# Vulnerabilities published in 2026


- [CVE-2026-65911](https://insights.sbomify.com/CVE-2026-65911/): DOMPurify before 3.4.0 XSS via ADD_ATTR/ADD_TAGS State Leakage (medium 5.1)
- [CVE-2026-6591](https://insights.sbomify.com/CVE-2026-6591/): ComfyUI LoadImage Node folder_paths.py folder_paths.get_annotated_filepath path traversal (medium 5.3)
- [CVE-2026-65908](https://insights.sbomify.com/CVE-2026-65908/): Code injection in PyCharm (high 8.6)
- [CVE-2026-65907](https://insights.sbomify.com/CVE-2026-65907/): Code injection in TeamCity (critical 9.1)
- [CVE-2026-65906](https://insights.sbomify.com/CVE-2026-65906/): Code injection in TeamCity (high 8.8)
- [CVE-2026-65905](https://insights.sbomify.com/CVE-2026-65905/): Apache Tomcat: Limited replay attack possible with DIGEST authentication (critical 9.8)
- [CVE-2026-65904](https://insights.sbomify.com/CVE-2026-65904/): DOMPurify through 3.3.3 Cross-Site Scripting via IN_PLACE mode (low 2.3)
- [CVE-2026-65903](https://insights.sbomify.com/CVE-2026-65903/): DOMPurify before 3.4.0 ADD_TAGS Function Bypasses FORBID_TAGS (medium 5.1)
- [CVE-2026-65902](https://insights.sbomify.com/CVE-2026-65902/): DOMPurify before 3.4.7 Hook Mutation Pollution via allowedTags (medium 5.3)
- [CVE-2026-65901](https://insights.sbomify.com/CVE-2026-65901/): DOMPurify 3.4.6 Cross-Site Scripting via IN_PLACE nodeName (medium 5.1)
- [CVE-2026-65900](https://insights.sbomify.com/CVE-2026-65900/): DOMPurify before 3.4.8 Template Expression Injection via RETURN_DOM (medium 5.1)
- [CVE-2026-6590](https://insights.sbomify.com/CVE-2026-6590/): ComfyUI Model Preview Endpoint model_manager.py get_model_preview path traversal (medium 5.3)
- [CVE-2026-65899](https://insights.sbomify.com/CVE-2026-65899/): DOMPurify before 3.4.9 Trusted Types Policy State Contamination (medium 5.1)
- [CVE-2026-65898](https://insights.sbomify.com/CVE-2026-65898/): DOMPurify before 3.4.11 Permanent Attribute Allowlist Pollution via setConfig (medium 5.1)
- [CVE-2026-65897](https://insights.sbomify.com/CVE-2026-65897/): Grav API Plugin 1.0.9 Privilege Escalation via Invitations groups (high 8.7)
- [CVE-2026-65896](https://insights.sbomify.com/CVE-2026-65896/): Grav API Plugin before 1.0.10 Path Traversal via move (high 7.1)
- [CVE-2026-65895](https://insights.sbomify.com/CVE-2026-65895/): Grav API Plugin before 1.0.10 Broken Access Control (high 8.2)
- [CVE-2026-65894](https://insights.sbomify.com/CVE-2026-65894/): Improper Authentication Vulnerability in CP PLUS EZ-P21 IP Camera (high 8.7)
- [CVE-2026-65893](https://insights.sbomify.com/CVE-2026-65893/): Arbitrary Code Execution Vulnerability in CP PLUS EZ-P21 IP Camera (high 7.0)
- [CVE-2026-65891](https://insights.sbomify.com/CVE-2026-65891/): Path traversal in Joomla Content Editor (JCE) extension for Joomla (medium 6.5)
- [CVE-2026-65890](https://insights.sbomify.com/CVE-2026-65890/): Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2 (critical 9.2)
- [CVE-2026-6589](https://insights.sbomify.com/CVE-2026-6589/): ComfyUI server.py create_origin_only_middleware cross-site request forgery (medium 5.3)
- [CVE-2026-65889](https://insights.sbomify.com/CVE-2026-65889/): Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion in Gridbox < 2.20.2 (critical 9.2)
- [CVE-2026-65888](https://insights.sbomify.com/CVE-2026-65888/): Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2 (critical 10.0)
- [CVE-2026-65887](https://insights.sbomify.com/CVE-2026-65887/): Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2 (critical 10.0)
- [CVE-2026-65886](https://insights.sbomify.com/CVE-2026-65886/): Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox < 2.20.2 (critical 9.2)
- [CVE-2026-65885](https://insights.sbomify.com/CVE-2026-65885/): Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2 (critical 9.4)
- [CVE-2026-65884](https://insights.sbomify.com/CVE-2026-65884/): Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2 (critical 10.0)
- [CVE-2026-65883](https://insights.sbomify.com/CVE-2026-65883/): Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0 (critical 10.0)
- [CVE-2026-65882](https://insights.sbomify.com/CVE-2026-65882/): Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle < 3.1.1 (medium 6.1)
- [CVE-2026-65881](https://insights.sbomify.com/CVE-2026-65881/): Misconfiguration in Joomdle component for Joomla (high 7.5)
- [CVE-2026-65880](https://insights.sbomify.com/CVE-2026-65880/): Joomla Extension - balbooa.com - Unauthenticated remote code execution in Balbooa Forms < 2.4.3 (critical 10.0)
- [CVE-2026-6588](https://insights.sbomify.com/CVE-2026-6588/): serge-chat serge Model API Endpoint model.py delete_model missing authentication (medium 6.9)
- [CVE-2026-65879](https://insights.sbomify.com/CVE-2026-65879/): Hardcoded credentials in SP Page Builder extension for Joomla (critical 9.8)
- [CVE-2026-65878](https://insights.sbomify.com/CVE-2026-65878/): Joomla Extension - joomshaper.com - Authenticated arbitrary file delete in SP Page Builder < 6.7.1 (high 8.3)
- [CVE-2026-65877](https://insights.sbomify.com/CVE-2026-65877/): Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder < 6.7.1 (high 8.2)
- [CVE-2026-65876](https://insights.sbomify.com/CVE-2026-65876/): Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.8.0 (critical 9.2)
- [CVE-2026-65875](https://insights.sbomify.com/CVE-2026-65875/): Code injection in BaserCMS (medium 5.1)
- [CVE-2026-6587](https://insights.sbomify.com/CVE-2026-6587/): vibrantlabsai RAGAS Collections util.py _try_process_url server-side request forgery (medium 5.3)
- [CVE-2026-6586](https://insights.sbomify.com/CVE-2026-6586/): TransformerOptimus SuperAGI Budget Endpoint budget.py update_budget authorization (medium 5.3)
- [CVE-2026-6585](https://insights.sbomify.com/CVE-2026-6585/): TransformerOptimus SuperAGI Organisation Update Endpoint organisation.py update_organisation authorization (medium 5.3)
- [CVE-2026-65842](https://insights.sbomify.com/CVE-2026-65842/): Plate: SSRF with response disclosure in DOCX image embedding (high 8.2)
- [CVE-2026-65841](https://insights.sbomify.com/CVE-2026-65841/): Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization (medium 5.3)
- [CVE-2026-6584](https://insights.sbomify.com/CVE-2026-6584/): TransformerOptimus SuperAGI User Update Endpoint user.py update_user authorization (medium 5.3)
- [CVE-2026-65838](https://insights.sbomify.com/CVE-2026-65838/): Skipper: Incomplete fix for CVE-2026-50197: an oversized body can bypass OPA deny-on-presence Rego policies (high 8.2)
- [CVE-2026-65835](https://insights.sbomify.com/CVE-2026-65835/): Capsule has an incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation) (medium 6.6)
- [CVE-2026-65834](https://insights.sbomify.com/CVE-2026-65834/): Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests (medium 6.8)
- [CVE-2026-65832](https://insights.sbomify.com/CVE-2026-65832/): Memory corruption in deskflow (high 8.2)
- [CVE-2026-65831](https://insights.sbomify.com/CVE-2026-65831/): ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file read (high 7.7)
- [CVE-2026-6583](https://insights.sbomify.com/CVE-2026-6583/): TransformerOptimus SuperAGI API Key Management Endpoint api_key.py edit_api_key authorization (medium 5.3)
- [CVE-2026-65829](https://insights.sbomify.com/CVE-2026-65829/): MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers (medium 5.3)
- [CVE-2026-65828](https://insights.sbomify.com/CVE-2026-65828/): Zammad: Pending upload deletion bypass via legacy attachment endpoint (low 2.3)
- [CVE-2026-65827](https://insights.sbomify.com/CVE-2026-65827/): Docmost: Unbounded ZIP decompression (zip-bomb) in page import allows denial of service (medium 6.5)
- [CVE-2026-65825](https://insights.sbomify.com/CVE-2026-65825/): OpenReception: one tenant's throttle row disables the PIN brute-force throttle for the same identifier in other tenants (high 7.5)
- [CVE-2026-65824](https://insights.sbomify.com/CVE-2026-65824/): Auth bypass in appointment-booking-software (high 7.4)
- [CVE-2026-65822](https://insights.sbomify.com/CVE-2026-65822/): ERPNext: SQL Injection in "Inactive Customers" report via unvalidated `doctype` filter (high 7.6)
- [CVE-2026-6582](https://insights.sbomify.com/CVE-2026-6582/): Auth bypass in SuperAGI (medium 6.9)
- [CVE-2026-65819](https://insights.sbomify.com/CVE-2026-65819/): Denial of service in gopacket (high 7.5)
- [CVE-2026-65818](https://insights.sbomify.com/CVE-2026-65818/): Power Automate Elevation of Privilege Vulnerability (high 8.5)
- [CVE-2026-65816](https://insights.sbomify.com/CVE-2026-65816/): Azure Arc Elevation of Privilege Vulnerability (critical 10.0)
- [CVE-2026-65815](https://insights.sbomify.com/CVE-2026-65815/): Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-65814](https://insights.sbomify.com/CVE-2026-65814/): Microsoft Windows Storage Port Driver Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-65813](https://insights.sbomify.com/CVE-2026-65813/): Microsoft Exchange Server Elevation of Privilege Vulnerability (medium 6.5)
- [CVE-2026-65812](https://insights.sbomify.com/CVE-2026-65812/): Microsoft Teams for Android Information Disclosure Vulnerability (medium 6.8)
- [CVE-2026-65811](https://insights.sbomify.com/CVE-2026-65811/): Power BI Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-65810](https://insights.sbomify.com/CVE-2026-65810/): .NET Framework Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-6581](https://insights.sbomify.com/CVE-2026-6581/): H3C Magic B1 aspForm SetMobileAPInfoById buffer overflow (high 8.7)
- [CVE-2026-65807](https://insights.sbomify.com/CVE-2026-65807/): Microsoft Excel Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-65806](https://insights.sbomify.com/CVE-2026-65806/): Azure CycleCloud Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-65804](https://insights.sbomify.com/CVE-2026-65804/): Microsoft Edge (Chromium-based) Spoofing Vulnerability (medium 6.1)
- [CVE-2026-65802](https://insights.sbomify.com/CVE-2026-65802/): Microsoft Edge for Android Information Disclosure Vulnerability (high 7.4)
- [CVE-2026-65801](https://insights.sbomify.com/CVE-2026-65801/): Microsoft Exchange Online Elevation of Privilege Vulnerability (critical 10.0)
- [CVE-2026-6580](https://insights.sbomify.com/CVE-2026-6580/): liangliangyy DjangoBlog Amap API Call views.py hard-coded key (medium 6.9)
- [CVE-2026-65799](https://insights.sbomify.com/CVE-2026-65799/): Windows DNS Elevation of Privilege Vulnerability (medium 6.7)
- [CVE-2026-65798](https://insights.sbomify.com/CVE-2026-65798/): Windows DNS Elevation of Privilege Vulnerability (medium 6.7)
- [CVE-2026-65797](https://insights.sbomify.com/CVE-2026-65797/): Windows DNS Elevation of Privilege Vulnerability (medium 6.7)
- [CVE-2026-65796](https://insights.sbomify.com/CVE-2026-65796/): Windows iSCSI Target Service Remote Code Execution Vulnerability (high 8.1)
- [CVE-2026-65795](https://insights.sbomify.com/CVE-2026-65795/): Windows DNS Elevation of Privilege Vulnerability (medium 6.7)
- [CVE-2026-65794](https://insights.sbomify.com/CVE-2026-65794/): Windows SMB Client Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-65791](https://insights.sbomify.com/CVE-2026-65791/): Windows iSCSI Target Service Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-65790](https://insights.sbomify.com/CVE-2026-65790/): Windows Message Queuing Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-6579](https://insights.sbomify.com/CVE-2026-6579/): liangliangyy DjangoBlog Clean Endpoint views.py missing authentication (medium 6.9)
- [CVE-2026-65789](https://insights.sbomify.com/CVE-2026-65789/): Windows DNS Server Remote Code Execution Vulnerability (high 8.1)
- [CVE-2026-65788](https://insights.sbomify.com/CVE-2026-65788/): Desktop Window Manager Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-65787](https://insights.sbomify.com/CVE-2026-65787/): Desktop Window Manager Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-65786](https://insights.sbomify.com/CVE-2026-65786/): Desktop Window Manager Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-65785](https://insights.sbomify.com/CVE-2026-65785/): Windows DHCP Client Denial of Service Vulnerability (medium 6.5)
- [CVE-2026-65784](https://insights.sbomify.com/CVE-2026-65784/): Windows NTFS Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-65783](https://insights.sbomify.com/CVE-2026-65783/): Windows Autopilot Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-65782](https://insights.sbomify.com/CVE-2026-65782/): Windows Autopilot Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-65781](https://insights.sbomify.com/CVE-2026-65781/): Windows Autopilot Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-65780](https://insights.sbomify.com/CVE-2026-65780/): Windows Autopilot Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-6578](https://insights.sbomify.com/CVE-2026-6578/): liangliangyy DjangoBlog Setting settings.py hard-coded credentials (medium 6.3)
- [CVE-2026-65779](https://insights.sbomify.com/CVE-2026-65779/): Windows Autopilot Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-65778](https://insights.sbomify.com/CVE-2026-65778/): Windows Autopilot Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-65777](https://insights.sbomify.com/CVE-2026-65777/): Active Directory Security Feature Bypass Vulnerability (medium 5.3)
- [CVE-2026-65776](https://insights.sbomify.com/CVE-2026-65776/): Windows Win32k Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-65775](https://insights.sbomify.com/CVE-2026-65775/): Windows Win32k Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-65774](https://insights.sbomify.com/CVE-2026-65774/): Windows Installer Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-65773](https://insights.sbomify.com/CVE-2026-65773/): Windows Kernel Elevation of Privilege Vulnerability (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/459/