# Vulnerabilities published in 2026


- [CVE-2026-18415](https://insights.sbomify.com/CVE-2026-18415/): Out-of-bounds write in the IEEE 802.15.4 L2 transmit path for oversized non-6LoWPAN frames (medium 6.3)
- [CVE-2026-18414](https://insights.sbomify.com/CVE-2026-18414/): Out-of-bounds write in the ADI MAX32 ADC driver due to incorrect adc_sequence buffer size validation (high 7.8)
- [CVE-2026-18413](https://insights.sbomify.com/CVE-2026-18413/): Out-of-bounds write in the NXP MCUX LPADC ADC driver due to missing adc_sequence buffer size validation (high 7.8)
- [CVE-2026-18412](https://insights.sbomify.com/CVE-2026-18412/): The OpenCart v4.2.0.0 extension installer contains a directory traversal vulnerability (critical 9.1)
- [CVE-2026-18411](https://insights.sbomify.com/CVE-2026-18411/): Use of hard-coded cryptographic key in Acrisure KARR BT and DR-100 (high 7.2)
- [CVE-2026-1841](https://insights.sbomify.com/CVE-2026-1841/): PixelYourSite <= 11.2.0 - Unauthenticated Stored Cross-Site Scripting (high 7.2)
- [CVE-2026-18409](https://insights.sbomify.com/CVE-2026-18409/): Cross-site scripting in WPForms Pro (high 7.2)
- [CVE-2026-18408](https://insights.sbomify.com/CVE-2026-18408/): PostgreSQL psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client (high 8.8)
- [CVE-2026-18406](https://insights.sbomify.com/CVE-2026-18406/): SureForms <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Text Field Entity-Encoded Payload (high 7.2)
- [CVE-2026-18405](https://insights.sbomify.com/CVE-2026-18405/): Jeg Kit for Elementor <= 3.2.16 - Unauthenticated Stored Cross-Site Scripting via Comment Content (high 7.2)
- [CVE-2026-18404](https://insights.sbomify.com/CVE-2026-18404/): Cross-site scripting in Social Chat – Click To Chat App Button (medium 6.4)
- [CVE-2026-18403](https://insights.sbomify.com/CVE-2026-18403/): LimeSurvey Community Edition 7.0.5 - Authenticated SQL injection in CPDB (medium 6.0)
- [CVE-2026-18402](https://insights.sbomify.com/CVE-2026-18402/): Cross-site scripting in SureDash – Community, Courses & Member Dashboard (medium 6.4)
- [CVE-2026-18401](https://insights.sbomify.com/CVE-2026-18401/): jackson-core: Number length constraint bypass in non-blocking (async) JSON parser leads to potential denial of service (medium 6.9)
- [CVE-2026-18400](https://insights.sbomify.com/CVE-2026-18400/): Cross-site scripting in Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider (medium 6.4)
- [CVE-2026-1840](https://insights.sbomify.com/CVE-2026-1840/): Missing authentication for critical function in Hubbell Aclara Metrum Cellular Web Interface (high 8.7)
- [CVE-2026-18397](https://insights.sbomify.com/CVE-2026-18397/): SConnect: Native Host Unauthenticated Remote Code Execution Vulnerability (critical 9.4)
- [CVE-2026-18395](https://insights.sbomify.com/CVE-2026-18395/): Child Pages Card < 1.09 - Contributor+ Stored XSS via Shortcode Attributes (medium 5.4)
- [CVE-2026-18394](https://insights.sbomify.com/CVE-2026-18394/): Incorrect authorization in Strands Agents Tools http_request proxy credential exfiltration (medium 6.9)
- [CVE-2026-18393](https://insights.sbomify.com/CVE-2026-18393/): Ffmpeg: ffmpeg: heap buffer overflow in tdsc_load_cursor() via cur_fmt_mono cursor (medium 5.4)
- [CVE-2026-18391](https://insights.sbomify.com/CVE-2026-18391/): WooCommerce Subscriptions < 9.1.0 - Unauthenticated RCE via PHP Object Injection (critical 9.8)
- [CVE-2026-18390](https://insights.sbomify.com/CVE-2026-18390/): Command Injection in Ministry of Justice's UYAP Document Editor (high 7.8)
- [CVE-2026-1839](https://insights.sbomify.com/CVE-2026-1839/): Arbitrary Code Execution via Unsafe torch.load() in Trainer Checkpoint Loading in huggingface/transformers (medium 6.5)
- [CVE-2026-18387](https://insights.sbomify.com/CVE-2026-18387/): Groundhogg <= 4.5.14 - Authenticated (Vendor+) SQL Injection via 'tag_query' Parameter (medium 6.5)
- [CVE-2026-18386](https://insights.sbomify.com/CVE-2026-18386/): Path traversal in WP BackItUp Community Edition (medium 4.9)
- [CVE-2026-18385](https://insights.sbomify.com/CVE-2026-18385/): Code injection in Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress (medium 5.4)
- [CVE-2026-18382](https://insights.sbomify.com/CVE-2026-18382/): Server-side request forgery in Cost Management 4 (medium 6.8)
- [CVE-2026-18381](https://insights.sbomify.com/CVE-2026-18381/): Server-side request forgery in Cost Management 4 (high 7.6)
- [CVE-2026-1838](https://insights.sbomify.com/CVE-2026-1838/): Hostel <= 1.1.6 - Reflected Cross-Site Scripting via 'shortcode_id' Parameter (medium 6.1)
- [CVE-2026-18378](https://insights.sbomify.com/CVE-2026-18378/): Server-side request forgery in Cost Management 4 (high 7.6)
- [CVE-2026-18374](https://insights.sbomify.com/CVE-2026-18374/): Memory corruption in glibc (medium 4.9)
- [CVE-2026-18372](https://insights.sbomify.com/CVE-2026-18372/): CSS injection in M-Files Web (medium 4.8)
- [CVE-2026-18371](https://insights.sbomify.com/CVE-2026-18371/): HTML injection in M-Files Web (medium 5.1)
- [CVE-2026-18370](https://insights.sbomify.com/CVE-2026-18370/): Heap-based buffer overflow in entr (medium 4.8)
- [CVE-2026-1837](https://insights.sbomify.com/CVE-2026-1837/): libjxl: Out-of-bounds write in grayscale color transformation when using LCMS2 (high 8.7)
- [CVE-2026-18369](https://insights.sbomify.com/CVE-2026-18369/): Server-side request forgery in Red Hat Certificate System 10 (medium 5.8)
- [CVE-2026-18368](https://insights.sbomify.com/CVE-2026-18368/): Heap buffer overflow in Modbusgwd (medium 6.0)
- [CVE-2026-18367](https://insights.sbomify.com/CVE-2026-18367/): Privilege escalation in Sophos Endpoint for macOS (critical 9.3)
- [CVE-2026-18366](https://insights.sbomify.com/CVE-2026-18366/): Events Manager < 7.4.1 - Unauthenticated Privilege Escalation to Administrator (critical 9.8)
- [CVE-2026-18365](https://insights.sbomify.com/CVE-2026-18365/): Zportals < 6.4.2 - Subscriber+ User Email Disclosure (medium 4.3)
- [CVE-2026-18364](https://insights.sbomify.com/CVE-2026-18364/): Zportals < 6.4.2 - Subscriber+ Arbitrary Plugin Settings Update (medium 4.3)
- [CVE-2026-18363](https://insights.sbomify.com/CVE-2026-18363/): Weak password recovery mechanism in osTicket by Enhancesoft LLC (critical 9.1)
- [CVE-2026-18362](https://insights.sbomify.com/CVE-2026-18362/): DFIR-IRIS Missing Brute Force Protection in User Authentication (medium 5.9)
- [CVE-2026-18361](https://insights.sbomify.com/CVE-2026-18361/): DFIR-IRIS Stored XSS in Datastore Upload (high 7.6)
- [CVE-2026-18360](https://insights.sbomify.com/CVE-2026-18360/): DFIR-IRIS Stored XSS in Custom Attributes (high 7.6)
- [CVE-2026-1836](https://insights.sbomify.com/CVE-2026-1836/): Stored credentials in Redmine (medium 5.3)
- [CVE-2026-18359](https://insights.sbomify.com/CVE-2026-18359/): Server-Side Request Forgery (SSRF) in eScriptorium (high 8.5)
- [CVE-2026-18358](https://insights.sbomify.com/CVE-2026-18358/): Denial of service in Red Hat Enterprise Linux 10 (high 7.5)
- [CVE-2026-18357](https://insights.sbomify.com/CVE-2026-18357/): WPC Order Tip for WooCommerce < 3.3.1 - Unauthenticated Order Data Disclosure (high 7.5)
- [CVE-2026-18356](https://insights.sbomify.com/CVE-2026-18356/): Limit Login Attempts Reloaded < 3.3.5 - Username Denylist Bypass via Case Variant and Account Email (low 3.7)
- [CVE-2026-18355](https://insights.sbomify.com/CVE-2026-18355/): Integer overflow in Red Hat Directory Server 11.5 E4S for RHEL 8 (high 7.5)
- [CVE-2026-18353](https://insights.sbomify.com/CVE-2026-18353/): Unauthenticated SSRF in PIA via OIDC issuer allowlist bypass (high 8.8)
- [CVE-2026-18352](https://insights.sbomify.com/CVE-2026-18352/): User Access Manager <= 2.3.15 - Unauthenticated Arbitrary File Read via 'uamgetfile' Parameter (high 7.5)
- [CVE-2026-18351](https://insights.sbomify.com/CVE-2026-18351/): Drag and Drop File Upload for Elementor Forms <= 1.6.0 - Unauthenticated Arbitrary File Upload via 'type' Parameter (critical 9.8)
- [CVE-2026-1835](https://insights.sbomify.com/CVE-2026-1835/): lcg0124 BootDo cross-site request forgery (medium 5.3)
- [CVE-2026-18349](https://insights.sbomify.com/CVE-2026-18349/): SAMA5D44 Fault Injection Vulnerability (high 7.3)
- [CVE-2026-18348](https://insights.sbomify.com/CVE-2026-18348/): Velociraptor NETWORK ACL bypass via upload_azure / upload_sftp / upload_smb VQL plugins (medium 4.1)
- [CVE-2026-18347](https://insights.sbomify.com/CVE-2026-18347/): Missing authorization in Kirki – Freeform Page Builder, Website Builder & Customizer (medium 4.3)
- [CVE-2026-18346](https://insights.sbomify.com/CVE-2026-18346/): TikTok <= 1.4.1 - Missing Authorization to Unauthenticated TikTok Integration Takeover via 'auth_code' Parameter (medium 5.3)
- [CVE-2026-18345](https://insights.sbomify.com/CVE-2026-18345/): Missing authorization in WP User Manager – User Profile Builder & Membership (medium 4.3)
- [CVE-2026-18344](https://insights.sbomify.com/CVE-2026-18344/): Responsive Thumbnail Slider < 1.1.53 - Reflected Cross-Site Scripting via 'id' Parameter (medium 6.1)
- [CVE-2026-18343](https://insights.sbomify.com/CVE-2026-18343/): IBM i is Affected By An Improper Privilege Management Vulnerability (medium 4.4)
- [CVE-2026-18341](https://insights.sbomify.com/CVE-2026-18341/): IBM i is Affected By Buffer Overflow Vulnerability [] (medium 6.3)
- [CVE-2026-1834](https://insights.sbomify.com/CVE-2026-1834/): Ibtana - WordPress Website Builder <= 1.2.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2026-18335](https://insights.sbomify.com/CVE-2026-18335/): Server-side request forgery in Kirki – Freeform Page Builder, Website Builder & Customizer (medium 5.4)
- [CVE-2026-18331](https://insights.sbomify.com/CVE-2026-18331/): Formidable Forms <= 6.33.1 - Unauthenticated Stored Cross-Site Scripting via 'frm_user_id' Parameter (high 7.2)
- [CVE-2026-18330](https://insights.sbomify.com/CVE-2026-18330/): Hardcoded Shared RSA-1024 Private Key in Web Login in TP-Link RE305 and Archer C7 (medium 6.1)
- [CVE-2026-1833](https://insights.sbomify.com/CVE-2026-1833/): Missing authorization in WaMate Confirm – Order Confirmation (medium 5.3)
- [CVE-2026-18329](https://insights.sbomify.com/CVE-2026-18329/): NGINX ngx_http_js_module vulnerability (high 8.8)
- [CVE-2026-18328](https://insights.sbomify.com/CVE-2026-18328/): Forminator Forms <= 1.57.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'error_description' Parameter (high 7.2)
- [CVE-2026-18325](https://insights.sbomify.com/CVE-2026-18325/): Forminator Forms <= 1.56.1 - Unauthenticated Stored Cross-Site Scripting via Forged Upload Record via Select Field (high 7.2)
- [CVE-2026-18324](https://insights.sbomify.com/CVE-2026-18324/): Forminator Forms <= 1.57.0.1 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field (high 7.2)
- [CVE-2026-18323](https://insights.sbomify.com/CVE-2026-18323/): Forminator Forms <= 1.57.0.2 - Unauthenticated Stored Cross-Site Scripting via Radio Field (Save and Continue Draft) (high 7.2)
- [CVE-2026-18322](https://insights.sbomify.com/CVE-2026-18322/): Smart Popup by Supsystic <= 1.12.0 - Unauthenticated Privilege Escalation to Administrator (high 8.8)
- [CVE-2026-18321](https://insights.sbomify.com/CVE-2026-18321/): Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in ntpsec (medium 4.7)
- [CVE-2026-18320](https://insights.sbomify.com/CVE-2026-18320/): CVE-2026-18320 (medium 6.1)
- [CVE-2026-1832](https://insights.sbomify.com/CVE-2026-1832/): ThriveDesk <= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Cache Deletion (medium 4.3)
- [CVE-2026-18318](https://insights.sbomify.com/CVE-2026-18318/): IBM i Information Disclosure (medium 5.3)
- [CVE-2026-18317](https://insights.sbomify.com/CVE-2026-18317/): Missing authorization in Foxtool All-in-One: Contact chat button, Custom login, Media optimize images (medium 4.3)
- [CVE-2026-18316](https://insights.sbomify.com/CVE-2026-18316/): Missing authorization in Solace Extra (critical 9.1)
- [CVE-2026-18315](https://insights.sbomify.com/CVE-2026-18315/): Missing authorization in TrueBooker – Appointment Booking and Scheduler System (critical 9.8)
- [CVE-2026-18313](https://insights.sbomify.com/CVE-2026-18313/): rpcapd memory leak in libpcap before 1.10.7 (medium 4.3)
- [CVE-2026-18312](https://insights.sbomify.com/CVE-2026-18312/): CVE-2026-18312 (medium 6.1)
- [CVE-2026-18311](https://insights.sbomify.com/CVE-2026-18311/): CVE-2026-18311 (medium 6.1)
- [CVE-2026-1831](https://insights.sbomify.com/CVE-2026-1831/): YayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) Plugin Installation and Activation (low 2.7)
- [CVE-2026-18309](https://insights.sbomify.com/CVE-2026-18309/): GIMP APNG File Parsing Integer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-18308](https://insights.sbomify.com/CVE-2026-18308/): GIMP TIF File Parsing Integer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-18307](https://insights.sbomify.com/CVE-2026-18307/): GIMP TIF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-18306](https://insights.sbomify.com/CVE-2026-18306/): GIMP SGI File Parsing Integer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-18305](https://insights.sbomify.com/CVE-2026-18305/): GIMP TIF File Parsing Integer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-18304](https://insights.sbomify.com/CVE-2026-18304/): GIMP TIF File Parsing Integer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-18303](https://insights.sbomify.com/CVE-2026-18303/): GIMP TIF File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-18302](https://insights.sbomify.com/CVE-2026-18302/): GIMP TIF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-18301](https://insights.sbomify.com/CVE-2026-18301/): GIMP PSD File Parsing Integer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-18300](https://insights.sbomify.com/CVE-2026-18300/): GIMP HDR File Parsing Integer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-1830](https://insights.sbomify.com/CVE-2026-1830/): Quick Playground <= 1.3.1 - Missing Authorization to Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2026-18299](https://insights.sbomify.com/CVE-2026-18299/): GStreamer rtpsbcdepay Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-18298](https://insights.sbomify.com/CVE-2026-18298/): GStreamer PNG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-18297](https://insights.sbomify.com/CVE-2026-18297/): GStreamer OGG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-18296](https://insights.sbomify.com/CVE-2026-18296/): GStreamer MRF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/833/