# Vulnerabilities published in 2026


- [CVE-2026-14259](https://insights.sbomify.com/CVE-2026-14259/): Board archive import bypasses team board creation permissions (medium 4.3)
- [CVE-2026-14258](https://insights.sbomify.com/CVE-2026-14258/): Dhcpcd: dhcpcd infinite loop and out-of-bounds read via zero-length ipv6 nd option in router advertisement handling (medium 6.5)
- [CVE-2026-14257](https://insights.sbomify.com/CVE-2026-14257/): brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash (high 7.5)
- [CVE-2026-14256](https://insights.sbomify.com/CVE-2026-14256/): Memory corruption in 100w Gen 4 Laptop (Lenovo) ELAN TrackPoint Driver for Windows 11 (Version 22H2 or later) - Lenovo 100w Gen 4, 300w Yoga Gen 4, 500w Yoga Gen 4 (medium 5.7)
- [CVE-2026-14255](https://insights.sbomify.com/CVE-2026-14255/): IFC File Parsing Uncontrolled Recursion in Certain Autodesk Products (medium 5.5)
- [CVE-2026-14254](https://insights.sbomify.com/CVE-2026-14254/): Improper Restriction of Excessive Authentication Attempts in Delphix Continuous Data (high 8.3)
- [CVE-2026-14251](https://insights.sbomify.com/CVE-2026-14251/): Missing authorization in Red Hat OpenShift GitOps (high 7.7)
- [CVE-2026-14250](https://insights.sbomify.com/CVE-2026-14250/): Themehunk Login Registration <= 1.0.2 - Unauthenticated Privilege Escalation via 'role' Parameter (medium 6.3)
- [CVE-2026-1425](https://insights.sbomify.com/CVE-2026-1425/): pymumu SmartDNS SVBC Record dns.c _dns_decode_SVCB_HTTPS stack-based overflow (medium 6.3)
- [CVE-2026-14249](https://insights.sbomify.com/CVE-2026-14249/): Request a Quote Form Plugin <= 2.5.5 - Unauthenticated Code Injection via 'path' Parameter (high 7.5)
- [CVE-2026-14245](https://insights.sbomify.com/CVE-2026-14245/): Auth bypass in miniOrange OTP Login, Verification and SMS Notifications (critical 9.8)
- [CVE-2026-14244](https://insights.sbomify.com/CVE-2026-14244/): Jssor Slider by jssor.com <= 3.1.24 - Unauthenticated Arbitrary File Read via 'url' Parameter (high 7.5)
- [CVE-2026-14241](https://insights.sbomify.com/CVE-2026-14241/): Memory safety bugs fixed in Firefox 152.0.4 (high 7.5)
- [CVE-2026-14240](https://insights.sbomify.com/CVE-2026-14240/): Tourmaster < 5.4.9 - Unauthenticated Sensitive Data Disclosure via Order Export (medium 5.3)
- [CVE-2026-1424](https://insights.sbomify.com/CVE-2026-1424/): PHPGurukul News Portal Profile Pic unrestricted upload (medium 5.1)
- [CVE-2026-14239](https://insights.sbomify.com/CVE-2026-14239/): Tourmaster < 5.4.8 - Stored XSS via CSRF (high 7.1)
- [CVE-2026-14238](https://insights.sbomify.com/CVE-2026-14238/): Vitepos < 3.6.0 - Admin+ SQL Injection via product-details-report (medium 4.1)
- [CVE-2026-14237](https://insights.sbomify.com/CVE-2026-14237/): Vitepos < 3.6.0 - Outlet Manager+ Privilege Escalation (high 7.2)
- [CVE-2026-14236](https://insights.sbomify.com/CVE-2026-14236/): Contact Form 7 – PayPal & Stripe Add-on < 2.5 - Open Redirect (medium 4.7)
- [CVE-2026-14235](https://insights.sbomify.com/CVE-2026-14235/): WordPress Download Manager < 3.3.62 - Unauthorized Protected File Download via Reusable Download Key (high 7.5)
- [CVE-2026-14234](https://insights.sbomify.com/CVE-2026-14234/): WOLF - WordPress Posts Bulk Editor and Manager < 1.1.0 - Stored XSS via CSRF (high 7.1)
- [CVE-2026-14231](https://insights.sbomify.com/CVE-2026-14231/): LifterLMS < 10.0.10 - Subscriber+ Sensitive Information Disclosure via select2_query_posts (medium 4.3)
- [CVE-2026-14230](https://insights.sbomify.com/CVE-2026-14230/): ECS < 4.3.8 - Contributor+ Stored XSS via Dynamic Repeater Bindings (medium 5.4)
- [CVE-2026-1423](https://insights.sbomify.com/CVE-2026-1423/): code-projects Online Examination System admin_pic.php unrestricted upload (medium 5.3)
- [CVE-2026-14229](https://insights.sbomify.com/CVE-2026-14229/): ECS < 4.3.8 - Unauthenticated Private Content Disclosure via ecsload (medium 5.3)
- [CVE-2026-14227](https://insights.sbomify.com/CVE-2026-14227/): Insufficient session expiration in MikroTik RouterOS (medium 6.9)
- [CVE-2026-14226](https://insights.sbomify.com/CVE-2026-14226/): Easy Appointments < 3.12.28 - Subscriber+ Sensitive Information Disclosure via REST Appointments Listing (medium 4.3)
- [CVE-2026-14225](https://insights.sbomify.com/CVE-2026-14225/): Easy Appointments < 3.12.28 - Contributor+ Shortcode Allowlist Bypass (low 2.7)
- [CVE-2026-14224](https://insights.sbomify.com/CVE-2026-14224/): Easy Appointments < 3.12.28 - Subscriber+ Cross-User Appointment Data Modification via IDOR (medium 5.4)
- [CVE-2026-14223](https://insights.sbomify.com/CVE-2026-14223/): Easy Appointments < 3.12.28 - Subscriber+ Customer PII Disclosure via IDOR (medium 4.3)
- [CVE-2026-14222](https://insights.sbomify.com/CVE-2026-14222/): Easy Appointments < 3.12.28 - Contributor+ Connection Deletion via Missing Authorization (low 3.8)
- [CVE-2026-14221](https://insights.sbomify.com/CVE-2026-14221/): Easy Appointments <= 4.0 - Contributor+ Appointment Data Disclosure & Modification via Missing Authorization (low 3.8)
- [CVE-2026-1422](https://insights.sbomify.com/CVE-2026-1422/): code-projects Online Examination System Login Page index.php sql injection (medium 6.9)
- [CVE-2026-14219](https://insights.sbomify.com/CVE-2026-14219/): URL Redirection in Bilin Software's HUMANIST Digital Human Resources (medium 5.4)
- [CVE-2026-14216](https://insights.sbomify.com/CVE-2026-14216/): Amelia < 2.4.7 - Unauthenticated Notification Queue Dispatch (medium 6.5)
- [CVE-2026-14215](https://insights.sbomify.com/CVE-2026-14215/): Amelia < 2.4.9 - Unauthenticated Post-Booking Action Trigger (medium 6.5)
- [CVE-2026-14214](https://insights.sbomify.com/CVE-2026-14214/): Amelia < 2.4.4 - Amelia Manager+ Arbitrary User-Field Modification via Mass Assignment (low 2.7)
- [CVE-2026-14213](https://insights.sbomify.com/CVE-2026-14213/): Amelia < 2.4.6 - Provider+ Cross-Customer Appointment Data Disclosure via IDOR (low 3.7)
- [CVE-2026-14212](https://insights.sbomify.com/CVE-2026-14212/): Amelia Pro < 9.8 - Provider+ Arbitrary Provider Password Update via IDOR (medium 4.7)
- [CVE-2026-14211](https://insights.sbomify.com/CVE-2026-14211/): Amelia Pro < 9.7 - Provider+ Arbitrary Customer Data Disclosure and Modification via IDOR (low 3.8)
- [CVE-2026-14210](https://insights.sbomify.com/CVE-2026-14210/): Insufficient Granularity of Access Control in GitLab (medium 4.3)
- [CVE-2026-1421](https://insights.sbomify.com/CVE-2026-1421/): code-projects Online Examination System Add Pages cross site scripting (medium 5.1)
- [CVE-2026-14209](https://insights.sbomify.com/CVE-2026-14209/): Missing authorization in Red Hat JBoss Enterprise Application Platform Expansion Pack (medium 4.3)
- [CVE-2026-14208](https://insights.sbomify.com/CVE-2026-14208/): Local Privilege Escalation via Insecure DLL Permissions in Remote Utilities Host <=7.7.3.0 (high 7.3)
- [CVE-2026-14207](https://insights.sbomify.com/CVE-2026-14207/): LifterLMS < 10.0.10 - Instructor+ Stored XSS via Featured Pricing Information (medium 6.1)
- [CVE-2026-14206](https://insights.sbomify.com/CVE-2026-14206/): HT Contact Form < 2.9.3 - Unauthenticated Saved Form Draft Data Disclosure (high 7.5)
- [CVE-2026-14205](https://insights.sbomify.com/CVE-2026-14205/): WP Events Manager < 2.2.5 - Subscriber+ Payment Bypass via 'qty' Parameter (critical 9.8)
- [CVE-2026-14204](https://insights.sbomify.com/CVE-2026-14204/): Google Authenticator < 0.56 - 2FA Secret Overwrite via CSRF (medium 6.5)
- [CVE-2026-14203](https://insights.sbomify.com/CVE-2026-14203/): Smart Manager < 8.92.0 - Contributor+ Stored XSS via Post Title (medium 4.8)
- [CVE-2026-14202](https://insights.sbomify.com/CVE-2026-14202/): Username Enumeration via Differential Login Responses in Bilin Software's HUMANIST Digital Human Resources (medium 5.3)
- [CVE-2026-1420](https://insights.sbomify.com/CVE-2026-1420/): Tenda AC23 WifiExtraSet buffer overflow (high 8.7)
- [CVE-2026-14199](https://insights.sbomify.com/CVE-2026-14199/): Session takeover via Auth Proxy cache key collision (high 7.1)
- [CVE-2026-14198](https://insights.sbomify.com/CVE-2026-14198/): @fastify/middie vulnerable to authorization bypass via encoded slash in path parameter values (critical 9.1)
- [CVE-2026-14197](https://insights.sbomify.com/CVE-2026-14197/): Fluent Support < 2.3.1 - Agent+ Arbitrary Ticket Customer Reassignment via IDOR (low 3.8)
- [CVE-2026-14196](https://insights.sbomify.com/CVE-2026-14196/): WCFM Marketplace < 3.8.1 - Store Vendor+ Cross-Vendor Review Deletion and Status Update via IDOR (medium 4.3)
- [CVE-2026-14195](https://insights.sbomify.com/CVE-2026-14195/): Brizy – Page Builder < 2.8.18 - Contributor+ Sensitive Information Disclosure via get_post_info (low 2.7)
- [CVE-2026-14194](https://insights.sbomify.com/CVE-2026-14194/): Path Traversal Allows Arbitrary File Download in Bilin Software's HUMANIST Digital Human Resources (medium 6.5)
- [CVE-2026-14193](https://insights.sbomify.com/CVE-2026-14193/): DVP80ES300T - Improper Validation of Array Index Vulnerability (high 7.5)
- [CVE-2026-14192](https://insights.sbomify.com/CVE-2026-14192/): Stored XSS in Bilin Software's HUMANIST Digital Human Resources (medium 5.4)
- [CVE-2026-14191](https://insights.sbomify.com/CVE-2026-14191/): WinRAR / UnRAR RAR5 recovery-volume (.rev) out-of-bounds heap write in RecVolumes5::ReadHeader (high 7.8)
- [CVE-2026-14190](https://insights.sbomify.com/CVE-2026-14190/): Sina Extension for Elementor < 3.10.2 - Reflected XSS (medium 6.1)
- [CVE-2026-1419](https://insights.sbomify.com/CVE-2026-1419/): D-Link DCS700l Web Form setDayNightMode command injection (medium 5.1)
- [CVE-2026-14189](https://insights.sbomify.com/CVE-2026-14189/): WPBot AI ChatBot < 8.5.2 - Admin+ Second-Order SQL Injection via qc_bot_str_fields (low 3.8)
- [CVE-2026-14188](https://insights.sbomify.com/CVE-2026-14188/): Easy Appointments < 3.12.28 - Contributor+ Customer Data Disclosure (low 2.7)
- [CVE-2026-14187](https://insights.sbomify.com/CVE-2026-14187/): Tutor LMS < 4.0.6 - Instructor+ Cross-Instructor Private Course Disclosure via IDOR (low 2.7)
- [CVE-2026-14185](https://insights.sbomify.com/CVE-2026-14185/): WPBot AI ChatBot < 8.2.0 - Subscriber+ RAG Settings Update (medium 4.3)
- [CVE-2026-14184](https://insights.sbomify.com/CVE-2026-14184/): Academy LMS < 3.8.1 - Subscriber+ Cross-User Lesson Note and Progress Modification via IDOR (medium 5.4)
- [CVE-2026-14183](https://insights.sbomify.com/CVE-2026-14183/): Classified Listing < 5.3.9 - Subscriber+ Payment Receipt Disclosure via IDOR (medium 4.3)
- [CVE-2026-14182](https://insights.sbomify.com/CVE-2026-14182/): Auth bypass in Customer Email Verification for WooCommerce (critical 9.8)
- [CVE-2026-14181](https://insights.sbomify.com/CVE-2026-14181/): @fastify/middie standalone engine vulnerable to Denial of Service via malformed percent-encoded paths (high 7.5)
- [CVE-2026-14180](https://insights.sbomify.com/CVE-2026-14180/): Undertow-core: undertow:http request smuggling via oversized chunk-size bit overlap (medium 5.3)
- [CVE-2026-1418](https://insights.sbomify.com/CVE-2026-1418/): GPAC SRT Subtitle Import text_to_bifs.c gf_text_import_srt_bifs out-of-bounds write (medium 4.8)
- [CVE-2026-14178](https://insights.sbomify.com/CVE-2026-14178/): openGauss存在非法内存访问导致DoS漏洞 (medium 5.9)
- [CVE-2026-14177](https://insights.sbomify.com/CVE-2026-14177/): User Enumeration via Password Reset in IKAS Technology Inc.'s ikas E-Commerce Infrastructure (high 7.5)
- [CVE-2026-14175](https://insights.sbomify.com/CVE-2026-14175/): Unrestricted File Upload in Bilin Software's HUMANIST Digital Human Resources (critical 9.8)
- [CVE-2026-14172](https://insights.sbomify.com/CVE-2026-14172/): Rapid7 InsightVM, Nexpose, and Insight Agent Local Privilege Escalation via Unvalidated Executable Invocation (high 7.8)
- [CVE-2026-14171](https://insights.sbomify.com/CVE-2026-14171/): ads-tec Industrial IT: Post-login open redirect in the web interface (medium 6.1)
- [CVE-2026-1417](https://insights.sbomify.com/CVE-2026-1417/): GPAC filedump.c dump_isom_rtp null pointer dereference (medium 4.8)
- [CVE-2026-14169](https://insights.sbomify.com/CVE-2026-14169/): ads-tec Industrial IT: Account lockout via non-atomic user creation (high 8.1)
- [CVE-2026-14168](https://insights.sbomify.com/CVE-2026-14168/): ads-tec Industrial IT: Vertical privilege escalation via configuration table write (high 8.8)
- [CVE-2026-14167](https://insights.sbomify.com/CVE-2026-14167/): ads-tec Industrial IT: Privilege escalation during configuration import (high 8.7)
- [CVE-2026-14165](https://insights.sbomify.com/CVE-2026-14165/): Missing authorization in Tuleap Enterprise Edition (high 7.5)
- [CVE-2026-14164](https://insights.sbomify.com/CVE-2026-14164/): Libarchive: double-free vulnerability in rar5 decompression logic via dangling filtered_buf pointer in init_unpack() (high 7.5)
- [CVE-2026-14163](https://insights.sbomify.com/CVE-2026-14163/): Information disclosure in Octopus Server (high 7.1)
- [CVE-2026-14162](https://insights.sbomify.com/CVE-2026-14162/): Advantech｜Hospital Quering Management - Missing Authentication (critical 9.3)
- [CVE-2026-14161](https://insights.sbomify.com/CVE-2026-14161/): Advantech｜Hospital Queuing Management - Sensitive Data Exposure (high 8.7)
- [CVE-2026-14160](https://insights.sbomify.com/CVE-2026-14160/): Race condition in Escargot (medium 5.9)
- [CVE-2026-1416](https://insights.sbomify.com/CVE-2026-1416/): GPAC filedump.c DumpMovieInfo null pointer dereference (medium 4.8)
- [CVE-2026-14158](https://insights.sbomify.com/CVE-2026-14158/): Widget Logic Visual <= 1.52 - Authenticated (Subscriber+) Remote Code Execution via 'nwlv[cod-tag]' Parameter (high 8.8)
- [CVE-2026-14157](https://insights.sbomify.com/CVE-2026-14157/): Memory corruption in Router (critical 9.4)
- [CVE-2026-14156](https://insights.sbomify.com/CVE-2026-14156/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-14155](https://insights.sbomify.com/CVE-2026-14155/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-14154](https://insights.sbomify.com/CVE-2026-14154/): Other in Chrome (medium 4.8)
- [CVE-2026-14153](https://insights.sbomify.com/CVE-2026-14153/): Other in Chrome (medium 5.3)
- [CVE-2026-14152](https://insights.sbomify.com/CVE-2026-14152/): Memory corruption in Chrome (critical 9.6)
- [CVE-2026-14151](https://insights.sbomify.com/CVE-2026-14151/): Security feature bypass in Chrome (high 8.3)
- [CVE-2026-14150](https://insights.sbomify.com/CVE-2026-14150/): Other in Chrome (medium 4.3)
- [CVE-2026-1415](https://insights.sbomify.com/CVE-2026-1415/): GPAC media_export.c gf_media_export_webvtt_metadata null pointer dereference (medium 4.8)
- [CVE-2026-14149](https://insights.sbomify.com/CVE-2026-14149/): Use after free in Chrome (high 8.8)
- [CVE-2026-14148](https://insights.sbomify.com/CVE-2026-14148/): Memory corruption in Chrome (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/869/