# Vulnerabilities published in 2026


- [CVE-2026-70688](https://insights.sbomify.com/CVE-2026-70688/): Missing authorization in Oracle Essbase (high 8.8)
- [CVE-2026-70687](https://insights.sbomify.com/CVE-2026-70687/): Missing authorization in Oracle Marketing (high 7.7)
- [CVE-2026-70686](https://insights.sbomify.com/CVE-2026-70686/): Missing authorization in Oracle General Ledger (high 8.8)
- [CVE-2026-70685](https://insights.sbomify.com/CVE-2026-70685/): Missing authorization in Oracle Hyperion Calculation Manager (high 7.9)
- [CVE-2026-70684](https://insights.sbomify.com/CVE-2026-70684/): Missing authorization in Oracle Enterprise Manager Base Platform (high 8.1)
- [CVE-2026-70683](https://insights.sbomify.com/CVE-2026-70683/): Missing authorization in Oracle Hyperion Calculation Manager (medium 4.3)
- [CVE-2026-70682](https://insights.sbomify.com/CVE-2026-70682/): Missing authorization in Oracle Hyperion Calculation Manager (low 3.7)
- [CVE-2026-70681](https://insights.sbomify.com/CVE-2026-70681/): Missing authorization in Oracle Applications DBA (high 7.5)
- [CVE-2026-70680](https://insights.sbomify.com/CVE-2026-70680/): Missing authorization in Oracle Applications DBA (high 7.1)
- [CVE-2026-7068](https://insights.sbomify.com/CVE-2026-7068/): D-Link DIR-825 nmbd sserver.c NMBD_process buffer overflow (high 8.7)
- [CVE-2026-70679](https://insights.sbomify.com/CVE-2026-70679/): Missing authorization in Oracle Hyperion Calculation Manager (medium 5.3)
- [CVE-2026-70678](https://insights.sbomify.com/CVE-2026-70678/): Missing authorization in Oracle Hyperion Calculation Manager (high 7.6)
- [CVE-2026-70677](https://insights.sbomify.com/CVE-2026-70677/): Missing authorization in Oracle Hyperion Calculation Manager (medium 5.9)
- [CVE-2026-70676](https://insights.sbomify.com/CVE-2026-70676/): Missing authorization in Oracle Hyperion Calculation Manager (high 7.0)
- [CVE-2026-70675](https://insights.sbomify.com/CVE-2026-70675/): Missing authorization in Oracle Reports Developer (high 8.1)
- [CVE-2026-70674](https://insights.sbomify.com/CVE-2026-70674/): Missing authorization in Oracle Reports Developer (high 8.8)
- [CVE-2026-70673](https://insights.sbomify.com/CVE-2026-70673/): Missing authorization in Oracle Reports Developer (critical 9.3)
- [CVE-2026-70672](https://insights.sbomify.com/CVE-2026-70672/): Missing authorization in Oracle Reports Developer (high 7.4)
- [CVE-2026-70671](https://insights.sbomify.com/CVE-2026-70671/): Missing authorization in Oracle Reports Developer (high 8.1)
- [CVE-2026-70670](https://insights.sbomify.com/CVE-2026-70670/): Missing authorization in Oracle Reports Developer (critical 9.6)
- [CVE-2026-7067](https://insights.sbomify.com/CVE-2026-7067/): D-Link DIR-822 udhcpd DHCP Service dhcpd.c system command injection (medium 6.9)
- [CVE-2026-70669](https://insights.sbomify.com/CVE-2026-70669/): Missing authorization in Oracle Reports Developer (critical 9.8)
- [CVE-2026-70668](https://insights.sbomify.com/CVE-2026-70668/): Missing authorization in Oracle Reports Developer (critical 9.1)
- [CVE-2026-70667](https://insights.sbomify.com/CVE-2026-70667/): Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for GHSA-54vg-pfh7-jq95) (medium 6.3)
- [CVE-2026-70666](https://insights.sbomify.com/CVE-2026-70666/): Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs (high 7.4)
- [CVE-2026-70665](https://insights.sbomify.com/CVE-2026-70665/): Doorkeeper OpenID Connect: DCR endpoint persists unvalidated client-supplied scopes (medium 4.2)
- [CVE-2026-7066](https://insights.sbomify.com/CVE-2026-7066/): choieastsea simple-openstack-mcp server.py exec_openstack os command injection (medium 6.9)
- [CVE-2026-70658](https://insights.sbomify.com/CVE-2026-70658/): pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifier (high 7.4)
- [CVE-2026-70657](https://insights.sbomify.com/CVE-2026-70657/): Copyparty: file/dirkey confusion (medium 4.3)
- [CVE-2026-70656](https://insights.sbomify.com/CVE-2026-70656/): Checkmate: Regular Expression Denial of Service (ReDoS) via User-Controlled Regex in Monitor Advanced Matching (medium 4.9)
- [CVE-2026-70654](https://insights.sbomify.com/CVE-2026-70654/): libvips: A well-crafted PPM image processed via a custom source could lead to possible heap buffer write overflow (medium 5.8)
- [CVE-2026-70653](https://insights.sbomify.com/CVE-2026-70653/): libvips: Possible heap-based buffer read overflow when decoding a well-crafted RLE Radiance image (medium 4.8)
- [CVE-2026-70652](https://insights.sbomify.com/CVE-2026-70652/): libvips: Possible heap-based buffer read overflow when resizing and re-encoding a JPEG with gain map (low 2.0)
- [CVE-2026-70651](https://insights.sbomify.com/CVE-2026-70651/): libvips: Possible integer overflow when reading multi-page TIFF images via ImageMagick (medium 6.9)
- [CVE-2026-70650](https://insights.sbomify.com/CVE-2026-70650/): Cross-site scripting in GetSimpleCMS-CE (high 8.8)
- [CVE-2026-7065](https://insights.sbomify.com/CVE-2026-7065/): BidingCC BuildingAI Remote Upload API file-storage.service.ts uploadRemoteFile server-side request forgery (medium 6.9)
- [CVE-2026-70646](https://insights.sbomify.com/CVE-2026-70646/): aiosend: Deserialization of request body before signature verification (Pre-auth DoS) in webhook handler (high 7.5)
- [CVE-2026-70640](https://insights.sbomify.com/CVE-2026-70640/): llama.cpp b1886–b7445 Race Condition Use-After-Free via llama-android.cpp (high 7.3)
- [CVE-2026-7064](https://insights.sbomify.com/CVE-2026-7064/): AgentDeskAI browser-tools-mcp browser-connector.ts os command injection (medium 6.9)
- [CVE-2026-70639](https://insights.sbomify.com/CVE-2026-70639/): llama.cpp b1886–b7445 Null Pointer Dereference DoS via llama-android.cpp (medium 6.8)
- [CVE-2026-70638](https://insights.sbomify.com/CVE-2026-70638/): llama.cpp b1886–b7445 Integer Overflow via new_1batch() in llama-android.cpp (high 8.5)
- [CVE-2026-70637](https://insights.sbomify.com/CVE-2026-70637/): LightFTP 2.4 Data Race Condition via ABOR Command in ftpserv.c (high 8.2)
- [CVE-2026-70636](https://insights.sbomify.com/CVE-2026-70636/): Flowise 3.1.4 Authentication Bypass via OAuth2 Credential Refresh Endpoint (high 8.7)
- [CVE-2026-70635](https://insights.sbomify.com/CVE-2026-70635/): TimescaleDB 2.29.1 Out-of-Bounds Read DoS via Bulk Dictionary Decompression Negative Index (high 7.1)
- [CVE-2026-70634](https://insights.sbomify.com/CVE-2026-70634/): TimescaleDB 2.29.1 Out-of-Bounds Read Information Disclosure via Dictionary Compression Reverse Iterator (high 7.2)
- [CVE-2026-70633](https://insights.sbomify.com/CVE-2026-70633/): TimescaleDB 2.29.1 Out-of-Bounds Read DoS via Gorilla Compression Reverse Iterator (high 7.1)
- [CVE-2026-70632](https://insights.sbomify.com/CVE-2026-70632/): FFmpeg 4.4 < 9.0 Heap Out-of-Bounds Write in CFHD Decoder via AVI Demuxing (high 8.5)
- [CVE-2026-70631](https://insights.sbomify.com/CVE-2026-70631/): FFmpeg 0.5 < 9.0 Uninitialized Heap Memory Read in TIFF Decoder (medium 6.8)
- [CVE-2026-70630](https://insights.sbomify.com/CVE-2026-70630/): FFmpeg 3.0 < 9.0 Uninitialized Heap Memory Read in Screenpresso Decoder (medium 6.8)
- [CVE-2026-7063](https://insights.sbomify.com/CVE-2026-7063/): code-projects Employee Management System Endpoint eprocess.php sql injection (medium 6.9)
- [CVE-2026-70629](https://insights.sbomify.com/CVE-2026-70629/): FFmpeg 3.0 < 9.0 Uninitialized Heap Memory Read in RSCC Decoder (medium 6.8)
- [CVE-2026-70628](https://insights.sbomify.com/CVE-2026-70628/): FFmpeg 0.5 < 9.0 DVB Subtitle Parser Heap Buffer Overflow via WTV File (high 8.5)
- [CVE-2026-70626](https://insights.sbomify.com/CVE-2026-70626/): NLTK before 3.9.4 Symlink Escape via CorpusReader (high 8.6)
- [CVE-2026-70622](https://insights.sbomify.com/CVE-2026-70622/): tar-rs 0.4.11 - 0.4.46 Symlink Escape via append_dir_all() (high 7.1)
- [CVE-2026-70620](https://insights.sbomify.com/CVE-2026-70620/): Odysseus SSRF via Embedding Endpoint Configuration (medium 6.1)
- [CVE-2026-7062](https://insights.sbomify.com/CVE-2026-7062/): Intina47 context-sync Git Integration git-integration.ts os command injection (medium 6.9)
- [CVE-2026-70619](https://insights.sbomify.com/CVE-2026-70619/): Odysseus Missing Admin Authorization via Embedding Endpoint Routes (high 8.7)
- [CVE-2026-70618](https://insights.sbomify.com/CVE-2026-70618/): Spacebar Server Missing Authorization via member-ids Endpoint (medium 5.3)
- [CVE-2026-70617](https://insights.sbomify.com/CVE-2026-70617/): Spacebar Server Missing Authorization via Group DM Recipient Endpoint (high 8.6)
- [CVE-2026-70616](https://insights.sbomify.com/CVE-2026-70616/): boringproxy 0.10.0 Resource Exhaustion DoS via GET /loading endpoint (high 7.1)
- [CVE-2026-70615](https://insights.sbomify.com/CVE-2026-70615/): boringproxy 0.10.0 SSH authorized_keys Injection via Tunnel Creation (high 8.5)
- [CVE-2026-70612](https://insights.sbomify.com/CVE-2026-70612/): Electron: Sandboxed iframes can launch external protocol handlers (medium 5.4)
- [CVE-2026-70611](https://insights.sbomify.com/CVE-2026-70611/): Electron: DevTools embedder handler executes arbitrary files via shell open (medium 6.9)
- [CVE-2026-70610](https://insights.sbomify.com/CVE-2026-70610/): Electron: contextBridge object copy honors prototype setters (medium 5.4)
- [CVE-2026-7061](https://insights.sbomify.com/CVE-2026-7061/): Toowiredd chatgpt-mcp-server MCP/HTTP docker.service.ts os command injection (medium 6.9)
- [CVE-2026-70609](https://insights.sbomify.com/CVE-2026-70609/): Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter (medium 5.7)
- [CVE-2026-70608](https://insights.sbomify.com/CVE-2026-70608/): Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path (high 7.2)
- [CVE-2026-70607](https://insights.sbomify.com/CVE-2026-70607/): Electron: window.open features string controls some window options considered privileged (medium 5.3)
- [CVE-2026-70606](https://insights.sbomify.com/CVE-2026-70606/): Electron: ProtocolResponse.url reuses the default session cache instead of the registering session (medium 5.9)
- [CVE-2026-70605](https://insights.sbomify.com/CVE-2026-70605/): Electron: HTTP redirect followed into local file loader (medium 5.9)
- [CVE-2026-70604](https://insights.sbomify.com/CVE-2026-70604/): Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads (high 7.4)
- [CVE-2026-70603](https://insights.sbomify.com/CVE-2026-70603/): Electron: shell.openPath path validation bypass via embedded null byte (medium 6.0)
- [CVE-2026-70602](https://insights.sbomify.com/CVE-2026-70602/): Electron: Extension tab APIs operate across session boundaries (medium 6.6)
- [CVE-2026-70601](https://insights.sbomify.com/CVE-2026-70601/): Electron: Context isolation bypass via Function.prototype.bind hijack (high 7.5)
- [CVE-2026-70600](https://insights.sbomify.com/CVE-2026-70600/): Electron: Cross-origin iframe can position native autofill popup (low 3.1)
- [CVE-2026-7060](https://insights.sbomify.com/CVE-2026-7060/): liyupi yu-picture MyBatis-Plus PictureServiceImpl.java PageRequest sql injection (medium 6.9)
- [CVE-2026-70599](https://insights.sbomify.com/CVE-2026-70599/): Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin (medium 5.9)
- [CVE-2026-70598](https://insights.sbomify.com/CVE-2026-70598/): Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size (low 3.9)
- [CVE-2026-70597](https://insights.sbomify.com/CVE-2026-70597/): Electron: Parent process code-sign check is spoofable (medium 6.3)
- [CVE-2026-70596](https://insights.sbomify.com/CVE-2026-70596/): Ghost: Cross-Site Scripting in Feature Image Captions (medium 4.3)
- [CVE-2026-70595](https://insights.sbomify.com/CVE-2026-70595/): Ghost: Server-Side Request Forgery Mitigation Issue (medium 4.0)
- [CVE-2026-70594](https://insights.sbomify.com/CVE-2026-70594/): Ghost: Session Fixation in Ghost Admin (medium 6.7)
- [CVE-2026-70593](https://insights.sbomify.com/CVE-2026-70593/): Ghost: Theme Upload Path Traversal (medium 6.6)
- [CVE-2026-70592](https://insights.sbomify.com/CVE-2026-70592/): Ghost: Database Backup Path Traversal (medium 5.5)
- [CVE-2026-70591](https://insights.sbomify.com/CVE-2026-70591/): Ghost: Server-Side Request Forgery in Image Fetching (medium 4.1)
- [CVE-2026-70590](https://insights.sbomify.com/CVE-2026-70590/): Ghost: Blind Password Hash Disclosure in Ghost Admin API (medium 4.8)
- [CVE-2026-7059](https://insights.sbomify.com/CVE-2026-7059/): 666ghj MiroFish Query Parameter simulation.py get_simulation_posts path traversal (medium 6.9)
- [CVE-2026-70589](https://insights.sbomify.com/CVE-2026-70589/): Ghost: Archived Offers can be Redeemed (medium 4.8)
- [CVE-2026-70588](https://insights.sbomify.com/CVE-2026-70588/): Ghost: Cross-Site Scripting in Universal Import (medium 5.0)
- [CVE-2026-70587](https://insights.sbomify.com/CVE-2026-70587/): Windows Remote Desktop Protocol Information Disclosure Vulnerability (high 7.5)
- [CVE-2026-70586](https://insights.sbomify.com/CVE-2026-70586/): Windows Paint Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-70585](https://insights.sbomify.com/CVE-2026-70585/): Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability (high 7.0)
- [CVE-2026-70584](https://insights.sbomify.com/CVE-2026-70584/): Windows Core Messaging Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-70583](https://insights.sbomify.com/CVE-2026-70583/): Windows Core Messaging Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-70582](https://insights.sbomify.com/CVE-2026-70582/): Windows Management Instrumentation Elevation of Privilege Vulnerability (medium 6.4)
- [CVE-2026-70581](https://insights.sbomify.com/CVE-2026-70581/): Windows Biometric Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-70580](https://insights.sbomify.com/CVE-2026-70580/): Windows Credential Guard Spoofing Vulnerability (high 8.8)
- [CVE-2026-7058](https://insights.sbomify.com/CVE-2026-7058/): 666ghj MiroFish Inter-Process Communication simulation_ipc.py SimulationIPCClient.send_command command injection (medium 6.9)
- [CVE-2026-70579](https://insights.sbomify.com/CVE-2026-70579/): Windows Mobile Broadband Information Disclosure Vulnerability (high 7.5)
- [CVE-2026-70578](https://insights.sbomify.com/CVE-2026-70578/): Windows Credential Guard Elevation of Privilege Vulnerability (high 7.0)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/426/