# Vulnerabilities published in 2026


- [CVE-2026-69228](https://insights.sbomify.com/CVE-2026-69228/): missing authentication vulnerability in Esri Portal for ArcGIS (medium 5.3)
- [CVE-2026-69227](https://insights.sbomify.com/CVE-2026-69227/): BUG-000187331 Portal for ArcGIS has a security vulnerability (critical 9.8)
- [CVE-2026-69226](https://insights.sbomify.com/CVE-2026-69226/): Portal for ArcGIS has a security vulnerability (medium 6.5)
- [CVE-2026-69225](https://insights.sbomify.com/CVE-2026-69225/): information disclosure vulnerability in Esri Portal for ArcGIS (medium 5.9)
- [CVE-2026-69224](https://insights.sbomify.com/CVE-2026-69224/): information disclosure vulnerability in Esri Portal for ArcGIS (medium 5.9)
- [CVE-2026-69223](https://insights.sbomify.com/CVE-2026-69223/): Apache Allura: Server-side request forgery (critical 9.1)
- [CVE-2026-69222](https://insights.sbomify.com/CVE-2026-69222/): LiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the process (high 7.5)
- [CVE-2026-69220](https://insights.sbomify.com/CVE-2026-69220/): RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoS (high 8.7)
- [CVE-2026-6922](https://insights.sbomify.com/CVE-2026-6922/): Missing authorization in WP Table Builder – Drag & Drop Table Builder (high 7.1)
- [CVE-2026-69219](https://insights.sbomify.com/CVE-2026-69219/): RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocation (high 8.7)
- [CVE-2026-69218](https://insights.sbomify.com/CVE-2026-69218/): Http4s Ember HTTP/2: unbounded continuation frame accumulation (high 7.5)
- [CVE-2026-69217](https://insights.sbomify.com/CVE-2026-69217/): Http4s: Ember Server accepts duplicate Content-Length headers (high 8.7)
- [CVE-2026-69216](https://insights.sbomify.com/CVE-2026-69216/): Http4s: Ember chunk parser lenience (TE.TE request smuggling) (medium 5.4)
- [CVE-2026-69215](https://insights.sbomify.com/CVE-2026-69215/): Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin (medium 6.8)
- [CVE-2026-69214](https://insights.sbomify.com/CVE-2026-69214/): Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain (medium 6.8)
- [CVE-2026-69213](https://insights.sbomify.com/CVE-2026-69213/): Http4s Ember HTTP/2: unbounded outbound frame queue (high 7.5)
- [CVE-2026-69212](https://insights.sbomify.com/CVE-2026-69212/): Http4s: FollowRedirect middleware leaks credentials over https->http same-authority redirect (medium 5.9)
- [CVE-2026-69211](https://insights.sbomify.com/CVE-2026-69211/): Http4s: Set-Cookie rendering does not escape attribute delimiters (medium 4.8)
- [CVE-2026-69210](https://insights.sbomify.com/CVE-2026-69210/): Http4s: WebSocket decoder accepts negative length, causing infinite decode loop (high 7.5)
- [CVE-2026-6921](https://insights.sbomify.com/CVE-2026-6921/): Race condition in Chrome (high 8.3)
- [CVE-2026-69209](https://insights.sbomify.com/CVE-2026-69209/): Http4s: WebSocket decoder accepts unbounded message sizes (high 7.5)
- [CVE-2026-69208](https://insights.sbomify.com/CVE-2026-69208/): Http4s: DigestAuth nonce map grows unbounded (high 7.5)
- [CVE-2026-69207](https://insights.sbomify.com/CVE-2026-69207/): Hono: ReDoS in CORS middleware via Access-Control-Request-Headers (medium 5.3)
- [CVE-2026-69206](https://insights.sbomify.com/CVE-2026-69206/): Http4s: DigestAuth allows replay of captured requests (medium 5.9)
- [CVE-2026-69205](https://insights.sbomify.com/CVE-2026-69205/): Http4s: Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling) (high 8.7)
- [CVE-2026-69204](https://insights.sbomify.com/CVE-2026-69204/): Http4s: Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling) (critical 9.2)
- [CVE-2026-69203](https://insights.sbomify.com/CVE-2026-69203/): Http4s Ember HTTP/2: does not enforce SETTINGS_MAX_CONCURRENT_STREAMS (high 7.5)
- [CVE-2026-69202](https://insights.sbomify.com/CVE-2026-69202/): Http4s Ember HTTP/2: unbounded inbound body buffering (high 7.5)
- [CVE-2026-69201](https://insights.sbomify.com/CVE-2026-69201/): Http4s: ResourceService and Webjar Service path escape via percent-encoded separators (medium 5.9)
- [CVE-2026-69200](https://insights.sbomify.com/CVE-2026-69200/): node-opcua: Prototype Pollution via internal `fieldsToJson()` implementation (Related to CVE-2024-57086) (low 3.7)
- [CVE-2026-6920](https://insights.sbomify.com/CVE-2026-6920/): Memory corruption in Chrome (critical 9.6)
- [CVE-2026-69198](https://insights.sbomify.com/CVE-2026-69198/): ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks (medium 6.9)
- [CVE-2026-69197](https://insights.sbomify.com/CVE-2026-69197/): Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion (high 8.7)
- [CVE-2026-69194](https://insights.sbomify.com/CVE-2026-69194/): FileRise: Unsanitized footerHtml in Public Site Config (medium 4.8)
- [CVE-2026-69193](https://insights.sbomify.com/CVE-2026-69193/): FileRise: Rate Limiting Bypass via Username Rotation Enables Unlimited Password Spraying (medium 6.5)
- [CVE-2026-69192](https://insights.sbomify.com/CVE-2026-69192/): ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass (high 7.7)
- [CVE-2026-69191](https://insights.sbomify.com/CVE-2026-69191/): FileRise: Login Method Restriction Bypass via Direct API Access (medium 5.4)
- [CVE-2026-69190](https://insights.sbomify.com/CVE-2026-69190/): Graylog: Manager-to-Owner privilege escalation on saved searches and dashboards (medium 6.3)
- [CVE-2026-6919](https://insights.sbomify.com/CVE-2026-6919/): Use after free in Chrome (critical 9.6)
- [CVE-2026-69189](https://insights.sbomify.com/CVE-2026-69189/): Hoppscotch: Cross-user private data exposure and UserHistory IDOR via team GraphQL resolvers (high 7.6)
- [CVE-2026-69186](https://insights.sbomify.com/CVE-2026-69186/): c-ares: Memory-amplification denial of service via unvalidated DNS header record counts (medium 5.3)
- [CVE-2026-69185](https://insights.sbomify.com/CVE-2026-69185/): Socket.IO: Zero-attachment Memory Exhaustion (high 7.5)
- [CVE-2026-69184](https://insights.sbomify.com/CVE-2026-69184/): c-ares: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains (high 7.5)
- [CVE-2026-69183](https://insights.sbomify.com/CVE-2026-69183/): Security feature bypass in monkeytype (high 7.5)
- [CVE-2026-6918](https://insights.sbomify.com/CVE-2026-6918/): Denial of service in Eclipse OpenJ9 (high 8.7)
- [CVE-2026-69160](https://insights.sbomify.com/CVE-2026-69160/): OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API (medium 6.5)
- [CVE-2026-6916](https://insights.sbomify.com/CVE-2026-6916/): Cross-site scripting in Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress (medium 6.4)
- [CVE-2026-69153](https://insights.sbomify.com/CVE-2026-69153/): PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset (medium 6.3)
- [CVE-2026-69152](https://insights.sbomify.com/CVE-2026-69152/): brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation (high 7.5)
- [CVE-2026-69151](https://insights.sbomify.com/CVE-2026-69151/): Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes (high 7.6)
- [CVE-2026-69150](https://insights.sbomify.com/CVE-2026-69150/): KeePassXC: Heap use-after-free in KeePass1 (KDB) importer via unpruned m_entryUuids map (medium 4.3)
- [CVE-2026-6915](https://insights.sbomify.com/CVE-2026-6915/): Flaw in the updateUser Command May Allow Unauthorized Configuration Change (medium 5.3)
- [CVE-2026-69149](https://insights.sbomify.com/CVE-2026-69149/): Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS) (high 8.6)
- [CVE-2026-69148](https://insights.sbomify.com/CVE-2026-69148/): MLflow: CreateModelVersion source validation does not check READ permission on referenced run_id (high 7.1)
- [CVE-2026-69147](https://insights.sbomify.com/CVE-2026-69147/): vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation (medium 6.5)
- [CVE-2026-69146](https://insights.sbomify.com/CVE-2026-69146/): MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth (medium 6.5)
- [CVE-2026-6914](https://insights.sbomify.com/CVE-2026-6914/): MD5 checksum creation may cause availability loss (high 7.1)
- [CVE-2026-6913](https://insights.sbomify.com/CVE-2026-6913/): Shortcodely <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'widget_area' Shortcode Attribute (medium 6.4)
- [CVE-2026-69129](https://insights.sbomify.com/CVE-2026-69129/): KubePi: Insufficient per-cluster authorization checks in cluster management APIs (medium 5.8)
- [CVE-2026-69127](https://insights.sbomify.com/CVE-2026-69127/): Kirby: System path exposure from error messages in the REST API (medium 6.9)
- [CVE-2026-6912](https://insights.sbomify.com/CVE-2026-6912/): Privilege Escalation via Self-Writable Cognito Custom Attribute in AWS Ops Wheel (high 8.7)
- [CVE-2026-69119](https://insights.sbomify.com/CVE-2026-69119/): Taubyte Tau v1.1.10 Missing Authorization via GET and DELETE /projects/{id} (high 7.2)
- [CVE-2026-69118](https://insights.sbomify.com/CVE-2026-69118/): Cachet 2.4.1 Authenticated Server-Side Template Injection RCE (high 8.7)
- [CVE-2026-69117](https://insights.sbomify.com/CVE-2026-69117/): NetBox 4.5.8 ORM Injection via WritableNestedSerializer (high 7.1)
- [CVE-2026-69116](https://insights.sbomify.com/CVE-2026-69116/): FlyEnv < 4.18.0 Cross-Site Scripting via v-html (medium 5.3)
- [CVE-2026-69115](https://insights.sbomify.com/CVE-2026-69115/): OpenIM Server v3.8.3 Missing Authorization on User and Group Enumeration Endpoints (high 7.1)
- [CVE-2026-69114](https://insights.sbomify.com/CVE-2026-69114/): Spacebar Server Cross-Channel Message Deletion via Permission Check Bypass (high 7.1)
- [CVE-2026-69113](https://insights.sbomify.com/CVE-2026-69113/): Cap v0.3.1 Broken Access Control via video comment endpoint (medium 5.3)
- [CVE-2026-69112](https://insights.sbomify.com/CVE-2026-69112/): Hugging Face Accelerate 1.14.0 Path Traversal and DoS via weight_map (medium 6.9)
- [CVE-2026-69111](https://insights.sbomify.com/CVE-2026-69111/): Milvus 2.6.22, 3.0.0 Unauthenticated Denial of Service via /management/stop (high 8.7)
- [CVE-2026-69110](https://insights.sbomify.com/CVE-2026-69110/): OpenCode Studio < 2.4.4 Unauthenticated File Read via /api/tmp and /api/music (critical 9.3)
- [CVE-2026-6911](https://insights.sbomify.com/CVE-2026-6911/): Authentication Bypass via Missing JWT Signature Verification in AWS Ops Wheel (critical 9.3)
- [CVE-2026-69109](https://insights.sbomify.com/CVE-2026-69109/): Path traversal in Siemens License Server (SLS) (high 8.7)
- [CVE-2026-69108](https://insights.sbomify.com/CVE-2026-69108/): Privilege escalation in Siemens License Server (SLS) (high 8.3)
- [CVE-2026-69107](https://insights.sbomify.com/CVE-2026-69107/): Potential unauthorized artifact access in JFrog Artifactory (medium 5.9)
- [CVE-2026-69106](https://insights.sbomify.com/CVE-2026-69106/): Potential cache poisoning in JFrog Artifactory (high 8.8)
- [CVE-2026-69105](https://insights.sbomify.com/CVE-2026-69105/): Potential package cache integrity issue in JFrog Artifactory (high 8.1)
- [CVE-2026-69104](https://insights.sbomify.com/CVE-2026-69104/): Potential unauthorized repository migration in JFrog Artifactory (high 7.6)
- [CVE-2026-69102](https://insights.sbomify.com/CVE-2026-69102/): MaxKey Hard-coded JWT Secret Unauthorized Access via /login/jwt/trust (critical 9.3)
- [CVE-2026-69101](https://insights.sbomify.com/CVE-2026-69101/): Datavane TIS v5.0.0 XXE Injection via doEditWorkflow Endpoint (high 8.3)
- [CVE-2026-69100](https://insights.sbomify.com/CVE-2026-69100/): LAMP 5.6.2 GlueFactory Unsandboxed Groovy Script Remote Code Execution (high 8.7)
- [CVE-2026-6910](https://insights.sbomify.com/CVE-2026-6910/): Bookero.pl <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-69098](https://insights.sbomify.com/CVE-2026-69098/): kotaemon 0.12.0 Unauthenticated Remote Code Execution via Insecure Deserialization (critical 9.3)
- [CVE-2026-69097](https://insights.sbomify.com/CVE-2026-69097/): GitPython before 3.1.53 Config Injection via Submodule Names (high 7.3)
- [CVE-2026-69096](https://insights.sbomify.com/CVE-2026-69096/): OpenWrt luci-app-dockerman Read ACL Remote Code Execution (high 8.7)
- [CVE-2026-69095](https://insights.sbomify.com/CVE-2026-69095/): OpenWrt luci-app-bmx7 Path Traversal via bmx7-info (high 8.7)
- [CVE-2026-69094](https://insights.sbomify.com/CVE-2026-69094/): Admidio before 5.0.11 IDOR via save_temporary mylist_function.php (medium 5.3)
- [CVE-2026-69093](https://insights.sbomify.com/CVE-2026-69093/): Admidio before 5.0.11 CSRF via category-report preferences (high 7.1)
- [CVE-2026-69092](https://insights.sbomify.com/CVE-2026-69092/): Admidio before 5.0.11 Reflected XSS via SSO/SAML Endpoint (medium 6.9)
- [CVE-2026-69091](https://insights.sbomify.com/CVE-2026-69091/): Admidio before 5.0.11 Authentication Bypass via forum.php (high 8.7)
- [CVE-2026-69090](https://insights.sbomify.com/CVE-2026-69090/): Admidio before 5.0.11 Cross-Organization Role Modification (medium 6.9)
- [CVE-2026-6909](https://insights.sbomify.com/CVE-2026-6909/): Reflected XSS in ATutor (medium 5.1)
- [CVE-2026-69089](https://insights.sbomify.com/CVE-2026-69089/): Grav CMS before 2.0.11 Path Traversal via watermark (high 8.7)
- [CVE-2026-69088](https://insights.sbomify.com/CVE-2026-69088/): Grav CMS 2.0.7 through 2.0.10 Arbitrary Method Invocation via Blueprint (high 8.6)
- [CVE-2026-69087](https://insights.sbomify.com/CVE-2026-69087/): Grav Form Plugin before 9.1.13 Open Redirect via form.value() Twig (high 7.1)
- [CVE-2026-69086](https://insights.sbomify.com/CVE-2026-69086/): SiYuan before v3.7.3 Path Traversal via unvalidated avID (high 8.3)
- [CVE-2026-69085](https://insights.sbomify.com/CVE-2026-69085/): SiYuan before v3.7.3 SQL Injection via searchDocs (critical 9.9)
- [CVE-2026-69084](https://insights.sbomify.com/CVE-2026-69084/): SiYuan before v3.7.3 SQL Injection via searchEmbedBlock (critical 9.9)
- [CVE-2026-69083](https://insights.sbomify.com/CVE-2026-69083/): SiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContent (critical 9.9)
- [CVE-2026-69082](https://insights.sbomify.com/CVE-2026-69082/): Cross-Site Request Forgery in the Administrative User Deletion Endpoint (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/439/