# Vulnerabilities published in 2026


- [CVE-2026-57301](https://insights.sbomify.com/CVE-2026-57301/): Jenkins OWASP ZAP Plugin: Builds executed on the Jenkins controller can lead to RCE (high 8.8)
- [CVE-2026-57300](https://insights.sbomify.com/CVE-2026-57300/): Jenkins MCP Server Plugin missing a permission check (medium 4.3)
- [CVE-2026-5730](https://insights.sbomify.com/CVE-2026-5730/): IDOR in Idvlabs' Ontime (high 7.5)
- [CVE-2026-57299](https://insights.sbomify.com/CVE-2026-57299/): Jenkins Contrast Continuous Application Security Plugin missing permission checks (medium 4.3)
- [CVE-2026-57298](https://insights.sbomify.com/CVE-2026-57298/): Jenkins Contrast Continuous Application Security Plugin has a CSRF vulnerability (medium 5.4)
- [CVE-2026-57297](https://insights.sbomify.com/CVE-2026-57297/): Jenkins Contrast Continuous Application Security Plugin has a missing permission check (medium 5.4)
- [CVE-2026-57296](https://insights.sbomify.com/CVE-2026-57296/): Jenkins External Workspace Manager Plugin has a path traversal vulnerability (high 8.8)
- [CVE-2026-57295](https://insights.sbomify.com/CVE-2026-57295/): Jenkins EC2 Fleet Plugin has a cross-site request forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2026-57294](https://insights.sbomify.com/CVE-2026-57294/): Jenkins EC2 Fleet Plugin has a missing permission check (medium 5.4)
- [CVE-2026-57293](https://insights.sbomify.com/CVE-2026-57293/): Jenkins Gitee Plugin has an incorrect permission check that allows enumerating credentials IDs (medium 4.3)
- [CVE-2026-57292](https://insights.sbomify.com/CVE-2026-57292/): Jenkins Gitee Plugin has a cross-site request forgery vulnerability (medium 5.4)
- [CVE-2026-57291](https://insights.sbomify.com/CVE-2026-57291/): Jenkins Gitee Plugin missing permission checks (medium 5.4)
- [CVE-2026-57290](https://insights.sbomify.com/CVE-2026-57290/): Jenkins Priority Sorter Plugin has a CSRF vulnerability (medium 4.3)
- [CVE-2026-5729](https://insights.sbomify.com/CVE-2026-5729/): Mali GPU Kernel Driver allows access to already freed memory (high 7.8)
- [CVE-2026-57289](https://insights.sbomify.com/CVE-2026-57289/): Jenkins Bitbucket Push and Pull Request Plugin unconditionally disables SSL/TLS certificate validation (medium 4.8)
- [CVE-2026-57288](https://insights.sbomify.com/CVE-2026-57288/): Jenkins Active Directory Plugin has an LDAP injection vulnerability (low 3.7)
- [CVE-2026-57287](https://insights.sbomify.com/CVE-2026-57287/): Jenkins Job Configuration History Plugin doesn't redact encrypted values of secrets in job and agent configurations (medium 4.3)
- [CVE-2026-57286](https://insights.sbomify.com/CVE-2026-57286/): Jenkins Git Parameter Plugin has a missing permission check that allows listing SCM branch and tag names (medium 4.3)
- [CVE-2026-57285](https://insights.sbomify.com/CVE-2026-57285/): Jenkins GitHub Branch Source Plugin has missing permission check that allows enumerating GitHub Enterprise server URLs (medium 4.3)
- [CVE-2026-57284](https://insights.sbomify.com/CVE-2026-57284/): Jenkins Pipeline: Groovy Plugin vulnerable to unrestricted instantiation of types (medium 4.3)
- [CVE-2026-57283](https://insights.sbomify.com/CVE-2026-57283/): Jenkins Pipeline: Groovy Plugin has a CSRF vulnerability (medium 4.3)
- [CVE-2026-57282](https://insights.sbomify.com/CVE-2026-57282/): Jenkins Git client Plugin has an OS command injection vulnerability on agents (medium 5.0)
- [CVE-2026-57281](https://insights.sbomify.com/CVE-2026-57281/): Jenkins Script Security Plugin has a script security bypass vulnerability (high 7.5)
- [CVE-2026-57280](https://insights.sbomify.com/CVE-2026-57280/): Jenkins Script Security Plugin sandbox bypass vulnerability (high 8.8)
- [CVE-2026-57279](https://insights.sbomify.com/CVE-2026-57279/): Cross-site scripting in Cybozu Garoon (medium 6.0)
- [CVE-2026-57278](https://insights.sbomify.com/CVE-2026-57278/): GeoVision GeoWebPlayer Websocket Server connectInfo handler stack-based buffer overflow vulnerability (high 8.3)
- [CVE-2026-57277](https://insights.sbomify.com/CVE-2026-57277/): GeoVision GeoWebPlayer Websocket Server connectInfo handler stack-based buffer overflow vulnerability (high 8.3)
- [CVE-2026-57276](https://insights.sbomify.com/CVE-2026-57276/): GeoVision GeoWebPlayer Websocket Server connectInfo handler stack-based buffer overflow vulnerability (high 8.3)
- [CVE-2026-57275](https://insights.sbomify.com/CVE-2026-57275/): GeoVision GeoWebPlayer Websocket Server connectInfo handler stack-based buffer overflow vulnerability (high 8.3)
- [CVE-2026-57274](https://insights.sbomify.com/CVE-2026-57274/): GeoVision GeoWebPlayer Websocket Server connectInfo handler stack-based buffer overflow vulnerability (high 8.3)
- [CVE-2026-57273](https://insights.sbomify.com/CVE-2026-57273/): GeoVision GeoWebPlayer Websocket Server connectInfo handler stack-based buffer overflow vulnerability (high 8.3)
- [CVE-2026-57272](https://insights.sbomify.com/CVE-2026-57272/): GeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerability (high 8.3)
- [CVE-2026-57271](https://insights.sbomify.com/CVE-2026-57271/): GeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerability (high 8.3)
- [CVE-2026-57270](https://insights.sbomify.com/CVE-2026-57270/): GeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerability (high 8.3)
- [CVE-2026-5727](https://insights.sbomify.com/CVE-2026-5727/): Missing authorization in Hello Plus (medium 5.4)
- [CVE-2026-57269](https://insights.sbomify.com/CVE-2026-57269/): GeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerability (high 8.3)
- [CVE-2026-57268](https://insights.sbomify.com/CVE-2026-57268/): GeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerability (high 8.3)
- [CVE-2026-57267](https://insights.sbomify.com/CVE-2026-57267/): GeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerability (high 8.3)
- [CVE-2026-57266](https://insights.sbomify.com/CVE-2026-57266/): GeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerability (high 8.3)
- [CVE-2026-57265](https://insights.sbomify.com/CVE-2026-57265/): GeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerability (high 8.3)
- [CVE-2026-57264](https://insights.sbomify.com/CVE-2026-57264/): GeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerability (high 8.3)
- [CVE-2026-57263](https://insights.sbomify.com/CVE-2026-57263/): Weak cryptography in LOGO! Soft Comfort (high 7.0)
- [CVE-2026-57262](https://insights.sbomify.com/CVE-2026-57262/): Hardcoded credentials in LOGO! Soft Comfort (high 7.0)
- [CVE-2026-57260](https://insights.sbomify.com/CVE-2026-57260/): Memory corruption in Foxit PDF Editor (high 7.8)
- [CVE-2026-5726](https://insights.sbomify.com/CVE-2026-5726/): ASDA-Soft Stack-based Buffer Overflow Vulnerability (high 7.8)
- [CVE-2026-57259](https://insights.sbomify.com/CVE-2026-57259/): Foxit PDF Editor/Reader XDP XFA XXE arbitrary local file read (medium 6.5)
- [CVE-2026-57258](https://insights.sbomify.com/CVE-2026-57258/): Foxit PDF Editor/Reader Crash via Malformed PRC 3D Stream (medium 6.1)
- [CVE-2026-57257](https://insights.sbomify.com/CVE-2026-57257/): Security vulnerability in Foxit PDF Editor/Reader — PRC 3D BRep Renderer Heap OOB Read (medium 6.1)
- [CVE-2026-57256](https://insights.sbomify.com/CVE-2026-57256/): Foxit Editor/Reader List Box Format Use-After-Free Vulnerability (high 7.8)
- [CVE-2026-57255](https://insights.sbomify.com/CVE-2026-57255/): Security vulnerability in Foxit PDF Editor/Reader — OOB Read via NaN-Bypass Clamp (medium 6.1)
- [CVE-2026-57254](https://insights.sbomify.com/CVE-2026-57254/): Foxit PDF Editor/Reader Annotation Type Confusion Vulnerability (high 7.8)
- [CVE-2026-57253](https://insights.sbomify.com/CVE-2026-57253/): Foxit PDF Editor/Reader PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 6.1)
- [CVE-2026-57252](https://insights.sbomify.com/CVE-2026-57252/): Foxit PDF Editor/Reader AcroForm Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-57251](https://insights.sbomify.com/CVE-2026-57251/): Foxit PDF Editor/Reader Cloud Appearance Buffer Overflow Vulnerability (high 7.8)
- [CVE-2026-57250](https://insights.sbomify.com/CVE-2026-57250/): Foxit PDF Editor/Reader Form Field Use-After-Free Vulnerability (high 7.8)
- [CVE-2026-5725](https://insights.sbomify.com/CVE-2026-5725/): Favicon Rotator <= 1.2.11 - Reflected Cross-Site Scripting via 'fvrt_' prefix (medium 6.1)
- [CVE-2026-57249](https://insights.sbomify.com/CVE-2026-57249/): Foxit PDF Editor/Reader Annotation Use-After-Free Vulnerability (high 7.8)
- [CVE-2026-57248](https://insights.sbomify.com/CVE-2026-57248/): Foxit PDF Editor/Reader Annotation Improper Release Vulnerability (high 7.8)
- [CVE-2026-57247](https://insights.sbomify.com/CVE-2026-57247/): Foxit PDF Editor/Reader Field Use-After-Free Vulnerability (high 7.8)
- [CVE-2026-57246](https://insights.sbomify.com/CVE-2026-57246/): Foxit PDF Editor/Reader Signature Buffer Overflow Vulnerability (high 7.8)
- [CVE-2026-57245](https://insights.sbomify.com/CVE-2026-57245/): Foxit PDF Editor/Reader Signature Hyperlink Use-After-Free Vulnerability (high 7.8)
- [CVE-2026-57244](https://insights.sbomify.com/CVE-2026-57244/): Foxit PDF Editor/Reader Form Control Use-After-Free Vulnerability (high 7.8)
- [CVE-2026-57243](https://insights.sbomify.com/CVE-2026-57243/): Foxit PDF Editor/Reader Page Out-of-bounds Read Vulnerability (medium 6.1)
- [CVE-2026-57242](https://insights.sbomify.com/CVE-2026-57242/): Foxit PDF Editor/Reader Page Use-After-Free Vulnerability (high 7.8)
- [CVE-2026-57241](https://insights.sbomify.com/CVE-2026-57241/): Foxit PDF Editor/Reader Page Out-of-bounds Read Vulnerability (medium 6.1)
- [CVE-2026-57240](https://insights.sbomify.com/CVE-2026-57240/): Foxit PDF Editor/Reader Form Field Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-5724](https://insights.sbomify.com/CVE-2026-5724/): Missing Authentication on Streaming gRPC Replication Endpoint (medium 6.3)
- [CVE-2026-57239](https://insights.sbomify.com/CVE-2026-57239/): Foxit PDF Editor/Reader Local Privilege Escalation (high 8.2)
- [CVE-2026-57238](https://insights.sbomify.com/CVE-2026-57238/): Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-57237](https://insights.sbomify.com/CVE-2026-57237/): Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-57236](https://insights.sbomify.com/CVE-2026-57236/): Nokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exception (low 1.7)
- [CVE-2026-57235](https://insights.sbomify.com/CVE-2026-57235/): Nokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]` (medium 6.3)
- [CVE-2026-57234](https://insights.sbomify.com/CVE-2026-57234/): Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247 (low 2.6)
- [CVE-2026-57233](https://insights.sbomify.com/CVE-2026-57233/): Notepad++: Path Traversal (Zip Slip) in WinGup Plugin Extraction (high 8.1)
- [CVE-2026-57232](https://insights.sbomify.com/CVE-2026-57232/): Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module (low 3.1)
- [CVE-2026-57231](https://insights.sbomify.com/CVE-2026-57231/): Podman: Malformed Image can trick podman run into leaking host environment variables into the container (high 7.5)
- [CVE-2026-57230](https://insights.sbomify.com/CVE-2026-57230/): OpenReplay: Authenticated ClickHouse SQL injection via session search (medium 5.4)
- [CVE-2026-57229](https://insights.sbomify.com/CVE-2026-57229/): Suricata smtp/mime: incomplete state reset allows detection bypass (medium 5.3)
- [CVE-2026-57228](https://insights.sbomify.com/CVE-2026-57228/): Suricata smtp/mime: heap out-of-bounds read quoted-printable decoder (high 8.2)
- [CVE-2026-57227](https://insights.sbomify.com/CVE-2026-57227/): Suricata mqtt: unbounded resource consumption from repeated pubrec and pubrel messages (high 7.5)
- [CVE-2026-57226](https://insights.sbomify.com/CVE-2026-57226/): Suricata swf: heap buffer overflow in SWF decompression depth handling (low 3.7)
- [CVE-2026-57225](https://insights.sbomify.com/CVE-2026-57225/): Suricata datasets: NULL pointer dereference in JSON/NDJSON dataset loading (low 3.3)
- [CVE-2026-57224](https://insights.sbomify.com/CVE-2026-57224/): Suricata dhcp: unbounded transactions in unidirectional traffic can lead to resource exhaustion (medium 6.5)
- [CVE-2026-57223](https://insights.sbomify.com/CVE-2026-57223/): Suricata windows: unquoted LocalSystem service ImagePath can allow local privilege escalation (high 7.0)
- [CVE-2026-57222](https://insights.sbomify.com/CVE-2026-57222/): Suricata ippair: hash collision can cause incorrect state reuse across IPv4 and IPv6 (medium 5.3)
- [CVE-2026-57221](https://insights.sbomify.com/CVE-2026-57221/): Missing authorization in rabbitmq-server (medium 5.3)
- [CVE-2026-57220](https://insights.sbomify.com/CVE-2026-57220/): Denial of service in rabbitmq-server (high 7.5)
- [CVE-2026-5722](https://insights.sbomify.com/CVE-2026-5722/): MoreConvert Pro <= 1.9.14 - Authentication Bypass via Waitlist Guest Verification Token Reuse (critical 9.8)
- [CVE-2026-57219](https://insights.sbomify.com/CVE-2026-57219/): Information disclosure in rabbitmq-server (high 8.7)
- [CVE-2026-57218](https://insights.sbomify.com/CVE-2026-57218/): RabbitMQ: AMQP 0-9-1 in combination with OAuth 2: consumer persistence can lead to post-revocation message disclosure (medium 4.9)
- [CVE-2026-57217](https://insights.sbomify.com/CVE-2026-57217/): RabbitMQ: Topic authorization can lead to cross-tenant routing-key bypass (high 7.0)
- [CVE-2026-57216](https://insights.sbomify.com/CVE-2026-57216/): Auth bypass in rabbitmq-server (medium 6.8)
- [CVE-2026-57215](https://insights.sbomify.com/CVE-2026-57215/): RabbitMQ: Direct-reply-to binding persistence can lead to unauthorized reply-channel injection and persistent phantom (high 7.0)
- [CVE-2026-57214](https://insights.sbomify.com/CVE-2026-57214/): RabbitMQ: Stored XSS in RabbitMQ management UI (high 7.1)
- [CVE-2026-57213](https://insights.sbomify.com/CVE-2026-57213/): RabbitMQ: Stored XSS federation management plugin via unsanitized consumer_tag rendering (medium 5.7)
- [CVE-2026-57212](https://insights.sbomify.com/CVE-2026-57212/): RabbitMQ management HTTP API accepts request bodies larger than configured max_http_body_size (high 7.1)
- [CVE-2026-57211](https://insights.sbomify.com/CVE-2026-57211/): RabbitMQ: UNC SSRF affecting the management UI on Windows (medium 6.5)
- [CVE-2026-57210](https://insights.sbomify.com/CVE-2026-57210/): Heimdall: IP Spoofing via Unvalidated Forwarding Headers (high 7.0)
- [CVE-2026-5721](https://insights.sbomify.com/CVE-2026-5721/): Cross-site scripting in wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin (medium 4.7)
- [CVE-2026-57209](https://insights.sbomify.com/CVE-2026-57209/): Heimdall: Forwarded Header Injection via Unsanitized Host Header in Proxy Mode (high 7.0)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/528/