# Vulnerabilities published in 2026


- [CVE-2026-42523](https://insights.sbomify.com/CVE-2026-42523/): Jenkins GitHub Plugin has an XSS vulnerability (critical 9.0)
- [CVE-2026-42522](https://insights.sbomify.com/CVE-2026-42522/): Jenkins GitHub Branch Source Plugin: Missing permissions check allows attackers to perform a connection test (medium 4.3)
- [CVE-2026-42521](https://insights.sbomify.com/CVE-2026-42521/): Jenkins Matrix Authorization Strategy Plugin: Unsafe deserialization allows invocation of parameterless constructors (medium 6.5)
- [CVE-2026-42520](https://insights.sbomify.com/CVE-2026-42520/): Jenkins Credentials Binding Plugin has a path traversal vulnerability (high 7.5)
- [CVE-2026-4252](https://insights.sbomify.com/CVE-2026-4252/): Tenda AC8 IPv6 check_is_ipv6 ip address for authentication (critical 9.3)
- [CVE-2026-42519](https://insights.sbomify.com/CVE-2026-42519/): Jenkins Script Security Plugin: Missing permission checks allow enumeration of pending and approved classpaths (medium 4.3)
- [CVE-2026-42518](https://insights.sbomify.com/CVE-2026-42518/): Information Disclosure Vulnerability in e-Sushrut HMIS (high 8.7)
- [CVE-2026-42517](https://insights.sbomify.com/CVE-2026-42517/): Cryptographic Failure Vulnerability in e-Sushrut HMIS (high 7.1)
- [CVE-2026-42516](https://insights.sbomify.com/CVE-2026-42516/): Broken Access Control Vulnerability in e-Sushrut HMIS (high 7.1)
- [CVE-2026-42515](https://insights.sbomify.com/CVE-2026-42515/): Insecure Direct Object Reference (IDOR) Vulnerability in e-Sushrut HMIS (high 7.1)
- [CVE-2026-42514](https://insights.sbomify.com/CVE-2026-42514/): Sensitive Data Exposure Vulnerability in e-Sushrut HMIS (high 8.8)
- [CVE-2026-42513](https://insights.sbomify.com/CVE-2026-42513/): Authentication Bypass Vulnerability in e-Sushrut HMIS (high 8.8)
- [CVE-2026-42512](https://insights.sbomify.com/CVE-2026-42512/): Remotely triggerable out-of-bounds heap write in dhclient (high 8.1)
- [CVE-2026-42511](https://insights.sbomify.com/CVE-2026-42511/): Remote code execution via malicious DHCP options (high 8.1)
- [CVE-2026-42510](https://insights.sbomify.com/CVE-2026-42510/): OpenStack Ironic is Vulnerable to Inclusion of Functionality from Untrusted Control Sphere (medium 6.6)
- [CVE-2026-4251](https://insights.sbomify.com/CVE-2026-4251/): CityData CityChat ai.citydata.citychat credentials.json credentials storage (low 2.0)
- [CVE-2026-42509](https://insights.sbomify.com/CVE-2026-42509/): Apache Wicket: crafted strings can break out of the JavaScript sequence (medium 6.1)
- [CVE-2026-42508](https://insights.sbomify.com/CVE-2026-42508/): Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (critical 9.1)
- [CVE-2026-42507](https://insights.sbomify.com/CVE-2026-42507/): Arbitrary inputs are included in errors without any escaping in net/textproto (medium 5.3)
- [CVE-2026-42506](https://insights.sbomify.com/CVE-2026-42506/): Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html (medium 6.1)
- [CVE-2026-42505](https://insights.sbomify.com/CVE-2026-42505/): Invoking Encrypted Client Hello privacy leak in crypto/tls (medium 5.3)
- [CVE-2026-42504](https://insights.sbomify.com/CVE-2026-42504/): Quadratic complexity in WordDecoder.DecodeHeader in mime (high 7.5)
- [CVE-2026-42503](https://insights.sbomify.com/CVE-2026-42503/): Accidental binding to INADDR_ANY might lead to RCE in golang.org/x/tools/gopls (high 8.8)
- [CVE-2026-42502](https://insights.sbomify.com/CVE-2026-42502/): Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html (medium 6.1)
- [CVE-2026-42501](https://insights.sbomify.com/CVE-2026-42501/): Malicious module proxy can bypass checksum database in cmd/go (high 7.5)
- [CVE-2026-42500](https://insights.sbomify.com/CVE-2026-42500/): Panic when reading out of bound palette index in golang.org/x/image/bmp (medium 5.3)
- [CVE-2026-4250](https://insights.sbomify.com/CVE-2026-4250/): Hardcoded credentials in Albert Health (low 2.0)
- [CVE-2026-42499](https://insights.sbomify.com/CVE-2026-42499/): Quadratic string concatenation in consumePhrase in net/mail (high 7.5)
- [CVE-2026-42498](https://insights.sbomify.com/CVE-2026-42498/): Apache Tomcat: WebSocket authentication header exposure (high 7.3)
- [CVE-2026-42497](https://insights.sbomify.com/CVE-2026-42497/): Path traversal in Archive::Tar (high 7.5)
- [CVE-2026-42496](https://insights.sbomify.com/CVE-2026-42496/): Path traversal in Archive::Tar (critical 9.1)
- [CVE-2026-42495](https://insights.sbomify.com/CVE-2026-42495/): buffer overruns in libfsimage iso9660 handling (medium 5.5)
- [CVE-2026-42494](https://insights.sbomify.com/CVE-2026-42494/): buffer overruns in libfsimage iso9660 handling (medium 6.1)
- [CVE-2026-42493](https://insights.sbomify.com/CVE-2026-42493/): x86 shadow paging is deprecated (high 7.5)
- [CVE-2026-42492](https://insights.sbomify.com/CVE-2026-42492/): vIRQ event channel binding may break Xenstore (high 7.5)
- [CVE-2026-42490](https://insights.sbomify.com/CVE-2026-42490/): domctl lock open to abuse (medium 6.5)
- [CVE-2026-4249](https://insights.sbomify.com/CVE-2026-4249/): Denial of service in WSO2 API Control Plane (high 8.6)
- [CVE-2026-42489](https://insights.sbomify.com/CVE-2026-42489/): domctl lock open to abuse (medium 5.3)
- [CVE-2026-42488](https://insights.sbomify.com/CVE-2026-42488/): x86: mismatched mapcache metadata (high 8.1)
- [CVE-2026-42487](https://insights.sbomify.com/CVE-2026-42487/): x86 HVM I/O port list traversal (high 7.9)
- [CVE-2026-42486](https://insights.sbomify.com/CVE-2026-42486/): Multiple RBAC issues in XAPI (critical 9.4)
- [CVE-2026-42485](https://insights.sbomify.com/CVE-2026-42485/): AGL agl-service-can-low-level contains a stack buffer overflow in the uds-c library. (high 7.5)
- [CVE-2026-42484](https://insights.sbomify.com/CVE-2026-42484/): Memory corruption in hashcat:hashcat (critical 9.8)
- [CVE-2026-42483](https://insights.sbomify.com/CVE-2026-42483/): Memory corruption in hashcat:hashcat (high 7.3)
- [CVE-2026-42482](https://insights.sbomify.com/CVE-2026-42482/): Memory corruption in hashcat:hashcat (high 7.5)
- [CVE-2026-42481](https://insights.sbomify.com/CVE-2026-42481/): Memory corruption in opencascade:open cascade technology (medium 5.5)
- [CVE-2026-42480](https://insights.sbomify.com/CVE-2026-42480/): Memory corruption in opencascade:open cascade technology (medium 5.5)
- [CVE-2026-4248](https://insights.sbomify.com/CVE-2026-4248/): Information disclosure in Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin (high 8.0)
- [CVE-2026-42479](https://insights.sbomify.com/CVE-2026-42479/): Memory corruption in opencascade:open cascade technology (medium 5.5)
- [CVE-2026-42478](https://insights.sbomify.com/CVE-2026-42478/): Null dereference in opencascade:open cascade technology (medium 5.5)
- [CVE-2026-42477](https://insights.sbomify.com/CVE-2026-42477/): Memory corruption in opencascade:open cascade technology (medium 5.5)
- [CVE-2026-42476](https://insights.sbomify.com/CVE-2026-42476/): Memory corruption in opencascade:open cascade technology (medium 5.5)
- [CVE-2026-42475](https://insights.sbomify.com/CVE-2026-42475/): MixPHP Framework has an SQL injection vulnerability (medium 6.5)
- [CVE-2026-42474](https://insights.sbomify.com/CVE-2026-42474/): MixPHP Framework has an SQL injection vulnerability via crafted `data` array (medium 6.5)
- [CVE-2026-42473](https://insights.sbomify.com/CVE-2026-42473/): Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. (critical 9.8)
- [CVE-2026-42472](https://insights.sbomify.com/CVE-2026-42472/): Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. (critical 9.8)
- [CVE-2026-42471](https://insights.sbomify.com/CVE-2026-42471/): Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. (high 8.1)
- [CVE-2026-4247](https://insights.sbomify.com/CVE-2026-4247/): TCP: remotely exploitable DoS vector (mbuf leak) (high 7.5)
- [CVE-2026-42469](https://insights.sbomify.com/CVE-2026-42469/): Memory corruption in openvehicles:open vehicle monitoring system firmware (high 8.6)
- [CVE-2026-42468](https://insights.sbomify.com/CVE-2026-42468/): Memory corruption in openvehicles:open vehicle monitoring system firmware (high 8.8)
- [CVE-2026-42467](https://insights.sbomify.com/CVE-2026-42467/): An issue was discovered in Open-SAE-J1939 thru commit b6caf884df46435e539b1ecbf92b6c29b345bdfe (2025-11-30) in SAE_J1939_Read_Binary_Data_Tr (high 7.5)
- [CVE-2026-42463](https://insights.sbomify.com/CVE-2026-42463/): SQLBot: Unauthorized Access Vulnerability (high 8.6)
- [CVE-2026-42462](https://insights.sbomify.com/CVE-2026-42462/): Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring (high 7.0)
- [CVE-2026-42461](https://insights.sbomify.com/CVE-2026-42461/): Arcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl. `.env` secrets) (high 8.7)
- [CVE-2026-4246](https://insights.sbomify.com/CVE-2026-4246/): ElementsKit Pro <= 4.10.1 - Unauthenticated Stored Cross-Site Scripting via 's' Parameter (medium 6.1)
- [CVE-2026-42459](https://insights.sbomify.com/CVE-2026-42459/): Free5GC UDM has Improper Input Validation and Generation of Error Messages Containing Sensitive Information (high 7.7)
- [CVE-2026-42458](https://insights.sbomify.com/CVE-2026-42458/): Magento LTS: Reflected XSS - Import -> Data Flow (profiles) (medium 5.3)
- [CVE-2026-42457](https://insights.sbomify.com/CVE-2026-42457/): vCluster Platform: Stored XSS can lead to privilege escalation (critical 9.0)
- [CVE-2026-42456](https://insights.sbomify.com/CVE-2026-42456/): AnythingLLM: Cross-User TTS Audio Disclosure via Chat ID (IDOR) (medium 4.3)
- [CVE-2026-42455](https://insights.sbomify.com/CVE-2026-42455/): LinkWarden: Stored XSS via Client-Side Archive Upload (Unsanitized HTML served from same origin) (high 8.8)
- [CVE-2026-42454](https://insights.sbomify.com/CVE-2026-42454/): Termix: OS Command Injection in Docker Container Management Endpoints (critical 9.9)
- [CVE-2026-42453](https://insights.sbomify.com/CVE-2026-42453/): Termix: Command injection in extractArchive/compressFiles via double-quote escaping bypass (high 8.7)
- [CVE-2026-42452](https://insights.sbomify.com/CVE-2026-42452/): Termix: Pending-TOTP temporary token can regenerate backup codes and neutralize TOTP (high 8.1)
- [CVE-2026-42451](https://insights.sbomify.com/CVE-2026-42451/): Grimmory: Stored XSS via Malicious EPUB Enables Session Token Theft (medium 6.3)
- [CVE-2026-42450](https://insights.sbomify.com/CVE-2026-42450/): OpenColorIO vulnerable to stack buffer overflow via unbounded `sscanf %s` in Spi3D (.spi3d) LUT parser (high 8.4)
- [CVE-2026-4245](https://insights.sbomify.com/CVE-2026-4245/): Post Duplicator <= 3.0.11 - Authorization Bypass to Authenticated (Contributor+) Post Duplication (medium 4.3)
- [CVE-2026-42449](https://insights.sbomify.com/CVE-2026-42449/): n8n-MCP: IPv4-mapped IPv6 addresses bypass SSRF protection in validateUrlSync(), enabling full SSRF for SDK embedders (high 8.5)
- [CVE-2026-42448](https://insights.sbomify.com/CVE-2026-42448/): wormhole receive, with --output pointing at an existing directory can be path-traversed (low 3.5)
- [CVE-2026-42447](https://insights.sbomify.com/CVE-2026-42447/): jadx: HTML Injection in Summary panel (low 3.6)
- [CVE-2026-42446](https://insights.sbomify.com/CVE-2026-42446/): NanaZip: Stack out-of-bounds read in NanaZip ZealFS bitmap parser (medium 4.4)
- [CVE-2026-42445](https://insights.sbomify.com/CVE-2026-42445/): NanaZip: Uncontrolled recursion in NanaZip UFS directory traversal causes stack exhaustion (low 3.3)
- [CVE-2026-42444](https://insights.sbomify.com/CVE-2026-42444/): NanaZip: Unbounded resource consumption in NanaZip littlefs parser via attacker-controlled BlockCount (low 3.3)
- [CVE-2026-42443](https://insights.sbomify.com/CVE-2026-42443/): NanaZip: Integer divide-by-zero in NanaZip UFS inode offset calculation (low 3.3)
- [CVE-2026-42442](https://insights.sbomify.com/CVE-2026-42442/): NanaZip: Null-pointer dereference in NanaZip UFS parser when root inode is a symlink (low 3.3)
- [CVE-2026-42440](https://insights.sbomify.com/CVE-2026-42440/): Apache OpenNLP: OOM DoS via Unbounded Array Allocation in AbstractModelReader (high 7.5)
- [CVE-2026-4244](https://insights.sbomify.com/CVE-2026-4244/): Missing authorization in Post Duplicator (medium 4.3)
- [CVE-2026-42439](https://insights.sbomify.com/CVE-2026-42439/): OpenClaw < 2026.4.10 - SSRF Policy Bypass in Browser Tabs Action Routes (medium 4.9)
- [CVE-2026-42438](https://insights.sbomify.com/CVE-2026-42438/): OpenClaw 2026.4.9 < 2026.4.10 - Sender Policy Bypass in Host Media Attachment Reads (medium 4.9)
- [CVE-2026-42437](https://insights.sbomify.com/CVE-2026-42437/): OpenClaw 2026.4.9 < 2026.4.10 - Denial of Service via Oversized WebSocket Frames in Voice-call Realtime Path (high 8.2)
- [CVE-2026-42436](https://insights.sbomify.com/CVE-2026-42436/): OpenClaw < 2026.4.14 - Internal Page Content Exposure via Browser Snapshot and Screenshot Routes (medium 4.9)
- [CVE-2026-42435](https://insights.sbomify.com/CVE-2026-42435/): OpenClaw 2026.2.22 < 2026.4.12 - Shell-Wrapper Detection Bypass via Environment Variable Assignment Injection (high 8.7)
- [CVE-2026-42434](https://insights.sbomify.com/CVE-2026-42434/): OpenClaw 2026.4.5 < 2026.4.10 - Sandbox Escape via host Parameter Override in Exec Routing (high 8.7)
- [CVE-2026-42433](https://insights.sbomify.com/CVE-2026-42433/): OpenClaw < 2026.4.10 - Unauthorized Matrix Profile Config Persistence Access via operator.write Message Tools (high 7.1)
- [CVE-2026-42432](https://insights.sbomify.com/CVE-2026-42432/): OpenClaw < 2026.4.8 - Command Escalation via Node Pairing Reconnect Bypass (high 7.3)
- [CVE-2026-42431](https://insights.sbomify.com/CVE-2026-42431/): OpenClaw < 2026.4.8 - Persistent Profile Mutation via node.invoke(browser.proxy) Bypass (high 7.6)
- [CVE-2026-42430](https://insights.sbomify.com/CVE-2026-42430/): OpenClaw < 2026.4.8 - Strict Browser SSRF Bypass via Playwright Redirect Handling (medium 4.8)
- [CVE-2026-4243](https://insights.sbomify.com/CVE-2026-4243/): La Nacion App app.lanacion.activity BuildConfig.java credentials storage (low 2.0)
- [CVE-2026-42429](https://insights.sbomify.com/CVE-2026-42429/): OpenClaw < 2026.4.8 - Privilege Escalation via Gateway Plugin HTTP Authentication (medium 6.0)
- [CVE-2026-42428](https://insights.sbomify.com/CVE-2026-42428/): OpenClaw < 2026.4.8 - Missing Integrity Verification in Package Downloads (high 7.5)
- [CVE-2026-42427](https://insights.sbomify.com/CVE-2026-42427/): OpenClaw < 2026.4.8 - Remote Code Execution via Build Tool Environment Variable Injection (medium 5.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/650/