# Vulnerabilities published in 2026


- [CVE-2026-26333](https://insights.sbomify.com/CVE-2026-26333/): Calero VeraSMART < 2022 R1 .NET Remoting Arbitrary File Read Leading to ViewState RCE (critical 10.0)
- [CVE-2026-26332](https://insights.sbomify.com/CVE-2026-26332/): vm2: Sandbox Escape (critical 9.8)
- [CVE-2026-26331](https://insights.sbomify.com/CVE-2026-26331/): yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option (high 8.8)
- [CVE-2026-26330](https://insights.sbomify.com/CVE-2026-26330/): Envoy's global rate limit may crash when the response phase limit is enabled and the response phase request is failed directly (medium 5.3)
- [CVE-2026-2633](https://insights.sbomify.com/CVE-2026-2633/): Missing authorization in Kadence Blocks — Page Builder Toolkit for Gutenberg Editor (medium 4.3)
- [CVE-2026-26329](https://insights.sbomify.com/CVE-2026-26329/): OpenClaw has a path traversal in browser upload allows local file read (high 7.1)
- [CVE-2026-26328](https://insights.sbomify.com/CVE-2026-26328/): OpenClaw iMessage group allowlist authorization inherited DM pairing-store identities (medium 6.5)
- [CVE-2026-26327](https://insights.sbomify.com/CVE-2026-26327/): OpenClaw allows unauthenticated discovery TXT records to steer routing and TLS pinning (high 7.1)
- [CVE-2026-26326](https://insights.sbomify.com/CVE-2026-26326/): OpenClaw skills.status could leak secrets to operator.read clients (medium 5.3)
- [CVE-2026-26325](https://insights.sbomify.com/CVE-2026-26325/): OpenClaw Node host system.run rawCommand/command mismatch can bypass allowlist/approvals (high 7.2)
- [CVE-2026-26324](https://insights.sbomify.com/CVE-2026-26324/): OpenClaw has a SSRF guard bypass via full-form IPv4-mapped IPv6 (loopback / metadata reachable) (high 7.5)
- [CVE-2026-26323](https://insights.sbomify.com/CVE-2026-26323/): OpenClaw has a command injection in maintainer clawtributors updater (high 8.6)
- [CVE-2026-26322](https://insights.sbomify.com/CVE-2026-26322/): OpenClaw Gateway tool allowed unrestricted gatewayUrl override (high 7.6)
- [CVE-2026-26321](https://insights.sbomify.com/CVE-2026-26321/): OpenClaw has a local file disclosure via sendMediaFeishu in Feishu extension (high 7.5)
- [CVE-2026-26320](https://insights.sbomify.com/CVE-2026-26320/): OpenClaw macOS deep link confirmation truncation can conceal executed agent message (high 7.1)
- [CVE-2026-26319](https://insights.sbomify.com/CVE-2026-26319/): OpenClaw has Missing Webhook Authentication in Telnyx Provider Allowing Unauthenticated Requests (high 7.5)
- [CVE-2026-26318](https://insights.sbomify.com/CVE-2026-26318/): systeminformation has Command Injection via Unsanitized `locate` Output in `versions()` (high 8.8)
- [CVE-2026-26317](https://insights.sbomify.com/CVE-2026-26317/): OpenClaw affected by cross-site request forgery (CSRF) through loopback browser mutation endpoints (high 7.1)
- [CVE-2026-26316](https://insights.sbomify.com/CVE-2026-26316/): OpenClaw has BlueBubbles webhook auth bypass via loopback proxy trust (high 7.5)
- [CVE-2026-26315](https://insights.sbomify.com/CVE-2026-26315/): Go Ethereum Improperly Validates the ECIES Public Key in RLPx Handshake (medium 6.9)
- [CVE-2026-26314](https://insights.sbomify.com/CVE-2026-26314/): Go Ethereum affected by DoS via malicious p2p message (high 8.7)
- [CVE-2026-26313](https://insights.sbomify.com/CVE-2026-26313/): Go Ethereum affected by DoS via malicious p2p message (medium 6.9)
- [CVE-2026-26312](https://insights.sbomify.com/CVE-2026-26312/): Stalwart Mail Server has Out-of-Memory Denial of Service via Malformed Nested MIME Messages (medium 6.5)
- [CVE-2026-26311](https://insights.sbomify.com/CVE-2026-26311/): Envoy HTTP: filter chain execution on reset streams causing UAF crash (medium 5.9)
- [CVE-2026-26310](https://insights.sbomify.com/CVE-2026-26310/): Crash for scoped ip address in Envoy during DNS (medium 5.9)
- [CVE-2026-2631](https://insights.sbomify.com/CVE-2026-2631/): Datalogics Ecommerce Delivery < 2.6.60 - Unauthenticated Privilege Escalation (critical 9.8)
- [CVE-2026-26309](https://insights.sbomify.com/CVE-2026-26309/): Envoy has an off-by-one write in JsonEscaper::escapeString() (medium 5.3)
- [CVE-2026-26308](https://insights.sbomify.com/CVE-2026-26308/): Envoy has an RBAC Header Validation Bypass via Multi-Value Header Concatenation (high 7.5)
- [CVE-2026-26307](https://insights.sbomify.com/CVE-2026-26307/): Gitea git grep search lacks a timeout (high 7.5)
- [CVE-2026-26306](https://insights.sbomify.com/CVE-2026-26306/): Other in OM Workspace (Windows Edition) (high 8.4)
- [CVE-2026-26305](https://insights.sbomify.com/CVE-2026-26305/): Mobility46 mobility46.se Improper Restriction of Excessive Authentication Attempts (high 8.7)
- [CVE-2026-26304](https://insights.sbomify.com/CVE-2026-26304/): Permission Bypass in Playbook Run Creation (medium 4.3)
- [CVE-2026-2630](https://insights.sbomify.com/CVE-2026-2630/): Command injection in Security Center (high 7.4)
- [CVE-2026-26292](https://insights.sbomify.com/CVE-2026-26292/): Gitea LFS mirror synchronization bypasses migration HTTP transport restrictions (critical 9.8)
- [CVE-2026-26291](https://insights.sbomify.com/CVE-2026-26291/): Cross-site scripting in GROWI (medium 4.8)
- [CVE-2026-26290](https://insights.sbomify.com/CVE-2026-26290/): EV Energy ev.energy Insufficient Session Expiration (medium 6.9)
- [CVE-2026-2629](https://insights.sbomify.com/CVE-2026-2629/): jishi node-sonos-http-api TTS Provider mac-os.js Promise os command injection (medium 6.9)
- [CVE-2026-26289](https://insights.sbomify.com/CVE-2026-26289/): Subnet Solutions PowerSYSTEM Center Incorrect Authorization (high 8.4)
- [CVE-2026-26288](https://insights.sbomify.com/CVE-2026-26288/): Everon api.everon.io Missing Authentication for Critical Function (critical 9.3)
- [CVE-2026-26287](https://insights.sbomify.com/CVE-2026-26287/): External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration (high 7.1)
- [CVE-2026-26286](https://insights.sbomify.com/CVE-2026-26286/): SillyTavern has Server-Side Request Forgery (SSRF) via Asset Download Endpoint that Allows Reading Internal Services (high 7.1)
- [CVE-2026-26284](https://insights.sbomify.com/CVE-2026-26284/): ImageMagick has heap overflow in pcd decoder that leads to out of bounds read. (medium 6.5)
- [CVE-2026-26283](https://insights.sbomify.com/CVE-2026-26283/): ImageMagick has possible infinite loop in JPEG encoder when using `jpeg:extent` (medium 6.2)
- [CVE-2026-26282](https://insights.sbomify.com/CVE-2026-26282/): NanaZip has DotNet Single file OOB Heap Read (medium 5.2)
- [CVE-2026-26281](https://insights.sbomify.com/CVE-2026-26281/): InvoicePlane has Stored Cross-Site Scripting (XSS) Issue in Sumex Invoice View (medium 4.4)
- [CVE-2026-26280](https://insights.sbomify.com/CVE-2026-26280/): Systeminformation has a Command Injection via unsanitized interface parameter in wifi.js retry path (high 8.4)
- [CVE-2026-2628](https://insights.sbomify.com/CVE-2026-2628/): All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login <= 2.2.5 - Authentication Bypass (critical 9.8)
- [CVE-2026-26279](https://insights.sbomify.com/CVE-2026-26279/): Froxlor Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injection (critical 9.1)
- [CVE-2026-26278](https://insights.sbomify.com/CVE-2026-26278/): fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit) (high 7.5)
- [CVE-2026-26276](https://insights.sbomify.com/CVE-2026-26276/): Gogs: DOM-based XSS via milestone selection (high 7.3)
- [CVE-2026-26275](https://insights.sbomify.com/CVE-2026-26275/): httpsig-hyper has Improper Digest Verification that May Allow Message Integrity Bypass (high 7.5)
- [CVE-2026-26274](https://insights.sbomify.com/CVE-2026-26274/): October: Safe Mode Bypass via Twig Database Write Operations (medium 6.6)
- [CVE-2026-26273](https://insights.sbomify.com/CVE-2026-26273/): Known affected by Account Takeover via Password Reset Token Leakage (critical 9.8)
- [CVE-2026-26272](https://insights.sbomify.com/CVE-2026-26272/): HomeBox affected by Stored XSS via HTML/SVG Attachment Upload (medium 4.6)
- [CVE-2026-26271](https://insights.sbomify.com/CVE-2026-26271/): Buffer Overread in FreeRDP Icon Processing (medium 5.5)
- [CVE-2026-26270](https://insights.sbomify.com/CVE-2026-26270/): InvoicePlane has Stored Cross-Site Scripting Issue in Identifier Formatting (medium 5.4)
- [CVE-2026-2627](https://insights.sbomify.com/CVE-2026-2627/): Softland FBackup Backup/Restore HID.dll link following (high 8.5)
- [CVE-2026-26269](https://insights.sbomify.com/CVE-2026-26269/): Vim has a Netbeans specialKeys Stack Buffer Overflow (medium 5.4)
- [CVE-2026-26268](https://insights.sbomify.com/CVE-2026-26268/): Cursor sandbox escape via Git hooks (high 8.1)
- [CVE-2026-26267](https://insights.sbomify.com/CVE-2026-26267/): rs-soroban-sdk #[contractimpl] macro calls inherent function instead of trait function when names collide (high 7.5)
- [CVE-2026-26266](https://insights.sbomify.com/CVE-2026-26266/): AliasVault affected by Cross-Site Scripting (XSS) via Email HTML Rendering (critical 9.3)
- [CVE-2026-26265](https://insights.sbomify.com/CVE-2026-26265/): Discourse has IDOR vulnerability in the directory items endpoint (high 7.5)
- [CVE-2026-26264](https://insights.sbomify.com/CVE-2026-26264/): BACnet Stack WriteProperty decoding length underflow leads to OOB read and crash (high 7.8)
- [CVE-2026-26263](https://insights.sbomify.com/CVE-2026-26263/): GLPI has an Unauthenticated SQL Injection via Search engine (high 8.1)
- [CVE-2026-2626](https://insights.sbomify.com/CVE-2026-2626/): Divi Booster < 5.0.2 - Unauthenticated PHP Object Injection (high 8.1)
- [CVE-2026-2625](https://insights.sbomify.com/CVE-2026-2625/): Rust-rpm-sequoia: rust-rpm-sequoia: denial of service via crafted rpm file during signature verification (medium 4.0)
- [CVE-2026-26247](https://insights.sbomify.com/CVE-2026-26247/): Gitea OAuth2 PKCE S256 challenges are not enforced during token exchange (critical 9.1)
- [CVE-2026-26246](https://insights.sbomify.com/CVE-2026-26246/): Memory Exhaustion via Malformed PSD File Upload (medium 4.3)
- [CVE-2026-26245](https://insights.sbomify.com/CVE-2026-26245/): SQLi#2 SQL Injection in class_videos.php getSmartVideosByOffset (high 7.1)
- [CVE-2026-26244](https://insights.sbomify.com/CVE-2026-26244/): SQLi#1 SQL Injection in class_videos.php _getFilters (high 7.1)
- [CVE-2026-26243](https://insights.sbomify.com/CVE-2026-26243/): Arbitrary Folder Deletion in Qsync Central 5.0.0.5 (high 7.2)
- [CVE-2026-26241](https://insights.sbomify.com/CVE-2026-26241/): File Station 5 (low 1.3)
- [CVE-2026-26240](https://insights.sbomify.com/CVE-2026-26240/): File Station 5 (low 1.3)
- [CVE-2026-2624](https://insights.sbomify.com/CVE-2026-2624/): Authentication Bypass in ePati's Antikor NGFW (critical 9.8)
- [CVE-2026-26239](https://insights.sbomify.com/CVE-2026-26239/): File Station 5 (medium 6.3)
- [CVE-2026-26237](https://insights.sbomify.com/CVE-2026-26237/): QuMagie (medium 6.6)
- [CVE-2026-26236](https://insights.sbomify.com/CVE-2026-26236/): QuMagie (medium 6.6)
- [CVE-2026-26235](https://insights.sbomify.com/CVE-2026-26235/): JUNG Smart Visu Server 1.1.1050 - 'JUNG Smart Visu Server' Missing Authentication (high 8.7)
- [CVE-2026-26234](https://insights.sbomify.com/CVE-2026-26234/): JUNG Smart Visu Server - Improper Neutralization of HTTP Headers for Scripting Syntax (high 8.7)
- [CVE-2026-26233](https://insights.sbomify.com/CVE-2026-26233/): Denial of Service via HTTP/2 single packet attack on login endpoint (medium 4.3)
- [CVE-2026-26232](https://insights.sbomify.com/CVE-2026-26232/): Gitea OAuth2 authorization codes lack expiry and reuse enforcement (critical 9.1)
- [CVE-2026-26231](https://insights.sbomify.com/CVE-2026-26231/): Gitea maintainer-edit permissions allow unauthorized commits to readable repositories (high 8.5)
- [CVE-2026-26230](https://insights.sbomify.com/CVE-2026-26230/): Team Admin Privilege Escalation to Demote Members to Guest (low 3.8)
- [CVE-2026-2623](https://insights.sbomify.com/CVE-2026-2623/): Blossom File Upload BLOSManager.java put path traversal (medium 5.3)
- [CVE-2026-26228](https://insights.sbomify.com/CVE-2026-26228/): VLC for Android < 3.7.0 Remote Access Path Traversal (low 2.3)
- [CVE-2026-26227](https://insights.sbomify.com/CVE-2026-26227/): VLC for Android < 3.7.0 Remote Access OTP Authentication Bypass (medium 6.3)
- [CVE-2026-26226](https://insights.sbomify.com/CVE-2026-26226/): beautiful-mermaid < 0.1.3 SVG Attribute Injection (medium 5.3)
- [CVE-2026-26225](https://insights.sbomify.com/CVE-2026-26225/): Intego Personal Backup Task File Privilege Escalation (high 8.5)
- [CVE-2026-26224](https://insights.sbomify.com/CVE-2026-26224/): Intego Log Reporter TOCTOU Local Privilege Escalation (high 8.5)
- [CVE-2026-26223](https://insights.sbomify.com/CVE-2026-26223/): SPIP < 4.4.8 Cross-Site Scripting via Iframe Tags in Private Area (medium 5.1)
- [CVE-2026-26222](https://insights.sbomify.com/CVE-2026-26222/): DocLink .NET Remoting Unauthenticated Arbitrary File Read/Write RCE (critical 10.0)
- [CVE-2026-26221](https://insights.sbomify.com/CVE-2026-26221/): Hyland OnBase Timer Service Unauthenticated .NET Remoting RCE (critical 9.3)
- [CVE-2026-26220](https://insights.sbomify.com/CVE-2026-26220/): LightLLM <= 1.1.0 PD Mode Unsafe Deserialization RCE (critical 9.3)
- [CVE-2026-2622](https://insights.sbomify.com/CVE-2026-2622/): Blossom Article Title ArticleController.java content cross site scripting (medium 5.1)
- [CVE-2026-26219](https://insights.sbomify.com/CVE-2026-26219/): newbee-mall Unsalted MD5 Password Hashing Enables Offline Credential Cracking (critical 9.3)
- [CVE-2026-26218](https://insights.sbomify.com/CVE-2026-26218/): newbee-mall Default Seeded Administrator Credentials Allow Account Takeover (critical 9.3)
- [CVE-2026-26217](https://insights.sbomify.com/CVE-2026-26217/): Crawl4AI < 0.8.0 Docker API Local File Inclusion via file URL Handling (critical 9.2)
- [CVE-2026-26216](https://insights.sbomify.com/CVE-2026-26216/): Crawl4AI < 0.8.0 Docker API Unauthenticated Remote Code Execution via Hooks Parameter (critical 10.0)
- [CVE-2026-26215](https://insights.sbomify.com/CVE-2026-26215/): manga-image-translator Shared API Unsafe Deserialization RCE (critical 9.3)
- [CVE-2026-26214](https://insights.sbomify.com/CVE-2026-26214/): Xiaomi Galaxy FDS Android SDK <= 3.0.8 TLS Hostname Verification Disabled Enables MITM (critical 9.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/762/