# Vulnerabilities published in 2026


- [CVE-2026-27680](https://insights.sbomify.com/CVE-2026-27680/): CSS Injection vulnerability in SAP NetWeaver Application Server ABAP (low 3.1)
- [CVE-2026-2768](https://insights.sbomify.com/CVE-2026-2768/): Sandbox escape in the Storage: IndexedDB component (critical 10.0)
- [CVE-2026-27679](https://insights.sbomify.com/CVE-2026-27679/): Missing Authorization check in SAP S/4HANA Frontend OData Service (Manage Reference Structures) (medium 6.5)
- [CVE-2026-27678](https://insights.sbomify.com/CVE-2026-27678/): Missing Authorization check in SAP S/4HANA Backend OData Service (Manage Reference Structures) (medium 6.5)
- [CVE-2026-27677](https://insights.sbomify.com/CVE-2026-27677/): Missing Authorization check in SAP S/4HANA OData Service (Manage Reference Equipment) (medium 6.5)
- [CVE-2026-27676](https://insights.sbomify.com/CVE-2026-27676/): Missing Authorization check in SAP S/4HANA OData Service (Manage Technical Object Structures) (medium 4.3)
- [CVE-2026-27675](https://insights.sbomify.com/CVE-2026-27675/): Code Injection vulnerability in SAP Landscape Transformation (low 2.0)
- [CVE-2026-27674](https://insights.sbomify.com/CVE-2026-27674/): Code Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java) (medium 6.1)
- [CVE-2026-27673](https://insights.sbomify.com/CVE-2026-27673/): Missing Authorization Check in SAP S/4HANA (Private Cloud and On-Premise) (medium 4.9)
- [CVE-2026-27672](https://insights.sbomify.com/CVE-2026-27672/): Missing Authorization check in Material Master Application (medium 4.3)
- [CVE-2026-27671](https://insights.sbomify.com/CVE-2026-27671/): Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform (critical 9.8)
- [CVE-2026-27670](https://insights.sbomify.com/CVE-2026-27670/): OpenClaw < 2026.3.2 - Arbitrary File Write via ZIP Extraction Parent Symlink Race Condition (medium 5.8)
- [CVE-2026-2767](https://insights.sbomify.com/CVE-2026-2767/): Use-after-free in the JavaScript: WebAssembly component (high 8.8)
- [CVE-2026-27668](https://insights.sbomify.com/CVE-2026-27668/): Privilege escalation in RUGGEDCOM CROSSBOW Secure Access Manager Primary (SAM-P) (high 8.7)
- [CVE-2026-27664](https://insights.sbomify.com/CVE-2026-27664/): Memory corruption in CPCI85 Central Processing/Communication (high 8.7)
- [CVE-2026-27663](https://insights.sbomify.com/CVE-2026-27663/): Denial of service in CPCI85 Central Processing/Communication (high 7.1)
- [CVE-2026-27662](https://insights.sbomify.com/CVE-2026-27662/): Missing authorization in SIMATIC HMI MTP1000 Unified Comfort Panel (high 7.0)
- [CVE-2026-27661](https://insights.sbomify.com/CVE-2026-27661/): Information disclosure in SINEC Security Monitor (medium 5.3)
- [CVE-2026-27660](https://insights.sbomify.com/CVE-2026-27660/): Gitea draft releases use insufficient permission checks (high 7.5)
- [CVE-2026-2766](https://insights.sbomify.com/CVE-2026-2766/): Use-after-free in the JavaScript Engine: JIT component (critical 9.8)
- [CVE-2026-27659](https://insights.sbomify.com/CVE-2026-27659/): CSRF vulnerability in UpdateAccessControlPolicyActiveStatus endpoint (medium 4.6)
- [CVE-2026-27657](https://insights.sbomify.com/CVE-2026-27657/): Gitea email settings allow changing another user's primary email address (high 7.5)
- [CVE-2026-27656](https://insights.sbomify.com/CVE-2026-27656/): Account Takeover via Substring Matching in OpenID Connect Authentication (medium 5.7)
- [CVE-2026-27655](https://insights.sbomify.com/CVE-2026-27655/): Stored XSS Vulnerability (high 7.3)
- [CVE-2026-27654](https://insights.sbomify.com/CVE-2026-27654/): NGINX ngx_http_dav_module vulnerability (high 8.8)
- [CVE-2026-27653](https://insights.sbomify.com/CVE-2026-27653/): Misconfiguration in Soliton SecureBrowser II (medium 5.4)
- [CVE-2026-27652](https://insights.sbomify.com/CVE-2026-27652/): CloudCharge cloudcharge.se Insufficient Session Expiration (medium 6.9)
- [CVE-2026-27651](https://insights.sbomify.com/CVE-2026-27651/): NGINX ngx_mail_auth_http_module vulnerability (high 8.7)
- [CVE-2026-27650](https://insights.sbomify.com/CVE-2026-27650/): Command injection in BUFFALO Wi-Fi router products (high 8.6)
- [CVE-2026-2765](https://insights.sbomify.com/CVE-2026-2765/): Use-after-free in the JavaScript Engine component (critical 9.8)
- [CVE-2026-27649](https://insights.sbomify.com/CVE-2026-27649/): CTEK Chargeportal Insufficient Session Expiration (medium 6.9)
- [CVE-2026-27648](https://insights.sbomify.com/CVE-2026-27648/): web_webview has an out-of-bounds write vulnerability (high 8.8)
- [CVE-2026-27647](https://insights.sbomify.com/CVE-2026-27647/): Mobility46 mobility46.se Insufficient Session Expiration (medium 6.9)
- [CVE-2026-27646](https://insights.sbomify.com/CVE-2026-27646/): OpenClaw < 2026.3.7 - Sandbox Escape via /acp spawn Command (medium 5.8)
- [CVE-2026-27645](https://insights.sbomify.com/CVE-2026-27645/): changedetection.io Vulnerable to Reflected XSS in RSS Single Watch Error Response (medium 6.1)
- [CVE-2026-27644](https://insights.sbomify.com/CVE-2026-27644/): traccar allows CSV formula injection via exported position data (medium 6.5)
- [CVE-2026-27643](https://insights.sbomify.com/CVE-2026-27643/): free5GC has improper error handling in NEF with information exposure (medium 6.6)
- [CVE-2026-27642](https://insights.sbomify.com/CVE-2026-27642/): free5GC has Improper Input Validation in UDM UEAU Service (medium 6.6)
- [CVE-2026-27641](https://insights.sbomify.com/CVE-2026-27641/): Flask-Reuploaded vulnerable to Remote Code Execution via Server-Side Template Injection (critical 9.8)
- [CVE-2026-27640](https://insights.sbomify.com/CVE-2026-27640/): tfplan2md has Sensitive Value Exposure in Generated Reports (high 8.5)
- [CVE-2026-2764](https://insights.sbomify.com/CVE-2026-2764/): JIT miscompilation, use-after-free in the JavaScript Engine: JIT component (critical 9.8)
- [CVE-2026-27639](https://insights.sbomify.com/CVE-2026-27639/): Mercator vulnerable to stored XSS via unescaped Blade directives in display templates (high 8.5)
- [CVE-2026-27638](https://insights.sbomify.com/CVE-2026-27638/): ActualBudget missing authorization in sync endpoints allows cross-user budget file access in multi-user mode (medium 5.7)
- [CVE-2026-27637](https://insights.sbomify.com/CVE-2026-27637/): FreeScout's Predictable Authentication Token Enables Account Takeover (critical 9.8)
- [CVE-2026-27636](https://insights.sbomify.com/CVE-2026-27636/): FreeScout: Missing .htaccess in Restricted File Extensions Allows Remote Code Execution on Apache (high 8.8)
- [CVE-2026-27635](https://insights.sbomify.com/CVE-2026-27635/): Manyfold vulnerable to OS command injection via ZIP filename in f3d render (high 7.5)
- [CVE-2026-27634](https://insights.sbomify.com/CVE-2026-27634/): Piwigo: Pre-auth SQL injection via date filter parameters in ws_std_image_sql_filter (high 8.7)
- [CVE-2026-27633](https://insights.sbomify.com/CVE-2026-27633/): TinyWeb has Unbounded Content-Length Memory Exhaustion (DoS) (high 8.7)
- [CVE-2026-27632](https://insights.sbomify.com/CVE-2026-27632/): Talishar Vulnerable to Cross-Site Request Forgery (CSRF) (low 2.6)
- [CVE-2026-27631](https://insights.sbomify.com/CVE-2026-27631/): Exiv2: Uncaught exception - cannot create std::vector larger than max_size() (low 2.7)
- [CVE-2026-27630](https://insights.sbomify.com/CVE-2026-27630/): TinyWeb vulnerable to Remote Denial of Service via Thread/Connection Exhaustion (Slowloris) (high 8.7)
- [CVE-2026-2763](https://insights.sbomify.com/CVE-2026-2763/): Use-after-free in the JavaScript Engine component (critical 9.8)
- [CVE-2026-27629](https://insights.sbomify.com/CVE-2026-27629/): InvenTree Vulnerable to Server Side Template Injection (SSTI) (medium 5.9)
- [CVE-2026-27628](https://insights.sbomify.com/CVE-2026-27628/): pypdf has a possible infinite loop when loading circular /Prev entries in cross-reference streams (low 1.2)
- [CVE-2026-27627](https://insights.sbomify.com/CVE-2026-27627/): Karakeep's Reddit plugin content bypasses DOMPurify sanitization, enabling stored XSS (high 8.2)
- [CVE-2026-27626](https://insights.sbomify.com/CVE-2026-27626/): OliveTin: OS Command Injection via `password` argument type and webhook JSON extraction bypasses shell safety checks (critical 10.0)
- [CVE-2026-27625](https://insights.sbomify.com/CVE-2026-27625/): Stirling-PDF Zip Slip: Arbitrary File Write via Path Traversal in Markdown-to-PDF ZIP Extraction (high 8.1)
- [CVE-2026-27624](https://insights.sbomify.com/CVE-2026-27624/): Coturn: IPv4-mapped IPv6 (::ffff:0:0/96) bypasses denied-peer-ip ACL (high 7.2)
- [CVE-2026-27623](https://insights.sbomify.com/CVE-2026-27623/): Valkey has Pre-Authentication DOS from malformed RESP request (high 7.5)
- [CVE-2026-27622](https://insights.sbomify.com/CVE-2026-27622/): OpenEXR CompositeDeepScanLine integer-overflow leads to heap OOB write (high 8.4)
- [CVE-2026-27621](https://insights.sbomify.com/CVE-2026-27621/): TypiCMS Core has Stored Cross-Site Scripting (XSS) via SVG File Upload (medium 6.8)
- [CVE-2026-2762](https://insights.sbomify.com/CVE-2026-2762/): Integer overflow in the JavaScript: Standard Library component (critical 9.8)
- [CVE-2026-27616](https://insights.sbomify.com/CVE-2026-27616/): Vikunja Vulnerable to Stored Cross-Site Scripting (XSS) via Unsanitized SVG Attachment Upload Leading to Token Exposure (high 7.3)
- [CVE-2026-27615](https://insights.sbomify.com/CVE-2026-27615/): ADB-Explorer: UNC Path Support in ManualAdbPath Leads to Remote Code Execution (RCE) (high 8.8)
- [CVE-2026-27614](https://insights.sbomify.com/CVE-2026-27614/): Bugsink is vulnerable to Stored XSS via Pygments fallback in stacktrace rendering (critical 9.3)
- [CVE-2026-27613](https://insights.sbomify.com/CVE-2026-27613/): CGI Parameter Injection (Bypass of STRICT_CGI_PARAMS and EscapeShellParam) (critical 10.0)
- [CVE-2026-27612](https://insights.sbomify.com/CVE-2026-27612/): Repostat Vulnerable to Reflected Cross-Site Scripting (XSS) via repo prop in RepoCard (medium 6.1)
- [CVE-2026-27611](https://insights.sbomify.com/CVE-2026-27611/): FileBrowser Quantum: Password Protection Not Enforced on Shared File Links (high 7.1)
- [CVE-2026-27610](https://insights.sbomify.com/CVE-2026-27610/): Parse Dashboard Has a Cache Key Collision that Leaks Master Key to Read-Only Sessions (high 7.0)
- [CVE-2026-2761](https://insights.sbomify.com/CVE-2026-2761/): Sandbox escape in the Graphics: WebRender component (critical 10.0)
- [CVE-2026-27609](https://insights.sbomify.com/CVE-2026-27609/): Parse Dashboard Missing CSRF Protection on Agent Endpoint (high 8.3)
- [CVE-2026-27608](https://insights.sbomify.com/CVE-2026-27608/): Parse Dashboard Missing Authorization on Agent Endpoint (critical 9.3)
- [CVE-2026-27607](https://insights.sbomify.com/CVE-2026-27607/): RustFS's Missing Post Policy Validation leads to Arbitrary Object Write (high 8.1)
- [CVE-2026-27606](https://insights.sbomify.com/CVE-2026-27606/): Rollup 4 has Arbitrary File Write via Path Traversal (high 8.8)
- [CVE-2026-27605](https://insights.sbomify.com/CVE-2026-27605/): Chartbrew: Stored Cross-Site Scripting (XSS) via File Upload API (medium 6.3)
- [CVE-2026-27604](https://insights.sbomify.com/CVE-2026-27604/): FOSSBilling: Improper API Role Validation (system) Enables Unauthenticated Access to Privileged Admin Functions (critical 10.0)
- [CVE-2026-27603](https://insights.sbomify.com/CVE-2026-27603/): Missing authorization in chartbrew (high 8.7)
- [CVE-2026-27602](https://insights.sbomify.com/CVE-2026-27602/): Modoboa has an OS Command Injection (high 7.2)
- [CVE-2026-27601](https://insights.sbomify.com/CVE-2026-27601/): Underscore.js has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack (high 8.2)
- [CVE-2026-27600](https://insights.sbomify.com/CVE-2026-27600/): HomeBox affected by Blind SSRF (medium 5.0)
- [CVE-2026-2760](https://insights.sbomify.com/CVE-2026-2760/): Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component (critical 10.0)
- [CVE-2026-27599](https://insights.sbomify.com/CVE-2026-27599/): ci4-cms-erp/ci4ms: System Settings (Mail Settings) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS (medium 4.7)
- [CVE-2026-27598](https://insights.sbomify.com/CVE-2026-27598/): Dagu: Path traversal in DAG creation allows arbitrary YAML file write outside DAGs directory (high 7.1)
- [CVE-2026-27597](https://insights.sbomify.com/CVE-2026-27597/): @enclave-vm/core is vulnerable to Sandbox Escape (critical 10.0)
- [CVE-2026-27596](https://insights.sbomify.com/CVE-2026-27596/): Exiv2: Integer Underflow in LoaderNative::getData() Causes Heap Buffer Overflow (low 2.7)
- [CVE-2026-27595](https://insights.sbomify.com/CVE-2026-27595/): Parse Dashboard has incomplete authentication on AI Agent endpoint (critical 9.9)
- [CVE-2026-27593](https://insights.sbomify.com/CVE-2026-27593/): Statamic is vulnerable to account takeover via password reset link injection (critical 9.3)
- [CVE-2026-27591](https://insights.sbomify.com/CVE-2026-27591/): Winter: Privilege escalation by authenticated backend users (critical 10.0)
- [CVE-2026-27590](https://insights.sbomify.com/CVE-2026-27590/): Caddy: Unicode case-folding length expansion causes incorrect split_path index in FastCGI transport (high 8.9)
- [CVE-2026-2759](https://insights.sbomify.com/CVE-2026-2759/): Incorrect boundary conditions in the Graphics: ImageLib component (critical 9.8)
- [CVE-2026-27589](https://insights.sbomify.com/CVE-2026-27589/): Caddy vulnerable to cross-origin config application via local admin API /load (caddy) (medium 6.9)
- [CVE-2026-27588](https://insights.sbomify.com/CVE-2026-27588/): Caddy: MatchHost becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass (high 7.7)
- [CVE-2026-27587](https://insights.sbomify.com/CVE-2026-27587/): Caddy: MatchPath %xx (escaped-path) branch skips case normalization, enabling path-based route/auth bypass (high 7.7)
- [CVE-2026-27586](https://insights.sbomify.com/CVE-2026-27586/): Caddy's mTLS client authentication silently fails open when CA certificate file is missing or malformed (high 8.8)
- [CVE-2026-27585](https://insights.sbomify.com/CVE-2026-27585/): Caddy's improper sanitization of glob characters in file matcher may lead to bypassing security protections (medium 6.9)
- [CVE-2026-27584](https://insights.sbomify.com/CVE-2026-27584/): ActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync endpoints (critical 9.2)
- [CVE-2026-2758](https://insights.sbomify.com/CVE-2026-2758/): Use-after-free in the JavaScript: GC component (critical 9.8)
- [CVE-2026-27579](https://insights.sbomify.com/CVE-2026-27579/): Misconfiguration in realtime-collaboration-platform (high 7.4)
- [CVE-2026-27578](https://insights.sbomify.com/CVE-2026-27578/): n8n Vulnerable to Stored XSS via Various Nodes (high 8.5)
- [CVE-2026-27577](https://insights.sbomify.com/CVE-2026-27577/): n8n: Expression Sandbox Escape Leads to RCE (critical 9.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/753/