# Vulnerabilities published in 2026


- [CVE-2026-73563](https://insights.sbomify.com/CVE-2026-73563/): @backstage/plugin-auth-backend: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass (medium 4.7)
- [CVE-2026-73562](https://insights.sbomify.com/CVE-2026-73562/): Mongoose: Prototype pollution in the update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter) (medium 6.5)
- [CVE-2026-73561](https://insights.sbomify.com/CVE-2026-73561/): Hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion (high 7.5)
- [CVE-2026-73560](https://insights.sbomify.com/CVE-2026-73560/): vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass MediaConnector protections (medium 6.5)
- [CVE-2026-7356](https://insights.sbomify.com/CVE-2026-7356/): Use after free in Chrome (high 8.8)
- [CVE-2026-73559](https://insights.sbomify.com/CVE-2026-73559/): vLLM: Completion prompt lists fan out into unbounded engine requests (medium 6.5)
- [CVE-2026-73558](https://insights.sbomify.com/CVE-2026-73558/): vLLM: Cross-User Data Leak Vulnerability (medium 5.3)
- [CVE-2026-73557](https://insights.sbomify.com/CVE-2026-73557/): vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts (medium 6.3)
- [CVE-2026-73556](https://insights.sbomify.com/CVE-2026-73556/): vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of GHSA-rwxx-mrjm-wc2m (medium 5.3)
- [CVE-2026-73555](https://insights.sbomify.com/CVE-2026-73555/): vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages (medium 5.3)
- [CVE-2026-73553](https://insights.sbomify.com/CVE-2026-73553/): Envoy: RBAC Authorization Bypass via Path Parameters (high 7.5)
- [CVE-2026-73552](https://insights.sbomify.com/CVE-2026-73552/): Envoy: HTTP RBAC safe_regex can fail open on RFC-valid obs-text header values (high 7.5)
- [CVE-2026-73551](https://insights.sbomify.com/CVE-2026-73551/): Envoy: Path normalization does not handle dot and dotdot segments with parameters (medium 5.3)
- [CVE-2026-73550](https://insights.sbomify.com/CVE-2026-73550/): Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoy (high 7.5)
- [CVE-2026-7355](https://insights.sbomify.com/CVE-2026-7355/): Use after free in Chrome (high 8.8)
- [CVE-2026-73549](https://insights.sbomify.com/CVE-2026-73549/): Denial of service in envoy (medium 5.3)
- [CVE-2026-73548](https://insights.sbomify.com/CVE-2026-73548/): Envoy: Cross-user response poisoning via a generic (non-WebSocket) HTTP upgrade on Envoy's shared backend pool (high 7.5)
- [CVE-2026-73547](https://insights.sbomify.com/CVE-2026-73547/): Envoy ext_authz: request `:path` pseudoheader dereferenced w/o null check (high 7.5)
- [CVE-2026-73546](https://insights.sbomify.com/CVE-2026-73546/): Envoy: Stored XSS in Admin Stats Interface (/stats?format=html) (high 7.4)
- [CVE-2026-73542](https://insights.sbomify.com/CVE-2026-73542/): Weak cryptography in Multiple SEIKO EPSON printers and scanners (medium 6.3)
- [CVE-2026-73541](https://insights.sbomify.com/CVE-2026-73541/): Denial of service in mpp (high 8.3)
- [CVE-2026-7354](https://insights.sbomify.com/CVE-2026-7354/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-73539](https://insights.sbomify.com/CVE-2026-73539/): Gitea external renderer argument injection and code execution (high 7.5)
- [CVE-2026-73537](https://insights.sbomify.com/CVE-2026-73537/): Cross-site scripting in Miraikan Assist App Android version (medium 5.1)
- [CVE-2026-73535](https://insights.sbomify.com/CVE-2026-73535/): Gitea second-factor bypass through OpenID identity linking (high 8.8)
- [CVE-2026-73533](https://insights.sbomify.com/CVE-2026-73533/): Ninja Tables Pro 5.2.11 Embedded Malicious Code via Tampered Plugin Build (critical 9.3)
- [CVE-2026-73532](https://insights.sbomify.com/CVE-2026-73532/): Fluent Forms Pro 6.2.7 Embedded Malicious Code via Tampered Plugin Build (critical 9.3)
- [CVE-2026-73531](https://insights.sbomify.com/CVE-2026-73531/): django-helpdesk < 2.3.3 Stored XSS via HTML Attachments (medium 5.3)
- [CVE-2026-73530](https://insights.sbomify.com/CVE-2026-73530/): Flyto2 Core < 2.28.0 SSRF Guard Bypass via is_private_ip() (medium 6.3)
- [CVE-2026-7353](https://insights.sbomify.com/CVE-2026-7353/): Memory corruption in Chrome (high 8.3)
- [CVE-2026-73529](https://insights.sbomify.com/CVE-2026-73529/): Plainpad Missing Rate Limiting via POST /v1/sessions (medium 6.9)
- [CVE-2026-73524](https://insights.sbomify.com/CVE-2026-73524/): Cypht < 2.12.2 XSS via FROM Email Header in Contacts Module (medium 5.1)
- [CVE-2026-73523](https://insights.sbomify.com/CVE-2026-73523/): COVESA Open1722 0.9.2 Stack Memory Disclosure via acf-can-listener.c Integer Truncation (high 8.7)
- [CVE-2026-73522](https://insights.sbomify.com/CVE-2026-73522/): COVESA Open1722 0.9.2 Stack Buffer Overflow via avtp_to_can() in acf-can-listener (high 8.7)
- [CVE-2026-7352](https://insights.sbomify.com/CVE-2026-7352/): Use after free in Chrome (high 8.3)
- [CVE-2026-73519](https://insights.sbomify.com/CVE-2026-73519/): WolfStack < 25.9.2 Hard-coded Secret Authentication Bypass via X-WolfStack-Secret (critical 9.3)
- [CVE-2026-73515](https://insights.sbomify.com/CVE-2026-73515/): PostGIS < 3.7.0beta2 Out-of-Bounds Read via FlatGeobuf Buffer (high 7.2)
- [CVE-2026-73514](https://insights.sbomify.com/CVE-2026-73514/): PostGIS address_standardizer Out-of-Bounds Write via standardize_address() (high 8.7)
- [CVE-2026-73513](https://insights.sbomify.com/CVE-2026-73513/): Envoy: oghttp2 upstream trailers incorrect handling (high 7.5)
- [CVE-2026-73512](https://insights.sbomify.com/CVE-2026-73512/): Envoy: use-after-free in QUIC on internal redirects (high 7.5)
- [CVE-2026-73511](https://insights.sbomify.com/CVE-2026-73511/): Auth bypass in envoy (medium 5.3)
- [CVE-2026-7351](https://insights.sbomify.com/CVE-2026-7351/): Race condition in Chrome (low 3.1)
- [CVE-2026-73509](https://insights.sbomify.com/CVE-2026-73509/): OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal (high 7.6)
- [CVE-2026-73508](https://insights.sbomify.com/CVE-2026-73508/): Netty: Memory Leak in DNS Record Decoder via Malformed Domain Names (medium 5.3)
- [CVE-2026-73507](https://insights.sbomify.com/CVE-2026-73507/): Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustion (high 7.5)
- [CVE-2026-73506](https://insights.sbomify.com/CVE-2026-73506/): Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data (medium 6.1)
- [CVE-2026-73505](https://insights.sbomify.com/CVE-2026-73505/): Oh My Posh: Arbitrary command execution via template injection in the path segment (high 7.8)
- [CVE-2026-73502](https://insights.sbomify.com/CVE-2026-73502/): kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has no schema (medium 5.3)
- [CVE-2026-73501](https://insights.sbomify.com/CVE-2026-73501/): kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default (critical 9.1)
- [CVE-2026-73500](https://insights.sbomify.com/CVE-2026-73500/): etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline (high 8.7)
- [CVE-2026-7350](https://insights.sbomify.com/CVE-2026-7350/): Use after free in Chrome (high 8.3)
- [CVE-2026-73499](https://insights.sbomify.com/CVE-2026-73499/): etcd: Watch API authorization bypass via open-ended range requests (high 7.1)
- [CVE-2026-73498](https://insights.sbomify.com/CVE-2026-73498/): mcp-atlassian: Arbitrary file read via missing path validation in confluence_upload_attachment (high 7.7)
- [CVE-2026-73497](https://insights.sbomify.com/CVE-2026-73497/): MCP Atlassian: DNS-rebinding TOCTOU bypass of the SSRF fix (CVE-2026-27826) (medium 6.5)
- [CVE-2026-73496](https://insights.sbomify.com/CVE-2026-73496/): MCP Atlassian: Arbitrary server-side file read via attachment upload (high 7.7)
- [CVE-2026-73495](https://insights.sbomify.com/CVE-2026-73495/): blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass) (high 7.4)
- [CVE-2026-73494](https://insights.sbomify.com/CVE-2026-73494/): blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser (high 7.4)
- [CVE-2026-73493](https://insights.sbomify.com/CVE-2026-73493/): http4s-blaze-server: Unbounded WebSocket message aggregation (high 7.5)
- [CVE-2026-73492](https://insights.sbomify.com/CVE-2026-73492/): Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons (low 2.3)
- [CVE-2026-73491](https://insights.sbomify.com/CVE-2026-73491/): Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references (low 2.3)
- [CVE-2026-73490](https://insights.sbomify.com/CVE-2026-73490/): Loofah: SVG `href` attribute bypasses local-reference restriction (medium 4.7)
- [CVE-2026-7349](https://insights.sbomify.com/CVE-2026-7349/): Use after free in Chrome (high 7.5)
- [CVE-2026-73489](https://insights.sbomify.com/CVE-2026-73489/): Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode records (medium 4.3)
- [CVE-2026-73488](https://insights.sbomify.com/CVE-2026-73488/): Flowise before 3.1.3 IDOR via customer-default-source endpoint (medium 6.0)
- [CVE-2026-73487](https://insights.sbomify.com/CVE-2026-73487/): Flowise before 3.1.3 Prompt Injection RCE via CSV Agent (critical 9.0)
- [CVE-2026-73486](https://insights.sbomify.com/CVE-2026-73486/): Flowise before 3.1.3 Code Injection via CSV Agent customReadCSV (critical 9.0)
- [CVE-2026-73485](https://insights.sbomify.com/CVE-2026-73485/): Flowise before 3.1.3 Remote Code Execution via Airtable Agent (critical 9.0)
- [CVE-2026-73484](https://insights.sbomify.com/CVE-2026-73484/): Flowise before 3.1.3 Sandbox Escape via Pandas Methods (high 8.6)
- [CVE-2026-73483](https://insights.sbomify.com/CVE-2026-73483/): Flowise before 3.1.3 Sandbox Escape via Puppeteer (critical 9.4)
- [CVE-2026-73482](https://insights.sbomify.com/CVE-2026-73482/): phpList < 3.7.0-RC5 Cross-Site Request Forgery via admins.php (high 7.2)
- [CVE-2026-73481](https://insights.sbomify.com/CVE-2026-73481/): phpList < 3.7.0-RC5 Cross-Site Request Forgery via Bounce Rules (medium 5.3)
- [CVE-2026-73480](https://insights.sbomify.com/CVE-2026-73480/): gdu Terminal Injection via Unstripped Escape Sequences (medium 4.8)
- [CVE-2026-7348](https://insights.sbomify.com/CVE-2026-7348/): Use after free in Chrome (high 8.8)
- [CVE-2026-73479](https://insights.sbomify.com/CVE-2026-73479/): dua-cli Terminal Escape Sequence Injection via Marked Paths (medium 4.8)
- [CVE-2026-73478](https://insights.sbomify.com/CVE-2026-73478/): Diff - Moderately critical - Access bypass - SA-CONTRIB-2026-096 (medium 5.3)
- [CVE-2026-73477](https://insights.sbomify.com/CVE-2026-73477/): Quick Tabs - Moderately critical - Access bypass - SA-CONTRIB-2026-099 (medium 5.3)
- [CVE-2026-73476](https://insights.sbomify.com/CVE-2026-73476/): External Authentication - Moderately critical - Access bypass - SA-CONTRIB-2026-098 (medium 5.4)
- [CVE-2026-73475](https://insights.sbomify.com/CVE-2026-73475/): Commerce PayPal - Moderately critical - Access bypass - SA-CONTRIB-2026-095 (critical 9.1)
- [CVE-2026-73474](https://insights.sbomify.com/CVE-2026-73474/): Entity Share Websub - Moderately critical - Server-side request forgery (SSRF) - SA-CONTRIB-2026-097 (medium 5.3)
- [CVE-2026-73470](https://insights.sbomify.com/CVE-2026-73470/): Apache Syncope: Delegating users can grant unowned Roles (critical 9.8)
- [CVE-2026-7347](https://insights.sbomify.com/CVE-2026-7347/): Use after free in Chrome (high 8.1)
- [CVE-2026-73469](https://insights.sbomify.com/CVE-2026-73469/): Security Advisory 0176 (medium 6.9)
- [CVE-2026-73468](https://insights.sbomify.com/CVE-2026-73468/): Security Advisory 0175 (high 7.1)
- [CVE-2026-73467](https://insights.sbomify.com/CVE-2026-73467/): Information disclosure in EOS (medium 6.0)
- [CVE-2026-73466](https://insights.sbomify.com/CVE-2026-73466/): On affected platforms running Arista EOS, under certain circumstances plaintext user passwords (medium 6.0)
- [CVE-2026-73465](https://insights.sbomify.com/CVE-2026-73465/): On affected platforms running Arista EOS, under certain circumstances plaintext private keys (medium 6.0)
- [CVE-2026-73464](https://insights.sbomify.com/CVE-2026-73464/): Security Advisory 0166 (high 8.7)
- [CVE-2026-73463](https://insights.sbomify.com/CVE-2026-73463/): Security Advisory 0169 (medium 6.0)
- [CVE-2026-73462](https://insights.sbomify.com/CVE-2026-73462/): Denial of service in EOS (high 7.1)
- [CVE-2026-73461](https://insights.sbomify.com/CVE-2026-73461/): Security Advisory 0163 (critical 9.4)
- [CVE-2026-73460](https://insights.sbomify.com/CVE-2026-73460/): Security Advisory 0160 (high 7.0)
- [CVE-2026-7346](https://insights.sbomify.com/CVE-2026-7346/): Memory corruption in Chrome (high 8.1)
- [CVE-2026-73459](https://insights.sbomify.com/CVE-2026-73459/): Security Advisory 0160 (high 7.0)
- [CVE-2026-73458](https://insights.sbomify.com/CVE-2026-73458/): Denial of service in EOS (critical 9.2)
- [CVE-2026-73457](https://insights.sbomify.com/CVE-2026-73457/): Information disclosure in EOS (medium 6.0)
- [CVE-2026-73456](https://insights.sbomify.com/CVE-2026-73456/): Code injection in EOS (critical 9.2)
- [CVE-2026-73455](https://insights.sbomify.com/CVE-2026-73455/): Security Advisory 0173 (high 8.9)
- [CVE-2026-73454](https://insights.sbomify.com/CVE-2026-73454/): Security Advisory 0165 (high 8.6)
- [CVE-2026-73453](https://insights.sbomify.com/CVE-2026-73453/): Security Advisory 0174 (critical 9.5)
- [CVE-2026-73451](https://insights.sbomify.com/CVE-2026-73451/): Security feature bypass in EOS (medium 6.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/400/