# Vulnerabilities published in 2026


- [CVE-2026-34417](https://insights.sbomify.com/CVE-2026-34417/): OSCAL-GUI Reflected XSS via project parameter in oscal-forms.php (medium 5.1)
- [CVE-2026-34416](https://insights.sbomify.com/CVE-2026-34416/): OSCAL-GUI Reflected XSS via project parameter in oscal.php (medium 5.1)
- [CVE-2026-34415](https://insights.sbomify.com/CVE-2026-34415/): Xerte Online Toolkits File Upload RCE via elfinder Connector (critical 9.3)
- [CVE-2026-34414](https://insights.sbomify.com/CVE-2026-34414/): Xerte Online Toolkits Path Traversal via connector.php (high 7.1)
- [CVE-2026-34413](https://insights.sbomify.com/CVE-2026-34413/): Xerte Online Toolkits Missing Authentication via connector.php (high 8.8)
- [CVE-2026-34411](https://insights.sbomify.com/CVE-2026-34411/): Appsmith < 1.98 Unauthenticated Instance Configuration Disclosure via Management APIs (medium 6.9)
- [CVE-2026-3441](https://insights.sbomify.com/CVE-2026-3441/): Binutils: gnu binutils: information disclosure via specially crafted xcoff object file (medium 6.1)
- [CVE-2026-34408](https://insights.sbomify.com/CVE-2026-34408/): An issue was discovered in Gambio 4.9.2.0 (patched in 2024-02 v1.0.0 for GX4 v4.0.0.0 to v4.9.2.0). (critical 9.1)
- [CVE-2026-34406](https://insights.sbomify.com/CVE-2026-34406/): APTRS: Privilege Escalation via Mass Assignment of is_superuser in User Edit Endpoint (critical 9.4)
- [CVE-2026-34405](https://insights.sbomify.com/CVE-2026-34405/): Nuxt OG Image vulnerable to reflected XSS via query parameter injection into HTML attributes (medium 6.1)
- [CVE-2026-34404](https://insights.sbomify.com/CVE-2026-34404/): Nuxt OG Image vulnerable to DoS via image generation (medium 6.9)
- [CVE-2026-34403](https://insights.sbomify.com/CVE-2026-34403/): Nginx-UI vulnerable to Cross-Site WebSocket Hijacking (CSWSH) via missing origin validation on all WebSocket endpoints (medium 5.5)
- [CVE-2026-34401](https://insights.sbomify.com/CVE-2026-34401/): XML Notepad: XML External Entity (XXE) Injection via Unsafe XmlTextReader in XML Diff and Schema Loading (medium 6.5)
- [CVE-2026-34400](https://insights.sbomify.com/CVE-2026-34400/): alerta-server has potential SQL Injection vulnerability in Query String Syntax (q=) API (medium 6.9)
- [CVE-2026-34399](https://insights.sbomify.com/CVE-2026-34399/): FreeCAD: Arbitrary Code Execution via eval() on untrusted SVG template scale field in BIM TechDraw Page (high 7.8)
- [CVE-2026-34398](https://insights.sbomify.com/CVE-2026-34398/): FreeCAD: Arbitrary Code Execution via eval() on untrusted project file metadata in BIM Workbench (high 7.8)
- [CVE-2026-34397](https://insights.sbomify.com/CVE-2026-34397/): himmelblau: NSS fake-primary group lookup reintroduces name collision risk (medium 6.3)
- [CVE-2026-34396](https://insights.sbomify.com/CVE-2026-34396/): AVideo: Stored XSS via Unescaped Plugin Configuration Values in Admin Panel (medium 6.1)
- [CVE-2026-34395](https://insights.sbomify.com/CVE-2026-34395/): AVideo: Mass User PII Disclosure via Missing Authorization in YPTWallet users.json.php (medium 6.5)
- [CVE-2026-34394](https://insights.sbomify.com/CVE-2026-34394/): AVideo: CSRF on Admin Plugin Configuration Enables Payment Credential Hijacking (high 8.1)
- [CVE-2026-34393](https://insights.sbomify.com/CVE-2026-34393/): Weblate: Privilege escalation in the user API endpoint (high 8.8)
- [CVE-2026-34392](https://insights.sbomify.com/CVE-2026-34392/): LORIS has a path traversal in static router (high 7.5)
- [CVE-2026-34391](https://insights.sbomify.com/CVE-2026-34391/): Fleet Vulnerable to Windows MDM cross-device command disclosure (medium 6.6)
- [CVE-2026-34390](https://insights.sbomify.com/CVE-2026-34390/): MantisBT: Privilege Escalation from Manager to Administrator (medium 5.1)
- [CVE-2026-3439](https://insights.sbomify.com/CVE-2026-3439/): Memory corruption in SonicOS (medium 4.9)
- [CVE-2026-34389](https://insights.sbomify.com/CVE-2026-34389/): Fleet's user account creation via invite does not enforce invited email address (medium 4.9)
- [CVE-2026-34388](https://insights.sbomify.com/CVE-2026-34388/): Fleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpoint (medium 6.6)
- [CVE-2026-34387](https://insights.sbomify.com/CVE-2026-34387/): Fleet vulnerable to OS command injection via crafted software package metadata in uninstall scripts (medium 5.7)
- [CVE-2026-34386](https://insights.sbomify.com/CVE-2026-34386/): Fleet vulnerable to SQL injection in MDM bootstrap package by authenticated team or global admin (medium 6.3)
- [CVE-2026-34385](https://insights.sbomify.com/CVE-2026-34385/): Fleet's Apple MDM profile delivery has second-order SQL injection that can compromise the database (medium 6.2)
- [CVE-2026-34384](https://insights.sbomify.com/CVE-2026-34384/): Admidio: Missing CSRF Protection on Registration Approval Actions (medium 4.5)
- [CVE-2026-34383](https://insights.sbomify.com/CVE-2026-34383/): Admidio: CSRF and Form Validation Bypass in Inventory Item Save via `imported` Parameter (medium 4.3)
- [CVE-2026-34382](https://insights.sbomify.com/CVE-2026-34382/): Admidio: Missing CSRF Protection on Custom List Deletion in mylist_function.php (medium 4.6)
- [CVE-2026-34381](https://insights.sbomify.com/CVE-2026-34381/): Admidio: Unauthenticated Access to Role-Restricted documents via neutralized .htaccess (high 7.5)
- [CVE-2026-34380](https://insights.sbomify.com/CVE-2026-34380/): Integer overflow in openexr (medium 5.9)
- [CVE-2026-3438](https://insights.sbomify.com/CVE-2026-3438/): Nexus Repository 3 - Reflected Cross-Site Scripting (XSS) in ?describe Pages (medium 5.1)
- [CVE-2026-34379](https://insights.sbomify.com/CVE-2026-34379/): OpenEXR has a misaligned write in LossyDctDecoder_execute leading to undefined behavior (DWA/DWAB decompression) (high 7.1)
- [CVE-2026-34378](https://insights.sbomify.com/CVE-2026-34378/): OpenEXR has a signed integer overflow in generic_unpack() when parsing EXR files with crafted negative dataWindow.min.x (medium 6.5)
- [CVE-2026-34377](https://insights.sbomify.com/CVE-2026-34377/): Zebra has a Consensus Failure due to Improper Verification of V5 Transactions (high 8.4)
- [CVE-2026-34376](https://insights.sbomify.com/CVE-2026-34376/): PdfDing: Password-protected share bypass via direct serve endpoint (high 7.5)
- [CVE-2026-34375](https://insights.sbomify.com/CVE-2026-34375/): AVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment Page (high 8.2)
- [CVE-2026-34374](https://insights.sbomify.com/CVE-2026-34374/): AVideo has SQL Injection in Live_schedule::keyExists() via Unparameterized Stream Key (critical 9.1)
- [CVE-2026-34373](https://insights.sbomify.com/CVE-2026-34373/): Parse Server: GraphQL API endpoint ignores CORS origin restriction (medium 5.3)
- [CVE-2026-34372](https://insights.sbomify.com/CVE-2026-34372/): Sulu checks fix permissions for subentities endpoints (medium 5.3)
- [CVE-2026-34371](https://insights.sbomify.com/CVE-2026-34371/): LibreChat Affected by Arbitrary File Write via `execute_code` Artifact Filename Traversal (medium 6.3)
- [CVE-2026-34370](https://insights.sbomify.com/CVE-2026-34370/): Chamilo LMS: IDOR in the Notebook Module allows an attacker to view other users' private notes (medium 6.5)
- [CVE-2026-3437](https://insights.sbomify.com/CVE-2026-3437/): Improper Restriction of Operations within the Bounds of a Memory Buffer in Portwell Engineering Toolkits (critical 9.3)
- [CVE-2026-34369](https://insights.sbomify.com/CVE-2026-34369/): AVideo has Video Password Protection Bypass via API Endpoints Returning Full Playback Sources Without Password Verification (medium 5.3)
- [CVE-2026-34368](https://insights.sbomify.com/CVE-2026-34368/): AVideo Vulnerable to Wallet Balance Double-Spend via TOCTOU Race Condition in transferBalance (medium 5.3)
- [CVE-2026-34367](https://insights.sbomify.com/CVE-2026-34367/): InvoiceShelf: SSRF in Invoice PDF Rendering via Unsanitised HTML in Notes Field (high 7.6)
- [CVE-2026-34366](https://insights.sbomify.com/CVE-2026-34366/): InvoiceShelf: SSRF in Payment Receipt PDF Rendering via Unsanitised HTML in Notes Field (high 7.6)
- [CVE-2026-34365](https://insights.sbomify.com/CVE-2026-34365/): InvoiceShelf: SSRF in Estimate PDF Rendering via Unsanitised HTML in Notes Field (high 7.6)
- [CVE-2026-34364](https://insights.sbomify.com/CVE-2026-34364/): AVideo has User Group-Based Category Access Control Bypass via Missing and Broken Group Filtering in categories.json.php (medium 5.3)
- [CVE-2026-34363](https://insights.sbomify.com/CVE-2026-34363/): Parse Server: LiveQuery protected field leak via shared mutable state across concurrent subscribers (high 8.2)
- [CVE-2026-34362](https://insights.sbomify.com/CVE-2026-34362/): AVideo's WebSocket Token Never Expires Due to Commented-Out Timeout Validation in verifyTokenSocket() (medium 5.4)
- [CVE-2026-34361](https://insights.sbomify.com/CVE-2026-34361/): HAPI FHIR: Unauthenticated SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft (critical 9.3)
- [CVE-2026-34360](https://insights.sbomify.com/CVE-2026-34360/): HAPI FHIR: Unauthenticated Blind SSRF via /loadIG Endpoint Enables Internal Network Probing (medium 5.8)
- [CVE-2026-34359](https://insights.sbomify.com/CVE-2026-34359/): HAPI FHIR: Authentication Credential Leakage via Improper URL Prefix Matching on HTTP Redirect in HAPI FHIR Core (high 7.4)
- [CVE-2026-34358](https://insights.sbomify.com/CVE-2026-34358/): CtrlPanel: Missing Authorization on Admin Write Endpoints Allows RBAC Bypass (high 8.1)
- [CVE-2026-34356](https://insights.sbomify.com/CVE-2026-34356/): Apache HTTP Server: ProxyPassReverseCookieMap buffer overflow (high 7.5)
- [CVE-2026-34355](https://insights.sbomify.com/CVE-2026-34355/): Apache HTTP Server: mod_proxy_html buffer overflow (high 7.5)
- [CVE-2026-34354](https://insights.sbomify.com/CVE-2026-34354/): Race condition in Guardicore Platform Agent (high 7.4)
- [CVE-2026-34353](https://insights.sbomify.com/CVE-2026-34353/): Integer overflow in OCaml (medium 5.9)
- [CVE-2026-34352](https://insights.sbomify.com/CVE-2026-34352/): Misconfiguration in TigerVNC (high 8.5)
- [CVE-2026-34351](https://insights.sbomify.com/CVE-2026-34351/): Windows TCP/IP Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-34350](https://insights.sbomify.com/CVE-2026-34350/): Windows Storport Miniport Driver Denial of Service Vulnerability (medium 6.5)
- [CVE-2026-34349](https://insights.sbomify.com/CVE-2026-34349/): Windows Media Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-34348](https://insights.sbomify.com/CVE-2026-34348/): Windows Event Logging Service Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-34347](https://insights.sbomify.com/CVE-2026-34347/): Windows Win32k Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-34346](https://insights.sbomify.com/CVE-2026-34346/): Windows Ancillary Function Driver for WinSock Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-34345](https://insights.sbomify.com/CVE-2026-34345/): Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-34344](https://insights.sbomify.com/CVE-2026-34344/): Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-34343](https://insights.sbomify.com/CVE-2026-34343/): Windows Application Identity (AppID) Subsystem Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-34342](https://insights.sbomify.com/CVE-2026-34342/): Windows Print Spooler Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-34341](https://insights.sbomify.com/CVE-2026-34341/): Windows Link-Layer Discovery Protocol (LLDP) Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-34340](https://insights.sbomify.com/CVE-2026-34340/): Windows Projected File System Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-34339](https://insights.sbomify.com/CVE-2026-34339/): Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability (medium 5.5)
- [CVE-2026-34338](https://insights.sbomify.com/CVE-2026-34338/): Windows Telephony Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-34337](https://insights.sbomify.com/CVE-2026-34337/): Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-34336](https://insights.sbomify.com/CVE-2026-34336/): Windows DWM Core Library Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-34335](https://insights.sbomify.com/CVE-2026-34335/): Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-34334](https://insights.sbomify.com/CVE-2026-34334/): Windows TCP/IP Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-34333](https://insights.sbomify.com/CVE-2026-34333/): Windows Win32k Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-34332](https://insights.sbomify.com/CVE-2026-34332/): Windows Kernel-Mode Driver Remote Code Execution Vulnerability (high 8.0)
- [CVE-2026-34331](https://insights.sbomify.com/CVE-2026-34331/): Win32k Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-34330](https://insights.sbomify.com/CVE-2026-34330/): Win32k Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-3433](https://insights.sbomify.com/CVE-2026-3433/): Mattermost fails to scope role_updated websocket events to authorized team and channel members (medium 4.3)
- [CVE-2026-34329](https://insights.sbomify.com/CVE-2026-34329/): Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-34328](https://insights.sbomify.com/CVE-2026-34328/): Windows Audio Service Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-34327](https://insights.sbomify.com/CVE-2026-34327/): Microsoft Partner Center Spoofing Vulnerability (high 8.2)
- [CVE-2026-34325](https://insights.sbomify.com/CVE-2026-34325/): Missing authorization in Oracle Financial Services Analytical Applications Infrastructure (medium 6.8)
- [CVE-2026-34324](https://insights.sbomify.com/CVE-2026-34324/): Missing authorization in Oracle Life Sciences InForm (medium 6.5)
- [CVE-2026-34323](https://insights.sbomify.com/CVE-2026-34323/): Missing authorization in Oracle Life Sciences InForm (medium 6.3)
- [CVE-2026-34321](https://insights.sbomify.com/CVE-2026-34321/): Missing authorization in Oracle Financial Services Analytical Applications Infrastructure (medium 4.8)
- [CVE-2026-34320](https://insights.sbomify.com/CVE-2026-34320/): Missing authorization in Oracle Financial Services Customer Screening (high 7.5)
- [CVE-2026-3432](https://insights.sbomify.com/CVE-2026-3432/): Sim Studio AI - Unauthenticated OAuth Token Theft (critical 9.3)
- [CVE-2026-34319](https://insights.sbomify.com/CVE-2026-34319/): Denial of service in MySQL Shell (medium 5.0)
- [CVE-2026-34318](https://insights.sbomify.com/CVE-2026-34318/): Information disclosure in MySQL Shell (medium 5.8)
- [CVE-2026-34317](https://insights.sbomify.com/CVE-2026-34317/): Denial of service in MySQL Shell (medium 5.0)
- [CVE-2026-34316](https://insights.sbomify.com/CVE-2026-34316/): Missing authorization in Oracle Commerce Service Center (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/700/