# Vulnerabilities published in 2026


- [CVE-2026-71350](https://insights.sbomify.com/CVE-2026-71350/): Windows Spaceport.sys Remote Code Execution Vulnerability (medium 6.8)
- [CVE-2026-7135](https://insights.sbomify.com/CVE-2026-7135/): GPAC MP4Box box_code_base.c elng_box_read out-of-bounds (medium 4.8)
- [CVE-2026-71349](https://insights.sbomify.com/CVE-2026-71349/): Windows Spaceport.sys Remote Code Execution Vulnerability (medium 6.8)
- [CVE-2026-71348](https://insights.sbomify.com/CVE-2026-71348/): Windows Spaceport.sys Remote Code Execution Vulnerability (medium 6.8)
- [CVE-2026-71347](https://insights.sbomify.com/CVE-2026-71347/): Windows Security Center Elevation of Privilege Vulnerability (medium 6.4)
- [CVE-2026-71345](https://insights.sbomify.com/CVE-2026-71345/): Windows Spaceport.sys Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-71343](https://insights.sbomify.com/CVE-2026-71343/): Windows Remote Access Connection Manager Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-71342](https://insights.sbomify.com/CVE-2026-71342/): Windows Remote Access Connection Manager Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-71341](https://insights.sbomify.com/CVE-2026-71341/): Windows Partition Management Driver Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-71340](https://insights.sbomify.com/CVE-2026-71340/): Windows File History Service Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-7134](https://insights.sbomify.com/CVE-2026-7134/): code-projects Online Lot Reservation System edithousepic.php unrestricted upload (medium 5.1)
- [CVE-2026-71339](https://insights.sbomify.com/CVE-2026-71339/): Windows Installer Elevation of Privilege Vulnerability (medium 6.7)
- [CVE-2026-71338](https://insights.sbomify.com/CVE-2026-71338/): Windows Failover Cluster Elevation of Privilege Vulnerability (medium 6.4)
- [CVE-2026-71337](https://insights.sbomify.com/CVE-2026-71337/): Windows Storage Management Provider Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-71336](https://insights.sbomify.com/CVE-2026-71336/): Windows Work Folder Service Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-71334](https://insights.sbomify.com/CVE-2026-71334/): Windows NFS Portmapper Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-71333](https://insights.sbomify.com/CVE-2026-71333/): Windows Remote Access Connection Manager Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-71332](https://insights.sbomify.com/CVE-2026-71332/): Windows Secure Socket Tunneling Protocol (SSTP) Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-71331](https://insights.sbomify.com/CVE-2026-71331/): Windows Device Health Attestation (DHA) Remote Code Execution Vulnerability (high 8.1)
- [CVE-2026-71330](https://insights.sbomify.com/CVE-2026-71330/): Windows Services for NFS ONCRPC XDR Driver Information Disclosure Vulnerability (high 7.5)
- [CVE-2026-7133](https://insights.sbomify.com/CVE-2026-7133/): code-projects Online Lot Reservation System activity.php unrestricted upload (medium 5.1)
- [CVE-2026-71329](https://insights.sbomify.com/CVE-2026-71329/): Windows NTFS Remote Code Execution Vulnerability (medium 6.8)
- [CVE-2026-71328](https://insights.sbomify.com/CVE-2026-71328/): .NET and Visual Studio Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-71327](https://insights.sbomify.com/CVE-2026-71327/): Traefik: Gateway API route identity collision allows cross-namespace backend hijacking (high 7.6)
- [CVE-2026-71326](https://insights.sbomify.com/CVE-2026-71326/): Traefik: BasicAuth singleflight key collision allows authenticated identity spoofing (low 2.1)
- [CVE-2026-71325](https://insights.sbomify.com/CVE-2026-71325/): Traefik: `allowCrossNamespace=false` bypass via `@kubernetescrd` TraefikService backendRef (medium 4.8)
- [CVE-2026-71324](https://insights.sbomify.com/CVE-2026-71324/): Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool (high 7.0)
- [CVE-2026-71322](https://insights.sbomify.com/CVE-2026-71322/): Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = False (medium 4.3)
- [CVE-2026-71321](https://insights.sbomify.com/CVE-2026-71321/): Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation (high 7.5)
- [CVE-2026-71320](https://insights.sbomify.com/CVE-2026-71320/): Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props (high 8.1)
- [CVE-2026-7132](https://insights.sbomify.com/CVE-2026-7132/): code-projects Online Lot Reservation System download.php readfile path traversal (medium 6.9)
- [CVE-2026-71319](https://insights.sbomify.com/CVE-2026-71319/): Nuxt.js Unauthenticated WebSocket RPC Call Leading to Remote Code Execution (critical 9.6)
- [CVE-2026-71318](https://insights.sbomify.com/CVE-2026-71318/): Nuxt: Unauthorized Component Instantiation via Server Island Props (medium 4.8)
- [CVE-2026-71317](https://insights.sbomify.com/CVE-2026-71317/): Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authority (medium 6.5)
- [CVE-2026-71316](https://insights.sbomify.com/CVE-2026-71316/): Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients (high 7.5)
- [CVE-2026-71315](https://insights.sbomify.com/CVE-2026-71315/): Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721) (high 8.2)
- [CVE-2026-71314](https://insights.sbomify.com/CVE-2026-71314/): Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering (high 7.5)
- [CVE-2026-71313](https://insights.sbomify.com/CVE-2026-71313/): rclone: Local Encoding Path Traversal (medium 6.9)
- [CVE-2026-71312](https://insights.sbomify.com/CVE-2026-71312/): rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Execution (high 8.0)
- [CVE-2026-71311](https://insights.sbomify.com/CVE-2026-71311/): rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines (medium 6.4)
- [CVE-2026-71310](https://insights.sbomify.com/CVE-2026-71310/): rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone Memory (medium 5.9)
- [CVE-2026-7131](https://insights.sbomify.com/CVE-2026-7131/): code-projects Online Lot Reservation System loginuser.php sql injection (medium 6.9)
- [CVE-2026-71309](https://insights.sbomify.com/CVE-2026-71309/): rclone: Incomplete path validation allows backend root escape in serve restic (high 8.6)
- [CVE-2026-71308](https://insights.sbomify.com/CVE-2026-71308/): Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates (high 8.1)
- [CVE-2026-71307](https://insights.sbomify.com/CVE-2026-71307/): Lemur: Authenticated low-privilege users can read plaintext destination credentials (SFTP password / private-key passphrase) via the destinations API (high 7.7)
- [CVE-2026-71303](https://insights.sbomify.com/CVE-2026-71303/): Lemur: Incomplete fix for GHSA-v2wp-frmc-5q3v -- ACME authority update endpoint allows non-admin to replace `acme_url` with internal IP, bypassing allowlist (high 7.7)
- [CVE-2026-71302](https://insights.sbomify.com/CVE-2026-71302/): Toptech TMS7 and TopHAT Session Fixation (high 7.5)
- [CVE-2026-71301](https://insights.sbomify.com/CVE-2026-71301/): Gitea private pull request title disclosure through markup (medium 4.3)
- [CVE-2026-71300](https://insights.sbomify.com/CVE-2026-71300/): Apache Camel: Camel-Atmosphere-Websocket: WebSocket dispatch header injection (critical 9.8)
- [CVE-2026-7130](https://insights.sbomify.com/CVE-2026-7130/): SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection (medium 6.9)
- [CVE-2026-71299](https://insights.sbomify.com/CVE-2026-71299/): Maestro: maestro: rest api write endpoints registered without authentication middleware (medium 6.5)
- [CVE-2026-71298](https://insights.sbomify.com/CVE-2026-71298/): Maestro: sql identifier injection via properties.* search filter and orderby field (medium 6.4)
- [CVE-2026-71297](https://insights.sbomify.com/CVE-2026-71297/): Maestro: maestro: grpc broker has no auth interceptor and client mtls is optional (medium 5.4)
- [CVE-2026-71294](https://insights.sbomify.com/CVE-2026-71294/): Cotonti CMS Comments Plugin PHP Object Injection via Unrestricted unserialize() in Create/Edit Actions (high 7.7)
- [CVE-2026-71293](https://insights.sbomify.com/CVE-2026-71293/): Statamic CMS Unguarded Exposure of 2FA Recovery Codes via Antlers current_user Variable (medium 6.2)
- [CVE-2026-71292](https://insights.sbomify.com/CVE-2026-71292/): Subrion CMS Admin Grid SQL Injection via Unwhitelisted ORDER BY sort Parameter (high 7.2)
- [CVE-2026-71291](https://insights.sbomify.com/CVE-2026-71291/): Bolt CMS Server-Side Template Injection via Unsandboxed allow_twig Field Rendering (high 8.8)
- [CVE-2026-71290](https://insights.sbomify.com/CVE-2026-71290/): Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM) (critical 9.1)
- [CVE-2026-7129](https://insights.sbomify.com/CVE-2026-7129/): SourceCodester Pharmacy Sales and Inventory System index.php cross site scripting (medium 5.3)
- [CVE-2026-71289](https://insights.sbomify.com/CVE-2026-71289/): NASA-AMMOS ANMS / JHUAPL dtnma-tools Unauthenticated Remote Command Execution via Exposed AMP Manager REST API (critical 9.8)
- [CVE-2026-71288](https://insights.sbomify.com/CVE-2026-71288/): Koha SQL Injection via order_by and {order}_ovalue Parameters in guided_reports.pl (high 8.8)
- [CVE-2026-71287](https://insights.sbomify.com/CVE-2026-71287/): Cacti sanitize_sql_column() Regex Allowlist Permits SQL Time-Delay Functions Leading to Blind SQL Injection (high 8.8)
- [CVE-2026-71286](https://insights.sbomify.com/CVE-2026-71286/): ember-dynamic-render-template Client-Side Template Injection via Unsanitized templateString (medium 6.1)
- [CVE-2026-71285](https://insights.sbomify.com/CVE-2026-71285/): Uptime Kuma Stored XSS via Matomo Analytics Site ID on Public Status Pages (high 8.1)
- [CVE-2026-71284](https://insights.sbomify.com/CVE-2026-71284/): Fledge IoT Gateway Backup Restore OS Command Injection via Tar Member Filename (high 7.2)
- [CVE-2026-71283](https://insights.sbomify.com/CVE-2026-71283/): Fledge IoT Gateway Backup Restore Tar Path Traversal (medium 4.9)
- [CVE-2026-71282](https://insights.sbomify.com/CVE-2026-71282/): ChirpStack SQLite Backend SQL Injection via Device Tag Key in ListDevices Filter (medium 6.5)
- [CVE-2026-71281](https://insights.sbomify.com/CVE-2026-71281/): peft Unsafe Deserialization via torch.load() Without weights_only in LoRA-GA and CorDA Modules (high 8.8)
- [CVE-2026-71280](https://insights.sbomify.com/CVE-2026-71280/): go-shiori Server-Side Request Forgery via Unrestricted Bookmark URL Fetch (high 8.5)
- [CVE-2026-7128](https://insights.sbomify.com/CVE-2026-7128/): SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection (medium 6.9)
- [CVE-2026-71279](https://insights.sbomify.com/CVE-2026-71279/): Zigbee2MQTT External JS Extension Path Traversal Leading to Remote Code Execution (high 8.1)
- [CVE-2026-71278](https://insights.sbomify.com/CVE-2026-71278/): rust-iot-platform Unauthenticated Remote Code Execution via Unsandboxed Calc-Rule Script Evaluation (critical 9.8)
- [CVE-2026-71277](https://insights.sbomify.com/CVE-2026-71277/): rust-iot-platform Authentication Bypass via Non-Validated Authorization Header (critical 9.1)
- [CVE-2026-71276](https://insights.sbomify.com/CVE-2026-71276/): Magistrala (formerly Mainflux) IoT Platform SQL Injection via format Query Parameter (high 7.1)
- [CVE-2026-71275](https://insights.sbomify.com/CVE-2026-71275/): OpenBK7231T - Reflected XSS via OTA host Parameter (medium 5.4)
- [CVE-2026-71274](https://insights.sbomify.com/CVE-2026-71274/): OpenBK7231T Stored XSS via Unsanitized MQTT-Set Channel Labels (high 8.5)
- [CVE-2026-71273](https://insights.sbomify.com/CVE-2026-71273/): OpenBK7231T CSRF in /cfg_wifi_set Leading to Implicit Web Password Disable and WiFi Hijack (medium 6.5)
- [CVE-2026-71272](https://insights.sbomify.com/CVE-2026-71272/): Memos Webhook DNS Rebinding TOCTOU SSRF in safeDialContext() (high 8.5)
- [CVE-2026-71271](https://insights.sbomify.com/CVE-2026-71271/): Memos Webhook SSRF via 0.0.0.0 Reserved-IP Bypass (high 8.5)
- [CVE-2026-71270](https://insights.sbomify.com/CVE-2026-71270/): Stirling-PDF Server-Side Request Forgery via /api/v1/convert/url/pdf WeasyPrint Subprocess (high 8.6)
- [CVE-2026-7127](https://insights.sbomify.com/CVE-2026-7127/): SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection (medium 6.9)
- [CVE-2026-71268](https://insights.sbomify.com/CVE-2026-71268/): OpenPLC Runtime v3 Path Traversal in Structured Text FILE Directive Leading to Arbitrary File Write (critical 9.9)
- [CVE-2026-71267](https://insights.sbomify.com/CVE-2026-71267/): microtar Stack Buffer Overflow in mtar_write_file_header() and mtar_write_dir_header() (critical 9.8)
- [CVE-2026-71266](https://insights.sbomify.com/CVE-2026-71266/): tinyobjloader-c Stack Buffer Overflow in MTL Material File Line Parsing (high 7.8)
- [CVE-2026-71265](https://insights.sbomify.com/CVE-2026-71265/): Domoticz MochadTCP Stack Buffer Overflow via MOCHAD_RFSEC strcpy() (high 7.5)
- [CVE-2026-71264](https://insights.sbomify.com/CVE-2026-71264/): WLED Unauthenticated Configuration Disclosure via /json/cfg and Global Settings-PIN Lock State (high 8.2)
- [CVE-2026-71263](https://insights.sbomify.com/CVE-2026-71263/): FreeModbus LINUXTCP Port Off-by-One Global Buffer Overflow in xMBPortTCPPool() (critical 9.1)
- [CVE-2026-71262](https://insights.sbomify.com/CVE-2026-71262/): IoTSharp BlobStorageController Missing Authentication and Path Traversal (critical 9.8)
- [CVE-2026-71261](https://insights.sbomify.com/CVE-2026-71261/): dr_wav.h W64 CUE Chunk Metadata Parsing Integer Overflow Leading to Heap Buffer Overflow on 32-bit Builds (high 7.8)
- [CVE-2026-71260](https://insights.sbomify.com/CVE-2026-71260/): ESPHome web_server Plaintext Password Disclosure via JSON "value" Field (medium 6.5)
- [CVE-2026-7126](https://insights.sbomify.com/CVE-2026-7126/): SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection (medium 6.9)
- [CVE-2026-71259](https://insights.sbomify.com/CVE-2026-71259/): ESPHome external_components file:// Scheme Validation Bypass Leading to Remote Code Execution (high 8.6)
- [CVE-2026-71257](https://insights.sbomify.com/CVE-2026-71257/): Apache Wicket: Configured file upload limits are not enforced when the multipart request has already been parsed (high 7.5)
- [CVE-2026-71256](https://insights.sbomify.com/CVE-2026-71256/): nanoMODBUS Client-Side Out-of-Bounds Read Leading to Wild-Pointer Write via object_id (critical 9.8)
- [CVE-2026-71255](https://insights.sbomify.com/CVE-2026-71255/): nanoMODBUS Client-Side Out-of-Bounds Write via object_length in recv_read_device_identification_res() (high 8.6)
- [CVE-2026-71254](https://insights.sbomify.com/CVE-2026-71254/): nanoMODBUS Server-Side Out-of-Bounds Write in handle_read_file_record() (critical 9.8)
- [CVE-2026-71253](https://insights.sbomify.com/CVE-2026-71253/): Apache Johnzon: ClassConverter loads & static-initializes an attacker-named class from untrusted JSON (critical 9.8)
- [CVE-2026-71252](https://insights.sbomify.com/CVE-2026-71252/): toner-management - Unauthenticated State-Changing Admin Actions (high 8.2)
- [CVE-2026-71251](https://insights.sbomify.com/CVE-2026-71251/): Akaunting - Cross-Company Media IDOR in Customer Portal Download Endpoint (medium 6.5)
- [CVE-2026-71250](https://insights.sbomify.com/CVE-2026-71250/): Firefly III - Webhook URL Validation Explicitly Allows Loopback and Is Bypassable via DNS Rebinding (medium 4.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/419/