# Vulnerabilities published in 2026


- [CVE-2026-67370](https://insights.sbomify.com/CVE-2026-67370/): Microsoft SQL Server Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-6737](https://insights.sbomify.com/CVE-2026-6737/): Missing authorization in AsusPTPFilter (low 2.0)
- [CVE-2026-67369](https://insights.sbomify.com/CVE-2026-67369/): Microsoft SQL Server Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-67368](https://insights.sbomify.com/CVE-2026-67368/): Microsoft SQL Server Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-67367](https://insights.sbomify.com/CVE-2026-67367/): Path traversal in SIMOVE Fleetmanager V3.1 (critical 9.2)
- [CVE-2026-67366](https://insights.sbomify.com/CVE-2026-67366/): Joomla Extension - icagenda.com - CSRF on frontend registration actions in iCagenda < 2.0.0-4.0.11 (medium 5.3)
- [CVE-2026-67365](https://insights.sbomify.com/CVE-2026-67365/): Joomla Extension - icagenda.com - Unauthenticated SQL injection in iCagenda < 4.0.0-4.0.11 (critical 9.2)
- [CVE-2026-67364](https://insights.sbomify.com/CVE-2026-67364/): Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2 (critical 10.0)
- [CVE-2026-67363](https://insights.sbomify.com/CVE-2026-67363/): Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2 (high 7.7)
- [CVE-2026-67362](https://insights.sbomify.com/CVE-2026-67362/): Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 (medium 5.1)
- [CVE-2026-67361](https://insights.sbomify.com/CVE-2026-67361/): File upload in J2Store extension for Joomla (medium 6.9)
- [CVE-2026-67360](https://insights.sbomify.com/CVE-2026-67360/): Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 (medium 6.3)
- [CVE-2026-6736](https://insights.sbomify.com/CVE-2026-6736/): Auth bypass in Enterprise Server (medium 6.3)
- [CVE-2026-67359](https://insights.sbomify.com/CVE-2026-67359/): Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 (high 8.7)
- [CVE-2026-67358](https://insights.sbomify.com/CVE-2026-67358/): Joomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 (medium 5.3)
- [CVE-2026-67357](https://insights.sbomify.com/CVE-2026-67357/): ArcadeDB before 26.7.3 Information Disclosure via get_server_settings (high 7.7)
- [CVE-2026-67356](https://insights.sbomify.com/CVE-2026-67356/): ArcadeDB before 26.7.3 Privilege Escalation via JavaScript Trigger (high 8.7)
- [CVE-2026-67355](https://insights.sbomify.com/CVE-2026-67355/): guzzlehttp/guzzle before 7.15.1 Host-only Cookie Scope (high 8.2)
- [CVE-2026-67354](https://insights.sbomify.com/CVE-2026-67354/): guzzlehttp/guzzle before 7.15.1 URI Fragment Disclosure via Referer (high 8.2)
- [CVE-2026-67353](https://insights.sbomify.com/CVE-2026-67353/): guzzlehttp/guzzle before 7.15.1 Unbounded Cookie Denial of Service (medium 6.9)
- [CVE-2026-67352](https://insights.sbomify.com/CVE-2026-67352/): luci-app-https-dns-proxy Stored XSS via resolver_url (medium 6.8)
- [CVE-2026-67351](https://insights.sbomify.com/CVE-2026-67351/): Serendipity < 2.6.1 Authentication Bypass via Username Collision (high 8.7)
- [CVE-2026-67350](https://insights.sbomify.com/CVE-2026-67350/): Serendipity < 2.6.1 Open Redirect via exit.php (low 2.1)
- [CVE-2026-6735](https://insights.sbomify.com/CVE-2026-6735/): XSS within PHP-FPM status endpoint (high 7.3)
- [CVE-2026-67349](https://insights.sbomify.com/CVE-2026-67349/): OpenCost < 1.121.0 Unauthenticated Helm Values Exposure and Admin Bypass (high 8.7)
- [CVE-2026-67348](https://insights.sbomify.com/CVE-2026-67348/): Julep Insecure Direct Object Reference via GET /executions/{execution_id} (high 8.6)
- [CVE-2026-67347](https://insights.sbomify.com/CVE-2026-67347/): Vendure 3.7.1 Cross-Channel Authorization Bypass via StockLocation and Asset Update (medium 6.1)
- [CVE-2026-67346](https://insights.sbomify.com/CVE-2026-67346/): Swarms 6.8.1 Server-Side Request Forgery via DNS Rebinding Bypass (high 7.7)
- [CVE-2026-67345](https://insights.sbomify.com/CVE-2026-67345/): MaxKey 4.1.12 DefaultRedirectResolver OAuth Authorization Code Theft (high 8.5)
- [CVE-2026-67344](https://insights.sbomify.com/CVE-2026-67344/): ArcadeDB before 26.7.2 Authentication Bypass via ALTER TYPE (high 8.5)
- [CVE-2026-67343](https://insights.sbomify.com/CVE-2026-67343/): ArcadeDB before 26.7.2 Cluster Token Disclosure via GET /api/v1/server (high 8.7)
- [CVE-2026-67342](https://insights.sbomify.com/CVE-2026-67342/): ArcadeDB before 26.7.2 Authorization Bypass via Database Handlers (critical 9.3)
- [CVE-2026-67341](https://insights.sbomify.com/CVE-2026-67341/): ArcadeDB before 26.7.2 Authorization Bypass via SQL DEFINE FUNCTION (critical 9.3)
- [CVE-2026-67340](https://insights.sbomify.com/CVE-2026-67340/): ArcadeDB before 26.7.2 Remote Code Execution via Trigger Scripts (high 8.6)
- [CVE-2026-6734](https://insights.sbomify.com/CVE-2026-6734/): undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse (high 7.5)
- [CVE-2026-67339](https://insights.sbomify.com/CVE-2026-67339/): guzzlehttp/guzzle before 7.14.2 Proxy-Authorization Header Disclosure (medium 6.9)
- [CVE-2026-67338](https://insights.sbomify.com/CVE-2026-67338/): JupyterLab before 4.5.9 Stored XSS via Extension Manager (medium 5.1)
- [CVE-2026-67337](https://insights.sbomify.com/CVE-2026-67337/): better-auth before 1.4.9 Two-Factor Authentication Bypass via session.cookieCache (high 7.1)
- [CVE-2026-67336](https://insights.sbomify.com/CVE-2026-67336/): better-auth before 1.6.11 Insecure Cryptographic Defaults via oidcProvider (critical 9.4)
- [CVE-2026-67335](https://insights.sbomify.com/CVE-2026-67335/): better-auth before 1.6.2 OAuth State Validation Bypass (medium 6.0)
- [CVE-2026-67334](https://insights.sbomify.com/CVE-2026-67334/): better-auth Stale Sessions Persist After User Deletion (medium 5.1)
- [CVE-2026-67333](https://insights.sbomify.com/CVE-2026-67333/): better-auth before 1.6.13 Stored XSS via javascript redirect_uri (medium 5.1)
- [CVE-2026-67332](https://insights.sbomify.com/CVE-2026-67332/): @better-auth/oauth-provider before 1.7.0-beta.4 Authorization Bypass (medium 5.3)
- [CVE-2026-67331](https://insights.sbomify.com/CVE-2026-67331/): better-auth SCIM 1.5.0 before 1.7.0-beta.4 Authorization Bypass (high 8.7)
- [CVE-2026-67330](https://insights.sbomify.com/CVE-2026-67330/): better-auth SCIM 1.4.0-beta.27 through 1.6.21 Account Takeover via Provider-ID Collision (critical 9.4)
- [CVE-2026-6733](https://insights.sbomify.com/CVE-2026-6733/): undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse (low 3.7)
- [CVE-2026-67329](https://insights.sbomify.com/CVE-2026-67329/): @better-auth/stripe before 1.6.21 Authorization Bypass via Organization Subscription (high 7.1)
- [CVE-2026-67328](https://insights.sbomify.com/CVE-2026-67328/): @better-auth/sso before 1.6.21 Account Takeover via SSO (high 8.6)
- [CVE-2026-67327](https://insights.sbomify.com/CVE-2026-67327/): better-auth before 1.6.22 Account Takeover via Magic-Link Email-OTP (high 8.7)
- [CVE-2026-67326](https://insights.sbomify.com/CVE-2026-67326/): GitPython before 3.1.50 Newline Injection via config_writer section (high 7.3)
- [CVE-2026-67325](https://insights.sbomify.com/CVE-2026-67325/): GitPython before 3.1.51 Command Injection via option prefix abbreviation (high 8.7)
- [CVE-2026-67324](https://insights.sbomify.com/CVE-2026-67324/): GitPython 3.1.50 Authentication Bypass via Joined Short Options (critical 9.3)
- [CVE-2026-67323](https://insights.sbomify.com/CVE-2026-67323/): GitPython before 3.1.51 Command Injection via unguarded Git options (high 8.6)
- [CVE-2026-67322](https://insights.sbomify.com/CVE-2026-67322/): GitPython before 3.1.52 Environment Variable Exfiltration via clone_from (high 8.7)
- [CVE-2026-67321](https://insights.sbomify.com/CVE-2026-67321/): axios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypass (medium 6.9)
- [CVE-2026-67320](https://insights.sbomify.com/CVE-2026-67320/): axios before 0.33.0 Prototype Pollution via Node HTTP adapter (high 8.3)
- [CVE-2026-6732](https://insights.sbomify.com/CVE-2026-6732/): Libxml2: libxml2: denial of service via crafted xsd-validated document (medium 6.5)
- [CVE-2026-67319](https://insights.sbomify.com/CVE-2026-67319/): axios before 0.33.0 Prototype Pollution via nested option objects (medium 6.3)
- [CVE-2026-67318](https://insights.sbomify.com/CVE-2026-67318/): axios 1.13.0 before 1.18.0 maxBodyLength Bypass via HTTP/2 (medium 6.3)
- [CVE-2026-67317](https://insights.sbomify.com/CVE-2026-67317/): axios 1.7.0 before 1.18.0 maxBodyLength Bypass via ReadableStream (medium 6.3)
- [CVE-2026-67316](https://insights.sbomify.com/CVE-2026-67316/): axios before 1.18.0 Prototype Pollution via bodyless methods (medium 6.3)
- [CVE-2026-67315](https://insights.sbomify.com/CVE-2026-67315/): axios 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 NO_PROXY Bypass via 0.0.0.0 (medium 6.9)
- [CVE-2026-67314](https://insights.sbomify.com/CVE-2026-67314/): axios before 1.18.0 Prototype Pollution via auth subfields (medium 6.3)
- [CVE-2026-67313](https://insights.sbomify.com/CVE-2026-67313/): axios 0.28.0 before 1.18.0 Denial of Service via formDataToJSON (medium 6.3)
- [CVE-2026-67312](https://insights.sbomify.com/CVE-2026-67312/): axios 0.28.0 before 0.33.0 and 1.0.0 before 1.18.0 Denial of Service via formToJSON (medium 6.3)
- [CVE-2026-67311](https://insights.sbomify.com/CVE-2026-67311/): Budibase before 3.38.1 SSRF Blacklist Bypass via HTTP Redirect (high 8.2)
- [CVE-2026-67310](https://insights.sbomify.com/CVE-2026-67310/): openremote before 1.27.0 Cross-Tenant IDOR via setAssetLinks (medium 5.3)
- [CVE-2026-6731](https://insights.sbomify.com/CVE-2026-6731/): X.509 name constraint bypass via Subject CN treated as a DNS name (medium 6.0)
- [CVE-2026-67309](https://insights.sbomify.com/CVE-2026-67309/): Traefik v3.7.0 Path Traversal via RewriteTarget Authentication Bypass (high 7.8)
- [CVE-2026-67308](https://insights.sbomify.com/CVE-2026-67308/): Wazuh GitHub Actions Shell Injection via Fork Pull Request (critical 9.3)
- [CVE-2026-67307](https://insights.sbomify.com/CVE-2026-67307/): Wazuh before 5.0.0-beta3 Cluster Attribution Spoofing via Inventory Sync (high 7.0)
- [CVE-2026-67306](https://insights.sbomify.com/CVE-2026-67306/): FreeRDP before 3.29.0 Out-of-Bounds Read via Planar RLE (medium 5.3)
- [CVE-2026-67305](https://insights.sbomify.com/CVE-2026-67305/): FreeRDP Windows Client before 3.29.0 Heap Buffer Overflow via Cliprdr (critical 9.4)
- [CVE-2026-67304](https://insights.sbomify.com/CVE-2026-67304/): FreeRDP before 3.29.0 NULL Dereference via smartcard cleanup (high 8.7)
- [CVE-2026-67303](https://insights.sbomify.com/CVE-2026-67303/): FreeRDP before 3.29.0 Denial of Service via serial DeviceControl (medium 5.3)
- [CVE-2026-67302](https://insights.sbomify.com/CVE-2026-67302/): FreeRDP rdpecam StartStreamsRequest divide-by-zero denial of service (medium 5.3)
- [CVE-2026-67301](https://insights.sbomify.com/CVE-2026-67301/): FreeRDP before 3.29.0 Out-of-bounds Read via Polygon async message-proxy (high 8.7)
- [CVE-2026-67300](https://insights.sbomify.com/CVE-2026-67300/): FreeRDP before 3.29.0 Use-After-Free via async message proxy (high 8.7)
- [CVE-2026-6730](https://insights.sbomify.com/CVE-2026-6730/): Multiple Vulnerabilities in IBM Concert Software (critical 9.8)
- [CVE-2026-67299](https://insights.sbomify.com/CVE-2026-67299/): FreeRDP before 3.29.0 Use-After-Free via WindowIcon async message (high 8.7)
- [CVE-2026-67298](https://insights.sbomify.com/CVE-2026-67298/): FreeRDP 3.28.0 Heap Buffer Overflow via RAIL orderLength Underflow (high 8.7)
- [CVE-2026-67297](https://insights.sbomify.com/CVE-2026-67297/): FreeRDP before 3.29.0 Resource Exhaustion via chunked HTTP response (high 8.7)
- [CVE-2026-67296](https://insights.sbomify.com/CVE-2026-67296/): FreeRDP before 3.29.0 Denial of Service via RDPEI PDU (high 8.7)
- [CVE-2026-67295](https://insights.sbomify.com/CVE-2026-67295/): FreeRDP before 3.29.0 Path Traversal via drive redirection (medium 5.3)
- [CVE-2026-67294](https://insights.sbomify.com/CVE-2026-67294/): FreeRDP before 3.29.0 TLS Certificate EKU Bypass (critical 9.3)
- [CVE-2026-67293](https://insights.sbomify.com/CVE-2026-67293/): FreeRDP before 3.29.0 Improper Certificate Hostname Validation (critical 9.3)
- [CVE-2026-67292](https://insights.sbomify.com/CVE-2026-67292/): FreeRDP before 3.29.0 WebSocket Ping Buffer Over-disclosure (critical 9.3)
- [CVE-2026-67291](https://insights.sbomify.com/CVE-2026-67291/): FreeRDP before 3.29.0 Heap Out-of-Bounds Read via GLYPH_FRAGMENT_ADD (high 8.7)
- [CVE-2026-67290](https://insights.sbomify.com/CVE-2026-67290/): FreeRDP before 3.29.0 Heap Out-of-Bounds Read via TSMF (high 8.7)
- [CVE-2026-6729](https://insights.sbomify.com/CVE-2026-6729/): HKUDS OpenHarness Session Key Collision Privilege Escalation (medium 5.3)
- [CVE-2026-67289](https://insights.sbomify.com/CVE-2026-67289/): FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection (critical 9.3)
- [CVE-2026-67288](https://insights.sbomify.com/CVE-2026-67288/): FreeRDP before 3.29.0 Denial of Service via smartcard cache (high 8.7)
- [CVE-2026-67287](https://insights.sbomify.com/CVE-2026-67287/): Joomla Extension - joomshaper.com - Unauthenticated comment creation in SP Page Builder < 6.8.0 (medium 6.3)
- [CVE-2026-67286](https://insights.sbomify.com/CVE-2026-67286/): Path traversal in SP Page Builder extension for Joomla (medium 6.3)
- [CVE-2026-67285](https://insights.sbomify.com/CVE-2026-67285/): Joomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file inclusion in SP Page Builder < 6.8.0 (critical 9.2)
- [CVE-2026-67284](https://insights.sbomify.com/CVE-2026-67284/): Joomla Extension - tabaoca.org - Improper ACL checks allow file operations in Cotton Cloud < 2.0.2 (medium 5.3)
- [CVE-2026-67283](https://insights.sbomify.com/CVE-2026-67283/): Joomla Extension - tabaoca.org - Improper ACL implementation allows allow file operations in Cotton Cloud < 2.0.2 (medium 6.9)
- [CVE-2026-67282](https://insights.sbomify.com/CVE-2026-67282/): Joomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabrik < 4.6.8 (critical 10.0)
- [CVE-2026-67281](https://insights.sbomify.com/CVE-2026-67281/): Unauthenticated file read in Mikrotik RouterOS (high 8.7)
- [CVE-2026-6728](https://insights.sbomify.com/CVE-2026-6728/): Slider Revolution <= 7.0.9 - Unauthenticated Sensitive Information Exposure via 'sliders/stream' (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/450/