# Vulnerabilities published in 2026


- [CVE-2026-17469](https://insights.sbomify.com/CVE-2026-17469/): IBM i is Affected By Denial of Service Vulnerabilities in Line Printer Daemon [, ] (medium 5.3)
- [CVE-2026-17468](https://insights.sbomify.com/CVE-2026-17468/): IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code execution (medium 5.3)
- [CVE-2026-17467](https://insights.sbomify.com/CVE-2026-17467/): Vulnerabilities exists in IBM Cloud Pak for Data System (high 8.2)
- [CVE-2026-17465](https://insights.sbomify.com/CVE-2026-17465/): Multiple Vulnerabilities in IBM Concert Software (medium 6.5)
- [CVE-2026-17463](https://insights.sbomify.com/CVE-2026-17463/): Denial of service in Db2 (medium 6.5)
- [CVE-2026-1746](https://insights.sbomify.com/CVE-2026-1746/): JeecgBoot Online Report API loadDictItemByKeyword sql injection (medium 5.3)
- [CVE-2026-17459](https://insights.sbomify.com/CVE-2026-17459/): perwendel spark SparkJava ExternalResourceHandler.jav staticFiles.externalLocation symlink (medium 5.3)
- [CVE-2026-17458](https://insights.sbomify.com/CVE-2026-17458/): mf-yang openclaw-cn Browser Control HTTP API agent.act.ts clickViaPlaywright server-side request forgery (medium 5.3)
- [CVE-2026-17457](https://insights.sbomify.com/CVE-2026-17457/): mf-yang openclaw-cn Scheme navigation-guard.ts assertBrowserNavigationAllowed information disclosure (medium 5.3)
- [CVE-2026-1745](https://insights.sbomify.com/CVE-2026-1745/): SourceCodester Medical Certificate Generator App cross-site request forgery (medium 5.3)
- [CVE-2026-17445](https://insights.sbomify.com/CVE-2026-17445/): IBM i is Affected By Improper Validation Vulnerability in Line Printer Daemon [] (high 8.2)
- [CVE-2026-17444](https://insights.sbomify.com/CVE-2026-17444/): IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs (medium 5.3)
- [CVE-2026-17443](https://insights.sbomify.com/CVE-2026-17443/): IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs (medium 5.3)
- [CVE-2026-17442](https://insights.sbomify.com/CVE-2026-17442/): IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs (medium 5.1)
- [CVE-2026-17440](https://insights.sbomify.com/CVE-2026-17440/): IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs (medium 5.5)
- [CVE-2026-1744](https://insights.sbomify.com/CVE-2026-1744/): D-Link DSL-6641K sp_pppoe_user.js doSubmitPPP cross site scripting (medium 4.8)
- [CVE-2026-17438](https://insights.sbomify.com/CVE-2026-17438/): IBM i is Affected By An Improper Privilege Management Vulnerability in LDAP [] (medium 4.4)
- [CVE-2026-17436](https://insights.sbomify.com/CVE-2026-17436/): Vulnerabilities in IBM AIX and PowerVM VIOS (high 8.8)
- [CVE-2026-17435](https://insights.sbomify.com/CVE-2026-17435/): File::Rotate::Simple versions before 0.4.0 for Perl create the target of dangling symlinks when rotating files (low 2.5)
- [CVE-2026-17434](https://insights.sbomify.com/CVE-2026-17434/): nanocoai NanoClaw add_mcp_server request.ts handleAddMcpServer improper authorization (medium 5.3)
- [CVE-2026-17433](https://insights.sbomify.com/CVE-2026-17433/): nanocoai NanoClaw MCP Server Approval chat-sdk-bridge.ts createChatSdkBridge.setup improper authorization (medium 4.8)
- [CVE-2026-17432](https://insights.sbomify.com/CVE-2026-17432/): NousResearch hermes-agent SimpleX Gateway Authorization adapter.py access control (low 2.3)
- [CVE-2026-17431](https://insights.sbomify.com/CVE-2026-17431/): Command injection in PDF::WebKit (medium 6.1)
- [CVE-2026-1743](https://insights.sbomify.com/CVE-2026-1743/): DJI Mavic Mini/Air/Spark/Mini SE Enhanced Wi-Fi Pairing authentication replay (low 2.3)
- [CVE-2026-17429](https://insights.sbomify.com/CVE-2026-17429/): Power System Incorrect Authorization (high 8.1)
- [CVE-2026-17425](https://insights.sbomify.com/CVE-2026-17425/): Vulnerabilities in IBM AIX and PowerVM VIOS (high 7.5)
- [CVE-2026-17424](https://insights.sbomify.com/CVE-2026-17424/): Vulnerabilities in IBM AIX and PowerVM VIOS (medium 4.8)
- [CVE-2026-17423](https://insights.sbomify.com/CVE-2026-17423/): Vulnerabilities in IBM AIX and PowerVM VIOS (high 7.7)
- [CVE-2026-17422](https://insights.sbomify.com/CVE-2026-17422/): Vulnerabilities in IBM AIX and PowerVM VIOS (critical 9.3)
- [CVE-2026-17420](https://insights.sbomify.com/CVE-2026-17420/): IBM i is Affected By Multiple Vulnerabilities in SQL (medium 6.3)
- [CVE-2026-1742](https://insights.sbomify.com/CVE-2026-1742/): EFM ipTIME A8004T VPN Service timepro.cgi commit_vpncli_file_upload unrestricted upload (medium 5.1)
- [CVE-2026-17419](https://insights.sbomify.com/CVE-2026-17419/): IBM i is Affected By Multiple Vulnerabilities in SQL (medium 6.5)
- [CVE-2026-17418](https://insights.sbomify.com/CVE-2026-17418/): IBM i is Affected By Multiple Vulnerabilities in SQL (high 8.5)
- [CVE-2026-17417](https://insights.sbomify.com/CVE-2026-17417/): IBM i is Affected By Remote Code Execution Vulnerabilities [, ] (high 8.8)
- [CVE-2026-17416](https://insights.sbomify.com/CVE-2026-17416/): IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs (high 7.8)
- [CVE-2026-17414](https://insights.sbomify.com/CVE-2026-17414/): Power System Improper Input Validation (high 8.1)
- [CVE-2026-17413](https://insights.sbomify.com/CVE-2026-17413/): This Power System update is being released to address (medium 5.1)
- [CVE-2026-1741](https://insights.sbomify.com/CVE-2026-1741/): EFM ipTIME A8004T Debug d.cgi httpcon_check_session_url backdoor (high 7.5)
- [CVE-2026-1740](https://insights.sbomify.com/CVE-2026-1740/): EFM ipTIME A8004T Hidden Hiddenloginsetup timepro.cgi httpcon_check_session_url improper authentication (medium 6.9)
- [CVE-2026-1739](https://insights.sbomify.com/CVE-2026-1739/): Free5GC pcf smpolicy.go HandleCreateSmPolicyRequest null pointer dereference (medium 6.9)
- [CVE-2026-1738](https://insights.sbomify.com/CVE-2026-1738/): Open5GS SGWC context.c sgwc_tunnel_add assertion (medium 6.9)
- [CVE-2026-1737](https://insights.sbomify.com/CVE-2026-1737/): Open5GS CreateBearerRequest s5c-handler.c sgwc_s5c_handle_create_bearer_request assertion (medium 6.9)
- [CVE-2026-1736](https://insights.sbomify.com/CVE-2026-1736/): Open5GS SGWC s11-handler.c assertion (medium 6.9)
- [CVE-2026-17351](https://insights.sbomify.com/CVE-2026-17351/): SQL injection in pgAdmin 4 (critical 9.4)
- [CVE-2026-17350](https://insights.sbomify.com/CVE-2026-17350/): pgAdmin 4: Tool permission bypass via backend routes and Socket.IO handlers (medium 5.3)
- [CVE-2026-1735](https://insights.sbomify.com/CVE-2026-1735/): Yealink MeetingBar A30 Diagnostic command injection (low 2.4)
- [CVE-2026-17349](https://insights.sbomify.com/CVE-2026-17349/): pgAdmin 4: Adhoc server clone leaks another user's stored database credentials and ownership to a non-owner (critical 9.3)
- [CVE-2026-17348](https://insights.sbomify.com/CVE-2026-17348/): Missing authorization in pgAdmin 4 (medium 6.9)
- [CVE-2026-17347](https://insights.sbomify.com/CVE-2026-17347/): pgAdmin 4: OS command injection in MASTER_PASSWORD_HOOK via untrusted username substitution (high 7.7)
- [CVE-2026-17346](https://insights.sbomify.com/CVE-2026-17346/): SQL injection in pgAdmin 4 (high 8.7)
- [CVE-2026-1734](https://insights.sbomify.com/CVE-2026-1734/): Zhong Bang CRMEB crontab Endpoint CrontabController.php authorization (medium 6.9)
- [CVE-2026-1733](https://insights.sbomify.com/CVE-2026-1733/): Zhong Bang CRMEB :uni tidyOrder improper authorization (medium 5.3)
- [CVE-2026-1732](https://insights.sbomify.com/CVE-2026-1732/): Improper Removal of Sensitive Information Before Storage or Transfer in GitLab (medium 4.3)
- [CVE-2026-1731](https://insights.sbomify.com/CVE-2026-1731/): BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection (critical 9.9, exploited in the wild)
- [CVE-2026-1730](https://insights.sbomify.com/CVE-2026-1730/): OS DataHub Maps <= 1.8.3 - Authenticated (Author+) Arbitrary File Upload (high 8.8)
- [CVE-2026-1729](https://insights.sbomify.com/CVE-2026-1729/): AdForest <= 6.0.12 - Authentication Bypass (critical 9.8)
- [CVE-2026-1728](https://insights.sbomify.com/CVE-2026-1728/): Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover (critical 9.8)
- [CVE-2026-17276](https://insights.sbomify.com/CVE-2026-17276/): IBM i is Affected By Multiple Vulnerabilities in Navigator for i (critical 9.6)
- [CVE-2026-17275](https://insights.sbomify.com/CVE-2026-17275/): IBM i is Affected by an Improper Validation Vulnerability (low 3.7)
- [CVE-2026-17274](https://insights.sbomify.com/CVE-2026-17274/): IBM i is Affected By Multiple Vulnerabilities in Debug Server (medium 5.4)
- [CVE-2026-17273](https://insights.sbomify.com/CVE-2026-17273/): IBM i is Affected By Multiple Vulnerabilities in Debug Server (medium 6.5)
- [CVE-2026-17272](https://insights.sbomify.com/CVE-2026-17272/): IBM i is Affected By a Denial of Service in HTTP Server [] (high 8.2)
- [CVE-2026-17271](https://insights.sbomify.com/CVE-2026-17271/): IBM i is Affected By Multiple Vulnerabilities in the Debug Server (high 7.5)
- [CVE-2026-17270](https://insights.sbomify.com/CVE-2026-17270/): IBM i is Affected By Multiple Vulnerabilities in Debug Server (medium 4.3)
- [CVE-2026-1727](https://insights.sbomify.com/CVE-2026-1727/): Information Disclosure via Bucket Squatting in Google Cloud Agentspace. (critical 9.1)
- [CVE-2026-17268](https://insights.sbomify.com/CVE-2026-17268/): IBM i is Affected By Multiple Vulnerabilities in Navigator for i (medium 6.8)
- [CVE-2026-17266](https://insights.sbomify.com/CVE-2026-17266/): IBM i is Affected By Multiple Vulnerabilities in Navigator for i (medium 6.5)
- [CVE-2026-17264](https://insights.sbomify.com/CVE-2026-17264/): Medixant RadiAnt DICOM Out-of-bounds write (medium 5.3)
- [CVE-2026-17262](https://insights.sbomify.com/CVE-2026-17262/): IBM i is Affected By Denial of Service and Security Restriction Bypass Vulnerabilities in FTP [, ] (medium 5.4)
- [CVE-2026-1726](https://insights.sbomify.com/CVE-2026-1726/): Multiple Vulnerabilities in IBM Guardium Key Lifecycle Manager (medium 4.8)
- [CVE-2026-17259](https://insights.sbomify.com/CVE-2026-17259/): IBM i is Affected By Multiple Vulnerabilities in Debug Server (medium 4.3)
- [CVE-2026-17255](https://insights.sbomify.com/CVE-2026-17255/): IBM i is Affected By Denial of Service Vulnerability [] (medium 4.3)
- [CVE-2026-17252](https://insights.sbomify.com/CVE-2026-17252/): Memory corruption in TL-MR6400 v7.0 (high 7.1)
- [CVE-2026-17251](https://insights.sbomify.com/CVE-2026-17251/): Unauthenticated Denial of Service via Null Pointer Dereference in HTTP Request Parsing (high 7.1)
- [CVE-2026-17250](https://insights.sbomify.com/CVE-2026-17250/): Authenticated Remote Code Execution via Stack-Based Buffer Overflow in Firmware Update Handling (high 8.5)
- [CVE-2026-1725](https://insights.sbomify.com/CVE-2026-1725/): Allocation of Resources Without Limits or Throttling in GitLab (medium 5.3)
- [CVE-2026-17248](https://insights.sbomify.com/CVE-2026-17248/): IBM i is Affected By Multiple Vulnerabilities in the Debug Server (high 7.1)
- [CVE-2026-1724](https://insights.sbomify.com/CVE-2026-1724/): Missing Authentication for Critical Function in GitLab (medium 6.8)
- [CVE-2026-1723](https://insights.sbomify.com/CVE-2026-1723/): TOTOLINK X6000R Unauthenticated Command Injection Vulnerability (critical 9.2)
- [CVE-2026-17229](https://insights.sbomify.com/CVE-2026-17229/): IBM i is Affected By Multiple Vulnerabilities in Host Servers (high 7.5)
- [CVE-2026-17227](https://insights.sbomify.com/CVE-2026-17227/): IBM Db2 Mirror for i is affected by multiple vulnerabilities (medium 5.4)
- [CVE-2026-17226](https://insights.sbomify.com/CVE-2026-17226/): IBM i is Affected By Multiple Vulnerabilities in NetServer (medium 5.4)
- [CVE-2026-17223](https://insights.sbomify.com/CVE-2026-17223/): IBM i is Affected By Multiple Vulnerabilities in Host Servers (high 8.8)
- [CVE-2026-17222](https://insights.sbomify.com/CVE-2026-17222/): IBM i is Affected By Multiple Vulnerabilities in SQL (medium 4.3)
- [CVE-2026-17220](https://insights.sbomify.com/CVE-2026-17220/): IBM i is Affected By Multiple Vulnerabilities in Host Servers (high 8.2)
- [CVE-2026-1722](https://insights.sbomify.com/CVE-2026-1722/): WCFM Marketplace <= 3.7.0 - Insecure Direct Object Reference to Unauthenticated Arbitrary Refund Request Creation (medium 5.3)
- [CVE-2026-17218](https://insights.sbomify.com/CVE-2026-17218/): IBM i is Affected By Remote Code Execution Vulnerability in Line Printer Daemon [] (critical 9.8)
- [CVE-2026-17216](https://insights.sbomify.com/CVE-2026-17216/): IBM i is Affected By Multiple Vulnerabilities in DRDA / DDM (medium 5.3)
- [CVE-2026-17212](https://insights.sbomify.com/CVE-2026-17212/): IBM i is Affected By Multiple Vulnerabilities in NetServer (medium 5.3)
- [CVE-2026-1721](https://insights.sbomify.com/CVE-2026-1721/): Reflected Cross-Site Scripting (XSS) vulnerability in AI Playground site (medium 6.2)
- [CVE-2026-17209](https://insights.sbomify.com/CVE-2026-17209/): IBM Db2 Mirror for i is affected by multiple vulnerabilities (medium 6.3)
- [CVE-2026-17207](https://insights.sbomify.com/CVE-2026-17207/): IBM i is Affected By Denial of Service Vulnerabilities in NFS [, ] (medium 6.5)
- [CVE-2026-17206](https://insights.sbomify.com/CVE-2026-17206/): IBM i is Affected By Multiple Vulnerabilities in Host Servers (high 8.1)
- [CVE-2026-17203](https://insights.sbomify.com/CVE-2026-17203/): Auth bypass in Administration Runtime Expert for i (high 7.5)
- [CVE-2026-1720](https://insights.sbomify.com/CVE-2026-1720/): Missing authorization in WowOptin: Next-Gen Popup Maker – Create Stunning Popups and Optins for Lead Generation (high 8.8)
- [CVE-2026-17199](https://insights.sbomify.com/CVE-2026-17199/): IBM i is Affected By Multiple Vulnerabilities in Host Servers (high 7.5)
- [CVE-2026-17197](https://insights.sbomify.com/CVE-2026-17197/): IBM i is Affected By Multiple Vulnerabilities in Host Servers (high 8.1)
- [CVE-2026-17196](https://insights.sbomify.com/CVE-2026-17196/): Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File Upload via 'extensions' Form Element Attribute (high 8.8)
- [CVE-2026-17195](https://insights.sbomify.com/CVE-2026-17195/): Vulnerabilities in IBM AIX and PowerVM VIOS (medium 6.5)
- [CVE-2026-17192](https://insights.sbomify.com/CVE-2026-17192/): VeloCloud Orchestrator Missing Input Validation SSRF (medium 6.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/842/