# Vulnerabilities published in 2026


- [CVE-2026-58373](https://insights.sbomify.com/CVE-2026-58373/): CVAT < 2.69.0 - Missing Authorization on Quality Reports parent_id Filter Leaks Cross-Organization Report Existence (medium 5.3)
- [CVE-2026-58372](https://insights.sbomify.com/CVE-2026-58372/): SeaweedFS < 4.34 - Cross-Bucket Object Deletion via DeleteObjects Request-Body Keys (high 7.2)
- [CVE-2026-58371](https://insights.sbomify.com/CVE-2026-58371/): SeaweedFS < 4.30 - Cross-Origin Information Disclosure via Unvalidated JSONP callback Parameter (low 2.3)
- [CVE-2026-58370](https://insights.sbomify.com/CVE-2026-58370/): Woodpecker < 3.15.0 - GitLab Approval Gate Bypass via Spoofable Commit Author Name (critical 9.2)
- [CVE-2026-5837](https://insights.sbomify.com/CVE-2026-5837/): PHPGurukul News Portal Project news-details.php sql injection (medium 6.9)
- [CVE-2026-58369](https://insights.sbomify.com/CVE-2026-58369/): Null dereference in woodpecker (medium 6.9)
- [CVE-2026-5836](https://insights.sbomify.com/CVE-2026-5836/): code-projects Online Shoe Store admin_product.php cross site scripting (medium 4.8)
- [CVE-2026-5835](https://insights.sbomify.com/CVE-2026-5835/): code-projects Online Shoe Store admin_football.php cross site scripting (medium 4.8)
- [CVE-2026-5834](https://insights.sbomify.com/CVE-2026-5834/): code-projects Online Shoe Store admin_running.php cross site scripting (medium 4.8)
- [CVE-2026-5833](https://insights.sbomify.com/CVE-2026-5833/): awwaiid mcp-server-taskwarrior index.ts server.setRequestHandler command injection (medium 4.8)
- [CVE-2026-5832](https://insights.sbomify.com/CVE-2026-5832/): atototo api-lab-mcp HTTP http-server.ts test_http_endpoint server-side request forgery (medium 6.9)
- [CVE-2026-58319](https://insights.sbomify.com/CVE-2026-58319/): Apache Doris: Improper Authentication in Frontend HTTP API (critical 9.1)
- [CVE-2026-58317](https://insights.sbomify.com/CVE-2026-58317/): Memory corruption in TTSSH2 (medium 5.1)
- [CVE-2026-58315](https://insights.sbomify.com/CVE-2026-58315/): Cross-site request forgery in Web Config (medium 5.1)
- [CVE-2026-58314](https://insights.sbomify.com/CVE-2026-58314/): Two SSRF findings in Gitea 1.26.2 (high 7.7)
- [CVE-2026-5831](https://insights.sbomify.com/CVE-2026-5831/): Agions taskflow-ai terminal_execute handlers.ts os command injection (medium 5.3)
- [CVE-2026-58307](https://insights.sbomify.com/CVE-2026-58307/): Memory corruption in Escargot (medium 6.1)
- [CVE-2026-58306](https://insights.sbomify.com/CVE-2026-58306/): Memory corruption in Escargot (medium 6.1)
- [CVE-2026-58305](https://insights.sbomify.com/CVE-2026-58305/): Memory corruption in Escargot (medium 6.1)
- [CVE-2026-58304](https://insights.sbomify.com/CVE-2026-58304/): Memory corruption in Escargot (medium 6.1)
- [CVE-2026-58303](https://insights.sbomify.com/CVE-2026-58303/): Memory corruption in Escargot (medium 6.1)
- [CVE-2026-58302](https://insights.sbomify.com/CVE-2026-58302/): Privilege escalation in LinuxCNC (high 8.4)
- [CVE-2026-58301](https://insights.sbomify.com/CVE-2026-58301/): Apache Shiro: Server-side POST request may be steered to an alternate host (medium 5.9)
- [CVE-2026-58300](https://insights.sbomify.com/CVE-2026-58300/): Microsoft Edge for Android Information Disclosure Vulnerability (medium 6.2)
- [CVE-2026-5830](https://insights.sbomify.com/CVE-2026-5830/): Tenda AC15 SysToolChangePwd websGetVar stack-based overflow (high 8.7)
- [CVE-2026-58299](https://insights.sbomify.com/CVE-2026-58299/): Microsoft Edge for Android Remote Code Execution Vulnerability (high 7.5)
- [CVE-2026-58298](https://insights.sbomify.com/CVE-2026-58298/): Microsoft Edge (Chromium-based) Spoofing Vulnerability (high 7.2)
- [CVE-2026-58297](https://insights.sbomify.com/CVE-2026-58297/): Microsoft Edge for Android Information Disclosure Vulnerability (high 7.1)
- [CVE-2026-58296](https://insights.sbomify.com/CVE-2026-58296/): Microsoft Edge for Android Information Disclosure Vulnerability (high 7.1)
- [CVE-2026-58295](https://insights.sbomify.com/CVE-2026-58295/): Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability (high 8.3)
- [CVE-2026-58294](https://insights.sbomify.com/CVE-2026-58294/): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (high 7.5)
- [CVE-2026-58293](https://insights.sbomify.com/CVE-2026-58293/): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (high 8.1)
- [CVE-2026-58292](https://insights.sbomify.com/CVE-2026-58292/): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (high 7.5)
- [CVE-2026-58291](https://insights.sbomify.com/CVE-2026-58291/): Microsoft Edge (Chromium-based) Information Disclosure Vulnerability (medium 6.1)
- [CVE-2026-58290](https://insights.sbomify.com/CVE-2026-58290/): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (high 7.5)
- [CVE-2026-5829](https://insights.sbomify.com/CVE-2026-5829/): code-projects Simple IT Discussion Forum content.php sql injection (medium 6.9)
- [CVE-2026-58289](https://insights.sbomify.com/CVE-2026-58289/): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (critical 9.0)
- [CVE-2026-58288](https://insights.sbomify.com/CVE-2026-58288/): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (high 8.3)
- [CVE-2026-58287](https://insights.sbomify.com/CVE-2026-58287/): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (high 8.3)
- [CVE-2026-58286](https://insights.sbomify.com/CVE-2026-58286/): Microsoft Edge (Chromium-based) Spoofing Vulnerability (high 8.1)
- [CVE-2026-58285](https://insights.sbomify.com/CVE-2026-58285/): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (high 8.3)
- [CVE-2026-58284](https://insights.sbomify.com/CVE-2026-58284/): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (high 8.3)
- [CVE-2026-58283](https://insights.sbomify.com/CVE-2026-58283/): Microsoft Edge (Chromium-based) Spoofing Vulnerability (high 8.1)
- [CVE-2026-58282](https://insights.sbomify.com/CVE-2026-58282/): Microsoft Edge (Chromium-based) Spoofing Vulnerability (high 8.1)
- [CVE-2026-58281](https://insights.sbomify.com/CVE-2026-58281/): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (high 8.3)
- [CVE-2026-58280](https://insights.sbomify.com/CVE-2026-58280/): .NET Denial of Service Vulnerability (high 7.5)
- [CVE-2026-5828](https://insights.sbomify.com/CVE-2026-5828/): code-projects Simple IT Discussion Forum addcomment.php sql injection (medium 6.9)
- [CVE-2026-58279](https://insights.sbomify.com/CVE-2026-58279/): Azure CycleCloud Elevation of Privilege Vulnerability (medium 6.5)
- [CVE-2026-58278](https://insights.sbomify.com/CVE-2026-58278/): Microsoft Edge (Chromium-based) Spoofing Vulnerability (medium 5.4)
- [CVE-2026-58277](https://insights.sbomify.com/CVE-2026-58277/): Microsoft SharePoint Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-58276](https://insights.sbomify.com/CVE-2026-58276/): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (high 7.5)
- [CVE-2026-58275](https://insights.sbomify.com/CVE-2026-58275/): Azure DNS Elevation of Privilege Vulnerability (critical 10.0)
- [CVE-2026-58272](https://insights.sbomify.com/CVE-2026-58272/): Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory) (medium 5.3)
- [CVE-2026-58271](https://insights.sbomify.com/CVE-2026-58271/): @sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register` (medium 6.8)
- [CVE-2026-58270](https://insights.sbomify.com/CVE-2026-58270/): Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters` (medium 6.5)
- [CVE-2026-5827](https://insights.sbomify.com/CVE-2026-5827/): code-projects Simple IT Discussion Forum question-function.php sql injection (medium 6.9)
- [CVE-2026-58269](https://insights.sbomify.com/CVE-2026-58269/): Sync-in Server has a complete 2FA Bypass via `POST /api/auth/token` (high 8.1)
- [CVE-2026-58268](https://insights.sbomify.com/CVE-2026-58268/): SIPGO: DoS via unvalidated Content-Length in the stream parser (high 7.5)
- [CVE-2026-58266](https://insights.sbomify.com/CVE-2026-58266/): Anki: User scripts in iframes have access to the internal Anki API (medium 6.5)
- [CVE-2026-58264](https://insights.sbomify.com/CVE-2026-58264/): FluidSynth: Heap-based buffer overrun (critical 9.8)
- [CVE-2026-58263](https://insights.sbomify.com/CVE-2026-58263/): Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier (high 7.2)
- [CVE-2026-58262](https://insights.sbomify.com/CVE-2026-58262/): Klever-Go: PubKeysBitmap padding bits bypass the BLS signature quorum (high 7.1)
- [CVE-2026-5826](https://insights.sbomify.com/CVE-2026-5826/): code-projects Simple IT Discussion Forum edit-category.php cross site scripting (medium 5.3)
- [CVE-2026-58257](https://insights.sbomify.com/CVE-2026-58257/): GRR vulnerable to Arbitrary File Read and Deletion (high 7.2)
- [CVE-2026-58256](https://insights.sbomify.com/CVE-2026-58256/): GRR vulnerable to Remote Code Execution Via PHP Code Injection (critical 9.1)
- [CVE-2026-58255](https://insights.sbomify.com/CVE-2026-58255/): Privilege escalation in Cronicle (high 8.8)
- [CVE-2026-58254](https://insights.sbomify.com/CVE-2026-58254/): NATS Server: Incomplete fix for CVE-2026-33249: Leaf node connections bypass Nats-Trace-Dest permission check (medium 5.3)
- [CVE-2026-58253](https://insights.sbomify.com/CVE-2026-58253/): NATS Server: Route API Auth Bypass (high 8.8)
- [CVE-2026-58252](https://insights.sbomify.com/CVE-2026-58252/): NATS Server: Subscribe Authz Bypass via Wildcard-Overlap (medium 6.5)
- [CVE-2026-58251](https://insights.sbomify.com/CVE-2026-58251/): NATS Server: Queue Subscribe Authz Bypass (medium 6.5)
- [CVE-2026-58250](https://insights.sbomify.com/CVE-2026-58250/): NATS Server: Pre-auth server crash via double INFO in leafnode handshake (high 7.5)
- [CVE-2026-5825](https://insights.sbomify.com/CVE-2026-5825/): code-projects Simple Laundry System delmemberinfo.php cross site scripting (medium 5.3)
- [CVE-2026-58249](https://insights.sbomify.com/CVE-2026-58249/): Memory Corruption vulnerability in SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager) (high 7.5)
- [CVE-2026-58248](https://insights.sbomify.com/CVE-2026-58248/): XML External Entity Injection in SAP BusinessObjects Business Intelligence (medium 6.5)
- [CVE-2026-58247](https://insights.sbomify.com/CVE-2026-58247/): Memory Corruption vulnerability in SAP ABAP Platform (medium 5.3)
- [CVE-2026-58246](https://insights.sbomify.com/CVE-2026-58246/): Information Disclosure vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform (medium 4.3)
- [CVE-2026-58245](https://insights.sbomify.com/CVE-2026-58245/): Hard-coded Credentials in SAP Advanced Planning and Optimization (Model Mix Planning) (low 3.8)
- [CVE-2026-58244](https://insights.sbomify.com/CVE-2026-58244/): Missing Authorization Check in SAP Manufacturing Integration and Intelligence (MII) (medium 4.3)
- [CVE-2026-58243](https://insights.sbomify.com/CVE-2026-58243/): Privilege Escalation vulnerability in SAP ABAP Developer Tools (high 8.8)
- [CVE-2026-58242](https://insights.sbomify.com/CVE-2026-58242/): Improper Authorization check in SAP Cloud Connector (low 3.5)
- [CVE-2026-58241](https://insights.sbomify.com/CVE-2026-58241/): Missing authorization in SAP NetWeaver and ABAP Platform (Change and Transport System - Customer Transport Integration Wizard (medium 4.2)
- [CVE-2026-58240](https://insights.sbomify.com/CVE-2026-58240/): Missing Authentication check in SAP NetWeaver (Message Server) (critical 9.8)
- [CVE-2026-5824](https://insights.sbomify.com/CVE-2026-5824/): code-projects Simple Laundry System userchecklogin.php sql injection (medium 6.9)
- [CVE-2026-58239](https://insights.sbomify.com/CVE-2026-58239/): Multiple vulnerabilities in SAP Business AI Platform (Approuter) (low 3.7)
- [CVE-2026-58238](https://insights.sbomify.com/CVE-2026-58238/): Multiple vulnerabilities in SAP Business AI Platform (Approuter) (medium 5.9)
- [CVE-2026-58237](https://insights.sbomify.com/CVE-2026-58237/): Multiple vulnerabilities in SAP Business AI Platform (Approuter) (medium 5.9)
- [CVE-2026-58236](https://insights.sbomify.com/CVE-2026-58236/): OS Command Injection vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform (medium 5.5)
- [CVE-2026-58235](https://insights.sbomify.com/CVE-2026-58235/): Use of Vulnerable Third-Party Component in SAP NetWeaver AS Java (Adobe Document Services) (medium 6.3)
- [CVE-2026-58234](https://insights.sbomify.com/CVE-2026-58234/): Denial of Service vulnerability in SAP Process Integration (SOAP Adapter) (low 2.2)
- [CVE-2026-58233](https://insights.sbomify.com/CVE-2026-58233/): Remote Code Execution vulnerability in SAP Change and Transport System Attach Tool (ctsattach) (high 7.6)
- [CVE-2026-58231](https://insights.sbomify.com/CVE-2026-58231/): Improper Authorization in SAP Commerce Cloud (Data Hub Adapter) (critical 10.0)
- [CVE-2026-58230](https://insights.sbomify.com/CVE-2026-58230/): Multiple vulnerabilities in SAP Business AI Platform (Approuter) (high 7.0)
- [CVE-2026-5823](https://insights.sbomify.com/CVE-2026-5823/): itsourcecode Construction Management System borrowed_tool_report.php sql injection (medium 5.3)
- [CVE-2026-58229](https://insights.sbomify.com/CVE-2026-58229/): Unbounded HTTP/1 response-header and chunked-trailer accumulation in Mint causes memory-exhaustion DoS (high 8.2)
- [CVE-2026-58228](https://insights.sbomify.com/CVE-2026-58228/): Scheme validation bypass in Phoenix.LiveView.Utils leads to XSS via <.link> (medium 5.1)
- [CVE-2026-58227](https://insights.sbomify.com/CVE-2026-58227/): TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain (high 8.7)
- [CVE-2026-58226](https://insights.sbomify.com/CVE-2026-58226/): Unauthenticated denial-of-service via unbounded HPACK integer decoding in hpax (high 8.7)
- [CVE-2026-58225](https://insights.sbomify.com/CVE-2026-58225/): Denial of service in postgrex (low 2.1)
- [CVE-2026-58224](https://insights.sbomify.com/CVE-2026-58224/): Samba: ctdb fails to do integrity checking of received packets (medium 6.5)
- [CVE-2026-58222](https://insights.sbomify.com/CVE-2026-58222/): Samba: samba ad ldap compare filter injection and trusted-request confusion disclose protected attributes (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/519/