# Vulnerabilities published in 2026


- [CVE-2026-50285](https://insights.sbomify.com/CVE-2026-50285/): Pomerium: Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE Callback (high 7.5)
- [CVE-2026-50284](https://insights.sbomify.com/CVE-2026-50284/): Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets (high 7.1)
- [CVE-2026-50283](https://insights.sbomify.com/CVE-2026-50283/): Craft CMS: Unauthorized Deletion of Source Assets During File Replacement (medium 5.3)
- [CVE-2026-50282](https://insights.sbomify.com/CVE-2026-50282/): Craft CMS: Unauthorized Deletion of Destination Folders During Forced Moves (medium 4.9)
- [CVE-2026-50281](https://insights.sbomify.com/CVE-2026-50281/): Craft CMS: Mass assignment via id in newAttributes during bulk duplicate overwrites existing elements (high 7.1)
- [CVE-2026-50280](https://insights.sbomify.com/CVE-2026-50280/): Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check (medium 6.0)
- [CVE-2026-5028](https://insights.sbomify.com/CVE-2026-5028/): Eight Day Week Print Workflow <= 1.2.6 - Authenticated (Subscriber+) SQL Injection via 'title' Parameter (medium 6.5)
- [CVE-2026-50279](https://insights.sbomify.com/CVE-2026-50279/): Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap (high 7.6)
- [CVE-2026-50278](https://insights.sbomify.com/CVE-2026-50278/): iccDEV: CIccEmbedIO::Read8() size_t underflow (medium 6.5)
- [CVE-2026-50277](https://insights.sbomify.com/CVE-2026-50277/): dd-trace-cpp: Improper parsing of W3C baggage headers may lead to DoS (high 7.5)
- [CVE-2026-50276](https://insights.sbomify.com/CVE-2026-50276/): dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS (high 7.5)
- [CVE-2026-50275](https://insights.sbomify.com/CVE-2026-50275/): Datadog PHP Tracer: Improper parsing of W3C baggage headers may lead to DoS (high 7.5)
- [CVE-2026-50274](https://insights.sbomify.com/CVE-2026-50274/): dd-trace-go: Improper parsing of W3C baggage headers may lead to DoS (high 7.5)
- [CVE-2026-50273](https://insights.sbomify.com/CVE-2026-50273/): Datadog .NET Tracer: Improper parsing of W3C baggage headers may lead to DoS (high 7.5)
- [CVE-2026-50272](https://insights.sbomify.com/CVE-2026-50272/): dd-trace: Improper parsing of W3C baggage headers may lead to DoS (high 7.5)
- [CVE-2026-50271](https://insights.sbomify.com/CVE-2026-50271/): dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS (high 7.5)
- [CVE-2026-50270](https://insights.sbomify.com/CVE-2026-50270/): dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS (high 7.5)
- [CVE-2026-5027](https://insights.sbomify.com/CVE-2026-5027/): Langflow - Path Traversal Arbitrary File Write via upload_user_file (high 8.8)
- [CVE-2026-50269](https://insights.sbomify.com/CVE-2026-50269/): AIOHTTP: CRLF injection in multipart headers (low 2.7)
- [CVE-2026-50268](https://insights.sbomify.com/CVE-2026-50268/): Steeltoe: OAEP setting silently selects PKCS#1 v1.5 padding (low 1.9)
- [CVE-2026-50267](https://insights.sbomify.com/CVE-2026-50267/): Steeltoe: TLS private keys written to /tmp with default permissions, never deleted (medium 4.7)
- [CVE-2026-50266](https://insights.sbomify.com/CVE-2026-50266/): OpenStack Neutron: Neutron port RBAC policy bypass allows project managers to set trusted device owners on shared networks (low 2.2)
- [CVE-2026-50264](https://insights.sbomify.com/CVE-2026-50264/): Memory corruption in Red Hat Enterprise Linux 10 (high 7.8)
- [CVE-2026-50263](https://insights.sbomify.com/CVE-2026-50263/): Use after free in Red Hat Enterprise Linux 10 (medium 5.5)
- [CVE-2026-50262](https://insights.sbomify.com/CVE-2026-50262/): Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: out-of-bounds read/write in glx changedrawableattributes (medium 5.5)
- [CVE-2026-50261](https://insights.sbomify.com/CVE-2026-50261/): Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in syncchangecounter() (high 7.8)
- [CVE-2026-50260](https://insights.sbomify.com/CVE-2026-50260/): Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in freecounter() (high 7.8)
- [CVE-2026-5026](https://insights.sbomify.com/CVE-2026-5026/): Langflow - Stored XSS via Malicious SVG Upload (high 7.0)
- [CVE-2026-50259](https://insights.sbomify.com/CVE-2026-50259/): Memory corruption in Red Hat Enterprise Linux 10 (high 7.8)
- [CVE-2026-50258](https://insights.sbomify.com/CVE-2026-50258/): Memory corruption in Red Hat Enterprise Linux 10 (high 7.8)
- [CVE-2026-50257](https://insights.sbomify.com/CVE-2026-50257/): Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in misyncdestroyfence() (high 7.8)
- [CVE-2026-50256](https://insights.sbomify.com/CVE-2026-50256/): Memory corruption in Red Hat Enterprise Linux 10 (high 7.8)
- [CVE-2026-50255](https://insights.sbomify.com/CVE-2026-50255/): Misconfiguration in Optical Disc Archive Software for Windows (medium 5.4)
- [CVE-2026-50254](https://insights.sbomify.com/CVE-2026-50254/): OFFIS DCMTK Toolkit Missing Release of Memory after Effective Lifetime (high 8.7)
- [CVE-2026-50252](https://insights.sbomify.com/CVE-2026-50252/): Possible cache poisoning attack by mapping source port population per thread (medium 5.7)
- [CVE-2026-50251](https://insights.sbomify.com/CVE-2026-50251/): Attacker supplied '0.0.0.0'/'::' glue triggers defensive full-cache flush (medium 5.3)
- [CVE-2026-5025](https://insights.sbomify.com/CVE-2026-5025/): Langflow - Application Logs Exposed to All Authenticated Users (medium 6.5)
- [CVE-2026-50248](https://insights.sbomify.com/CVE-2026-50248/): BOGUS configured primary hostname accepted for XFR in auth/rpz zones (medium 6.5)
- [CVE-2026-50245](https://insights.sbomify.com/CVE-2026-50245/): Brickcom Cameras Missing Authentication for Critical Function (high 8.3)
- [CVE-2026-50244](https://insights.sbomify.com/CVE-2026-50244/): Naxclow IoT Platform Missing Authorization (medium 6.9)
- [CVE-2026-50243](https://insights.sbomify.com/CVE-2026-50243/): 'response-ip'/'rpz' can rewrite BOGUS answers instead of returning SERVFAIL (medium 6.3)
- [CVE-2026-50242](https://insights.sbomify.com/CVE-2026-50242/): Auth bypass in Hub (critical 10.0)
- [CVE-2026-5024](https://insights.sbomify.com/CVE-2026-5024/): D-Link DIR-513 formSetEmail stack-based overflow (high 8.7)
- [CVE-2026-50237](https://insights.sbomify.com/CVE-2026-50237/): Server-side request forgery in Red Hat OpenShift Container Platform 4.12 (high 7.4)
- [CVE-2026-50236](https://insights.sbomify.com/CVE-2026-50236/): Server-side request forgery in Red Hat OpenShift Container Platform 4.14 (high 7.4)
- [CVE-2026-50235](https://insights.sbomify.com/CVE-2026-50235/): Lyrion Music Server 9.2.0 Reflected XSS via search Parameters (medium 5.1)
- [CVE-2026-50234](https://insights.sbomify.com/CVE-2026-50234/): Lyrion Music Server 9.2.0 Path Traversal File Read (high 8.7)
- [CVE-2026-50233](https://insights.sbomify.com/CVE-2026-50233/): Lyrion Music Server 9.2.0 Arbitrary Directory Listing (medium 6.9)
- [CVE-2026-50232](https://insights.sbomify.com/CVE-2026-50232/): Lyrion Music Server 9.2.0 Stored XSS via Metadata Tags (medium 5.1)
- [CVE-2026-50231](https://insights.sbomify.com/CVE-2026-50231/): Lyrion Music Server 9.2.0 Unauthenticated Stored XSS via server.log (medium 5.1)
- [CVE-2026-50230](https://insights.sbomify.com/CVE-2026-50230/): Lyrion Music Server 9.2.0 Reflected XSS via server.log (medium 5.1)
- [CVE-2026-5023](https://insights.sbomify.com/CVE-2026-5023/): DeDeveloper23 codebase-mcp RepoMix codebase.ts saveCodebase os command injection (medium 4.8)
- [CVE-2026-50229](https://insights.sbomify.com/CVE-2026-50229/): Apache Tomcat: XSS in number guess example (medium 6.1)
- [CVE-2026-50228](https://insights.sbomify.com/CVE-2026-50228/): Electron DevTools Arbitrary Code Execution Vulnerability in NitroSense (medium 6.1)
- [CVE-2026-50227](https://insights.sbomify.com/CVE-2026-50227/): MQTT WebSocket Command Execution Vulnerability in NitroSense (medium 6.1)
- [CVE-2026-50226](https://insights.sbomify.com/CVE-2026-50226/): Firmware Theft & IMEI Spoofing via Connect-OTA (medium 6.9)
- [CVE-2026-50225](https://insights.sbomify.com/CVE-2026-50225/): Account Creation Exhaustion (high 8.8)
- [CVE-2026-50224](https://insights.sbomify.com/CVE-2026-50224/): Unauthenticated IPv6 WAN Management Exposure (medium 6.9)
- [CVE-2026-50223](https://insights.sbomify.com/CVE-2026-50223/): Apache OFBiz: DataResource Low-Privileged Authenticated FreeMarker Template Injection Leads to Remote Code Execution (high 8.8)
- [CVE-2026-50222](https://insights.sbomify.com/CVE-2026-50222/): Apache CloudStack: Improper access control in Userdata reference APIs (high 7.5)
- [CVE-2026-50221](https://insights.sbomify.com/CVE-2026-50221/): OpenStack Swift vulnerable to authenticated server-side request forgery (medium 5.3)
- [CVE-2026-5022](https://insights.sbomify.com/CVE-2026-5022/): Langflow - Missing Authorization on download_image Endpoint (medium 6.3)
- [CVE-2026-50219](https://insights.sbomify.com/CVE-2026-50219/): Use after free in libexpat (medium 4.9)
- [CVE-2026-50218](https://insights.sbomify.com/CVE-2026-50218/): Auth bypass in Guardicore Platform Agent (high 8.5)
- [CVE-2026-50217](https://insights.sbomify.com/CVE-2026-50217/): Use after free in Guardicore Platform Agent (medium 4.7)
- [CVE-2026-50216](https://insights.sbomify.com/CVE-2026-50216/): Integer overflow in Guardicore Platform Agent (medium 5.3)
- [CVE-2026-50215](https://insights.sbomify.com/CVE-2026-50215/): Use after free in Guardicore Platform Agent (medium 4.4)
- [CVE-2026-50214](https://insights.sbomify.com/CVE-2026-50214/): Shared Secret Quota Inflation (critical 9.3)
- [CVE-2026-50213](https://insights.sbomify.com/CVE-2026-50213/): Bulk User Private Data Harvesting (high 8.7)
- [CVE-2026-50212](https://insights.sbomify.com/CVE-2026-50212/): Arbitrary Remote Device Unbinding (high 7.1)
- [CVE-2026-50211](https://insights.sbomify.com/CVE-2026-50211/): Exposed Factory Testing App Boundaries (high 8.8)
- [CVE-2026-50210](https://insights.sbomify.com/CVE-2026-50210/): Weak Static Cryptographic Initialization Vectors (medium 6.9)
- [CVE-2026-5021](https://insights.sbomify.com/CVE-2026-5021/): Tenda F453 httpd PPTPUserSetting fromPPTPUserSetting stack-based overflow (high 8.7)
- [CVE-2026-50209](https://insights.sbomify.com/CVE-2026-50209/): MDM Server Registration Overriding (critical 9.3)
- [CVE-2026-50208](https://insights.sbomify.com/CVE-2026-50208/): Permissive TrustAllCerts TLS Verification (critical 9.2)
- [CVE-2026-50207](https://insights.sbomify.com/CVE-2026-50207/): Local Modem Manipulation via Binder Interfaces (high 8.5)
- [CVE-2026-50206](https://insights.sbomify.com/CVE-2026-50206/): VPN Command Injection Vulnerability (high 8.5)
- [CVE-2026-50205](https://insights.sbomify.com/CVE-2026-50205/): Plaintext Log Credential Leakage (high 8.8)
- [CVE-2026-50203](https://insights.sbomify.com/CVE-2026-50203/): Apache Airflow SFTP provider: Path traversal in SFTPHook.retrieve_directory (critical 9.1)
- [CVE-2026-50202](https://insights.sbomify.com/CVE-2026-50202/): Steeltoe's static JWKS cache shared across schemes and never invalidated (medium 5.9)
- [CVE-2026-50201](https://insights.sbomify.com/CVE-2026-50201/): Steeltoe's sensitive actuators (heapdump/env) only require Restricted permission (medium 6.5)
- [CVE-2026-50200](https://insights.sbomify.com/CVE-2026-50200/): Steeltoe's env sanitizer misses connection strings — leaks embedded DB passwords (high 7.5)
- [CVE-2026-5020](https://insights.sbomify.com/CVE-2026-5020/): Totolink A3600R Parameter cstecgi.cgi setNoticeCfg command injection (medium 5.3)
- [CVE-2026-50199](https://insights.sbomify.com/CVE-2026-50199/): Wallos: Cross-user Fixer/API Layer credential consumption in exchange-rate refresh (medium 4.3)
- [CVE-2026-50198](https://insights.sbomify.com/CVE-2026-50198/): Wallos: Cross-user subscription cost inference via replacement_subscription_id (medium 4.3)
- [CVE-2026-50197](https://insights.sbomify.com/CVE-2026-50197/): Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding: chunked / HTTP/2 requests (high 7.8)
- [CVE-2026-50196](https://insights.sbomify.com/CVE-2026-50196/): Steeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire registry fetch (high 7.5)
- [CVE-2026-50195](https://insights.sbomify.com/CVE-2026-50195/): containerd: CRI checkpoint import allows local image tag poisoning (medium 5.6)
- [CVE-2026-50194](https://insights.sbomify.com/CVE-2026-50194/): Steeltoe vulnerable to management-port isolation bypass via spoofed Host header (high 8.2)
- [CVE-2026-50193](https://insights.sbomify.com/CVE-2026-50193/): jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString() (medium 6.3)
- [CVE-2026-50192](https://insights.sbomify.com/CVE-2026-50192/): Kerberos Hub private key (X-Kerberos-Hub-PrivateKey) leaked to cross-host redirect target due to redirect-following HTTP client without CheckRedirect (medium 6.9)
- [CVE-2026-50191](https://insights.sbomify.com/CVE-2026-50191/): 4gaBoards: Pre-Account Takeover via SSO Email Linkage (high 8.8)
- [CVE-2026-50190](https://insights.sbomify.com/CVE-2026-50190/): Shaarli vulnerable to stored XSS via raw bookmark title in document <title> element on public permalink page (high 8.6)
- [CVE-2026-5019](https://insights.sbomify.com/CVE-2026-5019/): code-projects Simple Food Order System Parameter all-orders.php sql injection (medium 6.9)
- [CVE-2026-50189](https://insights.sbomify.com/CVE-2026-50189/): Appsmith: RCE via Supervisord XML-RPC Admin Interface Exposed via /supervisor Caddy Route (high 8.9)
- [CVE-2026-50188](https://insights.sbomify.com/CVE-2026-50188/): Kirby: Request header injection in `Http\Remote` (medium 6.9)
- [CVE-2026-50187](https://insights.sbomify.com/CVE-2026-50187/): Oh My Zsh: Arbitrary Code Execution in oh-my-zsh dotenv plugin via malicious .env files (high 8.8)
- [CVE-2026-50186](https://insights.sbomify.com/CVE-2026-50186/): 4gaBoards: Path Traversal leading to Arbitrary File Read and Deletion in Board Export (high 8.8)
- [CVE-2026-50185](https://insights.sbomify.com/CVE-2026-50185/): RustCrypto Cmov/CmovEq on aarch64 can produce wrong results if high-bits of registers are set (low 2.0)
- [CVE-2026-50184](https://insights.sbomify.com/CVE-2026-50184/): Angular: Request Credential & Cache Policy Stripping in Angular Service Worker (medium 5.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/579/