# Vulnerabilities published in 2026


- [CVE-2026-35173](https://insights.sbomify.com/CVE-2026-35173/): Chyrp Lite has an IDOR via Mass Assignment in Post Model (medium 6.5)
- [CVE-2026-35172](https://insights.sbomify.com/CVE-2026-35172/): Distribution has stale blob access resurrection via repo-scoped redis descriptor cache invalidation (high 7.5)
- [CVE-2026-35171](https://insights.sbomify.com/CVE-2026-35171/): Arbitrary Code Execution via Malicious Logging Configuration in Kedro (critical 9.8)
- [CVE-2026-35170](https://insights.sbomify.com/CVE-2026-35170/): openFPGALoader has a heap buffer overflow in BitParser::parseHeader() via crafted .bit file (high 7.1)
- [CVE-2026-3517](https://insights.sbomify.com/CVE-2026-3517/): Command injection in ECS Connections Manager (high 8.4)
- [CVE-2026-35169](https://insights.sbomify.com/CVE-2026-35169/): LORIS has potential cross-site scripting in help_editor module (high 8.7)
- [CVE-2026-35168](https://insights.sbomify.com/CVE-2026-35168/): OpenSTAManager: SQL Injection via Aggiornamenti Module (high 8.8)
- [CVE-2026-35167](https://insights.sbomify.com/CVE-2026-35167/): Kedro has a path traversal in versioned dataset loading via unsanitized version string (high 7.1)
- [CVE-2026-35166](https://insights.sbomify.com/CVE-2026-35166/): Hugo does not properly escape some Markdown links (medium 5.3)
- [CVE-2026-35165](https://insights.sbomify.com/CVE-2026-35165/): LORIS has incorrect access checks in document_repository (medium 6.3)
- [CVE-2026-35164](https://insights.sbomify.com/CVE-2026-35164/): Brave CMS Sffected by Unrestricted File Upload via CKEditor Endpoint (high 8.8)
- [CVE-2026-35163](https://insights.sbomify.com/CVE-2026-35163/): OctoPrint: XSS in Suppressed Command Notifications (medium 4.6)
- [CVE-2026-35162](https://insights.sbomify.com/CVE-2026-35162/): Missing authorization in PowerFlex (medium 4.3)
- [CVE-2026-35161](https://insights.sbomify.com/CVE-2026-35161/): Denial of service in PowerScale InsightIQ (medium 5.3)
- [CVE-2026-35160](https://insights.sbomify.com/CVE-2026-35160/): Command injection in SmartFabric OS10 Software (medium 5.0)
- [CVE-2026-3516](https://insights.sbomify.com/CVE-2026-3516/): Contact List <= 3.0.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via '_cl_map_iframe' Parameter (medium 6.4)
- [CVE-2026-35159](https://insights.sbomify.com/CVE-2026-35159/): Auth bypass in 14 Plus 2-in-1 DB04250 (medium 5.3)
- [CVE-2026-35157](https://insights.sbomify.com/CVE-2026-35157/): Code injection in ECS (medium 5.8)
- [CVE-2026-35155](https://insights.sbomify.com/CVE-2026-35155/): Race condition in iDRAC10 (high 7.1)
- [CVE-2026-35154](https://insights.sbomify.com/CVE-2026-35154/): Privilege escalation in PowerProtect Data Domain appliances (medium 6.3)
- [CVE-2026-35153](https://insights.sbomify.com/CVE-2026-35153/): Command injection in PowerProtect Data Domain (medium 6.7)
- [CVE-2026-35152](https://insights.sbomify.com/CVE-2026-35152/): Apache Fineract: SQL injection in runreports endpoint (high 8.8)
- [CVE-2026-3515](https://insights.sbomify.com/CVE-2026-3515/): Argument Injection in prefecthq/prefect (high 8.5)
- [CVE-2026-35149](https://insights.sbomify.com/CVE-2026-35149/): HCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation. (high 8.2)
- [CVE-2026-35148](https://insights.sbomify.com/CVE-2026-35148/): HCL DFXServer is affected by a Missing Access Control vulnerability (medium 6.3)
- [CVE-2026-35147](https://insights.sbomify.com/CVE-2026-35147/): HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access. (high 8.2)
- [CVE-2026-35146](https://insights.sbomify.com/CVE-2026-35146/): HCL DFXServer is affected by an Unencrypted Communication vulnerability. (medium 6.3)
- [CVE-2026-35145](https://insights.sbomify.com/CVE-2026-35145/): HCL DFXAnalytics is affected by a Missing HTTP Strict-Transport-Security Header vulnerability. (low 3.1)
- [CVE-2026-35143](https://insights.sbomify.com/CVE-2026-35143/): HCL DFXAnalytics is affected by a Missing SameSite Attribute vulnerability. (low 3.0)
- [CVE-2026-35142](https://insights.sbomify.com/CVE-2026-35142/): HCL DFXAnalytics is affected by an Internal IP Address Disclosure vulnerability. (low 2.6)
- [CVE-2026-35141](https://insights.sbomify.com/CVE-2026-35141/): HCL DFXAnalytics is affected by a Login Replay Attack vulnerability (low 2.6)
- [CVE-2026-35140](https://insights.sbomify.com/CVE-2026-35140/): HCL DFXAnalytics is affected by a Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability (low 3.0)
- [CVE-2026-3514](https://insights.sbomify.com/CVE-2026-3514/): Authentication Bypass in prefecthq/prefect (high 7.5)
- [CVE-2026-3513](https://insights.sbomify.com/CVE-2026-3513/): Cross-site scripting in TableOn – WordPress Posts Table Filterable (medium 6.4)
- [CVE-2026-3512](https://insights.sbomify.com/CVE-2026-3512/): Writeprint Stylometry <= 0.1 - Reflected Cross-Site Scripting via 'p' Parameter (medium 6.1)
- [CVE-2026-3511](https://insights.sbomify.com/CVE-2026-3511/): XML external entity in Autogram (high 8.6)
- [CVE-2026-35099](https://insights.sbomify.com/CVE-2026-35099/): Race condition in SysTrack Agent (high 7.4)
- [CVE-2026-35098](https://insights.sbomify.com/CVE-2026-35098/): Improper Restriction of Excessive Authentication Attempts in KTM System e-BOK (medium 6.9)
- [CVE-2026-35097](https://insights.sbomify.com/CVE-2026-35097/): Weak Password Requirements in KTM System e-BOK (medium 6.9)
- [CVE-2026-35096](https://insights.sbomify.com/CVE-2026-35096/): Cross-Site Request Forgery (CSRF) in KTM System e-BOK (medium 5.1)
- [CVE-2026-35095](https://insights.sbomify.com/CVE-2026-35095/): Session fixation in KTM System e-BOK (medium 4.8)
- [CVE-2026-35094](https://insights.sbomify.com/CVE-2026-35094/): Libinput: libinput: information disclosure via dangling pointer in lua plugin handling (low 3.3)
- [CVE-2026-35093](https://insights.sbomify.com/CVE-2026-35093/): Libinput: libinput: unauthorized code execution and information disclosure through lua bytecode plugins (high 8.8)
- [CVE-2026-35092](https://insights.sbomify.com/CVE-2026-35092/): Corosync: corosync: denial of service via integer overflow in join message validation (high 7.5)
- [CVE-2026-35091](https://insights.sbomify.com/CVE-2026-35091/): Corosync: corosync: denial of service and information disclosure via crafted udp packet (high 8.2)
- [CVE-2026-35090](https://insights.sbomify.com/CVE-2026-35090/): Authentication Bypass in Slican telephone exchanges (critical 9.3)
- [CVE-2026-3509](https://insights.sbomify.com/CVE-2026-3509/): CODESYS Control Audit Log Format String DoS (high 7.5)
- [CVE-2026-35089](https://insights.sbomify.com/CVE-2026-35089/): Use of Weak Credentials in Slican telephone exchanges (high 8.7)
- [CVE-2026-35088](https://insights.sbomify.com/CVE-2026-35088/): Inadequate Encryption Strength in Slican telephone exchanges (high 8.2)
- [CVE-2026-35087](https://insights.sbomify.com/CVE-2026-35087/): Authentication Bypass in Slican telephone exchanges (critical 9.3)
- [CVE-2026-35086](https://insights.sbomify.com/CVE-2026-35086/): Apache OFBiz: Authenticated Remote Code Execution via Unsafe Template Expansion in email services (medium 6.5)
- [CVE-2026-35085](https://insights.sbomify.com/CVE-2026-35085/): Stack buffer overflow in method gdv-serverconfig (high 8.7)
- [CVE-2026-35084](https://insights.sbomify.com/CVE-2026-35084/): Stack buffer overflow in method dali-devconfig (high 8.7)
- [CVE-2026-35083](https://insights.sbomify.com/CVE-2026-35083/): Stack buffer overflow in method bac-deviceobject (high 8.7)
- [CVE-2026-35082](https://insights.sbomify.com/CVE-2026-35082/): Local file inclusion vulnerability and deletion in ugw-logread method (high 8.7)
- [CVE-2026-35081](https://insights.sbomify.com/CVE-2026-35081/): Arbitrary process termination vulnerability in method ugw-logstop (high 7.2)
- [CVE-2026-35080](https://insights.sbomify.com/CVE-2026-35080/): Arbitrary file delete vulnerability in method ugw-restoreinfo (high 7.2)
- [CVE-2026-3508](https://insights.sbomify.com/CVE-2026-3508/): Memory corruption in ASUS System Control Interface (medium 6.8)
- [CVE-2026-35079](https://insights.sbomify.com/CVE-2026-35079/): Arbitrary file delete vulnerability in method ugw-restore (high 7.2)
- [CVE-2026-35078](https://insights.sbomify.com/CVE-2026-35078/): Arbitrary file delete vulnerability in method ugw-logstop (high 7.2)
- [CVE-2026-35077](https://insights.sbomify.com/CVE-2026-35077/): Arbitrary file delete vulnerability in method ugw-delete-file (high 7.2)
- [CVE-2026-35076](https://insights.sbomify.com/CVE-2026-35076/): Arbitrary file delete vulnerability in method bac-scanresult (high 7.2)
- [CVE-2026-35075](https://insights.sbomify.com/CVE-2026-35075/): Hardcoded default Password for Service Account (critical 9.3)
- [CVE-2026-35074](https://insights.sbomify.com/CVE-2026-35074/): Command injection in PowerProtect Data Domain (medium 6.7)
- [CVE-2026-35073](https://insights.sbomify.com/CVE-2026-35073/): Command injection in PowerProtect Data Domain (medium 6.7)
- [CVE-2026-35072](https://insights.sbomify.com/CVE-2026-35072/): Command injection in PowerProtect Data Domain (medium 6.7)
- [CVE-2026-35071](https://insights.sbomify.com/CVE-2026-35071/): Command injection in PowerScale InsightIQ (high 8.2)
- [CVE-2026-35070](https://insights.sbomify.com/CVE-2026-35070/): Command injection in SmartFabric Storage Software (medium 6.4)
- [CVE-2026-35069](https://insights.sbomify.com/CVE-2026-35069/): SQL injection in PowerFlex (medium 5.7)
- [CVE-2026-35068](https://insights.sbomify.com/CVE-2026-35068/): SQL injection in PowerFlex (low 3.5)
- [CVE-2026-35067](https://insights.sbomify.com/CVE-2026-35067/): Missing authorization in PowerFlex (medium 5.7)
- [CVE-2026-35066](https://insights.sbomify.com/CVE-2026-35066/): Missing authorization in PowerFlex (high 7.1)
- [CVE-2026-35065](https://insights.sbomify.com/CVE-2026-35065/): Auth bypass in PowerFlex (high 8.8)
- [CVE-2026-35064](https://insights.sbomify.com/CVE-2026-35064/): SenseLive X3050 Missing authentication for critical function (high 8.7)
- [CVE-2026-35063](https://insights.sbomify.com/CVE-2026-35063/): Missing Authorization in OpenPLC_V3 (high 8.7)
- [CVE-2026-35062](https://insights.sbomify.com/CVE-2026-35062/): iControl SOAP vulnerability (high 7.1)
- [CVE-2026-35061](https://insights.sbomify.com/CVE-2026-35061/): Anviz Products Missing Authorization (medium 5.3)
- [CVE-2026-3506](https://insights.sbomify.com/CVE-2026-3506/): WP-Chatbot for Messenger <= 4.9 - Missing Authorization to Unauthenticated Chatbot Configuration Takeover (medium 5.3)
- [CVE-2026-35058](https://insights.sbomify.com/CVE-2026-35058/): Denial of service in OpenVPN (medium 6.9)
- [CVE-2026-35057](https://insights.sbomify.com/CVE-2026-35057/): XenForo Stored Cross-Site Scripting via Structured Text Mentions (medium 5.1)
- [CVE-2026-35056](https://insights.sbomify.com/CVE-2026-35056/): XenForo Remote Code Execution via Authenticated Admin (high 8.6)
- [CVE-2026-35055](https://insights.sbomify.com/CVE-2026-35055/): XenForo Cross-Site Scripting via Lightbox in Posts (medium 5.1)
- [CVE-2026-35054](https://insights.sbomify.com/CVE-2026-35054/): XenForo Stored Cross-Site Scripting via BB Code Rendering (medium 5.1)
- [CVE-2026-35053](https://insights.sbomify.com/CVE-2026-35053/): OneUptime: Unauthenticated Workflow Execution via ManualAPI (critical 9.2)
- [CVE-2026-35052](https://insights.sbomify.com/CVE-2026-35052/): D-Tale affected by Remote Code Execution through redis/shelf storage (medium 5.3)
- [CVE-2026-35051](https://insights.sbomify.com/CVE-2026-35051/): Traefik: ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass auth (high 7.8)
- [CVE-2026-35050](https://insights.sbomify.com/CVE-2026-35050/): Path traversal in text-generation-webui (critical 9.1)
- [CVE-2026-3505](https://insights.sbomify.com/CVE-2026-3505/): Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion. (high 8.7)
- [CVE-2026-35049](https://insights.sbomify.com/CVE-2026-35049/): wire-ios has Persistent Remote DoS via Integer Underflow (medium 6.5)
- [CVE-2026-35048](https://insights.sbomify.com/CVE-2026-35048/): Piwigo RCE via PHP Code Injection into Config File in Installer (critical 9.8)
- [CVE-2026-35047](https://insights.sbomify.com/CVE-2026-35047/): Brave CMS has Unrestricted File Upload in BraveCMS via CKEditor Endpoint (critical 9.3)
- [CVE-2026-35046](https://insights.sbomify.com/CVE-2026-35046/): Tandoor has a Stored CSS Injection via <style> Tag in Recipe Instructions (API-Level) (medium 5.4)
- [CVE-2026-35045](https://insights.sbomify.com/CVE-2026-35045/): Tandoor Recipes Affected by Private Recipe Exposure and Unauthorized Modification (high 8.1)
- [CVE-2026-35044](https://insights.sbomify.com/CVE-2026-35044/): BentoML has a Server-Side Template Injection via unsandboxed Jinja2 Environment in Dockerfile generation (high 8.8)
- [CVE-2026-35043](https://insights.sbomify.com/CVE-2026-35043/): BentoML: command injection in cloud deployment setup script (deployment.py) (high 7.8)
- [CVE-2026-35042](https://insights.sbomify.com/CVE-2026-35042/): fast-jwt accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation) (high 7.5)
- [CVE-2026-35041](https://insights.sbomify.com/CVE-2026-35041/): ReDoS in fast-jwt when using RegExp in allowed* leading to CPU exhaustion during token verification (medium 4.2)
- [CVE-2026-35040](https://insights.sbomify.com/CVE-2026-35040/): fast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS) (medium 5.3)
- [CVE-2026-3504](https://insights.sbomify.com/CVE-2026-3504/): Information disclosure in Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy (medium 5.3)
- [CVE-2026-35039](https://insights.sbomify.com/CVE-2026-35039/): fast-jwt: Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup) (critical 9.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/693/