# Vulnerabilities published in 2026


- [CVE-2026-43652](https://insights.sbomify.com/CVE-2026-43652/): Missing authorization in macOS (high 7.5)
- [CVE-2026-4365](https://insights.sbomify.com/CVE-2026-4365/): LearnPress <= 4.3.2.8 - Missing Authorization to Unauthenticated Arbitrary Quiz Answer Deletion (critical 9.1)
- [CVE-2026-43646](https://insights.sbomify.com/CVE-2026-43646/): Apache Wicket: crafted URLs can bypass PackageResourceGuard (high 7.5)
- [CVE-2026-43644](https://insights.sbomify.com/CVE-2026-43644/): podinfo 6.11.2 Reflected XSS via /echo Endpoint (medium 5.1)
- [CVE-2026-43643](https://insights.sbomify.com/CVE-2026-43643/): Softaculous Virtualizor Authorization Bypass via Billing Module Handler (high 8.7)
- [CVE-2026-43642](https://insights.sbomify.com/CVE-2026-43642/): Softaculous Virtualizor PHP Object Injection via Billing Module Handler (critical 9.2)
- [CVE-2026-43641](https://insights.sbomify.com/CVE-2026-43641/): Softaculous Virtualizor OS Command Injection via Billing Module Handler (critical 9.3)
- [CVE-2026-43640](https://insights.sbomify.com/CVE-2026-43640/): Bitwarden Server < 2026.4.1 Authentication Bypass via SCIM API Key (high 8.6)
- [CVE-2026-4364](https://insights.sbomify.com/CVE-2026-4364/): Security Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access (medium 5.4)
- [CVE-2026-43639](https://insights.sbomify.com/CVE-2026-43639/): Bitwarden Server < 2026.4.0 Missing Authorization via Provider Clients (high 8.9)
- [CVE-2026-43638](https://insights.sbomify.com/CVE-2026-43638/): Bitwarden Server < 2026.4.1 Missing Authorization via Organization Cipher Import (medium 5.3)
- [CVE-2026-43637](https://insights.sbomify.com/CVE-2026-43637/): Cornac < 2.6.0 Path Traversal via _extract_archive() in download.py (high 8.8)
- [CVE-2026-43634](https://insights.sbomify.com/CVE-2026-43634/): HestiaCP 1.2.0-1.9.4 IP Spoofing via CF-Connecting-IP Header (high 8.7)
- [CVE-2026-43633](https://insights.sbomify.com/CVE-2026-43633/): HestiaCP 1.9.0-1.9.4 Deserialization RCE via Web Terminal (critical 9.5)
- [CVE-2026-43632](https://insights.sbomify.com/CVE-2026-43632/): llama.cpp b7492–b9060 Use-After-Free in Tokenization Endpoints (critical 9.2)
- [CVE-2026-43631](https://insights.sbomify.com/CVE-2026-43631/): llama.cpp b7492–b9060 Use-After-Free RCE via llama-server (critical 9.2)
- [CVE-2026-43630](https://insights.sbomify.com/CVE-2026-43630/): llama.cpp b4882-b8487 Out-of-Bounds Read Information Disclosure (medium 6.3)
- [CVE-2026-4363](https://insights.sbomify.com/CVE-2026-4363/): Incorrect Authorization in GitLab (low 3.7)
- [CVE-2026-43629](https://insights.sbomify.com/CVE-2026-43629/): llama.cpp b4882–b9058 Buffer Overflow in KV Cache State Restore (critical 9.2)
- [CVE-2026-43628](https://insights.sbomify.com/CVE-2026-43628/): llama.cpp b3978–b9058 Integer Underflow via DRY Sampler (high 8.5)
- [CVE-2026-43627](https://insights.sbomify.com/CVE-2026-43627/): llama.cpp b1283–b9058 Integer Overflow in llama_batch_init() Function (high 8.5)
- [CVE-2026-43625](https://insights.sbomify.com/CVE-2026-43625/): CodexBar < 0.32.0 Session Cookie Exposure via HTTP Redirect (high 8.2)
- [CVE-2026-43624](https://insights.sbomify.com/CVE-2026-43624/): F5-TTS 1.1.20 Path Traversal via finetune_gradio.py create_data_project() (high 8.8)
- [CVE-2026-43623](https://insights.sbomify.com/CVE-2026-43623/): microtar 0.1.0 Stack-Based Buffer Overflow via raw_to_header() (high 8.7)
- [CVE-2026-43622](https://insights.sbomify.com/CVE-2026-43622/): llama.cpp b1886–b7445 Double Free via llama-android.cpp (high 8.5)
- [CVE-2026-43621](https://insights.sbomify.com/CVE-2026-43621/): Simple Machines Forum < 2.1.7 Authorization Confusion via Profile::load() (high 8.6)
- [CVE-2026-43620](https://insights.sbomify.com/CVE-2026-43620/): Rsync < 3.4.3 Out-of-Bounds Array Read via recv_files() (medium 6.9)
- [CVE-2026-4362](https://insights.sbomify.com/CVE-2026-4362/): ElementsKit Elementor Addons <= 3.8.2 - Missing Authorization to Unauthenticated Widget Content Overwrite (medium 6.5)
- [CVE-2026-43619](https://insights.sbomify.com/CVE-2026-43619/): Rsync < 3.4.3 Symlink Race Condition via Path-Based Syscalls (high 7.2)
- [CVE-2026-43618](https://insights.sbomify.com/CVE-2026-43618/): Rsync < 3.4.3 Integer Overflow Information Disclosure (medium 6.1)
- [CVE-2026-43617](https://insights.sbomify.com/CVE-2026-43617/): Rsync < 3.4.3 Authorization Bypass via Hostname Resolution (medium 6.3)
- [CVE-2026-43616](https://insights.sbomify.com/CVE-2026-43616/): Detect-It-Easy < 3.21 Path Traversal Arbitrary File Write (medium 6.8)
- [CVE-2026-4361](https://insights.sbomify.com/CVE-2026-4361/): Divi <= 4.27.6 - Authenticated (Contributor+) Server-Side Request Forgery via 'image_src' Parameter (medium 5.0)
- [CVE-2026-43606](https://insights.sbomify.com/CVE-2026-43606/): Weak cryptography in Vitis™ Libraries - Security Module (high 7.7)
- [CVE-2026-4360](https://insights.sbomify.com/CVE-2026-4360/): Tarfile.extract() doesn't fully respect filter parameter (low 2.0)
- [CVE-2026-43598](https://insights.sbomify.com/CVE-2026-43598/): Memory corruption in AMD Instinct™ MI210 (high 7.7)
- [CVE-2026-4359](https://insights.sbomify.com/CVE-2026-4359/): Heap-buffer-over-read in _mongoc_http_send via strstr on non-null-terminated buffer (low 2.0)
- [CVE-2026-43585](https://insights.sbomify.com/CVE-2026-43585/): OpenClaw < 2026.4.15 - Bearer Token Validation Bypass via Stale SecretRef Resolution (critical 9.2)
- [CVE-2026-43584](https://insights.sbomify.com/CVE-2026-43584/): OpenClaw < 2026.4.10 - Insufficient Environment Variable Denylist in Exec Policy (high 8.7)
- [CVE-2026-43583](https://insights.sbomify.com/CVE-2026-43583/): OpenClaw 2026.4.10 < 2026.4.14 - Loss of Group Tool-Policy Context in Delivery Queue Recovery (medium 6.0)
- [CVE-2026-43582](https://insights.sbomify.com/CVE-2026-43582/): OpenClaw < 2026.4.10 - DNS Rebinding SSRF via Hostname Validation Bypass (medium 4.9)
- [CVE-2026-43581](https://insights.sbomify.com/CVE-2026-43581/): OpenClaw < 2026.4.10 - Chrome DevTools Protocol Exposure via Overly Broad CDP Relay Binding (critical 9.0)
- [CVE-2026-43580](https://insights.sbomify.com/CVE-2026-43580/): OpenClaw < 2026.4.10 - Incomplete Navigation Guard Coverage in Browser Interactions (medium 4.9)
- [CVE-2026-4358](https://insights.sbomify.com/CVE-2026-4358/): Memory safety issues in slot-based execution hash table spill (medium 6.1)
- [CVE-2026-43579](https://insights.sbomify.com/CVE-2026-43579/): OpenClaw < 2026.4.10 - Insufficient Access Control in Nostr Profile Mutation Routes (medium 6.0)
- [CVE-2026-43578](https://insights.sbomify.com/CVE-2026-43578/): OpenClaw: Heartbeat owner downgrade missed local async exec completion events (critical 9.1)
- [CVE-2026-43577](https://insights.sbomify.com/CVE-2026-43577/): OpenClaw < 2026.4.9 - Arbitrary File Read via Browser Interaction Routes (high 7.1)
- [CVE-2026-43576](https://insights.sbomify.com/CVE-2026-43576/): OpenClaw < 2026.4.5 - Second-hop SSRF via CDP /json/version WebSocket URL (medium 4.9)
- [CVE-2026-43575](https://insights.sbomify.com/CVE-2026-43575/): OpenClaw 2026.2.21 < 2026.4.10 - Authentication Bypass in Sandbox noVNC Helper Route (critical 9.2)
- [CVE-2026-43574](https://insights.sbomify.com/CVE-2026-43574/): OpenClaw < 2026.4.12 - Improper Authorization via Empty Approver Lists (medium 6.0)
- [CVE-2026-43573](https://insights.sbomify.com/CVE-2026-43573/): OpenClaw < 2026.4.10 - SSRF Policy Bypass in Existing-Session Browser Interaction Routes (medium 4.9)
- [CVE-2026-43572](https://insights.sbomify.com/CVE-2026-43572/): OpenClaw 2026.4.10 < 2026.4.14 - Missing Sender Authorization in Microsoft Teams SSO Invoke Handler (medium 6.3)
- [CVE-2026-43571](https://insights.sbomify.com/CVE-2026-43571/): OpenClaw < 2026.4.10 - Untrusted Workspace Plugin Shadow Resolution in Channel Setup (high 7.7)
- [CVE-2026-43570](https://insights.sbomify.com/CVE-2026-43570/): OpenClaw 2026.3.22 < 2026.4.5 - Symlink Traversal in Remote Marketplace Repository Path Handling (medium 6.0)
- [CVE-2026-4357](https://insights.sbomify.com/CVE-2026-4357/): Embed HTML5 Game <= 1.3 - Unauthenticated Arbitrary File Upload (critical 10.0)
- [CVE-2026-43569](https://insights.sbomify.com/CVE-2026-43569/): OpenClaw < 2026.4.9 - Untrusted Provider Plugin Auto-enablement via Workspace Provider Auth (high 7.7)
- [CVE-2026-43568](https://insights.sbomify.com/CVE-2026-43568/): OpenClaw 2026.4.5 through 2026.4.9 - Privilege Escalation via Memory Dreaming Configuration in /dreaming Endpoint (high 7.1)
- [CVE-2026-43567](https://insights.sbomify.com/CVE-2026-43567/): OpenClaw < 2026.4.10 - Path Traversal in screen_record outPath Parameter (high 7.1)
- [CVE-2026-43566](https://insights.sbomify.com/CVE-2026-43566/): OpenClaw 2026.4.7 < 2026.4.14 - Privilege Escalation via Untrusted Webhook Wake Events (critical 9.1)
- [CVE-2026-4356](https://insights.sbomify.com/CVE-2026-4356/): itsourcecode University Management System add_result.php cross site scripting (medium 4.8)
- [CVE-2026-4355](https://insights.sbomify.com/CVE-2026-4355/): Portabilis i-Educar Endpoint educar_servidor_curso_lst.php cross site scripting (medium 5.1)
- [CVE-2026-4354](https://insights.sbomify.com/CVE-2026-4354/): TRENDnet TEW-824DRU Web apply_sec.cgi sub_420A78 cross site scripting (medium 5.1)
- [CVE-2026-43535](https://insights.sbomify.com/CVE-2026-43535/): OpenClaw < 2026.4.14 - Authorization Context Reuse in Collect-Mode Queue Batches (high 7.6)
- [CVE-2026-43534](https://insights.sbomify.com/CVE-2026-43534/): OpenClaw < 2026.4.10 - Unsanitized External Input in Agent Hook Events (critical 9.3)
- [CVE-2026-43533](https://insights.sbomify.com/CVE-2026-43533/): OpenClaw < 2026.4.10 - Arbitrary Local File Read via QQBot Media Tags (high 8.9)
- [CVE-2026-43532](https://insights.sbomify.com/CVE-2026-43532/): OpenClaw 2026.4.7 < 2026.4.10 - Sandbox Media Normalization Bypass via Discord Event Cover Image (medium 4.9)
- [CVE-2026-43531](https://insights.sbomify.com/CVE-2026-43531/): OpenClaw < 2026.4.9 - Environment Variable Injection via Workspace .env File (high 7.0)
- [CVE-2026-43530](https://insights.sbomify.com/CVE-2026-43530/): OpenClaw 2026.2.23 < 2026.4.12 - Weakened Exec Approval Binding via busybox and toybox Applet Execution (high 8.7)
- [CVE-2026-4353](https://insights.sbomify.com/CVE-2026-4353/): CI HUB Connector <= 1.2.106 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute (medium 6.4)
- [CVE-2026-43529](https://insights.sbomify.com/CVE-2026-43529/): OpenClaw < 2026.4.10 - Time-of-Check-Time-of-Use (TOCTOU) Race Condition in exec Script Preflight Validator (low 2.0)
- [CVE-2026-43528](https://insights.sbomify.com/CVE-2026-43528/): OpenClaw < 2026.4.14 - Redaction Bypass via sourceConfig and runtimeConfig Aliases (high 7.1)
- [CVE-2026-43527](https://insights.sbomify.com/CVE-2026-43527/): OpenClaw < 2026.4.14 - Server-Side Request Forgery via Private Network Navigation (medium 6.3)
- [CVE-2026-43526](https://insights.sbomify.com/CVE-2026-43526/): OpenClaw < 2026.4.12 - Server-Side Request Forgery via QQBot Reply Media URL Handling (high 8.3)
- [CVE-2026-4352](https://insights.sbomify.com/CVE-2026-4352/): JetEngine <= 3.8.6.1 - Unauthenticated SQL Injection via '_cct_search' Parameter (high 7.5)
- [CVE-2026-43515](https://insights.sbomify.com/CVE-2026-43515/): Apache Tomcat: Security constraints not correctly applied (critical 9.1)
- [CVE-2026-43514](https://insights.sbomify.com/CVE-2026-43514/): Apache Tomcat: AJP secret compared in non-constant time (low 3.7)
- [CVE-2026-43513](https://insights.sbomify.com/CVE-2026-43513/): Apache Tomcat: LockOutRealm treats user names as case-sensitive (high 7.5)
- [CVE-2026-43512](https://insights.sbomify.com/CVE-2026-43512/): Apache Tomcat: Digest authenticator will authenticate any unknown user (critical 9.8)
- [CVE-2026-43510](https://insights.sbomify.com/CVE-2026-43510/): CISA manage.get.gov insecure portfolio administrative privileges (medium 5.1)
- [CVE-2026-4351](https://insights.sbomify.com/CVE-2026-4351/): Perfmatters <= 2.5.9 - Authenticated (Subscriber+) Arbitrary File Overwrite via 'snippets' Parameter (high 8.1)
- [CVE-2026-43507](https://insights.sbomify.com/CVE-2026-43507/): Denial of service in Prosody (medium 5.3)
- [CVE-2026-43506](https://insights.sbomify.com/CVE-2026-43506/): Denial of service in Prosody (medium 5.3)
- [CVE-2026-43505](https://insights.sbomify.com/CVE-2026-43505/): Security feature bypass in Prosody (medium 6.5)
- [CVE-2026-43504](https://insights.sbomify.com/CVE-2026-43504/): Security feature bypass in Prosody (medium 6.5)
- [CVE-2026-43503](https://insights.sbomify.com/CVE-2026-43503/): net: skbuff: propagate shared-frag marker through frag-transfer helpers (high 8.8)
- [CVE-2026-43502](https://insights.sbomify.com/CVE-2026-43502/): net/rds: handle zerocopy send cleanup before the message is queued (high 7.8)
- [CVE-2026-43501](https://insights.sbomify.com/CVE-2026-43501/): ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (critical 9.8)
- [CVE-2026-43500](https://insights.sbomify.com/CVE-2026-43500/): rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (high 7.8)
- [CVE-2026-4350](https://insights.sbomify.com/CVE-2026-4350/): Perfmatters <= 2.5.9.1 - Authenticated (Subscriber+) Arbitrary File Deletion via 'delete' Parameter (high 8.1)
- [CVE-2026-43499](https://insights.sbomify.com/CVE-2026-43499/): rtmutex: Use waiter::task instead of current in remove_waiter() (high 7.8)
- [CVE-2026-43498](https://insights.sbomify.com/CVE-2026-43498/): accel/ivpu: Disallow re-exporting imported GEM objects (high 7.8)
- [CVE-2026-43497](https://insights.sbomify.com/CVE-2026-43497/): fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free (high 7.3)
- [CVE-2026-43496](https://insights.sbomify.com/CVE-2026-43496/): net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (medium 5.5)
- [CVE-2026-43495](https://insights.sbomify.com/CVE-2026-43495/): net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler (high 8.8)
- [CVE-2026-43494](https://insights.sbomify.com/CVE-2026-43494/): net/rds: reset op_nents when zerocopy page pin fails (high 7.8)
- [CVE-2026-43493](https://insights.sbomify.com/CVE-2026-43493/): crypto: pcrypt - Fix handling of MAY_BACKLOG requests (critical 9.8)
- [CVE-2026-43492](https://insights.sbomify.com/CVE-2026-43492/): lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() (medium 5.5)
- [CVE-2026-43491](https://insights.sbomify.com/CVE-2026-43491/): net: qrtr: ns: Limit the maximum server registration per node (medium 5.5)
- [CVE-2026-43490](https://insights.sbomify.com/CVE-2026-43490/): ksmbd: validate inherited ACE SID length (high 8.8)
- [CVE-2026-4349](https://insights.sbomify.com/CVE-2026-4349/): Duende IdentityServer4 Token Renewal Endpoint authorize improper authentication (medium 6.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/639/