# Vulnerabilities published in 2026


- [CVE-2026-4527](https://insights.sbomify.com/CVE-2026-4527/): Cross-Site Request Forgery (CSRF) in GitLab (medium 6.5)
- [CVE-2026-45267](https://insights.sbomify.com/CVE-2026-45267/): Nextcloud: Missing permission check for from submissions (medium 6.5)
- [CVE-2026-45266](https://insights.sbomify.com/CVE-2026-45266/): Nextcloud: Unauthorized force-mute from missing permission check when using internal signaling (low 3.5)
- [CVE-2026-45264](https://insights.sbomify.com/CVE-2026-45264/): Nextcloud: ACL Rename Permission Bypass in Team Folders Allows Unauthorized File Renames (medium 4.3)
- [CVE-2026-45261](https://insights.sbomify.com/CVE-2026-45261/): GitButler: Link injection via forge integration enables arbitrary script execution (critical 9.3)
- [CVE-2026-45260](https://insights.sbomify.com/CVE-2026-45260/): Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling (high 8.1)
- [CVE-2026-4526](https://insights.sbomify.com/CVE-2026-4526/): Global ZCL command parser missing minimum-length validation in EmberZNet v9.0.2 (high 7.1)
- [CVE-2026-45259](https://insights.sbomify.com/CVE-2026-45259/): sigqueue(2) missing capability mode restriction (medium 6.5)
- [CVE-2026-45258](https://insights.sbomify.com/CVE-2026-45258/): Multiple vulnerabilities in the sound(4) mmap path (high 7.8)
- [CVE-2026-45257](https://insights.sbomify.com/CVE-2026-45257/): Arbitrary file overwrite via the KTLS receive path (high 7.8)
- [CVE-2026-45256](https://insights.sbomify.com/CVE-2026-45256/): Missing permission check in thr_kill2(2) (medium 5.5)
- [CVE-2026-45255](https://insights.sbomify.com/CVE-2026-45255/): Remote code execution via installer Wi-Fi access point scans (high 7.5)
- [CVE-2026-45254](https://insights.sbomify.com/CVE-2026-45254/): Incorrect libcap_net limitation list manipulation (medium 6.5)
- [CVE-2026-45253](https://insights.sbomify.com/CVE-2026-45253/): Missing validation in ptrace(PT_SC_REMOTE) (high 8.4)
- [CVE-2026-45252](https://insights.sbomify.com/CVE-2026-45252/): Heap overflow in FUSE_LISTXATTR (medium 5.5)
- [CVE-2026-45251](https://insights.sbomify.com/CVE-2026-45251/): Kernel use-after-free via file descriptor syscalls (high 7.8)
- [CVE-2026-45250](https://insights.sbomify.com/CVE-2026-45250/): Stack buffer overflow via setcred(2) (high 7.8)
- [CVE-2026-4525](https://insights.sbomify.com/CVE-2026-4525/): Vault Token Leaked to Backends via Authorization: Bearer Passthrough Header (high 7.5)
- [CVE-2026-45249](https://insights.sbomify.com/CVE-2026-45249/): Apache ECharts: XSS in Lines series tooltip rendering (medium 6.1)
- [CVE-2026-45248](https://insights.sbomify.com/CVE-2026-45248/): Hedera Guardian Authentication Bypass Information Disclosure (medium 6.9)
- [CVE-2026-45247](https://insights.sbomify.com/CVE-2026-45247/): Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data (critical 9.3, exploited in the wild)
- [CVE-2026-45246](https://insights.sbomify.com/CVE-2026-45246/): Summarize < 0.15.1 Insecure File Permissions Information Disclosure (medium 6.8)
- [CVE-2026-45245](https://insights.sbomify.com/CVE-2026-45245/): Summarize < 0.15.1 Unauthorized Daemon Request via Untrusted Events (medium 4.6)
- [CVE-2026-45244](https://insights.sbomify.com/CVE-2026-45244/): Summarize < 0.15.1 Unapproved Browser Automation Execution (low 2.1)
- [CVE-2026-45243](https://insights.sbomify.com/CVE-2026-45243/): Summarize < 0.15.1 Browser Extension Missing Authorization via Content Script (medium 5.3)
- [CVE-2026-45242](https://insights.sbomify.com/CVE-2026-45242/): Summarize < 0.15.1 Path Traversal via slidesDir Parameter (high 7.1)
- [CVE-2026-4524](https://insights.sbomify.com/CVE-2026-4524/): Authentication Bypass Using an Alternate Path or Channel in GitLab (medium 6.5)
- [CVE-2026-45233](https://insights.sbomify.com/CVE-2026-45233/): HTMLy CMS 3.1.1 Path Traversal via oldfile Parameter in Autosave (high 7.2)
- [CVE-2026-45232](https://insights.sbomify.com/CVE-2026-45232/): Rsync < 3.4.3 Off-by-One Stack Write via HTTP Proxy (low 2.1)
- [CVE-2026-45231](https://insights.sbomify.com/CVE-2026-45231/): DumbAssets 1.0.11 Stored Cross-Site Scripting via Asset Fields (medium 5.3)
- [CVE-2026-45230](https://insights.sbomify.com/CVE-2026-45230/): DumbAssets 1.0.11 Path Traversal File Deletion via /api/delete-file (high 8.8)
- [CVE-2026-4523](https://insights.sbomify.com/CVE-2026-4523/): Missing Authorization in GitLab (low 3.7)
- [CVE-2026-45229](https://insights.sbomify.com/CVE-2026-45229/): Quark Drive (quark-auto-save) < 0.8.5 Mass Assignment via POST /update (high 8.7)
- [CVE-2026-45228](https://insights.sbomify.com/CVE-2026-45228/): Quark Drive (quark-auto-save) < 0.8.5 Stored XSS via System Configuration (medium 5.1)
- [CVE-2026-45227](https://insights.sbomify.com/CVE-2026-45227/): Heym < 0.0.21 Sandbox Escape via Python Introspection (high 8.7)
- [CVE-2026-45226](https://insights.sbomify.com/CVE-2026-45226/): Heym < 0.0.21 Authorization Bypass in Workflow Execution (high 7.6)
- [CVE-2026-45225](https://insights.sbomify.com/CVE-2026-45225/): Heym < 0.0.21 Path Traversal File Upload via upload_file() (high 7.2)
- [CVE-2026-45224](https://insights.sbomify.com/CVE-2026-45224/): Crabbox < 0.9.0 Path Traversal via Islo Provider Workspace Resolution (medium 6.8)
- [CVE-2026-45223](https://insights.sbomify.com/CVE-2026-45223/): Crabbox < 0.9.0 Authentication Bypass via Admin Claim Injection (high 7.7)
- [CVE-2026-45222](https://insights.sbomify.com/CVE-2026-45222/): Summarize Insecure Daemon Configuration File Permissions (medium 6.9)
- [CVE-2026-45221](https://insights.sbomify.com/CVE-2026-45221/): Konga < 2.1.0 Privilege Escalation via Hardcoded OpenSSL Path (high 8.5)
- [CVE-2026-4522](https://insights.sbomify.com/CVE-2026-4522/): Auth bypass in Passwordless (medium 6.7)
- [CVE-2026-45218](https://insights.sbomify.com/CVE-2026-45218/): WordPress WP Travel plugin <= 11.4.0 - SQL Injection vulnerability (high 7.7)
- [CVE-2026-45217](https://insights.sbomify.com/CVE-2026-45217/): WordPress Stripe Payment Gateway for WooCommerce plugin <= 5.0.7 - Broken Authentication vulnerability (medium 6.5)
- [CVE-2026-45216](https://insights.sbomify.com/CVE-2026-45216/): WordPress Smart Manager plugin <= 8.85.0 - Privilege Escalation vulnerability (high 8.8)
- [CVE-2026-45215](https://insights.sbomify.com/CVE-2026-45215/): WordPress WP EasyPay plugin <= 4.3.0 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-45214](https://insights.sbomify.com/CVE-2026-45214/): WordPress Xpro Elementor Addons plugin <= 1.5.1 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-45213](https://insights.sbomify.com/CVE-2026-45213/): WordPress BEAR plugin <= 1.1.7.1 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-45212](https://insights.sbomify.com/CVE-2026-45212/): WordPress Asset CleanUp: Page Speed Booster plugin <= 1.4.0.3 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-45211](https://insights.sbomify.com/CVE-2026-45211/): WordPress APIExperts Square for WooCommerce plugin <= 4.7.1 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-45210](https://insights.sbomify.com/CVE-2026-45210/): WordPress Broadstreet Ads plugin <= 1.52.2 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-45209](https://insights.sbomify.com/CVE-2026-45209/): WordPress MyCryptoCheckout plugin <= 2.161 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-45208](https://insights.sbomify.com/CVE-2026-45208/): Race condition in TrendAI Apex One (high 7.8)
- [CVE-2026-45207](https://insights.sbomify.com/CVE-2026-45207/): Privilege escalation in TrendAI Apex One (high 7.8)
- [CVE-2026-45206](https://insights.sbomify.com/CVE-2026-45206/): Privilege escalation in TrendAI Apex One (high 7.8)
- [CVE-2026-45205](https://insights.sbomify.com/CVE-2026-45205/): Apache Commons Configuration: StackOverflowError for YAML input with cycles (medium 5.3)
- [CVE-2026-45204](https://insights.sbomify.com/CVE-2026-45204/): Null dereference in Graphics DDK (medium 5.5)
- [CVE-2026-45203](https://insights.sbomify.com/CVE-2026-45203/): GPU DDK - rgxfw_hwperf_ufo() re-reads psCmdHeader->ui32CmdSize after initial check, TOCTOU (high 7.8)
- [CVE-2026-45202](https://insights.sbomify.com/CVE-2026-45202/): GPU DDK - Silent High-Order CMA Memory Leak & Double Free in `_FreeOSPages_Fast` (medium 5.5)
- [CVE-2026-45201](https://insights.sbomify.com/CVE-2026-45201/): Memory corruption in Graphics DDK (high 7.8)
- [CVE-2026-45200](https://insights.sbomify.com/CVE-2026-45200/): GPU DDK - Double free in _FreeOSPages due to incorrect allocation flag set by _EncodeAllocationFlags (high 7.8)
- [CVE-2026-45199](https://insights.sbomify.com/CVE-2026-45199/): GPU DDK - rgxfw_to_ptr() does not reject FW private data pointers (high 7.8)
- [CVE-2026-45198](https://insights.sbomify.com/CVE-2026-45198/): GPU DDK - RGXFWIF_SYSINIT::sCorememDataStore is untrusted (high 7.8)
- [CVE-2026-45197](https://insights.sbomify.com/CVE-2026-45197/): GPU DDK - TOCTOU affecting psFWMemContext->uiPageCatBaseRegSet (low 2.5)
- [CVE-2026-45196](https://insights.sbomify.com/CVE-2026-45196/): GPU DDK - Arbitrary GPU register write in rgxfw_hwperf_hw due to unsanitized pointers from host kernel (high 7.8)
- [CVE-2026-45195](https://insights.sbomify.com/CVE-2026-45195/): GPU DDK - rgxfw_set_mips_fault_address(&psInit->sFaultPhysAddr) is untrusted (high 7.8)
- [CVE-2026-45192](https://insights.sbomify.com/CVE-2026-45192/): Apache Airflow: Incomplete Redaction of Sensitive Fields in Connection Extra API Response (medium 6.5)
- [CVE-2026-45191](https://insights.sbomify.com/CVE-2026-45191/): Security feature bypass in Net::CIDR::Lite (medium 6.5)
- [CVE-2026-45190](https://insights.sbomify.com/CVE-2026-45190/): Security feature bypass in Net::CIDR::Lite (medium 6.5)
- [CVE-2026-4519](https://insights.sbomify.com/CVE-2026-4519/): webbrowser.open() allows leading dashes in URLs (high 7.0)
- [CVE-2026-45188](https://insights.sbomify.com/CVE-2026-45188/): Apache Kvrocks: Replication Fullsync Path Traversal via Unvalidated Filename Handling (low 2.4)
- [CVE-2026-45187](https://insights.sbomify.com/CVE-2026-45187/): Apache OFBiz: Improper Authorization in Scheduled Job Creation Allows Low-Privileged Users to Submit System Jobs (medium 6.5)
- [CVE-2026-45186](https://insights.sbomify.com/CVE-2026-45186/): Denial of service in libexpat (low 2.9)
- [CVE-2026-45185](https://insights.sbomify.com/CVE-2026-45185/): Use after free in Exim (critical 9.8)
- [CVE-2026-45184](https://insights.sbomify.com/CVE-2026-45184/): Code injection in Kdenlive (medium 6.5)
- [CVE-2026-45182](https://insights.sbomify.com/CVE-2026-45182/): Information disclosure in GrapheneOS (low 2.2)
- [CVE-2026-45181](https://insights.sbomify.com/CVE-2026-45181/): Command injection in IDA (medium 6.5)
- [CVE-2026-45180](https://insights.sbomify.com/CVE-2026-45180/): Catalyst::Plugin::Statsd versions through 0.10.0 for Perl may leak session ids (high 7.5)
- [CVE-2026-45179](https://insights.sbomify.com/CVE-2026-45179/): Plack::Middleware::Statsd versions before 0.9.0 for Perl may leak user IP addresses (medium 5.3)
- [CVE-2026-45178](https://insights.sbomify.com/CVE-2026-45178/): Idira Secrets Manager Self-Hosted: Improper Access Control in Internal Cluster Endpoints (high 8.4)
- [CVE-2026-45177](https://insights.sbomify.com/CVE-2026-45177/): Idira Secrets Manager SaaS Edge: Authentication Bypass of an internal validation mechanism (critical 9.1)
- [CVE-2026-45176](https://insights.sbomify.com/CVE-2026-45176/): Privilege escalation in Idira Endpoint Privilege Manager (high 8.9)
- [CVE-2026-45175](https://insights.sbomify.com/CVE-2026-45175/): Security feature bypass in Idira Endpoint Privilege Manager (high 8.5)
- [CVE-2026-45174](https://insights.sbomify.com/CVE-2026-45174/): Idira Endpoint Privilege Manager Linux Agent: Potential bypass of Agent Daemon Initialization (high 8.5)
- [CVE-2026-45173](https://insights.sbomify.com/CVE-2026-45173/): Idira Identity Browser Extension: Unauthorized Application Interaction via Origin Validation Failure (high 8.4)
- [CVE-2026-45172](https://insights.sbomify.com/CVE-2026-45172/): Command injection in PAM Self-Hosted, Privilege Cloud (high 8.7)
- [CVE-2026-45171](https://insights.sbomify.com/CVE-2026-45171/): Idira Privileged Session Manager (PSM): Potential Code Execution due to an Incomplete Input Validation (high 8.7)
- [CVE-2026-45170](https://insights.sbomify.com/CVE-2026-45170/): Idira Vendor PAM - Self-Hosted Connector: Potential Security Bypass due to Incomplete TLS Certificate Validation (high 7.5)
- [CVE-2026-45169](https://insights.sbomify.com/CVE-2026-45169/): Idira Privileged Access Manager (PAM) Self-Hosted Vault: Denial of Service due to Unexpected Input Processing (high 8.7)
- [CVE-2026-45165](https://insights.sbomify.com/CVE-2026-45165/): Idira Secrets Manager (Self-Hosted): Improper Authorization in REST API (high 8.6)
- [CVE-2026-45162](https://insights.sbomify.com/CVE-2026-45162/): Pimcore: Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction (high 8.0)
- [CVE-2026-45161](https://insights.sbomify.com/CVE-2026-45161/): wger: trainer_login accepts GET - CSRF bypass enables forced session rebinding (medium 5.4)
- [CVE-2026-45160](https://insights.sbomify.com/CVE-2026-45160/): ESF-IDF: Out-of-bounds Read in lwIP DHCP Server Option Parser (medium 6.5)
- [CVE-2026-4516](https://insights.sbomify.com/CVE-2026-4516/): Foundation Agents MetaGPT DataInterpreter write_analysis_code.py injection (medium 5.3)
- [CVE-2026-45159](https://insights.sbomify.com/CVE-2026-45159/): Missing authorization in security-advisories (low 3.5)
- [CVE-2026-45158](https://insights.sbomify.com/CVE-2026-45158/): OPNsense: Command Injection via Attacker-Controlled DHCP Config (critical 9.1)
- [CVE-2026-45157](https://insights.sbomify.com/CVE-2026-45157/): Nextcloud: Valid share tokens allow to access tempory upload files of share owner (medium 6.3)
- [CVE-2026-45156](https://insights.sbomify.com/CVE-2026-45156/): Nextcloud: Authentication Bypass in ID4me handling via Missing JWT Signature Verification in User OIDC (high 8.1)
- [CVE-2026-45155](https://insights.sbomify.com/CVE-2026-45155/): Nextcloud: Private circle can be added to another circle via API (low 2.6)
- [CVE-2026-45154](https://insights.sbomify.com/CVE-2026-45154/): Nextcloud: Improper Access Control in Collectives (low 2.6)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/624/