# Vulnerabilities published in 2026


- [CVE-2026-18181](https://insights.sbomify.com/CVE-2026-18181/): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (high 8.1)
- [CVE-2026-18180](https://insights.sbomify.com/CVE-2026-18180/): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (medium 6.5)
- [CVE-2026-18179](https://insights.sbomify.com/CVE-2026-18179/): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (medium 6.5)
- [CVE-2026-18178](https://insights.sbomify.com/CVE-2026-18178/): IBM Db2 Mirror for i is affected by multiple vulnerabilities (medium 5.4)
- [CVE-2026-18177](https://insights.sbomify.com/CVE-2026-18177/): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (high 7.1)
- [CVE-2026-18176](https://insights.sbomify.com/CVE-2026-18176/): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (high 7.4)
- [CVE-2026-18175](https://insights.sbomify.com/CVE-2026-18175/): IBM i is Affected By Improper Authorization and Authentication Vulnerabilities in DDM / DRDA [, ] (high 8.1)
- [CVE-2026-18174](https://insights.sbomify.com/CVE-2026-18174/): @fastify/forwarded vulnerable to improper input validation via unstripped tab characters in X-Forwarded-For (medium 5.3)
- [CVE-2026-18173](https://insights.sbomify.com/CVE-2026-18173/): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (low 3.7)
- [CVE-2026-18172](https://insights.sbomify.com/CVE-2026-18172/): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (high 7.4)
- [CVE-2026-18171](https://insights.sbomify.com/CVE-2026-18171/): Docker Sandboxes read-only runtime mount writable through its shared-export alias (medium 5.7)
- [CVE-2026-18170](https://insights.sbomify.com/CVE-2026-18170/): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (medium 6.5)
- [CVE-2026-18169](https://insights.sbomify.com/CVE-2026-18169/): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (critical 9.9)
- [CVE-2026-18167](https://insights.sbomify.com/CVE-2026-18167/): Stack-based buffer overflow in TP-Link Archer AX55 v4 (high 7.7)
- [CVE-2026-18166](https://insights.sbomify.com/CVE-2026-18166/): Missing authorization in Db2 (high 7.7)
- [CVE-2026-18165](https://insights.sbomify.com/CVE-2026-18165/): @fastify/oauth2 vulnerable to Login CSRF via plantable OAuth state cookies (medium 4.2)
- [CVE-2026-18164](https://insights.sbomify.com/CVE-2026-18164/): Flow Neuroscience FL-100 Use of Hard-coded Credentials (high 7.2)
- [CVE-2026-18163](https://insights.sbomify.com/CVE-2026-18163/): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (critical 9.8)
- [CVE-2026-18162](https://insights.sbomify.com/CVE-2026-18162/): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (critical 9.8)
- [CVE-2026-18161](https://insights.sbomify.com/CVE-2026-18161/): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (medium 4.3)
- [CVE-2026-1816](https://insights.sbomify.com/CVE-2026-1816/): OTP Bypass in TEİAŞ's Mobile Application (medium 6.3)
- [CVE-2026-18157](https://insights.sbomify.com/CVE-2026-18157/): Yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: remote code execution via apt argument injection (high 7.8)
- [CVE-2026-18156](https://insights.sbomify.com/CVE-2026-18156/): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (medium 6.5)
- [CVE-2026-18154](https://insights.sbomify.com/CVE-2026-18154/): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (high 8.0)
- [CVE-2026-18153](https://insights.sbomify.com/CVE-2026-18153/): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (medium 5.4)
- [CVE-2026-18152](https://insights.sbomify.com/CVE-2026-18152/): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (high 7.4)
- [CVE-2026-18151](https://insights.sbomify.com/CVE-2026-18151/): IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i. (medium 4.2)
- [CVE-2026-18150](https://insights.sbomify.com/CVE-2026-18150/): IBM i is Affected By Multiple Vulnerabilities in Navigator for i (medium 4.3)
- [CVE-2026-1815](https://insights.sbomify.com/CVE-2026-1815/): Session Hijacking in TEİAŞ's Mobile Application (medium 5.7)
- [CVE-2026-18149](https://insights.sbomify.com/CVE-2026-18149/): undici vulnerable to Denial of Service via orphaned RetryHandler response body (medium 5.9)
- [CVE-2026-18148](https://insights.sbomify.com/CVE-2026-18148/): IBM i is Affected By Multiple Vulnerabilities in Navigator for i (medium 4.3)
- [CVE-2026-18147](https://insights.sbomify.com/CVE-2026-18147/): Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url (high 8.1)
- [CVE-2026-18146](https://insights.sbomify.com/CVE-2026-18146/): Fluent Forms <= 6.2.11 - Unauthenticated Stored Cross-Site Scripting via Notification Smartcode Values (high 7.2)
- [CVE-2026-18145](https://insights.sbomify.com/CVE-2026-18145/): Fireware OS Stack-based Buffer Overflow in spamd Allows Remote Code Execution (high 8.6)
- [CVE-2026-18144](https://insights.sbomify.com/CVE-2026-18144/): IBM i is Affected By Multiple Vulnerabilities in Navigator for i (medium 4.3)
- [CVE-2026-18143](https://insights.sbomify.com/CVE-2026-18143/): Request a Quote for WooCommerce <= 2.9.2 - Unauthenticated Arbitrary File Upload via AJAX Popup Handler (critical 9.8)
- [CVE-2026-18141](https://insights.sbomify.com/CVE-2026-18141/): Aap-gateway: aap-gateway: authentication bypass in event-driven ansible via forged http header (high 8.2)
- [CVE-2026-18140](https://insights.sbomify.com/CVE-2026-18140/): aws-smithy-json: Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers (high 8.7)
- [CVE-2026-1814](https://insights.sbomify.com/CVE-2026-1814/): Rapid7 Nexpose Insecure Java Keystore Password Generation (medium 6.8)
- [CVE-2026-18137](https://insights.sbomify.com/CVE-2026-18137/): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (high 8.1)
- [CVE-2026-18134](https://insights.sbomify.com/CVE-2026-18134/): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (high 7.5)
- [CVE-2026-18133](https://insights.sbomify.com/CVE-2026-18133/): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (medium 5.4)
- [CVE-2026-18132](https://insights.sbomify.com/CVE-2026-18132/): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (medium 6.5)
- [CVE-2026-18131](https://insights.sbomify.com/CVE-2026-18131/): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (high 8.2)
- [CVE-2026-1813](https://insights.sbomify.com/CVE-2026-1813/): bolo-blog bolo-solo FreeMarker Template PicUploadProcessor.java unrestricted upload (medium 5.3)
- [CVE-2026-18129](https://insights.sbomify.com/CVE-2026-18129/): Information disclosure in Endpoint Manager (high 8.1)
- [CVE-2026-18127](https://insights.sbomify.com/CVE-2026-18127/): Path traversal in Endpoint Manager (high 7.7)
- [CVE-2026-18125](https://insights.sbomify.com/CVE-2026-18125/): Memory corruption in Endpoint Manager (high 7.5)
- [CVE-2026-18124](https://insights.sbomify.com/CVE-2026-18124/): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (medium 6.5)
- [CVE-2026-18123](https://insights.sbomify.com/CVE-2026-18123/): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (high 7.6)
- [CVE-2026-18122](https://insights.sbomify.com/CVE-2026-18122/): Concrete CMS 9.2.0 to 9.5.2 Express REST API list endpoint exposes restricted Express entries via Missing Authorization (medium 6.0)
- [CVE-2026-18121](https://insights.sbomify.com/CVE-2026-18121/): Missing authorization in Concrete CMS (medium 6.3)
- [CVE-2026-18120](https://insights.sbomify.com/CVE-2026-18120/): Missing Authorization in legacy Express entries search endpoint allows disclosure of Express entry data (medium 6.3)
- [CVE-2026-1812](https://insights.sbomify.com/CVE-2026-1812/): bolo-blog bolo-solo Filename BackupService.java importFromCnblogs path traversal (medium 5.3)
- [CVE-2026-18119](https://insights.sbomify.com/CVE-2026-18119/): Concrete CMS below 9.5.3 is vulnerable to Stored XSS via unsanitized inline block custom style values (high 7.0)
- [CVE-2026-18117](https://insights.sbomify.com/CVE-2026-18117/): Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Custom Page Alias Name (high 7.3)
- [CVE-2026-18116](https://insights.sbomify.com/CVE-2026-18116/): Concrete CMS 8.3.0 to 9.5.2 is vulnerable to Stored XSS in Calendar Event Name via Workflow Approval Notifications (high 7.3)
- [CVE-2026-18115](https://insights.sbomify.com/CVE-2026-18115/): Missing authorization in Concrete CMS (high 7.4)
- [CVE-2026-18114](https://insights.sbomify.com/CVE-2026-18114/): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (medium 6.5)
- [CVE-2026-18113](https://insights.sbomify.com/CVE-2026-18113/): Concrete CMS 9.0 to 9.5.2 is vulnerable to Stored XSS in the Top Navigation Bar Block via Dropdown Child Page Names (high 7.5)
- [CVE-2026-18111](https://insights.sbomify.com/CVE-2026-18111/): Cross-site scripting in Concrete CMS (high 8.5)
- [CVE-2026-18110](https://insights.sbomify.com/CVE-2026-18110/): Missing authorization in Concrete CMS (high 8.7)
- [CVE-2026-1811](https://insights.sbomify.com/CVE-2026-1811/): bolo-blog bolo-solo Filename BackupService.java importFromMarkdown path traversal (medium 5.3)
- [CVE-2026-18109](https://insights.sbomify.com/CVE-2026-18109/): W3 Total Cache <= 2.10.3 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name (high 7.2)
- [CVE-2026-18108](https://insights.sbomify.com/CVE-2026-18108/): Auth bypass in Net::SAML2 (critical 9.8)
- [CVE-2026-18107](https://insights.sbomify.com/CVE-2026-18107/): Criu: criu: container escape via rseq critical section hijack during checkpoint/restore (high 7.8)
- [CVE-2026-18106](https://insights.sbomify.com/CVE-2026-18106/): IBM i is Affected By Multiple Vulnerabilities in Navigator for i (medium 4.3)
- [CVE-2026-18105](https://insights.sbomify.com/CVE-2026-18105/): Fireware OS Uncontrolled Resource Consumption in Diagnostic Tasks Allows Denial of Service (high 7.1)
- [CVE-2026-18104](https://insights.sbomify.com/CVE-2026-18104/): IBM Db2 Mirror for i is vulnerable to obtain sensitive information [] (low 3.3)
- [CVE-2026-18103](https://insights.sbomify.com/CVE-2026-18103/): Dhcp-server: dhcp-server: persistent denial of service due to buffer overflow via omapi (medium 4.9)
- [CVE-2026-18102](https://insights.sbomify.com/CVE-2026-18102/): IBM i Buffer Overflow (low 3.5)
- [CVE-2026-18101](https://insights.sbomify.com/CVE-2026-18101/): IBM i is Affected By Multiple Vulnerabilities in WebSphere Application Server Liberty (high 8.8)
- [CVE-2026-18100](https://insights.sbomify.com/CVE-2026-18100/): MetForm <= 4.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mf_form_id' Widget Setting (medium 6.4)
- [CVE-2026-1810](https://insights.sbomify.com/CVE-2026-1810/): bolo-blog bolo-solo ZIP File BackupService.java unpackFilteredZip path traversal (medium 5.3)
- [CVE-2026-18099](https://insights.sbomify.com/CVE-2026-18099/): IBM i is Affected By Multiple Vulnerabilities in Navigator for i (high 8.9)
- [CVE-2026-18098](https://insights.sbomify.com/CVE-2026-18098/): IBM i is Affected By XML injection flaw in Navigator for i (high 8.1)
- [CVE-2026-18097](https://insights.sbomify.com/CVE-2026-18097/): Information disclosure in Db2 (medium 5.5)
- [CVE-2026-18096](https://insights.sbomify.com/CVE-2026-18096/): IBM® Db2® could allow a local attacker to cause a denial of service due to a memory leak (low 3.3)
- [CVE-2026-18095](https://insights.sbomify.com/CVE-2026-18095/): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (high 8.5)
- [CVE-2026-18092](https://insights.sbomify.com/CVE-2026-18092/): Auth bypass in Net::SAML2 (high 8.1)
- [CVE-2026-18090](https://insights.sbomify.com/CVE-2026-18090/): Gdk-pixbuf: gdk-pixbuf: heap out-of-bounds read in uncompress() via crafted icns rle block (medium 6.1)
- [CVE-2026-1809](https://insights.sbomify.com/CVE-2026-1809/): HTML Shortcodes <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-18089](https://insights.sbomify.com/CVE-2026-18089/): Auth bypass in Net::SAML2 (high 7.5)
- [CVE-2026-18086](https://insights.sbomify.com/CVE-2026-18086/): IBM i is Affected By Multiple Vulnerabilities in Java Secure Sockets Extension (medium 4.5)
- [CVE-2026-18085](https://insights.sbomify.com/CVE-2026-18085/): Improper Input Validation Leads to Arbitrary File Download and Potential Denial of Service in BlackBerry UEM (medium 5.9)
- [CVE-2026-18084](https://insights.sbomify.com/CVE-2026-18084/): Cross-Site Scripting (XSS) in Management Console of BlackBerry UEM (high 8.6)
- [CVE-2026-18080](https://insights.sbomify.com/CVE-2026-18080/): File upload in ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce (critical 9.8)
- [CVE-2026-1808](https://insights.sbomify.com/CVE-2026-1808/): Cross-site scripting in Orange Comfort+ accessibility toolbar for WordPress (medium 6.4)
- [CVE-2026-18078](https://insights.sbomify.com/CVE-2026-18078/): IBM i is Affected By Denial of Service Vulnerability in Save Restore [] (medium 4.3)
- [CVE-2026-18077](https://insights.sbomify.com/CVE-2026-18077/): IBM i is Affected By Multiple Vulnerabilities in Simple Mail Transfer Protocol (high 7.5)
- [CVE-2026-18076](https://insights.sbomify.com/CVE-2026-18076/): IBM i is Affected By Multiple Vulnerabilities in Debug Server (medium 4.3)
- [CVE-2026-18074](https://insights.sbomify.com/CVE-2026-18074/): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (high 8.2)
- [CVE-2026-18073](https://insights.sbomify.com/CVE-2026-18073/): IBM i is Affected By Multiple Vulnerabilities in Debug Server (medium 4.4)
- [CVE-2026-18072](https://insights.sbomify.com/CVE-2026-18072/): Hardcoded credentials in Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … (critical 9.8)
- [CVE-2026-18071](https://insights.sbomify.com/CVE-2026-18071/): IBM i is Affected By An Improper Management Vulnerability in HTTP Server [] (high 7.8)
- [CVE-2026-1807](https://insights.sbomify.com/CVE-2026-1807/): Cross-site scripting in InteractiveCalculator for WordPress (medium 6.4)
- [CVE-2026-18069](https://insights.sbomify.com/CVE-2026-18069/): IBM i is Affected By A Race Condition Vulnerability in SQL Query Engine [] (medium 6.0)
- [CVE-2026-18068](https://insights.sbomify.com/CVE-2026-18068/): IBM i is Affected By Multiple Vulnerabilities in Java Secure Sockets Extension (medium 4.3)
- [CVE-2026-18066](https://insights.sbomify.com/CVE-2026-18066/): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (high 7.9)
- [CVE-2026-18065](https://insights.sbomify.com/CVE-2026-18065/): IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i. (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/835/