# Vulnerabilities published in 2026


- [CVE-2026-2007](https://insights.sbomify.com/CVE-2026-2007/): PostgreSQL pg_trgm heap buffer overflow writes pattern onto server memory (high 8.2)
- [CVE-2026-20069](https://insights.sbomify.com/CVE-2026-20069/): Cross-site scripting in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software (medium 4.3)
- [CVE-2026-20068](https://insights.sbomify.com/CVE-2026-20068/): Multiple Cisco Products Snort 3 TBD Denial of Service Vulnerability (medium 5.8)
- [CVE-2026-20067](https://insights.sbomify.com/CVE-2026-20067/): Multiple Cisco Products Snort 3 TBD Denial of Service Vulnerability (medium 5.8)
- [CVE-2026-20066](https://insights.sbomify.com/CVE-2026-20066/): Multiple Cisco Products Snort 3 TBD Denial of Service Vulnerability (medium 5.8)
- [CVE-2026-20065](https://insights.sbomify.com/CVE-2026-20065/): Multiple Cisco Products Snort 3 TBD Denial of Service Vulnerability (medium 5.8)
- [CVE-2026-20064](https://insights.sbomify.com/CVE-2026-20064/): Null dereference in Cisco Secure Firewall Threat Defense (FTD) Software (medium 6.5)
- [CVE-2026-20063](https://insights.sbomify.com/CVE-2026-20063/): Cisco Secure FTD Software Authenticated Command Injection Vulnerability (medium 6.0)
- [CVE-2026-20062](https://insights.sbomify.com/CVE-2026-20062/): Missing authorization in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software (high 7.2)
- [CVE-2026-20061](https://insights.sbomify.com/CVE-2026-20061/): Cisco Unity Connection SQL Injection Vulnerability (medium 4.3)
- [CVE-2026-20060](https://insights.sbomify.com/CVE-2026-20060/): Cisco Unity Connection Open Redirect Vulnerability (medium 4.7)
- [CVE-2026-2006](https://insights.sbomify.com/CVE-2026-2006/): PostgreSQL missing validation of multibyte character length executes arbitrary code (high 8.8)
- [CVE-2026-20059](https://insights.sbomify.com/CVE-2026-20059/): Cisco Unity Connection Reflected Cross-Site Scripting Vulnerability (medium 6.1)
- [CVE-2026-20058](https://insights.sbomify.com/CVE-2026-20058/): Cisco Secure Firewall Threat Defense Software Snort 3 Visual Basic for Application Denial of Service Vulnerability (medium 5.8)
- [CVE-2026-20057](https://insights.sbomify.com/CVE-2026-20057/): Cisco Secure Firewall Threat Defense Software Snort 3 Visual Basic for Application Denial of Service Vulnerability (medium 5.8)
- [CVE-2026-20056](https://insights.sbomify.com/CVE-2026-20056/): Cisco Secure Web Appliance TBD Bypass Vulnerability (medium 4.0)
- [CVE-2026-20055](https://insights.sbomify.com/CVE-2026-20055/): Cisco Packaged Contact Center Enterprise & Cisco Unified Contact Center Enterprise Cross-Site Scripting Vulnerability (medium 4.8)
- [CVE-2026-20054](https://insights.sbomify.com/CVE-2026-20054/): Denial of service in Cisco Cyber Vision (medium 5.8)
- [CVE-2026-20053](https://insights.sbomify.com/CVE-2026-20053/): Memory corruption in Cisco Cyber Vision (medium 5.8)
- [CVE-2026-20052](https://insights.sbomify.com/CVE-2026-20052/): Cisco Secure Firewall Threat Defense Software Snort 3 Memory Management Denial of Service Vulnerability (medium 5.8)
- [CVE-2026-20051](https://insights.sbomify.com/CVE-2026-20051/): Cisco Nexus 3600-R and 9500-R Series Switching Platforms Layer 2 Loop Denial of Service Vulnerability (high 7.4)
- [CVE-2026-20050](https://insights.sbomify.com/CVE-2026-20050/): Cisco Secure Firewall Threat Defense Decryption Policy Denial of Service Vulnerability (medium 6.8)
- [CVE-2026-2005](https://insights.sbomify.com/CVE-2026-2005/): PostgreSQL pgcrypto heap buffer overflow executes arbitrary code (high 8.8)
- [CVE-2026-20049](https://insights.sbomify.com/CVE-2026-20049/): Denial of service in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software (high 7.7)
- [CVE-2026-20048](https://insights.sbomify.com/CVE-2026-20048/): Cisco NX-OS Software SNMP Denial of Service Vulnerability (high 7.7)
- [CVE-2026-20047](https://insights.sbomify.com/CVE-2026-20047/): Cisco Identity Services Engine Cross-Site Scripting Vulnerability (medium 4.8)
- [CVE-2026-20046](https://insights.sbomify.com/CVE-2026-20046/): Cisco IOS XR Software CLI Privilege Escalation Vulnerability (high 8.8)
- [CVE-2026-20045](https://insights.sbomify.com/CVE-2026-20045/): Cisco Unified Communications Products Code Injection (high 8.2, exploited in the wild)
- [CVE-2026-20044](https://insights.sbomify.com/CVE-2026-20044/): Cisco Secure Firewall Management Center Command Injection Vulnerability (medium 6.0)
- [CVE-2026-20043](https://insights.sbomify.com/CVE-2026-20043/): Multiple Cisco Products Snort 3 Software Hardening Release: October 2026 (critical 9.0)
- [CVE-2026-20042](https://insights.sbomify.com/CVE-2026-20042/): Cisco Nexus Dashboard Configuration REST API Unauthorized Access Vulnerability (medium 6.5)
- [CVE-2026-20041](https://insights.sbomify.com/CVE-2026-20041/): Cisco Nexus Dashboard Server Side Request Forgery Vulnerability (medium 6.1)
- [CVE-2026-20040](https://insights.sbomify.com/CVE-2026-20040/): Cisco IOS XR Software CLI Privilege Escalation Vulnerability (high 8.8)
- [CVE-2026-2004](https://insights.sbomify.com/CVE-2026-2004/): PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code (high 8.8)
- [CVE-2026-20039](https://insights.sbomify.com/CVE-2026-20039/): Denial of service in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software (high 8.6)
- [CVE-2026-20038](https://insights.sbomify.com/CVE-2026-20038/): Cisco Nexus 9000 Series Fabric Switches in ACI Mode Policy-Based Redirect Endpoint Group Contract Bypass Vulnerability (medium 5.8)
- [CVE-2026-20037](https://insights.sbomify.com/CVE-2026-20037/): Cisco UCS Manager File Write Vulnerability (medium 4.4)
- [CVE-2026-20036](https://insights.sbomify.com/CVE-2026-20036/): Cisco UCS Manager Software Command Injection Vulnerability (medium 6.5)
- [CVE-2026-20035](https://insights.sbomify.com/CVE-2026-20035/): Cisco Unity Connection Server-Side Request Forgery Vulnerability (high 7.2)
- [CVE-2026-20034](https://insights.sbomify.com/CVE-2026-20034/): Cisco Unity Connection Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-20033](https://insights.sbomify.com/CVE-2026-20033/): Cisco NX-OS Software Denial of Service Vulnerability (high 7.4)
- [CVE-2026-20032](https://insights.sbomify.com/CVE-2026-20032/): Cisco NX-OS Software Python Sandbox Escape Vulnerability (medium 4.4)
- [CVE-2026-20031](https://insights.sbomify.com/CVE-2026-20031/): ClamAV CSS Image Parsing Error Handling Denial of Service Vulnerability (medium 5.3)
- [CVE-2026-20030](https://insights.sbomify.com/CVE-2026-20030/): Cisco Crosswork Security Hardening Release: August 2026 (critical 10.0)
- [CVE-2026-2003](https://insights.sbomify.com/CVE-2026-2003/): PostgreSQL oidvector discloses a few bytes of memory (medium 4.3)
- [CVE-2026-20029](https://insights.sbomify.com/CVE-2026-20029/): Cisco Identity Services Engine XML External Entity Processing Information Disclosure Vulnerability (medium 4.9)
- [CVE-2026-20028](https://insights.sbomify.com/CVE-2026-20028/): Cisco Terminal Services Agent Firewall Rules Bypass Vulnerability (medium 5.0)
- [CVE-2026-20027](https://insights.sbomify.com/CVE-2026-20027/): Cisco Snort DCERPC Stub Data Out of Bounds Read (medium 5.3)
- [CVE-2026-20026](https://insights.sbomify.com/CVE-2026-20026/): Multiple Cisco Products Snort 3 DCERPC Vulnerabilities (medium 5.8)
- [CVE-2026-20025](https://insights.sbomify.com/CVE-2026-20025/): Integer overflow in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software (medium 6.8)
- [CVE-2026-20024](https://insights.sbomify.com/CVE-2026-20024/): Memory corruption in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software (medium 6.8)
- [CVE-2026-20023](https://insights.sbomify.com/CVE-2026-20023/): Memory corruption in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software (medium 6.1)
- [CVE-2026-20022](https://insights.sbomify.com/CVE-2026-20022/): Memory corruption in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software (medium 6.1)
- [CVE-2026-20021](https://insights.sbomify.com/CVE-2026-20021/): Denial of service in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software (medium 4.3)
- [CVE-2026-20020](https://insights.sbomify.com/CVE-2026-20020/): Memory corruption in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software (medium 6.8)
- [CVE-2026-2002](https://insights.sbomify.com/CVE-2026-2002/): Cross-site scripting in Forminator Forms – Contact Form, Payment Form & Custom Form Builder (medium 4.4)
- [CVE-2026-20019](https://insights.sbomify.com/CVE-2026-20019/): Multiple Cisco Products Snort 3 Netflow Denial of Service Vulnerabilities (medium 5.8)
- [CVE-2026-20018](https://insights.sbomify.com/CVE-2026-20018/): Cisco Firepower Management Center Software and Firepower Threat Defense Path Traversal Vulnerability (medium 5.9)
- [CVE-2026-20017](https://insights.sbomify.com/CVE-2026-20017/): Cisco Secure FTD Software Authenticated Command Injection Vulnerability (medium 6.0)
- [CVE-2026-20016](https://insights.sbomify.com/CVE-2026-20016/): Command injection in Cisco Secure Firewall Threat Defense (FTD) Software (medium 6.0)
- [CVE-2026-20015](https://insights.sbomify.com/CVE-2026-20015/): Denial of service in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software (medium 5.8)
- [CVE-2026-20014](https://insights.sbomify.com/CVE-2026-20014/): Denial of service in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software (high 7.7)
- [CVE-2026-20013](https://insights.sbomify.com/CVE-2026-20013/): Denial of service in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software (medium 5.8)
- [CVE-2026-20012](https://insights.sbomify.com/CVE-2026-20012/): Denial of service in Cisco IOS XE Software (high 8.6)
- [CVE-2026-20011](https://insights.sbomify.com/CVE-2026-20011/): Multiple Cisco Products Snort 3 SMTP MIME Denial of Service Vulnerability (medium 5.8)
- [CVE-2026-20010](https://insights.sbomify.com/CVE-2026-20010/): Cisco Nexus 3000 and 9000 Series Switches Link Layer Discovery Protocol Denial of Service Vulnerability (high 7.4)
- [CVE-2026-2001](https://insights.sbomify.com/CVE-2026-2001/): WowRevenue <= 2.1.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation (high 8.8)
- [CVE-2026-20009](https://insights.sbomify.com/CVE-2026-20009/): Cisco Secure Firewall Adaptive Security Appliance SSH Partial Private Key Authentication Bypass Vulnerability (medium 5.3)
- [CVE-2026-20008](https://insights.sbomify.com/CVE-2026-20008/): Code injection in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software (medium 6.0)
- [CVE-2026-20007](https://insights.sbomify.com/CVE-2026-20007/): Cisco Secure Firewall Threat Defense Software Snort Deep Inspection Bypass Vulnerability (medium 5.8)
- [CVE-2026-20006](https://insights.sbomify.com/CVE-2026-20006/): Cisco Firepower Threat Defense Software and Cisco FirePOWER Services TLS with Snort 3 Denial of Service Vulnerability (medium 5.8)
- [CVE-2026-20005](https://insights.sbomify.com/CVE-2026-20005/): Denial of service in Cisco Cyber Vision (medium 5.8)
- [CVE-2026-20004](https://insights.sbomify.com/CVE-2026-20004/): Denial of service in Cisco IOS XE Software (high 7.4)
- [CVE-2026-20003](https://insights.sbomify.com/CVE-2026-20003/): SQL injection in Cisco Secure Firewall Management Center (FMC) (medium 4.9)
- [CVE-2026-20002](https://insights.sbomify.com/CVE-2026-20002/): SQL injection in Cisco Secure Firewall Management Center (FMC) (high 8.1)
- [CVE-2026-20001](https://insights.sbomify.com/CVE-2026-20001/): Cisco Secure Firewall Management Center Software SQL Injection Vulnerabilities (medium 6.5)
- [CVE-2026-20000](https://insights.sbomify.com/CVE-2026-20000/): itsourcecode Hospital Management System viewprescriptionrecord.php sql injection (medium 5.3)
- [CVE-2026-2000](https://insights.sbomify.com/CVE-2026-2000/): DCN DCME-320 Web Management Backend bridge_cfg.php apply_config command injection (medium 5.1)
- [CVE-2026-19999](https://insights.sbomify.com/CVE-2026-19999/): Memory corruption in Assimp (medium 5.3)
- [CVE-2026-19998](https://insights.sbomify.com/CVE-2026-19998/): code-projects Online Shopping System offersmail.php cross site scripting (medium 5.3)
- [CVE-2026-19997](https://insights.sbomify.com/CVE-2026-19997/): Webkul Bagisto Backend Sales RMA Endpoint requests authorization (medium 5.1)
- [CVE-2026-19996](https://insights.sbomify.com/CVE-2026-19996/): Webkul Bagisto Backend Customer Behavior Data Endpoint customers privileges management (medium 5.3)
- [CVE-2026-19995](https://insights.sbomify.com/CVE-2026-19995/): Webkul Bagisto RMA Message send-message cross site scripting (medium 5.1)
- [CVE-2026-19994](https://insights.sbomify.com/CVE-2026-19994/): Webkul Bagisto Configuration Management execute authorization (medium 5.3)
- [CVE-2026-19993](https://insights.sbomify.com/CVE-2026-19993/): Webkul Bagisto RMA State Validation update-status behavioral workflow (medium 5.3)
- [CVE-2026-19992](https://insights.sbomify.com/CVE-2026-19992/): Orange View Limited DualSafe Password Manager & Digital Vault Extension postMessage-based Bridge information disclosure (low 2.3)
- [CVE-2026-19991](https://insights.sbomify.com/CVE-2026-19991/): UsersWP <= 1.2.70 - Authenticated (Subscriber+) Arbitrary File Deletion (high 8.1)
- [CVE-2026-1999](https://insights.sbomify.com/CVE-2026-1999/): Missing authorization in Enterprise Server (high 7.1)
- [CVE-2026-19988](https://insights.sbomify.com/CVE-2026-19988/): Alaev SEO Tools Extension Popup UI popup.html addDiv cross site scripting (medium 5.3)
- [CVE-2026-19987](https://insights.sbomify.com/CVE-2026-19987/): SourceCodester Best Employee Management System Profile exposure of information through directory listing (medium 6.9)
- [CVE-2026-19986](https://insights.sbomify.com/CVE-2026-19986/): Adblock for Youtube Extension Event Listener contentscript.js updateDynamicRules improper authorization (medium 5.3)
- [CVE-2026-19985](https://insights.sbomify.com/CVE-2026-19985/): Relevanssi <= 4.28.1 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2026-19984](https://insights.sbomify.com/CVE-2026-19984/): jkawamoto mcp-florence2 __init__.py get_images server-side request forgery (medium 5.3)
- [CVE-2026-19983](https://insights.sbomify.com/CVE-2026-19983/): GL.iNet XE3000 NAS Command Service gl_nas_sys os command injection (medium 6.9)
- [CVE-2026-19982](https://insights.sbomify.com/CVE-2026-19982/): GL.iNet BE9300/MT6000 Firewall-management RPC os command injection (medium 5.3)
- [CVE-2026-19981](https://insights.sbomify.com/CVE-2026-19981/): GL.iNet XE3000 Wi-Fi Timer Power-Schedule Feature os command injection (medium 5.3)
- [CVE-2026-19980](https://insights.sbomify.com/CVE-2026-19980/): GL.iNet XE3000 Language Update ui.update_langs code injection (medium 5.3)
- [CVE-2026-1998](https://insights.sbomify.com/CVE-2026-1998/): micropython runtime.c mp_import_all memory corruption (medium 4.8)
- [CVE-2026-19979](https://insights.sbomify.com/CVE-2026-19979/): GL.iNet XE3000 WebDAV Service MOVE authorization (medium 6.9)
- [CVE-2026-19978](https://insights.sbomify.com/CVE-2026-19978/): jiantao88 android-mcp-server Command Execution index.js child_process.exec os command injection (medium 4.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/819/