# Vulnerabilities published in 2026


- [CVE-2026-57992](https://insights.sbomify.com/CVE-2026-57992/): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (high 7.5)
- [CVE-2026-57991](https://insights.sbomify.com/CVE-2026-57991/): Microsoft Edge (Chromium-based) Information Disclosure Vulnerability (high 7.4)
- [CVE-2026-57990](https://insights.sbomify.com/CVE-2026-57990/): Microsoft Edge (Chromium-based) Information Disclosure Vulnerability (high 7.4)
- [CVE-2026-5799](https://insights.sbomify.com/CVE-2026-5799/): IDOR in Idvlabs' Ontime (high 7.5)
- [CVE-2026-57989](https://insights.sbomify.com/CVE-2026-57989/): Microsoft Edge (Chromium-based) Information Disclosure Vulnerability (high 7.4)
- [CVE-2026-57988](https://insights.sbomify.com/CVE-2026-57988/): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (high 7.1)
- [CVE-2026-57987](https://insights.sbomify.com/CVE-2026-57987/): Microsoft Edge (Chromium-based) Spoofing Vulnerability (medium 6.5)
- [CVE-2026-57986](https://insights.sbomify.com/CVE-2026-57986/): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (high 7.5)
- [CVE-2026-57985](https://insights.sbomify.com/CVE-2026-57985/): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (high 7.6)
- [CVE-2026-57984](https://insights.sbomify.com/CVE-2026-57984/): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (high 7.5)
- [CVE-2026-57983](https://insights.sbomify.com/CVE-2026-57983/): Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability (high 8.7)
- [CVE-2026-57982](https://insights.sbomify.com/CVE-2026-57982/): Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-57981](https://insights.sbomify.com/CVE-2026-57981/): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-57980](https://insights.sbomify.com/CVE-2026-57980/): Microsoft Edge (Chromium-based) Tampering Vulnerability (medium 5.4)
- [CVE-2026-5798](https://insights.sbomify.com/CVE-2026-5798/): Unsafe Object Reference (IDOR) vulnerability in Stel Order (high 7.1)
- [CVE-2026-57979](https://insights.sbomify.com/CVE-2026-57979/): Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-57978](https://insights.sbomify.com/CVE-2026-57978/): Microsoft Edge (Chromium-based) Spoofing Vulnerability (medium 5.4)
- [CVE-2026-57977](https://insights.sbomify.com/CVE-2026-57977/): Microsoft Edge (Chromium-based) Spoofing Vulnerability (high 7.1)
- [CVE-2026-57976](https://insights.sbomify.com/CVE-2026-57976/): Windows Active Directory Domain Services Denial of Service Vulnerability (medium 6.5)
- [CVE-2026-57975](https://insights.sbomify.com/CVE-2026-57975/): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (high 7.5)
- [CVE-2026-57974](https://insights.sbomify.com/CVE-2026-57974/): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-57973](https://insights.sbomify.com/CVE-2026-57973/): Windows Subsystem for Linux (WSL2) Kernel Tampering Vulnerability (medium 6.3)
- [CVE-2026-5797](https://insights.sbomify.com/CVE-2026-5797/): Code injection in Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker (medium 5.3)
- [CVE-2026-57969](https://insights.sbomify.com/CVE-2026-57969/): Azure CycleCloud Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-57968](https://insights.sbomify.com/CVE-2026-57968/): Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-57967](https://insights.sbomify.com/CVE-2026-57967/): Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment (critical 9.8)
- [CVE-2026-57966](https://insights.sbomify.com/CVE-2026-57966/): Spice-vdagent: path traversal in file transfer via unsanitized filename (medium 4.4)
- [CVE-2026-57965](https://insights.sbomify.com/CVE-2026-57965/): Spice-vdagent: integer overflow in udscs_write() leading to heap buffer overflow (medium 5.1)
- [CVE-2026-57963](https://insights.sbomify.com/CVE-2026-57963/): Chat UI manipulation by injection (medium 6.5)
- [CVE-2026-57962](https://insights.sbomify.com/CVE-2026-57962/): Denial-of-service via malicious LDAP address-book server (medium 5.3)
- [CVE-2026-57961](https://insights.sbomify.com/CVE-2026-57961/): phpMyFAQ - Authenticated Path Traversal in PDF Export via concatenatePaths Function (medium 5.1)
- [CVE-2026-57960](https://insights.sbomify.com/CVE-2026-57960/): Hi.Events 1.9.0 - Unauthenticated Attendee PII Exposure via Check-in List short_id (high 8.3)
- [CVE-2026-5796](https://insights.sbomify.com/CVE-2026-5796/): Incorrect Authorization in GitLab (medium 4.3)
- [CVE-2026-57959](https://insights.sbomify.com/CVE-2026-57959/): Hi.Events 1.9.0 - Promo Code Max-Usage Bypass via Asynchronous Job Race Condition (high 8.2)
- [CVE-2026-57958](https://insights.sbomify.com/CVE-2026-57958/): Mixpost 2.6.0 - Reflected XSS via OAuth Callback Error Parameter (medium 5.1)
- [CVE-2026-57957](https://insights.sbomify.com/CVE-2026-57957/): Papermark 0.22.0 - CORS Misconfiguration in Viewer Upload Endpoint (low 2.3)
- [CVE-2026-57956](https://insights.sbomify.com/CVE-2026-57956/): SigNoz < 0.133.0 - Cross-Organization Insecure Direct Object Reference in Alert Rules (medium 6.1)
- [CVE-2026-57955](https://insights.sbomify.com/CVE-2026-57955/): SigNoz 0.130.1 - SQL Injection in Alert History Endpoints via Rule ID Parameter (high 8.3)
- [CVE-2026-57954](https://insights.sbomify.com/CVE-2026-57954/): Elide 7.1.17 - Permission Bypass in Sort Expression Validation (medium 5.3)
- [CVE-2026-57953](https://insights.sbomify.com/CVE-2026-57953/): Mythic < 3.4.0.60 - Unauthorized Automation Workflow Modification via eventing_import_automatic_webhook Endpoint (medium 5.3)
- [CVE-2026-57952](https://insights.sbomify.com/CVE-2026-57952/): Mythic < 3.4.0.60 - Unauthorized C2 Profile Configuration Access via Unverified Payload UUID (medium 6.0)
- [CVE-2026-57951](https://insights.sbomify.com/CVE-2026-57951/): Mythic < 3.4.0.60 - Broken Permission Filter in payload_build_step Table (high 7.1)
- [CVE-2026-57950](https://insights.sbomify.com/CVE-2026-57950/): ruoyi-vue-pro - Incorrect Permission Namespace in ErpSaleOrderController (high 8.6)
- [CVE-2026-5795](https://insights.sbomify.com/CVE-2026-5795/): Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables (high 7.4)
- [CVE-2026-57949](https://insights.sbomify.com/CVE-2026-57949/): ruoyi-vue-pro - Missing Authorization in CRM Follow-up Record GET Endpoint (high 7.1)
- [CVE-2026-57948](https://insights.sbomify.com/CVE-2026-57948/): Pinpoint - Insecure Session Cookie Attributes in pinpointJwt (high 7.6)
- [CVE-2026-57947](https://insights.sbomify.com/CVE-2026-57947/): Pinpoint - Server-Side Request Forgery via Alarm Webhook Registration (medium 6.3)
- [CVE-2026-57946](https://insights.sbomify.com/CVE-2026-57946/): Invidious - Private Playlist Disclosure via Unauthenticated RSS Feed Endpoint (medium 6.3)
- [CVE-2026-57945](https://insights.sbomify.com/CVE-2026-57945/): PhotoPrism - Unauthorized User Profile Modification via PUT /api/v1/users/{uid} Endpoint (medium 5.3)
- [CVE-2026-57944](https://insights.sbomify.com/CVE-2026-57944/): AVideo channelToGallery.json.php Cross-Site Request Forgery (medium 5.3)
- [CVE-2026-57943](https://insights.sbomify.com/CVE-2026-57943/): LibrePhotos < 1.0.0 - Insecure Direct Object Reference in SetPhotosShared Endpoint (medium 6.0)
- [CVE-2026-57942](https://insights.sbomify.com/CVE-2026-57942/): LibreTranslate - IP Spoofing via X-Forwarded-For Header (medium 6.9)
- [CVE-2026-57941](https://insights.sbomify.com/CVE-2026-57941/): Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy (critical 9.8)
- [CVE-2026-57940](https://insights.sbomify.com/CVE-2026-57940/): Server-side request forgery in HTMLy (low 2.1)
- [CVE-2026-5794](https://insights.sbomify.com/CVE-2026-5794/): Vulnerability in Cryptobox allows an authenticated user to trigger an account lockout (medium 4.9)
- [CVE-2026-5793](https://insights.sbomify.com/CVE-2026-5793/): XSS in Inrove Software's BiEticaret (medium 6.1)
- [CVE-2026-57926](https://insights.sbomify.com/CVE-2026-57926/): Code injection in YouTrack (low 2.6)
- [CVE-2026-57925](https://insights.sbomify.com/CVE-2026-57925/): Missing authorization in YouTrack (medium 4.3)
- [CVE-2026-57924](https://insights.sbomify.com/CVE-2026-57924/): Information disclosure in YouTrack (medium 4.3)
- [CVE-2026-57923](https://insights.sbomify.com/CVE-2026-57923/): Missing authorization in YouTrack (medium 5.3)
- [CVE-2026-57922](https://insights.sbomify.com/CVE-2026-57922/): Missing authorization in YouTrack (low 3.1)
- [CVE-2026-57921](https://insights.sbomify.com/CVE-2026-57921/): Missing authorization in YouTrack (medium 4.3)
- [CVE-2026-57920](https://insights.sbomify.com/CVE-2026-57920/): Auth bypass in InControl (high 7.7)
- [CVE-2026-5792](https://insights.sbomify.com/CVE-2026-5792/): Authentication Bypass in Hedef Media's Related Marketing Cloud (RMC) (medium 6.5)
- [CVE-2026-57919](https://insights.sbomify.com/CVE-2026-57919/): PBackupVSS.exe in Matrix42 Empirum before 25.5 and 26.x before 26.2 creates a named pipe (\\.\pipe\PBackupVSS) with a DACL that grants GENER (high 7.8)
- [CVE-2026-57918](https://insights.sbomify.com/CVE-2026-57918/): Integer overflow in libnfs (high 7.1)
- [CVE-2026-57917](https://insights.sbomify.com/CVE-2026-57917/): Improper Restriction of XML External Entity Reference in proCertum SmartSign (medium 4.8)
- [CVE-2026-57916](https://insights.sbomify.com/CVE-2026-57916/): Arbitrary Path Execution via CPS URI in proCertum SmartSign (medium 4.6)
- [CVE-2026-57915](https://insights.sbomify.com/CVE-2026-57915/): Apache Kerby: Kerberos Pre-Authentication Bypass (high 7.3)
- [CVE-2026-57914](https://insights.sbomify.com/CVE-2026-57914/): Apache Kerby: StackOverflow on parsing deeply nested ASN1 structures (medium 6.5)
- [CVE-2026-57913](https://insights.sbomify.com/CVE-2026-57913/): Missing authorization in Audit Tracking Management System (high 7.5)
- [CVE-2026-57912](https://insights.sbomify.com/CVE-2026-57912/): Missing authorization in Campus Recruiting (high 7.5)
- [CVE-2026-57910](https://insights.sbomify.com/CVE-2026-57910/): WatchGuard Agent improper authentication allows unauthenticated remote code execution (critical 9.3)
- [CVE-2026-5791](https://insights.sbomify.com/CVE-2026-5791/): CSRF in DivvyDrive Information Technologies' DivvyDrive (medium 6.5)
- [CVE-2026-57909](https://insights.sbomify.com/CVE-2026-57909/): WatchGuard Agent path traversal allows unauthenticated remote code execution (critical 9.4)
- [CVE-2026-5790](https://insights.sbomify.com/CVE-2026-5790/): Stored Cross-Site Scripting (XSS) vulnerability in Stel Order (medium 5.1)
- [CVE-2026-57898](https://insights.sbomify.com/CVE-2026-57898/): Path traversal in Eclipse BaSyx - Java Server SDK (critical 9.0)
- [CVE-2026-57897](https://insights.sbomify.com/CVE-2026-57897/): Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs (medium 6.5)
- [CVE-2026-57896](https://insights.sbomify.com/CVE-2026-57896/): AutomationDirect Productivity Suite Out-of-bounds Read (medium 6.9)
- [CVE-2026-57895](https://insights.sbomify.com/CVE-2026-57895/): Misconfiguration in Pupsman (high 8.5)
- [CVE-2026-57894](https://insights.sbomify.com/CVE-2026-57894/): Gitea: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration (high 8.5)
- [CVE-2026-5789](https://insights.sbomify.com/CVE-2026-5789/): Search path without quotes in CivetWeb (high 8.5)
- [CVE-2026-57886](https://insights.sbomify.com/CVE-2026-57886/): Cross-repository issue/comment attachment re-linking can expose private attachment content (medium 5.9)
- [CVE-2026-57881](https://insights.sbomify.com/CVE-2026-57881/): GV-LPC2011/LPC2211 - unauthorized stack-based buffer overflow vulnerability (vlsvr) (critical 9.8)
- [CVE-2026-57880](https://insights.sbomify.com/CVE-2026-57880/): GV-LPC2011/LPC2211 - unauthorized buffer overflow via RTSP Digest username (ssvr) (critical 9.8)
- [CVE-2026-5788](https://insights.sbomify.com/CVE-2026-5788/): Missing authorization in Endpoint Manager Mobile (high 7.0)
- [CVE-2026-57879](https://insights.sbomify.com/CVE-2026-57879/): GV-LPC2011/LPC2211 - unauthorized buffer overflow via AuthMode/AuthValue path (ssvr) (critical 9.8)
- [CVE-2026-57878](https://insights.sbomify.com/CVE-2026-57878/): GV-LPC2011/LPC2211 - unauthorized buffer overflow vulnerability (thttpd) (critical 9.8)
- [CVE-2026-57877](https://insights.sbomify.com/CVE-2026-57877/): GV-LPC2011/LPC2211 - unauthorized format string vulnerability (vlsvr) (high 8.6)
- [CVE-2026-57876](https://insights.sbomify.com/CVE-2026-57876/): GV-LPC2011/LPC2211 - unauthorized out-of-bounds writing vulnerability (onvif.cgi) (high 7.5)
- [CVE-2026-57875](https://insights.sbomify.com/CVE-2026-57875/): GV-LPC2011/LPC2211 - unauthorized null pointer dereference vulnerability in packet parsing (high 7.5)
- [CVE-2026-57874](https://insights.sbomify.com/CVE-2026-57874/): GV-LPC2011/LPC2211 - unauthorized buffer overflow vulnerability (IEEE8021x_upload.cgi) (high 7.5)
- [CVE-2026-57873](https://insights.sbomify.com/CVE-2026-57873/): GV-LPC2011/LPC2211 - unauthorized null pointer dereference vulnerability (IEEE8021x_upload.cgi) (high 7.5)
- [CVE-2026-57872](https://insights.sbomify.com/CVE-2026-57872/): GV-LPC2011/LPC2211 - unauthorized directory traversal vulnerability (get_fcont.cgi) (high 7.5)
- [CVE-2026-57871](https://insights.sbomify.com/CVE-2026-57871/): Path traversal in MicroRealEstate (high 7.1)
- [CVE-2026-57870](https://insights.sbomify.com/CVE-2026-57870/): Missing authorization in MicroRealEstate (medium 5.3)
- [CVE-2026-5787](https://insights.sbomify.com/CVE-2026-5787/): Security feature bypass in Endpoint Manager Mobile (high 8.9)
- [CVE-2026-57869](https://insights.sbomify.com/CVE-2026-57869/): Missing authorization in MicroRealEstate (high 7.1)
- [CVE-2026-57868](https://insights.sbomify.com/CVE-2026-57868/): Missing authorization in MicroRealEstate (high 7.1)
- [CVE-2026-57867](https://insights.sbomify.com/CVE-2026-57867/): Auth bypass in MicroRealEstate (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/522/