# Vulnerabilities published in 2026 - [CVE-2026-40393](https://insights.sbomify.com/CVE-2026-40393/): Memory corruption in Mesa (high 8.1) - [CVE-2026-4039](https://insights.sbomify.com/CVE-2026-4039/): OpenClaw Skill Env applySkillConfigenvOverrides code injection (medium 5.3) - [CVE-2026-40386](https://insights.sbomify.com/CVE-2026-40386/): Integer overflow in libexif (medium 4.0) - [CVE-2026-40385](https://insights.sbomify.com/CVE-2026-40385/): Integer overflow in libexif (medium 4.0) - [CVE-2026-40384](https://insights.sbomify.com/CVE-2026-40384/): Joomla! Core - [20260510] - Path traversal in com_media webservice endpoint (medium 5.9) - [CVE-2026-40383](https://insights.sbomify.com/CVE-2026-40383/): Joomla! Core - [20260509] - LFI in HTMLView layout parameter (high 7.5) - [CVE-2026-40382](https://insights.sbomify.com/CVE-2026-40382/): Windows Telephony Service Elevation of Privilege Vulnerability (high 7.8) - [CVE-2026-40381](https://insights.sbomify.com/CVE-2026-40381/): Azure Connected Machine Agent Elevation of Privilege Vulnerability (high 7.8) - [CVE-2026-40380](https://insights.sbomify.com/CVE-2026-40380/): Windows Volume Manager Extension Driver Remote Code Execution Vulnerability (medium 6.2) - [CVE-2026-4038](https://insights.sbomify.com/CVE-2026-4038/): Aimogen Pro <= 2.7.5 - Unauthenticated Privilege Escalation via Arbitrary Function Call (critical 9.8) - [CVE-2026-40379](https://insights.sbomify.com/CVE-2026-40379/): Azure Entra ID Spoofing Vulnerability (critical 9.3) - [CVE-2026-40378](https://insights.sbomify.com/CVE-2026-40378/): Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability (high 7.5) - [CVE-2026-40377](https://insights.sbomify.com/CVE-2026-40377/): Microsoft Cryptographic Services Elevation of Privilege Vulnerability (high 7.8) - [CVE-2026-40376](https://insights.sbomify.com/CVE-2026-40376/): Visual Studio Code Elevation of Privilege Vulnerability (high 7.5) - [CVE-2026-40375](https://insights.sbomify.com/CVE-2026-40375/): Microsoft Dynamics Business Central Information Disclosure Vulnerability (medium 6.5) - [CVE-2026-40374](https://insights.sbomify.com/CVE-2026-40374/): Microsoft Power Automate Desktop Information Disclosure Vulnerability (medium 6.5) - [CVE-2026-40372](https://insights.sbomify.com/CVE-2026-40372/): ASP.NET Core Elevation of Privilege Vulnerability (critical 9.1) - [CVE-2026-40371](https://insights.sbomify.com/CVE-2026-40371/): Microsoft Dynamics 365 (on-premises) Elevation of Privilege Vulnerability (high 8.8) - [CVE-2026-40370](https://insights.sbomify.com/CVE-2026-40370/): SQL Server Remote Code Execution Vulnerability (high 8.8) - [CVE-2026-40369](https://insights.sbomify.com/CVE-2026-40369/): Windows Kernel Elevation of Privilege Vulnerability (high 7.8) - [CVE-2026-40368](https://insights.sbomify.com/CVE-2026-40368/): Microsoft SharePoint Server Remote Code Execution Vulnerability (high 8.0) - [CVE-2026-40367](https://insights.sbomify.com/CVE-2026-40367/): Microsoft Word Remote Code Execution Vulnerability (high 8.4) - [CVE-2026-40366](https://insights.sbomify.com/CVE-2026-40366/): Microsoft Word Remote Code Execution Vulnerability (high 8.4) - [CVE-2026-40365](https://insights.sbomify.com/CVE-2026-40365/): Microsoft SharePoint Server Remote Code Execution Vulnerability (high 8.8) - [CVE-2026-40364](https://insights.sbomify.com/CVE-2026-40364/): Microsoft Word Remote Code Execution Vulnerability (high 8.4) - [CVE-2026-40363](https://insights.sbomify.com/CVE-2026-40363/): Microsoft Office Remote Code Execution Vulnerability (high 8.4) - [CVE-2026-40362](https://insights.sbomify.com/CVE-2026-40362/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8) - [CVE-2026-40361](https://insights.sbomify.com/CVE-2026-40361/): Microsoft Outlook and Word Remote Code Execution Vulnerability (high 8.4) - [CVE-2026-40360](https://insights.sbomify.com/CVE-2026-40360/): Microsoft Excel Information Disclosure Vulnerability (high 7.8) - [CVE-2026-4036](https://insights.sbomify.com/CVE-2026-4036/): SQL injection in DiskStation Manager (DSM) (medium 6.5) - [CVE-2026-40359](https://insights.sbomify.com/CVE-2026-40359/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8) - [CVE-2026-40358](https://insights.sbomify.com/CVE-2026-40358/): Microsoft Office Remote Code Execution Vulnerability (high 8.4) - [CVE-2026-40357](https://insights.sbomify.com/CVE-2026-40357/): Microsoft SharePoint Server Remote Code Execution Vulnerability (high 8.8) - [CVE-2026-40356](https://insights.sbomify.com/CVE-2026-40356/): Integer overflow in Kerberos 5 (medium 5.9) - [CVE-2026-40355](https://insights.sbomify.com/CVE-2026-40355/): Null dereference in Kerberos 5 (medium 5.9) - [CVE-2026-40354](https://insights.sbomify.com/CVE-2026-40354/): Path traversal in xdg-desktop-portal (low 2.9) - [CVE-2026-40353](https://insights.sbomify.com/CVE-2026-40353/): wger: Stored XSS via Unescaped License Attribution Fields (medium 5.1) - [CVE-2026-40352](https://insights.sbomify.com/CVE-2026-40352/): FastGPT: NoSQL Injection in updatePasswordByOld Leads to Account Takeover (high 8.8) - [CVE-2026-40351](https://insights.sbomify.com/CVE-2026-40351/): FastGPT: NoSQL Injection in loginByPassword leads to Authentication Bypass (critical 9.8) - [CVE-2026-40350](https://insights.sbomify.com/CVE-2026-40350/): Missing authorization in movary (high 8.8) - [CVE-2026-4035](https://insights.sbomify.com/CVE-2026-4035/): Environment Variable Resolution Vulnerability in mlflow/mlflow (critical 9.1) - [CVE-2026-40349](https://insights.sbomify.com/CVE-2026-40349/): Authenticated Movary User Can Self-Escalate to Administrator via PUT /settings/users/{userId} by Setting isAdmin=true (high 8.8) - [CVE-2026-40348](https://insights.sbomify.com/CVE-2026-40348/): Movary has Authenticated SSRF via Jellyfin Server URL Verification that Allows Internal Network Probing (high 7.7) - [CVE-2026-40347](https://insights.sbomify.com/CVE-2026-40347/): Python-Multipart affected by Denial of Service via large multipart preamble or epilogue data (medium 5.3) - [CVE-2026-40346](https://insights.sbomify.com/CVE-2026-40346/): NocoBase has SSRF in Workflow HTTP Request and Custom Request Plugins (medium 6.4) - [CVE-2026-40345](https://insights.sbomify.com/CVE-2026-40345/): deepmerge-ts: Stack exhaustion when merging recursive object graphs (high 8.2) - [CVE-2026-40344](https://insights.sbomify.com/CVE-2026-40344/): MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads (high 8.8) - [CVE-2026-40343](https://insights.sbomify.com/CVE-2026-40343/): free5GC UDR: Fail-open handling in PolicyDataSubsToNotifyPost allows unintended subscription creation (medium 6.9) - [CVE-2026-40342](https://insights.sbomify.com/CVE-2026-40342/): Firebird: Path Traversal + Arbitrary File Write Leads to Remote Code Execution (critical 10.0) - [CVE-2026-40341](https://insights.sbomify.com/CVE-2026-40341/): libgphoto2 has an OOB Read in ptp_unpack_EOS_FocusInfoEx (low 3.5) - [CVE-2026-40340](https://insights.sbomify.com/CVE-2026-40340/): libgphoto2 has OOB read in ptp_unpack_OI() in ptp-pack.c via malicious PTP ObjectInfo response (medium 6.1) - [CVE-2026-4034](https://insights.sbomify.com/CVE-2026-4034/): TIBCO Administrator Injection Vulnerability (high 8.7) - [CVE-2026-40339](https://insights.sbomify.com/CVE-2026-40339/): libgphoto2 has OOB read in ptp_unpack_Sony_DPD() FormFlag parsing in ptp-pack.c (medium 5.2) - [CVE-2026-40338](https://insights.sbomify.com/CVE-2026-40338/): libgphoto2 has OOB read in ptp_unpack_Sony_DPD() enumeration count parsing in ptp-pack.c (medium 5.2) - [CVE-2026-40337](https://insights.sbomify.com/CVE-2026-40337/): Sentry kernel has incomplete ownership check for IRQ line manipulation (medium 5.1) - [CVE-2026-40336](https://insights.sbomify.com/CVE-2026-40336/): libgphoto2 has memory leak in ptp_unpack_Sony_DPD() secondary enumeration list in ptp-pack.c (low 2.4) - [CVE-2026-40335](https://insights.sbomify.com/CVE-2026-40335/): libgphoto2 has OOB read in ptp_unpack_DPV() UINT128/INT128 handling in ptp-pack.c (medium 5.2) - [CVE-2026-40334](https://insights.sbomify.com/CVE-2026-40334/): libgphoto2 missing null termination in ptp_unpack_Canon_FE() filename buffer in ptp-pack.c (low 3.5) - [CVE-2026-40333](https://insights.sbomify.com/CVE-2026-40333/): Memory corruption in libgphoto2 (medium 6.1) - [CVE-2026-40332](https://insights.sbomify.com/CVE-2026-40332/): Masa CMS open redirect via improper handling of scheme-relative URLs (medium 5.3) - [CVE-2026-40331](https://insights.sbomify.com/CVE-2026-40331/): Masa CMS unauthenticated SQL injection via altTable parameter in JSON API (critical 9.3) - [CVE-2026-40330](https://insights.sbomify.com/CVE-2026-40330/): Masa CMS SQL injection via sortDirection parameter in beanFeed (critical 9.3) - [CVE-2026-40329](https://insights.sbomify.com/CVE-2026-40329/): SQL Injection vulnerability via sortBy in beanFeed (critical 9.3) - [CVE-2026-40326](https://insights.sbomify.com/CVE-2026-40326/): Masa CMS CSRF in site bundle creation allows unauthorized site data export (high 7.1) - [CVE-2026-40325](https://insights.sbomify.com/CVE-2026-40325/): Masa CMS CSRF in content restoration allows unauthorized restoration of deleted content (high 8.7) - [CVE-2026-40324](https://insights.sbomify.com/CVE-2026-40324/): Hot Chocolate's Utf8GraphQLParser has Stack Overflow via Deeply Nested GraphQL Documents (critical 9.1) - [CVE-2026-40323](https://insights.sbomify.com/CVE-2026-40323/): SP1 V6 Recursion Circuit Row-Count Binding Gap (high 8.9) - [CVE-2026-40322](https://insights.sbomify.com/CVE-2026-40322/): SiYuan: Mermaid `javascript:` Link Injection Leads to Stored XSS and Electron RCE (critical 9.1) - [CVE-2026-40321](https://insights.sbomify.com/CVE-2026-40321/): DotNetNuke.Core has stored cross-site-scripting (XSS) via SVG upload (high 8.1) - [CVE-2026-40320](https://insights.sbomify.com/CVE-2026-40320/): Giskard has an Unsandboxed Jinja2 Template Rendering in ConformityCheck (medium 5.4) - [CVE-2026-4032](https://insights.sbomify.com/CVE-2026-4032/): CodeColorer <= 0.10.1 - Unauthenticated Stored Cross-Site Scripting via 'class' attribute in 'cc' Comment Shortcode (medium 6.1) - [CVE-2026-40319](https://insights.sbomify.com/CVE-2026-40319/): Giskard has a Regular Expression Denial of Service (ReDoS) in RegexMatching Check (low 1.0) - [CVE-2026-40318](https://insights.sbomify.com/CVE-2026-40318/): SiYuan: Publish Reader Path Traversal Delete via `removeUnusedAttributeView` (high 8.5) - [CVE-2026-40317](https://insights.sbomify.com/CVE-2026-40317/): NovumOS has Privilege Escalation in the Syscall Interface (critical 9.4) - [CVE-2026-40316](https://insights.sbomify.com/CVE-2026-40316/): OWASP BLT has RCE in Github Actions via untrusted Django model execution in workflow (high 8.8) - [CVE-2026-40315](https://insights.sbomify.com/CVE-2026-40315/): PraisonAI: SQLiteConversationStore didn't validate table_prefix when constructing SQL queries (high 7.2) - [CVE-2026-40314](https://insights.sbomify.com/CVE-2026-40314/): NamelessMC: Reactions on private or blocking profile posts can be read and modified without proper authorization (medium 6.9) - [CVE-2026-40313](https://insights.sbomify.com/CVE-2026-40313/): PraisonAI: ArtiPACKED Vulnerability via GitHub Actions Credential Persistence (critical 9.1) - [CVE-2026-40312](https://insights.sbomify.com/CVE-2026-40312/): ImageMagick: Off-by-One in MSL decoder could result in crash (medium 6.2) - [CVE-2026-40311](https://insights.sbomify.com/CVE-2026-40311/): ImageMagick: Heap-use-after-free via XMP profile could result in a crash when printing values (medium 5.5) - [CVE-2026-40310](https://insights.sbomify.com/CVE-2026-40310/): ImageMagick: Heap out-of-bounds write in JP2 encoder (medium 5.5) - [CVE-2026-4031](https://insights.sbomify.com/CVE-2026-4031/): Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Database Backup Interception (high 7.5) - [CVE-2026-40309](https://insights.sbomify.com/CVE-2026-40309/): Masa CMS CSRF in trash management allows unauthorized permanent deletion of deleted content (high 7.2) - [CVE-2026-40308](https://insights.sbomify.com/CVE-2026-40308/): My Calendar: Unauthenticated Information Disclosure (IDOR) via Multisite switch_to_blog (high 8.8) - [CVE-2026-40306](https://insights.sbomify.com/CVE-2026-40306/): DNN has same HostGUID for all new installs (medium 6.9) - [CVE-2026-40305](https://insights.sbomify.com/CVE-2026-40305/): DNN has Force Friend Request Acceptance (medium 4.3) - [CVE-2026-40304](https://insights.sbomify.com/CVE-2026-40304/): zrok's broken ownership check in DELETE /api/v2/unaccess allows non-admin to delete global frontend records (medium 5.3) - [CVE-2026-40303](https://insights.sbomify.com/CVE-2026-40303/): zrok allows unauthenticated DoS via unbounded memory allocation in striped session cookie parsing (high 7.5) - [CVE-2026-40302](https://insights.sbomify.com/CVE-2026-40302/): zrok has reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering (medium 6.1) - [CVE-2026-40301](https://insights.sbomify.com/CVE-2026-40301/): rhukster/dom-sanitizer: SVG