# Vulnerabilities published in 2026


- [CVE-2026-63517](https://insights.sbomify.com/CVE-2026-63517/): Microsoft Office Graphics Component Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-63516](https://insights.sbomify.com/CVE-2026-63516/): Microsoft SharePoint Server Spoofing Vulnerability (medium 6.5)
- [CVE-2026-63515](https://insights.sbomify.com/CVE-2026-63515/): Microsoft Office Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-63514](https://insights.sbomify.com/CVE-2026-63514/): Microsoft SharePoint Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-63513](https://insights.sbomify.com/CVE-2026-63513/): Microsoft Office Graphics Component Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-63512](https://insights.sbomify.com/CVE-2026-63512/): Microsoft SharePoint Server Tampering Vulnerability (medium 6.5)
- [CVE-2026-6351](https://insights.sbomify.com/CVE-2026-6351/): Openfind｜MailGates/MailAudit - CRLF Injection (high 8.7)
- [CVE-2026-63509](https://insights.sbomify.com/CVE-2026-63509/): Microsoft Fabric Elevation of Privilege Vulnerability (critical 9.9)
- [CVE-2026-63508](https://insights.sbomify.com/CVE-2026-63508/): Microsoft Planetary Computer Pro Elevation of Privilege Vulnerability (critical 10.0)
- [CVE-2026-63506](https://insights.sbomify.com/CVE-2026-63506/): Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site (high 8.8)
- [CVE-2026-6350](https://insights.sbomify.com/CVE-2026-6350/): Openfind｜MailGates/MailAudit - Stack-based Buffer Overflow (critical 9.3)
- [CVE-2026-63498](https://insights.sbomify.com/CVE-2026-63498/): Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API (high 8.7)
- [CVE-2026-63495](https://insights.sbomify.com/CVE-2026-63495/): Libevent: Unbounded memory accumulation in WebSocket server via fragmented frames (high 7.5)
- [CVE-2026-63493](https://insights.sbomify.com/CVE-2026-63493/): Snipe-IT: 2FA bypass via the API token flow (high 8.6)
- [CVE-2026-63490](https://insights.sbomify.com/CVE-2026-63490/): Handlebars.java: Arbitrary file read in `SpringTemplateLoader` via URL-fragment suffix bypass (high 7.5)
- [CVE-2026-6349](https://insights.sbomify.com/CVE-2026-6349/): HGiga｜iSherlock - OS Command Injection (critical 9.3)
- [CVE-2026-63481](https://insights.sbomify.com/CVE-2026-63481/): Hurl: Cookies in Cookies section leak when redirecting to a different host (medium 6.9)
- [CVE-2026-6348](https://insights.sbomify.com/CVE-2026-6348/): Simopro Technology｜WinMatrix - Missing Authentication (critical 9.3)
- [CVE-2026-63472](https://insights.sbomify.com/CVE-2026-63472/): Vendure affected by external-authentication account takeover: external login linked to a pre-existing account by email without verification (critical 9.1)
- [CVE-2026-6347](https://insights.sbomify.com/CVE-2026-6347/): Mattermost Calls plugin exposes TURN server credentials in plaintext in support packets (high 7.6)
- [CVE-2026-63466](https://insights.sbomify.com/CVE-2026-63466/): Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username (medium 4.1)
- [CVE-2026-63464](https://insights.sbomify.com/CVE-2026-63464/): Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private` (high 7.7)
- [CVE-2026-63462](https://insights.sbomify.com/CVE-2026-63462/): Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter (high 7.5)
- [CVE-2026-63461](https://insights.sbomify.com/CVE-2026-63461/): Vendure: Shop API list queries can return non-public entities when filterOperator is OR (medium 5.3)
- [CVE-2026-63460](https://insights.sbomify.com/CVE-2026-63460/): Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backends (high 7.5)
- [CVE-2026-6346](https://insights.sbomify.com/CVE-2026-6346/): Sensitive credentials exposed in plaintext in Mattermost support packets (high 8.7)
- [CVE-2026-63459](https://insights.sbomify.com/CVE-2026-63459/): Vendure: Stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions (high 8.7)
- [CVE-2026-63458](https://insights.sbomify.com/CVE-2026-63458/): Perses project query parameter authorization bypass exposes cross-project resources (high 7.1)
- [CVE-2026-63457](https://insights.sbomify.com/CVE-2026-63457/): Denial of service in HPE Integrated Lights-Out 6 (iLO 6) (medium 6.5)
- [CVE-2026-63456](https://insights.sbomify.com/CVE-2026-63456/): Authentication bypass via spoofed HTTP headers Orchestrator REST API (critical 9.8)
- [CVE-2026-63455](https://insights.sbomify.com/CVE-2026-63455/): Authentication bypass via spoofed HTTP headers Orchestrator REST API (critical 9.8)
- [CVE-2026-63454](https://insights.sbomify.com/CVE-2026-63454/): Authenticated Path Traversal Vulnerability Leads to Remote Code Execution in AOS-CX (high 7.2)
- [CVE-2026-63453](https://insights.sbomify.com/CVE-2026-63453/): Authenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-CX (high 7.2)
- [CVE-2026-63452](https://insights.sbomify.com/CVE-2026-63452/): Suricata http1: repeated brotli compression bombs can cause excessive CPU consumption (high 7.5)
- [CVE-2026-63451](https://insights.sbomify.com/CVE-2026-63451/): Suricata detect: frame rules without content and with transform can cause heap buffer overflow during rule load (low 3.3)
- [CVE-2026-63450](https://insights.sbomify.com/CVE-2026-63450/): Suricata ftp: RETR/STOR before PORT/PASV can disable further IDS app-layer detection (low 3.7)
- [CVE-2026-6345](https://insights.sbomify.com/CVE-2026-6345/): Prevent password disclosure and force reset during Slack import (medium 6.5)
- [CVE-2026-63449](https://insights.sbomify.com/CVE-2026-63449/): Suricata sip: large SIP message bodies can evade detection with frame keyword (low 3.7)
- [CVE-2026-63448](https://insights.sbomify.com/CVE-2026-63448/): Suricata smb: some SMB flows can cause resource exhaustion (medium 5.9)
- [CVE-2026-63447](https://insights.sbomify.com/CVE-2026-63447/): Suricata ftp: crafted FTP traffic can cause quadratic CPU consumption (high 7.5)
- [CVE-2026-63446](https://insights.sbomify.com/CVE-2026-63446/): Suricata app-layer: passed flows can retain transactions, causing resource exhaustion (high 7.5)
- [CVE-2026-63445](https://insights.sbomify.com/CVE-2026-63445/): Perses: Unvalidated project parameter enables filesystem path traversal (high 7.1)
- [CVE-2026-63443](https://insights.sbomify.com/CVE-2026-63443/): Coder: Workspace agent API insecure redirect handling allowed cross-agent file read and write (high 8.3)
- [CVE-2026-63442](https://insights.sbomify.com/CVE-2026-63442/): OPNsense: Log Forgery via Login Username CRLF in WebGUI Authentication → Pf Table IP Blocking (high 8.1)
- [CVE-2026-6344](https://insights.sbomify.com/CVE-2026-6344/): Fluent Forms <= 6.2.1 - Authenticated (Administrator+) Arbitrary File Read via Path Traversal in Email Attachment (medium 4.9)
- [CVE-2026-63435](https://insights.sbomify.com/CVE-2026-63435/): Mail: Email address spoofing via malformed RFC 2047 encoded-words (medium 5.3)
- [CVE-2026-63432](https://insights.sbomify.com/CVE-2026-63432/): Code injection in horilla-hr (medium 6.5)
- [CVE-2026-63431](https://insights.sbomify.com/CVE-2026-63431/): Missing authorization in horilla-hr (medium 6.5)
- [CVE-2026-63430](https://insights.sbomify.com/CVE-2026-63430/): ammonia: mXSS in ammonia via MathML `annotation-xml` encoding strip (medium 6.3)
- [CVE-2026-6343](https://insights.sbomify.com/CVE-2026-6343/): Mattermost doesn't check public/private permissions (medium 4.3)
- [CVE-2026-63429](https://insights.sbomify.com/CVE-2026-63429/): HeyForm has unauthenticated /api/upload endpoint that accepts arbitrary files with no auth/session/form context (high 8.6)
- [CVE-2026-63428](https://insights.sbomify.com/CVE-2026-63428/): Business logic in heyform (medium 5.8)
- [CVE-2026-63427](https://insights.sbomify.com/CVE-2026-63427/): Auth bypass in Software Fix (high 8.5)
- [CVE-2026-63426](https://insights.sbomify.com/CVE-2026-63426/): Privilege escalation in Dock Manager (medium 6.9)
- [CVE-2026-63425](https://insights.sbomify.com/CVE-2026-63425/): Privilege escalation in Dock Manager (high 8.5)
- [CVE-2026-63424](https://insights.sbomify.com/CVE-2026-63424/): Privilege escalation in Dock Manager (high 7.0)
- [CVE-2026-63423](https://insights.sbomify.com/CVE-2026-63423/): Hardcoded credentials in Accessories and Display Manager (high 8.5)
- [CVE-2026-63422](https://insights.sbomify.com/CVE-2026-63422/): OpenImageIO OpenEXR plugin partial edge tile heap out-of-bounds write (high 7.8)
- [CVE-2026-63421](https://insights.sbomify.com/CVE-2026-63421/): Keystone: `graphql.maxTake` bypass with negative `take` (high 7.5)
- [CVE-2026-63420](https://insights.sbomify.com/CVE-2026-63420/): OpenImageIO: PSD RawColor indexed image out-of-bounds read in `interleave_row` (medium 5.5)
- [CVE-2026-6342](https://insights.sbomify.com/CVE-2026-6342/): Group prefix matching bypass for subscriptions (medium 4.3)
- [CVE-2026-63419](https://insights.sbomify.com/CVE-2026-63419/): OpenImageIO: IFF ZBUFFER tile read writes past caller tile buffer (high 7.8)
- [CVE-2026-63416](https://insights.sbomify.com/CVE-2026-63416/): draw.io: Path traversal in ExportProxyServlet allows access to arbitrary backend endpoints (low 3.7)
- [CVE-2026-6341](https://insights.sbomify.com/CVE-2026-6341/): Incomplete group locking implementation (medium 4.3)
- [CVE-2026-63409](https://insights.sbomify.com/CVE-2026-63409/): Deskflow: Odd-length DSOP options vector causes out-of-bounds read in Deskflow client (high 8.2)
- [CVE-2026-63408](https://insights.sbomify.com/CVE-2026-63408/): Grav API Plugin: JWT Access Token Accepted via `?token=` URL Query Parameter (high 7.5)
- [CVE-2026-63407](https://insights.sbomify.com/CVE-2026-63407/): Grav API Plugin: CORS 'Access-Control-Allow-Origin: *' on Authenticated API Responses (high 8.2)
- [CVE-2026-63406](https://insights.sbomify.com/CVE-2026-63406/): AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets (medium 5.9)
- [CVE-2026-63405](https://insights.sbomify.com/CVE-2026-63405/): AnyCable: Pusher REST API Does Not Verify Request Body MD5 Enabling Signed-Request Replay with Arbitrary Body (medium 5.9)
- [CVE-2026-63404](https://insights.sbomify.com/CVE-2026-63404/): Faktory: Insecure predictable /tmp/redis.conf enables local Redis config hijack (network exposure / root RCE primitive) (high 7.3)
- [CVE-2026-63403](https://insights.sbomify.com/CVE-2026-63403/): Faktory: Unrecovered panic in command handlers allows full-server denial of service (high 8.7)
- [CVE-2026-6340](https://insights.sbomify.com/CVE-2026-6340/): Memory Exhaustion via Malicious 7zip File Upload (medium 4.3)
- [CVE-2026-63397](https://insights.sbomify.com/CVE-2026-63397/): remorses/genql code injection (high 7.1)
- [CVE-2026-6339](https://insights.sbomify.com/CVE-2026-6339/): Missing request origin validation on burn-on-read reveal endpoint (medium 4.3)
- [CVE-2026-63388](https://insights.sbomify.com/CVE-2026-63388/): Libevent: Heap out-of-bounds write in bufferevent_socket_set_conn_address_ reachable via AF_UNIX accept (high 8.4)
- [CVE-2026-63387](https://insights.sbomify.com/CVE-2026-63387/): Libevent: Off-by-one stack buffer overflow in dnsname_to_labels via crafted DNS server response (high 7.0)
- [CVE-2026-63386](https://insights.sbomify.com/CVE-2026-63386/): js-toml: Uncontrolled recursion in `load()` causes `RangeError` (stack exhaustion) on deeply nested input (medium 5.3)
- [CVE-2026-63385](https://insights.sbomify.com/CVE-2026-63385/): Libevent: HTTP header handling bugs create risk of access control bypass. (critical 9.2)
- [CVE-2026-63384](https://insights.sbomify.com/CVE-2026-63384/): Libevent: `evtag_unmarshal_header()` decodes a wire `uint32` length into a signed `int` return value. (high 8.7)
- [CVE-2026-63383](https://insights.sbomify.com/CVE-2026-63383/): Libevent: decode_tag_internal() can lead to out-of-bounds read (high 8.7)
- [CVE-2026-63382](https://insights.sbomify.com/CVE-2026-63382/): libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling (critical 9.2)
- [CVE-2026-63381](https://insights.sbomify.com/CVE-2026-63381/): Libevent: Dangling Pointer in `evbuffer_add_buffer_reference` (medium 5.8)
- [CVE-2026-63380](https://insights.sbomify.com/CVE-2026-63380/): Libevent: Null Pointer Dereference in `evws_new_session` (medium 5.7)
- [CVE-2026-6338](https://insights.sbomify.com/CVE-2026-6338/): HTTP request smuggling in Kong Enteprise Gateway (medium 4.9)
- [CVE-2026-63379](https://insights.sbomify.com/CVE-2026-63379/): Libevent: HTTP Header smuggling (medium 6.3)
- [CVE-2026-63376](https://insights.sbomify.com/CVE-2026-63376/): toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronization (high 8.2)
- [CVE-2026-63374](https://insights.sbomify.com/CVE-2026-63374/): AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing (critical 9.3)
- [CVE-2026-63373](https://insights.sbomify.com/CVE-2026-63373/): draw.io: OAuth CSRF via missing state validation on self-hosted deployments allows session token injection (medium 4.2)
- [CVE-2026-63362](https://insights.sbomify.com/CVE-2026-63362/): o6 Automation open62541 Integer Underflow (high 8.2)
- [CVE-2026-63361](https://insights.sbomify.com/CVE-2026-63361/): LimeSurvey Community Edition 7.0.5 - Reflected XSS in HTML editor popup (high 8.5)
- [CVE-2026-63360](https://insights.sbomify.com/CVE-2026-63360/): LimeSurvey Community Edition 7.0.5 - Reflected XSS in user activation confirmation endpoint (high 7.4)
- [CVE-2026-6336](https://insights.sbomify.com/CVE-2026-6336/): Incorrect Authorization in GitLab (medium 5.3)
- [CVE-2026-63359](https://insights.sbomify.com/CVE-2026-63359/): Appriss Insights VINE SQLI (critical 9.3)
- [CVE-2026-63358](https://insights.sbomify.com/CVE-2026-63358/): FileGator privilege escalation (high 8.4)
- [CVE-2026-63357](https://insights.sbomify.com/CVE-2026-63357/): Cross-site scripting in SIMATIC Drive Controller CPU 1504D TF (medium 5.3)
- [CVE-2026-63356](https://insights.sbomify.com/CVE-2026-63356/): Cross-site scripting in SIMATIC Drive Controller CPU 1504D TF (medium 5.3)
- [CVE-2026-63355](https://insights.sbomify.com/CVE-2026-63355/): Cross-site scripting in SIMATIC Drive Controller CPU 1504D TF (medium 5.3)
- [CVE-2026-63354](https://insights.sbomify.com/CVE-2026-63354/): Cross-site scripting in SIMATIC Drive Controller CPU 1504D TF (critical 9.4)
- [CVE-2026-63353](https://insights.sbomify.com/CVE-2026-63353/): Cross-site scripting in SIMATIC Drive Controller CPU 1504D TF (critical 9.4)
- [CVE-2026-63352](https://insights.sbomify.com/CVE-2026-63352/): Cross-site scripting in SIMATIC Drive Controller CPU 1504D TF (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/479/