# Vulnerabilities published in 2026


- [CVE-2026-28744](https://insights.sbomify.com/CVE-2026-28744/): Gitea Git smart HTTP bypasses repository token scopes for bearer tokens (high 8.1)
- [CVE-2026-28742](https://insights.sbomify.com/CVE-2026-28742/): Naxclow IoT Platform Use of hard-coded cryptographic key (critical 9.2)
- [CVE-2026-28741](https://insights.sbomify.com/CVE-2026-28741/): CSRF Protection Bypass Allows Updating a User's Authentication Method (medium 6.8)
- [CVE-2026-28740](https://insights.sbomify.com/CVE-2026-28740/): Gitea LFS object reuse bypasses Code-unit authorization (high 7.1)
- [CVE-2026-2874](https://insights.sbomify.com/CVE-2026-2874/): Tenda A21 fast_setting_wifi_set form_fast_setting_wifi_set stack-based overflow (high 8.7)
- [CVE-2026-28737](https://insights.sbomify.com/CVE-2026-28737/): Gitea 3D file viewer allows stored XSS through glTF extensionsRequired (high 8.7)
- [CVE-2026-28736](https://insights.sbomify.com/CVE-2026-28736/): Focalboard IDOR in file content endpoint allows cross-user file access (unsupported product, no fix) (medium 4.3)
- [CVE-2026-28735](https://insights.sbomify.com/CVE-2026-28735/): GitHub OAuth Scope Validation (medium 5.4)
- [CVE-2026-28733](https://insights.sbomify.com/CVE-2026-28733/): filemanagement_storage_service has an use after free vulnerability (medium 6.5)
- [CVE-2026-28732](https://insights.sbomify.com/CVE-2026-28732/): Slash command trigger-word update allowed command hijacking (medium 4.3)
- [CVE-2026-2873](https://insights.sbomify.com/CVE-2026-2873/): Tenda A21 openSchedWifi setSchedWifi stack-based overflow (high 8.7)
- [CVE-2026-28729](https://insights.sbomify.com/CVE-2026-28729/): Integer overflow in Intel(R) Slim Bootloader may allow an information disclosure. System software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (low), integrity (none) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (low), integrity (none) and availability (low) impacts. (low 2.4)
- [CVE-2026-28728](https://insights.sbomify.com/CVE-2026-28728/): Privilege escalation in Acronis True Image (medium 6.7)
- [CVE-2026-28727](https://insights.sbomify.com/CVE-2026-28727/): Privilege escalation in Acronis Cyber Protect 17 (high 7.8)
- [CVE-2026-28726](https://insights.sbomify.com/CVE-2026-28726/): Missing authorization in Acronis Cyber Protect 17 (medium 4.3)
- [CVE-2026-28725](https://insights.sbomify.com/CVE-2026-28725/): Information disclosure in Acronis Cyber Protect 17 (medium 5.5)
- [CVE-2026-28724](https://insights.sbomify.com/CVE-2026-28724/): Missing authorization in Acronis Cyber Protect 17 (medium 4.3)
- [CVE-2026-28723](https://insights.sbomify.com/CVE-2026-28723/): Missing authorization in Acronis Cyber Protect 17 (medium 4.3)
- [CVE-2026-28722](https://insights.sbomify.com/CVE-2026-28722/): Privilege escalation in Acronis Cyber Protect 17 (high 7.3)
- [CVE-2026-28721](https://insights.sbomify.com/CVE-2026-28721/): Privilege escalation in Acronis Cyber Protect 17 (high 7.3)
- [CVE-2026-28720](https://insights.sbomify.com/CVE-2026-28720/): Missing authorization in Acronis Cyber Protect 17 (medium 4.3)
- [CVE-2026-2872](https://insights.sbomify.com/CVE-2026-2872/): Tenda A21 MAC Filtering Configuration Endpoint setBlackRule set_device_name stack-based overflow (high 8.7)
- [CVE-2026-28719](https://insights.sbomify.com/CVE-2026-28719/): Missing authorization in Acronis Cyber Protect 17 (medium 4.3)
- [CVE-2026-28718](https://insights.sbomify.com/CVE-2026-28718/): Denial of service in Acronis Cyber Protect 17 (medium 5.3)
- [CVE-2026-28717](https://insights.sbomify.com/CVE-2026-28717/): Privilege escalation in Acronis Cyber Protect 17 (medium 5.0)
- [CVE-2026-28716](https://insights.sbomify.com/CVE-2026-28716/): Missing authorization in Acronis Cyber Protect 17 (medium 4.4)
- [CVE-2026-28715](https://insights.sbomify.com/CVE-2026-28715/): Missing authorization in Acronis Cyber Protect 17 (medium 6.5)
- [CVE-2026-28714](https://insights.sbomify.com/CVE-2026-28714/): Information disclosure in Acronis Cyber Protect 17 (medium 4.8)
- [CVE-2026-28713](https://insights.sbomify.com/CVE-2026-28713/): Hardcoded credentials in Acronis Cyber Protect 17 (high 7.1)
- [CVE-2026-28712](https://insights.sbomify.com/CVE-2026-28712/): Privilege escalation in Acronis Cyber Protect 17 (medium 6.3)
- [CVE-2026-28711](https://insights.sbomify.com/CVE-2026-28711/): Privilege escalation in Acronis Cyber Protect 17 (medium 6.3)
- [CVE-2026-28710](https://insights.sbomify.com/CVE-2026-28710/): Auth bypass in Acronis Cyber Protect 17 (high 8.1)
- [CVE-2026-2871](https://insights.sbomify.com/CVE-2026-2871/): Tenda A21 SetIpMacBind fromSetIpMacBind stack-based overflow (high 8.7)
- [CVE-2026-28709](https://insights.sbomify.com/CVE-2026-28709/): Missing authorization in Acronis Cyber Protect 17 (medium 4.3)
- [CVE-2026-28707](https://insights.sbomify.com/CVE-2026-28707/): Security feature bypass in LLM-on-Ray (medium 5.4)
- [CVE-2026-28705](https://insights.sbomify.com/CVE-2026-28705/): Gitea repository dumps write release assets using unsafe path names (medium 5.3)
- [CVE-2026-28704](https://insights.sbomify.com/CVE-2026-28704/): Other in Emocheck (high 8.4)
- [CVE-2026-28703](https://insights.sbomify.com/CVE-2026-28703/): Stored XSS Vulnerability (high 7.3)
- [CVE-2026-28701](https://insights.sbomify.com/CVE-2026-28701/): Daktronics Controller Firmware Path Traversal (critical 9.3)
- [CVE-2026-28700](https://insights.sbomify.com/CVE-2026-28700/): Privilege escalation in EquiTriton (medium 5.4)
- [CVE-2026-2870](https://insights.sbomify.com/CVE-2026-2870/): Tenda A21 formSetQosBand set_qosMib_list stack-based overflow (high 8.7)
- [CVE-2026-28699](https://insights.sbomify.com/CVE-2026-28699/): Gitea Basic Auth bypasses OAuth2 access token scopes (high 8.1)
- [CVE-2026-28698](https://insights.sbomify.com/CVE-2026-28698/): Exposure of Sensitive System Information to an Unauthorized Control Sphere in Panduit IntraVUE by Pronetiqs (critical 9.2)
- [CVE-2026-28697](https://insights.sbomify.com/CVE-2026-28697/): Craft Affected by Authenticated RCE via "craft.app.fs.write()" in Twig Templates (critical 9.4)
- [CVE-2026-28696](https://insights.sbomify.com/CVE-2026-28696/): Craft affected by IDOR via GraphQL @parseRefs (high 8.7)
- [CVE-2026-28695](https://insights.sbomify.com/CVE-2026-28695/): Craft affected by authenticated RCE via Twig SSTI - create() function + Symfony Process gadget (high 7.5)
- [CVE-2026-28693](https://insights.sbomify.com/CVE-2026-28693/): ImageMagick has an integer overflow in DIB coder can result in out of bounds read or write (high 8.1)
- [CVE-2026-28692](https://insights.sbomify.com/CVE-2026-28692/): ImageMagick has a heap buffer over-read via 32-bit integer overflow in MAT decoder (medium 4.8)
- [CVE-2026-28691](https://insights.sbomify.com/CVE-2026-28691/): ImageMagick has an uninitialized pointer dereference in JBIG decoder (high 7.5)
- [CVE-2026-28690](https://insights.sbomify.com/CVE-2026-28690/): ImageMagick has a stack write buffer overflow in MNG encoder (medium 6.9)
- [CVE-2026-2869](https://insights.sbomify.com/CVE-2026-2869/): janet-lang janet handleattr specials.c janetc_varset out-of-bounds (medium 4.8)
- [CVE-2026-28689](https://insights.sbomify.com/CVE-2026-28689/): ImageMagick has a Path Policy TOCTOU symlink race bypass (medium 6.3)
- [CVE-2026-28688](https://insights.sbomify.com/CVE-2026-28688/): ImageMagick has a heap use-after-free in the MSL encoder (medium 4.0)
- [CVE-2026-28687](https://insights.sbomify.com/CVE-2026-28687/): ImageMagick has a Heap Use-After-Free in ImageMagick MSL decoder (medium 5.3)
- [CVE-2026-28686](https://insights.sbomify.com/CVE-2026-28686/): ImageMagick has a write heap-buffer-overflow in PCL encoder via undersized output buffer (medium 6.8)
- [CVE-2026-28685](https://insights.sbomify.com/CVE-2026-28685/): Kimai: API invoice endpoint missing customer-level access control (IDOR) (medium 6.5)
- [CVE-2026-28684](https://insights.sbomify.com/CVE-2026-28684/): python-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallback (medium 6.6)
- [CVE-2026-28683](https://insights.sbomify.com/CVE-2026-28683/): Gokapi: Stored XSS in SVG Hotlinks (high 8.7)
- [CVE-2026-28682](https://insights.sbomify.com/CVE-2026-28682/): Gokapi: Data Leak in Upload Status Stream (medium 6.4)
- [CVE-2026-28681](https://insights.sbomify.com/CVE-2026-28681/): IRRd: web UI host header injection allows password reset poisoning via attacker-controlled email links (high 8.1)
- [CVE-2026-28680](https://insights.sbomify.com/CVE-2026-28680/): Ghostfolio: Full-Read SSRF in Manual Asset Import (critical 9.3)
- [CVE-2026-2868](https://insights.sbomify.com/CVE-2026-2868/): Cross-site scripting in Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem (medium 6.4)
- [CVE-2026-28679](https://insights.sbomify.com/CVE-2026-28679/): HomeGallery: Path Traversal (Arbitrary File Read) (high 8.6)
- [CVE-2026-28677](https://insights.sbomify.com/CVE-2026-28677/): OpenSift: Insufficient URL destination restrictions in ingest flow could enable SSRF-style internal access (high 8.2)
- [CVE-2026-28676](https://insights.sbomify.com/CVE-2026-28676/): OpenSift: Insufficient path containment checks in storage helpers could allow path traversal-style file operations (high 8.8)
- [CVE-2026-28675](https://insights.sbomify.com/CVE-2026-28675/): OpenSift: Sensitive implementation details exposed via raw exception messages and token-returning endpoints (medium 5.3)
- [CVE-2026-28674](https://insights.sbomify.com/CVE-2026-28674/): xiaoheiFS Vulnerable to RCE via Arbitrary Payment Plugin Upload (Automatic Execution) (high 7.2)
- [CVE-2026-28673](https://insights.sbomify.com/CVE-2026-28673/): xiaoheiFS Vulnerable to RCE via Unrestricted Plugin Installation (Manifest Manipulation) (high 7.2)
- [CVE-2026-28672](https://insights.sbomify.com/CVE-2026-28672/): Apache Ranger: OS Command Injection via Username in UnixUserGroupBuilder (critical 9.8)
- [CVE-2026-28671](https://insights.sbomify.com/CVE-2026-28671/): Race condition in Android (low 3.3)
- [CVE-2026-2867](https://insights.sbomify.com/CVE-2026-2867/): itsourcecode Vehicle Management System billaction.php sql injection (medium 6.9)
- [CVE-2026-28668](https://insights.sbomify.com/CVE-2026-28668/): Use after free in Android (high 7.8)
- [CVE-2026-28667](https://insights.sbomify.com/CVE-2026-28667/): Memory corruption in Android (medium 5.5)
- [CVE-2026-28666](https://insights.sbomify.com/CVE-2026-28666/): Security feature bypass in Android (high 8.8)
- [CVE-2026-28664](https://insights.sbomify.com/CVE-2026-28664/): Business logic in Android (high 7.8)
- [CVE-2026-28663](https://insights.sbomify.com/CVE-2026-28663/): Privilege escalation in Android (high 7.8)
- [CVE-2026-28662](https://insights.sbomify.com/CVE-2026-28662/): Memory corruption in Android (high 8.0)
- [CVE-2026-28660](https://insights.sbomify.com/CVE-2026-28660/): Business logic in Android (low 3.3)
- [CVE-2026-28659](https://insights.sbomify.com/CVE-2026-28659/): Missing authorization in Android XR (critical 10.0)
- [CVE-2026-28658](https://insights.sbomify.com/CVE-2026-28658/): Security feature bypass in Android (high 7.8)
- [CVE-2026-28657](https://insights.sbomify.com/CVE-2026-28657/): Privilege escalation in Android (high 7.8)
- [CVE-2026-28656](https://insights.sbomify.com/CVE-2026-28656/): Other in Android (high 7.3)
- [CVE-2026-28655](https://insights.sbomify.com/CVE-2026-28655/): Security feature bypass in Android (high 7.8)
- [CVE-2026-28653](https://insights.sbomify.com/CVE-2026-28653/): Integer overflow in Android (high 7.8)
- [CVE-2026-28652](https://insights.sbomify.com/CVE-2026-28652/): Missing authorization in Android (low 3.1)
- [CVE-2026-28650](https://insights.sbomify.com/CVE-2026-28650/): Security feature bypass in Android (high 7.8)
- [CVE-2026-2865](https://insights.sbomify.com/CVE-2026-2865/): itsourcecode Agri-Trading Online Shopping System HTTP POST Request productcontroller.php sql injection (medium 6.9)
- [CVE-2026-28648](https://insights.sbomify.com/CVE-2026-28648/): Privilege escalation in Android (high 7.8)
- [CVE-2026-28647](https://insights.sbomify.com/CVE-2026-28647/): Privilege escalation in Android (high 7.8)
- [CVE-2026-28644](https://insights.sbomify.com/CVE-2026-28644/): Privilege escalation in Android (high 7.8)
- [CVE-2026-28642](https://insights.sbomify.com/CVE-2026-28642/): Privilege escalation in Android (high 7.8)
- [CVE-2026-28641](https://insights.sbomify.com/CVE-2026-28641/): Privilege escalation in Android (high 7.8)
- [CVE-2026-28640](https://insights.sbomify.com/CVE-2026-28640/): Privilege escalation in Android (high 7.8)
- [CVE-2026-2864](https://insights.sbomify.com/CVE-2026-2864/): feng_ha_ha/megagao ssm-erp/production_ssm PictureController.java pictureDelete path traversal (medium 5.3)
- [CVE-2026-28639](https://insights.sbomify.com/CVE-2026-28639/): Memory corruption in Android (high 7.8)
- [CVE-2026-28638](https://insights.sbomify.com/CVE-2026-28638/): Information disclosure in Android (low 3.3)
- [CVE-2026-28636](https://insights.sbomify.com/CVE-2026-28636/): Security feature bypass in Android (high 7.8)
- [CVE-2026-28634](https://insights.sbomify.com/CVE-2026-28634/): Business logic in Android (high 7.8)
- [CVE-2026-28633](https://insights.sbomify.com/CVE-2026-28633/): Denial of service in Android (medium 5.5)
- [CVE-2026-28631](https://insights.sbomify.com/CVE-2026-28631/): Security feature bypass in Android (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/743/