# Vulnerabilities published in 2026


- [CVE-2026-7366](https://insights.sbomify.com/CVE-2026-7366/): IBM DataPower Gateway affected by HTTP request header leakage in XML-Firewall (medium 4.2)
- [CVE-2026-73659](https://insights.sbomify.com/CVE-2026-73659/): Trigger.dev: Cross-tenant object read/write via path traversal in packet presign API (high 8.1)
- [CVE-2026-73658](https://insights.sbomify.com/CVE-2026-73658/): Trigger.dev: Cross-tenant object store read and write via URL path traversal (high 8.2)
- [CVE-2026-73657](https://insights.sbomify.com/CVE-2026-73657/): Trigger.dev: Cross-tenant payload poisoning via packet write + replay (medium 4.2)
- [CVE-2026-73656](https://insights.sbomify.com/CVE-2026-73656/): Trigger.dev: Cross-project deployment worker registration can modify another project's deployment state (critical 9.9)
- [CVE-2026-73655](https://insights.sbomify.com/CVE-2026-73655/): Trigger.dev: Account Takeover via Cross-Provider OAuth Email Matching in Google Login (high 7.4)
- [CVE-2026-73654](https://insights.sbomify.com/CVE-2026-73654/): Trigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoS (high 8.5)
- [CVE-2026-73653](https://insights.sbomify.com/CVE-2026-73653/): Vitest: Browser Mode provider commands bypass the file-access permission gate (critical 9.4)
- [CVE-2026-73652](https://insights.sbomify.com/CVE-2026-73652/): vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review (high 7.1)
- [CVE-2026-73651](https://insights.sbomify.com/CVE-2026-73651/): TypeORM: migration:generate template-literal code injection (medium 5.7)
- [CVE-2026-73650](https://insights.sbomify.com/CVE-2026-73650/): SVGO: removeScripts plugin leaves some executable scripts intact (high 8.2)
- [CVE-2026-7365](https://insights.sbomify.com/CVE-2026-7365/): Hardcoded credentials in Operations Analytics - Log Analysis (high 8.4)
- [CVE-2026-73649](https://insights.sbomify.com/CVE-2026-73649/): Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of CVE-2026-44966 fix) (critical 9.8)
- [CVE-2026-73648](https://insights.sbomify.com/CVE-2026-73648/): rails-html-sanitizer: Possible XSS vulnerability with certain configurations (medium 5.1)
- [CVE-2026-73647](https://insights.sbomify.com/CVE-2026-73647/): Quasar Framework: Prototype pollution in Quasar extend() utility (medium 5.6)
- [CVE-2026-73646](https://insights.sbomify.com/CVE-2026-73646/): PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure (high 7.5)
- [CVE-2026-73645](https://insights.sbomify.com/CVE-2026-73645/): ERC7984ERC20Wrapper: once a wrapper is filled, subsequent wrap requests do not revert and result in loss of funds. (medium 6.6)
- [CVE-2026-73644](https://insights.sbomify.com/CVE-2026-73644/): OpenDJ SASL PLAIN authzid bypassing the proxy ACI scope check (critical 9.6)
- [CVE-2026-73643](https://insights.sbomify.com/CVE-2026-73643/): js-yaml: Exponential parsing time in the flow collections leads to denial of service (high 7.5)
- [CVE-2026-73642](https://insights.sbomify.com/CVE-2026-73642/): Path Traversal in Dayforce ESS Excelity (critical 9.2)
- [CVE-2026-73641](https://insights.sbomify.com/CVE-2026-73641/): Multiple Reflected XSS in Dayforce ESS Excelity (medium 5.1)
- [CVE-2026-73640](https://insights.sbomify.com/CVE-2026-73640/): Time-based SQL Injection in Dayforce ESS Excelity (critical 9.3)
- [CVE-2026-7364](https://insights.sbomify.com/CVE-2026-7364/): Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access (low 3.1)
- [CVE-2026-73639](https://insights.sbomify.com/CVE-2026-73639/): Imager::File::PNG versions from 1.003 before 1.004 for Perl write past the end of the row buffer reading a PNG with a tRNS transparency chunk in read_direct8. (critical 9.1)
- [CVE-2026-73638](https://insights.sbomify.com/CVE-2026-73638/): Imager versions from 0.45_02 before 1.035 for Perl read outside the EXIF block via unchecked start offsets in tiff_load_ifd. (medium 6.2)
- [CVE-2026-73637](https://insights.sbomify.com/CVE-2026-73637/): Apache HTTP Server: mod_auth_digest DoS attack (high 7.3)
- [CVE-2026-73636](https://insights.sbomify.com/CVE-2026-73636/): Apache HTTP Server: mod_auth_digest one-time-nonce replay attack (high 8.1)
- [CVE-2026-73635](https://insights.sbomify.com/CVE-2026-73635/): Apache Struts: Unbounded growth of localized-text caches driven by the request locale (high 7.5)
- [CVE-2026-73634](https://insights.sbomify.com/CVE-2026-73634/): Apache Struts: Unbounded read of a Content Security Policy violation report (high 7.5)
- [CVE-2026-73633](https://insights.sbomify.com/CVE-2026-73633/): Apache Struts: Unbounded read of a JSON request body (high 7.5)
- [CVE-2026-73632](https://insights.sbomify.com/CVE-2026-73632/): Apache Struts: Shared serialization state in the JSON plugin (medium 4.3)
- [CVE-2026-73631](https://insights.sbomify.com/CVE-2026-73631/): Apache Struts: Shared parsing state in the JSON plugin (medium 4.3)
- [CVE-2026-73630](https://insights.sbomify.com/CVE-2026-73630/): SiYuan before v3.7.4 Information Disclosure via authFilePublishAccess (medium 6.9)
- [CVE-2026-7363](https://insights.sbomify.com/CVE-2026-7363/): Use after free in Chrome (high 8.8)
- [CVE-2026-73629](https://insights.sbomify.com/CVE-2026-73629/): Serendipity before 2.6.0 SSRF via hex IPv4 and IPv6 addresses (high 8.4)
- [CVE-2026-73628](https://insights.sbomify.com/CVE-2026-73628/): Serendipity 2.3.5 Reflected XSS via search clean-URL route (medium 5.3)
- [CVE-2026-73627](https://insights.sbomify.com/CVE-2026-73627/): JupyterLab 4.6.0 Plugin Manager Lock-Rule Enforcement Bypass (medium 6.0)
- [CVE-2026-73626](https://insights.sbomify.com/CVE-2026-73626/): JupyterLab before 4.6.2 Authentication Bypass via PyPIExtensionManager (high 7.7)
- [CVE-2026-73625](https://insights.sbomify.com/CVE-2026-73625/): GitPython before 3.1.54 Remote Code Execution via kwarg value smuggling (high 8.7)
- [CVE-2026-73624](https://insights.sbomify.com/CVE-2026-73624/): GitPython before 3.1.54 Arbitrary File Overwrite via diff (high 7.2)
- [CVE-2026-73623](https://insights.sbomify.com/CVE-2026-73623/): GitPython before 3.1.54 Remote Code Execution via --template (high 7.7)
- [CVE-2026-73622](https://insights.sbomify.com/CVE-2026-73622/): GitPython before 3.1.55 Environment Variable Exfiltration via Remote.add() (high 8.7)
- [CVE-2026-73621](https://insights.sbomify.com/CVE-2026-73621/): GitPython before 3.1.56 Arbitrary File Truncation via Commit.count (medium 5.3)
- [CVE-2026-73620](https://insights.sbomify.com/CVE-2026-73620/): GitPython before 3.1.57 Arbitrary File Overwrite and Read (high 7.2)
- [CVE-2026-7362](https://insights.sbomify.com/CVE-2026-7362/): Improper Access Control Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway (medium 4.3)
- [CVE-2026-73619](https://insights.sbomify.com/CVE-2026-73619/): GitPython before 3.1.57 Arbitrary File Read via Repo.archive() (high 7.1)
- [CVE-2026-73618](https://insights.sbomify.com/CVE-2026-73618/): Budibase Server before 3.40.0 NoSQL Injection via JSON Parameter (high 8.7)
- [CVE-2026-73617](https://insights.sbomify.com/CVE-2026-73617/): Budibase before 3.40.0 NoSQL Injection via MongoDB datasource (high 7.1)
- [CVE-2026-73616](https://insights.sbomify.com/CVE-2026-73616/): OpenRemote Notification Delete Cross-Realm Insecure Direct Object Reference (high 7.1)
- [CVE-2026-73615](https://insights.sbomify.com/CVE-2026-73615/): Network-AI SandboxPolicy before 5.15.1 Blocklist Bypass via Quote Mismatch (high 8.7)
- [CVE-2026-73614](https://insights.sbomify.com/CVE-2026-73614/): Network-AI ClaudeHookBridge Deny Pattern Bypass via Truncation (high 8.7)
- [CVE-2026-73613](https://insights.sbomify.com/CVE-2026-73613/): filebrowser before 2.63.19 Out-of-Scope File Deletion via Symlink (high 7.2)
- [CVE-2026-73612](https://insights.sbomify.com/CVE-2026-73612/): File Browser before v2.63.22 Authorization Bypass via Recursive Operations (high 8.6)
- [CVE-2026-73611](https://insights.sbomify.com/CVE-2026-73611/): File Browser 2.50.0 through 2.63.21 JWT Expiration Bypass (high 7.6)
- [CVE-2026-73610](https://insights.sbomify.com/CVE-2026-73610/): SiYuan before v3.7.4 Information Disclosure via Local Storage (medium 6.9)
- [CVE-2026-7361](https://insights.sbomify.com/CVE-2026-7361/): Use after free in Chrome (high 8.8)
- [CVE-2026-73609](https://insights.sbomify.com/CVE-2026-73609/): SiYuan before v3.7.4 Information Disclosure via getBookmarkLabels (medium 6.9)
- [CVE-2026-73608](https://insights.sbomify.com/CVE-2026-73608/): SiYuan v3.7.4-alpha.2 Authorization Bypass via getAttributeViewSearchTarget (critical 9.2)
- [CVE-2026-73607](https://insights.sbomify.com/CVE-2026-73607/): SiYuan before v3.7.4 Information Disclosure via getOutlineStorage (medium 6.9)
- [CVE-2026-73606](https://insights.sbomify.com/CVE-2026-73606/): SiYuan before v3.7.4 Information Disclosure via getRefIDs (medium 6.9)
- [CVE-2026-73605](https://insights.sbomify.com/CVE-2026-73605/): SiYuan before v3.7.4 Path Traversal via getUniqueFilename (medium 6.9)
- [CVE-2026-73604](https://insights.sbomify.com/CVE-2026-73604/): Flowise before 3.1.3 Credential Exposure via API (high 7.1)
- [CVE-2026-73603](https://insights.sbomify.com/CVE-2026-73603/): Flowise before 3.1.4 Credential Abuse via Text-to-Speech (medium 6.3)
- [CVE-2026-73602](https://insights.sbomify.com/CVE-2026-73602/): Flowise before 3.1.3 Sandbox Escape to RCE (critical 9.0)
- [CVE-2026-73601](https://insights.sbomify.com/CVE-2026-73601/): Flowise before 3.1.3 Remote Code Execution via Custom MCP (critical 9.0)
- [CVE-2026-73600](https://insights.sbomify.com/CVE-2026-73600/): Memory corruption in PowerProtect Data Manager (high 7.8)
- [CVE-2026-7360](https://insights.sbomify.com/CVE-2026-7360/): Security feature bypass in Chrome (low 3.1)
- [CVE-2026-73599](https://insights.sbomify.com/CVE-2026-73599/): Open redirect in Secure Connect Gateway (SCG) Policy Manager (medium 5.4)
- [CVE-2026-73598](https://insights.sbomify.com/CVE-2026-73598/): Privilege escalation in Secure Connect Gateway (SCG) Policy Manager (high 7.8)
- [CVE-2026-73597](https://insights.sbomify.com/CVE-2026-73597/): Cross-site request forgery in Secure Connect Gateway (SCG) Policy Manager (medium 6.5)
- [CVE-2026-73596](https://insights.sbomify.com/CVE-2026-73596/): Misconfiguration in Secure Connect Gateway (SCG) Policy Manager (low 3.8)
- [CVE-2026-73595](https://insights.sbomify.com/CVE-2026-73595/): Supply chain in Secure Connect Gateway (SCG) Policy Manager (medium 4.7)
- [CVE-2026-73594](https://insights.sbomify.com/CVE-2026-73594/): Security feature bypass in Secure Connect Gateway (SCG) Policy Manager (medium 6.4)
- [CVE-2026-73593](https://insights.sbomify.com/CVE-2026-73593/): Other in Secure Connect Gateway (SCG) Policy Manager (low 3.0)
- [CVE-2026-73591](https://insights.sbomify.com/CVE-2026-73591/): Information disclosure in Secure Connect Gateway (SCG) Policy Manager (high 7.5)
- [CVE-2026-7359](https://insights.sbomify.com/CVE-2026-7359/): Use after free in Chrome (high 8.8)
- [CVE-2026-73589](https://insights.sbomify.com/CVE-2026-73589/): Weak cryptography in Secure Connect Gateway (SCG) Policy Manager (medium 6.3)
- [CVE-2026-73588](https://insights.sbomify.com/CVE-2026-73588/): Auth bypass in Secure Connect Gateway (SCG) Policy Manager (high 7.4)
- [CVE-2026-73587](https://insights.sbomify.com/CVE-2026-73587/): Security feature bypass in Secure Connect Gateway (SCG) Policy Manager (medium 6.8)
- [CVE-2026-73586](https://insights.sbomify.com/CVE-2026-73586/): Auth bypass in Secure Connect Gateway (SCG) Policy Manager (medium 6.4)
- [CVE-2026-73585](https://insights.sbomify.com/CVE-2026-73585/): Race condition in Red Hat Enterprise Linux 10 (medium 6.3)
- [CVE-2026-73584](https://insights.sbomify.com/CVE-2026-73584/): Sblim-sfcb: sblim-sfcb: privileged file corruption and denial of service via insecure temporary file handling (medium 6.3)
- [CVE-2026-73583](https://insights.sbomify.com/CVE-2026-73583/): Memory corruption in Red Hat Enterprise Linux 10 (medium 6.6)
- [CVE-2026-73581](https://insights.sbomify.com/CVE-2026-73581/): Apache Tomcat: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore (medium 6.5)
- [CVE-2026-7358](https://insights.sbomify.com/CVE-2026-7358/): Use after free in Chrome (high 8.8)
- [CVE-2026-73579](https://insights.sbomify.com/CVE-2026-73579/): Apache Syncope: Non-recursive Any search could skip Realms restrictions (critical 9.8)
- [CVE-2026-73576](https://insights.sbomify.com/CVE-2026-73576/): Weak cryptography in Collaboration (medium 6.3)
- [CVE-2026-73575](https://insights.sbomify.com/CVE-2026-73575/): Cross-site request forgery in Collaboration (low 3.1)
- [CVE-2026-73574](https://insights.sbomify.com/CVE-2026-73574/): Path traversal in Collaboration (low 3.1)
- [CVE-2026-73573](https://insights.sbomify.com/CVE-2026-73573/): Path traversal in Collaboration (low 3.1)
- [CVE-2026-73572](https://insights.sbomify.com/CVE-2026-73572/): Cross-site scripting in Collaboration (medium 6.1)
- [CVE-2026-73571](https://insights.sbomify.com/CVE-2026-73571/): Missing authorization in Collaboration (low 3.1)
- [CVE-2026-73570](https://insights.sbomify.com/CVE-2026-73570/): Zimbra Collaboration Suite (ZCS) OS Command Injection (high 8.9, exploited in the wild)
- [CVE-2026-7357](https://insights.sbomify.com/CVE-2026-7357/): Use after free in Chrome (high 7.5)
- [CVE-2026-73569](https://insights.sbomify.com/CVE-2026-73569/): fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits (high 8.7)
- [CVE-2026-73568](https://insights.sbomify.com/CVE-2026-73568/): py-libp2p: yamux connection DoS via oversized data frame (high 7.5)
- [CVE-2026-73567](https://insights.sbomify.com/CVE-2026-73567/): sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock (critical 9.1)
- [CVE-2026-73566](https://insights.sbomify.com/CVE-2026-73566/): node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection (high 7.5)
- [CVE-2026-73565](https://insights.sbomify.com/CVE-2026-73565/): @hono/node-server: Unauthenticated memory-leak DoS via aborted WebSocket handshake (medium 5.3)
- [CVE-2026-73564](https://insights.sbomify.com/CVE-2026-73564/): frp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer Overflow (high 8.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/399/