# Vulnerabilities published in 2026


- [CVE-2026-19768](https://insights.sbomify.com/CVE-2026-19768/): Code injection in PowerShell Universal (high 8.1)
- [CVE-2026-19767](https://insights.sbomify.com/CVE-2026-19767/): itsourcecode Hospital Management System viewdoctortimings.php sql injection (medium 5.3)
- [CVE-2026-19766](https://insights.sbomify.com/CVE-2026-19766/): Authentication Bypass leads to Administrative control of adjacent network hosts in HPE Networking Fabric Composer (critical 9.6)
- [CVE-2026-19765](https://insights.sbomify.com/CVE-2026-19765/): eyaushev swagger-testcase-mcp fetch_swagger swagger-parser.ts loadSource server-side request forgery (medium 5.3)
- [CVE-2026-19764](https://insights.sbomify.com/CVE-2026-19764/): Raisecom Communication Command and Dispatch Management Platform getpwd.php sql injection (medium 6.9)
- [CVE-2026-19763](https://insights.sbomify.com/CVE-2026-19763/): DTStack Taier Cluster Creation ClusterController.java FileUtils.deleteDirectory path traversal (medium 5.1)
- [CVE-2026-19762](https://insights.sbomify.com/CVE-2026-19762/): DTStack Taier Chunk-Check Endpoint FileChunkController.java Paths.ge path traversal (medium 6.9)
- [CVE-2026-19761](https://insights.sbomify.com/CVE-2026-19761/): DTStack Taier Upload Controller UploadController.java MultipartFile.getOriginalFilename path traversal (medium 5.1)
- [CVE-2026-19760](https://insights.sbomify.com/CVE-2026-19760/): WP Fastest Cache <= 1.5.0 - Unauthenticated Stored Cross-Site Scripting via HTTP Host Header (high 7.2)
- [CVE-2026-1976](https://insights.sbomify.com/CVE-2026-1976/): Free5GC SMF SessionDeletionResponse null pointer dereference (medium 6.9)
- [CVE-2026-19759](https://insights.sbomify.com/CVE-2026-19759/): Incorrect Authorization in Application Integration allows Internal Stubby RPC Execution (critical 9.4)
- [CVE-2026-19758](https://insights.sbomify.com/CVE-2026-19758/): dromara lamp-cloud chunk-check endpoint FileChunkController.java path traversal (medium 6.9)
- [CVE-2026-19757](https://insights.sbomify.com/CVE-2026-19757/): Dromara lamp-cloud File-Upload Controller FileAnyoneController.java path traversal (medium 6.9)
- [CVE-2026-19756](https://insights.sbomify.com/CVE-2026-19756/): Dromara lamp-cloud Code Generator DefGenProjectController.java path traversal (medium 5.3)
- [CVE-2026-19755](https://insights.sbomify.com/CVE-2026-19755/): NoSleep 1.5.1 - Unauthorized disclosure of root-owned files through privileged XPC helper (medium 6.9)
- [CVE-2026-19754](https://insights.sbomify.com/CVE-2026-19754/): Baserow 2.2.0 through 2.3.3 - SQL injection in formula index() JSONB array extraction (high 8.6)
- [CVE-2026-19753](https://insights.sbomify.com/CVE-2026-19753/): Model Context Protocol mcp-rdf-explorer MCP Server server.py explore_url server-side request forgery (medium 6.9)
- [CVE-2026-19752](https://insights.sbomify.com/CVE-2026-19752/): EnzoVezzaro mcp-dominican-layer PDF Parsing index.ts parse-pdf server-side request forgery (medium 5.3)
- [CVE-2026-19751](https://insights.sbomify.com/CVE-2026-19751/): EnzoVezzaro mcp-dominican-layer parse-csv tool index.ts axios.get server-side request forgery (medium 5.3)
- [CVE-2026-19750](https://insights.sbomify.com/CVE-2026-19750/): Tenda CH/CP/TX3 SSH hard-coded password (critical 9.2)
- [CVE-2026-1975](https://insights.sbomify.com/CVE-2026-1975/): Free5GC pfcp_reports.go identityTriggerType null pointer dereference (medium 6.9)
- [CVE-2026-19749](https://insights.sbomify.com/CVE-2026-19749/): Tenda CH7 RTSP/ONVIF missing authentication (medium 6.3)
- [CVE-2026-19748](https://insights.sbomify.com/CVE-2026-19748/): Tenda CH7 Kylin Web Service CWebSessionManager_ParseSession entropy (medium 6.3)
- [CVE-2026-19747](https://insights.sbomify.com/CVE-2026-19747/): Tenda CH7 ATE Module Kylin HandleCmd command injection (critical 9.3)
- [CVE-2026-19746](https://insights.sbomify.com/CVE-2026-19746/): Calix GigaSpire traceroute.cmd denial of service (medium 5.3)
- [CVE-2026-19745](https://insights.sbomify.com/CVE-2026-19745/): Calix GigaSpire Web Management utilities_configurationsave.cgi denial of service (medium 5.3)
- [CVE-2026-19744](https://insights.sbomify.com/CVE-2026-19744/): Stored Cross-site Scripting in Pentestify Markdown renderer via unescaped quotes (medium 5.1)
- [CVE-2026-19743](https://insights.sbomify.com/CVE-2026-19743/): Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in TeamViewer Desktop Clients (high 7.8)
- [CVE-2026-19742](https://insights.sbomify.com/CVE-2026-19742/): IPv6 stable and temporary interface identifiers derived from a non-cryptographic PRNG secret key (low 3.7)
- [CVE-2026-19741](https://insights.sbomify.com/CVE-2026-19741/): OpenThread joiner autostart uses a publicly documented default Joining Device Credential (PSKd) (high 7.5)
- [CVE-2026-19740](https://insights.sbomify.com/CVE-2026-19740/): Bluetooth LE Controller: retained RX node leak and reachable assertion in the PHY Update procedure (medium 6.5)
- [CVE-2026-1974](https://insights.sbomify.com/CVE-2026-1974/): Free5GC SMF datapath.go ResolveNodeIdToIp denial of service (medium 6.9)
- [CVE-2026-19739](https://insights.sbomify.com/CVE-2026-19739/): Bluetooth LE controller leaks a retained RX node when an unexpected LL Control PDU arrives during a Connection Update (medium 6.5)
- [CVE-2026-19738](https://insights.sbomify.com/CVE-2026-19738/): Retained RX node leak and reachable assertion in Bluetooth Controller CIS Create procedures (medium 6.5)
- [CVE-2026-19737](https://insights.sbomify.com/CVE-2026-19737/): NULL pointer dereference in the ESP32 I2S driver when triggering an unsupported direction (medium 5.5)
- [CVE-2026-19736](https://insights.sbomify.com/CVE-2026-19736/): Out-of-bounds write in the NXP MCUX TRNG entropy driver for non-word-multiple request lengths (high 7.8)
- [CVE-2026-19735](https://insights.sbomify.com/CVE-2026-19735/): Predictable TCP initial sequence numbers when the RFC 6528 secret key generation fails silently in the Zephyr TCP stack (medium 4.8)
- [CVE-2026-19734](https://insights.sbomify.com/CVE-2026-19734/): IDOR in Prospero Flow CRM allows cross-tenant product disclosure and hijacking (high 8.6)
- [CVE-2026-19733](https://insights.sbomify.com/CVE-2026-19733/): SSRF in Yordam Informatics's Library Automation System (medium 5.3)
- [CVE-2026-19730](https://insights.sbomify.com/CVE-2026-19730/): Podman: podman: quadlet install --replace non-truncating write retains removed host-access directives (medium 4.2)
- [CVE-2026-1973](https://insights.sbomify.com/CVE-2026-1973/): Free5GC SMF establishPfcpSession null pointer dereference (medium 6.9)
- [CVE-2026-19729](https://insights.sbomify.com/CVE-2026-19729/): Keycloak-services: keycloak-services: incomplete fix for arbitrary filesystem path probing via keystore parameters (medium 4.9)
- [CVE-2026-19728](https://insights.sbomify.com/CVE-2026-19728/): Missing authorization in Extra Product Options Builder for WooCommerce (high 7.5)
- [CVE-2026-19727](https://insights.sbomify.com/CVE-2026-19727/): HTML Injection via Improper Input Sanitization in Yordam Informatics's Library Automation System (medium 6.1)
- [CVE-2026-19726](https://insights.sbomify.com/CVE-2026-19726/): Visualizer < 4.0.7 - Contributor+ Cross-User Chart Configuration Disclosure (medium 6.5)
- [CVE-2026-19725](https://insights.sbomify.com/CVE-2026-19725/): WPvivid Backup & Migration < 0.9.131 - Unauthenticated Path Traversal via send_to_site_connect (critical 9.1)
- [CVE-2026-19723](https://insights.sbomify.com/CVE-2026-19723/): Social Media Share Buttons & Social Sharing Icons < 3.0.1 - Reflected XSS via Pin It Share Handler (high 7.1)
- [CVE-2026-19722](https://insights.sbomify.com/CVE-2026-19722/): WPvivid Backup & Migration < 0.9.133 - Admin+ Arbitrary File Write via Zip Slip in Backup Restore (medium 6.6)
- [CVE-2026-1972](https://insights.sbomify.com/CVE-2026-1972/): Edimax BR-6208AC auth_check_userpass2 default credentials (medium 6.9)
- [CVE-2026-19719](https://insights.sbomify.com/CVE-2026-19719/): Social Media Share Buttons & Social Sharing Icons < 3.0.1 - Contributor+ Stored XSS via Post Title (medium 6.8)
- [CVE-2026-19718](https://insights.sbomify.com/CVE-2026-19718/): BlogVault, MalCare and WP Remote 5.16 - 6.62 - Unauthenticated Site Takeover via Connection Key Recovery (high 8.1)
- [CVE-2026-19717](https://insights.sbomify.com/CVE-2026-19717/): CatFolders Document Gallery < 2.0.7 - Unauthenticated Attachment Disclosure via REST API (high 7.5)
- [CVE-2026-19716](https://insights.sbomify.com/CVE-2026-19716/): Stored Cross-site Scripting in Pentestify user account deletion via unescaped username (medium 5.1)
- [CVE-2026-19715](https://insights.sbomify.com/CVE-2026-19715/): WP OAuth Server < 6.3.1 - Unauthenticated OAuth Token and User Data Disclosure via Debug Log File (high 7.5)
- [CVE-2026-19714](https://insights.sbomify.com/CVE-2026-19714/): Simple JWT Login < 3.6.8 - Unauthenticated Account Takeover via Missing Google id_token Audience Validation (critical 9.1)
- [CVE-2026-19713](https://insights.sbomify.com/CVE-2026-19713/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-19712](https://insights.sbomify.com/CVE-2026-19712/): Masteriyo LMS < 2.3.3 - Instructor+ Stored XSS via Quiz Description (medium 6.1)
- [CVE-2026-19711](https://insights.sbomify.com/CVE-2026-19711/): Premium Packages – Sell Digital Products Securely < 7.0.7 - Subscriber+ Arbitrary Amount Withdrawal Request (medium 6.5)
- [CVE-2026-19710](https://insights.sbomify.com/CVE-2026-19710/): SourceCodester Simple Student Information System view_department.php sql injection (medium 6.9)
- [CVE-2026-1971](https://insights.sbomify.com/CVE-2026-1971/): Edimax BR-6288ACL wiz_WISP24gmanual.asp wiz_WISP24gmanual cross site scripting (medium 4.8)
- [CVE-2026-19709](https://insights.sbomify.com/CVE-2026-19709/): Membership For WooCommerce < 3.1.2 - Unauthenticated Member Data Disclosure via REST Consumer Secret Bypass (medium 5.3)
- [CVE-2026-19708](https://insights.sbomify.com/CVE-2026-19708/): File Manager 7.2.2 - 8.0.4 - Unauthenticated Database Backup Disclosure (medium 5.9)
- [CVE-2026-19704](https://insights.sbomify.com/CVE-2026-19704/): Comments – wpDiscuz < 7.6.66 - Unauthenticated Comment Disclosure via SQLi (medium 5.3)
- [CVE-2026-19702](https://insights.sbomify.com/CVE-2026-19702/): OS Command Injection in TÜBİTAK BİLGEM's Pardus Boot Repair (high 7.8)
- [CVE-2026-1970](https://insights.sbomify.com/CVE-2026-1970/): Edimax BR-6258n formStaDrvSetup redirect (medium 5.1)
- [CVE-2026-19699](https://insights.sbomify.com/CVE-2026-19699/): GutenKit 2.4.12 - 2.4.15 - Contributor+ Mailchimp Audience Data Disclosure (low 2.7)
- [CVE-2026-19698](https://insights.sbomify.com/CVE-2026-19698/): GutenKit < 2.5.1 - Contributor+ Stored CSS Injection (low 3.5)
- [CVE-2026-19697](https://insights.sbomify.com/CVE-2026-19697/): GutenKit < 2.5.0 - Author+ Stored XSS via SVG Upload (medium 6.8)
- [CVE-2026-19696](https://insights.sbomify.com/CVE-2026-19696/): Out-of-bounds Write in Wireshark (medium 6.6)
- [CVE-2026-19695](https://insights.sbomify.com/CVE-2026-19695/): Stack-based Buffer Overflow in Wireshark (medium 4.7)
- [CVE-2026-19694](https://insights.sbomify.com/CVE-2026-19694/): Heap-based Buffer Overflow in Wireshark (medium 4.7)
- [CVE-2026-19693](https://insights.sbomify.com/CVE-2026-19693/): extract-zip arbitrary file write outside the destination directory via a symlink at the final path component (high 8.1)
- [CVE-2026-1969](https://insights.sbomify.com/CVE-2026-1969/): ThemeREX Addons < 2.38.5 - Unauthenticated Arbitrary File Upload (medium 5.3)
- [CVE-2026-19685](https://insights.sbomify.com/CVE-2026-19685/): Security feature bypass in Red Hat Enterprise Linux 10 (high 7.1)
- [CVE-2026-19683](https://insights.sbomify.com/CVE-2026-19683/): Unencrypted Credential Transmission in Omada Gateway Dynamic DNS Authentication in Omada Gateways (medium 6.3)
- [CVE-2026-19682](https://insights.sbomify.com/CVE-2026-19682/): Command Injection (critical 9.4)
- [CVE-2026-19681](https://insights.sbomify.com/CVE-2026-19681/): Command Injection (critical 9.4)
- [CVE-2026-19680](https://insights.sbomify.com/CVE-2026-19680/): SQL Injection (high 7.1)
- [CVE-2026-19679](https://insights.sbomify.com/CVE-2026-19679/): Improper Input Validation (high 8.7)
- [CVE-2026-19678](https://insights.sbomify.com/CVE-2026-19678/): Server-Side Request Forgery (SSRF) Leading to Internal Solr Data Disclosure (high 8.7)
- [CVE-2026-19677](https://insights.sbomify.com/CVE-2026-19677/): Authentication Bypass Leading to Server-Side Command Execution (critical 9.3)
- [CVE-2026-19676](https://insights.sbomify.com/CVE-2026-19676/): Memory corruption in zephyr (high 7.8)
- [CVE-2026-19673](https://insights.sbomify.com/CVE-2026-19673/): Out-of-bounds read and net_buf length underflow in Zephyr Ethernet L2 when parsing a truncated VLAN header (high 7.1)
- [CVE-2026-19672](https://insights.sbomify.com/CVE-2026-19672/): tarfile extraction filter bypass allows creation of directories outside the destination (medium 6.3)
- [CVE-2026-19671](https://insights.sbomify.com/CVE-2026-19671/): Improper handling of highly compressed data (data amplification) in CISA Malcolm (high 7.1)
- [CVE-2026-19670](https://insights.sbomify.com/CVE-2026-19670/): Incorrect Authorization in CISA Malcolm (medium 5.3)
- [CVE-2026-19669](https://insights.sbomify.com/CVE-2026-19669/): Unbounded variable-length array in fuel gauge syscall verifiers allows kernel stack overflow from user mode (high 7.8)
- [CVE-2026-19668](https://insights.sbomify.com/CVE-2026-19668/): Resource Exhaustion via Excessive DNSSEC Cryptographic Material Matching (medium 5.3)
- [CVE-2026-19667](https://insights.sbomify.com/CVE-2026-19667/): Remote assertion failure via 16-bit length truncation in `dns_ncache_add()` (high 7.5)
- [CVE-2026-19666](https://insights.sbomify.com/CVE-2026-19666/): Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path (high 7.5)
- [CVE-2026-19662](https://insights.sbomify.com/CVE-2026-19662/): qpcache NOQNAME proof use-after-free crashes recursive resolver (medium 5.9)
- [CVE-2026-19660](https://insights.sbomify.com/CVE-2026-19660/): Divi Membership <= 2.3.0 - Unauthenticated Authentication Bypass via 'paypal_param' Parameter (critical 9.8)
- [CVE-2026-1966](https://insights.sbomify.com/CVE-2026-1966/): YugabyteDB Anywhere Exposes LDAP Credentials in Cleartext in Web UI (low 2.4)
- [CVE-2026-19658](https://insights.sbomify.com/CVE-2026-19658/): Deserialization in Give Tributes (critical 9.8)
- [CVE-2026-19657](https://insights.sbomify.com/CVE-2026-19657/): ScadaLTS Unauthenticated Reflected XSS (medium 6.1)
- [CVE-2026-19656](https://insights.sbomify.com/CVE-2026-19656/): ScadaLTS Authenticated Remote Code Execution (critical 9.9)
- [CVE-2026-19655](https://insights.sbomify.com/CVE-2026-19655/): Denial of service in EOS (high 7.1)
- [CVE-2026-19654](https://insights.sbomify.com/CVE-2026-19654/): Memory corruption in Red Hat Enterprise Linux 10 (high 7.5)
- [CVE-2026-19653](https://insights.sbomify.com/CVE-2026-19653/): Vulnerabilities in IBM AIX and PowerVM VIOS (medium 6.5)
- [CVE-2026-19652](https://insights.sbomify.com/CVE-2026-19652/): Divi Membership <= 2.2.0 - Unauthenticated Privilege Escalation via 'form_id' Parameter (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/822/