# Vulnerabilities published in 2026


- [CVE-2026-12663](https://insights.sbomify.com/CVE-2026-12663/): ControlFLASH ® – Improper Access Control (high 7.0)
- [CVE-2026-12661](https://insights.sbomify.com/CVE-2026-12661/): FactoryTalk® Historian Machine Edition - Out-of-Bounds Write Vulnerability (medium 4.8)
- [CVE-2026-12660](https://insights.sbomify.com/CVE-2026-12660/): IBM MQ Path Traversal (low 2.7)
- [CVE-2026-1266](https://insights.sbomify.com/CVE-2026-1266/): Postalicious <= 3.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings (medium 4.4)
- [CVE-2026-12659](https://insights.sbomify.com/CVE-2026-12659/): Rockwell Automation Flex 5000® Adapter - Denial of Service (high 8.7)
- [CVE-2026-12657](https://insights.sbomify.com/CVE-2026-12657/): LatePoint <= 5.6.2 - Unauthenticated Insecure Direct Object Reference to Arbitrary Creation via 'service_id' Parameter (medium 5.3)
- [CVE-2026-12656](https://insights.sbomify.com/CVE-2026-12656/): 1732E ArmorBlock® - Multiple Vulnerabilities (high 8.7)
- [CVE-2026-12655](https://insights.sbomify.com/CVE-2026-12655/): 1732E ArmorBlock® - Multiple Vulnerabilities (high 8.8)
- [CVE-2026-12654](https://insights.sbomify.com/CVE-2026-12654/): Missing authorization in Payment Plugins for Stripe WooCommerce (medium 5.3)
- [CVE-2026-12651](https://insights.sbomify.com/CVE-2026-12651/): Deserialization in Neurons for ITSM (high 8.8)
- [CVE-2026-12650](https://insights.sbomify.com/CVE-2026-12650/): Deserialization in Neurons for ITSM (critical 9.9)
- [CVE-2026-1265](https://insights.sbomify.com/CVE-2026-1265/): IBM InfoSphere Information Server is vulnerable due to sensitive information written to a log file (medium 4.3)
- [CVE-2026-12648](https://insights.sbomify.com/CVE-2026-12648/): Deserialization in Neurons for ITSM (high 8.8)
- [CVE-2026-12647](https://insights.sbomify.com/CVE-2026-12647/): Missing authorization in Ivanti Neurons for ITSM (critical 9.9)
- [CVE-2026-12646](https://insights.sbomify.com/CVE-2026-12646/): Missing authorization in Ivanti Neurons for ITSM (critical 9.9)
- [CVE-2026-12645](https://insights.sbomify.com/CVE-2026-12645/): Missing authorization in Ivanti Neurons for ITSM (critical 9.9)
- [CVE-2026-12644](https://insights.sbomify.com/CVE-2026-12644/): ts-deepmerge: Prototype Method Override leads to DoS (medium 6.9)
- [CVE-2026-1264](https://insights.sbomify.com/CVE-2026-1264/): IBM Sterling B2B Integrator and IBM Sterling File Gateway Improper Access Controls (high 7.1)
- [CVE-2026-12635](https://insights.sbomify.com/CVE-2026-12635/): Reliance on Reverse DNS Resolution for a Security-Critical Action in GitLab (not scored)
- [CVE-2026-12634](https://insights.sbomify.com/CVE-2026-12634/): Out-of-bounds stack write in the settings NVS backend from over-reported nvs_read length (medium 5.3)
- [CVE-2026-12633](https://insights.sbomify.com/CVE-2026-12633/): Out-of-bounds write in IPv6 6LoWPAN Context Option handling via unauthenticated Router Advertisement (high 8.1)
- [CVE-2026-12632](https://insights.sbomify.com/CVE-2026-12632/): Out-of-bounds read in Zephyr PTP message parsing from unvalidated message type (medium 6.5)
- [CVE-2026-12631](https://insights.sbomify.com/CVE-2026-12631/): Broken access-control denial in k_thread_join/k_thread_abort syscall validation in Zephyr kernel (medium 6.5)
- [CVE-2026-12630](https://insights.sbomify.com/CVE-2026-12630/): 6LoWPAN IPHC uncompression out-of-bounds read on reserved destination addressing mode (medium 4.3)
- [CVE-2026-1263](https://insights.sbomify.com/CVE-2026-1263/): Webling <= 3.9.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'title' Parameter (medium 6.4)
- [CVE-2026-12629](https://insights.sbomify.com/CVE-2026-12629/): PL011 UART error interrupts never cleared, enabling an external-peer interrupt-storm denial of service (medium 4.6)
- [CVE-2026-12628](https://insights.sbomify.com/CVE-2026-12628/): Hardcoded credential in the IBM Storage Protect Snapshot For Windows leads to unauthorized access to system (critical 9.1)
- [CVE-2026-12627](https://insights.sbomify.com/CVE-2026-12627/): Fortra's Core Privileged Access Manager (BoKS) autoregistration stack buffer overflow vulnerability (critical 9.8)
- [CVE-2026-12626](https://insights.sbomify.com/CVE-2026-12626/): Deserialization in Online Scheduling and Appointment Booking System – Bookly (high 7.2)
- [CVE-2026-12624](https://insights.sbomify.com/CVE-2026-12624/): Vault vulnerable to LIST authorization bypass via trailing-slash strip (medium 4.3)
- [CVE-2026-12622](https://insights.sbomify.com/CVE-2026-12622/): Open Redirect Vulnerability in Password Reset Submission in GridTime™ 3000 GNSS Time Server (medium 5.3)
- [CVE-2026-12621](https://insights.sbomify.com/CVE-2026-12621/): Cross-Site Scripting (XSS) Vulnerability in Password Reset Redirect in GridTime™ 3000 GNSS Time Server (medium 5.3)
- [CVE-2026-12620](https://insights.sbomify.com/CVE-2026-12620/): Access Token Exposure in URL Parameters in GridTime™ 3000 GNSS Time Server (medium 4.6)
- [CVE-2026-1262](https://insights.sbomify.com/CVE-2026-1262/): IBM InfoSphere Information Server Information Disclosure (medium 4.3)
- [CVE-2026-12619](https://insights.sbomify.com/CVE-2026-12619/): GridTime™ 3000 GNSS Time Server CSRF to XSS (medium 5.1)
- [CVE-2026-12618](https://insights.sbomify.com/CVE-2026-12618/): Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access (high 7.2)
- [CVE-2026-12617](https://insights.sbomify.com/CVE-2026-12617/): Record ordering based unexpected exit with CNAME or DNAME (high 7.5)
- [CVE-2026-12616](https://insights.sbomify.com/CVE-2026-12616/): Other in Eclipse CSI - PIA (medium 6.9)
- [CVE-2026-12613](https://insights.sbomify.com/CVE-2026-12613/): Insecure Deserialization Leading to Remote Code Execution in Ministry of Justice's UYAP Document Editor (high 8.8)
- [CVE-2026-12611](https://insights.sbomify.com/CVE-2026-12611/): Race condition in Eclipse Jetty (high 8.7)
- [CVE-2026-12610](https://insights.sbomify.com/CVE-2026-12610/): Sssd: use-after-free crash in sssd' 'sssd_pam' process (medium 6.4)
- [CVE-2026-1261](https://insights.sbomify.com/CVE-2026-1261/): MetForm Pro <= 3.9.6 - Unauthenticated Stored Cross-Site Scripting (high 7.2)
- [CVE-2026-12609](https://insights.sbomify.com/CVE-2026-12609/): Path traversal in Eclipse Theia (high 7.5)
- [CVE-2026-12606](https://insights.sbomify.com/CVE-2026-12606/): Other in Eclipse GlassFish (medium 6.3)
- [CVE-2026-12605](https://insights.sbomify.com/CVE-2026-12605/): Server-side request forgery in Eclipse GlassFish (critical 9.6)
- [CVE-2026-12602](https://insights.sbomify.com/CVE-2026-12602/): Incorrect permissions in ArubaSign by Aruba (high 8.8)
- [CVE-2026-12600](https://insights.sbomify.com/CVE-2026-12600/): Uncontrolled memory usage in Innodata Labs’ Poppler JPX decoder (high 8.7)
- [CVE-2026-1260](https://insights.sbomify.com/CVE-2026-1260/): Invalid Memory Access in Sentencepiece, (high 8.5)
- [CVE-2026-12598](https://insights.sbomify.com/CVE-2026-12598/): LoginPress Pro <= 6.2.3 - Unauthenticated Authentication Bypass via Unverified OAuth Email in Spotify OAuth Callback (high 8.1)
- [CVE-2026-12597](https://insights.sbomify.com/CVE-2026-12597/): LoginPress Pro <= 6.2.3 - Unauthenticated Authentication Bypass via Unverified OAuth Email via GitHub OAuth Callback (high 8.1)
- [CVE-2026-12595](https://insights.sbomify.com/CVE-2026-12595/): LoginPress Pro <= 6.2.3 - Unauthenticated Authentication Bypass via Unverified OAuth Email via Discord OAuth Callback (high 8.1)
- [CVE-2026-12593](https://insights.sbomify.com/CVE-2026-12593/): Privilege escalation via forged API token creation in Axivion Dashboard OIDC/OAuth2/SSO subsystem (high 8.7)
- [CVE-2026-12592](https://insights.sbomify.com/CVE-2026-12592/): SlimStat Analytics < 5.5.0 - Unauthenticated Stored XSS via CF-IPCountry Header (high 7.5)
- [CVE-2026-12590](https://insights.sbomify.com/CVE-2026-12590/): body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement (low 3.7)
- [CVE-2026-12588](https://insights.sbomify.com/CVE-2026-12588/): Denial of service in Trellix HX Console (medium 6.0)
- [CVE-2026-12587](https://insights.sbomify.com/CVE-2026-12587/): Embedded credentials in Virtuagym (high 8.6)
- [CVE-2026-12586](https://insights.sbomify.com/CVE-2026-12586/): Lenxel WP <= 1.0.31 - Unauthenticated Account Takeover via Arbitrary Password Reset (high 8.1)
- [CVE-2026-12585](https://insights.sbomify.com/CVE-2026-12585/): Abandoned Cart Lite for WooCommerce < 6.8.2 - Unauthenticated Account Takeover via Malleable Recovery-Link Token (high 8.1)
- [CVE-2026-12584](https://insights.sbomify.com/CVE-2026-12584/): Business logic in Payment Gateway for Redsys & WooCommerce Lite (high 7.5)
- [CVE-2026-12583](https://insights.sbomify.com/CVE-2026-12583/): Newsletters < 4.15 - Unauthenticated PHP Object Injection via Subscriber Custom Field (high 8.1)
- [CVE-2026-12582](https://insights.sbomify.com/CVE-2026-12582/): Library Management System < 3.5.8 - Unauthenticated SQL Injection via book_id (high 8.6)
- [CVE-2026-12581](https://insights.sbomify.com/CVE-2026-12581/): Digiwin｜EasyFlow .NET - Session Fixation (high 7.7)
- [CVE-2026-12580](https://insights.sbomify.com/CVE-2026-12580/): Digiwin｜EasyFlow .NET - Stored Cross-Site Scripting (medium 5.1)
- [CVE-2026-1258](https://insights.sbomify.com/CVE-2026-1258/): Mail Mint <= 1.19.2 - Authenticated (Administrator+) SQL Injection via Multiple API Endpoints (medium 4.9)
- [CVE-2026-12579](https://insights.sbomify.com/CVE-2026-12579/): AS228T - Authentication Bypass Vulnerability (high 7.4)
- [CVE-2026-12578](https://insights.sbomify.com/CVE-2026-12578/): DTMSoft - Deserialization of Untrusted Data Vulnerability (high 8.4)
- [CVE-2026-12577](https://insights.sbomify.com/CVE-2026-12577/): DVP80ES3 Improperly Implemented Security Check for Standard vulnerability (high 8.7)
- [CVE-2026-12576](https://insights.sbomify.com/CVE-2026-12576/): DVP80ES3 Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability (high 7.5)
- [CVE-2026-12575](https://insights.sbomify.com/CVE-2026-12575/): DVP80ES3 Improper Resource Shutdown or Release Vulnerability (high 7.5)
- [CVE-2026-12571](https://insights.sbomify.com/CVE-2026-12571/): Authentication Bypass Leading to Account Takeover (critical 9.8)
- [CVE-2026-12570](https://insights.sbomify.com/CVE-2026-12570/): Denial of Service via HDF5 Shape Bomb in keras.models.load_model() in keras-team/keras (medium 5.5)
- [CVE-2026-1257](https://insights.sbomify.com/CVE-2026-1257/): Administrative Shortcodes <= 0.3.4 - Authenticated (Contributor+) Local File Inclusion via 'slug' Shortcode Attribute (high 7.5)
- [CVE-2026-12569](https://insights.sbomify.com/CVE-2026-12569/): PTC Windchill and FlexPLM Improper Input Validation (critical 9.3, exploited in the wild)
- [CVE-2026-12568](https://insights.sbomify.com/CVE-2026-12568/): Arbitrary File Write in postman_download module (medium 6.5)
- [CVE-2026-12567](https://insights.sbomify.com/CVE-2026-12567/): Symlink-following arbitrary write via github_workflows module (low 2.2)
- [CVE-2026-12566](https://insights.sbomify.com/CVE-2026-12566/): SSRF via unvalidated WWW-Authenticate realm in docker_pull module (low 3.1)
- [CVE-2026-12565](https://insights.sbomify.com/CVE-2026-12565/): Path Traversal (Zip-Slip) in unarchive module (medium 5.3)
- [CVE-2026-12564](https://insights.sbomify.com/CVE-2026-12564/): Server-side request forgery in Red Hat Ansible Automation Platform 2.4 for RHEL 8 (critical 9.6)
- [CVE-2026-12562](https://insights.sbomify.com/CVE-2026-12562/): Toptech Systems RCU II+ and Multiload II+ Missing Authentication for Critical Function (high 8.7)
- [CVE-2026-12561](https://insights.sbomify.com/CVE-2026-12561/): tagDiv Composer <= 5.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2026-12560](https://insights.sbomify.com/CVE-2026-12560/): Editorial Rating <= 4.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Link URL' Field (medium 4.4)
- [CVE-2026-1256](https://insights.sbomify.com/CVE-2026-1256/): Missing authorization in YS LeadGen – Popup Builder, Popup Maker & Form Builder for WordPress | Lead Generation, Email Marketing, Sales, Conversions, Opt-Ins & Subscribers (medium 6.4)
- [CVE-2026-12559](https://insights.sbomify.com/CVE-2026-12559/): Cross-site scripting in Vendor Invoice Management for SAP Solutions (high 7.3)
- [CVE-2026-12557](https://insights.sbomify.com/CVE-2026-12557/): Missing authorization in Ninja Forms - File Uploads (medium 5.3)
- [CVE-2026-12556](https://insights.sbomify.com/CVE-2026-12556/): HP Easy Start for macOS - Security Update (high 7.7)
- [CVE-2026-12555](https://insights.sbomify.com/CVE-2026-12555/): HP Easy Start for macOS - Security Update (high 7.7)
- [CVE-2026-12554](https://insights.sbomify.com/CVE-2026-12554/): HP Easy Start for macOS - Security Update (high 8.5)
- [CVE-2026-12553](https://insights.sbomify.com/CVE-2026-12553/): HP Web Jetadmin (WJA) - Potential Arbitrary File Read/Write (high 8.9)
- [CVE-2026-1255](https://insights.sbomify.com/CVE-2026-1255/): Missing authorization in YS LeadGen – Popup Builder, Popup Maker & Form Builder for WordPress | Lead Generation, Email Marketing, Sales, Conversions, Opt-Ins & Subscribers (high 7.5)
- [CVE-2026-12549](https://insights.sbomify.com/CVE-2026-12549/): Libsoup: incomplete fix for cve-2026-2443: range suffix overflow in libsoup soupserver (medium 4.8)
- [CVE-2026-12548](https://insights.sbomify.com/CVE-2026-12548/): Libsoup: heap out-of-bounds read in libsoup due to integer truncation (medium 4.2)
- [CVE-2026-12547](https://insights.sbomify.com/CVE-2026-12547/): Libsoup: information disclosure in libsoup via soupauthmanager proxy credential leak on proxy switch (low 3.4)
- [CVE-2026-12545](https://insights.sbomify.com/CVE-2026-12545/): Rubygem-hammer_cli: command injection via insecure editor invocation (medium 6.7)
- [CVE-2026-12544](https://insights.sbomify.com/CVE-2026-12544/): Foreman: ssti and insecure deserialization in foreman-rake configuration (high 7.7)
- [CVE-2026-12542](https://insights.sbomify.com/CVE-2026-12542/): Foreman: command injection in foreman-tail (medium 5.3)
- [CVE-2026-12541](https://insights.sbomify.com/CVE-2026-12541/): Foreman: command injection in foreman-rake database tasks (high 8.2)
- [CVE-2026-12540](https://insights.sbomify.com/CVE-2026-12540/): Foreman: command injection in foreman-rake errors:fetch_log via request_id parameter (high 8.2)
- [CVE-2026-1254](https://insights.sbomify.com/CVE-2026-1254/): Missing authorization in Modula Image Gallery – Photo Grid & Video Gallery (medium 4.3)
- [CVE-2026-12539](https://insights.sbomify.com/CVE-2026-12539/): Docker Sandboxes ICMP egress restriction bypass after daemon restart (medium 5.1)
- [CVE-2026-12537](https://insights.sbomify.com/CVE-2026-12537/): Unauthenticated Remote Code Execution in Gemini CLI CI/CD Workflows (critical 10.0)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/883/