# Vulnerabilities published in 2026


- [CVE-2026-59502](https://insights.sbomify.com/CVE-2026-59502/): Priority - CWE-203: Observable Discrepancy (medium 5.3)
- [CVE-2026-59501](https://insights.sbomify.com/CVE-2026-59501/): Priority – CWE-284: Improper Access Control (high 8.2)
- [CVE-2026-59500](https://insights.sbomify.com/CVE-2026-59500/): Priority - CWE-287: Improper Authentication (critical 10.0)
- [CVE-2026-5950](https://insights.sbomify.com/CVE-2026-5950/): Unbounded resend loop in BIND 9 resolver (medium 5.3)
- [CVE-2026-59499](https://insights.sbomify.com/CVE-2026-59499/): Priority – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor (high 8.6)
- [CVE-2026-5947](https://insights.sbomify.com/CVE-2026-5947/): SIG(0) validation during query flood may lead to undefined behavior (high 7.5)
- [CVE-2026-5946](https://insights.sbomify.com/CVE-2026-5946/): Invalid handling of CLASS != IN (high 7.5)
- [CVE-2026-5944](https://insights.sbomify.com/CVE-2026-5944/): Cisco Intersight Device Connector for Nutanix Prism Central Unauthenticated API Access (medium 6.7)
- [CVE-2026-5943](https://insights.sbomify.com/CVE-2026-5943/): Foxit PDF Editor/Reader AcroForm Annotation Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-5942](https://insights.sbomify.com/CVE-2026-5942/): Foxit PDF Editor/Reader AcroForm Signature Use-After-Free Vulnerability (medium 5.5)
- [CVE-2026-5941](https://insights.sbomify.com/CVE-2026-5941/): Foxit PDF Editor/Reader AcroForm Signature Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-5940](https://insights.sbomify.com/CVE-2026-5940/): Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-5939](https://insights.sbomify.com/CVE-2026-5939/): UAF in Foxit PDF Editor/Reader via XFA calculate event (medium 5.5)
- [CVE-2026-5938](https://insights.sbomify.com/CVE-2026-5938/): Foxit PDF Editor/Reader Infinite Loop Denial-of-Service Vulnerability (medium 5.5)
- [CVE-2026-5937](https://insights.sbomify.com/CVE-2026-5937/): Foxit PDF Editor/Reader's insufficient parameter validation leads to denial-of-service vulnerability (medium 5.5)
- [CVE-2026-5936](https://insights.sbomify.com/CVE-2026-5936/): Server-Side Request Forgery (SSRF) via URL Parameter in Foxit PDF Services API (high 8.5)
- [CVE-2026-59358](https://insights.sbomify.com/CVE-2026-59358/): UAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant type (high 7.6)
- [CVE-2026-59357](https://insights.sbomify.com/CVE-2026-59357/): Self-UAA OIDC Configuration allows JWT injection to establish unauthorized sessions (medium 6.5)
- [CVE-2026-59355](https://insights.sbomify.com/CVE-2026-59355/): Spring Authorization Server: Open Redirect via request_uri parameter (medium 6.1)
- [CVE-2026-59354](https://insights.sbomify.com/CVE-2026-59354/): Spring Security OAuth2 Authorization Server: Insufficient validation of Dynamic Client Registration metadata (critical 9.6)
- [CVE-2026-5935](https://insights.sbomify.com/CVE-2026-5935/): TSSC/IMC is vulnerable to OS Command Injection (high 7.3)
- [CVE-2026-59347](https://insights.sbomify.com/CVE-2026-59347/): VMware Workstation and Fusion HGFS stack-based buffer-overflow vulnerability (high 8.1)
- [CVE-2026-59346](https://insights.sbomify.com/CVE-2026-59346/): VMware Workstation and Fusion VMXNET3 integer-overflow vulnerability (critical 9.3)
- [CVE-2026-59341](https://insights.sbomify.com/CVE-2026-59341/): Sealed Secrets: decryption oracle via Go template injection in unauthenticated controller endpoints (medium 4.2)
- [CVE-2026-5934](https://insights.sbomify.com/CVE-2026-5934/): Cross-site scripting in WP Rocket (high 7.2)
- [CVE-2026-59335](https://insights.sbomify.com/CVE-2026-59335/): Case-Sensitive Authorization Check Bypass via Identity Zone ID Case Manipulation Leads to Full UAA Compromise (high 8.7)
- [CVE-2026-59328](https://insights.sbomify.com/CVE-2026-59328/): Cross-Site Scripting in Eclipse Spring Boot Starter Wizard Dependency Tooltips (medium 4.2)
- [CVE-2026-59327](https://insights.sbomify.com/CVE-2026-59327/): Cleartext Storage of Spring Boot DevTools Remote Secret in Eclipse Launch Configurations (medium 4.4)
- [CVE-2026-59326](https://insights.sbomify.com/CVE-2026-59326/): HTTP Proxy Credentials Logged in Plaintext by the Spring Boot Language Server (low 3.3)
- [CVE-2026-59324](https://insights.sbomify.com/CVE-2026-59324/): fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction (high 8.2)
- [CVE-2026-59323](https://insights.sbomify.com/CVE-2026-59323/): Micrometer Tracing Brave Bridge W3C Baggage propagation DoS vulnerability (medium 5.3)
- [CVE-2026-59322](https://insights.sbomify.com/CVE-2026-59322/): EmbeddedHeadersJsonMessageMapper default gives wire peer full control of MessageHeaders (medium 6.3)
- [CVE-2026-59321](https://insights.sbomify.com/CVE-2026-59321/): Shared JSR-223 ScriptEngine evaluated concurrently without THREADING check (medium 4.2)
- [CVE-2026-59320](https://insights.sbomify.com/CVE-2026-59320/): In Spring AMQP the link credit never replenished on listener exception path (medium 6.5)
- [CVE-2026-59319](https://insights.sbomify.com/CVE-2026-59319/): RediSearch Tag Injection in RedisChatMemoryRepository Allows Cross-Conversation Data Exposure (medium 4.3)
- [CVE-2026-59318](https://insights.sbomify.com/CVE-2026-59318/): DefaultToolCallingManager Global Resolver Fallback Allows Unadvertised Tool Dispatch via Prompt Injection (medium 6.5)
- [CVE-2026-59317](https://insights.sbomify.com/CVE-2026-59317/): Denial of service in Spring for Apache Kafka (medium 6.5)
- [CVE-2026-59316](https://insights.sbomify.com/CVE-2026-59316/): Spring Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS) (high 8.2)
- [CVE-2026-59315](https://insights.sbomify.com/CVE-2026-59315/): Spring Cloud Config Monitor Denial of Service (medium 5.3)
- [CVE-2026-59314](https://insights.sbomify.com/CVE-2026-59314/): Spring Framework response splitting in ContentDisposition (low 3.7)
- [CVE-2026-59313](https://insights.sbomify.com/CVE-2026-59313/): Server Sent Event stream corruption in Spring MVC functional web framework (critical 9.8)
- [CVE-2026-59311](https://insights.sbomify.com/CVE-2026-59311/): Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creation (medium 6.8)
- [CVE-2026-59310](https://insights.sbomify.com/CVE-2026-59310/): Broadcom VMware vCenter Path Traversal (critical 9.8, exploited in the wild)
- [CVE-2026-59309](https://insights.sbomify.com/CVE-2026-59309/): vCenter authentication-bypass vulnerability (critical 9.8)
- [CVE-2026-59308](https://insights.sbomify.com/CVE-2026-59308/): Semantic Cache Cross-Tenant Isolation Bypass via SHA-256 Truncation (medium 4.2)
- [CVE-2026-59307](https://insights.sbomify.com/CVE-2026-59307/): Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference (high 8.0)
- [CVE-2026-59306](https://insights.sbomify.com/CVE-2026-59306/): Potential for deserialization of untrusted types in Spring Cloud Stream (low 3.1)
- [CVE-2026-59305](https://insights.sbomify.com/CVE-2026-59305/): Partition interceptor may be improperly added while sending message (low 3.1)
- [CVE-2026-59304](https://insights.sbomify.com/CVE-2026-59304/): Improper caching of the original content type in Spring Cloud Stream Avro (low 3.1)
- [CVE-2026-59303](https://insights.sbomify.com/CVE-2026-59303/): Dynamic destination cache size is not properly bound in Spring Cloud Stream (low 3.1)
- [CVE-2026-59302](https://insights.sbomify.com/CVE-2026-59302/): Potential for logging sensitive data in Spring Cloud Stream (low 3.1)
- [CVE-2026-59301](https://insights.sbomify.com/CVE-2026-59301/): Potential for logging sensitive data in Spring Cloud Function Azure (low 3.1)
- [CVE-2026-59300](https://insights.sbomify.com/CVE-2026-59300/): Potential for logging sensitive data in Spring Cloud Function AWS (low 3.1)
- [CVE-2026-59299](https://insights.sbomify.com/CVE-2026-59299/): Composition lookup can potentially poison base function in Spring Cloud Function (low 3.1)
- [CVE-2026-59298](https://insights.sbomify.com/CVE-2026-59298/): Potential for improper filtering of HTTP headers in Spring Cloud Function (low 3.1)
- [CVE-2026-59297](https://insights.sbomify.com/CVE-2026-59297/): Spring Cloud Function can incorrectly determine if URI is secure (low 3.1)
- [CVE-2026-59296](https://insights.sbomify.com/CVE-2026-59296/): Micrometer StatsD and Logging meter registries line-protocol and log injection vulnerability (medium 5.9)
- [CVE-2026-59295](https://insights.sbomify.com/CVE-2026-59295/): Micrometer instrumentation of Apache HttpAsyncClient DoS vulnerability (medium 5.9)
- [CVE-2026-59294](https://insights.sbomify.com/CVE-2026-59294/): Arbitrary File Write via Path Traversal in ResourceCacheService (medium 5.9)
- [CVE-2026-59293](https://insights.sbomify.com/CVE-2026-59293/): SMB minimum protocol dialect defaults to SMB1 (medium 6.6)
- [CVE-2026-59292](https://insights.sbomify.com/CVE-2026-59292/): World-readable metadata file in PropertiesPersistingMetadataStore (insecure temp-file permissions) (low 3.2)
- [CVE-2026-59291](https://insights.sbomify.com/CVE-2026-59291/): Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function (low 2.0)
- [CVE-2026-59289](https://insights.sbomify.com/CVE-2026-59289/): Spring for GraphQL Denial of Service via pagination support (high 7.5)
- [CVE-2026-59288](https://insights.sbomify.com/CVE-2026-59288/): Spring for GraphQL Information Exposure in GraphiQL support (high 7.5)
- [CVE-2026-59287](https://insights.sbomify.com/CVE-2026-59287/): Spring for GraphQL WebSocket Client Denial of Service (medium 5.9)
- [CVE-2026-59286](https://insights.sbomify.com/CVE-2026-59286/): Spring for GraphQL loads Untrusted Resources in GraphiQL support (high 8.1)
- [CVE-2026-59285](https://insights.sbomify.com/CVE-2026-59285/): Spring for GraphQL Unsafe Deserialization in pagination support (high 8.1)
- [CVE-2026-59284](https://insights.sbomify.com/CVE-2026-59284/): Spring Cloud Commons no allow list for writable env actuator endpoint (medium 6.6)
- [CVE-2026-59283](https://insights.sbomify.com/CVE-2026-59283/): Spring Framework Safety Guard Bypass via SpEL Expression Compilation (critical 9.1)
- [CVE-2026-59282](https://insights.sbomify.com/CVE-2026-59282/): Spring Framework Denial of Service via Unbounded List Growth in Data Binding (high 7.5)
- [CVE-2026-59281](https://insights.sbomify.com/CVE-2026-59281/): Spring Framework Cross-site Scripting via EscapedErrors (medium 6.1)
- [CVE-2026-59280](https://insights.sbomify.com/CVE-2026-59280/): Spring Framework Path Traversal via Backslash in SpringTemplateLoader (medium 4.3)
- [CVE-2026-5928](https://insights.sbomify.com/CVE-2026-5928/): Potential buffer under-read in ungetwc (high 7.5)
- [CVE-2026-59279](https://insights.sbomify.com/CVE-2026-59279/): Unbounded persistent session allocation via repeated initialize requests (high 7.5)
- [CVE-2026-59278](https://insights.sbomify.com/CVE-2026-59278/): Server-side request forgery in Spring for Apache Kafka (medium 6.5)
- [CVE-2026-59277](https://insights.sbomify.com/CVE-2026-59277/): Spring Security InetAddressMatchers Incomplete Internal Network Classification (low 3.7)
- [CVE-2026-59276](https://insights.sbomify.com/CVE-2026-59276/): Timing Attack via Non-Constant-Time Comparison of Sensitive Values (medium 5.9)
- [CVE-2026-59275](https://insights.sbomify.com/CVE-2026-59275/): Deserialization in Spring AMQP (medium 6.6)
- [CVE-2026-59274](https://insights.sbomify.com/CVE-2026-59274/): Unbounded decompression in UnZipTransformer enables zip-bomb DoS (medium 6.5)
- [CVE-2026-59272](https://insights.sbomify.com/CVE-2026-59272/): Log4j2 AmqpAppender disables TLS hostname verification by default (medium 6.8)
- [CVE-2026-59271](https://insights.sbomify.com/CVE-2026-59271/): Admin password disclosed in BrokerNotAliveException message (medium 5.3)
- [CVE-2026-59270](https://insights.sbomify.com/CVE-2026-59270/): Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces (critical 9.4)
- [CVE-2026-59269](https://insights.sbomify.com/CVE-2026-59269/): Privilege escalation in Pinniped (low 3.8)
- [CVE-2026-59265](https://insights.sbomify.com/CVE-2026-59265/): Apache OpenOffice, Apache OpenOffice: Opening a malicious document can lead to system takeover (high 8.8)
- [CVE-2026-59262](https://insights.sbomify.com/CVE-2026-59262/): AFFiNE - Unauthorized Document Edit History Access via GraphQL histories Field (high 7.1)
- [CVE-2026-59261](https://insights.sbomify.com/CVE-2026-59261/): OpenClaw < 2026.5.28 - Credential Override via Workspace Dotenv Files (high 8.4)
- [CVE-2026-59260](https://insights.sbomify.com/CVE-2026-59260/): OpenWrt luci-app-samba4 read ACL remote code execution via smbd (high 8.7)
- [CVE-2026-5926](https://insights.sbomify.com/CVE-2026-5926/): Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access (medium 6.5)
- [CVE-2026-59259](https://insights.sbomify.com/CVE-2026-59259/): n8n - Permission Bypass via Expression Parser Mismatch in External Secrets (medium 6.0)
- [CVE-2026-59258](https://insights.sbomify.com/CVE-2026-59258/): immich < 3.0.3 Shared Album Editor Ownership Takeover via updateUser (high 7.2)
- [CVE-2026-59257](https://insights.sbomify.com/CVE-2026-59257/): n8n - SQL Injection in MySQL v1 executeQuery Operation via Expression Interpolation (medium 5.3)
- [CVE-2026-59256](https://insights.sbomify.com/CVE-2026-59256/): WWBN AVideo Unbound Token Authorization Bypass via Gallery (high 8.7)
- [CVE-2026-59255](https://insights.sbomify.com/CVE-2026-59255/): BloodHound Missing Authorization on Custom Node Management API (high 7.1)
- [CVE-2026-59254](https://insights.sbomify.com/CVE-2026-59254/): n8n - External Secrets Disclosure via Workflow Node Expressions (medium 6.3)
- [CVE-2026-59253](https://insights.sbomify.com/CVE-2026-59253/): n8n - Improper Authorization in Workflow Assignment to Folders (medium 5.3)
- [CVE-2026-59252](https://insights.sbomify.com/CVE-2026-59252/): Missing gas_limit validation in mpp Tempo fee-payer enables wallet drain (high 8.2)
- [CVE-2026-59251](https://insights.sbomify.com/CVE-2026-59251/): Denial of service via exponential certificate policy tree growth in path validation (high 8.7)
- [CVE-2026-59250](https://insights.sbomify.com/CVE-2026-59250/): Megaco flex scanner buffer overflow via oversized property parm name (high 8.3)
- [CVE-2026-59249](https://insights.sbomify.com/CVE-2026-59249/): Other in mint (medium 6.3)
- [CVE-2026-59248](https://insights.sbomify.com/CVE-2026-59248/): Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS (high 8.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/513/