# Vulnerabilities published in 2026


- [CVE-2026-58593](https://insights.sbomify.com/CVE-2026-58593/): NodeBB - ActivityPub Author Spoofing via Unvalidated attributedTo Mapped to Local User (high 8.7)
- [CVE-2026-58592](https://insights.sbomify.com/CVE-2026-58592/): Ladybird - Web-Reachable Code Execution via Dangling FunctionType Reference in WebAssembly ESM Integration (high 8.9)
- [CVE-2026-58591](https://insights.sbomify.com/CVE-2026-58591/): Colorbox - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-069 (medium 5.4)
- [CVE-2026-58590](https://insights.sbomify.com/CVE-2026-58590/): FlowDrop - Moderately critical - Access bypass - SA-CONTRIB-2026-068 (medium 5.4)
- [CVE-2026-5859](https://insights.sbomify.com/CVE-2026-5859/): Integer overflow in Chrome (high 8.8)
- [CVE-2026-58589](https://insights.sbomify.com/CVE-2026-58589/): FlowDrop - Moderately critical - Access bypass - SA-CONTRIB-2026-067 (medium 5.4)
- [CVE-2026-58588](https://insights.sbomify.com/CVE-2026-58588/): Drupal Canvas - Moderately critical - Improper validation - SA-CONTRIB-2026-066 (medium 6.1)
- [CVE-2026-58587](https://insights.sbomify.com/CVE-2026-58587/): Drupal Canvas - Moderately critical - Improper validation - SA-CONTRIB-2026-065 (medium 6.1)
- [CVE-2026-58586](https://insights.sbomify.com/CVE-2026-58586/): Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp (critical 9.8)
- [CVE-2026-58583](https://insights.sbomify.com/CVE-2026-58583/): FluxInk Color Management Driver local privilege escalation (high 8.4)
- [CVE-2026-58580](https://insights.sbomify.com/CVE-2026-58580/): LobeChat 2.2.9 - Broken Object-Level Authorization in Message Sub-Resource Writes (medium 6.0)
- [CVE-2026-5858](https://insights.sbomify.com/CVE-2026-5858/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-58579](https://insights.sbomify.com/CVE-2026-58579/): RAGFlow < 0.26.3 - Stored Cross-Site Scripting via Agent Pipeline Node Name (medium 5.1)
- [CVE-2026-58578](https://insights.sbomify.com/CVE-2026-58578/): LobeChat < 2.2.10-canary.15 - Regular Expression Denial of Service in GitHub Skill Import (high 7.1)
- [CVE-2026-58575](https://insights.sbomify.com/CVE-2026-58575/): Auth bypass in PowerStore 1000T (high 8.8)
- [CVE-2026-58574](https://insights.sbomify.com/CVE-2026-58574/): Missing authorization in PowerStore 1000T (critical 9.8)
- [CVE-2026-58572](https://insights.sbomify.com/CVE-2026-58572/): Code injection in PowerStore 1000T (high 8.8)
- [CVE-2026-58571](https://insights.sbomify.com/CVE-2026-58571/): Command injection in PowerStore 1000T (high 8.8)
- [CVE-2026-5857](https://insights.sbomify.com/CVE-2026-5857/): Contiki-NG MQTT Client Out-of-Bounds Write in PUBLISH Topic Parser via Persistent State Between TCP Segments (critical 9.2)
- [CVE-2026-58569](https://insights.sbomify.com/CVE-2026-58569/): Privilege escalation in PowerStore 1000T (high 8.8)
- [CVE-2026-58567](https://insights.sbomify.com/CVE-2026-58567/): Command injection in PowerStore 1000T (high 8.8)
- [CVE-2026-58566](https://insights.sbomify.com/CVE-2026-58566/): Privilege escalation in PowerStore 1000T (high 8.8)
- [CVE-2026-58565](https://insights.sbomify.com/CVE-2026-58565/): Missing authorization in Dell Command Update (DCU) (high 8.8)
- [CVE-2026-58564](https://insights.sbomify.com/CVE-2026-58564/): Misconfiguration in Dell Command Update (DCU) (high 7.8)
- [CVE-2026-58562](https://insights.sbomify.com/CVE-2026-58562/): Missing authorization in Dell Command Update (DCU) (high 7.3)
- [CVE-2026-58561](https://insights.sbomify.com/CVE-2026-58561/): Null dereference in HarmonyOS (medium 4.0)
- [CVE-2026-58560](https://insights.sbomify.com/CVE-2026-58560/): Null dereference in HarmonyOS (medium 4.0)
- [CVE-2026-5856](https://insights.sbomify.com/CVE-2026-5856/): Contiki-NG DNS/mDNS Resolver Out-of-Bounds Read via Unchecked skip_name Traversal Before Transaction-ID Validation (high 7.1)
- [CVE-2026-58559](https://insights.sbomify.com/CVE-2026-58559/): Denial of service in EMUI (medium 6.5)
- [CVE-2026-58558](https://insights.sbomify.com/CVE-2026-58558/): Missing authorization in EMUI (high 7.8)
- [CVE-2026-58557](https://insights.sbomify.com/CVE-2026-58557/): Denial of service in HarmonyOS (medium 4.8)
- [CVE-2026-58556](https://insights.sbomify.com/CVE-2026-58556/): Missing authorization in EMUI (medium 5.1)
- [CVE-2026-58555](https://insights.sbomify.com/CVE-2026-58555/): Security feature bypass in HarmonyOS (medium 6.6)
- [CVE-2026-58554](https://insights.sbomify.com/CVE-2026-58554/): Missing authorization in EMUI (medium 6.6)
- [CVE-2026-58553](https://insights.sbomify.com/CVE-2026-58553/): Memory corruption in HarmonyOS (medium 4.0)
- [CVE-2026-58552](https://insights.sbomify.com/CVE-2026-58552/): Memory corruption in HarmonyOS (medium 5.1)
- [CVE-2026-58551](https://insights.sbomify.com/CVE-2026-58551/): Memory corruption in HarmonyOS (medium 5.1)
- [CVE-2026-58550](https://insights.sbomify.com/CVE-2026-58550/): Memory corruption in HarmonyOS (medium 4.0)
- [CVE-2026-5855](https://insights.sbomify.com/CVE-2026-5855/): Contiki-NG LwM2M TLV Parser Out-of-Bounds Read via Unchecked Buffer Length in lwm2m_tlv_read (high 8.7)
- [CVE-2026-58549](https://insights.sbomify.com/CVE-2026-58549/): Memory corruption in HarmonyOS (medium 4.0)
- [CVE-2026-58547](https://insights.sbomify.com/CVE-2026-58547/): Windows Universal Plug and Play (UPnP) Device Host Elevation of Privilege Vulnerability (medium 5.5)
- [CVE-2026-58546](https://insights.sbomify.com/CVE-2026-58546/): Windows Remote Desktop Client Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-58545](https://insights.sbomify.com/CVE-2026-58545/): Windows Kernel Security Feature Bypass Vulnerability (medium 5.5)
- [CVE-2026-58544](https://insights.sbomify.com/CVE-2026-58544/): Windows Management Services Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-58543](https://insights.sbomify.com/CVE-2026-58543/): Universal Print Management Service Elevation of Privilege Vulnerability (medium 6.3)
- [CVE-2026-58542](https://insights.sbomify.com/CVE-2026-58542/): Windows Media Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-58541](https://insights.sbomify.com/CVE-2026-58541/): Microsoft DWM Core Library Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-58540](https://insights.sbomify.com/CVE-2026-58540/): Windows Installer Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-5854](https://insights.sbomify.com/CVE-2026-5854/): Totolink A7100RU CGI cstecgi.cgi setWiFiEasyCfg os command injection (critical 9.3)
- [CVE-2026-58539](https://insights.sbomify.com/CVE-2026-58539/): Windows Remote Desktop Client Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-58538](https://insights.sbomify.com/CVE-2026-58538/): Windows Bluetooth Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-58537](https://insights.sbomify.com/CVE-2026-58537/): Microsoft NAT Helper Components (ipnathlp.dll) Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-58536](https://insights.sbomify.com/CVE-2026-58536/): Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-58535](https://insights.sbomify.com/CVE-2026-58535/): Windows Remote Desktop Client Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-58534](https://insights.sbomify.com/CVE-2026-58534/): Windows Input Method Editor (IME) Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-58533](https://insights.sbomify.com/CVE-2026-58533/): Windows Remote Desktop Client Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-58532](https://insights.sbomify.com/CVE-2026-58532/): Windows Kernel Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-58531](https://insights.sbomify.com/CVE-2026-58531/): Windows SMB Elevation of Privilege Vulnerability (high 7.5)
- [CVE-2026-58530](https://insights.sbomify.com/CVE-2026-58530/): Windows Resilient File System (ReFS) Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-5853](https://insights.sbomify.com/CVE-2026-5853/): Totolink A7100RU CGI cstecgi.cgi setIpv6LanCfg os command injection (critical 9.3)
- [CVE-2026-58529](https://insights.sbomify.com/CVE-2026-58529/): Windows Active Directory Federation Services (ADFS) Information Disclosure Vulnerability (high 7.1)
- [CVE-2026-58528](https://insights.sbomify.com/CVE-2026-58528/): Windows USB Audio Class Driver Information Disclosure Vulnerability (medium 6.8)
- [CVE-2026-58527](https://insights.sbomify.com/CVE-2026-58527/): Windows Runtime Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-58526](https://insights.sbomify.com/CVE-2026-58526/): Windows Storage Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-58525](https://insights.sbomify.com/CVE-2026-58525/): Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability (high 8.2)
- [CVE-2026-58524](https://insights.sbomify.com/CVE-2026-58524/): Microsoft Edge (Chromium-based) Spoofing Vulnerability (medium 5.4)
- [CVE-2026-58523](https://insights.sbomify.com/CVE-2026-58523/): Microsoft Edge for Android Security Feature Bypass Vulnerability (medium 6.5)
- [CVE-2026-58522](https://insights.sbomify.com/CVE-2026-58522/): Microsoft Edge for Android Information Disclosure Vulnerability (medium 6.8)
- [CVE-2026-58521](https://insights.sbomify.com/CVE-2026-58521/): SQLi in Cargo extension via year range filter (medium 6.9)
- [CVE-2026-58520](https://insights.sbomify.com/CVE-2026-58520/): UrlShortener defaults to ineffective validation open to third-party redirects (medium 6.9)
- [CVE-2026-5852](https://insights.sbomify.com/CVE-2026-5852/): Totolink A7100RU CGI cstecgi.cgi setIptvCfg os command injection (critical 9.3)
- [CVE-2026-58519](https://insights.sbomify.com/CVE-2026-58519/): Stored XSS through Cargo's map format (medium 6.9)
- [CVE-2026-58518](https://insights.sbomify.com/CVE-2026-58518/): Cross-site request forgery in Mediawiki - RedirectManager Extension (medium 6.9)
- [CVE-2026-58517](https://insights.sbomify.com/CVE-2026-58517/): Blocked users can create and edit WikiLambda objects (medium 6.9)
- [CVE-2026-58511](https://insights.sbomify.com/CVE-2026-58511/): Webhook Authorization Header Returned in Plaintext via API (low 2.7)
- [CVE-2026-58510](https://insights.sbomify.com/CVE-2026-58510/): Gitea: GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private (medium 4.3)
- [CVE-2026-5851](https://insights.sbomify.com/CVE-2026-5851/): Totolink A7100RU CGI cstecgi.cgi setUPnPCfg os command injection (critical 9.3)
- [CVE-2026-58508](https://insights.sbomify.com/CVE-2026-58508/): Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation) (critical 9.1)
- [CVE-2026-58507](https://insights.sbomify.com/CVE-2026-58507/): Private Repository Existence Disclosure via go-get Meta Endpoint (medium 5.3)
- [CVE-2026-58504](https://insights.sbomify.com/CVE-2026-58504/): draw.io: Stored XSS on file open via editable=0 sibling cell — patch bypass of CVE-2026-46642 (medium 6.1)
- [CVE-2026-58503](https://insights.sbomify.com/CVE-2026-58503/): Frappe: Unauthenticated User Enumeration via reset_password (medium 6.9)
- [CVE-2026-58502](https://insights.sbomify.com/CVE-2026-58502/): githubtoplanguages: Command Injection via Issue Title in Discord Notification Workflow (high 7.1)
- [CVE-2026-58501](https://insights.sbomify.com/CVE-2026-58501/): Zeep SSRF because Settings.forbid_external is not enforced (medium 5.9)
- [CVE-2026-58500](https://insights.sbomify.com/CVE-2026-58500/): MCP Appium: Unescaped Locator Data XSS in MCP-UI Resource (createLocatorGeneratorUI) (high 8.2)
- [CVE-2026-5850](https://insights.sbomify.com/CVE-2026-5850/): Totolink A7100RU CGI cstecgi.cgi setVpnPassCfg os command injection (critical 9.3)
- [CVE-2026-58499](https://insights.sbomify.com/CVE-2026-58499/): Path traversal in EverOS /api/v1/memory/add via unvalidated sender_id (high 8.2)
- [CVE-2026-58497](https://insights.sbomify.com/CVE-2026-58497/): Uni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requests (high 8.6)
- [CVE-2026-58496](https://insights.sbomify.com/CVE-2026-58496/): ThorVG: Out-of-bounds Read in SFNT/TTF Font Loader via Memory API (medium 4.3)
- [CVE-2026-58494](https://insights.sbomify.com/CVE-2026-58494/): Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination (medium 6.5)
- [CVE-2026-58493](https://insights.sbomify.com/CVE-2026-58493/): grav-plugin-database: DSN Parameter Injection via Unsanitized Configuration Values in Connection String Construction (medium 5.1)
- [CVE-2026-58492](https://insights.sbomify.com/CVE-2026-58492/): grav-plugin-database: SQL Injection in PDO::tableExists() due to Unsanitized Table Name Interpolation (critical 9.2)
- [CVE-2026-58491](https://insights.sbomify.com/CVE-2026-58491/): Warpgate: Reflected XSS in SSO return endpoint via attacker-controlled next parameter (critical 9.3)
- [CVE-2026-5849](https://insights.sbomify.com/CVE-2026-5849/): Tenda i12 HTTP path traversal (medium 6.9)
- [CVE-2026-58489](https://insights.sbomify.com/CVE-2026-58489/): HedgeDoc: CSRF in GitHub Gist export callback (medium 6.8)
- [CVE-2026-58488](https://insights.sbomify.com/CVE-2026-58488/): HedgeDoc: Rate-limit bypass via CF-Connecting-IP header spoofing (medium 6.9)
- [CVE-2026-58487](https://insights.sbomify.com/CVE-2026-58487/): HedgeDoc: Stored HTML injection via email local-part (medium 5.1)
- [CVE-2026-58486](https://insights.sbomify.com/CVE-2026-58486/): HedgeDoc: Denial-of-service via YAML alias expansion in note frontmatter (high 8.3)
- [CVE-2026-58485](https://insights.sbomify.com/CVE-2026-58485/): mcp-searxng: DNS-resolved Private Hostname SSRF in `web_url_read` (high 7.1)
- [CVE-2026-58484](https://insights.sbomify.com/CVE-2026-58484/): Network-AI: Poisoned environment backup manifest allows arbitrary recursive deletion during backup pruning (high 7.1)
- [CVE-2026-58483](https://insights.sbomify.com/CVE-2026-58483/): mcp-searxng: Unbounded Response Body Read Bypasses URL Size Limit in `web_url_read` (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/517/