# Vulnerabilities published in 2026


- [CVE-2026-45472](https://insights.sbomify.com/CVE-2026-45472/): Microsoft Office Remote Code Execution Vulnerability (high 8.4)
- [CVE-2026-45471](https://insights.sbomify.com/CVE-2026-45471/): Microsoft Word Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-4547](https://insights.sbomify.com/CVE-2026-4547/): mickasmt next-saas-stripe-starter Checkout generate-user-stripe.ts generateUserStripe logic error (medium 5.3)
- [CVE-2026-45469](https://insights.sbomify.com/CVE-2026-45469/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-45468](https://insights.sbomify.com/CVE-2026-45468/): Microsoft SharePoint Server Spoofing Vulnerability (medium 4.6)
- [CVE-2026-45467](https://insights.sbomify.com/CVE-2026-45467/): Microsoft SharePoint Server Spoofing Vulnerability (medium 4.6)
- [CVE-2026-45466](https://insights.sbomify.com/CVE-2026-45466/): Microsoft Word Information Disclosure Vulnerability (low 3.3)
- [CVE-2026-45465](https://insights.sbomify.com/CVE-2026-45465/): Microsoft SharePoint Server Spoofing Vulnerability (medium 5.4)
- [CVE-2026-45464](https://insights.sbomify.com/CVE-2026-45464/): Microsoft SharePoint Server Spoofing Vulnerability (medium 5.4)
- [CVE-2026-45463](https://insights.sbomify.com/CVE-2026-45463/): Microsoft Office Remote Code Execution Vulnerability (high 8.4)
- [CVE-2026-45462](https://insights.sbomify.com/CVE-2026-45462/): Microsoft SharePoint Server Spoofing Vulnerability (medium 4.6)
- [CVE-2026-45461](https://insights.sbomify.com/CVE-2026-45461/): Microsoft Office Remote Code Execution Vulnerability (high 8.4)
- [CVE-2026-45460](https://insights.sbomify.com/CVE-2026-45460/): Microsoft Office Information Disclosure Vulnerability (medium 4.7)
- [CVE-2026-4546](https://insights.sbomify.com/CVE-2026-4546/): Flos Freeware Notepad2 TextShaping.dll uncontrolled search path (high 7.3)
- [CVE-2026-45459](https://insights.sbomify.com/CVE-2026-45459/): Microsoft Excel Security Feature Bypass Vulnerability (low 3.3)
- [CVE-2026-45458](https://insights.sbomify.com/CVE-2026-45458/): Microsoft Outlook and Word Remote Code Execution Vulnerability (high 8.4)
- [CVE-2026-45457](https://insights.sbomify.com/CVE-2026-45457/): Microsoft Word Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-45456](https://insights.sbomify.com/CVE-2026-45456/): Microsoft Outlook and Word Remote Code Execution Vulnerability (high 8.4)
- [CVE-2026-45455](https://insights.sbomify.com/CVE-2026-45455/): Microsoft Excel Information Disclosure Vulnerability (low 3.3)
- [CVE-2026-45454](https://insights.sbomify.com/CVE-2026-45454/): Microsoft SharePoint Remote Code Execution Vulnerability (medium 6.5)
- [CVE-2026-45453](https://insights.sbomify.com/CVE-2026-45453/): Microsoft SharePoint Server Spoofing Vulnerability (medium 5.4)
- [CVE-2026-45452](https://insights.sbomify.com/CVE-2026-45452/): Unitronics - CWE-134 Use of Externally-Controlled format string (high 8.3)
- [CVE-2026-45451](https://insights.sbomify.com/CVE-2026-45451/): Unitronics - CWE-287: Improper Authentication (high 8.3)
- [CVE-2026-45450](https://insights.sbomify.com/CVE-2026-45450/): Unitronics - CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer (high 8.3)
- [CVE-2026-4545](https://insights.sbomify.com/CVE-2026-4545/): Flos Freeware Notepad2 PROPSYS.dll uncontrolled search path (high 7.3)
- [CVE-2026-45449](https://insights.sbomify.com/CVE-2026-45449/): Unitronics - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (high 8.3)
- [CVE-2026-45448](https://insights.sbomify.com/CVE-2026-45448/): ntopng - CWE-601: URL Redirection to Untrusted Site ('Open Redirect') (medium 4.3)
- [CVE-2026-45447](https://insights.sbomify.com/CVE-2026-45447/): Heap Use-After-Free in the PKCS7_verify() Function (high 8.8)
- [CVE-2026-45446](https://insights.sbomify.com/CVE-2026-45446/): Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (medium 4.8)
- [CVE-2026-45445](https://insights.sbomify.com/CVE-2026-45445/): AES-OCB IV Ignored on EVP_Cipher() Path (high 7.5)
- [CVE-2026-45444](https://insights.sbomify.com/CVE-2026-45444/): WordPress Gift Cards For WooCommerce Pro plugin <= 4.2.6 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2026-45443](https://insights.sbomify.com/CVE-2026-45443/): Missing authorization in PDF for Elementor Forms + Drag And Drop Template Builder (medium 5.0)
- [CVE-2026-45442](https://insights.sbomify.com/CVE-2026-45442/): WordPress Presto Player plugin <= 4.1.3 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-45441](https://insights.sbomify.com/CVE-2026-45441/): WordPress WpEvently plugin <= 5.3.3 - Other Vulnerability Type vulnerability (high 7.5)
- [CVE-2026-45440](https://insights.sbomify.com/CVE-2026-45440/): WordPress WP Ultimate CSV Importer plugin <= 9.2 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-4544](https://insights.sbomify.com/CVE-2026-4544/): Wavlink WL-WN578W2 POST Request login.cgi cross site scripting (medium 4.8)
- [CVE-2026-45439](https://insights.sbomify.com/CVE-2026-45439/): WordPress Realtyna Organic IDX plugin plugin <= 5.1.0 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-45438](https://insights.sbomify.com/CVE-2026-45438/): WordPress Smart Coupons for WooCommerce plugin < 2.3.0 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-45437](https://insights.sbomify.com/CVE-2026-45437/): WordPress Product Filter Widget for Elementor plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-45436](https://insights.sbomify.com/CVE-2026-45436/): WordPress WPBakery Page Builder plugin <= 8.7.2 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-45435](https://insights.sbomify.com/CVE-2026-45435/): WordPress WP Activity Log plugin <= 5.6.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-45434](https://insights.sbomify.com/CVE-2026-45434/): Apache OFBiz: Authentication Bypass via Password-Change Logic Flaw Leading to RCE (critical 9.8)
- [CVE-2026-45433](https://insights.sbomify.com/CVE-2026-45433/): Hardcoded Cryptographic Key Vulnerability in GX Earth ONT Models (high 8.7)
- [CVE-2026-45432](https://insights.sbomify.com/CVE-2026-45432/): Cleartext Transmission of Credentials Vulnerability in GX Earth ONT Models (high 8.7)
- [CVE-2026-45431](https://insights.sbomify.com/CVE-2026-45431/): Command Injection Vulnerability in GX Earth ONT Models (high 8.7)
- [CVE-2026-45430](https://insights.sbomify.com/CVE-2026-45430/): Cross-site request forgery in backdrop-contrib/salesforce (high 7.1)
- [CVE-2026-4543](https://insights.sbomify.com/CVE-2026-4543/): Wavlink WL-WN578W2 POST Request firewall.cgi command injection (medium 5.3)
- [CVE-2026-45426](https://insights.sbomify.com/CVE-2026-45426/): Apache Airflow: Log server JWT authorization bypass via Python lstrip() character stripping allows cross-Dag log access (low 3.1)
- [CVE-2026-4542](https://insights.sbomify.com/CVE-2026-4542/): SSCMS layerImage Endpoint LayerImageController.Submit.cs path traversal (medium 5.3)
- [CVE-2026-45419](https://insights.sbomify.com/CVE-2026-45419/): DataEase: Arbitrary File Write Vulnerability (high 8.5)
- [CVE-2026-45418](https://insights.sbomify.com/CVE-2026-45418/): ClipBucket: Blind SQL Injection in subtitle_edit.php (high 8.8)
- [CVE-2026-45417](https://insights.sbomify.com/CVE-2026-45417/): DataEase: SQL injection vulnerability (high 8.7)
- [CVE-2026-45416](https://insights.sbomify.com/CVE-2026-45416/): Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes (high 7.5)
- [CVE-2026-45415](https://insights.sbomify.com/CVE-2026-45415/): Decidim: CSV census record endpoints improper authorization (medium 6.0)
- [CVE-2026-45414](https://insights.sbomify.com/CVE-2026-45414/): Decidim: JWT-backed authentication can be replayed across organizations (high 8.5)
- [CVE-2026-45413](https://insights.sbomify.com/CVE-2026-45413/): MaxKB: Unsalted MD5 Password Hashing (medium 6.9)
- [CVE-2026-45412](https://insights.sbomify.com/CVE-2026-45412/): MaxKB: Unauthenticated SSRF via Workflow Template Import (medium 6.3)
- [CVE-2026-45411](https://insights.sbomify.com/CVE-2026-45411/): vm2: Sandbox Breakout Using Async Generator (critical 9.8)
- [CVE-2026-45410](https://insights.sbomify.com/CVE-2026-45410/): Time-based user enumeration in TREK authentication endpoint (medium 5.3)
- [CVE-2026-4541](https://insights.sbomify.com/CVE-2026-4541/): janmojzis tinyssh Ed25519 Signature crypto_sign_ed25519_tinyssh.c signature verification (low 2.0)
- [CVE-2026-45409](https://insights.sbomify.com/CVE-2026-45409/): Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix (medium 6.9)
- [CVE-2026-45408](https://insights.sbomify.com/CVE-2026-45408/): Dokku: OS Command Injection via App Name in Git Pre-Receive Hook (critical 9.0)
- [CVE-2026-45407](https://insights.sbomify.com/CVE-2026-45407/): Dokku: Git Credentials in .netrc Stored World-Readable Due to Premature touch (medium 5.0)
- [CVE-2026-45406](https://insights.sbomify.com/CVE-2026-45406/): Dokku: Host RCE via Maliciously Named OpenResty Include Files Injected Through eval (critical 9.0)
- [CVE-2026-45405](https://insights.sbomify.com/CVE-2026-45405/): Dokku: Arbitrary File Write via Tar Symlink Traversal in git:from-archive and certs:add (critical 9.0)
- [CVE-2026-45404](https://insights.sbomify.com/CVE-2026-45404/): OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access (medium 5.9)
- [CVE-2026-45403](https://insights.sbomify.com/CVE-2026-45403/): AnythingLLM: filesystem-copy-file follows nested symlinks and copies files from outside the allowed directory (low 2.0)
- [CVE-2026-45402](https://insights.sbomify.com/CVE-2026-45402/): Open WebUI: Cross-User File Access via Unchecked file_id in Folder Knowledge and Knowledge-Base Attach Endpoints (high 8.1)
- [CVE-2026-45401](https://insights.sbomify.com/CVE-2026-45401/): Open WebUI: SSRF Bypass via HTTP Redirect Following in Web-Fetch and Image-Load Endpoints (high 8.5)
- [CVE-2026-45400](https://insights.sbomify.com/CVE-2026-45400/): Open WebUI: Server-Side Request Forgery (SSRF) bypass in `validate_url` (high 8.5)
- [CVE-2026-4540](https://insights.sbomify.com/CVE-2026-4540/): projectworlds Online Notes Sharing System Parameters login.php sql injection (medium 6.9)
- [CVE-2026-45399](https://insights.sbomify.com/CVE-2026-45399/): Open WebUI: Low-privilege authenticated users can enumerate and stop global background tasks, causing system-wide chat disruption (high 7.1)
- [CVE-2026-45398](https://insights.sbomify.com/CVE-2026-45398/): Open WebUI: IDOR - Retrieval API Bypasses Knowledge Base Access Controls (high 7.5)
- [CVE-2026-45397](https://insights.sbomify.com/CVE-2026-45397/): Open WebUI: Unauthenticated RAG Configuration Disclosure (medium 5.3)
- [CVE-2026-45396](https://insights.sbomify.com/CVE-2026-45396/): Open WebUI: Mass Assignment via FeedbackForm extra=allow Allows Feedback User ID Spoofing and Evaluation Data Manipulation (medium 5.4)
- [CVE-2026-45395](https://insights.sbomify.com/CVE-2026-45395/): Open WebUI: Missing `workspace.tools` Authorization Check on Tool Update Endpoint Allows Privilege Escalation to Code Execution (high 7.2)
- [CVE-2026-45393](https://insights.sbomify.com/CVE-2026-45393/): Local privilege escalation to SYSTEM in Cribl Edge for Windows (high 8.5)
- [CVE-2026-45392](https://insights.sbomify.com/CVE-2026-45392/): DOM-based XSS in Cribl Stream (high 7.1)
- [CVE-2026-45391](https://insights.sbomify.com/CVE-2026-45391/): Local privilege escalation in Cribl Edge for Linux (high 8.5)
- [CVE-2026-45390](https://insights.sbomify.com/CVE-2026-45390/): In OCaml-tar before 3.4.0, a crafted archive with ../ path segments in its name allows escaping the current working directory. (critical 9.1)
- [CVE-2026-4539](https://insights.sbomify.com/CVE-2026-4539/): pygments archetype.py AdlLexer redos (medium 4.8)
- [CVE-2026-45389](https://insights.sbomify.com/CVE-2026-45389/): In OCaml-TLS before 2.1.0, the server implementation does insufficient checks of the certificate provided by the client (when doing client a (high 7.4)
- [CVE-2026-45388](https://insights.sbomify.com/CVE-2026-45388/): In OCaml-TLS before 2.1.0, the client implementation does insufficient checks of the certificate provided by the server, which allows impers (critical 9.1)
- [CVE-2026-45387](https://insights.sbomify.com/CVE-2026-45387/): Open WebUI: Sharing models for others to use (read permission) also exposes model details (system prompt leakage) (medium 4.3)
- [CVE-2026-45386](https://insights.sbomify.com/CVE-2026-45386/): Open WebUI: An IDOR vulnerability exists in the pin_channel_message API endpoint (medium 4.3)
- [CVE-2026-45385](https://insights.sbomify.com/CVE-2026-45385/): Open WebUI: An IDOR vulnerability exists in the update_message_by_id API endpoint (medium 4.3)
- [CVE-2026-45384](https://insights.sbomify.com/CVE-2026-45384/): bit7z: Arbitrary File Overwrite via Symlink Attack on Predictable Temp File During Archive Update (medium 6.1)
- [CVE-2026-45383](https://insights.sbomify.com/CVE-2026-45383/): Memory corruption in libde265 (medium 6.9)
- [CVE-2026-45382](https://insights.sbomify.com/CVE-2026-45382/): libde265 has a heap-buffer-overflow READ in decode_slice_unit_tiles via unvalidated PPS tile geometry (medium 6.9)
- [CVE-2026-45381](https://insights.sbomify.com/CVE-2026-45381/): Tautulli: Reflected XSS in `/search` endpoint (medium 5.1)
- [CVE-2026-45380](https://insights.sbomify.com/CVE-2026-45380/): bit7z: Path Traversal via Null Byte Injection from `gcount()` Off-by-One in `restoreSymlink()` (low 3.6)
- [CVE-2026-4538](https://insights.sbomify.com/CVE-2026-4538/): PyTorch pt2 Loading deserialization (medium 4.8)
- [CVE-2026-45378](https://insights.sbomify.com/CVE-2026-45378/): Decidim: Verification documents can be downloaded through reusable links (high 7.5)
- [CVE-2026-45377](https://insights.sbomify.com/CVE-2026-45377/): Decidim: Private exports can be downloaded through reusable links (medium 6.5)
- [CVE-2026-45376](https://insights.sbomify.com/CVE-2026-45376/): Decidim: Admin user search allows SQL injection through similarity-based sorting (medium 5.5)
- [CVE-2026-45375](https://insights.sbomify.com/CVE-2026-45375/): SiYuan Bazaar marketplace renders unescaped package `name` and `version` metadata, allowing stored XSS and Electron code execution (critical 9.0)
- [CVE-2026-45374](https://insights.sbomify.com/CVE-2026-45374/): CodeWhale: task_create Insecure Defaults Enable RCE via Prompt Injection in Project Files (critical 9.6)
- [CVE-2026-45373](https://insights.sbomify.com/CVE-2026-45373/): CodeWhale: SSRF‌ IPV6 bypass (high 7.4)
- [CVE-2026-45372](https://insights.sbomify.com/CVE-2026-45372/): cpp-httplib: HTTP header value percent-decoding in server-side `parse_header` enables CRLF injection (critical 9.9)
- [CVE-2026-45371](https://insights.sbomify.com/CVE-2026-45371/): SiYuan: SiYuan publish-mode Reader can mutate Conf and SQL index via 8 ungated APIs (high 7.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/622/