# Vulnerabilities published in 2026


- [CVE-2026-63702](https://insights.sbomify.com/CVE-2026-63702/): Hardcoded credentials in Wyse Management Suite (WMS) (medium 6.3)
- [CVE-2026-63701](https://insights.sbomify.com/CVE-2026-63701/): Deserialization in Wyse Management Suite (WMS) (medium 6.3)
- [CVE-2026-63700](https://insights.sbomify.com/CVE-2026-63700/): Privilege escalation in Wyse Management Suite (WMS) (high 7.8)
- [CVE-2026-6370](https://insights.sbomify.com/CVE-2026-6370/): WordPress Mini Ajax Cart for WooCommerce plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2026-63697](https://insights.sbomify.com/CVE-2026-63697/): Security feature bypass in System Update (high 7.6)
- [CVE-2026-63696](https://insights.sbomify.com/CVE-2026-63696/): Supply chain in SmartFabric OS10 Software (critical 9.1)
- [CVE-2026-63695](https://insights.sbomify.com/CVE-2026-63695/): Auth bypass in SmartFabric OS10 Software (critical 9.8)
- [CVE-2026-63694](https://insights.sbomify.com/CVE-2026-63694/): Command injection in SmartFabric OS10 (medium 5.0)
- [CVE-2026-63693](https://insights.sbomify.com/CVE-2026-63693/): Privilege escalation in AURORA R16 (medium 6.6)
- [CVE-2026-63692](https://insights.sbomify.com/CVE-2026-63692/): Auth bypass in Container Storage Modules (critical 10.0)
- [CVE-2026-63691](https://insights.sbomify.com/CVE-2026-63691/): Missing authorization in Container Storage Modules (medium 6.1)
- [CVE-2026-63690](https://insights.sbomify.com/CVE-2026-63690/): Missing authorization in Container Storage Modules (medium 5.4)
- [CVE-2026-6369](https://insights.sbomify.com/CVE-2026-6369/): Exposed Session Token in canonical-livepatch client snap (medium 5.7)
- [CVE-2026-63689](https://insights.sbomify.com/CVE-2026-63689/): Information disclosure in Container Storage Modules (medium 6.5)
- [CVE-2026-63688](https://insights.sbomify.com/CVE-2026-63688/): Missing authorization in Dell Container Storage Modules (CSM) (critical 10.0)
- [CVE-2026-63687](https://insights.sbomify.com/CVE-2026-63687/): Apache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parameters (critical 9.1)
- [CVE-2026-63686](https://insights.sbomify.com/CVE-2026-63686/): Apache HTTP Server: mod_xml2enc crash on charset conversion failure (high 7.5)
- [CVE-2026-63685](https://insights.sbomify.com/CVE-2026-63685/): Joomla Extension - regularlabs.com - Authorization bypass in DB Replacer extension (high 8.8)
- [CVE-2026-63684](https://insights.sbomify.com/CVE-2026-63684/): Cross-site request forgery in Content Templater extension for Joomla (high 8.8)
- [CVE-2026-63683](https://insights.sbomify.com/CVE-2026-63683/): Joomla Extension - regularlabs.com - Client IP spoofing vulnerability in Regular Labs conditions manager (high 7.5)
- [CVE-2026-6368](https://insights.sbomify.com/CVE-2026-6368/): wordexp with WRDE_APPEND can return or use invalid memory (low 2.1)
- [CVE-2026-63671](https://insights.sbomify.com/CVE-2026-63671/): @nuxtjs/mdc's URL sanitizer misses SVG xlink:href and data:text/html, allowing XSS from untrusted markdown at the default configuration (high 8.1)
- [CVE-2026-63670](https://insights.sbomify.com/CVE-2026-63670/): ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close (medium 6.1)
- [CVE-2026-6367](https://insights.sbomify.com/CVE-2026-6367/): Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-003 (medium 6.1)
- [CVE-2026-63669](https://insights.sbomify.com/CVE-2026-63669/): ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtree (medium 6.5)
- [CVE-2026-63667](https://insights.sbomify.com/CVE-2026-63667/): ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal (medium 6.5)
- [CVE-2026-6366](https://insights.sbomify.com/CVE-2026-6366/): Drupal core - Moderately critical - Gadget Chain - SA-CORE-2026-002 (medium 6.6)
- [CVE-2026-63654](https://insights.sbomify.com/CVE-2026-63654/): Frappe: Unauthenticated Workflow approval via confirm_action (medium 6.9)
- [CVE-2026-63652](https://insights.sbomify.com/CVE-2026-63652/): FreeRDP: Double-free of `client_formats` in the rdpsnd server channel on a malformed Client Audio Formats PDU (high 7.1)
- [CVE-2026-63650](https://insights.sbomify.com/CVE-2026-63650/): Auth bypass in OpenVPN (low 2.0)
- [CVE-2026-6365](https://insights.sbomify.com/CVE-2026-6365/): Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001 (medium 6.1)
- [CVE-2026-63649](https://insights.sbomify.com/CVE-2026-63649/): Security feature bypass in OpenVPN (medium 4.1)
- [CVE-2026-63647](https://insights.sbomify.com/CVE-2026-63647/): CordysCRM SSE Notification Stream Hijack via `/sse/subscribe` (critical 9.3)
- [CVE-2026-63646](https://insights.sbomify.com/CVE-2026-63646/): CordysCRM MCP Form Configuration Endpoint Exposed to Anonymous Users (medium 6.9)
- [CVE-2026-63645](https://insights.sbomify.com/CVE-2026-63645/): OpenObserve: Unauthenticated /config/runtime endpoint exposes PostgreSQL database credentials (high 7.5)
- [CVE-2026-63643](https://insights.sbomify.com/CVE-2026-63643/): MagicMirror: ssrf calendar .js (medium 6.3)
- [CVE-2026-63642](https://insights.sbomify.com/CVE-2026-63642/): MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery (medium 6.3)
- [CVE-2026-63641](https://insights.sbomify.com/CVE-2026-63641/): MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actions (low 2.3)
- [CVE-2026-63640](https://insights.sbomify.com/CVE-2026-63640/): MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables (medium 4.3)
- [CVE-2026-6364](https://insights.sbomify.com/CVE-2026-6364/): Memory corruption in Chrome (medium 6.5)
- [CVE-2026-63639](https://insights.sbomify.com/CVE-2026-63639/): Valkey: UAF in stream deserialization may lead to remote code execution (high 8.8)
- [CVE-2026-63638](https://insights.sbomify.com/CVE-2026-63638/): OpenImageIO: Cineon invalid bit depth heap out-of-bounds write (high 8.3)
- [CVE-2026-63637](https://insights.sbomify.com/CVE-2026-63637/): Dgraph: DQL Injection via unvalidated regexp filter argument in GraphQL query rewriter (high 8.6)
- [CVE-2026-63635](https://insights.sbomify.com/CVE-2026-63635/): OpenImageIO: PSD RawColor invalid color mode causes global out-of-bounds read and allocation DoS (medium 5.5)
- [CVE-2026-63633](https://insights.sbomify.com/CVE-2026-63633/): FreeRDP: Heap buffer overflow in Opus audio decode (`freerdp_dsp_decode_opus` resizes the wrong stream) — server→client (high 7.7)
- [CVE-2026-63632](https://insights.sbomify.com/CVE-2026-63632/): ONNX: Heap-Buffer-Overflow READ in Gemm Version Converter Adapter via Undersized Input Shape (low 3.3)
- [CVE-2026-63630](https://insights.sbomify.com/CVE-2026-63630/): BentoPDF: Workflow Import Allows Unvalidated TSA URL Leading to PDF Hash Exfiltration via RFC 3161 Requests (low 3.4)
- [CVE-2026-6363](https://insights.sbomify.com/CVE-2026-6363/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-63628](https://insights.sbomify.com/CVE-2026-63628/): mppx: Gas Draining with access list (medium 6.9)
- [CVE-2026-63627](https://insights.sbomify.com/CVE-2026-63627/): mppx: Gas Draining with padding (medium 6.9)
- [CVE-2026-63626](https://insights.sbomify.com/CVE-2026-63626/): Memory corruption in mongoose (high 8.8)
- [CVE-2026-63623](https://insights.sbomify.com/CVE-2026-63623/): Libvirt: information disclosure via world-readable storage volume images during clone/convert (medium 5.5)
- [CVE-2026-63622](https://insights.sbomify.com/CVE-2026-63622/): Libvirt: swtpm privilege escalation via symlink following (high 7.8)
- [CVE-2026-63621](https://insights.sbomify.com/CVE-2026-63621/): Apache Camel-Knative: CloudEvent extension fields received in structured content mode were mapped onto message headers without applying any header filter strategy (medium 5.3)
- [CVE-2026-6362](https://insights.sbomify.com/CVE-2026-6362/): Use after free in Chrome (medium 4.3)
- [CVE-2026-63619](https://insights.sbomify.com/CVE-2026-63619/): Apache Kylin: Missing authorization and path-confinement on system meta dump (critical 9.1)
- [CVE-2026-63618](https://insights.sbomify.com/CVE-2026-63618/): Apache Kylin: Low-Privilege Config Exposure (high 7.5)
- [CVE-2026-6361](https://insights.sbomify.com/CVE-2026-6361/): Memory corruption in Chrome (high 8.3)
- [CVE-2026-6360](https://insights.sbomify.com/CVE-2026-6360/): Use after free in Chrome (high 8.8)
- [CVE-2026-6359](https://insights.sbomify.com/CVE-2026-6359/): Use after free in Chrome (high 8.8)
- [CVE-2026-63587](https://insights.sbomify.com/CVE-2026-63587/): SMS Password Authorization Bypass via Failed Attempt Counter (high 8.8)
- [CVE-2026-63586](https://insights.sbomify.com/CVE-2026-63586/): Unauthenticated Remote Code Execution via Shell Injection in Web Management Interface (critical 9.3)
- [CVE-2026-6358](https://insights.sbomify.com/CVE-2026-6358/): Use after free in Chrome (high 8.8)
- [CVE-2026-63578](https://insights.sbomify.com/CVE-2026-63578/): Unbounded PBE iteration count when decrypting PKCS#8 private keys (high 7.1)
- [CVE-2026-63577](https://insights.sbomify.com/CVE-2026-63577/): Name Constraints bypass: directoryName constraint matched at any position in the DN instead of as a prefix (high 8.2)
- [CVE-2026-63576](https://insights.sbomify.com/CVE-2026-63576/): URI name constraints checked against a mis-parsed host (high 8.2)
- [CVE-2026-63575](https://insights.sbomify.com/CVE-2026-63575/): PKCS#12 key derivation loops about 2^32 times on a zero or negative iteration count (high 7.1)
- [CVE-2026-63574](https://insights.sbomify.com/CVE-2026-63574/): Unbounded allocation from OpenPGP signature and user attribute subpacket lengths (high 8.7)
- [CVE-2026-63573](https://insights.sbomify.com/CVE-2026-63573/): Bleichenbacher padding oracle in CMS RSA PKCS#1 v1.5 key-transport unwrap (high 8.2)
- [CVE-2026-63572](https://insights.sbomify.com/CVE-2026-63572/): Unbounded MAC and bag-decryption iteration counts when loading PKCS#12 files (high 7.1)
- [CVE-2026-63571](https://insights.sbomify.com/CVE-2026-63571/): Attribute certificate path validation does not verify the attribute certificate's signature (high 8.7)
- [CVE-2026-63570](https://insights.sbomify.com/CVE-2026-63570/): Pkcs12Store.GetCertificateChain loops forever on cyclic issuer links (high 7.1)
- [CVE-2026-6357](https://insights.sbomify.com/CVE-2026-6357/): pip self-update functionality can import newly installed modules after wheel installation (medium 5.3)
- [CVE-2026-63569](https://insights.sbomify.com/CVE-2026-63569/): MTI/A0 DHAgreement does not validate the peer's ephemeral value (critical 9.1)
- [CVE-2026-63568](https://insights.sbomify.com/CVE-2026-63568/): Unbounded CMP/CRMF password-based MAC iteration count allows CPU exhaustion (high 8.7)
- [CVE-2026-63567](https://insights.sbomify.com/CVE-2026-63567/): IesEngine block-cipher mode checks padding before MAC (CBC padding oracle) (high 8.2)
- [CVE-2026-63566](https://insights.sbomify.com/CVE-2026-63566/): DTLS handshake reassembler allocates buffer from unchecked 24-bit length (high 8.7)
- [CVE-2026-63563](https://insights.sbomify.com/CVE-2026-63563/): Misconfiguration in Sharp MFPs (medium 6.9)
- [CVE-2026-6356](https://insights.sbomify.com/CVE-2026-6356/): CVE-2026-6356 (critical 9.6)
- [CVE-2026-63559](https://insights.sbomify.com/CVE-2026-63559/): o6 Automation open62541 Integer Overflow or Wraparound (high 8.7)
- [CVE-2026-63550](https://insights.sbomify.com/CVE-2026-63550/): MZ Automation libiec61850 Out-of-bounds Read (high 7.1)
- [CVE-2026-6355](https://insights.sbomify.com/CVE-2026-6355/): CVE-2026-6355 (medium 6.5)
- [CVE-2026-63545](https://insights.sbomify.com/CVE-2026-63545/): Information disclosure in Sharp MFPs (low 2.4)
- [CVE-2026-63533](https://insights.sbomify.com/CVE-2026-63533/): Microsoft Office Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-63532](https://insights.sbomify.com/CVE-2026-63532/): Microsoft Office Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-63531](https://insights.sbomify.com/CVE-2026-63531/): Microsoft Office Word Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-63530](https://insights.sbomify.com/CVE-2026-63530/): Microsoft Office Word Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-63529](https://insights.sbomify.com/CVE-2026-63529/): Microsoft Office Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-63528](https://insights.sbomify.com/CVE-2026-63528/): Microsoft Office Word Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-63527](https://insights.sbomify.com/CVE-2026-63527/): Microsoft Office Word Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-63526](https://insights.sbomify.com/CVE-2026-63526/): Microsoft Office Graphics Component Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-63525](https://insights.sbomify.com/CVE-2026-63525/): Microsoft Office Word Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-63524](https://insights.sbomify.com/CVE-2026-63524/): Microsoft Office Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-63523](https://insights.sbomify.com/CVE-2026-63523/): Skype for Business Spoofing Vulnerability (medium 6.5)
- [CVE-2026-63522](https://insights.sbomify.com/CVE-2026-63522/): Azure SQL Database Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-63521](https://insights.sbomify.com/CVE-2026-63521/): Microsoft Office Word Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-63520](https://insights.sbomify.com/CVE-2026-63520/): Microsoft SharePoint Server Remote Code Execution Vulnerability (high 8.1)
- [CVE-2026-6352](https://insights.sbomify.com/CVE-2026-6352/): Incorrect Authorization in GitLab (low 2.7)
- [CVE-2026-63519](https://insights.sbomify.com/CVE-2026-63519/): Microsoft Office Graphics Component Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-63518](https://insights.sbomify.com/CVE-2026-63518/): Microsoft Office Word Remote Code Execution Vulnerability (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/478/