# Vulnerabilities published in 2026


- [CVE-2026-26118](https://insights.sbomify.com/CVE-2026-26118/): Azure MCP Server Tools Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-26117](https://insights.sbomify.com/CVE-2026-26117/): Arc Enabled Servers - Azure Connected Machine Agent Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-26116](https://insights.sbomify.com/CVE-2026-26116/): SQL Server Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-26115](https://insights.sbomify.com/CVE-2026-26115/): SQL Server Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-26114](https://insights.sbomify.com/CVE-2026-26114/): Microsoft SharePoint Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-26113](https://insights.sbomify.com/CVE-2026-26113/): Microsoft Office Remote Code Execution Vulnerability (high 8.4)
- [CVE-2026-26112](https://insights.sbomify.com/CVE-2026-26112/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-26111](https://insights.sbomify.com/CVE-2026-26111/): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (high 8.0)
- [CVE-2026-26110](https://insights.sbomify.com/CVE-2026-26110/): Microsoft Office Remote Code Execution Vulnerability (high 8.4)
- [CVE-2026-2611](https://insights.sbomify.com/CVE-2026-2611/): Improper Origin Validation in mlflow/mlflow (critical 9.6)
- [CVE-2026-26109](https://insights.sbomify.com/CVE-2026-26109/): Microsoft Excel Remote Code Execution Vulnerability (high 8.4)
- [CVE-2026-26108](https://insights.sbomify.com/CVE-2026-26108/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-26107](https://insights.sbomify.com/CVE-2026-26107/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-26106](https://insights.sbomify.com/CVE-2026-26106/): Microsoft SharePoint Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-26105](https://insights.sbomify.com/CVE-2026-26105/): Microsoft SharePoint Server Spoofing Vulnerability (high 8.1)
- [CVE-2026-26104](https://insights.sbomify.com/CVE-2026-26104/): Udisks: missing authorization check allows unprivileged users to back up luks headers via udisks d-bus api (medium 5.5)
- [CVE-2026-26103](https://insights.sbomify.com/CVE-2026-26103/): Udisks: missing authorization check allows unprivileged users to restore luks headers via udisks d-bus api (high 7.1)
- [CVE-2026-26102](https://insights.sbomify.com/CVE-2026-26102/): Incorrect Permission Assignment for Critical Resource in Owl opds (high 8.5)
- [CVE-2026-26101](https://insights.sbomify.com/CVE-2026-26101/): Incorrect Permission Assignment for Critical Resource in Owl opds (high 8.5)
- [CVE-2026-26100](https://insights.sbomify.com/CVE-2026-26100/): Incorrect Permission Assignment for Critical Resource in Owl opds (medium 6.8)
- [CVE-2026-26099](https://insights.sbomify.com/CVE-2026-26099/): Uncontrolled Search Path Element in Owl opds (high 8.4)
- [CVE-2026-26098](https://insights.sbomify.com/CVE-2026-26098/): Uncontrolled Search Path Element in Owl opds (high 8.4)
- [CVE-2026-26097](https://insights.sbomify.com/CVE-2026-26097/): Uncontrolled Search Path Element in Owl opds (high 8.4)
- [CVE-2026-26096](https://insights.sbomify.com/CVE-2026-26096/): Incorrect Permission Assignment for Critical Resource in Owl opds (high 8.5)
- [CVE-2026-26095](https://insights.sbomify.com/CVE-2026-26095/): Incorrect Permission Assignment for Critical Resource in Owl opds (high 8.5)
- [CVE-2026-26093](https://insights.sbomify.com/CVE-2026-26093/): Improper Neutralization of Special Elements used in a Command ('Command Injection') in Owl opds (high 8.7)
- [CVE-2026-26084](https://insights.sbomify.com/CVE-2026-26084/): Missing authorization in FortiSandbox (high 8.9)
- [CVE-2026-26083](https://insights.sbomify.com/CVE-2026-26083/): Missing authorization in FortiSandbox (critical 9.1)
- [CVE-2026-26081](https://insights.sbomify.com/CVE-2026-26081/): Memory corruption in HAProxy (medium 4.8)
- [CVE-2026-26080](https://insights.sbomify.com/CVE-2026-26080/): Denial of service in HAProxy (low 3.7)
- [CVE-2026-2608](https://insights.sbomify.com/CVE-2026-2608/): Gutenberg Blocks by Kadence Blocks <= 3.5.32 - Missing Authorization (medium 4.3)
- [CVE-2026-26079](https://insights.sbomify.com/CVE-2026-26079/): Cross-site scripting in Webmail (medium 4.7)
- [CVE-2026-26078](https://insights.sbomify.com/CVE-2026-26078/): Discourse has authentication bypass vulnerability in the Patreon plugin webhook endpoint (high 7.5)
- [CVE-2026-26077](https://insights.sbomify.com/CVE-2026-26077/): Discourse doesn't ensure webhooks require a token (medium 6.5)
- [CVE-2026-26076](https://insights.sbomify.com/CVE-2026-26076/): ntpd-rs affected by excessive CPU load from malformed packets (medium 6.9)
- [CVE-2026-26075](https://insights.sbomify.com/CVE-2026-26075/): Cross-Site Request Forgery (CSRF) in FastGPT (medium 6.9)
- [CVE-2026-26074](https://insights.sbomify.com/CVE-2026-26074/): EVerest: OCPP201 startup event_queue lock mismatch leads to std::map/std::queue data race (high 7.0)
- [CVE-2026-26073](https://insights.sbomify.com/CVE-2026-26073/): EVerest: OCPP 1.6 heap corruption caused by lock-free insertion in event_queue (medium 5.9)
- [CVE-2026-26072](https://insights.sbomify.com/CVE-2026-26072/): EVerest has race-condition-induced std::map corruption in OCPP 1.6 evse_soc_map (medium 4.2)
- [CVE-2026-26071](https://insights.sbomify.com/CVE-2026-26071/): EVerest: OCPP 2.0.1 EVCCID Data Race Leads to Heap Use‑After‑Free (medium 4.2)
- [CVE-2026-26070](https://insights.sbomify.com/CVE-2026-26070/): EVerest: OCPP 2.0.1 EV SoC Update Race Causes Charge Point Crash (medium 4.6)
- [CVE-2026-2607](https://insights.sbomify.com/CVE-2026-2607/): Multiple vulnerabilities in IBM MQ Operator and Queue manager container images (medium 5.1)
- [CVE-2026-26069](https://insights.sbomify.com/CVE-2026-26069/): Scraparr Readarr Integration exposes sensitive values as metric labels. (critical 9.1)
- [CVE-2026-26068](https://insights.sbomify.com/CVE-2026-26068/): emp3r0r Agent-Controlled Metadata to Operator RCE (tmux Command Injection) (critical 9.3)
- [CVE-2026-26067](https://insights.sbomify.com/CVE-2026-26067/): October: Safe Mode Bypass via CSS Preprocessor Compilers (medium 4.9)
- [CVE-2026-26066](https://insights.sbomify.com/CVE-2026-26066/): ImageMagick has infinite loop when writing IPTCTEXT leads to denial of service via crafted profile (medium 6.2)
- [CVE-2026-26065](https://insights.sbomify.com/CVE-2026-26065/): calibre: Path Traversal can Lead to Arbitrary File Write and Potential Code Execution (critical 9.3)
- [CVE-2026-26064](https://insights.sbomify.com/CVE-2026-26064/): calibre: Path Traversal Vulnerability Enables Arbitrary File Write and Remote Code Execution (critical 9.3)
- [CVE-2026-26063](https://insights.sbomify.com/CVE-2026-26063/): CediPay Affected by Improper Input Validation in Payment Processing (high 8.8)
- [CVE-2026-26062](https://insights.sbomify.com/CVE-2026-26062/): Fleet server may terminate unexpectedly when handling certain gRPC requests (high 8.7)
- [CVE-2026-26061](https://insights.sbomify.com/CVE-2026-26061/): Fleet's unbounded request body read allows remote Denial of Service (high 8.7)
- [CVE-2026-26060](https://insights.sbomify.com/CVE-2026-26060/): Fleet: Password reset tokens remain valid after password change for 24 hours (medium 6.0)
- [CVE-2026-2606](https://insights.sbomify.com/CVE-2026-2606/): IBM webMethods API Management fails to validate user input and enables unauthorized arbitrary file read (medium 6.5)
- [CVE-2026-26059](https://insights.sbomify.com/CVE-2026-26059/): ChurchCRM has Stored Cross-Site Scripting (XSS) in GroupEditor.php (low 2.1)
- [CVE-2026-26058](https://insights.sbomify.com/CVE-2026-26058/): Zulip: Path Traversal in Import (medium 6.1)
- [CVE-2026-26057](https://insights.sbomify.com/CVE-2026-26057/): Skill Scanner Unsecured Network Binding Vulnerability (medium 6.5)
- [CVE-2026-26056](https://insights.sbomify.com/CVE-2026-26056/): Arbitrary WASM Code Execution via AnnotationOverrideFlight Injection in Yoke ATC (high 8.8)
- [CVE-2026-26055](https://insights.sbomify.com/CVE-2026-26055/): Unauthenticated Admission Webhook Endpoints in Yoke ATC (high 7.5)
- [CVE-2026-26054](https://insights.sbomify.com/CVE-2026-26054/): SumatraPDF: Heap out-of-bounds read in MOBI header parser. (medium 6.8)
- [CVE-2026-26053](https://insights.sbomify.com/CVE-2026-26053/): Privilege escalation in Command Centre Server (medium 5.3)
- [CVE-2026-26051](https://insights.sbomify.com/CVE-2026-26051/): Mobiliti e-mobi.hu Missing Authentication for Critical Function (critical 9.3)
- [CVE-2026-26050](https://insights.sbomify.com/CVE-2026-26050/): Other in ジョブログ集計/分析ソフトウェア RICOHジョブログ集計ツール (high 8.4)
- [CVE-2026-2605](https://insights.sbomify.com/CVE-2026-2605/): Tanium addressed an insertion of sensitive information into log file vulnerability in TanOS. (medium 5.3)
- [CVE-2026-26049](https://insights.sbomify.com/CVE-2026-26049/): Jinan USR IOT Technology Limited (PUSR) USR-W610 Insufficiently Protected Credentials (medium 5.7)
- [CVE-2026-26048](https://insights.sbomify.com/CVE-2026-26048/): Jinan USR IOT Technology Limited (PUSR) USR-W610 Missing Authentication for Critical Function (high 7.5)
- [CVE-2026-26047](https://insights.sbomify.com/CVE-2026-26047/): Moodle: moodle: uncontrolled resource consumption in tex formula editor leading to denial of service (medium 6.5)
- [CVE-2026-26046](https://insights.sbomify.com/CVE-2026-26046/): Moodle: moodle: improper input sanitization in tex filter administration setting (high 7.2)
- [CVE-2026-26045](https://insights.sbomify.com/CVE-2026-26045/): Moodle: moodle: improper validation in file restore functionality leading to remote code execution (high 7.2)
- [CVE-2026-2604](https://insights.sbomify.com/CVE-2026-2604/): Evolution-data-server: evolution data server: arbitrary file deletion via inconsistent uri handling (medium 5.6)
- [CVE-2026-26035](https://insights.sbomify.com/CVE-2026-26035/): Auth bypass in FortiWeb (high 8.8)
- [CVE-2026-26034](https://insights.sbomify.com/CVE-2026-26034/): Privilege escalation in UPS Multi-UPS Management Console (MUMC) (high 8.5)
- [CVE-2026-26033](https://insights.sbomify.com/CVE-2026-26033/): Privilege escalation in UPS Multi-UPS Management Console (MUMC) (high 8.4)
- [CVE-2026-26032](https://insights.sbomify.com/CVE-2026-26032/): Apache Ivy: PackagerResolver path traversal vulnerability (medium 5.4)
- [CVE-2026-26031](https://insights.sbomify.com/CVE-2026-26031/): Frappe LMS affected by unauthorised user was able to access the full list of batch enrolled students (low 1.3)
- [CVE-2026-26030](https://insights.sbomify.com/CVE-2026-26030/): Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable to remote code execution (critical 10.0)
- [CVE-2026-2603](https://insights.sbomify.com/CVE-2026-2603/): Keycloak: keycloak: unauthorized authentication via disabled saml identity provider (high 8.1)
- [CVE-2026-26029](https://insights.sbomify.com/CVE-2026-26029/): sf-mcp-server has a Command Injection in query_records tool due to unsafe use of child_process.exec (high 7.5)
- [CVE-2026-26028](https://insights.sbomify.com/CVE-2026-26028/): CryptPad: Sanitizer Bypass in Diffmarked.js Allows Arbitrary HTML Injection and Potential XSS (medium 6.1)
- [CVE-2026-26027](https://insights.sbomify.com/CVE-2026-26027/): GLPI has an Unauthenticated Stored XSS via inventory (high 7.5)
- [CVE-2026-26026](https://insights.sbomify.com/CVE-2026-26026/): GLPI has a Server-Side Template Injection via Double-Compilation (critical 9.1)
- [CVE-2026-26025](https://insights.sbomify.com/CVE-2026-26025/): Null dereference in smf (medium 6.6)
- [CVE-2026-26024](https://insights.sbomify.com/CVE-2026-26024/): Null dereference in smf (medium 6.6)
- [CVE-2026-26023](https://insights.sbomify.com/CVE-2026-26023/): Client‑side DOM XSS in the web chat app of Dify when using echarts (medium 5.3)
- [CVE-2026-26022](https://insights.sbomify.com/CVE-2026-26022/): Gogs: Stored XSS via data URI in issue comments (high 8.7)
- [CVE-2026-26021](https://insights.sbomify.com/CVE-2026-26021/): Prototype pollution in set-in (critical 9.4)
- [CVE-2026-26020](https://insights.sbomify.com/CVE-2026-26020/): AutoGPT Affected by Remote Code Execution via Dynamic Module Import in Block Loading (__import__) (critical 9.4)
- [CVE-2026-2602](https://insights.sbomify.com/CVE-2026-2602/): Twentig <= 1.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'featuredImageSizeWidth' (medium 6.4)
- [CVE-2026-26019](https://insights.sbomify.com/CVE-2026-26019/): @langchain/community affected by SSRF Bypass in RecursiveUrlLoader via insufficient URL origin validation (medium 4.1)
- [CVE-2026-26018](https://insights.sbomify.com/CVE-2026-26018/): CoreDNS Loop Detection Denial of Service Vulnerability (high 7.5)
- [CVE-2026-26017](https://insights.sbomify.com/CVE-2026-26017/): CoreDNS ACL Bypass (high 7.7)
- [CVE-2026-26016](https://insights.sbomify.com/CVE-2026-26016/): Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization (critical 9.2)
- [CVE-2026-26015](https://insights.sbomify.com/CVE-2026-26015/): Unauthenticated RCE in DocsGPT MCP STDIO Configuration (critical 10.0)
- [CVE-2026-26014](https://insights.sbomify.com/CVE-2026-26014/): Pion DTLS uses random nonce generation with AES GCM ciphers risks leaking the authentication key (medium 5.9)
- [CVE-2026-26013](https://insights.sbomify.com/CVE-2026-26013/): LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages (low 3.7)
- [CVE-2026-26012](https://insights.sbomify.com/CVE-2026-26012/): vaultwarden has Full Cipher Enumeration Ignoring Organization Collection Permissions (medium 6.5)
- [CVE-2026-26011](https://insights.sbomify.com/CVE-2026-26011/): Memory corruption in navigation2 (critical 9.3)
- [CVE-2026-26010](https://insights.sbomify.com/CVE-2026-26010/): Leaky JWTs in OpenMetadata exposing highly-privileged bot users (high 7.6)
- [CVE-2026-2601](https://insights.sbomify.com/CVE-2026-2601/): Missing Authorization in GitLab (medium 4.3)
- [CVE-2026-26009](https://insights.sbomify.com/CVE-2026-26009/): Catalyst Affected by Remote Code Execution as Root via Containerized Install Script Execution (critical 10.0)
- [CVE-2026-26008](https://insights.sbomify.com/CVE-2026-26008/): EVerest has OOB via EVSE ID Indexing Mismatch in OCPP 2.0.1 UpdateAllowedEnergyTransferModes (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/764/