# Vulnerabilities published in 2026


- [CVE-2026-19271](https://insights.sbomify.com/CVE-2026-19271/): Blind LDAP Injection in Sign-In Endpoint in TÜBİTAK BİLGEM's Liderahenk (high 7.5)
- [CVE-2026-19270](https://insights.sbomify.com/CVE-2026-19270/): Hulupeep mcp-ui-probe Journey/Usage JourneyStorage.ts usage_stats path traversal (medium 4.8)
- [CVE-2026-1927](https://insights.sbomify.com/CVE-2026-1927/): Missing authorization in Greenshift – animation and page builder blocks (medium 5.4)
- [CVE-2026-19268](https://insights.sbomify.com/CVE-2026-19268/): abdullah1854 MCPGateway Claude Usage Range Endpoint claude-usage.ts getUsageByDateRange command injection (medium 5.3)
- [CVE-2026-19267](https://insights.sbomify.com/CVE-2026-19267/): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (medium 6.2)
- [CVE-2026-19266](https://insights.sbomify.com/CVE-2026-19266/): Kirachon context-engine review-git-diff Endpoint gitUtils.ts execGitCommand command injection (medium 5.1)
- [CVE-2026-19264](https://insights.sbomify.com/CVE-2026-19264/): Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover (critical 9.3)
- [CVE-2026-19263](https://insights.sbomify.com/CVE-2026-19263/): INQUIRELAB mcp-bridge-api Servers Endpoint mcp-bridge.js command injection (medium 6.9)
- [CVE-2026-1926](https://insights.sbomify.com/CVE-2026-1926/): Subscriptions for WooCommerce <= 1.9.2 - Missing Authorization to Unauthenticated Arbitrary Subscription Cancellation (medium 5.3)
- [CVE-2026-19259](https://insights.sbomify.com/CVE-2026-19259/): Memory corruption in libiec61850 (medium 4.8)
- [CVE-2026-19253](https://insights.sbomify.com/CVE-2026-19253/): Path traversal in Cache Enabler (high 8.7)
- [CVE-2026-19251](https://insights.sbomify.com/CVE-2026-19251/): Ultimate Member < 2.13.0 - Unauthenticated Unapproved Comment Disclosure via Profile Activity (medium 5.3)
- [CVE-2026-1925](https://insights.sbomify.com/CVE-2026-1925/): Missing authorization in EmailKit – Email Customizer for WooCommerce & WP (medium 4.3)
- [CVE-2026-19248](https://insights.sbomify.com/CVE-2026-19248/): Unbounded recursion vulnerability in the QDomNode destructor of Qt XML impacts Qt (high 7.1)
- [CVE-2026-19246](https://insights.sbomify.com/CVE-2026-19246/): HKUDS nanobot Provider-returned Image URL image_generation.py _download_image_data_url server-side request forgery (medium 5.3)
- [CVE-2026-19245](https://insights.sbomify.com/CVE-2026-19245/): HKUDS nanobot Login-shell Environment shell.py ExecTool._prepare_command information disclosure (medium 4.8)
- [CVE-2026-19244](https://insights.sbomify.com/CVE-2026-19244/): HKUDS nanobot MCP enabledTools Scope mcp.py connect_mcp_servers access control (medium 5.1)
- [CVE-2026-19243](https://insights.sbomify.com/CVE-2026-19243/): HKUDS nanobot Shell Allowlist shell.py ExecTool._spawn os command injection (medium 5.3)
- [CVE-2026-1924](https://insights.sbomify.com/CVE-2026-1924/): Aruba HiSpeed Cache <= 3.0.4 - Cross-Site Request Forgery to Plugin Settings Reset (medium 4.3)
- [CVE-2026-19234](https://insights.sbomify.com/CVE-2026-19234/): Power System Buffer Overflow (high 8.2)
- [CVE-2026-19233](https://insights.sbomify.com/CVE-2026-19233/): Server-side request forgery in EcoStruxure™ IT Data Center Expert (Formerly known as StruxureWare Data Center Expert) (high 8.6)
- [CVE-2026-19232](https://insights.sbomify.com/CVE-2026-19232/): Adobe Experience Manager | Incorrect Authorization (CWE-863) (critical 9.9)
- [CVE-2026-19231](https://insights.sbomify.com/CVE-2026-19231/): SourceCodester Simple Doctors Appointment System ajax.php delete_appointment sql injection (medium 6.9)
- [CVE-2026-19230](https://insights.sbomify.com/CVE-2026-19230/): SourceCodester Photo Share Website Comment Input Box ajax.php save_upload cross site scripting (medium 5.1)
- [CVE-2026-1923](https://insights.sbomify.com/CVE-2026-1923/): Social Rocket – Social Sharing Plugin <= 1.3.4.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via id (medium 6.4)
- [CVE-2026-19229](https://insights.sbomify.com/CVE-2026-19229/): SourceCodester Online Clothing Store Dreamweaver Metadata Files _notes file information disclosure (medium 6.9)
- [CVE-2026-19228](https://insights.sbomify.com/CVE-2026-19228/): Authorization Bypass Through User-Controlled Key in GitLab (high 8.5)
- [CVE-2026-19226](https://insights.sbomify.com/CVE-2026-19226/): Royal Elementor Addons < 1.7.1066 - Contributor+ Stored XSS via Image Accordion Widget Effect Settings (medium 6.8)
- [CVE-2026-19225](https://insights.sbomify.com/CVE-2026-19225/): Defender Security < 6.2.0 - Admin+ Network-Wide RCE via Hub Connector on Multisite (medium 6.6)
- [CVE-2026-19224](https://insights.sbomify.com/CVE-2026-19224/): Hummingbird < 3.21.2 - Admin+ Network-Wide RCE via Hub Connector on Multisite (high 7.2)
- [CVE-2026-19223](https://insights.sbomify.com/CVE-2026-19223/): Smush < 4.3.2 - Admin+ Network-Wide RCE via Hub Connector on Multisite (high 7.2)
- [CVE-2026-19222](https://insights.sbomify.com/CVE-2026-19222/): Forminator Forms < 1.57.0.7 - Authenticated Privilege Escalation via Registration Form Role Bypass (medium 6.6)
- [CVE-2026-19221](https://insights.sbomify.com/CVE-2026-19221/): Forminator Forms < 1.57.0.5 - Admin+ Network-Wide RCE via Hub Connector API Key on Multisite (high 7.2)
- [CVE-2026-19220](https://insights.sbomify.com/CVE-2026-19220/): Forminator Forms < 1.57.1 - Unauthenticated Multisite Site Creation and Privilege Escalation (low 3.7)
- [CVE-2026-1922](https://insights.sbomify.com/CVE-2026-1922/): Cross-site scripting in The Events Calendar Shortcode & Block (medium 6.4)
- [CVE-2026-19219](https://insights.sbomify.com/CVE-2026-19219/): DialogHandler UploadPaths Tampering Vulnerability in Telerik UI for ASP.NET AJAX (high 8.1)
- [CVE-2026-19218](https://insights.sbomify.com/CVE-2026-19218/): Password Reset Code Brute Force Leading to Account Takeover in AKIN Software's MyRezzta (critical 9.1)
- [CVE-2026-19217](https://insights.sbomify.com/CVE-2026-19217/): Royal Elementor Addons < 1.7.1065 - Contributor+ Stored XSS via Icon Box Widget (medium 5.4)
- [CVE-2026-19213](https://insights.sbomify.com/CVE-2026-19213/): WonderTrader Pending Order TraderAdapter.h _undone_qty behavioral workflow (medium 5.3)
- [CVE-2026-19212](https://insights.sbomify.com/CVE-2026-19212/): WonderTrader TraderATP Cash Trade Conversion WTSTradeDef.hpp uninitialized variable (medium 5.3)
- [CVE-2026-19211](https://insights.sbomify.com/CVE-2026-19211/): SourceCodester Photo Share Website ajax.php signup sql injection (medium 6.9)
- [CVE-2026-19210](https://insights.sbomify.com/CVE-2026-19210/): SourceCodester Photo Share Website ajax.php save_upload unrestricted upload (medium 5.3)
- [CVE-2026-1921](https://insights.sbomify.com/CVE-2026-1921/): Loco Translate <= 2.8.2 - Authenticated (Translator+) Path Traversal to Limited File Read via 'ref' Parameter (medium 4.9)
- [CVE-2026-19209](https://insights.sbomify.com/CVE-2026-19209/): SourceCodester Photo Share Website index.php home cross site scripting (medium 5.1)
- [CVE-2026-19208](https://insights.sbomify.com/CVE-2026-19208/): WonderTrader TraderDD.cpp queryTrades behavioral workflow (medium 6.3)
- [CVE-2026-19207](https://insights.sbomify.com/CVE-2026-19207/): PHPGurukul Company Visitor Management System manage-newvisitors.php cross site scripting (medium 4.8)
- [CVE-2026-19206](https://insights.sbomify.com/CVE-2026-19206/): MZ Automation libiec61850 ASDU Element sv_subscriber.c SVReceiver_stopThreadless heap-based overflow (medium 4.8)
- [CVE-2026-19205](https://insights.sbomify.com/CVE-2026-19205/): User Enumeration in GastroMenum's GastroMenum Web Panel (high 7.5)
- [CVE-2026-19204](https://insights.sbomify.com/CVE-2026-19204/): Denial of service in Eclipse Jetty (high 8.7)
- [CVE-2026-19203](https://insights.sbomify.com/CVE-2026-19203/): Other in Eclipse Jetty (high 8.3)
- [CVE-2026-19202](https://insights.sbomify.com/CVE-2026-19202/): Token Cache Reuse in mcp-toolbox-sdk-python (critical 9.1)
- [CVE-2026-19201](https://insights.sbomify.com/CVE-2026-19201/): Denial of Service via Unbounded Recursion in go-attestation Windows SIPA Parser (medium 6.6)
- [CVE-2026-19200](https://insights.sbomify.com/CVE-2026-19200/): Velociraptor Analyst overwrites live built-in artifacts through verify() (high 8.9)
- [CVE-2026-1920](https://insights.sbomify.com/CVE-2026-1920/): Booktics <= 1.0.16 - Missing Authorization to Addon Plugin Installation (medium 5.3)
- [CVE-2026-19198](https://insights.sbomify.com/CVE-2026-19198/): Akaunting 3.1.21 - Improper authorization in BulkActions handle dispatch (high 8.7)
- [CVE-2026-19197](https://insights.sbomify.com/CVE-2026-19197/): Broken access control in dashboard snapshots (medium 6.3)
- [CVE-2026-19196](https://insights.sbomify.com/CVE-2026-19196/): SourceCodester Photo Share Website ajax.php login sql injection (medium 6.9)
- [CVE-2026-19195](https://insights.sbomify.com/CVE-2026-19195/): V-Secure Jingyun Antivirus Kernel Driver ZyArk.sys access control (high 8.5)
- [CVE-2026-19193](https://insights.sbomify.com/CVE-2026-19193/): Jiangmin Antivirus Minifilter Port kvcore.sys MessageNotifyCallback access control (high 8.5)
- [CVE-2026-19192](https://insights.sbomify.com/CVE-2026-19192/): DeepCool DisplayService DeepCoolDisplayService.exe access control (high 8.5)
- [CVE-2026-19191](https://insights.sbomify.com/CVE-2026-19191/): StableBit DrivePool DrivePoolService DrivePool.Service.exe permission (high 8.5)
- [CVE-2026-19190](https://insights.sbomify.com/CVE-2026-19190/): StableBit Scanner ScannerService Scanner.Service.exe permission (high 8.5)
- [CVE-2026-1919](https://insights.sbomify.com/CVE-2026-1919/): Booktics <= 1.0.16 - Missing Authorization to Get Items via REST API endpoints (medium 5.3)
- [CVE-2026-19189](https://insights.sbomify.com/CVE-2026-19189/): Power Sofware PowerISO Kernel Driver scdemu.sys privileges management (high 8.5)
- [CVE-2026-19188](https://insights.sbomify.com/CVE-2026-19188/): Haiwell IoT Cloud HMI Gateway OS Command Injection (critical 10.0)
- [CVE-2026-19186](https://insights.sbomify.com/CVE-2026-19186/): Integer underflow in IEEE 802.15.4 frame decryption leads to out-of-bounds read and write (high 8.1)
- [CVE-2026-19185](https://insights.sbomify.com/CVE-2026-19185/): Memory corruption in zephyr (high 7.8)
- [CVE-2026-19184](https://insights.sbomify.com/CVE-2026-19184/): Out-of-bounds write in the NXP GAU ADC driver due to byte-versus-sample buffer size validation mismatch (high 8.4)
- [CVE-2026-19182](https://insights.sbomify.com/CVE-2026-19182/): Missing authorization in Horizon (medium 4.3)
- [CVE-2026-1918](https://insights.sbomify.com/CVE-2026-1918/): IBM Sterling B2B Integrator and IBM Sterling File Gateway store sensitive information in a log file (medium 4.9)
- [CVE-2026-19179](https://insights.sbomify.com/CVE-2026-19179/): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (high 8.2)
- [CVE-2026-19178](https://insights.sbomify.com/CVE-2026-19178/): TS4500 Tape Library Race Condition (medium 6.8)
- [CVE-2026-19177](https://insights.sbomify.com/CVE-2026-19177/): Security feature bypass in Chrome (high 8.3)
- [CVE-2026-19176](https://insights.sbomify.com/CVE-2026-19176/): Use after free in Chrome (high 7.5)
- [CVE-2026-19175](https://insights.sbomify.com/CVE-2026-19175/): Use after free in Chrome (critical 9.6)
- [CVE-2026-19174](https://insights.sbomify.com/CVE-2026-19174/): Integer overflow in Chrome (high 8.8)
- [CVE-2026-19173](https://insights.sbomify.com/CVE-2026-19173/): Memory corruption in Chrome (high 8.3)
- [CVE-2026-19172](https://insights.sbomify.com/CVE-2026-19172/): Use after free in Chrome (high 8.3)
- [CVE-2026-19171](https://insights.sbomify.com/CVE-2026-19171/): Use after free in Chrome (critical 9.6)
- [CVE-2026-19170](https://insights.sbomify.com/CVE-2026-19170/): Use after free in Chrome (critical 9.6)
- [CVE-2026-1917](https://insights.sbomify.com/CVE-2026-1917/): Login Disable - Less critical - Access bypass - SA-CONTRIB-2026-008 (medium 4.3)
- [CVE-2026-19169](https://insights.sbomify.com/CVE-2026-19169/): Privilege escalation in Chrome (high 8.8)
- [CVE-2026-19168](https://insights.sbomify.com/CVE-2026-19168/): Security feature bypass in Chrome (high 8.8)
- [CVE-2026-19167](https://insights.sbomify.com/CVE-2026-19167/): Integer overflow in Chrome (low 3.1)
- [CVE-2026-19166](https://insights.sbomify.com/CVE-2026-19166/): Use after free in Chrome (critical 9.6)
- [CVE-2026-19165](https://insights.sbomify.com/CVE-2026-19165/): Use after free in Chrome (high 7.5)
- [CVE-2026-19164](https://insights.sbomify.com/CVE-2026-19164/): Security feature bypass in Chrome (critical 9.6)
- [CVE-2026-19163](https://insights.sbomify.com/CVE-2026-19163/): Use after free in Chrome (high 8.3)
- [CVE-2026-19162](https://insights.sbomify.com/CVE-2026-19162/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-19161](https://insights.sbomify.com/CVE-2026-19161/): Information disclosure in Chrome (low 3.1)
- [CVE-2026-19160](https://insights.sbomify.com/CVE-2026-19160/): Information disclosure in Chrome (low 3.1)
- [CVE-2026-1916](https://insights.sbomify.com/CVE-2026-1916/): Missing authorization in WPGSI: Spreadsheet Integration (high 7.5)
- [CVE-2026-19159](https://insights.sbomify.com/CVE-2026-19159/): Use after free in Chrome (high 7.5)
- [CVE-2026-19158](https://insights.sbomify.com/CVE-2026-19158/): Use after free in Chrome (high 7.5)
- [CVE-2026-19157](https://insights.sbomify.com/CVE-2026-19157/): Memory corruption in Chrome (critical 9.6)
- [CVE-2026-19156](https://insights.sbomify.com/CVE-2026-19156/): Memory corruption in Chrome (high 7.5)
- [CVE-2026-19155](https://insights.sbomify.com/CVE-2026-19155/): Use after free in Chrome (high 8.3)
- [CVE-2026-19154](https://insights.sbomify.com/CVE-2026-19154/): Use after free in Chrome (high 8.3)
- [CVE-2026-19153](https://insights.sbomify.com/CVE-2026-19153/): Security feature bypass in Chrome (high 8.1)
- [CVE-2026-19152](https://insights.sbomify.com/CVE-2026-19152/): Security feature bypass in Chrome (high 8.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/826/