# Vulnerabilities published in 2026


- [CVE-2026-79867](https://insights.sbomify.com/CVE-2026-79867/): Authentication Bypass Leading to Remote Code Execution in AOS-8 (critical 9.6)
- [CVE-2026-79866](https://insights.sbomify.com/CVE-2026-79866/): Unauthenticated Adjacent Path Traversal Vulnerability leads to Filesystem Compromise in AOS-8 (critical 9.6)
- [CVE-2026-79865](https://insights.sbomify.com/CVE-2026-79865/): Unauthenticated Adjacent Memory Corruption Vulnerability leads to Remote Code Execution in AOS-10 (critical 9.6)
- [CVE-2026-79864](https://insights.sbomify.com/CVE-2026-79864/): Unauthenticated Adjacent Command Injection Vulnerability in AOS-10 (critical 9.6)
- [CVE-2026-79863](https://insights.sbomify.com/CVE-2026-79863/): Unauthenticated Adjacent Buffer Overflow Vulnerabilities lead to Remote Code Execution (critical 9.6)
- [CVE-2026-79862](https://insights.sbomify.com/CVE-2026-79862/): Unauthenticated Adjacent Buffer Overflow Vulnerabilities lead to Remote Code Execution (critical 9.6)
- [CVE-2026-79861](https://insights.sbomify.com/CVE-2026-79861/): Unauthenticated Command Injection Vulnerability in the PAPI Protocol of AOS-10 (critical 9.8)
- [CVE-2026-79860](https://insights.sbomify.com/CVE-2026-79860/): Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-8 (critical 9.8)
- [CVE-2026-7986](https://insights.sbomify.com/CVE-2026-7986/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2026-79859](https://insights.sbomify.com/CVE-2026-79859/): Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-8 (critical 9.8)
- [CVE-2026-79858](https://insights.sbomify.com/CVE-2026-79858/): Unauthenticated SQL Injection Vulnerability in the PAPI Protocol of AOS-8 (critical 9.8)
- [CVE-2026-79857](https://insights.sbomify.com/CVE-2026-79857/): Unauthenticated Command Injection Vulnerability in AOS-8 PAPI Protocol (critical 9.8)
- [CVE-2026-79856](https://insights.sbomify.com/CVE-2026-79856/): Unauthenticated Buffer Overflow Vulnerability leads to Authentication Bypass in AOS-8 (critical 9.8)
- [CVE-2026-79855](https://insights.sbomify.com/CVE-2026-79855/): Authentication Bypass in the SSH Daemon of AOS-8 leads to Complete System Compromise (critical 9.8)
- [CVE-2026-79854](https://insights.sbomify.com/CVE-2026-79854/): Unauthenticated SQL Injection Vulnerability leads to Remote Code Execution in AOS-10 (critical 9.8)
- [CVE-2026-79853](https://insights.sbomify.com/CVE-2026-79853/): Unauthenticated Sensitive Information Disclosure leads to Remote Code Execution in AOS-10 (critical 9.8)
- [CVE-2026-79852](https://insights.sbomify.com/CVE-2026-79852/): Unauthenticated SQL Injection allows Remote Code Execution in AOS Web-Based Management Interface (critical 9.8)
- [CVE-2026-79851](https://insights.sbomify.com/CVE-2026-79851/): Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-10 (critical 10.0)
- [CVE-2026-79850](https://insights.sbomify.com/CVE-2026-79850/): Authentication Bypass Leading to Remote Code Execution in AOS-8 (critical 10.0)
- [CVE-2026-7985](https://insights.sbomify.com/CVE-2026-7985/): Use after free in Chrome (high 8.3)
- [CVE-2026-79849](https://insights.sbomify.com/CVE-2026-79849/): Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8 (critical 10.0)
- [CVE-2026-79848](https://insights.sbomify.com/CVE-2026-79848/): Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8 (critical 10.0)
- [CVE-2026-79847](https://insights.sbomify.com/CVE-2026-79847/): Unauthenticated Buffer Overflow Vulnerabilities leads to Remote Code Execution in AOS-10 (critical 10.0)
- [CVE-2026-79846](https://insights.sbomify.com/CVE-2026-79846/): Unauthenticated Command Injection Vulnerabilities in AOS-8 (critical 10.0)
- [CVE-2026-79845](https://insights.sbomify.com/CVE-2026-79845/): code-projects Simple Inventory System edit.php sql injection (medium 6.9)
- [CVE-2026-79844](https://insights.sbomify.com/CVE-2026-79844/): Authentication Bypass Leading to Remote Code Execution in AOS-10 (critical 10.0)
- [CVE-2026-79843](https://insights.sbomify.com/CVE-2026-79843/): HPE NonStop SQL/MX EXE - out-of-bounds read vulnerability (medium 6.5)
- [CVE-2026-79842](https://insights.sbomify.com/CVE-2026-79842/): Auth bypass in HPE Intelligent Management Center (iMC) (critical 9.1)
- [CVE-2026-79841](https://insights.sbomify.com/CVE-2026-79841/): HPE NonStop RDMA SERVICES NSK - Out-of-bounds memory write vulnerability (medium 5.8)
- [CVE-2026-79840](https://insights.sbomify.com/CVE-2026-79840/): HPE NonStop XABroker - Memory corruption vulnerability (high 7.3)
- [CVE-2026-7984](https://insights.sbomify.com/CVE-2026-7984/): Use after free in Chrome (high 8.8)
- [CVE-2026-79839](https://insights.sbomify.com/CVE-2026-79839/): HPE NonStop ODBC/MX Server - Memory corruption vulnerability (high 7.3)
- [CVE-2026-79838](https://insights.sbomify.com/CVE-2026-79838/): HPE NonStop ODBC/MX Services - Memory corruption vulnerability (high 7.3)
- [CVE-2026-79837](https://insights.sbomify.com/CVE-2026-79837/): HPE NonStop SQL/MX UDR SERVER - Service disruption vulnerability (high 7.3)
- [CVE-2026-79836](https://insights.sbomify.com/CVE-2026-79836/): HPE NonStop SQL/MX Run-Time Statistics - Information disclosure and DoS vulnerability (medium 6.4)
- [CVE-2026-79835](https://insights.sbomify.com/CVE-2026-79835/): HPE Nonstop KMS Server - Buffer overflow vulnerability (low 2.8)
- [CVE-2026-79834](https://insights.sbomify.com/CVE-2026-79834/): HPE NonStop SQL/MX SQLCAT - Unauthorized command execution vulnerability (high 7.4)
- [CVE-2026-79833](https://insights.sbomify.com/CVE-2026-79833/): HPE NonStop ANSI SQLUTIL - Denial of Service vulnerability (high 7.5)
- [CVE-2026-79832](https://insights.sbomify.com/CVE-2026-79832/): HPE NonStop SQL/MX Executor - Buffer overflow vulnerability (high 7.6)
- [CVE-2026-79831](https://insights.sbomify.com/CVE-2026-79831/): HPE NonStop Posix User Threads - Heap buffer overflow vulnerability (medium 6.6)
- [CVE-2026-79830](https://insights.sbomify.com/CVE-2026-79830/): HPE NonStop Kernel Level Thread Model Lib - Stack buffer overflow vulnerability (medium 6.6)
- [CVE-2026-7983](https://insights.sbomify.com/CVE-2026-7983/): Memory corruption in Chrome (medium 4.3)
- [CVE-2026-79829](https://insights.sbomify.com/CVE-2026-79829/): HPE NonStop HTTP WEBSERVER - Memory corruption vulnerability (high 8.2)
- [CVE-2026-79828](https://insights.sbomify.com/CVE-2026-79828/): HPE NonStop Debug Utilities - Heap buffer overflow vulnerability (high 7.1)
- [CVE-2026-79827](https://insights.sbomify.com/CVE-2026-79827/): HPE NonStop Inspect Subsystem - Heap buffer overflow vulnerability (high 7.1)
- [CVE-2026-79826](https://insights.sbomify.com/CVE-2026-79826/): HPE NonStop OCAX - Heap buffer overflow vulnerability (high 7.1)
- [CVE-2026-79825](https://insights.sbomify.com/CVE-2026-79825/): HPE NonStop NDSREST - Heap buffer overflow vulnerability (high 7.1)
- [CVE-2026-79824](https://insights.sbomify.com/CVE-2026-79824/): HPE NonStop Python 3.x - Directory traversal vulnerability (high 8.0)
- [CVE-2026-79823](https://insights.sbomify.com/CVE-2026-79823/): HPE NonStop EMS Distributor - Buffer Overflow vulnerability (medium 4.0)
- [CVE-2026-79822](https://insights.sbomify.com/CVE-2026-79822/): HPE NonStop TNS/X Native Inspect - Execution flow vulnerability (high 7.1)
- [CVE-2026-79821](https://insights.sbomify.com/CVE-2026-79821/): HPE NonStop SOAP 4.0 - Memory corruption (high 8.2)
- [CVE-2026-79820](https://insights.sbomify.com/CVE-2026-79820/): Auth bypass in HPE Integrated Lights-Out (iLO) 7 (critical 9.0)
- [CVE-2026-7982](https://insights.sbomify.com/CVE-2026-7982/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-79818](https://insights.sbomify.com/CVE-2026-79818/): Authentication Bypass in the API Interface Allows Unauthorized Information Disclosure in ClearPass Policy Manager (medium 5.3)
- [CVE-2026-79817](https://insights.sbomify.com/CVE-2026-79817/): Local Disclosure of Sensitive Information in HPE Networking ClearPass Policy Manager Client Software (medium 5.5)
- [CVE-2026-79816](https://insights.sbomify.com/CVE-2026-79816/): Unauthenticated DOM-Based Cross-Site Scripting (XSS) Vulnerability in the ClearPass Policy Manager Client Interface (medium 5.4)
- [CVE-2026-79815](https://insights.sbomify.com/CVE-2026-79815/): Authenticated Command Injection Vulnerability in the ClearPass Policy Manager OnGuard Agent (medium 6.5)
- [CVE-2026-79814](https://insights.sbomify.com/CVE-2026-79814/): Local Arbitrary File Write Leading to Local Privilege Escalation in ClearPass Policy Manager OnGuard Agent (medium 6.7)
- [CVE-2026-79813](https://insights.sbomify.com/CVE-2026-79813/): Local Privilege Escalation in ClearPass Client Software (medium 6.7)
- [CVE-2026-79812](https://insights.sbomify.com/CVE-2026-79812/): Authenticated Local Denial-of-Service Vulnerability in the OnGuard Agent of ClearPass Policy Manager (medium 6.1)
- [CVE-2026-79811](https://insights.sbomify.com/CVE-2026-79811/): Authenticated SQL Injection allows Remote Code Execution in ClearPass Policy Manager API (high 7.2)
- [CVE-2026-79810](https://insights.sbomify.com/CVE-2026-79810/): Authenticated Remote Code Execution Vulnerabilities in HPE Networking ClearPass Policy Manager (high 7.2)
- [CVE-2026-7981](https://insights.sbomify.com/CVE-2026-7981/): Memory corruption in Chrome (high 8.1)
- [CVE-2026-79809](https://insights.sbomify.com/CVE-2026-79809/): Unauthenticated Path Traversal in ClearPass Policy Manager API Endpoint Leads to Authorization Bypass (high 7.3)
- [CVE-2026-79808](https://insights.sbomify.com/CVE-2026-79808/): Local Authenticated Buffer Overflow Vulnerability in the ClearPass Policy Manager OnGuard Agent (high 7.8)
- [CVE-2026-79807](https://insights.sbomify.com/CVE-2026-79807/): Privilege escalation in ClearPass Policy Manager (CPPM) (high 7.8)
- [CVE-2026-79806](https://insights.sbomify.com/CVE-2026-79806/): Authenticated Local Privilege Escalation in ClearPass Policy Manager OnGuard Linux Agent (high 7.8)
- [CVE-2026-79805](https://insights.sbomify.com/CVE-2026-79805/): Path traversal in ClearPass Policy Manager (CPPM) (critical 9.8)
- [CVE-2026-79804](https://insights.sbomify.com/CVE-2026-79804/): SililaWijesinghe Food Ordering System search.php sql injection (medium 6.9)
- [CVE-2026-79803](https://insights.sbomify.com/CVE-2026-79803/): Authenticated Command Injection Leading to Privilege Escalation in ClearPass Policy Manager API (high 8.8)
- [CVE-2026-79802](https://insights.sbomify.com/CVE-2026-79802/): Command Injection Vulnerability in the ClearPass Policy Manager Client Software (high 8.8)
- [CVE-2026-79801](https://insights.sbomify.com/CVE-2026-79801/): Unauthenticated Missing Integrity Verification allows Remote Code Execution in ClearPass Policy Manager Client Agent (critical 9.8)
- [CVE-2026-79800](https://insights.sbomify.com/CVE-2026-79800/): Authenticated Path Traversal Vulnerability Leads to Remote Code Execution in ClearPass Policy Manager (high 8.8)
- [CVE-2026-7980](https://insights.sbomify.com/CVE-2026-7980/): Use after free in Chrome (high 8.8)
- [CVE-2026-79799](https://insights.sbomify.com/CVE-2026-79799/): Cross-site scripting in ClearPass Policy Manager (CPPM) (high 8.8)
- [CVE-2026-79798](https://insights.sbomify.com/CVE-2026-79798/): Authenticated SQL Injection Vulnerabilities in ClearPass Policy Manager Web-Based Management Interface (critical 9.9)
- [CVE-2026-79797](https://insights.sbomify.com/CVE-2026-79797/): Improper Access Control in HPE Networking ClearPass Android Client Application (high 8.8)
- [CVE-2026-79796](https://insights.sbomify.com/CVE-2026-79796/): Authentication Bypass Vulnerabilities in ClearPass Policy Manager (critical 9.8)
- [CVE-2026-79794](https://insights.sbomify.com/CVE-2026-79794/): Authenticated SQL Injection Vulnerability in ClearPass Policy Manager Web-based Management Interface (critical 9.1)
- [CVE-2026-79793](https://insights.sbomify.com/CVE-2026-79793/): code-projects Online Shopping System sumit_form.php cross site scripting (medium 5.3)
- [CVE-2026-79792](https://insights.sbomify.com/CVE-2026-79792/): zackees transcribe-anything Yt-dlp Download ytldp_download.py ytdlp_download os command injection (medium 6.3)
- [CVE-2026-7979](https://insights.sbomify.com/CVE-2026-7979/): Information disclosure in Chrome (medium 4.3)
- [CVE-2026-79788](https://insights.sbomify.com/CVE-2026-79788/): Dradis Community Edition 5.1.0 through 5.2.0 Server-Side Request Forgery via Unrestricted AI Provider Address (high 7.1)
- [CVE-2026-79787](https://insights.sbomify.com/CVE-2026-79787/): Alluxio through 2.9.5 S3 REST Proxy Authentication Bypass via Unverified Request Signature (critical 9.3)
- [CVE-2026-79786](https://insights.sbomify.com/CVE-2026-79786/): Coroot 1.20.2 through 1.24.5 Unvalidated Redirect URI in MCP OAuth Client Registration (high 7.0)
- [CVE-2026-79785](https://insights.sbomify.com/CVE-2026-79785/): X-AnyLabeling before 4.0.0-beta.9 Improper Certificate Validation in Model Downloads (high 8.2)
- [CVE-2026-79784](https://insights.sbomify.com/CVE-2026-79784/): Vocos through 0.1.0 Arbitrary Code Execution via Unrestricted class_path in Model Configuration (high 8.6)
- [CVE-2026-79783](https://insights.sbomify.com/CVE-2026-79783/): rclone before 1.74.4 Privilege Escalation via setuid Metadata (low 2.0)
- [CVE-2026-79782](https://insights.sbomify.com/CVE-2026-79782/): rclone before 1.74.4 Security Token Disclosure via HTTPS to HTTP Redirect (critical 9.3)
- [CVE-2026-79781](https://insights.sbomify.com/CVE-2026-79781/): rclone serve s3 Path Traversal via dot-dot object keys (medium 6.9)
- [CVE-2026-79780](https://insights.sbomify.com/CVE-2026-79780/): rclone before v1.75.0 Credential Exposure via S3 Redirect (medium 6.0)
- [CVE-2026-7978](https://insights.sbomify.com/CVE-2026-7978/): Privilege escalation in Chrome (high 8.1)
- [CVE-2026-79779](https://insights.sbomify.com/CVE-2026-79779/): rclone before v1.75.0 WebDAV Credential Exposure via HTTPS-to-HTTP Redirect (medium 6.0)
- [CVE-2026-79778](https://insights.sbomify.com/CVE-2026-79778/): rclone before v1.75.0 Denial of Service via TUS nil-response panic (medium 6.0)
- [CVE-2026-79777](https://insights.sbomify.com/CVE-2026-79777/): rclone before v1.75.0 Information Disclosure via RC API (medium 5.1)
- [CVE-2026-79776](https://insights.sbomify.com/CVE-2026-79776/): rclone before 1.75.0 Authentication Bypass via pprof (medium 6.9)
- [CVE-2026-79775](https://insights.sbomify.com/CVE-2026-79775/): rclone Archive Backend SquashFS Parser Denial of Service (high 7.1)
- [CVE-2026-79774](https://insights.sbomify.com/CVE-2026-79774/): Winter CMS before 1.2.13 Twig Sandbox Escape via SecurityPolicy (critical 9.3)
- [CVE-2026-79773](https://insights.sbomify.com/CVE-2026-79773/): Winter CMS before 1.2.13 Local File Inclusion via JavaScript (medium 6.9)
- [CVE-2026-79772](https://insights.sbomify.com/CVE-2026-79772/): Nokogiri before 1.19.1 Unchecked Return Value canonicalize (medium 6.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/353/