# Vulnerabilities published in 2026 - [CVE-2026-97926](https://insights.sbomify.com/CVE-2026-97926/): ufs: validate cylinder group metadata before caching it (high 7.0) - [CVE-2026-97925](https://insights.sbomify.com/CVE-2026-97925/): tick/broadcast: Plug clockevents replacement race (not scored) - [CVE-2026-97924](https://insights.sbomify.com/CVE-2026-97924/): tracing/user_events: Don't destroy fields when event removal fails (not scored) - [CVE-2026-97923](https://insights.sbomify.com/CVE-2026-97923/): tracing: Free histogram the var ref when its initialization fails (not scored) - [CVE-2026-97922](https://insights.sbomify.com/CVE-2026-97922/): tracing: Free histogram var refs regardless of how often they are referenced (not scored) - [CVE-2026-97921](https://insights.sbomify.com/CVE-2026-97921/): tracing: Free histogram the field rejected for a bad modifier (not scored) - [CVE-2026-97920](https://insights.sbomify.com/CVE-2026-97920/): tracing: Keep the entry count when the histogram stats allocation fails (not scored) - [CVE-2026-9792](https://insights.sbomify.com/CVE-2026-9792/): Keycloak: keycloak: security restriction bypass allows unauthorized ropc token acquisition (medium 6.5) - [CVE-2026-97919](https://insights.sbomify.com/CVE-2026-97919/): tracing: Take the reference before publishing the named histogram trigger (not scored) - [CVE-2026-97918](https://insights.sbomify.com/CVE-2026-97918/): tracing: Undo the registration when enabling the histogram trigger fails (not scored) - [CVE-2026-97917](https://insights.sbomify.com/CVE-2026-97917/): accel/ivpu: Validate full buffer range in ivpu_to_cpu_addr (not scored) - [CVE-2026-97916](https://insights.sbomify.com/CVE-2026-97916/): accel/ivpu: Validate firmware log buffer metadata (not scored) - [CVE-2026-97915](https://insights.sbomify.com/CVE-2026-97915/): accel/ivpu: Limit firmware log name prints to field size (not scored) - [CVE-2026-97914](https://insights.sbomify.com/CVE-2026-97914/): accel: ethosu: Fix ethosu_job_open() return value (not scored) - [CVE-2026-97913](https://insights.sbomify.com/CVE-2026-97913/): accel: ethosu: Ensure cmd stream ends with a stop op (not scored) - [CVE-2026-97912](https://insights.sbomify.com/CVE-2026-97912/): accel: ethosu: Ensure SRAM size is 0 on mapping failure (not scored) - [CVE-2026-97911](https://insights.sbomify.com/CVE-2026-97911/): accel: ethosu: Ensure SRAM region size matches job (high 7.8) - [CVE-2026-97910](https://insights.sbomify.com/CVE-2026-97910/): ASoC: sprd: validate compress buffer sizes against fixed allocations (high 7.8) - [CVE-2026-9791](https://insights.sbomify.com/CVE-2026-9791/): Keycloak-rhel9: organization data leak after feature disabled in keycloak (medium 4.3) - [CVE-2026-97909](https://insights.sbomify.com/CVE-2026-97909/): ASoC: sti: initialize IRQ lock before requesting IRQ (not scored) - [CVE-2026-97908](https://insights.sbomify.com/CVE-2026-97908/): Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev (not scored) - [CVE-2026-97907](https://insights.sbomify.com/CVE-2026-97907/): Bluetooth: btrtl: Don't leak return code when parsing firmware format v2 (not scored) - [CVE-2026-97906](https://insights.sbomify.com/CVE-2026-97906/): bootconfig: Fix integer overflow in initrd size check (not scored) - [CVE-2026-97905](https://insights.sbomify.com/CVE-2026-97905/): cpufreq: zero-initialize policy cpumask before sysfs publication (not scored) - [CVE-2026-97904](https://insights.sbomify.com/CVE-2026-97904/): cpufreq: initialize policy rwsem before sysfs publication (not scored) - [CVE-2026-97903](https://insights.sbomify.com/CVE-2026-97903/): exit: hold a reference to thread_pid across proc_flush_pid (high 7.8) - [CVE-2026-97902](https://insights.sbomify.com/CVE-2026-97902/): fs: don't return -EINVAL for successful nested thaw (not scored) - [CVE-2026-97901](https://insights.sbomify.com/CVE-2026-97901/): genetlink: pin family module during policy dump (not scored) - [CVE-2026-97900](https://insights.sbomify.com/CVE-2026-97900/): drm/drm_exec: fix up contended obj when num_objects is 0 (not scored) - [CVE-2026-97899](https://insights.sbomify.com/CVE-2026-97899/): drm/i915: Fix memory leak in query_perf_config_list() (not scored) - [CVE-2026-97898](https://insights.sbomify.com/CVE-2026-97898/): Broken authorization in Akia keyless entry lets an authenticated guest unlock other rooms (high 8.4) - [CVE-2026-97897](https://insights.sbomify.com/CVE-2026-97897/): Krayin laravel-crm TinyMCE Media Upload Sanitizer.php cross site scripting (medium 5.1) - [CVE-2026-97896](https://insights.sbomify.com/CVE-2026-97896/): krayin laravel-crm Upload Functionality ConfigurationForm.php rules cross site scripting (medium 5.1) - [CVE-2026-97895](https://insights.sbomify.com/CVE-2026-97895/): krayin laravel-crm User Management UserController.php privileges management (medium 5.3) - [CVE-2026-9789](https://insights.sbomify.com/CVE-2026-9789/): NitroSense V3: Security Vulnerability Information (high 8.5) - [CVE-2026-97886](https://insights.sbomify.com/CVE-2026-97886/): mathurvishal CloudClassroom-PHP-Project managevideos2.php sql injection (medium 5.3) - [CVE-2026-97885](https://insights.sbomify.com/CVE-2026-97885/): mathurvishal CloudClassroom-PHP-Project updatefaculty.php sql injection (medium 6.9) - [CVE-2026-97884](https://insights.sbomify.com/CVE-2026-97884/): mathurvishal CloudClassroom-PHP-Project Student Update Functionality updatestudent.php sql injection (medium 5.3) - [CVE-2026-97883](https://insights.sbomify.com/CVE-2026-97883/): mathurvishal CloudClassroom-PHP-Project updatequery.php sql injection (medium 6.9) - [CVE-2026-97882](https://insights.sbomify.com/CVE-2026-97882/): mathurvishal CloudClassroom-PHP-Project Faculty Authentication loginlinkfaculty.php sql injection (medium 6.9) - [CVE-2026-97879](https://insights.sbomify.com/CVE-2026-97879/): zhistaredu StarTraining api-docs Endpoint SecurityConfig.java missing authentication (medium 6.9) - [CVE-2026-97878](https://insights.sbomify.com/CVE-2026-97878/): zhistaredu StarTraining Druid Console index.html anonymous missing authentication (medium 6.9) - [CVE-2026-97877](https://insights.sbomify.com/CVE-2026-97877/): zhistaredu StarTraining JWT Token application.yml UserLoginService.createToken hard-coded password (medium 6.9) - [CVE-2026-97876](https://insights.sbomify.com/CVE-2026-97876/): Bypass of GRUB lockdown restriction in Secure Boot mode via serial command MMIO base address (medium 6.4) - [CVE-2026-97875](https://insights.sbomify.com/CVE-2026-97875/): DNS rebinding vulnerability in rojo serve HTTP API (high 8.1) - [CVE-2026-97873](https://insights.sbomify.com/CVE-2026-97873/): Legacy PBES1 and PKCS#12 PBE iteration count honoured unbounded in the raw JCA provider (medium 5.3) - [CVE-2026-97871](https://insights.sbomify.com/CVE-2026-97871/): Zhonglun CloudPos JSBridge JSBridge.cs OpenLocalBrowser code injection (medium 6.9) - [CVE-2026-9787](https://insights.sbomify.com/CVE-2026-9787/): Quest NetVault Backup NVBULogDaemon Command Injection Remote Code Execution Vulnerability (high 8.8) - [CVE-2026-97869](https://insights.sbomify.com/CVE-2026-97869/): langchain4j LangChain4j-agentic AgenticScopeJsonSerializationIT.java AgenticScopeSerializer.fromJson deserialization (low 2.1) - [CVE-2026-97868](https://insights.sbomify.com/CVE-2026-97868/): sheshbabu zen Note Editor NotesEditor.jsx dangerouslySetInnerHTML cross site scripting (medium 5.1) - [CVE-2026-97866](https://insights.sbomify.com/CVE-2026-97866/): Zhonglun CloudPOS Automatic Update Program.cs channel accessible (medium 6.3) - [CVE-2026-97865](https://insights.sbomify.com/CVE-2026-97865/): Open-Web-Analytics Remote Event Queue Endpoint queue.php loadFromArray deserialization (medium 6.9) - [CVE-2026-97864](https://insights.sbomify.com/CVE-2026-97864/): GibbonEdu Gibbon Unit Planner units_add_blockAjax.php makeBlock missing authentication (medium 6.9) - [CVE-2026-97863](https://insights.sbomify.com/CVE-2026-97863/): Command injection in misp-modules (medium 6.3) - [CVE-2026-97860](https://insights.sbomify.com/CVE-2026-97860/): Privilege escalation in YMS-VPN8 (high 8.4) - [CVE-2026-9786](https://insights.sbomify.com/CVE-2026-9786/): Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability (high 8.8) - [CVE-2026-97859](https://insights.sbomify.com/CVE-2026-97859/): Gitea API disclosure of private user social graph, keys and stars (medium 6.5) - [CVE-2026-97858](https://insights.sbomify.com/CVE-2026-97858/): Guangzhou Juan IoT Technology EseeCloud Improperly Controlled Modification of Dynamically-Determined Object Attributes (medium 6.9) - [CVE-2026-97854](https://insights.sbomify.com/CVE-2026-97854/): Command injection in NWR100 (critical 9.3) - [CVE-2026-97853](https://insights.sbomify.com/CVE-2026-97853/): Unbounded allocation in decimal Decimal.round/3 driven by the places argument enables DoS (medium 6.9) - [CVE-2026-97851](https://insights.sbomify.com/CVE-2026-97851/): J4Care dcm4che Missing Authorization (high 8.8) - [CVE-2026-9785](https://insights.sbomify.com/CVE-2026-9785/): Quest NetVault Backup NVBULibrarySlot SQL Injection Remote Code Execution Vulnerability (high 8.8) - [CVE-2026-97846](https://insights.sbomify.com/CVE-2026-97846/): Keycloak-services: keycloak-services: standard token exchange v2 bypasses mtls holder-of-key binding (medium 6.8) - [CVE-2026-97844](https://insights.sbomify.com/CVE-2026-97844/): Role: DNS Server Information Disclosure Vulnerability (medium 6.5) - [CVE-2026-97843](https://insights.sbomify.com/CVE-2026-97843/): Role: DNS Server Information Disclosure Vulnerability (medium 6.5) - [CVE-2026-97842](https://insights.sbomify.com/CVE-2026-97842/): Role: DNS Server Information Disclosure Vulnerability (medium 6.5) - [CVE-2026-97841](https://insights.sbomify.com/CVE-2026-97841/): Role: DNS Server Information Disclosure Vulnerability (medium 6.5) - [CVE-2026-97840](https://insights.sbomify.com/CVE-2026-97840/): Role: DNS Server Information Disclosure Vulnerability (medium 6.5) - [CVE-2026-9784](https://insights.sbomify.com/CVE-2026-9784/): Quest NetVault Backup NVBULibraryPort SQL Injection Remote Code Execution Vulnerability (high 8.8) - [CVE-2026-97839](https://insights.sbomify.com/CVE-2026-97839/): Role: DNS Server Information Disclosure Vulnerability (medium 6.5) - [CVE-2026-97838](https://insights.sbomify.com/CVE-2026-97838/): Role: DNS Server Information Disclosure Vulnerability (medium 6.5) - [CVE-2026-97837](https://insights.sbomify.com/CVE-2026-97837/): Role: DNS Server Information Disclosure Vulnerability (medium 6.5) - [CVE-2026-97836](https://insights.sbomify.com/CVE-2026-97836/): Role: DNS Server Information Disclosure Vulnerability (medium 6.5) - [CVE-2026-97835](https://insights.sbomify.com/CVE-2026-97835/): Role: DNS Server Information Disclosure Vulnerability (medium 6.5) - [CVE-2026-97834](https://insights.sbomify.com/CVE-2026-97834/): Role: DNS Server Information Disclosure Vulnerability (medium 6.5) - [CVE-2026-97833](https://insights.sbomify.com/CVE-2026-97833/): Role: DNS Server Information Disclosure Vulnerability (medium 6.5) - [CVE-2026-97832](https://insights.sbomify.com/CVE-2026-97832/): Role: DNS Server Information Disclosure Vulnerability (medium 6.5) - [CVE-2026-97831](https://insights.sbomify.com/CVE-2026-97831/): Role: DNS Server Information Disclosure Vulnerability (medium 6.5) - [CVE-2026-97830](https://insights.sbomify.com/CVE-2026-97830/): Windows Internet Information Services Denial of Service Vulnerability (high 7.5) - [CVE-2026-9783](https://insights.sbomify.com/CVE-2026-9783/): Quest NetVault Backup NVBURemovableMedia SQL Injection Remote Code Execution Vulnerability (high 8.8) - [CVE-2026-97829](https://insights.sbomify.com/CVE-2026-97829/): Role: DNS Server Information Disclosure Vulnerability (medium 6.5) - [CVE-2026-97828](https://insights.sbomify.com/CVE-2026-97828/): Role: DNS Server Information Disclosure Vulnerability (medium 6.5) - [CVE-2026-97827](https://insights.sbomify.com/CVE-2026-97827/): Role: DNS Server Information Disclosure Vulnerability (medium 6.5) - [CVE-2026-97826](https://insights.sbomify.com/CVE-2026-97826/): Role: DNS Server Information Disclosure Vulnerability (medium 6.5) - [CVE-2026-97825](https://insights.sbomify.com/CVE-2026-97825/): Role: DNS Server Information Disclosure Vulnerability (medium 6.5) - [CVE-2026-97824](https://insights.sbomify.com/CVE-2026-97824/): Role: DNS Server Information Disclosure Vulnerability (medium 6.5) - [CVE-2026-97823](https://insights.sbomify.com/CVE-2026-97823/): Role: DNS Server Information Disclosure Vulnerability (medium 6.5) - [CVE-2026-97822](https://insights.sbomify.com/CVE-2026-97822/): Role: DNS Server Information Disclosure Vulnerability (medium 6.5) - [CVE-2026-97821](https://insights.sbomify.com/CVE-2026-97821/): Role: DNS Server Information Disclosure Vulnerability (medium 6.5) - [CVE-2026-97820](https://insights.sbomify.com/CVE-2026-97820/): Role: DNS Server Information Disclosure Vulnerability (medium 6.5) - [CVE-2026-9782](https://insights.sbomify.com/CVE-2026-9782/): Quest NetVault Backup NVBUDeviceDrive SQL Injection Remote Code Execution Vulnerability (high 8.8) - [CVE-2026-97819](https://insights.sbomify.com/CVE-2026-97819/): Role: DNS Server Information Disclosure Vulnerability (medium 6.5) - [CVE-2026-97818](https://insights.sbomify.com/CVE-2026-97818/): Missing authorization in phpIPAM (high 8.6) - [CVE-2026-97817](https://insights.sbomify.com/CVE-2026-97817/): Role: DNS Server Information Disclosure Vulnerability (medium 6.5) - [CVE-2026-97816](https://insights.sbomify.com/CVE-2026-97816/): Microsoft OpenSSH for Windows Remote Code Execution Vulnerability (critical 9.8) - [CVE-2026-97815](https://insights.sbomify.com/CVE-2026-97815/): Windows Error Reporting Remote Code Execution Vulnerability (critical 9.8) - [CVE-2026-97814](https://insights.sbomify.com/CVE-2026-97814/): Windows Text Shaping Remote Code Execution Vulnerability (critical 9.8) - [CVE-2026-97813](https://insights.sbomify.com/CVE-2026-97813/): Windows Hyper-V Information Disclosure Vulnerability (medium 6.5) - [CVE-2026-97812](https://insights.sbomify.com/CVE-2026-97812/): Windows Update Orchestrator Service Elevation of Privilege Vulnerability (high 7.0) - [CVE-2026-97811](https://insights.sbomify.com/CVE-2026-97811/): Microsoft OpenSSH for Windows Elevation of Privilege Vulnerability (high 7.8) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/214/