# Vulnerabilities published in 2026


- [CVE-2026-49364](https://insights.sbomify.com/CVE-2026-49364/): Information disclosure in Apache ActiveMQ Artemis (critical 9.1)
- [CVE-2026-49363](https://insights.sbomify.com/CVE-2026-49363/): Missing authorization in Apache ActiveMQ Artemis (high 7.5)
- [CVE-2026-49362](https://insights.sbomify.com/CVE-2026-49362/): Missing authorization in Apache ActiveMQ Artemis (high 7.5)
- [CVE-2026-49361](https://insights.sbomify.com/CVE-2026-49361/): Apache Fluss Netty Frame Decoder Memory Exhaustion Vulnerability (high 7.5)
- [CVE-2026-49360](https://insights.sbomify.com/CVE-2026-49360/): Recce server has unauthenticated SQL execution that allows local file read/write through DuckDB (high 7.8)
- [CVE-2026-4936](https://insights.sbomify.com/CVE-2026-4936/): Power System Insufficient Entropy (medium 5.1)
- [CVE-2026-49359](https://insights.sbomify.com/CVE-2026-49359/): PhpWeasyPrint vulnerable to SSRF and local file disclosure via the attachment option (medium 6.5)
- [CVE-2026-49358](https://insights.sbomify.com/CVE-2026-49358/): PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temporaryFiles (low 3.0)
- [CVE-2026-49357](https://insights.sbomify.com/CVE-2026-49357/): Streamable HTTP mode exposes LINE Desktop read/send tools without MCP authentication (high 8.8)
- [CVE-2026-49356](https://insights.sbomify.com/CVE-2026-49356/): Babel: Arbitrary File Read via sourceMappingURL Comment in @babel/core (low 3.2)
- [CVE-2026-49355](https://insights.sbomify.com/CVE-2026-49355/): OpenProject: Private work package data disclosure through single meeting agenda item API (medium 4.3)
- [CVE-2026-49353](https://insights.sbomify.com/CVE-2026-49353/): 9Router: Local-Only Access Gate Bypass in 9router via Host Header SpoofING (high 7.5)
- [CVE-2026-49352](https://insights.sbomify.com/CVE-2026-49352/): 9Router: Hardcoded Default fallback JWT Secret Allows Authentication Bypass (critical 9.8)
- [CVE-2026-4935](https://insights.sbomify.com/CVE-2026-4935/): SureTriggers < 1.1.23 – Unauthenticated SQLi (high 8.6)
- [CVE-2026-49349](https://insights.sbomify.com/CVE-2026-49349/): regclient may leak authentication credentials to external blob stores (medium 6.8)
- [CVE-2026-49347](https://insights.sbomify.com/CVE-2026-49347/): Quest Bot: Ticket creation has no per-user open-ticket limit or cooldown (medium 5.3)
- [CVE-2026-49346](https://insights.sbomify.com/CVE-2026-49346/): libde265 has a heap buffer overflow in de265_image_get_buffer via SPS dimension integer overflow (high 7.1)
- [CVE-2026-49345](https://insights.sbomify.com/CVE-2026-49345/): Mercator CVE Configuration Vulnerable to Server-Side Request Forgery (SSRF) (medium 5.3)
- [CVE-2026-49344](https://insights.sbomify.com/CVE-2026-49344/): Mercator has a Personal Identifiable Information Leak from Query Executor feature (high 7.1)
- [CVE-2026-49343](https://insights.sbomify.com/CVE-2026-49343/): Klever-Go KVM: Throttler slot leak in trie account-data sync causes epoch bootstrap / state sync DoS (medium 5.9)
- [CVE-2026-49342](https://insights.sbomify.com/CVE-2026-49342/): YARD static cache reads raw traversal paths before router sanitization (medium 5.3)
- [CVE-2026-49340](https://insights.sbomify.com/CVE-2026-49340/): gonic has arbitrary file write in createPlaylist: any authenticated user can write playlist M3U content to attacker-controlled path on the host (high 8.1)
- [CVE-2026-49339](https://insights.sbomify.com/CVE-2026-49339/): gonic: Path Traversal in playlist `id` bypasses ownership check, enabling any user to read/delete other users' playlists (high 7.1)
- [CVE-2026-49338](https://insights.sbomify.com/CVE-2026-49338/): Subsonic API: any authenticated user can delete or read any other user's playlist (IDOR) (high 7.1)
- [CVE-2026-49337](https://insights.sbomify.com/CVE-2026-49337/): libde265 has an unbounded memory leak via orphaned slice headers in `read_slice_NAL` (medium 4.3)
- [CVE-2026-49336](https://insights.sbomify.com/CVE-2026-49336/): @microsoft/kiota-http-fetchlibrary: Bearer token and Cookie leak across origin on redirect due to case-mismatched scrub in fetchRequestAdapter (medium 5.5)
- [CVE-2026-49332](https://insights.sbomify.com/CVE-2026-49332/): Auth bypass in Red Hat OpenShift Container Platform 4.12 (high 8.5)
- [CVE-2026-49331](https://insights.sbomify.com/CVE-2026-49331/): Openshift/oauth-proxy: openshift/oauth-proxy: unauthenticated identity header injection on whitelisted paths (medium 6.5)
- [CVE-2026-4933](https://insights.sbomify.com/CVE-2026-4933/): Unpublished Node Permissions - Critical - Access bypass - SA-CONTRIB-2026-029 (high 7.5)
- [CVE-2026-49329](https://insights.sbomify.com/CVE-2026-49329/): Denial of service in Red Hat OpenShift Container Platform 4.14 (high 7.5)
- [CVE-2026-49328](https://insights.sbomify.com/CVE-2026-49328/): Apache Fesod (Incubating): Improper validation of user-supplied URLs leading to SSRF (medium 5.3)
- [CVE-2026-49326](https://insights.sbomify.com/CVE-2026-49326/): Apache HBase: Missing scanner instance owner check in thrift delegation service (medium 6.5)
- [CVE-2026-49325](https://insights.sbomify.com/CVE-2026-49325/): Indian Scout Bobber 2025 WCM voltage-based shutdown (medium 4.1)
- [CVE-2026-49324](https://insights.sbomify.com/CVE-2026-49324/): Indian Scout Bobber 2025 WCM brute-force (medium 4.1)
- [CVE-2026-49323](https://insights.sbomify.com/CVE-2026-49323/): Indian Scout Bobber 2025 WCM-to-ECM weak authentication (medium 4.1)
- [CVE-2026-49322](https://insights.sbomify.com/CVE-2026-49322/): Indian Scout Bobber 2025 Infotainment-to-WCM weak authentication allows recovery of user PIN from observed exchange (medium 4.1)
- [CVE-2026-4932](https://insights.sbomify.com/CVE-2026-4932/): This Power System update is being released to address Insufficient Entropy (medium 4.2)
- [CVE-2026-49319](https://insights.sbomify.com/CVE-2026-49319/): Alps Electric Co., Ltd. R53R0 Remote Keyless Entry System (RKES) Replay Attack (medium 6.9)
- [CVE-2026-49318](https://insights.sbomify.com/CVE-2026-49318/): Indian Scout Bobber 2025 Infotainment Digital Round skips PIN entry when WCM is silent at boot (low 1.0)
- [CVE-2026-49317](https://insights.sbomify.com/CVE-2026-49317/): Indian Scout Bobber 2025 Infotainment Digital Round skips PIN entry when WCM is silent at boot (low 1.0)
- [CVE-2026-49316](https://insights.sbomify.com/CVE-2026-49316/): Indian Scout Bobber 2025 WCM CAN bus-off attack silently bypasses anti-theft shutdown (medium 4.1)
- [CVE-2026-49315](https://insights.sbomify.com/CVE-2026-49315/): Denial of service in EMUI (high 7.1)
- [CVE-2026-49314](https://insights.sbomify.com/CVE-2026-49314/): Memory corruption in HarmonyOS (high 7.3)
- [CVE-2026-49313](https://insights.sbomify.com/CVE-2026-49313/): Missing authorization in HarmonyOS (medium 5.5)
- [CVE-2026-49312](https://insights.sbomify.com/CVE-2026-49312/): Missing authorization in HarmonyOS (medium 4.0)
- [CVE-2026-49311](https://insights.sbomify.com/CVE-2026-49311/): Missing authorization in HarmonyOS (medium 6.2)
- [CVE-2026-49310](https://insights.sbomify.com/CVE-2026-49310/): Missing authorization in HarmonyOS (high 8.6)
- [CVE-2026-4931](https://insights.sbomify.com/CVE-2026-4931/): CVE-2026-4931 (medium 6.8)
- [CVE-2026-49309](https://insights.sbomify.com/CVE-2026-49309/): Missing authorization in EMUI (medium 4.8)
- [CVE-2026-49308](https://insights.sbomify.com/CVE-2026-49308/): Missing authorization in HarmonyOS (medium 5.5)
- [CVE-2026-49307](https://insights.sbomify.com/CVE-2026-49307/): Missing authorization in HarmonyOS (medium 6.2)
- [CVE-2026-49306](https://insights.sbomify.com/CVE-2026-49306/): Use after free in HarmonyOS (low 3.3)
- [CVE-2026-49305](https://insights.sbomify.com/CVE-2026-49305/): Missing authorization in EMUI (medium 6.2)
- [CVE-2026-49304](https://insights.sbomify.com/CVE-2026-49304/): Missing authorization in HarmonyOS (medium 6.2)
- [CVE-2026-49303](https://insights.sbomify.com/CVE-2026-49303/): Missing authorization in EMUI (medium 5.1)
- [CVE-2026-49302](https://insights.sbomify.com/CVE-2026-49302/): Missing authorization in HarmonyOS (medium 6.2)
- [CVE-2026-49301](https://insights.sbomify.com/CVE-2026-49301/): Missing authorization in EMUI (medium 6.2)
- [CVE-2026-4930](https://insights.sbomify.com/CVE-2026-4930/): DPA Countermeasures weakening on Series 3 devices (high 7.1)
- [CVE-2026-49299](https://insights.sbomify.com/CVE-2026-49299/): OpenStack Neutron has an Incorrect Authorization issue (medium 5.3)
- [CVE-2026-49298](https://insights.sbomify.com/CVE-2026-49298/): Apache Airflow: JWT Token Exposure in KubernetesExecutor Command-Line Arguments (high 8.8)
- [CVE-2026-49297](https://insights.sbomify.com/CVE-2026-49297/): Apache Airflow Google provider allows path traversal through GCS object names (high 8.1)
- [CVE-2026-49296](https://insights.sbomify.com/CVE-2026-49296/): Apache Airflow: Per-DAG read bypass discloses co-located DAGs' source via GET /api/v2/dagSources/{dag_id} (medium 6.5)
- [CVE-2026-49295](https://insights.sbomify.com/CVE-2026-49295/): libde265 has an out-of-bounds write in process_reference_picture_set via predicted short-term RPS (high 7.1)
- [CVE-2026-49294](https://insights.sbomify.com/CVE-2026-49294/): Valhalla has reflected XSS via unsanitized JSONP callback parameter (medium 6.1)
- [CVE-2026-49293](https://insights.sbomify.com/CVE-2026-49293/): CPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literals (high 7.5)
- [CVE-2026-49292](https://insights.sbomify.com/CVE-2026-49292/): Kiwi TCMS: The /init-db/ page renders and responds to requests after first use (not scored)
- [CVE-2026-49291](https://insights.sbomify.com/CVE-2026-49291/): mcp-memory-service: OAuth read-only clients can write and delete memories through MCP tools/call (high 8.1)
- [CVE-2026-49290](https://insights.sbomify.com/CVE-2026-49290/): Slopsmith has path traversal in archive extractors that allows arbitrary file write → potential RCE (high 7.6)
- [CVE-2026-4929](https://insights.sbomify.com/CVE-2026-4929/): Simple Hierarchical Select (Drupal 7) XSS in term-derived output (medium 5.1)
- [CVE-2026-49289](https://insights.sbomify.com/CVE-2026-49289/): SimpleSAMLphp SAML2: Possible DoS via XPath Transform (high 7.5)
- [CVE-2026-49288](https://insights.sbomify.com/CVE-2026-49288/): Statamic CMS missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources (medium 4.3)
- [CVE-2026-49287](https://insights.sbomify.com/CVE-2026-49287/): Statamic CMS vulnerable to unsafe method invocation via collection sorting allows data destruction (high 7.4)
- [CVE-2026-49286](https://insights.sbomify.com/CVE-2026-49286/): PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass) (high 8.1)
- [CVE-2026-49284](https://insights.sbomify.com/CVE-2026-49284/): SimpleSAMLphp SP accepts a response from an unexpected IdP when unsigned `Response/InResponseTo` is combined with a signed assertion lacking `SubjectConfirmationData/InResponseTo` (high 7.1)
- [CVE-2026-49283](https://insights.sbomify.com/CVE-2026-49283/): SimpleSAMLphp HTTP-Artifact TLS validator confusion allows cross-IdP authentication bypass (high 8.7)
- [CVE-2026-49282](https://insights.sbomify.com/CVE-2026-49282/): Capstone M68K and RISCV `cs_insn_name()` invalid IDs can trigger out-of-bounds reads and process crashes (medium 5.1)
- [CVE-2026-49279](https://insights.sbomify.com/CVE-2026-49279/): WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass) (high 7.7)
- [CVE-2026-49278](https://insights.sbomify.com/CVE-2026-49278/): Rocket.Chat: Livechat Visitor Profile Disclosure Leaks Bearer Token and Enables Visitor Impersonation (medium 6.7)
- [CVE-2026-49277](https://insights.sbomify.com/CVE-2026-49277/): Rocket.Chat: OAuth access and refresh tokens remain valid after account deactivation (low 2.3)
- [CVE-2026-49276](https://insights.sbomify.com/CVE-2026-49276/): Kirby: Self cross-site scripting (self-XSS) in the writer field (high 7.4)
- [CVE-2026-49274](https://insights.sbomify.com/CVE-2026-49274/): Kirby: `pages.access` permission is not checked in the pages picker for parent pages (medium 5.3)
- [CVE-2026-49271](https://insights.sbomify.com/CVE-2026-49271/): libheif: Wrapped icef compressed-unit range check causes out-of-bounds read in uncompressed HEIF decoder (medium 6.5)
- [CVE-2026-49270](https://insights.sbomify.com/CVE-2026-49270/): Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have an Exposure of Sensitive Information Through Metadata vulnerability (medium 5.9)
- [CVE-2026-4927](https://insights.sbomify.com/CVE-2026-4927/): Information disclosure in Server (medium 6.5)
- [CVE-2026-49269](https://insights.sbomify.com/CVE-2026-49269/): Apple M1 GPUs retain register file data between compute shader dispatches from different processes. (high 8.6)
- [CVE-2026-49268](https://insights.sbomify.com/CVE-2026-49268/): Apache Shiro: LDAP DN Injection in DefaultLdapRealm (high 8.8)
- [CVE-2026-49267](https://insights.sbomify.com/CVE-2026-49267/): Apache Airflow: No certificate validation on SMTP STARTTLS connections (medium 5.9)
- [CVE-2026-49265](https://insights.sbomify.com/CVE-2026-49265/): OAuthLib: Timing Attack Vulnerability in PKCE code_verifier Comparison (medium 6.8)
- [CVE-2026-49264](https://insights.sbomify.com/CVE-2026-49264/): OAuthLib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation (medium 6.1)
- [CVE-2026-49263](https://insights.sbomify.com/CVE-2026-49263/): Capstone WASM `br_table` instruction-size truncation can cause no-progress disassembly and parser desynchronization (low 2.0)
- [CVE-2026-49262](https://insights.sbomify.com/CVE-2026-49262/): Aimeos Pagible CMS vulnerable to Server Side Request Forgery (SSRF) via DNS rebinding in admin proxy (low 3.0)
- [CVE-2026-49261](https://insights.sbomify.com/CVE-2026-49261/): MariaDB server has unsafe parameter handling in `wsrep_notify_cmd` (critical 10.0)
- [CVE-2026-49260](https://insights.sbomify.com/CVE-2026-49260/): php-weasyprint: shell command injection via configurable WeasyPrint binary path due to inverted is_executable() guard (mirror of KnpLabs/snappy GHSA-vpr4-p6fq-85jc) (high 8.2)
- [CVE-2026-4926](https://insights.sbomify.com/CVE-2026-4926/): path-to-regexp vulnerable to Denial of Service via sequential optional groups (high 7.5)
- [CVE-2026-49258](https://insights.sbomify.com/CVE-2026-49258/): Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete) (high 8.8)
- [CVE-2026-49257](https://insights.sbomify.com/CVE-2026-49257/): mcp-pinot: Unauthenticated tool invocation via default oauth_enabled=False + host 0.0.0.0 bind (critical 10.0)
- [CVE-2026-49256](https://insights.sbomify.com/CVE-2026-49256/): Discourse: Hidden tag names leaked via category serializers (medium 6.3)
- [CVE-2026-49255](https://insights.sbomify.com/CVE-2026-49255/): electerm: Command Injection in File System Operations (rmrf, mv, cp) (high 8.8)
- [CVE-2026-49254](https://insights.sbomify.com/CVE-2026-49254/): Dragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /api/v1/oauth (low 2.9)
- [CVE-2026-49253](https://insights.sbomify.com/CVE-2026-49253/): electerm: Path Traversal in Zmodem and Trzsz Download Filename Handling (high 7.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/585/