# Vulnerabilities published in 2026


- [CVE-2026-49887](https://insights.sbomify.com/CVE-2026-49887/): Privilege escalation in Android (high 7.8)
- [CVE-2026-49885](https://insights.sbomify.com/CVE-2026-49885/): Integer overflow in Android (high 7.8)
- [CVE-2026-49884](https://insights.sbomify.com/CVE-2026-49884/): Memory corruption in Android (high 7.8)
- [CVE-2026-49883](https://insights.sbomify.com/CVE-2026-49883/): Missing authorization in Android Wear (critical 10.0)
- [CVE-2026-49882](https://insights.sbomify.com/CVE-2026-49882/): Memory corruption in Android (high 8.8)
- [CVE-2026-49881](https://insights.sbomify.com/CVE-2026-49881/): Business logic in Android (high 7.8)
- [CVE-2026-49880](https://insights.sbomify.com/CVE-2026-49880/): Memory corruption in Android (high 7.8)
- [CVE-2026-4988](https://insights.sbomify.com/CVE-2026-4988/): Open5GS CCA Message smf_s6b denial of service (medium 6.3)
- [CVE-2026-49879](https://insights.sbomify.com/CVE-2026-49879/): Integer overflow in Android (high 8.8)
- [CVE-2026-49878](https://insights.sbomify.com/CVE-2026-49878/): Memory corruption in Android (high 7.2)
- [CVE-2026-49877](https://insights.sbomify.com/CVE-2026-49877/): Apache ActiveMQ: Authenticated web users retain admin access by default in the Web Console (high 8.1)
- [CVE-2026-49876](https://insights.sbomify.com/CVE-2026-49876/): Server-side request forgery in Apache Gravitino (medium 6.5)
- [CVE-2026-49875](https://insights.sbomify.com/CVE-2026-49875/): Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils (medium 6.5)
- [CVE-2026-49872](https://insights.sbomify.com/CVE-2026-49872/): Apache APISIX: Improper authentication in cas-auth plugin (medium 5.3)
- [CVE-2026-49871](https://insights.sbomify.com/CVE-2026-49871/): Apache APISIX: cas-auth login CSRF / session injection issue (low 2.1)
- [CVE-2026-49870](https://insights.sbomify.com/CVE-2026-49870/): Snipe-IT: TOTP Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor` (medium 5.9)
- [CVE-2026-4987](https://insights.sbomify.com/CVE-2026-4987/): SureForms <= 2.5.2 - Unauthenticated Payment Amount Validation Bypass via 'form_id' (high 7.5)
- [CVE-2026-49869](https://insights.sbomify.com/CVE-2026-49869/): Kestra OSS OS Command Injection (critical 10.0, exploited in the wild)
- [CVE-2026-49868](https://insights.sbomify.com/CVE-2026-49868/): Integer overflow in RIOT (critical 9.8)
- [CVE-2026-49867](https://insights.sbomify.com/CVE-2026-49867/): DataEase: Authenticated Stored XSS in DataEase Template Static Resources (medium 6.3)
- [CVE-2026-49866](https://insights.sbomify.com/CVE-2026-49866/): libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays (high 7.5)
- [CVE-2026-49865](https://insights.sbomify.com/CVE-2026-49865/): Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Image URLs (medium 5.3)
- [CVE-2026-49864](https://insights.sbomify.com/CVE-2026-49864/): wetty vulnerable to DOM XSS via file-download filename (high 8.6)
- [CVE-2026-49860](https://insights.sbomify.com/CVE-2026-49860/): Deno: WebSocket API sandbox bypass via missing post-DNS check (medium 5.2)
- [CVE-2026-4986](https://insights.sbomify.com/CVE-2026-4986/): WPForms Lite < 1.10.0.5 – Unauthenticated PayPal Webhook Forgery (medium 5.3)
- [CVE-2026-49859](https://insights.sbomify.com/CVE-2026-49859/): Deno: `fetch()` API sandbox bypass via missing DNS resolution check (medium 5.2)
- [CVE-2026-49858](https://insights.sbomify.com/CVE-2026-49858/): API Platform Core: Cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate (medium 5.9)
- [CVE-2026-49857](https://insights.sbomify.com/CVE-2026-49857/): auth-fetch-mcp has SSRF Protection Bypass via IPv4-mapped IPv6 Loopback (high 7.4)
- [CVE-2026-49856](https://insights.sbomify.com/CVE-2026-49856/): @jshookmcp/jshook: ICMP probe and traceroute skip local-network SSRF authorization (medium 4.3)
- [CVE-2026-49855](https://insights.sbomify.com/CVE-2026-49855/): tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb) (high 7.5)
- [CVE-2026-49854](https://insights.sbomify.com/CVE-2026-49854/): Tornado: Out-of-bounds memory access in C extension (medium 5.3)
- [CVE-2026-49853](https://insights.sbomify.com/CVE-2026-49853/): Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient (high 7.7)
- [CVE-2026-49852](https://insights.sbomify.com/CVE-2026-49852/): joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363) (high 8.7)
- [CVE-2026-49851](https://insights.sbomify.com/CVE-2026-49851/): Mistune: Potential DoS via quadratic-time parsing in parse_link_text (high 8.7)
- [CVE-2026-49850](https://insights.sbomify.com/CVE-2026-49850/): InvoicePlane: Missing CSRF Protection on State-Changing delete Actions (high 7.5)
- [CVE-2026-4985](https://insights.sbomify.com/CVE-2026-4985/): dloebl CGIF GIF Image cgif.c cgif_addframe integer overflow (medium 5.3)
- [CVE-2026-49849](https://insights.sbomify.com/CVE-2026-49849/): xShop: Unrestricted File Upload in File Attachment Module in Admin panel leads to Arbitrary Code Execution (critical 9.1)
- [CVE-2026-49848](https://insights.sbomify.com/CVE-2026-49848/): FreeSWITCH: Pre-authentication `userVariables` injection in `mod_verto` (medium 4.3)
- [CVE-2026-49847](https://insights.sbomify.com/CVE-2026-49847/): FreeSWITCH: Stack overflow in bundled cJSON parser via deeply nested JSON (high 7.5)
- [CVE-2026-49846](https://insights.sbomify.com/CVE-2026-49846/): libks has path traversal in kws HTTP parser via URI segment overflow (high 7.5)
- [CVE-2026-49845](https://insights.sbomify.com/CVE-2026-49845/): Apache Hive: SQL Injection vulnerability in HiveMetaStore partition-name direct-SQL paths (critical 9.8)
- [CVE-2026-49844](https://insights.sbomify.com/CVE-2026-49844/): Apache Log4j API: Improper serialization of non-finite floating-point values in MapMessage.asJson() (medium 6.3)
- [CVE-2026-49843](https://insights.sbomify.com/CVE-2026-49843/): FreeSWITCH: Pre-authentication session eviction via attacker-chosen `sessid` in `mod_verto` (medium 5.3)
- [CVE-2026-49842](https://insights.sbomify.com/CVE-2026-49842/): FreeSWITCH: Pre-authentication bandwidth amplification via `mod_verto` speed-test frames (high 7.5)
- [CVE-2026-49841](https://insights.sbomify.com/CVE-2026-49841/): FreeSWITCH: Pre-authentication heap buffer overflow in `mod_verto` HTTP POST body read (critical 9.8)
- [CVE-2026-49840](https://insights.sbomify.com/CVE-2026-49840/): FreeSWITCH: Pre-authentication heap buffer overflow in libesl `Content-Length` parsing (critical 9.1)
- [CVE-2026-4984](https://insights.sbomify.com/CVE-2026-4984/): Botpress - Credential Disclosure via Twilio Webhook Handler (high 8.2)
- [CVE-2026-49839](https://insights.sbomify.com/CVE-2026-49839/): jq --rawfile invalid-state reuse after String too long causes heap-buffer-overflow (high 7.1)
- [CVE-2026-49838](https://insights.sbomify.com/CVE-2026-49838/): GoBGP confederation validation panics on empty AS_PATH attribute (medium 5.9)
- [CVE-2026-49837](https://insights.sbomify.com/CVE-2026-49837/): GoBGP: BGP OPEN capability parser may read capability values outside declared CapLen boundaries (medium 5.9)
- [CVE-2026-49836](https://insights.sbomify.com/CVE-2026-49836/): psd-tools: arbitrary file write via smart-object filename (medium 4.6)
- [CVE-2026-49835](https://insights.sbomify.com/CVE-2026-49835/): Sigstore Timestamp Authority: OOM due to unbounded metric label cardinality (medium 5.9)
- [CVE-2026-49834](https://insights.sbomify.com/CVE-2026-49834/): sigstore-go: Multi-log threshold bypass via single compromised log (medium 5.9)
- [CVE-2026-49833](https://insights.sbomify.com/CVE-2026-49833/): DSpace: Path Traversal possible in LDN message generation (medium 5.5)
- [CVE-2026-49832](https://insights.sbomify.com/CVE-2026-49832/): DSpace: Remote Code Execution (RCE) possible in Velocity Templates used by LDN (high 8.0)
- [CVE-2026-49831](https://insights.sbomify.com/CVE-2026-49831/): DSpace: Curation Task Reporter output path is not restricted to trusted directories (Path Traversal Vulnerability) (medium 5.5)
- [CVE-2026-49830](https://insights.sbomify.com/CVE-2026-49830/): DSpace: ORE resource URI does not validate scheme for non-web resources (medium 4.4)
- [CVE-2026-4983](https://insights.sbomify.com/CVE-2026-4983/): Cross-site scripting in Eclipse Open VSX (medium 4.1)
- [CVE-2026-49827](https://insights.sbomify.com/CVE-2026-49827/): WebErpMesv2 has Unauthenticated RCE via Unrestricted File Upload in HR Expense scan_file (CWE-434) (critical 9.8)
- [CVE-2026-49826](https://insights.sbomify.com/CVE-2026-49826/): Concourse login flow has an open redirect issue (not scored)
- [CVE-2026-49825](https://insights.sbomify.com/CVE-2026-49825/): lxml: javascript: URL bypass in Cleaner via xlink:href (high 8.2)
- [CVE-2026-49824](https://insights.sbomify.com/CVE-2026-49824/): Fission: Cross-namespace Environment reference via unvalidated EnvironmentRef in Function admission webhook (high 8.5)
- [CVE-2026-49823](https://insights.sbomify.com/CVE-2026-49823/): Fission: Cross-namespace Package read via unvalidated PackageRef in Function admission webhook (high 7.7)
- [CVE-2026-49822](https://insights.sbomify.com/CVE-2026-49822/): Fission: Cross-namespace event leakage via KubernetesWatchTrigger allows persistent tenant surveillance (high 7.7)
- [CVE-2026-49821](https://insights.sbomify.com/CVE-2026-49821/): Fission: Cross-namespace Environment reference in Package allows build-time command execution and SA token exfiltration (high 7.7)
- [CVE-2026-49820](https://insights.sbomify.com/CVE-2026-49820/): Probo has an open redirect bypass via path normalization (medium 4.7)
- [CVE-2026-4982](https://insights.sbomify.com/CVE-2026-4982/): Unauthorized access to chat contents (high 7.3)
- [CVE-2026-49819](https://insights.sbomify.com/CVE-2026-49819/): UpSnap - Unauthenticated Initial-Superuser Takeover Chains to Root RCE via wake_cmd (critical 9.8)
- [CVE-2026-49818](https://insights.sbomify.com/CVE-2026-49818/): Apache Airflow Samba provider: Path traversal in GCSToSambaOperator via GCS object names (medium 6.5)
- [CVE-2026-49817](https://insights.sbomify.com/CVE-2026-49817/): Deserialization in Dell Command Update (DCU) (high 7.8)
- [CVE-2026-49816](https://insights.sbomify.com/CVE-2026-49816/): Deserialization in Dell Command Update (DCU) (high 7.8)
- [CVE-2026-49815](https://insights.sbomify.com/CVE-2026-49815/): Command injection in PowerProtect Data Domain (high 7.2)
- [CVE-2026-49814](https://insights.sbomify.com/CVE-2026-49814/): Command injection in PowerProtect Data Domain (high 7.2)
- [CVE-2026-49813](https://insights.sbomify.com/CVE-2026-49813/): Command injection in PowerProtect Data Domain (medium 6.7)
- [CVE-2026-49811](https://insights.sbomify.com/CVE-2026-49811/): Privilege escalation in Command | Monitor (DCM) (high 8.4)
- [CVE-2026-49810](https://insights.sbomify.com/CVE-2026-49810/): Information disclosure in Command Powershell Provider (DCPP) (high 7.8)
- [CVE-2026-49809](https://insights.sbomify.com/CVE-2026-49809/): SQL injection in Cyber Recovery (medium 6.5)
- [CVE-2026-49808](https://insights.sbomify.com/CVE-2026-49808/): Windows Kernel Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-49807](https://insights.sbomify.com/CVE-2026-49807/): Windows DirectX Information Disclosure Vulnerability (medium 6.2)
- [CVE-2026-49806](https://insights.sbomify.com/CVE-2026-49806/): Windows USB Print Driver Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-49805](https://insights.sbomify.com/CVE-2026-49805/): Win32k Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-49804](https://insights.sbomify.com/CVE-2026-49804/): Windows USB Video Driver Elevation of Privilege Vulnerability (medium 6.6)
- [CVE-2026-49803](https://insights.sbomify.com/CVE-2026-49803/): Windows AppX Deployment Extensions Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-49802](https://insights.sbomify.com/CVE-2026-49802/): Windows USB Print Driver Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-49801](https://insights.sbomify.com/CVE-2026-49801/): Windows SMB Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-49800](https://insights.sbomify.com/CVE-2026-49800/): Windows Web Proxy Auto-Discovery Protocol (WPAD) Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-4980](https://insights.sbomify.com/CVE-2026-4980/): Improper Restriction of XML External Entity Reference in Inkscape (medium 6.3)
- [CVE-2026-49799](https://insights.sbomify.com/CVE-2026-49799/): Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability (medium 6.5)
- [CVE-2026-49798](https://insights.sbomify.com/CVE-2026-49798/): Windows Kernel Elevation of Privilege Vulnerability (critical 9.3)
- [CVE-2026-49797](https://insights.sbomify.com/CVE-2026-49797/): Windows NTFS Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-49796](https://insights.sbomify.com/CVE-2026-49796/): Windows GDI+ Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-49795](https://insights.sbomify.com/CVE-2026-49795/): Windows Kernel Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-49794](https://insights.sbomify.com/CVE-2026-49794/): Windows USB Audio Class Driver Information Disclosure Vulnerability (medium 4.6)
- [CVE-2026-49793](https://insights.sbomify.com/CVE-2026-49793/): Windows Resilient File System (ReFS) Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-49792](https://insights.sbomify.com/CVE-2026-49792/): Windows Resilient File System (ReFS) Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-49791](https://insights.sbomify.com/CVE-2026-49791/): Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability (high 7.1)
- [CVE-2026-49790](https://insights.sbomify.com/CVE-2026-49790/): Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability (high 7.3)
- [CVE-2026-4979](https://insights.sbomify.com/CVE-2026-4979/): UsersWP <= 1.2.58 - Authenticated (Subscriber+) Server-Side Request Forgery via 'uwp_crop' Parameter (medium 5.0)
- [CVE-2026-49789](https://insights.sbomify.com/CVE-2026-49789/): Windows NTFS Elevation of Privilege Vulnerability (high 7.3)
- [CVE-2026-49788](https://insights.sbomify.com/CVE-2026-49788/): HTTP/2 Denial of Service Vulnerability (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/582/