# Vulnerabilities published in 2026


- [CVE-2026-28845](https://insights.sbomify.com/CVE-2026-28845/): Missing authorization in macOS (medium 5.5)
- [CVE-2026-28844](https://insights.sbomify.com/CVE-2026-28844/): Security feature bypass in macOS (medium 6.5)
- [CVE-2026-28842](https://insights.sbomify.com/CVE-2026-28842/): Memory corruption in macOS (high 7.5)
- [CVE-2026-28841](https://insights.sbomify.com/CVE-2026-28841/): Memory corruption in macOS (medium 6.2)
- [CVE-2026-28840](https://insights.sbomify.com/CVE-2026-28840/): Privilege escalation in macOS (high 7.8)
- [CVE-2026-2884](https://insights.sbomify.com/CVE-2026-2884/): D-Link DWR-M960 WAN Interface Setting formWanConfigSetup sub_41914C stack-based overflow (high 8.7)
- [CVE-2026-28839](https://insights.sbomify.com/CVE-2026-28839/): Missing authorization in macOS (medium 5.3)
- [CVE-2026-28838](https://insights.sbomify.com/CVE-2026-28838/): Security feature bypass in macOS (medium 5.3)
- [CVE-2026-28837](https://insights.sbomify.com/CVE-2026-28837/): Business logic in macOS (high 7.5)
- [CVE-2026-28836](https://insights.sbomify.com/CVE-2026-28836/): Security feature bypass in macOS (medium 6.1)
- [CVE-2026-28835](https://insights.sbomify.com/CVE-2026-28835/): Use after free in macOS (medium 6.5)
- [CVE-2026-28834](https://insights.sbomify.com/CVE-2026-28834/): Race condition in macOS (medium 5.1)
- [CVE-2026-28833](https://insights.sbomify.com/CVE-2026-28833/): Information disclosure in iOS and iPadOS (medium 6.2)
- [CVE-2026-28832](https://insights.sbomify.com/CVE-2026-28832/): Memory corruption in macOS (high 8.4)
- [CVE-2026-28831](https://insights.sbomify.com/CVE-2026-28831/): Missing authorization in macOS (medium 5.5)
- [CVE-2026-28830](https://insights.sbomify.com/CVE-2026-28830/): Race condition in macOS (medium 4.7)
- [CVE-2026-2883](https://insights.sbomify.com/CVE-2026-2883/): D-Link DWR-M960 formIpQoS sub_427D74 stack-based overflow (high 8.7)
- [CVE-2026-28829](https://insights.sbomify.com/CVE-2026-28829/): Misconfiguration in macOS (medium 5.5)
- [CVE-2026-28828](https://insights.sbomify.com/CVE-2026-28828/): Missing authorization in macOS (medium 5.3)
- [CVE-2026-28827](https://insights.sbomify.com/CVE-2026-28827/): Path traversal in macOS (critical 9.3)
- [CVE-2026-28826](https://insights.sbomify.com/CVE-2026-28826/): Security feature bypass in macOS (medium 4.0)
- [CVE-2026-28825](https://insights.sbomify.com/CVE-2026-28825/): Memory corruption in macOS (high 7.1)
- [CVE-2026-28824](https://insights.sbomify.com/CVE-2026-28824/): Missing authorization in macOS (medium 5.3)
- [CVE-2026-28823](https://insights.sbomify.com/CVE-2026-28823/): Path traversal in macOS (medium 4.9)
- [CVE-2026-28822](https://insights.sbomify.com/CVE-2026-28822/): Memory corruption in iOS and iPadOS (medium 6.2)
- [CVE-2026-28821](https://insights.sbomify.com/CVE-2026-28821/): Privilege escalation in macOS (high 8.4)
- [CVE-2026-28820](https://insights.sbomify.com/CVE-2026-28820/): Information disclosure in macOS (medium 5.5)
- [CVE-2026-2882](https://insights.sbomify.com/CVE-2026-2882/): D-Link DWR-M960 formDosCfg sub_46385C stack-based overflow (high 8.7)
- [CVE-2026-28819](https://insights.sbomify.com/CVE-2026-28819/): Memory corruption in iOS and iPadOS (medium 5.4)
- [CVE-2026-28818](https://insights.sbomify.com/CVE-2026-28818/): Information disclosure in macOS (medium 5.3)
- [CVE-2026-28817](https://insights.sbomify.com/CVE-2026-28817/): Race condition in macOS (high 8.1)
- [CVE-2026-28816](https://insights.sbomify.com/CVE-2026-28816/): Path traversal in macOS (medium 4.0)
- [CVE-2026-28815](https://insights.sbomify.com/CVE-2026-28815/): Swift Crypto: X-Wing HPKE Decapsulation Accepts Malformed Ciphertext Length (high 7.5)
- [CVE-2026-28814](https://insights.sbomify.com/CVE-2026-28814/): Apache JSPWiki: Pre-Authentication Arbitrary Wiki Markup Rendering (high 7.5)
- [CVE-2026-28813](https://insights.sbomify.com/CVE-2026-28813/): Apache JSPWiki: JSPWiki vulnerable to JSON hijacking (high 8.8)
- [CVE-2026-28812](https://insights.sbomify.com/CVE-2026-28812/): Apache JSPWiki: UserManager does not sanity-check user database at startup (critical 9.8)
- [CVE-2026-28811](https://insights.sbomify.com/CVE-2026-28811/): Apache JSPWiki: Error Handling - Reveals Error Details (high 7.5)
- [CVE-2026-28810](https://insights.sbomify.com/CVE-2026-28810/): Predictable DNS Transaction IDs Enable Cache Poisoning in Built-in Resolver (medium 6.3)
- [CVE-2026-2881](https://insights.sbomify.com/CVE-2026-2881/): D-Link DWR-M960 Advanced Firewall Configuration Endpoint formFirewallAdv sub_425FF8 stack-based overflow (high 8.7)
- [CVE-2026-28809](https://insights.sbomify.com/CVE-2026-28809/): XXE in esaml SAML library allows local file read and potential SSRF (medium 6.3)
- [CVE-2026-28808](https://insights.sbomify.com/CVE-2026-28808/): ScriptAlias CGI targets bypass directory auth in inets httpd (mod_auth vs mod_cgi path mismatch) (high 8.3)
- [CVE-2026-28807](https://insights.sbomify.com/CVE-2026-28807/): Path Traversal in wisp.serve_static allows arbitrary file read (high 8.7)
- [CVE-2026-28806](https://insights.sbomify.com/CVE-2026-28806/): Improper authorization in device bulk actions and device update API allows cross-organization device control (critical 9.4)
- [CVE-2026-28805](https://insights.sbomify.com/CVE-2026-28805/): OpenSTAManager: Time-Based Blind SQL Injection via `options[stato]` Parameter (high 8.8)
- [CVE-2026-28804](https://insights.sbomify.com/CVE-2026-28804/): pypdf: Inefficient decoding of ASCIIHexDecode streams (medium 6.9)
- [CVE-2026-28803](https://insights.sbomify.com/CVE-2026-28803/): Open Forms possible to view submission details of other people than intended (medium 6.5)
- [CVE-2026-28802](https://insights.sbomify.com/CVE-2026-28802/): Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification (high 7.7)
- [CVE-2026-28801](https://insights.sbomify.com/CVE-2026-28801/): Natro Macro: Code Injection through Pattern/Path files (medium 6.6)
- [CVE-2026-28800](https://insights.sbomify.com/CVE-2026-28800/): Natro Macro: Malicious actions allowed through Discord RC Commands by any user (medium 6.4)
- [CVE-2026-2880](https://insights.sbomify.com/CVE-2026-2880/): @fastify/middie has an improper path normalization vulnerability (high 8.2)
- [CVE-2026-28799](https://insights.sbomify.com/CVE-2026-28799/): PJSIP: Heap use-after-free in PJSIP presence subscription termination handler (high 8.7)
- [CVE-2026-28798](https://insights.sbomify.com/CVE-2026-28798/): Arbitrary internal service access via /v1/sys/proxy when Cloudflare Tunnel is enabled on ZimaOS (critical 9.1)
- [CVE-2026-28797](https://insights.sbomify.com/CVE-2026-28797/): Code injection in ragflow (high 8.7)
- [CVE-2026-28795](https://insights.sbomify.com/CVE-2026-28795/): OpenChatBI: Critical Path Traversal Vulnerability in save_report Tool of OpenChatBI (high 8.7)
- [CVE-2026-28794](https://insights.sbomify.com/CVE-2026-28794/): oRPC: Prototype Pollution in `@orpc/client` via `StandardRPCJsonSerializer` Deserialization (critical 9.3)
- [CVE-2026-28793](https://insights.sbomify.com/CVE-2026-28793/): Path Traversal Leading to Arbitrary File Read, Write and Delete in TinaCMS (high 8.4)
- [CVE-2026-28792](https://insights.sbomify.com/CVE-2026-28792/): Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS (critical 9.7)
- [CVE-2026-28791](https://insights.sbomify.com/CVE-2026-28791/): Path Traversal in Media Upload Handle in Tina (high 7.4)
- [CVE-2026-28790](https://insights.sbomify.com/CVE-2026-28790/): OliveTin: Unauthenticated Action Termination via KillAction When Guests Must Login (high 7.5)
- [CVE-2026-2879](https://insights.sbomify.com/CVE-2026-2879/): GetGenie <= 4.3.2 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Post Overwrite/Deletion (medium 5.4)
- [CVE-2026-28789](https://insights.sbomify.com/CVE-2026-28789/): OliveTin: Unauthenticated DoS via concurrent map writes in OAuth2 state handling (high 7.5)
- [CVE-2026-28788](https://insights.sbomify.com/CVE-2026-28788/): Open WebUI's process_files_batch() endpoint missing ownership check, allows unauthorized file overwrite (high 7.1)
- [CVE-2026-28787](https://insights.sbomify.com/CVE-2026-28787/): OneUptime has WebAuthn 2FA bypass: server accepts client-supplied challenge instead of server-stored value, allowing credential replay (high 8.2)
- [CVE-2026-28786](https://insights.sbomify.com/CVE-2026-28786/): Open WebUI vulnerable to Path Traversal in `POST /api/v1/audio/transcriptions` (medium 4.3)
- [CVE-2026-28785](https://insights.sbomify.com/CVE-2026-28785/): Ghostfolio: Time-Based Blind SQL Injection in Manual Asset Import (critical 9.3)
- [CVE-2026-28784](https://insights.sbomify.com/CVE-2026-28784/): Craft is affected by potential authenticated Remote Code Execution via Twig SSTI (high 8.6)
- [CVE-2026-28783](https://insights.sbomify.com/CVE-2026-28783/): Craft has a Twig Function Blocklist Bypass (critical 9.4)
- [CVE-2026-28782](https://insights.sbomify.com/CVE-2026-28782/): Craft has a Permission Bypass and IDOR in Duplicate Entry Action (medium 5.3)
- [CVE-2026-28781](https://insights.sbomify.com/CVE-2026-28781/): Craft Affected by Entries Authorship Spoofing via Mass Assignment (high 7.1)
- [CVE-2026-28780](https://insights.sbomify.com/CVE-2026-28780/): Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header() (critical 9.8)
- [CVE-2026-2878](https://insights.sbomify.com/CVE-2026-2878/): Insufficient Entropy Vulnerability in Telerik UI for ASP.NET AJAX (medium 5.3)
- [CVE-2026-28779](https://insights.sbomify.com/CVE-2026-28779/): Apache Airflow: Path of session token in cookie does not consider base_url - session hijacking via co-hosted applications (high 7.5)
- [CVE-2026-28778](https://insights.sbomify.com/CVE-2026-28778/): Hardcoded FTP Credentials and LPE(via Insecure Permissions) for `xd` Local Account on IDC SFX2100 (high 7.9)
- [CVE-2026-28777](https://insights.sbomify.com/CVE-2026-28777/): Hardcoded and Insecure Credentials for "User" Local Account with SSH Access On IDC SFX2100 Satellite Receiver (critical 9.2)
- [CVE-2026-28776](https://insights.sbomify.com/CVE-2026-28776/): Hardcoded and Insecure Credentials for "monitor" account with SSH Access On IDC SFX2100 Satellite Receiver (high 7.8)
- [CVE-2026-28775](https://insights.sbomify.com/CVE-2026-28775/): Unauthenticated RCE via SNMP Default Writable Community String (critical 10.0)
- [CVE-2026-28774](https://insights.sbomify.com/CVE-2026-28774/): Authenticated OS Command Injection via Traceroute Utility leads to Root RCE (critical 9.3)
- [CVE-2026-28773](https://insights.sbomify.com/CVE-2026-28773/): Authenticated OS Command Injection via Ping Utility Leading to RCE as Root (critical 9.3)
- [CVE-2026-28772](https://insights.sbomify.com/CVE-2026-28772/): Reflected XSS in IDC_Logging Index endpoint (medium 5.1)
- [CVE-2026-28771](https://insights.sbomify.com/CVE-2026-28771/): Reflected XSS In /index.cgi Endpoint On IDC Satellite Receiver Web Management Interface Version 101 (medium 5.1)
- [CVE-2026-28770](https://insights.sbomify.com/CVE-2026-28770/): XML injection In /IDC_Logging/checkifdone.cgi Endpoint On IDC SFX Web Management Interface Version 101 (medium 5.3)
- [CVE-2026-2877](https://insights.sbomify.com/CVE-2026-2877/): Tenda A18 Httpd Service WifiExtraSet strcpy stack-based overflow (high 8.7)
- [CVE-2026-28769](https://insights.sbomify.com/CVE-2026-28769/): Path traversal in SFX Series SuperFlex Satellite Receiver Web management interface (medium 5.3)
- [CVE-2026-28767](https://insights.sbomify.com/CVE-2026-28767/): Gardyn Cloud API Missing Authentication for Critical Function (medium 6.9)
- [CVE-2026-28766](https://insights.sbomify.com/CVE-2026-28766/): Gardyn Cloud API Missing Authentication for Critical Function (critical 9.2)
- [CVE-2026-28764](https://insights.sbomify.com/CVE-2026-28764/): Memory corruption in MediaInfoLib (high 7.8)
- [CVE-2026-28763](https://insights.sbomify.com/CVE-2026-28763/): Memory corruption in Totolink (critical 9.1)
- [CVE-2026-28761](https://insights.sbomify.com/CVE-2026-28761/): Cross-site request forgery in Musetheque V4 Information Disclosure for IPKNOWLEDGE (high 8.5)
- [CVE-2026-28760](https://insights.sbomify.com/CVE-2026-28760/): Other in RATOC RAID Monitoring Manager for Windows (high 8.4)
- [CVE-2026-2876](https://insights.sbomify.com/CVE-2026-2876/): Tenda A18 setBlackRule parse_macfilter_rule stack-based overflow (high 8.7)
- [CVE-2026-28759](https://insights.sbomify.com/CVE-2026-28759/): Mattermost does not verify remote cluster channel access when processing shared channel membership removals (medium 4.3)
- [CVE-2026-28758](https://insights.sbomify.com/CVE-2026-28758/): BIG-IP iControl REST vulnerability (medium 6.7)
- [CVE-2026-28757](https://insights.sbomify.com/CVE-2026-28757/): Security feature bypass in Intel(R) Workload Services Framework software (medium 5.4)
- [CVE-2026-28756](https://insights.sbomify.com/CVE-2026-28756/): Stored XSS Vulnerability (high 7.3)
- [CVE-2026-28755](https://insights.sbomify.com/CVE-2026-28755/): NGINX ngx_stream_ssl_module vulnerability (medium 5.3)
- [CVE-2026-28754](https://insights.sbomify.com/CVE-2026-28754/): Stored XSS Vulnerability (high 7.3)
- [CVE-2026-28753](https://insights.sbomify.com/CVE-2026-28753/): NGINX ngx_mail_proxy_module vulnerability (medium 6.3)
- [CVE-2026-28751](https://insights.sbomify.com/CVE-2026-28751/): filemanagement_storage_service has an improper input validation vulnerability (low 3.3)
- [CVE-2026-28747](https://insights.sbomify.com/CVE-2026-28747/): Milesight Cameras Authorization Bypass Through User-Controlled Key (high 7.3)
- [CVE-2026-28745](https://insights.sbomify.com/CVE-2026-28745/): Red Lion Controls N-Tron 700 Series Storing Passwords in a Recoverable Format (critical 9.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/742/