# Vulnerabilities published in 2026


- [CVE-2026-28411](https://insights.sbomify.com/CVE-2026-28411/): WeGIA Vulnerable to Authentication Bypass via `extract($_REQUEST)` (critical 9.8)
- [CVE-2026-28410](https://insights.sbomify.com/CVE-2026-28410/): The Graph: Revocable vesting contracts allows early access to locked tokens (medium 5.3)
- [CVE-2026-28409](https://insights.sbomify.com/CVE-2026-28409/): WeGIA Vulnerable to Remote Code Execution (RCE) via OS Command Injection (critical 10.0)
- [CVE-2026-28408](https://insights.sbomify.com/CVE-2026-28408/): WeGIA lacks authentication verification in adicionar_tipo_docs_atendido.php (critical 9.8)
- [CVE-2026-28407](https://insights.sbomify.com/CVE-2026-28407/): malcontent's nested archive extraction failure can drop content from scan inputs (medium 6.9)
- [CVE-2026-28406](https://insights.sbomify.com/CVE-2026-28406/): kaniko has tar archive path traversal in build context extraction allows writing files outside destination directory (high 8.2)
- [CVE-2026-28405](https://insights.sbomify.com/CVE-2026-28405/): MarkUs: Stored XSS in Submission HTML Preview Enables Instructor-Context Actions (high 8.0)
- [CVE-2026-28403](https://insights.sbomify.com/CVE-2026-28403/): Textream Cross-Site WebSocket Hijacking (CSWSH) vulnerability (high 7.6)
- [CVE-2026-28402](https://insights.sbomify.com/CVE-2026-28402/): nimiq/core-rs-albatross's nimiq-blockchain missing proposal body root verification (high 7.1)
- [CVE-2026-28401](https://insights.sbomify.com/CVE-2026-28401/): NocoDB: Stored Cross-Site Scripting via Rich Text Cells (medium 5.3)
- [CVE-2026-28400](https://insights.sbomify.com/CVE-2026-28400/): Docker Model Runner Unauthenticated Runtime Flag Injection via _configure Endpoint (high 7.6)
- [CVE-2026-2840](https://insights.sbomify.com/CVE-2026-2840/): Cross-site scripting in Email Encoder – Protect Email Addresses and Phone Numbers (medium 6.4)
- [CVE-2026-28399](https://insights.sbomify.com/CVE-2026-28399/): NocoDB: SQL Injection via DATEADD Formula (medium 6.2)
- [CVE-2026-28398](https://insights.sbomify.com/CVE-2026-28398/): NocoDB: Stored Cross-Site Scripting via Comments and Rich Text Cells (medium 5.3)
- [CVE-2026-28397](https://insights.sbomify.com/CVE-2026-28397/): NocoDB: Stored Cross-Site Scripting via Comments (medium 5.3)
- [CVE-2026-28396](https://insights.sbomify.com/CVE-2026-28396/): NocoDB: Refresh Tokens Not Revoked on Password Reset (medium 4.9)
- [CVE-2026-28395](https://insights.sbomify.com/CVE-2026-28395/): OpenClaw 2026.1.14-1 < 2026.2.12 - Unintended Public Binding of Chrome Extension Relay via Wildcard cdpUrl (medium 6.3)
- [CVE-2026-28394](https://insights.sbomify.com/CVE-2026-28394/): OpenClaw < 2026.2.15 - Denial of Service via Unbounded Response Parsing in web_fetch Tool (medium 6.9)
- [CVE-2026-28393](https://insights.sbomify.com/CVE-2026-28393/): OpenClaw 2.0.0-beta3 < 2026.2.14 - Arbitrary JavaScript Module Loading via Hook Transform Path Traversal (high 8.3)
- [CVE-2026-28392](https://insights.sbomify.com/CVE-2026-28392/): OpenClaw < 2026.2.14 - Privilege Escalation in Slack Slash Command Handler via Direct Messages (high 8.2)
- [CVE-2026-28391](https://insights.sbomify.com/CVE-2026-28391/): OpenClaw < 2026.2.2 - Command Injection via cmd.exe Parsing Bypass in Allowlist Enforcement (critical 9.2)
- [CVE-2026-28390](https://insights.sbomify.com/CVE-2026-28390/): Possible NULL Dereference When Processing CMS KeyTransportRecipientInfo (high 7.5)
- [CVE-2026-2839](https://insights.sbomify.com/CVE-2026-2839/): Missing authorization in Advanced Custom Fields: Extended (medium 5.3)
- [CVE-2026-28389](https://insights.sbomify.com/CVE-2026-28389/): Possible NULL Dereference When Processing CMS KeyAgreeRecipientInfo (high 7.5)
- [CVE-2026-28388](https://insights.sbomify.com/CVE-2026-28388/): NULL Pointer Dereference When Processing a Delta CRL (high 7.5)
- [CVE-2026-28387](https://insights.sbomify.com/CVE-2026-28387/): Potential Use-after-free in DANE Client Code (high 8.1)
- [CVE-2026-28386](https://insights.sbomify.com/CVE-2026-28386/): Out-of-bounds Read in AES-CFB-128 on X86-64 with AVX-512 Support (critical 9.1)
- [CVE-2026-28385](https://insights.sbomify.com/CVE-2026-28385/): SSRF via image import from URL allows internal network probing by authenticated users (medium 5.0)
- [CVE-2026-28384](https://insights.sbomify.com/CVE-2026-28384/): Authenticated RCE via unsanitized compression_algorithm (critical 9.4)
- [CVE-2026-28383](https://insights.sbomify.com/CVE-2026-28383/): Grafana plugin resources can lead to unbounded memory allocation (medium 6.5)
- [CVE-2026-28381](https://insights.sbomify.com/CVE-2026-28381/): Local File Read/Write to Potential Privilege Escalation via Snowflake GET/PUT (critical 9.6)
- [CVE-2026-28380](https://insights.sbomify.com/CVE-2026-28380/): BAC in Snapshot API allows deletion of unauthorized dashboard snapshots (medium 6.5)
- [CVE-2026-2838](https://insights.sbomify.com/CVE-2026-2838/): Cross-site scripting in Whole Enquiry Cart for WooCommerce (medium 4.4)
- [CVE-2026-28379](https://insights.sbomify.com/CVE-2026-28379/): Viewer-triggered race condition in Grafana Live leads to complete server crash (medium 6.5)
- [CVE-2026-28378](https://insights.sbomify.com/CVE-2026-28378/): Cross-Organization Public Dashboard Deletion via Missing Org Isolation (low 3.1)
- [CVE-2026-28377](https://insights.sbomify.com/CVE-2026-28377/): S3 SSE-C Encryption Key Exposed in Plaintext via Config Endpoint (CVE-2025-41118 Pattern) (high 7.5)
- [CVE-2026-28376](https://insights.sbomify.com/CVE-2026-28376/): Grafana Live push endpoint allows unbounded memory allocation leading to OOM (medium 6.5)
- [CVE-2026-28375](https://insights.sbomify.com/CVE-2026-28375/): Grafana Testdata datasource can issue unbounded memory allocations (medium 6.5)
- [CVE-2026-28374](https://insights.sbomify.com/CVE-2026-28374/): IDOR in Annotations API allows unprivileged users to DELETE annotation (medium 4.3)
- [CVE-2026-28373](https://insights.sbomify.com/CVE-2026-28373/): Path traversal in stackfield:stackfield (critical 9.6)
- [CVE-2026-28372](https://insights.sbomify.com/CVE-2026-28372/): Privilege escalation in inetutils (high 7.4)
- [CVE-2026-28370](https://insights.sbomify.com/CVE-2026-28370/): OpenStack Vitrage: Unauthorized Access to the Host can Lead to Eval Injection (critical 9.1)
- [CVE-2026-2837](https://insights.sbomify.com/CVE-2026-2837/): Ricerca – advanced search <= 1.1.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Settings (medium 4.4)
- [CVE-2026-28369](https://insights.sbomify.com/CVE-2026-28369/): Undertow: undertow: request smuggling via malformed http request headers (high 8.7)
- [CVE-2026-28368](https://insights.sbomify.com/CVE-2026-28368/): Undertow: undertow: request smuggling via inconsistent header parsing (high 8.7)
- [CVE-2026-28367](https://insights.sbomify.com/CVE-2026-28367/): Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator (high 8.7)
- [CVE-2026-28364](https://insights.sbomify.com/CVE-2026-28364/): Memory corruption in OCaml (high 7.9)
- [CVE-2026-28363](https://insights.sbomify.com/CVE-2026-28363/): Security feature bypass in OpenClaw (critical 9.9)
- [CVE-2026-28361](https://insights.sbomify.com/CVE-2026-28361/): NocoDB: Missing Ownership Validation in MCP Token Operations (medium 4.9)
- [CVE-2026-28360](https://insights.sbomify.com/CVE-2026-28360/): NocoDB: Plaintext Storage of Shared View Passwords (low 2.7)
- [CVE-2026-2836](https://insights.sbomify.com/CVE-2026-2836/): Cache poisoning via insecure-by-default cache key (high 8.4)
- [CVE-2026-28359](https://insights.sbomify.com/CVE-2026-28359/): NocoDB: Stored Cross-Site Scripting via Rich Text Field (medium 5.3)
- [CVE-2026-28358](https://insights.sbomify.com/CVE-2026-28358/): NocoDB: User Enumeration via Password Reset Endpoint (low 2.7)
- [CVE-2026-28357](https://insights.sbomify.com/CVE-2026-28357/): NocoDB: Stored Cross-Site Scripting via Formula Cell (medium 5.3)
- [CVE-2026-28356](https://insights.sbomify.com/CVE-2026-28356/): ReDoS in multipart 1.3.0 - `parse_options_header()` (high 7.5)
- [CVE-2026-28355](https://insights.sbomify.com/CVE-2026-28355/): "PWA" Canarytoken Vulnerable to Stored Self Cross-Site Scripting (low 1.3)
- [CVE-2026-28354](https://insights.sbomify.com/CVE-2026-28354/): ClipBucket v5 has IDOR in Collection Item Management (medium 5.7)
- [CVE-2026-28353](https://insights.sbomify.com/CVE-2026-28353/): Trivy Vulnerability Scanner: Unauthorized AI Agent Execution Code Included in OpenVSX Extension Release (critical 10.0)
- [CVE-2026-28352](https://insights.sbomify.com/CVE-2026-28352/): Indico missing access check in event series management API (medium 6.5)
- [CVE-2026-28351](https://insights.sbomify.com/CVE-2026-28351/): Manipulated RunLengthDecode streams can exhaust RAM (medium 6.9)
- [CVE-2026-28350](https://insights.sbomify.com/CVE-2026-28350/): lxml_html_clean: <base> tag injection through default Cleaner configuration (medium 6.1)
- [CVE-2026-2835](https://insights.sbomify.com/CVE-2026-2835/): HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding Misparsing (critical 9.3)
- [CVE-2026-28348](https://insights.sbomify.com/CVE-2026-28348/): lxml_html_clean: CSS @import Filter Bypass via Unicode Escapes (medium 6.1)
- [CVE-2026-28343](https://insights.sbomify.com/CVE-2026-28343/): CKEditor: Cross-site scripting (XSS) in the HTML Support package (medium 6.4)
- [CVE-2026-28342](https://insights.sbomify.com/CVE-2026-28342/): OliveTin: Unauthenticated Denial of Service via Memory Exhaustion in PasswordHash API Endpoint (high 7.5)
- [CVE-2026-2834](https://insights.sbomify.com/CVE-2026-2834/): Cross-site scripting in Age Verification & Identity Verification by Token of Trust (high 7.2)
- [CVE-2026-28338](https://insights.sbomify.com/CVE-2026-28338/): PMD Designer has Stored XSS in VBHTMLRenderer and YAHTMLRenderer via unescaped violation messages (medium 6.8)
- [CVE-2026-28331](https://insights.sbomify.com/CVE-2026-28331/): SolarWinds Patch Manager Sensitive Information Exposure Vulnerability (medium 4.4)
- [CVE-2026-28330](https://insights.sbomify.com/CVE-2026-28330/): SolarWinds Observability Self-Hosted Cross-Site Scripting Vulnerability (medium 4.6)
- [CVE-2026-2833](https://insights.sbomify.com/CVE-2026-2833/): HTTP Request Smuggling via Premature Upgrade (critical 9.3)
- [CVE-2026-28329](https://insights.sbomify.com/CVE-2026-28329/): SolarWinds Observability Self-Hosted Server-Side Request Forgery (SSRF) (medium 6.4)
- [CVE-2026-28328](https://insights.sbomify.com/CVE-2026-28328/): SolarWinds Observability Self-Hosted broken authorization schema (high 8.8)
- [CVE-2026-28326](https://insights.sbomify.com/CVE-2026-28326/): SolarWinds Access Rights Manager Unauthenticated Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-28325](https://insights.sbomify.com/CVE-2026-28325/): SolarWinds Observability Self-Hosted Unauthenticated Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-28324](https://insights.sbomify.com/CVE-2026-28324/): SolarWinds Observability Self-Hosted Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-28323](https://insights.sbomify.com/CVE-2026-28323/): SolarWinds Web Help Desk SAML Authentication Bypass Vulnerability (critical 9.8)
- [CVE-2026-28322](https://insights.sbomify.com/CVE-2026-28322/): SolarWinds Database Performance Analyzer Stored Cross-Site Scripting Vulnerability (medium 5.6)
- [CVE-2026-28321](https://insights.sbomify.com/CVE-2026-28321/): SolarWinds Serv-U Broken Access Control Vulnerability (critical 9.1)
- [CVE-2026-2832](https://insights.sbomify.com/CVE-2026-2832/): Certain Samsung MultiXpress Multifunction Printers Firmware – Potential Information Disclosure (medium 5.3)
- [CVE-2026-28318](https://insights.sbomify.com/CVE-2026-28318/): SolarWinds Serv-U Uncontrolled Resource Consumption (high 7.5, exploited in the wild)
- [CVE-2026-28317](https://insights.sbomify.com/CVE-2026-28317/): SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability (critical 9.1)
- [CVE-2026-28316](https://insights.sbomify.com/CVE-2026-28316/): SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability (critical 9.1)
- [CVE-2026-28315](https://insights.sbomify.com/CVE-2026-28315/): SolarWinds Serv-U Authenticated Stored Cross-site Scripting (XSS) Vulnerability (medium 6.2)
- [CVE-2026-28314](https://insights.sbomify.com/CVE-2026-28314/): SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability (critical 9.1)
- [CVE-2026-28313](https://insights.sbomify.com/CVE-2026-28313/): SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability (critical 9.1)
- [CVE-2026-28312](https://insights.sbomify.com/CVE-2026-28312/): SolarWinds Serv-U Privilege Escalation Vulnerability (critical 9.1)
- [CVE-2026-28310](https://insights.sbomify.com/CVE-2026-28310/): SolarWinds Serv-U Privilege Escalation Vulnerability (critical 9.1)
- [CVE-2026-2831](https://insights.sbomify.com/CVE-2026-2831/): MailArchiver <= 4.5.0 - Authenticated (Admininistrator+) SQL Injection via 'logid' Parameter (medium 4.9)
- [CVE-2026-28309](https://insights.sbomify.com/CVE-2026-28309/): SolarWinds Serv-U Broken Access Control Vulnerability (critical 9.1)
- [CVE-2026-28308](https://insights.sbomify.com/CVE-2026-28308/): SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability (critical 9.1)
- [CVE-2026-28307](https://insights.sbomify.com/CVE-2026-28307/): SolarWinds Serv-U Privilege Escalation Vulnerability (critical 9.1)
- [CVE-2026-28306](https://insights.sbomify.com/CVE-2026-28306/): SolarWinds Serv-U Privilege Escalation Vulnerability (critical 9.1)
- [CVE-2026-28305](https://insights.sbomify.com/CVE-2026-28305/): SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability (critical 9.1)
- [CVE-2026-28304](https://insights.sbomify.com/CVE-2026-28304/): SolarWinds Serv-U Remote Code Execution Vulnerability (critical 9.1)
- [CVE-2026-28302](https://insights.sbomify.com/CVE-2026-28302/): SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability (critical 9.1)
- [CVE-2026-28301](https://insights.sbomify.com/CVE-2026-28301/): SolarWinds Observability Self-Hosted Open Redirect Vulnerability (medium 4.8)
- [CVE-2026-2830](https://insights.sbomify.com/CVE-2026-2830/): WP All Import <= 4.0.0 - Reflected Cross-Site Scripting via 'filepath' (medium 6.1)
- [CVE-2026-28299](https://insights.sbomify.com/CVE-2026-28299/): SolarWinds Web Help Desk Denial-of-Service Vulnerability (high 8.2)
- [CVE-2026-28298](https://insights.sbomify.com/CVE-2026-28298/): SolarWinds Observability Self-Hosted Stored Cross-Site Scripting Vulnerability (medium 5.9)
- [CVE-2026-28297](https://insights.sbomify.com/CVE-2026-28297/): SolarWinds Observability Self-Hosted Stored Cross-Site Scripting Vulnerability (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/746/