# Vulnerabilities published in 2026


- [CVE-2026-0313](https://insights.sbomify.com/CVE-2026-0313/): Cortex XSOAR: OS Command Injection Vulnerability (medium 6.1)
- [CVE-2026-0312](https://insights.sbomify.com/CVE-2026-0312/): Checkov by Prisma Cloud: Path Traversal Vulnerabilities (medium 4.3)
- [CVE-2026-0311](https://insights.sbomify.com/CVE-2026-0311/): Checkov by Prisma Cloud: Server-Side Request Forgery Vulnerability (low 1.1)
- [CVE-2026-0310](https://insights.sbomify.com/CVE-2026-0310/): PAN-OS: Buffer Overflow Vulnerability via XML Processing (high 7.2)
- [CVE-2026-0309](https://insights.sbomify.com/CVE-2026-0309/): PAN-OS: Authenticated Command Injection in CLI with Luna HSM Configuration (medium 4.0)
- [CVE-2026-0308](https://insights.sbomify.com/CVE-2026-0308/): PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface (low 1.1)
- [CVE-2026-0307](https://insights.sbomify.com/CVE-2026-0307/): GlobalProtect App: Local Privilege Escalation Vulnerabilities (medium 5.9)
- [CVE-2026-0306](https://insights.sbomify.com/CVE-2026-0306/): Prisma Access Agent: EndPoint DLP Bypass Vulnerability on Windows (medium 5.8)
- [CVE-2026-0305](https://insights.sbomify.com/CVE-2026-0305/): Prisma Access Agent: Information Disclosure Vulnerability on Linux (medium 4.3)
- [CVE-2026-0304](https://insights.sbomify.com/CVE-2026-0304/): Cortex XDR Broker VM: Privilege Escalation Vulnerability (medium 4.8)
- [CVE-2026-0303](https://insights.sbomify.com/CVE-2026-0303/): Checkov by Prisma Cloud: Code Execution via Auto-Loaded Configuration File (low 2.4)
- [CVE-2026-0302](https://insights.sbomify.com/CVE-2026-0302/): Checkov by Prisma Cloud: OS Command Injection Vulnerability (low 1.1)
- [CVE-2026-0301](https://insights.sbomify.com/CVE-2026-0301/): PAN-OS: Information Disclosure Vulnerability in URL Filtering (low 1.7)
- [CVE-2026-0300](https://insights.sbomify.com/CVE-2026-0300/): Palo Alto Networks PAN-OS Out-of-bounds Write (critical 9.3, exploited in the wild)
- [CVE-2026-0299](https://insights.sbomify.com/CVE-2026-0299/): GlobalProtect App: Local Privilege Escalation Vulnerabilities (medium 5.9)
- [CVE-2026-0298](https://insights.sbomify.com/CVE-2026-0298/): GlobalProtect App: Code Execution Vulnerability in Windows Pre-Logon Access Provider (PLAP) (medium 5.2)
- [CVE-2026-0297](https://insights.sbomify.com/CVE-2026-0297/): GlobalProtect App: Buffer Overflow Vulnerability during UDP Tunnel Handshake (medium 5.2)
- [CVE-2026-0296](https://insights.sbomify.com/CVE-2026-0296/): GlobalProtect App: Improper Certificate Validation Bypass Vulnerability (medium 4.5)
- [CVE-2026-0295](https://insights.sbomify.com/CVE-2026-0295/): GlobalProtect App: Local Privilege Escalation via Race Condition on macOS (medium 4.1)
- [CVE-2026-0294](https://insights.sbomify.com/CVE-2026-0294/): Prisma Access Agent: Local Privilege Escalation (medium 6.0)
- [CVE-2026-0293](https://insights.sbomify.com/CVE-2026-0293/): Prisma Access Agent: Anti-Tamper Protection Bypass on Windows (medium 5.6)
- [CVE-2026-0292](https://insights.sbomify.com/CVE-2026-0292/): Prisma Access Agent: Local Security Inspection Bypass Vulnerability on Windows (low 2.1)
- [CVE-2026-0291](https://insights.sbomify.com/CVE-2026-0291/): Prisma Access Agent: Authenticated Limited File Deletion on Linux (low 1.1)
- [CVE-2026-0290](https://insights.sbomify.com/CVE-2026-0290/): Prisma Browser: Sensitive Information Disclosure Vulnerability (low 0.5)
- [CVE-2026-0289](https://insights.sbomify.com/CVE-2026-0289/): Prisma Browser: Inappropriate Implementation in Account Protection (low 0.5)
- [CVE-2026-0288](https://insights.sbomify.com/CVE-2026-0288/): PAN-OS: Buffer Overflow Vulnerabilities in User-ID Terminal Server Agent (high 7.2)
- [CVE-2026-0287](https://insights.sbomify.com/CVE-2026-0287/): PAN-OS: Denial of Service Vulnerabilities in Network Traffic Processing (medium 6.6)
- [CVE-2026-0286](https://insights.sbomify.com/CVE-2026-0286/): PAN-OS: Authenticated Command Injection in CLI (medium 6.0)
- [CVE-2026-0285](https://insights.sbomify.com/CVE-2026-0285/): PAN-OS: Server-Side Request Forgery Vulnerability in Management Web Interface (medium 4.7)
- [CVE-2026-0284](https://insights.sbomify.com/CVE-2026-0284/): PAN-OS: XML Injection Vulnerability in Large Scale VPN (LSVPN) (medium 4.7)
- [CVE-2026-0283](https://insights.sbomify.com/CVE-2026-0283/): PAN-OS: Authentication Bypass Vulnerability in Large Scale VPN (LSVPN) (medium 4.5)
- [CVE-2026-0282](https://insights.sbomify.com/CVE-2026-0282/): PAN-OS: File Deletion Vulnerability in Management Web Interface (low 2.7)
- [CVE-2026-0281](https://insights.sbomify.com/CVE-2026-0281/): PAN-OS: Information Disclosure Vulnerability in Management Web Interface (low 2.1)
- [CVE-2026-0280](https://insights.sbomify.com/CVE-2026-0280/): PAN-OS: IPv6 Firewall Policy Bypass (low 1.7)
- [CVE-2026-0279](https://insights.sbomify.com/CVE-2026-0279/): PAN-OS: Multiple Cross-Site Scripting (XSS) Vulnerabilities (low 1.3)
- [CVE-2026-0278](https://insights.sbomify.com/CVE-2026-0278/): Prisma Access Agent: Multiple DLP Policy Bypass Vulnerabilities on Windows (medium 5.8)
- [CVE-2026-0277](https://insights.sbomify.com/CVE-2026-0277/): Prisma Access Agent: Improper Certificate Validation on iOS (medium 5.7)
- [CVE-2026-0276](https://insights.sbomify.com/CVE-2026-0276/): Cortex XDR Broker VM: Privilege Escalation (PE) Vulnerability (low 1.1)
- [CVE-2026-0275](https://insights.sbomify.com/CVE-2026-0275/): Prisma Browser: Local Privilege Escalation on macOS (low 2.0)
- [CVE-2026-0274](https://insights.sbomify.com/CVE-2026-0274/): Cortex XSOAR: Improper Validation of Credentials in CommvaultSecurityIQ integration (high 8.1)
- [CVE-2026-0273](https://insights.sbomify.com/CVE-2026-0273/): PAN-OS: Authenticated Admin Command Injection Vulnerability via CLI or Web UI (medium 6.1)
- [CVE-2026-0272](https://insights.sbomify.com/CVE-2026-0272/): PAN-OS: Privilege Escalation (PE) Vulnerability in the Command Line Interface (CLI) (medium 6.0)
- [CVE-2026-0271](https://insights.sbomify.com/CVE-2026-0271/): Prisma Access Agent: Local Privilege Escalation by Authorized Users (medium 5.9)
- [CVE-2026-0270](https://insights.sbomify.com/CVE-2026-0270/): Cortex XSOAR: Path Traversal Vulnerability (medium 4.8)
- [CVE-2026-0269](https://insights.sbomify.com/CVE-2026-0269/): PAN-OS: Denial of Service (DoS) in Tunnel Traffic Processing (medium 4.6)
- [CVE-2026-0268](https://insights.sbomify.com/CVE-2026-0268/): Prisma Access Agent: Local Authenticated VPN Enforcement Bypass on Linux (medium 4.4)
- [CVE-2026-0267](https://insights.sbomify.com/CVE-2026-0267/): GlobalProtect App: Information Exposure Vulnerability on macOS (medium 4.4)
- [CVE-2026-0266](https://insights.sbomify.com/CVE-2026-0266/): PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface (low 1.1)
- [CVE-2026-0265](https://insights.sbomify.com/CVE-2026-0265/): PAN-OS: Authentication Bypass with Cloud Authentication Service (CAS) enabled (high 7.2)
- [CVE-2026-0264](https://insights.sbomify.com/CVE-2026-0264/): PAN-OS: Heap-Based Buffer Overflow in DNS Proxy and DNS Server Allows Unauthenticated Remote Code Execution (high 7.2)
- [CVE-2026-0263](https://insights.sbomify.com/CVE-2026-0263/): PAN-OS: Remote Code Execution (RCE) in IKEv2 Processing (high 7.2)
- [CVE-2026-0262](https://insights.sbomify.com/CVE-2026-0262/): PAN-OS: Denial of Service Vulnerabilities in Network Traffic Parsing (medium 6.6)
- [CVE-2026-0261](https://insights.sbomify.com/CVE-2026-0261/): PAN-OS: Authenticated Admin Command Injection Vulnerability (medium 6.1)
- [CVE-2026-0259](https://insights.sbomify.com/CVE-2026-0259/): WildFire WF-500 and WF-500-B: Arbitrary File Read and Delete Vulnerability in WildFire Appliance (WF-500, WF-500-B) (medium 5.0)
- [CVE-2026-0258](https://insights.sbomify.com/CVE-2026-0258/): PAN-OS: Server-Side Request Forgery (SSRF) in IKEv2 Certificate URL Fetching (medium 4.8)
- [CVE-2026-0257](https://insights.sbomify.com/CVE-2026-0257/): Palo Alto Networks PAN-OS Authentication Bypass (high 7.8, exploited in the wild)
- [CVE-2026-0256](https://insights.sbomify.com/CVE-2026-0256/): PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface (medium 4.4)
- [CVE-2026-0251](https://insights.sbomify.com/CVE-2026-0251/): GlobalProtect App: Local Privilege Escalation Vulnerabilities (medium 5.9)
- [CVE-2026-0250](https://insights.sbomify.com/CVE-2026-0250/): GlobalProtect App: Buffer Overflow Vulnerability during connection to Portal or Gateway (medium 5.2)
- [CVE-2026-0249](https://insights.sbomify.com/CVE-2026-0249/): GlobalProtect App: Certificate Validation Bypass Vulnerabilities (medium 4.9)
- [CVE-2026-0248](https://insights.sbomify.com/CVE-2026-0248/): Prisma Access Agent: Improper Certificate Validation Vulnerability (medium 6.2)
- [CVE-2026-0247](https://insights.sbomify.com/CVE-2026-0247/): Prisma Access Agent Endpoint DLP: Authorization Bypass Vulnerabilities (medium 5.9)
- [CVE-2026-0246](https://insights.sbomify.com/CVE-2026-0246/): Prisma Access Agent: Local Privilege Escalation Vulnerability (medium 5.9)
- [CVE-2026-0245](https://insights.sbomify.com/CVE-2026-0245/): Prisma Access Agent: Information Disclosure Vulnerabilities (medium 4.3)
- [CVE-2026-0244](https://insights.sbomify.com/CVE-2026-0244/): Prisma SD-WAN: Improper Certificate Validation Vulnerability (medium 5.2)
- [CVE-2026-0243](https://insights.sbomify.com/CVE-2026-0243/): Prisma SD-WAN: Denial of Service (DoS) Vulnerability Through IPv6 Crafted Packet (medium 4.9)
- [CVE-2026-0242](https://insights.sbomify.com/CVE-2026-0242/): Trust Protection Foundation: SQL Injection Vulnerability (medium 6.1)
- [CVE-2026-0241](https://insights.sbomify.com/CVE-2026-0241/): Trust Protection Foundation: Multiple Authorization Bypass Vulnerabilities (medium 5.1)
- [CVE-2026-0240](https://insights.sbomify.com/CVE-2026-0240/): Trust Protection Foundation: Sensitive Information Disclosure Vulnerability (medium 4.5)
- [CVE-2026-0239](https://insights.sbomify.com/CVE-2026-0239/): Chronosphere Chronocollector Information Disclosure Vulnerability (medium 4.9)
- [CVE-2026-0238](https://insights.sbomify.com/CVE-2026-0238/): Broker VM: Improper Input Validation in Broker VM Certificate and Key Fields (low 1.1)
- [CVE-2026-0237](https://insights.sbomify.com/CVE-2026-0237/): Prisma Browser: Improperly Restricted Automation Bridge Allows Security Bypass (high 7.3)
- [CVE-2026-0236](https://insights.sbomify.com/CVE-2026-0236/): Prisma Browser: Code Injection Enables Security Controls Bypass (high 7.3)
- [CVE-2026-0235](https://insights.sbomify.com/CVE-2026-0235/): Prisma Browser: Access and Data Rule Bypass (medium 5.8)
- [CVE-2026-0234](https://insights.sbomify.com/CVE-2026-0234/): Cortex XSOAR: Improper Verification of Cryptographic Signature in Microsoft Teams integration (high 7.2)
- [CVE-2026-0233](https://insights.sbomify.com/CVE-2026-0233/): Autonomous Digital Experience Manager: Improper validation of ADEM certificate (low 2.0)
- [CVE-2026-0232](https://insights.sbomify.com/CVE-2026-0232/): Cortex XDR Agent: Local Administrator can disable the agent on Windows (medium 4.0)
- [CVE-2026-0231](https://insights.sbomify.com/CVE-2026-0231/): Cortex XDR Broker VM: Sensitive Information Disclosure Vulnerability (medium 5.7)
- [CVE-2026-0230](https://insights.sbomify.com/CVE-2026-0230/): Cortex XDR Agent: Local Administrator can disable the agent on macOS (medium 4.0)
- [CVE-2026-0229](https://insights.sbomify.com/CVE-2026-0229/): PAN-OS: Denial of Service in Advanced DNS Security Feature (medium 6.6)
- [CVE-2026-0228](https://insights.sbomify.com/CVE-2026-0228/): PAN-OS: Improper Validation of Terminal Server Agent Certificate (low 1.3)
- [CVE-2026-0227](https://insights.sbomify.com/CVE-2026-0227/): PAN-OS: Firewall Denial of Service (DoS) in GlobalProtect Gateway and Portal (medium 6.6)
- [CVE-2026-0209](https://insights.sbomify.com/CVE-2026-0209/): Business logic in FlashArray (medium 6.9)
- [CVE-2026-0207](https://insights.sbomify.com/CVE-2026-0207/): Sensitive Information Logging Vulnerability in FlashBlade (high 8.5)
- [CVE-2026-0206](https://insights.sbomify.com/CVE-2026-0206/): Memory corruption in SonicOS (medium 4.9)
- [CVE-2026-0205](https://insights.sbomify.com/CVE-2026-0205/): Path traversal in SonicOS (medium 6.8)
- [CVE-2026-0204](https://insights.sbomify.com/CVE-2026-0204/): Auth bypass in SonicOS (high 8.0)
- [CVE-2026-0203](https://insights.sbomify.com/CVE-2026-0203/): Junos OS: Receipt of a specifically malformed ICMP packet causes an FPC restart (high 7.1)
- [CVE-2026-0200](https://insights.sbomify.com/CVE-2026-0200/): Memory corruption in Android (high 8.8)
- [CVE-2026-0199](https://insights.sbomify.com/CVE-2026-0199/): Memory corruption in Android (high 7.8)
- [CVE-2026-0198](https://insights.sbomify.com/CVE-2026-0198/): Missing authorization in Android (medium 4.4)
- [CVE-2026-0197](https://insights.sbomify.com/CVE-2026-0197/): Information disclosure in Android (medium 4.4)
- [CVE-2026-0194](https://insights.sbomify.com/CVE-2026-0194/): Integer overflow in Android (high 8.4)
- [CVE-2026-0192](https://insights.sbomify.com/CVE-2026-0192/): Missing authorization in Android (medium 6.7)
- [CVE-2026-0189](https://insights.sbomify.com/CVE-2026-0189/): Privilege escalation in Android (high 8.4)
- [CVE-2026-0187](https://insights.sbomify.com/CVE-2026-0187/): Privilege escalation in Android (medium 6.7)
- [CVE-2026-0186](https://insights.sbomify.com/CVE-2026-0186/): Privilege escalation in Android (medium 6.7)
- [CVE-2026-0183](https://insights.sbomify.com/CVE-2026-0183/): Information disclosure in Android (medium 4.4)
- [CVE-2026-0179](https://insights.sbomify.com/CVE-2026-0179/): Missing authorization in Android (medium 6.7)
- [CVE-2026-0177](https://insights.sbomify.com/CVE-2026-0177/): Memory corruption in Android (medium 4.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/1011/