# Vulnerabilities published in 2026


- [CVE-2026-67568](https://insights.sbomify.com/CVE-2026-67568/): Mira Hormone Monitor, Mira Android App Use of Hard-coded Credentials (critical 9.3)
- [CVE-2026-67567](https://insights.sbomify.com/CVE-2026-67567/): Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2.11 (critical 9.9)
- [CVE-2026-67560](https://insights.sbomify.com/CVE-2026-67560/): Stack-based Buffer Overflow in Bendix EC80 Brake ECU (high 7.7)
- [CVE-2026-6756](https://insights.sbomify.com/CVE-2026-6756/): Mitigation bypass in Firefox for Android (high 7.5)
- [CVE-2026-67558](https://insights.sbomify.com/CVE-2026-67558/): Mira Hormone Monitor, Mira Android App Authentication bypass by spoofing (high 8.2)
- [CVE-2026-67555](https://insights.sbomify.com/CVE-2026-67555/): Apache Qpid Proton Dotnet: Unable to govern the maximum number of transfer frames per incoming delivery (medium 6.5)
- [CVE-2026-67554](https://insights.sbomify.com/CVE-2026-67554/): Apache Qpid Proton Dotnet: Unbounded disposition range handling can lead to denial of service (medium 6.5)
- [CVE-2026-67553](https://insights.sbomify.com/CVE-2026-67553/): Apache Qpid Proton Dotnet: Incoming session flow control window can be exceeded (medium 6.5)
- [CVE-2026-67552](https://insights.sbomify.com/CVE-2026-67552/): Apache Qpid Proton Dotnet: Unbounded type nesting can lead to pre-authentication stackoverflow (high 7.5)
- [CVE-2026-67551](https://insights.sbomify.com/CVE-2026-67551/): Apache Qpid Proton Dotnet: Type size/count handling can lead to excessive allocation pre-authentication (high 7.5)
- [CVE-2026-67550](https://insights.sbomify.com/CVE-2026-67550/): re2: Out-of-bounds heap read in `exec`/`test`/`match` via attacker-influenced `lastIndex` on a non-ASCII subject → uncatchable process crash (DoS) (medium 5.7)
- [CVE-2026-6755](https://insights.sbomify.com/CVE-2026-6755/): Mitigation bypass in the DOM: postMessage component (medium 6.5)
- [CVE-2026-67549](https://insights.sbomify.com/CVE-2026-67549/): OpenImageIO: TIFF 1-bit CMYK bit conversion heap out-of-bounds write (high 7.6)
- [CVE-2026-6754](https://insights.sbomify.com/CVE-2026-6754/): Use-after-free in the JavaScript Engine component (high 7.5)
- [CVE-2026-67531](https://insights.sbomify.com/CVE-2026-67531/): FrontMCP: CodeCall sandbox escape -> host RCE via live Zod schema exposure by getTool (critical 9.3)
- [CVE-2026-67530](https://insights.sbomify.com/CVE-2026-67530/): WACRM: SSRF via the automation `send_webhook` action (medium 6.4)
- [CVE-2026-6753](https://insights.sbomify.com/CVE-2026-6753/): Incorrect boundary conditions in the WebRTC component (high 7.3)
- [CVE-2026-67529](https://insights.sbomify.com/CVE-2026-67529/): Missing authorization in openproject (medium 4.3)
- [CVE-2026-67528](https://insights.sbomify.com/CVE-2026-67528/): OpenProject: Improper Access Control through /api/v3/custom_options/:id via Path "id" leads to Sensitive Data Exposure (medium 4.3)
- [CVE-2026-67527](https://insights.sbomify.com/CVE-2026-67527/): OpenProject: Improper Access Control through /api/v3/work_packages/<X.id> via PATCH parameter "fileLinks" (high 7.6)
- [CVE-2026-6752](https://insights.sbomify.com/CVE-2026-6752/): Incorrect boundary conditions in the WebRTC component (high 7.3)
- [CVE-2026-6751](https://insights.sbomify.com/CVE-2026-6751/): Uninitialized memory in the Audio/Video: Web Codecs component (high 7.3)
- [CVE-2026-6750](https://insights.sbomify.com/CVE-2026-6750/): Privilege escalation in the Graphics: WebRender component (high 8.8)
- [CVE-2026-6749](https://insights.sbomify.com/CVE-2026-6749/): Information disclosure due to uninitialized memory in the Graphics: Canvas2D component (high 7.5)
- [CVE-2026-6748](https://insights.sbomify.com/CVE-2026-6748/): Uninitialized memory in the Audio/Video: Web Codecs component (critical 9.8)
- [CVE-2026-6747](https://insights.sbomify.com/CVE-2026-6747/): Use-after-free in the WebRTC component (high 7.5)
- [CVE-2026-67465](https://insights.sbomify.com/CVE-2026-67465/): Apache Qpid Proton Dotnet: Unbounded symbol value caching can lead to pre-authentication resource exhaustion (high 7.5)
- [CVE-2026-6746](https://insights.sbomify.com/CVE-2026-6746/): Use-after-free in the DOM: Core & HTML component (high 7.5)
- [CVE-2026-67456](https://insights.sbomify.com/CVE-2026-67456/): Memory corruption in Warp (medium 4.4)
- [CVE-2026-6745](https://insights.sbomify.com/CVE-2026-6745/): Bagisto Custom Scripts cross site scripting (medium 5.1)
- [CVE-2026-67448](https://insights.sbomify.com/CVE-2026-67448/): Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689) (medium 6.5)
- [CVE-2026-67447](https://insights.sbomify.com/CVE-2026-67447/): Mailpit: SMTP DATA line reader buffers over-limit input before size enforcement (medium 5.3)
- [CVE-2026-67446](https://insights.sbomify.com/CVE-2026-67446/): Mailpit: Thumbnail generation decodes unbounded image dimensions before scaling (medium 5.3)
- [CVE-2026-67445](https://insights.sbomify.com/CVE-2026-67445/): Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection (medium 5.3)
- [CVE-2026-67443](https://insights.sbomify.com/CVE-2026-67443/): FUXA: Unauthenticated guest JWT bypasses Node-RED secure-mode authorization gate (Remote Script Execution) (critical 9.2)
- [CVE-2026-67442](https://insights.sbomify.com/CVE-2026-67442/): FUXA Business Logic Flaw: Role Deletion Without User Assignment Cleanup (low 2.0)
- [CVE-2026-67440](https://insights.sbomify.com/CVE-2026-67440/): FUXA: Unauthenticated Socket.IO read events (medium 6.9)
- [CVE-2026-6744](https://insights.sbomify.com/CVE-2026-6744/): Bagisto Downloadable Link copy server-side request forgery (medium 5.3)
- [CVE-2026-67439](https://insights.sbomify.com/CVE-2026-67439/): OliveTin: StartActionAndWait Endpoints Bypass `logs` Permission and Return Action Output (medium 4.3)
- [CVE-2026-67438](https://insights.sbomify.com/CVE-2026-67438/): OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check (medium 6.6)
- [CVE-2026-67437](https://insights.sbomify.com/CVE-2026-67437/): OliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion (Unbounded Map Growth) (high 7.5)
- [CVE-2026-67436](https://insights.sbomify.com/CVE-2026-67436/): Linuxfabrik monitoring-plugins: SSRF and auth-token disclosure via unvalidated @odata.id link in redfish-* plugins (high 8.3)
- [CVE-2026-67435](https://insights.sbomify.com/CVE-2026-67435/): linuxfabrik-lib: fetch() forwards credential headers across a cross-origin redirect (medium 6.0)
- [CVE-2026-67434](https://insights.sbomify.com/CVE-2026-67434/): PHP_CodeSniffer gitblame report command injection via crafted filename (high 7.3)
- [CVE-2026-67433](https://insights.sbomify.com/CVE-2026-67433/): Linuxfabrik monitoring-plugins: Symlink following in logfile legacy database migration (medium 5.8)
- [CVE-2026-67432](https://insights.sbomify.com/CVE-2026-67432/): MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport (high 7.5)
- [CVE-2026-67431](https://insights.sbomify.com/CVE-2026-67431/): MCP Ruby SDK: Ruby SSE Session Poisoning (high 8.3)
- [CVE-2026-67430](https://insights.sbomify.com/CVE-2026-67430/): MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood (medium 5.3)
- [CVE-2026-6743](https://insights.sbomify.com/CVE-2026-6743/): WebSystems WebTOTUM Calendar cross site scripting (medium 5.1)
- [CVE-2026-67429](https://insights.sbomify.com/CVE-2026-67429/): Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules) (critical 10.0)
- [CVE-2026-67428](https://insights.sbomify.com/CVE-2026-67428/): Flyto2 Core: Multiple HTTP-family modules fetch client-controlled URLs without the SSRF guard their siblings apply (SSRF to internal/metadata) (high 8.5)
- [CVE-2026-67427](https://insights.sbomify.com/CVE-2026-67427/): Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted (high 8.6)
- [CVE-2026-67426](https://insights.sbomify.com/CVE-2026-67426/): Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration (critical 9.3)
- [CVE-2026-67425](https://insights.sbomify.com/CVE-2026-67425/): Flyto2 Core: LLM/API keys leak to an attacker-controlled base_url (high 8.6)
- [CVE-2026-67424](https://insights.sbomify.com/CVE-2026-67424/): Flyto2 Core: Guarded HTTP modules follow redirects into internal space without per-hop SSRF revalidation (high 8.5)
- [CVE-2026-67422](https://insights.sbomify.com/CVE-2026-67422/): pymdown-extensions: Exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors (high 7.5)
- [CVE-2026-67421](https://insights.sbomify.com/CVE-2026-67421/): RabbitMQ: Stored HTML Injection in RabbitMQ Management OAuth Error Handling (medium 4.5)
- [CVE-2026-67420](https://insights.sbomify.com/CVE-2026-67420/): RabbitMQ OAuth credential refresh retains revoked runtime tags (low 2.3)
- [CVE-2026-6742](https://insights.sbomify.com/CVE-2026-6742/): Cross-site scripting in Advanced iFrame (medium 6.4)
- [CVE-2026-67419](https://insights.sbomify.com/CVE-2026-67419/): RabbitMQ: Consecutive topic wildcards cause combinatorial routing work (high 7.1)
- [CVE-2026-67418](https://insights.sbomify.com/CVE-2026-67418/): RabbitMQ MQTT 5: inapplicable PUBLISH property disconnects matching subscribers (medium 5.3)
- [CVE-2026-67416](https://insights.sbomify.com/CVE-2026-67416/): RabbitMQ: AMQP 1.0 symbolic body descriptor prefix collisions bypass validation (medium 5.3)
- [CVE-2026-67415](https://insights.sbomify.com/CVE-2026-67415/): RabbitMQ: Shovel Management Atom Exhaustion Allows Persistent Broker-Wide Denial of Service (medium 5.9)
- [CVE-2026-67414](https://insights.sbomify.com/CVE-2026-67414/): RabbitMQ AMQP 1.0 parser: amplification memory-exhaustion DoS via zero-width array aggregation (medium 6.0)
- [CVE-2026-67413](https://insights.sbomify.com/CVE-2026-67413/): Denial of service in rabbitmq-server (medium 6.0)
- [CVE-2026-67412](https://insights.sbomify.com/CVE-2026-67412/): RabbitMQ: Federation upstream skips vhost authorization allowing cross-vhost message access (medium 6.0)
- [CVE-2026-67411](https://insights.sbomify.com/CVE-2026-67411/): RabbitMQ: Web MQTT with PROXY Protocol enabled: a loopback-only user permission bypass (medium 6.0)
- [CVE-2026-67410](https://insights.sbomify.com/CVE-2026-67410/): RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint (high 8.2)
- [CVE-2026-6741](https://insights.sbomify.com/CVE-2026-6741/): Privilege escalation in LatePoint – Calendar Booking Plugin for Appointments and Events (high 8.8)
- [CVE-2026-67409](https://insights.sbomify.com/CVE-2026-67409/): RabbitMQ: JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS (high 8.2)
- [CVE-2026-67408](https://insights.sbomify.com/CVE-2026-67408/): RabbitMQ: Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service (high 7.1)
- [CVE-2026-67407](https://insights.sbomify.com/CVE-2026-67407/): Missing authorization in rabbitmq-server (medium 5.1)
- [CVE-2026-67406](https://insights.sbomify.com/CVE-2026-67406/): Information disclosure in rabbitmq-server (medium 4.6)
- [CVE-2026-67405](https://insights.sbomify.com/CVE-2026-67405/): RabbitMQ: CSWSH on Web-STOMP / Web-MQTT (no Origin validation) (medium 5.3)
- [CVE-2026-67404](https://insights.sbomify.com/CVE-2026-67404/): RabbitMQ: OAuth2 silent verify_none fallback for JWKS fetch (critical 9.2)
- [CVE-2026-67403](https://insights.sbomify.com/CVE-2026-67403/): Missing authorization in Sage AR Automation (critical 9.0)
- [CVE-2026-67402](https://insights.sbomify.com/CVE-2026-67402/): Misconfiguration in ConfigServer Security & Firewall (critical 9.2)
- [CVE-2026-67401](https://insights.sbomify.com/CVE-2026-67401/): SQL injection in cPanel (critical 9.9)
- [CVE-2026-67400](https://insights.sbomify.com/CVE-2026-67400/): Missing authorization in Richdocuments (low 3.5)
- [CVE-2026-6740](https://insights.sbomify.com/CVE-2026-6740/): Nexter Blocks <= 4.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'commentIcon' Block Attribute (medium 6.4)
- [CVE-2026-67399](https://insights.sbomify.com/CVE-2026-67399/): Deserialization in WHMCS (critical 9.3)
- [CVE-2026-67398](https://insights.sbomify.com/CVE-2026-67398/): Missing authorization in WHMCS (high 8.2)
- [CVE-2026-67397](https://insights.sbomify.com/CVE-2026-67397/): Path traversal in Plesk (high 8.5)
- [CVE-2026-67395](https://insights.sbomify.com/CVE-2026-67395/): Path traversal in Employee Self Service (medium 5.9)
- [CVE-2026-67394](https://insights.sbomify.com/CVE-2026-67394/): Command injection in Plesk (critical 9.0)
- [CVE-2026-67393](https://insights.sbomify.com/CVE-2026-67393/): Microsoft SQL Server Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-67390](https://insights.sbomify.com/CVE-2026-67390/): Microsoft SQL Server Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-6739](https://insights.sbomify.com/CVE-2026-6739/): Mattermost: Delegated admins could patch protected default system roles (medium 6.7)
- [CVE-2026-67389](https://insights.sbomify.com/CVE-2026-67389/): Microsoft SQL Server Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-67388](https://insights.sbomify.com/CVE-2026-67388/): Microsoft SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-67386](https://insights.sbomify.com/CVE-2026-67386/): Microsoft SQL Server Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-67385](https://insights.sbomify.com/CVE-2026-67385/): Microsoft SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-67384](https://insights.sbomify.com/CVE-2026-67384/): Microsoft SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-67383](https://insights.sbomify.com/CVE-2026-67383/): Microsoft SQL Server Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-67381](https://insights.sbomify.com/CVE-2026-67381/): Microsoft SQL Server Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-67380](https://insights.sbomify.com/CVE-2026-67380/): Microsoft SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-67379](https://insights.sbomify.com/CVE-2026-67379/): Microsoft SQL Server Remote Code Execution Vulnerability (high 8.5)
- [CVE-2026-67378](https://insights.sbomify.com/CVE-2026-67378/): Microsoft SQL Server Remote Code Execution Vulnerability (critical 9.0)
- [CVE-2026-67376](https://insights.sbomify.com/CVE-2026-67376/): Microsoft SQL Server Denial of Service Vulnerability (high 7.5)
- [CVE-2026-67373](https://insights.sbomify.com/CVE-2026-67373/): Microsoft SQL Server Remote Code Execution Vulnerability (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/449/