# Vulnerabilities published in 2026


- [CVE-2026-18661](https://insights.sbomify.com/CVE-2026-18661/): In Eclipse Jetty, across various versions of `jetty-annotations`, and `jetty-eeN-annotations`, the Jakarta Spec authoritative url-pattern ru (high 8.8)
- [CVE-2026-18660](https://insights.sbomify.com/CVE-2026-18660/): Jetty proxy blacklist performs case-sensitive matching of case-insensitive DNS hostnames (high 8.8)
- [CVE-2026-1866](https://insights.sbomify.com/CVE-2026-1866/): Cross-site scripting in Name Directory (high 7.2)
- [CVE-2026-18659](https://insights.sbomify.com/CVE-2026-18659/): Unauthenticated authorization bypass in ConstraintSecurityHandler - HTTP method-omission matched by substring (medium 6.9)
- [CVE-2026-18658](https://insights.sbomify.com/CVE-2026-18658/): IBM Operational Decision Manager for Aug 2026 - Multiple CVEs addressed (critical 9.8)
- [CVE-2026-18657](https://insights.sbomify.com/CVE-2026-18657/): Executable Resolution from Untrusted Project Directory in Kiro CLI on Windows (high 8.5)
- [CVE-2026-18656](https://insights.sbomify.com/CVE-2026-18656/): Executable Resolution from Untrusted Project Directory in Kiro IDE on Windows (high 8.5)
- [CVE-2026-18655](https://insights.sbomify.com/CVE-2026-18655/): Broker Credential and OAuth Token Disclosure in AWS Labs Amazon MQ MCP Server via Prompt Injection (high 7.1)
- [CVE-2026-18654](https://insights.sbomify.com/CVE-2026-18654/): Disabled SSH host key verification in Amazon AWS CLI EMR helper commands (medium 6.9)
- [CVE-2026-18653](https://insights.sbomify.com/CVE-2026-18653/): WP Directory Kit < 1.5.7 - Admin+ SQL Injection via section Parameter (high 7.2)
- [CVE-2026-18652](https://insights.sbomify.com/CVE-2026-18652/): Velociraptor STACK Type Download Path Bypasses Denied Prefix Check (medium 6.5)
- [CVE-2026-18651](https://insights.sbomify.com/CVE-2026-18651/): Auth bypass in Red Hat Directory Server 11 (medium 5.4)
- [CVE-2026-18650](https://insights.sbomify.com/CVE-2026-18650/): Missing Authorization Leading to Root Code Execution in HAVELSAN's Liman MYS (high 8.8)
- [CVE-2026-1865](https://insights.sbomify.com/CVE-2026-1865/): User Registration & Membership <= 5.1.2 - Authenticated (Subscriber+) SQL Injection via membership_ids[] (medium 6.5)
- [CVE-2026-18649](https://insights.sbomify.com/CVE-2026-18649/): Gstreamer1-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay rtp depayloaders (high 7.5)
- [CVE-2026-18648](https://insights.sbomify.com/CVE-2026-18648/): Blix Email Blue Mail Calendar App react-native-receive-sharing-intent FileDirectory.getFileFromUri path traversal (medium 4.8)
- [CVE-2026-18647](https://insights.sbomify.com/CVE-2026-18647/): jina-ai reader Crawler/Puppeteer crawler.ts isValidTLD server-side request forgery (medium 6.9)
- [CVE-2026-18646](https://insights.sbomify.com/CVE-2026-18646/): danpros HTMLy Author Name htmly.php path traversal (medium 6.9)
- [CVE-2026-18645](https://insights.sbomify.com/CVE-2026-18645/): danpros HTMLy Admin Content Endpoint admin.php add_content path traversal (medium 5.3)
- [CVE-2026-18644](https://insights.sbomify.com/CVE-2026-18644/): danpros HTMLy Delete Username Endpoint htmly.php unlink path traversal (medium 5.3)
- [CVE-2026-18642](https://insights.sbomify.com/CVE-2026-18642/): Remote Code Execution via Insecure Deserialization in TÜBİTAK BİLGEM's eta-otp-lock (high 7.8)
- [CVE-2026-18641](https://insights.sbomify.com/CVE-2026-18641/): Command injection in Operation and Maintenance Security Management System (medium 6.9)
- [CVE-2026-18640](https://insights.sbomify.com/CVE-2026-18640/): Velociraptor directory traversal via the NewNotebook API (high 7.1)
- [CVE-2026-18639](https://insights.sbomify.com/CVE-2026-18639/): Velociraptor OIDC Authenticator susceptible to email spoofing (high 7.3)
- [CVE-2026-18638](https://insights.sbomify.com/CVE-2026-18638/): Velociraptor server crash via the SetPassword API (medium 6.5)
- [CVE-2026-18636](https://insights.sbomify.com/CVE-2026-18636/): Velociraptor VFSGetBuffer API path deny list bypass (medium 6.8)
- [CVE-2026-18635](https://insights.sbomify.com/CVE-2026-18635/): Velociraptor query plugin allows impersonation in other orgs (high 7.2)
- [CVE-2026-18634](https://insights.sbomify.com/CVE-2026-18634/): Deserialization in GMS (high 8.4)
- [CVE-2026-18632](https://insights.sbomify.com/CVE-2026-18632/): langgenius dify Jinja2 jinja2_transformer.py jinja2.Template special elements used in a template engine (medium 5.3)
- [CVE-2026-18631](https://insights.sbomify.com/CVE-2026-18631/): jeequan jeepay PreAuthorize SysLogController.java WebSecurityConfig authorization (medium 5.3)
- [CVE-2026-18630](https://insights.sbomify.com/CVE-2026-18630/): SQL Injection in TMT Machine's Talassoft Industrial Management Software (high 8.8)
- [CVE-2026-18626](https://insights.sbomify.com/CVE-2026-18626/): Out-of-bounds Read vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers. (medium 6.8)
- [CVE-2026-18622](https://insights.sbomify.com/CVE-2026-18622/): Foxit PDF Editor/Reader's signature-validation pop-up reports modified certified documents as valid (medium 4.7)
- [CVE-2026-18621](https://insights.sbomify.com/CVE-2026-18621/): Data-sciences-pipeline: dsp: v1 argo template path accepts arbitrary workflow spec, bypassing all v2 security hardening (high 7.6)
- [CVE-2026-18620](https://insights.sbomify.com/CVE-2026-18620/): Data-sciences-pipeline: user-controlled serviceaccount for workflow pods without authorization check — confused deputy (high 7.1)
- [CVE-2026-1862](https://insights.sbomify.com/CVE-2026-1862/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-18618](https://insights.sbomify.com/CVE-2026-18618/): Ml-metdata: bundled grpc 1.46.3 (2022) with published http/2 dos cves — directly reachable on listener (high 7.5)
- [CVE-2026-18617](https://insights.sbomify.com/CVE-2026-18617/): Code injection in Red Hat OpenShift AI 2.25 (high 8.8)
- [CVE-2026-18616](https://insights.sbomify.com/CVE-2026-18616/): GL-iNet GL-MT3000 wg-server.so Native Plugin glc server.set_peer command injection (critical 9.3)
- [CVE-2026-18615](https://insights.sbomify.com/CVE-2026-18615/): GL-iNet GL-MT3000 wg-server.so Native Plugin glc wg-server.generate_publickey command injection (critical 9.3)
- [CVE-2026-18614](https://insights.sbomify.com/CVE-2026-18614/): GL-iNet GL-MT3000 s2s.so Native Plugin glc s2s.enable_echo_server command injection (critical 9.3)
- [CVE-2026-18613](https://insights.sbomify.com/CVE-2026-18613/): GL-iNet GL-MT3000 plugins.so Native Plugin glc plugins.set_config injection (critical 9.3)
- [CVE-2026-18612](https://insights.sbomify.com/CVE-2026-18612/): GL-iNet GL-MT3000 plugins.so Native Plugin glc plugins.install_package command injection (critical 9.3)
- [CVE-2026-18611](https://insights.sbomify.com/CVE-2026-18611/): Data-science-pipelines-operator: dspo: cryptographically weak secret generation (math/rand) for db and s3 credentials (high 7.5)
- [CVE-2026-18610](https://insights.sbomify.com/CVE-2026-18610/): NewType WebEIP EIP_Com_FileList.aspx improper authentication (medium 6.9)
- [CVE-2026-1861](https://insights.sbomify.com/CVE-2026-1861/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-18608](https://insights.sbomify.com/CVE-2026-18608/): Privilege escalation in Red Hat OpenShift AI 2.25 (high 8.7)
- [CVE-2026-18607](https://insights.sbomify.com/CVE-2026-18607/): Wavlink NU516 lighttpd upload.cgi strcpy stack-based overflow (high 8.7)
- [CVE-2026-18606](https://insights.sbomify.com/CVE-2026-18606/): Razer RzUpdateService Named Pipe RzUpdateService.exe privileges management (high 8.5)
- [CVE-2026-18605](https://insights.sbomify.com/CVE-2026-18605/): CheckMAL AppCheck Pro Kernel Mini-Filter Driver AppCheckD.sys uncontrolled search path (high 7.3)
- [CVE-2026-18604](https://insights.sbomify.com/CVE-2026-18604/): textPlus Text Message and Call App com.gogii.textplus DialerActivity improper export of android application components (medium 4.8)
- [CVE-2026-18603](https://insights.sbomify.com/CVE-2026-18603/): Cancel Order & Request Woocommerce < 1.3.4.34 - Unauthenticated Order Content Disclosure via Reorder AJAX Actions (medium 6.5)
- [CVE-2026-18602](https://insights.sbomify.com/CVE-2026-18602/): GL.iNet GL-MT3000 ovpn-client.so Native Plugin glc ovpn-client.get_recommend_config command injection (critical 9.3)
- [CVE-2026-18601](https://insights.sbomify.com/CVE-2026-18601/): GL.iNet GL-MT3000 ovpn-client.so Native Plugin glc ovpn-client.check_config command injection (critical 9.3)
- [CVE-2026-18600](https://insights.sbomify.com/CVE-2026-18600/): GL.iNet GL-MT3000 Network Lua RPC Plugin network network.switch_status command injection (high 8.7)
- [CVE-2026-1860](https://insights.sbomify.com/CVE-2026-1860/): Kali Forms <= 2.4.8 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Form Data Exposure (medium 4.3)
- [CVE-2026-18599](https://insights.sbomify.com/CVE-2026-18599/): GL.iNet GL-MT3000 Logread Lua RPC Plugin logread logread.set_config command injection (high 8.6)
- [CVE-2026-18598](https://insights.sbomify.com/CVE-2026-18598/): GL.iNet GL-MT3000 Logread Lua RPC plugin logread logread.get_system_log command injection (high 8.7)
- [CVE-2026-18597](https://insights.sbomify.com/CVE-2026-18597/): Blind SSRF on Foxit PDF Services API (high 8.5)
- [CVE-2026-18595](https://insights.sbomify.com/CVE-2026-18595/): WP-Lister Lite for eBay <= 3.8.9 - Unauthenticated Stored Cross-Site Scripting via AJAX Cron Handler Request (high 7.2)
- [CVE-2026-18594](https://insights.sbomify.com/CVE-2026-18594/): Missing authorization in Advanced Contact form 7 DB (medium 4.3)
- [CVE-2026-18593](https://insights.sbomify.com/CVE-2026-18593/): vxcontrol PentAGI Tool Management Protocol pentester.tmpl sandbox (medium 6.3)
- [CVE-2026-18592](https://insights.sbomify.com/CVE-2026-18592/): osCommerce Email Template Configuration EmailController.php EmailController sql injection (medium 5.1)
- [CVE-2026-18591](https://insights.sbomify.com/CVE-2026-18591/): Meesho Online Shopping App com.meesho.supply cleartext storage (low 2.4)
- [CVE-2026-18590](https://insights.sbomify.com/CVE-2026-18590/): Wavlink WL-NU516U1 Admin Password adm.cgi set_sys_adm os command injection (medium 5.3)
- [CVE-2026-18589](https://insights.sbomify.com/CVE-2026-18589/): Wavlink WL-NU516U1 nas.cgi change_password stack-based overflow (critical 9.3)
- [CVE-2026-18588](https://insights.sbomify.com/CVE-2026-18588/): Wavlink WL-NU516U1 nas.cgi fgets stack-based overflow (critical 9.3)
- [CVE-2026-18587](https://insights.sbomify.com/CVE-2026-18587/): Wavlink WL-NU516U1 Config Import os command injection (high 7.7)
- [CVE-2026-18586](https://insights.sbomify.com/CVE-2026-18586/): Premium Packages <= 7.0.5 - Unauthenticated Stored Cross-Site Scripting via 'order_email' (high 7.2)
- [CVE-2026-18585](https://insights.sbomify.com/CVE-2026-18585/): GL.iNet MT2500 APPS-NAS nas-web.get_file_list heap-based overflow (medium 5.3)
- [CVE-2026-18584](https://insights.sbomify.com/CVE-2026-18584/): GL.iNet E5800/E750/X2000/X3000/XE3000/XE300 eSIM LPA API v1 improper authorization (medium 5.3)
- [CVE-2026-18583](https://insights.sbomify.com/CVE-2026-18583/): mz-automation libiec61850 MMS Request mms_mapping.c checkDataSetAccess out-of-bounds (medium 6.9)
- [CVE-2026-18582](https://insights.sbomify.com/CVE-2026-18582/): Memory corruption in libiec61850 (medium 6.9)
- [CVE-2026-18581](https://insights.sbomify.com/CVE-2026-18581/): ggml-org llama.cpp Jinja Minja Template parser.cpp assertion (medium 4.8)
- [CVE-2026-1858](https://insights.sbomify.com/CVE-2026-1858/): wget2 Improper Certificate Validation (medium 4.8)
- [CVE-2026-18579](https://insights.sbomify.com/CVE-2026-18579/): WP Photo Album Plus <= 9.2.08.003 - Unauthenticated Stored Cross-Site Scripting (high 7.2)
- [CVE-2026-18577](https://insights.sbomify.com/CVE-2026-18577/): N-able N-central Authentication Bypass Using an Alternate Path or Channel (high 8.2, exploited in the wild)
- [CVE-2026-18574](https://insights.sbomify.com/CVE-2026-18574/): Authentication Bypass in Check Point Security Management Server (critical 9.3)
- [CVE-2026-18573](https://insights.sbomify.com/CVE-2026-18573/): Keycloak-services: keycloak-services: client access-type policy condition bypass during client update (medium 6.5)
- [CVE-2026-18572](https://insights.sbomify.com/CVE-2026-18572/): Keycloak-services: keycloak-services: uma claim token can override authorization time-policy evaluation attributes (medium 6.5)
- [CVE-2026-18571](https://insights.sbomify.com/CVE-2026-18571/): Keycloak-services: keycloak-services: fgap v2 group assignment bypass during user creation (medium 6.6)
- [CVE-2026-18570](https://insights.sbomify.com/CVE-2026-18570/): Keycloak-services: keycloak-services: full-scope-disabled client policy validation bypass via omitted fullscopeallowed (medium 5.4)
- [CVE-2026-1857](https://insights.sbomify.com/CVE-2026-1857/): Server-side request forgery in Kadence Blocks — Page Builder Toolkit for Gutenberg Editor (medium 4.3)
- [CVE-2026-18569](https://insights.sbomify.com/CVE-2026-18569/): Keycloak-services: keycloak-services: oidc backchannel logout accepts unsigned forged logout tokens (low 3.7)
- [CVE-2026-18568](https://insights.sbomify.com/CVE-2026-18568/): Security feature bypass in XML::Sig (high 7.5)
- [CVE-2026-18567](https://insights.sbomify.com/CVE-2026-18567/): IBM Db2 Mirror for i is affected by multiple vulnerabilities [, , ] (medium 4.4)
- [CVE-2026-18562](https://insights.sbomify.com/CVE-2026-18562/): HUSKY <= 1.4.3 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2026-18561](https://insights.sbomify.com/CVE-2026-18561/): Unlimited Elements For Elementor <= 2.0.16 - Unauthenticated SQL Injection (high 7.5)
- [CVE-2026-18560](https://insights.sbomify.com/CVE-2026-18560/): Missing authorization in Mattermost (medium 4.3)
- [CVE-2026-1856](https://insights.sbomify.com/CVE-2026-1856/): Cross-site scripting in Creavi Appointment Booking Calendar (medium 6.4)
- [CVE-2026-18558](https://insights.sbomify.com/CVE-2026-18558/): Embed Any Document <= 2.7.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'embeddoc' Shortcode (medium 6.4)
- [CVE-2026-18557](https://insights.sbomify.com/CVE-2026-18557/): Photo Gallery by 10Web <= 1.8.42 - Reflected Cross-Site Scripting via 'title' Parameter (medium 6.1)
- [CVE-2026-18556](https://insights.sbomify.com/CVE-2026-18556/): N-able N-central Authentication Bypass Using an Alternate Path or Channel (high 8.2, exploited in the wild)
- [CVE-2026-18555](https://insights.sbomify.com/CVE-2026-18555/): Cross-site scripting in Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots (medium 6.1)
- [CVE-2026-18554](https://insights.sbomify.com/CVE-2026-18554/): IBM Db2 Mirror for i is affected by multiple vulnerabilities (high 7.5)
- [CVE-2026-18551](https://insights.sbomify.com/CVE-2026-18551/): Mattermost guest account privilege escalation via member roles API (medium 6.5)
- [CVE-2026-18550](https://insights.sbomify.com/CVE-2026-18550/): Nokri - Job Board WordPress Theme <= 1.6.6 - Unauthenticated Privilege Escalation via 'token' Parameter (critical 9.8)
- [CVE-2026-18549](https://insights.sbomify.com/CVE-2026-18549/): @fastify/multipart vulnerable to Denial of Service via aborted upload after fileSize limit (high 7.5)
- [CVE-2026-18548](https://insights.sbomify.com/CVE-2026-18548/): Groundhogg <= 4.5.14 - Unauthenticated Stored Cross-Site Scripting via 'ref' Parameter (high 7.2)
- [CVE-2026-18547](https://insights.sbomify.com/CVE-2026-18547/): Cross-site scripting in Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin (medium 6.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/831/