# Vulnerabilities published in 2026


- [CVE-2026-32288](https://insights.sbomify.com/CVE-2026-32288/): Unbounded allocation for old GNU sparse in archive/tar (medium 5.5)
- [CVE-2026-32287](https://insights.sbomify.com/CVE-2026-32287/): Infinite loop in github.com/antchfx/xpath (high 7.5)
- [CVE-2026-32286](https://insights.sbomify.com/CVE-2026-32286/): Denial of service in github.com/jackc/pgproto3/v2 (high 7.5)
- [CVE-2026-32285](https://insights.sbomify.com/CVE-2026-32285/): Denial of service in github.com/buger/jsonparser (high 7.5)
- [CVE-2026-32284](https://insights.sbomify.com/CVE-2026-32284/): Denial of service in github.com/shamaton/msgpack (high 7.5)
- [CVE-2026-32283](https://insights.sbomify.com/CVE-2026-32283/): Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls (high 7.5)
- [CVE-2026-32282](https://insights.sbomify.com/CVE-2026-32282/): TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix (medium 6.4)
- [CVE-2026-32281](https://insights.sbomify.com/CVE-2026-32281/): Inefficient policy validation in crypto/x509 (high 7.5)
- [CVE-2026-32280](https://insights.sbomify.com/CVE-2026-32280/): Unexpected work during chain building in crypto/x509 (high 7.5)
- [CVE-2026-3228](https://insights.sbomify.com/CVE-2026-3228/): Cross-site scripting in NextScripts: Social Networks Auto-Poster (medium 6.4)
- [CVE-2026-32279](https://insights.sbomify.com/CVE-2026-32279/): Connect CMS has SSRF in the External Page Migration Feature of its Page Management Plugin (medium 6.8)
- [CVE-2026-32278](https://insights.sbomify.com/CVE-2026-32278/): Connect CMS has Stored Cross-site Scripting (XSS) in the File Field of its Form Plugin (high 8.2)
- [CVE-2026-32277](https://insights.sbomify.com/CVE-2026-32277/): Connect-CMS has DOM-based Cross-Site Scripting (XSS) in the Cabinet Plugin List View (high 8.7)
- [CVE-2026-32276](https://insights.sbomify.com/CVE-2026-32276/): Connect-CMS has Arbitrary Code Execution by an Authenticated User in its Code Study Plugin (high 8.8)
- [CVE-2026-32275](https://insights.sbomify.com/CVE-2026-32275/): Tautulli: Unsanitized JSONP callback parameter allows cross-origin script injection and API key theft (high 7.4)
- [CVE-2026-32274](https://insights.sbomify.com/CVE-2026-32274/): Black: Arbitrary file writes from unsanitized user input in cache file name (high 8.7)
- [CVE-2026-32273](https://insights.sbomify.com/CVE-2026-32273/): Discourse: XSS on category description update via API (medium 5.4)
- [CVE-2026-32272](https://insights.sbomify.com/CVE-2026-32272/): Craft Commerce: Blind SQL Injection via hasVariant/hasProduct (high 8.7)
- [CVE-2026-32271](https://insights.sbomify.com/CVE-2026-32271/): Craft Commerce: SQL Injection can lead to Remote Code Execution via TotalRevenue Widget (high 7.7)
- [CVE-2026-32270](https://insights.sbomify.com/CVE-2026-32270/): Craft Commerce has an unauthenticated information disclosure that can leak some customer order data on anonymous payments (low 1.7)
- [CVE-2026-3227](https://insights.sbomify.com/CVE-2026-3227/): Authenticated Command Injection on TP-Link TL-WR802N, TL-WR841N and TL-WR840N (high 8.5)
- [CVE-2026-32269](https://insights.sbomify.com/CVE-2026-32269/): Parse Server OAuth2 adapter app ID validation sends wrong token to introspection endpoint (medium 6.3)
- [CVE-2026-32268](https://insights.sbomify.com/CVE-2026-32268/): Azure Blob Storage for Craft CMS Potential Sensitive Information Disclosure vulnerability (high 8.7)
- [CVE-2026-32267](https://insights.sbomify.com/CVE-2026-32267/): Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken() (high 7.7)
- [CVE-2026-32266](https://insights.sbomify.com/CVE-2026-32266/): Google Cloud Storage for Craft CMS has an Information Disclosure Vulnerability (low 2.4)
- [CVE-2026-32265](https://insights.sbomify.com/CVE-2026-32265/): Amazon S3 for Craft CMS has an Information Disclosure vulnerability (medium 6.9)
- [CVE-2026-32264](https://insights.sbomify.com/CVE-2026-32264/): Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController (high 8.6)
- [CVE-2026-32263](https://insights.sbomify.com/CVE-2026-32263/): Craft CMS vulnerable to behavior injection RCE via EntryTypesController (high 8.6)
- [CVE-2026-32262](https://insights.sbomify.com/CVE-2026-32262/): Craft CMS has a Path Traversal Vulnerability in AssetsController (medium 5.3)
- [CVE-2026-32261](https://insights.sbomify.com/CVE-2026-32261/): RCE via SSTI for users with permissions to access the Craft CMS Webhooks plugin (high 8.5)
- [CVE-2026-32260](https://insights.sbomify.com/CVE-2026-32260/): Command Injection via incomplete shell metacharacter blocklist in node:child_process (bypass of CVE-2026-27190 fix) (high 8.1)
- [CVE-2026-3226](https://insights.sbomify.com/CVE-2026-3226/): LearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Notification Triggering (medium 4.3)
- [CVE-2026-32259](https://insights.sbomify.com/CVE-2026-32259/): ImageMagick has a possible stack buffer overflow in sixel encoder (medium 6.7)
- [CVE-2026-32258](https://insights.sbomify.com/CVE-2026-32258/): Winter: Stored XSS through Editor Settings custom styles (high 8.1)
- [CVE-2026-32257](https://insights.sbomify.com/CVE-2026-32257/): Winter: Stored XSS through Brand Settings custom styles (high 8.1)
- [CVE-2026-32256](https://insights.sbomify.com/CVE-2026-32256/): music-metadata has an infinite loop vulnerability in ASF parser (high 7.5)
- [CVE-2026-32255](https://insights.sbomify.com/CVE-2026-32255/): Kan is Vulnerable to Unauthenticated SSRF via Attachment Download Endpoint (high 8.6)
- [CVE-2026-32254](https://insights.sbomify.com/CVE-2026-32254/): Kube-router Proxy Module Blindly Trusts ExternalIPs/LoadBalancer IPs Enabling Cluster-Wide Traffic Hijacking and DNS DoS (high 7.1)
- [CVE-2026-32253](https://insights.sbomify.com/CVE-2026-32253/): Sunshine: Authentication bypass via improper client certificate validation (critical 9.8)
- [CVE-2026-32252](https://insights.sbomify.com/CVE-2026-32252/): Chartbrew Cross-Tenant Template Export and Secret Disclosure in `GET /team/:team_id/template/generate/:project_id` (high 7.7)
- [CVE-2026-32251](https://insights.sbomify.com/CVE-2026-32251/): Tolgee has an XXE Injection in Translation Import (critical 9.3)
- [CVE-2026-32250](https://insights.sbomify.com/CVE-2026-32250/): NamelessMC has Reflected Cross-Site Scripting (XSS) in id parameter of /index.php?route=/queries/user/ (medium 4.3)
- [CVE-2026-3225](https://insights.sbomify.com/CVE-2026-3225/): LearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Answer Deletion (medium 4.3)
- [CVE-2026-32249](https://insights.sbomify.com/CVE-2026-32249/): NFA regex engine NULL pointer dereference affects Vim < 9.2.0137 (medium 5.3)
- [CVE-2026-32248](https://insights.sbomify.com/CVE-2026-32248/): Parse Server: Account takeover via operator injection in authentication data identifier (critical 9.3)
- [CVE-2026-32247](https://insights.sbomify.com/CVE-2026-32247/): Graphiti vulnerable to Cypher Injection via unsanitized node_labels in search filters (high 8.1)
- [CVE-2026-32246](https://insights.sbomify.com/CVE-2026-32246/): Tinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpoint (high 8.5)
- [CVE-2026-32245](https://insights.sbomify.com/CVE-2026-32245/): Tinyauth's OIDC authorization codes are not bound to client on token exchange (medium 6.5)
- [CVE-2026-32244](https://insights.sbomify.com/CVE-2026-32244/): Discourse: Cached outdated summaries can leak removed content (medium 5.3)
- [CVE-2026-32243](https://insights.sbomify.com/CVE-2026-32243/): Discourse: Stored XSS in discourse-ai shared conversations onebox (medium 5.3)
- [CVE-2026-32242](https://insights.sbomify.com/CVE-2026-32242/): Parse Server OAuth2 adapter shares mutable state across providers via singleton instance (critical 9.1)
- [CVE-2026-32241](https://insights.sbomify.com/CVE-2026-32241/): Flannel vulnerable to cross-node remote code execution via extension backend BackendData injection (high 7.5)
- [CVE-2026-32240](https://insights.sbomify.com/CVE-2026-32240/): Cap'n Proto: Integer overflow in KJ-HTTP chunk size (medium 6.3)
- [CVE-2026-3224](https://insights.sbomify.com/CVE-2026-3224/): Auth bypass in Server (critical 9.8)
- [CVE-2026-32239](https://insights.sbomify.com/CVE-2026-32239/): Cap'n Proto has an integer overflow in KJ-HTTP (medium 6.3)
- [CVE-2026-32238](https://insights.sbomify.com/CVE-2026-32238/): OpenEMR has Remote Code Execution in backup functionality (critical 9.1)
- [CVE-2026-32237](https://insights.sbomify.com/CVE-2026-32237/): @backstage/plugin-scaffolder-backend: Possible exposure of defaultEnvironment secrets using dry-run endpoint (medium 4.4)
- [CVE-2026-32236](https://insights.sbomify.com/CVE-2026-32236/): @backstage/plugin-auth-backend: SSRF in experimental CIMD metadata fetch (low 1.7)
- [CVE-2026-32235](https://insights.sbomify.com/CVE-2026-32235/): @backstage/plugin-auth-backend: OAuth redirect URI allowlist bypass (medium 5.9)
- [CVE-2026-32234](https://insights.sbomify.com/CVE-2026-32234/): Parse Server has a SQL injection via query field name when using PostgreSQL (medium 5.1)
- [CVE-2026-32232](https://insights.sbomify.com/CVE-2026-32232/): ZeptoClaw: Path boundary checks bypass via symlink, TOCTOU, and hardlink (high 8.8)
- [CVE-2026-32231](https://insights.sbomify.com/CVE-2026-32231/): ZeptoClaw: Generic webhook channel trusts caller-supplied identity fields; allowlist is checked against untrusted payload data (high 8.2)
- [CVE-2026-32230](https://insights.sbomify.com/CVE-2026-32230/): Uptime Kuma is Missing Authorization Checks on Ping Badge Endpoint, Leaks Ping times of monitors without needing to be on a status page (medium 5.3)
- [CVE-2026-3223](https://insights.sbomify.com/CVE-2026-3223/): Zip Slip leading to Arbitrary File Write and Privilege Escalation in Google Web Designer (high 8.4)
- [CVE-2026-32229](https://insights.sbomify.com/CVE-2026-32229/): Auth bypass in Hub (medium 6.8)
- [CVE-2026-32228](https://insights.sbomify.com/CVE-2026-32228/): Apache Airflow: Users with asset materialization permisssions could trigger Dags they had no access to (high 7.5)
- [CVE-2026-32227](https://insights.sbomify.com/CVE-2026-32227/): Apache Ranger: SQL Injection vulnerability in lookup functionality (critical 9.8)
- [CVE-2026-32226](https://insights.sbomify.com/CVE-2026-32226/): .NET Framework Denial of Service Vulnerability (medium 5.9)
- [CVE-2026-32225](https://insights.sbomify.com/CVE-2026-32225/): Windows Shell Security Feature Bypass Vulnerability (high 8.8)
- [CVE-2026-32224](https://insights.sbomify.com/CVE-2026-32224/): Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-32223](https://insights.sbomify.com/CVE-2026-32223/): Windows USB Printing Stack (usbprint.sys) Elevation of Privilege Vulnerability (medium 6.8)
- [CVE-2026-32222](https://insights.sbomify.com/CVE-2026-32222/): Windows Win32k Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-32221](https://insights.sbomify.com/CVE-2026-32221/): Windows Graphics Component Remote Code Execution Vulnerability (high 8.4)
- [CVE-2026-32220](https://insights.sbomify.com/CVE-2026-32220/): UEFI Secure Boot Security Feature Bypass Vulnerability (medium 4.4)
- [CVE-2026-3222](https://insights.sbomify.com/CVE-2026-3222/): WP Maps <= 4.9.1 - Unauthenticated SQL Injection via 'location_id' Parameter (high 7.5)
- [CVE-2026-32219](https://insights.sbomify.com/CVE-2026-32219/): Microsoft Brokering File System Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-32218](https://insights.sbomify.com/CVE-2026-32218/): Windows Kernel Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-32217](https://insights.sbomify.com/CVE-2026-32217/): Windows Kernel Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-32216](https://insights.sbomify.com/CVE-2026-32216/): Windows Redirected Drive Buffering System Denial of Service Vulnerability (medium 5.5)
- [CVE-2026-32215](https://insights.sbomify.com/CVE-2026-32215/): Windows Kernel Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-32214](https://insights.sbomify.com/CVE-2026-32214/): Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-32213](https://insights.sbomify.com/CVE-2026-32213/): Azure AI Foundry Elevation of Privilege Vulnerability (critical 10.0)
- [CVE-2026-32212](https://insights.sbomify.com/CVE-2026-32212/): Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-32211](https://insights.sbomify.com/CVE-2026-32211/): Azure MCP Server Information Disclosure Vulnerability (critical 9.1)
- [CVE-2026-32210](https://insights.sbomify.com/CVE-2026-32210/): Microsoft Dynamics 365 (online) Spoofing Vulnerability (critical 9.3)
- [CVE-2026-3221](https://insights.sbomify.com/CVE-2026-3221/): Information disclosure in Server (medium 4.9)
- [CVE-2026-32209](https://insights.sbomify.com/CVE-2026-32209/): Windows Filtering Platform (WFP) Security Feature Bypass Vulnerability (medium 4.4)
- [CVE-2026-32208](https://insights.sbomify.com/CVE-2026-32208/): Microsoft Entra ID Spoofing Vulnerability (high 8.8)
- [CVE-2026-32207](https://insights.sbomify.com/CVE-2026-32207/): Azure Machine Learning Notebook Spoofing Vulnerability (high 8.8)
- [CVE-2026-32204](https://insights.sbomify.com/CVE-2026-32204/): Azure Monitor Agent Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-32203](https://insights.sbomify.com/CVE-2026-32203/): .NET and Visual Studio Denial of Service Vulnerability (high 7.5)
- [CVE-2026-32202](https://insights.sbomify.com/CVE-2026-32202/): Microsoft Windows Protection Mechanism Failure (medium 4.3, exploited in the wild)
- [CVE-2026-32201](https://insights.sbomify.com/CVE-2026-32201/): Microsoft SharePoint Server Improper Input Validation (medium 6.5, exploited in the wild)
- [CVE-2026-32200](https://insights.sbomify.com/CVE-2026-32200/): Microsoft PowerPoint Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-3220](https://insights.sbomify.com/CVE-2026-3220/): Multiple Plugins - Unauthenticated Stored XSS via Minify Library (high 8.8)
- [CVE-2026-32199](https://insights.sbomify.com/CVE-2026-32199/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-32198](https://insights.sbomify.com/CVE-2026-32198/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-32197](https://insights.sbomify.com/CVE-2026-32197/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-32196](https://insights.sbomify.com/CVE-2026-32196/): Windows Admin Center Spoofing Vulnerability (medium 6.1)
- [CVE-2026-32195](https://insights.sbomify.com/CVE-2026-32195/): Windows Kernel Elevation of Privilege Vulnerability (high 7.0)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/721/