# Vulnerabilities published in 2026


- [CVE-2026-33595](https://insights.sbomify.com/CVE-2026-33595/): DoQ/DoH3 excessive memory allocation (medium 5.3)
- [CVE-2026-33594](https://insights.sbomify.com/CVE-2026-33594/): Outgoing DoH excessive memory allocation (medium 5.3)
- [CVE-2026-33593](https://insights.sbomify.com/CVE-2026-33593/): Denial of service via crafted DNSCrypt query (high 7.5)
- [CVE-2026-33592](https://insights.sbomify.com/CVE-2026-33592/): FindServers Memory Exhaustion in open62541 (high 7.5)
- [CVE-2026-33591](https://insights.sbomify.com/CVE-2026-33591/): Authentication bypass on WaptServer (critical 10.0)
- [CVE-2026-33590](https://insights.sbomify.com/CVE-2026-33590/): Insecure default permissions in Portainer CE (high 8.5)
- [CVE-2026-3359](https://insights.sbomify.com/CVE-2026-3359/): SQL injection in Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder (high 7.5)
- [CVE-2026-33589](https://insights.sbomify.com/CVE-2026-33589/): Arbitrary File Read via Local File Inclusion (LFI) (high 8.2)
- [CVE-2026-33588](https://insights.sbomify.com/CVE-2026-33588/): Arbitrary File Write Through Path Traversal (high 7.0)
- [CVE-2026-33587](https://insights.sbomify.com/CVE-2026-33587/): Remote Code Execution (RCE) via Server-Side Template Injection (SSTI) (critical 9.2)
- [CVE-2026-33586](https://insights.sbomify.com/CVE-2026-33586/): Authenticated SMTP Sender Address Forgery (medium 6.3)
- [CVE-2026-33585](https://insights.sbomify.com/CVE-2026-33585/): Arqit SKA-Platform Improper Handling of Parameters Vulnerability (low 3.8)
- [CVE-2026-33584](https://insights.sbomify.com/CVE-2026-33584/): Arqit SKA-Platform Enables Access to Debug Information (medium 5.3)
- [CVE-2026-33583](https://insights.sbomify.com/CVE-2026-33583/): Arqit SKA-Platform Vulnerable to Key Exposure (high 8.7)
- [CVE-2026-33582](https://insights.sbomify.com/CVE-2026-33582/): Apache Answer: Uploading specially crafted TIFF files causes an Out-of-Memory error (medium 6.5)
- [CVE-2026-33581](https://insights.sbomify.com/CVE-2026-33581/): OpenClaw < 2026.3.24 - Arbitrary File Read via mediaUrl and fileUrl Parameters (high 7.1)
- [CVE-2026-33580](https://insights.sbomify.com/CVE-2026-33580/): OpenClaw < 2026.3.28 - Brute Force Attack via Missing Rate Limiting on Webhook Shared Secret Authentication (medium 6.3)
- [CVE-2026-3358](https://insights.sbomify.com/CVE-2026-3358/): Tutor LMS <= 3.9.7 - Missing Authorization to Authenticated (Subscriber+) Unauthorized Private Course Enrollment (medium 5.4)
- [CVE-2026-33579](https://insights.sbomify.com/CVE-2026-33579/): OpenClaw < 2026.3.28 - Privilege Escalation via Missing Caller Scope Validation in Device Pair Approval (critical 9.4)
- [CVE-2026-33578](https://insights.sbomify.com/CVE-2026-33578/): OpenClaw < 2026.3.28 - Sender Policy Allowlist Bypass via Policy Downgrade in Google Chat and Zalouser Extensions (medium 5.3)
- [CVE-2026-33577](https://insights.sbomify.com/CVE-2026-33577/): OpenClaw < 2026.3.28 - Insufficient Scope Validation in node.pair.approve (high 8.6)
- [CVE-2026-33576](https://insights.sbomify.com/CVE-2026-33576/): OpenClaw < 2026.3.28 - Unauthorized Media Download via Zalo Channel (medium 6.9)
- [CVE-2026-33575](https://insights.sbomify.com/CVE-2026-33575/): OpenClaw < 2026.3.12 - Long-lived Credential Exposure in Pairing Setup Codes (high 8.6)
- [CVE-2026-33574](https://insights.sbomify.com/CVE-2026-33574/): OpenClaw < 2026.3.8 - Path Traversal via Tools Root Rebinding in Skills Download (medium 5.8)
- [CVE-2026-33573](https://insights.sbomify.com/CVE-2026-33573/): OpenClaw < 2026.3.11 - Workspace Boundary Bypass via Agent RPC Parameters (high 8.7)
- [CVE-2026-33572](https://insights.sbomify.com/CVE-2026-33572/): OpenClaw < 2026.2.17 - Insufficient File Permissions in Session Transcript Files (medium 6.8)
- [CVE-2026-33570](https://insights.sbomify.com/CVE-2026-33570/): Subnet Solutions PowerSYSTEM Center Incorrect Authorization (medium 6.9)
- [CVE-2026-3357](https://insights.sbomify.com/CVE-2026-3357/): IBM Langflow Desktop FAISS Vector Store Remote Code Execution via malicious Pickle file (high 8.8)
- [CVE-2026-33569](https://insights.sbomify.com/CVE-2026-33569/): Anviz Products Cleartext Transmission of Sensitive Information (medium 6.5)
- [CVE-2026-33568](https://insights.sbomify.com/CVE-2026-33568/): Command injection in Totolink (critical 9.1)
- [CVE-2026-33566](https://insights.sbomify.com/CVE-2026-33566/): Code injection in LogonTracer (medium 5.1)
- [CVE-2026-33565](https://insights.sbomify.com/CVE-2026-33565/): kernel_linux_common_modules has a Race Condition vulnerability (low 3.3)
- [CVE-2026-33560](https://insights.sbomify.com/CVE-2026-33560/): Daktronics Controller Firmware Unrestricted Upload of File with Dangerous Type (high 8.4)
- [CVE-2026-3356](https://insights.sbomify.com/CVE-2026-3356/): Missing Authentication for Critical Function vulnerability in Anritsu Remote Spectrum Monitor (critical 9.3)
- [CVE-2026-33559](https://insights.sbomify.com/CVE-2026-33559/): Cross-site scripting in OpenStreetMap (medium 5.1)
- [CVE-2026-33558](https://insights.sbomify.com/CVE-2026-33558/): Apache Kafka, Apache Kafka Clients: Information Exposure Through Network Client Log Output (medium 5.3)
- [CVE-2026-33557](https://insights.sbomify.com/CVE-2026-33557/): Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication (critical 9.1)
- [CVE-2026-33555](https://insights.sbomify.com/CVE-2026-33555/): Other in HAProxy (medium 4.0)
- [CVE-2026-33554](https://insights.sbomify.com/CVE-2026-33554/): Memory corruption in FreeIPMI (high 7.5)
- [CVE-2026-33553](https://insights.sbomify.com/CVE-2026-33553/): Northern.tech CFEngine Enterprise 3.24.3 before 3.24.4 and 3.27.0 before 3.27.1 allows XSS. (medium 6.1)
- [CVE-2026-33552](https://insights.sbomify.com/CVE-2026-33552/): Northern.tech Mender Enterprise Server before 4.1.1 has Incorrect Access Control. (low 3.7)
- [CVE-2026-33551](https://insights.sbomify.com/CVE-2026-33551/): OpenStack Keystone: Restricted application credentials can create EC2 credentials (low 3.5)
- [CVE-2026-33550](https://insights.sbomify.com/CVE-2026-33550/): Weak cryptography in SOGo (low 2.0)
- [CVE-2026-3355](https://insights.sbomify.com/CVE-2026-3355/): Customer Reviews for WooCommerce <= 5.101.0 - Reflected Cross-Site Scripting via 'crsearch' (medium 6.1)
- [CVE-2026-33549](https://insights.sbomify.com/CVE-2026-33549/): Privilege escalation in SPIP (medium 6.7)
- [CVE-2026-33548](https://insights.sbomify.com/CVE-2026-33548/): MantisBT has Stored HTML Injection / XSS when displaying Tags in Timeline (high 8.6)
- [CVE-2026-33545](https://insights.sbomify.com/CVE-2026-33545/): MobSF has SQL Injection in its SQLite Database Viewer Utils (medium 5.3)
- [CVE-2026-33544](https://insights.sbomify.com/CVE-2026-33544/): Tinyauth has OAuth account confusion via shared mutable state on singleton service instances (high 7.7)
- [CVE-2026-33543](https://insights.sbomify.com/CVE-2026-33543/): FOSSBilling: Authentication bypass allows unauthenticated administrator creation (critical 9.3)
- [CVE-2026-33542](https://insights.sbomify.com/CVE-2026-33542/): Incus does not verify combined fingerprint when downloading images from simplestreams servers (medium 5.7)
- [CVE-2026-33541](https://insights.sbomify.com/CVE-2026-33541/): TSPortal's Uncontrolled User Creation via Validation Side Effects Leads to Potential Denial of Service (medium 6.5)
- [CVE-2026-33540](https://insights.sbomify.com/CVE-2026-33540/): Distribution affected by pull-through cache credential exfiltration via www-authenticate bearer realm (high 7.5)
- [CVE-2026-3354](https://insights.sbomify.com/CVE-2026-3354/): Wikilookup <= 1.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Popup Width' Setting (medium 4.4)
- [CVE-2026-33539](https://insights.sbomify.com/CVE-2026-33539/): Parse Server: SQL injection via aggregate and distinct field names in PostgreSQL adapter (high 8.6)
- [CVE-2026-33538](https://insights.sbomify.com/CVE-2026-33538/): Parse Server: Denial of service via unindexed database query for unconfigured auth providers (high 8.7)
- [CVE-2026-33537](https://insights.sbomify.com/CVE-2026-33537/): Lychee has SSRF bypass via incomplete IP validation in Photo::fromUrl — loopback and link-local IPs not blocked (medium 5.3)
- [CVE-2026-33536](https://insights.sbomify.com/CVE-2026-33536/): ImageMagick has an Out-of-bounds Write via InterpretImageFilename (medium 5.1)
- [CVE-2026-33535](https://insights.sbomify.com/CVE-2026-33535/): ImageMagick has an Out-of-Bounds write of a zero byte in its X11 display interaction (medium 4.0)
- [CVE-2026-33534](https://insights.sbomify.com/CVE-2026-33534/): EspoCRM has authenticated SSRF via internal-host validation bypass using alternative IPv4 notation (medium 4.3)
- [CVE-2026-33533](https://insights.sbomify.com/CVE-2026-33533/): Glances Vulnerable to Cross-Origin System Information Disclosure via XML-RPC Server CORS Wildcard (high 7.1)
- [CVE-2026-33532](https://insights.sbomify.com/CVE-2026-33532/): yaml is vulnerable to Stack Overflow via deeply nested YAML collections (medium 4.3)
- [CVE-2026-33531](https://insights.sbomify.com/CVE-2026-33531/): InvenTree has Path Traversal In Report Templates (medium 4.9)
- [CVE-2026-33530](https://insights.sbomify.com/CVE-2026-33530/): InvenTree Vulnerable to ORM Filter Injection (high 7.7)
- [CVE-2026-3353](https://insights.sbomify.com/CVE-2026-3353/): Comment SPAM Wiper <= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'API Key' Setting (medium 4.4)
- [CVE-2026-33529](https://insights.sbomify.com/CVE-2026-33529/): Zoraxy: Authenticated Path Traversal in Config Import leads to RCE (low 3.3)
- [CVE-2026-33528](https://insights.sbomify.com/CVE-2026-33528/): GoDoxy has a Path Traversal Vulnerability in its File API (medium 6.5)
- [CVE-2026-33527](https://insights.sbomify.com/CVE-2026-33527/): Parse Server: Session update endpoint allows overwriting server-generated session fields (medium 5.3)
- [CVE-2026-33526](https://insights.sbomify.com/CVE-2026-33526/): Squid vulnerable to Denial of Service in ICP Request handling (critical 9.2)
- [CVE-2026-33525](https://insights.sbomify.com/CVE-2026-33525/): Authelia: Improper Neutralization of Input During Web Page Generation Leads to Potential Cross-site Scripting (low 0.5)
- [CVE-2026-33524](https://insights.sbomify.com/CVE-2026-33524/): Zserio: Integer Overflow in BitStreamReader and Unbounded Memory Allocation in Deserialization (high 7.5)
- [CVE-2026-33523](https://insights.sbomify.com/CVE-2026-33523/): Apache HTTP Server: multiple modules: HTTP response splitting forwarding malicious status line (medium 6.5)
- [CVE-2026-33522](https://insights.sbomify.com/CVE-2026-33522/): BUG-000182936 - ArcGIS Server has a security vulnerability. (medium 5.3)
- [CVE-2026-33521](https://insights.sbomify.com/CVE-2026-33521/): BUG-000186514 - ArcGIS Server has a security vulnerability. (high 7.5)
- [CVE-2026-33520](https://insights.sbomify.com/CVE-2026-33520/): BUG-000185167 - ArcGIS Server has a security vulnerability. (medium 6.1)
- [CVE-2026-3352](https://insights.sbomify.com/CVE-2026-3352/): Easy PHP Settings <= 1.0.4 - Authenticated (Administrator+) PHP Code Injection via 'wp_memory_limit' Setting (high 7.2)
- [CVE-2026-33519](https://insights.sbomify.com/CVE-2026-33519/): Incorrect privilege assignment in Portal for ArcGIS (critical 9.8)
- [CVE-2026-33518](https://insights.sbomify.com/CVE-2026-33518/): Incorrect privilege assignment in Portal for ArcGIS (critical 9.8)
- [CVE-2026-33517](https://insights.sbomify.com/CVE-2026-33517/): MantisBT Vulnerable to Stored HTML Injection in Tag Delete Confirmation (high 8.6)
- [CVE-2026-33516](https://insights.sbomify.com/CVE-2026-33516/): xrdp: Pre-authentication out-of-bounds reads in RDP capability and channel parsers (high 7.7)
- [CVE-2026-33515](https://insights.sbomify.com/CVE-2026-33515/): Squid has issues in ICP message handling (medium 6.9)
- [CVE-2026-33514](https://insights.sbomify.com/CVE-2026-33514/): Discourse: Information Disclosure in Form Template API Due to Missing Authorization (medium 6.0)
- [CVE-2026-33513](https://insights.sbomify.com/CVE-2026-33513/): AVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP) (high 8.6)
- [CVE-2026-33512](https://insights.sbomify.com/CVE-2026-33512/): AVideo has an unauthenticated decrypt oracle leaking any ciphertext (high 7.5)
- [CVE-2026-33511](https://insights.sbomify.com/CVE-2026-33511/): pyload-ng: Authentication Bypass via Host Header Injection in ClickNLoad (high 8.8)
- [CVE-2026-33510](https://insights.sbomify.com/CVE-2026-33510/): DOM-Based XSS in Homarr /auth/login Redirect (high 8.8)
- [CVE-2026-3351](https://insights.sbomify.com/CVE-2026-3351/): Authorization Bypass in LXD GET /1.0/certificates Endpoint (low 2.1)
- [CVE-2026-33509](https://insights.sbomify.com/CVE-2026-33509/): pyload-ng: SETTINGS Permission Users Can Achieve Remote Code Execution via Unrestricted Reconnect Script Configuration (high 7.5)
- [CVE-2026-33508](https://insights.sbomify.com/CVE-2026-33508/): Parse Server: LiveQuery subscription query depth bypass (high 8.2)
- [CVE-2026-33507](https://insights.sbomify.com/CVE-2026-33507/): AVideo Affected by CSRF on Plugin Import Endpoint Enables Unauthenticated Remote Code Execution via Malicious Plugin Upload (high 8.8)
- [CVE-2026-33506](https://insights.sbomify.com/CVE-2026-33506/): DOM-Based XSS in Ory Polis Login Page (high 8.8)
- [CVE-2026-33505](https://insights.sbomify.com/CVE-2026-33505/): Ory Keto has a SQL injection via forged pagination tokens (high 7.2)
- [CVE-2026-33504](https://insights.sbomify.com/CVE-2026-33504/): Ory Hydra has a SQL injection via forged pagination tokens (high 7.2)
- [CVE-2026-33503](https://insights.sbomify.com/CVE-2026-33503/): Ory Kratos has a SQL injection via forged pagination tokens (high 7.2)
- [CVE-2026-33502](https://insights.sbomify.com/CVE-2026-33502/): AVideo has Unauthenticated SSRF via plugin/Live/test.php (critical 9.3)
- [CVE-2026-33501](https://insights.sbomify.com/CVE-2026-33501/): AVideo has Unauthenticated Information Disclosure of User Group Permission Mappings via Permissions Plugin (medium 5.3)
- [CVE-2026-33500](https://insights.sbomify.com/CVE-2026-33500/): AVideo Vulnerable to Stored XSS via Markdown `javascript:` URI Bypasses ParsedownSafeWithLinks Sanitization (medium 5.4)
- [CVE-2026-3350](https://insights.sbomify.com/CVE-2026-3350/): Image Alt Text Manager <= 1.8.2 - Authenticated (Author+) Stored Cross-Site Scripting via Post Title (medium 6.4)
- [CVE-2026-33499](https://insights.sbomify.com/CVE-2026-33499/): AVideo has Reflected XSS via unlockPassword Parameter in forbiddenPage.php and warningPage.php (medium 6.1)
- [CVE-2026-33498](https://insights.sbomify.com/CVE-2026-33498/): Parse Server: Query condition depth bypass via pre-validation transform pipeline (high 8.7)
- [CVE-2026-33497](https://insights.sbomify.com/CVE-2026-33497/): Langflow: /profile_pictures/{folder_name}/{file_name} endpoint file reading (high 8.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/708/