# Vulnerabilities published in 2026


- [CVE-2026-70577](https://insights.sbomify.com/CVE-2026-70577/): Windows Modern Device Management (MDM) Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-70575](https://insights.sbomify.com/CVE-2026-70575/): Windows Schannel Denial of Service Vulnerability (medium 5.3)
- [CVE-2026-70574](https://insights.sbomify.com/CVE-2026-70574/): Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulernability (high 7.8)
- [CVE-2026-70573](https://insights.sbomify.com/CVE-2026-70573/): Windows Biometric Service Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-70572](https://insights.sbomify.com/CVE-2026-70572/): Windows Biometric Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-70571](https://insights.sbomify.com/CVE-2026-70571/): Microsoft Exchange Server Remote Code Execution Vulnerability (high 8.1)
- [CVE-2026-70570](https://insights.sbomify.com/CVE-2026-70570/): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (high 7.5)
- [CVE-2026-7057](https://insights.sbomify.com/CVE-2026-7057/): Tenda F456 httpd setcfm buffer overflow (high 8.7)
- [CVE-2026-70569](https://insights.sbomify.com/CVE-2026-70569/): Windows Spaceport.sys Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-70568](https://insights.sbomify.com/CVE-2026-70568/): Windows Defender Firewall Service Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-70567](https://insights.sbomify.com/CVE-2026-70567/): Windows Display Enhancement Service Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-70566](https://insights.sbomify.com/CVE-2026-70566/): Windows Schannel Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-70565](https://insights.sbomify.com/CVE-2026-70565/): Windows AF_UNIX Socket Provider Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-70564](https://insights.sbomify.com/CVE-2026-70564/): Windows Print Spooler Components Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-70563](https://insights.sbomify.com/CVE-2026-70563/): Windows Shell Spoofing Vulnerability (high 8.1)
- [CVE-2026-70562](https://insights.sbomify.com/CVE-2026-70562/): Windows Audio Service Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-70561](https://insights.sbomify.com/CVE-2026-70561/): TestLink 1.9.20 and prior Authenticated IDOR via attachmentdownload.php (high 7.1)
- [CVE-2026-70560](https://insights.sbomify.com/CVE-2026-70560/): Ultimate POS Stored XSS via First Name Field in Leave Notifications (medium 4.8)
- [CVE-2026-7056](https://insights.sbomify.com/CVE-2026-7056/): Tenda F456 httpd SafeUrlFilter fromSafeUrlFilter buffer overflow (high 8.7)
- [CVE-2026-70559](https://insights.sbomify.com/CVE-2026-70559/): Dinky Unauthenticated System Configuration and Credential Disclosure via GET /api/sysConfig/getAll (high 8.7)
- [CVE-2026-70558](https://insights.sbomify.com/CVE-2026-70558/): Dinky Unauthenticated Arbitrary File Write via /download/uploadFromRsByLocal Gated Only by Hardcoded Default Token (critical 9.3)
- [CVE-2026-70557](https://insights.sbomify.com/CVE-2026-70557/): diboot-core Authenticated Arbitrary Field Read via loadRelatedData Discloses Password Hashes and Salts (high 7.1)
- [CVE-2026-70556](https://insights.sbomify.com/CVE-2026-70556/): Hubzilla version prior to 11.4 CSRF via OAuth2 /authorize Endpoint App Registration (medium 5.1)
- [CVE-2026-70554](https://insights.sbomify.com/CVE-2026-70554/): MaxSite CMS Unauthenticated PHP Object Injection via maxsite_comuser Cookie (critical 9.3)
- [CVE-2026-70553](https://insights.sbomify.com/CVE-2026-70553/): MaxSite CMS Unauthenticated RCE via Install Endpoint (critical 9.3)
- [CVE-2026-70552](https://insights.sbomify.com/CVE-2026-70552/): MaxSite CMS 109.5 Unauthenticated AJAX Dispatcher Bypass via ajax.php (critical 9.3)
- [CVE-2026-70551](https://insights.sbomify.com/CVE-2026-70551/): Server-Side Request Forgery Via VCS remote download in JFrog Artifactory (high 8.5)
- [CVE-2026-70550](https://insights.sbomify.com/CVE-2026-70550/): Potential unauthorized access to private Composer repository metadata in JFrog Artifactory (medium 6.5)
- [CVE-2026-7055](https://insights.sbomify.com/CVE-2026-7055/): Tenda F456 httpd VirtualSer fromVirtualSer buffer overflow (high 8.7)
- [CVE-2026-70548](https://insights.sbomify.com/CVE-2026-70548/): SSRF In CocoaPods Via JFrog Artifactory External Dependency (low 3.5)
- [CVE-2026-70547](https://insights.sbomify.com/CVE-2026-70547/): Potential unauthorized metadata exposure in JFrog Artifactory (medium 4.3)
- [CVE-2026-7054](https://insights.sbomify.com/CVE-2026-7054/): Tenda F456 httpd PPTPDClient fromPptpUserAdd buffer overflow (high 8.7)
- [CVE-2026-7053](https://insights.sbomify.com/CVE-2026-7053/): Tenda F456 httpd L7Prot frmL7ProtForm buffer overflow (high 8.7)
- [CVE-2026-7052](https://insights.sbomify.com/CVE-2026-7052/): HT Contact Form <= 2.8.2 - Unauthenticated Stored Cross-Site Scripting via File Upload Field (high 7.2)
- [CVE-2026-7051](https://insights.sbomify.com/CVE-2026-7051/): Missing authorization in Blog2Social: Social Media Auto Post & Scheduler (medium 5.4)
- [CVE-2026-7050](https://insights.sbomify.com/CVE-2026-7050/): Missing authorization in Forms Rb (medium 4.3)
- [CVE-2026-70496](https://insights.sbomify.com/CVE-2026-70496/): Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 (critical 9.9)
- [CVE-2026-70495](https://insights.sbomify.com/CVE-2026-70495/): Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 (high 8.8)
- [CVE-2026-70494](https://insights.sbomify.com/CVE-2026-70494/): Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder (high 8.1)
- [CVE-2026-70493](https://insights.sbomify.com/CVE-2026-70493/): Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically (medium 6.5)
- [CVE-2026-70492](https://insights.sbomify.com/CVE-2026-70492/): Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages (high 8.7)
- [CVE-2026-70491](https://insights.sbomify.com/CVE-2026-70491/): Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints (medium 6.5)
- [CVE-2026-70490](https://insights.sbomify.com/CVE-2026-70490/): Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check (medium 6.3)
- [CVE-2026-7049](https://insights.sbomify.com/CVE-2026-7049/): PixelYourSite Pro <= 12.5.0.1 - Unauthenticated Blind Server-Side Request Forgery via 'urls[]' Parameter (high 7.2)
- [CVE-2026-70489](https://insights.sbomify.com/CVE-2026-70489/): Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing (medium 6.5)
- [CVE-2026-70488](https://insights.sbomify.com/CVE-2026-70488/): Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup (medium 4.3)
- [CVE-2026-70487](https://insights.sbomify.com/CVE-2026-70487/): Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata (medium 5.3)
- [CVE-2026-70486](https://insights.sbomify.com/CVE-2026-70486/): Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin (high 8.2)
- [CVE-2026-70485](https://insights.sbomify.com/CVE-2026-70485/): Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs (high 7.1)
- [CVE-2026-70484](https://insights.sbomify.com/CVE-2026-70484/): Open WebUI: Users denied the image-generation permission can still generate images via chat completions (medium 4.3)
- [CVE-2026-70483](https://insights.sbomify.com/CVE-2026-70483/): Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint (low 3.1)
- [CVE-2026-70482](https://insights.sbomify.com/CVE-2026-70482/): Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client (high 8.1)
- [CVE-2026-70481](https://insights.sbomify.com/CVE-2026-70481/): Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages (medium 5.4)
- [CVE-2026-70480](https://insights.sbomify.com/CVE-2026-70480/): Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart rendering (medium 4.1)
- [CVE-2026-7048](https://insights.sbomify.com/CVE-2026-7048/): Photo Gallery by 10Web <= 1.8.40 - Authenticated (Contributor+) SQL Injection via 'order_by' Shortcode Attribute (medium 6.5)
- [CVE-2026-70479](https://insights.sbomify.com/CVE-2026-70479/): Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader (high 7.7)
- [CVE-2026-70478](https://insights.sbomify.com/CVE-2026-70478/): Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service (critical 9.2)
- [CVE-2026-70477](https://insights.sbomify.com/CVE-2026-70477/): Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability (critical 9.5)
- [CVE-2026-70476](https://insights.sbomify.com/CVE-2026-70476/): Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation (high 8.3)
- [CVE-2026-70475](https://insights.sbomify.com/CVE-2026-70475/): Flowise: Missing Authorization on Execution Update Endpoint (high 7.1)
- [CVE-2026-70474](https://insights.sbomify.com/CVE-2026-70474/): Flowise: Cross-Workspace OAuth2 Credential Metadata Leak (high 7.6)
- [CVE-2026-70473](https://insights.sbomify.com/CVE-2026-70473/): Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history (high 8.3)
- [CVE-2026-70472](https://insights.sbomify.com/CVE-2026-70472/): Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store (high 7.1)
- [CVE-2026-70471](https://insights.sbomify.com/CVE-2026-70471/): Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure (high 7.1)
- [CVE-2026-70470](https://insights.sbomify.com/CVE-2026-70470/): Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE (critical 9.5)
- [CVE-2026-7047](https://insights.sbomify.com/CVE-2026-7047/): Frontend User Notes <= 2.1.1 - Cross-Site Request Forgery to Note Content Modification via 'confirmEdit' Action (medium 4.3)
- [CVE-2026-70469](https://insights.sbomify.com/CVE-2026-70469/): Apache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP Requests (high 7.5)
- [CVE-2026-70468](https://insights.sbomify.com/CVE-2026-70468/): Auth bypass in FortiManager (high 7.3)
- [CVE-2026-70467](https://insights.sbomify.com/CVE-2026-70467/): Server-side request forgery in FortiSIEM (low 3.4)
- [CVE-2026-70466](https://insights.sbomify.com/CVE-2026-70466/): Security feature bypass in FortiOS (medium 4.8)
- [CVE-2026-70465](https://insights.sbomify.com/CVE-2026-70465/): Memory corruption in FortiClientWindows (high 7.3)
- [CVE-2026-70464](https://insights.sbomify.com/CVE-2026-70464/): rsync 2.0.0 < 3.5.0 Connection Slot Exhaustion DoS via Handshake Stall (high 8.7)
- [CVE-2026-70463](https://insights.sbomify.com/CVE-2026-70463/): rsync 3.1.0 < 3.5.0 Authorization Bypass via auth users Directive Parsing (high 8.6)
- [CVE-2026-70462](https://insights.sbomify.com/CVE-2026-70462/): rsync 3.1.0 < 3.5.0 Signed Integer Overflow via MSG_IO_TIMEOUT (high 7.1)
- [CVE-2026-70461](https://insights.sbomify.com/CVE-2026-70461/): rsync 3.2.5 < 3.5.0 Heap Out-of-Bounds Write via files-from Entry (high 8.8)
- [CVE-2026-70460](https://insights.sbomify.com/CVE-2026-70460/): rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink (critical 9.2)
- [CVE-2026-7046](https://insights.sbomify.com/CVE-2026-7046/): SQL injection in NEX-Forms – Ultimate Forms Plugin for WordPress (medium 4.9)
- [CVE-2026-70459](https://insights.sbomify.com/CVE-2026-70459/): rsync 3.0.0 < 3.5.0 Daemon Crash via Malformed File List Entry (medium 6.9)
- [CVE-2026-70458](https://insights.sbomify.com/CVE-2026-70458/): rsync 3.0.0 < 3.5.0 Out-of-Bounds Write via FLAG_HLINKED Handling (high 8.8)
- [CVE-2026-70457](https://insights.sbomify.com/CVE-2026-70457/): rsync 3.2.3 < 3.5.0 Out-of-Bounds Write via parse_size_arg() (high 8.3)
- [CVE-2026-70456](https://insights.sbomify.com/CVE-2026-70456/): rsync 3.0.1 < 3.5.0 Heap Out-of-Bounds Write via read_args() (high 8.8)
- [CVE-2026-70455](https://insights.sbomify.com/CVE-2026-70455/): rsync 3.4.2 < 3.5.0 DoS via --zt Zstandard Compression Thread Exhaustion (high 8.7)
- [CVE-2026-70454](https://insights.sbomify.com/CVE-2026-70454/): rsync < 3.5.0 TLS Certificate Validation Bypass via SSL/OpenSSL Mode (high 7.6)
- [CVE-2026-70453](https://insights.sbomify.com/CVE-2026-70453/): rsync < 3.5.0 Algorithmic Complexity DoS via hash_search() (high 8.7)
- [CVE-2026-70452](https://insights.sbomify.com/CVE-2026-70452/): rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure (critical 9.1)
- [CVE-2026-7045](https://insights.sbomify.com/CVE-2026-7045/): Dynamic-Datasource has an Injection vulnerability (medium 5.3)
- [CVE-2026-70449](https://insights.sbomify.com/CVE-2026-70449/): Apache Wicket: Path traversal in resource style/variation/locale (medium 5.3)
- [CVE-2026-70448](https://insights.sbomify.com/CVE-2026-70448/): XML external entity in Jenkins Ivy Report Plugin (high 7.1)
- [CVE-2026-70447](https://insights.sbomify.com/CVE-2026-70447/): Missing authorization in Jenkins AWS CodeBuild Plugin (medium 4.3)
- [CVE-2026-70446](https://insights.sbomify.com/CVE-2026-70446/): Missing authorization in Jenkins CodeSonar Plugin (medium 4.3)
- [CVE-2026-70445](https://insights.sbomify.com/CVE-2026-70445/): Missing authorization in Jenkins Sauce OnDemand Plugin (medium 4.3)
- [CVE-2026-70444](https://insights.sbomify.com/CVE-2026-70444/): Missing authorization in Jenkins Violation Comments to GitLab Plugin (medium 4.3)
- [CVE-2026-70443](https://insights.sbomify.com/CVE-2026-70443/): Information disclosure in Jenkins Horreum Plugin (medium 4.3)
- [CVE-2026-70442](https://insights.sbomify.com/CVE-2026-70442/): Missing authorization in Jenkins Google Chat Notification Plugin (medium 4.3)
- [CVE-2026-70441](https://insights.sbomify.com/CVE-2026-70441/): Cross-site scripting in Jenkins Summary Display Plugin (medium 5.4)
- [CVE-2026-70440](https://insights.sbomify.com/CVE-2026-70440/): Cross-site scripting in Jenkins Qualys Container Scanning Connector Plugin (medium 5.4)
- [CVE-2026-7044](https://insights.sbomify.com/CVE-2026-7044/): GreenCMS index.php themeadd unrestricted upload (medium 5.3)
- [CVE-2026-70439](https://insights.sbomify.com/CVE-2026-70439/): Missing authorization in Jenkins XML Job to Job DSL Plugin (medium 6.5)
- [CVE-2026-70438](https://insights.sbomify.com/CVE-2026-70438/): Missing authorization in Jenkins Parameterized Remote Trigger Plugin (medium 4.3)
- [CVE-2026-70437](https://insights.sbomify.com/CVE-2026-70437/): Weak cryptography in Jenkins Webhook Secret Credentials Provider Plugin (low 3.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/427/