# Vulnerabilities published in 2026


- [CVE-2026-35271](https://insights.sbomify.com/CVE-2026-35271/): Missing authorization in PeopleSoft Enterprise PT PeopleTools (high 8.7)
- [CVE-2026-35270](https://insights.sbomify.com/CVE-2026-35270/): Missing authorization in Oracle WebCenter Content (critical 9.1)
- [CVE-2026-3527](https://insights.sbomify.com/CVE-2026-3527/): AJAX Dashboard - Critical - Access bypass - SA-CONTRIB-2026-022 (medium 6.5)
- [CVE-2026-35269](https://insights.sbomify.com/CVE-2026-35269/): Missing authorization in Identity Manager (high 7.5)
- [CVE-2026-35268](https://insights.sbomify.com/CVE-2026-35268/): Missing authorization in Identity Manager (critical 9.9)
- [CVE-2026-35267](https://insights.sbomify.com/CVE-2026-35267/): Missing authorization in Identity Manager (high 8.8)
- [CVE-2026-35266](https://insights.sbomify.com/CVE-2026-35266/): Cross-site request forgery in Oracle REST Data Services (high 7.9)
- [CVE-2026-35265](https://insights.sbomify.com/CVE-2026-35265/): Auth bypass in Identity Manager (high 8.8)
- [CVE-2026-35263](https://insights.sbomify.com/CVE-2026-35263/): Missing authorization in WebLogic Server (critical 9.9)
- [CVE-2026-35262](https://insights.sbomify.com/CVE-2026-35262/): Missing authorization in Oracle Data Integrator (high 8.3)
- [CVE-2026-35261](https://insights.sbomify.com/CVE-2026-35261/): Auth bypass in Oracle Access Manager (medium 6.5)
- [CVE-2026-3526](https://insights.sbomify.com/CVE-2026-3526/): File Access Fix (deprecated) - Moderately critical - Access bypass - SA-CONTRIB-2026-021 (medium 5.3)
- [CVE-2026-35259](https://insights.sbomify.com/CVE-2026-35259/): Open redirect in WebLogic Server (high 8.8)
- [CVE-2026-35258](https://insights.sbomify.com/CVE-2026-35258/): Open redirect in WebLogic Server (high 8.7)
- [CVE-2026-35255](https://insights.sbomify.com/CVE-2026-35255/): Code injection in Oracle Cloud Native Environment Command Line Interface (medium 6.6)
- [CVE-2026-35254](https://insights.sbomify.com/CVE-2026-35254/): Path traversal in Oracle OCI CLI of Oracle Open Source Projects (medium 6.1)
- [CVE-2026-35253](https://insights.sbomify.com/CVE-2026-35253/): Open redirect in Oracle Macaron Tool of Oracle Open Source Projects (medium 4.7)
- [CVE-2026-35252](https://insights.sbomify.com/CVE-2026-35252/): Missing authorization in Oracle Security Service (medium 6.4)
- [CVE-2026-35251](https://insights.sbomify.com/CVE-2026-35251/): Other in Oracle VM VirtualBox (high 7.5)
- [CVE-2026-35250](https://insights.sbomify.com/CVE-2026-35250/): Denial of service in Oracle VM VirtualBox (low 2.3)
- [CVE-2026-3525](https://insights.sbomify.com/CVE-2026-3525/): File Access Fix (deprecated) - Moderately critical - Access bypass - SA-CONTRIB-2026-020 (medium 5.3)
- [CVE-2026-35249](https://insights.sbomify.com/CVE-2026-35249/): Other in Oracle VM VirtualBox (low 3.2)
- [CVE-2026-35248](https://insights.sbomify.com/CVE-2026-35248/): Other in Oracle VM VirtualBox (medium 5.0)
- [CVE-2026-35247](https://insights.sbomify.com/CVE-2026-35247/): Missing authorization in Oracle VM VirtualBox (medium 6.0)
- [CVE-2026-35246](https://insights.sbomify.com/CVE-2026-35246/): Other in Oracle VM VirtualBox (high 7.5)
- [CVE-2026-35245](https://insights.sbomify.com/CVE-2026-35245/): Denial of service in Oracle VM VirtualBox (high 7.5)
- [CVE-2026-35244](https://insights.sbomify.com/CVE-2026-35244/): Missing authorization in Oracle Hyperion Infrastructure Technology (medium 5.2)
- [CVE-2026-35243](https://insights.sbomify.com/CVE-2026-35243/): Missing authorization in Oracle Application Development Framework (ADF) (high 7.8)
- [CVE-2026-35242](https://insights.sbomify.com/CVE-2026-35242/): Other in Oracle VM VirtualBox (high 7.5)
- [CVE-2026-35241](https://insights.sbomify.com/CVE-2026-35241/): Missing authorization in PeopleSoft Enterprise CS Student Records (medium 5.7)
- [CVE-2026-35240](https://insights.sbomify.com/CVE-2026-35240/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2026-3524](https://insights.sbomify.com/CVE-2026-3524/): Authorization Bypass in Mattermost Legal Hold Plugin Due to Missing Return After Permission Check (high 8.3)
- [CVE-2026-35239](https://insights.sbomify.com/CVE-2026-35239/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2026-35238](https://insights.sbomify.com/CVE-2026-35238/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2026-35237](https://insights.sbomify.com/CVE-2026-35237/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2026-35236](https://insights.sbomify.com/CVE-2026-35236/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2026-35235](https://insights.sbomify.com/CVE-2026-35235/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2026-35234](https://insights.sbomify.com/CVE-2026-35234/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2026-35233](https://insights.sbomify.com/CVE-2026-35233/): Memory corruption in Oracle Linux (medium 4.4)
- [CVE-2026-35232](https://insights.sbomify.com/CVE-2026-35232/): Missing authorization in Oracle Fusion Middleware (medium 5.4)
- [CVE-2026-35231](https://insights.sbomify.com/CVE-2026-35231/): Missing authorization in Oracle Financial Services Transaction Filtering (high 7.5)
- [CVE-2026-35230](https://insights.sbomify.com/CVE-2026-35230/): Other in Oracle VM VirtualBox (high 7.5)
- [CVE-2026-3523](https://insights.sbomify.com/CVE-2026-3523/): Apocalypse Meow <= 22.1.0 - Authenticated (Administrator+) SQL Injection via 'type' Parameter (medium 4.9)
- [CVE-2026-35229](https://insights.sbomify.com/CVE-2026-35229/): Missing authorization in Oracle Database Server (high 7.5)
- [CVE-2026-35228](https://insights.sbomify.com/CVE-2026-35228/): SQL injection in Oracle MCP Server Helper Tool product of Oracle Open Source Projects (high 8.7)
- [CVE-2026-35227](https://insights.sbomify.com/CVE-2026-35227/): Improper resource management in CODESYS Modbus TCP Server (high 8.2)
- [CVE-2026-35226](https://insights.sbomify.com/CVE-2026-35226/): Out-of-bounds Write in CODESYS PROFINET Controller (high 7.1)
- [CVE-2026-35225](https://insights.sbomify.com/CVE-2026-35225/): Improper timeout handling in CODESYS EtherNetIP (high 8.7)
- [CVE-2026-35223](https://insights.sbomify.com/CVE-2026-35223/): Joomla! Core - [20260508] - Improper access check in com_config webservice endpoints (high 8.6)
- [CVE-2026-35222](https://insights.sbomify.com/CVE-2026-35222/): Joomla! Core - [20260507] - Authenticated blind SQLi in com_tags (medium 6.9)
- [CVE-2026-35221](https://insights.sbomify.com/CVE-2026-35221/): Joomla! Core - [20260506] - Authenticated blind SQLi in com_finder (medium 6.9)
- [CVE-2026-35220](https://insights.sbomify.com/CVE-2026-35220/): Joomla! Core - [20260505] - CSRF in user activation endpoint (medium 4.6)
- [CVE-2026-35219](https://insights.sbomify.com/CVE-2026-35219/): Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist (high 7.1)
- [CVE-2026-35218](https://insights.sbomify.com/CVE-2026-35218/): Budibase: Stored XSS via unsanitized entity names rendered with {@html} in Builder Command Palette (high 8.7)
- [CVE-2026-35217](https://insights.sbomify.com/CVE-2026-35217/): NanoMQ Incorrectly Accepts a Malformed SUBSCRIBE and Can Be Driven into an ASAN-Detectable Out-of-Bounds Read (medium 6.5)
- [CVE-2026-35216](https://insights.sbomify.com/CVE-2026-35216/): Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step (critical 9.1)
- [CVE-2026-35215](https://insights.sbomify.com/CVE-2026-35215/): Firebird: DoS via malicious slice descriptor in slice packet (high 7.5)
- [CVE-2026-35214](https://insights.sbomify.com/CVE-2026-35214/): Budibase: Path traversal in plugin file upload enables arbitrary directory deletion and file write (high 8.7)
- [CVE-2026-35213](https://insights.sbomify.com/CVE-2026-35213/): Regular Expression Denial of Service (ReDoS) in @hapi/content HTTP header parsing (high 8.7)
- [CVE-2026-35212](https://insights.sbomify.com/CVE-2026-35212/): OpenCTI has XSS in the rendering of email-message observable body data (medium 5.3)
- [CVE-2026-35211](https://insights.sbomify.com/CVE-2026-35211/): Code injection in opencti (medium 6.5)
- [CVE-2026-35210](https://insights.sbomify.com/CVE-2026-35210/): OpenCTI: Authorization Bypass via `synchronized-upsert` HTTP Header Injection (high 7.1)
- [CVE-2026-35209](https://insights.sbomify.com/CVE-2026-35209/): defu: Prototype pollution via `__proto__` key in defaults argument (high 7.5)
- [CVE-2026-35208](https://insights.sbomify.com/CVE-2026-35208/): lichess.org has an Unsanitized Stream Title Injection on /streamer (medium 5.3)
- [CVE-2026-35207](https://insights.sbomify.com/CVE-2026-35207/): Security feature bypass in dde-control-center (medium 5.4)
- [CVE-2026-35206](https://insights.sbomify.com/CVE-2026-35206/): Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment (medium 4.8)
- [CVE-2026-35205](https://insights.sbomify.com/CVE-2026-35205/): Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install (high 8.4)
- [CVE-2026-35204](https://insights.sbomify.com/CVE-2026-35204/): Helm has a path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory (high 8.4)
- [CVE-2026-35203](https://insights.sbomify.com/CVE-2026-35203/): ZLMediaKit VP9 RTP Parser Out-of-Bounds Read (high 7.5)
- [CVE-2026-35202](https://insights.sbomify.com/CVE-2026-35202/): Pterodactyl has a database resource limit bypass via race condition in Client API (low 2.3)
- [CVE-2026-35201](https://insights.sbomify.com/CVE-2026-35201/): Discount has an Out-of-bounds Read in rdiscount (medium 5.9)
- [CVE-2026-35200](https://insights.sbomify.com/CVE-2026-35200/): Parse Server has a file upload Content-Type override via extension mismatch (low 2.1)
- [CVE-2026-3520](https://insights.sbomify.com/CVE-2026-3520/): Multer vulnerable to Denial of Service via uncontrolled recursion (high 8.7)
- [CVE-2026-35199](https://insights.sbomify.com/CVE-2026-35199/): SymCrypt SymCryptXmssSign function - Heap overflow via 64->32-bit leaf-count truncation (medium 6.1)
- [CVE-2026-35198](https://insights.sbomify.com/CVE-2026-35198/): HeyForm vulnerable to stored XSS via form field titles (critical 9.0)
- [CVE-2026-35197](https://insights.sbomify.com/CVE-2026-35197/): Code injection in dye template expressions (medium 6.6)
- [CVE-2026-35196](https://insights.sbomify.com/CVE-2026-35196/): Chamilo LMS has OS Command Injection via export_all_certificates action (high 8.8)
- [CVE-2026-35195](https://insights.sbomify.com/CVE-2026-35195/): Wasmtime has an out-of-bounds write or crash when transcoding component model strings (medium 6.1)
- [CVE-2026-35194](https://insights.sbomify.com/CVE-2026-35194/): Apache Flink: Remote code execution via SQL injection in code generation (high 8.1)
- [CVE-2026-35193](https://insights.sbomify.com/CVE-2026-35193/): Potential exposure of private data via missing Vary: Authorization in UpdateCacheMiddleware (low 2.3)
- [CVE-2026-35192](https://insights.sbomify.com/CVE-2026-35192/): Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST (low 2.3)
- [CVE-2026-35191](https://insights.sbomify.com/CVE-2026-35191/): QUIC Unvalidated Amplification Credit may be Over Accounted (low 3.7)
- [CVE-2026-3519](https://insights.sbomify.com/CVE-2026-3519/): Command injection in ECS Connections Manager (high 8.4)
- [CVE-2026-35189](https://insights.sbomify.com/CVE-2026-35189/): Excessive Memory Allocation in Relative CRLDP Processing (medium 5.3)
- [CVE-2026-35188](https://insights.sbomify.com/CVE-2026-35188/): Double-free When Checking OCSP Stapled Response (medium 5.0)
- [CVE-2026-35187](https://insights.sbomify.com/CVE-2026-35187/): pyLoad has SSRF in parse_urls API endpoint via unvalidated URL parameter (high 7.7)
- [CVE-2026-35186](https://insights.sbomify.com/CVE-2026-35186/): Wasmtime has an improperly masked return value from `table.grow` with Winch compiler backend (medium 6.1)
- [CVE-2026-35185](https://insights.sbomify.com/CVE-2026-35185/): HAX CMS's public /server-status endpoint exposes authentication tokens, user activity, and client IP addresses (high 8.7)
- [CVE-2026-35184](https://insights.sbomify.com/CVE-2026-35184/): EcclesiaCRM has a Critical SQL Injection (high 8.7)
- [CVE-2026-35183](https://insights.sbomify.com/CVE-2026-35183/): Brave CMS has an Insecure Direct Object Reference in Article Image Deletion (high 7.1)
- [CVE-2026-35182](https://insights.sbomify.com/CVE-2026-35182/): Missing Authorization Privilege Escalation (high 8.8)
- [CVE-2026-35181](https://insights.sbomify.com/CVE-2026-35181/): WWBN AVideo Affected by CSRF on Player Skin Configuration via admin/playerUpdate.json.php (medium 4.3)
- [CVE-2026-35180](https://insights.sbomify.com/CVE-2026-35180/): WWBN AVideo affected by CSRF on Site Customization Endpoint Enables Logo Overwrite via Base64 File Write (medium 4.3)
- [CVE-2026-3518](https://insights.sbomify.com/CVE-2026-3518/): Command injection in ECS Connections Manager (high 8.4)
- [CVE-2026-35179](https://insights.sbomify.com/CVE-2026-35179/): WWBN AVideo Unauthenticated Instagram Graph API Proxy via publishInstagram.json.php (medium 5.3)
- [CVE-2026-35178](https://insights.sbomify.com/CVE-2026-35178/): Workbench Affected by Remote Code Execution (RCE) via Malicious Cookie in Timezone Conversion (critical 9.3)
- [CVE-2026-35177](https://insights.sbomify.com/CVE-2026-35177/): Path traversal issue with zip.vim in Vim (medium 4.1)
- [CVE-2026-35176](https://insights.sbomify.com/CVE-2026-35176/): openFPGALoader has a heap buffer overflow in POFParser::parseSection() via crafted .pof file (high 7.1)
- [CVE-2026-35175](https://insights.sbomify.com/CVE-2026-35175/): Ajenti has an authorization bypass during custom package installation (high 7.2)
- [CVE-2026-35174](https://insights.sbomify.com/CVE-2026-35174/): Chyrp Lite has a Path Traversal to Remote Code Execution (critical 9.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/692/