# Vulnerabilities published in 2026


- [CVE-2026-1891](https://insights.sbomify.com/CVE-2026-1891/): Simple Football Scoreboard <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-18909](https://insights.sbomify.com/CVE-2026-18909/): Memory corruption in ELAN Smart-Pad (medium 5.6)
- [CVE-2026-18907](https://insights.sbomify.com/CVE-2026-18907/): PathTravelsal Vulnerability in com.talpa.hibrowser (high 7.5)
- [CVE-2026-18905](https://insights.sbomify.com/CVE-2026-18905/): IBM ContextForge MCP Gateway is affected by server-side request forgery via DNS TOCTOU at tool invocation (high 7.7)
- [CVE-2026-18904](https://insights.sbomify.com/CVE-2026-18904/): Auth bypass in Langflow OSS (high 8.2)
- [CVE-2026-18903](https://insights.sbomify.com/CVE-2026-18903/): yeqifu warehouse FileController.java path traversal (medium 5.3)
- [CVE-2026-18902](https://insights.sbomify.com/CVE-2026-18902/): H3C NX15 esps repeaterproc command injection (high 8.6)
- [CVE-2026-18901](https://insights.sbomify.com/CVE-2026-18901/): H3C NX15 Web API esps service.add routine (high 8.6)
- [CVE-2026-18900](https://insights.sbomify.com/CVE-2026-18900/): H3C NX15 Backend RPC esps file.exec os command injection (high 8.6)
- [CVE-2026-1890](https://insights.sbomify.com/CVE-2026-1890/): LeadConnector < 3.0.22 - Unauthenticated Rest Call (medium 5.3)
- [CVE-2026-18899](https://insights.sbomify.com/CVE-2026-18899/): Path traversal in Langflow OSS (high 7.5)
- [CVE-2026-18898](https://insights.sbomify.com/CVE-2026-18898/): UTT HiPER 1200GW ConfigAdvideo strcpy stack-based overflow (high 8.7)
- [CVE-2026-18897](https://insights.sbomify.com/CVE-2026-18897/): UTT HiPER 1250GW getOneApConfTempEntry strcpy stack-based overflow (high 8.7)
- [CVE-2026-18896](https://insights.sbomify.com/CVE-2026-18896/): lavkush-maurya Student-Registration-System changepass.php sql injection (medium 5.3)
- [CVE-2026-18895](https://insights.sbomify.com/CVE-2026-18895/): UTT HiPER 1250GW APSecurity_5g strcpy stack-based overflow (high 8.7)
- [CVE-2026-18894](https://insights.sbomify.com/CVE-2026-18894/): Langflow OSS is affected by multiple vulnerabilities (medium 6.5)
- [CVE-2026-18891](https://insights.sbomify.com/CVE-2026-18891/): Auth bypass in Langflow OSS (high 8.2)
- [CVE-2026-1889](https://insights.sbomify.com/CVE-2026-1889/): Outgrow <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'outgrow' Shortcode 'id' Attribute (medium 6.4)
- [CVE-2026-18888](https://insights.sbomify.com/CVE-2026-18888/): Memory corruption in BI Connector ODBC Driver (high 7.1)
- [CVE-2026-18887](https://insights.sbomify.com/CVE-2026-18887/): IBM i is Affected By Sensitive Information Exposure Vulnerability in PASE [] (medium 6.5)
- [CVE-2026-18886](https://insights.sbomify.com/CVE-2026-18886/): Unauthenticated Privilege Escalation via System Configuration Image Upload Processor (critical 10.0)
- [CVE-2026-18885](https://insights.sbomify.com/CVE-2026-18885/): Unauthenticated Remote Code Execution in GraphQL Composite Data API (critical 10.0)
- [CVE-2026-18884](https://insights.sbomify.com/CVE-2026-18884/): WooCommerce Lottery <= 2.2.9 - Unauthenticated Time-Based SQL Injection via 'orderby' and 'order' Parameters (high 7.5)
- [CVE-2026-18881](https://insights.sbomify.com/CVE-2026-18881/): TableOn <= 1.0.5.1 - Unauthenticated Blind SQL Injection via 'comment_count' Filter Parameter (high 7.5)
- [CVE-2026-1888](https://insights.sbomify.com/CVE-2026-1888/): Docus <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-18875](https://insights.sbomify.com/CVE-2026-18875/): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (high 7.3)
- [CVE-2026-18874](https://insights.sbomify.com/CVE-2026-18874/): Code injection in Red Hat Advanced Cluster Management for Kubernetes 2.11 (medium 6.2)
- [CVE-2026-18872](https://insights.sbomify.com/CVE-2026-18872/): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (critical 9.3)
- [CVE-2026-18871](https://insights.sbomify.com/CVE-2026-18871/): Power System Buffer Overflow (high 7.3)
- [CVE-2026-18870](https://insights.sbomify.com/CVE-2026-18870/): This Power System update is being released to address (medium 4.3)
- [CVE-2026-18869](https://insights.sbomify.com/CVE-2026-18869/): IBM i is Affected By Denial of Service and Security Restriction Bypass Vulnerabilities in FTP [, ] (medium 6.4)
- [CVE-2026-18860](https://insights.sbomify.com/CVE-2026-18860/): Velociraptor incorrect Org deletion permissions check (high 8.7)
- [CVE-2026-1886](https://insights.sbomify.com/CVE-2026-1886/): Cross-site scripting in Go Night Pro | WordPress Dark Mode Plugin (medium 6.4)
- [CVE-2026-18859](https://insights.sbomify.com/CVE-2026-18859/): ESAFENET CDG usbkey;logindojojs sql injection (medium 6.9)
- [CVE-2026-18858](https://insights.sbomify.com/CVE-2026-18858/): IBM i is Affected By Obtaining Sensitive Information Vulnerability in OpenSSH [] (low 3.3)
- [CVE-2026-18857](https://insights.sbomify.com/CVE-2026-18857/): This Power System update is being released to address (low 3.4)
- [CVE-2026-18856](https://insights.sbomify.com/CVE-2026-18856/): Poesis Rhymix CMS Data Import importer.admin.controller.php procImporterAdminCheckXmlFile server-side request forgery (medium 5.1)
- [CVE-2026-18855](https://insights.sbomify.com/CVE-2026-18855/): Link Library <= 7.9.4 - Unauthenticated Arbitrary File Deletion via link_url Parameter (critical 9.1)
- [CVE-2026-18854](https://insights.sbomify.com/CVE-2026-18854/): Shandong Hoteam PDM Product Data Management System DataService GetStoredClassByFilter sql injection (medium 6.9)
- [CVE-2026-18853](https://insights.sbomify.com/CVE-2026-18853/): ZomboDroid Meme Generator App com.zombodroid.MemeGenerator t5.l.c path traversal (medium 4.8)
- [CVE-2026-18852](https://insights.sbomify.com/CVE-2026-18852/): epsilla-cloud vectordb Filter expr.cpp ShuntingYard unusual condition (medium 4.8)
- [CVE-2026-18851](https://insights.sbomify.com/CVE-2026-18851/): Missing authorization in Endpoint Manager Mobile (high 8.8)
- [CVE-2026-1885](https://insights.sbomify.com/CVE-2026-1885/): Cross-site scripting in Slideshow Wp (medium 6.4)
- [CVE-2026-18849](https://insights.sbomify.com/CVE-2026-18849/): IBM OpenBMC Code Execution (medium 6.8)
- [CVE-2026-18848](https://insights.sbomify.com/CVE-2026-18848/): Power System Cross-Site Request Forgery (CSRF) (high 8.3)
- [CVE-2026-18847](https://insights.sbomify.com/CVE-2026-18847/): IBM i is Affected By Multiple Vulnerabilities in Navigator for i (high 8.8)
- [CVE-2026-18846](https://insights.sbomify.com/CVE-2026-18846/): IBM i is Affected By Multiple Vulnerabilities in Host Servers (high 7.5)
- [CVE-2026-18844](https://insights.sbomify.com/CVE-2026-18844/): Pulsetto Vagus Nerve Stimulator Hidden Functionality (high 7.2)
- [CVE-2026-18843](https://insights.sbomify.com/CVE-2026-18843/): Cross-site scripting in Beaver Builder Plugin (Starter Version) (medium 6.1)
- [CVE-2026-18842](https://insights.sbomify.com/CVE-2026-18842/): Vulnerabilities in IBM AIX and PowerVM VIOS (high 8.4)
- [CVE-2026-18840](https://insights.sbomify.com/CVE-2026-18840/): Vulnerabilities in IBM AIX and PowerVM VIOS (high 8.2)
- [CVE-2026-1884](https://insights.sbomify.com/CVE-2026-1884/): ZenTao Webhook model.php fetchHook server-side request forgery (medium 5.1)
- [CVE-2026-18839](https://insights.sbomify.com/CVE-2026-18839/): Popt-devel: popt-static: size_t underflow in singleoptionhelp (low 2.2)
- [CVE-2026-18835](https://insights.sbomify.com/CVE-2026-18835/): Vulnerabilities in IBM AIX and PowerVM VIOS (critical 9.9)
- [CVE-2026-18832](https://insights.sbomify.com/CVE-2026-18832/): Vulnerabilities in IBM AIX and PowerVM VIOS (high 8.8)
- [CVE-2026-18830](https://insights.sbomify.com/CVE-2026-18830/): Insufficient input validation in Amazon Bedrock AgentCore harness InvokeHarness API (high 8.6)
- [CVE-2026-1883](https://insights.sbomify.com/CVE-2026-1883/): Wicked Folders <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Folder Deletion (medium 4.3)
- [CVE-2026-18828](https://insights.sbomify.com/CVE-2026-18828/): Vulnerabilities in IBM AIX and PowerVM VIOS (medium 5.4)
- [CVE-2026-18825](https://insights.sbomify.com/CVE-2026-18825/): Origin validation error in the connect-xcors npm package (medium 5.3)
- [CVE-2026-18824](https://insights.sbomify.com/CVE-2026-18824/): Vulnerabilities in IBM AIX and PowerVM VIOS (high 8.4)
- [CVE-2026-18822](https://insights.sbomify.com/CVE-2026-18822/): Vulnerabilities in IBM AIX and PowerVM VIOS (medium 4.4)
- [CVE-2026-18821](https://insights.sbomify.com/CVE-2026-18821/): Power System Out-of-bounds Write (high 7.5)
- [CVE-2026-18819](https://insights.sbomify.com/CVE-2026-18819/): RackTables cross-site request forgery (medium 5.3)
- [CVE-2026-18818](https://insights.sbomify.com/CVE-2026-18818/): Ehco1996 django-sspanel Support Ticket views.py TicketDetailView authorization (medium 5.3)
- [CVE-2026-18817](https://insights.sbomify.com/CVE-2026-18817/): Baserow Inactive Non-Staff User serializers.py BaserowImpersonateAuthTokenSerializer improper authorization (low 2.1)
- [CVE-2026-18816](https://insights.sbomify.com/CVE-2026-18816/): Baserow 2FA Verify Endpoint views.py verify improper authentication (low 2.3)
- [CVE-2026-18814](https://insights.sbomify.com/CVE-2026-18814/): H3C NX15 esps reload.reload_config command injection (high 8.6)
- [CVE-2026-18813](https://insights.sbomify.com/CVE-2026-18813/): H3C NX15 esps delete command injection (high 8.6)
- [CVE-2026-18812](https://insights.sbomify.com/CVE-2026-18812/): H3C NX15 esps esps.ipv6.wan command injection (high 8.6)
- [CVE-2026-18811](https://insights.sbomify.com/CVE-2026-18811/): H3C NX15 esps add command injection (high 8.6)
- [CVE-2026-18810](https://insights.sbomify.com/CVE-2026-18810/): H3C NX15 networkSetup missing authentication (medium 6.9)
- [CVE-2026-1881](https://insights.sbomify.com/CVE-2026-1881/): Broadstreet <= 1.52.2 - Authenticated (Subscriber+) Private Post Meta Disclosure via get_sponsored_meta (medium 4.3)
- [CVE-2026-18809](https://insights.sbomify.com/CVE-2026-18809/): Information disclosure in Firefox for Android and Firefox Focus for Android (medium 6.5)
- [CVE-2026-18808](https://insights.sbomify.com/CVE-2026-18808/): Unauthenticated Remote Code Execution via Code Injection in Klemsan's KIO (critical 9.8)
- [CVE-2026-18807](https://insights.sbomify.com/CVE-2026-18807/): ECS < 4.3.13 - Contributor+ Arbitrary Post Binding and Global Preset Modification via Dynamic Repeater Handlers (medium 4.3)
- [CVE-2026-18806](https://insights.sbomify.com/CVE-2026-18806/): Arbitrary Block Device Write via Missing Validation in TÜBİTAK BİLGEM's pardus-image-writer (high 7.1)
- [CVE-2026-18801](https://insights.sbomify.com/CVE-2026-18801/): Stored Clickhouse SQL Injection Through Customer Usage Attribution (critical 9.3)
- [CVE-2026-1880](https://insights.sbomify.com/CVE-2026-1880/): Race condition in DriverHub (medium 5.4)
- [CVE-2026-18799](https://insights.sbomify.com/CVE-2026-18799/): Mattermost Server fails to restrict Slack import account binding, allowing team admins to forge posts as existing users (medium 4.3)
- [CVE-2026-18798](https://insights.sbomify.com/CVE-2026-18798/): QUIC Server May Trigger Double Free When Processing INITIAL Packet (high 7.5)
- [CVE-2026-18796](https://insights.sbomify.com/CVE-2026-18796/): QSPI flash encryption side-channel leakage (medium 6.8)
- [CVE-2026-18795](https://insights.sbomify.com/CVE-2026-18795/): Missing server side validation allowed user to quarantine a DM and GM post (medium 6.4)
- [CVE-2026-18794](https://insights.sbomify.com/CVE-2026-18794/): OpenRGB: insufficient input data checks lead to Denial-of-Service, memory overread and overwrite (high 8.8)
- [CVE-2026-18790](https://insights.sbomify.com/CVE-2026-18790/): Systerel S2OPC DeleteMonitoredItemsRequest state_machine.c out-of-bounds (medium 4.8)
- [CVE-2026-1879](https://insights.sbomify.com/CVE-2026-1879/): Harvard University IQSS Dataverse Theme Customization ThemeAndWidgets.xhtml unrestricted upload (medium 5.3)
- [CVE-2026-18789](https://insights.sbomify.com/CVE-2026-18789/): Ezoic < 2.23.1 - Unauthenticated Database Export via Content Export REST Routes (high 7.5)
- [CVE-2026-18788](https://insights.sbomify.com/CVE-2026-18788/): Trippo ResponsiveFilemanager dialog.php unrestricted upload (medium 6.9)
- [CVE-2026-18787](https://insights.sbomify.com/CVE-2026-18787/): GL.iNet AX1800 RPC Endpoint oui-rpc.lua remove_rule command injection (high 8.7)
- [CVE-2026-18786](https://insights.sbomify.com/CVE-2026-18786/): CheckView < 2.3.2 - Administrator Account Creation via REST API Authentication Bypass (high 8.8)
- [CVE-2026-18785](https://insights.sbomify.com/CVE-2026-18785/): o6 open62541 client_types_custom.c UA_Client_getRemoteDataTypes use after free (medium 4.8)
- [CVE-2026-18784](https://insights.sbomify.com/CVE-2026-18784/): o6 open62541 ua_client_highlevel.c UA_Client_readNodeClassAttribute heap-based overflow (medium 4.8)
- [CVE-2026-18783](https://insights.sbomify.com/CVE-2026-18783/): Missing Server-Side Authentication on REST API Endpoint in Trex Digital Manufacturing's Trex MES (high 8.8)
- [CVE-2026-18782](https://insights.sbomify.com/CVE-2026-18782/): SQL Injection in Trex Digital Manufacturing's Trex MES (critical 9.8)
- [CVE-2026-18781](https://insights.sbomify.com/CVE-2026-18781/): File upload in Drag and Drop Multiple File Upload for Contact Form 7 (high 8.1)
- [CVE-2026-18780](https://insights.sbomify.com/CVE-2026-18780/): CSRF in TMT Machine's Talassoft Industrial Management Software (high 7.1)
- [CVE-2026-1878](https://insights.sbomify.com/CVE-2026-1878/): Race condition in Driver( Headset ) (medium 5.4)
- [CVE-2026-18779](https://insights.sbomify.com/CVE-2026-18779/): Missing authorization in TrueBooker (medium 5.3)
- [CVE-2026-18778](https://insights.sbomify.com/CVE-2026-18778/): TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Customer PII Disclosure via Multiple AJAX Actions (medium 5.3)
- [CVE-2026-18777](https://insights.sbomify.com/CVE-2026-18777/): Missing authorization in TrueBooker (medium 5.3)
- [CVE-2026-18776](https://insights.sbomify.com/CVE-2026-18776/): TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Account Takeover via Multiple AJAX Actions (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/829/