# Vulnerabilities published in 2026


- [CVE-2026-46796](https://insights.sbomify.com/CVE-2026-46796/): Open redirect in Oracle WebCenter Sites (high 8.0)
- [CVE-2026-46795](https://insights.sbomify.com/CVE-2026-46795/): Missing authorization in Oracle WebCenter Content (critical 9.3)
- [CVE-2026-46794](https://insights.sbomify.com/CVE-2026-46794/): Privilege escalation in Identity Manager Connector (critical 9.9)
- [CVE-2026-46793](https://insights.sbomify.com/CVE-2026-46793/): Missing authorization in Identity Manager Connector (critical 9.9)
- [CVE-2026-46792](https://insights.sbomify.com/CVE-2026-46792/): Missing authorization in Identity Manager Connector (critical 9.9)
- [CVE-2026-46791](https://insights.sbomify.com/CVE-2026-46791/): Missing authorization in Oracle WebCenter Content (high 7.5)
- [CVE-2026-46790](https://insights.sbomify.com/CVE-2026-46790/): Information disclosure in Oracle WebCenter Content (medium 5.3)
- [CVE-2026-4679](https://insights.sbomify.com/CVE-2026-4679/): Integer overflow in Chrome (high 8.8)
- [CVE-2026-46789](https://insights.sbomify.com/CVE-2026-46789/): Auth bypass in Oracle WebCenter Content (critical 9.6)
- [CVE-2026-46788](https://insights.sbomify.com/CVE-2026-46788/): Missing authorization in Oracle WebCenter Content (high 8.4)
- [CVE-2026-46787](https://insights.sbomify.com/CVE-2026-46787/): Cross-site request forgery in Oracle WebCenter Content (high 8.0)
- [CVE-2026-46786](https://insights.sbomify.com/CVE-2026-46786/): Cross-site request forgery in Oracle WebCenter Content (critical 9.6)
- [CVE-2026-46785](https://insights.sbomify.com/CVE-2026-46785/): Cross-site request forgery in Oracle WebCenter Content (critical 9.3)
- [CVE-2026-46784](https://insights.sbomify.com/CVE-2026-46784/): Missing authorization in WebCenter Content: Imaging (critical 9.1)
- [CVE-2026-46783](https://insights.sbomify.com/CVE-2026-46783/): Missing authorization in WebCenter Content: Imaging (critical 9.8)
- [CVE-2026-46782](https://insights.sbomify.com/CVE-2026-46782/): Missing authorization in Oracle WebCenter Enterprise Capture (critical 9.9)
- [CVE-2026-46781](https://insights.sbomify.com/CVE-2026-46781/): Missing authorization in Oracle WebCenter Enterprise Capture (critical 10.0)
- [CVE-2026-46780](https://insights.sbomify.com/CVE-2026-46780/): Missing authorization in WebCenter Content: Imaging (high 8.8)
- [CVE-2026-4678](https://insights.sbomify.com/CVE-2026-4678/): Use after free in Chrome (high 8.8)
- [CVE-2026-46779](https://insights.sbomify.com/CVE-2026-46779/): Missing authorization in Oracle WebCenter Enterprise Capture (critical 9.9)
- [CVE-2026-46778](https://insights.sbomify.com/CVE-2026-46778/): Missing authorization in Oracle WebCenter Enterprise Capture (critical 10.0)
- [CVE-2026-46777](https://insights.sbomify.com/CVE-2026-46777/): Missing authorization in Oracle WebCenter Content (critical 9.1)
- [CVE-2026-46776](https://insights.sbomify.com/CVE-2026-46776/): Missing authorization in Oracle Unified Directory (high 8.6)
- [CVE-2026-46775](https://insights.sbomify.com/CVE-2026-46775/): Denial of service in Oracle REST Data Services (critical 9.9)
- [CVE-2026-46774](https://insights.sbomify.com/CVE-2026-46774/): Missing authorization in Oracle Unified Directory (critical 9.8)
- [CVE-2026-46773](https://insights.sbomify.com/CVE-2026-46773/): Missing authorization in Oracle Unified Directory (critical 9.8)
- [CVE-2026-46772](https://insights.sbomify.com/CVE-2026-46772/): Missing authorization in Oracle Application Development Framework (ADF) (medium 4.7)
- [CVE-2026-46771](https://insights.sbomify.com/CVE-2026-46771/): Missing authorization in Oracle Application Development Framework (ADF) (medium 4.1)
- [CVE-2026-46770](https://insights.sbomify.com/CVE-2026-46770/): Missing authorization in Oracle Application Development Framework (ADF) (medium 6.1)
- [CVE-2026-4677](https://insights.sbomify.com/CVE-2026-4677/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-46769](https://insights.sbomify.com/CVE-2026-46769/): Missing authorization in Oracle Application Development Framework (ADF) (high 7.2)
- [CVE-2026-46768](https://insights.sbomify.com/CVE-2026-46768/): Denial of service in Oracle VM VirtualBox (medium 6.0)
- [CVE-2026-46767](https://insights.sbomify.com/CVE-2026-46767/): Missing authorization in Oracle WebCenter Portal (critical 9.9)
- [CVE-2026-46766](https://insights.sbomify.com/CVE-2026-46766/): Missing authorization in Oracle WebCenter Content (critical 9.8)
- [CVE-2026-46765](https://insights.sbomify.com/CVE-2026-46765/): Missing authorization in Oracle WebCenter Portal (critical 9.9)
- [CVE-2026-46764](https://insights.sbomify.com/CVE-2026-46764/): Apache Airflow: Event Log detail endpoint bypasses DAG-scoped event log permission filter (medium 4.3)
- [CVE-2026-4676](https://insights.sbomify.com/CVE-2026-4676/): Use after free in Chrome (high 8.8)
- [CVE-2026-46752](https://insights.sbomify.com/CVE-2026-46752/): Apache Kvrocks: Stack buffer overflow in Lua bit.tohex() (critical 10.0)
- [CVE-2026-46751](https://insights.sbomify.com/CVE-2026-46751/): Code injection in Apache Kvrocks (medium 5.5)
- [CVE-2026-4675](https://insights.sbomify.com/CVE-2026-4675/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-46749](https://insights.sbomify.com/CVE-2026-46749/): Weak cryptography in SINEC INS (medium 5.0)
- [CVE-2026-46748](https://insights.sbomify.com/CVE-2026-46748/): Privilege escalation in SINEC INS (high 8.7)
- [CVE-2026-46747](https://insights.sbomify.com/CVE-2026-46747/): Path traversal in SINEC INS (medium 5.3)
- [CVE-2026-46746](https://insights.sbomify.com/CVE-2026-46746/): Command injection in SINEC INS (high 8.7)
- [CVE-2026-46745](https://insights.sbomify.com/CVE-2026-46745/): Apache Airflow FAB provider: LDAP Filter Injection in FAB Auth Manager _search_ldap reachable via /auth/token (medium 5.3)
- [CVE-2026-46741](https://insights.sbomify.com/CVE-2026-46741/): Etsy::StatsD versions through 1.002002 for Perl allow metric injections (high 7.5)
- [CVE-2026-46740](https://insights.sbomify.com/CVE-2026-46740/): Mojolicious::Plugin::Statsd versions through 0.04 for Perl allowed metric injections (medium 5.3)
- [CVE-2026-4674](https://insights.sbomify.com/CVE-2026-4674/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-46739](https://insights.sbomify.com/CVE-2026-46739/): Net::Statsd versions before 0.13 for Perl allow metric injections (medium 5.3)
- [CVE-2026-46738](https://insights.sbomify.com/CVE-2026-46738/): Privilege escalation in PowerProtect Data Manager (critical 9.1)
- [CVE-2026-46737](https://insights.sbomify.com/CVE-2026-46737/): Other in PowerProtect Data Manager (medium 6.7)
- [CVE-2026-46735](https://insights.sbomify.com/CVE-2026-46735/): Command injection in Display and Peripheral Manager (high 7.8)
- [CVE-2026-46734](https://insights.sbomify.com/CVE-2026-46734/): Security feature bypass in Display and Peripheral Manager (high 7.3)
- [CVE-2026-46733](https://insights.sbomify.com/CVE-2026-46733/): Missing authorization in Display and Peripheral Manager (high 7.8)
- [CVE-2026-46732](https://insights.sbomify.com/CVE-2026-46732/): Race condition in Display and Peripheral Manager (medium 6.7)
- [CVE-2026-46731](https://insights.sbomify.com/CVE-2026-46731/): Auth bypass in Display and Peripheral Manager (DDPM Windows) (high 7.8)
- [CVE-2026-46730](https://insights.sbomify.com/CVE-2026-46730/): Missing authorization in PowerProtect Data Domain (medium 4.2)
- [CVE-2026-4673](https://insights.sbomify.com/CVE-2026-4673/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-46729](https://insights.sbomify.com/CVE-2026-46729/): Apache HTTP Server: mod_heartmonitor denial of service (high 7.5)
- [CVE-2026-46728](https://insights.sbomify.com/CVE-2026-46728/): Security feature bypass in U-Boot (high 8.2)
- [CVE-2026-46727](https://insights.sbomify.com/CVE-2026-46727/): Use after free in Ruby (high 8.1)
- [CVE-2026-46726](https://insights.sbomify.com/CVE-2026-46726/): Apache Camel-Vertx-Websocket: The inbound consumer maps externally-supplied WebSocket query and path parameters into the Exchange without a HeaderFilterStrategy (high 7.5)
- [CVE-2026-46725](https://insights.sbomify.com/CVE-2026-46725/): Remote Code Execution in extension "Content Element Selector" (ceselector) (critical 9.2)
- [CVE-2026-46724](https://insights.sbomify.com/CVE-2026-46724/): Path Traversal in extension "Faceted Search" (ke_search) (medium 5.9)
- [CVE-2026-46723](https://insights.sbomify.com/CVE-2026-46723/): Information Disclosure in extension "Faceted Search" (ke_search) (medium 5.9)
- [CVE-2026-46722](https://insights.sbomify.com/CVE-2026-46722/): XML External Entity Injection in extension "Faceted Search" (ke_search) (medium 5.9)
- [CVE-2026-46721](https://insights.sbomify.com/CVE-2026-46721/): Broken Access Control in extension "Frontend User Registration" (sf_register) (medium 6.9)
- [CVE-2026-46720](https://insights.sbomify.com/CVE-2026-46720/): Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections (high 8.2)
- [CVE-2026-4672](https://insights.sbomify.com/CVE-2026-4672/): Missing Authorization in GitLab (medium 4.3)
- [CVE-2026-46719](https://insights.sbomify.com/CVE-2026-46719/): Net::Statsd::Lite versions before 0.9.0 for Perl allowed metric injections (medium 6.5)
- [CVE-2026-46718](https://insights.sbomify.com/CVE-2026-46718/): Apache Calcite: A user-controled model can load arbitrary classes, leading to code execution (medium 6.5)
- [CVE-2026-46717](https://insights.sbomify.com/CVE-2026-46717/): Nezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notification (high 7.7)
- [CVE-2026-46716](https://insights.sbomify.com/CVE-2026-46716/): Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron (critical 9.9)
- [CVE-2026-46715](https://insights.sbomify.com/CVE-2026-46715/): Flask-Security-Too OAuth reauthentication freshness bypass via cross- user OAuth identity acceptance (medium 5.3)
- [CVE-2026-46714](https://insights.sbomify.com/CVE-2026-46714/): Misskey: Denial of Service via Uncontrolled Recursion in Theme Compilation (medium 5.1)
- [CVE-2026-46713](https://insights.sbomify.com/CVE-2026-46713/): Misskey: JSON-LD signature validation + compaction may lead to improper activity handling (critical 9.2)
- [CVE-2026-46712](https://insights.sbomify.com/CVE-2026-46712/): Misskey: Lack of proper permission checks in Direct Messaging feature (low 2.3)
- [CVE-2026-46711](https://insights.sbomify.com/CVE-2026-46711/): Missing authorization in security (high 8.3)
- [CVE-2026-46710](https://insights.sbomify.com/CVE-2026-46710/): Notepad++: Privilege Escalation in the Installer via Uncontrolled Executable Search Path (high 7.5)
- [CVE-2026-4671](https://insights.sbomify.com/CVE-2026-4671/): justhtml before 1.18.0 Denial of Service via CSS Selector (high 8.7)
- [CVE-2026-46709](https://insights.sbomify.com/CVE-2026-46709/): Tabby: Drag-and-drop path injection still allows RCE via shell command substitution (incomplete fix for CVE-2026-45038) (high 7.8)
- [CVE-2026-46708](https://insights.sbomify.com/CVE-2026-46708/): EspoCRM: Target list Opt-Out actions allows opting out record without access Target List and access to record (medium 4.3)
- [CVE-2026-46705](https://insights.sbomify.com/CVE-2026-46705/): russh server userauth state is not reset when authentication principal changes (medium 5.3)
- [CVE-2026-46703](https://insights.sbomify.com/CVE-2026-46703/): BoxLite: Path Traversal Vulnerability in boxlite Leads to Arbitrary File Write on the Host (critical 9.6)
- [CVE-2026-46702](https://insights.sbomify.com/CVE-2026-46702/): Russh: Post-decompression SSH packet size was not bounded, allowing remote oversized compressed packets (high 7.5)
- [CVE-2026-46701](https://insights.sbomify.com/CVE-2026-46701/): Network-AI: Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret (high 7.6)
- [CVE-2026-46700](https://insights.sbomify.com/CVE-2026-46700/): @actual-app/sync-server's missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secrets (medium 4.3)
- [CVE-2026-4670](https://insights.sbomify.com/CVE-2026-4670/): Improper Authentication vulnerability in Progress MOVEit Automation (critical 9.8)
- [CVE-2026-46699](https://insights.sbomify.com/CVE-2026-46699/): Business logic in conda-smithy (high 7.6)
- [CVE-2026-46698](https://insights.sbomify.com/CVE-2026-46698/): Fediverse Embeds: Public-nonce SSRF via ftf_get_site_info AJAX action (medium 5.3)
- [CVE-2026-46697](https://insights.sbomify.com/CVE-2026-46697/): Fediverse Embeds: Unauthenticated SSRF / open proxy via REST media-proxy endpoint (high 7.5)
- [CVE-2026-46696](https://insights.sbomify.com/CVE-2026-46696/): October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls (low 3.3)
- [CVE-2026-46695](https://insights.sbomify.com/CVE-2026-46695/): BoxLite: Permission Bypass in boxlite Allows Modification of Read-Only Files (critical 10.0)
- [CVE-2026-46694](https://insights.sbomify.com/CVE-2026-46694/): EspoCRM: Portal User ACL Bypass Exposes Internal Stream Notes (medium 6.5)
- [CVE-2026-46693](https://insights.sbomify.com/CVE-2026-46693/): ImageMagick: Race Condition in distributed pixel cache server can result in file descriptor hijacking (medium 4.1)
- [CVE-2026-46692](https://insights.sbomify.com/CVE-2026-46692/): ImageMagick: Heap Buffer Over-Write in distributed pixel cache server (medium 4.1)
- [CVE-2026-46691](https://insights.sbomify.com/CVE-2026-46691/): EspoCRM: IDOR in Import exportErrors Endpoint Leaks CSV Data of Other Users (medium 6.5)
- [CVE-2026-46690](https://insights.sbomify.com/CVE-2026-46690/): unbounded-spsc: Sender::send pointer-as-value transmute causes OOB read and fake-Arc drop under TX/RX race (medium 5.8)
- [CVE-2026-46689](https://insights.sbomify.com/CVE-2026-46689/): Kanidm: Unauthenticated process abort via SCIM filter stack exhaustion (high 8.7)
- [CVE-2026-46688](https://insights.sbomify.com/CVE-2026-46688/): Meeting Room Booking System has an unauthenticated open redirect (medium 6.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/609/