# Vulnerabilities published in 2026


- [CVE-2026-71473](https://insights.sbomify.com/CVE-2026-71473/): Code injection in Red Hat Advanced Cluster Management for Kubernetes 2.11 (high 8.5)
- [CVE-2026-71472](https://insights.sbomify.com/CVE-2026-71472/): Command injection in Red Hat Advanced Cluster Management for Kubernetes 2.11 (critical 9.1)
- [CVE-2026-71471](https://insights.sbomify.com/CVE-2026-71471/): Code injection in Red Hat Advanced Cluster Management for Kubernetes 2.11 (critical 9.0)
- [CVE-2026-71470](https://insights.sbomify.com/CVE-2026-71470/): Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2.11 (critical 9.1)
- [CVE-2026-7147](https://insights.sbomify.com/CVE-2026-7147/): JoeCastrom mcp-chat-studio LLM Models API llm.js server-side request forgery (medium 6.9)
- [CVE-2026-71469](https://insights.sbomify.com/CVE-2026-71469/): Acm-search-v2-api-rhel9: search-v2-api: unbounded tokenreviews cache allows unauthenticated memory-exhaustion dos (high 7.5)
- [CVE-2026-71468](https://insights.sbomify.com/CVE-2026-71468/): Acm-search-v2-api-rhel9: search-v2-api: cross-user bearer-token reuse via global federation-config cache (medium 5.3)
- [CVE-2026-71467](https://insights.sbomify.com/CVE-2026-71467/): Acm-search-v2-api-rhel9: search-v2-api: authentication bypass on /federated via upgrade: websocket header spoofing (high 7.5)
- [CVE-2026-71465](https://insights.sbomify.com/CVE-2026-71465/): Command injection in Red Hat Ansible Automation Platform 2.5 for RHEL 8 (low 3.1)
- [CVE-2026-71464](https://insights.sbomify.com/CVE-2026-71464/): Command injection in Red Hat Ansible Automation Platform 2.5 for RHEL 8 (low 3.1)
- [CVE-2026-71463](https://insights.sbomify.com/CVE-2026-71463/): Information disclosure in Red Hat Ansible Automation Platform 2.5 for RHEL 8 (low 2.7)
- [CVE-2026-71462](https://insights.sbomify.com/CVE-2026-71462/): Information disclosure in Red Hat Ansible Automation Platform 2.5 for RHEL 8 (medium 4.1)
- [CVE-2026-71461](https://insights.sbomify.com/CVE-2026-71461/): Information disclosure in Red Hat Ansible Automation Platform 2 (medium 4.3)
- [CVE-2026-71460](https://insights.sbomify.com/CVE-2026-71460/): Missing authorization in Red Hat Ansible Automation Platform 2.5 for RHEL 8 (medium 4.3)
- [CVE-2026-7146](https://insights.sbomify.com/CVE-2026-7146/): AlejandroArciniegas mcp-data-vis HTTP Request server.js axios server-side request forgery (medium 6.9)
- [CVE-2026-71459](https://insights.sbomify.com/CVE-2026-71459/): Missing authorization in Red Hat Ansible Automation Platform 2.5 for RHEL 8 (medium 5.0)
- [CVE-2026-71458](https://insights.sbomify.com/CVE-2026-71458/): Information disclosure in Red Hat Ansible Automation Platform 2.5 for RHEL 8 (medium 5.0)
- [CVE-2026-71456](https://insights.sbomify.com/CVE-2026-71456/): Hardcoded credentials in Kantech Entrapass (high 8.5)
- [CVE-2026-71455](https://insights.sbomify.com/CVE-2026-71455/): Information disclosure in Kantech Entrapass (medium 5.3)
- [CVE-2026-71454](https://insights.sbomify.com/CVE-2026-71454/): Cross-site scripting in CAPEC-63 (medium 5.8)
- [CVE-2026-71453](https://insights.sbomify.com/CVE-2026-71453/): Path traversal in EasyIO FS32 (medium 5.6)
- [CVE-2026-71452](https://insights.sbomify.com/CVE-2026-71452/): Command injection in EasyIO FS32 (high 7.2)
- [CVE-2026-71451](https://insights.sbomify.com/CVE-2026-71451/): Command injection in EasyIO FS32 (medium 5.6)
- [CVE-2026-7145](https://insights.sbomify.com/CVE-2026-7145/): mettle sendportal Invitation WorkspaceInvitationsController.php destroy authorization (medium 5.3)
- [CVE-2026-71449](https://insights.sbomify.com/CVE-2026-71449/): Hardcoded credentials in EasyIO FS32 (critical 9.3)
- [CVE-2026-71448](https://insights.sbomify.com/CVE-2026-71448/): Misconfiguration in EasyIO FS32 (medium 5.6)
- [CVE-2026-71447](https://insights.sbomify.com/CVE-2026-71447/): Stored Cross-Site Scripting in Chat and Forum Translation Controls in ail-framework (medium 6.9)
- [CVE-2026-71446](https://insights.sbomify.com/CVE-2026-71446/): Stored Cross-Site Scripting in AIL Framework Domain Screenshot View (medium 6.9)
- [CVE-2026-71445](https://insights.sbomify.com/CVE-2026-71445/): Authenticated Reflected Cross-Site Scripting in Tag Error Responses in ail-framework (high 8.2)
- [CVE-2026-71444](https://insights.sbomify.com/CVE-2026-71444/): CAI Content Credentials | Integer Underflow (Wrap or Wraparound) (CWE-191) (medium 6.2)
- [CVE-2026-71443](https://insights.sbomify.com/CVE-2026-71443/): CAI Content Credentials | Improper Input Validation (CWE-20) (high 7.5)
- [CVE-2026-71442](https://insights.sbomify.com/CVE-2026-71442/): CAI Content Credentials | Integer Underflow (Wrap or Wraparound) (CWE-191) (high 7.5)
- [CVE-2026-71441](https://insights.sbomify.com/CVE-2026-71441/): Illustrator | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2026-71440](https://insights.sbomify.com/CVE-2026-71440/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2026-7144](https://insights.sbomify.com/CVE-2026-7144/): 1000 Projects Portfolio Management System MCA update_passwd_process.php authorization (medium 5.3)
- [CVE-2026-71439](https://insights.sbomify.com/CVE-2026-71439/): Mermaid radar diagrams are vulnerable to DoS (medium 5.3)
- [CVE-2026-71438](https://insights.sbomify.com/CVE-2026-71438/): Mermaid configuration APIs allow prototype pollution (low 2.4)
- [CVE-2026-71437](https://insights.sbomify.com/CVE-2026-71437/): Mermaid Architecture diagrams are vulnerable to prototype pollution (medium 6.5)
- [CVE-2026-71436](https://insights.sbomify.com/CVE-2026-71436/): Mermaid XY Charts are vulnerable to an infinite loop DoS (medium 5.3)
- [CVE-2026-71435](https://insights.sbomify.com/CVE-2026-71435/): Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template (medium 6.1)
- [CVE-2026-71434](https://insights.sbomify.com/CVE-2026-71434/): Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types (medium 5.3)
- [CVE-2026-71433](https://insights.sbomify.com/CVE-2026-71433/): LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores (medium 5.3)
- [CVE-2026-71430](https://insights.sbomify.com/CVE-2026-71430/): node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable ToLocalChecked on empty MaybeLocal) when the result exceeds V8's max string length (medium 6.2)
- [CVE-2026-7143](https://insights.sbomify.com/CVE-2026-7143/): 1000 Projects Portfolio Management System MCA block_status.php sql injection (medium 5.3)
- [CVE-2026-71429](https://insights.sbomify.com/CVE-2026-71429/): stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS) (medium 6.2)
- [CVE-2026-71428](https://insights.sbomify.com/CVE-2026-71428/): unstructured: Server-Side Request Forgery in the URL-based partitioning (critical 9.3)
- [CVE-2026-71426](https://insights.sbomify.com/CVE-2026-71426/): GetSimple CMS: Authenticated Stored Local File Inclusion (LFI) via page "template" field (high 7.1)
- [CVE-2026-71424](https://insights.sbomify.com/CVE-2026-71424/): Onyx: Cross-user OAuth-token leak via /api/mcp/servers* for per-user MCP servers (critical 9.6)
- [CVE-2026-7142](https://insights.sbomify.com/CVE-2026-7142/): Wooey API Endpoint scripts.py add_or_update_script improper authorization (medium 5.3)
- [CVE-2026-71418](https://insights.sbomify.com/CVE-2026-71418/): Suricata doh2: crafted HTTP/2 DATA frames can cause quadratic CPU consumption (high 7.5)
- [CVE-2026-71417](https://insights.sbomify.com/CVE-2026-71417/): Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking it (high 7.3)
- [CVE-2026-71416](https://insights.sbomify.com/CVE-2026-71416/): Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH) (high 8.8)
- [CVE-2026-71415](https://insights.sbomify.com/CVE-2026-71415/): Kirby: File upload permissions are not checked during processing of chunk data (high 7.1)
- [CVE-2026-7141](https://insights.sbomify.com/CVE-2026-7141/): vLLM KV Block kv_cache_interface.py has_mamba_layers uninitialized resource (medium 6.3)
- [CVE-2026-71408](https://insights.sbomify.com/CVE-2026-71408/): Denial of service in FortiOS (medium 5.0)
- [CVE-2026-71407](https://insights.sbomify.com/CVE-2026-71407/): Memory corruption in FortiOS (medium 5.1)
- [CVE-2026-71404](https://insights.sbomify.com/CVE-2026-71404/): Rancher: Ownership-less ClusterRole overwrite via attacker-controlled cr-name annotation on GlobalRole (high 8.7)
- [CVE-2026-71403](https://insights.sbomify.com/CVE-2026-71403/): Rancher: Identity-field mutation in /v3/users allows account hijack via principal rebind (medium 6.1)
- [CVE-2026-71402](https://insights.sbomify.com/CVE-2026-71402/): wicked: out-of-bounds read in the DHCPv4 option parser due to payload length taken from the IP total length (medium 5.3)
- [CVE-2026-71401](https://insights.sbomify.com/CVE-2026-71401/): wicked: integer underflow of the UDP length in ni_capture_inspect_udp_header() leads to an out-of-bounds read (medium 5.3)
- [CVE-2026-7140](https://insights.sbomify.com/CVE-2026-7140/): Totolink A8000RU CGI cstecgi.cgi CsteSystem os command injection (critical 9.3)
- [CVE-2026-71399](https://insights.sbomify.com/CVE-2026-71399/): Adobe XD | Buffer Overflow (CWE-120) (high 7.8)
- [CVE-2026-71398](https://insights.sbomify.com/CVE-2026-71398/): Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863) (critical 10.0)
- [CVE-2026-71396](https://insights.sbomify.com/CVE-2026-71396/): Use of Hard-coded Credentials in Bendix EC80 Brake ECU (medium 5.3)
- [CVE-2026-71394](https://insights.sbomify.com/CVE-2026-71394/): Heap Use of Uninitialized Memory in GNU Emacs for Android (medium 5.3)
- [CVE-2026-71393](https://insights.sbomify.com/CVE-2026-71393/): Heap Buffer Overflow in GNU Emacs for Android (medium 5.3)
- [CVE-2026-71392](https://insights.sbomify.com/CVE-2026-71392/): Integer Overflow in GNU Emacs for Android (medium 5.3)
- [CVE-2026-71391](https://insights.sbomify.com/CVE-2026-71391/): Off-by-One Error in GNU Emacs for Android (medium 5.3)
- [CVE-2026-71390](https://insights.sbomify.com/CVE-2026-71390/): CAI Content Credentials | Improper Input Validation (CWE-20) (medium 4.0)
- [CVE-2026-7139](https://insights.sbomify.com/CVE-2026-7139/): Totolink A8000RU CGI cstecgi.cgi setWiFiAclRules os command injection (critical 9.3)
- [CVE-2026-71389](https://insights.sbomify.com/CVE-2026-71389/): CAI Content Credentials | Integer Underflow (Wrap or Wraparound) (CWE-191) (medium 6.2)
- [CVE-2026-71388](https://insights.sbomify.com/CVE-2026-71388/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-71387](https://insights.sbomify.com/CVE-2026-71387/): ColdFusion | Incorrect Authorization (CWE-863) (high 8.8)
- [CVE-2026-71386](https://insights.sbomify.com/CVE-2026-71386/): ColdFusion | Cross-site Scripting (XSS) (CWE-79) (high 8.8)
- [CVE-2026-71385](https://insights.sbomify.com/CVE-2026-71385/): ColdFusion | Incorrect Authorization (CWE-863) (high 8.4)
- [CVE-2026-71384](https://insights.sbomify.com/CVE-2026-71384/): ColdFusion | Incorrect Authorization (CWE-863) (critical 9.6)
- [CVE-2026-71383](https://insights.sbomify.com/CVE-2026-71383/): ColdFusion | Incorrect Authorization (CWE-863) (high 7.3)
- [CVE-2026-71382](https://insights.sbomify.com/CVE-2026-71382/): Substance3D - Sampler | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-71381](https://insights.sbomify.com/CVE-2026-71381/): Adobe Genuine Software Integrity Service | CWE-863 Incorrect Authorization (medium 4.0)
- [CVE-2026-71380](https://insights.sbomify.com/CVE-2026-71380/): httpd applies no timeout while receiving a request body, parking a worker on a stalled client (high 8.7)
- [CVE-2026-7138](https://insights.sbomify.com/CVE-2026-7138/): Totolink A8000RU CGI cstecgi.cgi setNtpCfg os command injection (critical 9.3)
- [CVE-2026-71379](https://insights.sbomify.com/CVE-2026-71379/): Toptech TMS7 and TopHAT Files or Directories Accessible to External Parties (critical 10.0)
- [CVE-2026-71378](https://insights.sbomify.com/CVE-2026-71378/): Apache Wicket: Cross-Site Request Forgery (CSRF) protection bypass in ResourceIsolationRequestCycleListener (medium 4.6)
- [CVE-2026-71377](https://insights.sbomify.com/CVE-2026-71377/): Command Argument Injection Vulnerability in Cosminexus Component Container (critical 9.8)
- [CVE-2026-71376](https://insights.sbomify.com/CVE-2026-71376/): OS Command Injection Vulnerability in Cosminexus Component Container (critical 9.8)
- [CVE-2026-71375](https://insights.sbomify.com/CVE-2026-71375/): XXE Vulnerability in Cosminexus Component Container (high 7.4)
- [CVE-2026-71374](https://insights.sbomify.com/CVE-2026-71374/): Deserialization of Untrusted Data Vulnerability in Cosminexus Component Container (critical 9.8)
- [CVE-2026-7137](https://insights.sbomify.com/CVE-2026-7137/): Totolink A8000RU CGI cstecgi.cgi setStorageCfg os command injection (critical 9.3)
- [CVE-2026-71368](https://insights.sbomify.com/CVE-2026-71368/): Cross-site scripting in F-RevoCRM (medium 5.1)
- [CVE-2026-71366](https://insights.sbomify.com/CVE-2026-71366/): Awx: notification backends allow ssrf and credential leakage (high 7.7)
- [CVE-2026-71365](https://insights.sbomify.com/CVE-2026-71365/): Awx: webhook status callback ssrf leaks the git pat (high 7.7)
- [CVE-2026-71364](https://insights.sbomify.com/CVE-2026-71364/): Awx: project archive extraction allows path traversal file writes (high 7.2)
- [CVE-2026-71362](https://insights.sbomify.com/CVE-2026-71362/): Adobe Commerce and Magento Incorrect Authorization Vulnerability (critical 9.1, exploited in the wild)
- [CVE-2026-71360](https://insights.sbomify.com/CVE-2026-71360/): CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400) (high 7.5)
- [CVE-2026-7136](https://insights.sbomify.com/CVE-2026-7136/): Totolink A8000RU CGI cstecgi.cgi setDmzCfg os command injection (critical 9.3)
- [CVE-2026-71357](https://insights.sbomify.com/CVE-2026-71357/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-71356](https://insights.sbomify.com/CVE-2026-71356/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-71353](https://insights.sbomify.com/CVE-2026-71353/): Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-71352](https://insights.sbomify.com/CVE-2026-71352/): Windows Remote Access Connection Manager Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-71351](https://insights.sbomify.com/CVE-2026-71351/): Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability (high 7.0)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/418/