# Vulnerabilities published in 2026


- [CVE-2026-82397](https://insights.sbomify.com/CVE-2026-82397/): Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop (high 7.5)
- [CVE-2026-82396](https://insights.sbomify.com/CVE-2026-82396/): Sulu: Stored XSS via media download inline-disposition override (medium 5.4)
- [CVE-2026-82395](https://insights.sbomify.com/CVE-2026-82395/): Sulu: Media move/update authorization bypass (IDOR) (medium 5.3)
- [CVE-2026-82394](https://insights.sbomify.com/CVE-2026-82394/): Sulu: Fix authorization bypass when creating preview links (medium 5.3)
- [CVE-2026-82393](https://insights.sbomify.com/CVE-2026-82393/): pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install (high 7.5)
- [CVE-2026-82392](https://insights.sbomify.com/CVE-2026-82392/): pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph (high 7.1)
- [CVE-2026-82390](https://insights.sbomify.com/CVE-2026-82390/): Cross-session AES key confusion in the Espressif ESP32 hardware crypto driver (low 3.7)
- [CVE-2026-8239](https://insights.sbomify.com/CVE-2026-8239/): Concrete CMS 9.5.0 and below is vulnerable to IDOR in '/ccm/frontend/conversations/get_rating' (medium 6.3)
- [CVE-2026-82389](https://insights.sbomify.com/CVE-2026-82389/): Null dereference in zephyr (medium 6.5)
- [CVE-2026-82388](https://insights.sbomify.com/CVE-2026-82388/): Use of a released HFP HF object after a failed RFCOMM connect in the Bluetooth Classic host (medium 5.3)
- [CVE-2026-82387](https://insights.sbomify.com/CVE-2026-82387/): Apache Roller: Stored cross-site scripting via uploaded media content type (medium 5.4)
- [CVE-2026-82386](https://insights.sbomify.com/CVE-2026-82386/): Apache Roller: XML external entity processing in OPML bookmark import (high 7.7)
- [CVE-2026-82385](https://insights.sbomify.com/CVE-2026-82385/): Apache Roller: Weblog template include escapes the Velocity sandbox and reads classpath files (medium 6.5)
- [CVE-2026-82384](https://insights.sbomify.com/CVE-2026-82384/): Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint (critical 9.8)
- [CVE-2026-82383](https://insights.sbomify.com/CVE-2026-82383/): Apache Roller: Anonymous setup action allows frontpage configuration tampering (high 8.2)
- [CVE-2026-82382](https://insights.sbomify.com/CVE-2026-82382/): Apache Roller: Reflected cross-site scripting in the frontpage directory parameter (medium 6.1)
- [CVE-2026-82381](https://insights.sbomify.com/CVE-2026-82381/): Apache Roller: Stored cross-site scripting in the authoring UI (medium 5.4)
- [CVE-2026-82380](https://insights.sbomify.com/CVE-2026-82380/): Apache Roller: CSRF protection bypass via self-generated salt validation (high 8.1)
- [CVE-2026-8238](https://insights.sbomify.com/CVE-2026-8238/): Concrete CMS is vulnerable to IDOR (medium 6.3)
- [CVE-2026-82379](https://insights.sbomify.com/CVE-2026-82379/): Apache Roller: WSSE digest authentication headers can be replayed (high 7.7)
- [CVE-2026-82378](https://insights.sbomify.com/CVE-2026-82378/): Apache Roller: OAuth authorization endpoint trusts request-supplied identity (critical 9.0)
- [CVE-2026-82377](https://insights.sbomify.com/CVE-2026-82377/): Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers (critical 9.9)
- [CVE-2026-82376](https://insights.sbomify.com/CVE-2026-82376/): Apache Roller: XML external entity processing in trackback response parser (high 7.7)
- [CVE-2026-82375](https://insights.sbomify.com/CVE-2026-82375/): Apache Roller: Server-side request forgery via entry trackback and enclosure URLs (high 7.4)
- [CVE-2026-82372](https://insights.sbomify.com/CVE-2026-82372/): Improper handling of sensitive data during IPsec policy creation and modification in Brocade SANnav before 3.0.1.a (high 8.5)
- [CVE-2026-82371](https://insights.sbomify.com/CVE-2026-82371/): Plaintext exposure of sensitive authentication data in SANnav discovery service log files (high 8.5)
- [CVE-2026-82370](https://insights.sbomify.com/CVE-2026-82370/): Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service (high 8.6)
- [CVE-2026-8237](https://insights.sbomify.com/CVE-2026-8237/): Concrete CMS 9.5.0 and below is vulnerable to IDOR in the`/ccm/frontend/conversations/message_detail` endpoint (medium 6.3)
- [CVE-2026-82369](https://insights.sbomify.com/CVE-2026-82369/): Insufficient input sanitization of shell metacharacters in Brocade SANnav before 3.0.1a (high 8.6)
- [CVE-2026-82368](https://insights.sbomify.com/CVE-2026-82368/): Missing authorization in SANnav (high 8.7)
- [CVE-2026-82367](https://insights.sbomify.com/CVE-2026-82367/): Re-entrant synchronous publish in AshGraphql subscription batcher delivers one subscriber's records to another's topic (low 2.3)
- [CVE-2026-82364](https://insights.sbomify.com/CVE-2026-82364/): macrozheng mall Order Submission submit race condition (low 2.3)
- [CVE-2026-8236](https://insights.sbomify.com/CVE-2026-8236/): Concrete CMS is vulnerable to IDOR combined with a missing authentication gate (medium 6.3)
- [CVE-2026-82358](https://insights.sbomify.com/CVE-2026-82358/): RT-Labs AB C-Open CANopen SDO Server Write Protection Bypass (high 7.1)
- [CVE-2026-82357](https://insights.sbomify.com/CVE-2026-82357/): RT-Labs AB C-Open CANopen NULL pointer dereference (high 7.1)
- [CVE-2026-82356](https://insights.sbomify.com/CVE-2026-82356/): Imprivata EAM: Unrotatable X.509 RSA Key Pair in Production (high 7.5)
- [CVE-2026-82355](https://insights.sbomify.com/CVE-2026-82355/): Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation (medium 4.2)
- [CVE-2026-8235](https://insights.sbomify.com/CVE-2026-8235/): 8421bit MiniClaw System kernel.ts resolveSkillScriptPath os command injection (medium 5.1)
- [CVE-2026-82348](https://insights.sbomify.com/CVE-2026-82348/): Apache Roller: Cross-weblog resource tampering via unscoped authoring lookups (high 7.7)
- [CVE-2026-82346](https://insights.sbomify.com/CVE-2026-82346/): HP ImageDiags - Potential Escalation of Privilege (high 7.0)
- [CVE-2026-82344](https://insights.sbomify.com/CVE-2026-82344/): IBM Guardium Data Protection Buffer Overflow (high 8.1)
- [CVE-2026-82343](https://insights.sbomify.com/CVE-2026-82343/): Gimp: heap out-of-bounds read and stack out-of-bounds access in psd loader from channel-count handling (medium 6.1)
- [CVE-2026-82340](https://insights.sbomify.com/CVE-2026-82340/): IBM Guardium Data Protection is affected by multiple vulnerabilities. (critical 9.8)
- [CVE-2026-8234](https://insights.sbomify.com/CVE-2026-8234/): EFM ipTIME A8004T WifiBasicSet formWifiBasicSet stack-based overflow (high 8.7)
- [CVE-2026-82335](https://insights.sbomify.com/CVE-2026-82335/): IBM Guardium Data Protection Buffer Overflow (high 8.1)
- [CVE-2026-82334](https://insights.sbomify.com/CVE-2026-82334/): IBM Guardium Data Protection Out-of-bounds Read (high 8.1)
- [CVE-2026-82333](https://insights.sbomify.com/CVE-2026-82333/): multer vulnerable to Denial of Service via oversized array index in field names (high 7.5)
- [CVE-2026-82332](https://insights.sbomify.com/CVE-2026-82332/): Fireware OS Improper Authentication in AuthPoint MFA Verification Allows Session Hijacking (medium 5.6)
- [CVE-2026-82331](https://insights.sbomify.com/CVE-2026-82331/): Apache BuildStream: tar source extraction escape (critical 9.8)
- [CVE-2026-82330](https://insights.sbomify.com/CVE-2026-82330/): Gimp: heap out-of-bounds read in pvr vq (compressed) decoder due to missing bounds check (medium 6.1)
- [CVE-2026-8233](https://insights.sbomify.com/CVE-2026-8233/): Dotouch XproUPF access control (low 2.1)
- [CVE-2026-82329](https://insights.sbomify.com/CVE-2026-82329/): JFrog Artifactory Improper Authentication (critical 9.8, exploited in the wild)
- [CVE-2026-82328](https://insights.sbomify.com/CVE-2026-82328/): Gimp: heap out-of-bounds read in ico loader via unvalidated used_clrs palette count (medium 6.1)
- [CVE-2026-82327](https://insights.sbomify.com/CVE-2026-82327/): Memory corruption in Red Hat Enterprise Linux 10 (medium 5.5)
- [CVE-2026-82326](https://insights.sbomify.com/CVE-2026-82326/): HTML Injection in Enocta Educational's Enocta Platform (medium 4.1)
- [CVE-2026-82325](https://insights.sbomify.com/CVE-2026-82325/): Use after free in ovpn-dco-win (medium 6.8)
- [CVE-2026-82324](https://insights.sbomify.com/CVE-2026-82324/): Gimp: heap out-of-bounds reads in iff/ilbm loader from ham row size mismatch and nplanes=0 (medium 6.1)
- [CVE-2026-82323](https://insights.sbomify.com/CVE-2026-82323/): Improper Authorization in Enocta Educational's Enocta Platform (high 8.1)
- [CVE-2026-8232](https://insights.sbomify.com/CVE-2026-8232/): Dotouch XproUPF UPF Process libvlib.so vlib_worker_loop denial of service (medium 5.1)
- [CVE-2026-82312](https://insights.sbomify.com/CVE-2026-82312/): Misconfiguration in OpenVPN (low 1.8)
- [CVE-2026-82311](https://insights.sbomify.com/CVE-2026-82311/): Auth bypass in Apache Airflow FAB provider (critical 9.8)
- [CVE-2026-82310](https://insights.sbomify.com/CVE-2026-82310/): Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT access (high 7.2)
- [CVE-2026-8231](https://insights.sbomify.com/CVE-2026-8231/): CodeAstro Online Catering Ordering System deleteorder.php sql injection (medium 5.3)
- [CVE-2026-82309](https://insights.sbomify.com/CVE-2026-82309/): Robots::Validate versions from 0.3.2 before 0.3.11 for Perl allow unbounded outbound DNS queries per validation via a forward-confirmation l (medium 4.3)
- [CVE-2026-82307](https://insights.sbomify.com/CVE-2026-82307/): Multiple Vulnerabilities in Dolusoft Software's SOPLOG (critical 9.8)
- [CVE-2026-82306](https://insights.sbomify.com/CVE-2026-82306/): StarRocks Query Detail Endpoint Returns Every User's Query History (medium 6.5)
- [CVE-2026-82305](https://insights.sbomify.com/CVE-2026-82305/): YITH WooCommerce Wishlist < 4.18.1 - Unauthenticated Arbitrary Wishlist Rename via change_wishlist_title (medium 5.3)
- [CVE-2026-82304](https://insights.sbomify.com/CVE-2026-82304/): Music Store – WordPress eCommerce < 1.4.5 - Unauthenticated SQLi via paypal-data Handler (high 8.6)
- [CVE-2026-82302](https://insights.sbomify.com/CVE-2026-82302/): Incorrect Authorization in Kibana Leading to Unauthorized Configuration Modification (high 8.1)
- [CVE-2026-82300](https://insights.sbomify.com/CVE-2026-82300/): Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service (medium 6.5)
- [CVE-2026-8230](https://insights.sbomify.com/CVE-2026-8230/): Wavlink NU516U1 login.cgi sys_login1 os command injection (medium 5.3)
- [CVE-2026-82299](https://insights.sbomify.com/CVE-2026-82299/): Incorrect Authorization in Kibana Leading to Information Disclosure (medium 6.5)
- [CVE-2026-82298](https://insights.sbomify.com/CVE-2026-82298/): Incorrect Authorization in Kibana Leading to Denial of Service (medium 4.3)
- [CVE-2026-82294](https://insights.sbomify.com/CVE-2026-82294/): Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service (medium 6.5)
- [CVE-2026-82293](https://insights.sbomify.com/CVE-2026-82293/): Incorrect Authorization in Kibana Leading to Unauthorized Resource Consumption (medium 4.3)
- [CVE-2026-82291](https://insights.sbomify.com/CVE-2026-82291/): HeyForm Reflects Any Origin in CORS Responses While Allowing Credentials (high 8.1)
- [CVE-2026-82290](https://insights.sbomify.com/CVE-2026-82290/): Chainlit Feedback Endpoints Missing Ownership Validation (medium 6.0)
- [CVE-2026-8229](https://insights.sbomify.com/CVE-2026-8229/): Wavlink NU516U1 wireless.cgi WifiBasic os command injection (medium 5.3)
- [CVE-2026-82289](https://insights.sbomify.com/CVE-2026-82289/): Gitingest Prefix-Based Git Host Check Enables Request Forgery and Token Disclosure (high 8.3)
- [CVE-2026-82288](https://insights.sbomify.com/CVE-2026-82288/): Stable Diffusion WebUI Credential Disclosure via /sdapi/v1/cmd-flags (high 8.7)
- [CVE-2026-82287](https://insights.sbomify.com/CVE-2026-82287/): Rybbit Reflects Any Origin in CORS Responses While Allowing Credentials (high 8.6)
- [CVE-2026-82286](https://insights.sbomify.com/CVE-2026-82286/): gpt-crawler Arbitrary File Write via outputFileName Parameter (high 8.8)
- [CVE-2026-82285](https://insights.sbomify.com/CVE-2026-82285/): BISHENG Unauthenticated Server-Side Request Forgery via Workflow Report Callback (high 8.8)
- [CVE-2026-82284](https://insights.sbomify.com/CVE-2026-82284/): Quivr Chat Endpoints Missing Ownership Validation (high 8.6)
- [CVE-2026-82283](https://insights.sbomify.com/CVE-2026-82283/): VoltAgent Memory API Handlers Missing Ownership Checks (high 8.6)
- [CVE-2026-82282](https://insights.sbomify.com/CVE-2026-82282/): Atlantis GitHub App Setup Endpoint Returns App Credentials to Unauthenticated Callers (high 8.8)
- [CVE-2026-82281](https://insights.sbomify.com/CVE-2026-82281/): Kotaemon Missing Ownership Check in Conversation Functions (critical 9.1)
- [CVE-2026-82280](https://insights.sbomify.com/CVE-2026-82280/): Quivr Prompt Endpoints Missing Ownership Validation (high 7.1)
- [CVE-2026-8228](https://insights.sbomify.com/CVE-2026-8228/): Wavlink NU516U1 wireless.cgi advance os command injection (medium 5.3)
- [CVE-2026-82279](https://insights.sbomify.com/CVE-2026-82279/): HyperDX Team Management Operations Missing Role-Based Access Control (high 7.2)
- [CVE-2026-82278](https://insights.sbomify.com/CVE-2026-82278/): BISHENG Authenticated Arbitrary Python Code Execution via Workflow run_once (high 8.7)
- [CVE-2026-82277](https://insights.sbomify.com/CVE-2026-82277/): Argo Rollouts Dashboard Unauthenticated Mutating Operations (critical 9.3)
- [CVE-2026-82276](https://insights.sbomify.com/CVE-2026-82276/): StarRocks Frontend REST Handlers Bypass the Base Class Authentication Gate (medium 5.3)
- [CVE-2026-82275](https://insights.sbomify.com/CVE-2026-82275/): Qwen-Agent Arbitrary File Read via Caller-Supplied Document Path (high 8.7)
- [CVE-2026-82274](https://insights.sbomify.com/CVE-2026-82274/): Twenty Open Redirect via OAuth Propagator Callback (medium 5.3)
- [CVE-2026-82273](https://insights.sbomify.com/CVE-2026-82273/): Mastra Memory API Thread Ownership Check Is a No-op When mapUserToResourceId Is Unset (high 7.1)
- [CVE-2026-82272](https://insights.sbomify.com/CVE-2026-82272/): Immich Locked Assets Remain Readable Through Albums and Shared Links (high 7.1)
- [CVE-2026-82271](https://insights.sbomify.com/CVE-2026-82271/): R2R Missing Ownership Check Allows Modifying Other Users' Conversations (high 7.1)
- [CVE-2026-82270](https://insights.sbomify.com/CVE-2026-82270/): Portkey AI Gateway Server-Side Request Forgery via /v1/proxy/* (high 8.7)
- [CVE-2026-8227](https://insights.sbomify.com/CVE-2026-8227/): Wavlink NU516U1 adm.cgi wzdapMesh os command injection (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/334/