# Vulnerabilities published in 2026


- [CVE-2026-84502](https://insights.sbomify.com/CVE-2026-84502/): Command injection in Red Hat Ansible Automation Platform 2.4 for RHEL 8 (critical 9.9)
- [CVE-2026-84501](https://insights.sbomify.com/CVE-2026-84501/): Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProvider (medium 5.3)
- [CVE-2026-8450](https://insights.sbomify.com/CVE-2026-8450/): HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file() (critical 9.1)
- [CVE-2026-84499](https://insights.sbomify.com/CVE-2026-84499/): Information disclosure in Red Hat Ansible Automation Platform 2.5 for RHEL 8 (high 7.7)
- [CVE-2026-84498](https://insights.sbomify.com/CVE-2026-84498/): Information disclosure in macOS (not scored)
- [CVE-2026-84497](https://insights.sbomify.com/CVE-2026-84497/): Memory corruption in iOS and iPadOS (high 7.8)
- [CVE-2026-84496](https://insights.sbomify.com/CVE-2026-84496/): Memory corruption in macOS (medium 6.5)
- [CVE-2026-84495](https://insights.sbomify.com/CVE-2026-84495/): Use after free in iOS and iPadOS (not scored)
- [CVE-2026-84494](https://insights.sbomify.com/CVE-2026-84494/): Memory corruption in iOS and iPadOS (not scored)
- [CVE-2026-84493](https://insights.sbomify.com/CVE-2026-84493/): Auth bypass in iOS and iPadOS (not scored)
- [CVE-2026-84492](https://insights.sbomify.com/CVE-2026-84492/): Race condition in iOS and iPadOS (medium 4.7)
- [CVE-2026-84491](https://insights.sbomify.com/CVE-2026-84491/): Missing authorization in iOS and iPadOS (medium 5.5)
- [CVE-2026-84490](https://insights.sbomify.com/CVE-2026-84490/): Auth bypass in iOS and iPadOS (low 2.0)
- [CVE-2026-84489](https://insights.sbomify.com/CVE-2026-84489/): Memory corruption in iOS and iPadOS (medium 5.5)
- [CVE-2026-84487](https://insights.sbomify.com/CVE-2026-84487/): Integer overflow in iOS and iPadOS (medium 6.5)
- [CVE-2026-84486](https://insights.sbomify.com/CVE-2026-84486/): Missing authorization in Red Hat Ansible Automation Platform 2.6 (high 8.2)
- [CVE-2026-84485](https://insights.sbomify.com/CVE-2026-84485/): APITable through 1.13.0-beta.1 Missing Authentication on the Internal Organization Load or Search Endpoint (high 8.7)
- [CVE-2026-84484](https://insights.sbomify.com/CVE-2026-84484/): ION-DTN before 4.2.0 Out-of-Bounds Read via decodeSdnv (high 8.7)
- [CVE-2026-84483](https://insights.sbomify.com/CVE-2026-84483/): WWBN AVideo Unauthenticated Password Hash Oracle via encryptPass.json.php (medium 6.9)
- [CVE-2026-84482](https://insights.sbomify.com/CVE-2026-84482/): WWBN AVideo Cross-Site Request Forgery via get_domain() validation (high 8.7)
- [CVE-2026-84481](https://insights.sbomify.com/CVE-2026-84481/): WWBN AVideo through 30.0 Information Disclosure via MobileManager (medium 6.9)
- [CVE-2026-84480](https://insights.sbomify.com/CVE-2026-84480/): WWBN AVideo Password Recovery Token Expiration Bypass (critical 9.3)
- [CVE-2026-84479](https://insights.sbomify.com/CVE-2026-84479/): WWBN AVideo Authentication Bypass via User-Agent Header (critical 9.3)
- [CVE-2026-84478](https://insights.sbomify.com/CVE-2026-84478/): WWBN AVideo Unauthenticated Arbitrary Log File Deletion (medium 6.9)
- [CVE-2026-84477](https://insights.sbomify.com/CVE-2026-84477/): AVideo Stored XSS via Live Schedule Title Description (medium 5.1)
- [CVE-2026-84476](https://insights.sbomify.com/CVE-2026-84476/): WWBN AVideo Authentication Bypass via X-Real-IP Header (high 8.7)
- [CVE-2026-84474](https://insights.sbomify.com/CVE-2026-84474/): Privilege escalation in Red Hat Ansible Automation Platform 2.4 for RHEL 8 (critical 9.9)
- [CVE-2026-84471](https://insights.sbomify.com/CVE-2026-84471/): Use after free in OpenVPN (high 7.2)
- [CVE-2026-84470](https://insights.sbomify.com/CVE-2026-84470/): Missing authorization in Red Hat Ansible Automation Platform 2.5 for RHEL 8 (medium 6.4)
- [CVE-2026-8447](https://insights.sbomify.com/CVE-2026-8447/): Cross-site scripting in Langflow OSS (medium 6.1)
- [CVE-2026-84469](https://insights.sbomify.com/CVE-2026-84469/): fastify vulnerable to request validation bypass via skipped boolean false schemas (high 7.5)
- [CVE-2026-84465](https://insights.sbomify.com/CVE-2026-84465/): Zammad: S/MIME signature verification allows forged sender impersonation (high 7.1)
- [CVE-2026-84464](https://insights.sbomify.com/CVE-2026-84464/): Zammad: IDOR in External Data Source rendering exposes ticket, user, group, and organization data (high 7.1)
- [CVE-2026-84463](https://insights.sbomify.com/CVE-2026-84463/): Cross-site scripting in zammad (medium 6.3)
- [CVE-2026-84462](https://insights.sbomify.com/CVE-2026-84462/): Zammad: AI Agent template sanitizer bypass leads to remote code execution (high 8.6)
- [CVE-2026-84461](https://insights.sbomify.com/CVE-2026-84461/): Zammad: Missing rate limiting allows password brute-forcing during two-factor login (medium 6.9)
- [CVE-2026-84460](https://insights.sbomify.com/CVE-2026-84460/): Zammad: Missing Authorization in TagsController#list Allows Cross-Object Tag Enumeration (medium 5.3)
- [CVE-2026-8446](https://insights.sbomify.com/CVE-2026-8446/): Langflow is affected by security vulnerabilities in Model Context Protocol features (high 7.5)
- [CVE-2026-84458](https://insights.sbomify.com/CVE-2026-84458/): Zammad: Account takeover via unverified email matching during SSO auto-link (critical 9.1)
- [CVE-2026-84452](https://insights.sbomify.com/CVE-2026-84452/): Windows ML CLI: CORS misconfig enables localhost RCE (high 8.6)
- [CVE-2026-84451](https://insights.sbomify.com/CVE-2026-84451/): libheif: Incomplete fix for CVE-2026-62292 leaves libheif vulnerable to an out-of-bounds read (medium 6.5)
- [CVE-2026-84450](https://insights.sbomify.com/CVE-2026-84450/): libheif: `clap` + oversized `ispe` aborts on an assert in `Fraction::Fraction` (incomplete fix for CVE-2026-62289) (medium 4.3)
- [CVE-2026-8445](https://insights.sbomify.com/CVE-2026-8445/): justhtml before 1.12.0 Sanitizer Bypass via Markdown (critical 9.3)
- [CVE-2026-84449](https://insights.sbomify.com/CVE-2026-84449/): libheif hOp_RGB24_32_to_YCbCr Memory Access Error / SEGV (low 3.7)
- [CVE-2026-84448](https://insights.sbomify.com/CVE-2026-84448/): Memory corruption in libheif (medium 4.0)
- [CVE-2026-84447](https://insights.sbomify.com/CVE-2026-84447/): Denial of service in libheif (high 7.5)
- [CVE-2026-84446](https://insights.sbomify.com/CVE-2026-84446/): Denial of service in libheif (high 7.5)
- [CVE-2026-84445](https://insights.sbomify.com/CVE-2026-84445/): gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers (high 8.7)
- [CVE-2026-84444](https://insights.sbomify.com/CVE-2026-84444/): libheif uncompressed tiled image encoding allows out-of-bounds write (high 7.4)
- [CVE-2026-84442](https://insights.sbomify.com/CVE-2026-84442/): MapQuest Get Directions App com.mapquest.android.ace ExpoShareIntentModule.kt getDataColumn path traversal (medium 4.8)
- [CVE-2026-84441](https://insights.sbomify.com/CVE-2026-84441/): Piwigo Image Derivative i.php path traversal (medium 6.9)
- [CVE-2026-84440](https://insights.sbomify.com/CVE-2026-84440/): IBM Guardium Data Protection is affected by multiple vulnerabilities. (high 7.5)
- [CVE-2026-8444](https://insights.sbomify.com/CVE-2026-8444/): WP Review Slider Pro <= 12.6.8 - Authenticated (Subscriber+) SQL Injection via 'curselrevs' Parameter (high 8.8)
- [CVE-2026-84439](https://insights.sbomify.com/CVE-2026-84439/): Apache ZooKeeper: Audit log injection via unsanitized output from multiple sources (medium 5.3)
- [CVE-2026-84438](https://insights.sbomify.com/CVE-2026-84438/): OpenCart Autocomplete Workflow edit.php cross site scripting (medium 5.1)
- [CVE-2026-84437](https://insights.sbomify.com/CVE-2026-84437/): OpenCart Autocomplete Workflow address.php cross site scripting (medium 5.1)
- [CVE-2026-84436](https://insights.sbomify.com/CVE-2026-84436/): IBM Guardium Data Protection is affected by multiple vulnerabilities. (critical 9.1)
- [CVE-2026-84434](https://insights.sbomify.com/CVE-2026-84434/): Gravity Forms <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload Field (critical 9.8)
- [CVE-2026-84432](https://insights.sbomify.com/CVE-2026-84432/): Concrete CMS 9 through 9.5.2 is vulnerable to CSRFin the Boards custom slot dialog controller (medium 5.3)
- [CVE-2026-84431](https://insights.sbomify.com/CVE-2026-84431/): AirAsia MOVE App com.airasia.mobile com.airasia.core.utils.RealPathUtil.getRealPath path traversal (medium 4.8)
- [CVE-2026-84430](https://insights.sbomify.com/CVE-2026-84430/): gouguoa edit_personal Endpoint Index.php update dynamically-determined object attributes (medium 5.3)
- [CVE-2026-8443](https://insights.sbomify.com/CVE-2026-8443/): WP Review Slider Pro <= 12.6.8 - Authenticated (Subscriber+) SQL Injection via 'stypes' Parameter (high 8.8)
- [CVE-2026-84429](https://insights.sbomify.com/CVE-2026-84429/): Potential denial-of-service vulnerability in HTTP header parsing (medium 6.9)
- [CVE-2026-84428](https://insights.sbomify.com/CVE-2026-84428/): fastify vulnerable to header validation bypass via incomplete schema case normalization (high 7.5)
- [CVE-2026-84427](https://insights.sbomify.com/CVE-2026-84427/): zhayujie CowAgent Bash Tool bash.py denial of service (medium 5.3)
- [CVE-2026-84425](https://insights.sbomify.com/CVE-2026-84425/): zhayujie CowAgent Browser Tool browser_tool.py BrowserTool denial of service (medium 5.3)
- [CVE-2026-84423](https://insights.sbomify.com/CVE-2026-84423/): Casdoor upload-resource API resource.go missing authentication (medium 6.9)
- [CVE-2026-84422](https://insights.sbomify.com/CVE-2026-84422/): IBM Guardium Data Protection is affected by multiple vulnerabilities. (high 7.2)
- [CVE-2026-84421](https://insights.sbomify.com/CVE-2026-84421/): DataStage on Cloud Pak for Data has several vulnerabilities (high 8.8)
- [CVE-2026-84420](https://insights.sbomify.com/CVE-2026-84420/): Out-of-Bounds Write and Out-of-Bounds Read (medium 5.8)
- [CVE-2026-8442](https://insights.sbomify.com/CVE-2026-8442/): WP Review Slider Pro <= 12.6.8 - Authenticated (Subscriber+) Arbitrary File Deletion via 'myaction' Parameter (high 8.1)
- [CVE-2026-84419](https://insights.sbomify.com/CVE-2026-84419/): Out-of-Bounds Write (medium 6.8)
- [CVE-2026-84418](https://insights.sbomify.com/CVE-2026-84418/): DataStage on Cloud Pak for Data Improper Certificate Validation (high 7.4)
- [CVE-2026-84414](https://insights.sbomify.com/CVE-2026-84414/): IBM i is Affected By An Incorrect Permission Assignment Vulnerability in Network Authentication Service [] (high 7.8)
- [CVE-2026-84412](https://insights.sbomify.com/CVE-2026-84412/): Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94) (critical 10.0)
- [CVE-2026-84411](https://insights.sbomify.com/CVE-2026-84411/): MikroTik RouterOS Integer Underflow (critical 9.3)
- [CVE-2026-8441](https://insights.sbomify.com/CVE-2026-8441/): WP Review Slider Pro <= 12.7.2 - Unauthenticated SQL Injection via 'notinstring' Parameter (high 7.5)
- [CVE-2026-84409](https://insights.sbomify.com/CVE-2026-84409/): Lantronix G520 Series Cellular Gateway Cross-site Scripting (high 7.7)
- [CVE-2026-84408](https://insights.sbomify.com/CVE-2026-84408/): Privilege escalation in QND Advance (high 8.7)
- [CVE-2026-84403](https://insights.sbomify.com/CVE-2026-84403/): Botslab G980H Dashcams Missing Authentication for Critical Function (medium 6.9)
- [CVE-2026-84400](https://insights.sbomify.com/CVE-2026-84400/): CareCam CM2507 Missing Authentication for Critical Function (low 2.3)
- [CVE-2026-84399](https://insights.sbomify.com/CVE-2026-84399/): Botslab G980H Dashcams Incorrect Authorization (high 8.7)
- [CVE-2026-84398](https://insights.sbomify.com/CVE-2026-84398/): CareCam CM2507 Empty Password in Configuration File (high 8.7)
- [CVE-2026-84397](https://insights.sbomify.com/CVE-2026-84397/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2026-84396](https://insights.sbomify.com/CVE-2026-84396/): InDesign Desktop | NULL Pointer Dereference (CWE-476) (medium 5.5)
- [CVE-2026-84395](https://insights.sbomify.com/CVE-2026-84395/): Premiere Pro | Server-Side Request Forgery (SSRF) (CWE-918) (high 7.1)
- [CVE-2026-84394](https://insights.sbomify.com/CVE-2026-84394/): fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority (high 7.5)
- [CVE-2026-84393](https://insights.sbomify.com/CVE-2026-84393/): Security feature bypass in FortiOS (high 7.3)
- [CVE-2026-84392](https://insights.sbomify.com/CVE-2026-84392/): Null dereference in FortiOS (low 2.5)
- [CVE-2026-84391](https://insights.sbomify.com/CVE-2026-84391/): Denial of service in FortiAnalyzer (medium 5.9)
- [CVE-2026-84390](https://insights.sbomify.com/CVE-2026-84390/): Information disclosure in FortiMonitorOnSight (critical 9.6)
- [CVE-2026-84389](https://insights.sbomify.com/CVE-2026-84389/): Open redirect in FortiSIEM (low 2.8)
- [CVE-2026-84388](https://insights.sbomify.com/CVE-2026-84388/): Other in FortiPAM Chrome Extension (critical 9.1)
- [CVE-2026-84387](https://insights.sbomify.com/CVE-2026-84387/): Command injection in FortiSandbox (medium 6.7)
- [CVE-2026-84386](https://insights.sbomify.com/CVE-2026-84386/): Missing authorization in FortiClientWindows (medium 4.7)
- [CVE-2026-84385](https://insights.sbomify.com/CVE-2026-84385/): Privilege escalation in FortiSOAR PaaS (medium 4.9)
- [CVE-2026-84384](https://insights.sbomify.com/CVE-2026-84384/): libheif: brotli/zlib decompression paths lack output-size limits, allowing decompression-bomb OOM/DoS (high 7.5)
- [CVE-2026-84383](https://insights.sbomify.com/CVE-2026-84383/): libheif: Heap buffer overflow in `scale_nearest_neighbor()` via duplicate Alpha planes from nested `iden`/`auxl` items (critical 9.8)
- [CVE-2026-84382](https://insights.sbomify.com/CVE-2026-84382/): HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification) (high 7.5)
- [CVE-2026-84381](https://insights.sbomify.com/CVE-2026-84381/): HTTPX2: Secure WebSocket traffic sent without TLS through SOCKS proxies (high 8.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/315/