# Vulnerabilities published in 2026


- [CVE-2026-55075](https://insights.sbomify.com/CVE-2026-55075/): Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass (high 7.4)
- [CVE-2026-55074](https://insights.sbomify.com/CVE-2026-55074/): Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv) (high 8.2)
- [CVE-2026-55073](https://insights.sbomify.com/CVE-2026-55073/): WeasyPrint restrictive URL fetcher bypass allows local file read and SSRF (medium 6.2)
- [CVE-2026-55072](https://insights.sbomify.com/CVE-2026-55072/): Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name (high 8.5)
- [CVE-2026-55071](https://insights.sbomify.com/CVE-2026-55071/): MCP-for-Stata: Stata Command Injection via Unsanitized `package` in `ado_package_install` (high 8.4)
- [CVE-2026-5507](https://insights.sbomify.com/CVE-2026-5507/): Session Cache Restore — Arbitrary Free via Deserialized Pointer (medium 4.1)
- [CVE-2026-55069](https://insights.sbomify.com/CVE-2026-55069/): Kestra BasicAuth Password Stored as SHA-512 Enables Offline Brute-Force Attack (high 8.7)
- [CVE-2026-55068](https://insights.sbomify.com/CVE-2026-55068/): free5GC NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints (critical 9.3)
- [CVE-2026-55067](https://insights.sbomify.com/CVE-2026-55067/): Vikunja: Authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignment (medium 5.0)
- [CVE-2026-55066](https://insights.sbomify.com/CVE-2026-55066/): Vikunja: Cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id (high 7.1)
- [CVE-2026-55065](https://insights.sbomify.com/CVE-2026-55065/): Vikunja: Improper Authorization and Authorization Bypass Through User-Controlled Key in code.vikunja.io/api (high 8.1)
- [CVE-2026-55064](https://insights.sbomify.com/CVE-2026-55064/): Vikunja has an incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0 (medium 4.3)
- [CVE-2026-55062](https://insights.sbomify.com/CVE-2026-55062/): uniget: Path Traversal in Hook Files - Directory Escape Vulnerability (high 8.4)
- [CVE-2026-55061](https://insights.sbomify.com/CVE-2026-55061/): uniget: EDITOR Command Injection in uniget CLI (low 1.0)
- [CVE-2026-55060](https://insights.sbomify.com/CVE-2026-55060/): GoCD is vulnerable to authorization bypass via support process list API (low 3.7)
- [CVE-2026-5506](https://insights.sbomify.com/CVE-2026-5506/): Wavr <= 0.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-55059](https://insights.sbomify.com/CVE-2026-55059/): OpenEXR: OpenEXRUtil SampleCountChannel row setter heap has an out-of-bounds write vulnerability (medium 6.1)
- [CVE-2026-55058](https://insights.sbomify.com/CVE-2026-55058/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-55057](https://insights.sbomify.com/CVE-2026-55057/): Microsoft Office Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-55056](https://insights.sbomify.com/CVE-2026-55056/): Microsoft Office Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-55055](https://insights.sbomify.com/CVE-2026-55055/): Microsoft Word Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-55054](https://insights.sbomify.com/CVE-2026-55054/): Microsoft Excel Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-55053](https://insights.sbomify.com/CVE-2026-55053/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-55052](https://insights.sbomify.com/CVE-2026-55052/): Microsoft SharePoint Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-55051](https://insights.sbomify.com/CVE-2026-55051/): Microsoft SharePoint Server Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-55050](https://insights.sbomify.com/CVE-2026-55050/): Microsoft Word Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-5505](https://insights.sbomify.com/CVE-2026-5505/): WP-Clippy <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-55049](https://insights.sbomify.com/CVE-2026-55049/): Microsoft Office Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-55048](https://insights.sbomify.com/CVE-2026-55048/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-55047](https://insights.sbomify.com/CVE-2026-55047/): Microsoft Office Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-55046](https://insights.sbomify.com/CVE-2026-55046/): Microsoft Excel Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-55045](https://insights.sbomify.com/CVE-2026-55045/): Microsoft Office Remote Code Execution Vulnerability (high 8.4)
- [CVE-2026-55044](https://insights.sbomify.com/CVE-2026-55044/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-55043](https://insights.sbomify.com/CVE-2026-55043/): Microsoft PowerPoint Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-55042](https://insights.sbomify.com/CVE-2026-55042/): Microsoft Office Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-55041](https://insights.sbomify.com/CVE-2026-55041/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-55040](https://insights.sbomify.com/CVE-2026-55040/): Microsoft SharePoint Weak Authentication (critical 9.1, exploited in the wild)
- [CVE-2026-5504](https://insights.sbomify.com/CVE-2026-5504/): PKCS7 CBC Padding Oracle — Plaintext Recovery (medium 6.3)
- [CVE-2026-55039](https://insights.sbomify.com/CVE-2026-55039/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-55038](https://insights.sbomify.com/CVE-2026-55038/): Microsoft Word Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-55037](https://insights.sbomify.com/CVE-2026-55037/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-55036](https://insights.sbomify.com/CVE-2026-55036/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-55035](https://insights.sbomify.com/CVE-2026-55035/): Microsoft Office Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-55034](https://insights.sbomify.com/CVE-2026-55034/): Microsoft SharePoint Server Spoofing Vulnerability (high 7.3)
- [CVE-2026-55033](https://insights.sbomify.com/CVE-2026-55033/): Microsoft Word Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-55032](https://insights.sbomify.com/CVE-2026-55032/): Microsoft Word Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-55031](https://insights.sbomify.com/CVE-2026-55031/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-55030](https://insights.sbomify.com/CVE-2026-55030/): Microsoft SharePoint Server Spoofing Vulnerability (medium 4.6)
- [CVE-2026-5503](https://insights.sbomify.com/CVE-2026-5503/): out-of-bounds write in TLSX_EchChangeSNI via attacker-controlled publicName (medium 6.9)
- [CVE-2026-55029](https://insights.sbomify.com/CVE-2026-55029/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-55028](https://insights.sbomify.com/CVE-2026-55028/): Microsoft Office Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-55027](https://insights.sbomify.com/CVE-2026-55027/): Microsoft Office Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-55026](https://insights.sbomify.com/CVE-2026-55026/): Microsoft Office Information Disclosure Vulnerability (medium 6.2)
- [CVE-2026-55025](https://insights.sbomify.com/CVE-2026-55025/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-55024](https://insights.sbomify.com/CVE-2026-55024/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-55023](https://insights.sbomify.com/CVE-2026-55023/): Microsoft Office Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-55022](https://insights.sbomify.com/CVE-2026-55022/): Microsoft Office Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-55021](https://insights.sbomify.com/CVE-2026-55021/): Microsoft SharePoint Server Spoofing Vulnerability (high 7.3)
- [CVE-2026-55020](https://insights.sbomify.com/CVE-2026-55020/): Microsoft SharePoint Server Spoofing Vulnerability (medium 4.6)
- [CVE-2026-5502](https://insights.sbomify.com/CVE-2026-5502/): Missing authorization in Tutor LMS – eLearning and online course solution (medium 5.3)
- [CVE-2026-55019](https://insights.sbomify.com/CVE-2026-55019/): Microsoft SharePoint Server Spoofing Vulnerability (medium 4.6)
- [CVE-2026-55018](https://insights.sbomify.com/CVE-2026-55018/): Microsoft Office Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-55017](https://insights.sbomify.com/CVE-2026-55017/): Microsoft Office Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-55016](https://insights.sbomify.com/CVE-2026-55016/): Microsoft SharePoint Server Spoofing Vulnerability (medium 4.6)
- [CVE-2026-55015](https://insights.sbomify.com/CVE-2026-55015/): Microsoft Remote Help Denial of Service Vulnerability (medium 5.5)
- [CVE-2026-55014](https://insights.sbomify.com/CVE-2026-55014/): Windows Remote Help Defense Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-55013](https://insights.sbomify.com/CVE-2026-55013/): Windows Remote Help Defense Spoofing Vulnerability (high 7.1)
- [CVE-2026-55012](https://insights.sbomify.com/CVE-2026-55012/): Microsoft Defender Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-55011](https://insights.sbomify.com/CVE-2026-55011/): Microsoft Defender Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-55010](https://insights.sbomify.com/CVE-2026-55010/): Minecraft Bedrock Dedicated Server Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-5501](https://insights.sbomify.com/CVE-2026-5501/): Improper Certificate Signature Verification in X.509 Chain Validation Allows Forged Leaf Certificates (high 8.6)
- [CVE-2026-55009](https://insights.sbomify.com/CVE-2026-55009/): Microsoft Exchange Server Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-55008](https://insights.sbomify.com/CVE-2026-55008/): Microsoft Exchange Server Spoofing Vulnerability (critical 9.6)
- [CVE-2026-55007](https://insights.sbomify.com/CVE-2026-55007/): Microsoft Exchange Server Remote Code Execution Vulnerability (high 8.1)
- [CVE-2026-55006](https://insights.sbomify.com/CVE-2026-55006/): Microsoft Exchange Server Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-55005](https://insights.sbomify.com/CVE-2026-55005/): Microsoft Exchange Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-55004](https://insights.sbomify.com/CVE-2026-55004/): Windows Print Configuration Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-55003](https://insights.sbomify.com/CVE-2026-55003/): Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-55002](https://insights.sbomify.com/CVE-2026-55002/): Microsoft SQL Server Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-55001](https://insights.sbomify.com/CVE-2026-55001/): Active Directory Domain Services Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-55000](https://insights.sbomify.com/CVE-2026-55000/): Windows USB Print Driver Elevation of Privilege Vulnerability (medium 6.4)
- [CVE-2026-5500](https://insights.sbomify.com/CVE-2026-5500/): Improper Validation of AES-GCM Authentication Tag Length in PKCS#7 Envelope Allows Authentication Bypass (high 8.7)
- [CVE-2026-54999](https://insights.sbomify.com/CVE-2026-54999/): Windows TCP/IP Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-54998](https://insights.sbomify.com/CVE-2026-54998/): Microsoft Exchange Online Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-54997](https://insights.sbomify.com/CVE-2026-54997/): Windows SMB Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-54996](https://insights.sbomify.com/CVE-2026-54996/): Windows USB Print Driver Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-54995](https://insights.sbomify.com/CVE-2026-54995/): Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability (high 8.1)
- [CVE-2026-54993](https://insights.sbomify.com/CVE-2026-54993/): Microsoft Windows Media Foundation Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-54992](https://insights.sbomify.com/CVE-2026-54992/): Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability (high 8.4)
- [CVE-2026-54991](https://insights.sbomify.com/CVE-2026-54991/): Windows USB Print Driver Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-54990](https://insights.sbomify.com/CVE-2026-54990/): Remote Desktop Client Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-54989](https://insights.sbomify.com/CVE-2026-54989/): Quality Windows Audio/Video Experience (QWAVE) Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-54988](https://insights.sbomify.com/CVE-2026-54988/): Microsoft Excel Information Disclosure Vulnerability (medium 6.1)
- [CVE-2026-54987](https://insights.sbomify.com/CVE-2026-54987/): Windows Overlay Filter Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-54986](https://insights.sbomify.com/CVE-2026-54986/): Windows Win32k Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-54984](https://insights.sbomify.com/CVE-2026-54984/): Windows Imaging Component Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-54983](https://insights.sbomify.com/CVE-2026-54983/): Windows Active Directory Federation Services Denial of Service Vulnerability (high 7.5)
- [CVE-2026-54982](https://insights.sbomify.com/CVE-2026-54982/): Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-54981](https://insights.sbomify.com/CVE-2026-54981/): Visual Studio Code Python Extension Security Feature Bypass Vulnerability (high 7.8)
- [CVE-2026-5497](https://insights.sbomify.com/CVE-2026-5497/): Unbounded Frame Count in video/jpeg Base64 Data URL Processing Leads to OOM DoS in vllm-project/vllm (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/546/