# Vulnerabilities published in 2026


- [CVE-2026-15943](https://insights.sbomify.com/CVE-2026-15943/): Keycloak-services: keycloak-services: oidc idp update reuses masked client secret after token url change (medium 5.5)
- [CVE-2026-15941](https://insights.sbomify.com/CVE-2026-15941/): Relevanssi <= 4.27.1 and Relevanssi Premium <= 2.30.2 - Authenticated (Contributor+) SQL Injection (medium 6.5)
- [CVE-2026-1594](https://insights.sbomify.com/CVE-2026-1594/): itsourcecode Society Management System add_expenses.php sql injection (medium 6.9)
- [CVE-2026-15939](https://insights.sbomify.com/CVE-2026-15939/): Simple Restrict < 1.2.9 - Contributor+ Restricted Content Disclosure via REST API (low 2.7)
- [CVE-2026-15937](https://insights.sbomify.com/CVE-2026-15937/): Agent receiver certificate confusion allows authentication with a certificate issued for another endpoint (medium 5.3)
- [CVE-2026-15933](https://insights.sbomify.com/CVE-2026-15933/): Cleartext Storage of Sensitive Credentials in OptimiDoc Server (On-Premise) (medium 6.9)
- [CVE-2026-15932](https://insights.sbomify.com/CVE-2026-15932/): Support Genix Lite < 1.4.48 - Unauthenticated Arbitrary File Read via Path Traversal (medium 5.3)
- [CVE-2026-15931](https://insights.sbomify.com/CVE-2026-15931/): Simple Membership < 4.7.8 - Unauthenticated Stored XSS via PayPal Subscription Subscriber Name (medium 6.1)
- [CVE-2026-15930](https://insights.sbomify.com/CVE-2026-15930/): Simple Membership < 4.7.8 - Unauthenticated Administrator Account Takeover via Registration Username Collision (critical 9.4)
- [CVE-2026-1593](https://insights.sbomify.com/CVE-2026-1593/): itsourcecode Society Management System edit_expenses_query.php sql injection (medium 6.9)
- [CVE-2026-15929](https://insights.sbomify.com/CVE-2026-15929/): SQL injection in SmartShare (high 7.1)
- [CVE-2026-15928](https://insights.sbomify.com/CVE-2026-15928/): Cross-site scripting in XMLRPC-C (high 8.2)
- [CVE-2026-15927](https://insights.sbomify.com/CVE-2026-15927/): Quay: mirror-registry: ssrf: repo-level mirror accepts external_reference without url validation (medium 6.8)
- [CVE-2026-15925](https://insights.sbomify.com/CVE-2026-15925/): Improper TLS Hostname Verification in Snowflake Connector for Python (critical 9.2)
- [CVE-2026-15924](https://insights.sbomify.com/CVE-2026-15924/): Use-after-free / double-free from unsynchronized concurrent access to the TLS client session cache in Zephyr sockets (medium 5.9)
- [CVE-2026-15923](https://insights.sbomify.com/CVE-2026-15923/): Infinite loop denial of service in Zephyr SDIO byte-I/O from a card-supplied zero max_blk_size (medium 4.6)
- [CVE-2026-15921](https://insights.sbomify.com/CVE-2026-15921/): nvm path traversal via a malicious mirror's LTS codename writes outside the alias directory (low 2.1)
- [CVE-2026-15920](https://insights.sbomify.com/CVE-2026-15920/): Potential cross-site scripting via URLField values in the admin (medium 5.1)
- [CVE-2026-1592](https://insights.sbomify.com/CVE-2026-1592/): Stored XSS via Create New Layer Field found in Foxit PDF Editor Cloud (medium 6.3)
- [CVE-2026-15918](https://insights.sbomify.com/CVE-2026-15918/): VikAppointments – Services Booking Calendar <= 1.2.19 - Unauthenticated SQL Injection (high 7.5)
- [CVE-2026-15917](https://insights.sbomify.com/CVE-2026-15917/): Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011 (medium 4.7)
- [CVE-2026-15916](https://insights.sbomify.com/CVE-2026-15916/): Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010 (medium 4.2)
- [CVE-2026-15915](https://insights.sbomify.com/CVE-2026-15915/): Multiple Vulnerabilities in IBM Concert Software (medium 6.2)
- [CVE-2026-15913](https://insights.sbomify.com/CVE-2026-15913/): Path Traversal in Fortra's GoAnywhere MFT Endpoint (high 7.7)
- [CVE-2026-15911](https://insights.sbomify.com/CVE-2026-15911/): Confluent Kafka Python Improper TLS Certificate Validation (high 7.4)
- [CVE-2026-1591](https://insights.sbomify.com/CVE-2026-1591/): Stored XSS via Attachments Feature in https://pdfonline.foxit.com/ (medium 6.3)
- [CVE-2026-15909](https://insights.sbomify.com/CVE-2026-15909/): RafyMrX TOKO-ONLINE-ROTI add.php authorization (medium 5.3)
- [CVE-2026-15907](https://insights.sbomify.com/CVE-2026-15907/): H3C SecPath F1000-C8300 g=log_fw_nbc_mail_jsondata sql injection (medium 6.9)
- [CVE-2026-15906](https://insights.sbomify.com/CVE-2026-15906/): Premium Packages <= 7.0.4 - Authenticated (Admin+) SQL Injection via 'orderby' Parameter (medium 6.5)
- [CVE-2026-15905](https://insights.sbomify.com/CVE-2026-15905/): Use after free in Chrome (high 7.8)
- [CVE-2026-15904](https://insights.sbomify.com/CVE-2026-15904/): Use after free in Chrome (high 8.8)
- [CVE-2026-15903](https://insights.sbomify.com/CVE-2026-15903/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-15902](https://insights.sbomify.com/CVE-2026-15902/): Use after free in Chrome (high 8.8)
- [CVE-2026-15901](https://insights.sbomify.com/CVE-2026-15901/): Use after free in Chrome (critical 9.6)
- [CVE-2026-15900](https://insights.sbomify.com/CVE-2026-15900/): Use after free in Chrome (critical 9.6)
- [CVE-2026-1590](https://insights.sbomify.com/CVE-2026-1590/): itsourcecode School Management System index.php sql injection (medium 6.9)
- [CVE-2026-15899](https://insights.sbomify.com/CVE-2026-15899/): Use after free in Chrome (critical 9.6)
- [CVE-2026-15897](https://insights.sbomify.com/CVE-2026-15897/): Privilege escalation in Super Forms – Drag & Drop Form Builder (high 8.8)
- [CVE-2026-15896](https://insights.sbomify.com/CVE-2026-15896/): Super Forms <= 6.3.316 - Unauthenticated Path Traversal to Arbitrary File Read via 'sfgtfi' URL Path Parameter (critical 9.1)
- [CVE-2026-15895](https://insights.sbomify.com/CVE-2026-15895/): OS command injection in jsii-diff in AWS jsii (high 8.4)
- [CVE-2026-15894](https://insights.sbomify.com/CVE-2026-15894/): Bluetooth Mesh solicitation PDU stack buffer overflow via oversized advertisement (high 8.8)
- [CVE-2026-15893](https://insights.sbomify.com/CVE-2026-15893/): Zephyr IPv6 Neighbor Discovery zero reachable time from crafted Router Advertisement causes assertion/DoS (medium 6.5)
- [CVE-2026-15892](https://insights.sbomify.com/CVE-2026-15892/): Heap memory leak in mcumgr settings-management handlers on access-hook rejection leads to denial of service (medium 5.3)
- [CVE-2026-15891](https://insights.sbomify.com/CVE-2026-15891/): NULL pointer dereference in Zephyr MQTT-SN client when removing a non-responsive gateway (high 7.5)
- [CVE-2026-15890](https://insights.sbomify.com/CVE-2026-15890/): AEAD nonce reuse in Zephyr secure_storage ITS default nonce provider due to missing thread synchronization (medium 5.3)
- [CVE-2026-1589](https://insights.sbomify.com/CVE-2026-1589/): itsourcecode School Management System index.php sql injection (medium 6.9)
- [CVE-2026-15889](https://insights.sbomify.com/CVE-2026-15889/): Aruba HiSpeed Cache <= 3.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content (medium 6.4)
- [CVE-2026-15887](https://insights.sbomify.com/CVE-2026-15887/): IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities (medium 5.4)
- [CVE-2026-1588](https://insights.sbomify.com/CVE-2026-1588/): jishenghua jshERP installByPath install path traversal (medium 5.1)
- [CVE-2026-1587](https://insights.sbomify.com/CVE-2026-1587/): Open5GS SGWC s11-handler.c sgwc_s11_handle_modify_bearer_request denial of service (medium 6.9)
- [CVE-2026-1586](https://insights.sbomify.com/CVE-2026-1586/): Open5GS SGWC s11-handler.c ogs_gtp2_f_teid_to_ip denial of service (medium 6.9)
- [CVE-2026-1585](https://insights.sbomify.com/CVE-2026-1585/): Privilege escalation in IJ Scan Utility (high 8.4)
- [CVE-2026-1584](https://insights.sbomify.com/CVE-2026-1584/): Gnutls: gnutls: remote denial of service via crafted clienthello with invalid psk binder (high 7.5)
- [CVE-2026-15831](https://insights.sbomify.com/CVE-2026-15831/): Generation of Incorrect Security Tokens in GitLab (medium 4.3)
- [CVE-2026-15830](https://insights.sbomify.com/CVE-2026-15830/): Potential denial-of-service vulnerability via nested geometry collections (medium 6.9)
- [CVE-2026-15829](https://insights.sbomify.com/CVE-2026-15829/): SQL Injection and Security Boundary Bypass in googleapis/mcp-toolbox (high 8.6)
- [CVE-2026-15827](https://insights.sbomify.com/CVE-2026-15827/): Missing authorization in GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor (medium 5.3)
- [CVE-2026-15826](https://insights.sbomify.com/CVE-2026-15826/): Auth bypass in User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor (critical 9.8)
- [CVE-2026-15824](https://insights.sbomify.com/CVE-2026-15824/): IBM DataPower Gateway Denial of Service (high 8.2)
- [CVE-2026-15823](https://insights.sbomify.com/CVE-2026-15823/): Missing authorization in Builderall for WordPress (medium 4.3)
- [CVE-2026-15822](https://insights.sbomify.com/CVE-2026-15822/): IBM DataPower Gateway Denial of Service (high 7.5)
- [CVE-2026-15821](https://insights.sbomify.com/CVE-2026-15821/): SureDash <= 1.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-15820](https://insights.sbomify.com/CVE-2026-15820/): Cross-site scripting in Builderall for WordPress (medium 6.4)
- [CVE-2026-1582](https://insights.sbomify.com/CVE-2026-1582/): WP All Export <= 1.4.14 - Unauthenticated Sensitive Information Exposure via PHP Type Juggling (low 3.7)
- [CVE-2026-15819](https://insights.sbomify.com/CVE-2026-15819/): IBM DataPower Gateway Out-of-bounds Write (high 7.5)
- [CVE-2026-15816](https://insights.sbomify.com/CVE-2026-15816/): Dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die() (high 7.5)
- [CVE-2026-15815](https://insights.sbomify.com/CVE-2026-15815/): CVE-2026-15815 CVE Record (high 8.8)
- [CVE-2026-15814](https://insights.sbomify.com/CVE-2026-15814/): Uploading a crafted image causes excessive memory allocation in the Mattermost Server (medium 6.5)
- [CVE-2026-15813](https://insights.sbomify.com/CVE-2026-15813/): Kronosnet: kronosnet: memory corruption and out-of-bounds access via malformed network packet defragmentation (medium 6.5)
- [CVE-2026-15812](https://insights.sbomify.com/CVE-2026-15812/): Kronosnet: kronosnet: access control list bypass via link id spoofing on unencrypted dynamic links (medium 4.8)
- [CVE-2026-15811](https://insights.sbomify.com/CVE-2026-15811/): Kronosnet: kronosnet: encryption key exposure in memory after cryptographic configuration changes (medium 5.8)
- [CVE-2026-15810](https://insights.sbomify.com/CVE-2026-15810/): Cross-Site Scripting (XSS) in Looker allows Admin Account Takeover (high 8.7)
- [CVE-2026-1581](https://insights.sbomify.com/CVE-2026-1581/): wpForo Forum <= 2.4.14 - Unauthenticated Time-Based SQL Injection (high 7.5)
- [CVE-2026-15809](https://insights.sbomify.com/CVE-2026-15809/): Github.com/cri-o/cri-o: fix bypass for cve-2022-4318 — /etc/passwd injection via home env (high 7.8)
- [CVE-2026-15806](https://insights.sbomify.com/CVE-2026-15806/): `HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching (medium 6.0)
- [CVE-2026-15804](https://insights.sbomify.com/CVE-2026-15804/): MetaGuru｜HCM - SQL Injection (high 8.7)
- [CVE-2026-15803](https://insights.sbomify.com/CVE-2026-15803/): XML external entity in Eclipse RDF4J (high 8.7)
- [CVE-2026-15802](https://insights.sbomify.com/CVE-2026-15802/): Path traversal in WP Foodbakery (high 8.1)
- [CVE-2026-15801](https://insights.sbomify.com/CVE-2026-15801/): Cri-o: cri-o: insufficient validation during container checkpoint restore (high 8.0)
- [CVE-2026-1580](https://insights.sbomify.com/CVE-2026-1580/): ingress-nginx auth-method nginx configuration injection (high 8.8)
- [CVE-2026-15798](https://insights.sbomify.com/CVE-2026-15798/): Smart Slider 3 <= 3.5.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slider' Block Attribute (medium 6.4)
- [CVE-2026-15797](https://insights.sbomify.com/CVE-2026-15797/): Popup Maker <= 1.24.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_title (medium 6.4)
- [CVE-2026-15796](https://insights.sbomify.com/CVE-2026-15796/): Cross-site scripting in Builderall for WordPress (medium 6.4)
- [CVE-2026-15795](https://insights.sbomify.com/CVE-2026-15795/): Responsive Plus <= 3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-15794](https://insights.sbomify.com/CVE-2026-15794/): Cross-site scripting in Grid/List View for WooCommerce (medium 6.4)
- [CVE-2026-15793](https://insights.sbomify.com/CVE-2026-15793/): Git source checkout from a bundle file could lead to command injection (medium 6.5)
- [CVE-2026-15792](https://insights.sbomify.com/CVE-2026-15792/): Possible panic when incorrect parameters sent from frontend (medium 6.3)
- [CVE-2026-15791](https://insights.sbomify.com/CVE-2026-15791/): LLB file operation can be tricked to remove /tmp directory contents (low 3.3)
- [CVE-2026-15790](https://insights.sbomify.com/CVE-2026-15790/): Cross-site scripting in Video Gallery – YouTube Gallery, Playlist & Video Grid (medium 6.4)
- [CVE-2026-1579](https://insights.sbomify.com/CVE-2026-1579/): PX4 Autopilot Missing authentication for critical function (critical 9.3)
- [CVE-2026-15789](https://insights.sbomify.com/CVE-2026-15789/): Malicious client can bypass destination directory validation on local sources upload (medium 6.9)
- [CVE-2026-15788](https://insights.sbomify.com/CVE-2026-15788/): WCOW cache mount source selector resolves NTFS junctions outside of cache root (medium 5.6)
- [CVE-2026-15787](https://insights.sbomify.com/CVE-2026-15787/): Cross-site scripting in Ultimate Addons for Elementor (medium 6.4)
- [CVE-2026-15786](https://insights.sbomify.com/CVE-2026-15786/): WP Encryption <= 7.8.6.6 - Authenticated (Administrator+) Arbitrary File Write via 'imploded' Parameter (medium 4.4)
- [CVE-2026-15784](https://insights.sbomify.com/CVE-2026-15784/): IBM DataPower Gateway Out-of-bounds Write (high 8.1)
- [CVE-2026-15783](https://insights.sbomify.com/CVE-2026-15783/): Missing authorization in Enterprise Server (medium 5.3)
- [CVE-2026-15782](https://insights.sbomify.com/CVE-2026-15782/): Cross-site scripting in WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More (medium 4.9)
- [CVE-2026-15781](https://insights.sbomify.com/CVE-2026-15781/): IBM DataPower Gateway Buffer Overflow (high 8.0)
- [CVE-2026-15780](https://insights.sbomify.com/CVE-2026-15780/): WP Statistics <= 14.16.8 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter (high 7.2)
- [CVE-2026-1578](https://insights.sbomify.com/CVE-2026-1578/): HP App – Potential Cross-Site Scripting (medium 5.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/854/