# Vulnerabilities published in 2026


- [CVE-2026-58091](https://insights.sbomify.com/CVE-2026-58091/): Kernel use-after-free via the SNDCTL_DSP_SYNCSTART ioctl (high 7.8)
- [CVE-2026-58090](https://insights.sbomify.com/CVE-2026-58090/): Use-after-free in unix SOCK_STREAM message handling (high 7.8)
- [CVE-2026-5809](https://insights.sbomify.com/CVE-2026-5809/): wpForo Forum <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion via 'data[body][fileurl]' Parameter (high 7.1)
- [CVE-2026-58089](https://insights.sbomify.com/CVE-2026-58089/): hwpmc fails to detach PMCs during exec credential transitions (high 7.8)
- [CVE-2026-58088](https://insights.sbomify.com/CVE-2026-58088/): Race condition in ELF core dump segment counting (high 7.4)
- [CVE-2026-58087](https://insights.sbomify.com/CVE-2026-58087/): Heap out-of-bounds access in semctl(2) (high 7.8)
- [CVE-2026-58086](https://insights.sbomify.com/CVE-2026-58086/): ktrace(2) privilege incorrectly validated in jails (high 8.1)
- [CVE-2026-58085](https://insights.sbomify.com/CVE-2026-58085/): Missing MAC validation in wg(4) packet decryption (high 7.5)
- [CVE-2026-58084](https://insights.sbomify.com/CVE-2026-58084/): Kernel stack disclosure via timer_settime(2) (medium 5.5)
- [CVE-2026-58083](https://insights.sbomify.com/CVE-2026-58083/): Use-after-free in kqueue copy-on-fork (high 8.4)
- [CVE-2026-58082](https://insights.sbomify.com/CVE-2026-58082/): Stack based buffer overflow in iconv(3) (critical 9.8)
- [CVE-2026-58081](https://insights.sbomify.com/CVE-2026-58081/): Heap based buffer overflow in iconv(3) (critical 9.8)
- [CVE-2026-58080](https://insights.sbomify.com/CVE-2026-58080/): Missing authorization in Eclipse Milo (high 8.8)
- [CVE-2026-5808](https://insights.sbomify.com/CVE-2026-5808/): openstatusHQ openstatus Onboarding Endpoint client.tsx cross site scripting (medium 5.3)
- [CVE-2026-58078](https://insights.sbomify.com/CVE-2026-58078/): Joomla Extension - themexpert.com - Unauthenticated SQL injection in Quix Page Builder Pro < 6.2.1 (high 8.7)
- [CVE-2026-58077](https://insights.sbomify.com/CVE-2026-58077/): Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics < 5.0.2 (high 8.7)
- [CVE-2026-58076](https://insights.sbomify.com/CVE-2026-58076/): Apache Airflow exception-node deserialization permits arbitrary callable execution (high 8.8)
- [CVE-2026-58075](https://insights.sbomify.com/CVE-2026-58075/): Auth bypass in ONE (high 8.7)
- [CVE-2026-58074](https://insights.sbomify.com/CVE-2026-58074/): Code injection in ONE (high 8.6)
- [CVE-2026-58073](https://insights.sbomify.com/CVE-2026-58073/): Auth bypass in Service Provider Console (critical 9.5)
- [CVE-2026-58072](https://insights.sbomify.com/CVE-2026-58072/): Path traversal in Service Provider Console (critical 9.0)
- [CVE-2026-58071](https://insights.sbomify.com/CVE-2026-58071/): Auth bypass in Service Provider Console (high 8.2)
- [CVE-2026-58070](https://insights.sbomify.com/CVE-2026-58070/): Information disclosure in Backup and Replication (medium 6.8)
- [CVE-2026-5807](https://insights.sbomify.com/CVE-2026-5807/): Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey Operations (high 7.5)
- [CVE-2026-58069](https://insights.sbomify.com/CVE-2026-58069/): Path traversal in Backup and Replication (high 8.3)
- [CVE-2026-58068](https://insights.sbomify.com/CVE-2026-58068/): Missing authorization in Agent for Windows (medium 6.8)
- [CVE-2026-58067](https://insights.sbomify.com/CVE-2026-58067/): Denial of service in Service Provider Console (high 8.7)
- [CVE-2026-58066](https://insights.sbomify.com/CVE-2026-58066/): Auth bypass in Rocket.Chat (critical 9.8)
- [CVE-2026-58065](https://insights.sbomify.com/CVE-2026-58065/): Weak cryptography in Apache Airflow Git provider (high 8.1)
- [CVE-2026-58064](https://insights.sbomify.com/CVE-2026-58064/): Apache bRPC: Denial of Service via Unbounded Redis Inline Command Allocation (not scored)
- [CVE-2026-58063](https://insights.sbomify.com/CVE-2026-58063/): BCFKS keystore load honours unbounded KDF cost from untrusted file (medium 5.3)
- [CVE-2026-58062](https://insights.sbomify.com/CVE-2026-58062/): Stapled OCSP response accepted without binding to the checked certificate (critical 9.3)
- [CVE-2026-58061](https://insights.sbomify.com/CVE-2026-58061/): CCM-family modes write plaintext to caller buffer before tag check (high 8.7)
- [CVE-2026-58060](https://insights.sbomify.com/CVE-2026-58060/): HSS public-key level count unbounded, enabling huge allocation on verify (high 8.7)
- [CVE-2026-5806](https://insights.sbomify.com/CVE-2026-5806/): code-projects Easy Blog Site update.php cross site scripting (medium 5.1)
- [CVE-2026-58059](https://insights.sbomify.com/CVE-2026-58059/): Quadratic-time escaping when stringifying X.500 distinguished names (high 8.7)
- [CVE-2026-58058](https://insights.sbomify.com/CVE-2026-58058/): Nmap - Integer Underflow in IPv6 Extension Header Parsing (medium 6.9)
- [CVE-2026-58057](https://insights.sbomify.com/CVE-2026-58057/): Flowise - Custom MCP Environment Variable Denylist Bypass via Case Sensitivity (low 2.3)
- [CVE-2026-58056](https://insights.sbomify.com/CVE-2026-58056/): RustDesk - FileTransfer Session Authorization Scope Bypass (high 7.2)
- [CVE-2026-58055](https://insights.sbomify.com/CVE-2026-58055/): nghttp2 nghttpx - HTTP Request/Response Smuggling via Upgrade Request with Content-Length (medium 6.3)
- [CVE-2026-58053](https://insights.sbomify.com/CVE-2026-58053/): Gitea act_runner - Container Hardening Bypass via Workflow Container Options (critical 9.4)
- [CVE-2026-58052](https://insights.sbomify.com/CVE-2026-58052/): 7-Zip - Mark-of-the-Web Bypass via RAR5 Alternate Data Stream Name Collision (medium 4.8)
- [CVE-2026-58051](https://insights.sbomify.com/CVE-2026-58051/): libssh2 - Free of Uninitialized Pointer in publickey List Cleanup (high 8.3)
- [CVE-2026-58050](https://insights.sbomify.com/CVE-2026-58050/): libssh2 - Integer Overflow in publickey Subsystem Attribute Allocation (high 8.3)
- [CVE-2026-5805](https://insights.sbomify.com/CVE-2026-5805/): code-projects Easy Blog Site contact_us.php sql injection (medium 6.9)
- [CVE-2026-58049](https://insights.sbomify.com/CVE-2026-58049/): FFmpeg - Out-of-Bounds Write in RASC Decoder decode_dlta() (high 8.8)
- [CVE-2026-58048](https://insights.sbomify.com/CVE-2026-58048/): SQL injection in WP Squared (critical 9.4)
- [CVE-2026-58047](https://insights.sbomify.com/CVE-2026-58047/): Other in WP Squared (medium 5.6)
- [CVE-2026-58046](https://insights.sbomify.com/CVE-2026-58046/): SQL injection in Plesk (critical 9.9)
- [CVE-2026-58045](https://insights.sbomify.com/CVE-2026-58045/): Denial of service in node (medium 6.2)
- [CVE-2026-58044](https://insights.sbomify.com/CVE-2026-58044/): Other in node (low 3.7)
- [CVE-2026-58043](https://insights.sbomify.com/CVE-2026-58043/): Security feature bypass in node (high 7.5)
- [CVE-2026-58042](https://insights.sbomify.com/CVE-2026-58042/): Denial of service in node (medium 5.9)
- [CVE-2026-58041](https://insights.sbomify.com/CVE-2026-58041/): Race condition in node (medium 5.3)
- [CVE-2026-58040](https://insights.sbomify.com/CVE-2026-58040/): Security feature bypass in node (medium 6.3)
- [CVE-2026-5804](https://insights.sbomify.com/CVE-2026-5804/): Auth bypass in Phones (high 8.4)
- [CVE-2026-58039](https://insights.sbomify.com/CVE-2026-58039/): Security feature bypass in node (low 3.3)
- [CVE-2026-58038](https://insights.sbomify.com/CVE-2026-58038/): Stored XSS through javascript URLs in SVGs generated by EasyTimeline (not scored)
- [CVE-2026-58037](https://insights.sbomify.com/CVE-2026-58037/): Core log entries for exceptions and XSS issues in log entry formatting code that may be caused by user-controlled input (not scored)
- [CVE-2026-58036](https://insights.sbomify.com/CVE-2026-58036/): Users API leaks whether privileged users have their user groups disabled for lack of 2FA (low 2.1)
- [CVE-2026-58035](https://insights.sbomify.com/CVE-2026-58035/): Stored XSS through a system message in the codex version of Special:Block (not scored)
- [CVE-2026-58034](https://insights.sbomify.com/CVE-2026-58034/): Stored XSS through a system message when blocking a temporary account that's related to other temporary accounts (not scored)
- [CVE-2026-58033](https://insights.sbomify.com/CVE-2026-58033/): Information disclosure in MediaWiki (medium 5.3)
- [CVE-2026-58032](https://insights.sbomify.com/CVE-2026-58032/): mw.Api.getErrorMessage() may return injected HTML if used without errorformat=html (medium 5.3)
- [CVE-2026-58031](https://insights.sbomify.com/CVE-2026-58031/): Stored i18n XSS in Special:ApiSandbox when a deprecated module is selected (not scored)
- [CVE-2026-58030](https://insights.sbomify.com/CVE-2026-58030/): SyntaxHighlight stored XSS via unsanitized 'linelinks' attribute (medium 5.3)
- [CVE-2026-5803](https://insights.sbomify.com/CVE-2026-5803/): bigsk1 openai-realtime-ui API Proxy Endpoint server.js server-side request forgery (medium 5.3)
- [CVE-2026-58029](https://insights.sbomify.com/CVE-2026-58029/): Full Account Takeover from BotPasswords and OAuth via action=changeauthenticationdata (medium 5.3)
- [CVE-2026-58028](https://insights.sbomify.com/CVE-2026-58028/): Pretty-printed API output combined with centralauthtoken allows XSS with certain gadgets (not scored)
- [CVE-2026-58027](https://insights.sbomify.com/CVE-2026-58027/): QueryAbuseFilter API can be used to see the hit count of private filters, which is hidden in the UI (medium 5.3)
- [CVE-2026-58026](https://insights.sbomify.com/CVE-2026-58026/): $wgNonincludableNamespaces can be bypassed by embedding redirect in other namespaces (not scored)
- [CVE-2026-58025](https://insights.sbomify.com/CVE-2026-58025/): Remote Code Execution via Unsafe Deserialization in LogItem Import (medium 5.9)
- [CVE-2026-58024](https://insights.sbomify.com/CVE-2026-58024/): API identification of users on private wikis (medium 5.1)
- [CVE-2026-58023](https://insights.sbomify.com/CVE-2026-58023/): Apache Thrift: c_glib heap out-of-bounds read in transport leftover-bytes path (medium 6.9)
- [CVE-2026-5802](https://insights.sbomify.com/CVE-2026-5802/): idachev mcp-javadc HTTP os command injection (medium 6.9)
- [CVE-2026-58016](https://insights.sbomify.com/CVE-2026-58016/): Glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml" (high 7.5)
- [CVE-2026-58015](https://insights.sbomify.com/CVE-2026-58015/): Glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive (medium 5.9)
- [CVE-2026-58014](https://insights.sbomify.com/CVE-2026-58014/): Glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list" (high 7.3)
- [CVE-2026-58013](https://insights.sbomify.com/CVE-2026-58013/): Glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend" (medium 6.5)
- [CVE-2026-58012](https://insights.sbomify.com/CVE-2026-58012/): Glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char() (medium 6.5)
- [CVE-2026-58011](https://insights.sbomify.com/CVE-2026-58011/): Glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid gdatetime (medium 6.5)
- [CVE-2026-58010](https://insights.sbomify.com/CVE-2026-58010/): Glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal() (medium 6.5)
- [CVE-2026-5801](https://insights.sbomify.com/CVE-2026-5801/): SQLi in Semtek Informatics' SEM-PMP (critical 9.8)
- [CVE-2026-58008](https://insights.sbomify.com/CVE-2026-58008/): Unchecked HKDF key-size input in EL3 causes a stack buffer overflow (high 8.3)
- [CVE-2026-58007](https://insights.sbomify.com/CVE-2026-58007/): Unchecked SDM mailbox response address enables EL3 secure-memory corruption (high 8.3)
- [CVE-2026-58006](https://insights.sbomify.com/CVE-2026-58006/): Altera SoCFPGA BL31 Mailbox Output Pointer Validation Enables EL3 Secure-Memory Corruption (high 8.3)
- [CVE-2026-58005](https://insights.sbomify.com/CVE-2026-58005/): Unvalidated SiP v2 mailbox pointers allow non-secure EL1 access to arbitrary physical addresses through EL3. (high 8.3)
- [CVE-2026-58004](https://insights.sbomify.com/CVE-2026-58004/): Crafted oversized firmware image causes EL3 stack overflow during VAB authentication on Trusted Firmware. (high 8.3)
- [CVE-2026-58003](https://insights.sbomify.com/CVE-2026-58003/): WWBN AVideo Cross-Site Request Forgery via releaseVideoNow.json.php (high 7.1)
- [CVE-2026-58002](https://insights.sbomify.com/CVE-2026-58002/): WWBN AVideo Authorization Bypass via Users_affiliations add.json.php (high 7.1)
- [CVE-2026-58001](https://insights.sbomify.com/CVE-2026-58001/): WWBN AVideo Cross-Site Request Forgery via videoEditLight.php (medium 6.9)
- [CVE-2026-58000](https://insights.sbomify.com/CVE-2026-58000/): luci-proto-openvpn - Command Injection via cl_meta Parameter in generateKey (high 8.7)
- [CVE-2026-5800](https://insights.sbomify.com/CVE-2026-5800/): Reflected XSS in Dayneks Software's E-Commerce Platform (medium 6.1)
- [CVE-2026-57999](https://insights.sbomify.com/CVE-2026-57999/): luci-app-tailscale-community - Command Injection via tailscale.do_login RPC (high 7.7)
- [CVE-2026-57998](https://insights.sbomify.com/CVE-2026-57998/): better-npm-audit OS Command Injection via registry flag (high 8.5)
- [CVE-2026-57997](https://insights.sbomify.com/CVE-2026-57997/): Strapi users-permissions - JWT Algorithm Confusion via Missing Algorithm Configuration (medium 6.3)
- [CVE-2026-57996](https://insights.sbomify.com/CVE-2026-57996/): phpMyFAQ - Privilege Escalation via Missing SuperAdmin Guard in user/add Endpoint (high 8.7)
- [CVE-2026-57995](https://insights.sbomify.com/CVE-2026-57995/): phpMyFAQ - Privilege Escalation via Missing Self-Rights Constraint in GroupController::updatePermissions (high 8.7)
- [CVE-2026-57994](https://insights.sbomify.com/CVE-2026-57994/): phpMyFAQ - Information Disclosure of Inactive FAQ Content via Public API Endpoints (medium 6.9)
- [CVE-2026-57993](https://insights.sbomify.com/CVE-2026-57993/): Microsoft Edge (Chromium-based) Spoofing Vulnerability (high 7.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/521/