# Vulnerabilities published in 2026


- [CVE-2026-43027](https://insights.sbomify.com/CVE-2026-43027/): netfilter: nf_conntrack_helper: pass helper to expect cleanup (high 7.8)
- [CVE-2026-43026](https://insights.sbomify.com/CVE-2026-43026/): netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (medium 5.5)
- [CVE-2026-43025](https://insights.sbomify.com/CVE-2026-43025/): netfilter: ctnetlink: ignore explicit helper on new expectations (high 7.3)
- [CVE-2026-43024](https://insights.sbomify.com/CVE-2026-43024/): netfilter: nf_tables: reject immediate NF_QUEUE verdict (medium 5.5)
- [CVE-2026-43023](https://insights.sbomify.com/CVE-2026-43023/): Bluetooth: SCO: fix race conditions in sco_sock_connect() (high 7.8)
- [CVE-2026-43022](https://insights.sbomify.com/CVE-2026-43022/): Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (medium 5.5)
- [CVE-2026-43021](https://insights.sbomify.com/CVE-2026-43021/): Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (medium 5.5)
- [CVE-2026-43020](https://insights.sbomify.com/CVE-2026-43020/): Bluetooth: MGMT: validate LTK enc_size on load (high 7.8)
- [CVE-2026-4302](https://insights.sbomify.com/CVE-2026-4302/): WowOptin: Next-Gen Popup Maker <= 1.4.29 - Unauthenticated Server-Side Request Forgery via 'link' Parameter in REST API (high 7.2)
- [CVE-2026-43019](https://insights.sbomify.com/CVE-2026-43019/): Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync (high 7.8)
- [CVE-2026-43018](https://insights.sbomify.com/CVE-2026-43018/): Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt (high 8.8)
- [CVE-2026-43017](https://insights.sbomify.com/CVE-2026-43017/): Bluetooth: MGMT: validate mesh send advertising payload length (medium 5.5)
- [CVE-2026-43016](https://insights.sbomify.com/CVE-2026-43016/): bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready(). (high 7.8)
- [CVE-2026-43015](https://insights.sbomify.com/CVE-2026-43015/): net: macb: fix clk handling on PCI glue driver removal (high 7.8)
- [CVE-2026-43014](https://insights.sbomify.com/CVE-2026-43014/): net: macb: properly unregister fixed rate clocks (medium 5.5)
- [CVE-2026-43013](https://insights.sbomify.com/CVE-2026-43013/): net/mlx5: lag: Check for LAG device before creating debugfs (medium 5.5)
- [CVE-2026-43012](https://insights.sbomify.com/CVE-2026-43012/): net/mlx5: Fix switchdev mode rollback in case of failure (medium 5.5)
- [CVE-2026-43011](https://insights.sbomify.com/CVE-2026-43011/): net/x25: Fix potential double free of skb (critical 9.8)
- [CVE-2026-43010](https://insights.sbomify.com/CVE-2026-43010/): bpf: Reject sleepable kprobe_multi programs at attach time (medium 5.5)
- [CVE-2026-4301](https://insights.sbomify.com/CVE-2026-4301/): Missing authorization in Rate Star Review Vote – AJAX Reviews, Votes, Star Ratings (medium 4.3)
- [CVE-2026-43009](https://insights.sbomify.com/CVE-2026-43009/): bpf: Fix incorrect pruning due to atomic fetch precision tracking (high 7.8)
- [CVE-2026-43008](https://insights.sbomify.com/CVE-2026-43008/): gpio: qixis-fpga: Fix error handling for devm_regmap_init_mmio() (medium 5.5)
- [CVE-2026-43007](https://insights.sbomify.com/CVE-2026-43007/): accel/qaic: Handle DBC deactivation if the owner went away (high 7.8)
- [CVE-2026-43006](https://insights.sbomify.com/CVE-2026-43006/): io_uring/rsrc: reject zero-length fixed buffer import (high 7.1)
- [CVE-2026-43005](https://insights.sbomify.com/CVE-2026-43005/): hwmon: (tps53679) Fix array access with zero-length block read (high 7.1)
- [CVE-2026-43004](https://insights.sbomify.com/CVE-2026-43004/): spi: stm32-ospi: Fix resource leak in remove() callback (medium 5.5)
- [CVE-2026-43003](https://insights.sbomify.com/CVE-2026-43003/): OpenStack Ironic Python Agent Includes Functionality from Untrusted Control Sphere (high 8.0)
- [CVE-2026-43002](https://insights.sbomify.com/CVE-2026-43002/): OpenStack Horizon has Incorrect Behavior Order (medium 5.3)
- [CVE-2026-43001](https://insights.sbomify.com/CVE-2026-43001/): OpenStack Keystone has an Incorrect Authorization Issue (high 7.9)
- [CVE-2026-43000](https://insights.sbomify.com/CVE-2026-43000/): OpenStack Keystone has an Incorrect Authorization issue (medium 6.0)
- [CVE-2026-4300](https://insights.sbomify.com/CVE-2026-4300/): Robo Gallery <= 5.1.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'Loading Label' Setting (medium 6.4)
- [CVE-2026-42999](https://insights.sbomify.com/CVE-2026-42999/): OpenStack Keystone has an Authorization Bypass (medium 6.0)
- [CVE-2026-42998](https://insights.sbomify.com/CVE-2026-42998/): OpenStack Keystone doesn't verify that the user supplied in the authentication request matches the owner of the application credential (medium 6.0)
- [CVE-2026-42997](https://insights.sbomify.com/CVE-2026-42997/): OpenStack Ironic has an Incorrect Resource Transfer Between Spheres (high 7.7)
- [CVE-2026-42996](https://insights.sbomify.com/CVE-2026-42996/): Memory corruption in JS8Call (critical 10.0)
- [CVE-2026-42994](https://insights.sbomify.com/CVE-2026-42994/): Supply chain in Bitwarden CLI (high 8.8)
- [CVE-2026-42993](https://insights.sbomify.com/CVE-2026-42993/): Remote Desktop Client Remote Code Execution Vulnerability (high 7.5)
- [CVE-2026-42992](https://insights.sbomify.com/CVE-2026-42992/): Remote Desktop Client Remote Code Execution Vulnerability (high 7.5)
- [CVE-2026-42991](https://insights.sbomify.com/CVE-2026-42991/): Windows Push Notifications Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-42990](https://insights.sbomify.com/CVE-2026-42990/): SQL Server ODBC driver Elevation of Privilege Vulnerability (critical 9.8)
- [CVE-2026-4299](https://insights.sbomify.com/CVE-2026-4299/): Missing authorization in MainWP Child Reports (medium 5.3)
- [CVE-2026-42989](https://insights.sbomify.com/CVE-2026-42989/): Winlogon Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-42987](https://insights.sbomify.com/CVE-2026-42987/): Windows Deployment Services (WDS) Remote Code Execution (high 8.1)
- [CVE-2026-42986](https://insights.sbomify.com/CVE-2026-42986/): Microsoft Graphics Component Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-42985](https://insights.sbomify.com/CVE-2026-42985/): Remote Desktop Client Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-42984](https://insights.sbomify.com/CVE-2026-42984/): Windows Kernel Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-42983](https://insights.sbomify.com/CVE-2026-42983/): Windows DWM Core Library Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-42982](https://insights.sbomify.com/CVE-2026-42982/): Windows Secure Kernel Mode Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-42981](https://insights.sbomify.com/CVE-2026-42981/): Windows Performance Monitor Remote Code Execution Vulnerability (high 8.1)
- [CVE-2026-42980](https://insights.sbomify.com/CVE-2026-42980/): NT OS Kernel Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-4298](https://insights.sbomify.com/CVE-2026-4298/): DSGVO All in one for WP <= 4.9 - Missing Authorization to Authenticated (Subscriber+) Settings Reset (medium 4.3)
- [CVE-2026-42979](https://insights.sbomify.com/CVE-2026-42979/): Windows Push Notifications Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-42978](https://insights.sbomify.com/CVE-2026-42978/): Windows Push Notifications Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-42977](https://insights.sbomify.com/CVE-2026-42977/): Windows Push Notifications Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-42976](https://insights.sbomify.com/CVE-2026-42976/): Remote Access Management service/API (RPC server) Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-42975](https://insights.sbomify.com/CVE-2026-42975/): Windows Bluetooth Port Driver Remote Code Execution (high 8.0)
- [CVE-2026-42974](https://insights.sbomify.com/CVE-2026-42974/): Windows Performance Monitor Remote Code Execution Vulnerability (high 8.1)
- [CVE-2026-42973](https://insights.sbomify.com/CVE-2026-42973/): Windows Push Notification Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-42972](https://insights.sbomify.com/CVE-2026-42972/): Windows Hyper-V Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-42971](https://insights.sbomify.com/CVE-2026-42971/): Windows Push Notification Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-42970](https://insights.sbomify.com/CVE-2026-42970/): Windows Push Notification Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-4297](https://insights.sbomify.com/CVE-2026-4297/): Missing authorization in Welcome Software Publishing (high 8.8)
- [CVE-2026-42969](https://insights.sbomify.com/CVE-2026-42969/): Windows Push Notification Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-42968](https://insights.sbomify.com/CVE-2026-42968/): Windows Telephony Server Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-42965](https://insights.sbomify.com/CVE-2026-42965/): Openshift/router: openshift/router: cloud metadata ssrf via fqdn-typed endpointslice bypasses destination validation (high 7.7)
- [CVE-2026-42961](https://insights.sbomify.com/CVE-2026-42961/): Cross-site request forgery in WAB-BE187-M (medium 5.1)
- [CVE-2026-42960](https://insights.sbomify.com/CVE-2026-42960/): Possible cache poisoning via promiscuous records for the authority section (medium 5.7)
- [CVE-2026-4296](https://insights.sbomify.com/CVE-2026-4296/): Auth bypass in Enterprise Server (high 7.5)
- [CVE-2026-42959](https://insights.sbomify.com/CVE-2026-42959/): Crash during DNSSEC validation of malicious content (high 8.7)
- [CVE-2026-42958](https://insights.sbomify.com/CVE-2026-42958/): Use After Free in Labcenter Proteus (high 8.4)
- [CVE-2026-42955](https://insights.sbomify.com/CVE-2026-42955/): Business logic in Unbound (low 3.7)
- [CVE-2026-42953](https://insights.sbomify.com/CVE-2026-42953/): Out-of-bounds write in Labcenter Proteus (high 8.4)
- [CVE-2026-42952](https://insights.sbomify.com/CVE-2026-42952/): Hydro-Québec Le Circuit Electrique charging station backend Improper Restriction of Excessive Authentication Attempts (high 8.7)
- [CVE-2026-42951](https://insights.sbomify.com/CVE-2026-42951/): MacGregor Voyage Data Recorder (VDR) G4e Insufficiently Protected Credentials (medium 5.9)
- [CVE-2026-42950](https://insights.sbomify.com/CVE-2026-42950/): Other in WAB-BE187-M (medium 5.1)
- [CVE-2026-4295](https://insights.sbomify.com/CVE-2026-4295/): Arbitrary code execution via crafted project files in Kiro IDE (high 8.5)
- [CVE-2026-42949](https://insights.sbomify.com/CVE-2026-42949/): Missing authorization in Frangoteam (medium 5.6)
- [CVE-2026-42948](https://insights.sbomify.com/CVE-2026-42948/): Cross-site scripting in WAB-BE187-M (medium 4.8)
- [CVE-2026-42947](https://insights.sbomify.com/CVE-2026-42947/): Naxclow IoT Platform Authorization bypass through User-Controlled key (high 8.7)
- [CVE-2026-42946](https://insights.sbomify.com/CVE-2026-42946/): NGINX ngx_http_scgi_module and ngx_http_uwsgi_module vulnerability (high 8.3)
- [CVE-2026-42945](https://insights.sbomify.com/CVE-2026-42945/): NGINX ngx_http_rewrite_module vulnerability (critical 9.2)
- [CVE-2026-42944](https://insights.sbomify.com/CVE-2026-42944/): Heap overflow with multiple NSID, COOKIE, PADDING EDNS options (high 8.7)
- [CVE-2026-42941](https://insights.sbomify.com/CVE-2026-42941/): MacGregor Voyage Data Recorder (VDR) G4e Use of Default Credentials (high 8.7)
- [CVE-2026-42937](https://insights.sbomify.com/CVE-2026-42937/): iControl REST and tmsh vulnerability (high 7.1)
- [CVE-2026-42936](https://insights.sbomify.com/CVE-2026-42936/): Other in HYPER SBI 2 (high 8.4)
- [CVE-2026-42934](https://insights.sbomify.com/CVE-2026-42934/): NGINX ngx_http_charset_module vulnerability (medium 6.3)
- [CVE-2026-42933](https://insights.sbomify.com/CVE-2026-42933/): Unintended Proxy or Intermediary in Panduit IntraVUE by Pronetiqs (critical 10.0)
- [CVE-2026-42932](https://insights.sbomify.com/CVE-2026-42932/): Naxclow IoT Platform Generation of Predictable Numbers or Identifiers (medium 6.9)
- [CVE-2026-42931](https://insights.sbomify.com/CVE-2026-42931/): Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint (medium 6.5)
- [CVE-2026-42930](https://insights.sbomify.com/CVE-2026-42930/): Appliance mode iControl REST vulnerability (high 8.5)
- [CVE-2026-4293](https://insights.sbomify.com/CVE-2026-4293/): Kieback & Peter DDC Building Controllers Cross-site Scripting (medium 5.3)
- [CVE-2026-42929](https://insights.sbomify.com/CVE-2026-42929/): MacGregor Voyage Data Recorder (VDR) G4e Use of Hard-coded Credentials (high 8.7)
- [CVE-2026-42926](https://insights.sbomify.com/CVE-2026-42926/): NGINX ngx_http_proxy_v2_module vulnerability (medium 6.3)
- [CVE-2026-42924](https://insights.sbomify.com/CVE-2026-42924/): BIG-IP iControl SOAP vulnerability (high 8.5)
- [CVE-2026-42923](https://insights.sbomify.com/CVE-2026-42923/): Degradation of service with unbounded NSEC3 hash calculations (medium 6.9)
- [CVE-2026-42922](https://insights.sbomify.com/CVE-2026-42922/): Missing authorization in Frangoteam (critical 9.8)
- [CVE-2026-42920](https://insights.sbomify.com/CVE-2026-42920/): BIG-IP DTLS Vulnerability (high 8.7)
- [CVE-2026-4292](https://insights.sbomify.com/CVE-2026-4292/): Privilege abuse in ModelAdmin.list_editable (low 2.7)
- [CVE-2026-42919](https://insights.sbomify.com/CVE-2026-42919/): F5 BIG-IP Appliance Mode Vulnerability (high 7.1)
- [CVE-2026-42916](https://insights.sbomify.com/CVE-2026-42916/): NT OS Kernel Elevation of Privilege Vulnerability (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/645/