# Vulnerabilities published in 2026


- [CVE-2026-63081](https://insights.sbomify.com/CVE-2026-63081/): Perfect Support Ticketing System 1.7 Stored XSS via Ticket Notes Field (medium 5.1)
- [CVE-2026-63080](https://insights.sbomify.com/CVE-2026-63080/): Aptabase SQL Injection via ClickHouse query backend (high 7.1)
- [CVE-2026-6308](https://insights.sbomify.com/CVE-2026-6308/): Memory corruption in Chrome (high 7.5)
- [CVE-2026-63077](https://insights.sbomify.com/CVE-2026-63077/): JetBrains TeamCity Deserialization of Untrusted Data (critical 9.8, exploited in the wild)
- [CVE-2026-63076](https://insights.sbomify.com/CVE-2026-63076/): Invalid Pointer Dereference in CMP Server via Crafted protectionAlg (high 7.5)
- [CVE-2026-63075](https://insights.sbomify.com/CVE-2026-63075/): QUIC ACK-only Packet Retention Can Cause Memory Exhaustion (high 7.5)
- [CVE-2026-63074](https://insights.sbomify.com/CVE-2026-63074/): CMP Indefinite Cache Growth of ExtraCerts (medium 5.9)
- [CVE-2026-63073](https://insights.sbomify.com/CVE-2026-63073/): Untrusted Sender DN Used as Format String in CMP Response Validation (critical 9.8)
- [CVE-2026-63072](https://insights.sbomify.com/CVE-2026-63072/): Heap Buffer Overflow in CMS Key Unwrapping (high 7.5)
- [CVE-2026-63071](https://insights.sbomify.com/CVE-2026-63071/): Apache Syncope: RCE via Groovy Sandbox bypass (critical 9.8)
- [CVE-2026-6307](https://insights.sbomify.com/CVE-2026-6307/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-6306](https://insights.sbomify.com/CVE-2026-6306/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-6305](https://insights.sbomify.com/CVE-2026-6305/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-63048](https://insights.sbomify.com/CVE-2026-63048/): Joomla Extension - joomlack.fr - Improper access control in Page Builder CK 1.0.0-3.1.2, 3.4.0-3.4.11, 3.5.0-3.6.2 (critical 9.4)
- [CVE-2026-63047](https://insights.sbomify.com/CVE-2026-63047/): Joomla Extension - joomdonation.com - Invoice data exfiltration via incorrect ACL check in Events Booking 5.0.0-5.8.1 (high 7.5)
- [CVE-2026-63046](https://insights.sbomify.com/CVE-2026-63046/): Apache InLong: Agent Installer — Command Injection to RCE via Default Credentials (high 8.8)
- [CVE-2026-63045](https://insights.sbomify.com/CVE-2026-63045/): Apache HTTP Server: mod_proxy_ftp PASV address handling (high 7.5)
- [CVE-2026-63044](https://insights.sbomify.com/CVE-2026-63044/): Apache InLong: Authenticated SSRF via POST /api/node/testConnection (medium 5.4)
- [CVE-2026-63043](https://insights.sbomify.com/CVE-2026-63043/): Apache InLong: Agent path traversal via unvalidated file source path (high 7.5)
- [CVE-2026-63042](https://insights.sbomify.com/CVE-2026-63042/): Apache InLong: Missing authorization on DataNode management endpoints (high 8.1)
- [CVE-2026-63041](https://insights.sbomify.com/CVE-2026-63041/): Apache APISIX: attach-consumer-label does not strip client-supplied consumer-label headers (medium 5.3)
- [CVE-2026-63040](https://insights.sbomify.com/CVE-2026-63040/): Apache InLong: Missing authorization in StreamSource forceDelete (high 8.1)
- [CVE-2026-6304](https://insights.sbomify.com/CVE-2026-6304/): Use after free in Chrome (high 8.3)
- [CVE-2026-63039](https://insights.sbomify.com/CVE-2026-63039/): Apache InLong: SQL Injection via Unvalidated MyBatis Dollar-Sign Interpolation in AuditAlertRuleService (critical 9.8)
- [CVE-2026-63038](https://insights.sbomify.com/CVE-2026-63038/): Apache InLong: SQL Injection via String Concatenation Vulnerability Report (critical 9.8)
- [CVE-2026-63037](https://insights.sbomify.com/CVE-2026-63037/): Apache InLong: Unauthenticated SQL injection in Manager OpenAPI audit alert rule list endpoint (critical 9.8)
- [CVE-2026-63035](https://insights.sbomify.com/CVE-2026-63035/): o6 Automation open62541 Use After Free (high 7.2)
- [CVE-2026-63033](https://insights.sbomify.com/CVE-2026-63033/): MZ Automation lib60870 Out-of-bounds Read (medium 6.9)
- [CVE-2026-63030](https://insights.sbomify.com/CVE-2026-63030/): WordPress Core Interpretation Conflict (critical 9.8, exploited in the wild)
- [CVE-2026-6303](https://insights.sbomify.com/CVE-2026-6303/): Use after free in Chrome (high 8.8)
- [CVE-2026-63021](https://insights.sbomify.com/CVE-2026-63021/): Gitea Swift package manifest memory exhaustion (medium 6.5)
- [CVE-2026-63020](https://insights.sbomify.com/CVE-2026-63020/): BIG-IP Configuration utility vulnerability (low 2.3)
- [CVE-2026-6302](https://insights.sbomify.com/CVE-2026-6302/): Use after free in Chrome (high 8.8)
- [CVE-2026-63016](https://insights.sbomify.com/CVE-2026-63016/): Apache InLong: Ordinary users can create new packages (medium 5.3)
- [CVE-2026-63015](https://insights.sbomify.com/CVE-2026-63015/): Apache InLong: Non-template responsible persons can view template information (medium 4.3)
- [CVE-2026-6301](https://insights.sbomify.com/CVE-2026-6301/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-63006](https://insights.sbomify.com/CVE-2026-63006/): Zammad: HTML sanitizer API path allowlist bypass via interior path traversal in img src/srcset (medium 5.3)
- [CVE-2026-63004](https://insights.sbomify.com/CVE-2026-63004/): Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers (medium 5.5)
- [CVE-2026-63003](https://insights.sbomify.com/CVE-2026-63003/): django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass) (medium 6.5)
- [CVE-2026-63002](https://insights.sbomify.com/CVE-2026-63002/): REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames (medium 4.8)
- [CVE-2026-63001](https://insights.sbomify.com/CVE-2026-63001/): REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()` (medium 4.8)
- [CVE-2026-63000](https://insights.sbomify.com/CVE-2026-63000/): REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates (medium 6.4)
- [CVE-2026-6300](https://insights.sbomify.com/CVE-2026-6300/): Use after free in Chrome (high 8.8)
- [CVE-2026-62999](https://insights.sbomify.com/CVE-2026-62999/): Path traversal in copier (high 7.5)
- [CVE-2026-62998](https://insights.sbomify.com/CVE-2026-62998/): REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration (medium 4.3)
- [CVE-2026-62997](https://insights.sbomify.com/CVE-2026-62997/): Kedro-Datasets: Remote code execution in experimental `PyTorchDataset` via unsafe `torch.load` (high 7.7)
- [CVE-2026-62996](https://insights.sbomify.com/CVE-2026-62996/): Smarty Security stream restriction bypass through stream: resource (medium 6.9)
- [CVE-2026-62995](https://insights.sbomify.com/CVE-2026-62995/): joserfc accepts JWT with padding, leading to JWT malleability (low 2.3)
- [CVE-2026-62994](https://insights.sbomify.com/CVE-2026-62994/): CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin (low 3.7)
- [CVE-2026-62993](https://insights.sbomify.com/CVE-2026-62993/): Smarty: SSRF via redirect bypass of trusted_uri using {fetch} (medium 6.9)
- [CVE-2026-62992](https://insights.sbomify.com/CVE-2026-62992/): Smarty: Symlink path traversal out of trusted directories (medium 6.9)
- [CVE-2026-6299](https://insights.sbomify.com/CVE-2026-6299/): Use after free in Chrome (high 8.8)
- [CVE-2026-62988](https://insights.sbomify.com/CVE-2026-62988/): Froxlor: Credential and 2FA secret disclosure via Froxlor API endpoints (critical 9.0)
- [CVE-2026-62987](https://insights.sbomify.com/CVE-2026-62987/): Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection header (medium 5.8)
- [CVE-2026-62986](https://insights.sbomify.com/CVE-2026-62986/): OpenEXR: PyOpenEXR deep prefixed RGB stale lane disclosure (medium 4.3)
- [CVE-2026-62985](https://insights.sbomify.com/CVE-2026-62985/): request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js process (high 7.5)
- [CVE-2026-62982](https://insights.sbomify.com/CVE-2026-62982/): Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection (high 8.8)
- [CVE-2026-6298](https://insights.sbomify.com/CVE-2026-6298/): Memory corruption in Chrome (medium 4.3)
- [CVE-2026-6297](https://insights.sbomify.com/CVE-2026-6297/): Use after free in Chrome (high 8.3)
- [CVE-2026-62963](https://insights.sbomify.com/CVE-2026-62963/): Centrifugo: Decompression bomb DoS via permessage-deflate in unidirectional WebSocket transport (high 8.7)
- [CVE-2026-62960](https://insights.sbomify.com/CVE-2026-62960/): Git for Windows: Server-advertised bundle-uri can trigger outbound SMB callbacks via UNC and file:// paths on Windows (high 7.4)
- [CVE-2026-6296](https://insights.sbomify.com/CVE-2026-6296/): Memory corruption in Chrome (critical 9.6)
- [CVE-2026-62959](https://insights.sbomify.com/CVE-2026-62959/): Coturn: Pre-authentication heap memory disclosure in ACME redirect (`try_acme_redirect`) (high 8.2)
- [CVE-2026-6295](https://insights.sbomify.com/CVE-2026-6295/): WP Optimizer <= 2.5.0 - Authenticated (Administrator+) SQL Injection via 's' Parameter (medium 4.9)
- [CVE-2026-62949](https://insights.sbomify.com/CVE-2026-62949/): AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATION (medium 6.5)
- [CVE-2026-62948](https://insights.sbomify.com/CVE-2026-62948/): Cross-site scripting in openwrt (critical 9.6)
- [CVE-2026-62947](https://insights.sbomify.com/CVE-2026-62947/): OpenWrt: ACL bypass and arbitrary root file read via cgi-io cgi-download (medium 4.9)
- [CVE-2026-62946](https://insights.sbomify.com/CVE-2026-62946/): ImageMagick: Integer Overflow in JNX decoder causes heap buffer over-write when processing extremly large files on 32-bit builds (medium 5.1)
- [CVE-2026-62945](https://insights.sbomify.com/CVE-2026-62945/): TREK: Cross-trip reservation title disclosure via file links (medium 4.3)
- [CVE-2026-62943](https://insights.sbomify.com/CVE-2026-62943/): btrbk: SSH Command Filter Bypass in ssh_filter_btrbk.sh (high 8.7)
- [CVE-2026-62941](https://insights.sbomify.com/CVE-2026-62941/): Incus: Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge (critical 9.9)
- [CVE-2026-62940](https://insights.sbomify.com/CVE-2026-62940/): Incus has a project restriction bypass via instance migration config override (critical 9.9)
- [CVE-2026-6294](https://insights.sbomify.com/CVE-2026-6294/): Google PageRank Display <= 1.4 - Cross-Site Request Forgery to Settings Update via Settings Page (medium 4.3)
- [CVE-2026-6293](https://insights.sbomify.com/CVE-2026-6293/): Cross-site request forgery in Inquiry form to posts or pages (medium 4.3)
- [CVE-2026-62928](https://insights.sbomify.com/CVE-2026-62928/): Command injection in XING CPTrans-ME-X (critical 9.3)
- [CVE-2026-62927](https://insights.sbomify.com/CVE-2026-62927/): Missing authorization in Eclipse Milo (high 8.7)
- [CVE-2026-62925](https://insights.sbomify.com/CVE-2026-62925/): Gitea Alpine package parsing memory exhaustion (medium 6.5)
- [CVE-2026-6292](https://insights.sbomify.com/CVE-2026-6292/): MP Customize Login Page <= 1.0 - Cross-Site Request Forgery to Settings Update (medium 4.3)
- [CVE-2026-62918](https://insights.sbomify.com/CVE-2026-62918/): Microsoft Teams Spoofing Vulnerability (high 7.5)
- [CVE-2026-62917](https://insights.sbomify.com/CVE-2026-62917/): Microsoft SharePoint Server Spoofing Vulnerability (medium 4.6)
- [CVE-2026-62916](https://insights.sbomify.com/CVE-2026-62916/): Microsoft Entra ID Elevation of Privilege Vulnerability (critical 9.1)
- [CVE-2026-62915](https://insights.sbomify.com/CVE-2026-62915/): Microsoft Exchange Server Security Feature Bypass Vulnerability (medium 6.5)
- [CVE-2026-62914](https://insights.sbomify.com/CVE-2026-62914/): Microsoft Exchange Server Spoofing Vulnerability (high 7.3)
- [CVE-2026-62913](https://insights.sbomify.com/CVE-2026-62913/): Microsoft Exchange Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-62912](https://insights.sbomify.com/CVE-2026-62912/): Microsoft Exchange Server Denial of Service Vulnerability (medium 6.5)
- [CVE-2026-62911](https://insights.sbomify.com/CVE-2026-62911/): Microsoft Exchange Server Elevation of Privilege Vulnerability (high 8.0)
- [CVE-2026-62910](https://insights.sbomify.com/CVE-2026-62910/): Microsoft Exchange Server Elevation of Privilege Vulnerability (high 7.2)
- [CVE-2026-6291](https://insights.sbomify.com/CVE-2026-6291/): Bleichenbacher padding oracle in PKCS#7 KTRI RSA PKCS#1 v1.5 decryption (medium 6.0)
- [CVE-2026-62909](https://insights.sbomify.com/CVE-2026-62909/): .NET Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-62908](https://insights.sbomify.com/CVE-2026-62908/): Windows Backup Engine Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-62906](https://insights.sbomify.com/CVE-2026-62906/): Microsoft Discovery Studio Information Disclosure Vulnerability (high 7.4)
- [CVE-2026-62904](https://insights.sbomify.com/CVE-2026-62904/): Microsoft Edge (Chromium-based) Information Disclosure Vulnerability (medium 5.4)
- [CVE-2026-62902](https://insights.sbomify.com/CVE-2026-62902/): .NET Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-62901](https://insights.sbomify.com/CVE-2026-62901/): .NET Denial of Service Vulnerability (high 7.5)
- [CVE-2026-62900](https://insights.sbomify.com/CVE-2026-62900/): .NET Information Disclosure Vulnerability (medium 5.9)
- [CVE-2026-6290](https://insights.sbomify.com/CVE-2026-6290/): Velociraptor Query() Plugin Misapplies Permissions To Orgs (high 8.0)
- [CVE-2026-62899](https://insights.sbomify.com/CVE-2026-62899/): .NET Security Feature Bypass Vulnerability (medium 5.9)
- [CVE-2026-62898](https://insights.sbomify.com/CVE-2026-62898/): Microsoft QUIC Information Disclosure Vulnerability (high 7.5)
- [CVE-2026-62897](https://insights.sbomify.com/CVE-2026-62897/): .NET Framework Remote Code Execution Vulnerability (high 7.0)
- [CVE-2026-62896](https://insights.sbomify.com/CVE-2026-62896/): Microsoft Teams Elevation of Privilege Vulnerability (critical 9.6)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/482/