# Vulnerabilities published in 2026


- [CVE-2026-6869](https://insights.sbomify.com/CVE-2026-6869/): Improperly Controlled Sequential Memory Allocation in Wireshark (medium 5.5)
- [CVE-2026-6868](https://insights.sbomify.com/CVE-2026-6868/): Stack-based Buffer Overflow in Wireshark (medium 5.5)
- [CVE-2026-6867](https://insights.sbomify.com/CVE-2026-6867/): Improperly Controlled Sequential Memory Allocation in Wireshark (medium 5.5)
- [CVE-2026-6866](https://insights.sbomify.com/CVE-2026-6866/): Initialization of a Resource with an Insecure Default vulnerability on EcoStruxure™ Panel Server (high 8.2)
- [CVE-2026-6865](https://insights.sbomify.com/CVE-2026-6865/): Improper Limitation of a Pathname to a Restricted Directory Vulnerability on Multiple Products (high 7.1)
- [CVE-2026-6864](https://insights.sbomify.com/CVE-2026-6864/): CBX 5 Star Rating & Review <= 1.0.7 - Reflected Cross-Site Scripting via 'page' Parameter (medium 6.1)
- [CVE-2026-6863](https://insights.sbomify.com/CVE-2026-6863/): HTTP Filestore Endpoints Misapply Permissions Across Organizations (medium 6.8)
- [CVE-2026-6862](https://insights.sbomify.com/CVE-2026-6862/): Efivar: efivar: denial of service due to stack overflow in device path node parsing (medium 5.5)
- [CVE-2026-6861](https://insights.sbomify.com/CVE-2026-6861/): Emacs: emacs: memory corruption vulnerability when processing svg css (medium 6.1)
- [CVE-2026-6860](https://insights.sbomify.com/CVE-2026-6860/): Vert.x has a DoS via unbounded server-side SNI SslContext cache growth (medium 6.9)
- [CVE-2026-6859](https://insights.sbomify.com/CVE-2026-6859/): Instructlab: instructlab: arbitrary code execution due to hardcoded `trust_remote_code=true` (high 8.8)
- [CVE-2026-68587](https://insights.sbomify.com/CVE-2026-68587/): SiYuan before v3.7.3 Information Disclosure via getHeading*Transaction (critical 9.2)
- [CVE-2026-68586](https://insights.sbomify.com/CVE-2026-68586/): SiYuan before v3.7.3 Content Disclosure via getBacklinkDoc (critical 9.2)
- [CVE-2026-68585](https://insights.sbomify.com/CVE-2026-68585/): SiYuan before v3.7.3 Metadata Disclosure via getBlockInfo (medium 6.9)
- [CVE-2026-68584](https://insights.sbomify.com/CVE-2026-68584/): SiYuan before v3.7.3 Authentication Bypass via Content Endpoints (critical 9.2)
- [CVE-2026-68583](https://insights.sbomify.com/CVE-2026-68583/): luci-app-adblock-fast before 1.2.4-4 Stored XSS via file_url.name (medium 5.1)
- [CVE-2026-68582](https://insights.sbomify.com/CVE-2026-68582/): Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Token (critical 9.3)
- [CVE-2026-68581](https://insights.sbomify.com/CVE-2026-68581/): Vikunja 0.22.0 through 2.3.0 Authentication Bypass via Principal ID Collision (high 8.6)
- [CVE-2026-68580](https://insights.sbomify.com/CVE-2026-68580/): FreeRDP before 3.29.0 Integer Overflow via Audio Input Channel (high 7.7)
- [CVE-2026-6858](https://insights.sbomify.com/CVE-2026-6858/): Transbank Webpay < 1.14.0 - Unauthenticated Stored XSS (high 7.1)
- [CVE-2026-68579](https://insights.sbomify.com/CVE-2026-68579/): FreeRDP before 3.30.0 Heap Overflow via CliprdrStream_Read (high 8.7)
- [CVE-2026-68578](https://insights.sbomify.com/CVE-2026-68578/): ArcadeDB before 26.7.3 Authentication Bypass via MCP Transport (high 7.7)
- [CVE-2026-68573](https://insights.sbomify.com/CVE-2026-68573/): Apache Kylin: Unauthenticated Metastore Cleanup (critical 9.8)
- [CVE-2026-68572](https://insights.sbomify.com/CVE-2026-68572/): Apache Kylin: Unauthorized SQL execution to Spark SQL env (high 7.5)
- [CVE-2026-68571](https://insights.sbomify.com/CVE-2026-68571/): Apache Kylin: JDBC URL Whitelist Verification Bypass (high 8.8)
- [CVE-2026-68570](https://insights.sbomify.com/CVE-2026-68570/): Apache Doris: Authorization bypass leading to unauthorized data access (medium 6.5)
- [CVE-2026-6857](https://insights.sbomify.com/CVE-2026-6857/): Camel-infinispan: camel-infinispan: remote code execution via unsafe deserialization (high 7.5)
- [CVE-2026-68569](https://insights.sbomify.com/CVE-2026-68569/): Apache Tomcat: Principal lookup can fail open in some cases (high 8.1)
- [CVE-2026-68568](https://insights.sbomify.com/CVE-2026-68568/): WordPress MasterStudy LMS plugin <= 3.7.41 - Privilege Escalation vulnerability (medium 6.3)
- [CVE-2026-68567](https://insights.sbomify.com/CVE-2026-68567/): WordPress EasyTest – Simplify A/B Testing plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-68566](https://insights.sbomify.com/CVE-2026-68566/): WordPress BookingPress Appointment Booking Pro plugin <= 6.0.2 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-68565](https://insights.sbomify.com/CVE-2026-68565/): WordPress GeoDirectory plugin <= 2.8.172 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-68564](https://insights.sbomify.com/CVE-2026-68564/): WordPress NotificationX Pro plugin <= 3.1.4 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-68563](https://insights.sbomify.com/CVE-2026-68563/): Information disclosure in Red Hat Enterprise Linux 10 (medium 5.5)
- [CVE-2026-68562](https://insights.sbomify.com/CVE-2026-68562/): Ansible-collection-redhat-leapp: ansible-collection-redhat-leapp: information disclosure via leapp report tampering (medium 6.2)
- [CVE-2026-68561](https://insights.sbomify.com/CVE-2026-68561/): Privilege escalation in wekan (high 8.8)
- [CVE-2026-68560](https://insights.sbomify.com/CVE-2026-68560/): Wekan:hell Injection in External Antivirus Scanner Path via asyncExec (high 7.7)
- [CVE-2026-68559](https://insights.sbomify.com/CVE-2026-68559/): Wekan: Broken access control in the Excel-export route (`/api/boards/:boardId/exportExcel`) (medium 6.5)
- [CVE-2026-68558](https://insights.sbomify.com/CVE-2026-68558/): Wekan: SSRF filter bypass via DNS-resolving hostname in outgoing webhooks (incomplete fix of CVE-2026-53446) (high 8.5)
- [CVE-2026-68555](https://insights.sbomify.com/CVE-2026-68555/): coturn: Chained mobility resumes allow authenticated remote memory exhaustion (medium 6.5)
- [CVE-2026-68554](https://insights.sbomify.com/CVE-2026-68554/): Security feature bypass in coturn (low 2.3)
- [CVE-2026-68553](https://insights.sbomify.com/CVE-2026-68553/): Coturn: Format String Injection via TURN USERNAME/REALM into hiredis Redis Command (high 7.1)
- [CVE-2026-68552](https://insights.sbomify.com/CVE-2026-68552/): Coturn: uint16_t truncation overflow in STUN message length causes TCP stream framing bypass (medium 5.3)
- [CVE-2026-6855](https://insights.sbomify.com/CVE-2026-6855/): Instructlab: instructlab: path traversal allows arbitrary directory creation and file write (high 7.1)
- [CVE-2026-6854](https://insights.sbomify.com/CVE-2026-6854/): My Calendar <= 3.7.8 - Unauthenticated SQL Injection via 'mc_auth' and 'mc_host' Parameters (high 7.5)
- [CVE-2026-68537](https://insights.sbomify.com/CVE-2026-68537/): Fulgur: Unbounded page slicing from attacker-controlled CSS height causes denial of service (high 7.5)
- [CVE-2026-68536](https://insights.sbomify.com/CVE-2026-68536/): Apache MyFaces: Server-Side Request Forgery / Local File Inclusion Vulnerability (critical 9.8)
- [CVE-2026-68535](https://insights.sbomify.com/CVE-2026-68535/): Missing authorization in Concrete CMS (medium 5.1)
- [CVE-2026-68534](https://insights.sbomify.com/CVE-2026-68534/): Concrete CMS below 9.5.2 is vulnerable to Stored XSS via unescaped Express entry labels in association selectors (low 2.3)
- [CVE-2026-68533](https://insights.sbomify.com/CVE-2026-68533/): Missing authorization in Concrete CMS (low 2.3)
- [CVE-2026-68532](https://insights.sbomify.com/CVE-2026-68532/): Concrete CMS 9.0.0 to 9.5.2 is vunerable to CSRF in Concrete CMS Group Type Deletion Dashboard Action (low 2.3)
- [CVE-2026-68531](https://insights.sbomify.com/CVE-2026-68531/): Denial of service in Concrete CMS (low 2.1)
- [CVE-2026-68530](https://insights.sbomify.com/CVE-2026-68530/): Missing authorization in Concrete CMS (low 2.1)
- [CVE-2026-6853](https://insights.sbomify.com/CVE-2026-6853/): OTP Bypass in Başbelen Group's Pause+ Mobile App (critical 9.8)
- [CVE-2026-68529](https://insights.sbomify.com/CVE-2026-68529/): Missing authorization in Concrete CMS (low 2.1)
- [CVE-2026-68528](https://insights.sbomify.com/CVE-2026-68528/): Concrete CMS 9.5.2 and below is vulnerable to Stored XSS in RSS Displayer Block via Unescaped Remote Feed Item title (medium 6.0)
- [CVE-2026-68527](https://insights.sbomify.com/CVE-2026-68527/): Missing authorization in Concrete CMS (medium 5.9)
- [CVE-2026-68526](https://insights.sbomify.com/CVE-2026-68526/): Concrete CMS before 9.5.3 is vulnerable to CSRF in the Calendar event duplicate dialog controller (medium 5.3)
- [CVE-2026-68525](https://insights.sbomify.com/CVE-2026-68525/): Apache Tomcat: Redirect after FORM auth may bypass method specific constraints (critical 9.1)
- [CVE-2026-68523](https://insights.sbomify.com/CVE-2026-68523/): Fulgur: Unbounded page slicing from attacker-controlled CSS height causes denial of service (high 7.5)
- [CVE-2026-68520](https://insights.sbomify.com/CVE-2026-68520/): Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config (medium 5.3)
- [CVE-2026-68519](https://insights.sbomify.com/CVE-2026-68519/): Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925) (high 7.1)
- [CVE-2026-68518](https://insights.sbomify.com/CVE-2026-68518/): Glances: Command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction (high 8.8)
- [CVE-2026-68517](https://insights.sbomify.com/CVE-2026-68517/): Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard (medium 6.5)
- [CVE-2026-68516](https://insights.sbomify.com/CVE-2026-68516/): OpenEXR: HTJ2K SIZ image-offset gap stack buffer overflow (medium 6.5)
- [CVE-2026-68515](https://insights.sbomify.com/CVE-2026-68515/): OpenEXR: Heap out-of-bounds write in exrmultiview with subsampled channel union (high 7.1)
- [CVE-2026-68514](https://insights.sbomify.com/CVE-2026-68514/): OpenEXR: Heap buffer overflow in PyOpenEXR from literal/prefixed RGB channel name collision in deep images (medium 5.5)
- [CVE-2026-68513](https://insights.sbomify.com/CVE-2026-68513/): OpenEXR: Heap buffer overflow in PyOpenEXR from literal/prefixed RGB channel name collision (high 7.1)
- [CVE-2026-6851](https://insights.sbomify.com/CVE-2026-6851/): Improper link resolution before file access in Bitdefender Total Security via Link Following (VA-13681) (high 7.0)
- [CVE-2026-68508](https://insights.sbomify.com/CVE-2026-68508/): Hydra: hydra.utils.instantiate with untrusted config can lead to code execution (high 7.8)
- [CVE-2026-68503](https://insights.sbomify.com/CVE-2026-68503/): LazyOwn: Default C2 Operator Credentials Enable Administrative Access to C2 Dashboard (critical 9.8)
- [CVE-2026-68502](https://insights.sbomify.com/CVE-2026-68502/): LazyOwn: Unauthenticated Socket.IO `input` Event Reaches LazyOwn Command Dispatcher — Unauthenticated RCE (critical 9.8)
- [CVE-2026-68501](https://insights.sbomify.com/CVE-2026-68501/): Sylius Mollie Plugin: Unauthenticated IDOR leaks order token and customer PII (medium 6.5)
- [CVE-2026-68500](https://insights.sbomify.com/CVE-2026-68500/): Sylius Mollie Plugin: Payment status forgery via the payment webhook (high 7.5)
- [CVE-2026-6850](https://insights.sbomify.com/CVE-2026-6850/): Crafted message attachment causes client-side denial of service via markdown parser regex backtracking in Mattermost (medium 6.5)
- [CVE-2026-68499](https://insights.sbomify.com/CVE-2026-68499/): re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS) (medium 6.2)
- [CVE-2026-68498](https://insights.sbomify.com/CVE-2026-68498/): Denial of service in jackson-core (high 7.5)
- [CVE-2026-68497](https://insights.sbomify.com/CVE-2026-68497/): jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS (high 7.5)
- [CVE-2026-68496](https://insights.sbomify.com/CVE-2026-68496/): Denial of service in jackson-dataformats-binary (high 7.5)
- [CVE-2026-68495](https://insights.sbomify.com/CVE-2026-68495/): Denial of service in jackson-dataformats-binary (high 7.5)
- [CVE-2026-68494](https://insights.sbomify.com/CVE-2026-68494/): jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq) (high 8.7)
- [CVE-2026-68493](https://insights.sbomify.com/CVE-2026-68493/): Missing authorization in Server (low 3.1)
- [CVE-2026-68492](https://insights.sbomify.com/CVE-2026-68492/): Code injection in Plesk (high 8.7)
- [CVE-2026-68491](https://insights.sbomify.com/CVE-2026-68491/): Path traversal in SolusVM (critical 9.4)
- [CVE-2026-68490](https://insights.sbomify.com/CVE-2026-68490/): Misconfiguration in cPanel (high 8.2)
- [CVE-2026-6849](https://insights.sbomify.com/CVE-2026-6849/): OS Command Injection in TUBITAK BILGEM's Pardus OS My Computer (high 8.8)
- [CVE-2026-68489](https://insights.sbomify.com/CVE-2026-68489/): Code injection in Plesk extension "Node.js Toolkit" (high 8.7)
- [CVE-2026-68488](https://insights.sbomify.com/CVE-2026-68488/): Race condition in Plesk (critical 9.9)
- [CVE-2026-68487](https://insights.sbomify.com/CVE-2026-68487/): Path traversal in Plesk (critical 9.9)
- [CVE-2026-68484](https://insights.sbomify.com/CVE-2026-68484/): Missing authorization in Sage AR Automation (critical 9.0)
- [CVE-2026-68482](https://insights.sbomify.com/CVE-2026-68482/): Apache Answer: Improper Authorization in Question Invite User Lookup (not scored)
- [CVE-2026-68481](https://insights.sbomify.com/CVE-2026-68481/): Apache CXF: Revocation bypass in DefaultEncryptingOAuthDataProvider (high 7.5)
- [CVE-2026-68480](https://insights.sbomify.com/CVE-2026-68480/): x86/bugs: Make Safe-RET robust against interrupt injection (not scored)
- [CVE-2026-6848](https://insights.sbomify.com/CVE-2026-6848/): Quay: red hat quay: authentication bypass allows privileged actions without valid credentials (medium 5.4)
- [CVE-2026-68479](https://insights.sbomify.com/CVE-2026-68479/): Bluetooth: btrtl: validate firmware patch bounds (high 7.8)
- [CVE-2026-68478](https://insights.sbomify.com/CVE-2026-68478/): memstick: ms_block: reject a card that reports too many blocks (not scored)
- [CVE-2026-68477](https://insights.sbomify.com/CVE-2026-68477/): ipvs: fix more places with wrong ipv6 transport offsets (critical 9.8)
- [CVE-2026-68476](https://insights.sbomify.com/CVE-2026-68476/): ipvs: reload ip header after head reallocation (critical 9.8)
- [CVE-2026-68475](https://insights.sbomify.com/CVE-2026-68475/): reset: sunxi: fix memory region leak on ioremap failure (not scored)
- [CVE-2026-68474](https://insights.sbomify.com/CVE-2026-68474/): powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access() (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/442/