# Vulnerabilities published in 2026


- [CVE-2026-1449](https://insights.sbomify.com/CVE-2026-1449/): Hisense TransTech Smart Bus Management System TireMng.aspx Page_Load sql injection (medium 6.9)
- [CVE-2026-14489](https://insights.sbomify.com/CVE-2026-14489/): WHMCS Bridge <= 6.9 - Unauthenticated Arbitrary File Upload via 'ccce' Parameter (high 8.8)
- [CVE-2026-14488](https://insights.sbomify.com/CVE-2026-14488/): Missing authorization in Meta Box AIO (critical 9.1)
- [CVE-2026-14487](https://insights.sbomify.com/CVE-2026-14487/): Simple Coherent Form <= 2.4.13 - Unauthenticated Arbitrary File Deletion via 'id' Parameter (critical 9.1)
- [CVE-2026-14484](https://insights.sbomify.com/CVE-2026-14484/): RapiSafe <= 1.0.4 - Unauthenticated Arbitrary File Deletion via 'rsmfcf7_session' and 'file_name' Parameters (critical 9.1)
- [CVE-2026-14483](https://insights.sbomify.com/CVE-2026-14483/): File upload in Realtyna Organic IDX plugin + WPL Real Estate (critical 9.8)
- [CVE-2026-14482](https://insights.sbomify.com/CVE-2026-14482/): 多说社会化评论框 <= 1.2 - Unauthenticated Privilege Escalation via api.php 'option'/'value' Parameters (high 8.8)
- [CVE-2026-14481](https://insights.sbomify.com/CVE-2026-14481/): Cross-site scripting in Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance (medium 6.4)
- [CVE-2026-14480](https://insights.sbomify.com/CVE-2026-14480/): OpenPLC v3 External Control of File Name or Path (high 8.7)
- [CVE-2026-1448](https://insights.sbomify.com/CVE-2026-1448/): D-Link DIR-615 Web Management wiz_policy_3_machine.php os command injection (high 8.6)
- [CVE-2026-14479](https://insights.sbomify.com/CVE-2026-14479/): Denial of Service in Autodesk Installer IPC Channel (medium 5.5)
- [CVE-2026-14478](https://insights.sbomify.com/CVE-2026-14478/): Incorrect Permission Assignment in Autodesk Installer Named Pipes (high 7.8)
- [CVE-2026-14476](https://insights.sbomify.com/CVE-2026-14476/): Sssd: sssd: gpo cache path traversal via unsanitized gpcfilesyspath allows kerberos authentication bypass (high 8.0)
- [CVE-2026-14475](https://insights.sbomify.com/CVE-2026-14475/): Cookie Banner for GDPR / CCPA <= 4.3.6 - Authenticated (Administrator+) SQL Injection via 'scan_id' Parameter (medium 4.9)
- [CVE-2026-14474](https://insights.sbomify.com/CVE-2026-14474/): Privilege escalation in Red Hat Enterprise Linux 10 (high 8.8)
- [CVE-2026-14472](https://insights.sbomify.com/CVE-2026-14472/): Cross-site scripting in Kubio AI Page Builder (medium 6.4)
- [CVE-2026-14471](https://insights.sbomify.com/CVE-2026-14471/): Authenticated SQL injection in the metrics-service retention policy subsystem of mcp-gateway-registry (high 8.6)
- [CVE-2026-14470](https://insights.sbomify.com/CVE-2026-14470/): Path traversal in Langflow OSS (medium 6.5)
- [CVE-2026-1447](https://insights.sbomify.com/CVE-2026-1447/): Mail Mint <= 1.19.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting (medium 5.4)
- [CVE-2026-14468](https://insights.sbomify.com/CVE-2026-14468/): Path traversal allows arbitrary file read in Terraform Enterprise container (high 7.7)
- [CVE-2026-14466](https://insights.sbomify.com/CVE-2026-14466/): Possible XSS in the SNS web administration panel (medium 4.3)
- [CVE-2026-14465](https://insights.sbomify.com/CVE-2026-14465/): Session Fixation in Bilin Software's HUMANIST Digital Human Resources (medium 6.5)
- [CVE-2026-14461](https://insights.sbomify.com/CVE-2026-14461/): Out-of-bound read in mtr (medium 5.1)
- [CVE-2026-14460](https://insights.sbomify.com/CVE-2026-14460/): Missing Authorization in TUBITAK BILGEM's pardus-software (high 8.8)
- [CVE-2026-1446](https://insights.sbomify.com/CVE-2026-1446/): XSS issue is Esri ArcGIS Pro versions 3.6.0 and earlier (medium 5.0)
- [CVE-2026-14459](https://insights.sbomify.com/CVE-2026-14459/): Argument Injection in TUBITAK BILGEM's pardus-software (high 8.8)
- [CVE-2026-14457](https://insights.sbomify.com/CVE-2026-14457/): RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate (high 7.5)
- [CVE-2026-14456](https://insights.sbomify.com/CVE-2026-14456/): Unbounded Memory Growth in QUIC Server Incoming Channel Queue (high 7.5)
- [CVE-2026-14454](https://insights.sbomify.com/CVE-2026-14454/): Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed (critical 9.8)
- [CVE-2026-14453](https://insights.sbomify.com/CVE-2026-14453/): A user with low privileges can inject SSTI templates that can lead to RCE in open-tickets (critical 9.6)
- [CVE-2026-14452](https://insights.sbomify.com/CVE-2026-14452/): Open redirect and XSS via reset_url parameter (high 8.6)
- [CVE-2026-14450](https://insights.sbomify.com/CVE-2026-14450/): Maas-billing: maas api: privilege escalation via forged http headers due to missing authentication (critical 9.9)
- [CVE-2026-1445](https://insights.sbomify.com/CVE-2026-1445/): iJason-Liu Books_Manager upload_bookCover.php unrestricted upload (medium 5.1)
- [CVE-2026-14449](https://insights.sbomify.com/CVE-2026-14449/): POST-based reflected XSS via the thanks parameter in form components (medium 6.4)
- [CVE-2026-14448](https://insights.sbomify.com/CVE-2026-14448/): Authenticated RCE in system_certificates view (high 8.6)
- [CVE-2026-14446](https://insights.sbomify.com/CVE-2026-14446/): IBM WebSphere Application Server is affected by a privilege escalation (critical 9.8)
- [CVE-2026-14444](https://insights.sbomify.com/CVE-2026-14444/): Privilege escalation in WP Fusion (Pro) (high 7.5)
- [CVE-2026-14443](https://insights.sbomify.com/CVE-2026-14443/): Incomplete log sanitization during bulk IPsec policy collection in Brocade SANnav before 3.0.1a (high 8.4)
- [CVE-2026-14442](https://insights.sbomify.com/CVE-2026-14442/): Information exposure vulnerability in the job scheduling component of SANnav before 3.0.1a (medium 6.9)
- [CVE-2026-14441](https://insights.sbomify.com/CVE-2026-14441/): Logic flaw in SANnav Java cache key handling object comparison handling (medium 6.9)
- [CVE-2026-14440](https://insights.sbomify.com/CVE-2026-14440/): Cloudflare Universal SSL automatically managed CAA RRset supersedes customer-configured CAA records (high 7.6)
- [CVE-2026-1444](https://insights.sbomify.com/CVE-2026-1444/): iJason-Liu Books_Manager add_book_check.php cross site scripting (medium 4.8)
- [CVE-2026-14439](https://insights.sbomify.com/CVE-2026-14439/): Path Traversal in Altium Git Service Allows Remote Code Execution (critical 9.4)
- [CVE-2026-14433](https://insights.sbomify.com/CVE-2026-14433/): Cross-site scripting in Online Booking & Scheduling Calendar by vcita (high 7.2)
- [CVE-2026-14432](https://insights.sbomify.com/CVE-2026-14432/): Use after free in Chrome (high 8.8)
- [CVE-2026-14431](https://insights.sbomify.com/CVE-2026-14431/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-14430](https://insights.sbomify.com/CVE-2026-14430/): Integer overflow in Chrome (high 8.8)
- [CVE-2026-1443](https://insights.sbomify.com/CVE-2026-1443/): code-projects Online Music Site AdminDeleteUser.php sql injection (medium 6.9)
- [CVE-2026-14429](https://insights.sbomify.com/CVE-2026-14429/): Security feature bypass in Chrome (high 8.3)
- [CVE-2026-14428](https://insights.sbomify.com/CVE-2026-14428/): Security feature bypass in Chrome (high 8.3)
- [CVE-2026-14427](https://insights.sbomify.com/CVE-2026-14427/): Memory corruption in Chrome (high 8.3)
- [CVE-2026-14426](https://insights.sbomify.com/CVE-2026-14426/): Use after free in Chrome (high 7.5)
- [CVE-2026-14425](https://insights.sbomify.com/CVE-2026-14425/): Use after free in Chrome (critical 9.6)
- [CVE-2026-14424](https://insights.sbomify.com/CVE-2026-14424/): Use after free in Chrome (critical 9.6)
- [CVE-2026-14423](https://insights.sbomify.com/CVE-2026-14423/): Memory corruption in Chrome (critical 9.6)
- [CVE-2026-14422](https://insights.sbomify.com/CVE-2026-14422/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-14421](https://insights.sbomify.com/CVE-2026-14421/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-14420](https://insights.sbomify.com/CVE-2026-14420/): Memory corruption in Chrome (critical 9.6)
- [CVE-2026-1442](https://insights.sbomify.com/CVE-2026-1442/): Unitree UPK files Hard-Coded Key (high 7.8)
- [CVE-2026-14419](https://insights.sbomify.com/CVE-2026-14419/): Use after free in Chrome (critical 9.6)
- [CVE-2026-14418](https://insights.sbomify.com/CVE-2026-14418/): Information disclosure in Chrome (medium 4.3)
- [CVE-2026-14417](https://insights.sbomify.com/CVE-2026-14417/): Use after free in Chrome (critical 9.6)
- [CVE-2026-14416](https://insights.sbomify.com/CVE-2026-14416/): Memory corruption in Chrome (critical 9.6)
- [CVE-2026-14415](https://insights.sbomify.com/CVE-2026-14415/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-14414](https://insights.sbomify.com/CVE-2026-14414/): Information disclosure in Chrome (medium 5.3)
- [CVE-2026-14413](https://insights.sbomify.com/CVE-2026-14413/): Memory corruption in Chrome (high 8.3)
- [CVE-2026-14412](https://insights.sbomify.com/CVE-2026-14412/): Security feature bypass in Chrome (high 8.3)
- [CVE-2026-14411](https://insights.sbomify.com/CVE-2026-14411/): Security feature bypass in Chrome (critical 9.6)
- [CVE-2026-14410](https://insights.sbomify.com/CVE-2026-14410/): Other in Chrome (medium 4.3)
- [CVE-2026-1441](https://insights.sbomify.com/CVE-2026-1441/): Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web Interface (medium 5.3)
- [CVE-2026-14409](https://insights.sbomify.com/CVE-2026-14409/): Security feature bypass in Chrome (high 7.5)
- [CVE-2026-14408](https://insights.sbomify.com/CVE-2026-14408/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-14407](https://insights.sbomify.com/CVE-2026-14407/): Code injection in Chrome (high 8.8)
- [CVE-2026-14406](https://insights.sbomify.com/CVE-2026-14406/): Memory corruption in Chrome (medium 5.9)
- [CVE-2026-14405](https://insights.sbomify.com/CVE-2026-14405/): Memory corruption in Chrome (critical 9.6)
- [CVE-2026-14404](https://insights.sbomify.com/CVE-2026-14404/): Other in Chrome (medium 6.5)
- [CVE-2026-14403](https://insights.sbomify.com/CVE-2026-14403/): Use after free in Chrome (high 8.8)
- [CVE-2026-14402](https://insights.sbomify.com/CVE-2026-14402/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-14401](https://insights.sbomify.com/CVE-2026-14401/): Security feature bypass in Chrome (high 8.3)
- [CVE-2026-14400](https://insights.sbomify.com/CVE-2026-14400/): Memory corruption in Chrome (high 8.3)
- [CVE-2026-1440](https://insights.sbomify.com/CVE-2026-1440/): Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web Interface (medium 5.3)
- [CVE-2026-14399](https://insights.sbomify.com/CVE-2026-14399/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-14398](https://insights.sbomify.com/CVE-2026-14398/): Use after free in Chrome (critical 9.6)
- [CVE-2026-14397](https://insights.sbomify.com/CVE-2026-14397/): Memory corruption in Chrome (critical 9.6)
- [CVE-2026-14396](https://insights.sbomify.com/CVE-2026-14396/): Memory corruption in Chrome (medium 6.5)
- [CVE-2026-14395](https://insights.sbomify.com/CVE-2026-14395/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-14394](https://insights.sbomify.com/CVE-2026-14394/): Use after free in Chrome (high 8.8)
- [CVE-2026-14393](https://insights.sbomify.com/CVE-2026-14393/): Use after free in Chrome (high 8.8)
- [CVE-2026-14392](https://insights.sbomify.com/CVE-2026-14392/): Memory corruption in Chrome (critical 9.6)
- [CVE-2026-14391](https://insights.sbomify.com/CVE-2026-14391/): Integer overflow in Chrome (medium 5.3)
- [CVE-2026-14390](https://insights.sbomify.com/CVE-2026-14390/): Use after free in Chrome (critical 9.6)
- [CVE-2026-1439](https://insights.sbomify.com/CVE-2026-1439/): Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web Interface (medium 5.3)
- [CVE-2026-14389](https://insights.sbomify.com/CVE-2026-14389/): Integer overflow in Chrome (high 8.3)
- [CVE-2026-14388](https://insights.sbomify.com/CVE-2026-14388/): Memory corruption in Chrome (medium 6.5)
- [CVE-2026-14387](https://insights.sbomify.com/CVE-2026-14387/): Integer overflow in Chrome (critical 9.6)
- [CVE-2026-14386](https://insights.sbomify.com/CVE-2026-14386/): Memory corruption in Chrome (medium 6.5)
- [CVE-2026-14385](https://insights.sbomify.com/CVE-2026-14385/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-14384](https://insights.sbomify.com/CVE-2026-14384/): Memory corruption in Chrome (medium 6.5)
- [CVE-2026-14383](https://insights.sbomify.com/CVE-2026-14383/): Code injection in Chrome (high 8.8)
- [CVE-2026-14382](https://insights.sbomify.com/CVE-2026-14382/): Security feature bypass in Chrome (critical 9.6)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/867/