# Vulnerabilities published in 2026


- [CVE-2026-66282](https://insights.sbomify.com/CVE-2026-66282/): Authenticated Denial-of-Service in Zigbee Publish Billing Period (medium 6.0)
- [CVE-2026-66281](https://insights.sbomify.com/CVE-2026-66281/): Authenticated Denial-of-Service in Zigbee Discover Attributes Handling (medium 6.0)
- [CVE-2026-6628](https://insights.sbomify.com/CVE-2026-6628/): phili67 Ecclesia CRM Query Viewer view ValidateInput sql injection (medium 5.3)
- [CVE-2026-66279](https://insights.sbomify.com/CVE-2026-66279/): Dis-connect vulnerability in Connect Stack (high 7.2)
- [CVE-2026-66277](https://insights.sbomify.com/CVE-2026-66277/): Apache Qpid Proton-J: Unable to govern the maximum number of transfer frames per incoming delivery (medium 6.5)
- [CVE-2026-66276](https://insights.sbomify.com/CVE-2026-66276/): Apache Qpid Proton-J: Unbounded disposition range handling can lead to denial of service (medium 6.5)
- [CVE-2026-66275](https://insights.sbomify.com/CVE-2026-66275/): Apache Qpid Proton-J: Incoming session flow control window can be exceeded (medium 6.5)
- [CVE-2026-66274](https://insights.sbomify.com/CVE-2026-66274/): Apache Qpid Proton-J: Unbounded type nesting can lead to pre-authentication stackoverflow (high 7.5)
- [CVE-2026-66273](https://insights.sbomify.com/CVE-2026-66273/): Apache Qpid Proton-J: Type size/count handling can lead to excessive allocation pre-authentication (high 7.5)
- [CVE-2026-66272](https://insights.sbomify.com/CVE-2026-66272/): Missing authorization in Wyse Management Suite (WMS) (medium 5.3)
- [CVE-2026-66271](https://insights.sbomify.com/CVE-2026-66271/): File upload in Wyse Management Suite (WMS) (high 7.2)
- [CVE-2026-66270](https://insights.sbomify.com/CVE-2026-66270/): File upload in Wyse Management Suite (WMS) (high 7.2)
- [CVE-2026-6627](https://insights.sbomify.com/CVE-2026-6627/): WPFormify <= 1.1.1 - Missing Authorization (high 8.2)
- [CVE-2026-66269](https://insights.sbomify.com/CVE-2026-66269/): Security feature bypass in Dell OpenManage Server Administrator Managed Node (Patch) for Windows (high 7.3)
- [CVE-2026-6626](https://insights.sbomify.com/CVE-2026-6626/): Cockpit-HQ Cockpit Asset Handler/Aggregate data query logic injection (medium 5.3)
- [CVE-2026-66257](https://insights.sbomify.com/CVE-2026-66257/): Apache Qpid Proton-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustion (high 7.5)
- [CVE-2026-66256](https://insights.sbomify.com/CVE-2026-66256/): Deserialization in Apache Shindig Common (high 7.2)
- [CVE-2026-66253](https://insights.sbomify.com/CVE-2026-66253/): HCL iControl is affected by a Session Timeout vulnerability (low 3.1)
- [CVE-2026-6625](https://insights.sbomify.com/CVE-2026-6625/): Server-side request forgery in Mogu Blog v2 (medium 6.9)
- [CVE-2026-66249](https://insights.sbomify.com/CVE-2026-66249/): HCL iControl is affected by a Missing Secure Attribute vulnerability (low 3.1)
- [CVE-2026-66248](https://insights.sbomify.com/CVE-2026-66248/): HCL iControl is affected by an Improper Error Handling vulnerability (low 3.1)
- [CVE-2026-66247](https://insights.sbomify.com/CVE-2026-66247/): Misconfiguration in iControl (medium 4.3)
- [CVE-2026-66246](https://insights.sbomify.com/CVE-2026-66246/): HCL iControl is affected by multiple security vulnerabilities (high 8.8)
- [CVE-2026-6624](https://insights.sbomify.com/CVE-2026-6624/): BichitroGan ISP Billing Software Pool List add cross site scripting (medium 4.8)
- [CVE-2026-6623](https://insights.sbomify.com/CVE-2026-6623/): BichitroGan ISP Billing Software Profile users-view cross site scripting (medium 4.8)
- [CVE-2026-6622](https://insights.sbomify.com/CVE-2026-6622/): BichitroGan ISP Billing Software Customer edit cross site scripting (medium 4.8)
- [CVE-2026-6621](https://insights.sbomify.com/CVE-2026-6621/): 1024bit extend-deep index.js prototype pollution (medium 6.9)
- [CVE-2026-6620](https://insights.sbomify.com/CVE-2026-6620/): SonicCloudOrg sonic-server File Upload Endpoint FileTool.java upload path traversal (medium 5.3)
- [CVE-2026-6619](https://insights.sbomify.com/CVE-2026-6619/): langgenius dify ImagePreview image-preview.tsx openInNewTab cross site scripting (medium 5.1)
- [CVE-2026-6618](https://insights.sbomify.com/CVE-2026-6618/): langgenius dify ApiBasedToolSchemaParser parser.py parse_openai_plugin_json_to_tool_bundle server-side request forgery (medium 5.3)
- [CVE-2026-6617](https://insights.sbomify.com/CVE-2026-6617/): Server-side request forgery in dify (medium 5.3)
- [CVE-2026-6616](https://insights.sbomify.com/CVE-2026-6616/): TransformerOptimus SuperAGI WebScraperTool webpage_extractor.py extract_with_lxml server-side request forgery (medium 5.3)
- [CVE-2026-66155](https://insights.sbomify.com/CVE-2026-66155/): Cross-site scripting in Element maps-ng V47 (high 7.0)
- [CVE-2026-66154](https://insights.sbomify.com/CVE-2026-66154/): Security feature bypass in GMS (high 8.3)
- [CVE-2026-66153](https://insights.sbomify.com/CVE-2026-66153/): Path traversal in NetExtender (high 7.0)
- [CVE-2026-66152](https://insights.sbomify.com/CVE-2026-66152/): Path traversal in NetExtender (high 8.8)
- [CVE-2026-66151](https://insights.sbomify.com/CVE-2026-66151/): Memory corruption in Global VPN Client (medium 5.5)
- [CVE-2026-66150](https://insights.sbomify.com/CVE-2026-66150/): Code injection in Email Security (high 7.8)
- [CVE-2026-6615](https://insights.sbomify.com/CVE-2026-6615/): TransformerOptimus SuperAGI Multipart Upload resources.py upload path traversal (medium 6.9)
- [CVE-2026-66149](https://insights.sbomify.com/CVE-2026-66149/): Command injection in Email Security (high 7.8)
- [CVE-2026-66148](https://insights.sbomify.com/CVE-2026-66148/): Command injection in GMS (medium 6.3)
- [CVE-2026-66147](https://insights.sbomify.com/CVE-2026-66147/): Command injection in GMS (critical 9.4)
- [CVE-2026-66146](https://insights.sbomify.com/CVE-2026-66146/): Cross-site scripting in GMS (medium 6.1)
- [CVE-2026-66145](https://insights.sbomify.com/CVE-2026-66145/): Path traversal in GMS (critical 9.1)
- [CVE-2026-66144](https://insights.sbomify.com/CVE-2026-66144/): Apache Neethi: Remote PolicyReference fetch lacks resource bounds (high 7.5)
- [CVE-2026-66143](https://insights.sbomify.com/CVE-2026-66143/): Apache Neethi: Missing global alternative-output budget across policy computation paths (high 7.5)
- [CVE-2026-66142](https://insights.sbomify.com/CVE-2026-66142/): Apache Neethi: Uncontrolled recursion in policy processing (high 7.5)
- [CVE-2026-66141](https://insights.sbomify.com/CVE-2026-66141/): Privilege escalation in Exim (high 7.4)
- [CVE-2026-66140](https://insights.sbomify.com/CVE-2026-66140/): Path traversal in Exim (high 8.4)
- [CVE-2026-6614](https://insights.sbomify.com/CVE-2026-6614/): TransformerOptimus SuperAGI project.py get_projects_organisation authorization (medium 5.3)
- [CVE-2026-66139](https://insights.sbomify.com/CVE-2026-66139/): Auth bypass in Zaqar (medium 4.8)
- [CVE-2026-66138](https://insights.sbomify.com/CVE-2026-66138/): Command injection in Ironic Python Agent (high 7.2)
- [CVE-2026-6613](https://insights.sbomify.com/CVE-2026-6613/): TransformerOptimus SuperAGI agent.py get_schedule_data authorization (medium 5.3)
- [CVE-2026-6612](https://insights.sbomify.com/CVE-2026-6612/): TransformerOptimus SuperAGI Agent Execution Endpoint agent_execution.py update_agent_execution authorization (medium 5.3)
- [CVE-2026-6611](https://insights.sbomify.com/CVE-2026-6611/): liangliangyy DjangoBlog File Upload Endpoint settings.py hard-coded key (low 2.3)
- [CVE-2026-66109](https://insights.sbomify.com/CVE-2026-66109/): Missing authorization in SKYMEC IT Manager (high 8.5)
- [CVE-2026-6610](https://insights.sbomify.com/CVE-2026-6610/): liangliangyy DjangoBlog Setting settings.py hard-coded credentials (medium 6.3)
- [CVE-2026-66098](https://insights.sbomify.com/CVE-2026-66098/): Mira Hormone Monitor, Mira Android App Missing authentication for critical function (high 7.1)
- [CVE-2026-66092](https://insights.sbomify.com/CVE-2026-66092/): Stored XSS in pre-login notice via reachable legacy logon route (medium 4.8)
- [CVE-2026-66091](https://insights.sbomify.com/CVE-2026-66091/): Unauthenticated IDOR Enables Disclosure of Other Users’ last-known details (medium 6.9)
- [CVE-2026-66090](https://insights.sbomify.com/CVE-2026-66090/): XML External Entity (XXE) Injection in Metadata Field Allows Arbitrary File Read (high 7.1)
- [CVE-2026-6609](https://insights.sbomify.com/CVE-2026-6609/): liangliangyy DjangoBlog views.py form_valid improper authorization (medium 5.3)
- [CVE-2026-66089](https://insights.sbomify.com/CVE-2026-66089/): XML External Entity (XXE) Vulnerability in SOAP Interface Allows External Entity Expansion (medium 6.1)
- [CVE-2026-66088](https://insights.sbomify.com/CVE-2026-66088/): Unrestricted Command Execution via system.execute (critical 9.4)
- [CVE-2026-66087](https://insights.sbomify.com/CVE-2026-66087/): Apache DolphinScheduler: Project Authorization Bypass in the Task instance stop/savepoint Endpoint (high 8.1)
- [CVE-2026-66086](https://insights.sbomify.com/CVE-2026-66086/): Stack-based Buffer Overflow in Modem (high 8.3)
- [CVE-2026-66085](https://insights.sbomify.com/CVE-2026-66085/): Information Disclosure in Modem (medium 5.5)
- [CVE-2026-66084](https://insights.sbomify.com/CVE-2026-66084/): Apache DolphinScheduler: Project Authorization Bypass in the Task Definition with-upstream Endpoint (high 8.1)
- [CVE-2026-66083](https://insights.sbomify.com/CVE-2026-66083/): Apache DolphinScheduler: Unauthorized Disclosure of Data Source Information via /datasources/unauth-datasource (medium 6.5)
- [CVE-2026-66082](https://insights.sbomify.com/CVE-2026-66082/): Apache DolphinScheduler: Cross-project authorization bypasses in DolphinScheduler API (schedule / workflow） (medium 6.5)
- [CVE-2026-66081](https://insights.sbomify.com/CVE-2026-66081/): Apache Thrift: c_glib read_message_begin leaves output parameters unset for non-versioned messages (high 8.7)
- [CVE-2026-66080](https://insights.sbomify.com/CVE-2026-66080/): RabbitMQ: Super-stream partitions unbounded allocation (medium 5.9)
- [CVE-2026-6608](https://insights.sbomify.com/CVE-2026-6608/): lm-sys fastchat Arena Side-by-Side View add_text control flow (medium 6.9)
- [CVE-2026-66079](https://insights.sbomify.com/CVE-2026-66079/): RabbitMQ: Pre-auth AMQP 1.0 array32 zero-width element DoS (high 8.2)
- [CVE-2026-66078](https://insights.sbomify.com/CVE-2026-66078/): RabbitMQ: protected tag bypass via bulk-delete (low 2.1)
- [CVE-2026-66077](https://insights.sbomify.com/CVE-2026-66077/): RabbitMQ: Stored XSS via TLS peer-certificate DN in management UI (high 7.3)
- [CVE-2026-66076](https://insights.sbomify.com/CVE-2026-66076/): RabbitMQ: Cross-vhost quorum-queue status and stream tracking disclosure (low 2.3)
- [CVE-2026-66075](https://insights.sbomify.com/CVE-2026-66075/): RabbitMQ: Monitoring-tag user can restart federation links (low 2.3)
- [CVE-2026-66074](https://insights.sbomify.com/CVE-2026-66074/): RabbitMQ: ReDoS via management API ?name= filter (medium 6.0)
- [CVE-2026-66073](https://insights.sbomify.com/CVE-2026-66073/): RabbitMQ: Atom table exhaustion via management API node field (medium 6.0)
- [CVE-2026-66072](https://insights.sbomify.com/CVE-2026-66072/): RabbitMQ: Atom table exhaustion via stream `chunk_selector` (medium 6.0)
- [CVE-2026-66071](https://insights.sbomify.com/CVE-2026-66071/): RabbitMQ: Atom exhaustion: OAuth2 JWT tag: scope values (medium 6.0)
- [CVE-2026-66070](https://insights.sbomify.com/CVE-2026-66070/): RabbitMQ: CORS * reflects Origin with Allow-Credentials (high 7.6)
- [CVE-2026-6607](https://insights.sbomify.com/CVE-2026-6607/): lm-sys fastchat Worker API Endpoint api_generate resource consumption (medium 6.9)
- [CVE-2026-66069](https://insights.sbomify.com/CVE-2026-66069/): RabbitMQ: Monitoring-tag DELETE of auth-attempt metrics (low 2.3)
- [CVE-2026-66068](https://insights.sbomify.com/CVE-2026-66068/): RabbitMQ: Shovel DEBUG log of full state exposes decrypted URIs (medium 5.6)
- [CVE-2026-66067](https://insights.sbomify.com/CVE-2026-66067/): RabbitMQ: Stream protocol skips per vhost per user connection limits (medium 6.0)
- [CVE-2026-66066](https://insights.sbomify.com/CVE-2026-66066/): Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing (critical 9.5)
- [CVE-2026-66065](https://insights.sbomify.com/CVE-2026-66065/): ouroboros-ai: Incomplete fix of CVE-2026-47211: untrusted project .env can still reach RCE via omitted execution-routing keys (high 8.4)
- [CVE-2026-66064](https://insights.sbomify.com/CVE-2026-66064/): goshs has ACL Bypass & Path Traversal (medium 5.3)
- [CVE-2026-66063](https://insights.sbomify.com/CVE-2026-66063/): goshs has a Path Traversal issue (medium 6.5)
- [CVE-2026-66062](https://insights.sbomify.com/CVE-2026-66062/): SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header (medium 5.3)
- [CVE-2026-66061](https://insights.sbomify.com/CVE-2026-66061/): Home Assistant: iOS Companion app forwards NFC/QR tag scans without confirmation, enabling silent automation execution (high 7.1)
- [CVE-2026-66060](https://insights.sbomify.com/CVE-2026-66060/): Home Assistant: Unconfirmed NFC/QR tag scans allow silent automation execution by untrusted callers (high 7.1)
- [CVE-2026-6606](https://insights.sbomify.com/CVE-2026-6606/): modelscope agentscope _agent_base.py _process_audio_block server-side request forgery (medium 6.9)
- [CVE-2026-66059](https://insights.sbomify.com/CVE-2026-66059/): Frappe: Field-level permission bypass via Document Follow (medium 5.3)
- [CVE-2026-66058](https://insights.sbomify.com/CVE-2026-66058/): Frappe: Unrestricted access to a Document Follow API (medium 5.3)
- [CVE-2026-66057](https://insights.sbomify.com/CVE-2026-66057/): Frappe: Open Redirect via Unsanitized OAuth State Param. (medium 5.1)
- [CVE-2026-66055](https://insights.sbomify.com/CVE-2026-66055/): Denial of service in Apache Thrift (high 8.2)
- [CVE-2026-66054](https://insights.sbomify.com/CVE-2026-66054/): Apache Thrift: C++ THeaderTransport does not enforce configured maxFrameSize (medium 6.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/457/