# Vulnerabilities published in 2026


- [CVE-2026-93684](https://insights.sbomify.com/CVE-2026-93684/): Apache Impala: Stored XSS in Impala query plans (medium 5.4)
- [CVE-2026-93683](https://insights.sbomify.com/CVE-2026-93683/): Dpdk: dpdk: guest-triggered out-of-bounds walk via vhost indirect descriptor length toctou (medium 6.4)
- [CVE-2026-93682](https://insights.sbomify.com/CVE-2026-93682/): Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header (medium 5.8)
- [CVE-2026-93681](https://insights.sbomify.com/CVE-2026-93681/): Tutor LMS <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name Parameter (medium 6.4)
- [CVE-2026-93680](https://insights.sbomify.com/CVE-2026-93680/): Langflow OSS is affected by multiple vulnerabilities (critical 9.8)
- [CVE-2026-9368](https://insights.sbomify.com/CVE-2026-9368/): NousResearch hermes-agent Environment Variable code_execution_tool.py execute_code sandbox (medium 6.9)
- [CVE-2026-93679](https://insights.sbomify.com/CVE-2026-93679/): Langflow OSS is affected by multiple vulnerabilities (medium 4.3)
- [CVE-2026-93678](https://insights.sbomify.com/CVE-2026-93678/): Langflow OSS is affected by multiple vulnerabilities (high 7.6)
- [CVE-2026-93677](https://insights.sbomify.com/CVE-2026-93677/): Langflow OSS is affected by multiple vulnerabilities (high 7.7)
- [CVE-2026-93676](https://insights.sbomify.com/CVE-2026-93676/): Xdg-dbus-proxy: xdg-dbus-proxy: filtering for broadcast messages bypasses path/interface/member checks (low 3.2)
- [CVE-2026-93675](https://insights.sbomify.com/CVE-2026-93675/): Langflow OSS is affected by multiple vulnerabilities (high 8.8)
- [CVE-2026-93674](https://insights.sbomify.com/CVE-2026-93674/): Langflow OSS is affected by multiple vulnerabilities (critical 9.8)
- [CVE-2026-9367](https://insights.sbomify.com/CVE-2026-9367/): NousResearch hermes-agent terminal_tool approval.py detect_dangerous_command os command injection (medium 6.9)
- [CVE-2026-93662](https://insights.sbomify.com/CVE-2026-93662/): Events Manager 7.4.1 - 7.4.4 - Subscriber+ Unpublished Event and Location Disclosure via 'owner' Parameter (medium 4.3)
- [CVE-2026-93661](https://insights.sbomify.com/CVE-2026-93661/): Events Manager < 7.4.5 - Contributor+ Arbitrary Ticket Overwrite via IDOR (low 2.7)
- [CVE-2026-93660](https://insights.sbomify.com/CVE-2026-93660/): SQLBot through 1.10.1 Improper Access Control via Dashboard Update (high 7.1)
- [CVE-2026-9366](https://insights.sbomify.com/CVE-2026-9366/): NousResearch hermes-agent prompt_builder.py _scan_context_content injection (medium 6.9)
- [CVE-2026-93659](https://insights.sbomify.com/CVE-2026-93659/): Concrete CMS Community Store before 2.7.8 Stored XSS (high 8.6)
- [CVE-2026-93658](https://insights.sbomify.com/CVE-2026-93658/): uutils coreutils 0.0.18 before 0.10.0 Privilege Escalation via setuid (high 7.3)
- [CVE-2026-93657](https://insights.sbomify.com/CVE-2026-93657/): hickory-resolver before 0.26.2 DNSSEC Validation Bypass (high 8.7)
- [CVE-2026-93656](https://insights.sbomify.com/CVE-2026-93656/): User Profile Builder <= 4.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Field (medium 6.4)
- [CVE-2026-93655](https://insights.sbomify.com/CVE-2026-93655/): Booking Calendar <= 11.8.3 - Reflected Cross-Site Scripting via 'wpbc_auto_fill' Parameter (medium 6.1)
- [CVE-2026-93654](https://insights.sbomify.com/CVE-2026-93654/): Premium Packages <= 7.2.1 - Unauthenticated Stored Cross-Site Scripting via 'cart_items[][product_name]' Parameter (high 7.2)
- [CVE-2026-93653](https://insights.sbomify.com/CVE-2026-93653/): Denial of service in Red Hat Enterprise Linux 10 (medium 5.5)
- [CVE-2026-93652](https://insights.sbomify.com/CVE-2026-93652/): Integer Overflow or Wraparound in µD3TN (high 7.5)
- [CVE-2026-93651](https://insights.sbomify.com/CVE-2026-93651/): WordPress Minimum and Maximum Quantity for WooCommerce plugin <= 2.1.2 - PHP Object Injection vulnerability (high 7.2)
- [CVE-2026-93650](https://insights.sbomify.com/CVE-2026-93650/): Saleor throttling.py get_client_ip excessive authentication (medium 6.3)
- [CVE-2026-9365](https://insights.sbomify.com/CVE-2026-9365/): Ettercap GG Dissector ec_gg.c FUNC_DECODER heap-based overflow (medium 6.3)
- [CVE-2026-93649](https://insights.sbomify.com/CVE-2026-93649/): Open redirect in Adoptium Temurin (high 7.5)
- [CVE-2026-93647](https://insights.sbomify.com/CVE-2026-93647/): Cross-site scripting in Zimbra Collaboration Suite (ZCS) (critical 9.3)
- [CVE-2026-93643](https://insights.sbomify.com/CVE-2026-93643/): Path traversal in Zimbra Collaboration Suite (ZCS) (critical 9.8)
- [CVE-2026-93642](https://insights.sbomify.com/CVE-2026-93642/): Zimbra Collaboration Suite Modern Web Client Stored Cross-Site Scripting via Forged Share Invitation (critical 9.3)
- [CVE-2026-93641](https://insights.sbomify.com/CVE-2026-93641/): Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Forged Share Invitation (critical 9.3)
- [CVE-2026-93640](https://insights.sbomify.com/CVE-2026-93640/): Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted zmunbound Sudo Configuration (high 7.8)
- [CVE-2026-9364](https://insights.sbomify.com/CVE-2026-9364/): projectworlds Online Art Gallery Shop adminHome.php sql injection (medium 6.9)
- [CVE-2026-93639](https://insights.sbomify.com/CVE-2026-93639/): Missing authorization in Zimbra Collaboration Suite (high 8.7)
- [CVE-2026-93638](https://insights.sbomify.com/CVE-2026-93638/): Zimbra Collaboration Suite Pre-Authentication Reflected Cross-Site Scripting via Login Page zrememberme Parameter (medium 6.1)
- [CVE-2026-93637](https://insights.sbomify.com/CVE-2026-93637/): Zimbra Collaboration Suite GraphQL Batched Authentication Bypasses Pre-Auth Rate Limiting (low 3.7)
- [CVE-2026-93636](https://insights.sbomify.com/CVE-2026-93636/): Zimbra Collaboration Suite LDAP Filter Injection via Calendar Resource Attribute Name (medium 4.3)
- [CVE-2026-93635](https://insights.sbomify.com/CVE-2026-93635/): Zimbra Collaboration Suite LDAP Filter Injection via Unescaped computeDn() Template Substitution (medium 5.3)
- [CVE-2026-93634](https://insights.sbomify.com/CVE-2026-93634/): Zimbra Collaboration Suite Cross-Account Authorization Bypass via Forged Shared-File Records (medium 4.3)
- [CVE-2026-93633](https://insights.sbomify.com/CVE-2026-93633/): Zimbra Collaboration Suite Briefcase CSS Sanitization Bypass via Non-ASCII Stylesheet Characters (medium 5.4)
- [CVE-2026-93631](https://insights.sbomify.com/CVE-2026-93631/): Zimbra Collaboration Suite OAuth Extension Cross-Site Request Forgery Enables Account Linking (high 7.1)
- [CVE-2026-93630](https://insights.sbomify.com/CVE-2026-93630/): Zimbra Collaboration Suite Email HTML Sanitizer Bypass via Hostname Canonicalization (medium 4.3)
- [CVE-2026-9363](https://insights.sbomify.com/CVE-2026-9363/): Edimax EW-7438RPn POST Request formEZCHNwlanSetu formEZCHNwlanSetup command injection (medium 5.3)
- [CVE-2026-93629](https://insights.sbomify.com/CVE-2026-93629/): Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REQUEST Organizer Identity (medium 5.3)
- [CVE-2026-93628](https://insights.sbomify.com/CVE-2026-93628/): Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REPLY Attendee Response (medium 5.3)
- [CVE-2026-93627](https://insights.sbomify.com/CVE-2026-93627/): Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar CANCEL/REQUEST Organizer (medium 5.3)
- [CVE-2026-93624](https://insights.sbomify.com/CVE-2026-93624/): WordPress Music Player for WooCommerce plugin <= 1.9.1 - PHP Object Injection vulnerability (high 7.2)
- [CVE-2026-93623](https://insights.sbomify.com/CVE-2026-93623/): WordPress AI Engine plugin <= 3.7.8 - Insecure Direct Object References (IDOR) vulnerability (medium 5.3)
- [CVE-2026-93622](https://insights.sbomify.com/CVE-2026-93622/): WordPress WPS Limit Login plugin <= 1.5.9.3 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-93621](https://insights.sbomify.com/CVE-2026-93621/): WordPress WP Data Access plugin <= 5.5.84 - SQL Injection vulnerability (high 8.2)
- [CVE-2026-93620](https://insights.sbomify.com/CVE-2026-93620/): WordPress PayPlus Payment Gateway plugin <= 8.2.5 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-9362](https://insights.sbomify.com/CVE-2026-9362/): Edimax EW-7438RPn Setting formConnectionSetting command injection (medium 5.3)
- [CVE-2026-93618](https://insights.sbomify.com/CVE-2026-93618/): WordPress JetTricks plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-93617](https://insights.sbomify.com/CVE-2026-93617/): WordPress Sunshine Photo Cart plugin <= 3.7.1 - PHP Object Injection vulnerability (high 7.2)
- [CVE-2026-93616](https://insights.sbomify.com/CVE-2026-93616/): Check Point Multiple Products Path Traversal (critical 9.8, exploited in the wild)
- [CVE-2026-9361](https://insights.sbomify.com/CVE-2026-9361/): Edimax EW-7438RPn POST Request formAccep formAccept command injection (medium 5.3)
- [CVE-2026-93606](https://insights.sbomify.com/CVE-2026-93606/): vm2 before 3.12.1 Sandbox Escape via Promise Symbol.species (critical 10.0)
- [CVE-2026-93605](https://insights.sbomify.com/CVE-2026-93605/): vm2 NodeVM before 3.12.1 Remote Code Execution via child_process (critical 10.0)
- [CVE-2026-93604](https://insights.sbomify.com/CVE-2026-93604/): vm2 3.11.8 Sandbox Escape via crypto.setFips (medium 6.9)
- [CVE-2026-93603](https://insights.sbomify.com/CVE-2026-93603/): vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Function (critical 10.0)
- [CVE-2026-93602](https://insights.sbomify.com/CVE-2026-93602/): rustls-webpki before 0.103.10 CRL Revocation Check Bypass (medium 5.9)
- [CVE-2026-93601](https://insights.sbomify.com/CVE-2026-93601/): rustls webpki 0.101.0 before 0.103.12 Name Constraint Bypass (low 2.1)
- [CVE-2026-93600](https://insights.sbomify.com/CVE-2026-93600/): rustls webpki Name Constraints URI Validation Bypass (low 2.1)
- [CVE-2026-9360](https://insights.sbomify.com/CVE-2026-9360/): Edimax EW-7438RPn POST Request formwlencrypt24g buffer overflow (high 8.7)
- [CVE-2026-93599](https://insights.sbomify.com/CVE-2026-93599/): rustls-webpki before 0.103.13 Panic via empty BIT STRING (high 8.7)
- [CVE-2026-93598](https://insights.sbomify.com/CVE-2026-93598/): ArcadeDB before 26.9.1 Classpath Credential Disclosure via ResourceBundle (high 7.1)
- [CVE-2026-93597](https://insights.sbomify.com/CVE-2026-93597/): ArcadeDB before 26.9.1 SSRF via IPv6 transition addresses (medium 5.3)
- [CVE-2026-93596](https://insights.sbomify.com/CVE-2026-93596/): ArcadeDB before 26.9.1 Authorization Bypass via Batch Edge Connect (medium 5.3)
- [CVE-2026-93595](https://insights.sbomify.com/CVE-2026-93595/): ArcadeDB before 26.9.1 ACL Bypass via query_database Tool (high 7.1)
- [CVE-2026-93594](https://insights.sbomify.com/CVE-2026-93594/): ArcadeDB before 26.9.1 ACL Bypass via Index and TimeSeries (high 7.1)
- [CVE-2026-93593](https://insights.sbomify.com/CVE-2026-93593/): ArcadeDB before 26.9.1 TimeSeries ACL Bypass via Type Permission (high 8.6)
- [CVE-2026-93592](https://insights.sbomify.com/CVE-2026-93592/): vLLM before 0.28.0 Denial of Service via negative token ID (high 8.7)
- [CVE-2026-93591](https://insights.sbomify.com/CVE-2026-93591/): SiYuan before 3.8.3 SQL Injection via unescaped tag in graph.go (high 7.2)
- [CVE-2026-93590](https://insights.sbomify.com/CVE-2026-93590/): ImageMagick before 7.1.2-31 Policy Bypass in UHDR encoder (medium 6.3)
- [CVE-2026-9359](https://insights.sbomify.com/CVE-2026-9359/): Edimax EW-7438RPn POST Request formHwSet command injection (medium 5.3)
- [CVE-2026-93589](https://insights.sbomify.com/CVE-2026-93589/): ImageMagick before 7.1.2-31 Division by Zero in FLIF encoder (medium 6.3)
- [CVE-2026-93588](https://insights.sbomify.com/CVE-2026-93588/): ImageMagick before 7.1.2-31 Null Pointer Dereference via PNM (low 2.3)
- [CVE-2026-93587](https://insights.sbomify.com/CVE-2026-93587/): ImageMagick before 7.1.2-31 Policy Bypass via PCD decoder (medium 4.8)
- [CVE-2026-93586](https://insights.sbomify.com/CVE-2026-93586/): ImageMagick before 7.1.2-31 Use After Free via ImagesToBlob (low 2.1)
- [CVE-2026-93582](https://insights.sbomify.com/CVE-2026-93582/): Authentication Bypass via Spoofed Remote-User Header in HTTP Basic Authentication (critical 9.4)
- [CVE-2026-93581](https://insights.sbomify.com/CVE-2026-93581/): Insufficient Neutralization of Formula Elements in CSV Exports (medium 6.1)
- [CVE-2026-93580](https://insights.sbomify.com/CVE-2026-93580/): InPost for WooCommerce 1.7.5 - 1.9.7 - Unauthenticated Order Status Forgery via Shipment Webhook (medium 5.3)
- [CVE-2026-9358](https://insights.sbomify.com/CVE-2026-9358/): postcss-selector-parser AST Serialization container.js toString recursion (medium 5.3)
- [CVE-2026-93579](https://insights.sbomify.com/CVE-2026-93579/): Io.netty/netty-codec-http2: netty: http/2 header field values are not validated by default (cr/lf/nul passthrough) (medium 6.5)
- [CVE-2026-93578](https://insights.sbomify.com/CVE-2026-93578/): Security feature bypass in Red Hat build of Apache Camel for Spring Boot 4 (medium 5.9)
- [CVE-2026-93577](https://insights.sbomify.com/CVE-2026-93577/): Integer Overflow or Wraparound in GitLab (critical 9.9)
- [CVE-2026-93576](https://insights.sbomify.com/CVE-2026-93576/): Other in Red Hat Fuse 7 (high 7.5)
- [CVE-2026-93575](https://insights.sbomify.com/CVE-2026-93575/): Io.netty/netty-codec-mqtt: netty: resource exhaustion in mqttdecoder (high 7.5)
- [CVE-2026-93574](https://insights.sbomify.com/CVE-2026-93574/): Io.netty/netty-codec-http: netty: http request smuggling via post-digit whitespace in chunk-size parsing (medium 6.5)
- [CVE-2026-93573](https://insights.sbomify.com/CVE-2026-93573/): Security feature bypass in Red Hat AMQ Broker 7 (medium 6.5)
- [CVE-2026-93572](https://insights.sbomify.com/CVE-2026-93572/): Io.netty/netty-codec-redis: netty: redisarrayaggregator nested resp headers multiply patched preallocation limits (high 7.5)
- [CVE-2026-93571](https://insights.sbomify.com/CVE-2026-93571/): Path Traversal in Szafir (low 2.3)
- [CVE-2026-93570](https://insights.sbomify.com/CVE-2026-93570/): XML External Entity injection in Szafir and Szafir Weryfikująca (high 8.2)
- [CVE-2026-9357](https://insights.sbomify.com/CVE-2026-9357/): vBulletin Login cross site scripting (medium 5.1)
- [CVE-2026-93569](https://insights.sbomify.com/CVE-2026-93569/): Security feature bypass in Red Hat AMQ Broker 7 (high 8.2)
- [CVE-2026-93568](https://insights.sbomify.com/CVE-2026-93568/): Security feature bypass in Red Hat AMQ Broker 7 (high 7.5)
- [CVE-2026-93567](https://insights.sbomify.com/CVE-2026-93567/): Security feature bypass in Red Hat AMQ Broker 7 (high 7.5)
- [CVE-2026-93566](https://insights.sbomify.com/CVE-2026-93566/): Io.netty/netty-codec-http: netty: http request smuggling due to control characters in the chunk-size line (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/239/