# Vulnerabilities published in 2026


- [CVE-2026-41985](https://insights.sbomify.com/CVE-2026-41985/): Use after free in HarmonyOS (medium 5.1)
- [CVE-2026-41984](https://insights.sbomify.com/CVE-2026-41984/): Use after free in HarmonyOS (medium 5.2)
- [CVE-2026-41983](https://insights.sbomify.com/CVE-2026-41983/): Null dereference in HarmonyOS (medium 4.3)
- [CVE-2026-41982](https://insights.sbomify.com/CVE-2026-41982/): Race condition in HarmonyOS (medium 6.4)
- [CVE-2026-41981](https://insights.sbomify.com/CVE-2026-41981/): Memory corruption in HarmonyOS (medium 5.3)
- [CVE-2026-41980](https://insights.sbomify.com/CVE-2026-41980/): Missing authorization in HarmonyOS (medium 5.5)
- [CVE-2026-4198](https://insights.sbomify.com/CVE-2026-4198/): hypermodel-labs mcp-server-auto-commit index.ts getGitChanges command injection (medium 4.8)
- [CVE-2026-41979](https://insights.sbomify.com/CVE-2026-41979/): Missing authorization in HarmonyOS (medium 5.5)
- [CVE-2026-41978](https://insights.sbomify.com/CVE-2026-41978/): Missing authorization in HarmonyOS (medium 4.4)
- [CVE-2026-41977](https://insights.sbomify.com/CVE-2026-41977/): Integer overflow in EMUI (medium 5.0)
- [CVE-2026-41976](https://insights.sbomify.com/CVE-2026-41976/): Missing authorization in EMUI (medium 6.6)
- [CVE-2026-41975](https://insights.sbomify.com/CVE-2026-41975/): Missing authorization in HarmonyOS (medium 6.3)
- [CVE-2026-41974](https://insights.sbomify.com/CVE-2026-41974/): Missing authorization in EMUI (low 3.6)
- [CVE-2026-41973](https://insights.sbomify.com/CVE-2026-41973/): Missing authorization in EMUI (medium 5.9)
- [CVE-2026-41972](https://insights.sbomify.com/CVE-2026-41972/): Path traversal in HarmonyOS (medium 5.4)
- [CVE-2026-41971](https://insights.sbomify.com/CVE-2026-41971/): Missing authorization in HarmonyOS (medium 5.5)
- [CVE-2026-41970](https://insights.sbomify.com/CVE-2026-41970/): Memory corruption in EMUI (medium 6.8)
- [CVE-2026-4197](https://insights.sbomify.com/CVE-2026-4197/): D-Link DNS-1550-04 download_mgr.cgi RSS_Item_List command injection (medium 5.3)
- [CVE-2026-41969](https://insights.sbomify.com/CVE-2026-41969/): Missing authorization in EMUI (medium 6.2)
- [CVE-2026-41968](https://insights.sbomify.com/CVE-2026-41968/): Missing authorization in HarmonyOS (medium 5.9)
- [CVE-2026-41967](https://insights.sbomify.com/CVE-2026-41967/): Missing authorization in HarmonyOS (medium 5.9)
- [CVE-2026-41966](https://insights.sbomify.com/CVE-2026-41966/): Missing authorization in HarmonyOS (medium 5.6)
- [CVE-2026-41965](https://insights.sbomify.com/CVE-2026-41965/): Use after free in HarmonyOS (medium 5.6)
- [CVE-2026-41964](https://insights.sbomify.com/CVE-2026-41964/): Race condition in HarmonyOS (high 8.4)
- [CVE-2026-41963](https://insights.sbomify.com/CVE-2026-41963/): Memory corruption in HarmonyOS (low 2.8)
- [CVE-2026-41962](https://insights.sbomify.com/CVE-2026-41962/): Missing authorization in HarmonyOS (low 3.6)
- [CVE-2026-41961](https://insights.sbomify.com/CVE-2026-41961/): Missing authorization in HarmonyOS (medium 5.9)
- [CVE-2026-41960](https://insights.sbomify.com/CVE-2026-41960/): Missing authorization in EMUI (medium 5.8)
- [CVE-2026-4196](https://insights.sbomify.com/CVE-2026-4196/): D-Link DNS-1550-04 remote_backup.cgi cgi_set_rsync_server command injection (medium 5.3)
- [CVE-2026-41959](https://insights.sbomify.com/CVE-2026-41959/): iControl and tmsh REST vulnerability (high 7.1)
- [CVE-2026-41958](https://insights.sbomify.com/CVE-2026-41958/): Path traversal in visidata (medium 6.5)
- [CVE-2026-41957](https://insights.sbomify.com/CVE-2026-41957/): BIG-IP and BIG-IQ Configuration utility vulnerability (high 8.7)
- [CVE-2026-41956](https://insights.sbomify.com/CVE-2026-41956/): BIG-IP TMM Vulnerability (high 8.7)
- [CVE-2026-41954](https://insights.sbomify.com/CVE-2026-41954/): iControl REST and tmsh vulnerability (medium 6.9)
- [CVE-2026-41953](https://insights.sbomify.com/CVE-2026-41953/): BIG-IP Privilege Escalation vulnerability (high 8.5)
- [CVE-2026-41952](https://insights.sbomify.com/CVE-2026-41952/): Privilege escalation in Acronis Cyber Protect Cloud Agent (high 7.8)
- [CVE-2026-41951](https://insights.sbomify.com/CVE-2026-41951/): Path traversal in GROWI (high 8.6)
- [CVE-2026-41950](https://insights.sbomify.com/CVE-2026-41950/): Dify < 1.14.0 Authorization Bypass via File UUID (medium 6.0)
- [CVE-2026-4195](https://insights.sbomify.com/CVE-2026-4195/): D-Link DNS-1550-04 wizard_mgr.cgi command injection (medium 5.3)
- [CVE-2026-41949](https://insights.sbomify.com/CVE-2026-41949/): Dify < 1.14.2 Authorization Bypass via File Preview Endpoint (high 8.2)
- [CVE-2026-41948](https://insights.sbomify.com/CVE-2026-41948/): Dify v1.14.1 Path Traversal via Plugin Daemon Internal API Access (critical 9.3)
- [CVE-2026-41947](https://insights.sbomify.com/CVE-2026-41947/): Dify < 1.14.2 Authorization Bypass via Trace Configuration Endpoints (critical 9.3)
- [CVE-2026-41940](https://insights.sbomify.com/CVE-2026-41940/): WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function (critical 9.3, exploited in the wild)
- [CVE-2026-4194](https://insights.sbomify.com/CVE-2026-4194/): D-Link DNS-1550-04 system_mgr.cgi cgi_set_wto access control (medium 6.9)
- [CVE-2026-41939](https://insights.sbomify.com/CVE-2026-41939/): Care Everywhere Gateway 14.3.10 Hard-coded Credentials RCE via WildFly (critical 9.3)
- [CVE-2026-41938](https://insights.sbomify.com/CVE-2026-41938/): Vvveb < 1.0.8.2 RCE via Media Upload Handler (high 8.7)
- [CVE-2026-41937](https://insights.sbomify.com/CVE-2026-41937/): Vvveb < 1.0.8.3 Unrestricted File Upload RCE via Plugin Upload (high 8.6)
- [CVE-2026-41936](https://insights.sbomify.com/CVE-2026-41936/): Vvveb < 1.0.8.2 XML External Entity Injection via Import (high 8.6)
- [CVE-2026-41935](https://insights.sbomify.com/CVE-2026-41935/): Vvveb < 1.0.8.3 Uncontrolled Recursion Denial of Service (high 7.1)
- [CVE-2026-41934](https://insights.sbomify.com/CVE-2026-41934/): Vvveb < 1.0.8.2 Authenticated RCE via Code Editor (high 8.7)
- [CVE-2026-41933](https://insights.sbomify.com/CVE-2026-41933/): Vvveb < 1.0.8.3 Directory Listing Information Disclosure (medium 6.9)
- [CVE-2026-41932](https://insights.sbomify.com/CVE-2026-41932/): Vvveb < 1.0.8.3 Stored XSS via Signup Controller (medium 5.3)
- [CVE-2026-41931](https://insights.sbomify.com/CVE-2026-41931/): Vvveb < 1.0.8.2 Information Disclosure via Debug Exception Handler (medium 6.9)
- [CVE-2026-41930](https://insights.sbomify.com/CVE-2026-41930/): Vvveb < 1.0.8.2 Hard-coded Credentials Information Disclosure via phpMyAdmin (critical 9.2)
- [CVE-2026-4193](https://insights.sbomify.com/CVE-2026-4193/): D-Link DIR-823G goahead UpdateClientInfo access control (medium 6.9)
- [CVE-2026-41929](https://insights.sbomify.com/CVE-2026-41929/): Vvveb < 1.0.8.2 Unauthenticated Reflected XSS via Visual Editor (medium 5.1)
- [CVE-2026-41928](https://insights.sbomify.com/CVE-2026-41928/): Vvveb < 1.0.8.2 Information Disclosure via Cron Controller (medium 6.9)
- [CVE-2026-41927](https://insights.sbomify.com/CVE-2026-41927/): WDR201A WiFi Extender Stack-Based Buffer Overflow via firewall.cgi (high 8.3)
- [CVE-2026-41926](https://insights.sbomify.com/CVE-2026-41926/): WDR201A WiFi Extender OS Command Injection via firewall.cgi (critical 9.3)
- [CVE-2026-41925](https://insights.sbomify.com/CVE-2026-41925/): WDR201A WiFi Extender OS Command Injection via adm.cgi (reboot_time) (critical 9.3)
- [CVE-2026-41924](https://insights.sbomify.com/CVE-2026-41924/): WDR201A WiFi Extender OS Command Injection via makeRequest.cgi (critical 9.3)
- [CVE-2026-41923](https://insights.sbomify.com/CVE-2026-41923/): WDR201A WiFi Extender OS Command Injection via internet.cgi (critical 9.3)
- [CVE-2026-41922](https://insights.sbomify.com/CVE-2026-41922/): WDR201A WiFi Extender OS Command Injection via wireless.cgi (critical 9.3)
- [CVE-2026-41921](https://insights.sbomify.com/CVE-2026-41921/): Koha Stored XSS via Purchase Suggestion Handler (medium 5.1)
- [CVE-2026-41920](https://insights.sbomify.com/CVE-2026-41920/): Apache Traffic Server: SNI to Host header matching policy is not properly enforced (high 7.0)
- [CVE-2026-4192](https://insights.sbomify.com/CVE-2026-4192/): AvinashBole quip-mcp-server index.ts setupToolHandlers command injection (medium 5.3)
- [CVE-2026-41919](https://insights.sbomify.com/CVE-2026-41919/): Apache OFBiz: Authentication Bypass due to Improper Neutralization of LDAP Special Elements in DN Construction (critical 9.1)
- [CVE-2026-41918](https://insights.sbomify.com/CVE-2026-41918/): Information disclosure in RUGGEDCOM RST2428P (medium 5.9)
- [CVE-2026-41917](https://insights.sbomify.com/CVE-2026-41917/): OpenKM 6.3.12 Local File Inclusion via Admin Scripting (medium 6.9)
- [CVE-2026-41916](https://insights.sbomify.com/CVE-2026-41916/): OpenClaw < 2026.4.8 - Stale Authentication State via Config Reload (low 2.3)
- [CVE-2026-41915](https://insights.sbomify.com/CVE-2026-41915/): OpenClaw < 2026.4.8 - Git Environment Variable Injection via Unfiltered Exec Environment (medium 5.8)
- [CVE-2026-41914](https://insights.sbomify.com/CVE-2026-41914/): OpenClaw < 2026.4.8 - Server-Side Request Forgery in QQ Bot Media Fetch Paths (medium 5.1)
- [CVE-2026-41913](https://insights.sbomify.com/CVE-2026-41913/): OpenClaw < 2026.4.4 - Rate-Limit Bypass via Concurrent Async Authentication Attempts (medium 6.3)
- [CVE-2026-41912](https://insights.sbomify.com/CVE-2026-41912/): OpenClaw < 2026.4.8 - Server-Side Request Forgery Policy Bypass via Interaction-Triggered Navigation (medium 4.8)
- [CVE-2026-41911](https://insights.sbomify.com/CVE-2026-41911/): OpenClaw < 2026.4.8 - Workspace-Only Filesystem Policy Bypass via docx upload_file/upload_image (medium 6.0)
- [CVE-2026-41910](https://insights.sbomify.com/CVE-2026-41910/): OpenClaw < 2026.4.8 - Missing Owner-Only Enforcement in /allowlist Cross-Channel Writes (low 2.3)
- [CVE-2026-4191](https://insights.sbomify.com/CVE-2026-4191/): JawherKl node-api-postgres Profile Picture index.js path.extname unrestricted upload (medium 6.9)
- [CVE-2026-41909](https://insights.sbomify.com/CVE-2026-41909/): OpenClaw < 2026.4.20 - Improper Authorization in Paired-Device Pairing Actions (medium 5.3)
- [CVE-2026-41908](https://insights.sbomify.com/CVE-2026-41908/): OpenClaw < 2026.4.20 - Scope Enforcement Bypass in Assistant-Media Route (low 2.3)
- [CVE-2026-41907](https://insights.sbomify.com/CVE-2026-41907/): uuid: Missing buffer bounds check in `v3`/`v5`/`v6` when `buf` is provided (high 8.1)
- [CVE-2026-41906](https://insights.sbomify.com/CVE-2026-41906/): FreeScout: Conversation Change-Customer Cross-Mailbox Authorization Bypass (high 7.1)
- [CVE-2026-41905](https://insights.sbomify.com/CVE-2026-41905/): Server-side request forgery in freescout (high 7.7)
- [CVE-2026-41904](https://insights.sbomify.com/CVE-2026-41904/): Cross-site scripting in freescout (high 7.6)
- [CVE-2026-41903](https://insights.sbomify.com/CVE-2026-41903/): Missing authorization in freescout (medium 5.4)
- [CVE-2026-41902](https://insights.sbomify.com/CVE-2026-41902/): FreeScout's user invitation hash never expires: permanent unauthenticated account takeover if invite link leaks (critical 9.1)
- [CVE-2026-41901](https://insights.sbomify.com/CVE-2026-41901/): Thymeleaf: Improper recognition of unauthorized syntax patterns in sandboxed Thymeleaf expressions (critical 9.0)
- [CVE-2026-41900](https://insights.sbomify.com/CVE-2026-41900/): OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment (high 8.8)
- [CVE-2026-4190](https://insights.sbomify.com/CVE-2026-4190/): JawherKl node-api-postgres user.js User.getAll sql injection (medium 6.9)
- [CVE-2026-41899](https://insights.sbomify.com/CVE-2026-41899/): Coolify unauthenticated feedback endpoint allows Discord webhook abuse (medium 6.5)
- [CVE-2026-41898](https://insights.sbomify.com/CVE-2026-41898/): rust-openssl: Unchecked callback length in PSK/cookie trampolines leaks adjacent memory to peer (high 8.3)
- [CVE-2026-41897](https://insights.sbomify.com/CVE-2026-41897/): MantisBT: Reflected XSS in Rendering Dynamic Custom Textarea Field (medium 5.3)
- [CVE-2026-41896](https://insights.sbomify.com/CVE-2026-41896/): Coolify: Unauthenticated Deployment Trigger via Webhook HMAC Bypass with Null Secret (high 7.5)
- [CVE-2026-41895](https://insights.sbomify.com/CVE-2026-41895/): changedetection.io: XXE vulnerability in the changedetection.io project (high 8.2)
- [CVE-2026-41894](https://insights.sbomify.com/CVE-2026-41894/): SiYuan: Incomplete Fix Bypass for CVE-2026-30869: Path Traversal via Double URL Encoding in `/export/` Endpoint (high 7.1)
- [CVE-2026-41893](https://insights.sbomify.com/CVE-2026-41893/): Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force) (high 8.7)
- [CVE-2026-41891](https://insights.sbomify.com/CVE-2026-41891/): CI4MS: Deactivated User Session Bypass (active=0) (medium 5.3)
- [CVE-2026-41890](https://insights.sbomify.com/CVE-2026-41890/): CI4MS: Arbitrary Database Table Drop via Theme deleteProcess (medium 6.9)
- [CVE-2026-4189](https://insights.sbomify.com/CVE-2026-4189/): phpipam Section edit-result.php sql injection (medium 5.1)
- [CVE-2026-41889](https://insights.sbomify.com/CVE-2026-41889/): pgx: SQL Injection via placeholder confusion with dollar quoted string literals (low 2.3)
- [CVE-2026-41888](https://insights.sbomify.com/CVE-2026-41888/): Distribution: Tag deletion bypasses `storage.delete.enabled` configuration (medium 6.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/655/