# Vulnerabilities published in 2026


- [CVE-2026-47372](https://insights.sbomify.com/CVE-2026-47372/): Crypt::SaltedHash versions through 0.09 for Perl generate insecure random values for salts (critical 9.1)
- [CVE-2026-47370](https://insights.sbomify.com/CVE-2026-47370/): Command injection in EFG (critical 9.9)
- [CVE-2026-4737](https://insights.sbomify.com/CVE-2026-4737/): Use-After-Free Vulnerability in No-Chicken/Echo-Mate (high 7.3)
- [CVE-2026-47369](https://insights.sbomify.com/CVE-2026-47369/): Privilege escalation in EFG (critical 9.9)
- [CVE-2026-47368](https://insights.sbomify.com/CVE-2026-47368/): Path traversal in EFG (high 8.6)
- [CVE-2026-47367](https://insights.sbomify.com/CVE-2026-47367/): Command injection in UID Enterprise Agent (critical 9.9)
- [CVE-2026-47366](https://insights.sbomify.com/CVE-2026-47366/): Privilege escalation in phpBB (high 7.2)
- [CVE-2026-47365](https://insights.sbomify.com/CVE-2026-47365/): Command injection in WordPress-Toolkit (critical 9.9)
- [CVE-2026-47364](https://insights.sbomify.com/CVE-2026-47364/): Information disclosure in Android App (medium 6.5)
- [CVE-2026-47363](https://insights.sbomify.com/CVE-2026-47363/): Missing authorization in Android App (medium 6.3)
- [CVE-2026-47362](https://insights.sbomify.com/CVE-2026-47362/): Information disclosure in Android App (medium 4.6)
- [CVE-2026-47361](https://insights.sbomify.com/CVE-2026-47361/): Missing authorization in Android App (medium 6.4)
- [CVE-2026-47360](https://insights.sbomify.com/CVE-2026-47360/): Apache HTTP Server: mod_session: Session cookie not removed during internal redirect (high 7.5)
- [CVE-2026-4736](https://insights.sbomify.com/CVE-2026-4736/): Math Issue in No-Chicken/Echo-Mate (high 7.3)
- [CVE-2026-47359](https://insights.sbomify.com/CVE-2026-47359/): Apache CloudStack: OS Command Injection due to unsanitized mount command (high 8.8)
- [CVE-2026-47358](https://insights.sbomify.com/CVE-2026-47358/): Server-side request forgery in Terrascan (critical 9.3)
- [CVE-2026-47357](https://insights.sbomify.com/CVE-2026-47357/): Server-side request forgery in Terrascan (critical 9.3)
- [CVE-2026-47356](https://insights.sbomify.com/CVE-2026-47356/): Server-side request forgery in Terrascan (high 8.7)
- [CVE-2026-47352](https://insights.sbomify.com/CVE-2026-47352/): TYPO3 CMS - Broken Access Control in Backend API (medium 5.3)
- [CVE-2026-47351](https://insights.sbomify.com/CVE-2026-47351/): TYPO3 CMS - Broken Access Control in Clipboard (medium 5.3)
- [CVE-2026-47350](https://insights.sbomify.com/CVE-2026-47350/): TYPO3 CMS - Broken Access Control in DataHandler (medium 5.3)
- [CVE-2026-4735](https://insights.sbomify.com/CVE-2026-4735/): A stack overflow and DoS vulnerability in DTStack/chunjun (high 8.7)
- [CVE-2026-47349](https://insights.sbomify.com/CVE-2026-47349/): TYPO3 CMS - Broken Access Control in Recycler (medium 5.3)
- [CVE-2026-47348](https://insights.sbomify.com/CVE-2026-47348/): TYPO3 CMS - Cross-Site Scripting in Indexed Search (medium 5.1)
- [CVE-2026-47347](https://insights.sbomify.com/CVE-2026-47347/): TYPO3 CMS - Open Redirect in Core Utilities (medium 5.3)
- [CVE-2026-47346](https://insights.sbomify.com/CVE-2026-47346/): TYPO3 CMS - Broken Access Control in Form Framework (high 7.6)
- [CVE-2026-47345](https://insights.sbomify.com/CVE-2026-47345/): TYPO3 HTML Sanitizer allows Cross-Site Scripting (medium 5.1)
- [CVE-2026-47344](https://insights.sbomify.com/CVE-2026-47344/): TYPO3 HTML Sanitizer allows Cross-Site Scripting (low 2.1)
- [CVE-2026-47343](https://insights.sbomify.com/CVE-2026-47343/): TYPO3 CMS - Destructive Actions on File Mount Folders (high 7.2)
- [CVE-2026-47342](https://insights.sbomify.com/CVE-2026-47342/): Apache OFBiz: Privilege Escalation via updateOrRemove Authorization Bypass (high 8.8)
- [CVE-2026-47341](https://insights.sbomify.com/CVE-2026-47341/): Apache APISIX: Session replay issue in hmac-auth (medium 6.3)
- [CVE-2026-47340](https://insights.sbomify.com/CVE-2026-47340/): Apache DolphinScheduler: An incorrect authorization vulnerability allows authenticated users to access alert instances associated with alert groups they do not have permission to access. (medium 6.5)
- [CVE-2026-4734](https://insights.sbomify.com/CVE-2026-4734/): Heap Buffer Overflow in yoyofr/modizer (critical 9.4)
- [CVE-2026-47339](https://insights.sbomify.com/CVE-2026-47339/): Apache APISIX: authz-casdoor incorrect session sharing (medium 5.3)
- [CVE-2026-47337](https://insights.sbomify.com/CVE-2026-47337/): NULL pointer dereference in Ubuntu Linux AppArmor IPv4/IPv6 socket mediation (low 3.3)
- [CVE-2026-47336](https://insights.sbomify.com/CVE-2026-47336/): Use of uninitialized value in Ubuntu Linux AppArmor IPv4/IPv6 socket mediation rules (low 3.3)
- [CVE-2026-47335](https://insights.sbomify.com/CVE-2026-47335/): NULL pointer dereference in Ubuntu Linux AppArmor notification handling (medium 5.5)
- [CVE-2026-47334](https://insights.sbomify.com/CVE-2026-47334/): Deadlock or kernel panic in Ubuntu Linux AppArmor notification handling (medium 5.5)
- [CVE-2026-47333](https://insights.sbomify.com/CVE-2026-47333/): Out-of-bounds read in Ubuntu Linux AppArmor notification handling (high 7.8)
- [CVE-2026-47332](https://insights.sbomify.com/CVE-2026-47332/): Out-of-bounds read in Ubuntu Linux AppArmor notification handling (medium 5.5)
- [CVE-2026-47331](https://insights.sbomify.com/CVE-2026-47331/): Use-after-free in Ubuntu Linux AppArmor notification handling (high 7.8)
- [CVE-2026-47330](https://insights.sbomify.com/CVE-2026-47330/): Use of uninitialized value in Ubuntu Linux AppArmor notification handling (low 3.3)
- [CVE-2026-4733](https://insights.sbomify.com/CVE-2026-4733/): Information disclosure in ixray-1.6-stcop (medium 5.3)
- [CVE-2026-47329](https://insights.sbomify.com/CVE-2026-47329/): Incorrect validation of field size in Ubuntu Linux AppArmor notification responses (low 3.3)
- [CVE-2026-47328](https://insights.sbomify.com/CVE-2026-47328/): Invalid pointer deallocation in Ubuntu Linux AppArmor notification handling (medium 6.1)
- [CVE-2026-47327](https://insights.sbomify.com/CVE-2026-47327/): NULL pointer dereference in Ubuntu Linux AppArmor notification handling (low 3.3)
- [CVE-2026-47326](https://insights.sbomify.com/CVE-2026-47326/): Memory leak in Ubuntu Linux AppArmor large notification response allocation (medium 5.5)
- [CVE-2026-47325](https://insights.sbomify.com/CVE-2026-47325/): Weak password policy in ProjectsAndPrograms school-management-system (medium 6.9)
- [CVE-2026-47324](https://insights.sbomify.com/CVE-2026-47324/): Stored XSS in Multiple Points in ProjectsAndPrograms school-management-system (medium 5.1)
- [CVE-2026-47323](https://insights.sbomify.com/CVE-2026-47323/): Apache Camel: Camel-CXF Message Header Injection via Missing Inbound Filtering (critical 9.8)
- [CVE-2026-47321](https://insights.sbomify.com/CVE-2026-47321/): Apache MINA: Unbounded Decompression Amplification DoS in Zlib.inflate (high 7.5)
- [CVE-2026-47320](https://insights.sbomify.com/CVE-2026-47320/): Memory corruption in rlottie (medium 6.1)
- [CVE-2026-4732](https://insights.sbomify.com/CVE-2026-4732/): Out-of-bounds Read Overflow in tildearrow/furnace (high 8.4)
- [CVE-2026-47319](https://insights.sbomify.com/CVE-2026-47319/): Denial of service in rlottie (medium 6.1)
- [CVE-2026-47318](https://insights.sbomify.com/CVE-2026-47318/): Memory corruption in rlottie (medium 6.1)
- [CVE-2026-47317](https://insights.sbomify.com/CVE-2026-47317/): Denial of service in Escargot (medium 5.5)
- [CVE-2026-47316](https://insights.sbomify.com/CVE-2026-47316/): Other in Escargot (medium 5.5)
- [CVE-2026-47315](https://insights.sbomify.com/CVE-2026-47315/): Other in Escargot (medium 5.5)
- [CVE-2026-47314](https://insights.sbomify.com/CVE-2026-47314/): Memory corruption in Escargot (high 7.8)
- [CVE-2026-47313](https://insights.sbomify.com/CVE-2026-47313/): Denial of service in Escargot (medium 5.5)
- [CVE-2026-47312](https://insights.sbomify.com/CVE-2026-47312/): Memory corruption in Escargot (medium 5.5)
- [CVE-2026-47311](https://insights.sbomify.com/CVE-2026-47311/): Memory corruption in Escargot (high 7.8)
- [CVE-2026-47310](https://insights.sbomify.com/CVE-2026-47310/): Use after free in Escargot (high 7.8)
- [CVE-2026-4731](https://insights.sbomify.com/CVE-2026-4731/): An Integer Overflow Vulnerability in artraweditor/ART (high 8.5)
- [CVE-2026-47309](https://insights.sbomify.com/CVE-2026-47309/): Denial of service in Escargot (medium 5.5)
- [CVE-2026-47308](https://insights.sbomify.com/CVE-2026-47308/): Null dereference in Walrus (medium 5.5)
- [CVE-2026-47307](https://insights.sbomify.com/CVE-2026-47307/): Null dereference in Walrus (medium 5.5)
- [CVE-2026-47306](https://insights.sbomify.com/CVE-2026-47306/): Denial of service in rlottie (medium 6.1)
- [CVE-2026-47305](https://insights.sbomify.com/CVE-2026-47305/): Visual Studio Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-47304](https://insights.sbomify.com/CVE-2026-47304/): .NET Security Feature Bypass Vulnerability (high 8.1)
- [CVE-2026-47303](https://insights.sbomify.com/CVE-2026-47303/): ASP.NET Core Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-47302](https://insights.sbomify.com/CVE-2026-47302/): .NET Denial of Service Vulnerability (high 7.5)
- [CVE-2026-47301](https://insights.sbomify.com/CVE-2026-47301/): Configuration Manager Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-47300](https://insights.sbomify.com/CVE-2026-47300/): ASP.NET Core Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-4730](https://insights.sbomify.com/CVE-2026-4730/): Cross-site scripting in Charts Ninja: Create Beautiful Graphs & Charts and Easily Add Them to Your Website (medium 6.4)
- [CVE-2026-47299](https://insights.sbomify.com/CVE-2026-47299/): Azure Monitor Agent Elevation of Privilege Vulnerability (high 7.2)
- [CVE-2026-47298](https://insights.sbomify.com/CVE-2026-47298/): Microsoft SharePoint Server Remote Code Execution Vulnerability (high 8.0)
- [CVE-2026-47297](https://insights.sbomify.com/CVE-2026-47297/): Microsoft SQL Server Remote Code Execution Vulnerability (high 8.1)
- [CVE-2026-47296](https://insights.sbomify.com/CVE-2026-47296/): Microsoft SQL Server Elevation of Privilege Vulnerability (high 7.5)
- [CVE-2026-47295](https://insights.sbomify.com/CVE-2026-47295/): Microsoft SQL Server Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-47294](https://insights.sbomify.com/CVE-2026-47294/): Microsoft SharePoint Server Remote Code Execution Vulnerability (high 8.0)
- [CVE-2026-47293](https://insights.sbomify.com/CVE-2026-47293/): Microsoft Office Click-To-Run Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-47292](https://insights.sbomify.com/CVE-2026-47292/): Visual Studio Code MSSQL Extension Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-47291](https://insights.sbomify.com/CVE-2026-47291/): HTTP.sys Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-47290](https://insights.sbomify.com/CVE-2026-47290/): Microsoft Office Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-4729](https://insights.sbomify.com/CVE-2026-4729/): Memory safety bugs fixed in Firefox 149 and Thunderbird 149 (critical 9.8)
- [CVE-2026-47289](https://insights.sbomify.com/CVE-2026-47289/): Remote Desktop Client Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-47288](https://insights.sbomify.com/CVE-2026-47288/): Windows Kerberos Key Distribution Center (KDC) Remote Code Execution (high 7.1)
- [CVE-2026-47287](https://insights.sbomify.com/CVE-2026-47287/): Visual Studio Code Tampering Vulnerability (medium 6.5)
- [CVE-2026-47285](https://insights.sbomify.com/CVE-2026-47285/): Visual Studio Code Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-47284](https://insights.sbomify.com/CVE-2026-47284/): Visual Studio Code Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-47282](https://insights.sbomify.com/CVE-2026-47282/): GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-47281](https://insights.sbomify.com/CVE-2026-47281/): Visual Studio Code Elevation of Privilege Vulnerability (critical 9.6)
- [CVE-2026-47280](https://insights.sbomify.com/CVE-2026-47280/): Azure Resource Manager Elevation of Privilege Vulnerability (critical 10.0)
- [CVE-2026-4728](https://insights.sbomify.com/CVE-2026-4728/): Spoofing issue in the Privacy: Anti-Tracking component (medium 6.5)
- [CVE-2026-47279](https://insights.sbomify.com/CVE-2026-47279/): NocoDB: Hidden LTAR Column Exposure in Public Shared-View Relation Endpoints (medium 6.9)
- [CVE-2026-47277](https://insights.sbomify.com/CVE-2026-47277/): Runtipi: Unauthenticated arbitrary file read through app-store logo symlinks (medium 6.5)
- [CVE-2026-47276](https://insights.sbomify.com/CVE-2026-47276/): NULL Pointer Dereference in REST API properties_parse via Malformed user_properties (medium 6.5)
- [CVE-2026-47275](https://insights.sbomify.com/CVE-2026-47275/): nanomq NULL Pointer Dereference in MQTTv5 Client CONNECT Decoder Leading to Remote DoS (low 2.6)
- [CVE-2026-47274](https://insights.sbomify.com/CVE-2026-47274/): pam_usb: Uncontrolled search path in pam_usb tools allows privilege escalation via PATH manipulation (medium 6.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/603/