# Vulnerabilities published in 2026


- [CVE-2026-12308](https://insights.sbomify.com/CVE-2026-12308/): Memory safety bug fixed in Thunderbird 152 (medium 5.3)
- [CVE-2026-12307](https://insights.sbomify.com/CVE-2026-12307/): Memory safety bug fixed in Thunderbird 152 (medium 5.3)
- [CVE-2026-12306](https://insights.sbomify.com/CVE-2026-12306/): Memory safety bug fixed in Thunderbird 152 (medium 5.3)
- [CVE-2026-12305](https://insights.sbomify.com/CVE-2026-12305/): Memory safety bug fixed in Thunderbird 152 (high 7.5)
- [CVE-2026-12304](https://insights.sbomify.com/CVE-2026-12304/): Same-origin policy bypass in the Networking: Cookies component (critical 9.1)
- [CVE-2026-12303](https://insights.sbomify.com/CVE-2026-12303/): Information disclosure due to incorrect boundary conditions in the Graphics: WebGPU component (medium 4.3)
- [CVE-2026-12302](https://insights.sbomify.com/CVE-2026-12302/): Mitigation bypass in the DOM: Security component (medium 6.5)
- [CVE-2026-12301](https://insights.sbomify.com/CVE-2026-12301/): Memory safety bug fixed in Thunderbird 152 (medium 5.3)
- [CVE-2026-12300](https://insights.sbomify.com/CVE-2026-12300/): Memory safety bug fixed in Thunderbird 152 (medium 5.3)
- [CVE-2026-1230](https://insights.sbomify.com/CVE-2026-1230/): Use of Incorrectly-Resolved Name or Reference in GitLab (medium 4.1)
- [CVE-2026-12299](https://insights.sbomify.com/CVE-2026-12299/): JIT miscompilation in the DOM: Core & HTML component (medium 5.4)
- [CVE-2026-12298](https://insights.sbomify.com/CVE-2026-12298/): Memory safety bug fixed in Thunderbird 152 (medium 5.4)
- [CVE-2026-12297](https://insights.sbomify.com/CVE-2026-12297/): Sandbox escape due to incorrect boundary conditions in the Networking component (critical 9.6)
- [CVE-2026-12296](https://insights.sbomify.com/CVE-2026-12296/): Sandbox escape in the Security: Process Sandboxing component (critical 9.6)
- [CVE-2026-12295](https://insights.sbomify.com/CVE-2026-12295/): Sandbox escape in the DOM: Navigation component (critical 9.6)
- [CVE-2026-12294](https://insights.sbomify.com/CVE-2026-12294/): Sandbox escape in the DOM: Workers component (critical 9.6)
- [CVE-2026-12293](https://insights.sbomify.com/CVE-2026-12293/): Use-after-free in the Graphics: WebGPU component (critical 9.8)
- [CVE-2026-12292](https://insights.sbomify.com/CVE-2026-12292/): Incorrect boundary conditions in the Web Audio component (high 8.1)
- [CVE-2026-12291](https://insights.sbomify.com/CVE-2026-12291/): Use-after-free in the Networking: HTTP component (high 8.8)
- [CVE-2026-12290](https://insights.sbomify.com/CVE-2026-12290/): Memory safety bug fixed in Thunderbird 152 (high 8.1)
- [CVE-2026-1229](https://insights.sbomify.com/CVE-2026-1229/): Incorrect calculation in CIRCL secp384r1 CombinedMult (low 2.9)
- [CVE-2026-12289](https://insights.sbomify.com/CVE-2026-12289/): Privilege escalation in the Graphics: WebRender component (high 8.8)
- [CVE-2026-12285](https://insights.sbomify.com/CVE-2026-12285/): Mali GPU Kernel Driver allows access to already freed memory (medium 4.0)
- [CVE-2026-12284](https://insights.sbomify.com/CVE-2026-12284/): Mattermost Desktop App Missing IPC Sender Validation in Calls Leave Handler (low 3.8)
- [CVE-2026-12283](https://insights.sbomify.com/CVE-2026-12283/): SQL injection in Amazon Athena Synapse connector (medium 6.1)
- [CVE-2026-12281](https://insights.sbomify.com/CVE-2026-12281/): Shibboleth < 2.5.4 - Unauthenticated Administrator Account Creation via Identity Header Spoofing (high 8.1)
- [CVE-2026-1228](https://insights.sbomify.com/CVE-2026-1228/): Missing authorization in Timeline Block – Beautiful Timeline Builder for WordPress (Vertical & Horizontal Timelines) (medium 4.3)
- [CVE-2026-12277](https://insights.sbomify.com/CVE-2026-12277/): Frontend File Manager Plugin <= 23.6 - Unauthenticated Arbitrary File Deletion via Saved File Metadata Path Traversal (high 8.7)
- [CVE-2026-12276](https://insights.sbomify.com/CVE-2026-12276/): LA-Studio Element Kit for Elementor < 1.6.1 - Unauthenticated Open Registration (medium 5.3)
- [CVE-2026-12275](https://insights.sbomify.com/CVE-2026-12275/): Missing authorization in Tutor LMS (high 7.1)
- [CVE-2026-12274](https://insights.sbomify.com/CVE-2026-12274/): Tutor LMS < 3.9.13 - Instructor+ Arbitrary Post Overwrite via IDOR (medium 6.5)
- [CVE-2026-12273](https://insights.sbomify.com/CVE-2026-12273/): Tutor LMS < 3.9.13 - Subscriber+ Arbitrary Auto-Approved Comment Creation (medium 4.3)
- [CVE-2026-12272](https://insights.sbomify.com/CVE-2026-12272/): Lightweight Cookie Notice <= 1.19 - Sensitive Information Exposure via W3TC_DYNAMIC_SECURITY Constant (medium 5.3)
- [CVE-2026-12271](https://insights.sbomify.com/CVE-2026-12271/): Tutor LMS < 3.9.13 - Subscriber+ Arbitrary Quiz Attempt Modification via IDOR (medium 5.4)
- [CVE-2026-12270](https://insights.sbomify.com/CVE-2026-12270/): Everest Forms < 3.5.0 - Unauthenticated Missing Authorization via Site Assistant REST Endpoints (medium 6.5)
- [CVE-2026-1227](https://insights.sbomify.com/CVE-2026-1227/): XML external entity in EcoStruxure Building Operation Webstation (high 7.0)
- [CVE-2026-12269](https://insights.sbomify.com/CVE-2026-12269/): Authenticated File Write to RCE via keepalived in DDI Central (high 8.8)
- [CVE-2026-12268](https://insights.sbomify.com/CVE-2026-12268/): Authenticated PowerShell Injection leads to RCE (high 8.8)
- [CVE-2026-12267](https://insights.sbomify.com/CVE-2026-12267/): Authenticated PowerShell Injection in DNS Query Resolution Policy leads to RCE (high 7.2)
- [CVE-2026-12265](https://insights.sbomify.com/CVE-2026-12265/): Missing Authorization on HA Failover Config allows Complete Data Destruction (high 8.8)
- [CVE-2026-12264](https://insights.sbomify.com/CVE-2026-12264/): Authenticated File Write via HA Failover Config Upload leads to RCE (high 8.8)
- [CVE-2026-12263](https://insights.sbomify.com/CVE-2026-12263/): Authentication Bypass (high 8.8)
- [CVE-2026-12261](https://insights.sbomify.com/CVE-2026-12261/): Improper Access Control in nltk/nltk (medium 5.3)
- [CVE-2026-12260](https://insights.sbomify.com/CVE-2026-12260/): SQL injection in the NetBoard CRM demo platform (critical 10.0)
- [CVE-2026-1226](https://insights.sbomify.com/CVE-2026-1226/): Code injection in EcoStruxure Building Operation Webstation (high 7.0)
- [CVE-2026-12259](https://insights.sbomify.com/CVE-2026-12259/): Improper Input Validation in nltk/nltk (medium 5.3)
- [CVE-2026-12258](https://insights.sbomify.com/CVE-2026-12258/): Inadequate access control in the Hiperdino REST API (critical 9.2)
- [CVE-2026-12257](https://insights.sbomify.com/CVE-2026-12257/): Remote code execution in Mura Software’s CMS (critical 9.3)
- [CVE-2026-12256](https://insights.sbomify.com/CVE-2026-12256/): WordPress Fusion Builder plugin <= 3.15.3 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-12255](https://insights.sbomify.com/CVE-2026-12255/): MainWP Child < 6.1.2 - Unauthenticated Administrator Authentication Bypass via Passwordless Site Registration (high 8.1)
- [CVE-2026-12254](https://insights.sbomify.com/CVE-2026-12254/): Netskope Client Captive Portal WebView Persistence allowing SWG bypass issue (medium 6.4)
- [CVE-2026-12252](https://insights.sbomify.com/CVE-2026-12252/): Untrusted JAR Code Execution in Multiple Stanford Interface Classes in nltk/nltk (high 7.8)
- [CVE-2026-12251](https://insights.sbomify.com/CVE-2026-12251/): Ultimate Member < 2.12.1 - Unauthenticated Privilege Escalation via Role Selection Field (high 8.1)
- [CVE-2026-12250](https://insights.sbomify.com/CVE-2026-12250/): Sensitive Data Exposure in TUBITAK BILGEM's Pardus Domain Joiner (high 7.9)
- [CVE-2026-1225](https://insights.sbomify.com/CVE-2026-1225/): Malicious logback.xml configuration file allows instantiation of arbitrary classes (low 1.8)
- [CVE-2026-12249](https://insights.sbomify.com/CVE-2026-12249/): Canonical ADSys Trust Store Poisoning via Plaintext HTTP Certificate Auto-Enrollment (critical 9.0)
- [CVE-2026-12248](https://insights.sbomify.com/CVE-2026-12248/): WPML Multilingual CMS <= 4.9.5 - Authenticated (Translator+) SQL Injection via 'sorting' Parameter (medium 6.5)
- [CVE-2026-12246](https://insights.sbomify.com/CVE-2026-12246/): Out of bounds stack write with crafted APL RR (high 7.2)
- [CVE-2026-12245](https://insights.sbomify.com/CVE-2026-12245/): Denial of DNS over TLS service by any DoT client (high 8.7)
- [CVE-2026-12244](https://insights.sbomify.com/CVE-2026-12244/): Heap overflow and crash with crafted SVCB RR (high 8.7)
- [CVE-2026-12242](https://insights.sbomify.com/CVE-2026-12242/): AdRotate Banner Manager <= 5.17.7 - Authenticated (Contributor+) PHP Code Injection via 'banner' Shortcode Attribute (high 8.8)
- [CVE-2026-12241](https://insights.sbomify.com/CVE-2026-12241/): Cross-site scripting in Advanced Woo Labels – Product Labels & Badges for WooCommerce (medium 5.4)
- [CVE-2026-12240](https://insights.sbomify.com/CVE-2026-12240/): Deserialization in Export User Data (high 8.0)
- [CVE-2026-1224](https://insights.sbomify.com/CVE-2026-1224/): Tanium addressed an uncontrolled resource consumption vulnerability in Discover. (medium 4.9)
- [CVE-2026-12238](https://insights.sbomify.com/CVE-2026-12238/): WP Go Maps <= 10.1.01 - Unauthenticated Arbitrary Record Creation (medium 5.3)
- [CVE-2026-12236](https://insights.sbomify.com/CVE-2026-12236/): Infinite loop (DoS) in Bluetooth GATT client parsing of Read-By-Type responses with zero data length (medium 6.5)
- [CVE-2026-12235](https://insights.sbomify.com/CVE-2026-12235/): Out-of-bounds write in Xtensa llext PLT relocation from malformed ELF (CWE-787) (medium 6.3)
- [CVE-2026-12234](https://insights.sbomify.com/CVE-2026-12234/): TOCTOU double-fetch in `zsock_sendmsg`/`recvmsg` userspace verifiers allows kernel-heap out-of-bounds write (high 7.8)
- [CVE-2026-12233](https://insights.sbomify.com/CVE-2026-12233/): Uninitialized mutex in TLS trusted-credential backend causes kernel NULL-deref DoS under contention (medium 5.9)
- [CVE-2026-12232](https://insights.sbomify.com/CVE-2026-12232/): Out-of-bounds read via unvalidated stream_id in Intel ALH DAI get_properties (medium 6.1)
- [CVE-2026-12231](https://insights.sbomify.com/CVE-2026-12231/): Cross-site scripting in Exclusive Addons for Elementor (medium 6.4)
- [CVE-2026-12230](https://insights.sbomify.com/CVE-2026-12230/): LearnPress <= 4.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'layout_custom_css' (medium 6.4)
- [CVE-2026-1223](https://insights.sbomify.com/CVE-2026-1223/): BROWAN COMMUNICATIONS ｜PrismX MX100 AP controller - Insufficiently Protected Credentials (medium 6.9)
- [CVE-2026-12228](https://insights.sbomify.com/CVE-2026-12228/): Stored XSS in Direct Messages via Prompt Sharing in parisneo/lollms (high 8.7)
- [CVE-2026-12227](https://insights.sbomify.com/CVE-2026-12227/): Visual Composer Website Builder <= 45.16.0 - Unauthenticated Local File Inclusion via 'vcv-template' Parameter (critical 9.8)
- [CVE-2026-12225](https://insights.sbomify.com/CVE-2026-12225/): syracom Secure Login (2FA) for Confluence allows 2FA bypass via spoofed User-Agent (high 8.7)
- [CVE-2026-12224](https://insights.sbomify.com/CVE-2026-12224/): Dokan Pro <= 5.0.4 - Authenticated (Vendor+) Privilege Escalation via update_capabilities REST Endpoint (high 8.8)
- [CVE-2026-12223](https://insights.sbomify.com/CVE-2026-12223/): Yealink SIP-T46U Web FastCGI Service tftpuploadiperf mod_webd.TFTPUploadIperf command injection (medium 5.1)
- [CVE-2026-12222](https://insights.sbomify.com/CVE-2026-12222/): Yealink SIP-T46U Web FastCGI Service bttest mod_webd.BlueToothTest stack-based overflow (high 8.6)
- [CVE-2026-12221](https://insights.sbomify.com/CVE-2026-12221/): Yealink SIP-T46U Firmware Chunk Upload upgrade sprintf stack-based overflow (high 8.6)
- [CVE-2026-12220](https://insights.sbomify.com/CVE-2026-12220/): Yealink SIP-T46U Firmware Chunk Upload handler accupgradebychunk mod_upgrade.SparePartsUpload stack-based overflow (high 8.6)
- [CVE-2026-1222](https://insights.sbomify.com/CVE-2026-1222/): BROWAN COMMUNICATIONS ｜PrismX MX100 AP controller - Arbitrary File Upload (high 8.6)
- [CVE-2026-12219](https://insights.sbomify.com/CVE-2026-12219/): Yealink SIP-T46U Web FastCGI Service start mod_diagnose.CommandShellByType command injection (medium 5.3)
- [CVE-2026-12218](https://insights.sbomify.com/CVE-2026-12218/): Yealink SIP-T46U Web FastCGI Service beforewifitest StartReportInformation stack-based overflow (high 8.6)
- [CVE-2026-12217](https://insights.sbomify.com/CVE-2026-12217/): DVDFab Virtual Drive Signed Kernel Driver dvdfabio.sys privileges management (high 8.5)
- [CVE-2026-12216](https://insights.sbomify.com/CVE-2026-12216/): svaarala duktape duk_api_bytecode.c memory corruption (medium 4.8)
- [CVE-2026-12215](https://insights.sbomify.com/CVE-2026-12215/): OTP Login & Register Woocommerce <= 2.7.2 - Unauthenticated Authentication Bypass via Brute Force (medium 5.3)
- [CVE-2026-12214](https://insights.sbomify.com/CVE-2026-12214/): Qihoo 360 Total Security Nucleus Engine Monitoring Logic RpcStringBindingComposeW protection mechanism (high 8.5)
- [CVE-2026-12213](https://insights.sbomify.com/CVE-2026-12213/): hcengineering Huly Platform User Information operations.ts getAccountInfo improper authorization (medium 5.3)
- [CVE-2026-12212](https://insights.sbomify.com/CVE-2026-12212/): hcengineering Huly Platform RPC operations.ts getMailboxSecret access control (medium 5.3)
- [CVE-2026-12211](https://insights.sbomify.com/CVE-2026-12211/): Intelbras iNVU 7016 FT Web syslog path traversal (medium 5.1)
- [CVE-2026-12210](https://insights.sbomify.com/CVE-2026-12210/): universal-tool-calling-protocol python-utcp utcp-gql/utcp-websocket server-side request forgery (medium 5.3)
- [CVE-2026-1221](https://insights.sbomify.com/CVE-2026-1221/): BROWAN COMMUNICATIONS ｜PrismX MX100 AP controller - Use of Hard-coded Credentials (critical 9.3)
- [CVE-2026-12209](https://insights.sbomify.com/CVE-2026-12209/): RubyLouvre avalon Template Filter index.js prototype pollution (medium 6.9)
- [CVE-2026-12208](https://insights.sbomify.com/CVE-2026-12208/): jsonata-js jsonata Function Binding Frame System jsonata.js createFrame prototype pollution (medium 6.9)
- [CVE-2026-12207](https://insights.sbomify.com/CVE-2026-12207/): medkey-org medkey HTTP REST API PatientController.php actionGetPatientById resource injection (medium 5.3)
- [CVE-2026-12206](https://insights.sbomify.com/CVE-2026-12206/): Grit42 Grit data_table_entity.rb DataTableEntity sql injection (medium 5.3)
- [CVE-2026-12205](https://insights.sbomify.com/CVE-2026-12205/): Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to private-key recovery (critical 9.1)
- [CVE-2026-12204](https://insights.sbomify.com/CVE-2026-12204/): ShopXO Scheduled Task Endpoint Crontab.php GoodsGiveIntegral authorization (medium 6.9)
- [CVE-2026-12203](https://insights.sbomify.com/CVE-2026-12203/): HKUDS AI-Trader Research Export agents.csv information disclosure (medium 6.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/886/