# Vulnerabilities published in 2026


- [CVE-2026-101401](https://insights.sbomify.com/CVE-2026-101401/): Denial of service in Siebel Apps - Marketing (low 2.9)
- [CVE-2026-101400](https://insights.sbomify.com/CVE-2026-101400/): Denial of service in Siebel Apps - Marketing (low 2.9)
- [CVE-2026-10140](https://insights.sbomify.com/CVE-2026-10140/): Cross-Tenant API Key Reuse and Billing Fraud in Langflow Voice Mode Subsystem (critical 9.6)
- [CVE-2026-1014](https://insights.sbomify.com/CVE-2026-1014/): IBM InfoSphere Information Server is vulnerable due to disclosure of sensitive information (medium 6.5)
- [CVE-2026-101399](https://insights.sbomify.com/CVE-2026-101399/): Denial of service in Siebel Apps - Marketing (medium 5.3)
- [CVE-2026-101398](https://insights.sbomify.com/CVE-2026-101398/): Missing authorization in Oracle Capacity (high 7.6)
- [CVE-2026-101397](https://insights.sbomify.com/CVE-2026-101397/): Information disclosure in Siebel Apps - Marketing (low 2.2)
- [CVE-2026-101396](https://insights.sbomify.com/CVE-2026-101396/): Missing authorization in Siebel Apps - Marketing (medium 4.7)
- [CVE-2026-101395](https://insights.sbomify.com/CVE-2026-101395/): Missing authorization in Siebel Apps - Marketing (medium 6.1)
- [CVE-2026-101394](https://insights.sbomify.com/CVE-2026-101394/): Missing authorization in Siebel Apps - Marketing (medium 5.3)
- [CVE-2026-101393](https://insights.sbomify.com/CVE-2026-101393/): Cross-site request forgery in Siebel Apps - Marketing (medium 4.3)
- [CVE-2026-101392](https://insights.sbomify.com/CVE-2026-101392/): Information disclosure in Siebel Apps - Marketing (medium 5.5)
- [CVE-2026-101391](https://insights.sbomify.com/CVE-2026-101391/): Missing authorization in Siebel Apps - Marketing (medium 6.1)
- [CVE-2026-101390](https://insights.sbomify.com/CVE-2026-101390/): Auth bypass in PeopleSoft Enterprise PeopleTools (high 8.1)
- [CVE-2026-10139](https://insights.sbomify.com/CVE-2026-10139/): Memory corruption in Totolink (critical 9.1)
- [CVE-2026-101389](https://insights.sbomify.com/CVE-2026-101389/): Denial of service in PeopleSoft Enterprise PeopleTools (medium 5.9)
- [CVE-2026-101388](https://insights.sbomify.com/CVE-2026-101388/): Missing authorization in PeopleSoft Enterprise PeopleTools (high 7.1)
- [CVE-2026-101387](https://insights.sbomify.com/CVE-2026-101387/): Missing authorization in Oracle Capacity (high 7.6)
- [CVE-2026-101386](https://insights.sbomify.com/CVE-2026-101386/): Missing authorization in Oracle REST Data Services (medium 4.2)
- [CVE-2026-101385](https://insights.sbomify.com/CVE-2026-101385/): Missing authorization in Oracle REST Data Services (medium 4.9)
- [CVE-2026-101384](https://insights.sbomify.com/CVE-2026-101384/): Information disclosure in Oracle REST Data Services (medium 5.0)
- [CVE-2026-101383](https://insights.sbomify.com/CVE-2026-101383/): Missing authorization in Oracle REST Data Services (medium 5.4)
- [CVE-2026-101382](https://insights.sbomify.com/CVE-2026-101382/): Missing authorization in Oracle REST Data Services (medium 4.2)
- [CVE-2026-101381](https://insights.sbomify.com/CVE-2026-101381/): Missing authorization in Oracle REST Data Services (medium 5.4)
- [CVE-2026-101380](https://insights.sbomify.com/CVE-2026-101380/): Missing authorization in Oracle REST Data Services (medium 5.4)
- [CVE-2026-10138](https://insights.sbomify.com/CVE-2026-10138/): Command injection in Totolink (critical 9.1)
- [CVE-2026-101379](https://insights.sbomify.com/CVE-2026-101379/): Missing authorization in Oracle REST Data Services (medium 5.3)
- [CVE-2026-101378](https://insights.sbomify.com/CVE-2026-101378/): Missing authorization in Oracle REST Data Services (medium 4.3)
- [CVE-2026-101377](https://insights.sbomify.com/CVE-2026-101377/): Denial of service in Oracle REST Data Services (low 2.7)
- [CVE-2026-101376](https://insights.sbomify.com/CVE-2026-101376/): Missing authorization in Oracle REST Data Services (medium 4.7)
- [CVE-2026-101375](https://insights.sbomify.com/CVE-2026-101375/): Missing authorization in Oracle REST Data Services (medium 6.3)
- [CVE-2026-101374](https://insights.sbomify.com/CVE-2026-101374/): Missing authorization in Oracle REST Data Services (medium 5.9)
- [CVE-2026-101373](https://insights.sbomify.com/CVE-2026-101373/): Missing authorization in Oracle REST Data Services (low 2.4)
- [CVE-2026-101372](https://insights.sbomify.com/CVE-2026-101372/): Information disclosure in Oracle REST Data Services (low 3.7)
- [CVE-2026-101371](https://insights.sbomify.com/CVE-2026-101371/): Other in Oracle REST Data Services (low 3.1)
- [CVE-2026-101370](https://insights.sbomify.com/CVE-2026-101370/): Other in Oracle REST Data Services (low 3.1)
- [CVE-2026-10137](https://insights.sbomify.com/CVE-2026-10137/): Memory corruption in Totolink (critical 9.1)
- [CVE-2026-101369](https://insights.sbomify.com/CVE-2026-101369/): Other in Oracle REST Data Services (medium 6.1)
- [CVE-2026-101368](https://insights.sbomify.com/CVE-2026-101368/): Other in Oracle REST Data Services (medium 5.4)
- [CVE-2026-101367](https://insights.sbomify.com/CVE-2026-101367/): Other in Oracle REST Data Services (medium 5.4)
- [CVE-2026-101366](https://insights.sbomify.com/CVE-2026-101366/): Information disclosure in Oracle REST Data Services (medium 4.3)
- [CVE-2026-101365](https://insights.sbomify.com/CVE-2026-101365/): Denial of service in Oracle REST Data Services (medium 4.7)
- [CVE-2026-101364](https://insights.sbomify.com/CVE-2026-101364/): Other in Oracle REST Data Services (medium 5.4)
- [CVE-2026-101363](https://insights.sbomify.com/CVE-2026-101363/): Information disclosure in Oracle REST Data Services (medium 5.3)
- [CVE-2026-101362](https://insights.sbomify.com/CVE-2026-101362/): Other in Oracle REST Data Services (medium 6.9)
- [CVE-2026-101361](https://insights.sbomify.com/CVE-2026-101361/): Other in Oracle REST Data Services (medium 4.2)
- [CVE-2026-101360](https://insights.sbomify.com/CVE-2026-101360/): Other in Oracle REST Data Services (medium 5.4)
- [CVE-2026-10136](https://insights.sbomify.com/CVE-2026-10136/): Memory corruption in Totolink (critical 9.1)
- [CVE-2026-101359](https://insights.sbomify.com/CVE-2026-101359/): Missing authorization in Oracle REST Data Services (medium 5.3)
- [CVE-2026-101357](https://insights.sbomify.com/CVE-2026-101357/): Cross-site scripting in SEOPress – AI SEO Plugin & On-site SEO (medium 4.9)
- [CVE-2026-101356](https://insights.sbomify.com/CVE-2026-101356/): Apache Tomcat: HTTP/2 request/response mix-up after error during async processing (critical 9.1)
- [CVE-2026-101354](https://insights.sbomify.com/CVE-2026-101354/): FAST FAC1203R MmtAtePrase _tWlanTask stack-based overflow (critical 9.4)
- [CVE-2026-10135](https://insights.sbomify.com/CVE-2026-10135/): Command injection in Totolink (critical 9.1)
- [CVE-2026-101341](https://insights.sbomify.com/CVE-2026-101341/): Stack overwrite from specially formatted TXT-DATA RDATA field (high 8.7)
- [CVE-2026-10134](https://insights.sbomify.com/CVE-2026-10134/): Unauthenticated Server-Side RCE via PythonCodeStructuredTool in Public Flows (critical 10.0)
- [CVE-2026-101339](https://insights.sbomify.com/CVE-2026-101339/): Stack overwrite from a specially crafted and formatted HIP RR (high 8.7)
- [CVE-2026-101338](https://insights.sbomify.com/CVE-2026-101338/): Stack overwrite from a specially crafted and formatted SVCB or HTTPS RR (high 8.7)
- [CVE-2026-101337](https://insights.sbomify.com/CVE-2026-101337/): Stack overwrite from specially formatted base64 RDATA field (high 8.7)
- [CVE-2026-101335](https://insights.sbomify.com/CVE-2026-101335/): Code injection in Forminator Forms – Contact Form, Payment Form & Custom Form Builder (medium 6.5)
- [CVE-2026-101333](https://insights.sbomify.com/CVE-2026-101333/): Keycloak-services: keycloak-services: unbounded metric series creation via idp tag on broker login endpoint (low 3.7)
- [CVE-2026-101331](https://insights.sbomify.com/CVE-2026-101331/): Langflow OSS is affected by multiple vulnerabilities (high 7.7)
- [CVE-2026-10133](https://insights.sbomify.com/CVE-2026-10133/): Memory corruption in Totolink (critical 9.1)
- [CVE-2026-101329](https://insights.sbomify.com/CVE-2026-101329/): Langflow OSS is affected by multiple vulnerabilities (medium 6.5)
- [CVE-2026-101324](https://insights.sbomify.com/CVE-2026-101324/): Fluent Forms <= 6.2.14 - Reflected Cross-Site Scripting via '{get.*}' Editor SmartCode Parameter (medium 4.7)
- [CVE-2026-101322](https://insights.sbomify.com/CVE-2026-101322/): Information disclosure in Eclipse BaSyx AAS Web UI (high 8.3)
- [CVE-2026-10132](https://insights.sbomify.com/CVE-2026-10132/): Memory corruption in Totolink (critical 9.1)
- [CVE-2026-101311](https://insights.sbomify.com/CVE-2026-101311/): Multiple vulnerabilities in bhyve device models (high 7.0)
- [CVE-2026-101310](https://insights.sbomify.com/CVE-2026-101310/): Multiple vulnerabilities in bhyve device models (high 7.0)
- [CVE-2026-10131](https://insights.sbomify.com/CVE-2026-10131/): Command injection in Totolink (critical 9.1)
- [CVE-2026-101309](https://insights.sbomify.com/CVE-2026-101309/): Multiple vulnerabilities in bhyve device models (high 7.0)
- [CVE-2026-101308](https://insights.sbomify.com/CVE-2026-101308/): TOCTOU race between sound(4) buffer resizing and mmap (medium 5.5)
- [CVE-2026-101307](https://insights.sbomify.com/CVE-2026-101307/): Remotely triggerable buffer overflow in tcp_rack (high 8.2)
- [CVE-2026-101306](https://insights.sbomify.com/CVE-2026-101306/): Multiple jail filesystem root escapes (critical 9.8)
- [CVE-2026-101305](https://insights.sbomify.com/CVE-2026-101305/): Multiple jail filesystem root escapes (high 8.8)
- [CVE-2026-101304](https://insights.sbomify.com/CVE-2026-101304/): Multiple jail filesystem root escapes (high 7.1)
- [CVE-2026-101303](https://insights.sbomify.com/CVE-2026-101303/): IPv6 UDP sendto(2) bypasses jail loopback restriction (high 7.5)
- [CVE-2026-101302](https://insights.sbomify.com/CVE-2026-101302/): Remote DoS via receive-side kernel TLS (medium 6.5)
- [CVE-2026-101301](https://insights.sbomify.com/CVE-2026-101301/): WPCode 2.0.0 - 2.3.9 - Unauthenticated Snippet Suppression via Safe Mode Bypass (medium 5.3)
- [CVE-2026-101300](https://insights.sbomify.com/CVE-2026-101300/): Server-Side Request Forgery in Wegow PDF export (high 7.1)
- [CVE-2026-10130](https://insights.sbomify.com/CVE-2026-10130/): QueryWeaver Authentication Bypass via Email Signup Token Issuance for Existing Accounts (high 8.8)
- [CVE-2026-101296](https://insights.sbomify.com/CVE-2026-101296/): Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms (critical 9.1)
- [CVE-2026-101295](https://insights.sbomify.com/CVE-2026-101295/): Oc-mirror: oc-mirror: path traversal / arbitrary file write in operator catalog image extraction (high 7.3)
- [CVE-2026-101294](https://insights.sbomify.com/CVE-2026-101294/): IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a missing cryptographic step (high 8.7)
- [CVE-2026-101292](https://insights.sbomify.com/CVE-2026-101292/): Artemis-core-client: unsafe reflection in apache activemq artemis federation message deserialization (high 8.2)
- [CVE-2026-101290](https://insights.sbomify.com/CVE-2026-101290/): CVE-2026-101290 (high 7.5)
- [CVE-2026-10129](https://insights.sbomify.com/CVE-2026-10129/): SSRF via HTTP Redirect Following in Langflow API Request Component (high 8.5)
- [CVE-2026-101288](https://insights.sbomify.com/CVE-2026-101288/): Langflow OSS is affected by multiple vulnerabilities (high 8.8)
- [CVE-2026-101287](https://insights.sbomify.com/CVE-2026-101287/): Authentication bypass in Stela by Diaple Networking (critical 9.3)
- [CVE-2026-101283](https://insights.sbomify.com/CVE-2026-101283/): Memory corruption in iperf3 (critical 9.2)
- [CVE-2026-101281](https://insights.sbomify.com/CVE-2026-101281/): Trusted Domain Project OpenDMARC SPF Macro opendmarc_spf.c opendmarc_sp2_find_mailfrom_domain improper authentication (medium 6.9)
- [CVE-2026-101280](https://insights.sbomify.com/CVE-2026-101280/): Trusted Domain Project OpenDMARC Multi-Record Set opendmarc_policy_query_dmarc authentication spoofing (medium 6.9)
- [CVE-2026-10128](https://insights.sbomify.com/CVE-2026-10128/): Langflow is affected by weaknesses in secret handling and sensitive configuration access (medium 6.5)
- [CVE-2026-101279](https://insights.sbomify.com/CVE-2026-101279/): Trusted Domain Project OpenDMARC opendmarc_policy.c integer overflow (medium 6.9)
- [CVE-2026-101278](https://insights.sbomify.com/CVE-2026-101278/): Trusted Domain Project OpenDMARC PSL Wildcard opendmarc_tld.c : opendmarc_get_tld origin validation (medium 5.3)
- [CVE-2026-101277](https://insights.sbomify.com/CVE-2026-101277/): Trusted Domain Project OpenDKIM Tag Tokenizer dkim.c dkim_process_set less trusted source (medium 6.9)
- [CVE-2026-101276](https://insights.sbomify.com/CVE-2026-101276/): Use after free in iperf3 (critical 9.2)
- [CVE-2026-101274](https://insights.sbomify.com/CVE-2026-101274/): When pretix is used as the identity provider in a Single-Sign-On (SSO) setup for customer accounts, the system did not properly validate the (medium 6.9)
- [CVE-2026-101273](https://insights.sbomify.com/CVE-2026-101273/): Giftcard enumeration (medium 5.3)
- [CVE-2026-101272](https://insights.sbomify.com/CVE-2026-101272/): Incorrect session validation for API-created shredder exports (low 2.3)
- [CVE-2026-101271](https://insights.sbomify.com/CVE-2026-101271/): OAuth credentials not disabled when application is disabled (low 2.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/996/