# Vulnerabilities published in 2026 - [CVE-2026-64906](https://insights.sbomify.com/CVE-2026-64906/): Microsoft Access Remote Code Execution Vulnerability (high 7.8) - [CVE-2026-64905](https://insights.sbomify.com/CVE-2026-64905/): Microsoft Office Word Remote Code Execution Vulnerability (high 7.8) - [CVE-2026-64904](https://insights.sbomify.com/CVE-2026-64904/): Microsoft Office Remote Code Execution Vulnerability (high 7.8) - [CVE-2026-64903](https://insights.sbomify.com/CVE-2026-64903/): Microsoft Office Remote Code Execution Vulnerability (high 7.8) - [CVE-2026-64902](https://insights.sbomify.com/CVE-2026-64902/): Microsoft SharePoint Server Spoofing Vulnerability (medium 4.6) - [CVE-2026-64901](https://insights.sbomify.com/CVE-2026-64901/): Microsoft SharePoint Server Remote Code Execution Vulnerability (high 8.8) - [CVE-2026-64900](https://insights.sbomify.com/CVE-2026-64900/): Microsoft SharePoint Server Spoofing Vulnerability (high 7.3) - [CVE-2026-6490](https://insights.sbomify.com/CVE-2026-6490/): QueryMine sms GET Request Parameter deletecourse.php sql injection (medium 6.9) - [CVE-2026-64899](https://insights.sbomify.com/CVE-2026-64899/): Microsoft Office Information Disclosure Vulnerability (medium 5.5) - [CVE-2026-64898](https://insights.sbomify.com/CVE-2026-64898/): Microsoft Office Remote Code Execution Vulnerability (high 7.8) - [CVE-2026-64897](https://insights.sbomify.com/CVE-2026-64897/): Microsoft SharePoint Server Spoofing Vulnerability (medium 4.6) - [CVE-2026-64896](https://insights.sbomify.com/CVE-2026-64896/): T2000 open debug port (medium 5.2) - [CVE-2026-64893](https://insights.sbomify.com/CVE-2026-64893/): Information disclosure in EasyIO NEO (high 7.3) - [CVE-2026-64892](https://insights.sbomify.com/CVE-2026-64892/): Information disclosure in Easy IO Neo (medium 6.3) - [CVE-2026-6489](https://insights.sbomify.com/CVE-2026-6489/): QueryMine sms Background Management addteacher.php unrestricted upload (medium 5.3) - [CVE-2026-64887](https://insights.sbomify.com/CVE-2026-64887/): Airwall - Hardcoded Secrets (high 7.0) - [CVE-2026-64881](https://insights.sbomify.com/CVE-2026-64881/): Command Injection (high 8.7) - [CVE-2026-64880](https://insights.sbomify.com/CVE-2026-64880/): Blind SQL Injection (high 7.1) - [CVE-2026-6488](https://insights.sbomify.com/CVE-2026-6488/): QueryMine sms GET Request Parameter editcourse.php sql injection (medium 5.3) - [CVE-2026-64879](https://insights.sbomify.com/CVE-2026-64879/): Command Injection (critical 9.4) - [CVE-2026-64878](https://insights.sbomify.com/CVE-2026-64878/): Command Injection (critical 9.4) - [CVE-2026-64877](https://insights.sbomify.com/CVE-2026-64877/): SQL injection in Security Center (critical 9.4) - [CVE-2026-64876](https://insights.sbomify.com/CVE-2026-64876/): Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in GeoIP extension (high 8.8) - [CVE-2026-64875](https://insights.sbomify.com/CVE-2026-64875/): Joomla Extension - regularlabs.com - IP spoofing vulnerability in GeoIP extension (medium 6.5) - [CVE-2026-64874](https://insights.sbomify.com/CVE-2026-64874/): Joomla Extension - regularlabs.com - CDN Credential leakage Cache Cleaner Pro extension (critical 9.8) - [CVE-2026-64873](https://insights.sbomify.com/CVE-2026-64873/): Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension (critical 9.8) - [CVE-2026-64872](https://insights.sbomify.com/CVE-2026-64872/): Joomla Extension - regularlabs.com - Path traversal in Cache Cleaner Pro extension (medium 6.5) - [CVE-2026-64871](https://insights.sbomify.com/CVE-2026-64871/): Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Cache Cleaner extension (medium 5.4) - [CVE-2026-64870](https://insights.sbomify.com/CVE-2026-64870/): MaxKB: UpdateStoreTool fetches caller-supplied app-store URLs without host validation (medium 5.3) - [CVE-2026-6487](https://insights.sbomify.com/CVE-2026-6487/): Qihui jtbc5 CMS Code Endpoint manage.php path traversal (medium 5.3) - [CVE-2026-64868](https://insights.sbomify.com/CVE-2026-64868/): New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging (high 7.5) - [CVE-2026-64866](https://insights.sbomify.com/CVE-2026-64866/): New API: Admin can reset passkeys for same-level or higher-privileged users (medium 5.1) - [CVE-2026-64865](https://insights.sbomify.com/CVE-2026-64865/): New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass (medium 6.0) - [CVE-2026-64863](https://insights.sbomify.com/CVE-2026-64863/): goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite (critical 9.1) - [CVE-2026-64862](https://insights.sbomify.com/CVE-2026-64862/): Frappe HR: Missing Authorization on PWA API Endpoints enables Cross-Employee Data access in HRMS (medium 6.5) - [CVE-2026-6486](https://insights.sbomify.com/CVE-2026-6486/): classroombookings User Display Name layout.php read cross site scripting (medium 5.1) - [CVE-2026-64859](https://insights.sbomify.com/CVE-2026-64859/): New API: User List API Leaks Root User Access Token Leading to Privilege Escalation (critical 9.1) - [CVE-2026-64857](https://insights.sbomify.com/CVE-2026-64857/): tirreno has Session Fixation in Login Authentication (medium 5.3) - [CVE-2026-64856](https://insights.sbomify.com/CVE-2026-64856/): FileRise: Missing Authentication Guard on File Snippet Preview Endpoint (low 3.7) - [CVE-2026-64852](https://insights.sbomify.com/CVE-2026-64852/): Grav API Plugin: Missing authorization on API-key generate/revoke lets any admin.login user forge keys for any account (high 8.7) - [CVE-2026-64851](https://insights.sbomify.com/CVE-2026-64851/): Grav Shortcode Core Plugin: Stored XSS in shortcode-core attribute handlers (high 8.5) - [CVE-2026-64850](https://insights.sbomify.com/CVE-2026-64850/): Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData() (high 8.7) - [CVE-2026-6485](https://insights.sbomify.com/CVE-2026-6485/): UEFI BIOS embedded Shell can be used to bypass Secure Boot (high 8.2) - [CVE-2026-64849](https://insights.sbomify.com/CVE-2026-64849/): MLflow Server-Side Request Forgery (critical 9.3, exploited in the wild) - [CVE-2026-64847](https://insights.sbomify.com/CVE-2026-64847/): AnyIO process-pool workers can block indefinitely on undrained stderr (medium 6.8) - [CVE-2026-64846](https://insights.sbomify.com/CVE-2026-64846/): Nix: Arbitrary file truncation outside the sandbox with recursive-nix experimental feature (low 2.8) - [CVE-2026-6484](https://insights.sbomify.com/CVE-2026-6484/): Lack of verified boot to certain FV may cause arbitrary code execution (high 8.2) - [CVE-2026-64838](https://insights.sbomify.com/CVE-2026-64838/): ICEcoder through 8.1 Path Traversal via oldFileName Parameter (high 8.7) - [CVE-2026-64837](https://insights.sbomify.com/CVE-2026-64837/): ICEcoder through 8.1 OS Command Injection via lib/properties.php (high 8.7) - [CVE-2026-64836](https://insights.sbomify.com/CVE-2026-64836/): ICEcoder through 8.1 Path Traversal via Ineffective File::check() Confinement (high 8.7) - [CVE-2026-64835](https://insights.sbomify.com/CVE-2026-64835/): FFmpeg 4.4 - 8.1.2 Out-of-Bounds Memory Access in ADX Audio Decoder (high 8.7) - [CVE-2026-64834](https://insights.sbomify.com/CVE-2026-64834/): FFmpeg 0.6.3 - 8.1.2 Infinite Loop DoS via RTP/ASF Demuxer (high 8.7) - [CVE-2026-64833](https://insights.sbomify.com/CVE-2026-64833/): FFmpeg 0.7.1 - 8.1.2 Out-of-Bounds Read via S/PDIF Muxer spdifenc.c (high 7.1) - [CVE-2026-64832](https://insights.sbomify.com/CVE-2026-64832/): FFmpeg 4.4 - 8.1.2 Double-Free in NVDEC Hardware Decoder via nvdec.c (high 8.7) - [CVE-2026-64831](https://insights.sbomify.com/CVE-2026-64831/): FFmpeg 8.0 - 8.1.2 Stack Buffer Overflow in Vulkan HEVC Decoder (high 8.7) - [CVE-2026-64830](https://insights.sbomify.com/CVE-2026-64830/): FFmpeg 2.1 - 8.1.2 Heap Buffer Overflow via VobSub Subtitle Demuxer (high 8.7) - [CVE-2026-6483](https://insights.sbomify.com/CVE-2026-6483/): Wavlink WL-WN530H4 internet.cgi snprintf os command injection (high 8.6) - [CVE-2026-64829](https://insights.sbomify.com/CVE-2026-64829/): Question2Answer 1.8.8 Session Fixation via Forgot-Password Flow (critical 9.1) - [CVE-2026-64828](https://insights.sbomify.com/CVE-2026-64828/): Froiden TableTrack 1.3.10 Stored XSS via Order Notes Field (medium 5.3) - [CVE-2026-64827](https://insights.sbomify.com/CVE-2026-64827/): Telenia TVox 26.5.3 Authentication Bypass via set_env.php (critical 9.3) - [CVE-2026-64826](https://insights.sbomify.com/CVE-2026-64826/): rConfig < 8.2.13 Path Traversal File Read via FileDownloadController (high 7.1) - [CVE-2026-64825](https://insights.sbomify.com/CVE-2026-64825/): Home Assistant Core < 2026.6.0 Path Traversal File Write via Backup Upload (critical 9.0) - [CVE-2026-64824](https://insights.sbomify.com/CVE-2026-64824/): Home Assistant Core < 2026.7.0 Symlink Path Traversal RCE via backup-restore (critical 9.3) - [CVE-2026-64823](https://insights.sbomify.com/CVE-2026-64823/): Home Assistant Core < 2026.5.4 XSS via Shelly media_player.py thumb URI (low 2.1) - [CVE-2026-64822](https://insights.sbomify.com/CVE-2026-64822/): djangoSIGE 1.10 User Enumeration via ForgotPasswordView (medium 6.9) - [CVE-2026-64821](https://insights.sbomify.com/CVE-2026-64821/): djangoSIGE 1.10 CSRF via GET-based Order Cancellation Views (medium 5.3) - [CVE-2026-6482](https://insights.sbomify.com/CVE-2026-6482/): Local Privilege Escalation via OpenSSL configuration file in Insight Agent (high 8.5) - [CVE-2026-64816](https://insights.sbomify.com/CVE-2026-64816/): RapidRAW < 1.6.0 NTLMv2 Credential Leak via UNC Path in lutPath (high 7.1) - [CVE-2026-64815](https://insights.sbomify.com/CVE-2026-64815/): Code injection in IntelliJ IDEA (high 8.1) - [CVE-2026-64814](https://insights.sbomify.com/CVE-2026-64814/): Missing authorization in IntelliJ IDEA (high 8.6) - [CVE-2026-64813](https://insights.sbomify.com/CVE-2026-64813/): Security feature bypass in IntelliJ IDEA (critical 10.0) - [CVE-2026-64812](https://insights.sbomify.com/CVE-2026-64812/): Auth bypass in IntelliJ IDEA (critical 10.0) - [CVE-2026-64811](https://insights.sbomify.com/CVE-2026-64811/): Code injection in IntelliJ IDEA (high 7.8) - [CVE-2026-64810](https://insights.sbomify.com/CVE-2026-64810/): Cross-site scripting in IntelliJ IDEA (medium 4.3) - [CVE-2026-64809](https://insights.sbomify.com/CVE-2026-64809/): Code injection in PhpStorm (high 8.4) - [CVE-2026-64808](https://insights.sbomify.com/CVE-2026-64808/): Code injection in PhpStorm (high 8.4) - [CVE-2026-64807](https://insights.sbomify.com/CVE-2026-64807/): Code injection in WebStorm (high 7.8) - [CVE-2026-64806](https://insights.sbomify.com/CVE-2026-64806/): Code injection in WebStorm (high 8.4) - [CVE-2026-64805](https://insights.sbomify.com/CVE-2026-64805/): Code injection in WebStorm (high 8.4) - [CVE-2026-64804](https://insights.sbomify.com/CVE-2026-64804/): Code injection in WebStorm (high 8.4) - [CVE-2026-64803](https://insights.sbomify.com/CVE-2026-64803/): Code injection in GoLand (high 7.8) - [CVE-2026-64802](https://insights.sbomify.com/CVE-2026-64802/): Code injection in GoLand (high 7.8) - [CVE-2026-64800](https://insights.sbomify.com/CVE-2026-64800/): Information disclosure in GoLand (low 3.5) - [CVE-2026-64799](https://insights.sbomify.com/CVE-2026-64799/): Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensions (high 7.5) - [CVE-2026-64798](https://insights.sbomify.com/CVE-2026-64798/): Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension (critical 9.1) - [CVE-2026-64797](https://insights.sbomify.com/CVE-2026-64797/): Joomla Extension - regularlabs.com - IP spoofing vulnerability in IP login extension (high 7.5) - [CVE-2026-64796](https://insights.sbomify.com/CVE-2026-64796/): Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension (critical 9.8) - [CVE-2026-64795](https://insights.sbomify.com/CVE-2026-64795/): Joomla Extension - regularlabs.com - XSS vectors in tag-provided inputs in various Regular Labs extensions (medium 5.4) - [CVE-2026-64794](https://insights.sbomify.com/CVE-2026-64794/): Joomla Extension - regularlabs.com - restricted user-data exposure in Users Anywhere and Articles Anywhere extensions (medium 6.5) - [CVE-2026-64793](https://insights.sbomify.com/CVE-2026-64793/): Missing authorization in Articles Anywhere extension for Joomla (critical 9.1) - [CVE-2026-64792](https://insights.sbomify.com/CVE-2026-64792/): Information disclosure in Articles Anywhere extension for Joomla (high 7.5) - [CVE-2026-64791](https://insights.sbomify.com/CVE-2026-64791/): Missing authorization in Regular Labs Extension Manager extension for Joomla (high 8.8) - [CVE-2026-64790](https://insights.sbomify.com/CVE-2026-64790/): Path traversal in macOS (high 7.8) - [CVE-2026-6479](https://insights.sbomify.com/CVE-2026-6479/): PostgreSQL SSL/GSS init causes denial of service, via uncontrolled recursion (high 7.5) - [CVE-2026-64789](https://insights.sbomify.com/CVE-2026-64789/): Security feature bypass in macOS (not scored) - [CVE-2026-64788](https://insights.sbomify.com/CVE-2026-64788/): Memory corruption in iOS and iPadOS (medium 5.4) - [CVE-2026-64787](https://insights.sbomify.com/CVE-2026-64787/): Use after free in Safari (medium 6.5) - [CVE-2026-64785](https://insights.sbomify.com/CVE-2026-64785/): swift-nio-http2: Missing CR/LF/NUL validation in header values (medium 5.3) - [CVE-2026-64784](https://insights.sbomify.com/CVE-2026-64784/): Memory corruption in Safari (medium 4.3) - [CVE-2026-64783](https://insights.sbomify.com/CVE-2026-64783/): Use after free in Safari (high 8.8) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/466/