# Vulnerabilities published in 2026


- [CVE-2026-44634](https://insights.sbomify.com/CVE-2026-44634/): Stack buffer overflows in SimpleBLE (high 8.7)
- [CVE-2026-44633](https://insights.sbomify.com/CVE-2026-44633/): Live Helper Chat: REST API chat update accepts arbitrary chat fields across department boundaries (high 8.1)
- [CVE-2026-44632](https://insights.sbomify.com/CVE-2026-44632/): Yamcs: Server-Side Code Injection (RCE) via Janino Expression Engine in `JavaExprAlgorithmExecutionFactory` (critical 9.1)
- [CVE-2026-44631](https://insights.sbomify.com/CVE-2026-44631/): Apache HTTP Server: Heap Underflow in `ap_regname` via Signed Char Overflow (critical 9.8)
- [CVE-2026-44630](https://insights.sbomify.com/CVE-2026-44630/): Apache IoTDB: RPC service denial of service via unchecked Thrift string length (high 7.5)
- [CVE-2026-4463](https://insights.sbomify.com/CVE-2026-4463/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-44629](https://insights.sbomify.com/CVE-2026-44629/): Misconfiguration in Synergis Softwire (high 7.9)
- [CVE-2026-44628](https://insights.sbomify.com/CVE-2026-44628/): OFFIS DCMTK Toolkit Type Confusion (high 8.7)
- [CVE-2026-44622](https://insights.sbomify.com/CVE-2026-44622/): EVoke Systems EVoke CSMS Insufficiently Protected Credentials (medium 6.9)
- [CVE-2026-44621](https://insights.sbomify.com/CVE-2026-44621/): Libunbound applications configured with 'unwanted-reply-threshold' could eventually be abruptly terminated (medium 5.9)
- [CVE-2026-4462](https://insights.sbomify.com/CVE-2026-4462/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-44618](https://insights.sbomify.com/CVE-2026-44618/): Apache CXF: XXE vulnerability in WS-Transfer functionality (medium 5.3)
- [CVE-2026-44617](https://insights.sbomify.com/CVE-2026-44617/): Apache Zeppelin: LDAP filter injection in LdapRealm — incomplete fix of CVE-2024-31867 (medium 6.5)
- [CVE-2026-44616](https://insights.sbomify.com/CVE-2026-44616/): Apache Zeppelin: LDAP injection in ActiveDirectoryGroupRealm filter construction (medium 6.5)
- [CVE-2026-44615](https://insights.sbomify.com/CVE-2026-44615/): Path traversal in NotebookRepo note and folder path composition (medium 6.5)
- [CVE-2026-44613](https://insights.sbomify.com/CVE-2026-44613/): Apache Zeppelin: Cross-site request forgery in REST and WebSocket request handling (medium 6.1)
- [CVE-2026-44612](https://insights.sbomify.com/CVE-2026-44612/): Other in Bytello Share (Windows Edition) installer executable (high 8.4)
- [CVE-2026-44611](https://insights.sbomify.com/CVE-2026-44611/): MacGregor Voyage Data Recorder (VDR) G4e Use of Password Hash With Insufficient Computational Effort (medium 5.9)
- [CVE-2026-4461](https://insights.sbomify.com/CVE-2026-4461/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-44609](https://insights.sbomify.com/CVE-2026-44609/): Privilege escalation in Acronis DeviceLock DLP (high 7.3)
- [CVE-2026-44608](https://insights.sbomify.com/CVE-2026-44608/): Use after free and crash under special conditions in RPZ code (medium 4.6)
- [CVE-2026-44605](https://insights.sbomify.com/CVE-2026-44605/): Rpm: heap buffer overflow in ndb slot table parsing (medium 5.5)
- [CVE-2026-44604](https://insights.sbomify.com/CVE-2026-44604/): Command injection in Red Hat Enterprise Linux 10 (high 7.0)
- [CVE-2026-44603](https://insights.sbomify.com/CVE-2026-44603/): Memory corruption in Tor (low 3.7)
- [CVE-2026-44602](https://insights.sbomify.com/CVE-2026-44602/): Null dereference in Tor (low 3.7)
- [CVE-2026-44601](https://insights.sbomify.com/CVE-2026-44601/): Denial of service in Tor (low 3.7)
- [CVE-2026-44600](https://insights.sbomify.com/CVE-2026-44600/): Other in Tor (low 3.7)
- [CVE-2026-4460](https://insights.sbomify.com/CVE-2026-4460/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-44599](https://insights.sbomify.com/CVE-2026-44599/): Other in Tor (low 3.7)
- [CVE-2026-44598](https://insights.sbomify.com/CVE-2026-44598/): Apache Shiro Jakarta EE module: Open redirect and SSRF (requires valid credentials) (medium 5.1)
- [CVE-2026-44597](https://insights.sbomify.com/CVE-2026-44597/): Memory corruption in Tor (low 3.7)
- [CVE-2026-44596](https://insights.sbomify.com/CVE-2026-44596/): Yamcs: No Rate Limiting on Authentication Endpoint (medium 6.5)
- [CVE-2026-44595](https://insights.sbomify.com/CVE-2026-44595/): Yamcs: Unauthorized user enumeration via IAM API endpoints (medium 4.3)
- [CVE-2026-44594](https://insights.sbomify.com/CVE-2026-44594/): esm.sh: Path Traversal via package.json browser field allows reading arbitrary server files (high 7.5)
- [CVE-2026-44593](https://insights.sbomify.com/CVE-2026-44593/): esm.sh: Legacy Route Path Traversal Can Lead to RCE (high 8.7)
- [CVE-2026-44592](https://insights.sbomify.com/CVE-2026-44592/): Gradient: Unauthenticated worker on /proto → arbitrary NAR write / cache poisoning (critical 9.4)
- [CVE-2026-44590](https://insights.sbomify.com/CVE-2026-44590/): Sherlock: Command Injection via pull_request_target in validate_modified_targets.yml (critical 9.3)
- [CVE-2026-4459](https://insights.sbomify.com/CVE-2026-4459/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-44589](https://insights.sbomify.com/CVE-2026-44589/): nuxt-og-image SSRF — bypass of GHSA-pqhr-mp3f-hrpp / v6.2.5 fix (IPv6 + redirect) (low 3.7)
- [CVE-2026-44588](https://insights.sbomify.com/CVE-2026-44588/): SiYuan: URL-encoded title bypasses `escapeAriaLabel`, decoded by `decodeURIComponent` into a tooltip-XSS (critical 9.4)
- [CVE-2026-44587](https://insights.sbomify.com/CVE-2026-44587/): CarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacters (medium 4.7)
- [CVE-2026-44586](https://insights.sbomify.com/CVE-2026-44586/): SiYuan: Bazaar marketplace renders unescaped package author metadata, allowing XSS and Electron code execution (high 8.3)
- [CVE-2026-44585](https://insights.sbomify.com/CVE-2026-44585/): Paymenter: Broken object level authorization via service reference manipulation on ticket creation (medium 5.4)
- [CVE-2026-44584](https://insights.sbomify.com/CVE-2026-44584/): Paymenter doesn't reset email verification status after email change (medium 4.3)
- [CVE-2026-44583](https://insights.sbomify.com/CVE-2026-44583/): Paymenter: Blind Unauthenticated SSRF on the Paypal gateway module (medium 5.3)
- [CVE-2026-44582](https://insights.sbomify.com/CVE-2026-44582/): Next.js: Cache poisoning via collisions in React Server Component cache-busting (low 3.7)
- [CVE-2026-44581](https://insights.sbomify.com/CVE-2026-44581/): Next.js: Cross-site scripting in App Router applications using CSP nonces (medium 4.7)
- [CVE-2026-44580](https://insights.sbomify.com/CVE-2026-44580/): Next.js: Cross-site scripting in beforeInteractive scripts with untrusted input (medium 6.1)
- [CVE-2026-4458](https://insights.sbomify.com/CVE-2026-4458/): Use after free in Chrome (high 8.8)
- [CVE-2026-44579](https://insights.sbomify.com/CVE-2026-44579/): Next.js: Denial of Service via connection exhaustion in applications using Cache Components (high 7.5)
- [CVE-2026-44578](https://insights.sbomify.com/CVE-2026-44578/): Next.js: Server-side request forgery in applications using WebSocket upgrades (high 8.6)
- [CVE-2026-44577](https://insights.sbomify.com/CVE-2026-44577/): Next.js: Denial of Service in the Image Optimization API (medium 5.9)
- [CVE-2026-44576](https://insights.sbomify.com/CVE-2026-44576/): Next.js: Cache poisoning in React Server Component responses (medium 5.4)
- [CVE-2026-44575](https://insights.sbomify.com/CVE-2026-44575/): Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes (high 7.5)
- [CVE-2026-44574](https://insights.sbomify.com/CVE-2026-44574/): Next.js: Middleware / Proxy bypass through dynamic route parameter injection (high 8.1)
- [CVE-2026-44573](https://insights.sbomify.com/CVE-2026-44573/): Next.js: Middleware / Proxy bypass in Pages Router applications using i18n (high 7.5)
- [CVE-2026-44572](https://insights.sbomify.com/CVE-2026-44572/): Next.js: Middleware / Proxy redirects can be cache-poisoned (low 3.7)
- [CVE-2026-44571](https://insights.sbomify.com/CVE-2026-44571/): Open WebUI: Improper Authorization in Standard Channels Allows Message Updates with Read Permission (medium 6.5)
- [CVE-2026-44570](https://insights.sbomify.com/CVE-2026-44570/): Open WebUI: Inconsistent authorization controls within memories API (high 8.3)
- [CVE-2026-4457](https://insights.sbomify.com/CVE-2026-4457/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-44569](https://insights.sbomify.com/CVE-2026-44569/): Open WebUI: Insecure Message Access Breaks Authorization (high 7.1)
- [CVE-2026-44568](https://insights.sbomify.com/CVE-2026-44568/): Open WebUI: Stored XSS in Pending User Overlay via Incorrect DOMPurify Application Order (medium 4.8)
- [CVE-2026-44567](https://insights.sbomify.com/CVE-2026-44567/): Open WebUI: Open WebUI Improper Authorization Control (high 7.3)
- [CVE-2026-44566](https://insights.sbomify.com/CVE-2026-44566/): Open WebUI: Arbitrary File Upload and Path Traversal (high 7.3)
- [CVE-2026-44565](https://insights.sbomify.com/CVE-2026-44565/): Open WebUI: Open WebUI Arbitrary File Write, Delete via Path Traversal (high 8.1)
- [CVE-2026-44564](https://insights.sbomify.com/CVE-2026-44564/): Open WebUI: Read-Only Users Can Modify Collaborative Documents via Socket.IO (medium 5.4)
- [CVE-2026-44563](https://insights.sbomify.com/CVE-2026-44563/): Open WebUI: Ollama Model Access Control Bypass via /api/generate, /api/embed, /api/embeddings, and /api/show (medium 5.4)
- [CVE-2026-44562](https://insights.sbomify.com/CVE-2026-44562/): Open WebUI: Model Import Overwrites Any Model Without Ownership Check (medium 6.5)
- [CVE-2026-44561](https://insights.sbomify.com/CVE-2026-44561/): Open WebUI: Deactivated Channel Members Retain Full Access to Group/DM Channels (medium 5.4)
- [CVE-2026-44560](https://insights.sbomify.com/CVE-2026-44560/): Open WebUI: Unauthorized File and Knowledge Base Content Access via RAG Vector Search (medium 6.5)
- [CVE-2026-4456](https://insights.sbomify.com/CVE-2026-4456/): Use after free in Chrome (high 8.8)
- [CVE-2026-44559](https://insights.sbomify.com/CVE-2026-44559/): Open WebUI: Missing Access Check on Channel Members Endpoint for Standard Channels (medium 4.3)
- [CVE-2026-44558](https://insights.sbomify.com/CVE-2026-44558/): Open WebUI: Channel Access Grants Bypass filter_allowed_access_grants (medium 5.4)
- [CVE-2026-44557](https://insights.sbomify.com/CVE-2026-44557/): Open WebUI: Global Knowledge Base Enumeration via knowledge-bases Meta-Collection (medium 4.3)
- [CVE-2026-44556](https://insights.sbomify.com/CVE-2026-44556/): Open WebUI: responses passthrough endpoint lacks access control authorization (high 7.1)
- [CVE-2026-44555](https://insights.sbomify.com/CVE-2026-44555/): Open WebUI: Base Model Routing Bypasses Access Control via Model Chaining (high 7.6)
- [CVE-2026-44554](https://insights.sbomify.com/CVE-2026-44554/): Open WebUI: Knowledge Base Destruction and RAG Poisoning via Unauthorized Collection Overwrite (high 8.1)
- [CVE-2026-44553](https://insights.sbomify.com/CVE-2026-44553/): Open WebUI: Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User Note Access (high 8.1)
- [CVE-2026-44552](https://insights.sbomify.com/CVE-2026-44552/): Open WebUI: Redis Cache Keys tool_servers and terminal_servers Missing Instance Prefix Enable Cross-Instance Cache Poisoning (high 8.7)
- [CVE-2026-44551](https://insights.sbomify.com/CVE-2026-44551/): Open WebUI: LDAP Empty Password Authentication Bypass (critical 9.1)
- [CVE-2026-44550](https://insights.sbomify.com/CVE-2026-44550/): Open WebUI: Mass Assignment via Pydantic extra='allow' Allows Creating Folders in Other Users' Accounts (medium 5.0)
- [CVE-2026-4455](https://insights.sbomify.com/CVE-2026-4455/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-44549](https://insights.sbomify.com/CVE-2026-44549/): Open WebUI: Stored XSS in excel file preview (high 7.3)
- [CVE-2026-44548](https://insights.sbomify.com/CVE-2026-44548/): ChurchCRM: CSRF via legacy GET-delete pages (FundRaiserDelete.php, PropertyTypeDelete.php, NoteDelete.php) (high 8.1)
- [CVE-2026-44547](https://insights.sbomify.com/CVE-2026-44547/): Auth bypass in CRM (critical 9.6)
- [CVE-2026-44546](https://insights.sbomify.com/CVE-2026-44546/): Header injection via WebSocket upgrade parser differential allows ASGI scope header spoofing (low 3.7)
- [CVE-2026-44545](https://insights.sbomify.com/CVE-2026-44545/): Unbounded WebSocket message and frame sizes can cause unauthenticated remote denial of service (medium 5.3)
- [CVE-2026-44544](https://insights.sbomify.com/CVE-2026-44544/): gittuf: Policy can be rolled back to prior valid version (medium 4.9)
- [CVE-2026-44543](https://insights.sbomify.com/CVE-2026-44543/): Local Path Provisioner: HelperPod Template Injection (high 8.7)
- [CVE-2026-44542](https://insights.sbomify.com/CVE-2026-44542/): FileBrowser Quantum: Unauthenticated Path Traversal in Public Share Delete Allows Arbitrary File Deletion (critical 9.1)
- [CVE-2026-44541](https://insights.sbomify.com/CVE-2026-44541/): Fides: DOM-based XSS vulnerability in fides.js via fides_description override (high 7.0)
- [CVE-2026-4454](https://insights.sbomify.com/CVE-2026-4454/): Use after free in Chrome (high 8.8)
- [CVE-2026-4453](https://insights.sbomify.com/CVE-2026-4453/): Integer overflow in Chrome (medium 4.3)
- [CVE-2026-44523](https://insights.sbomify.com/CVE-2026-44523/): Note Mark: JWT Secret Weakness allows Full Account Takeover via token forgery (critical 10.0)
- [CVE-2026-44522](https://insights.sbomify.com/CVE-2026-44522/): Note Mark: Arbitrary File Write via Path Traversal in Asset Names Leading to Remote Code Execution (high 8.6)
- [CVE-2026-44521](https://insights.sbomify.com/CVE-2026-44521/): elFinder: SQL Injection MySQL Volume Driver (elFinderVolumeMySQL) (high 8.8)
- [CVE-2026-44520](https://insights.sbomify.com/CVE-2026-44520/): Docling-Graph: SSRF via Missing Internal IP Validation in URLInputHandler (medium 5.7)
- [CVE-2026-4452](https://insights.sbomify.com/CVE-2026-4452/): Integer overflow in Chrome (high 8.8)
- [CVE-2026-44518](https://insights.sbomify.com/CVE-2026-44518/): liboqs: XMSS Buffer Overread Bug (medium 5.3)
- [CVE-2026-44517](https://insights.sbomify.com/CVE-2026-44517/): Buildah: Build breakout using malicious Containerfile and Git Smart HTTP server or GitHub release tar archive (medium 6.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/630/