# Vulnerabilities published in 2026


- [CVE-2026-35470](https://insights.sbomify.com/CVE-2026-35470/): OpenSTAManager has a SQL Injection via righe Parameter in confronta_righe Modals (high 8.8)
- [CVE-2026-3547](https://insights.sbomify.com/CVE-2026-3547/): wolfSSL: out-of-bounds read (DoS) in ALPN parsing due to incomplete validation (high 7.5)
- [CVE-2026-35469](https://insights.sbomify.com/CVE-2026-35469/): SpdyStream: DOS on CRI (high 8.7)
- [CVE-2026-35468](https://insights.sbomify.com/CVE-2026-35468/): nimiq/core-rs-albatross: Panic in history index request handlers when a full node runs without the history index (medium 5.3)
- [CVE-2026-35467](https://insights.sbomify.com/CVE-2026-35467/): Private Key stored as extractable in browser IndexeDB (high 7.5)
- [CVE-2026-35466](https://insights.sbomify.com/CVE-2026-35466/): Stored XSS via unsanitized input from remote service (medium 6.1)
- [CVE-2026-35465](https://insights.sbomify.com/CVE-2026-35465/): SecureDrop Client has path injection in read_gzip_header_filename() (high 7.5)
- [CVE-2026-35464](https://insights.sbomify.com/CVE-2026-35464/): pyLoad: Unprotected storage_folder enables arbitrary file write to Flask session store and code execution (Incomplete fix for CVE-2026-33509) (high 7.5)
- [CVE-2026-35463](https://insights.sbomify.com/CVE-2026-35463/): pyLoad has Improper Neutralization of Special Elements used in an OS Command (high 8.8)
- [CVE-2026-35462](https://insights.sbomify.com/CVE-2026-35462/): Papra Does Not Reject Expired API Keys (medium 4.3)
- [CVE-2026-35461](https://insights.sbomify.com/CVE-2026-35461/): Papra has a Blind Server-Side Request Forgery (SSRF) via Webhook URL (medium 5.0)
- [CVE-2026-35460](https://insights.sbomify.com/CVE-2026-35460/): Papra has an HTML Injection in Transactional Emails via Unescaped User Display Name (medium 4.3)
- [CVE-2026-3546](https://insights.sbomify.com/CVE-2026-3546/): Missing authorization in e-shot (medium 5.3)
- [CVE-2026-35459](https://insights.sbomify.com/CVE-2026-35459/): pyLoad has SSRF fix bypass via HTTP redirect (critical 9.3)
- [CVE-2026-35458](https://insights.sbomify.com/CVE-2026-35458/): Gotenberg has a ReDoS via extraHttpHeaders scope feature (high 8.7)
- [CVE-2026-35457](https://insights.sbomify.com/CVE-2026-35457/): libp2p-rust has unbounded rendezvous DISCOVER cookies enable remote memory exhaustion (high 8.2)
- [CVE-2026-35455](https://insights.sbomify.com/CVE-2026-35455/): immich has Stored XSS via OCR Text in 360° Panorama Viewer (high 7.3)
- [CVE-2026-35454](https://insights.sbomify.com/CVE-2026-35454/): Code Extension Marketplace has a Zip Slip Path Traversal (high 8.7)
- [CVE-2026-35453](https://insights.sbomify.com/CVE-2026-35453/): PhpSpreadsheet XSS via number format text substitution in HTML Writer (medium 4.8)
- [CVE-2026-35452](https://insights.sbomify.com/CVE-2026-35452/): WWBN AVideo has Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.php (medium 5.3)
- [CVE-2026-35451](https://insights.sbomify.com/CVE-2026-35451/): Twenty: Stored XSS via BlockNote FileBlock (medium 5.7)
- [CVE-2026-35450](https://insights.sbomify.com/CVE-2026-35450/): WWBN AVideo has Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.php (medium 5.3)
- [CVE-2026-3545](https://insights.sbomify.com/CVE-2026-3545/): Security feature bypass in Chrome (critical 9.6)
- [CVE-2026-35449](https://insights.sbomify.com/CVE-2026-35449/): WWBN AVideo has Unauthenticated Information Disclosure via Disabled CLI Guard in install/test.php (medium 5.3)
- [CVE-2026-35448](https://insights.sbomify.com/CVE-2026-35448/): WWBN AVideo Provides Unauthenticated Access to Payment Order Data via BlockonomicsYPT check.php (low 3.7)
- [CVE-2026-35447](https://insights.sbomify.com/CVE-2026-35447/): Missing authorization in Nameless (medium 5.3)
- [CVE-2026-35446](https://insights.sbomify.com/CVE-2026-35446/): LORIS has a path traversal in FilesDownloadHandler (high 7.7)
- [CVE-2026-35445](https://insights.sbomify.com/CVE-2026-35445/): Winter: Authenticated backend users can bypass Users controller permission checks (high 7.1)
- [CVE-2026-35444](https://insights.sbomify.com/CVE-2026-35444/): SDL_image has a heap buffer overflow READ via unchecked colormap index in XCF loader (high 7.1)
- [CVE-2026-35443](https://insights.sbomify.com/CVE-2026-35443/): NamelessMC: Forum reactions bypass the "view own topics only" restriction (medium 5.3)
- [CVE-2026-35442](https://insights.sbomify.com/CVE-2026-35442/): Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queries (high 8.1)
- [CVE-2026-35441](https://insights.sbomify.com/CVE-2026-35441/): Directus Affected by GraphQL Alias Amplification Denial-of-Service Due to Missing Query Cost/Complexity Limits (medium 6.5)
- [CVE-2026-35440](https://insights.sbomify.com/CVE-2026-35440/): Microsoft Word Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-3544](https://insights.sbomify.com/CVE-2026-3544/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-35439](https://insights.sbomify.com/CVE-2026-35439/): Microsoft SharePoint Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-35438](https://insights.sbomify.com/CVE-2026-35438/): Windows Admin Center Elevation of Privilege Vulnerability (high 8.3)
- [CVE-2026-35436](https://insights.sbomify.com/CVE-2026-35436/): Microsoft Office Click-To-Run Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-35435](https://insights.sbomify.com/CVE-2026-35435/): Azure AI Foundry Elevation of Privilege Vulnerability (high 8.6)
- [CVE-2026-35433](https://insights.sbomify.com/CVE-2026-35433/): .NET Elevation of Privilege Vulnerability (high 7.3)
- [CVE-2026-35431](https://insights.sbomify.com/CVE-2026-35431/): Microsoft Entra ID Entitlement Management Spoofing Vulnerability (critical 10.0)
- [CVE-2026-35430](https://insights.sbomify.com/CVE-2026-35430/): Azure Privileged Identity Management (PIM) Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-3543](https://insights.sbomify.com/CVE-2026-3543/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-35429](https://insights.sbomify.com/CVE-2026-35429/): Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability (medium 4.3)
- [CVE-2026-35428](https://insights.sbomify.com/CVE-2026-35428/): Azure Cloud Shell Spoofing Vulnerability (critical 9.6)
- [CVE-2026-35425](https://insights.sbomify.com/CVE-2026-35425/): Azure API Management (APIM) Remote Code Execution Vulnerability (high 8.0)
- [CVE-2026-35424](https://insights.sbomify.com/CVE-2026-35424/): Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability (high 7.5)
- [CVE-2026-35423](https://insights.sbomify.com/CVE-2026-35423/): Windows 11 Telnet Client Information Disclosure Vulnerability (medium 5.4)
- [CVE-2026-35422](https://insights.sbomify.com/CVE-2026-35422/): Windows TCP/IP Driver Security Feature Bypass Vulnerability (medium 6.5)
- [CVE-2026-35421](https://insights.sbomify.com/CVE-2026-35421/): Windows GDI Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-35420](https://insights.sbomify.com/CVE-2026-35420/): Windows Kernel Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-3542](https://insights.sbomify.com/CVE-2026-3542/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-35419](https://insights.sbomify.com/CVE-2026-35419/): Windows DWM Core Library Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-35418](https://insights.sbomify.com/CVE-2026-35418/): Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-35417](https://insights.sbomify.com/CVE-2026-35417/): Windows Win32k Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-35416](https://insights.sbomify.com/CVE-2026-35416/): Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-35415](https://insights.sbomify.com/CVE-2026-35415/): Windows Storage Spaces Controller Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-35414](https://insights.sbomify.com/CVE-2026-35414/): Security feature bypass in OpenSSH (medium 4.2)
- [CVE-2026-35413](https://insights.sbomify.com/CVE-2026-35413/): Directus GraphQL Schema SDL Disclosure Setting (medium 5.3)
- [CVE-2026-35412](https://insights.sbomify.com/CVE-2026-35412/): Directus has a TUS Upload Authorization Bypass Allows Arbitrary File Overwrite (high 7.1)
- [CVE-2026-35411](https://insights.sbomify.com/CVE-2026-35411/): Directus is an Open Redirect in Admin 2FA Setup Page (medium 4.3)
- [CVE-2026-35410](https://insights.sbomify.com/CVE-2026-35410/): Directus has an Open Redirect via Parser Bypass in OAuth2/SAML Authentication Flow (medium 6.1)
- [CVE-2026-3541](https://insights.sbomify.com/CVE-2026-3541/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-35409](https://insights.sbomify.com/CVE-2026-35409/): Directus has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import (high 7.7)
- [CVE-2026-35408](https://insights.sbomify.com/CVE-2026-35408/): Directus is Missing Cross-Origin Opener Policy (high 8.7)
- [CVE-2026-35407](https://insights.sbomify.com/CVE-2026-35407/): Saleor has Cross-Account Email Change via Unbound Confirmation Token (medium 5.9)
- [CVE-2026-35406](https://insights.sbomify.com/CVE-2026-35406/): Aardvark-dns has incorrect error handling for malformed tcp packets (medium 6.2)
- [CVE-2026-35405](https://insights.sbomify.com/CVE-2026-35405/): libp2p-rendezvous: Unlimited namespace registrations per peer enables OOM DoS on rendezvous servers (high 7.5)
- [CVE-2026-35404](https://insights.sbomify.com/CVE-2026-35404/): Open edX Platform has an Open Redirect in Survey Views via Unvalidated redirect_url Parameter (medium 4.7)
- [CVE-2026-35403](https://insights.sbomify.com/CVE-2026-35403/): LORIS has potential cross-site scripting in survey_accounts module (medium 6.5)
- [CVE-2026-35402](https://insights.sbomify.com/CVE-2026-35402/): mcp-neo4j-cypher: SSRF and Data Modification via read_only Mode Bypass Through CALL Procedures (low 2.3)
- [CVE-2026-35401](https://insights.sbomify.com/CVE-2026-35401/): Saleor has a resource exhaustion vulnerability in GraphQL queries (high 7.5)
- [CVE-2026-35400](https://insights.sbomify.com/CVE-2026-35400/): LORIS incorrectly trusts user input in publication module (low 3.5)
- [CVE-2026-3540](https://insights.sbomify.com/CVE-2026-3540/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-35399](https://insights.sbomify.com/CVE-2026-35399/): WeGIA has Stored XSS in backup file names (high 8.5)
- [CVE-2026-35398](https://insights.sbomify.com/CVE-2026-35398/): WeGIA - Open Redirect - OrigemControle - listarTodos() & listarId_Nome() - Unvalidated $_GET['nextPage'] (medium 5.1)
- [CVE-2026-35397](https://insights.sbomify.com/CVE-2026-35397/): jupyter-server path traversal allows access to sibling directories sharing root_dir name prefix (high 7.6)
- [CVE-2026-35396](https://insights.sbomify.com/CVE-2026-35396/): WeGIA - Open Redirect - IsaidaControle - listarId() - Unvalidated $_GET['nextPage'] (medium 5.1)
- [CVE-2026-35395](https://insights.sbomify.com/CVE-2026-35395/): WeGIA has a SQL Injection in DespachoDAO.php via id_memorando parameter (high 8.8)
- [CVE-2026-35394](https://insights.sbomify.com/CVE-2026-35394/): Mobile Next has Arbitrary Android Intent Execution via mobile_open_url (high 8.3)
- [CVE-2026-35393](https://insights.sbomify.com/CVE-2026-35393/): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload (critical 9.8)
- [CVE-2026-35392](https://insights.sbomify.com/CVE-2026-35392/): goshs has an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload (critical 9.8)
- [CVE-2026-35391](https://insights.sbomify.com/CVE-2026-35391/): Security feature bypass in webmail (high 8.7)
- [CVE-2026-35390](https://insights.sbomify.com/CVE-2026-35390/): Content-Security-Policy was set to Report-Only mode, failing to block XSS attacks (medium 5.3)
- [CVE-2026-35389](https://insights.sbomify.com/CVE-2026-35389/): Bulwark Webmail S/MIME signature verification accepted self-signed certificates (high 8.7)
- [CVE-2026-35388](https://insights.sbomify.com/CVE-2026-35388/): Other in OpenSSH (low 2.5)
- [CVE-2026-35387](https://insights.sbomify.com/CVE-2026-35387/): Weak cryptography in OpenSSH (low 3.1)
- [CVE-2026-35386](https://insights.sbomify.com/CVE-2026-35386/): Command injection in OpenSSH (low 3.6)
- [CVE-2026-35385](https://insights.sbomify.com/CVE-2026-35385/): Misconfiguration in OpenSSH (high 7.5)
- [CVE-2026-35383](https://insights.sbomify.com/CVE-2026-35383/): Bentley Systems iTwin Platform exposed access token (medium 6.9)
- [CVE-2026-35381](https://insights.sbomify.com/CVE-2026-35381/): uutils coreutils cut Local Logic Error and Data Integrity Issue in Output Filtering (low 3.3)
- [CVE-2026-35380](https://insights.sbomify.com/CVE-2026-35380/): uutils coreutils cut Local Logic Error and Data Integrity Issue in Delimiter Parsing (medium 5.5)
- [CVE-2026-3538](https://insights.sbomify.com/CVE-2026-3538/): Integer overflow in Chrome (high 8.8)
- [CVE-2026-35379](https://insights.sbomify.com/CVE-2026-35379/): uutils coreutils tr Local Logic Error and Data Integrity Issue in Character Class Handling (low 3.3)
- [CVE-2026-35378](https://insights.sbomify.com/CVE-2026-35378/): uutils coreutils expr Local Denial of Service via Eager Evaluation of Parenthesized Subexpressions (low 3.3)
- [CVE-2026-35377](https://insights.sbomify.com/CVE-2026-35377/): uutils coreutils env Local Denial of Service via Improper Handling of Backslashes in Split-String Mode (low 3.3)
- [CVE-2026-35376](https://insights.sbomify.com/CVE-2026-35376/): uutils coreutils chcon Security Bypass and Mandatory Access Control (MAC) Inconsistency via TOCTOU Race Condition (medium 4.5)
- [CVE-2026-35375](https://insights.sbomify.com/CVE-2026-35375/): uutils coreutils split Local Data Integrity Issue via Lossy Filename Encoding (low 3.3)
- [CVE-2026-35374](https://insights.sbomify.com/CVE-2026-35374/): uutils coreutils split Arbitrary File Truncation via Time-of-Check to Time-of-Use (TOCTOU) Race Condition (medium 6.3)
- [CVE-2026-35373](https://insights.sbomify.com/CVE-2026-35373/): uutils coreutils ln Local Denial of Service via Improper Handling of Non-UTF-8 Filenames (low 3.3)
- [CVE-2026-35372](https://insights.sbomify.com/CVE-2026-35372/): uutils coreutils ln Security Bypass via Improper Handling of the --no-dereference Flag (medium 5.0)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/690/