# Vulnerabilities published in 2026


- [CVE-2026-66422](https://insights.sbomify.com/CVE-2026-66422/): Apache Tomcat: Servlet role references can bypass declarative role constraints (high 8.1)
- [CVE-2026-66421](https://insights.sbomify.com/CVE-2026-66421/): OpenClaw Dashboard Stored XSS via lastMessage Session Field (high 8.8)
- [CVE-2026-66420](https://insights.sbomify.com/CVE-2026-66420/): MeshCentral Cross-Site WebSocket Hijacking via Origin Validation Bypass on Self-Signed Certificate Deployments (high 8.6)
- [CVE-2026-6642](https://insights.sbomify.com/CVE-2026-6642/): Cross-site scripting in Media Library Assistant (medium 6.4)
- [CVE-2026-66418](https://insights.sbomify.com/CVE-2026-66418/): OpenClaw Dashboard v3.0.0 Stored XSS via Failed Login Username Field (critical 9.3)
- [CVE-2026-66416](https://insights.sbomify.com/CVE-2026-66416/): Leantime CSRF Protection Globally Disabled by Omission of Laravel VerifyCsrfToken Middleware (high 8.6)
- [CVE-2026-66415](https://insights.sbomify.com/CVE-2026-66415/): Leantime Server-Side Request Forgery and Local File Inclusion in Blueprints::import() (high 8.4)
- [CVE-2026-66414](https://insights.sbomify.com/CVE-2026-66414/): Leantime Open Redirect in Login Controller via redirectUrl Parameter (medium 5.1)
- [CVE-2026-66412](https://insights.sbomify.com/CVE-2026-66412/): Leantime all versions prior to and 3.6.2 Broken Access Control via tickets.getMilestone JSON-RPC (high 7.1)
- [CVE-2026-66411](https://insights.sbomify.com/CVE-2026-66411/): Auth bypass in DEEBOT PRO K1VAC (medium 6.9)
- [CVE-2026-66410](https://insights.sbomify.com/CVE-2026-66410/): Weak cryptography in Android App "ECOVACS PRO" (low 2.3)
- [CVE-2026-6641](https://insights.sbomify.com/CVE-2026-6641/): Cross-site scripting in Media Library Assistant (medium 6.4)
- [CVE-2026-66409](https://insights.sbomify.com/CVE-2026-66409/): Weak cryptography in DEEBOT PRO K1VAC (medium 6.9)
- [CVE-2026-66408](https://insights.sbomify.com/CVE-2026-66408/): Hardcoded credentials in DEEBOT PRO K1VAC (medium 5.1)
- [CVE-2026-66407](https://insights.sbomify.com/CVE-2026-66407/): Weak cryptography in DEEBOT PRO K1VAC (high 7.7)
- [CVE-2026-66406](https://insights.sbomify.com/CVE-2026-66406/): Security feature bypass in DEEBOT PRO K1VAC (low 2.3)
- [CVE-2026-66405](https://insights.sbomify.com/CVE-2026-66405/): Misconfiguration in DEEBOT PRO K1VAC (high 8.7)
- [CVE-2026-66404](https://insights.sbomify.com/CVE-2026-66404/): Security feature bypass in DEEBOT PRO K1VAC (medium 6.0)
- [CVE-2026-66403](https://insights.sbomify.com/CVE-2026-66403/): Misconfiguration in DEEBOT PRO K1VAC (high 8.7)
- [CVE-2026-66402](https://insights.sbomify.com/CVE-2026-66402/): FreeRDP before 3.29.0 TLS Certificate Identity Validation Bypass (critical 9.3)
- [CVE-2026-66401](https://insights.sbomify.com/CVE-2026-66401/): FreeRDP before 3.29.0 Out-of-Bounds Read via UVC H.264 (low 2.4)
- [CVE-2026-66400](https://insights.sbomify.com/CVE-2026-66400/): Grav Login Plugin before 3.8.13 Insufficient Session Expiration (medium 6.3)
- [CVE-2026-6640](https://insights.sbomify.com/CVE-2026-6640/): Cross-site scripting in Media Library Assistant (medium 6.4)
- [CVE-2026-66399](https://insights.sbomify.com/CVE-2026-66399/): phpMyFAQ before 4.1.6 Privilege Escalation via Group Membership (high 8.5)
- [CVE-2026-66398](https://insights.sbomify.com/CVE-2026-66398/): phpMyFAQ before 4.1.6 Remote Code Execution via Configuration API (critical 9.4)
- [CVE-2026-66397](https://insights.sbomify.com/CVE-2026-66397/): phpMyFAQ before 4.1.6 Path Traversal via category image deletion (high 8.6)
- [CVE-2026-66396](https://insights.sbomify.com/CVE-2026-66396/): SiYuan before v3.7.2 Stored XSS to RCE via title-img IAL (critical 9.3)
- [CVE-2026-66395](https://insights.sbomify.com/CVE-2026-66395/): SiYuan Desktop before v3.7.2 Reflected XSS to RCE via siyuan Protocol (critical 9.4)
- [CVE-2026-66394](https://insights.sbomify.com/CVE-2026-66394/): SiYuan before v3.7.3 Stored and Reflected XSS via SVG Sanitizer Bypass (critical 9.3)
- [CVE-2026-66393](https://insights.sbomify.com/CVE-2026-66393/): NLTK before 3.9.4 Denial of Service via JSONTaggedDecoder (high 8.7)
- [CVE-2026-66392](https://insights.sbomify.com/CVE-2026-66392/): Apache bRPC: TLS Client Accepts Certificates for Mismatched Peer Names (not scored)
- [CVE-2026-66391](https://insights.sbomify.com/CVE-2026-66391/): Apache Wicket: leaked and missing CSP headers (medium 6.5)
- [CVE-2026-66390](https://insights.sbomify.com/CVE-2026-66390/): Apache Wicket: crafted Link URL strings can break out of the JavaScript sequence (medium 6.1)
- [CVE-2026-6639](https://insights.sbomify.com/CVE-2026-6639/): Missing authorization in AI Copilot – Content Generator (high 7.5)
- [CVE-2026-66384](https://insights.sbomify.com/CVE-2026-66384/): JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory (medium 5.3, exploited in the wild)
- [CVE-2026-66382](https://insights.sbomify.com/CVE-2026-66382/): Authenticated users may write files outside the intended Artifactory work directory (medium 4.3)
- [CVE-2026-66381](https://insights.sbomify.com/CVE-2026-66381/): Repository readers may access content outside configured upstream paths (medium 5.3)
- [CVE-2026-66380](https://insights.sbomify.com/CVE-2026-66380/): Authenticated users may access private OCI referrer metadata (medium 4.3)
- [CVE-2026-6638](https://insights.sbomify.com/CVE-2026-6638/): PostgreSQL REFRESH PUBLICATION allows SQL injection via table name (low 3.7)
- [CVE-2026-66379](https://insights.sbomify.com/CVE-2026-66379/): Authenticated users may view private Puppet module metadata (medium 4.3)
- [CVE-2026-66378](https://insights.sbomify.com/CVE-2026-66378/): Authenticated users may access private NuGet metadata (medium 4.3)
- [CVE-2026-66377](https://insights.sbomify.com/CVE-2026-66377/): Anonymous users may access restricted Artifactory repository information (medium 5.3)
- [CVE-2026-66376](https://insights.sbomify.com/CVE-2026-66376/): Deleted users may temporarily retain access to JFrog Artifactory (medium 4.2)
- [CVE-2026-66375](https://insights.sbomify.com/CVE-2026-66375/): Low-privilege users may remove protected Artifactory metadata (high 8.1)
- [CVE-2026-66374](https://insights.sbomify.com/CVE-2026-66374/): Memory corruption in Knot Resolver (high 8.1)
- [CVE-2026-66373](https://insights.sbomify.com/CVE-2026-66373/): Memory corruption in Redis (high 7.5)
- [CVE-2026-66372](https://insights.sbomify.com/CVE-2026-66372/): Predictable Seed in Pseudo-Random Number Generator (PRNG) in Digital Watchdog VMAX DVR and NVR Product Lineups (high 7.6)
- [CVE-2026-66370](https://insights.sbomify.com/CVE-2026-66370/): html_sanitize_ex HTML5 scrubber keeps attacker-supplied form-association attributes, allowing form hijacking (medium 4.8)
- [CVE-2026-6637](https://insights.sbomify.com/CVE-2026-6637/): PostgreSQL refint allows stack buffer overflow and SQL injection (high 8.8)
- [CVE-2026-66369](https://insights.sbomify.com/CVE-2026-66369/): MZ Automation libiec61850 Out-of-bounds Read (high 7.1)
- [CVE-2026-66364](https://insights.sbomify.com/CVE-2026-66364/): MZ Automation libiec61850 Out-of-bounds Read (high 7.1)
- [CVE-2026-66362](https://insights.sbomify.com/CVE-2026-66362/): NGF vulnerability (high 8.6)
- [CVE-2026-66360](https://insights.sbomify.com/CVE-2026-66360/): MZ Automation libiec61850 Out-of-bounds Read (high 8.7)
- [CVE-2026-6636](https://insights.sbomify.com/CVE-2026-6636/): p2r3 convert API buildCache.js Bun.serve path traversal (medium 5.3)
- [CVE-2026-66358](https://insights.sbomify.com/CVE-2026-66358/): Cross-site scripting in acmailer CGI (medium 5.1)
- [CVE-2026-66357](https://insights.sbomify.com/CVE-2026-66357/): inets,httpd:HTTP Request Smuggling via obs-fold Header Continuation (high 8.3)
- [CVE-2026-66353](https://insights.sbomify.com/CVE-2026-66353/): Doggo vulnerable to cross-site scripting via unescaped date field values (medium 5.3)
- [CVE-2026-6635](https://insights.sbomify.com/CVE-2026-6635/): rowboatlabs rowboat tools_webhook app.py tool_call improper authentication (medium 6.9)
- [CVE-2026-66349](https://insights.sbomify.com/CVE-2026-66349/): MZ Automation libiec61850 Out-of-bounds Read (medium 6.9)
- [CVE-2026-66344](https://insights.sbomify.com/CVE-2026-66344/): Privilege escalation in NetKids iMark (medium 5.4)
- [CVE-2026-66340](https://insights.sbomify.com/CVE-2026-66340/): Mira Hormone Monitor, Mira Android App Improper restriction of excessive authentication attempts (medium 6.9)
- [CVE-2026-6634](https://insights.sbomify.com/CVE-2026-6634/): usememos UpdateInstanceSetting App.tsx memos_access_token improper authorization (medium 5.3)
- [CVE-2026-66339](https://insights.sbomify.com/CVE-2026-66339/): Libsoup: libsoup: proxy credentials leak to destination server via proxy-authorization header in connect tunnels (medium 6.5)
- [CVE-2026-66338](https://insights.sbomify.com/CVE-2026-66338/): Libsoup: libsoup: http request smuggling via permissive chunk-size parsing in soup_body_input_stream_read_chunked() (medium 5.4)
- [CVE-2026-66337](https://insights.sbomify.com/CVE-2026-66337/): Libsoup: libsoup: heap buffer over-read via integer underflow in soup_filter_input_stream_read_until() (medium 6.5)
- [CVE-2026-66331](https://insights.sbomify.com/CVE-2026-66331/): Apache Thrift: Buffered transport reads are not accounted against MaxMessageSize (medium 6.9)
- [CVE-2026-6633](https://insights.sbomify.com/CVE-2026-6633/): Yifang CMS Extended Management L_rbac_admin.php store cross site scripting (medium 5.1)
- [CVE-2026-66326](https://insights.sbomify.com/CVE-2026-66326/): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (medium 6.5)
- [CVE-2026-66325](https://insights.sbomify.com/CVE-2026-66325/): Microsoft Edge (Chromium-based) Spoofing Vulnerability (medium 6.1)
- [CVE-2026-66324](https://insights.sbomify.com/CVE-2026-66324/): Microsoft Edge (Chromium-based) Spoofing Vulnerability (medium 6.5)
- [CVE-2026-66323](https://insights.sbomify.com/CVE-2026-66323/): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (medium 5.4)
- [CVE-2026-66322](https://insights.sbomify.com/CVE-2026-66322/): Microsoft Edge (Chromium-based) Spoofing Vulnerability (high 7.1)
- [CVE-2026-66321](https://insights.sbomify.com/CVE-2026-66321/): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (high 7.4)
- [CVE-2026-6632](https://insights.sbomify.com/CVE-2026-6632/): Tenda F451 httpd SafeClientFilter fromSafeClientFilter buffer overflow (high 8.7)
- [CVE-2026-66318](https://insights.sbomify.com/CVE-2026-66318/): Microsoft Edge (Chromium-based) Information Disclosure Vulnerability (high 8.1)
- [CVE-2026-66317](https://insights.sbomify.com/CVE-2026-66317/): Microsoft Edge (Chromium-based) Tampering Vulnerability (medium 5.4)
- [CVE-2026-66316](https://insights.sbomify.com/CVE-2026-66316/): Microsoft Edge (Chromium-based) Spoofing Vulnerability (medium 5.4)
- [CVE-2026-66315](https://insights.sbomify.com/CVE-2026-66315/): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (high 7.5)
- [CVE-2026-66314](https://insights.sbomify.com/CVE-2026-66314/): Microsoft Edge (Chromium-based) Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-66313](https://insights.sbomify.com/CVE-2026-66313/): Microsoft Edge (Chromium-based) Tampering Vulnerability (medium 6.8)
- [CVE-2026-66312](https://insights.sbomify.com/CVE-2026-66312/): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (medium 6.5)
- [CVE-2026-66311](https://insights.sbomify.com/CVE-2026-66311/): Microsoft Edge (Chromium-based) Tampering Vulnerability (medium 6.2)
- [CVE-2026-66310](https://insights.sbomify.com/CVE-2026-66310/): Microsoft Edge for Android Information Disclosure Vulnerability (high 7.7)
- [CVE-2026-6631](https://insights.sbomify.com/CVE-2026-6631/): Tenda F451 httpd webExcptypemanFilter fromwebExcptypemanFilter buffer overflow (high 8.7)
- [CVE-2026-66309](https://insights.sbomify.com/CVE-2026-66309/): Azure SQL Database Elevation of Privilege Vulnerability (critical 9.1)
- [CVE-2026-66308](https://insights.sbomify.com/CVE-2026-66308/): Skype for Business and Lync Denial of Service Vulnerability (medium 6.5)
- [CVE-2026-66307](https://insights.sbomify.com/CVE-2026-66307/): Skype for Business and Lync Denial of Service Vulnerability (high 7.5)
- [CVE-2026-66306](https://insights.sbomify.com/CVE-2026-66306/): Skype for Business Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-66305](https://insights.sbomify.com/CVE-2026-66305/): Skype for Business Spoofing Vulnerability (high 7.1)
- [CVE-2026-66304](https://insights.sbomify.com/CVE-2026-66304/): Skype for Business Information Disclosure Vulnerability (high 7.5)
- [CVE-2026-66303](https://insights.sbomify.com/CVE-2026-66303/): Skype for Business and Lync Denial of Service Vulnerability (medium 6.5)
- [CVE-2026-66302](https://insights.sbomify.com/CVE-2026-66302/): Skype for Business Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-66301](https://insights.sbomify.com/CVE-2026-66301/): Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-66300](https://insights.sbomify.com/CVE-2026-66300/): SNOMED International Snowstorm reflected XSS (low 2.3)
- [CVE-2026-6630](https://insights.sbomify.com/CVE-2026-6630/): Tenda F451 httpd GstDhcpSetSer fromGstDhcpSetSer buffer overflow (high 8.7)
- [CVE-2026-66299](https://insights.sbomify.com/CVE-2026-66299/): Apache Tomcat: DoS via WebSocket chat example (high 7.5)
- [CVE-2026-66298](https://insights.sbomify.com/CVE-2026-66298/): JS-view sandboxed output can synthesize keyboard events to trigger unconfirmed global shortcuts (high 8.6)
- [CVE-2026-66297](https://insights.sbomify.com/CVE-2026-66297/): Unescaped deployment environment variables in generated setup commands (medium 5.0)
- [CVE-2026-66296](https://insights.sbomify.com/CVE-2026-66296/): Reflected XSS in oaskit's default HTML error handler (medium 5.1)
- [CVE-2026-6629](https://insights.sbomify.com/CVE-2026-6629/): Metasoft 美特软件 MetaCRM Interface sql.jsp Statement.executeUpdate sql injection (medium 6.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/456/