# Vulnerabilities published in 2026 - [CVE-2026-0535](https://insights.sbomify.com/CVE-2026-0535/): Stored XSS in Electronic Library Component Description (high 8.1) - [CVE-2026-0534](https://insights.sbomify.com/CVE-2026-0534/): Stored XSS in the value of a part attribute (high 8.1) - [CVE-2026-0533](https://insights.sbomify.com/CVE-2026-0533/): Stored XSS in Fusion desktop when attempting to delete a file (high 8.1) - [CVE-2026-0532](https://insights.sbomify.com/CVE-2026-0532/): External Control of File Name or Path and Server-Side Request Forgery (SSRF) in Kibana Google Gemini Connector (high 8.6) - [CVE-2026-0531](https://insights.sbomify.com/CVE-2026-0531/): Allocation of Resources Without Limits or Throttling in Kibana Fleet (medium 6.5) - [CVE-2026-0530](https://insights.sbomify.com/CVE-2026-0530/): Allocation of Resources Without Limits or Throttling in Kibana Leading to Excessive Allocation (medium 6.5) - [CVE-2026-0529](https://insights.sbomify.com/CVE-2026-0529/): Improper Validation of Array Index in Packetbeat Leading to Overflow Buffers (medium 6.5) - [CVE-2026-0528](https://insights.sbomify.com/CVE-2026-0528/): Improper Input Validation in Metricbeat Leading to Denial of Service (medium 6.5) - [CVE-2026-0522](https://insights.sbomify.com/CVE-2026-0522/): Local File Inclusion in the File Upload/Download Process (high 7.4) - [CVE-2026-0521](https://insights.sbomify.com/CVE-2026-0521/): Reflected Cross-Site Scripting in PDF Export Error Message (medium 5.6) - [CVE-2026-0520](https://insights.sbomify.com/CVE-2026-0520/): Information disclosure in FileZ (low 2.4) - [CVE-2026-0519](https://insights.sbomify.com/CVE-2026-0519/): Information Disclosure in Secure Access Between 12.70 and 14.20 (medium 4.6) - [CVE-2026-0518](https://insights.sbomify.com/CVE-2026-0518/): XSS in Secure Access Consoles prior to 14.20 (medium 4.8) - [CVE-2026-0517](https://insights.sbomify.com/CVE-2026-0517/): Denial of Service in Secure Access Servers Prior to 14.20. (medium 6.0) - [CVE-2026-0516](https://insights.sbomify.com/CVE-2026-0516/): Open redirect in SonicOS (medium 6.5) - [CVE-2026-0515](https://insights.sbomify.com/CVE-2026-0515/): Denial of service in QNX OS for Medical (medium 6.2) - [CVE-2026-0514](https://insights.sbomify.com/CVE-2026-0514/): Cross-Site Scripting (XSS) vulnerability in SAP Business Connector (medium 6.1) - [CVE-2026-0513](https://insights.sbomify.com/CVE-2026-0513/): Open Redirect Vulnerability in SAP Supplier Relationship Management (SICF Handler in SRM Catalog) (medium 4.7) - [CVE-2026-0512](https://insights.sbomify.com/CVE-2026-0512/): Cross-Site Scripting (XSS) vulnerability in SAP Supplier Relationship Management (SICF Handler in SRM Catalog) (medium 6.1) - [CVE-2026-0511](https://insights.sbomify.com/CVE-2026-0511/): Multiple vulnerabilities in SAP Fiori App (Intercompany Balance Reconciliation) (high 8.1) - [CVE-2026-0510](https://insights.sbomify.com/CVE-2026-0510/): Obsolete Encryption Algorithm Used in NW AS Java UME User Mapping (low 3.0) - [CVE-2026-0509](https://insights.sbomify.com/CVE-2026-0509/): Missing Authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform (critical 9.6) - [CVE-2026-0508](https://insights.sbomify.com/CVE-2026-0508/): Open Redirect vulnerability in SAP BusinessObjects Business Intelligence Platform (high 7.3) - [CVE-2026-0507](https://insights.sbomify.com/CVE-2026-0507/): OS Command Injection vulnerability in SAP Application Server for ABAP and SAP NetWeaver RFCSDK (high 8.4) - [CVE-2026-0506](https://insights.sbomify.com/CVE-2026-0506/): Missing Authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform (high 8.1) - [CVE-2026-0505](https://insights.sbomify.com/CVE-2026-0505/): Multiple vulnerabilities in BSP Applications of SAP Document Management System (medium 6.1) - [CVE-2026-0504](https://insights.sbomify.com/CVE-2026-0504/): Insufficient Input Handling in JNDI Operations of SAP Identity Management (low 3.8) - [CVE-2026-0503](https://insights.sbomify.com/CVE-2026-0503/): Missing Authorization check in in SAP ERP Central Component and SAP S/4HANA (SAP EHS Management) (medium 6.4) - [CVE-2026-0502](https://insights.sbomify.com/CVE-2026-0502/): Cross Site Request Forgery (CSRF) in SAP BusinessObjects Business Intelligence Platform (medium 5.4) - [CVE-2026-0501](https://insights.sbomify.com/CVE-2026-0501/): SQL Injection Vulnerability in SAP S/4HANA Private Cloud and On-Premise (Financials � General Ledger) (critical 9.9) - [CVE-2026-0500](https://insights.sbomify.com/CVE-2026-0500/): Remote code execution in SAP Wily Introscope Enterprise Manager (WorkStation) (critical 9.6) - [CVE-2026-0499](https://insights.sbomify.com/CVE-2026-0499/): Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal (medium 6.1) - [CVE-2026-0498](https://insights.sbomify.com/CVE-2026-0498/): Code Injection vulnerability in SAP S/4HANA (Private Cloud and On-Premise) (critical 9.1) - [CVE-2026-0497](https://insights.sbomify.com/CVE-2026-0497/): Missing Authorization check in Business Server Pages Application (Product Designer Web UI) (medium 4.3) - [CVE-2026-0496](https://insights.sbomify.com/CVE-2026-0496/): Multiple vulnerabilities in SAP Fiori App (Intercompany Balance Reconciliation) (medium 6.6) - [CVE-2026-0495](https://insights.sbomify.com/CVE-2026-0495/): Multiple vulnerabilities in SAP Fiori App (Intercompany Balance Reconciliation) (medium 5.1) - [CVE-2026-0494](https://insights.sbomify.com/CVE-2026-0494/): Information Disclosure vulnerability in SAP Fiori App (Intercompany Balance Reconciliation) (medium 4.3) - [CVE-2026-0493](https://insights.sbomify.com/CVE-2026-0493/): Cross-Site Request Forgery (CSRF) vulnerability in SAP Fiori App (Intercompany Balance Reconciliation) (medium 4.3) - [CVE-2026-0492](https://insights.sbomify.com/CVE-2026-0492/): Privilege escalation vulnerability in SAP HANA database (high 8.8) - [CVE-2026-0491](https://insights.sbomify.com/CVE-2026-0491/): Code Injection vulnerability in SAP Landscape Transformation (critical 9.1) - [CVE-2026-0490](https://insights.sbomify.com/CVE-2026-0490/): Denial of service (DOS) in SAP BusinessObjects BI Platform (high 7.5) - [CVE-2026-0489](https://insights.sbomify.com/CVE-2026-0489/): DOM-based Cross-Site Scripting (XSS) Vulnerability in SAP Business One (Job Service) (medium 6.1) - [CVE-2026-0488](https://insights.sbomify.com/CVE-2026-0488/): Code Injection vulnerability in SAP CRM and SAP S/4HANA (Scripting Editor) (critical 9.9) - [CVE-2026-0487](https://insights.sbomify.com/CVE-2026-0487/): DLL Hijacking vulnerability in SAProuter on Microsoft Windows (high 8.4) - [CVE-2026-0486](https://insights.sbomify.com/CVE-2026-0486/): Missing Authorization Check in ABAP based SAP systems (medium 5.0) - [CVE-2026-0485](https://insights.sbomify.com/CVE-2026-0485/): Denial of service (DOS) vulnerability in SAP BusinessObjects BI Platform (high 7.5) - [CVE-2026-0484](https://insights.sbomify.com/CVE-2026-0484/): Missing Authorization check in SAP NetWeaver Application Server ABAP and SAP S/4HANA (medium 6.5) - [CVE-2026-0483](https://insights.sbomify.com/CVE-2026-0483/): Stored Cross-Site Scripting (XSS) vulnerability in LiveHelperChat (medium 6.9) - [CVE-2026-0482](https://insights.sbomify.com/CVE-2026-0482/): Memory corruption in Alveo™ Accelerator Cards (medium 5.4) - [CVE-2026-0481](https://insights.sbomify.com/CVE-2026-0481/): Misconfiguration in AMD Instinct™ MI210 (critical 9.2) - [CVE-2026-0466](https://insights.sbomify.com/CVE-2026-0466/): Missing authorization in AMD µProf (medium 6.8) - [CVE-2026-0465](https://insights.sbomify.com/CVE-2026-0465/): Use after free in AMD Ryzen™ Master (medium 5.6) - [CVE-2026-0461](https://insights.sbomify.com/CVE-2026-0461/): Memory corruption in Kria SOMs (high 7.5) - [CVE-2026-0438](https://insights.sbomify.com/CVE-2026-0438/): Privilege escalation in AMD EPYC™ 4004 Series Processors (medium 5.4) - [CVE-2026-0432](https://insights.sbomify.com/CVE-2026-0432/): Misconfiguration in AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics (high 8.5) - [CVE-2026-0428](https://insights.sbomify.com/CVE-2026-0428/): Other in AMD Instinct™ MI300A (low 1.8) - [CVE-2026-0427](https://insights.sbomify.com/CVE-2026-0427/): Information disclosure in AMD Instinct™ MI210 (medium 4.6) - [CVE-2026-0421](https://insights.sbomify.com/CVE-2026-0421/): Security feature bypass in ThinkPad L13 Gen 6 2 in 1 BIOS (high 7.0) - [CVE-2026-0420](https://insights.sbomify.com/CVE-2026-0420/): Missing TLS certificate validation in NETGEAR's ReadyCloud client app (medium 4.6) - [CVE-2026-0419](https://insights.sbomify.com/CVE-2026-0419/): Insufficient input validation vulnerability in NETGEAR JR6150 (medium 4.4) - [CVE-2026-0418](https://insights.sbomify.com/CVE-2026-0418/): Certain NETGEAR devices allow administrators to tamper with system (medium 4.3) - [CVE-2026-0417](https://insights.sbomify.com/CVE-2026-0417/): Insufficient input validation in certain NETGEAR routers (medium 4.3) - [CVE-2026-0416](https://insights.sbomify.com/CVE-2026-0416/): Improper input validation in certain NETGEAR routers allows unauthorized modification of protected router functionality (medium 4.3) - [CVE-2026-0415](https://insights.sbomify.com/CVE-2026-0415/): Insufficient input validation vulnerability in certain Orbi routers (medium 4.3) - [CVE-2026-0414](https://insights.sbomify.com/CVE-2026-0414/): Insufficient Input Validation Allows Unauthorized Modification of Router Software in certain NETGEAR Routers (medium 4.3) - [CVE-2026-0413](https://insights.sbomify.com/CVE-2026-0413/): Buffer overflow vulnerability in certain NETGEAR Nighthawk routers (medium 4.3) - [CVE-2026-0412](https://insights.sbomify.com/CVE-2026-0412/): Insufficient input validation vulnerability in NETGEAR JR6150 Web UI (medium 4.3) - [CVE-2026-0411](https://insights.sbomify.com/CVE-2026-0411/): A Sensitive Information Disclosure Vulnerability in NETGEAR Orbi Satellites (medium 4.2) - [CVE-2026-0410](https://insights.sbomify.com/CVE-2026-0410/): Insufficient input validation in certain NETGEAR routers (low 1.9) - [CVE-2026-0409](https://insights.sbomify.com/CVE-2026-0409/): Netgear Orbi 370 Series Remote Code Execution vulnerability (medium 4.8) - [CVE-2026-0408](https://insights.sbomify.com/CVE-2026-0408/): Path traversal vulnerability in Netgear WiFi Range Extenders (medium 6.1) - [CVE-2026-0407](https://insights.sbomify.com/CVE-2026-0407/): Authentication bypass in NETGEAR WiFi Range Extenders via network adjacent attacks (medium 6.1) - [CVE-2026-0406](https://insights.sbomify.com/CVE-2026-0406/): Insufficient input validation in NETGEAR Nighthawk router XR1000v2 (medium 6.1) - [CVE-2026-0405](https://insights.sbomify.com/CVE-2026-0405/): Authentication Bypass in NETGEAR Orbi Devices (medium 6.1) - [CVE-2026-0404](https://insights.sbomify.com/CVE-2026-0404/): Insufficient input validation in NETGEAR Orbi routers (medium 4.8) - [CVE-2026-0403](https://insights.sbomify.com/CVE-2026-0403/): Insufficient input validation in NETGEAR Orbi routers (low 1.1) - [CVE-2026-0402](https://insights.sbomify.com/CVE-2026-0402/): Memory corruption in SonicOS (medium 4.9) - [CVE-2026-0401](https://insights.sbomify.com/CVE-2026-0401/): Null dereference in SonicOS (medium 4.9) - [CVE-2026-0400](https://insights.sbomify.com/CVE-2026-0400/): Memory corruption in SonicOS (medium 4.9) - [CVE-2026-0399](https://insights.sbomify.com/CVE-2026-0399/): Memory corruption in SonicOS (medium 4.9) - [CVE-2026-0398](https://insights.sbomify.com/CVE-2026-0398/): Crafted zones can lead to increased resource usage and crafted CNAME chains can lead to cache poisoning in Recursor (medium 5.3) - [CVE-2026-0397](https://insights.sbomify.com/CVE-2026-0397/): Information disclosure via CORS misconfiguration (low 3.1) - [CVE-2026-0396](https://insights.sbomify.com/CVE-2026-0396/): HTML injection in the web dashboard (low 3.1) - [CVE-2026-0394](https://insights.sbomify.com/CVE-2026-0394/): Path traversal in OX Dovecot Pro (medium 5.3) - [CVE-2026-0393](https://insights.sbomify.com/CVE-2026-0393/): CODESYS Visualization - Insufficiently Protected Credentials (medium 6.9) - [CVE-2026-0392](https://insights.sbomify.com/CVE-2026-0392/): eParakstītājs 3.0 for Windows – remote code execution via unauthenticated auto-update (high 7.3) - [CVE-2026-0391](https://insights.sbomify.com/CVE-2026-0391/): Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability (medium 6.5) - [CVE-2026-0390](https://insights.sbomify.com/CVE-2026-0390/): UEFI Secure Boot Security Feature Bypass Vulnerability (medium 6.7) - [CVE-2026-0386](https://insights.sbomify.com/CVE-2026-0386/): Windows Deployment Services Remote Code Execution Vulnerability (high 7.5) - [CVE-2026-0385](https://insights.sbomify.com/CVE-2026-0385/): Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability (medium 5.0) - [CVE-2026-0383](https://insights.sbomify.com/CVE-2026-0383/): Information disclosure in Brocade Fabric OS before 9.2.1c2, 9.2.2 through 9.2.2a and 10.0.0 (high 8.2) - [CVE-2026-0322](https://insights.sbomify.com/CVE-2026-0322/): Palo Alto Networks PAN-OS Code Injection (high 8.6, exploited in the wild) - [CVE-2026-0321](https://insights.sbomify.com/CVE-2026-0321/): PAN-OS: Denial of Service (DoS) Vulnerabilities in Network Services (medium 6.6) - [CVE-2026-0320](https://insights.sbomify.com/CVE-2026-0320/): PAN-OS: Authenticated Admin Command Injection Vulnerability (medium 6.1) - [CVE-2026-0319](https://insights.sbomify.com/CVE-2026-0319/): PAN-OS: Improper Input Handling Vulnerability (medium 4.9) - [CVE-2026-0318](https://insights.sbomify.com/CVE-2026-0318/): PAN-OS: Denial of Service (DoS) on Panorama (medium 4.6) - [CVE-2026-0317](https://insights.sbomify.com/CVE-2026-0317/): PAN-OS: Denial of Service Vulnerability (low 1.2) - [CVE-2026-0316](https://insights.sbomify.com/CVE-2026-0316/): PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability (low 1.1) - [CVE-2026-0315](https://insights.sbomify.com/CVE-2026-0315/): GlobalProtect App: Local Privilege Escalation Vulnerability on macOS (medium 5.9) - [CVE-2026-0314](https://insights.sbomify.com/CVE-2026-0314/): GlobalProtect App: Local Denial of Service (DoS) on Windows (medium 4.3) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/1010/