# Vulnerabilities published in 2026


- [CVE-2026-33891](https://insights.sbomify.com/CVE-2026-33891/): Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input (high 7.5)
- [CVE-2026-33890](https://insights.sbomify.com/CVE-2026-33890/): MyTube has an Unauthenticated Admin Privilege Escalation via Passkey Registration (high 8.9)
- [CVE-2026-3389](https://insights.sbomify.com/CVE-2026-3389/): Squirrel sqstdrex.cpp sqstd_rex_newnode null pointer dereference (medium 4.8)
- [CVE-2026-33889](https://insights.sbomify.com/CVE-2026-33889/): ApostropheCMS: Stored XSS via CSS Custom Property Injection in `@apostrophecms/color-field` Escaping Style Tag Context (medium 5.4)
- [CVE-2026-33888](https://insights.sbomify.com/CVE-2026-33888/): ApostropheCMS: publicApiProjection Bypass via `project` Query Builder in Piece-Type REST API (medium 5.3)
- [CVE-2026-33887](https://insights.sbomify.com/CVE-2026-33887/): Statamic allows unauthorized content access through missing authorization in its revision controllers (medium 5.4)
- [CVE-2026-33886](https://insights.sbomify.com/CVE-2026-33886/): Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields (medium 6.5)
- [CVE-2026-33885](https://insights.sbomify.com/CVE-2026-33885/): Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differential (medium 6.1)
- [CVE-2026-33884](https://insights.sbomify.com/CVE-2026-33884/): Statamic's live preview token bypasses content protection for unrelated entries (medium 4.3)
- [CVE-2026-33883](https://insights.sbomify.com/CVE-2026-33883/): Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag (medium 6.1)
- [CVE-2026-33882](https://insights.sbomify.com/CVE-2026-33882/): Statamic's Markdown preview endpoint exposes sensitive user data (medium 6.5)
- [CVE-2026-33881](https://insights.sbomify.com/CVE-2026-33881/): Code injection in windmill (high 7.3)
- [CVE-2026-3388](https://insights.sbomify.com/CVE-2026-3388/): Squirrel sqcompiler.cpp UnaryOP recursion (medium 4.8)
- [CVE-2026-33879](https://insights.sbomify.com/CVE-2026-33879/): FLIP doesn't have rate limiting or brute-force protection on login (low 2.7)
- [CVE-2026-33877](https://insights.sbomify.com/CVE-2026-33877/): ApostropheCMS: User Enumeration via Timing Side Channel in Password Reset Endpoint (low 3.7)
- [CVE-2026-33875](https://insights.sbomify.com/CVE-2026-33875/): Authenticator Vulnerable to Authentication Flow Hijack (critical 9.3)
- [CVE-2026-33874](https://insights.sbomify.com/CVE-2026-33874/): Authenticator vulnerable to Remote Code Execution (high 7.8)
- [CVE-2026-33873](https://insights.sbomify.com/CVE-2026-33873/): Langflow has Authenticated Code Execution in Agentic Assistant Validation (critical 9.3)
- [CVE-2026-33872](https://insights.sbomify.com/CVE-2026-33872/): elixir-nodejs has Cross-User Data Leakage or Information Disclosure due to Worker Protocol Race Condition (high 7.1)
- [CVE-2026-33871](https://insights.sbomify.com/CVE-2026-33871/): Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass (high 8.7)
- [CVE-2026-33870](https://insights.sbomify.com/CVE-2026-33870/): Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing (high 7.5)
- [CVE-2026-3387](https://insights.sbomify.com/CVE-2026-3387/): wren-lang wren wren_compiler.c getByteCountForArguments null pointer dereference (medium 4.8)
- [CVE-2026-33869](https://insights.sbomify.com/CVE-2026-33869/): Mastodon has a denial of service for quote authorization (medium 4.8)
- [CVE-2026-33868](https://insights.sbomify.com/CVE-2026-33868/): Mastodon has a GET-Based Open Redirect via '/web/%2F<domain>' (medium 4.3)
- [CVE-2026-33867](https://insights.sbomify.com/CVE-2026-33867/): AVideo has Plaintext Video Password Storage (critical 9.1)
- [CVE-2026-33866](https://insights.sbomify.com/CVE-2026-33866/): Authorization Bypass in MLflow AJAX Endpoint (medium 5.3)
- [CVE-2026-33865](https://insights.sbomify.com/CVE-2026-33865/): Stored XSS via unsafe YAML parsing in MLflow (medium 5.1)
- [CVE-2026-33862](https://insights.sbomify.com/CVE-2026-33862/): Cross-site scripting in Teamcenter V2312 (high 8.5)
- [CVE-2026-3386](https://insights.sbomify.com/CVE-2026-3386/): wren-lang wren wren_compiler.c emitOp out-of-bounds (medium 4.8)
- [CVE-2026-33858](https://insights.sbomify.com/CVE-2026-33858/): Apache Airflow: Unsafe Deserialization via Legacy Serialization Keys (__type/__var) Bypass in XCom API (high 8.8)
- [CVE-2026-33857](https://insights.sbomify.com/CVE-2026-33857/): Apache HTTP Server: Off-by-one OOB reads in AJP getter functions (medium 5.3)
- [CVE-2026-33856](https://insights.sbomify.com/CVE-2026-33856/): Missing Release of Memory after Effective Lifetime in MolotovCherry Android-ImageMagick7 (high 7.5)
- [CVE-2026-33855](https://insights.sbomify.com/CVE-2026-33855/): Integer Overflow or Wraparound in MolotovCherry Android-ImageMagick7 (medium 5.5)
- [CVE-2026-33854](https://insights.sbomify.com/CVE-2026-33854/): Out-of-bounds Write in MolotovCherry Android-ImageMagick7 (high 8.8)
- [CVE-2026-33853](https://insights.sbomify.com/CVE-2026-33853/): NULL Pointer Dereference in MolotovCherry Android-ImageMagick7 (medium 5.5)
- [CVE-2026-33852](https://insights.sbomify.com/CVE-2026-33852/): Missing Release of Memory after Effective Lifetime in MolotovCherry Android-ImageMagick7 (high 7.5)
- [CVE-2026-33851](https://insights.sbomify.com/CVE-2026-33851/): Improper Restriction of Operations within the Bounds of a Memory Buffer in joncampbell123 doslib (high 7.8)
- [CVE-2026-33850](https://insights.sbomify.com/CVE-2026-33850/): Out-of-bounds Write in WujekFoliarz DualSenseY-v2 (high 7.8)
- [CVE-2026-3385](https://insights.sbomify.com/CVE-2026-3385/): wren-lang wren wren_compiler.c resolveLocal recursion (medium 4.8)
- [CVE-2026-33849](https://insights.sbomify.com/CVE-2026-33849/): Improper Restriction of Operations within the Bounds of a Memory Buffer in linkingvision rapidvms (high 8.8)
- [CVE-2026-33848](https://insights.sbomify.com/CVE-2026-33848/): Improper Restriction of Operations within the Bounds of a Memory Buffer in linkingvision rapidvms (high 8.8)
- [CVE-2026-33847](https://insights.sbomify.com/CVE-2026-33847/): Improper Restriction of Operations within the Bounds of a Memory Buffer in linkingvision rapidvms (high 7.8)
- [CVE-2026-33846](https://insights.sbomify.com/CVE-2026-33846/): Gnutls: gnutls: denial of service via heap buffer overflow in dtls handshake fragment reassembly (high 7.5)
- [CVE-2026-33845](https://insights.sbomify.com/CVE-2026-33845/): Gnutls: gnutls: denial of service via dtls zero-length fragment (high 7.5)
- [CVE-2026-33844](https://insights.sbomify.com/CVE-2026-33844/): Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability (critical 9.0)
- [CVE-2026-33843](https://insights.sbomify.com/CVE-2026-33843/): Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability (critical 9.1)
- [CVE-2026-33842](https://insights.sbomify.com/CVE-2026-33842/): Windows File Explorer Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-33841](https://insights.sbomify.com/CVE-2026-33841/): Windows Kernel Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-33840](https://insights.sbomify.com/CVE-2026-33840/): Win32k Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-3384](https://insights.sbomify.com/CVE-2026-3384/): ChaiScript chaiscript_eval.hpp Function_Push_Pop recursion (medium 4.8)
- [CVE-2026-33839](https://insights.sbomify.com/CVE-2026-33839/): Win32k Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-33838](https://insights.sbomify.com/CVE-2026-33838/): Windows Message Queuing (MSMQ) Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-33837](https://insights.sbomify.com/CVE-2026-33837/): Windows TCP/IP Local Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-33835](https://insights.sbomify.com/CVE-2026-33835/): Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-33834](https://insights.sbomify.com/CVE-2026-33834/): Windows Event Logging Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-33833](https://insights.sbomify.com/CVE-2026-33833/): Azure Machine Learning Notebook Spoofing Vulnerability (high 8.2)
- [CVE-2026-3383](https://insights.sbomify.com/CVE-2026-3383/): ChaiScript boxed_number.hpp go divide by zero (medium 4.8)
- [CVE-2026-33829](https://insights.sbomify.com/CVE-2026-33829/): Windows Snipping Tool Spoofing Vulnerability (medium 4.3)
- [CVE-2026-33828](https://insights.sbomify.com/CVE-2026-33828/): Windows Device Health Attestation (DHA) Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-33827](https://insights.sbomify.com/CVE-2026-33827/): Windows TCP/IP Remote Code Execution Vulnerability (high 8.1)
- [CVE-2026-33826](https://insights.sbomify.com/CVE-2026-33826/): Windows Active Directory Remote Code Execution Vulnerability (high 8.0)
- [CVE-2026-33825](https://insights.sbomify.com/CVE-2026-33825/): Microsoft Defender Insufficient Granularity of Access Control (high 7.8, exploited in the wild)
- [CVE-2026-33824](https://insights.sbomify.com/CVE-2026-33824/): Microsoft Internet Key Exchange (IKE) Service Extensions Double Free (critical 9.8, exploited in the wild)
- [CVE-2026-33823](https://insights.sbomify.com/CVE-2026-33823/): Microsoft Team Events Portal Information Disclosure Vulnerability (critical 9.6)
- [CVE-2026-33822](https://insights.sbomify.com/CVE-2026-33822/): Microsoft Word Information Disclosure Vulnerability (medium 6.1)
- [CVE-2026-33821](https://insights.sbomify.com/CVE-2026-33821/): Microsoft Dynamics 365 Customer Insights Elevation of Privilege Vulnerability (high 7.7)
- [CVE-2026-3382](https://insights.sbomify.com/CVE-2026-3382/): ChaiScript boxed_number.hpp get_as memory corruption (medium 4.8)
- [CVE-2026-33819](https://insights.sbomify.com/CVE-2026-33819/): Microsoft Bing Remote Code Execution Vulnerability (critical 10.0)
- [CVE-2026-33818](https://insights.sbomify.com/CVE-2026-33818/): Enforce maximum recursion depth in encoding/asn1 (high 7.5)
- [CVE-2026-33816](https://insights.sbomify.com/CVE-2026-33816/): CVE-2026-33816 in github.com/jackc/pgx (critical 9.8)
- [CVE-2026-33815](https://insights.sbomify.com/CVE-2026-33815/): CVE-2026-33815 in github.com/jackc/pgx (critical 9.8)
- [CVE-2026-33814](https://insights.sbomify.com/CVE-2026-33814/): Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net (high 7.5)
- [CVE-2026-33813](https://insights.sbomify.com/CVE-2026-33813/): Panic when decoding large WEBP image on 32-bit platforms in golang.org/x/image (high 7.5)
- [CVE-2026-33812](https://insights.sbomify.com/CVE-2026-33812/): Excessive memory allocation when decoding malicious SFNT in golang.org/x/image (medium 6.1)
- [CVE-2026-33811](https://insights.sbomify.com/CVE-2026-33811/): Crash when handling long CNAME response in net (high 7.5)
- [CVE-2026-33810](https://insights.sbomify.com/CVE-2026-33810/): Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509 (high 7.5)
- [CVE-2026-3381](https://insights.sbomify.com/CVE-2026-3381/): Compress::Raw::Zlib versions through 2.219 for Perl use potentially insecure versions of zlib (critical 9.8)
- [CVE-2026-33809](https://insights.sbomify.com/CVE-2026-33809/): OOM from malicious IFD offset in golang.org/x/image/tiff (medium 5.3)
- [CVE-2026-33808](https://insights.sbomify.com/CVE-2026-33808/): @fastify/express has a middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons) (critical 9.1)
- [CVE-2026-33807](https://insights.sbomify.com/CVE-2026-33807/): @fastify/express vulnerable to middleware path doubling causing authentication bypass in child plugin scopes (critical 9.1)
- [CVE-2026-33806](https://insights.sbomify.com/CVE-2026-33806/): fastify vulnerable to Body Schema Validation Bypass via Leading Space in Content-Type Header (high 7.5)
- [CVE-2026-33805](https://insights.sbomify.com/CVE-2026-33805/): @fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers (critical 9.0)
- [CVE-2026-33804](https://insights.sbomify.com/CVE-2026-33804/): @fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes option (high 7.4)
- [CVE-2026-33803](https://insights.sbomify.com/CVE-2026-33803/): Junos OS Evolved: A port which has been inadvertently exposed can be reached by an attacker (medium 6.9)
- [CVE-2026-33802](https://insights.sbomify.com/CVE-2026-33802/): Junos OS: EX Series: Unauthorized users can execute service-impacting CLI command (medium 6.8)
- [CVE-2026-33801](https://insights.sbomify.com/CVE-2026-33801/): Junos OS and Junos OS Evolved: When a specifically malformed BGP route update is received RPD crashes (high 7.1)
- [CVE-2026-33800](https://insights.sbomify.com/CVE-2026-33800/): Junos OS: MX Series: In a VC scenario a high rate of micro-BFD session flaps will cause an FPC crash (high 7.1)
- [CVE-2026-3380](https://insights.sbomify.com/CVE-2026-3380/): Tenda F453 L7Im frmL7ImForm buffer overflow (high 8.7)
- [CVE-2026-33799](https://insights.sbomify.com/CVE-2026-33799/): Junos OS and Junos OS Evolved: Receipt of a specific SNMPv3 request results in memory leak and eventual snmpd crash (medium 5.3)
- [CVE-2026-33798](https://insights.sbomify.com/CVE-2026-33798/): Junos OS and Junos OS Evolved: SRX Series: An attacker causes remote code execution when SRX chassis-cluster is enabled (high 8.7)
- [CVE-2026-33797](https://insights.sbomify.com/CVE-2026-33797/): Junos OS and Junos OS Evolved: An attacker sending a specific genuine BGP packet causes a BGP reset (high 7.1)
- [CVE-2026-33796](https://insights.sbomify.com/CVE-2026-33796/): Junos OS and Junos OS Evolved: An attacker causes remote root command execution when BMP route monitoring is enabled (critical 9.3)
- [CVE-2026-33795](https://insights.sbomify.com/CVE-2026-33795/): Junos OS and Junos OS Evolved: An attacker causes a routing-daemon crash when BGP Prefix-SID routes are re-advertised (high 8.7)
- [CVE-2026-33794](https://insights.sbomify.com/CVE-2026-33794/): Junos OS Evolved: PTX Series: Receipt of repeated ECMP routing updates results in PFE crash (high 8.2)
- [CVE-2026-33793](https://insights.sbomify.com/CVE-2026-33793/): Privilege escalation in Junos OS (high 8.5)
- [CVE-2026-33792](https://insights.sbomify.com/CVE-2026-33792/): Junos OS: SRX Series: An attacker causes remote code execution and denial of service when a GRE tunnel is configured (critical 9.3)
- [CVE-2026-33791](https://insights.sbomify.com/CVE-2026-33791/): Junos OS and Junos OS Evolved: Execution of crafted CLI commands allows for arbitrary shell injection as root (high 8.4)
- [CVE-2026-33790](https://insights.sbomify.com/CVE-2026-33790/): Denial of service in Junos OS (high 8.7)
- [CVE-2026-3379](https://insights.sbomify.com/CVE-2026-3379/): Tenda F453 SetIpBind fromSetIpBind buffer overflow (high 8.7)
- [CVE-2026-33789](https://insights.sbomify.com/CVE-2026-33789/): Memory corruption in Junos OS (critical 9.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/705/