# Vulnerabilities published in 2026


- [CVE-2026-44195](https://insights.sbomify.com/CVE-2026-44195/): OPNsense: Authentication lockout bypass (medium 5.3)
- [CVE-2026-44194](https://insights.sbomify.com/CVE-2026-44194/): OPNsense: RCE on user managment (critical 9.1)
- [CVE-2026-44193](https://insights.sbomify.com/CVE-2026-44193/): OPNsense: RCE via XMLRPC endpoint using `opnsense.restore_config_section` method (critical 9.1)
- [CVE-2026-44192](https://insights.sbomify.com/CVE-2026-44192/): Ansible-lightspeed: ansible lightspeed mcp server: remote code execution and data exfiltration via path traversal (medium 6.6)
- [CVE-2026-44191](https://insights.sbomify.com/CVE-2026-44191/): Command injection in Red Hat Ansible Automation Platform 2 (high 7.8)
- [CVE-2026-44190](https://insights.sbomify.com/CVE-2026-44190/): Command injection in Red Hat Ansible Automation Platform 2 (high 7.8)
- [CVE-2026-44189](https://insights.sbomify.com/CVE-2026-44189/): Command injection in Red Hat Ansible Automation Platform 2 (high 7.8)
- [CVE-2026-44188](https://insights.sbomify.com/CVE-2026-44188/): Auth bypass in Red Hat Ansible Automation Platform 2 (medium 5.3)
- [CVE-2026-44187](https://insights.sbomify.com/CVE-2026-44187/): Information disclosure in Red Hat Ansible Automation Platform 2 (low 3.3)
- [CVE-2026-44186](https://insights.sbomify.com/CVE-2026-44186/): Apache HTTP Server: Loop in `proxy_ftp_handler` in mod_proxy_ftp (high 7.3)
- [CVE-2026-44185](https://insights.sbomify.com/CVE-2026-44185/): Apache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP `send_request` (high 7.3)
- [CVE-2026-44184](https://insights.sbomify.com/CVE-2026-44184/): Cleanuparr: Reflective CORS combined with trusted-network auth allows cross-origin admin API reads (high 8.0)
- [CVE-2026-44183](https://insights.sbomify.com/CVE-2026-44183/): Auth bypass in Cleanuparr (critical 9.8)
- [CVE-2026-44182](https://insights.sbomify.com/CVE-2026-44182/): Jupyter Enterprise Gateway Has Kubernetes Manifest Injection via Jinja2 Template Rendering (critical 10.0)
- [CVE-2026-44181](https://insights.sbomify.com/CVE-2026-44181/): Jupyter Enterprise Gateway: Jinja2 Template Server Side Template Injection results in Remote Code Execution (critical 10.0)
- [CVE-2026-44180](https://insights.sbomify.com/CVE-2026-44180/): Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_prohibited_ids can be Bypassed (critical 9.8)
- [CVE-2026-4418](https://insights.sbomify.com/CVE-2026-4418/): IBM Cloud Pak System HTML Injection (medium 5.4)
- [CVE-2026-44179](https://insights.sbomify.com/CVE-2026-44179/): XWiki Pro Macros: excerpt-include title and content injection executes code (critical 9.9)
- [CVE-2026-44178](https://insights.sbomify.com/CVE-2026-44178/): xrdp: Channel Data Forwarding Fixed-Size Buffer Overflow (high 8.8)
- [CVE-2026-44177](https://insights.sbomify.com/CVE-2026-44177/): Kirby: Pre-authentication path traversal and PHP file inclusion during user lookup (high 8.8)
- [CVE-2026-44176](https://insights.sbomify.com/CVE-2026-44176/): Kirby: `pages.access` permission is not checked during rendering of page drafts (medium 6.0)
- [CVE-2026-44175](https://insights.sbomify.com/CVE-2026-44175/): Kirby: Cross-site scripting (XSS) from list field content in the site frontend (high 8.5)
- [CVE-2026-44174](https://insights.sbomify.com/CVE-2026-44174/): Kirby: Arbitrary Method Call via REST API search and collection query endpoints (high 8.7)
- [CVE-2026-44173](https://insights.sbomify.com/CVE-2026-44173/): MariaDB: FILE privilege was not checked for subqueries in the FROM clause (medium 5.0)
- [CVE-2026-44172](https://insights.sbomify.com/CVE-2026-44172/): MariaDB: mysql_real_escape_string() incorrectly handled big5 (medium 6.9)
- [CVE-2026-44171](https://insights.sbomify.com/CVE-2026-44171/): MariaDB: path traversal in mbstream (medium 6.3)
- [CVE-2026-44170](https://insights.sbomify.com/CVE-2026-44170/): MariaDB: Argument injection in CONNECT REST Xcurl on Windows via unsanitized URL (medium 6.3)
- [CVE-2026-44169](https://insights.sbomify.com/CVE-2026-44169/): MariaDB: Authorization bypass in role-based routine-level privilege check exposes stored routine definitions (medium 4.3)
- [CVE-2026-44168](https://insights.sbomify.com/CVE-2026-44168/): MariaDB: wsrep SST unsafe parameter handling on the donor side (high 8.0)
- [CVE-2026-44167](https://insights.sbomify.com/CVE-2026-44167/): phpseclib: CVE-2024-27355 mitigation bypass — OID amplification DoS in ASN1::decodeOID() (high 7.5)
- [CVE-2026-44166](https://insights.sbomify.com/CVE-2026-44166/): Pocketbase: Account pre-hijacking via OAuth2 unverfied->verified autolinking upgrade (medium 6.1)
- [CVE-2026-44163](https://insights.sbomify.com/CVE-2026-44163/): fluent-plugin-opentelemetry: Denial of Service (DoS) via Large Payloads and Decompression Bombs in `in_opentelemetry` (medium 5.3)
- [CVE-2026-44162](https://insights.sbomify.com/CVE-2026-44162/): fluent-plugin-s3: Denial of Service (DoS) via Decompression Bomb in `in_s3` (low 2.7)
- [CVE-2026-44161](https://insights.sbomify.com/CVE-2026-44161/): Fluentd: Server-Side Request Forgery (SSRF) via Placeholder Expansion in `out_http` (high 7.2)
- [CVE-2026-44160](https://insights.sbomify.com/CVE-2026-44160/): Fluentd: Denial of Service (DoS) via Gzip Decompression Bomb in `in_http` and `in_forward` (high 7.5)
- [CVE-2026-4416](https://insights.sbomify.com/CVE-2026-4416/): GIGABYTE｜Performance Library - Insecure Deserialization (high 8.5)
- [CVE-2026-44159](https://insights.sbomify.com/CVE-2026-44159/): Tyler Identity Local (TID-L) default administrative credentials (critical 9.3)
- [CVE-2026-4415](https://insights.sbomify.com/CVE-2026-4415/): GIGABYTE｜Gigabyte Control Center - Arbitrary File Write (critical 9.2)
- [CVE-2026-4413](https://insights.sbomify.com/CVE-2026-4413/): IBM Concert Software Cross-Site Scripting (medium 6.1)
- [CVE-2026-44129](https://insights.sbomify.com/CVE-2026-44129/): Server-side template injection (high 8.3)
- [CVE-2026-44128](https://insights.sbomify.com/CVE-2026-44128/): Unauthenticated Remote Code Execution (critical 9.3)
- [CVE-2026-44127](https://insights.sbomify.com/CVE-2026-44127/): Local File Inclusion (LFI) and Arbitrary File Deletion (high 8.8)
- [CVE-2026-44126](https://insights.sbomify.com/CVE-2026-44126/): Insecure deserialization (critical 9.2)
- [CVE-2026-44125](https://insights.sbomify.com/CVE-2026-44125/): Missing Authorization in GINAv2 (critical 9.3)
- [CVE-2026-44119](https://insights.sbomify.com/CVE-2026-44119/): Apache HTTP Server: escalation of privilege through expressions in .htaccess in multiple modules (medium 5.5)
- [CVE-2026-44118](https://insights.sbomify.com/CVE-2026-44118/): OpenClaw < 2026.4.22 - Owner Context Spoofing via Bearer Token Header (high 8.5)
- [CVE-2026-44117](https://insights.sbomify.com/CVE-2026-44117/): OpenClaw < 2026.4.20 - Server-Side Request Forgery in QQBot Direct Media Upload (medium 6.3)
- [CVE-2026-44116](https://insights.sbomify.com/CVE-2026-44116/): OpenClaw < 2026.4.22 - Server-Side Request Forgery in Zalo Photo URL Validation (medium 6.9)
- [CVE-2026-44115](https://insights.sbomify.com/CVE-2026-44115/): OpenClaw < 2026.4.22 - Shell Expansion Bypass in Unquoted Heredocs via Exec Allowlist (high 8.7)
- [CVE-2026-44114](https://insights.sbomify.com/CVE-2026-44114/): OpenClaw < 2026.4.20 - Environment Variable Namespace Collision via Workspace dotenv (high 8.5)
- [CVE-2026-44113](https://insights.sbomify.com/CVE-2026-44113/): OpenClaw < 2026.4.22 - Time-of-Check/Time-of-Use Race Condition in OpenShell FS Bridge (high 8.3)
- [CVE-2026-44112](https://insights.sbomify.com/CVE-2026-44112/): OpenClaw < 2026.4.22 - Symlink Swap Race Condition in OpenShell FS Bridge Writes (high 8.4)
- [CVE-2026-44111](https://insights.sbomify.com/CVE-2026-44111/): OpenClaw < 2026.4.15 - Arbitrary Markdown File Read via QMD memory_get (low 2.3)
- [CVE-2026-44110](https://insights.sbomify.com/CVE-2026-44110/): OpenClaw < 2026.4.15 - Authorization Bypass in Matrix Room Control Commands via DM Pairing Store (high 7.7)
- [CVE-2026-44109](https://insights.sbomify.com/CVE-2026-44109/): OpenClaw < 2026.4.15 - Authentication Bypass in Feishu Webhook and Card-Action Validation (critical 9.2)
- [CVE-2026-44108](https://insights.sbomify.com/CVE-2026-44108/): Firewall bypass during shutdown (critical 9.3)
- [CVE-2026-44107](https://insights.sbomify.com/CVE-2026-44107/): Exposed Reboot via Modbus (high 8.7)
- [CVE-2026-44106](https://insights.sbomify.com/CVE-2026-44106/): Local Privilege Escalation vulnerability in /etc/init.d/user-applications via customer website file (high 8.5)
- [CVE-2026-44105](https://insights.sbomify.com/CVE-2026-44105/): Cleartext password in logs (medium 5.8)
- [CVE-2026-44104](https://insights.sbomify.com/CVE-2026-44104/): ControllerAgent does not perform validation of firmware (critical 9.3)
- [CVE-2026-44103](https://insights.sbomify.com/CVE-2026-44103/): JupiCore does not perform validation of firmware (medium 6.9)
- [CVE-2026-44102](https://insights.sbomify.com/CVE-2026-44102/): OCPP Firmware download is not properly locked (medium 6.9)
- [CVE-2026-44101](https://insights.sbomify.com/CVE-2026-44101/): OCPP reconfiguration vulnerability (critical 9.3)
- [CVE-2026-44100](https://insights.sbomify.com/CVE-2026-44100/): JupiCore charging point reconfiguration without auth (high 8.8)
- [CVE-2026-4410](https://insights.sbomify.com/CVE-2026-4410/): IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a denial of service (medium 4.8)
- [CVE-2026-44099](https://insights.sbomify.com/CVE-2026-44099/): Local Privilege Escalation via pppd password injection (high 8.5)
- [CVE-2026-44098](https://insights.sbomify.com/CVE-2026-44098/): OS Command Injection in OCPP Agent via charge_box_id (high 8.8)
- [CVE-2026-44097](https://insights.sbomify.com/CVE-2026-44097/): File Upload vulnerability (medium 5.3)
- [CVE-2026-44096](https://insights.sbomify.com/CVE-2026-44096/): udhcpc Privilege Escalation (high 8.5)
- [CVE-2026-44095](https://insights.sbomify.com/CVE-2026-44095/): Local Privilege Escalation via Network scripts (high 8.5)
- [CVE-2026-44094](https://insights.sbomify.com/CVE-2026-44094/): Fallback to second RAUC slot with default credentials (high 8.3)
- [CVE-2026-44093](https://insights.sbomify.com/CVE-2026-44093/): Local Privilege Escalation vulnerability in /etc/init.d/user-applications via user-application start script (high 8.5)
- [CVE-2026-44092](https://insights.sbomify.com/CVE-2026-44092/): Missing input validation / stripping of CRLF characters in SystemConfigManager (high 8.8)
- [CVE-2026-44091](https://insights.sbomify.com/CVE-2026-44091/): Creation of a new configuration by posting a malicious ID to MQTT (high 8.8)
- [CVE-2026-44090](https://insights.sbomify.com/CVE-2026-44090/): Missing authentication for MQTT Broker (critical 9.3)
- [CVE-2026-4409](https://insights.sbomify.com/CVE-2026-4409/): Subscribe To Comments Reloaded <= 240119 - Improper Authorization to Unauthenticated Arbitrary Subscription Management (medium 6.5)
- [CVE-2026-44089](https://insights.sbomify.com/CVE-2026-44089/): Buffer Overflow in Totolink EX1200L router (critical 9.4)
- [CVE-2026-44088](https://insights.sbomify.com/CVE-2026-44088/): Remote Code Execution in SzafirHost (high 8.6)
- [CVE-2026-44087](https://insights.sbomify.com/CVE-2026-44087/): Apache APISIX: Openid-connect plugin Identity Header Spoofing (medium 5.3)
- [CVE-2026-44084](https://insights.sbomify.com/CVE-2026-44084/): Access Code Forgery in Video Station leading to unauthorized media access (high 8.7)
- [CVE-2026-44083](https://insights.sbomify.com/CVE-2026-44083/): QuMagie (high 8.7)
- [CVE-2026-4408](https://insights.sbomify.com/CVE-2026-4408/): Samba: remote code execution in samr (critical 9.0)
- [CVE-2026-44076](https://insights.sbomify.com/CVE-2026-44076/): Shell injection via volume path (medium 6.7)
- [CVE-2026-44075](https://insights.sbomify.com/CVE-2026-44075/): Missing break in DSI OpenSession (low 3.7)
- [CVE-2026-44074](https://insights.sbomify.com/CVE-2026-44074/): Bitwise OR of errno values (low 3.7)
- [CVE-2026-44073](https://insights.sbomify.com/CVE-2026-44073/): seteuid failure ignored in auth modules (medium 4.0)
- [CVE-2026-44072](https://insights.sbomify.com/CVE-2026-44072/): system() after failed chdir() (low 2.5)
- [CVE-2026-44071](https://insights.sbomify.com/CVE-2026-44071/): FORTIFY_SOURCE disabled (low 3.7)
- [CVE-2026-44070](https://insights.sbomify.com/CVE-2026-44070/): Unbounded realloc in charset conversion (low 3.1)
- [CVE-2026-4407](https://insights.sbomify.com/CVE-2026-4407/): Out-of-bounds array write in Xpdf 4.06 due to missing validation (low 2.1)
- [CVE-2026-44069](https://insights.sbomify.com/CVE-2026-44069/): Integer underflow in volxlate (low 3.4)
- [CVE-2026-44068](https://insights.sbomify.com/CVE-2026-44068/): EA path traversal via incomplete sanitization (high 7.6)
- [CVE-2026-44067](https://insights.sbomify.com/CVE-2026-44067/): EA header parsing heap over-read (low 3.7)
- [CVE-2026-44066](https://insights.sbomify.com/CVE-2026-44066/): Heap out-of-bounds reads in Spotlight RPC unmarshalling (high 7.1)
- [CVE-2026-44065](https://insights.sbomify.com/CVE-2026-44065/): Off-by-two in papd lp_write() (low 3.7)
- [CVE-2026-44064](https://insights.sbomify.com/CVE-2026-44064/): ASP session ID out-of-bounds access (high 7.1)
- [CVE-2026-44063](https://insights.sbomify.com/CVE-2026-44063/): LDAP filter injection (medium 4.2)
- [CVE-2026-44062](https://insights.sbomify.com/CVE-2026-44062/): Missing o_len bounds check in pull_charset_flags() (high 7.5)
- [CVE-2026-44061](https://insights.sbomify.com/CVE-2026-44061/): DES-ECB auth with timing side channel (medium 5.9)
- [CVE-2026-44060](https://insights.sbomify.com/CVE-2026-44060/): Integer underflow in dsi_writeinit() leads to denial of service (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/634/