# Vulnerabilities published in 2026


- [CVE-2026-77557](https://insights.sbomify.com/CVE-2026-77557/): Privilege escalation in UniFi Protect AI Key (critical 9.8)
- [CVE-2026-77556](https://insights.sbomify.com/CVE-2026-77556/): Memory corruption in Cloud Gateways (high 7.5)
- [CVE-2026-77555](https://insights.sbomify.com/CVE-2026-77555/): Memory corruption in Cloud Gateways (high 7.5)
- [CVE-2026-77554](https://insights.sbomify.com/CVE-2026-77554/): Command injection in UniFi Talk Application (critical 10.0)
- [CVE-2026-77553](https://insights.sbomify.com/CVE-2026-77553/): Privilege escalation in UniFi Access Application (critical 9.9)
- [CVE-2026-77552](https://insights.sbomify.com/CVE-2026-77552/): Command injection in UniFi Enterprise Audio/Video Bridge (critical 9.8)
- [CVE-2026-77551](https://insights.sbomify.com/CVE-2026-77551/): Privilege escalation in UniFi Connect Display Cast Pro (critical 9.0)
- [CVE-2026-77550](https://insights.sbomify.com/CVE-2026-77550/): Auth bypass in Cloud Gateways (critical 10.0)
- [CVE-2026-7755](https://insights.sbomify.com/CVE-2026-7755/): MCP Server Configuration Validator Bypass via File Upload API (high 8.8)
- [CVE-2026-77549](https://insights.sbomify.com/CVE-2026-77549/): Auth bypass in Cloud Gateways (critical 9.0)
- [CVE-2026-77548](https://insights.sbomify.com/CVE-2026-77548/): Command injection in UniFi Protect Application (critical 9.9)
- [CVE-2026-77547](https://insights.sbomify.com/CVE-2026-77547/): Command injection in UniFi Access Application (critical 9.9)
- [CVE-2026-77546](https://insights.sbomify.com/CVE-2026-77546/): Command injection in UniFi Access Application (critical 9.9)
- [CVE-2026-77545](https://insights.sbomify.com/CVE-2026-77545/): Privilege escalation in Cloud Gateways (critical 9.0)
- [CVE-2026-77544](https://insights.sbomify.com/CVE-2026-77544/): Memory corruption in Cloud Gateways (high 7.5)
- [CVE-2026-77543](https://insights.sbomify.com/CVE-2026-77543/): Command injection in UniFi Access Application (critical 9.9)
- [CVE-2026-77542](https://insights.sbomify.com/CVE-2026-77542/): Command injection in UID Enterprise Agent (critical 9.1)
- [CVE-2026-77541](https://insights.sbomify.com/CVE-2026-77541/): Privilege escalation in UniFi Network Application (critical 9.1)
- [CVE-2026-77540](https://insights.sbomify.com/CVE-2026-77540/): Command injection in UniFi OS Server (critical 9.1)
- [CVE-2026-7754](https://insights.sbomify.com/CVE-2026-7754/): SSRF Protection Configuration Vulnerability (high 7.7)
- [CVE-2026-77539](https://insights.sbomify.com/CVE-2026-77539/): Command injection in UniFi OS Server (critical 9.1)
- [CVE-2026-77538](https://insights.sbomify.com/CVE-2026-77538/): Privilege escalation in UniFi Connect Application (high 8.2)
- [CVE-2026-77537](https://insights.sbomify.com/CVE-2026-77537/): Command injection in UniFi Protect Application (critical 10.0)
- [CVE-2026-77536](https://insights.sbomify.com/CVE-2026-77536/): Privilege escalation in Cloud Gateways (critical 9.9)
- [CVE-2026-77535](https://insights.sbomify.com/CVE-2026-77535/): Command injection in UniFi Network Application (critical 9.1)
- [CVE-2026-77534](https://insights.sbomify.com/CVE-2026-77534/): Privilege escalation in Cloud Gateways (critical 9.9)
- [CVE-2026-77533](https://insights.sbomify.com/CVE-2026-77533/): Command injection in UniFi Protect Application (critical 9.9)
- [CVE-2026-77532](https://insights.sbomify.com/CVE-2026-77532/): Memory corruption in EdgeMAX EdgeSwitch (high 8.8)
- [CVE-2026-7753](https://insights.sbomify.com/CVE-2026-7753/): Missing authorization in Cost Calculator Builder (medium 6.5)
- [CVE-2026-77528](https://insights.sbomify.com/CVE-2026-77528/): Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation (medium 5.3)
- [CVE-2026-77525](https://insights.sbomify.com/CVE-2026-77525/): MaxKB: Management chat-record routes trust path application_id but load ChatRecord by global chat_id (medium 4.2)
- [CVE-2026-77524](https://insights.sbomify.com/CVE-2026-77524/): KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication (critical 9.9)
- [CVE-2026-77523](https://insights.sbomify.com/CVE-2026-77523/): MaxKB: Cross-workspace model parameter form write (high 7.4)
- [CVE-2026-77522](https://insights.sbomify.com/CVE-2026-77522/): Server-side request forgery in MaxKB (medium 4.3)
- [CVE-2026-77521](https://insights.sbomify.com/CVE-2026-77521/): MaxKB: Prompt-injectable agent can lead to command execution (critical 10.0)
- [CVE-2026-77520](https://insights.sbomify.com/CVE-2026-77520/): Missing authorization in MaxKB (medium 5.4)
- [CVE-2026-77519](https://insights.sbomify.com/CVE-2026-77519/): MaxKB: Expired application API keys remain usable on `/chat/api/mcp` (medium 5.4)
- [CVE-2026-77518](https://insights.sbomify.com/CVE-2026-77518/): MaxKB: Known MCP tool IDs expose owner Tool.code and can be referenced by attacker workflows (medium 5.0)
- [CVE-2026-77517](https://insights.sbomify.com/CVE-2026-77517/): MaxKB cross-knowledge IDOR lets a normal user read and modify documents and paragraphs in another knowledge base (medium 5.4)
- [CVE-2026-77516](https://insights.sbomify.com/CVE-2026-77516/): MaxKB: Missing per-tool authorization in the agent and workflow tool-dispatch path (medium 5.4)
- [CVE-2026-77508](https://insights.sbomify.com/CVE-2026-77508/): Weblate: Unverified REST API email changes (low 3.5)
- [CVE-2026-77507](https://insights.sbomify.com/CVE-2026-77507/): Weblate: Object-scoped RSS feeds disclose private change history to unauthorized users (medium 5.3)
- [CVE-2026-77506](https://insights.sbomify.com/CVE-2026-77506/): Cross-site scripting in Znuny (medium 4.8)
- [CVE-2026-77505](https://insights.sbomify.com/CVE-2026-77505/): Windows DNS Server Remote Code Execution Vulnerability (high 8.1)
- [CVE-2026-77504](https://insights.sbomify.com/CVE-2026-77504/): Microsoft Office Word Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-77503](https://insights.sbomify.com/CVE-2026-77503/): Windows NTFS Elevation of Privilege Vulnerability (high 8.4)
- [CVE-2026-77502](https://insights.sbomify.com/CVE-2026-77502/): Windows DHCP Server Denial of Service Vulnerability (high 7.5)
- [CVE-2026-77501](https://insights.sbomify.com/CVE-2026-77501/): Windows DHCP Server Denial of Service Vulnerability (high 7.5)
- [CVE-2026-77500](https://insights.sbomify.com/CVE-2026-77500/): Windows Device Association Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-7750](https://insights.sbomify.com/CVE-2026-7750/): Totolink N300RH POST Request cstecgi.cgi setMacFilterRules buffer overflow (high 8.7)
- [CVE-2026-77499](https://insights.sbomify.com/CVE-2026-77499/): Windows DHCP Server Denial of Service Vulnerability (high 7.5)
- [CVE-2026-77498](https://insights.sbomify.com/CVE-2026-77498/): Windows DHCP Server Denial of Service Vulnerability (high 7.5)
- [CVE-2026-77496](https://insights.sbomify.com/CVE-2026-77496/): Windows Imaging Component Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-77495](https://insights.sbomify.com/CVE-2026-77495/): Windows Imaging Component Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-77494](https://insights.sbomify.com/CVE-2026-77494/): Windows DHCP Server Denial of Service Vulnerability (high 7.5)
- [CVE-2026-77493](https://insights.sbomify.com/CVE-2026-77493/): Windows Graphics Component Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-77492](https://insights.sbomify.com/CVE-2026-77492/): Windows Storage Port Driver Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-77491](https://insights.sbomify.com/CVE-2026-77491/): Windows GDI Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-77490](https://insights.sbomify.com/CVE-2026-77490/): Microsoft Edge (Chromium-based) Spoofing Vulnerability (medium 6.1)
- [CVE-2026-7749](https://insights.sbomify.com/CVE-2026-7749/): Totolink N300RH POST Request cstecgi.cgi setWanConfig buffer overflow (high 8.7)
- [CVE-2026-77489](https://insights.sbomify.com/CVE-2026-77489/): Windows Biometric Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-77488](https://insights.sbomify.com/CVE-2026-77488/): Microsoft SQL Server Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-77487](https://insights.sbomify.com/CVE-2026-77487/): SQL Server Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-77486](https://insights.sbomify.com/CVE-2026-77486/): Microsoft SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-77485](https://insights.sbomify.com/CVE-2026-77485/): SQL Server Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-77484](https://insights.sbomify.com/CVE-2026-77484/): Microsoft SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-77483](https://insights.sbomify.com/CVE-2026-77483/): SQL Server Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-77482](https://insights.sbomify.com/CVE-2026-77482/): Microsoft SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-77481](https://insights.sbomify.com/CVE-2026-77481/): Microsoft SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-77480](https://insights.sbomify.com/CVE-2026-77480/): SQL Server Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-7748](https://insights.sbomify.com/CVE-2026-7748/): Totolink N300RH POST Request cstecgi.cgi setUpgradeFW buffer overflow (high 8.7)
- [CVE-2026-77474](https://insights.sbomify.com/CVE-2026-77474/): Denial of service in destructive command guard (high 7.1)
- [CVE-2026-77470](https://insights.sbomify.com/CVE-2026-77470/): Business logic in Lychee (high 8.3)
- [CVE-2026-7747](https://insights.sbomify.com/CVE-2026-7747/): Totolink N300RH Parameter cstecgi.cgi loginauth buffer overflow (critical 9.3)
- [CVE-2026-77468](https://insights.sbomify.com/CVE-2026-77468/): Information disclosure in Lychee (medium 6.9)
- [CVE-2026-77467](https://insights.sbomify.com/CVE-2026-77467/): Lychee: A single 383-byte PDF causes ~184 seconds of CPU consumption in the real processing path (high 7.1)
- [CVE-2026-77466](https://insights.sbomify.com/CVE-2026-77466/): Lychee: Webshop payment bypass via unrestricted "Dummy" gateway selection (high 8.3)
- [CVE-2026-77465](https://insights.sbomify.com/CVE-2026-77465/): toml-node: Uncontrolled Recursion (high 7.5)
- [CVE-2026-77460](https://insights.sbomify.com/CVE-2026-77460/): EspoCRM: Mass email template renderer leaks restricted record fields (medium 6.5)
- [CVE-2026-7746](https://insights.sbomify.com/CVE-2026-7746/): SourceCodester Web-based Pharmacy Product Management System edit-admin.php sql injection (medium 5.3)
- [CVE-2026-77459](https://insights.sbomify.com/CVE-2026-77459/): Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks (critical 9.9)
- [CVE-2026-77454](https://insights.sbomify.com/CVE-2026-77454/): exists/2 predicate silently dropped on limited relationships with a parent() filter in AshSql (medium 5.9)
- [CVE-2026-7745](https://insights.sbomify.com/CVE-2026-7745/): CodeAstro Online Classroom facultydetails sql injection (medium 5.3)
- [CVE-2026-7744](https://insights.sbomify.com/CVE-2026-7744/): CodeAstro Online Classroom addnewstudent sql injection (medium 5.3)
- [CVE-2026-77438](https://insights.sbomify.com/CVE-2026-77438/): Trilium unauthenticated share-search discloses password-protected and hidden shared notes (high 7.5)
- [CVE-2026-7743](https://insights.sbomify.com/CVE-2026-7743/): CodeAstro Online Classroom studentdetails sql injection (medium 5.3)
- [CVE-2026-77427](https://insights.sbomify.com/CVE-2026-77427/): FileRise: Insecure default cryptographic key fallback in manual installs (medium 5.9)
- [CVE-2026-77426](https://insights.sbomify.com/CVE-2026-77426/): Unleash: Missing await on permission check + cross-project IDOR in admin API (high 7.1)
- [CVE-2026-77425](https://insights.sbomify.com/CVE-2026-77425/): Unleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write), bypassing project RBAC and the audit log (medium 4.3)
- [CVE-2026-77423](https://insights.sbomify.com/CVE-2026-77423/): JLine: ReDoS in Built-in Less Viewer Search (high 7.5)
- [CVE-2026-77422](https://insights.sbomify.com/CVE-2026-77422/): JLine: ReDoS in Built-in grep Command Amplified by Automatic `.*` Wrapping (high 7.5)
- [CVE-2026-77421](https://insights.sbomify.com/CVE-2026-77421/): JLine: ReDoS in Nano Editor Regex Search Mode (medium 6.5)
- [CVE-2026-77420](https://insights.sbomify.com/CVE-2026-77420/): JLine: ReDoS via `HISTORY_IGNORE` Configuration Variable (medium 5.5)
- [CVE-2026-7742](https://insights.sbomify.com/CVE-2026-7742/): CodeAstro Online Classroom facultylogin sql injection (medium 5.3)
- [CVE-2026-77415](https://insights.sbomify.com/CVE-2026-77415/): JSONata: Arbitrary Code Execution via crafted JSONata expressions (critical 9.3)
- [CVE-2026-77414](https://insights.sbomify.com/CVE-2026-77414/): JSONata: Arbitrary Code Execution via crafted JSONata expressions (critical 9.3)
- [CVE-2026-77413](https://insights.sbomify.com/CVE-2026-77413/): JSONata: Arbitrary Code Execution via crafted JSONata expressions (critical 9.3)
- [CVE-2026-77412](https://insights.sbomify.com/CVE-2026-77412/): RabbitMQ amqp091-go: Denial of Service via Malicious Field Length in AMQP Client (high 8.9)
- [CVE-2026-77411](https://insights.sbomify.com/CVE-2026-77411/): RabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstr (critical 9.5)
- [CVE-2026-77410](https://insights.sbomify.com/CVE-2026-77410/): RabbitMQ amqp091-go: Resource Exhaustion (OOM) via Unbounded Body Buffer Allocation (high 8.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/369/