# Vulnerabilities published in 2026


- [CVE-2026-33999](https://insights.sbomify.com/CVE-2026-33999/): Xorg: xwayland: x.org x server: denial of service via integer underflow in xkb compatibility map handling (high 7.8)
- [CVE-2026-33997](https://insights.sbomify.com/CVE-2026-33997/): Moby: Off-by-one error in plugin privilege validation (medium 6.8)
- [CVE-2026-33996](https://insights.sbomify.com/CVE-2026-33996/): LibJWT has NULL/bounds validation in JWK octet and RSA PSS parsing (medium 5.8)
- [CVE-2026-33995](https://insights.sbomify.com/CVE-2026-33995/): FreeRDP: Possible double free in kerberos_AcceptSecurityContext (medium 5.3)
- [CVE-2026-33994](https://insights.sbomify.com/CVE-2026-33994/): Locutus Prototype Pollution due to incomplete fix for CVE-2026-25521 (medium 6.3)
- [CVE-2026-33993](https://insights.sbomify.com/CVE-2026-33993/): Locutus has Prototype Pollution via __proto__ Key Injection in unserialize() (medium 6.9)
- [CVE-2026-33992](https://insights.sbomify.com/CVE-2026-33992/): pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration (critical 9.3)
- [CVE-2026-33991](https://insights.sbomify.com/CVE-2026-33991/): WeGIA has SQL Injection in deletar_tag.php (high 8.8)
- [CVE-2026-33990](https://insights.sbomify.com/CVE-2026-33990/): Docker Model Runner OCI Registry Client Vulnerable to Server-Side Request Forgery (SSRF) (medium 6.8)
- [CVE-2026-3399](https://insights.sbomify.com/CVE-2026-3399/): Tenda F453 httpd GstDhcpSetSer fromGstDhcpSetSer buffer overflow (high 8.7)
- [CVE-2026-33989](https://insights.sbomify.com/CVE-2026-33989/): @mobilenext/mobile-mcp alllows arbitrary file write via Path Traversal in mobile screen capture tools (high 8.1)
- [CVE-2026-33987](https://insights.sbomify.com/CVE-2026-33987/): FreeRDP: Persistent Cache bmpSize Desync - Heap OOB Write (high 7.1)
- [CVE-2026-33986](https://insights.sbomify.com/CVE-2026-33986/): FreeRDP: H.264 YUV Buffer Dimension Desync - Heap OOB Write (high 7.5)
- [CVE-2026-33985](https://insights.sbomify.com/CVE-2026-33985/): FreeRDP: ClearCodec Glyph Cache Count Desync - Heap OOB Read (medium 5.9)
- [CVE-2026-33984](https://insights.sbomify.com/CVE-2026-33984/): FreeRDP: ClearCodec resize_vbar_entry() Heap OOB Write (high 7.5)
- [CVE-2026-33983](https://insights.sbomify.com/CVE-2026-33983/): FreeRDP: Progressive Codec Quant BYTE Underflow - UB + CPU DoS (medium 6.5)
- [CVE-2026-33982](https://insights.sbomify.com/CVE-2026-33982/): FreeRDP: Persistent Cache Allocator Mismatch - Heap OOB Read (high 7.1)
- [CVE-2026-33981](https://insights.sbomify.com/CVE-2026-33981/): Changedetection.io Discloses Environment Variables via jq env Builtin in Include Filters (high 8.3)
- [CVE-2026-33980](https://insights.sbomify.com/CVE-2026-33980/): Azure Data Explorer MCP Server: KQL Injection in multiple tools allows MCP client to execute arbitrary Kusto queries (high 8.3)
- [CVE-2026-3398](https://insights.sbomify.com/CVE-2026-3398/): Tenda F453 httpd AdvSetWan fromAdvSetWan buffer overflow (high 8.7)
- [CVE-2026-33979](https://insights.sbomify.com/CVE-2026-33979/): Express XSS Sanitizer: allowedTags/allowedAttributes bypass leads to permissive sanitization (XSS risk) (high 8.2)
- [CVE-2026-33978](https://insights.sbomify.com/CVE-2026-33978/): Notesnook: Stored XSS in mobile share editor via unescaped web clip title metadata (medium 5.4)
- [CVE-2026-33977](https://insights.sbomify.com/CVE-2026-33977/): FreeRDP: DoS via WINPR_ASSERT in IMA ADPCM audio decoder (dsp.c:331) (medium 6.9)
- [CVE-2026-33976](https://insights.sbomify.com/CVE-2026-33976/): Notesnook vulnerable to RCE via stored XSS in Web Clipper rendering (critical 9.7)
- [CVE-2026-33975](https://insights.sbomify.com/CVE-2026-33975/): twenty-server SSRF protection bypass via IPv4-mapped IPv6 address normalization (high 8.3)
- [CVE-2026-33970](https://insights.sbomify.com/CVE-2026-33970/): Null dereference in Exynos 850 firmware (low 3.5)
- [CVE-2026-33968](https://insights.sbomify.com/CVE-2026-33968/): Race condition in Exynos 1330 firmware (low 2.8)
- [CVE-2026-33967](https://insights.sbomify.com/CVE-2026-33967/): Memory corruption in Exynos 1330 firmware (low 2.8)
- [CVE-2026-33966](https://insights.sbomify.com/CVE-2026-33966/): Information disclosure in Exynos 1330 firmware (low 2.8)
- [CVE-2026-33964](https://insights.sbomify.com/CVE-2026-33964/): Memory corruption in Exynos 1580 firmware (medium 6.4)
- [CVE-2026-33963](https://insights.sbomify.com/CVE-2026-33963/): Memory corruption in Exynos 1330 firmware (high 7.5)
- [CVE-2026-33962](https://insights.sbomify.com/CVE-2026-33962/): Memory corruption in Exynos 850 firmware (low 2.8)
- [CVE-2026-33960](https://insights.sbomify.com/CVE-2026-33960/): Memory corruption in Exynos 1330 firmware (low 2.8)
- [CVE-2026-3396](https://insights.sbomify.com/CVE-2026-3396/): WCAPF – WooCommerce Ajax Product Filter <= 4.2.3 - Unauthenticated Time-Based SQL Injection (high 7.5)
- [CVE-2026-33957](https://insights.sbomify.com/CVE-2026-33957/): Memory corruption in Exynos 1580 firmware (medium 4.2)
- [CVE-2026-33956](https://insights.sbomify.com/CVE-2026-33956/): Memory corruption in Exynos 1330 firmware (low 2.8)
- [CVE-2026-33955](https://insights.sbomify.com/CVE-2026-33955/): Notesnook vulnerable to RCE via stored XSS in Note History diff viewer (high 8.6)
- [CVE-2026-33954](https://insights.sbomify.com/CVE-2026-33954/): LinkAce discloses private notesto unauthorized authenticated users via the web link detail page (medium 6.5)
- [CVE-2026-33953](https://insights.sbomify.com/CVE-2026-33953/): LinkAce's SSRF protection can be bypassed via internal hostname resolution in LinkAce (high 8.5)
- [CVE-2026-33952](https://insights.sbomify.com/CVE-2026-33952/): FreeRDP: DoS via WINPR_ASSERT in rts_read_auth_verifier_no_checks (medium 6.0)
- [CVE-2026-33951](https://insights.sbomify.com/CVE-2026-33951/): signalk-server: Unauthenticated Source Priorities Manipulation (medium 6.9)
- [CVE-2026-33950](https://insights.sbomify.com/CVE-2026-33950/): signalk-server: Privilege Escalation by Admin Role Injection via /enableSecurity (critical 9.4)
- [CVE-2026-3395](https://insights.sbomify.com/CVE-2026-3395/): MaxSite CMS MarkItUp Preview AJAX Endpoint preview-ajax.php eval code injection (medium 6.9)
- [CVE-2026-33949](https://insights.sbomify.com/CVE-2026-33949/): @tinacms/graphql has Path Traversal that leads to overwrite of arbitrary files (high 8.1)
- [CVE-2026-33948](https://insights.sbomify.com/CVE-2026-33948/): jq: Embedded-NUL Truncation in CLI JSON Input Path Causes Prefix-Only Validation of Malformed Input (low 2.9)
- [CVE-2026-33947](https://insights.sbomify.com/CVE-2026-33947/): jq: Unbounded Recursion in jv_setpath(), jv_getpath() and delpaths_sorted() (medium 6.2)
- [CVE-2026-33946](https://insights.sbomify.com/CVE-2026-33946/): MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay (high 8.2)
- [CVE-2026-33945](https://insights.sbomify.com/CVE-2026-33945/): Abitrary file write through systemd-creds option (critical 10.0)
- [CVE-2026-33943](https://insights.sbomify.com/CVE-2026-33943/): Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code (high 8.8)
- [CVE-2026-33942](https://insights.sbomify.com/CVE-2026-33942/): Saloon has insecure deserialization in AccessTokenAuthenticator (object injection / RCE) (high 8.1)
- [CVE-2026-33941](https://insights.sbomify.com/CVE-2026-33941/): Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options (high 8.3)
- [CVE-2026-33940](https://insights.sbomify.com/CVE-2026-33940/): Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial (high 8.1)
- [CVE-2026-3394](https://insights.sbomify.com/CVE-2026-3394/): jarikomppa soloud WAV File soloud_wav.cpp loadwav memory corruption (medium 4.8)
- [CVE-2026-33939](https://insights.sbomify.com/CVE-2026-33939/): Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation (high 7.5)
- [CVE-2026-33938](https://insights.sbomify.com/CVE-2026-33938/): Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block (high 8.1)
- [CVE-2026-33937](https://insights.sbomify.com/CVE-2026-33937/): Handlebars.js has JavaScript Injection via AST Type Confusion (critical 9.8)
- [CVE-2026-33936](https://insights.sbomify.com/CVE-2026-33936/): python-ecdsa: Denial of Service via improper DER length validation in crafted private keys (medium 5.3)
- [CVE-2026-33935](https://insights.sbomify.com/CVE-2026-33935/): MyTube has Unauthenticated Account Lockout via Shared Login Attempt State (high 7.7)
- [CVE-2026-33934](https://insights.sbomify.com/CVE-2026-33934/): OpenEMR's Missing Authorization in show-signature.php Allows Portal Patients to Read Staff Signatures (medium 4.3)
- [CVE-2026-33933](https://insights.sbomify.com/CVE-2026-33933/): Reflected XSS via Unescaped contextName Parameter in Custom Template Editor (medium 6.1)
- [CVE-2026-33932](https://insights.sbomify.com/CVE-2026-33932/): OpenEMR has Stored XSS in CCDA Preview via Unsanitized linkHtml Attributes (high 7.6)
- [CVE-2026-33931](https://insights.sbomify.com/CVE-2026-33931/): OpenEMR has IDOR in Portal Payment Page that Allows Cross-Patient Record Access (medium 6.5)
- [CVE-2026-33930](https://insights.sbomify.com/CVE-2026-33930/): Apache Traffic Server: Buffer overflow via Host field that has a long string value (high 8.2)
- [CVE-2026-3393](https://insights.sbomify.com/CVE-2026-3393/): jarikomppa soloud Audio File soloud_wav.cpp loadflac heap-based overflow (medium 4.8)
- [CVE-2026-33929](https://insights.sbomify.com/CVE-2026-33929/): Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code (medium 4.3)
- [CVE-2026-33924](https://insights.sbomify.com/CVE-2026-33924/): Authenticated RCE in update functionality in Guardian/CMC before 26.4.0 (high 7.5)
- [CVE-2026-33923](https://insights.sbomify.com/CVE-2026-33923/): Update bundle signature bypass in Guardian/CMC before 26.4.0 (high 7.5)
- [CVE-2026-33922](https://insights.sbomify.com/CVE-2026-33922/): Path traversal in the Offline archives functionality of the local web interface in Arc before v2.7.0 (medium 6.8)
- [CVE-2026-33921](https://insights.sbomify.com/CVE-2026-33921/): Npcap driver installed without administrator-only access restriction on Windows in Arc before v2.7.0 (medium 4.8)
- [CVE-2026-33920](https://insights.sbomify.com/CVE-2026-33920/): Cross-site request forgery in the Guardian/CMC login before 26.3.0 (medium 5.1)
- [CVE-2026-3392](https://insights.sbomify.com/CVE-2026-3392/): FascinatedBox lily lily_emitter.c eval_tree null pointer dereference (medium 4.8)
- [CVE-2026-33918](https://insights.sbomify.com/CVE-2026-33918/): OpenEMR Missing Authorization on Claim File Download Endpoint (high 7.6)
- [CVE-2026-33917](https://insights.sbomify.com/CVE-2026-33917/): OpenEMR has SQL Injection in CAMOS Form (high 8.8)
- [CVE-2026-33916](https://insights.sbomify.com/CVE-2026-33916/): Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection (medium 4.7)
- [CVE-2026-33915](https://insights.sbomify.com/CVE-2026-33915/): OpenEMR Missing ACL Checks on Insurance Company API Routes (medium 5.4)
- [CVE-2026-33914](https://insights.sbomify.com/CVE-2026-33914/): OpenEMR has SQL Injection in PostCalendar Category Delete (high 7.2)
- [CVE-2026-33913](https://insights.sbomify.com/CVE-2026-33913/): OpenEMR: XInclude Injection in CCDA Import Allows Reading Arbitrary Server Files (high 7.7)
- [CVE-2026-33912](https://insights.sbomify.com/CVE-2026-33912/): OpenEMR has reflected XSS in ajax_download.php via reportID parameter (medium 5.4)
- [CVE-2026-33911](https://insights.sbomify.com/CVE-2026-33911/): OpenEMR vulnerable to reflected XSS in graphs.php via title parameter (medium 5.4)
- [CVE-2026-33910](https://insights.sbomify.com/CVE-2026-33910/): OpenEMR has a SQL Injection Vulnerability in patient selection (high 7.2)
- [CVE-2026-3391](https://insights.sbomify.com/CVE-2026-3391/): FascinatedBox lily lily_emitter.c clear_storages out-of-bounds (medium 4.8)
- [CVE-2026-33909](https://insights.sbomify.com/CVE-2026-33909/): OpenEMR Vulnerable to SQL Injection via Unsanitized Variables in MedEx Recall/Reminder Processing (medium 5.9)
- [CVE-2026-33908](https://insights.sbomify.com/CVE-2026-33908/): ImageMagick is vulnerable to Stack Overflow in DestroyXMLTree() (high 7.5)
- [CVE-2026-33907](https://insights.sbomify.com/CVE-2026-33907/): Ella Core Panics during NAS Authentication Response/Failure with missing IEs (medium 6.5)
- [CVE-2026-33906](https://insights.sbomify.com/CVE-2026-33906/): Ella Core has Privilege Escalation via Database Restore by NetworkManager role (high 7.2)
- [CVE-2026-33905](https://insights.sbomify.com/CVE-2026-33905/): ImageMagick has an Out-of-Bounds read via -sample operation (medium 5.5)
- [CVE-2026-33904](https://insights.sbomify.com/CVE-2026-33904/): Ella Core has a Denial of Service via SCTP connection cleanup deadlock (medium 6.5)
- [CVE-2026-33903](https://insights.sbomify.com/CVE-2026-33903/): Ella Core panics when processing a crafted NGAP LocationReport message (medium 6.5)
- [CVE-2026-33902](https://insights.sbomify.com/CVE-2026-33902/): ImageMagick: Stack Overflow via Recursive FX Expression Parsing (medium 5.5)
- [CVE-2026-33901](https://insights.sbomify.com/CVE-2026-33901/): ImageMagick has a Heap Buffer Overflow via MVG decoder (high 7.5)
- [CVE-2026-33900](https://insights.sbomify.com/CVE-2026-33900/): ImageMagick has a Heap overflow caused by integer overflow/wraparound in viff encoder on 32-bit builds (medium 5.9)
- [CVE-2026-3390](https://insights.sbomify.com/CVE-2026-3390/): FascinatedBox lily Error Reporting lily_build_error.c patch_line_end out-of-bounds (medium 4.8)
- [CVE-2026-33899](https://insights.sbomify.com/CVE-2026-33899/): ImageMagick: Heap BufferOverflow write of single zero byte when parsing XML (medium 5.3)
- [CVE-2026-33898](https://insights.sbomify.com/CVE-2026-33898/): Local Incus UI web server vulnerable to nuthentication bypass (high 8.8)
- [CVE-2026-33897](https://insights.sbomify.com/CVE-2026-33897/): Incus vulnerable to arbitrary file read and write through pongo templates (critical 10.0)
- [CVE-2026-33896](https://insights.sbomify.com/CVE-2026-33896/): Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation) (high 7.4)
- [CVE-2026-33895](https://insights.sbomify.com/CVE-2026-33895/): Forge has signature forgery in Ed25519 due to missing S > L check (high 7.5)
- [CVE-2026-33894](https://insights.sbomify.com/CVE-2026-33894/): Forge has signature forgery in RSA-PKCS due to ASN.1 extra field (high 7.5)
- [CVE-2026-33893](https://insights.sbomify.com/CVE-2026-33893/): Hardcoded credentials in Teamcenter V2312 (high 8.7)
- [CVE-2026-33892](https://insights.sbomify.com/CVE-2026-33892/): Auth bypass in Industrial Edge Management Pro V1 (medium 5.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/704/