# Vulnerabilities published in 2026


- [CVE-2026-74881](https://insights.sbomify.com/CVE-2026-74881/): openssl_encrypt before 1.4.0 CORS Misconfiguration via Wildcard Origins (high 7.1)
- [CVE-2026-74880](https://insights.sbomify.com/CVE-2026-74880/): openssl_encrypt before 1.4.0 Token Leakage via Query Parameters (critical 9.3)
- [CVE-2026-7488](https://insights.sbomify.com/CVE-2026-7488/): Sensitive Data Exposure in IKAS Technologies' E-Commerce (high 7.5)
- [CVE-2026-74879](https://insights.sbomify.com/CVE-2026-74879/): openssl_encrypt before 1.4.0 Information Disclosure via /ready endpoint (high 8.7)
- [CVE-2026-74878](https://insights.sbomify.com/CVE-2026-74878/): openssl_encrypt before 1.4.0 TOTP Rate Limiter Bypass (critical 9.3)
- [CVE-2026-74877](https://insights.sbomify.com/CVE-2026-74877/): openssl_encrypt before 1.4.0 Missing Ownership Verification via revoke_key (high 8.7)
- [CVE-2026-74876](https://insights.sbomify.com/CVE-2026-74876/): openssl_encrypt before 1.4.0 Unverified Key Bundle Encryption (critical 9.3)
- [CVE-2026-74875](https://insights.sbomify.com/CVE-2026-74875/): openssl_encrypt before 1.4.0 Schema Validation Bypass (critical 9.3)
- [CVE-2026-74874](https://insights.sbomify.com/CVE-2026-74874/): openssl_encrypt before 1.4.0 Weak PRNG Steganography Pixel Selection (high 8.7)
- [CVE-2026-74873](https://insights.sbomify.com/CVE-2026-74873/): openssl_encrypt before 1.4.0 Password Exposure via CLI Argument (high 8.7)
- [CVE-2026-74872](https://insights.sbomify.com/CVE-2026-74872/): openssl_encrypt before 1.4.0 Arbitrary Code Execution via Whirlpool (critical 9.3)
- [CVE-2026-74871](https://insights.sbomify.com/CVE-2026-74871/): openssl_encrypt before 1.4.6 KDF Bypass via Sequential-XOR (medium 6.9)
- [CVE-2026-74870](https://insights.sbomify.com/CVE-2026-74870/): openssl_encrypt before 1.4.8 Hardware Pepper Information Disclosure (high 8.7)
- [CVE-2026-7487](https://insights.sbomify.com/CVE-2026-7487/): Access Control Check Implemented After Asset is Accessed in GitLab (low 3.5)
- [CVE-2026-74869](https://insights.sbomify.com/CVE-2026-74869/): stoatchat before 0.15.0 Missing Authorization via Subscribe (high 8.3)
- [CVE-2026-74868](https://insights.sbomify.com/CVE-2026-74868/): SiYuan before 3.7.4 Brute-Force Authentication via Publish Service (high 8.7)
- [CVE-2026-74867](https://insights.sbomify.com/CVE-2026-74867/): SiYuan before 3.7.4 Cross-Site Request Forgery via CheckAuth (low 2.3)
- [CVE-2026-74866](https://insights.sbomify.com/CVE-2026-74866/): @fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name (medium 5.8)
- [CVE-2026-74865](https://insights.sbomify.com/CVE-2026-74865/): Authentication Bypass in sogo_yhn (critical 9.2)
- [CVE-2026-74864](https://insights.sbomify.com/CVE-2026-74864/): Authentication Bypass in sogo_yhn (critical 9.3)
- [CVE-2026-74860](https://insights.sbomify.com/CVE-2026-74860/): Libxml2: double-free/uaf in libxml2 python bindings (high 8.5)
- [CVE-2026-7486](https://insights.sbomify.com/CVE-2026-7486/): SQLi in Netcad's E-İmar (critical 9.8)
- [CVE-2026-74859](https://insights.sbomify.com/CVE-2026-74859/): Gnome-tweaks: path traversal in theme installer (medium 6.8)
- [CVE-2026-74858](https://insights.sbomify.com/CVE-2026-74858/): jae-jae fetcher-mcp URL Validation security-credentials fetch_urls server-side request forgery (medium 5.3)
- [CVE-2026-74853](https://insights.sbomify.com/CVE-2026-74853/): Pods < 3.3.9.2 - Author+ Arbitrary File Read via Shortcode Display Callback (medium 6.8)
- [CVE-2026-74851](https://insights.sbomify.com/CVE-2026-74851/): Pods < 3.3.9.1 - Author+ RCE via Shortcode Display Callback (high 7.2)
- [CVE-2026-7485](https://insights.sbomify.com/CVE-2026-7485/): Frozen BI aggregations leak host and service names to unauthorized users (low 2.3)
- [CVE-2026-74849](https://insights.sbomify.com/CVE-2026-74849/): Remote code execution vulnerability (critical 9.8)
- [CVE-2026-74848](https://insights.sbomify.com/CVE-2026-74848/): Apache APISIX: Cross-user response poisoning in serverless plugins (high 7.0)
- [CVE-2026-74845](https://insights.sbomify.com/CVE-2026-74845/): 2100 Technology｜Official Document Management System - Arbitrary File Upload (high 8.7)
- [CVE-2026-74843](https://insights.sbomify.com/CVE-2026-74843/): Wavlink WN531P3/WN535M1 Export Pingortrace CGI export_pingortrace.cgi strcpy stack-based overflow (critical 10.0)
- [CVE-2026-74842](https://insights.sbomify.com/CVE-2026-74842/): Kira-Pgr PromptShopMCP Image-Toolkit-MCP-Server server.py download_image server-side request forgery (medium 5.3)
- [CVE-2026-7484](https://insights.sbomify.com/CVE-2026-7484/): Improper Access Control in Abis Technology's AVESİS (medium 5.3)
- [CVE-2026-74837](https://insights.sbomify.com/CVE-2026-74837/): Unbounded atom creation from client-supplied RPC field names in AshTypescript field formatter (high 8.7)
- [CVE-2026-74836](https://insights.sbomify.com/CVE-2026-74836/): HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit (high 8.7)
- [CVE-2026-74835](https://insights.sbomify.com/CVE-2026-74835/): inets,httpd: Memory Exhaustion via Unenforced max_body_size During Chunked Body Reception (high 8.7)
- [CVE-2026-7483](https://insights.sbomify.com/CVE-2026-7483/): Local privilege escalation in ESET security applications for macOS (high 8.5)
- [CVE-2026-74820](https://insights.sbomify.com/CVE-2026-74820/): Unauthenticated SQL Injection via Dynamic Schema ORDER BY Clause (critical 10.0)
- [CVE-2026-7482](https://insights.sbomify.com/CVE-2026-7482/): Ollama heap out-of-bounds read in GGUF tensor parsing leaks server process memory to unauthenticated remote attackers (high 8.8)
- [CVE-2026-7481](https://insights.sbomify.com/CVE-2026-7481/): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (high 8.7)
- [CVE-2026-74804](https://insights.sbomify.com/CVE-2026-74804/): Joomla Extension - yootheme.com - Unauthenticated SQL injection in Zoo < 4.1.64 (critical 9.3)
- [CVE-2026-74803](https://insights.sbomify.com/CVE-2026-74803/): Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.64 (critical 10.0)
- [CVE-2026-74802](https://insights.sbomify.com/CVE-2026-74802/): SiYuan 3.7.3 Cross-Site WebSocket Hijacking via network proxy (high 7.1)
- [CVE-2026-74801](https://insights.sbomify.com/CVE-2026-74801/): SiYuan before 3.7.4 Local Privilege Escalation via elevator.exe (high 8.6)
- [CVE-2026-74800](https://insights.sbomify.com/CVE-2026-74800/): SiYuan before v3.7.4 Stored XSS via assets endpoint (critical 9.4)
- [CVE-2026-7480](https://insights.sbomify.com/CVE-2026-7480/): Privilege escalation in ASUS System Control Interface (high 7.3)
- [CVE-2026-74799](https://insights.sbomify.com/CVE-2026-74799/): SiYuan before 3.7.4 Unauthenticated Debug Endpoint Information Disclosure (critical 9.2)
- [CVE-2026-74798](https://insights.sbomify.com/CVE-2026-74798/): SiYuan kernel Path Traversal via database_clean MCP tool (critical 9.3)
- [CVE-2026-74797](https://insights.sbomify.com/CVE-2026-74797/): OpenTofu before 1.11.4 Denial of Service via malicious zip (low 2.3)
- [CVE-2026-74796](https://insights.sbomify.com/CVE-2026-74796/): OpenTofu before 1.11.7 Symlink Following Path Traversal (high 7.0)
- [CVE-2026-74795](https://insights.sbomify.com/CVE-2026-74795/): Scriban before 6.6.0 Denial of Service via Uncontrolled Recursion (high 8.7)
- [CVE-2026-74794](https://insights.sbomify.com/CVE-2026-74794/): Scriban before 6.6.0 Denial of Service via Infinite Recursion (high 8.7)
- [CVE-2026-74793](https://insights.sbomify.com/CVE-2026-74793/): justhtml before 3.11.0 XSS via selectedcontent projection (medium 5.1)
- [CVE-2026-74792](https://insights.sbomify.com/CVE-2026-74792/): Scriban before 7.0.0 Stack Overflow via nested array initializers (high 8.7)
- [CVE-2026-74791](https://insights.sbomify.com/CVE-2026-74791/): Scriban before 7.0.0 Authorization Bypass via Stale Include Cache (critical 9.2)
- [CVE-2026-74790](https://insights.sbomify.com/CVE-2026-74790/): Scriban before 7.0.0 MemberFilter Bypass via TemplateContext Cache (critical 9.3)
- [CVE-2026-74789](https://insights.sbomify.com/CVE-2026-74789/): Scriban before 7.0.0 LoopLimit Bypass via Built-in Operations (high 8.7)
- [CVE-2026-74788](https://insights.sbomify.com/CVE-2026-74788/): Scriban before 7.0.0 Denial of Service via string.pad_left/pad_right (high 8.7)
- [CVE-2026-74787](https://insights.sbomify.com/CVE-2026-74787/): Scriban before 7.0.0 Uncontrolled Recursion via object.to_json (high 8.7)
- [CVE-2026-74786](https://insights.sbomify.com/CVE-2026-74786/): Scriban before 7.0.0 Denial of Service via Unbounded Template Output (high 7.1)
- [CVE-2026-74785](https://insights.sbomify.com/CVE-2026-74785/): Scriban before 7.0.0 Denial of Service via Unbounded Resource Consumption (high 7.1)
- [CVE-2026-74784](https://insights.sbomify.com/CVE-2026-74784/): Scriban before 7.2.0 Denial of Service via array.insert_at (high 8.7)
- [CVE-2026-74783](https://insights.sbomify.com/CVE-2026-74783/): Scriban 6.6.0 through 7.2.0 Parser Recursion Denial of Service (high 8.7)
- [CVE-2026-74774](https://insights.sbomify.com/CVE-2026-74774/): Security feature bypass in PowerProtect One (medium 5.9)
- [CVE-2026-74771](https://insights.sbomify.com/CVE-2026-74771/): Missing authorization in PowerProtect One (medium 6.5)
- [CVE-2026-74770](https://insights.sbomify.com/CVE-2026-74770/): Command injection in PowerProtect One (high 8.8)
- [CVE-2026-7477](https://insights.sbomify.com/CVE-2026-7477/): Mali GPU Kernel Driver allows access to already freed memory (high 7.8)
- [CVE-2026-74769](https://insights.sbomify.com/CVE-2026-74769/): Missing authorization in PowerProtect Data Manager (medium 6.5)
- [CVE-2026-74768](https://insights.sbomify.com/CVE-2026-74768/): Server-side request forgery in PowerProtect Data Manager (medium 4.1)
- [CVE-2026-74767](https://insights.sbomify.com/CVE-2026-74767/): Unbounded DAA Decompression in Pandora Allows Denial of Service via Decompression Bomb (high 8.7)
- [CVE-2026-74766](https://insights.sbomify.com/CVE-2026-74766/): Net::IDN::Punycode versions from 2.301 before 2.590 for Perl allow a heap use-after-free via a decoded code point that reallocates the outpu (high 8.4)
- [CVE-2026-74765](https://insights.sbomify.com/CVE-2026-74765/): Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encode_punycode. (medium 6.5)
- [CVE-2026-74764](https://insights.sbomify.com/CVE-2026-74764/): Path Traversal in TAR Archive Extraction Allows Arbitrary File Write in Pandora (critical 10.0)
- [CVE-2026-74761](https://insights.sbomify.com/CVE-2026-74761/): Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientId (high 7.5)
- [CVE-2026-7476](https://insights.sbomify.com/CVE-2026-7476/): Mali GPU Kernel Driver allows access to already freed memory (high 7.8)
- [CVE-2026-74758](https://insights.sbomify.com/CVE-2026-74758/): Apache bRPC: Heap Use-After-Free in RTMP Abort Message Handling (not scored)
- [CVE-2026-74757](https://insights.sbomify.com/CVE-2026-74757/): Apache bRPC: Uncontrolled Memory Allocation via Malicious mcpack Array Item Count (high 7.5)
- [CVE-2026-74755](https://insights.sbomify.com/CVE-2026-74755/): Apache bRPC: Integer Underflow in mcpack2pb Parser Leading to Denial of Service (not scored)
- [CVE-2026-74754](https://insights.sbomify.com/CVE-2026-74754/): scsi: core: pair EH runtime PM get and put (not scored)
- [CVE-2026-74753](https://insights.sbomify.com/CVE-2026-74753/): perf: Reject exited events as group leaders (high 7.8)
- [CVE-2026-74752](https://insights.sbomify.com/CVE-2026-74752/): sctp: validate cookie AUTH state before use (critical 9.8)
- [CVE-2026-74751](https://insights.sbomify.com/CVE-2026-74751/): riscv: lib: Fix ZBB strnlen reading past count boundary (critical 9.4)
- [CVE-2026-74750](https://insights.sbomify.com/CVE-2026-74750/): ovpn: defer key slot crypto freeing to workqueue (high 7.5)
- [CVE-2026-7475](https://insights.sbomify.com/CVE-2026-7475/): Sky Addons <= 3.3.2 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Script (medium 6.4)
- [CVE-2026-74749](https://insights.sbomify.com/CVE-2026-74749/): rseq: Prevent hard lockup on granted time slice extension (not scored)
- [CVE-2026-74748](https://insights.sbomify.com/CVE-2026-74748/): netfilter: ipset: fix refcount race between list:set GC and swap (high 7.8)
- [CVE-2026-74747](https://insights.sbomify.com/CVE-2026-74747/): ipvs: revalidate ihl to prevent out-of-bounds access (high 7.8)
- [CVE-2026-74746](https://insights.sbomify.com/CVE-2026-74746/): netfilter: flowtable: publish GC-visible tuple last (critical 9.8)
- [CVE-2026-74745](https://insights.sbomify.com/CVE-2026-74745/): eth: bnxt: avoid deadlock when canceling IRQ affinity notifier (high 7.5)
- [CVE-2026-74744](https://insights.sbomify.com/CVE-2026-74744/): ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (critical 9.8)
- [CVE-2026-74743](https://insights.sbomify.com/CVE-2026-74743/): macvlan: inherit needed_headroom and needed_tailroom from lowerdev (critical 9.8)
- [CVE-2026-74742](https://insights.sbomify.com/CVE-2026-74742/): veth: fix queue index used to wake the peer txq in veth_poll (high 7.5)
- [CVE-2026-74741](https://insights.sbomify.com/CVE-2026-74741/): net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling (high 7.5)
- [CVE-2026-74740](https://insights.sbomify.com/CVE-2026-74740/): net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain (not scored)
- [CVE-2026-7474](https://insights.sbomify.com/CVE-2026-7474/): Nomad vulnerable to path traversal in dynamic host volume which may lead to code execution (high 8.8)
- [CVE-2026-74739](https://insights.sbomify.com/CVE-2026-74739/): net/sched: cls_u32: skip hash tables in u32_bind_class() (high 7.8)
- [CVE-2026-74738](https://insights.sbomify.com/CVE-2026-74738/): regmap: sdw-mbq: don't call an unset readable_reg callback (not scored)
- [CVE-2026-74737](https://insights.sbomify.com/CVE-2026-74737/): net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG (critical 9.8)
- [CVE-2026-74736](https://insights.sbomify.com/CVE-2026-74736/): net/sched: cls_bpf: reject dev-bound programs bound to a different device (high 7.8)
- [CVE-2026-74735](https://insights.sbomify.com/CVE-2026-74735/): l2tp: fix tunnel and session refcount leak on seq_file release (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/389/