# Vulnerabilities published in 2026


- [CVE-2026-14620](https://insights.sbomify.com/CVE-2026-14620/): webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints (medium 4.7)
- [CVE-2026-1462](https://insights.sbomify.com/CVE-2026-1462/): Safe Mode Bypass in keras-team/keras (high 8.8)
- [CVE-2026-14619](https://insights.sbomify.com/CVE-2026-14619/): itsourcecode Hospital Management System medicine.php sql injection (medium 5.3)
- [CVE-2026-14618](https://insights.sbomify.com/CVE-2026-14618/): Open5GS AMF nnrf-handler.c amf_nnrf_handle_nf_discover denial of service (medium 5.3)
- [CVE-2026-14617](https://insights.sbomify.com/CVE-2026-14617/): Security feature bypass in hermes-agent (low 2.3)
- [CVE-2026-14615](https://insights.sbomify.com/CVE-2026-14615/): Keycloak-services: keycloak: fgap v2 parent group children endpoint bypasses per-child view permission filter (medium 4.3)
- [CVE-2026-14614](https://insights.sbomify.com/CVE-2026-14614/): Keycloak-services: keycloak-services: fgap v2 client scope assignment bypass via clientresource (medium 5.4)
- [CVE-2026-14613](https://insights.sbomify.com/CVE-2026-14613/): Missing authorization in Red Hat Build of Keycloak (medium 4.3)
- [CVE-2026-14612](https://insights.sbomify.com/CVE-2026-14612/): Freeipa: ipa: idm: freeipa: off-by-one buffer overflows in ipa-otpd oauth2.c during oauth2 device authorization (medium 4.2)
- [CVE-2026-14611](https://insights.sbomify.com/CVE-2026-14611/): DeepMyst Mysti Per-Project Auto-Memory MemoryManager.ts initProjectMemory exposure of resource (medium 5.3)
- [CVE-2026-14610](https://insights.sbomify.com/CVE-2026-14610/): Open Asset Import Library Assimp CSM File CSMLoader.cpp InternReadFile heap-based overflow (medium 4.8)
- [CVE-2026-1461](https://insights.sbomify.com/CVE-2026-1461/): Simple Membership <= 4.7.0 - Unauthenticated Improper Handling of Missing Values (medium 6.5)
- [CVE-2026-14609](https://insights.sbomify.com/CVE-2026-14609/): SourceCodester CET Automated Grading System with AI Predictive Analytics session fixiation (medium 6.3)
- [CVE-2026-14608](https://insights.sbomify.com/CVE-2026-14608/): SourceCodester CET Automated Grading System with AI Predictive Analytics POST index.php view_student authorization (medium 5.3)
- [CVE-2026-14607](https://insights.sbomify.com/CVE-2026-14607/): RT-Thread lwp_syscall.c sys_getaddrinfo memory corruption (medium 6.8)
- [CVE-2026-14606](https://insights.sbomify.com/CVE-2026-14606/): RT-Thread SWM341 CAN SWM341.h CAN_Receive stack-based overflow (high 8.5)
- [CVE-2026-14605](https://insights.sbomify.com/CVE-2026-14605/): RT-Thread ls1c CAN ls1c_can.h recvmsg stack-based overflow (high 8.5)
- [CVE-2026-14604](https://insights.sbomify.com/CVE-2026-14604/): Open Asset Import Library Assimp PLY Model PlyLoader.cpp ExportToBlob double free (medium 5.3)
- [CVE-2026-14603](https://insights.sbomify.com/CVE-2026-14603/): WowOptin < 1.4.38 - Unauthenticated Opt-in Deactivation and Template Row Injection (high 7.5)
- [CVE-2026-14602](https://insights.sbomify.com/CVE-2026-14602/): Remote API <= 0.2 - Unauthenticated PHP Object Injection via remote-api Query Parameter (critical 9.0)
- [CVE-2026-14601](https://insights.sbomify.com/CVE-2026-14601/): Link Whisper < 0.9.7 - Editor+ SQL Injection via domain Parameter (medium 6.8)
- [CVE-2026-1460](https://insights.sbomify.com/CVE-2026-1460/): Command injection in DX3301-T0 firmware (high 7.2)
- [CVE-2026-14596](https://insights.sbomify.com/CVE-2026-14596/): DynamicKit for Elementor < 1.0.3 - Unauthenticated Account Takeover via Password Reset Link Host Injection (high 8.8)
- [CVE-2026-14592](https://insights.sbomify.com/CVE-2026-14592/): WP Real IP-based Access Control <= 1.3.1 - Unauthenticated Stored XSS via acl_ctrl_addr (medium 6.1)
- [CVE-2026-1459](https://insights.sbomify.com/CVE-2026-1459/): Command injection in VMG3625-T50B firmware (high 7.2)
- [CVE-2026-14587](https://insights.sbomify.com/CVE-2026-14587/): Unathenticated connection can hold Bolt channel open (medium 5.5)
- [CVE-2026-14586](https://insights.sbomify.com/CVE-2026-14586/): Assertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC environments (medium 5.9)
- [CVE-2026-1458](https://insights.sbomify.com/CVE-2026-1458/): Allocation of Resources Without Limits or Throttling in GitLab (medium 6.5)
- [CVE-2026-14574](https://insights.sbomify.com/CVE-2026-14574/): Code injection in Eclipse Theia (medium 5.7)
- [CVE-2026-14572](https://insights.sbomify.com/CVE-2026-14572/): Kirki <= 6.2.0 - Authenticated (Custom+) Stored Cross-Site Scripting via Page Builder Text Content (medium 6.4)
- [CVE-2026-14571](https://insights.sbomify.com/CVE-2026-14571/): SQL injection (SQLi) in the user authentication module of Futurum Software (critical 9.1)
- [CVE-2026-14570](https://insights.sbomify.com/CVE-2026-14570/): Weak cryptography in Crypt::DSA (high 7.5)
- [CVE-2026-1457](https://insights.sbomify.com/CVE-2026-1457/): Authenticated RCE Vulnerability Due to Buffer Overflow on TP-Link VIGI C385 (high 8.5)
- [CVE-2026-14568](https://insights.sbomify.com/CVE-2026-14568/): WP User Frontend < 4.3.8 - Unauthenticated Author-less Attachment Deletion (medium 6.5)
- [CVE-2026-14567](https://insights.sbomify.com/CVE-2026-14567/): WP User Frontend < 4.3.10 - Unauthenticated User Email and Phone Disclosure via User Directory (medium 5.3)
- [CVE-2026-14566](https://insights.sbomify.com/CVE-2026-14566/): Advanced Customized Prompts <= 1.0.1 - Subscriber+ WooCommerce Order Item Metadata Tampering (medium 4.3)
- [CVE-2026-14565](https://insights.sbomify.com/CVE-2026-14565/): Advanced Customized Prompts <= 1.0.1 - Subscriber+ Stored XSS via Product Popup Configuration (medium 5.4)
- [CVE-2026-14564](https://insights.sbomify.com/CVE-2026-14564/): Sensitive Data Exposure in Innotim Software's Logsign SIEM (critical 9.0)
- [CVE-2026-14563](https://insights.sbomify.com/CVE-2026-14563/): Advanced Customized Prompts <= 1.0.1 - Unauthenticated Account Takeover (critical 9.8)
- [CVE-2026-14562](https://insights.sbomify.com/CVE-2026-14562/): Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Order Data Disclosure (medium 5.3)
- [CVE-2026-14561](https://insights.sbomify.com/CVE-2026-14561/): Authora - Easy Login with Mobile Number < 1.7.7 - Unauthenticated Account Takeover via OTP Disclosure (medium 6.5)
- [CVE-2026-14560](https://insights.sbomify.com/CVE-2026-14560/): Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Arbitrary File Upload (critical 10.0)
- [CVE-2026-1456](https://insights.sbomify.com/CVE-2026-1456/): Allocation of Resources Without Limits or Throttling in GitLab (medium 6.5)
- [CVE-2026-14559](https://insights.sbomify.com/CVE-2026-14559/): Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Account Takeover (critical 9.8)
- [CVE-2026-14558](https://insights.sbomify.com/CVE-2026-14558/): WP User Frontend < 4.3.10 - Editor+ PHP Object Injection via AI Form Builder (high 7.2)
- [CVE-2026-14557](https://insights.sbomify.com/CVE-2026-14557/): SoftMarket <= 1.0.0 - Unauthenticated Account Takeover via Email Verification Bypass (critical 9.1)
- [CVE-2026-14556](https://insights.sbomify.com/CVE-2026-14556/): HappyForms < 1.26.15 - Unauthenticated HTML Injection in Admin Notification Email via client_referer (medium 5.4)
- [CVE-2026-14554](https://insights.sbomify.com/CVE-2026-14554/): Check & Log Email < 2.0.15 - Admin+ SQL Injection via d and s Parameters (medium 6.5)
- [CVE-2026-14553](https://insights.sbomify.com/CVE-2026-14553/): Zportals < 6.3.4 - Subscriber+ Arbitrary File Upload (high 8.1)
- [CVE-2026-14552](https://insights.sbomify.com/CVE-2026-14552/): Incorrect Authorization in GitLab (medium 4.3)
- [CVE-2026-14551](https://insights.sbomify.com/CVE-2026-14551/): Local Privilege Escalation in servereye client (sensorhub) (high 8.8)
- [CVE-2026-14550](https://insights.sbomify.com/CVE-2026-14550/): WPCafe < 3.0.18 - Unauthenticated Reservation Approval Bypass via Missing Authorization (medium 5.3)
- [CVE-2026-1455](https://insights.sbomify.com/CVE-2026-1455/): Cross-site request forgery in Whatsiplus Scheduled Notification for Woocommerce (medium 4.3)
- [CVE-2026-14549](https://insights.sbomify.com/CVE-2026-14549/): Ray Enterprise Translation <= 1.7.3 - Subscriber+ Language Addition and Deletion (medium 4.3)
- [CVE-2026-14548](https://insights.sbomify.com/CVE-2026-14548/): Ray Enterprise Translation <= 1.7.3 - Subscriber+ Arbitrary API Token Update (medium 6.5)
- [CVE-2026-14547](https://insights.sbomify.com/CVE-2026-14547/): Estatik Real Estate Plugin < 4.3.3 - Unauthenticated Arbitrary-Recipient Mail Relay via Request Form (medium 5.3)
- [CVE-2026-14545](https://insights.sbomify.com/CVE-2026-14545/): TrueBooker Appointment Booking < 1.2.4 - Unauthenticated Account Takeover via Password Reset (critical 9.8)
- [CVE-2026-14544](https://insights.sbomify.com/CVE-2026-14544/): Hplip: incomplete fix for cve-2026-8631 (critical 9.8)
- [CVE-2026-14541](https://insights.sbomify.com/CVE-2026-14541/): Authentication Bypass and Audience Confusion in MCP Toolbox OAuth Provider (high 8.0)
- [CVE-2026-14540](https://insights.sbomify.com/CVE-2026-14540/): Server-Side Request Forgery via Unrestricted HTTP Redirection in MCP Toolbox (high 8.0)
- [CVE-2026-1454](https://insights.sbomify.com/CVE-2026-1454/): Responsive Contact Form Builder & Lead Generation Plugin <= 2.0.1 - Unauthenticated Stored Cross-Site Scripting (high 7.2)
- [CVE-2026-14539](https://insights.sbomify.com/CVE-2026-14539/): Denial of Service via Unrestricted Payload Buffering in MCP Toolbox (medium 6.6)
- [CVE-2026-14538](https://insights.sbomify.com/CVE-2026-14538/): BigQuery Dataset Allowlist Bypass via Metadata Dry-Run in MCP Toolbox (medium 5.7)
- [CVE-2026-14537](https://insights.sbomify.com/CVE-2026-14537/): Authorization Bypass in MCP Toolbox Legacy HTTP Endpoints (high 8.1)
- [CVE-2026-14536](https://insights.sbomify.com/CVE-2026-14536/): Auth bypass in Server (high 7.3)
- [CVE-2026-14535](https://insights.sbomify.com/CVE-2026-14535/): Fickling MLAllowlist analysis pass rendered inoperative by shared mutable state in AnalysisContext.shorten_code() (high 8.8)
- [CVE-2026-14534](https://insights.sbomify.com/CVE-2026-14534/): Fickling check_safety() bypass via unlisted standard library modules (_posixsubprocess, site, atexit) (high 8.8)
- [CVE-2026-14532](https://insights.sbomify.com/CVE-2026-14532/): IBM WebSphere Application Server Liberty Integer Overflow (medium 4.3)
- [CVE-2026-1453](https://insights.sbomify.com/CVE-2026-1453/): Missing Authentication for Critical Function in KiloView Encoder Series (critical 9.3)
- [CVE-2026-14529](https://insights.sbomify.com/CVE-2026-14529/): IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a server-side request forgery (critical 9.4)
- [CVE-2026-14528](https://insights.sbomify.com/CVE-2026-14528/): IBM WebSphere Application Server is affected by an unsafe deserialization and exposure of sensitive information (high 7.4)
- [CVE-2026-14526](https://insights.sbomify.com/CVE-2026-14526/): AI Copilot – Content Generator <= 1.5.6 - Unauthenticated Privilege Escalation via Custom Workflow Route (critical 9.8)
- [CVE-2026-14525](https://insights.sbomify.com/CVE-2026-14525/): IBM WebSphere Application Server Liberty is affected by an authenication bypass (critical 9.4)
- [CVE-2026-14524](https://insights.sbomify.com/CVE-2026-14524/): ProSolution WP Client <= 2.0.8 - Unauthenticated Arbitrary File Deletion via 'newfilename' and 'filename' Parameters (critical 9.1)
- [CVE-2026-14522](https://insights.sbomify.com/CVE-2026-14522/): IBM App Connect Enterprise is vulnerable to an arbitrary file read and arbitrary changes to configuration settings (high 8.8)
- [CVE-2026-14521](https://insights.sbomify.com/CVE-2026-14521/): IBM DataPower Gateway affected by server-side request forgery (medium 4.9)
- [CVE-2026-14519](https://insights.sbomify.com/CVE-2026-14519/): IBM App Connect Enterprise is vulnerable to an arbitrary file read and arbitrary changes to configuration settings (high 7.5)
- [CVE-2026-14516](https://insights.sbomify.com/CVE-2026-14516/): Online Scheduling and Appointment Booking System <= 27.5 - Unauthenticated SQL Injection (high 7.5)
- [CVE-2026-14515](https://insights.sbomify.com/CVE-2026-14515/): IBM WebSphere Application Server is affected by cross-site scripting and deserialization vulnerabilities (medium 6.1)
- [CVE-2026-14514](https://insights.sbomify.com/CVE-2026-14514/): Reliable Scalable Cluster Technology Denial-of-Service (medium 6.5)
- [CVE-2026-14512](https://insights.sbomify.com/CVE-2026-14512/): IBM WebSphere Application Server is affected by an unsafe deserialization and exposure of sensitive information (critical 9.8)
- [CVE-2026-14511](https://insights.sbomify.com/CVE-2026-14511/): IBM MQ Denial of Service (medium 6.5)
- [CVE-2026-1451](https://insights.sbomify.com/CVE-2026-1451/): rognone <= 0.6.2 - Reflected Cross-Site Scripting via 'a' Parameter (medium 6.1)
- [CVE-2026-14509](https://insights.sbomify.com/CVE-2026-14509/): IBM DataPower Gateway Denial of Service (medium 5.9)
- [CVE-2026-14508](https://insights.sbomify.com/CVE-2026-14508/): IBM DataPower Gateway Use After Free (medium 6.5)
- [CVE-2026-14507](https://insights.sbomify.com/CVE-2026-14507/): IBM DataPower Gateway Out-of-bounds Write (high 7.7)
- [CVE-2026-14505](https://insights.sbomify.com/CVE-2026-14505/): Tanium addressed a path traversal vulnerability in Tanium Data Service. (medium 6.6)
- [CVE-2026-14504](https://insights.sbomify.com/CVE-2026-14504/): Nexus Repository 3 - Authorization Bypass in Component Upload API (high 8.2)
- [CVE-2026-14503](https://insights.sbomify.com/CVE-2026-14503/): Missing authorization in pCloud WP Backup (medium 6.5)
- [CVE-2026-14502](https://insights.sbomify.com/CVE-2026-14502/): IBM DataPower Gateway Improper Authentication (critical 9.8)
- [CVE-2026-14501](https://insights.sbomify.com/CVE-2026-14501/): Use of Potentially Dangerous Functionthat in IBM Db2 Genius Hub (medium 4.3)
- [CVE-2026-14500](https://insights.sbomify.com/CVE-2026-14500/): Bulk Order Update for WooCommerce <= 1.6 - Unauthenticated Arbitrary File Read via 'csv_url' Parameter (medium 5.3)
- [CVE-2026-1450](https://insights.sbomify.com/CVE-2026-1450/): rognone <= 0.6.2 - Reflected Cross-Site Scripting via 'mode' Parameter (medium 6.1)
- [CVE-2026-14499](https://insights.sbomify.com/CVE-2026-14499/): Command injection in Langflow OSS (high 8.8)
- [CVE-2026-14498](https://insights.sbomify.com/CVE-2026-14498/): Query Wrangler <= 1.5.57 - Authenticated (Subscriber+) Remote Code Execution via 'options' Parameter (high 8.8)
- [CVE-2026-14497](https://insights.sbomify.com/CVE-2026-14497/): IBM DataPower Gateway Improper Verification of Cryptographic Signature (high 8.1)
- [CVE-2026-14496](https://insights.sbomify.com/CVE-2026-14496/): IBM DataPower Gateway Out-of-bounds Read (high 8.2)
- [CVE-2026-14495](https://insights.sbomify.com/CVE-2026-14495/): Weak cryptography in DoLogin Security (high 8.8)
- [CVE-2026-14494](https://insights.sbomify.com/CVE-2026-14494/): File upload in SigmaForms Pro – AI Generated Forms (critical 9.8)
- [CVE-2026-14490](https://insights.sbomify.com/CVE-2026-14490/): Demi <= 0.0.6 - Unauthenticated Arbitrary Directory Deletion via demi_restore_step AJAX action (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/866/