# Vulnerabilities published in 2026


- [CVE-2026-65086](https://insights.sbomify.com/CVE-2026-65086/): Command injection in OpenShell (medium 6.8)
- [CVE-2026-65085](https://insights.sbomify.com/CVE-2026-65085/): Other in OpenShell (medium 5.2)
- [CVE-2026-65084](https://insights.sbomify.com/CVE-2026-65084/): Security feature bypass in NemoClaw (high 8.1)
- [CVE-2026-65083](https://insights.sbomify.com/CVE-2026-65083/): Security feature bypass in OpenShell (critical 9.9)
- [CVE-2026-65082](https://insights.sbomify.com/CVE-2026-65082/): Code injection in NemoClaw (high 7.0)
- [CVE-2026-65081](https://insights.sbomify.com/CVE-2026-65081/): Supply chain in NemoClaw (high 8.1)
- [CVE-2026-6508](https://insights.sbomify.com/CVE-2026-6508/): RCE in TUBITAK BILGEM's Liderahenk (critical 9.8)
- [CVE-2026-6507](https://insights.sbomify.com/CVE-2026-6507/): Dnsmasq: dnsmasq: denial of service due to out-of-bounds write in dhcp bootreply processing (high 7.5)
- [CVE-2026-65069](https://insights.sbomify.com/CVE-2026-65069/): Misconfiguration in Data::DisjointSet::Shared (medium 4.0)
- [CVE-2026-65068](https://insights.sbomify.com/CVE-2026-65068/): Misconfiguration in Data::SpatialHash::Shared (low 3.8)
- [CVE-2026-65067](https://insights.sbomify.com/CVE-2026-65067/): Misconfiguration in Data::Intern::Shared (low 3.8)
- [CVE-2026-65066](https://insights.sbomify.com/CVE-2026-65066/): Misconfiguration in Data::RingBuffer::Shared (low 3.8)
- [CVE-2026-65065](https://insights.sbomify.com/CVE-2026-65065/): Misconfiguration in Data::RoaringBitmap::Shared (medium 5.5)
- [CVE-2026-65064](https://insights.sbomify.com/CVE-2026-65064/): Misconfiguration in Data::HashMap::Shared (low 3.8)
- [CVE-2026-65063](https://insights.sbomify.com/CVE-2026-65063/): Misconfiguration in Data::RadixTree::Shared (low 3.8)
- [CVE-2026-65062](https://insights.sbomify.com/CVE-2026-65062/): Misconfiguration in Data::SortedSet::Shared (low 3.8)
- [CVE-2026-65061](https://insights.sbomify.com/CVE-2026-65061/): Misconfiguration in Data::ReqRep::Shared (low 3.8)
- [CVE-2026-6506](https://insights.sbomify.com/CVE-2026-6506/): Missing authorization in InfusedWoo Pro (high 8.8)
- [CVE-2026-65058](https://insights.sbomify.com/CVE-2026-65058/): Trezor Safe improper security check in on-device display (medium 5.9)
- [CVE-2026-65057](https://insights.sbomify.com/CVE-2026-65057/): Keep Unauthenticated Server-Side Request Forgery via POST /providers/healthcheck (critical 9.2)
- [CVE-2026-65056](https://insights.sbomify.com/CVE-2026-65056/): mcp-webresearch Server-Side Request Forgery in visit_page Due to Missing Internal-IP Filtering (high 8.3)
- [CVE-2026-65055](https://insights.sbomify.com/CVE-2026-65055/): Taiga taiga-back Private Project Member Roster Disclosure via Unauthenticated filters_data Endpoints (medium 6.9)
- [CVE-2026-65054](https://insights.sbomify.com/CVE-2026-65054/): MediaCMS Private Media Metadata Disclosure via Playlist Ownership Loophole (high 8.2)
- [CVE-2026-65053](https://insights.sbomify.com/CVE-2026-65053/): Horde IMP before 7.2.0 Stored Cross-Site Scripting via AppleDouble Viewer Part Name (medium 5.1)
- [CVE-2026-65052](https://insights.sbomify.com/CVE-2026-65052/): Ninja Forms Calculation and Payment Total Tampering via Fail-Open get_calc_value in ListSelect and ListRadio Fields (high 8.7)
- [CVE-2026-65051](https://insights.sbomify.com/CVE-2026-65051/): Ninja Forms Server-Side Validation Bypass via Client-Controlled Field Metadata Merge in AJAX Submission Handler (medium 6.9)
- [CVE-2026-65050](https://insights.sbomify.com/CVE-2026-65050/): Missing authorization in Ninja Forms (high 7.1)
- [CVE-2026-6505](https://insights.sbomify.com/CVE-2026-6505/): Race condition in AXIS OS (medium 5.1)
- [CVE-2026-65049](https://insights.sbomify.com/CVE-2026-65049/): Ninja Forms Cross-Site Network-Wide Data Deletion on WordPress Multisite via nf_delete_all_data AJAX Action (high 8.4)
- [CVE-2026-65048](https://insights.sbomify.com/CVE-2026-65048/): Ninja Forms Unauthenticated Stored Cross-Site Scripting via Repeatable Fieldset Submission Index (critical 9.3)
- [CVE-2026-6504](https://insights.sbomify.com/CVE-2026-6504/): Cross-site scripting in Royal Addons for Elementor – Addons and Templates Kit for Elementor (medium 6.4)
- [CVE-2026-65017](https://insights.sbomify.com/CVE-2026-65017/): Apache Airflow: Config API: team-scoped Celery broker secret disclosed to a Viewer (multi-team masking bypass) (medium 6.5)
- [CVE-2026-65016](https://insights.sbomify.com/CVE-2026-65016/): n8n before 1.123.64, 2.29.8, and 2.30.1 Privilege Escalation via SSO Instance-Role (high 7.7)
- [CVE-2026-65015](https://insights.sbomify.com/CVE-2026-65015/): n8n before 2.30.1 Privilege Escalation via run_node_tool (high 7.2)
- [CVE-2026-65014](https://insights.sbomify.com/CVE-2026-65014/): n8n before 2.28.0 Authentication Bypass via test-webhook (medium 6.3)
- [CVE-2026-65013](https://insights.sbomify.com/CVE-2026-65013/): Onlook tRPC Insecure Direct Object Reference via multiple procedures (high 8.7)
- [CVE-2026-65012](https://insights.sbomify.com/CVE-2026-65012/): InvokeAI < 6.13.7 Unauthenticated Directory Enumeration via scan_folder (medium 6.3)
- [CVE-2026-65011](https://insights.sbomify.com/CVE-2026-65011/): Graylog2 Server Missing Permission Check on Event Definition Duplicate (medium 5.3)
- [CVE-2026-65010](https://insights.sbomify.com/CVE-2026-65010/): Datasets Symlink-following Arbitrary File Write via Extractor.extract() (medium 4.4)
- [CVE-2026-6501](https://insights.sbomify.com/CVE-2026-6501/): jOpenDocument has an improper restriction of XML external entity reference vulnerability (medium 5.3)
- [CVE-2026-65009](https://insights.sbomify.com/CVE-2026-65009/): OpenRemote before 1.26.2 Information Disclosure via Syslog REST API (medium 5.3)
- [CVE-2026-65008](https://insights.sbomify.com/CVE-2026-65008/): Grav before 2.0.7 Remote Code Execution via Blueprint dynamicData (critical 9.3)
- [CVE-2026-65007](https://insights.sbomify.com/CVE-2026-65007/): Grav before 1.0.8 Missing Authorization on API Key Generation (high 8.7)
- [CVE-2026-6500](https://insights.sbomify.com/CVE-2026-6500/): Information disclosure in OpenConcerto (medium 4.8)
- [CVE-2026-64993](https://insights.sbomify.com/CVE-2026-64993/): Security feature bypass in RVTools (medium 6.8)
- [CVE-2026-6499](https://insights.sbomify.com/CVE-2026-6499/): Misconfiguration in OpenConcerto (low 2.4)
- [CVE-2026-6498](https://insights.sbomify.com/CVE-2026-6498/): Business logic in Five Star Restaurant Reservations – WordPress Booking Plugin (medium 5.3)
- [CVE-2026-64972](https://insights.sbomify.com/CVE-2026-64972/): Reflected XSS in ATutor (medium 4.8)
- [CVE-2026-64971](https://insights.sbomify.com/CVE-2026-64971/): Reflected XSS in ATutor (medium 4.8)
- [CVE-2026-64970](https://insights.sbomify.com/CVE-2026-64970/): Stored XSS in ATutor (medium 5.1)
- [CVE-2026-6497](https://insights.sbomify.com/CVE-2026-6497/): prasathmani TinyFileManager File Upload filemanager.php server-side request forgery (medium 5.3)
- [CVE-2026-64969](https://insights.sbomify.com/CVE-2026-64969/): Insecure Direct Object Reference in ATutor (medium 5.3)
- [CVE-2026-64968](https://insights.sbomify.com/CVE-2026-64968/): Server-Side Request Forgery in ATutor (medium 5.1)
- [CVE-2026-64967](https://insights.sbomify.com/CVE-2026-64967/): Path Traversal in ATutor (medium 6.9)
- [CVE-2026-64966](https://insights.sbomify.com/CVE-2026-64966/): Path Traversal leading to Remote Code Execution in ATutor (high 8.7)
- [CVE-2026-64965](https://insights.sbomify.com/CVE-2026-64965/): Missing Authorization Check in ATutor (medium 5.3)
- [CVE-2026-64964](https://insights.sbomify.com/CVE-2026-64964/): Generation of Predictable Email Confirmation Token in ATutor (medium 6.3)
- [CVE-2026-64963](https://insights.sbomify.com/CVE-2026-64963/): Path Traversal in ATutor (low 2.3)
- [CVE-2026-64962](https://insights.sbomify.com/CVE-2026-64962/): Cross-Site Request Forgery (CSRF) in ATutor (medium 5.1)
- [CVE-2026-64961](https://insights.sbomify.com/CVE-2026-64961/): Authentication Bypass in ATutor (medium 6.3)
- [CVE-2026-64960](https://insights.sbomify.com/CVE-2026-64960/): Remote Code Execution via Unrestricted File Upload in ATutor (high 8.7)
- [CVE-2026-6496](https://insights.sbomify.com/CVE-2026-6496/): prasathmani TinyFileManager POST Parameter filemanager.php path traversal (medium 5.3)
- [CVE-2026-64959](https://insights.sbomify.com/CVE-2026-64959/): Apache Kylin: Missing authentication on certain cache API endpoints (critical 9.8)
- [CVE-2026-64958](https://insights.sbomify.com/CVE-2026-64958/): Apache CXF: Denial of service via message header attachments (high 7.5)
- [CVE-2026-64955](https://insights.sbomify.com/CVE-2026-64955/): Velociraptor CSV Formula Injection in Export Pipeline (medium 6.1)
- [CVE-2026-64954](https://insights.sbomify.com/CVE-2026-64954/): Velociraptor collect_client() Permissions Bypass (high 8.2)
- [CVE-2026-64952](https://insights.sbomify.com/CVE-2026-64952/): Velociraptor Hunt Deletion With Insufficient Permission Check (medium 6.5)
- [CVE-2026-64951](https://insights.sbomify.com/CVE-2026-64951/): Velociraptor DoS triggered by Divide by Zero panic (low 3.5)
- [CVE-2026-64950](https://insights.sbomify.com/CVE-2026-64950/): Stored Cross-Site Scripting via Directory Name in File Manager Create Directory (high 8.4)
- [CVE-2026-6495](https://insights.sbomify.com/CVE-2026-6495/): Ajax Load More < 7.8.4 - Reflected XSS (high 7.1)
- [CVE-2026-64949](https://insights.sbomify.com/CVE-2026-64949/): Unrestricted File Upload Leading to Remote Code Execution in Admin Tools File Manager (high 8.6)
- [CVE-2026-64948](https://insights.sbomify.com/CVE-2026-64948/): Missing Authorization in get_module_detail AJAX Endpoint Allows Cross-Group Module Data Disclosure (high 7.1)
- [CVE-2026-64947](https://insights.sbomify.com/CVE-2026-64947/): CSRF Bypass Leading to Remote Code Execution via Unrestricted File Upload in Plugin File Manager (high 7.5)
- [CVE-2026-64946](https://insights.sbomify.com/CVE-2026-64946/): CSRF Bypass Leading to Stored Cross-Site Scripting via Unrestricted SVG Upload in File Manager (high 7.4)
- [CVE-2026-64945](https://insights.sbomify.com/CVE-2026-64945/): Apache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show questions (not scored)
- [CVE-2026-64944](https://insights.sbomify.com/CVE-2026-64944/): Apache Answer: Stored XSS via unsanitized HTML in imported question content (not scored)
- [CVE-2026-64943](https://insights.sbomify.com/CVE-2026-64943/): Apache Answer: API keys logged in plaintext during authentication (high 8.1)
- [CVE-2026-64941](https://insights.sbomify.com/CVE-2026-64941/): Open redirect in Phoenix.LiveView.validate_local_url!/2 via ASCII tab, LF and CR (low 2.1)
- [CVE-2026-64940](https://insights.sbomify.com/CVE-2026-64940/): Auth bypass in Tegalog -Fumy Otegaru Memo Logger- (high 8.8)
- [CVE-2026-6494](https://insights.sbomify.com/CVE-2026-6494/): Aap-mcp-server: aap mcp server: log injection allows social engineering attacks via unsanitized input (medium 5.3)
- [CVE-2026-64934](https://insights.sbomify.com/CVE-2026-64934/): Mira Hormone Monitor, Mira Android App Reliance on untrusted inputs in a security decision (medium 5.3)
- [CVE-2026-6493](https://insights.sbomify.com/CVE-2026-6493/): lukevella rallly Reset Password reset-password-form.tsx cross site scripting (medium 5.1)
- [CVE-2026-64927](https://insights.sbomify.com/CVE-2026-64927/): Missing authorization in Red Hat Advanced Cluster Management for Kubernetes 2.11 (medium 6.4)
- [CVE-2026-64922](https://insights.sbomify.com/CVE-2026-64922/): Microsoft SharePoint Server Spoofing Vulnerability (medium 4.6)
- [CVE-2026-64921](https://insights.sbomify.com/CVE-2026-64921/): Microsoft SharePoint Server Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-64920](https://insights.sbomify.com/CVE-2026-64920/): Microsoft Access Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-6492](https://insights.sbomify.com/CVE-2026-6492/): arnobt78 Hotel Booking Management System Health Check Endpoint detailed information disclosure (medium 6.9)
- [CVE-2026-64919](https://insights.sbomify.com/CVE-2026-64919/): Microsoft Access Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-64918](https://insights.sbomify.com/CVE-2026-64918/): Microsoft Office Spoofing Vulnerability (medium 6.5)
- [CVE-2026-64917](https://insights.sbomify.com/CVE-2026-64917/): Microsoft Office Word Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-64916](https://insights.sbomify.com/CVE-2026-64916/): Microsoft SharePoint Server Spoofing Vulnerability (medium 4.6)
- [CVE-2026-64915](https://insights.sbomify.com/CVE-2026-64915/): Microsoft Office Word Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-64914](https://insights.sbomify.com/CVE-2026-64914/): Microsoft Access Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-64912](https://insights.sbomify.com/CVE-2026-64912/): Microsoft Access Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-64911](https://insights.sbomify.com/CVE-2026-64911/): Microsoft Office Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-64910](https://insights.sbomify.com/CVE-2026-64910/): Microsoft Office Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-6491](https://insights.sbomify.com/CVE-2026-6491/): libvips nip2 vips7compat.c im_minpos_vec heap-based overflow (medium 4.8)
- [CVE-2026-64909](https://insights.sbomify.com/CVE-2026-64909/): Microsoft Office Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-64908](https://insights.sbomify.com/CVE-2026-64908/): Microsoft Access Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-64907](https://insights.sbomify.com/CVE-2026-64907/): Microsoft Office Word Remote Code Execution Vulnerability (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/465/