sensitive Information Disclosure in Discover Splunk Observability Cloud app for Splunk Enterprise (medium 5.4)
- [CVE-2026-20165](https://insights.sbomify.com/CVE-2026-20165/): Sensitive Information Disclosure in MongoClient logging channel in Splunk Enterprise (medium 6.3)
- [CVE-2026-20164](https://insights.sbomify.com/CVE-2026-20164/): Sensitive Information Disclosure through Improper Access Control in Splunk Enterprise (medium 6.5)
- [CVE-2026-20163](https://insights.sbomify.com/CVE-2026-20163/): Remote Command Execution (RCE) through the '/splunkd/__upload/indexing/preview' REST endpoint in Splunk Enterprise (high 8.0)
- [CVE-2026-20162](https://insights.sbomify.com/CVE-2026-20162/): Stored Cross-Site Scripting (XSS) through Path Traversal in Splunk Enterprise (medium 6.3)
- [CVE-2026-20161](https://insights.sbomify.com/CVE-2026-20161/): Cisco ThousandEyes Enterprise Agent Arbitrary File Overwrite Vulnerability (medium 5.5)
- [CVE-2026-20160](https://insights.sbomify.com/CVE-2026-20160/): Cisco Smart Software Manager On-Prem Arbitrary Command Execution Vulnerability (critical 9.8)
- [CVE-2026-2016](https://insights.sbomify.com/CVE-2026-2016/): happyfish100 libfastcommon base64.c base64_decode stack-based overflow (medium 4.8)
- [CVE-2026-20158](https://insights.sbomify.com/CVE-2026-20158/): Cisco RoomOS Security Hardening Release - Resource Lifetime Management Vulnerabilities (high 7.5)
- [CVE-2026-20157](https://insights.sbomify.com/CVE-2026-20157/): Cisco RoomOS Security Hardening Release - Missing Encryption Vulnerabilities (high 7.5)
- [CVE-2026-20156](https://insights.sbomify.com/CVE-2026-20156/): Cisco RoomOS Security Hardening Release - Buffer Management Vulnerabilities (high 8.1)
- [CVE-2026-20155](https://insights.sbomify.com/CVE-2026-20155/): Cisco Evolved Programmable Network Manager Improper Authorization Vulnerability (high 8.0)
- [CVE-2026-20154](https://insights.sbomify.com/CVE-2026-20154/): Denial of service in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software (high 8.6)
- [CVE-2026-20153](https://insights.sbomify.com/CVE-2026-20153/): Cisco RoomOS Security Hardening Release - Input Validation Vulnerabilities (high 7.5)
- [CVE-2026-20152](https://insights.sbomify.com/CVE-2026-20152/): Cisco Secure Web Appliance Authentication Service Traffic Bypass Vulnerability (medium 5.3)
- [CVE-2026-20151](https://insights.sbomify.com/CVE-2026-20151/): Cisco Smart Software Manager On-Prem Privilege Escalation Vulnerability (high 7.3)
- [CVE-2026-20150](https://insights.sbomify.com/CVE-2026-20150/): Cisco RoomOS Security Hardening Release - Access Control Vulnerabilities (high 8.8)
- [CVE-2026-2015](https://insights.sbomify.com/CVE-2026-2015/): Portabilis i-Educar Final Status Import FinalStatusImportService.php improper authorization (medium 5.3)
- [CVE-2026-20149](https://insights.sbomify.com/CVE-2026-20149/): Cross-site scripting in Cisco Webex Meetings (medium 6.1)
- [CVE-2026-20148](https://insights.sbomify.com/CVE-2026-20148/): Cisco Identity Services Engine Path Traversal Vulnerability (medium 4.9)
- [CVE-2026-20147](https://insights.sbomify.com/CVE-2026-20147/): Cisco Identity Services Engine Remote Code Execution Vulnerability (critical 9.9)
- [CVE-2026-20146](https://insights.sbomify.com/CVE-2026-20146/): Cisco Identity Services Engine Path Traversal Vulnerability (medium 5.5)
- [CVE-2026-20144](https://insights.sbomify.com/CVE-2026-20144/): Sensitive Information Disclosure in ''_internal'' index in Splunk Enterprise (medium 6.8)
- [CVE-2026-20142](https://insights.sbomify.com/CVE-2026-20142/): Sensitive Information Disclosure in "_internal" index in Splunk Enterprise (medium 6.8)
- [CVE-2026-20141](https://insights.sbomify.com/CVE-2026-20141/): Improper Access Control in Splunk Monitoring Console App (medium 4.3)
- [CVE-2026-2014](https://insights.sbomify.com/CVE-2026-2014/): itsourcecode Student Management System index.php sql injection (medium 6.9)
- [CVE-2026-20139](https://insights.sbomify.com/CVE-2026-20139/): Denial of service in Splunk Cloud Platform (medium 4.3)
- [CVE-2026-20138](https://insights.sbomify.com/CVE-2026-20138/): Sensitive Information Disclosure in "_internal" index in Splunk Enterprise (medium 6.8)
- [CVE-2026-20137](https://insights.sbomify.com/CVE-2026-20137/): Risky Commands Safeguards Bypass through preloaded Data Models due to Path Traversal vulnerability in Splunk Enterprise (low 3.5)
- [CVE-2026-20136](https://insights.sbomify.com/CVE-2026-20136/): Cisco Identity Services Engine Authenticated Privilege Escalation Vulnerability (medium 6.0)
- [CVE-2026-20135](https://insights.sbomify.com/CVE-2026-20135/): Cisco Secure Firewall Threat Defense Software TLS 1.3 Denial of Service Vulnerability (high 8.6)
- [CVE-2026-20133](https://insights.sbomify.com/CVE-2026-20133/): Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor (medium 6.5, exploited in the wild)
- [CVE-2026-20132](https://insights.sbomify.com/CVE-2026-20132/): Cisco Identity Services Engine Multiple Cross-Site Scripting Vulnerabilities (medium 4.8)
- [CVE-2026-20131](https://insights.sbomify.com/CVE-2026-20131/): Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data (critical 10.0, exploited in the wild)
- [CVE-2026-20130](https://insights.sbomify.com/CVE-2026-20130/): Cisco Identity Services Engine Hardening Release - Improper Neutralization Vulnerabilities (critical 10.0)
- [CVE-2026-2013](https://insights.sbomify.com/CVE-2026-2013/): itsourcecode Student Management System index.php sql injection (medium 6.9)
- [CVE-2026-20129](https://insights.sbomify.com/CVE-2026-20129/): Cisco Catayst SD-WAN Authentication Bypass Vulnerability (critical 9.8)
- [CVE-2026-20128](https://insights.sbomify.com/CVE-2026-20128/): Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format (high 7.5, exploited in the wild)
- [CVE-2026-20127](https://insights.sbomify.com/CVE-2026-20127/): Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass (critical 10.0, exploited in the wild)
- [CVE-2026-20126](https://insights.sbomify.com/CVE-2026-20126/): Cisco Catalyst SD-WAN Manager Privilege Escalation Vulnerability (high 8.8)
- [CVE-2026-20125](https://insights.sbomify.com/CVE-2026-20125/): Denial of service in Cisco IOS XE Software (high 7.7)
- [CVE-2026-20124](https://insights.sbomify.com/CVE-2026-20124/): Cisco IOS XE Software SNMP Denial of Service Vulnerability (high 7.7)
- [CVE-2026-20123](https://insights.sbomify.com/CVE-2026-20123/): Cisco Prime Infrastructure and Evolved Programmable Network Manager Open Redirect Vulnerability (medium 4.3)
- [CVE-2026-20122](https://insights.sbomify.com/CVE-2026-20122/): Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs (medium 5.4, exploited in the wild)
- [CVE-2026-20121](https://insights.sbomify.com/CVE-2026-20121/): CIsco FTD Bypass Access List (medium 5.3)
- [CVE-2026-20120](https://insights.sbomify.com/CVE-2026-20120/): Cisco FTD ACL bypass vulnerability (medium 5.8)
- [CVE-2026-2012](https://insights.sbomify.com/CVE-2026-2012/): itsourcecode Student Management System index.php sql injection (medium 6.9)
- [CVE-2026-20119](https://insights.sbomify.com/CVE-2026-20119/): Cisco TelePresence Collaboration Endpoint Software and RoomOS Software Denial of Service Vulnerability (high 7.5)
- [CVE-2026-20118](https://insights.sbomify.com/CVE-2026-20118/): Cisco IOS-XR NCS 5500 and NCS 5700 Egress Packet Network Interfaces Aligner Interrupt Denial of Service Vulnerability (medium 6.8)
- [CVE-2026-20117](https://insights.sbomify.com/CVE-2026-20117/): Multiple Cisco Contact Center Products Cross-Site Scripting Vulnerabilities (medium 6.1)
- [CVE-2026-20116](https://insights.sbomify.com/CVE-2026-20116/): Multiple Cisco Contact Center Products Cross-Site Scripting Vulnerabilities (medium 6.1)
- [CVE-2026-20115](https://insights.sbomify.com/CVE-2026-20115/): Information disclosure in Cisco IOS XE Software (medium 6.1)
- [CVE-2026-20114](https://insights.sbomify.com/CVE-2026-20114/): Privilege escalation in Cisco IOS XE Software (medium 5.4)
- [CVE-2026-20113](https://insights.sbomify.com/CVE-2026-20113/): Other in Cisco IOS XE Software (medium 5.3)
- [CVE-2026-20112](https://insights.sbomify.com/CVE-2026-20112/): Cross-site scripting in Cisco IOS XE Software (medium 4.8)
- [CVE-2026-20111](https://insights.sbomify.com/CVE-2026-20111/): Cisco Prime Infrastructure Stored Cross-Site Scripting Vulnerability (medium 4.8)
- [CVE-2026-20110](https://insights.sbomify.com/CVE-2026-20110/): Privilege escalation in Cisco IOS XE Software (medium 6.5)
- [CVE-2026-2011](https://insights.sbomify.com/CVE-2026-2011/): itsourcecode Student Management System controller.php sql injection (medium 6.9)
- [CVE-2026-20109](https://insights.sbomify.com/CVE-2026-20109/): Cisco Packaged Contact Center Enterprise and Cisco Unified Contact Center Enterprise Cross-Site Scripting Vulnerability (medium 4.8)
- [CVE-2026-20108](https://insights.sbomify.com/CVE-2026-20108/): Cross-site scripting in Cisco Catalyst SD-WAN Manager (medium 5.4)
- [CVE-2026-20107](https://insights.sbomify.com/CVE-2026-20107/): Cisco Application Policy Infrastructure Controller Denial of Service Vulnerability (medium 5.5)
- [CVE-2026-20106](https://insights.sbomify.com/CVE-2026-20106/): Denial of service in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software (medium 5.3)
- [CVE-2026-20105](https://insights.sbomify.com/CVE-2026-20105/): Denial of service in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software (high 7.7)
- [CVE-2026-20104](https://insights.sbomify.com/CVE-2026-20104/): Security feature bypass in Cisco IOS XE Software (medium 6.1)
- [CVE-2026-20103](https://insights.sbomify.com/CVE-2026-20103/): Denial of service in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software (high 8.6)
- [CVE-2026-20102](https://insights.sbomify.com/CVE-2026-20102/): Cross-site scripting in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software (medium 6.1)
- [CVE-2026-20101](https://insights.sbomify.com/CVE-2026-20101/): Denial of service in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software (high 8.6)
- [CVE-2026-20100](https://insights.sbomify.com/CVE-2026-20100/): Memory corruption in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software (high 7.7)
- [CVE-2026-2010](https://insights.sbomify.com/CVE-2026-2010/): Sanluan PublicCMS Trade Payment TradePaymentService.java paid improper authorization (low 2.3)
- [CVE-2026-20099](https://insights.sbomify.com/CVE-2026-20099/): Cisco UCS Manager and FXOS Software Command Injection Vulnerability (medium 6.7)
- [CVE-2026-20098](https://insights.sbomify.com/CVE-2026-20098/): Cisco Meeting Management Arbitrary File Upload Vulnerability (high 8.8)
- [CVE-2026-20097](https://insights.sbomify.com/CVE-2026-20097/): Cisco Integrated Management Controller Remote Code Execution Vulnerability (medium 6.5)
- [CVE-2026-20096](https://insights.sbomify.com/CVE-2026-20096/): Cisco Integrated Management Controller Command Injection Vulnerability (medium 6.5)
- [CVE-2026-20095](https://insights.sbomify.com/CVE-2026-20095/): Cisco Integrated Management Controller Command Injection Vulnerability (medium 6.5)
- [CVE-2026-20094](https://insights.sbomify.com/CVE-2026-20094/): Cisco Integrated Management Controller Command Injection Vulnerability (high 8.8)
- [CVE-2026-20093](https://insights.sbomify.com/CVE-2026-20093/): Cisco Integrated Management Controller Authentication Bypass Vulnerability (critical 9.8)
- [CVE-2026-20092](https://insights.sbomify.com/CVE-2026-20092/): Cisco Intersight Virtual Appliance Privilege Escalation Vulnerability (medium 6.0)
- [CVE-2026-20091](https://insights.sbomify.com/CVE-2026-20091/): Cisco UCS Manager and FXOS Software Stored Cross-Site Scripting Vulnerability (medium 4.8)
- [CVE-2026-20090](https://insights.sbomify.com/CVE-2026-20090/): Cisco Integrated Management Controller Cross-Site Scripting Vulnerability (medium 4.8)
- [CVE-2026-2009](https://insights.sbomify.com/CVE-2026-2009/): SourceCodester Gas Agency Management System createUser.php access control (medium 5.3)
- [CVE-2026-20089](https://insights.sbomify.com/CVE-2026-20089/): Cisco Integrated Management Controller Cross-Site Scripting Vulnerability (medium 4.8)
- [CVE-2026-20088](https://insights.sbomify.com/CVE-2026-20088/): Cisco Integrated Management Controller Cross-Site Scripting Vulnerability (medium 4.8)
- [CVE-2026-20087](https://insights.sbomify.com/CVE-2026-20087/): Cisco Integrated Management Controller Cross-Site Scripting Vulnerability (medium 4.8)
- [CVE-2026-20086](https://insights.sbomify.com/CVE-2026-20086/): Denial of service in Cisco IOS XE Software (high 8.6)
- [CVE-2026-20085](https://insights.sbomify.com/CVE-2026-20085/): Cisco Integrated Management Controller Cross-Site Scripting Vulnerability (medium 6.1)
- [CVE-2026-20084](https://insights.sbomify.com/CVE-2026-20084/): Denial of service in Cisco IOS XE Software (high 8.6)
- [CVE-2026-20083](https://insights.sbomify.com/CVE-2026-20083/): Denial of service in Cisco IOS XE Software (medium 6.5)
- [CVE-2026-20082](https://insights.sbomify.com/CVE-2026-20082/): Denial of service in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software (high 8.6)
- [CVE-2026-20081](https://insights.sbomify.com/CVE-2026-20081/): Cisco Unity Connection Arbitrary File Download Vulnerability (medium 6.5)
- [CVE-2026-20080](https://insights.sbomify.com/CVE-2026-20080/): Cisco IEC6400 Edge Compute Appliance SSH Denial of Service Vulnerability (medium 5.3)
- [CVE-2026-2008](https://insights.sbomify.com/CVE-2026-2008/): abhiphile fermat-mcp eqn_chart.py eqn_chart code injection (medium 5.3)
- [CVE-2026-20079](https://insights.sbomify.com/CVE-2026-20079/): Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel (critical 10.0, exploited in the wild)
- [CVE-2026-20078](https://insights.sbomify.com/CVE-2026-20078/): Cisco Unity Connection Arbitrary File Download Vulnerability (medium 6.5)
- [CVE-2026-20076](https://insights.sbomify.com/CVE-2026-20076/): Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerability (medium 4.8)
- [CVE-2026-20075](https://insights.sbomify.com/CVE-2026-20075/): Cisco Evolved Programmable Network Manager and Cisco Prime Infrastructure Stored Cross-Site Scripting Vulnerability (medium 4.8)
- [CVE-2026-20074](https://insights.sbomify.com/CVE-2026-20074/): Cisco IOS XR Software Multi-Instance Intermediate System-to-Intermediate System Denial of Service Vulnerability (high 7.4)
- [CVE-2026-20073](https://insights.sbomify.com/CVE-2026-20073/): Security feature bypass in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software (medium 5.8)
- [CVE-2026-20072](https://insights.sbomify.com/CVE-2026-20072/): ISE information disclosure (medium 4.9)
- [CVE-2026-20071](https://insights.sbomify.com/CVE-2026-20071/): ISE 802.1x Session Hijack Vulnerability (low 3.8)
- [CVE-2026-20070](https://insights.sbomify.com/CVE-2026-20070/): Cross-site scripting in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/818/