# Vulnerabilities published in 2026


- [CVE-2026-63351](https://insights.sbomify.com/CVE-2026-63351/): Cross-site scripting in SIMATIC Drive Controller CPU 1504D TF (medium 5.3)
- [CVE-2026-63350](https://insights.sbomify.com/CVE-2026-63350/): Code injection in SIMATIC Drive Controller CPU 1504D TF (critical 9.4)
- [CVE-2026-6335](https://insights.sbomify.com/CVE-2026-6335/): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (medium 5.4)
- [CVE-2026-63349](https://insights.sbomify.com/CVE-2026-63349/): AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups (high 7.0)
- [CVE-2026-63343](https://insights.sbomify.com/CVE-2026-63343/): Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root (critical 9.9)
- [CVE-2026-63342](https://insights.sbomify.com/CVE-2026-63342/): Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check (medium 6.3)
- [CVE-2026-6334](https://insights.sbomify.com/CVE-2026-6334/): OAuth authorization code client binding not enforced during token redemption in Mattermost (low 3.1)
- [CVE-2026-63337](https://insights.sbomify.com/CVE-2026-63337/): RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading (high 7.5)
- [CVE-2026-63336](https://insights.sbomify.com/CVE-2026-63336/): RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITM (medium 5.1)
- [CVE-2026-63335](https://insights.sbomify.com/CVE-2026-63335/): RabbitMQ Java client malformed body frame triggers raw command assembler exception (medium 6.3)
- [CVE-2026-63334](https://insights.sbomify.com/CVE-2026-63334/): draw.io: SSRF via DNS rebinding in ProxyServlet bypasses private IP blocklist (medium 6.8)
- [CVE-2026-63330](https://insights.sbomify.com/CVE-2026-63330/): Missing authorization in warpgate (high 7.7)
- [CVE-2026-6333](https://insights.sbomify.com/CVE-2026-6333/): SSRF via Host Header Spoofing in Custom Slash Commands (low 3.5)
- [CVE-2026-63329](https://insights.sbomify.com/CVE-2026-63329/): Auth bypass in warpgate (medium 4.9)
- [CVE-2026-63328](https://insights.sbomify.com/CVE-2026-63328/): Trivy: Path Traversal in Trivy Plugin Manager Allows Arbitrary File Write (medium 6.8)
- [CVE-2026-63325](https://insights.sbomify.com/CVE-2026-63325/): Redocly CLI: Arbitrary code execution via Arazzo `$faker` expression using `respect` (high 7.8)
- [CVE-2026-6332](https://insights.sbomify.com/CVE-2026-6332/): Clear Text Storage of Sensitive Information on EcoStruxure™ Machine Expert HVAC (medium 6.8)
- [CVE-2026-63317](https://insights.sbomify.com/CVE-2026-63317/): Apache OpenNLP: Arbitrary Class Instantiation in GeneratorFactory via Feature Descriptor XML (medium 5.6)
- [CVE-2026-63316](https://insights.sbomify.com/CVE-2026-63316/): SQL Injection in Payload CMS (high 8.7)
- [CVE-2026-63315](https://insights.sbomify.com/CVE-2026-63315/): Plaintext storage of a password in WebCTI (high 8.2)
- [CVE-2026-63314](https://insights.sbomify.com/CVE-2026-63314/): SQL Injection in WebCTI (high 8.7)
- [CVE-2026-63313](https://insights.sbomify.com/CVE-2026-63313/): 9Router before 0.4.72 Server-Side Request Forgery via /v1/web/fetch (high 8.3)
- [CVE-2026-63312](https://insights.sbomify.com/CVE-2026-63312/): NLTK StreamBackedCorpusView Bypasses pathsec.ENFORCE Arbitrary File Read (high 8.7)
- [CVE-2026-63311](https://insights.sbomify.com/CVE-2026-63311/): NLTK before 3.10.0 SSRF via DNS Resolution Failure (medium 6.9)
- [CVE-2026-6331](https://insights.sbomify.com/CVE-2026-6331/): HMAC zero-length tag forgery in EVP_DigestVerifyFinal (low 2.1)
- [CVE-2026-63309](https://insights.sbomify.com/CVE-2026-63309/): SurrealDB < 3.1.5 Information Disclosure via ORDER BY (medium 5.3)
- [CVE-2026-63308](https://insights.sbomify.com/CVE-2026-63308/): Helm Files.Lines Denial of Service via Empty Chart Files (medium 5.3)
- [CVE-2026-63307](https://insights.sbomify.com/CVE-2026-63307/): Chat2DB < 5.3.0 Insecure Direct Object Reference via GET /api/connection/datasource (high 7.1)
- [CVE-2026-63306](https://insights.sbomify.com/CVE-2026-63306/): stoatchat before 0.13.5 Unauthenticated SSRF via proxy and embed endpoints (critical 9.2)
- [CVE-2026-63305](https://insights.sbomify.com/CVE-2026-63305/): AVideo through 29.0 OS Command Injection via ffmpeg.json.php (critical 9.2)
- [CVE-2026-63304](https://insights.sbomify.com/CVE-2026-63304/): AVideo through 29.0 OS Command Injection via listFFmpegProcesses (critical 9.2)
- [CVE-2026-63303](https://insights.sbomify.com/CVE-2026-63303/): Path Traversal in Quick.CMS (medium 5.1)
- [CVE-2026-63302](https://insights.sbomify.com/CVE-2026-63302/): Local File Inclusion in Quick.CMS (medium 5.1)
- [CVE-2026-63301](https://insights.sbomify.com/CVE-2026-63301/): Denial of Service in Quick.CMS (high 7.0)
- [CVE-2026-63300](https://insights.sbomify.com/CVE-2026-63300/): Cross-project instance move bypasses all project restrictions allowing host command execution (critical 9.9)
- [CVE-2026-6330](https://insights.sbomify.com/CVE-2026-6330/): ML-KEM ARM64 NEON ciphertext comparison only compares half of the input (medium 6.3)
- [CVE-2026-63299](https://insights.sbomify.com/CVE-2026-63299/): Storage volume cross-project move and snapshot restore bypass project disk limits (high 8.5)
- [CVE-2026-63298](https://insights.sbomify.com/CVE-2026-63298/): LXD arbitrary lxc.conf directive injection via NVIDIA instance configuration (high 8.7)
- [CVE-2026-63297](https://insights.sbomify.com/CVE-2026-63297/): Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge (critical 9.9)
- [CVE-2026-63296](https://insights.sbomify.com/CVE-2026-63296/): Project restriction bypass via instance migration config override (critical 9.9)
- [CVE-2026-63295](https://insights.sbomify.com/CVE-2026-63295/): Project restriction `restricted.containers.privilege=isolated` bypassable by omitting `security.idmap.isolated` (medium 4.3)
- [CVE-2026-63294](https://insights.sbomify.com/CVE-2026-63294/): Root RCE via image backup.yaml symlink (critical 9.9)
- [CVE-2026-63293](https://insights.sbomify.com/CVE-2026-63293/): Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root (critical 9.9)
- [CVE-2026-63292](https://insights.sbomify.com/CVE-2026-63292/): Apache HTTP Server: mod_vhost_alias stack overflow (high 7.5)
- [CVE-2026-6329](https://insights.sbomify.com/CVE-2026-6329/): PKCS#12 MAC verification uses attacker-controlled comparison length (medium 6.0)
- [CVE-2026-63286](https://insights.sbomify.com/CVE-2026-63286/): Weak cryptography in AXIS Camera Station 5 (high 7.1)
- [CVE-2026-63281](https://insights.sbomify.com/CVE-2026-63281/): Joomla Extension - regularlabs.com - XSS vulnerability in Regular Labs conditions manager (medium 4.8)
- [CVE-2026-63280](https://insights.sbomify.com/CVE-2026-63280/): Cross-site request forgery in Advanced Module Manager extension for Joomla (high 8.8)
- [CVE-2026-6328](https://insights.sbomify.com/CVE-2026-6328/): XQUIC Improper STREAM Frame Validation in Initial/Handshake Packets (high 8.3)
- [CVE-2026-63279](https://insights.sbomify.com/CVE-2026-63279/): Out of bounds read in PICT image import (medium 5.4)
- [CVE-2026-63278](https://insights.sbomify.com/CVE-2026-63278/): Package URLs can be used to exfiltrate arbitrary INI file values and environment variables (medium 6.7)
- [CVE-2026-63277](https://insights.sbomify.com/CVE-2026-63277/): RCE via calcext:data-mappings, sql provider and jdbc connector (high 8.5)
- [CVE-2026-63276](https://insights.sbomify.com/CVE-2026-63276/): Stack buffer overflow in CFF to Type 1 font conversion (medium 5.4)
- [CVE-2026-63275](https://insights.sbomify.com/CVE-2026-63275/): Stack buffer overflow in CFF font hint handling (medium 5.4)
- [CVE-2026-63274](https://insights.sbomify.com/CVE-2026-63274/): Heap buffer overflow in PDF import stream handling (medium 5.4)
- [CVE-2026-63273](https://insights.sbomify.com/CVE-2026-63273/): Heap buffer overflow in PDF import encryption handling (medium 5.4)
- [CVE-2026-63272](https://insights.sbomify.com/CVE-2026-63272/): Heap buffer overflow in WMF text record import (medium 5.4)
- [CVE-2026-63270](https://insights.sbomify.com/CVE-2026-63270/): Environment/ini-file leaks (medium 6.7)
- [CVE-2026-6327](https://insights.sbomify.com/CVE-2026-6327/): Multiple Vulnerabilities in IBM Concert Software (medium 4.3)
- [CVE-2026-63269](https://insights.sbomify.com/CVE-2026-63269/): LFI and GET SSRF via GStreamer and HLS playlists (medium 6.7)
- [CVE-2026-63268](https://insights.sbomify.com/CVE-2026-63268/): LFI via calcext:data-mappings, sql provider and sdbc:flat:file:// db href (medium 6.7)
- [CVE-2026-63267](https://insights.sbomify.com/CVE-2026-63267/): LFI and GET SSRF via calcext:data-mappings and csv provider (medium 6.7)
- [CVE-2026-63266](https://insights.sbomify.com/CVE-2026-63266/): Arbitrary file write via calcext:data-mappings, sql provider and Firebird backup functionality (medium 6.8)
- [CVE-2026-63265](https://insights.sbomify.com/CVE-2026-63265/): Cross-site request forgery in Advanced Module Manager extension for Joomla (high 8.0)
- [CVE-2026-63264](https://insights.sbomify.com/CVE-2026-63264/): Joomla Extension - joomshopping.com - Reflective XSS in JoomShopping < 5.9.3 (medium 5.3)
- [CVE-2026-63263](https://insights.sbomify.com/CVE-2026-63263/): Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service (medium 6.5)
- [CVE-2026-63262](https://insights.sbomify.com/CVE-2026-63262/): Missing Authorization in Kibana Leading to Information Disclosure (medium 4.3)
- [CVE-2026-63261](https://insights.sbomify.com/CVE-2026-63261/): Uncontrolled Resource Consumption in Kibana Leading to Denial of Service (medium 6.5)
- [CVE-2026-63260](https://insights.sbomify.com/CVE-2026-63260/): Uncontrolled Resource Consumption in Kibana Leading to Denial of Service (medium 6.5)
- [CVE-2026-63259](https://insights.sbomify.com/CVE-2026-63259/): Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure (medium 4.3)
- [CVE-2026-63252](https://insights.sbomify.com/CVE-2026-63252/): Denial of service in Eclipse Milo (high 8.7)
- [CVE-2026-6325](https://insights.sbomify.com/CVE-2026-6325/): Out-of-bounds write in SetSuitesHashSigAlgo on oversized signature algorithms list (low 2.0)
- [CVE-2026-63248](https://insights.sbomify.com/CVE-2026-63248/): Missing authorization in Eclipse Milo (medium 6.9)
- [CVE-2026-63244](https://insights.sbomify.com/CVE-2026-63244/): Authentication Bypass Vulnerability (critical 9.8)
- [CVE-2026-63243](https://insights.sbomify.com/CVE-2026-63243/): Firmware verification vulnerability (medium 4.3)
- [CVE-2026-63242](https://insights.sbomify.com/CVE-2026-63242/): Business logic vulnerability (medium 4.3)
- [CVE-2026-63241](https://insights.sbomify.com/CVE-2026-63241/): Insecure direct object reference vulnerability (low 3.1)
- [CVE-2026-63240](https://insights.sbomify.com/CVE-2026-63240/): Information disclosure vulnerability (medium 4.3)
- [CVE-2026-6324](https://insights.sbomify.com/CVE-2026-6324/): Libsoup: libsoup: http request smuggling via unsigned to signed conversion error (medium 4.8)
- [CVE-2026-63239](https://insights.sbomify.com/CVE-2026-63239/): Hard-coded AWS IAM credentials vulnerability (medium 5.4)
- [CVE-2026-63238](https://insights.sbomify.com/CVE-2026-63238/): Authentication bypass vulnerability (medium 6.5)
- [CVE-2026-63237](https://insights.sbomify.com/CVE-2026-63237/): TOTP two-factor authentication bypass vulnerability (medium 4.8)
- [CVE-2026-63236](https://insights.sbomify.com/CVE-2026-63236/): Improper access control vulnerability (low 3.7)
- [CVE-2026-63235](https://insights.sbomify.com/CVE-2026-63235/): Improper access control vulnerability (low 3.7)
- [CVE-2026-63234](https://insights.sbomify.com/CVE-2026-63234/): SQL injection and unsafe deserialisation vulnerability (critical 9.9)
- [CVE-2026-63233](https://insights.sbomify.com/CVE-2026-63233/): SQL injection and unsafe deserialisation vulnerability (critical 9.9)
- [CVE-2026-63232](https://insights.sbomify.com/CVE-2026-63232/): SQL injection and unsafe deserialisation vulnerability (critical 9.9)
- [CVE-2026-63231](https://insights.sbomify.com/CVE-2026-63231/): Post-authentication SQL injection vulnerability (high 8.1)
- [CVE-2026-63230](https://insights.sbomify.com/CVE-2026-63230/): Pre-authentication error-based SQL injection vulnerability (critical 9.1)
- [CVE-2026-63229](https://insights.sbomify.com/CVE-2026-63229/): Pre-authentication blind SQL injection vulnerability (critical 9.1)
- [CVE-2026-63228](https://insights.sbomify.com/CVE-2026-63228/): Unrestricted image upload vulnerability (low 2.6)
- [CVE-2026-63227](https://insights.sbomify.com/CVE-2026-63227/): Unrestricted SCORM file upload vulnerability (critical 9.9)
- [CVE-2026-63226](https://insights.sbomify.com/CVE-2026-63226/): Server-side request forgery in Ricoh printers and Multifunction Printers (MFPs) (medium 6.9)
- [CVE-2026-63225](https://insights.sbomify.com/CVE-2026-63225/): Redocly CLI: Path traversal when using `split` command (medium 4.4)
- [CVE-2026-63223](https://insights.sbomify.com/CVE-2026-63223/): CodeIgniter: Uploaded file extension validation bypass in is_image and mime_in rules (critical 9.8)
- [CVE-2026-63222](https://insights.sbomify.com/CVE-2026-63222/): CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames (high 7.5)
- [CVE-2026-63221](https://insights.sbomify.com/CVE-2026-63221/): CodeIgniter: SQL injection is possible via Query Builder deleteBatch() when used with where() conditions (critical 9.4)
- [CVE-2026-63220](https://insights.sbomify.com/CVE-2026-63220/): CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure() (medium 4.8)
- [CVE-2026-6322](https://insights.sbomify.com/CVE-2026-6322/): fast-uri vulnerable to host confusion via percent-encoded authority delimiters (high 7.5)
- [CVE-2026-63219](https://insights.sbomify.com/CVE-2026-63219/): Unauthenticated file upload via missing authorization on formatter upload endpoint (high 8.6)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/480/