# Vulnerabilities published in 2026


- [CVE-2026-73897](https://insights.sbomify.com/CVE-2026-73897/): Missing authorization in Helidon (medium 6.5)
- [CVE-2026-73896](https://insights.sbomify.com/CVE-2026-73896/): Other in Helidon (medium 6.5)
- [CVE-2026-73895](https://insights.sbomify.com/CVE-2026-73895/): Missing authorization in Helidon (medium 5.3)
- [CVE-2026-73894](https://insights.sbomify.com/CVE-2026-73894/): Missing authorization in Helidon (high 7.3)
- [CVE-2026-73893](https://insights.sbomify.com/CVE-2026-73893/): Missing authorization in Helidon (medium 6.5)
- [CVE-2026-73892](https://insights.sbomify.com/CVE-2026-73892/): Missing authorization in Helidon (medium 6.5)
- [CVE-2026-73891](https://insights.sbomify.com/CVE-2026-73891/): Missing authorization in Helidon (high 7.3)
- [CVE-2026-73890](https://insights.sbomify.com/CVE-2026-73890/): Denial of service in Helidon (high 7.5)
- [CVE-2026-7389](https://insights.sbomify.com/CVE-2026-7389/): EyouCMS common.php GetSortData sql injection (medium 6.9)
- [CVE-2026-73889](https://insights.sbomify.com/CVE-2026-73889/): Missing authorization in Helidon (medium 5.3)
- [CVE-2026-73888](https://insights.sbomify.com/CVE-2026-73888/): Missing authorization in Helidon (medium 5.3)
- [CVE-2026-73887](https://insights.sbomify.com/CVE-2026-73887/): Missing authorization in Helidon (high 7.5)
- [CVE-2026-73886](https://insights.sbomify.com/CVE-2026-73886/): Missing authorization in Helidon (high 7.2)
- [CVE-2026-73885](https://insights.sbomify.com/CVE-2026-73885/): Missing authorization in Helidon (high 7.2)
- [CVE-2026-73884](https://insights.sbomify.com/CVE-2026-73884/): Information disclosure in Helidon (high 7.5)
- [CVE-2026-73883](https://insights.sbomify.com/CVE-2026-73883/): Information disclosure in Helidon (high 7.5)
- [CVE-2026-73882](https://insights.sbomify.com/CVE-2026-73882/): Denial of service in Helidon (high 7.5)
- [CVE-2026-73881](https://insights.sbomify.com/CVE-2026-73881/): Missing authorization in Helidon (medium 5.4)
- [CVE-2026-73880](https://insights.sbomify.com/CVE-2026-73880/): Missing authorization in Helidon (medium 4.4)
- [CVE-2026-7388](https://insights.sbomify.com/CVE-2026-7388/): EyouCMS Template File FilemanagerLogic.php editFile code injection (medium 5.1)
- [CVE-2026-73879](https://insights.sbomify.com/CVE-2026-73879/): Missing authorization in Helidon (high 7.5)
- [CVE-2026-73878](https://insights.sbomify.com/CVE-2026-73878/): Information disclosure in Helidon (high 7.5)
- [CVE-2026-73877](https://insights.sbomify.com/CVE-2026-73877/): Missing authorization in Helidon (medium 5.3)
- [CVE-2026-73876](https://insights.sbomify.com/CVE-2026-73876/): Missing authorization in Helidon (high 7.2)
- [CVE-2026-73875](https://insights.sbomify.com/CVE-2026-73875/): Missing authorization in Helidon (high 7.2)
- [CVE-2026-73874](https://insights.sbomify.com/CVE-2026-73874/): Missing authorization in Helidon (medium 5.4)
- [CVE-2026-73873](https://insights.sbomify.com/CVE-2026-73873/): Missing authorization in Helidon (medium 4.2)
- [CVE-2026-73872](https://insights.sbomify.com/CVE-2026-73872/): Missing authorization in Helidon (medium 5.3)
- [CVE-2026-73871](https://insights.sbomify.com/CVE-2026-73871/): Missing authorization in Helidon (medium 5.3)
- [CVE-2026-73870](https://insights.sbomify.com/CVE-2026-73870/): Missing authorization in Helidon (medium 6.1)
- [CVE-2026-7387](https://insights.sbomify.com/CVE-2026-7387/): Mattermost group syncable endpoints allow privilege escalation via scheme_admin (high 8.8)
- [CVE-2026-73869](https://insights.sbomify.com/CVE-2026-73869/): Missing authorization in Helidon (medium 6.1)
- [CVE-2026-73868](https://insights.sbomify.com/CVE-2026-73868/): Missing authorization in Helidon (medium 6.5)
- [CVE-2026-73867](https://insights.sbomify.com/CVE-2026-73867/): Missing authorization in Helidon (medium 6.5)
- [CVE-2026-73866](https://insights.sbomify.com/CVE-2026-73866/): Missing authorization in Helidon (critical 9.1)
- [CVE-2026-73865](https://insights.sbomify.com/CVE-2026-73865/): Missing authorization in Helidon (critical 9.1)
- [CVE-2026-73863](https://insights.sbomify.com/CVE-2026-73863/): NanoMQ: Heap-Buffer-Overflow in `nmq_subinfo_decode()` During MQTT v5 SUBSCRIBE Parsing (high 7.0)
- [CVE-2026-7386](https://insights.sbomify.com/CVE-2026-7386/): fatbobman mail-mcp-bridge mail_mcp_server.py path traversal (medium 6.9)
- [CVE-2026-73858](https://insights.sbomify.com/CVE-2026-73858/): Solspace Freeform: Limited Twig template injection via submitted field values (medium 5.3)
- [CVE-2026-73851](https://insights.sbomify.com/CVE-2026-73851/): Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass) (medium 6.1)
- [CVE-2026-73850](https://insights.sbomify.com/CVE-2026-73850/): Emlog: Arbitrary SQL Execution Vulnerability in ai.php within queryDatabase() Function (high 8.6)
- [CVE-2026-7385](https://insights.sbomify.com/CVE-2026-7385/): Decent Comments < 3.0.2 - Unauthenticated Email Address Disclosure (medium 5.8)
- [CVE-2026-73849](https://insights.sbomify.com/CVE-2026-73849/): emlog allows unauthenticated reinstallation via `install.php?action=reinstall`. (critical 9.8)
- [CVE-2026-73848](https://insights.sbomify.com/CVE-2026-73848/): Emlog: Stored XSS via Tag Name in Article Editor (medium 6.9)
- [CVE-2026-73847](https://insights.sbomify.com/CVE-2026-73847/): Cross-site request forgery in emlog (medium 6.8)
- [CVE-2026-73846](https://insights.sbomify.com/CVE-2026-73846/): CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning (medium 6.5)
- [CVE-2026-73845](https://insights.sbomify.com/CVE-2026-73845/): CKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`) (medium 5.3)
- [CVE-2026-73844](https://insights.sbomify.com/CVE-2026-73844/): CKAN MCP Server: Information disclosure via verbose error reflection (low 3.7)
- [CVE-2026-73843](https://insights.sbomify.com/CVE-2026-73843/): OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs (critical 9.6)
- [CVE-2026-73842](https://insights.sbomify.com/CVE-2026-73842/): OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation (critical 9.0)
- [CVE-2026-73841](https://insights.sbomify.com/CVE-2026-73841/): OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints (high 8.8)
- [CVE-2026-73840](https://insights.sbomify.com/CVE-2026-73840/): OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass) (medium 5.3)
- [CVE-2026-7384](https://insights.sbomify.com/CVE-2026-7384/): ezequiroga mcp-bases research_server.py search_papers path traversal (medium 6.9)
- [CVE-2026-73839](https://insights.sbomify.com/CVE-2026-73839/): Ebyte NE2-D11 Insufficiently Protected Credentials (medium 5.1)
- [CVE-2026-73834](https://insights.sbomify.com/CVE-2026-73834/): Must-gather: must-gather: embedded secret data in acm wrapper crs collected without redaction (medium 5.5)
- [CVE-2026-7383](https://insights.sbomify.com/CVE-2026-7383/): Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion (high 8.1)
- [CVE-2026-73829](https://insights.sbomify.com/CVE-2026-73829/): Non-atomic hash-credential dedup in mpp Tempo allows replay of a confirmed payment under a concurrent race (medium 6.3)
- [CVE-2026-73827](https://insights.sbomify.com/CVE-2026-73827/): Cross-site scripting in SOY Calendar (medium 4.8)
- [CVE-2026-7382](https://insights.sbomify.com/CVE-2026-7382/): Information Disclosure in MeWare Software's PDKS (medium 6.5)
- [CVE-2026-73819](https://insights.sbomify.com/CVE-2026-73819/): Ebyte NA111-M Weak Authentication (critical 9.3)
- [CVE-2026-73814](https://insights.sbomify.com/CVE-2026-73814/): Gitea repository ownership escalation by administrators (medium 6.5)
- [CVE-2026-73812](https://insights.sbomify.com/CVE-2026-73812/): inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Length (high 8.3)
- [CVE-2026-7381](https://insights.sbomify.com/CVE-2026-7381/): Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting (critical 9.1)
- [CVE-2026-73809](https://insights.sbomify.com/CVE-2026-73809/): Ebyte NA111-M Cleartext Transmission of Sensitive Information (high 8.7)
- [CVE-2026-73807](https://insights.sbomify.com/CVE-2026-73807/): mySCADA myPRO Manager Missing Authorization (critical 9.3)
- [CVE-2026-73804](https://insights.sbomify.com/CVE-2026-73804/): Gitea API token scope escalation through HTTP signatures (high 8.1)
- [CVE-2026-73802](https://insights.sbomify.com/CVE-2026-73802/): Gitea Runner host isolation bypass through container options (high 8.8)
- [CVE-2026-73800](https://insights.sbomify.com/CVE-2026-73800/): Gitea reusable workflow secret exposure in pull_request_target (high 8.8)
- [CVE-2026-7380](https://insights.sbomify.com/CVE-2026-7380/): HTML Injection in Armiya Technologies' Access Control System (medium 6.1)
- [CVE-2026-73799](https://insights.sbomify.com/CVE-2026-73799/): HPE NonStop SNMP Trap Multiplexer - Memory Corruption vulnerability (high 7.5)
- [CVE-2026-73798](https://insights.sbomify.com/CVE-2026-73798/): HPE NonStop DNS 9.2.3 Non Secure Version (high 8.2)
- [CVE-2026-73797](https://insights.sbomify.com/CVE-2026-73797/): HPE NonStop TSQLFIL - Memory corruption vulnerability (medium 5.3)
- [CVE-2026-73796](https://insights.sbomify.com/CVE-2026-73796/): HPE NonStop TSQLEXE - Memory Corruption vulnerability (medium 4.4)
- [CVE-2026-73795](https://insights.sbomify.com/CVE-2026-73795/): HPE NonStop TMF Auditread2 - Denial of Service vulnerability (medium 6.4)
- [CVE-2026-73794](https://insights.sbomify.com/CVE-2026-73794/): HPE NonStop MODULAR NSJ - Vulnerability in Random Number Generation (medium 4.6)
- [CVE-2026-73793](https://insights.sbomify.com/CVE-2026-73793/): HPE NonStop Middleware - Secret key handling vulnerability (high 7.9)
- [CVE-2026-73792](https://insights.sbomify.com/CVE-2026-73792/): HPE NonStop Java JToolkit - Command Injection and buffer overflow vulnerability (low 3.8)
- [CVE-2026-73791](https://insights.sbomify.com/CVE-2026-73791/): HPE NonStop Hpjmeter - Buffer overflow vulnerability (low 2.0)
- [CVE-2026-73790](https://insights.sbomify.com/CVE-2026-73790/): HPE NonStop iTP WebServer - Memory corruption vulnerability (high 8.2)
- [CVE-2026-7379](https://insights.sbomify.com/CVE-2026-7379/): Missing Release of Memory after Effective Lifetime in Wireshark (medium 5.5)
- [CVE-2026-73789](https://insights.sbomify.com/CVE-2026-73789/): Unauthenticated Insecure Parameter Manipulation allows Data Tampering In CPPM Web Interface (medium 5.3)
- [CVE-2026-73788](https://insights.sbomify.com/CVE-2026-73788/): Privilege Escalation in ClearPass OnGuard Agent (medium 6.5)
- [CVE-2026-73787](https://insights.sbomify.com/CVE-2026-73787/): Authenticated Arbitrary File Write allows Remote Code Execution via CPPM Web Interface (high 7.2)
- [CVE-2026-73786](https://insights.sbomify.com/CVE-2026-73786/): Unauthenticated Network-Based Denial of Service in CPPM systems (high 7.5)
- [CVE-2026-73785](https://insights.sbomify.com/CVE-2026-73785/): HPE IceWall Federation Agent and Proxy, Denial of Service vulnerability (high 7.5)
- [CVE-2026-73784](https://insights.sbomify.com/CVE-2026-73784/): HPE IceWall products, Remote Bypass of Security Restrictions (high 8.8)
- [CVE-2026-73783](https://insights.sbomify.com/CVE-2026-73783/): Authenticated Stack Overflow Vulnerabilities lead to Denial-of-Service in AOS-CX (medium 4.9)
- [CVE-2026-73782](https://insights.sbomify.com/CVE-2026-73782/): Unauthenticated Format String Vulnerability leads to Remote Code Execution in AOS-CX (high 8.8)
- [CVE-2026-73781](https://insights.sbomify.com/CVE-2026-73781/): Authenticated Stored Cross-Site Scripting Vulnerability (XSS) in AOS-CX Web-Based Management Interface (high 8.4)
- [CVE-2026-73780](https://insights.sbomify.com/CVE-2026-73780/): Lack of Cross-Site Request Forgery (CSRF) Protections for Certificate-Authenticated Sessions in AOS-CX (high 8.3)
- [CVE-2026-7378](https://insights.sbomify.com/CVE-2026-7378/): Heap-based Buffer Overflow in Wireshark (medium 5.5)
- [CVE-2026-73779](https://insights.sbomify.com/CVE-2026-73779/): Auth bypass in AOS-CX (high 8.2)
- [CVE-2026-73778](https://insights.sbomify.com/CVE-2026-73778/): Credential Manager Vulnerability Allows Unauthorized Administrative Access (high 8.1)
- [CVE-2026-73777](https://insights.sbomify.com/CVE-2026-73777/): Authorization Bypass Vulnerabilities Leading to Privilege Escalation in AOS-CX API Endpoint (high 8.1)
- [CVE-2026-73776](https://insights.sbomify.com/CVE-2026-73776/): Authenticated Signature Verification Bypass Leading to Arbitrary Code Execution in AOS-CX (high 7.9)
- [CVE-2026-73775](https://insights.sbomify.com/CVE-2026-73775/): Authenticated Sensitive Information Disclosure Vulnerabilities in AOS-CX (high 7.7)
- [CVE-2026-73774](https://insights.sbomify.com/CVE-2026-73774/): Unauthenticated Buffer Overflow Vulnerability leads to Sensitive Information Disclosure in AOS-CX (high 7.6)
- [CVE-2026-73773](https://insights.sbomify.com/CVE-2026-73773/): Unauthenticated Denial-of-Service (DoS) Vulnerability in AOS-CX (high 7.5)
- [CVE-2026-73772](https://insights.sbomify.com/CVE-2026-73772/): Unauthenticated Buffer Overflow Vulnerabilities lead to Denial-of-Service in AOS-CX (medium 6.5)
- [CVE-2026-73771](https://insights.sbomify.com/CVE-2026-73771/): Improper Authentication Handling in AOS-CX Management Interface and API (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/397/