# Vulnerabilities published in 2026


- [CVE-2026-6543](https://insights.sbomify.com/CVE-2026-6543/): Authenticated Remote Code Execution Vulnerability in Langflow Code Validation Endpoint (high 8.8)
- [CVE-2026-65423](https://insights.sbomify.com/CVE-2026-65423/): o6 Automation open62541 Integer Overflow or Wraparound (high 8.7)
- [CVE-2026-65422](https://insights.sbomify.com/CVE-2026-65422/): Missing authorization in Genetec Security Center (medium 6.5)
- [CVE-2026-65421](https://insights.sbomify.com/CVE-2026-65421/): MZ Automation libiec61850 Out-of-bounds Read (high 7.1)
- [CVE-2026-6542](https://insights.sbomify.com/CVE-2026-6542/): Monitor API allows cross-user read of transaction logs and deletion of build data via flow_id (medium 6.5)
- [CVE-2026-65415](https://insights.sbomify.com/CVE-2026-65415/): Race condition in iOS and iPadOS (high 8.1)
- [CVE-2026-65414](https://insights.sbomify.com/CVE-2026-65414/): Memory corruption in iOS and iPadOS (critical 9.8)
- [CVE-2026-65413](https://insights.sbomify.com/CVE-2026-65413/): Integer overflow in macOS (medium 5.5)
- [CVE-2026-65412](https://insights.sbomify.com/CVE-2026-65412/): Null dereference in iOS and iPadOS (medium 6.5)
- [CVE-2026-65411](https://insights.sbomify.com/CVE-2026-65411/): Path traversal in iOS and iPadOS (medium 5.5)
- [CVE-2026-65410](https://insights.sbomify.com/CVE-2026-65410/): Denial of service in iOS and iPadOS (high 7.5)
- [CVE-2026-6541](https://insights.sbomify.com/CVE-2026-6541/): Unscoped updates to other playbooks' metric configuration (medium 4.3)
- [CVE-2026-65409](https://insights.sbomify.com/CVE-2026-65409/): Memory corruption in iOS and iPadOS (medium 5.5)
- [CVE-2026-65408](https://insights.sbomify.com/CVE-2026-65408/): Integer overflow in iOS and iPadOS (medium 5.5)
- [CVE-2026-65407](https://insights.sbomify.com/CVE-2026-65407/): Use after free in iOS and iPadOS (medium 5.5)
- [CVE-2026-65406](https://insights.sbomify.com/CVE-2026-65406/): Security feature bypass in iOS and iPadOS (medium 5.5)
- [CVE-2026-65405](https://insights.sbomify.com/CVE-2026-65405/): Information disclosure in iOS and iPadOS (medium 5.5)
- [CVE-2026-65404](https://insights.sbomify.com/CVE-2026-65404/): Security feature bypass in iOS and iPadOS (medium 5.5)
- [CVE-2026-65403](https://insights.sbomify.com/CVE-2026-65403/): Missing authorization in iOS and iPadOS (medium 5.5)
- [CVE-2026-65402](https://insights.sbomify.com/CVE-2026-65402/): Use after free in iOS and iPadOS (medium 5.5)
- [CVE-2026-65401](https://insights.sbomify.com/CVE-2026-65401/): Race condition in macOS (medium 5.5)
- [CVE-2026-65400](https://insights.sbomify.com/CVE-2026-65400/): Apple macOS Improper Authentication (critical 9.8, exploited in the wild)
- [CVE-2026-6540](https://insights.sbomify.com/CVE-2026-6540/): L7 policy bypass via unnormalized HTTP path matching (high 7.9)
- [CVE-2026-65399](https://insights.sbomify.com/CVE-2026-65399/): Security feature bypass in iOS and iPadOS (medium 4.4)
- [CVE-2026-65398](https://insights.sbomify.com/CVE-2026-65398/): Memory corruption in iOS and iPadOS (high 7.8)
- [CVE-2026-65397](https://insights.sbomify.com/CVE-2026-65397/): Missing authorization in iOS and iPadOS (medium 5.5)
- [CVE-2026-65396](https://insights.sbomify.com/CVE-2026-65396/): Memory corruption in macOS (medium 5.5)
- [CVE-2026-65395](https://insights.sbomify.com/CVE-2026-65395/): Memory corruption in iOS and iPadOS (medium 6.5)
- [CVE-2026-65393](https://insights.sbomify.com/CVE-2026-65393/): Missing authorization in Xcode (medium 5.5)
- [CVE-2026-65392](https://insights.sbomify.com/CVE-2026-65392/): Missing authorization in macOS (not scored)
- [CVE-2026-65391](https://insights.sbomify.com/CVE-2026-65391/): Memory corruption in Safari (high 8.8)
- [CVE-2026-65390](https://insights.sbomify.com/CVE-2026-65390/): Integer overflow in Safari (high 8.8)
- [CVE-2026-6539](https://insights.sbomify.com/CVE-2026-6539/): Notepad++ 8.9.3 Format String Injection via nativeLang.xml (medium 4.6)
- [CVE-2026-65388](https://insights.sbomify.com/CVE-2026-65388/): Open redirect in containerization (high 7.5)
- [CVE-2026-65385](https://insights.sbomify.com/CVE-2026-65385/): Memory corruption in iOS and iPadOS (not scored)
- [CVE-2026-65384](https://insights.sbomify.com/CVE-2026-65384/): Memory corruption in macOS (not scored)
- [CVE-2026-65383](https://insights.sbomify.com/CVE-2026-65383/): Security feature bypass in macOS (medium 4.4)
- [CVE-2026-65382](https://insights.sbomify.com/CVE-2026-65382/): Path traversal in macOS (medium 5.5)
- [CVE-2026-65381](https://insights.sbomify.com/CVE-2026-65381/): Security feature bypass in macOS (high 8.8)
- [CVE-2026-65380](https://insights.sbomify.com/CVE-2026-65380/): Missing authorization in macOS (medium 5.5)
- [CVE-2026-6538](https://insights.sbomify.com/CVE-2026-6538/): Stack-based Buffer Overflow in Wireshark (medium 5.5)
- [CVE-2026-65379](https://insights.sbomify.com/CVE-2026-65379/): Information disclosure in macOS (medium 5.5)
- [CVE-2026-65378](https://insights.sbomify.com/CVE-2026-65378/): Missing authorization in macOS (medium 5.5)
- [CVE-2026-65377](https://insights.sbomify.com/CVE-2026-65377/): Memory corruption in iOS and iPadOS (medium 5.5)
- [CVE-2026-65376](https://insights.sbomify.com/CVE-2026-65376/): Memory corruption in macOS (medium 5.5)
- [CVE-2026-65375](https://insights.sbomify.com/CVE-2026-65375/): Auth bypass in macOS (high 7.5)
- [CVE-2026-65374](https://insights.sbomify.com/CVE-2026-65374/): Memory corruption in macOS (high 8.8)
- [CVE-2026-65373](https://insights.sbomify.com/CVE-2026-65373/): Privilege escalation in macOS (not scored)
- [CVE-2026-65372](https://insights.sbomify.com/CVE-2026-65372/): Race condition in macOS (medium 4.7)
- [CVE-2026-65371](https://insights.sbomify.com/CVE-2026-65371/): Information disclosure in iOS and iPadOS (low 3.3)
- [CVE-2026-65370](https://insights.sbomify.com/CVE-2026-65370/): Other in servicetalk (high 7.5)
- [CVE-2026-6537](https://insights.sbomify.com/CVE-2026-6537/): Stack-based Buffer Overflow in Wireshark (medium 5.5)
- [CVE-2026-65369](https://insights.sbomify.com/CVE-2026-65369/): Security feature bypass in macOS (medium 5.5)
- [CVE-2026-65368](https://insights.sbomify.com/CVE-2026-65368/): Security feature bypass in macOS (not scored)
- [CVE-2026-65367](https://insights.sbomify.com/CVE-2026-65367/): Null dereference in iOS and iPadOS (medium 5.5)
- [CVE-2026-65365](https://insights.sbomify.com/CVE-2026-65365/): Memory corruption in macOS (medium 6.5)
- [CVE-2026-65364](https://insights.sbomify.com/CVE-2026-65364/): Memory corruption in macOS (high 7.5)
- [CVE-2026-65363](https://insights.sbomify.com/CVE-2026-65363/): Security feature bypass in iOS and iPadOS (not scored)
- [CVE-2026-65362](https://insights.sbomify.com/CVE-2026-65362/): Privilege escalation in macOS (high 7.8)
- [CVE-2026-65361](https://insights.sbomify.com/CVE-2026-65361/): Missing authorization in macOS (medium 5.5)
- [CVE-2026-65360](https://insights.sbomify.com/CVE-2026-65360/): Race condition in iOS and iPadOS (medium 4.7)
- [CVE-2026-6536](https://insights.sbomify.com/CVE-2026-6536/): Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark (medium 5.5)
- [CVE-2026-65359](https://insights.sbomify.com/CVE-2026-65359/): Memory corruption in iOS and iPadOS (high 7.1)
- [CVE-2026-65358](https://insights.sbomify.com/CVE-2026-65358/): Race condition in iOS and iPadOS (medium 4.7)
- [CVE-2026-65357](https://insights.sbomify.com/CVE-2026-65357/): Memory corruption in iOS and iPadOS (high 7.8)
- [CVE-2026-65356](https://insights.sbomify.com/CVE-2026-65356/): Missing authorization in macOS (medium 5.5)
- [CVE-2026-65355](https://insights.sbomify.com/CVE-2026-65355/): Information disclosure in iOS and iPadOS (medium 4.3)
- [CVE-2026-65354](https://insights.sbomify.com/CVE-2026-65354/): Privilege escalation in iOS and iPadOS (high 8.2)
- [CVE-2026-65353](https://insights.sbomify.com/CVE-2026-65353/): Missing authorization in iOS and iPadOS (medium 5.5)
- [CVE-2026-65352](https://insights.sbomify.com/CVE-2026-65352/): Information disclosure in iOS and iPadOS (medium 4.3)
- [CVE-2026-65351](https://insights.sbomify.com/CVE-2026-65351/): Denial of service in Safari (medium 4.3)
- [CVE-2026-65350](https://insights.sbomify.com/CVE-2026-65350/): Use after free in iOS and iPadOS (not scored)
- [CVE-2026-6535](https://insights.sbomify.com/CVE-2026-6535/): Improperly Controlled Sequential Memory Allocation in Wireshark (medium 5.5)
- [CVE-2026-65349](https://insights.sbomify.com/CVE-2026-65349/): Memory corruption in iOS and iPadOS (medium 6.6)
- [CVE-2026-65348](https://insights.sbomify.com/CVE-2026-65348/): Misconfiguration in iOS and iPadOS (medium 5.5)
- [CVE-2026-65347](https://insights.sbomify.com/CVE-2026-65347/): Denial of service in iOS and iPadOS (medium 6.5)
- [CVE-2026-65346](https://insights.sbomify.com/CVE-2026-65346/): Integer overflow in iOS and iPadOS (high 8.8)
- [CVE-2026-65345](https://insights.sbomify.com/CVE-2026-65345/): Missing authorization in iOS and iPadOS (medium 5.5)
- [CVE-2026-65344](https://insights.sbomify.com/CVE-2026-65344/): Memory corruption in iOS and iPadOS (high 7.8)
- [CVE-2026-65343](https://insights.sbomify.com/CVE-2026-65343/): Use after free in iOS and iPadOS (high 7.5)
- [CVE-2026-65342](https://insights.sbomify.com/CVE-2026-65342/): Missing authorization in macOS (medium 5.5)
- [CVE-2026-65341](https://insights.sbomify.com/CVE-2026-65341/): Use after free in Safari (medium 5.4)
- [CVE-2026-65340](https://insights.sbomify.com/CVE-2026-65340/): Denial of service in Safari (medium 4.3)
- [CVE-2026-6534](https://insights.sbomify.com/CVE-2026-6534/): Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark (medium 5.5)
- [CVE-2026-65339](https://insights.sbomify.com/CVE-2026-65339/): Information disclosure in iOS and iPadOS (medium 5.0)
- [CVE-2026-65338](https://insights.sbomify.com/CVE-2026-65338/): Use after free in Safari (medium 4.3)
- [CVE-2026-65337](https://insights.sbomify.com/CVE-2026-65337/): Denial of service in Safari (medium 4.3)
- [CVE-2026-65336](https://insights.sbomify.com/CVE-2026-65336/): Denial of service in Safari (medium 4.3)
- [CVE-2026-65335](https://insights.sbomify.com/CVE-2026-65335/): Memory corruption in Safari (medium 4.3)
- [CVE-2026-65334](https://insights.sbomify.com/CVE-2026-65334/): Memory corruption in Safari (medium 4.3)
- [CVE-2026-65333](https://insights.sbomify.com/CVE-2026-65333/): Memory corruption in Safari (medium 4.3)
- [CVE-2026-65332](https://insights.sbomify.com/CVE-2026-65332/): Denial of service in Safari (medium 4.3)
- [CVE-2026-65331](https://insights.sbomify.com/CVE-2026-65331/): Denial of service in Safari (medium 4.3)
- [CVE-2026-65330](https://insights.sbomify.com/CVE-2026-65330/): Memory corruption in iOS and iPadOS (medium 6.5)
- [CVE-2026-6533](https://insights.sbomify.com/CVE-2026-6533/): Improperly Controlled Sequential Memory Allocation in Wireshark (medium 5.5)
- [CVE-2026-65329](https://insights.sbomify.com/CVE-2026-65329/): Auth bypass in iOS and iPadOS (medium 5.9)
- [CVE-2026-65327](https://insights.sbomify.com/CVE-2026-65327/): Privilege escalation in macOS (high 8.4)
- [CVE-2026-65325](https://insights.sbomify.com/CVE-2026-65325/): Apache Traffic Server: HTTP/2 multiplexed origin sessions are reused without certificate re-verification (medium 6.3)
- [CVE-2026-65324](https://insights.sbomify.com/CVE-2026-65324/): Apache Traffic Server: HTTP/2 and HTTP/3 dechunking removes per-stream buffer cap, allowing memory exhaustion (high 8.2)
- [CVE-2026-65321](https://insights.sbomify.com/CVE-2026-65321/): PyAthena SQL Injection via DefaultParameterFormatter DELETE/CTAS (critical 9.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/463/