# Vulnerabilities published in 2026


- [CVE-2026-70436](https://insights.sbomify.com/CVE-2026-70436/): Missing authorization in Jenkins External Workspace Manager Plugin (medium 4.3)
- [CVE-2026-70435](https://insights.sbomify.com/CVE-2026-70435/): Missing authorization in Jenkins SCM-Manager Plugin (medium 4.2)
- [CVE-2026-70434](https://insights.sbomify.com/CVE-2026-70434/): Cross-site request forgery in Jenkins SCM-Manager Plugin (medium 4.2)
- [CVE-2026-70433](https://insights.sbomify.com/CVE-2026-70433/): Missing authorization in Jenkins HCL AppScan Plugin (medium 4.3)
- [CVE-2026-70432](https://insights.sbomify.com/CVE-2026-70432/): Cross-site request forgery in Jenkins Multijob Plugin (high 8.8)
- [CVE-2026-70431](https://insights.sbomify.com/CVE-2026-70431/): Code injection in Jenkins Multijob Plugin (high 8.8)
- [CVE-2026-70430](https://insights.sbomify.com/CVE-2026-70430/): Privilege escalation in Jenkins (low 2.7)
- [CVE-2026-7043](https://insights.sbomify.com/CVE-2026-7043/): GreenCMS index.php pluginAddLocal unrestricted upload (medium 5.3)
- [CVE-2026-70429](https://insights.sbomify.com/CVE-2026-70429/): Auth bypass in Jenkins (high 8.1)
- [CVE-2026-70428](https://insights.sbomify.com/CVE-2026-70428/): Path traversal in Jenkins (medium 4.3)
- [CVE-2026-70427](https://insights.sbomify.com/CVE-2026-70427/): Path traversal in Jenkins (medium 4.3)
- [CVE-2026-70426](https://insights.sbomify.com/CVE-2026-70426/): Deserialization in Jenkins (critical 9.0)
- [CVE-2026-70425](https://insights.sbomify.com/CVE-2026-70425/): Command injection in PowerScale OneFS (medium 6.7)
- [CVE-2026-70424](https://insights.sbomify.com/CVE-2026-70424/): Path traversal in OpenManage Enterprise (medium 6.5)
- [CVE-2026-70423](https://insights.sbomify.com/CVE-2026-70423/): XML external entity in OpenManage Enterprise (medium 6.5)
- [CVE-2026-70422](https://insights.sbomify.com/CVE-2026-70422/): SQL injection in OpenManage Enterprise (high 8.1)
- [CVE-2026-70421](https://insights.sbomify.com/CVE-2026-70421/): Privilege escalation in OpenManage Enterprise (high 7.2)
- [CVE-2026-7042](https://insights.sbomify.com/CVE-2026-7042/): 666ghj MiroFish REST API Endpoint __init__.py create_app missing authentication (medium 6.9)
- [CVE-2026-70419](https://insights.sbomify.com/CVE-2026-70419/): Command injection in Cloud Disaster Recovery (critical 9.1)
- [CVE-2026-70416](https://insights.sbomify.com/CVE-2026-70416/): Deserialization in ObjectScale (critical 10.0)
- [CVE-2026-70415](https://insights.sbomify.com/CVE-2026-70415/): Memory corruption in PowerStore 1000T (high 8.1)
- [CVE-2026-70414](https://insights.sbomify.com/CVE-2026-70414/): Information disclosure in Command | Configure (DCC) (medium 5.5)
- [CVE-2026-70413](https://insights.sbomify.com/CVE-2026-70413/): Hardcoded credentials in Live Optics Collector (medium 5.6)
- [CVE-2026-70412](https://insights.sbomify.com/CVE-2026-70412/): Information disclosure in iDRAC10 (low 3.5)
- [CVE-2026-70411](https://insights.sbomify.com/CVE-2026-70411/): Missing authorization in Container Storage Modules (CSM) (high 7.1)
- [CVE-2026-70410](https://insights.sbomify.com/CVE-2026-70410/): Apache Calcite Avatica: Unrestricted class initialization when instantiating plugins (high 8.8)
- [CVE-2026-7041](https://insights.sbomify.com/CVE-2026-7041/): 666ghj MiroFish Werkzeug Debugger PIN console information disclosure (medium 6.3)
- [CVE-2026-70409](https://insights.sbomify.com/CVE-2026-70409/): eldap does not bound the port component of a referral URL before integer conversion (medium 6.3)
- [CVE-2026-70408](https://insights.sbomify.com/CVE-2026-70408/): Privilege escalation in acmailer CGI (high 8.7)
- [CVE-2026-70407](https://insights.sbomify.com/CVE-2026-70407/): Gitea organization listing token scope bypass (medium 4.3)
- [CVE-2026-70406](https://insights.sbomify.com/CVE-2026-70406/): Gitea private comparison disclosure with public-only tokens (medium 6.5)
- [CVE-2026-70405](https://insights.sbomify.com/CVE-2026-70405/): snmp BER INTEGER decoder applies no size limit to attacker-supplied integer fields (medium 6.3)
- [CVE-2026-70403](https://insights.sbomify.com/CVE-2026-70403/): Hardcoded credentials in XING CPTrans-ME-X (critical 9.3)
- [CVE-2026-70402](https://insights.sbomify.com/CVE-2026-70402/): Gitea local code execution through writable Git hooks (medium 5.8)
- [CVE-2026-70400](https://insights.sbomify.com/CVE-2026-70400/): Gitea private migration creation with public-only tokens (medium 5.4)
- [CVE-2026-7040](https://insights.sbomify.com/CVE-2026-7040/): Memory corruption in Text::Minify::XS (high 7.5)
- [CVE-2026-70399](https://insights.sbomify.com/CVE-2026-70399/): httpd does not enforce the documented default max_clients connection limit (high 8.7)
- [CVE-2026-70398](https://insights.sbomify.com/CVE-2026-70398/): Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2.11 (critical 9.6)
- [CVE-2026-70396](https://insights.sbomify.com/CVE-2026-70396/): Gitea organization repository creation token scope bypass (medium 5.4)
- [CVE-2026-70395](https://insights.sbomify.com/CVE-2026-70395/): Predicate injection in manage_relationship belongs_to lookup discloses secret lookup keys in Ash (low 2.1)
- [CVE-2026-7039](https://insights.sbomify.com/CVE-2026-7039/): tufantunc ssh-mcp index.ts shell.write command injection (high 8.5)
- [CVE-2026-70388](https://insights.sbomify.com/CVE-2026-70388/): Memory Corruption via Integer Underflow in Message Length Validation (high 8.3)
- [CVE-2026-70387](https://insights.sbomify.com/CVE-2026-70387/): OnePlus OxygenOS exposed dangerous method vulnerability (high 8.4)
- [CVE-2026-70386](https://insights.sbomify.com/CVE-2026-70386/): OnePlus OxygenOS improper neutralization of special elements vulnerability (high 8.5)
- [CVE-2026-70383](https://insights.sbomify.com/CVE-2026-70383/): Arbitrary file overwrite vulnerability in DigiDoc4 client (high 8.4)
- [CVE-2026-70382](https://insights.sbomify.com/CVE-2026-70382/): Stored Cross-Site Scripting in Web Interface (medium 5.1)
- [CVE-2026-70381](https://insights.sbomify.com/CVE-2026-70381/): Unauthorized Access to Internal Web Resources (medium 6.9)
- [CVE-2026-70380](https://insights.sbomify.com/CVE-2026-70380/): Resource Exhaustion in MICE Service (medium 6.9)
- [CVE-2026-7038](https://insights.sbomify.com/CVE-2026-7038/): tufantunc ssh-mcp Command Line index.ts insufficiently protected credentials (medium 4.8)
- [CVE-2026-70379](https://insights.sbomify.com/CVE-2026-70379/): Unauthorized Access to vSolution Matrix RTSP (high 7.1)
- [CVE-2026-70378](https://insights.sbomify.com/CVE-2026-70378/): imagecli - Negative carve Ratio Bypasses Bounds Check and Crashes Process via Reachable Panic (high 7.5)
- [CVE-2026-70377](https://insights.sbomify.com/CVE-2026-70377/): imagecli - Uncontrolled Memory Allocation via Unbounded scale Ratio Causes Denial of Service (high 7.5)
- [CVE-2026-70376](https://insights.sbomify.com/CVE-2026-70376/): Pluck CMS - CSRF via Spoofable Missing-Referer Bypass Leads to Stored XSS and RCE (critical 9.6)
- [CVE-2026-70375](https://insights.sbomify.com/CVE-2026-70375/): HashBrown CMS - OS Command Injection via Git Deployer Branch Field (high 8.8)
- [CVE-2026-70374](https://insights.sbomify.com/CVE-2026-70374/): HashBrown CMS - OS Command Injection in Media Upload Thumbnail Generation (high 8.8)
- [CVE-2026-70373](https://insights.sbomify.com/CVE-2026-70373/): Koha - SQL Injection in reports/issues_stats.pl (high 8.8)
- [CVE-2026-70372](https://insights.sbomify.com/CVE-2026-70372/): Koha - SQL Injection in reports/bor_issues_top.pl (high 8.8)
- [CVE-2026-70371](https://insights.sbomify.com/CVE-2026-70371/): Koha - SQL Injection in reports/issues_avg_stats.pl (high 8.8)
- [CVE-2026-70370](https://insights.sbomify.com/CVE-2026-70370/): Koha - SQL Injection in reports/catalogue_stats.pl (high 8.8)
- [CVE-2026-7037](https://insights.sbomify.com/CVE-2026-7037/): Totolink A8000RU CGI cstecgi.cgi setVpnPassCfg os command injection (critical 9.3)
- [CVE-2026-70369](https://insights.sbomify.com/CVE-2026-70369/): Koha - SQL Injection in reports/acquisitions_stats.pl (high 8.8)
- [CVE-2026-70368](https://insights.sbomify.com/CVE-2026-70368/): Stunnel: stack-based out-of-bounds read/write in stunnel s_vlog via oversized log message (medium 6.5)
- [CVE-2026-70367](https://insights.sbomify.com/CVE-2026-70367/): Server-side request forgery in Red Hat Enterprise Linux 10 (medium 5.4)
- [CVE-2026-7036](https://insights.sbomify.com/CVE-2026-7036/): Tenda i9 HTTP R7WebsSecurityHandlerfunction path traversal (medium 6.9)
- [CVE-2026-70357](https://insights.sbomify.com/CVE-2026-70357/): Gitea repository migration SSRF through DNS rebinding (high 7.5)
- [CVE-2026-70356](https://insights.sbomify.com/CVE-2026-70356/): Toptech TMS7 and TopHAT Unrestricted Upload of File with Dangerous Type (critical 9.4)
- [CVE-2026-70355](https://insights.sbomify.com/CVE-2026-70355/): Microsoft SharePoint Server Elevation of Privilege Vulnerability (high 7.3)
- [CVE-2026-70354](https://insights.sbomify.com/CVE-2026-70354/): .NET Core Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-70352](https://insights.sbomify.com/CVE-2026-70352/): Azure AI Language Elevation of Privilege Vulnerability (critical 10.0)
- [CVE-2026-70351](https://insights.sbomify.com/CVE-2026-70351/): Microsoft WebP Image Extension Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-7035](https://insights.sbomify.com/CVE-2026-7035/): Tenda FH1202 httpd WrlclientSet fromWrlclientSet stack-based overflow (high 8.7)
- [CVE-2026-70348](https://insights.sbomify.com/CVE-2026-70348/): Windows Management Services Denial of Service Vulnerability (medium 5.5)
- [CVE-2026-70347](https://insights.sbomify.com/CVE-2026-70347/): Windows Installer Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-70346](https://insights.sbomify.com/CVE-2026-70346/): Windows Installer Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-70345](https://insights.sbomify.com/CVE-2026-70345/): Windows Installer Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-70344](https://insights.sbomify.com/CVE-2026-70344/): Windows Installer Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-70343](https://insights.sbomify.com/CVE-2026-70343/): Microsoft MPEG-2 Video Extension Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-70342](https://insights.sbomify.com/CVE-2026-70342/): Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (high 8.1)
- [CVE-2026-70341](https://insights.sbomify.com/CVE-2026-70341/): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (high 8.5)
- [CVE-2026-70340](https://insights.sbomify.com/CVE-2026-70340/): Azure CycleCloud Elevation of Privilege Vulnerability (high 8.1)
- [CVE-2026-7034](https://insights.sbomify.com/CVE-2026-7034/): Tenda FH1202 httpd WrlExtraSet stack-based overflow (high 8.7)
- [CVE-2026-70339](https://insights.sbomify.com/CVE-2026-70339/): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (medium 5.4)
- [CVE-2026-70338](https://insights.sbomify.com/CVE-2026-70338/): Microsoft PowerShell Security Feature Bypass Vulnerability (high 7.8)
- [CVE-2026-70337](https://insights.sbomify.com/CVE-2026-70337/): Microsoft PowerShell Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-70336](https://insights.sbomify.com/CVE-2026-70336/): Visual Studio Code Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-70335](https://insights.sbomify.com/CVE-2026-70335/): GitHub Copilot and Visual Studio Code Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-70334](https://insights.sbomify.com/CVE-2026-70334/): Visual Studio Code Security Feature Bypass Vulnerability (high 7.8)
- [CVE-2026-70332](https://insights.sbomify.com/CVE-2026-70332/): Microsoft Office SharePoint Spoofing Vulnerability (critical 9.6)
- [CVE-2026-70331](https://insights.sbomify.com/CVE-2026-70331/): Microsoft Edge for iOS Spoofing Vulnerability (medium 5.4)
- [CVE-2026-70330](https://insights.sbomify.com/CVE-2026-70330/): Windows DNS Elevation of Privilege Vulnerability (medium 6.7)
- [CVE-2026-7033](https://insights.sbomify.com/CVE-2026-7033/): Tenda F456 SafeClientFilter fromSafeClientFilter buffer overflow (high 8.7)
- [CVE-2026-70329](https://insights.sbomify.com/CVE-2026-70329/): Microsoft Outlook Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-70328](https://insights.sbomify.com/CVE-2026-70328/): Microsoft Excel Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-70327](https://insights.sbomify.com/CVE-2026-70327/): Microsoft Excel Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-70326](https://insights.sbomify.com/CVE-2026-70326/): Microsoft SharePoint Server Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-70325](https://insights.sbomify.com/CVE-2026-70325/): Powerpoint Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-70324](https://insights.sbomify.com/CVE-2026-70324/): Microsoft SharePoint Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-70323](https://insights.sbomify.com/CVE-2026-70323/): Microsoft Office Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-70322](https://insights.sbomify.com/CVE-2026-70322/): Powerpoint Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-70321](https://insights.sbomify.com/CVE-2026-70321/): Microsoft SharePoint Remote Code Execution Vulnerability (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/428/