# Vulnerabilities published in 2026


- [CVE-2026-34539](https://insights.sbomify.com/CVE-2026-34539/): iccDEV: HBO in CTiffImg::WriteLine() (medium 6.2)
- [CVE-2026-34538](https://insights.sbomify.com/CVE-2026-34538/): Apache Airflow: Authorization bypass in DagRun wait endpoint (XCom exposure) (medium 6.5)
- [CVE-2026-34537](https://insights.sbomify.com/CVE-2026-34537/): iccDEV: UB in CIccOpDefEnvVar::Exec() (medium 6.2)
- [CVE-2026-34536](https://insights.sbomify.com/CVE-2026-34536/): iccDEV: SO in SIccCalcOp::ArgsUsed() (medium 6.2)
- [CVE-2026-34535](https://insights.sbomify.com/CVE-2026-34535/): iccDEV: SEGV in CIccTagArray::Cleanup() (medium 6.2)
- [CVE-2026-34534](https://insights.sbomify.com/CVE-2026-34534/): iccDEV: HBO in CIccMpeSpectralMatrix::Describe() (medium 6.2)
- [CVE-2026-34533](https://insights.sbomify.com/CVE-2026-34533/): iccDEV: UB in CIccCalculatorFunc::ApplySequence() (medium 6.2)
- [CVE-2026-34532](https://insights.sbomify.com/CVE-2026-34532/): Parse Server: Cloud function validator bypass via prototype chain traversal (critical 9.1)
- [CVE-2026-34531](https://insights.sbomify.com/CVE-2026-34531/): Flask-HTTPAuth invokes token verification callback when missing or empty token was given by client (medium 6.5)
- [CVE-2026-34530](https://insights.sbomify.com/CVE-2026-34530/): File Browser is vulnerable to Stored Cross-Site Scripting via text/template branding injection (medium 6.9)
- [CVE-2026-3453](https://insights.sbomify.com/CVE-2026-3453/): Missing authorization in Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress (high 8.1)
- [CVE-2026-34529](https://insights.sbomify.com/CVE-2026-34529/): File Browser is vulnerable to Stored Cross-site Scripting via crafted EPUB file (high 7.6)
- [CVE-2026-34528](https://insights.sbomify.com/CVE-2026-34528/): File Browser's Signup Grants Execution Permissions When Default Permissions Includes Execution (high 8.1)
- [CVE-2026-34527](https://insights.sbomify.com/CVE-2026-34527/): Sandboxie-Plus EditPassword hash entropy reduced from 160 bits to 80 bits due to incorrect nibble extraction (low 2.0)
- [CVE-2026-34526](https://insights.sbomify.com/CVE-2026-34526/): SillyTavern: Incomplete IP validation in /api/search/visit allows SSRF via localhost and IPv6 (medium 5.0)
- [CVE-2026-34525](https://insights.sbomify.com/CVE-2026-34525/): AIOHTTP: Duplicate Host header accepted (medium 6.3)
- [CVE-2026-34524](https://insights.sbomify.com/CVE-2026-34524/): SillyTavern: Path Traversal in `/api/chats/export` and `/api/chats/delete` allows arbitrary file read/delete within user data root (high 8.3)
- [CVE-2026-34523](https://insights.sbomify.com/CVE-2026-34523/): SillyTavern: Path traversal allows file existence oracle (medium 5.3)
- [CVE-2026-34522](https://insights.sbomify.com/CVE-2026-34522/): SillyTavern: Path traversal in `/api/chats/import` allows arbitrary file write outside intended chat directory (high 8.1)
- [CVE-2026-34520](https://insights.sbomify.com/CVE-2026-34520/): AIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values - header injection/security bypass (low 2.7)
- [CVE-2026-3452](https://insights.sbomify.com/CVE-2026-3452/): Concrete CMS below 9.4.8 is vulnerable to stored deserialization leading to RCE in the Express Entry List block. (high 8.9)
- [CVE-2026-34519](https://insights.sbomify.com/CVE-2026-34519/): AIOHTTP: HTTP response splitting via \r in reason phrase (low 2.7)
- [CVE-2026-34518](https://insights.sbomify.com/CVE-2026-34518/): AIOHTTP: Cookie and Proxy-Authorization headers leaked on cross-origin redirect (low 2.7)
- [CVE-2026-34517](https://insights.sbomify.com/CVE-2026-34517/): AIOHTTP: Late size enforcement for non-file multipart fields causes memory DoS (low 2.7)
- [CVE-2026-34516](https://insights.sbomify.com/CVE-2026-34516/): AIOHTTP: Multipart Header Size Bypass (medium 6.6)
- [CVE-2026-34515](https://insights.sbomify.com/CVE-2026-34515/): AIOHTTP: UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows (medium 6.6)
- [CVE-2026-34514](https://insights.sbomify.com/CVE-2026-34514/): AIOHTTP: CRLF injection in multipart part content type header construction (low 2.7)
- [CVE-2026-34513](https://insights.sbomify.com/CVE-2026-34513/): AIOHTTP: Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector (low 2.7)
- [CVE-2026-34512](https://insights.sbomify.com/CVE-2026-34512/): OpenClaw < 2026.3.25 - Improper Access Control in /sessions/:sessionKey/kill Endpoint (high 7.2)
- [CVE-2026-34511](https://insights.sbomify.com/CVE-2026-34511/): OpenClaw < 2026.4.2 - PKCE Verifier Exposure via OAuth State Parameter (medium 6.0)
- [CVE-2026-34510](https://insights.sbomify.com/CVE-2026-34510/): OpenClaw < 2026.3.22 - Remote File URL Acceptance in Windows Media Loaders (medium 6.9)
- [CVE-2026-34507](https://insights.sbomify.com/CVE-2026-34507/): OpenClaw < 2026.4.29 - Policy Bypass in QQBot Admin Commands via DM-only and allowFrom Checks (low 2.3)
- [CVE-2026-34506](https://insights.sbomify.com/CVE-2026-34506/): OpenClaw < 2026.3.8 - Sender Allowlist Bypass in Microsoft Teams Plugin via Route Allowlist Configuration (low 2.3)
- [CVE-2026-34505](https://insights.sbomify.com/CVE-2026-34505/): OpenClaw < 2026.3.12 - Webhook Rate Limiting Bypass via Pre-Authentication Secret Validation (medium 6.9)
- [CVE-2026-34504](https://insights.sbomify.com/CVE-2026-34504/): OpenClaw < 2026.3.28 - Server-Side Request Forgery via Unguarded Image Download in fal Provider (medium 6.9)
- [CVE-2026-34503](https://insights.sbomify.com/CVE-2026-34503/): OpenClaw < 2026.3.28 - Incomplete WebSocket Session Termination on Device Removal and Token Revocation (high 8.6)
- [CVE-2026-34502](https://insights.sbomify.com/CVE-2026-34502/): Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client (high 7.5)
- [CVE-2026-34501](https://insights.sbomify.com/CVE-2026-34501/): Apache Portable Runtime Utility: Heap buffer overflow in APR redis client (high 7.5)
- [CVE-2026-34500](https://insights.sbomify.com/CVE-2026-34500/): Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (medium 6.5)
- [CVE-2026-34499](https://insights.sbomify.com/CVE-2026-34499/): Hardcoded credentials in ADVMS (high 8.5)
- [CVE-2026-34498](https://insights.sbomify.com/CVE-2026-34498/): L4L (medium 5.1)
- [CVE-2026-34497](https://insights.sbomify.com/CVE-2026-34497/): FMS Employee Vulnerable to HTML Injection (medium 4.8)
- [CVE-2026-34496](https://insights.sbomify.com/CVE-2026-34496/): victor Web - Priviledge Escalation (high 7.1)
- [CVE-2026-34495](https://insights.sbomify.com/CVE-2026-34495/): FMS Employee vulnerable to XSS (medium 4.8)
- [CVE-2026-34494](https://insights.sbomify.com/CVE-2026-34494/): Information disclosure in Neo Series MVP2 (high 7.2)
- [CVE-2026-34493](https://insights.sbomify.com/CVE-2026-34493/): Information disclosure in EasyIO FS32 (high 7.2)
- [CVE-2026-34492](https://insights.sbomify.com/CVE-2026-34492/): Airwall - Arbitrary file read (high 7.0)
- [CVE-2026-34491](https://insights.sbomify.com/CVE-2026-34491/): Cross-site scripting in Metasys 14 (medium 6.1)
- [CVE-2026-34490](https://insights.sbomify.com/CVE-2026-34490/): XAAP Android Data Stored in Unencrypted Database (medium 4.8)
- [CVE-2026-3449](https://insights.sbomify.com/CVE-2026-3449/): @tootallnate/once vulnerable to Incorrect Control Flow Scoping (medium 4.8)
- [CVE-2026-34488](https://insights.sbomify.com/CVE-2026-34488/): Other in IP Setting Software (high 7.0)
- [CVE-2026-34487](https://insights.sbomify.com/CVE-2026-34487/): Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token (high 7.5)
- [CVE-2026-34486](https://insights.sbomify.com/CVE-2026-34486/): Apache Tomcat Missing Encryption of Sensitive Data (high 7.5, exploited in the wild)
- [CVE-2026-34485](https://insights.sbomify.com/CVE-2026-34485/): A CLI ACL Bypass vulnerability in Nokia 1830 Global Express (GX) (high 7.8)
- [CVE-2026-34484](https://insights.sbomify.com/CVE-2026-34484/): A Shell Privilege Escalation vulnerability in Nokia 1830 Global Express (GX) (medium 6.7)
- [CVE-2026-34483](https://insights.sbomify.com/CVE-2026-34483/): Apache Tomcat: Incomplete escaping of JSON access logs (high 7.5)
- [CVE-2026-34481](https://insights.sbomify.com/CVE-2026-34481/): Apache Log4j JSON Template Layout: Improper serialization of non-finite floating-point values in JsonTemplateLayout (medium 6.3)
- [CVE-2026-34480](https://insights.sbomify.com/CVE-2026-34480/): Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters (medium 6.9)
- [CVE-2026-34479](https://insights.sbomify.com/CVE-2026-34479/): Apache Log4j 1 to Log4j 2 bridge: silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters (medium 6.9)
- [CVE-2026-34478](https://insights.sbomify.com/CVE-2026-34478/): Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibility (medium 6.9)
- [CVE-2026-34477](https://insights.sbomify.com/CVE-2026-34477/): Apache Log4j Core: `verifyHostName` attribute silently ignored in TLS configuration (medium 6.3)
- [CVE-2026-34476](https://insights.sbomify.com/CVE-2026-34476/): Apache SkyWalking MCP: Server-Side Request Forgery via SW-URL Header in MCP Server (high 7.1)
- [CVE-2026-34475](https://insights.sbomify.com/CVE-2026-34475/): Security feature bypass in Varnish Cache (medium 5.4)
- [CVE-2026-34474](https://insights.sbomify.com/CVE-2026-34474/): Sensitive data exposure leading to admin/WLAN credential leak in ZTE ZXHN H298A 1.1 and H108N 2.6. (high 7.5)
- [CVE-2026-34473](https://insights.sbomify.com/CVE-2026-34473/): Unauthenticated DoS in ZTE H8102E, H168N, H167A, H199A, H288A, H198A, H267A, H267N, H268A, H388X, H196A, H369A, H268N, H208N, H367N, H181A, and H196Q. (high 7.5)
- [CVE-2026-34472](https://insights.sbomify.com/CVE-2026-34472/): Missing authorization in zte:zxhn h188a firmware (high 7.1)
- [CVE-2026-34464](https://insights.sbomify.com/CVE-2026-34464/): Sandboxie-Plus NamedPipeServer OpenHandler stack overflow via unterminated server field (high 8.8)
- [CVE-2026-34463](https://insights.sbomify.com/CVE-2026-34463/): MantisBT has Stored HTML Injection/XSS via Clone Issue Form (high 8.6)
- [CVE-2026-34462](https://insights.sbomify.com/CVE-2026-34462/): Sandboxie-Plus ProcessServer boxname stack buffer overflows via unterminated wide string copy (high 7.3)
- [CVE-2026-34461](https://insights.sbomify.com/CVE-2026-34461/): Sandboxie-Plus SbieIniServer RunSbieCtrl stack buffer overflow allows local privilege escalation (high 7.3)
- [CVE-2026-34460](https://insights.sbomify.com/CVE-2026-34460/): NamelessMC: OAuth callback `state` is not validated, allowing login CSRF / session swapping (medium 5.4)
- [CVE-2026-3446](https://insights.sbomify.com/CVE-2026-3446/): Base64 decoding stops at first padded quad by default (medium 6.0)
- [CVE-2026-34459](https://insights.sbomify.com/CVE-2026-34459/): Sandboxie-Plus sandbox escape via uninitialized memory leak and stack overflow in GetRawInputDeviceInfoSlave (high 8.8)
- [CVE-2026-34458](https://insights.sbomify.com/CVE-2026-34458/): Sandboxie-Plus privilege escalation via INI CRLF injection bypassing EditAdminOnly (critical 9.3)
- [CVE-2026-34457](https://insights.sbomify.com/CVE-2026-34457/): OAuth2 Proxy: Health Check User-Agent Matching Bypasses Authentication in auth_request Mode (critical 9.1)
- [CVE-2026-34456](https://insights.sbomify.com/CVE-2026-34456/): Reviactyl: OAuth account takeover via auto-linking (critical 9.1)
- [CVE-2026-34455](https://insights.sbomify.com/CVE-2026-34455/): Hi.Events: SQL Injection via Unvalidated sort_by Query Parameter in Multiple Repository Classes (high 8.7)
- [CVE-2026-34454](https://insights.sbomify.com/CVE-2026-34454/): OAuth2 Proxy: Session cookie not cleared when rendering sign-in page (low 3.5)
- [CVE-2026-34453](https://insights.sbomify.com/CVE-2026-34453/): SiYuan: Unauthenticated Access to Password-Protected Bookmarks via /api/bookmark/getBookmark (high 7.5)
- [CVE-2026-34452](https://insights.sbomify.com/CVE-2026-34452/): Claude SDK for Python: Memory Tool Path Validation Race Condition Allows Sandbox Escape (medium 5.8)
- [CVE-2026-34451](https://insights.sbomify.com/CVE-2026-34451/): Claude SDK for TypeScript: Memory Tool Path Validation Allows Sandbox Escape to Sibling Directories (medium 6.3)
- [CVE-2026-34450](https://insights.sbomify.com/CVE-2026-34450/): Claude SDK for Python: Insecure Default File Permissions in Local Filesystem Memory Tool (medium 4.8)
- [CVE-2026-3445](https://insights.sbomify.com/CVE-2026-3445/): Missing authorization in Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress (high 7.1)
- [CVE-2026-34449](https://insights.sbomify.com/CVE-2026-34449/): SiYuan: Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection (critical 9.7)
- [CVE-2026-34448](https://insights.sbomify.com/CVE-2026-34448/): SiYuan: Stored XSS in Attribute View Gallery/Kanban Cover Rendering Allows Arbitrary Command Execution in Desktop Client (critical 9.1)
- [CVE-2026-34447](https://insights.sbomify.com/CVE-2026-34447/): ONNX: External Data Symlink Traversal (medium 5.5)
- [CVE-2026-34446](https://insights.sbomify.com/CVE-2026-34446/): ONNX: Arbitrary File Read via ExternalData Hardlink Bypass in ONNX load (medium 4.7)
- [CVE-2026-34445](https://insights.sbomify.com/CVE-2026-34445/): ONNX: Malicious ONNX models can crash servers by exploiting unprotected object settings. (high 8.6)
- [CVE-2026-34444](https://insights.sbomify.com/CVE-2026-34444/): Lupa has a Sandbox escape and RCE due to incomplete attribute_filter enforcement in getattr / setattr (high 7.9)
- [CVE-2026-34443](https://insights.sbomify.com/CVE-2026-34443/): FreeScout: SSRF protection bypass via broken CIDR check in checkIpByMask() (medium 6.9)
- [CVE-2026-34442](https://insights.sbomify.com/CVE-2026-34442/): FreeScout: Host Header Injection Leading to External Resource Loading and Open Redirect in FreeScout (medium 5.4)
- [CVE-2026-34441](https://insights.sbomify.com/CVE-2026-34441/): cpp-httplib: HTTP Request Smuggling via Unconsumed GET Request Body (medium 4.8)
- [CVE-2026-34430](https://insights.sbomify.com/CVE-2026-34430/): ByteDance DeerFlow LocalSandboxProvider Host Bash Escape (high 8.6)
- [CVE-2026-34429](https://insights.sbomify.com/CVE-2026-34429/): Vvveb < 1.0.8.1 Stored XSS via Media Upload and Rename (medium 5.1)
- [CVE-2026-34428](https://insights.sbomify.com/CVE-2026-34428/): Vvveb < 1.0.8.1 SSRF via oEmbedProxy (high 8.3)
- [CVE-2026-34427](https://insights.sbomify.com/CVE-2026-34427/): Vvveb < 1.0.8.1 Privilege Escalation via admin/user/save (high 8.7)
- [CVE-2026-34426](https://insights.sbomify.com/CVE-2026-34426/): OpenClaw - Approval Bypass via Environment Variable Normalization (medium 6.9)
- [CVE-2026-34425](https://insights.sbomify.com/CVE-2026-34425/): OpenClaw - Shell-Bleed Protection Preflight Validation Bypass (medium 5.3)
- [CVE-2026-34424](https://insights.sbomify.com/CVE-2026-34424/): Smart Slider 3 Pro 3.5.1.35 Supply Chain Attack Remote Access Toolkit (critical 9.3)
- [CVE-2026-3442](https://insights.sbomify.com/CVE-2026-3442/): Binutils: gnu binutils: information disclosure or denial of service via out-of-bounds read in bfd linker (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/699/