# Vulnerabilities published in 2026


- [CVE-2026-6532](https://insights.sbomify.com/CVE-2026-6532/): Buffer Over-read in Wireshark (medium 5.5)
- [CVE-2026-65319](https://insights.sbomify.com/CVE-2026-65319/): Feedbin Unauthenticated Entry Content Disclosure via GET /api/v2/entries/:id/text (high 8.7)
- [CVE-2026-65318](https://insights.sbomify.com/CVE-2026-65318/): Verba (goldenverba) Unauthenticated Server-Side Request Forgery via WebSocket Import Endpoint HTMLReader (critical 9.2)
- [CVE-2026-65317](https://insights.sbomify.com/CVE-2026-65317/): Verba (goldenverba) Server-Side Request Forgery via /api/connect and Same-Origin Middleware Bypass (critical 9.2)
- [CVE-2026-65316](https://insights.sbomify.com/CVE-2026-65316/): xxl-job Cross-Job-Group Log Disclosure via Missing Authorization Check in /joblog/logDetailCat (high 7.1)
- [CVE-2026-65315](https://insights.sbomify.com/CVE-2026-65315/): Ollama Remote Denial of Service via Attacker-Controlled Allocation in GGUF Metadata Parser (high 8.7)
- [CVE-2026-65314](https://insights.sbomify.com/CVE-2026-65314/): Electric Postgres Sync Excluded-Column Value Inference via Subset Where Clauses (medium 5.3)
- [CVE-2026-65313](https://insights.sbomify.com/CVE-2026-65313/): Use of hard-coded VNC credentials in the engineering-workstation provisioning (high 8.1)
- [CVE-2026-65311](https://insights.sbomify.com/CVE-2026-65311/): Missing authentication for logging-configuration endpoint (medium 5.3)
- [CVE-2026-65310](https://insights.sbomify.com/CVE-2026-65310/): Missing authentication and permissive CORS policy (high 7.5)
- [CVE-2026-6531](https://insights.sbomify.com/CVE-2026-6531/): Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark (medium 5.5)
- [CVE-2026-65309](https://insights.sbomify.com/CVE-2026-65309/): Storage of passwords in a reversible format (high 7.5)
- [CVE-2026-6530](https://insights.sbomify.com/CVE-2026-6530/): Heap-based Buffer Overflow in Wireshark (medium 5.5)
- [CVE-2026-6529](https://insights.sbomify.com/CVE-2026-6529/): Heap-based Buffer Overflow in Wireshark (medium 5.5)
- [CVE-2026-6528](https://insights.sbomify.com/CVE-2026-6528/): Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark (medium 5.5)
- [CVE-2026-6527](https://insights.sbomify.com/CVE-2026-6527/): Uncontrolled Recursion in Wireshark (medium 5.5)
- [CVE-2026-6526](https://insights.sbomify.com/CVE-2026-6526/): NULL Pointer Dereference in Wireshark (medium 5.5)
- [CVE-2026-6525](https://insights.sbomify.com/CVE-2026-6525/): NULL Pointer Dereference in Wireshark (medium 5.5)
- [CVE-2026-6524](https://insights.sbomify.com/CVE-2026-6524/): Access of Uninitialized Pointer in Wireshark (medium 5.5)
- [CVE-2026-6523](https://insights.sbomify.com/CVE-2026-6523/): Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark (medium 5.5)
- [CVE-2026-65220](https://insights.sbomify.com/CVE-2026-65220/): Supermicro BMC IPMI feature contains a Privilege escalation vulnerability (high 8.8)
- [CVE-2026-6522](https://insights.sbomify.com/CVE-2026-6522/): Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark (medium 5.5)
- [CVE-2026-65219](https://insights.sbomify.com/CVE-2026-65219/): Supermicro BMC contains Unordered RAKP Message 3 Grants an IPMI Session vulnerability (high 7.4)
- [CVE-2026-65213](https://insights.sbomify.com/CVE-2026-65213/): Supermicro BMC IPMI feature contains a Arbitrary Command Execution with Superuser Privileges vulnerability (medium 6.6)
- [CVE-2026-65211](https://insights.sbomify.com/CVE-2026-65211/): Supermicro BMC IPMI feature contains Critical Privilege Escalation and Arbitrary Access vulnerability (high 7.2)
- [CVE-2026-65210](https://insights.sbomify.com/CVE-2026-65210/): Supermicro BMC IPMI feature contains Arbitrary File Access vulnerability (medium 4.9)
- [CVE-2026-6521](https://insights.sbomify.com/CVE-2026-6521/): Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark (medium 5.5)
- [CVE-2026-65200](https://insights.sbomify.com/CVE-2026-65200/): Huawei malicious on-bus PLDM or NCSI device can drive out-of-bounds-heap reads via short MCTP responses (low 3.5)
- [CVE-2026-6520](https://insights.sbomify.com/CVE-2026-6520/): Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark (medium 5.5)
- [CVE-2026-65199](https://insights.sbomify.com/CVE-2026-65199/): Huawei openUBMC low-privilege SNMP to administrator privilege escalation (medium 5.4)
- [CVE-2026-65198](https://insights.sbomify.com/CVE-2026-65198/): Huawei Default SNMPv3 USM key (high 8.6)
- [CVE-2026-65197](https://insights.sbomify.com/CVE-2026-65197/): H3C G3/G5 HDM Firmware Verification Key Replacement (low 3.1)
- [CVE-2026-6519](https://insights.sbomify.com/CVE-2026-6519/): Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark (medium 5.5)
- [CVE-2026-65184](https://insights.sbomify.com/CVE-2026-65184/): Avocent ACS8000 wsserver command injection (critical 9.8)
- [CVE-2026-65183](https://insights.sbomify.com/CVE-2026-65183/): Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets (high 8.1)
- [CVE-2026-65182](https://insights.sbomify.com/CVE-2026-65182/): Apache Tomcat: Bypass longest prefix security constraint (critical 9.1)
- [CVE-2026-65181](https://insights.sbomify.com/CVE-2026-65181/): Apache Impala: RCE via External Data Source Class Loading (high 8.1)
- [CVE-2026-65180](https://insights.sbomify.com/CVE-2026-65180/): Deserialization in Megatron-LM (high 7.8)
- [CVE-2026-6518](https://insights.sbomify.com/CVE-2026-6518/): File upload in CMP – Coming Soon & Maintenance Plugin by NiteoThemes (high 8.8)
- [CVE-2026-65179](https://insights.sbomify.com/CVE-2026-65179/): Deserialization in NeMo Speech (high 8.8)
- [CVE-2026-65178](https://insights.sbomify.com/CVE-2026-65178/): Deserialization in NeMo Speech (high 7.8)
- [CVE-2026-65173](https://insights.sbomify.com/CVE-2026-65173/): Missing authorization in AIStore framework (critical 9.1)
- [CVE-2026-65172](https://insights.sbomify.com/CVE-2026-65172/): Missing authorization in AIStore framework (high 8.6)
- [CVE-2026-65170](https://insights.sbomify.com/CVE-2026-65170/): Server-side request forgery in AIStore framework (high 8.6)
- [CVE-2026-6517](https://insights.sbomify.com/CVE-2026-6517/): Mattermost Desktop App fails to restrict the allow list of domains which NTLM credentials are passed (medium 6.3)
- [CVE-2026-65164](https://insights.sbomify.com/CVE-2026-65164/): Path traversal in AIStore framework (high 8.1)
- [CVE-2026-65162](https://insights.sbomify.com/CVE-2026-65162/): Privilege escalation in AIStore framework (critical 10.0)
- [CVE-2026-65161](https://insights.sbomify.com/CVE-2026-65161/): Path traversal in AIStore framework (high 7.5)
- [CVE-2026-6516](https://insights.sbomify.com/CVE-2026-6516/): Remote Code Execution (critical 10.0)
- [CVE-2026-65151](https://insights.sbomify.com/CVE-2026-65151/): SQL injection in NeMo Agent Toolkit (high 8.4)
- [CVE-2026-65150](https://insights.sbomify.com/CVE-2026-65150/): Memory corruption in DALI (high 7.3)
- [CVE-2026-6515](https://insights.sbomify.com/CVE-2026-6515/): Insufficient Session Expiration in GitLab (medium 5.4)
- [CVE-2026-65149](https://insights.sbomify.com/CVE-2026-65149/): Memory corruption in DALI (high 7.3)
- [CVE-2026-65148](https://insights.sbomify.com/CVE-2026-65148/): Memory corruption in DALI (high 7.3)
- [CVE-2026-65147](https://insights.sbomify.com/CVE-2026-65147/): Memory corruption in DALI (high 7.3)
- [CVE-2026-65145](https://insights.sbomify.com/CVE-2026-65145/): Auth bypass in NeMo Agent Toolkit (critical 10.0)
- [CVE-2026-65142](https://insights.sbomify.com/CVE-2026-65142/): Deserialization in Model-Optimizer (high 7.8)
- [CVE-2026-65141](https://insights.sbomify.com/CVE-2026-65141/): Code injection in Isaac Lab (high 7.8)
- [CVE-2026-6514](https://insights.sbomify.com/CVE-2026-6514/): InfusedWoo Pro <= 5.1.2 - Unauthenticated Arbitrary File Read via 'url' Parameter (high 7.5)
- [CVE-2026-65131](https://insights.sbomify.com/CVE-2026-65131/): Missing authorization in NVSentinel (medium 6.0)
- [CVE-2026-65130](https://insights.sbomify.com/CVE-2026-65130/): Command injection in Infrastructure Controller (high 8.0)
- [CVE-2026-65129](https://insights.sbomify.com/CVE-2026-65129/): Security feature bypass in Infrastructure Controller (medium 6.7)
- [CVE-2026-65128](https://insights.sbomify.com/CVE-2026-65128/): SQL injection in Infrastructure Controller (high 8.8)
- [CVE-2026-65127](https://insights.sbomify.com/CVE-2026-65127/): Information disclosure in Infrastructure Controller (medium 4.1)
- [CVE-2026-65126](https://insights.sbomify.com/CVE-2026-65126/): Business logic in Infrastructure Controller (medium 5.0)
- [CVE-2026-65125](https://insights.sbomify.com/CVE-2026-65125/): Path traversal in Infrastructure Controller (medium 6.6)
- [CVE-2026-65124](https://insights.sbomify.com/CVE-2026-65124/): Code injection in Infrastructure Controller (medium 5.9)
- [CVE-2026-65122](https://insights.sbomify.com/CVE-2026-65122/): Memory corruption in TensorRT (medium 5.5)
- [CVE-2026-65121](https://insights.sbomify.com/CVE-2026-65121/): Auth bypass in Infrastructure Controller (high 8.2)
- [CVE-2026-65120](https://insights.sbomify.com/CVE-2026-65120/): Server-side request forgery in TensorRT-LLM (high 7.1)
- [CVE-2026-6512](https://insights.sbomify.com/CVE-2026-6512/): InfusedWoo Pro <= 5.1.2 - Unauthenticated Missing Authorization to Arbitrary Post Deletion via Multiple Parameters (critical 9.1)
- [CVE-2026-65119](https://insights.sbomify.com/CVE-2026-65119/): Code injection in TensorRT-LLM (high 8.4)
- [CVE-2026-65118](https://insights.sbomify.com/CVE-2026-65118/): Security feature bypass in Infrastructure Controller (high 7.5)
- [CVE-2026-65117](https://insights.sbomify.com/CVE-2026-65117/): Hardcoded credentials in Infrastructure Controller (medium 5.0)
- [CVE-2026-65115](https://insights.sbomify.com/CVE-2026-65115/): Denial of service in Infrastructure Controller (medium 6.5)
- [CVE-2026-65114](https://insights.sbomify.com/CVE-2026-65114/): Auth bypass in Infrastructure Controller (high 8.3)
- [CVE-2026-65113](https://insights.sbomify.com/CVE-2026-65113/): Hardcoded credentials in Infrastructure Controller (critical 9.8)
- [CVE-2026-65112](https://insights.sbomify.com/CVE-2026-65112/): Denial of service in Infrastructure Controller (medium 6.5)
- [CVE-2026-65111](https://insights.sbomify.com/CVE-2026-65111/): Code injection in NeMo Speech (high 7.8)
- [CVE-2026-65110](https://insights.sbomify.com/CVE-2026-65110/): Deserialization in Megatron-LM (high 7.8)
- [CVE-2026-6511](https://insights.sbomify.com/CVE-2026-6511/): Missing authorization in Smart Connect (medium 6.8)
- [CVE-2026-65105](https://insights.sbomify.com/CVE-2026-65105/): Missing authorization in NemoClaw (high 8.1)
- [CVE-2026-65104](https://insights.sbomify.com/CVE-2026-65104/): Weak cryptography in Megatron-LM (high 7.1)
- [CVE-2026-65103](https://insights.sbomify.com/CVE-2026-65103/): Path traversal in AIStore framework (high 8.1)
- [CVE-2026-65102](https://insights.sbomify.com/CVE-2026-65102/): Integer overflow in DeepStream (high 7.8)
- [CVE-2026-65101](https://insights.sbomify.com/CVE-2026-65101/): Server-side request forgery in AIStore framework (high 8.6)
- [CVE-2026-65100](https://insights.sbomify.com/CVE-2026-65100/): Apache Traffic Server: HPACK encoder desynchronizes from the decoder after a failed header encode (medium 6.3)
- [CVE-2026-6510](https://insights.sbomify.com/CVE-2026-6510/): InfusedWoo Pro <= 5.1.2 - Unauthenticated Missing Authorization to Privilege Escalation via 'iwar_save_recipe' (critical 9.8)
- [CVE-2026-65099](https://insights.sbomify.com/CVE-2026-65099/): Command injection in NemoClaw (high 7.8)
- [CVE-2026-65098](https://insights.sbomify.com/CVE-2026-65098/): Auth bypass in NemoClaw (high 8.1)
- [CVE-2026-65097](https://insights.sbomify.com/CVE-2026-65097/): Supply chain in NemoClaw (high 7.5)
- [CVE-2026-65096](https://insights.sbomify.com/CVE-2026-65096/): Command injection in NemoClaw (high 7.8)
- [CVE-2026-65093](https://insights.sbomify.com/CVE-2026-65093/): Security feature bypass in OpenShell (critical 9.9)
- [CVE-2026-65092](https://insights.sbomify.com/CVE-2026-65092/): Path traversal in OpenShell (high 8.5)
- [CVE-2026-65091](https://insights.sbomify.com/CVE-2026-65091/): Command injection in OpenShell (high 8.8)
- [CVE-2026-65090](https://insights.sbomify.com/CVE-2026-65090/): Command injection in NemoClaw (high 7.8)
- [CVE-2026-6509](https://insights.sbomify.com/CVE-2026-6509/): Privilege Escalation in TUBITAK BILGEM's Pardus Update (high 7.8)
- [CVE-2026-65089](https://insights.sbomify.com/CVE-2026-65089/): Command injection in NemoClaw (high 7.8)
- [CVE-2026-65088](https://insights.sbomify.com/CVE-2026-65088/): Information disclosure in NemoClaw (medium 5.5)
- [CVE-2026-65087](https://insights.sbomify.com/CVE-2026-65087/): Information disclosure in NemoClaw (medium 5.6)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/464/