# Vulnerabilities published in 2026


- [CVE-2026-64685](https://insights.sbomify.com/CVE-2026-64685/): ImageMagick: Heap Buffer Over-Read in BGR decoder due to mising end-of-file check (medium 5.3)
- [CVE-2026-64684](https://insights.sbomify.com/CVE-2026-64684/): RMCP: Custom HTTP headers leak to cross-origin redirect targets (medium 6.8)
- [CVE-2026-64679](https://insights.sbomify.com/CVE-2026-64679/): Atlantis: Path Traversal in Atlantis Workspace Handling Allows Out-of-Bounds Directory Deletion/Creation (high 8.1)
- [CVE-2026-64677](https://insights.sbomify.com/CVE-2026-64677/): Anki's local HTTP server is vulnerable to directory traversal attacks (medium 5.9)
- [CVE-2026-64676](https://insights.sbomify.com/CVE-2026-64676/): Kata Containers: Unauthorized mem-agent ttRPC methods let an untrusted host tamper with confidential-guest memory (medium 5.7)
- [CVE-2026-64665](https://insights.sbomify.com/CVE-2026-64665/): Statamic: Account takeover via OAuth email matching without email-verification check (high 8.1)
- [CVE-2026-64664](https://insights.sbomify.com/CVE-2026-64664/): Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence (medium 4.3)
- [CVE-2026-64663](https://insights.sbomify.com/CVE-2026-64663/): Statamic: Unsafe method invocation via Antlers template resolution allows data destruction (medium 6.5)
- [CVE-2026-64662](https://insights.sbomify.com/CVE-2026-64662/): Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries (medium 6.5)
- [CVE-2026-64657](https://insights.sbomify.com/CVE-2026-64657/): Budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL (high 8.4)
- [CVE-2026-64655](https://insights.sbomify.com/CVE-2026-64655/): GitHub CLI: Attestation Verification Bypass via Unescaped Regex Metacharacters in SAN Matching (low 2.1)
- [CVE-2026-64654](https://insights.sbomify.com/CVE-2026-64654/): GitHub CLI: Terminal escape sequence injection in multiple `gh` commands (medium 5.3)
- [CVE-2026-64653](https://insights.sbomify.com/CVE-2026-64653/): GitHub CLI: Unescaped variable components in request URLs could allow path traversal (medium 5.1)
- [CVE-2026-64652](https://insights.sbomify.com/CVE-2026-64652/): GitHub CLI: Partial token disclosure in `gh auth status` output (low 3.3)
- [CVE-2026-64651](https://insights.sbomify.com/CVE-2026-64651/): AI SDK OpenCode Harness Tool Relay Authorization Bypass (medium 6.3)
- [CVE-2026-64650](https://insights.sbomify.com/CVE-2026-64650/): AI SDK Codex Harness Tool Relay Authorization Bypass (medium 6.3)
- [CVE-2026-64649](https://insights.sbomify.com/CVE-2026-64649/): Next.js: Server-Side Request Forgery in Server Actions on Custom Servers (high 8.3)
- [CVE-2026-64648](https://insights.sbomify.com/CVE-2026-64648/): Next.js: Response Body Cache Confusion for Requests Containing Bodies (medium 6.0)
- [CVE-2026-64647](https://insights.sbomify.com/CVE-2026-64647/): Next.js: Response Body Cache Confusion with Invalid UTF-8 Request Bodies (medium 6.3)
- [CVE-2026-64646](https://insights.sbomify.com/CVE-2026-64646/): Next.js: Unbounded Server Action payload in Edge runtime (medium 6.3)
- [CVE-2026-64645](https://insights.sbomify.com/CVE-2026-64645/): Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname (high 8.3)
- [CVE-2026-64644](https://insights.sbomify.com/CVE-2026-64644/): Next.js: Denial of Service in the Image Optimization API using SVGs (medium 6.3)
- [CVE-2026-64643](https://insights.sbomify.com/CVE-2026-64643/): Next.js: Unauthenticated Disclosure of Internal Server Function endpoints (medium 6.3)
- [CVE-2026-64642](https://insights.sbomify.com/CVE-2026-64642/): Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale (high 8.3)
- [CVE-2026-64641](https://insights.sbomify.com/CVE-2026-64641/): Next.js: Denial of Service in App Router using Server Actions (high 8.2)
- [CVE-2026-64640](https://insights.sbomify.com/CVE-2026-64640/): Apache Polaris: register endpoint reads attacker-controlled storage location before allowed-locations validation (medium 5.3)
- [CVE-2026-6464](https://insights.sbomify.com/CVE-2026-6464/): PostgreSQL psql COPY FROM STDIN early failure processes data lines as psql commands (high 8.1)
- [CVE-2026-64639](https://insights.sbomify.com/CVE-2026-64639/): Privilege escalation in Plesk (critical 9.3)
- [CVE-2026-64638](https://insights.sbomify.com/CVE-2026-64638/): Cross-site scripting in WordPress (high 8.9)
- [CVE-2026-64637](https://insights.sbomify.com/CVE-2026-64637/): Privilege escalation in Plesk (critical 9.9)
- [CVE-2026-64636](https://insights.sbomify.com/CVE-2026-64636/): SQL injection in Plesk (high 7.7)
- [CVE-2026-64635](https://insights.sbomify.com/CVE-2026-64635/): Business logic in Service Provider Console (medium 5.3)
- [CVE-2026-64634](https://insights.sbomify.com/CVE-2026-64634/): Privilege escalation in ONE (high 8.4)
- [CVE-2026-64633](https://insights.sbomify.com/CVE-2026-64633/): Code injection in ONE (critical 10.0)
- [CVE-2026-64632](https://insights.sbomify.com/CVE-2026-64632/): Information disclosure in ONE (high 8.5)
- [CVE-2026-64631](https://insights.sbomify.com/CVE-2026-64631/): SQL injection in ONE (high 8.6)
- [CVE-2026-64630](https://insights.sbomify.com/CVE-2026-64630/): Missing authorization in ONE (medium 5.3)
- [CVE-2026-64629](https://insights.sbomify.com/CVE-2026-64629/): Memory corruption in Parasolid V38.0 (high 7.3)
- [CVE-2026-64628](https://insights.sbomify.com/CVE-2026-64628/): Grav Stored Cross-Site Scripting via Shortcode Attribute Handlers (medium 5.1)
- [CVE-2026-64627](https://insights.sbomify.com/CVE-2026-64627/): Parse Server 9.0.0 Schema Disclosure via GraphQL Variable Coercion (medium 6.9)
- [CVE-2026-64626](https://insights.sbomify.com/CVE-2026-64626/): AVideo Encoder downloadURL SSRF via unpinned retry fallback (medium 5.3)
- [CVE-2026-64625](https://insights.sbomify.com/CVE-2026-64625/): AVideo before 29.0 OS Command Injection via execAsync (critical 9.3)
- [CVE-2026-64624](https://insights.sbomify.com/CVE-2026-64624/): FreeRDP RDP File Parser Remote Code Execution via CLI Options (high 8.5)
- [CVE-2026-64623](https://insights.sbomify.com/CVE-2026-64623/): Network-AI before 5.13.4 Cryptographic Signature Verification Bypass (high 8.8)
- [CVE-2026-64622](https://insights.sbomify.com/CVE-2026-64622/): Network-AI 5.12.2 through 5.13.3 Missing Authorization via ApprovalInbox (critical 9.3)
- [CVE-2026-64621](https://insights.sbomify.com/CVE-2026-64621/): FreeRDP before 3.28.0 Double-Free via selectedmonitors (critical 9.3)
- [CVE-2026-64620](https://insights.sbomify.com/CVE-2026-64620/): FreeRDP before 3.28.0 Heap Buffer Overflow via crypto_rsa_common (critical 9.3)
- [CVE-2026-64619](https://insights.sbomify.com/CVE-2026-64619/): FileCodeBox < 2.4 Anti-bruteforce Rate Limit Bypass via Spoofed Headers (high 8.7)
- [CVE-2026-64617](https://insights.sbomify.com/CVE-2026-64617/): Misconfiguration in Data::PubSub::Shared (low 3.8)
- [CVE-2026-64616](https://insights.sbomify.com/CVE-2026-64616/): Misconfiguration in Data::NDArray::Shared (low 3.3)
- [CVE-2026-64615](https://insights.sbomify.com/CVE-2026-64615/): Misconfiguration in Data::Graph::Shared (low 3.3)
- [CVE-2026-64614](https://insights.sbomify.com/CVE-2026-64614/): Misconfiguration in Data::Deque::Shared (low 3.8)
- [CVE-2026-64613](https://insights.sbomify.com/CVE-2026-64613/): Misconfiguration in Data::Buffer::Shared (medium 6.2)
- [CVE-2026-64612](https://insights.sbomify.com/CVE-2026-64612/): Libcupsfilters: cups-filters: libcupsfilters: cups image filter process abort via malformed png (high 7.5)
- [CVE-2026-64611](https://insights.sbomify.com/CVE-2026-64611/): Libcupsfilters: cups-filters: libcupsfilters: cpu exhaustion via infinite loop in cfieee1284normalizemakemodel() (high 7.5)
- [CVE-2026-64610](https://insights.sbomify.com/CVE-2026-64610/): Apache Kylin: Redis unsafe Java deserialization (critical 9.8)
- [CVE-2026-64609](https://insights.sbomify.com/CVE-2026-64609/): Apache Fory, Apache Fory: Out-of-Bounds Read via sun.misc.Unsafe in zero-copy java deserialization (critical 9.1)
- [CVE-2026-64608](https://insights.sbomify.com/CVE-2026-64608/): Apache Fory: Heap type confusion and out-of-bounds read/write in C++ compatible-mode field-skip paths (critical 9.8)
- [CVE-2026-64607](https://insights.sbomify.com/CVE-2026-64607/): Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS (medium 5.3)
- [CVE-2026-64606](https://insights.sbomify.com/CVE-2026-64606/): Apache Fory, Apache Fory: Class-registration bypass through an auto-admitted SerializedLambda capturing interface (critical 9.8)
- [CVE-2026-64604](https://insights.sbomify.com/CVE-2026-64604/): KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode (not scored)
- [CVE-2026-64603](https://insights.sbomify.com/CVE-2026-64603/): platform/x86: intel-hid: Protect ACPI notify handler against recursion (not scored)
- [CVE-2026-64602](https://insights.sbomify.com/CVE-2026-64602/): iio: adc: spear: Initialize completion before requesting IRQ (not scored)
- [CVE-2026-64601](https://insights.sbomify.com/CVE-2026-64601/): ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on each resubmission (high 7.8)
- [CVE-2026-64600](https://insights.sbomify.com/CVE-2026-64600/): xfs: resample the data fork mapping after cycling ILOCK (high 7.8)
- [CVE-2026-64599](https://insights.sbomify.com/CVE-2026-64599/): crypto: amlogic - avoid double cleanup in meson_crypto_probe() (high 7.8)
- [CVE-2026-64598](https://insights.sbomify.com/CVE-2026-64598/): smb/client: Fix error code in smb2_aead_req_alloc() (high 8.8)
- [CVE-2026-64597](https://insights.sbomify.com/CVE-2026-64597/): smb: client: fix double-free in SMB2_close() replay (critical 9.8)
- [CVE-2026-64596](https://insights.sbomify.com/CVE-2026-64596/): libfs: set SB_I_NOEXEC and SB_I_NODEV by default in init_pseudo() (not scored)
- [CVE-2026-64595](https://insights.sbomify.com/CVE-2026-64595/): HID: hid-lenovo-go: cancel cfg_setup work in hid_go_cfg_remove() (not scored)
- [CVE-2026-64594](https://insights.sbomify.com/CVE-2026-64594/): usb: gadget: f_fs: initialize reset_work at allocation time (not scored)
- [CVE-2026-64593](https://insights.sbomify.com/CVE-2026-64593/): btrfs: do not trim a device which is not writeable (not scored)
- [CVE-2026-64592](https://insights.sbomify.com/CVE-2026-64592/): riscv: mm: Unconditionally sfence.vma for spurious fault (not scored)
- [CVE-2026-64591](https://insights.sbomify.com/CVE-2026-64591/): iommu/vt-d: Avoid WARNING in sva unbind path (not scored)
- [CVE-2026-64590](https://insights.sbomify.com/CVE-2026-64590/): dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning (not scored)
- [CVE-2026-6459](https://insights.sbomify.com/CVE-2026-6459/): Cross-site scripting in Essential Addons for Elementor – Popular Elementor Templates & Widgets (medium 6.4)
- [CVE-2026-64589](https://insights.sbomify.com/CVE-2026-64589/): i2c: core: fix NULL-deref on adapter registration failure (not scored)
- [CVE-2026-64588](https://insights.sbomify.com/CVE-2026-64588/): fuse-uring: fix data races on ring->ready (high 7.8)
- [CVE-2026-64587](https://insights.sbomify.com/CVE-2026-64587/): net: ethernet: arc: emac: quiesce interrupts before requesting IRQ (high 7.0)
- [CVE-2026-64586](https://insights.sbomify.com/CVE-2026-64586/): wifi: brcmfmac: drain bus_reset work on device removal (high 8.8)
- [CVE-2026-64585](https://insights.sbomify.com/CVE-2026-64585/): can: esd_usb: kill anchored URBs before freeing netdevs (high 7.8)
- [CVE-2026-64584](https://insights.sbomify.com/CVE-2026-64584/): usb: gadget: f_midi: cancel pending IN work before freeing the midi object (high 7.8)
- [CVE-2026-64583](https://insights.sbomify.com/CVE-2026-64583/): usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown (high 7.8)
- [CVE-2026-64582](https://insights.sbomify.com/CVE-2026-64582/): RDMA/rxe: Fix a use-after-free problem in rxe_mmap (high 7.8)
- [CVE-2026-64581](https://insights.sbomify.com/CVE-2026-64581/): xfrm: fix sk_dst_cache double-free in xfrm_user_policy() (high 7.8)
- [CVE-2026-64580](https://insights.sbomify.com/CVE-2026-64580/): xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() (high 7.8)
- [CVE-2026-6458](https://insights.sbomify.com/CVE-2026-6458/): AES-256-GCM Authentication Tag Does Not Cover First Ciphertext Blocks When AAD Is Empty (medium 5.1)
- [CVE-2026-64579](https://insights.sbomify.com/CVE-2026-64579/): xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert (not scored)
- [CVE-2026-64578](https://insights.sbomify.com/CVE-2026-64578/): ksmbd: validate compound request size before reading StructureSize2 (high 8.2)
- [CVE-2026-64577](https://insights.sbomify.com/CVE-2026-64577/): gtp: check skb_pull_data() return in gtp1u_send_echo_resp() (high 7.5)
- [CVE-2026-64576](https://insights.sbomify.com/CVE-2026-64576/): nexthop: initialize extack in nh_res_bucket_migrate() (high 7.1)
- [CVE-2026-64575](https://insights.sbomify.com/CVE-2026-64575/): bpf: tcp: fix double sock release on batch realloc (high 7.8)
- [CVE-2026-64574](https://insights.sbomify.com/CVE-2026-64574/): wifi: mac80211: tear down new links on vif update error path (high 7.8)
- [CVE-2026-64573](https://insights.sbomify.com/CVE-2026-64573/): Bluetooth: qca: fix NVM tag length underflow in TLV parser (not scored)
- [CVE-2026-64572](https://insights.sbomify.com/CVE-2026-64572/): ipv4: fib: free fib_alias with kfree_rcu() on insert error path (not scored)
- [CVE-2026-64571](https://insights.sbomify.com/CVE-2026-64571/): wifi: p54: validate RX frame length in p54_rx_eeprom_readback() (not scored)
- [CVE-2026-64570](https://insights.sbomify.com/CVE-2026-64570/): wifi: mac80211: fix fils_discovery double free on alloc failure (high 7.8)
- [CVE-2026-6457](https://insights.sbomify.com/CVE-2026-6457/): Geo Mashup <= 1.13.19 - Authenticated (Subscriber+) SQL Injection via 'geo_mashup_null_fields' Parameter (medium 6.5)
- [CVE-2026-64569](https://insights.sbomify.com/CVE-2026-64569/): mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n (not scored)
- [CVE-2026-64568](https://insights.sbomify.com/CVE-2026-64568/): wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/468/