# Vulnerabilities published in 2026


- [CVE-2026-35371](https://insights.sbomify.com/CVE-2026-35371/): uutils coreutils id Misleading Identity Reporting in Pretty Print Mode (low 3.3)
- [CVE-2026-35370](https://insights.sbomify.com/CVE-2026-35370/): uutils coreutils id Incorrect Access-Control Decisions via Misrepresented Group Membership (medium 4.4)
- [CVE-2026-3537](https://insights.sbomify.com/CVE-2026-3537/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-35369](https://insights.sbomify.com/CVE-2026-35369/): uutils coreutils kill System-wide Process Termination and Denial of Service via Argument Misinterpretation (medium 5.5)
- [CVE-2026-35368](https://insights.sbomify.com/CVE-2026-35368/): uutils coreutils chroot Local Privilege Escalation and chroot Escape in via Name Service Switch (NSS) Injection (high 7.2)
- [CVE-2026-35367](https://insights.sbomify.com/CVE-2026-35367/): uutils coreutils nohup Information Disclosure via Insecure Default Output Permissions (low 3.3)
- [CVE-2026-35366](https://insights.sbomify.com/CVE-2026-35366/): uutils coreutils printenv Security Inspection Bypass via UTF-8 Enforcement (medium 4.4)
- [CVE-2026-35365](https://insights.sbomify.com/CVE-2026-35365/): uutils coreutils mv Denial of Service and Data Duplication via Improper Symlink Expansion (medium 6.6)
- [CVE-2026-35364](https://insights.sbomify.com/CVE-2026-35364/): uutils coreutils mv Arbitrary File Overwrite via Cross-Device TOCTOU Race Condition (medium 6.3)
- [CVE-2026-35363](https://insights.sbomify.com/CVE-2026-35363/): uutils coreutils rm Safeguard Bypass via Improper Path Normalization (medium 5.6)
- [CVE-2026-35362](https://insights.sbomify.com/CVE-2026-35362/): uutils coreutils Missing TOCTOU Protection on Non-Linux Unix Platforms in Safe Traversal Module (low 3.6)
- [CVE-2026-35361](https://insights.sbomify.com/CVE-2026-35361/): uutils coreutils mknod Security Label Inconsistency and Broken Cleanup on SELinux Systems (low 3.4)
- [CVE-2026-35360](https://insights.sbomify.com/CVE-2026-35360/): uutils coreutils touch Arbitrary File Truncation via TOCTOU Race Condition (medium 6.3)
- [CVE-2026-3536](https://insights.sbomify.com/CVE-2026-3536/): Integer overflow in Chrome (high 8.8)
- [CVE-2026-35359](https://insights.sbomify.com/CVE-2026-35359/): uutils coreutils cp Information Disclosure via Time-of-Check to Time-of-Use Symlink Swap (medium 4.7)
- [CVE-2026-35358](https://insights.sbomify.com/CVE-2026-35358/): uutils coreutils cp Semantic Loss and Potential Denial of Service with -R via Device Node Stream Reading (medium 4.4)
- [CVE-2026-35357](https://insights.sbomify.com/CVE-2026-35357/): uutils coreutils cp Information Disclosure via Permission Handling Race (medium 4.7)
- [CVE-2026-35356](https://insights.sbomify.com/CVE-2026-35356/): uutils coreutils install Arbitrary File Overwrite with -D via Path Component Symlink Race (medium 6.3)
- [CVE-2026-35355](https://insights.sbomify.com/CVE-2026-35355/): uutils coreutils install Arbitrary File Overwrite via Symlink TOCTOU Race (medium 6.3)
- [CVE-2026-35354](https://insights.sbomify.com/CVE-2026-35354/): uutils coreutils mv Security Xattr TOCTOU Race in Cross-Device (medium 4.7)
- [CVE-2026-35353](https://insights.sbomify.com/CVE-2026-35353/): uutils coreutils mkdir Permission Exposure Race Condition with -m (low 3.3)
- [CVE-2026-35352](https://insights.sbomify.com/CVE-2026-35352/): uutils coreutils mkfifo Privilege Escalation via TOCTOU Race Condition (high 7.0)
- [CVE-2026-35351](https://insights.sbomify.com/CVE-2026-35351/): uutils coreutils mv Silent Ownership Loss in Cross-Device Operations (medium 4.2)
- [CVE-2026-35350](https://insights.sbomify.com/CVE-2026-35350/): uutils coreutils cp Unexpected Privileged Executable Creation with -p (medium 6.6)
- [CVE-2026-3535](https://insights.sbomify.com/CVE-2026-3535/): DSGVO Google Web Fonts GDPR <= 1.1 - Unauthenticated Arbitrary File Upload via 'fonturl' Parameter (critical 9.8)
- [CVE-2026-35349](https://insights.sbomify.com/CVE-2026-35349/): uutils coreutils Path-Based Safety Bypass with --preserve-root (medium 6.7)
- [CVE-2026-35348](https://insights.sbomify.com/CVE-2026-35348/): uutils coreutils sort Local Denial of Service via Forced UTF-8 Parsing (medium 5.5)
- [CVE-2026-35347](https://insights.sbomify.com/CVE-2026-35347/): uutils coreutils comm Silent Data Loss or Denial of Service via Improper Input Validation (medium 4.4)
- [CVE-2026-35346](https://insights.sbomify.com/CVE-2026-35346/): uutils coreutils comm Silent Data Corruption via Lossy UTF-8 Normalization (low 3.3)
- [CVE-2026-35345](https://insights.sbomify.com/CVE-2026-35345/): uutils coreutils tail Privileged Information Disclosure via Symlink Replacement Race (medium 5.3)
- [CVE-2026-35344](https://insights.sbomify.com/CVE-2026-35344/): uutils coreutils dd Silent Data Corruption via Unconditional Truncation Error Suppression (low 3.3)
- [CVE-2026-35343](https://insights.sbomify.com/CVE-2026-35343/): uutils coreutils cut Inconsistent Output Suppression with Newline Delimiters (low 3.3)
- [CVE-2026-35342](https://insights.sbomify.com/CVE-2026-35342/): uutils coreutils mktemp Insecure Temporary File Placement via Empty TMPDIR (low 3.3)
- [CVE-2026-35341](https://insights.sbomify.com/CVE-2026-35341/): uutils coreutils mkfifo Unauthorized Permission Change on Existing Files (high 7.1)
- [CVE-2026-35340](https://insights.sbomify.com/CVE-2026-35340/): uutils coreutils chown and chgrp False Success Exit Code in Recursive Mode (medium 5.5)
- [CVE-2026-3534](https://insights.sbomify.com/CVE-2026-3534/): Astra <= 4.12.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta (medium 6.4)
- [CVE-2026-35339](https://insights.sbomify.com/CVE-2026-35339/): uutils coreutils chmod False Success Exit Code in Recursive Mode (medium 5.5)
- [CVE-2026-35338](https://insights.sbomify.com/CVE-2026-35338/): uutils coreutils chmod Path Traversal Bypass of --preserve-root (high 7.3)
- [CVE-2026-35337](https://insights.sbomify.com/CVE-2026-35337/): Apache Storm Client: RCE through Unsafe Deserialization via Kerberos TGT Credential Handling (high 8.8)
- [CVE-2026-3533](https://insights.sbomify.com/CVE-2026-3533/): File upload in Jupiter X Core (high 8.8)
- [CVE-2026-35327](https://insights.sbomify.com/CVE-2026-35327/): Missing authorization in Oracle WebCenter Content (high 7.6)
- [CVE-2026-35326](https://insights.sbomify.com/CVE-2026-35326/): Missing authorization in Oracle WebCenter Content (high 7.2)
- [CVE-2026-35325](https://insights.sbomify.com/CVE-2026-35325/): Missing authorization in Oracle WebCenter Content (high 8.8)
- [CVE-2026-35324](https://insights.sbomify.com/CVE-2026-35324/): Missing authorization in Oracle WebCenter Content (high 8.8)
- [CVE-2026-35323](https://insights.sbomify.com/CVE-2026-35323/): Missing authorization in Oracle WebCenter Content (critical 9.9)
- [CVE-2026-35322](https://insights.sbomify.com/CVE-2026-35322/): Missing authorization in Oracle WebCenter Content (high 8.8)
- [CVE-2026-35321](https://insights.sbomify.com/CVE-2026-35321/): Missing authorization in Oracle WebCenter Content (critical 9.9)
- [CVE-2026-35320](https://insights.sbomify.com/CVE-2026-35320/): Missing authorization in Oracle WebCenter Content (critical 9.0)
- [CVE-2026-3532](https://insights.sbomify.com/CVE-2026-3532/): OpenID Connect / OAuth client - Less critical - Access bypass - SA-CONTRIB-2026-027 (medium 4.2)
- [CVE-2026-35319](https://insights.sbomify.com/CVE-2026-35319/): Missing authorization in Oracle WebCenter Content (critical 9.8)
- [CVE-2026-35318](https://insights.sbomify.com/CVE-2026-35318/): Missing authorization in Oracle WebCenter Sites (high 8.8)
- [CVE-2026-35317](https://insights.sbomify.com/CVE-2026-35317/): Missing authorization in Oracle WebCenter Content (high 8.8)
- [CVE-2026-35316](https://insights.sbomify.com/CVE-2026-35316/): Missing authorization in Oracle WebCenter Content (critical 9.9)
- [CVE-2026-35315](https://insights.sbomify.com/CVE-2026-35315/): Missing authorization in Oracle WebCenter Content (high 8.8)
- [CVE-2026-35314](https://insights.sbomify.com/CVE-2026-35314/): Missing authorization in Oracle Access Manager (high 7.3)
- [CVE-2026-35313](https://insights.sbomify.com/CVE-2026-35313/): Missing authorization in Oracle Access Manager (critical 9.9)
- [CVE-2026-35312](https://insights.sbomify.com/CVE-2026-35312/): Missing authorization in Oracle Virtual Directory (critical 9.8)
- [CVE-2026-35311](https://insights.sbomify.com/CVE-2026-35311/): Missing authorization in WebLogic Server (high 8.8)
- [CVE-2026-35310](https://insights.sbomify.com/CVE-2026-35310/): Missing authorization in Oracle Coherence (critical 9.8)
- [CVE-2026-3531](https://insights.sbomify.com/CVE-2026-3531/): OpenID Connect / OAuth client - Moderately critical - Access bypass - SA-CONTRIB-2026-026 (medium 6.5)
- [CVE-2026-35309](https://insights.sbomify.com/CVE-2026-35309/): Missing authorization in Oracle Coherence (critical 9.8)
- [CVE-2026-35308](https://insights.sbomify.com/CVE-2026-35308/): Missing authorization in Oracle Coherence (critical 10.0)
- [CVE-2026-35307](https://insights.sbomify.com/CVE-2026-35307/): Missing authorization in Oracle Coherence (critical 10.0)
- [CVE-2026-35306](https://insights.sbomify.com/CVE-2026-35306/): Missing authorization in Oracle Coherence (critical 9.3)
- [CVE-2026-35305](https://insights.sbomify.com/CVE-2026-35305/): Missing authorization in Oracle Coherence (critical 9.3)
- [CVE-2026-35304](https://insights.sbomify.com/CVE-2026-35304/): Missing authorization in Oracle Coherence (critical 9.8)
- [CVE-2026-35303](https://insights.sbomify.com/CVE-2026-35303/): Auth bypass in WebLogic Server (high 8.8)
- [CVE-2026-35302](https://insights.sbomify.com/CVE-2026-35302/): Open redirect in WebLogic Server (high 8.3)
- [CVE-2026-35301](https://insights.sbomify.com/CVE-2026-35301/): Auth bypass in WebLogic Server (critical 10.0)
- [CVE-2026-35300](https://insights.sbomify.com/CVE-2026-35300/): Deserialization in WebLogic Server (critical 9.8)
- [CVE-2026-3530](https://insights.sbomify.com/CVE-2026-3530/): Server-side request forgery in OpenID Connect / OAuth client (medium 4.3)
- [CVE-2026-35299](https://insights.sbomify.com/CVE-2026-35299/): Missing authorization in WebLogic Server (high 8.8)
- [CVE-2026-35298](https://insights.sbomify.com/CVE-2026-35298/): Missing authorization in WebLogic Server (critical 9.1)
- [CVE-2026-35296](https://insights.sbomify.com/CVE-2026-35296/): Auth bypass in Oracle WebCenter Sites (critical 9.8)
- [CVE-2026-35295](https://insights.sbomify.com/CVE-2026-35295/): Missing authorization in Oracle WebCenter Sites (high 7.5)
- [CVE-2026-35294](https://insights.sbomify.com/CVE-2026-35294/): Missing authorization in Identity Manager Connector (critical 9.9)
- [CVE-2026-35293](https://insights.sbomify.com/CVE-2026-35293/): Auth bypass in Oracle WebCenter Sites (critical 9.8)
- [CVE-2026-35292](https://insights.sbomify.com/CVE-2026-35292/): Auth bypass in WebLogic Server (critical 10.0)
- [CVE-2026-35291](https://insights.sbomify.com/CVE-2026-35291/): Privilege escalation in WebLogic Server (medium 6.6)
- [CVE-2026-35290](https://insights.sbomify.com/CVE-2026-35290/): Missing authorization in Oracle Application Testing Suite (critical 9.8)
- [CVE-2026-3529](https://insights.sbomify.com/CVE-2026-3529/): Google Analytics GA4 - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-024 (medium 6.1)
- [CVE-2026-35289](https://insights.sbomify.com/CVE-2026-35289/): Auth bypass in PeopleSoft Enterprise PT PeopleTools (high 8.1)
- [CVE-2026-35288](https://insights.sbomify.com/CVE-2026-35288/): Privilege escalation in PeopleSoft Enterprise PT PeopleTools (high 8.2)
- [CVE-2026-35287](https://insights.sbomify.com/CVE-2026-35287/): Missing authorization in Oracle Application Testing Suite (high 7.5)
- [CVE-2026-35286](https://insights.sbomify.com/CVE-2026-35286/): Missing authorization in Oracle WebCenter Content (critical 9.8)
- [CVE-2026-35285](https://insights.sbomify.com/CVE-2026-35285/): Missing authorization in Oracle WebCenter Enterprise Capture (critical 9.9)
- [CVE-2026-35284](https://insights.sbomify.com/CVE-2026-35284/): Missing authorization in Oracle WebCenter Enterprise Capture (critical 9.9)
- [CVE-2026-35283](https://insights.sbomify.com/CVE-2026-35283/): Missing authorization in Oracle WebCenter Enterprise Capture (critical 9.9)
- [CVE-2026-35282](https://insights.sbomify.com/CVE-2026-35282/): Missing authorization in Oracle WebCenter Enterprise Capture (critical 9.9)
- [CVE-2026-35281](https://insights.sbomify.com/CVE-2026-35281/): Missing authorization in Oracle WebCenter Enterprise Capture (critical 9.9)
- [CVE-2026-35280](https://insights.sbomify.com/CVE-2026-35280/): Missing authorization in Oracle WebCenter Enterprise Capture (critical 9.9)
- [CVE-2026-3528](https://insights.sbomify.com/CVE-2026-3528/): Calculation Fields - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-023 (medium 6.1)
- [CVE-2026-35279](https://insights.sbomify.com/CVE-2026-35279/): Auth bypass in PeopleSoft Enterprise PT PeopleTools (high 8.1)
- [CVE-2026-35278](https://insights.sbomify.com/CVE-2026-35278/): Missing authorization in PeopleSoft Enterprise PT PeopleTools (critical 9.8)
- [CVE-2026-35277](https://insights.sbomify.com/CVE-2026-35277/): Other in Oracle REST Data Services (high 8.1)
- [CVE-2026-35276](https://insights.sbomify.com/CVE-2026-35276/): Auth bypass in PeopleSoft Enterprise PT PeopleTools (high 8.1)
- [CVE-2026-35275](https://insights.sbomify.com/CVE-2026-35275/): Other in Oracle VM VirtualBox (high 7.5)
- [CVE-2026-35274](https://insights.sbomify.com/CVE-2026-35274/): Missing authorization in PeopleSoft Enterprise PT PeopleTools (high 8.2)
- [CVE-2026-35273](https://insights.sbomify.com/CVE-2026-35273/): Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function (critical 9.8, exploited in the wild)
- [CVE-2026-35272](https://insights.sbomify.com/CVE-2026-35272/): Privilege escalation in PeopleSoft Enterprise PT PeopleTools (high 8.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/691/