# Vulnerabilities published in 2026


- [CVE-2026-18775](https://insights.sbomify.com/CVE-2026-18775/): NousResearch hermes-agent Browser Tooling browser_tool.py browser_snapshot server-side request forgery (medium 5.3)
- [CVE-2026-18774](https://insights.sbomify.com/CVE-2026-18774/): Server-side request forgery in hermes-agent (medium 5.3)
- [CVE-2026-18773](https://insights.sbomify.com/CVE-2026-18773/): NousResearch hermes-agent Quick run.py _check_slash_access authorization (medium 5.3)
- [CVE-2026-18772](https://insights.sbomify.com/CVE-2026-18772/): Denial of service in rlottie (medium 6.5)
- [CVE-2026-18771](https://insights.sbomify.com/CVE-2026-18771/): Missing Authentication for Critical Function in TMT Machine's Talassoft Industrial Management Software (high 7.5)
- [CVE-2026-18770](https://insights.sbomify.com/CVE-2026-18770/): vibesurf-ai VibeSurf Python Validation code code injection (medium 6.9)
- [CVE-2026-1877](https://insights.sbomify.com/CVE-2026-1877/): Auto Post Scheduler <= 1.84 - Cross-Site Request Forgery to Stored Cross-Site Scripting via aps_options_page (medium 6.1)
- [CVE-2026-18766](https://insights.sbomify.com/CVE-2026-18766/): chetans9 core-php-admin-panel customers.php sql injection (medium 5.3)
- [CVE-2026-18765](https://insights.sbomify.com/CVE-2026-18765/): SQL Injection in Teracity Sotware's Teracity E-OSB Platform (critical 9.8)
- [CVE-2026-1876](https://insights.sbomify.com/CVE-2026-1876/): Denial-of-Service (DoS) vulnerability in Ethernet function of MELSEC iQ-F Series Ethernet module (high 8.7)
- [CVE-2026-18759](https://insights.sbomify.com/CVE-2026-18759/): An improper authentication and path traversal vulnerability exists in ASUSTOR Backup Plan and ASUSTOR EZ Sync. (high 8.5)
- [CVE-2026-18756](https://insights.sbomify.com/CVE-2026-18756/): HumHub Community Edition 1.18.4-pl1 - Reflected XSS in Space membership request button rendering (high 7.2)
- [CVE-2026-18755](https://insights.sbomify.com/CVE-2026-18755/): GV-ASManager DLL hijacking vulnerability (high 7.3)
- [CVE-2026-18754](https://insights.sbomify.com/CVE-2026-18754/): Hardcoded Cryptographic Key on GV-AS1620 Controller Firmware (GV-Cloud) (critical 9.1)
- [CVE-2026-18753](https://insights.sbomify.com/CVE-2026-18753/): Hardcoded Cryptographic Key on GV-AS1620 Controller Firmware (GV-ASManager) (critical 9.1)
- [CVE-2026-18752](https://insights.sbomify.com/CVE-2026-18752/): Persistent Login <= 3.1.0 - Authenticated (Subscriber+) SQL Injection via 'wppl_device_id' Cookie (medium 6.5)
- [CVE-2026-18751](https://insights.sbomify.com/CVE-2026-18751/): Citrix Workspace App for Mac Security Bulletin for CVE-2026-18751 (medium 5.2)
- [CVE-2026-18750](https://insights.sbomify.com/CVE-2026-18750/): CVE-2026-18750 (medium 5.3)
- [CVE-2026-1875](https://insights.sbomify.com/CVE-2026-1875/): Denial-of-Service (DoS) vulnerability in Ethernet function of MELSEC iQ-F Series EtherNet/IP module (high 8.7)
- [CVE-2026-18749](https://insights.sbomify.com/CVE-2026-18749/): CVE-2026-18749 (critical 9.8)
- [CVE-2026-18748](https://insights.sbomify.com/CVE-2026-18748/): Out-of-bounds read in Bluetooth Classic A2DP codec information element handling (low 3.5)
- [CVE-2026-18747](https://insights.sbomify.com/CVE-2026-18747/): Integer underflow of net_buf length in the MCUmgr serial (SMP over console) transport leads to out-of-bounds read (medium 6.8)
- [CVE-2026-18746](https://insights.sbomify.com/CVE-2026-18746/): NULL pointer dereference in Zephyr LwM2M client when the CoAP Block1 context pool is exhausted (medium 5.9)
- [CVE-2026-18744](https://insights.sbomify.com/CVE-2026-18744/): CVE-2026-18744 (medium 6.5)
- [CVE-2026-18743](https://insights.sbomify.com/CVE-2026-18743/): Popt-devel: popt-static: short realloc in poptconfigfiletostring (low 2.5)
- [CVE-2026-18741](https://insights.sbomify.com/CVE-2026-18741/): Worksuite SaaS version prior to 6.0.14 Stored XSS via Asset Management Location and Description Fields (medium 4.6)
- [CVE-2026-18740](https://insights.sbomify.com/CVE-2026-18740/): Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access (high 8.8)
- [CVE-2026-1874](https://insights.sbomify.com/CVE-2026-1874/): Denial-of-Service (DoS) vulnerability in Ethernet function of MELSEC iQ-F Series EtherNet/IP module and Ethernet module (high 8.7)
- [CVE-2026-18739](https://insights.sbomify.com/CVE-2026-18739/): Popt-devel: popt-static: off-by-one in poptstuffargs (low 2.5)
- [CVE-2026-18738](https://insights.sbomify.com/CVE-2026-18738/): Shlink CSV Formula Injection via Visit Export CLI (medium 5.1)
- [CVE-2026-18737](https://insights.sbomify.com/CVE-2026-18737/): Shlink Blind SQL Injection via tags/stats orderBy Parameter (high 7.1)
- [CVE-2026-18736](https://insights.sbomify.com/CVE-2026-18736/): Shlink Server-Side Request Forgery via Short URL Title Auto-Resolution (medium 5.3)
- [CVE-2026-18733](https://insights.sbomify.com/CVE-2026-18733/): Prompt injection bypasses shell tool consent gate in Strands Agents Tools (high 7.5)
- [CVE-2026-18730](https://insights.sbomify.com/CVE-2026-18730/): Server-side request forgery in Enterprise Server (high 8.2)
- [CVE-2026-18729](https://insights.sbomify.com/CVE-2026-18729/): Code injection in Langflow OSS (high 8.8)
- [CVE-2026-18728](https://insights.sbomify.com/CVE-2026-18728/): Open-iscsi: open-iscsi: integer underflow in iscsiuio ipv4 dhcp parsing (medium 6.5)
- [CVE-2026-18727](https://insights.sbomify.com/CVE-2026-18727/): Open-iscsi: open-iscsi: integer underflow in iscsiuio dhcpv6 parsing (medium 6.5)
- [CVE-2026-18726](https://insights.sbomify.com/CVE-2026-18726/): Open-iscsi: open-iscsi: denial of service in iscsiuio router advertisement parsing (medium 6.5)
- [CVE-2026-18723](https://insights.sbomify.com/CVE-2026-18723/): diaowen DWSurvey Survey Status up-survey-status.do improper authorization (medium 5.3)
- [CVE-2026-18722](https://insights.sbomify.com/CVE-2026-18722/): diaowen DWSurvey dev-survey.do in DwDeisgnSurveyController.devSurvey. authorization (medium 5.3)
- [CVE-2026-18721](https://insights.sbomify.com/CVE-2026-18721/): kalcaddle kodbox SSO API Login apiLogin redirect (medium 5.3)
- [CVE-2026-18720](https://insights.sbomify.com/CVE-2026-18720/): kalcaddle kodbox msgWarning Plugin action improper authorization (medium 6.9)
- [CVE-2026-18719](https://insights.sbomify.com/CVE-2026-18719/): cemtan sar2html Search sar2html.py sql injection (medium 5.3)
- [CVE-2026-18718](https://insights.sbomify.com/CVE-2026-18718/): Ghidra Swift Demangler Analyzer Arbitrary Code Execution via Project State (high 7.1)
- [CVE-2026-18717](https://insights.sbomify.com/CVE-2026-18717/): Improper Certificate Validation in ASE 2000 (critical 9.1)
- [CVE-2026-18716](https://insights.sbomify.com/CVE-2026-18716/): Vulnerabilities in IBM AIX and PowerVM VIOS (high 7.9)
- [CVE-2026-18715](https://insights.sbomify.com/CVE-2026-18715/): IBM i is Affected By Multiple Vulnerabilities in WebSphere Application Server Liberty (medium 6.5)
- [CVE-2026-18713](https://insights.sbomify.com/CVE-2026-18713/): IBM i is Affected By Multiple Vulnerabilities in Navigator for i (high 8.8)
- [CVE-2026-18712](https://insights.sbomify.com/CVE-2026-18712/): Missing authorization in MongoDB Server (high 7.2)
- [CVE-2026-18711](https://insights.sbomify.com/CVE-2026-18711/): Use-After-Free in MongoDB Query Execution Engine Leads to Denial of Service and Potential Memory Disclosure (high 7.1)
- [CVE-2026-18710](https://insights.sbomify.com/CVE-2026-18710/): Cleartext Storage of Sensitive Information in MongoDB Driver Logging During Client Initialization (high 8.2)
- [CVE-2026-1871](https://insights.sbomify.com/CVE-2026-1871/): Authenticated Stack-based Buffer Overflow in RTSP Authentication of Tapo C200 (high 7.1)
- [CVE-2026-18709](https://insights.sbomify.com/CVE-2026-18709/): Missing Authorization in MongoDB Sharded Transaction Commit/Abort Handling Leads to Cross-Shard Data Inconsistency (medium 5.9)
- [CVE-2026-18708](https://insights.sbomify.com/CVE-2026-18708/): Code injection in MongoDB Server (medium 5.3)
- [CVE-2026-18707](https://insights.sbomify.com/CVE-2026-18707/): Improper Input Validation in MongoDB Aggregation Command Handling Leads to Denial of Service (medium 5.3)
- [CVE-2026-18706](https://insights.sbomify.com/CVE-2026-18706/): Use-After-Free in MongoDB $graphLookup Aggregation Stage Leads to Denial of Service and Potential Remote Code Execution (high 7.5)
- [CVE-2026-18705](https://insights.sbomify.com/CVE-2026-18705/): Improper Authorization in MongoDB Atlas Vector Search Allows Unauthorized Access to Protected View Data (high 7.1)
- [CVE-2026-18704](https://insights.sbomify.com/CVE-2026-18704/): Improper Authorization in MongoDB Aggregation Framework Allows Read-Only User to Perform Unauthorized Write Operations (high 7.1)
- [CVE-2026-18703](https://insights.sbomify.com/CVE-2026-18703/): Auth bypass in MongoDB Server (low 2.3)
- [CVE-2026-18702](https://insights.sbomify.com/CVE-2026-18702/): Improper Authorization in MongoDB profile Command Allows Unauthorized Modification of Server-Wide Diagnostic Settings (medium 5.3)
- [CVE-2026-18701](https://insights.sbomify.com/CVE-2026-18701/): Type Confusion in MongoDB Query Subsystem Leads to Denial of Service (high 7.1)
- [CVE-2026-18700](https://insights.sbomify.com/CVE-2026-18700/): Use-After-Free in MongoDB Geospatial Validation Leads to Denial of Service (medium 6.0)
- [CVE-2026-1870](https://insights.sbomify.com/CVE-2026-1870/): Thim Kit for Elementor <= 1.3.7 - Missing Authorization to Unauthenticated Private Course Disclosure (medium 5.3)
- [CVE-2026-18699](https://insights.sbomify.com/CVE-2026-18699/): Improper Input Validation in MongoDB Query Planner Leads to Denial of Service (medium 6.0)
- [CVE-2026-18698](https://insights.sbomify.com/CVE-2026-18698/): Improper Authorization in MongoDB Server Allows Unauthorized Actions on System Collections via the validate Command (medium 5.3)
- [CVE-2026-18697](https://insights.sbomify.com/CVE-2026-18697/): Improper Input Validation in MongoDB Aggregation Framework Allows Unauthenticated Denial of Service on mongos (high 8.7)
- [CVE-2026-18696](https://insights.sbomify.com/CVE-2026-18696/): Improper Authorization in MongoDB applyOps Command Handling Allows Unauthorized DDL Operations on Collections (high 7.0)
- [CVE-2026-18695](https://insights.sbomify.com/CVE-2026-18695/): Improper Input Validation in MongoDB Timeseries Query Processing Leads to Denial of Service (high 7.1)
- [CVE-2026-18694](https://insights.sbomify.com/CVE-2026-18694/): Out-of-Bounds Read in MongoDB Geospatial Query Processing Leads to Denial of Service and Potential Memory Disclosure (high 7.1)
- [CVE-2026-18693](https://insights.sbomify.com/CVE-2026-18693/): Memory corruption in MongoDB Server (high 7.2)
- [CVE-2026-18692](https://insights.sbomify.com/CVE-2026-18692/): Use-After-Free in MongoDB Timeseries Bucket Handling Leads to Denial of Service and Potential Remote Code Execution (high 7.7)
- [CVE-2026-18691](https://insights.sbomify.com/CVE-2026-18691/): Improper Authentication in MongoDB Intra-Cluster Connections Allows Credential Exposure (critical 9.0)
- [CVE-2026-18690](https://insights.sbomify.com/CVE-2026-18690/): Improper Authorization in MongoDB Server Allows Unauthorized Actions on System Collections (high 7.2)
- [CVE-2026-1869](https://insights.sbomify.com/CVE-2026-1869/): User Registration & Membership <= 5.2.0 - Missing Authorization to Unauthenticated Payment Bypass (medium 6.5)
- [CVE-2026-18688](https://insights.sbomify.com/CVE-2026-18688/): Out-of-Bounds Read in MongoDB Aggregation Framework Leads to Denial of Service and Potential Memory Disclosure (high 7.1)
- [CVE-2026-18687](https://insights.sbomify.com/CVE-2026-18687/): Integer overflow in MongoDB Server (high 7.1)
- [CVE-2026-18686](https://insights.sbomify.com/CVE-2026-18686/): GL.iNet GL-MT3000 nas-web RPC Wrapper glc nas-web.add_user command injection (critical 9.3)
- [CVE-2026-18685](https://insights.sbomify.com/CVE-2026-18685/): GL.iNet GL-MT3000 modem.so glc set_upgrade command injection (critical 9.3)
- [CVE-2026-18684](https://insights.sbomify.com/CVE-2026-18684/): GL.iNet GL-MT3000 modem.so glc remove_profile command injection (critical 9.3)
- [CVE-2026-18683](https://insights.sbomify.com/CVE-2026-18683/): IBM i is Affected By privilege escalation in Navigator for i (high 8.8)
- [CVE-2026-18682](https://insights.sbomify.com/CVE-2026-18682/): OpenAkita File Upload API upload cross site scripting (low 2.3)
- [CVE-2026-18681](https://insights.sbomify.com/CVE-2026-18681/): This Power System Buffer Overflow (medium 6.8)
- [CVE-2026-1868](https://insights.sbomify.com/CVE-2026-1868/): Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway (critical 9.9)
- [CVE-2026-18679](https://insights.sbomify.com/CVE-2026-18679/): Kong Mesh: kuma-dp connects to the control plane without verifying the TLS certificate when no CA is configured (medium 5.8)
- [CVE-2026-18678](https://insights.sbomify.com/CVE-2026-18678/): Kong Mesh: kumactl connects to the control plane without verifying the TLS certificate when no CA is configured (medium 5.5)
- [CVE-2026-18677](https://insights.sbomify.com/CVE-2026-18677/): Kong Mesh: a dataplane token without a workload binding can claim any workload's SPIFFE identity (medium 6.0)
- [CVE-2026-18676](https://insights.sbomify.com/CVE-2026-18676/): Kong Mesh: default control plane config leaks the admin token cross-origin via a CORS wildcard and localhost admin (medium 5.1)
- [CVE-2026-18675](https://insights.sbomify.com/CVE-2026-18675/): Kong Mesh: control plane denial of service via a malformed dataplane token with a non-string JWT kid (medium 5.3)
- [CVE-2026-18674](https://insights.sbomify.com/CVE-2026-18674/): Security feature bypass in Kong Mesh (high 7.0)
- [CVE-2026-18673](https://insights.sbomify.com/CVE-2026-18673/): Kong Mesh: the kuma-dp readiness service exposes the Envoy admin API without authentication (medium 5.3)
- [CVE-2026-18672](https://insights.sbomify.com/CVE-2026-18672/): RadImageEditor ClientState Unauthenticated Arbitrary File Read Vulnerability in Telerik UI for ASP.NET AJAX (high 7.5)
- [CVE-2026-18671](https://insights.sbomify.com/CVE-2026-18671/): IBM i is Affected By Multiple Vulnerabilities in NetServer (medium 6.5)
- [CVE-2026-18670](https://insights.sbomify.com/CVE-2026-18670/): Vulnerabilities in IBM AIX and PowerVM VIOS (high 8.2)
- [CVE-2026-1867](https://insights.sbomify.com/CVE-2026-1867/): WP Front User Submit < 5.0.6 - Unauthenticated Sensitive Information Exposure (medium 5.9)
- [CVE-2026-18669](https://insights.sbomify.com/CVE-2026-18669/): IBM i is Affected By A Privilege Escalation Vulnerability [] (high 8.8)
- [CVE-2026-18667](https://insights.sbomify.com/CVE-2026-18667/): Sensor Proxy Version 1.4.2 Fixes One Vulnerability (critical 9.3)
- [CVE-2026-18666](https://insights.sbomify.com/CVE-2026-18666/): Library Management System < 3.6.7 - Subscriber+ SQL Injection via Filter Value (medium 4.3)
- [CVE-2026-18664](https://insights.sbomify.com/CVE-2026-18664/): Wrong interpretation of ACL ranges (high 8.2)
- [CVE-2026-18663](https://insights.sbomify.com/CVE-2026-18663/): Memory corruption in Red Hat Directory Server 11 (medium 5.9)
- [CVE-2026-18662](https://insights.sbomify.com/CVE-2026-18662/): In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, two or more security constraints with the same http (medium 6.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/830/