# Vulnerabilities published in 2026


- [CVE-2026-86075](https://insights.sbomify.com/CVE-2026-86075/): n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint (high 8.7)
- [CVE-2026-86074](https://insights.sbomify.com/CVE-2026-86074/): n8n: Instance AI Credential Setup Accepts Unvalidated Probe URL from Fetched Content (medium 5.9)
- [CVE-2026-86073](https://insights.sbomify.com/CVE-2026-86073/): n8n: Per-Resource OAuth Consent Bypass via Unbound Refresh Token Resource Substitution (medium 5.9)
- [CVE-2026-86071](https://insights.sbomify.com/CVE-2026-86071/): Junrar: LocalFolderExtractor mkdir escape allows directory creation outside extraction root (low 3.7)
- [CVE-2026-8607](https://insights.sbomify.com/CVE-2026-8607/): Cross-site scripting in Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred (medium 6.4)
- [CVE-2026-86066](https://insights.sbomify.com/CVE-2026-86066/): Horilla attendance approval endpoint is vulnerable to cross-site request forgery (medium 5.9)
- [CVE-2026-86065](https://insights.sbomify.com/CVE-2026-86065/): Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS) (high 7.5)
- [CVE-2026-86064](https://insights.sbomify.com/CVE-2026-86064/): Klever-Go: /log controls global node logging (high 8.6)
- [CVE-2026-86063](https://insights.sbomify.com/CVE-2026-86063/): Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning (high 7.5)
- [CVE-2026-86062](https://insights.sbomify.com/CVE-2026-86062/): LightRAG: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested content (medium 6.1)
- [CVE-2026-86060](https://insights.sbomify.com/CVE-2026-86060/): MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command (critical 9.2, exploited in the wild)
- [CVE-2026-8606](https://insights.sbomify.com/CVE-2026-8606/): Server-Side Request Forgery in GitHub Enterprise Server via Advisory Package URL Endpoint (high 7.0)
- [CVE-2026-86059](https://insights.sbomify.com/CVE-2026-86059/): Dokploy: Git Provider Credential Exposure via Unprotected .one Endpoints and application.one (critical 9.6)
- [CVE-2026-86056](https://insights.sbomify.com/CVE-2026-86056/): Notepad++: Null pointer dereference in NPPM_SAVESESSION message handler causes crash (DoS) (medium 5.5)
- [CVE-2026-86055](https://insights.sbomify.com/CVE-2026-86055/): Part-DB: Password Reset Link Poisoning via Host Header Injection leads to pre-authentication Account Takeover (high 8.7)
- [CVE-2026-86054](https://insights.sbomify.com/CVE-2026-86054/): Notepad++: Stack Buffer Overflow in `NppParameters::writeSession` via overlong session path (high 7.8)
- [CVE-2026-8605](https://insights.sbomify.com/CVE-2026-8605/): Use of Hard-coded Credentials in ScadaBR (medium 5.1)
- [CVE-2026-86049](https://insights.sbomify.com/CVE-2026-86049/): Jupyter Server: 5xx request logging leaks token-bearing Referer header values (high 7.1)
- [CVE-2026-86047](https://insights.sbomify.com/CVE-2026-86047/): MariaDB: Insufficient quoting in mariadb-dump and SHOW commands (high 7.7)
- [CVE-2026-86043](https://insights.sbomify.com/CVE-2026-86043/): Skipper: OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix CVE-2026-50197) (high 7.5)
- [CVE-2026-86040](https://insights.sbomify.com/CVE-2026-86040/): libp2p: Unbounded RPC decode + synchronous subscription processing in @libp2p/floodsub allows unauthenticated DoS (high 7.5)
- [CVE-2026-8604](https://insights.sbomify.com/CVE-2026-8604/): Cross-Site request forgery (CSRF) in ScadaBR (high 8.6)
- [CVE-2026-86039](https://insights.sbomify.com/CVE-2026-86039/): libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses (high 8.2)
- [CVE-2026-86038](https://insights.sbomify.com/CVE-2026-86038/): libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID (high 7.5)
- [CVE-2026-86035](https://insights.sbomify.com/CVE-2026-86035/): Weblate: Mercurial argument injection via repository filenames allows authenticated command execution (high 8.5)
- [CVE-2026-8603](https://insights.sbomify.com/CVE-2026-8603/): Improper neutralization of special elements used in an OS command ('OS command injection') in ScadaBR (high 8.7)
- [CVE-2026-86022](https://insights.sbomify.com/CVE-2026-86022/): VNote: Argument injection to arbitrary command execution via crafted note filename in external-program handling (high 7.0)
- [CVE-2026-86020](https://insights.sbomify.com/CVE-2026-86020/): Part-DB: Spreadsheet Formula Injection in XLSX Part Exports (medium 4.6)
- [CVE-2026-8602](https://insights.sbomify.com/CVE-2026-8602/): Missing authentication for critical function in ScadaBR (high 8.8)
- [CVE-2026-86019](https://insights.sbomify.com/CVE-2026-86019/): Part-DB: Attachment Size Limit Bypass via API Base64 Upload (medium 5.3)
- [CVE-2026-86018](https://insights.sbomify.com/CVE-2026-86018/): Part-DB: Authenticated Disk Exhaustion via Unbounded Server-Side Attachment Downloads (medium 5.3)
- [CVE-2026-86016](https://insights.sbomify.com/CVE-2026-86016/): VNote: Stored XSS via YAML Frontmatter Leading to Local File Read and Remote Exfiltration (high 8.2)
- [CVE-2026-86009](https://insights.sbomify.com/CVE-2026-86009/): Mailu: Domain managers can allow themselves to spoof on other hosted domains they should not control (high 8.2)
- [CVE-2026-86008](https://insights.sbomify.com/CVE-2026-86008/): Mailu domain managers can take over higher-privileged accounts (high 7.2)
- [CVE-2026-86003](https://insights.sbomify.com/CVE-2026-86003/): CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP (high 7.5)
- [CVE-2026-86002](https://insights.sbomify.com/CVE-2026-86002/): Dokku: Host Command Execution via eval of Unsanitized Docker Options in DOCKER_ARGS (critical 9.0)
- [CVE-2026-86000](https://insights.sbomify.com/CVE-2026-86000/): Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patterns (medium 5.3)
- [CVE-2026-85999](https://insights.sbomify.com/CVE-2026-85999/): Soup Sieve: Polynomial-time ReDoS (O(n²)) in the whitespace/comment trimming regex `RE_WS_END` (triggers on VALID selectors) (medium 5.3)
- [CVE-2026-85995](https://insights.sbomify.com/CVE-2026-85995/): Notepad++: Authenticode verification bypass allows modified updater execution (high 7.3)
- [CVE-2026-85990](https://insights.sbomify.com/CVE-2026-85990/): Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods (high 8.8)
- [CVE-2026-8599](https://insights.sbomify.com/CVE-2026-8599/): MailerPress <= 2.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via Campaign HTML Content Field (medium 6.4)
- [CVE-2026-85985](https://insights.sbomify.com/CVE-2026-85985/): MariaDB: Unauthorized file access via CONNECT engine UDFs (medium 5.4)
- [CVE-2026-85984](https://insights.sbomify.com/CVE-2026-85984/): Auth bypass in miniOrange OTP Login, Verification and SMS Notifications (critical 9.8)
- [CVE-2026-85983](https://insights.sbomify.com/CVE-2026-85983/): Local Privilege Escalation in Auth0 AD/LDAP Connector (high 7.8)
- [CVE-2026-85982](https://insights.sbomify.com/CVE-2026-85982/): Stored Cross-Site Scripting (XSS) in Auth0 AD/LDAP Connector (critical 9.0)
- [CVE-2026-85981](https://insights.sbomify.com/CVE-2026-85981/): Unauthenticated Localhost Admin Panel in Auth0 AD/LDAP Connector (medium 6.7)
- [CVE-2026-8598](https://insights.sbomify.com/CVE-2026-8598/): Unauthenticated Export Service in ZKTeco CCTV Cameras (critical 9.1)
- [CVE-2026-85979](https://insights.sbomify.com/CVE-2026-85979/): Command Injection in Puppet Enterprise (high 8.6)
- [CVE-2026-85978](https://insights.sbomify.com/CVE-2026-85978/): Unauthenticated Remote Code Execution in Akana API Platform (critical 10.0)
- [CVE-2026-85977](https://insights.sbomify.com/CVE-2026-85977/): Libtirpc: libtirpc: denial of service via unbounded memory allocation during portmapper response decoding (medium 5.3)
- [CVE-2026-85976](https://insights.sbomify.com/CVE-2026-85976/): HTTP response splitting in Progress MarkLogic Server Query Console (medium 5.4)
- [CVE-2026-85975](https://insights.sbomify.com/CVE-2026-85975/): Cleartext transmission in Progress MarkLogic Server Amazon S3 connections (high 7.5)
- [CVE-2026-85974](https://insights.sbomify.com/CVE-2026-85974/): Improper TLS hostname verification in Progress MarkLogic Server (high 7.4)
- [CVE-2026-85973](https://insights.sbomify.com/CVE-2026-85973/): Cleartext transmission in Progress MarkLogic Server cluster join operations (high 7.4)
- [CVE-2026-85972](https://insights.sbomify.com/CVE-2026-85972/): Improper Kerberos server verification in Progress MarkLogic Server (high 7.4)
- [CVE-2026-85971](https://insights.sbomify.com/CVE-2026-85971/): Incorrect log file permissions in Progress MarkLogic Server (high 7.1)
- [CVE-2026-85970](https://insights.sbomify.com/CVE-2026-85970/): Improper XML external entity restriction in Progress MarkLogic Server (high 7.1)
- [CVE-2026-8597](https://insights.sbomify.com/CVE-2026-8597/): Missing integrity verification in Triton inference handler in Amazon SageMaker Python SDK (medium 6.4)
- [CVE-2026-85969](https://insights.sbomify.com/CVE-2026-85969/): Out-of-bounds write in Progress MarkLogic Server (high 7.1)
- [CVE-2026-85968](https://insights.sbomify.com/CVE-2026-85968/): Out-of-bounds read in Progress MarkLogic Server (high 7.1)
- [CVE-2026-85967](https://insights.sbomify.com/CVE-2026-85967/): Cross-site scripting in Progress MarkLogic Server (medium 6.1)
- [CVE-2026-85966](https://insights.sbomify.com/CVE-2026-85966/): Exposure of sensitive information in Progress MarkLogic Server (high 7.7)
- [CVE-2026-85965](https://insights.sbomify.com/CVE-2026-85965/): Use-after-free in Progress MarkLogic Server JavaScript engine integration (high 8.0)
- [CVE-2026-85964](https://insights.sbomify.com/CVE-2026-85964/): Path traversal in Progress MarkLogic Server Query Console (high 7.7)
- [CVE-2026-85963](https://insights.sbomify.com/CVE-2026-85963/): Server-side request forgery and hard-coded key in Progress MarkLogic Server OpsDirector (high 7.5)
- [CVE-2026-85962](https://insights.sbomify.com/CVE-2026-85962/): Improper authentication in Progress MarkLogic Server SAML processing (high 7.5)
- [CVE-2026-85961](https://insights.sbomify.com/CVE-2026-85961/): Sensitive information exposure in Progress MarkLogic Server Azure deployments (high 7.5)
- [CVE-2026-85960](https://insights.sbomify.com/CVE-2026-85960/): Cross-site request forgery in Progress MarkLogic Server Query Console (high 7.5)
- [CVE-2026-8596](https://insights.sbomify.com/CVE-2026-8596/): Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK ModelBuilder/Serve path (high 8.5)
- [CVE-2026-85959](https://insights.sbomify.com/CVE-2026-85959/): Insufficient authentication logging in Progress MarkLogic Server (high 7.5)
- [CVE-2026-85958](https://insights.sbomify.com/CVE-2026-85958/): Improper OAuth token validation in Progress MarkLogic Server (high 7.5)
- [CVE-2026-85957](https://insights.sbomify.com/CVE-2026-85957/): Improper XML external entity restriction in Progress MarkLogic Server SAML processing (high 7.5)
- [CVE-2026-85956](https://insights.sbomify.com/CVE-2026-85956/): Improper privilege management in Progress MarkLogic Server backup and restore operations (critical 9.6)
- [CVE-2026-85955](https://insights.sbomify.com/CVE-2026-85955/): Improper privilege management in Progress MarkLogic Server xdmp:eval-in (critical 9.9)
- [CVE-2026-85954](https://insights.sbomify.com/CVE-2026-85954/): Improper privilege management in Progress MarkLogic Server higher-order XQuery functions (high 8.6)
- [CVE-2026-85953](https://insights.sbomify.com/CVE-2026-85953/): Path traversal and privilege management flaws in Progress MarkLogic Server InfoStudio (high 8.5)
- [CVE-2026-85952](https://insights.sbomify.com/CVE-2026-85952/): Server-side request forgery in Progress MarkLogic Server Linux cloud deployments (high 8.5)
- [CVE-2026-85951](https://insights.sbomify.com/CVE-2026-85951/): Server-side request forgery in Progress MarkLogic Server Azure deployments (high 8.5)
- [CVE-2026-85950](https://insights.sbomify.com/CVE-2026-85950/): Improper privilege management in Progress MarkLogic Server REST extensions (high 8.4)
- [CVE-2026-8595](https://insights.sbomify.com/CVE-2026-8595/): Stored XSS in the table panel (TableNG) (medium 6.8)
- [CVE-2026-85949](https://insights.sbomify.com/CVE-2026-85949/): Sensitive information exposure in Progress MarkLogic Server trace logs (high 8.1)
- [CVE-2026-85948](https://insights.sbomify.com/CVE-2026-85948/): Improper privilege management in Progress MarkLogic Server Management API (critical 9.9)
- [CVE-2026-85947](https://insights.sbomify.com/CVE-2026-85947/): Improper privilege management in Progress MarkLogic Server forest operations (critical 9.9)
- [CVE-2026-85945](https://insights.sbomify.com/CVE-2026-85945/): Windows Kernel Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-85943](https://insights.sbomify.com/CVE-2026-85943/): Reliable Multicast Transport Driver (RMCAST) Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-85941](https://insights.sbomify.com/CVE-2026-85941/): Windows Installer Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-8594](https://insights.sbomify.com/CVE-2026-8594/): Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break characters (medium 6.2)
- [CVE-2026-85939](https://insights.sbomify.com/CVE-2026-85939/): Windows Kernel Security Feature Bypass Vulnerability (medium 5.3)
- [CVE-2026-85938](https://insights.sbomify.com/CVE-2026-85938/): Windows Broadcast DVR User Service Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-85936](https://insights.sbomify.com/CVE-2026-85936/): Windows Shell Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-85935](https://insights.sbomify.com/CVE-2026-85935/): Windows USB Driver Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-85934](https://insights.sbomify.com/CVE-2026-85934/): Windows AppX Deployment Service Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-85933](https://insights.sbomify.com/CVE-2026-85933/): Windows Print Spooler Components Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-85932](https://insights.sbomify.com/CVE-2026-85932/): Microsoft Office SharePoint Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-85931](https://insights.sbomify.com/CVE-2026-85931/): Windows Distributed File System (DFS) Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-85930](https://insights.sbomify.com/CVE-2026-85930/): Windows Image Acquisition Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-8593](https://insights.sbomify.com/CVE-2026-8593/): Fix Business Intelligence API Pack permission (medium 5.3)
- [CVE-2026-85928](https://insights.sbomify.com/CVE-2026-85928/): Windows Volume Manager Extension Driver Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-85927](https://insights.sbomify.com/CVE-2026-85927/): Windows Universal Plug and Play (UPnP) Device Host Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-85926](https://insights.sbomify.com/CVE-2026-85926/): Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability (high 8.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/302/