# Vulnerabilities published in 2026


- [CVE-2026-84717](https://insights.sbomify.com/CVE-2026-84717/): Information disclosure in Red Hat Ansible Automation Platform 2.5 for RHEL 8 (medium 5.3)
- [CVE-2026-84716](https://insights.sbomify.com/CVE-2026-84716/): Security feature bypass in Red Hat Ansible Automation Platform 2.5 for RHEL 8 (medium 6.6)
- [CVE-2026-84715](https://insights.sbomify.com/CVE-2026-84715/): FeatherPanel before 1.3.7.10 Privilege Escalation via Subuser Permission Update (high 8.7)
- [CVE-2026-84714](https://insights.sbomify.com/CVE-2026-84714/): Code injection in Red Hat Ansible Automation Platform 2.5 for RHEL 8 (high 7.1)
- [CVE-2026-84713](https://insights.sbomify.com/CVE-2026-84713/): Missing authorization in Red Hat Ansible Automation Platform 2 (medium 6.5)
- [CVE-2026-84712](https://insights.sbomify.com/CVE-2026-84712/): Information disclosure in Red Hat Ansible Automation Platform 2.5 for RHEL 8 (medium 5.3)
- [CVE-2026-84706](https://insights.sbomify.com/CVE-2026-84706/): Code injection in Red Hat Ansible Automation Platform 2.5 for RHEL 8 (high 7.6)
- [CVE-2026-84702](https://insights.sbomify.com/CVE-2026-84702/): facefusion before 3.7.0 Path Traversal via Job Identifier (high 8.7)
- [CVE-2026-84701](https://insights.sbomify.com/CVE-2026-84701/): NocoBase Rich Text Field Stored Cross-Site Scripting via API (medium 5.1)
- [CVE-2026-84700](https://insights.sbomify.com/CVE-2026-84700/): Pika Unauthenticated Replication Access via Internal Protobuf Port (high 8.8)
- [CVE-2026-8470](https://insights.sbomify.com/CVE-2026-8470/): Langflow is affected by weaknesses in secret handling and sensitive configuration access (high 7.4)
- [CVE-2026-84699](https://insights.sbomify.com/CVE-2026-84699/): Team Password Manager before 14.184.308 Authentication Bypass in Password Reset (critical 9.3)
- [CVE-2026-84698](https://insights.sbomify.com/CVE-2026-84698/): PX4 Autopilot sd_bench Heap Buffer Overflow via Block Size (high 7.1)
- [CVE-2026-84697](https://insights.sbomify.com/CVE-2026-84697/): Mailpit SSRF Deny List Bypass via Azure Metadata and IPv6 Prefix (medium 6.9)
- [CVE-2026-84696](https://insights.sbomify.com/CVE-2026-84696/): Phison PS3111-S11 Controller Firmware Missing Authentication on Vendor Unique Commands (critical 9.3)
- [CVE-2026-84695](https://insights.sbomify.com/CVE-2026-84695/): BookStack before 26.05.4 Stored XSS via Drawing Upload (critical 9.3)
- [CVE-2026-84694](https://insights.sbomify.com/CVE-2026-84694/): Coolify before 4.2.0 Remote Code Execution via Environment Variable Key (high 8.7)
- [CVE-2026-84691](https://insights.sbomify.com/CVE-2026-84691/): Code injection in Red Hat Ansible Automation Platform 2.5 for RHEL 8 (high 8.7)
- [CVE-2026-8469](https://insights.sbomify.com/CVE-2026-8469/): Unauthenticated denial-of-service via BEAM atom table exhaustion in phoenix_storybook (high 8.2)
- [CVE-2026-84685](https://insights.sbomify.com/CVE-2026-84685/): Improper Cache Isolation in auth0/react-native-auth0 SDK Web Platform Credential Management (medium 6.5)
- [CVE-2026-84683](https://insights.sbomify.com/CVE-2026-84683/): Cross-site scripting in Red Hat Ansible Automation Platform 2.5 for RHEL 8 (high 8.7)
- [CVE-2026-84682](https://insights.sbomify.com/CVE-2026-84682/): TDDPv2 setProductVer Command Injection in Archer AX90 (high 7.7)
- [CVE-2026-8468](https://insights.sbomify.com/CVE-2026-8468/): Unbounded buffer accumulation in multipart header parsing causes denial of service in plug (high 8.2)
- [CVE-2026-84677](https://insights.sbomify.com/CVE-2026-84677/): Cross-site scripting in Jenkins update-center2 (medium 5.4)
- [CVE-2026-84676](https://insights.sbomify.com/CVE-2026-84676/): Information disclosure in Jenkins Parameterized Remote Trigger Plugin (medium 4.3)
- [CVE-2026-84675](https://insights.sbomify.com/CVE-2026-84675/): Command injection in Jenkins TICS Plugin (high 7.4)
- [CVE-2026-84674](https://insights.sbomify.com/CVE-2026-84674/): Missing authorization in Jenkins XebiaLabs XL Deploy Plugin (medium 5.4)
- [CVE-2026-84673](https://insights.sbomify.com/CVE-2026-84673/): Cross-site scripting in Jenkins Customizable Header Plugin (high 8.8)
- [CVE-2026-84672](https://insights.sbomify.com/CVE-2026-84672/): Privilege escalation in Jenkins Microsoft Entra ID (previously Azure AD) Plugin (high 8.8)
- [CVE-2026-84671](https://insights.sbomify.com/CVE-2026-84671/): Path traversal in Jenkins File Parameter Plugin (high 8.8)
- [CVE-2026-84670](https://insights.sbomify.com/CVE-2026-84670/): Deserialization in Jenkins Performance Plugin (high 8.8)
- [CVE-2026-8467](https://insights.sbomify.com/CVE-2026-8467/): Unauthenticated remote code execution via HEEx template injection in phoenix_storybook playground (critical 9.5)
- [CVE-2026-84669](https://insights.sbomify.com/CVE-2026-84669/): Path traversal in Jenkins Allure Plugin (high 8.8)
- [CVE-2026-84668](https://insights.sbomify.com/CVE-2026-84668/): Missing authorization in Jenkins SAML Plugin (high 8.8)
- [CVE-2026-84667](https://insights.sbomify.com/CVE-2026-84667/): Path traversal in Jenkins ThinBackup Plugin (high 7.1)
- [CVE-2026-84666](https://insights.sbomify.com/CVE-2026-84666/): Other in Jenkins Job Configuration History Plugin (medium 5.4)
- [CVE-2026-84665](https://insights.sbomify.com/CVE-2026-84665/): Cross-site scripting in Jenkins SonarQube Scanner Plugin (high 8.0)
- [CVE-2026-84664](https://insights.sbomify.com/CVE-2026-84664/): Other in Jenkins GitLab Plugin (medium 5.4)
- [CVE-2026-84663](https://insights.sbomify.com/CVE-2026-84663/): Cross-site request forgery in Jenkins Pipeline: Groovy Libraries Plugin (medium 5.4)
- [CVE-2026-84662](https://insights.sbomify.com/CVE-2026-84662/): Server-side request forgery in Jenkins LDAP Plugin (medium 4.3)
- [CVE-2026-84661](https://insights.sbomify.com/CVE-2026-84661/): Missing authorization in Jenkins Pipeline: Build Step Plugin (medium 5.4)
- [CVE-2026-84660](https://insights.sbomify.com/CVE-2026-84660/): Missing authorization in Jenkins Pipeline: Build Step Plugin (medium 5.4)
- [CVE-2026-8466](https://insights.sbomify.com/CVE-2026-8466/): Unbounded buffer accumulation in multipart header parsing causes denial of service in cowboy (high 8.2)
- [CVE-2026-84659](https://insights.sbomify.com/CVE-2026-84659/): Missing authorization in Jenkins Script Security Plugin (medium 4.3)
- [CVE-2026-84658](https://insights.sbomify.com/CVE-2026-84658/): Information disclosure in Jenkins Script Security Plugin (medium 4.3)
- [CVE-2026-84657](https://insights.sbomify.com/CVE-2026-84657/): Missing authorization in Jenkins (medium 4.2)
- [CVE-2026-84656](https://insights.sbomify.com/CVE-2026-84656/): Missing authorization in Jenkins (medium 4.3)
- [CVE-2026-84655](https://insights.sbomify.com/CVE-2026-84655/): Code injection in Jenkins (medium 4.3)
- [CVE-2026-84654](https://insights.sbomify.com/CVE-2026-84654/): Business logic in Jenkins (medium 5.4)
- [CVE-2026-84653](https://insights.sbomify.com/CVE-2026-84653/): Missing authorization in Jenkins (low 3.5)
- [CVE-2026-84652](https://insights.sbomify.com/CVE-2026-84652/): Auth bypass in Jenkins (high 7.3)
- [CVE-2026-84651](https://insights.sbomify.com/CVE-2026-84651/): Missing authorization in Jenkins (medium 6.3)
- [CVE-2026-84650](https://insights.sbomify.com/CVE-2026-84650/): Deserialization in Jenkins (high 8.8)
- [CVE-2026-84649](https://insights.sbomify.com/CVE-2026-84649/): Cross-site request forgery in Jenkins (high 8.8)
- [CVE-2026-84648](https://insights.sbomify.com/CVE-2026-84648/): Cross-site scripting in Jenkins (high 8.8)
- [CVE-2026-84647](https://insights.sbomify.com/CVE-2026-84647/): Deserialization in Jenkins (high 8.8)
- [CVE-2026-84646](https://insights.sbomify.com/CVE-2026-84646/): Deserialization in Jenkins (medium 4.3)
- [CVE-2026-84645](https://insights.sbomify.com/CVE-2026-84645/): Code injection in Jenkins (high 8.8)
- [CVE-2026-84642](https://insights.sbomify.com/CVE-2026-84642/): Allowed UNC hostnames for attachments interpreted as a regular expression (high 7.5)
- [CVE-2026-84641](https://insights.sbomify.com/CVE-2026-84641/): Information disclosure due to malicious IMAP server response (high 7.5)
- [CVE-2026-84640](https://insights.sbomify.com/CVE-2026-84640/): One byte overflow read in mail parser (high 7.5)
- [CVE-2026-8464](https://insights.sbomify.com/CVE-2026-8464/): Path traversal in Neuron Soft Golem OEE MES (high 8.3)
- [CVE-2026-84639](https://insights.sbomify.com/CVE-2026-84639/): Uninitialized memory in MIME parsing (critical 9.1)
- [CVE-2026-84637](https://insights.sbomify.com/CVE-2026-84637/): Calendar invitation attachments could launch local executables (critical 9.8)
- [CVE-2026-84636](https://insights.sbomify.com/CVE-2026-84636/): Missing authorization in iOS and iPadOS (medium 5.5)
- [CVE-2026-84635](https://insights.sbomify.com/CVE-2026-84635/): Business logic in Safari (medium 6.5)
- [CVE-2026-84634](https://insights.sbomify.com/CVE-2026-84634/): Race condition in iOS and iPadOS (not scored)
- [CVE-2026-84633](https://insights.sbomify.com/CVE-2026-84633/): Path traversal in macOS (not scored)
- [CVE-2026-84632](https://insights.sbomify.com/CVE-2026-84632/): Memory corruption in iOS and iPadOS (high 7.3)
- [CVE-2026-84631](https://insights.sbomify.com/CVE-2026-84631/): Privilege escalation in macOS (high 7.8)
- [CVE-2026-84630](https://insights.sbomify.com/CVE-2026-84630/): Race condition in iOS and iPadOS (medium 4.7)
- [CVE-2026-8463](https://insights.sbomify.com/CVE-2026-8463/): Memory corruption in Crypt::Argon2 (medium 5.3)
- [CVE-2026-84629](https://insights.sbomify.com/CVE-2026-84629/): Missing authorization in iOS and iPadOS (high 7.5)
- [CVE-2026-84628](https://insights.sbomify.com/CVE-2026-84628/): Missing authorization in iOS and iPadOS (medium 5.5)
- [CVE-2026-84627](https://insights.sbomify.com/CVE-2026-84627/): Memory corruption in iOS and iPadOS (not scored)
- [CVE-2026-84626](https://insights.sbomify.com/CVE-2026-84626/): Information disclosure in iOS and iPadOS (low 3.3)
- [CVE-2026-84625](https://insights.sbomify.com/CVE-2026-84625/): Information disclosure in iOS and iPadOS (critical 9.1)
- [CVE-2026-84624](https://insights.sbomify.com/CVE-2026-84624/): Path traversal in iOS and iPadOS (medium 5.5)
- [CVE-2026-84623](https://insights.sbomify.com/CVE-2026-84623/): Auth bypass in iOS and iPadOS (high 7.5)
- [CVE-2026-84622](https://insights.sbomify.com/CVE-2026-84622/): Information disclosure in iOS and iPadOS (medium 6.2)
- [CVE-2026-84621](https://insights.sbomify.com/CVE-2026-84621/): Missing authorization in iOS and iPadOS (medium 5.5)
- [CVE-2026-84620](https://insights.sbomify.com/CVE-2026-84620/): Integer overflow in iOS and iPadOS (high 7.3)
- [CVE-2026-8462](https://insights.sbomify.com/CVE-2026-8462/): OpenMeter SQL Injection in ClickHouse-backed Meter Definitions (high 8.9)
- [CVE-2026-84619](https://insights.sbomify.com/CVE-2026-84619/): Memory corruption in macOS (medium 6.1)
- [CVE-2026-84618](https://insights.sbomify.com/CVE-2026-84618/): Missing authorization in macOS (medium 5.5)
- [CVE-2026-84617](https://insights.sbomify.com/CVE-2026-84617/): Missing authorization in iOS and iPadOS (medium 5.5)
- [CVE-2026-84616](https://insights.sbomify.com/CVE-2026-84616/): Memory corruption in iOS and iPadOS (medium 5.5)
- [CVE-2026-84615](https://insights.sbomify.com/CVE-2026-84615/): Missing authorization in iOS and iPadOS (medium 5.5)
- [CVE-2026-84614](https://insights.sbomify.com/CVE-2026-84614/): Security feature bypass in iOS and iPadOS (not scored)
- [CVE-2026-84613](https://insights.sbomify.com/CVE-2026-84613/): Memory corruption in iOS and iPadOS (medium 6.5)
- [CVE-2026-84612](https://insights.sbomify.com/CVE-2026-84612/): Missing authorization in iOS and iPadOS (medium 5.5)
- [CVE-2026-84611](https://insights.sbomify.com/CVE-2026-84611/): Memory corruption in iOS and iPadOS (high 7.3)
- [CVE-2026-84610](https://insights.sbomify.com/CVE-2026-84610/): Security feature bypass in macOS (not scored)
- [CVE-2026-8461](https://insights.sbomify.com/CVE-2026-8461/): Heap out-of-bounds write via odd slice_height in FFmpeg MagicYUV decoder (high 8.8)
- [CVE-2026-84609](https://insights.sbomify.com/CVE-2026-84609/): Path traversal in iOS and iPadOS (critical 9.8)
- [CVE-2026-84607](https://insights.sbomify.com/CVE-2026-84607/): Race condition in iOS and iPadOS (high 7.8)
- [CVE-2026-84606](https://insights.sbomify.com/CVE-2026-84606/): Information disclosure in iOS and iPadOS (high 7.5)
- [CVE-2026-84605](https://insights.sbomify.com/CVE-2026-84605/): Missing authorization in iOS and iPadOS (not scored)
- [CVE-2026-84604](https://insights.sbomify.com/CVE-2026-84604/): Memory corruption in macOS (not scored)
- [CVE-2026-84603](https://insights.sbomify.com/CVE-2026-84603/): Privilege escalation in iOS and iPadOS (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/313/