# Vulnerabilities published in 2026


- [CVE-2026-40503](https://insights.sbomify.com/CVE-2026-40503/): OpenHarness Path Traversal Information Disclosure via /memory show (high 7.1)
- [CVE-2026-40502](https://insights.sbomify.com/CVE-2026-40502/): OpenHarness Remote Administrative Command Injection via Gateway Handler (high 8.7)
- [CVE-2026-40501](https://insights.sbomify.com/CVE-2026-40501/): Cherry Studio RCE via SearchService nodeIntegration Misconfiguration (high 8.6)
- [CVE-2026-40499](https://insights.sbomify.com/CVE-2026-40499/): radare2 < 6.1.4 Command Injection via PDB Parser print_gvars() (high 8.4)
- [CVE-2026-40498](https://insights.sbomify.com/CVE-2026-40498/): FreeScout has Authentication Bypass and Information Disclosure in SystemController via /system/cron (high 8.9)
- [CVE-2026-40497](https://insights.sbomify.com/CVE-2026-40497/): FreeScout Vulnerable to CSS Injection via Stored Style Tag in Mailbox Signature (CSRF Token Exfiltration) (high 8.1)
- [CVE-2026-40496](https://insights.sbomify.com/CVE-2026-40496/): FreeScout has Predictable Attachment Token that Allows Unauthenticated Private File Download via Brute Force (high 8.8)
- [CVE-2026-40495](https://insights.sbomify.com/CVE-2026-40495/): FOSSBilling version exposed via asset cache buster (medium 6.9)
- [CVE-2026-40494](https://insights.sbomify.com/CVE-2026-40494/): SAIL has heap buffer overflow in TGA RLE decoder — raw packet path missing bounds check (critical 9.8)
- [CVE-2026-40493](https://insights.sbomify.com/CVE-2026-40493/): SAIL has heap buffer overflow in PSD decoder — bpp mismatch in LAB 16-bit mode (critical 9.8)
- [CVE-2026-40492](https://insights.sbomify.com/CVE-2026-40492/): SAIL has heap buffer overflow in XWD decoder — bits_per_pixel vs pixmap_depth type confusion in byte-swap (critical 9.8)
- [CVE-2026-40491](https://insights.sbomify.com/CVE-2026-40491/): gdown Affected by Arbitrary File Write via Path Traversal in gdown.extractall (medium 6.5)
- [CVE-2026-40490](https://insights.sbomify.com/CVE-2026-40490/): AsyncHttpClient leaks authorization credentials to untrusted domains on cross-origin redirects (medium 6.8)
- [CVE-2026-40489](https://insights.sbomify.com/CVE-2026-40489/): editorconfig-core-c has incomplete fix for CVE-2023-0341 (high 8.6)
- [CVE-2026-40488](https://insights.sbomify.com/CVE-2026-40488/): OpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Execution (high 8.7)
- [CVE-2026-40487](https://insights.sbomify.com/CVE-2026-40487/): Postiz Has Unrestricted File Upload via MIME Type Spoofing that Leads to Stored XSS (high 8.9)
- [CVE-2026-40486](https://insights.sbomify.com/CVE-2026-40486/): Kimai's User Preferences API allows standard users to modify restricted attributes: hourly_rate, internal_rate (medium 4.3)
- [CVE-2026-40485](https://insights.sbomify.com/CVE-2026-40485/): ChurchCRM: Username Enumeration via Differential Response in Public Login API (medium 5.3)
- [CVE-2026-40484](https://insights.sbomify.com/CVE-2026-40484/): ChurchCRM: Authenticated Remote Code Execution via Unrestricted PHP File Write in Database Restore Function (critical 9.1)
- [CVE-2026-40483](https://insights.sbomify.com/CVE-2026-40483/): ChurchCRM: Stored XSS in PledgeEditor.php via Donation Comment Field (medium 5.4)
- [CVE-2026-40482](https://insights.sbomify.com/CVE-2026-40482/): ChurchCRM has Authenticated SQL Injection in `/api/families/byCheckNumber/{scanString}` (high 7.1)
- [CVE-2026-40481](https://insights.sbomify.com/CVE-2026-40481/): monetr: Unauthenticated Stripe webhook reads attacker-sized request bodies before signature validation (high 8.2)
- [CVE-2026-40480](https://insights.sbomify.com/CVE-2026-40480/): ChurchCRM has Missing Object-Level Authorization / IDOR in `/api/person/{personId}` (high 7.1)
- [CVE-2026-4048](https://insights.sbomify.com/CVE-2026-4048/): Command injection in ECS Connections Manager (high 8.4)
- [CVE-2026-40479](https://insights.sbomify.com/CVE-2026-40479/): Kimai: Stored XSS via Incomplete HTML Attribute Escaping in Team Member Widget (medium 5.4)
- [CVE-2026-40478](https://insights.sbomify.com/CVE-2026-40478/): Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf (critical 9.1)
- [CVE-2026-40477](https://insights.sbomify.com/CVE-2026-40477/): Improper restriction of the scope of accessible objects in Thymeleaf expressions (critical 9.1)
- [CVE-2026-40476](https://insights.sbomify.com/CVE-2026-40476/): graphql-php: Denial of Service via quadratic complexity in OverlappingFieldsCanBeMerged validation (medium 6.9)
- [CVE-2026-40474](https://insights.sbomify.com/CVE-2026-40474/): wger has Broken Access Control in the Global Gym Configuration Update Endpoint (high 7.6)
- [CVE-2026-40473](https://insights.sbomify.com/CVE-2026-40473/): Apache Camel Mina: Unsafe Deserialization in MinaConverter.toObjectInput() via TCP/UDP (high 8.8)
- [CVE-2026-40472](https://insights.sbomify.com/CVE-2026-40472/): Hackage package metadata stored XSS vulnerability (critical 9.9)
- [CVE-2026-40471](https://insights.sbomify.com/CVE-2026-40471/): Hackage CSRF vulnerability (critical 9.6)
- [CVE-2026-40470](https://insights.sbomify.com/CVE-2026-40470/): Hackage package and doc upload stored XSS vulnerability (critical 9.9)
- [CVE-2026-40469](https://insights.sbomify.com/CVE-2026-40469/): Heap buffer overflow in gawk (medium 5.1)
- [CVE-2026-40468](https://insights.sbomify.com/CVE-2026-40468/): Heap buffer overflow in gawk (low 2.1)
- [CVE-2026-40467](https://insights.sbomify.com/CVE-2026-40467/): Use after free in gawk (medium 5.1)
- [CVE-2026-40466](https://insights.sbomify.com/CVE-2026-40466/): Apache ActiveMQ Vulnerable to Improper Input Validation and Code Injection (high 8.8)
- [CVE-2026-40465](https://insights.sbomify.com/CVE-2026-40465/): An Open Re-direct Vulnerability in Nokia NSP (medium 5.3)
- [CVE-2026-40464](https://insights.sbomify.com/CVE-2026-40464/): A Stored Cross-Site Scripting (XSS) Vulnerability in Nokia NSP (medium 5.4)
- [CVE-2026-40463](https://insights.sbomify.com/CVE-2026-40463/): An Insufficient Role-based Access Control Vulnerability in WaveSuite (high 7.6)
- [CVE-2026-40462](https://insights.sbomify.com/CVE-2026-40462/): iControl REST and tmsh vulnerability (high 7.1)
- [CVE-2026-40461](https://insights.sbomify.com/CVE-2026-40461/): Anviz Products Missing Authentication for Critical Function (high 7.5)
- [CVE-2026-40460](https://insights.sbomify.com/CVE-2026-40460/): NGINX ngx_quic_module vulnerability (medium 6.9)
- [CVE-2026-4046](https://insights.sbomify.com/CVE-2026-4046/): iconv crash due to assertion failure with untrusted input (high 7.5)
- [CVE-2026-40459](https://insights.sbomify.com/CVE-2026-40459/): LDAP Injection in PAC4J (high 8.7)
- [CVE-2026-40458](https://insights.sbomify.com/CVE-2026-40458/): Cross-Site Request Forgery in PAC4J (high 7.0)
- [CVE-2026-40457](https://insights.sbomify.com/CVE-2026-40457/): Reflected XSS in LMS (low 2.1)
- [CVE-2026-40456](https://insights.sbomify.com/CVE-2026-40456/): OS Command Injection in LMS (high 8.6)
- [CVE-2026-40455](https://insights.sbomify.com/CVE-2026-40455/): SQL Injection in LMS (high 8.6)
- [CVE-2026-40454](https://insights.sbomify.com/CVE-2026-40454/): Memory corruption in Apache IoTDB C++ client (high 7.5)
- [CVE-2026-40453](https://insights.sbomify.com/CVE-2026-40453/): Apache Camel has an incomplete fix for CVE-2025-27636 (critical 9.9)
- [CVE-2026-40452](https://insights.sbomify.com/CVE-2026-40452/): Missing authorization in Apache IoTDB (high 7.5)
- [CVE-2026-40451](https://insights.sbomify.com/CVE-2026-40451/): Cross-site scripting in Chrome browser extension (medium 5.1)
- [CVE-2026-40450](https://insights.sbomify.com/CVE-2026-40450/): Integer overflow in ONE (medium 6.6)
- [CVE-2026-4045](https://insights.sbomify.com/CVE-2026-4045/): projectsend Auth.php response discrepancy (medium 6.3)
- [CVE-2026-40449](https://insights.sbomify.com/CVE-2026-40449/): Integer overflow in ONE (medium 6.6)
- [CVE-2026-40448](https://insights.sbomify.com/CVE-2026-40448/): Integer overflow in ONE (medium 5.3)
- [CVE-2026-40447](https://insights.sbomify.com/CVE-2026-40447/): Integer overflow in Escargot (medium 5.1)
- [CVE-2026-40446](https://insights.sbomify.com/CVE-2026-40446/): Memory corruption in Escargot (medium 6.9)
- [CVE-2026-4044](https://insights.sbomify.com/CVE-2026-4044/): projectsend Delete import-orphans.php realpath path traversal (medium 5.1)
- [CVE-2026-40436](https://insights.sbomify.com/CVE-2026-40436/): ZTE ZXEDM iEMS product has a password reset vulnerability (high 7.1)
- [CVE-2026-40435](https://insights.sbomify.com/CVE-2026-40435/): BIG-IP httpd access control vulnerability (medium 6.9)
- [CVE-2026-40434](https://insights.sbomify.com/CVE-2026-40434/): Anviz CrossChex Standard Improper Verification of Source of a Communication Channel (high 8.1)
- [CVE-2026-40431](https://insights.sbomify.com/CVE-2026-40431/): SenseLive X3050 Cleartext transmission of sensitive information (medium 6.9)
- [CVE-2026-40430](https://insights.sbomify.com/CVE-2026-40430/): Plaintext Storage of a Password in Panduit IntraVUE by Pronetiqs (high 8.7)
- [CVE-2026-4043](https://insights.sbomify.com/CVE-2026-4043/): Tenda i12 wifiSSIDget formwrlSSIDget stack-based overflow (high 8.7)
- [CVE-2026-40425](https://insights.sbomify.com/CVE-2026-40425/): MacGregor Voyage Data Recorder (VDR) G4e Files or Directories Accessible to External Parties (medium 6.9)
- [CVE-2026-40423](https://insights.sbomify.com/CVE-2026-40423/): BIG-IP SIP profile vulnerability (high 8.7)
- [CVE-2026-40422](https://insights.sbomify.com/CVE-2026-40422/): Windows File Explorer Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-40421](https://insights.sbomify.com/CVE-2026-40421/): Microsoft Word Information Disclosure Vulnerability (medium 4.3)
- [CVE-2026-40420](https://insights.sbomify.com/CVE-2026-40420/): Microsoft Office Click-To-Run Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-4042](https://insights.sbomify.com/CVE-2026-4042/): Tenda i12 WifiMacFilterGet formWifiMacFilterGet stack-based overflow (high 8.7)
- [CVE-2026-40419](https://insights.sbomify.com/CVE-2026-40419/): Microsoft Office Click-To-Run Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-40418](https://insights.sbomify.com/CVE-2026-40418/): Microsoft Office Click-To-Run Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-40417](https://insights.sbomify.com/CVE-2026-40417/): Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-40416](https://insights.sbomify.com/CVE-2026-40416/): Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability (medium 4.3)
- [CVE-2026-40415](https://insights.sbomify.com/CVE-2026-40415/): Windows TCP/IP Remote Code Execution Vulnerability (high 8.1)
- [CVE-2026-40414](https://insights.sbomify.com/CVE-2026-40414/): Windows TCP/IP Denial of Service Vulnerability (high 7.4)
- [CVE-2026-40413](https://insights.sbomify.com/CVE-2026-40413/): Windows TCP/IP Denial of Service Vulnerability (high 7.4)
- [CVE-2026-40412](https://insights.sbomify.com/CVE-2026-40412/): Azure Orbital Spatio Remote Code Execution Vulnerability (critical 10.0)
- [CVE-2026-40411](https://insights.sbomify.com/CVE-2026-40411/): Azure Virtual Network Gateway Remote Code Execution Vulnerability (critical 9.9)
- [CVE-2026-40410](https://insights.sbomify.com/CVE-2026-40410/): Windows SMB Client Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-4041](https://insights.sbomify.com/CVE-2026-4041/): Tenda i12 exeCommand vos_strcpy stack-based overflow (high 8.7)
- [CVE-2026-40409](https://insights.sbomify.com/CVE-2026-40409/): Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-40408](https://insights.sbomify.com/CVE-2026-40408/): Windows WAN ARP Driver Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-40407](https://insights.sbomify.com/CVE-2026-40407/): Windows Common Log File System Driver Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-40406](https://insights.sbomify.com/CVE-2026-40406/): Windows TCP/IP Information Disclosure Vulnerability (high 7.5)
- [CVE-2026-40405](https://insights.sbomify.com/CVE-2026-40405/): Windows TCP/IP Denial of Service Vulnerability (high 7.5)
- [CVE-2026-40404](https://insights.sbomify.com/CVE-2026-40404/): Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-40403](https://insights.sbomify.com/CVE-2026-40403/): Windows Graphics Component Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-40402](https://insights.sbomify.com/CVE-2026-40402/): Windows Hyper-V Elevation of Privilege Vulnerability (critical 9.3)
- [CVE-2026-40401](https://insights.sbomify.com/CVE-2026-40401/): Windows TCP/IP Denial of Service Vulnerability (high 7.1)
- [CVE-2026-40400](https://insights.sbomify.com/CVE-2026-40400/): Windows PowerShell Remote Code Execution Vulnerability (high 8.0)
- [CVE-2026-4040](https://insights.sbomify.com/CVE-2026-4040/): OpenClaw File Existence tools.exec.safeBins information exposure (medium 4.8)
- [CVE-2026-40399](https://insights.sbomify.com/CVE-2026-40399/): Windows TCP/IP Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-40398](https://insights.sbomify.com/CVE-2026-40398/): Windows Remote Desktop Services Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-40397](https://insights.sbomify.com/CVE-2026-40397/): Windows Common Log File System Driver Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-40396](https://insights.sbomify.com/CVE-2026-40396/): Denial of service in Varnish Cache (medium 4.0)
- [CVE-2026-40395](https://insights.sbomify.com/CVE-2026-40395/): Denial of service in Varnish Enterprise (medium 4.0)
- [CVE-2026-40394](https://insights.sbomify.com/CVE-2026-40394/): Denial of service in Varnish Cache (medium 4.0)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/668/