# Vulnerabilities published in 2026


- [CVE-2026-15779](https://insights.sbomify.com/CVE-2026-15779/): Samba-winbind: samba: pam_winbind mkhomedir chowns critical system paths without validation (medium 6.1)
- [CVE-2026-15778](https://insights.sbomify.com/CVE-2026-15778/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-15777](https://insights.sbomify.com/CVE-2026-15777/): Use after free in Chrome (high 7.5)
- [CVE-2026-15776](https://insights.sbomify.com/CVE-2026-15776/): Code injection in Chrome (high 8.8)
- [CVE-2026-15775](https://insights.sbomify.com/CVE-2026-15775/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-15774](https://insights.sbomify.com/CVE-2026-15774/): Use after free in Chrome (high 8.3)
- [CVE-2026-15773](https://insights.sbomify.com/CVE-2026-15773/): Use after free in Chrome (critical 9.6)
- [CVE-2026-15772](https://insights.sbomify.com/CVE-2026-15772/): Use after free in Chrome (high 8.3)
- [CVE-2026-15771](https://insights.sbomify.com/CVE-2026-15771/): Information disclosure in Chrome (medium 5.3)
- [CVE-2026-15770](https://insights.sbomify.com/CVE-2026-15770/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-1577](https://insights.sbomify.com/CVE-2026-1577/): IBM® Db2® is vulnerable to a denial of service with a specially crafted query involving multiple subqueries (medium 6.5)
- [CVE-2026-15769](https://insights.sbomify.com/CVE-2026-15769/): Security feature bypass in Chrome (high 8.3)
- [CVE-2026-15768](https://insights.sbomify.com/CVE-2026-15768/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-15767](https://insights.sbomify.com/CVE-2026-15767/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-15766](https://insights.sbomify.com/CVE-2026-15766/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-15765](https://insights.sbomify.com/CVE-2026-15765/): Use after free in Chrome (high 7.5)
- [CVE-2026-15764](https://insights.sbomify.com/CVE-2026-15764/): Use after free in Chrome (high 7.5)
- [CVE-2026-15762](https://insights.sbomify.com/CVE-2026-15762/): IBM DataPower Gateway Out-of-bounds Write (critical 9.8)
- [CVE-2026-15761](https://insights.sbomify.com/CVE-2026-15761/): Tickera <= 3.6.0.1 - Authenticated (Staff+) SQL Injection via 'tc_event_filter' Parameter (medium 6.5)
- [CVE-2026-15760](https://insights.sbomify.com/CVE-2026-15760/): Missing authorization in Divi Essentials (medium 6.5)
- [CVE-2026-15759](https://insights.sbomify.com/CVE-2026-15759/): Cross-site scripting in ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form (medium 6.4)
- [CVE-2026-15758](https://insights.sbomify.com/CVE-2026-15758/): 3D FlipBook <= 1.16.20 - Unauthenticated Sensitive Information Exposure in 'id' Parameter (medium 5.3)
- [CVE-2026-15757](https://insights.sbomify.com/CVE-2026-15757/): Insufficient input validation vulnerability in NETGEAR DGND3700v1 modem router (medium 6.3)
- [CVE-2026-15755](https://insights.sbomify.com/CVE-2026-15755/): Open User Map <= 1.4.45 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-15754](https://insights.sbomify.com/CVE-2026-15754/): Missing per-channel team-scope check in ABAC access control policy unassign allows cross-team policy removal (medium 4.2)
- [CVE-2026-15753](https://insights.sbomify.com/CVE-2026-15753/): zhinianboke xianyu-auto-reply review approve trusting http permission methods on the server side (medium 5.3)
- [CVE-2026-15752](https://insights.sbomify.com/CVE-2026-15752/): zhinianboke xianyu-auto-reply Backend User Endpoint users authorization (medium 6.9)
- [CVE-2026-15751](https://insights.sbomify.com/CVE-2026-15751/): mastergo-design mastergo-magic-mcp mcp__getComponentGenerator component-workflow.md execute path traversal (medium 4.8)
- [CVE-2026-15750](https://insights.sbomify.com/CVE-2026-15750/): mastergo-design mastergo-magic-mcp mcp__getComponentLink get-component-link.ts z.string server-side request forgery (medium 5.3)
- [CVE-2026-1575](https://insights.sbomify.com/CVE-2026-1575/): Schema Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2026-15749](https://insights.sbomify.com/CVE-2026-15749/): mastergo-design mastergo-magic-mcp mcp__C2d get-c2d.ts execute path traversal (medium 4.8)
- [CVE-2026-15748](https://insights.sbomify.com/CVE-2026-15748/): Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration (critical 9.8)
- [CVE-2026-15747](https://insights.sbomify.com/CVE-2026-15747/): Information disclosure in Mojolicious (critical 9.1)
- [CVE-2026-15746](https://insights.sbomify.com/CVE-2026-15746/): Credential disclosure in Strands Agents Tools elasticsearch_memory tool (medium 6.9)
- [CVE-2026-15743](https://insights.sbomify.com/CVE-2026-15743/): Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable (medium 5.7)
- [CVE-2026-15742](https://insights.sbomify.com/CVE-2026-15742/): PostgreSQL fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound (high 8.8)
- [CVE-2026-15741](https://insights.sbomify.com/CVE-2026-15741/): PostgreSQL expression deparse allows SQL injection via EXTRACT argument (high 8.8)
- [CVE-2026-1574](https://insights.sbomify.com/CVE-2026-1574/): MyQtip – easy qTip2 <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2026-15739](https://insights.sbomify.com/CVE-2026-15739/): Cross-site scripting in Rich Showcase for Google Reviews (medium 6.4)
- [CVE-2026-15738](https://insights.sbomify.com/CVE-2026-15738/): Cross-namespace traffic interception via incorrect route precedence ordering in AWS Load Balancer Controller (medium 5.8)
- [CVE-2026-15737](https://insights.sbomify.com/CVE-2026-15737/): Sensitive content disclosure via OpenTelemetry spans in AgentCore Python SDK (medium 5.7)
- [CVE-2026-15736](https://insights.sbomify.com/CVE-2026-15736/): Multiple SQL/DDL Injection and Arbitrary File Read Vulnerabilities in snowflake-sqlalchemy (high 8.3)
- [CVE-2026-15735](https://insights.sbomify.com/CVE-2026-15735/): Cross-site scripting in Contact Form to Any API (medium 6.4)
- [CVE-2026-15734](https://insights.sbomify.com/CVE-2026-15734/): WGDashboard Server-Side Template Injection vulnerability (critical 9.8)
- [CVE-2026-15733](https://insights.sbomify.com/CVE-2026-15733/): WGDashboard Remote Code Execution vulnerability (critical 9.8)
- [CVE-2026-15732](https://insights.sbomify.com/CVE-2026-15732/): WGDashboard Server-Side Request Forgery Vulnerability (critical 9.8)
- [CVE-2026-15731](https://insights.sbomify.com/CVE-2026-15731/): Cross-site scripting in WP Multilang – Translation and Multilingual Plugin (medium 6.4)
- [CVE-2026-15730](https://insights.sbomify.com/CVE-2026-15730/): GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'heading_size' Shortcode Attribute (medium 6.4)
- [CVE-2026-1573](https://insights.sbomify.com/CVE-2026-1573/): OMIGO <= 3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2026-15727](https://insights.sbomify.com/CVE-2026-15727/): WP Bulk Delete <= 1.4.2 - Authenticated (Administrator+) SQL Injection via 'delete_user_roles' Parameter (medium 4.9)
- [CVE-2026-15726](https://insights.sbomify.com/CVE-2026-15726/): Serious Slider <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'theme' Shortcode Attribute (medium 6.4)
- [CVE-2026-15724](https://insights.sbomify.com/CVE-2026-15724/): Path traversal in Progress ShareFile Storage Zones Controller (SZC) (high 8.7)
- [CVE-2026-15723](https://insights.sbomify.com/CVE-2026-15723/): Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') in GitLab (high 8.2)
- [CVE-2026-15722](https://insights.sbomify.com/CVE-2026-15722/): Memory corruption in Red Hat Directory Server 11.5 E4S for RHEL 8 (high 7.5)
- [CVE-2026-15721](https://insights.sbomify.com/CVE-2026-15721/): Query Console SQL Injection Leading to Sensitive Data Disclosure in Bilin Software's HUMANIST Digital Human Resources (critical 9.8)
- [CVE-2026-15720](https://insights.sbomify.com/CVE-2026-15720/): Pre-auth heap out-of-bounds read in the AMF NAS 5GS mobile-identity handler (high 8.6)
- [CVE-2026-1572](https://insights.sbomify.com/CVE-2026-1572/): Cross-site scripting in Livemesh Addons by Elementor (medium 6.4)
- [CVE-2026-15719](https://insights.sbomify.com/CVE-2026-15719/): Site isolation issue in the DOM: Navigation component (medium 5.4)
- [CVE-2026-15718](https://insights.sbomify.com/CVE-2026-15718/): Invalid pointer in the JavaScript: WebAssembly component (medium 4.3)
- [CVE-2026-15715](https://insights.sbomify.com/CVE-2026-15715/): SourceCodester Class and Exam Timetabling System exam.php cross site scripting (medium 5.3)
- [CVE-2026-15714](https://insights.sbomify.com/CVE-2026-15714/): Memory corruption in Red Hat Enterprise Linux 10 (medium 6.5)
- [CVE-2026-15713](https://insights.sbomify.com/CVE-2026-15713/): Libsoup: soupcache: libsoup: http/2 frame window exhaustion remote denial of service via memory leak (medium 5.9)
- [CVE-2026-15712](https://insights.sbomify.com/CVE-2026-15712/): Memory corruption in Red Hat Enterprise Linux 10 (medium 5.9)
- [CVE-2026-15711](https://insights.sbomify.com/CVE-2026-15711/): Denial of service in Red Hat Enterprise Linux 10 (high 7.5)
- [CVE-2026-15710](https://insights.sbomify.com/CVE-2026-15710/): Netskope Client Endpoint DLP Kernel Driver Information Leakage (medium 6.8)
- [CVE-2026-1571](https://insights.sbomify.com/CVE-2026-1571/): Reflected XSS Vulnerability on TP-Link Archer C60 (medium 5.3)
- [CVE-2026-15709](https://insights.sbomify.com/CVE-2026-15709/): Denial of service in Red Hat Enterprise Linux 10 (high 7.5)
- [CVE-2026-15706](https://insights.sbomify.com/CVE-2026-15706/): Missing Authentication for Critical Function in Management API in Baylan Water Meters's BMS (critical 9.8)
- [CVE-2026-15704](https://insights.sbomify.com/CVE-2026-15704/): CWE-863: ABAC authorization bypass via trailing slash route normalization in Eclipse BaSyx Go Components (critical 9.8)
- [CVE-2026-15703](https://insights.sbomify.com/CVE-2026-15703/): SourceCodester Simple and Nice Shopping Cart Script userproductdeletequery.php sql injection (medium 6.9)
- [CVE-2026-15702](https://insights.sbomify.com/CVE-2026-15702/): tamagui config.ts updateConfig prototype pollution (medium 5.3)
- [CVE-2026-15701](https://insights.sbomify.com/CVE-2026-15701/): Totolink NR1800X lighttpd formLogout.htm Form_Logout stack-based overflow (critical 9.3)
- [CVE-2026-15700](https://insights.sbomify.com/CVE-2026-15700/): DedeCMS Album Publishing Feature zip.class.php ExtractFile path traversal (medium 5.1)
- [CVE-2026-1570](https://insights.sbomify.com/CVE-2026-1570/): Simple Bible Verse via Shortcode <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2026-15699](https://insights.sbomify.com/CVE-2026-15699/): spencermountain compromise Public Root API extend.js nlp.extend prototype pollution (medium 5.3)
- [CVE-2026-15698](https://insights.sbomify.com/CVE-2026-15698/): kofrasa mingo Update API updateMany prototype pollution (medium 5.3)
- [CVE-2026-15697](https://insights.sbomify.com/CVE-2026-15697/): svgdotjs svg.js npm Package API EventTarget.on prototype pollution (medium 5.3)
- [CVE-2026-15696](https://insights.sbomify.com/CVE-2026-15696/): Tenda BE12 Pro VirtualSer fromVirtualSer stack-based overflow (high 8.7)
- [CVE-2026-15695](https://insights.sbomify.com/CVE-2026-15695/): Tenda BE12 Pro DhcpListClient fromDhcpListClient stack-based overflow (high 8.7)
- [CVE-2026-15694](https://insights.sbomify.com/CVE-2026-15694/): Tenda BE12 Pro SetIpBind fromSetIpBind stack-based overflow (high 8.7)
- [CVE-2026-15693](https://insights.sbomify.com/CVE-2026-15693/): Tenda BE12 Pro SafeMacFilter fromSafeMacFilter stack-based overflow (high 8.7)
- [CVE-2026-15692](https://insights.sbomify.com/CVE-2026-15692/): Tenda BE12 Pro SafeUrlFilter fromSafeUrlFilter stack-based overflow (high 8.7)
- [CVE-2026-15691](https://insights.sbomify.com/CVE-2026-15691/): Tenda BE12 Pro SafeClientFilter fromSafeClientFilter stack-based overflow (high 8.7)
- [CVE-2026-15690](https://insights.sbomify.com/CVE-2026-15690/): open62541 Shared Client ua_client_connect.c responseReadNamespacesArray null pointer dereference (low 2.3)
- [CVE-2026-1569](https://insights.sbomify.com/CVE-2026-1569/): Wueen <= 0.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin's Shortcode (medium 6.4)
- [CVE-2026-15689](https://insights.sbomify.com/CVE-2026-15689/): Business logic in Dancer2::Plugin::Auth::Extensible (critical 9.8)
- [CVE-2026-15688](https://insights.sbomify.com/CVE-2026-15688/): Password Authentication Bypass Vulnerability in GX Works3 and Motion Control Setting (critical 9.2)
- [CVE-2026-15687](https://insights.sbomify.com/CVE-2026-15687/): Path traversal via non-tar copyDirectoryFromPod (low 2.7)
- [CVE-2026-15686](https://insights.sbomify.com/CVE-2026-15686/): Adminer multi_query Incorrect Check of Function Return Value Remote Code Execution Vulnerability (high 7.2)
- [CVE-2026-15685](https://insights.sbomify.com/CVE-2026-15685/): Ollama downloadBlob Improper Validation of Array Index Denial-of-Service Vulnerability (high 7.5)
- [CVE-2026-15684](https://insights.sbomify.com/CVE-2026-15684/): Glarysoft Glary Utilities Link Following Local Privilege Escalation Vulnerability (high 7.3)
- [CVE-2026-15683](https://insights.sbomify.com/CVE-2026-15683/): Lorex 2K Indoor Wi-Fi Security Camera Device Management Server Improper Certificate Validation Vulnerability (high 7.5)
- [CVE-2026-15682](https://insights.sbomify.com/CVE-2026-15682/): AnyDesk Support Information Link Following Denial-of-Service Vulnerability (medium 4.7)
- [CVE-2026-15681](https://insights.sbomify.com/CVE-2026-15681/): AnyDesk Screen Recording Link Following Denial-of-Service Vulnerability (medium 4.7)
- [CVE-2026-15680](https://insights.sbomify.com/CVE-2026-15680/): Lorex 2K Indoor Wi-Fi Security Camera CDeviceOperator Format String Remote Code Execution Vulnerability (high 7.5)
- [CVE-2026-1568](https://insights.sbomify.com/CVE-2026-1568/): Rapid7 InsightVM Signature Validation Vulnerability (critical 9.6)
- [CVE-2026-15679](https://insights.sbomify.com/CVE-2026-15679/): Hugging Face PyTorch Image Models checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-15678](https://insights.sbomify.com/CVE-2026-15678/): code-projects Online Job Portal DetailJob.php cross site scripting (medium 5.1)
- [CVE-2026-15677](https://insights.sbomify.com/CVE-2026-15677/): code-projects Online Job Portal JobSeekerInsert.php unrestricted upload (medium 6.9)
- [CVE-2026-15676](https://insights.sbomify.com/CVE-2026-15676/): code-projects Online Job Portal DeleteUser.php sql injection (medium 6.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/855/