# Vulnerabilities published in 2026


- [CVE-2026-19517](https://insights.sbomify.com/CVE-2026-19517/): Denial of service in rlottie (medium 6.5)
- [CVE-2026-19516](https://insights.sbomify.com/CVE-2026-19516/): CVE-2026-19516 CVE Record (critical 9.1)
- [CVE-2026-19515](https://insights.sbomify.com/CVE-2026-19515/): OS Command Injection via Unit Test Execution in WSO2 Integrator MI VS Code Extension Allows Arbitrary Command Execution (high 7.0)
- [CVE-2026-19513](https://insights.sbomify.com/CVE-2026-19513/): Gravity Forms <= 3.0.2 - Unauthenticated Arbitrary File Upload via State/Chunk Hash Confusion (high 8.1)
- [CVE-2026-1951](https://insights.sbomify.com/CVE-2026-1951/): No checking of the length of the buffer with the directory name in AS320T (critical 9.8)
- [CVE-2026-19509](https://insights.sbomify.com/CVE-2026-19509/): RDK WebUI DOS vulnerability (medium 6.5)
- [CVE-2026-19508](https://insights.sbomify.com/CVE-2026-19508/): RDK WebUI heap-based buffer overflow vulnerability (critical 9.8)
- [CVE-2026-19507](https://insights.sbomify.com/CVE-2026-19507/): RDK WebUI uncontrolled resource consumption (high 7.5)
- [CVE-2026-19506](https://insights.sbomify.com/CVE-2026-19506/): RDK-B WebUI race condition vulnerability (high 8.1)
- [CVE-2026-19505](https://insights.sbomify.com/CVE-2026-19505/): RDK-B WebUI improper cryptographic signature verification vulnerability (critical 9.8)
- [CVE-2026-19504](https://insights.sbomify.com/CVE-2026-19504/): Fabric.js loadFromJSON Server-Side Request Forgery Vulnerability (medium 4.0)
- [CVE-2026-19503](https://insights.sbomify.com/CVE-2026-19503/): Insufficient OIDC endpoint validation could invoke unintended local protocol handlers (medium 6.3)
- [CVE-2026-19502](https://insights.sbomify.com/CVE-2026-19502/): Insufficient redaction of sensitive configuration values in diagnostic output of MongoDB SQL Schema Builder CLI (medium 6.8)
- [CVE-2026-19501](https://insights.sbomify.com/CVE-2026-19501/): CVE-2026-19501 (high 8.8)
- [CVE-2026-19500](https://insights.sbomify.com/CVE-2026-19500/): SureForms contains an uncontrolled resource consumption vulnerability (high 7.5)
- [CVE-2026-1950](https://insights.sbomify.com/CVE-2026-1950/): No checking of the length of the buffer with the file name in AS320T (critical 9.8)
- [CVE-2026-19499](https://insights.sbomify.com/CVE-2026-19499/): Buffer overflow in strfmon and strfmon_l right-justification padding (high 7.7)
- [CVE-2026-19498](https://insights.sbomify.com/CVE-2026-19498/): Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access (medium 5.9)
- [CVE-2026-19494](https://insights.sbomify.com/CVE-2026-19494/): Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access (high 8.1)
- [CVE-2026-19493](https://insights.sbomify.com/CVE-2026-19493/): Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access (high 7.5)
- [CVE-2026-19492](https://insights.sbomify.com/CVE-2026-19492/): This Power System update is being released to address (low 3.2)
- [CVE-2026-19491](https://insights.sbomify.com/CVE-2026-19491/): Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access (critical 9.1)
- [CVE-2026-19490](https://insights.sbomify.com/CVE-2026-19490/): Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel (critical 9.3, exploited in the wild)
- [CVE-2026-1949](https://insights.sbomify.com/CVE-2026-1949/): Incorrect calculation of buffer size on the stack in AS320T (critical 9.8)
- [CVE-2026-19489](https://insights.sbomify.com/CVE-2026-19489/): Memory corruption in ADC (high 8.8)
- [CVE-2026-19487](https://insights.sbomify.com/CVE-2026-19487/): Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick pr (medium 5.3)
- [CVE-2026-19486](https://insights.sbomify.com/CVE-2026-19486/): SSRF in Gemini Enterprise Agent Platform App Builder (high 8.7)
- [CVE-2026-19485](https://insights.sbomify.com/CVE-2026-19485/): Bucket Squatting in Vertex AI Search for Commerce (critical 9.3)
- [CVE-2026-19484](https://insights.sbomify.com/CVE-2026-19484/): @fastify/busboy vulnerable to Denial of Service via oversized multipart boundary (high 7.5)
- [CVE-2026-19483](https://insights.sbomify.com/CVE-2026-19483/): Information disclosure in Storage Scale (high 7.1)
- [CVE-2026-19482](https://insights.sbomify.com/CVE-2026-19482/): Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access (high 8.8)
- [CVE-2026-19481](https://insights.sbomify.com/CVE-2026-19481/): @fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header (high 7.5)
- [CVE-2026-19480](https://insights.sbomify.com/CVE-2026-19480/): CAI Content Credentials | Improper Input Validation (CWE-20) (high 7.5)
- [CVE-2026-1948](https://insights.sbomify.com/CVE-2026-1948/): Missing authorization in NEX-Forms – Ultimate Forms Plugin for WordPress (medium 4.3)
- [CVE-2026-19479](https://insights.sbomify.com/CVE-2026-19479/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-19478](https://insights.sbomify.com/CVE-2026-19478/): Improper Control of Generation of Code ('Code Injection') in GitLab (critical 9.4)
- [CVE-2026-19477](https://insights.sbomify.com/CVE-2026-19477/): Stack-based Buffer Overflow Vulnerability in Linux (uldaq) (high 8.6)
- [CVE-2026-19475](https://insights.sbomify.com/CVE-2026-19475/): SQL Data Source Plugin: OOM DoS via $__timeGroup macro (medium 6.5)
- [CVE-2026-19474](https://insights.sbomify.com/CVE-2026-19474/): @fastify/multipart vulnerable to Denial of Service via temporary file leak on aborted upload (high 7.5)
- [CVE-2026-19472](https://insights.sbomify.com/CVE-2026-19472/): Rockwell Automation ArmorStart® LT Denial Of Service (high 8.7)
- [CVE-2026-19471](https://insights.sbomify.com/CVE-2026-19471/): Rockwell Automation ArmorStart® LT Stored Cross-site scripting (medium 6.9)
- [CVE-2026-1947](https://insights.sbomify.com/CVE-2026-1947/): Missing authorization in NEX-Forms – Ultimate Forms Plugin for WordPress (high 7.5)
- [CVE-2026-1946](https://insights.sbomify.com/CVE-2026-1946/): Missing authorization in GW AI Website Builder (medium 4.3)
- [CVE-2026-19454](https://insights.sbomify.com/CVE-2026-19454/): JetBackup 3.1.18.8 - 3.1.23.3 - Admin+ Multisite Network Backup Download (medium 4.4)
- [CVE-2026-19453](https://insights.sbomify.com/CVE-2026-19453/): JetBackup 3.1.7.9 - 3.1.23.3 - Subscriber+ Privilege Escalation via Restore Admin User Selection (high 7.1)
- [CVE-2026-1945](https://insights.sbomify.com/CVE-2026-1945/): WPBookit <= 1.0.8 - Unauthenticated Stored Cross-Site Scripting via 'wpb_user_name' and 'wpb_user_email' Parameters (high 7.2)
- [CVE-2026-19449](https://insights.sbomify.com/CVE-2026-19449/): Vulnerabilities in IBM AIX and PowerVM VIOS (high 8.8)
- [CVE-2026-19448](https://insights.sbomify.com/CVE-2026-19448/): Vulnerabilities in IBM AIX and PowerVM VIOS (medium 6.5)
- [CVE-2026-19447](https://insights.sbomify.com/CVE-2026-19447/): Stored XSS in Fileorbis Informatics's FileOrbis (medium 5.4)
- [CVE-2026-19446](https://insights.sbomify.com/CVE-2026-19446/): Vulnerabilities in IBM AIX and PowerVM VIOS (high 7.5)
- [CVE-2026-19445](https://insights.sbomify.com/CVE-2026-19445/): Use-after-free of a server-side SSLContext when sni_callback switches contexts (critical 9.2)
- [CVE-2026-19444](https://insights.sbomify.com/CVE-2026-19444/): Kubernetes kubectl cp path traversal on Windows allows arbitrary file writes (medium 6.5)
- [CVE-2026-19442](https://insights.sbomify.com/CVE-2026-19442/): Vulnerabilities in IBM AIX and PowerVM VIOS (high 8.2)
- [CVE-2026-19441](https://insights.sbomify.com/CVE-2026-19441/): Unauthenticated API Allows Analytics Data Manipulation in IKAS Technology's Rush (medium 5.3)
- [CVE-2026-1944](https://insights.sbomify.com/CVE-2026-1944/): CallbackKiller service widget <= 1.2 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Update (medium 5.3)
- [CVE-2026-19439](https://insights.sbomify.com/CVE-2026-19439/): Missing authorization in Ultimate Gift Cards for WooCommerce (high 7.5)
- [CVE-2026-19438](https://insights.sbomify.com/CVE-2026-19438/): Mint Workbench I Path traversal Vulnerability (high 8.2)
- [CVE-2026-19437](https://insights.sbomify.com/CVE-2026-19437/): Vulnerabilities in IBM AIX and PowerVM VIOS (high 8.1)
- [CVE-2026-19436](https://insights.sbomify.com/CVE-2026-19436/): Ultimate Gift Cards For WooCommerce < 3.2.10 - Unauthenticated Gift Card Value Inflation via Discounted Purchase (high 7.5)
- [CVE-2026-19435](https://insights.sbomify.com/CVE-2026-19435/): Copy & Delete Posts < 1.5.6 - Authenticated Arbitrary Post Content and Password Disclosure (low 2.7)
- [CVE-2026-19434](https://insights.sbomify.com/CVE-2026-19434/): Stored Cross-site Scripting in Pentestify finding severity field (medium 5.1)
- [CVE-2026-19433](https://insights.sbomify.com/CVE-2026-19433/): Authorization Bypass Through User-Controlled Key in Prospero Flow CRM contact save and vCard export (high 8.6)
- [CVE-2026-19430](https://insights.sbomify.com/CVE-2026-19430/): CatFolders Document Gallery Pro < 2.0.7 - Unauthenticated Missing Authorization via download-all (medium 5.3)
- [CVE-2026-1943](https://insights.sbomify.com/CVE-2026-1943/): YayMail <= 4.3.2 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via Template Elements (medium 4.4)
- [CVE-2026-19426](https://insights.sbomify.com/CVE-2026-19426/): FitSoft｜POS Sytstem - Missing Authentication (high 8.8)
- [CVE-2026-19425](https://insights.sbomify.com/CVE-2026-19425/): Win Men Intermational｜Travel Agency Management System - SQL Injection (critical 9.3)
- [CVE-2026-19424](https://insights.sbomify.com/CVE-2026-19424/): Inventec Appliances｜Chiline Cloud - Insecure Direct Object Reference (high 8.7)
- [CVE-2026-19423](https://insights.sbomify.com/CVE-2026-19423/): Ultimate Member 2.6.7 - 2.12.1 - Unauthenticated Privilege Escalation via Role Field on Profile Forms (high 8.1)
- [CVE-2026-1942](https://insights.sbomify.com/CVE-2026-1942/): Missing authorization in Blog2Social: Social Media Auto Post & Scheduler (medium 6.5)
- [CVE-2026-19418](https://insights.sbomify.com/CVE-2026-19418/): TYPO3 CMS - Broken Access Control in Backend and Install Tool (high 7.3)
- [CVE-2026-19417](https://insights.sbomify.com/CVE-2026-19417/): KiviCare < 4.5.4 - Patient+ Arbitrary Media Attachment Read via IDOR (medium 6.5)
- [CVE-2026-19416](https://insights.sbomify.com/CVE-2026-19416/): KiviCare < 4.5.4 - Patient+ Cross-Patient Appointment Modification via IDOR (medium 4.3)
- [CVE-2026-19412](https://insights.sbomify.com/CVE-2026-19412/): Hardcoded Credentials Vulnerability in CP Plus CP-XR-DE21-S Router (high 8.7)
- [CVE-2026-19411](https://insights.sbomify.com/CVE-2026-19411/): Shim/dp.c library: null-pointer dereference in is_removable_media_path() when devicepathtostr() returns null (low 3.9)
- [CVE-2026-19410](https://insights.sbomify.com/CVE-2026-19410/): Google Cloud Build Comment Control Bypass via Webhook Suppression (critical 9.4)
- [CVE-2026-1941](https://insights.sbomify.com/CVE-2026-1941/): WP Event Aggregator <= 1.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-19407](https://insights.sbomify.com/CVE-2026-19407/): GCS Bucket Squatting leading to RCE in Gemini Enterprise Agent Platform Python SDK (high 7.7)
- [CVE-2026-19406](https://insights.sbomify.com/CVE-2026-19406/): Easy Appointments < 4.0.1 - Contributor+ Sensitive Information Disclosure via REST Appointments Listing (low 2.7)
- [CVE-2026-19404](https://insights.sbomify.com/CVE-2026-19404/): Missing authorization in Red Hat Directory Server 11 (medium 6.5)
- [CVE-2026-19401](https://insights.sbomify.com/CVE-2026-19401/): Remote UDP DoS by sending multiple DNS Cookie options (high 8.2)
- [CVE-2026-1940](https://insights.sbomify.com/CVE-2026-1940/): Gstreamer: incomplete fix of cve-2026-1940 (medium 5.1)
- [CVE-2026-19398](https://insights.sbomify.com/CVE-2026-19398/): Memory corruption in FA507NU (medium 6.8)
- [CVE-2026-19397](https://insights.sbomify.com/CVE-2026-19397/): Auth bypass in Control Center Express Agent (high 7.7)
- [CVE-2026-19396](https://insights.sbomify.com/CVE-2026-19396/): Weak cryptography in Router (high 7.7)
- [CVE-2026-19395](https://insights.sbomify.com/CVE-2026-19395/): An empty <img> attribute value in styled text triggers a parser error that halts the device. (medium 6.6)
- [CVE-2026-19391](https://insights.sbomify.com/CVE-2026-19391/): Information disclosure in Pen Drive Powered by Red Hat Lightspeed (medium 6.5)
- [CVE-2026-1939](https://insights.sbomify.com/CVE-2026-1939/): Percent to Infograph <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-19389](https://insights.sbomify.com/CVE-2026-19389/): Integer overflow in Red Hat Enterprise Linux 10 (high 7.1)
- [CVE-2026-19387](https://insights.sbomify.com/CVE-2026-19387/): Gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec ima/dvi adpcm decoder (high 7.6)
- [CVE-2026-19386](https://insights.sbomify.com/CVE-2026-19386/): Memory corruption in Router (critical 9.3)
- [CVE-2026-19385](https://insights.sbomify.com/CVE-2026-19385/): PostgreSQL pg_dump heap buffer overflow executes arbitrary code (high 8.8)
- [CVE-2026-19384](https://insights.sbomify.com/CVE-2026-19384/): SourceCodester Simple Doctors Appointment System ajax.php set_appointment sql injection (medium 6.9)
- [CVE-2026-19383](https://insights.sbomify.com/CVE-2026-19383/): saithink/saigroup SaiAdmin Plugin Upload Endpoint upload shell_exec unrestricted upload (medium 5.1)
- [CVE-2026-19382](https://insights.sbomify.com/CVE-2026-19382/): Almico Speedfan MSR Index speedfan.sys KiSystemCall64 memory leak (medium 4.6)
- [CVE-2026-19381](https://insights.sbomify.com/CVE-2026-19381/): Kingston FURY CTRL RGB Control Software Driver NTIOLib_KSFX.sys privileges management (high 8.5)
- [CVE-2026-19380](https://insights.sbomify.com/CVE-2026-19380/): Mullvad wireguard.sys IOCTL AdapterState reference count (medium 4.6)
- [CVE-2026-1938](https://insights.sbomify.com/CVE-2026-1938/): Missing authorization in YayMail – WooCommerce Email Customizer (medium 5.3)
- [CVE-2026-19379](https://insights.sbomify.com/CVE-2026-19379/): EFM ipTIME AX8004M CGI Endpoint d.cgi popen os command injection (medium 6.9)
- [CVE-2026-19378](https://insights.sbomify.com/CVE-2026-19378/): code-projects Task Management System CommentSave.php cross site scripting (medium 5.3)
- [CVE-2026-19377](https://insights.sbomify.com/CVE-2026-19377/): Improper certificate validation in Cato Client tunnel handshake (medium 6.0)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/824/