# Vulnerabilities published in 2026


- [CVE-2026-32678](https://insights.sbomify.com/CVE-2026-32678/): Auth bypass in BUFFALO Wi-Fi router products (high 8.7)
- [CVE-2026-32677](https://insights.sbomify.com/CVE-2026-32677/): Path traversal in gaudi-container-runtime (medium 5.4)
- [CVE-2026-32673](https://insights.sbomify.com/CVE-2026-32673/): BIG-IP scripted monitor vulnerability (high 8.5)
- [CVE-2026-32669](https://insights.sbomify.com/CVE-2026-32669/): Code injection in BUFFALO Wi-Fi router products (high 8.7)
- [CVE-2026-32666](https://insights.sbomify.com/CVE-2026-32666/): Automated Logic WebCTRL Premium Server Authentication Bypass by Spoofing (high 7.5)
- [CVE-2026-32665](https://insights.sbomify.com/CVE-2026-32665/): Remote DNS-over-QUIC denial of service due to `quic-size` budget bypass (high 7.5)
- [CVE-2026-32663](https://insights.sbomify.com/CVE-2026-32663/): IGL-Technologies eParking.fi Insufficient Session Expiration (medium 6.9)
- [CVE-2026-32662](https://insights.sbomify.com/CVE-2026-32662/): Gardyn Cloud API Active Debug Code (medium 6.9)
- [CVE-2026-32661](https://insights.sbomify.com/CVE-2026-32661/): Memory corruption in GUARDIANWALL Mail Security Cloud (SaaS version) (critical 9.3)
- [CVE-2026-3266](https://insights.sbomify.com/CVE-2026-3266/): Improper access control vulnerability has been discovered in OpenText™ Filr. (high 8.3)
- [CVE-2026-32658](https://insights.sbomify.com/CVE-2026-32658/): Missing authorization in Automation Platform (high 8.0)
- [CVE-2026-32657](https://insights.sbomify.com/CVE-2026-32657/): Privilege escalation in AppSync (high 7.3)
- [CVE-2026-32655](https://insights.sbomify.com/CVE-2026-32655/): Privilege escalation in Alienware Command Center (AWCC) (medium 5.3)
- [CVE-2026-32652](https://insights.sbomify.com/CVE-2026-32652/): Hardcoded credentials in AIOps (high 7.8)
- [CVE-2026-32650](https://insights.sbomify.com/CVE-2026-32650/): Anviz CrossChex Standard Algorithm Downgrade (high 7.5)
- [CVE-2026-3265](https://insights.sbomify.com/CVE-2026-3265/): go2ismail Free-CRM Security API improper authorization (medium 5.3)
- [CVE-2026-32649](https://insights.sbomify.com/CVE-2026-32649/): Milesight Cameras OS Command Injection (high 7.3)
- [CVE-2026-32648](https://insights.sbomify.com/CVE-2026-32648/): Anviz Products Missing Authorization (medium 5.3)
- [CVE-2026-32647](https://insights.sbomify.com/CVE-2026-32647/): NGINX ngx_http_mp4_module vulnerability (high 8.5)
- [CVE-2026-32646](https://insights.sbomify.com/CVE-2026-32646/): Gardyn Cloud API Missing Authentication for Critical Function (high 8.7)
- [CVE-2026-32645](https://insights.sbomify.com/CVE-2026-32645/): Red Lion Controls N-Tron 700 Series Use of Hard-Coded Credentials (critical 9.2)
- [CVE-2026-32644](https://insights.sbomify.com/CVE-2026-32644/): Milesight Cameras Use of Hard-coded Cryptographic Key (critical 9.2)
- [CVE-2026-32643](https://insights.sbomify.com/CVE-2026-32643/): BIG-IP and BIG-IQ privilege escalation vulnerability (high 8.5)
- [CVE-2026-32642](https://insights.sbomify.com/CVE-2026-32642/): Apache Artemis: Unauthorized Temporary Address Creation via OpenWire Protocol (low 2.3)
- [CVE-2026-32641](https://insights.sbomify.com/CVE-2026-32641/): Parseable: Unauthenticated Denial of Service via panic in Kinesis header parsing middleware (high 7.5)
- [CVE-2026-32640](https://insights.sbomify.com/CVE-2026-32640/): (SimpleEval) Objects (including modules) can leak dangerous modules through to direct access inside the sandbox. (high 8.7)
- [CVE-2026-3264](https://insights.sbomify.com/CVE-2026-3264/): go2ismail Free-CRM Administrative redirect (medium 5.3)
- [CVE-2026-32639](https://insights.sbomify.com/CVE-2026-32639/): Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads (medium 6.8)
- [CVE-2026-32638](https://insights.sbomify.com/CVE-2026-32638/): StudioCMS REST getUsers Exposes Owner Account Records to Admin Tokens (low 2.7)
- [CVE-2026-32637](https://insights.sbomify.com/CVE-2026-32637/): Velero vulnerable to file path traversal when extracting from backup's tarball (medium 5.9)
- [CVE-2026-32636](https://insights.sbomify.com/CVE-2026-32636/): ImageMagick has a heap-buffer-overflow in NewXMLTree which could result in crash (medium 5.3)
- [CVE-2026-32635](https://insights.sbomify.com/CVE-2026-32635/): Angular has XSS in i18n attribute bindings (high 8.6)
- [CVE-2026-32634](https://insights.sbomify.com/CVE-2026-32634/): Glances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers (high 8.1)
- [CVE-2026-32633](https://insights.sbomify.com/CVE-2026-32633/): Glances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist` (critical 9.1)
- [CVE-2026-32632](https://insights.sbomify.com/CVE-2026-32632/): Glances's REST/WebUI Lacks Host Validation and Remains Exposed to DNS Rebinding (medium 5.9)
- [CVE-2026-32631](https://insights.sbomify.com/CVE-2026-32631/): Git for Windows: `git clone` from manipulated repositories can leak NTLM hashes to arbitrary servers (high 7.4)
- [CVE-2026-32630](https://insights.sbomify.com/CVE-2026-32630/): file-type affected by ZIP Decompression Bomb DoS via [Content_Types].xml entry (medium 5.3)
- [CVE-2026-3263](https://insights.sbomify.com/CVE-2026-3263/): go2ismail Asp.Net-Core-Inventory-Order-Management-System Security API improper authorization (medium 5.3)
- [CVE-2026-32629](https://insights.sbomify.com/CVE-2026-32629/): phpMyFAQ: Stored XSS via Unsanitized Email Field in Admin FAQ Editor (medium 5.4)
- [CVE-2026-32628](https://insights.sbomify.com/CVE-2026-32628/): AnythingLLM has SQL Injection in Built-in SQL Agent Plugin via Unsanitized table_name Parameter (high 7.7)
- [CVE-2026-32627](https://insights.sbomify.com/CVE-2026-32627/): cpp-httplib has a Silent TLS Certificate Verification Bypass on HTTPS Redirect via Proxy (high 8.7)
- [CVE-2026-32626](https://insights.sbomify.com/CVE-2026-32626/): AnythingLLM has a Streaming Phase XSS to RCE via LLM Response Injection (critical 9.7)
- [CVE-2026-32625](https://insights.sbomify.com/CVE-2026-32625/): LibreChat Exfiltrates Server Secrets via MCP Server URL Injection (critical 9.6)
- [CVE-2026-32624](https://insights.sbomify.com/CVE-2026-32624/): xrdp: Heap buffer overflow in xrdp_sec_process_logon_info() via incorrect g_strncat length calculation (medium 6.3)
- [CVE-2026-32623](https://insights.sbomify.com/CVE-2026-32623/): xrdp: Heap buffer overflow in NeutrinoRDP channel reassembly (high 7.7)
- [CVE-2026-32622](https://insights.sbomify.com/CVE-2026-32622/): SQLBot: Remote Code Execution via Terminology Poisoning (high 8.6)
- [CVE-2026-32621](https://insights.sbomify.com/CVE-2026-32621/): Apollo Federation has prototype pollution via incomplete key sanitization (critical 9.9)
- [CVE-2026-32620](https://insights.sbomify.com/CVE-2026-32620/): Discourse: Missing post-level authorization allows whisper metadata disclosure (medium 5.3)
- [CVE-2026-3262](https://insights.sbomify.com/CVE-2026-3262/): go2ismail Asp.Net-Core-Inventory-Order-Management-System Administrative redirect (medium 5.3)
- [CVE-2026-32619](https://insights.sbomify.com/CVE-2026-32619/): Discourse: Insufficient topic visibility check allows unauthorized poll manipulation in private categories (medium 6.3)
- [CVE-2026-32618](https://insights.sbomify.com/CVE-2026-32618/): Discourse: Unauthorized channel membership inference via excluded_memberships_channel_id (medium 4.3)
- [CVE-2026-32617](https://insights.sbomify.com/CVE-2026-32617/): AnythingLLM Permissable CORS policy (high 7.1)
- [CVE-2026-32616](https://insights.sbomify.com/CVE-2026-32616/): Pigeon has a Host Header Injection in email verification flow (high 8.2)
- [CVE-2026-32615](https://insights.sbomify.com/CVE-2026-32615/): Discourse: Category group moderators can perform actions on topics in restricted categories without read access (medium 5.3)
- [CVE-2026-32614](https://insights.sbomify.com/CVE-2026-32614/): Go ShangMi SM9 Infinity-Point Ciphertext Forgery Vulnerability (high 7.5)
- [CVE-2026-32613](https://insights.sbomify.com/CVE-2026-32613/): Spinnaker vulnerable to RCE via expression parsing due to unrestricted context handling (critical 10.0)
- [CVE-2026-32612](https://insights.sbomify.com/CVE-2026-32612/): Statamic: privilege escalation via stored cross-site scripting (medium 5.4)
- [CVE-2026-32611](https://insights.sbomify.com/CVE-2026-32611/): Glances has a SQL Injection in DuckDB Export via Unparameterized DDL Statements (high 7.0)
- [CVE-2026-32610](https://insights.sbomify.com/CVE-2026-32610/): Glances's Default CORS Configuration Allows Cross-Origin Credential Theft (high 8.1)
- [CVE-2026-3261](https://insights.sbomify.com/CVE-2026-3261/): itsourcecode School Management System Setting index.php sql injection (medium 6.9)
- [CVE-2026-32609](https://insights.sbomify.com/CVE-2026-32609/): Glances has Incomplete Secrets Redaction: /api/v4/args Endpoint Leaks Password Hash and SNMP Credentials (high 7.5)
- [CVE-2026-32608](https://insights.sbomify.com/CVE-2026-32608/): Glances has a Command Injection via Process Names in Action Command Templates (high 7.0)
- [CVE-2026-32607](https://insights.sbomify.com/CVE-2026-32607/): Discourse: Stored XSS via unescaped assignee name (low 2.1)
- [CVE-2026-32606](https://insights.sbomify.com/CVE-2026-32606/): IncusOS has a LUKS encryption bypass due to insufficient TPM policy (high 7.7)
- [CVE-2026-32605](https://insights.sbomify.com/CVE-2026-32605/): Nimiq: Remote crash via off-by-one signer bounds check in proposal buffer (high 7.5)
- [CVE-2026-32604](https://insights.sbomify.com/CVE-2026-32604/): Spinnaker: RCE when using gitrepo artifact types due to improper sanitization of user input on branch and paths (critical 10.0)
- [CVE-2026-32603](https://insights.sbomify.com/CVE-2026-32603/): Sandboxie kernel driver denial of service via malformed IOCTL from sandboxed process (high 8.2)
- [CVE-2026-32602](https://insights.sbomify.com/CVE-2026-32602/): Homarr has a Race Condition in Invite Token Registration (TOCTOU) (medium 4.2)
- [CVE-2026-32600](https://insights.sbomify.com/CVE-2026-32600/): xml-security is Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption (high 8.2)
- [CVE-2026-32599](https://insights.sbomify.com/CVE-2026-32599/): Netmaker has a boolean‑based SQL Injection (medium 5.3)
- [CVE-2026-32598](https://insights.sbomify.com/CVE-2026-32598/): OneUptime: Password Reset Token Logged at INFO Level (medium 6.9)
- [CVE-2026-32597](https://insights.sbomify.com/CVE-2026-32597/): PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation) (high 7.5)
- [CVE-2026-32596](https://insights.sbomify.com/CVE-2026-32596/): Glances exposes the REST API without authentication (high 8.7)
- [CVE-2026-32595](https://insights.sbomify.com/CVE-2026-32595/): Traefik: BasicAuth Middleware Timing Attack Allows Username Enumeration (medium 6.3)
- [CVE-2026-32594](https://insights.sbomify.com/CVE-2026-32594/): Parse Server GraphQL WebSocket endpoint bypasses security middleware (medium 6.9)
- [CVE-2026-32593](https://insights.sbomify.com/CVE-2026-32593/): Winter: SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjax (medium 5.9)
- [CVE-2026-32591](https://insights.sbomify.com/CVE-2026-32591/): Mirror-registry: quay: server-side request forgery in proxy cache upstream registry configuration (medium 5.2)
- [CVE-2026-32590](https://insights.sbomify.com/CVE-2026-32590/): Mirror-registry: remote code execution using pickle deserialization (high 7.1)
- [CVE-2026-3259](https://insights.sbomify.com/CVE-2026-3259/): Sensitive Data Disclosure in BigQuery via Materialized View Error Messages (high 7.1)
- [CVE-2026-32589](https://insights.sbomify.com/CVE-2026-32589/): Mirror-registry: quay: insecure direct object reference in blobupload (high 7.4)
- [CVE-2026-32588](https://insights.sbomify.com/CVE-2026-32588/): Apache Cassandra: Authenticated DoS via ALTER ROLE Password Hashing (medium 6.5)
- [CVE-2026-32587](https://insights.sbomify.com/CVE-2026-32587/): WordPress WP EasyPay plugin <= 4.2.11 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-32586](https://insights.sbomify.com/CVE-2026-32586/): WordPress Booster for WooCommerce plugin < 7.11.3 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-32585](https://insights.sbomify.com/CVE-2026-32585/): WordPress Airano MCP Bridge plugin <= 2.11.0 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-32584](https://insights.sbomify.com/CVE-2026-32584/): Information disclosure in Smart One Click Setup – Complete Demo Import &amp; Export (medium 5.3)
- [CVE-2026-32583](https://insights.sbomify.com/CVE-2026-32583/): WordPress Modern Events Calendar plugin <= 7.29.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-32582](https://insights.sbomify.com/CVE-2026-32582/): WordPress IATO MCP plugin <= 1.12.0 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-32581](https://insights.sbomify.com/CVE-2026-32581/): WordPress Mooberry Book Manager plugin 4.16.2 - SQL Injection vulnerability (high 7.1)
- [CVE-2026-32580](https://insights.sbomify.com/CVE-2026-32580/): WordPress WooCommerce Lottery plugin <= 2.2.9 - SQL Injection vulnerability (high 7.5)
- [CVE-2026-32579](https://insights.sbomify.com/CVE-2026-32579/): WordPress Kognetiks Chatbot for WordPress plugin <= 2.4.9 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2026-32578](https://insights.sbomify.com/CVE-2026-32578/): WordPress ECPay Ecommerce for WooCommerce plugin <= 1.1.2606090 - Broken Access Control vulnerability (high 7.1)
- [CVE-2026-32577](https://insights.sbomify.com/CVE-2026-32577/): WordPress Frontend File Manager plugin <= 23.6 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-32576](https://insights.sbomify.com/CVE-2026-32576/): WordPress Faktur Pro for WooCommerce plugin <= 3.2.2 - Insecure Direct Object References (IDOR) vulnerability (medium 6.5)
- [CVE-2026-32575](https://insights.sbomify.com/CVE-2026-32575/): WordPress SUMO Affiliates Pro plugin <= 11.7.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-32574](https://insights.sbomify.com/CVE-2026-32574/): WordPress Smart Forms plugin <= 2.6.104 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-32573](https://insights.sbomify.com/CVE-2026-32573/): WordPress Nelio AB Testing plugin <= 8.2.7 - Remote Code Execution (RCE) vulnerability (critical 9.1)
- [CVE-2026-32572](https://insights.sbomify.com/CVE-2026-32572/): WordPress WP User Frontend Pro plugin <= 4.2.13 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-32571](https://insights.sbomify.com/CVE-2026-32571/): WordPress Ohio Extra plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-32570](https://insights.sbomify.com/CVE-2026-32570/): WordPress Progressify - Progressive Web App (PWA) plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-3257](https://insights.sbomify.com/CVE-2026-3257/): UnQLite versions through 0.06 for Perl uses a potentially insecure version of the UnQLite library (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/717/