# Vulnerabilities published in 2026


- [CVE-2026-41050](https://insights.sbomify.com/CVE-2026-41050/): Helm impersonation bypass of `RESTClientGetter` retains `cluster-admin` during template rendering (critical 9.9)
- [CVE-2026-4105](https://insights.sbomify.com/CVE-2026-4105/): Systemd: systemd: privilege escalation via improper access control in registermachine d-bus method (medium 6.7)
- [CVE-2026-41049](https://insights.sbomify.com/CVE-2026-41049/): Caching of Authentication allows Authentication Bypass between users in qSnapper (high 8.4)
- [CVE-2026-41048](https://insights.sbomify.com/CVE-2026-41048/): Caching of Authentication allows Authentication Bypass in qSnapper (high 8.4)
- [CVE-2026-41047](https://insights.sbomify.com/CVE-2026-41047/): Information leak via “diff” methods in qSnapper (medium 6.9)
- [CVE-2026-41046](https://insights.sbomify.com/CVE-2026-41046/): path traversal via `config` parameter in qSnapper (high 7.3)
- [CVE-2026-41045](https://insights.sbomify.com/CVE-2026-41045/): Weak polkit authentication check in qSnapper (high 8.1)
- [CVE-2026-41044](https://insights.sbomify.com/CVE-2026-41044/): Apache ActiveMQ Vulnerable to Code Injection (high 8.8)
- [CVE-2026-41043](https://insights.sbomify.com/CVE-2026-41043/): Apache ActiveMQ, Apache ActiveMQ Web: ActiveMQ Web Console - XSS vulnerability when browsing queues (medium 6.5)
- [CVE-2026-41042](https://insights.sbomify.com/CVE-2026-41042/): Code injection in Apache Gravitino (critical 9.1)
- [CVE-2026-41041](https://insights.sbomify.com/CVE-2026-41041/): Path traversal in Apache Gravitino (critical 9.1)
- [CVE-2026-41040](https://insights.sbomify.com/CVE-2026-41040/): Denial of service in GROWI (high 8.7)
- [CVE-2026-4104](https://insights.sbomify.com/CVE-2026-4104/): SQLi in Akmer Informatics' TeknoPass (critical 9.8)
- [CVE-2026-41039](https://insights.sbomify.com/CVE-2026-41039/): Information Disclosure Vulnerability in Quantum Networks Router QN-I-470 (high 8.7)
- [CVE-2026-41038](https://insights.sbomify.com/CVE-2026-41038/): Weak Password Policy Vulnerability in Quantum Networks Router QN-I-470 (high 7.6)
- [CVE-2026-41037](https://insights.sbomify.com/CVE-2026-41037/): Missing Rate Limiting Vulnerability in Quantum Networks Router QN-I-470 (high 8.7)
- [CVE-2026-41036](https://insights.sbomify.com/CVE-2026-41036/): Command Injection Vulnerability in Quantum Networks Router QN-I-470 (high 8.7)
- [CVE-2026-41035](https://insights.sbomify.com/CVE-2026-41035/): Use after free in rsync (high 7.4)
- [CVE-2026-41034](https://insights.sbomify.com/CVE-2026-41034/): Memory corruption in ONLYOFFICE DocumentServer (medium 5.0)
- [CVE-2026-41032](https://insights.sbomify.com/CVE-2026-41032/): Phoenix Contact: Unauthenticated log download vulnerability in the firmware of CHARX SEC-3xxx charging controllers (high 7.5)
- [CVE-2026-41031](https://insights.sbomify.com/CVE-2026-41031/): A Stored Cross-Site Scripting (XSS) vulnerability occurs in Vinna Process Monitor (critical 9.3)
- [CVE-2026-41030](https://insights.sbomify.com/CVE-2026-41030/): Privilege escalation in ONLYOFFICE DesktopEditors (medium 6.2)
- [CVE-2026-4103](https://insights.sbomify.com/CVE-2026-4103/): Cross-Site Scripting via HTML Sanitization in WSO2 Publisher and Developer Portals Allows Malicious Script Execution (medium 6.4)
- [CVE-2026-41022](https://insights.sbomify.com/CVE-2026-41022/): Security feature bypass in easySoft (medium 5.9)
- [CVE-2026-41021](https://insights.sbomify.com/CVE-2026-41021/): Weak cryptography in easyE4 (high 7.5)
- [CVE-2026-41020](https://insights.sbomify.com/CVE-2026-41020/): Auth bypass in easyE4 (high 7.5)
- [CVE-2026-41018](https://insights.sbomify.com/CVE-2026-41018/): Apache Airflow Providers Elasticsearch: Elasticsearch task-log handler leaks credentials embedded in the host URL (medium 6.5)
- [CVE-2026-41017](https://insights.sbomify.com/CVE-2026-41017/): Apache Airflow: JWT cookie missing Secure flag in JWTRefreshMiddleware behind HTTPS-terminating proxy (medium 5.9)
- [CVE-2026-41016](https://insights.sbomify.com/CVE-2026-41016/): Apache Airflow Providers SMTP: No certificate validation on SMTP STARTTLS connections in SMTP provider (medium 5.9)
- [CVE-2026-41015](https://insights.sbomify.com/CVE-2026-41015/): Command injection in radare2 (high 7.4)
- [CVE-2026-41014](https://insights.sbomify.com/CVE-2026-41014/): Apache Airflow: per-DAG RBAC bypass on /ui/partitioned_dag_runs endpoints (medium 4.3)
- [CVE-2026-41013](https://insights.sbomify.com/CVE-2026-41013/): Tenant-controlled comma smuggles arbitrary CIFS mount options (high 8.1)
- [CVE-2026-41012](https://insights.sbomify.com/CVE-2026-41012/): BOSH vSphere CPI Improper Cert Validation (high 7.7)
- [CVE-2026-41011](https://insights.sbomify.com/CVE-2026-41011/): Command injection in BOSH (high 8.7)
- [CVE-2026-41010](https://insights.sbomify.com/CVE-2026-41010/): Command injection in BOSH Director (high 8.7)
- [CVE-2026-4101](https://insights.sbomify.com/CVE-2026-4101/): Security Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access (high 8.1)
- [CVE-2026-41009](https://insights.sbomify.com/CVE-2026-41009/): Local Blobstore may allow arbitrary reads/deletes (medium 4.3)
- [CVE-2026-41008](https://insights.sbomify.com/CVE-2026-41008/): Spring Security Authorization Server Open Redirect via request_uri (medium 6.1)
- [CVE-2026-41007](https://insights.sbomify.com/CVE-2026-41007/): Spring HATEOAS heap exhaustion through unbounded internal caching (high 7.5)
- [CVE-2026-41006](https://insights.sbomify.com/CVE-2026-41006/): Spring HATEOAS Collection+JSON/UBER deserializers do not honor Jackson configuration (high 7.5)
- [CVE-2026-41005](https://insights.sbomify.com/CVE-2026-41005/): UAA accepts SAML Encrypted Assertions authentication bypass (critical 9.0)
- [CVE-2026-41004](https://insights.sbomify.com/CVE-2026-41004/): Spring Cloud Config Server Logged Sensitive Information (medium 4.4)
- [CVE-2026-41003](https://insights.sbomify.com/CVE-2026-41003/): Unencoded HTML Outputs in Spring Security May Allow Cross-Site Scripting (high 7.6)
- [CVE-2026-41002](https://insights.sbomify.com/CVE-2026-41002/): Spring Cloud Config Server Susceptible To TOCTOU Attack (high 7.4)
- [CVE-2026-41001](https://insights.sbomify.com/CVE-2026-41001/): Predictable Temp Directory in Artemis Auto-configuration (medium 5.3)
- [CVE-2026-41000](https://insights.sbomify.com/CVE-2026-41000/): WSS4J validation does not use configured replay cache (low 3.7)
- [CVE-2026-4100](https://insights.sbomify.com/CVE-2026-4100/): Missing authorization in Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions (high 7.1)
- [CVE-2026-40999](https://insights.sbomify.com/CVE-2026-40999/): Spring WS SSRF via unvalidated WS-Addressing reply destinations (high 8.6)
- [CVE-2026-40998](https://insights.sbomify.com/CVE-2026-40998/): Jaxp13 XPath XXE via StreamSource and SAXSource (high 8.2)
- [CVE-2026-40997](https://insights.sbomify.com/CVE-2026-40997/): SOAP security faults leak Spring Security account state (medium 5.3)
- [CVE-2026-40996](https://insights.sbomify.com/CVE-2026-40996/): Inbound WS-Security allows RSA PKCS#1 v1.5 key transport by default (medium 4.8)
- [CVE-2026-40995](https://insights.sbomify.com/CVE-2026-40995/): X.509 authentication bypasses Spring Security account checks (medium 5.4)
- [CVE-2026-40994](https://insights.sbomify.com/CVE-2026-40994/): Wss4jSecurityInterceptor disables WS-I BSP validation by default (high 8.2)
- [CVE-2026-40993](https://insights.sbomify.com/CVE-2026-40993/): Unfiltered Java Native Deserialization of SAML 2.0 Asserting Party Credentials BLOB Database Entry (high 7.3)
- [CVE-2026-40992](https://insights.sbomify.com/CVE-2026-40992/): Mail Auto-Configuration Does Not Enable SSL Hostname Verification (medium 5.0)
- [CVE-2026-40991](https://insights.sbomify.com/CVE-2026-40991/): XML External Entity (XXE) injection when documenting untrusted XML content (medium 5.9)
- [CVE-2026-40990](https://insights.sbomify.com/CVE-2026-40990/): Unbounded cache for function definitions (medium 5.7)
- [CVE-2026-40989](https://insights.sbomify.com/CVE-2026-40989/): Self Routing guard bypassed via function composition (medium 5.7)
- [CVE-2026-40988](https://insights.sbomify.com/CVE-2026-40988/): Unbounded DEFLATE Inflation in SAML 2.0 Service Provider (high 7.5)
- [CVE-2026-40987](https://insights.sbomify.com/CVE-2026-40987/): Spring Integration File Support: FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem (high 7.1)
- [CVE-2026-40986](https://insights.sbomify.com/CVE-2026-40986/): Spring Web Flow JS RemotingHandler renders non-HTML Response as HTML (medium 4.8)
- [CVE-2026-40985](https://insights.sbomify.com/CVE-2026-40985/): Data Binding Vulnerability in Spring Web Flow with Unified EL Parser (medium 6.4)
- [CVE-2026-40984](https://insights.sbomify.com/CVE-2026-40984/): Micrometer HTTP server instrumentations DoS vulnerability (high 7.5)
- [CVE-2026-40983](https://insights.sbomify.com/CVE-2026-40983/): Micrometer gRPC server instrumentation DoS vulnerability (high 7.5)
- [CVE-2026-40982](https://insights.sbomify.com/CVE-2026-40982/): Spring Cloud Config vulnerable to Path Traversal (critical 9.1)
- [CVE-2026-40981](https://insights.sbomify.com/CVE-2026-40981/): Spring Cloud Config has an Authorization Bypass Through User-Controlled Key (high 7.5)
- [CVE-2026-40980](https://insights.sbomify.com/CVE-2026-40980/): Spring AI Vulnerable to OOM by attacker-controlled PDF (medium 6.5)
- [CVE-2026-40979](https://insights.sbomify.com/CVE-2026-40979/): Spring AI's ONNX model cache defaults to world-writable predictable /tmp directory (medium 6.1)
- [CVE-2026-40978](https://insights.sbomify.com/CVE-2026-40978/): Spring AI has SQL Injection in CosmosDBVectorStore.doDelete() (high 8.8)
- [CVE-2026-40977](https://insights.sbomify.com/CVE-2026-40977/): Spring Boot's PID file write follows symlinks at predictable default path (medium 4.7)
- [CVE-2026-40976](https://insights.sbomify.com/CVE-2026-40976/): Spring Boot's default security filter chain has no authorization rule with Actuator but without Health (critical 9.1)
- [CVE-2026-40975](https://insights.sbomify.com/CVE-2026-40975/): Spring Boot's random value property source uses a weak PRNG unsuitable for secrets (medium 4.8)
- [CVE-2026-40974](https://insights.sbomify.com/CVE-2026-40974/): Spring Boot's Cassandra SSL auto-configuration disables TLS hostname verification (medium 5.0)
- [CVE-2026-40973](https://insights.sbomify.com/CVE-2026-40973/): Spring Boot accepts predictable temp directory without ownership verification (high 7.0)
- [CVE-2026-40972](https://insights.sbomify.com/CVE-2026-40972/): Spring Boot DevTools remote secret comparison is vulnerable to timing attacks (high 7.5)
- [CVE-2026-40971](https://insights.sbomify.com/CVE-2026-40971/): Spring Boot's RabbitMQ auto-configuration doesn't perform hostname verification when connecting to the RabbitMQ broker (medium 5.0)
- [CVE-2026-40970](https://insights.sbomify.com/CVE-2026-40970/): Spring Boot's Elasticsearch auto-configuration doesn't perform hostname verification when connecting to the Elasticsearch server. (medium 5.0)
- [CVE-2026-40969](https://insights.sbomify.com/CVE-2026-40969/): Spring gRPC AuthenticationException message reflected to remote client (low 3.7)
- [CVE-2026-40968](https://insights.sbomify.com/CVE-2026-40968/): Spring gRPC SecurityContext leaks across requests on authorization failure (medium 4.3)
- [CVE-2026-40967](https://insights.sbomify.com/CVE-2026-40967/): Spring AI has a VectorStore FilterExpression Converter injection (high 8.6)
- [CVE-2026-40966](https://insights.sbomify.com/CVE-2026-40966/): VectorStoreChatMemoryAdvisor conversation scoping can lead to cross-tenant memory exfiltration (medium 5.9)
- [CVE-2026-40965](https://insights.sbomify.com/CVE-2026-40965/): Information disclosure in CF Deployment (critical 10.0)
- [CVE-2026-40964](https://insights.sbomify.com/CVE-2026-40964/): Auth bypass in CF Deployment (high 7.5)
- [CVE-2026-40963](https://insights.sbomify.com/CVE-2026-40963/): Apache Airflow: DAG authorization bypass on /ui/structure/structure_data (low 3.1)
- [CVE-2026-40962](https://insights.sbomify.com/CVE-2026-40962/): Integer overflow in FFmpeg (medium 4.9)
- [CVE-2026-40961](https://insights.sbomify.com/CVE-2026-40961/): Apache Airflow: Open Redirect Bypass Vulnerability (high 7.2)
- [CVE-2026-40960](https://insights.sbomify.com/CVE-2026-40960/): Security feature bypass in Luanti (high 8.1)
- [CVE-2026-4096](https://insights.sbomify.com/CVE-2026-4096/): Other in DevOps Plan (medium 6.5)
- [CVE-2026-40959](https://insights.sbomify.com/CVE-2026-40959/): Security feature bypass in Luanti (critical 9.3)
- [CVE-2026-40958](https://insights.sbomify.com/CVE-2026-40958/): Input validation error in Secure Access clients prior to 14.55 (low 2.3)
- [CVE-2026-40957](https://insights.sbomify.com/CVE-2026-40957/): Frameable content vulnerability in the Secure Access server login page (medium 6.1)
- [CVE-2026-40956](https://insights.sbomify.com/CVE-2026-40956/): Memory disclosure in Secure Access Clients (low 2.1)
- [CVE-2026-40955](https://insights.sbomify.com/CVE-2026-40955/): Integer underflow vulnerability in Secure Access clients (low 2.1)
- [CVE-2026-40954](https://insights.sbomify.com/CVE-2026-40954/): Integer underflow in Secure Access clients prior to 14.55 (low 2.1)
- [CVE-2026-40953](https://insights.sbomify.com/CVE-2026-40953/): Heap overflow in Secure Access clients (medium 6.7)
- [CVE-2026-40952](https://insights.sbomify.com/CVE-2026-40952/): Privilge misconfiguration in Secure Access installers (high 8.5)
- [CVE-2026-40951](https://insights.sbomify.com/CVE-2026-40951/): Memory corruption in Secure Access Windows clients prior to 14.50 (medium 6.8)
- [CVE-2026-40950](https://insights.sbomify.com/CVE-2026-40950/): Buffer overflow in the Secure Access server prior to 14.50 (high 7.1)
- [CVE-2026-40949](https://insights.sbomify.com/CVE-2026-40949/): Buffer overflow in Windows clients prior to 14.50 (medium 6.8)
- [CVE-2026-40948](https://insights.sbomify.com/CVE-2026-40948/): Apache Airflow Providers Keycloak: OAuth Login CSRF — Missing State Parameter in Keycloak Auth Manager (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/663/