# Vulnerabilities published in 2026


- [CVE-2026-2475](https://insights.sbomify.com/CVE-2026-2475/): Security Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access (low 3.1)
- [CVE-2026-24749](https://insights.sbomify.com/CVE-2026-24749/): Silverstripe Assets Module has a DBFile::getURL() permission bypass (medium 5.3)
- [CVE-2026-24748](https://insights.sbomify.com/CVE-2026-24748/): Kargo's `GetConfig()` and `RefreshResource()` API endpoints allow unauthenticated access (medium 6.9)
- [CVE-2026-24747](https://insights.sbomify.com/CVE-2026-24747/): PyTorch Vulnerable to Remote Code Execution via Untrusted Checkpoint Files (high 8.8)
- [CVE-2026-24746](https://insights.sbomify.com/CVE-2026-24746/): InvoicePlane has a Stored Cross-Site Scripting (XSS) issue (medium 5.7)
- [CVE-2026-24745](https://insights.sbomify.com/CVE-2026-24745/): InvoicePlane has a Stored Cross-Site Scripting (XSS) issue (medium 5.7)
- [CVE-2026-24744](https://insights.sbomify.com/CVE-2026-24744/): InvoicePlane has a Stored Cross-Site Scripting (XSS) issue (medium 5.7)
- [CVE-2026-24743](https://insights.sbomify.com/CVE-2026-24743/): InvoicePlane has a Stored Cross-Site Scripting (XSS) issue (medium 5.7)
- [CVE-2026-24742](https://insights.sbomify.com/CVE-2026-24742/): Discourse staff action logs expose sensitive information to moderators (medium 6.5)
- [CVE-2026-24741](https://insights.sbomify.com/CVE-2026-24741/): ConvertX Vulnerable to Arbitrary File Deletion via Path Traversal in `POST /delete` (high 8.1)
- [CVE-2026-24740](https://insights.sbomify.com/CVE-2026-24740/): Dozzle Agent Label-Based Access Control Bypass Allows Unauthorized Container Shell Access (high 8.7)
- [CVE-2026-2474](https://insights.sbomify.com/CVE-2026-2474/): Integer overflow in Crypt::URandom (high 7.5)
- [CVE-2026-24739](https://insights.sbomify.com/CVE-2026-24739/): Symfony has incorrect argument escaping under MSYS2/Git Bash on Windows that can lead to destructive file operations (medium 6.3)
- [CVE-2026-24738](https://insights.sbomify.com/CVE-2026-24738/): gmrtd ReadFile Vulnerable to Denial of Service via Excessive TLV Length Values (medium 5.9)
- [CVE-2026-24737](https://insights.sbomify.com/CVE-2026-24737/): jsPDF has a PDF Injection in AcroFormChoiceField which allows Arbitrary JavaScript Execution (high 8.1)
- [CVE-2026-24736](https://insights.sbomify.com/CVE-2026-24736/): Squidex has Server-Side Request Forgery (SSRF) Issue in Webhook Configuration (critical 9.1)
- [CVE-2026-24735](https://insights.sbomify.com/CVE-2026-24735/): Apache Answer: Revision API Improper Access Control leads to Information Disclosure (high 7.5)
- [CVE-2026-24734](https://insights.sbomify.com/CVE-2026-24734/): Apache Tomcat Native, Apache Tomcat: OCSP revocation bypass (high 7.4)
- [CVE-2026-24733](https://insights.sbomify.com/CVE-2026-24733/): Apache Tomcat: Security constraint bypass with HTTP/0.9 (medium 6.5)
- [CVE-2026-24732](https://insights.sbomify.com/CVE-2026-24732/): Improper permission checks in Extension:NSFileRepo (medium 6.6)
- [CVE-2026-24731](https://insights.sbomify.com/CVE-2026-24731/): EV2GO ev2go.io Missing Authentication for Critical Function (critical 9.3)
- [CVE-2026-2473](https://insights.sbomify.com/CVE-2026-2473/): Bucket Squatting in Vertex AI Experiments leads to RCE and Model Theft. (high 7.7)
- [CVE-2026-24729](https://insights.sbomify.com/CVE-2026-24729/): Interinfo DreamMaker - Unrestricted Upload of File with Dangerous Type (critical 10.0)
- [CVE-2026-24728](https://insights.sbomify.com/CVE-2026-24728/): Interinfo DreamMaker - Missing Authentication for Critical Function (critical 9.3)
- [CVE-2026-24727](https://insights.sbomify.com/CVE-2026-24727/): SUNNET Corporate Training Management System - Unrestricted Upload of File with Dangerous Type (critical 9.3)
- [CVE-2026-24724](https://insights.sbomify.com/CVE-2026-24724/): File Station 5 (medium 6.2)
- [CVE-2026-24723](https://insights.sbomify.com/CVE-2026-24723/): NULL Pointer Dereference in utilRequest.cgi (medium 5.3)
- [CVE-2026-24722](https://insights.sbomify.com/CVE-2026-24722/): Null Pointer Dereference in File Station 5 (medium 5.3)
- [CVE-2026-24721](https://insights.sbomify.com/CVE-2026-24721/): Null Pointer Dereference in File Station 5 (medium 5.3)
- [CVE-2026-24720](https://insights.sbomify.com/CVE-2026-24720/): File Station 5 (low 1.3)
- [CVE-2026-2472](https://insights.sbomify.com/CVE-2026-2472/): Stored Cross-Site Scripting (XSS) in Vertex AI Python SDK Visualization (high 8.6)
- [CVE-2026-24719](https://insights.sbomify.com/CVE-2026-24719/): QTS, QuTS hero (medium 6.1)
- [CVE-2026-24718](https://insights.sbomify.com/CVE-2026-24718/): Path Traversal Vulnerability in Qsync Central's qsyncsrv.cgi (medium 5.3)
- [CVE-2026-24717](https://insights.sbomify.com/CVE-2026-24717/): QTS, QuTS hero (low 1.2)
- [CVE-2026-24716](https://insights.sbomify.com/CVE-2026-24716/): QTS, QuTS hero (low 1.2)
- [CVE-2026-24715](https://insights.sbomify.com/CVE-2026-24715/): Lack of Reproducible Vulnerability Evidence in QNAP Report (medium 5.3)
- [CVE-2026-24714](https://insights.sbomify.com/CVE-2026-24714/): Security feature bypass in NETGEAR products (high 8.7)
- [CVE-2026-24713](https://insights.sbomify.com/CVE-2026-24713/): Apache IoTDB: JEXL Expression Injection Vulnerability (critical 9.8)
- [CVE-2026-24712](https://insights.sbomify.com/CVE-2026-24712/): Command injection in northern.tech:cfengine (high 7.3)
- [CVE-2026-24711](https://insights.sbomify.com/CVE-2026-24711/): Missing authorization in northern.tech:cfengine (medium 5.3)
- [CVE-2026-24710](https://insights.sbomify.com/CVE-2026-24710/): Cross-site scripting in northern.tech:cfengine (medium 6.1)
- [CVE-2026-2471](https://insights.sbomify.com/CVE-2026-2471/): WP Mail Logging <= 1.15.0 - Unauthenticated PHP Object Injection via Email Log Message Field (high 7.5)
- [CVE-2026-24708](https://insights.sbomify.com/CVE-2026-24708/): OpenStack Nova calls qemu-img without format restrictions for resize (high 8.2)
- [CVE-2026-24700](https://insights.sbomify.com/CVE-2026-24700/): Command injection in cisco:rv110w firmware (high 7.2)
- [CVE-2026-2470](https://insights.sbomify.com/CVE-2026-2470/): Pagelayer <= 2.0.9 - Incorrect Authorization to Authenticated (Contributor+) Mail Relay Configuration via 'contacts' (medium 4.3)
- [CVE-2026-24699](https://insights.sbomify.com/CVE-2026-24699/): Command injection in cisco:rv110w firmware (high 7.2)
- [CVE-2026-24698](https://insights.sbomify.com/CVE-2026-24698/): Command injection in cisco:rv110w firmware (high 7.2)
- [CVE-2026-24697](https://insights.sbomify.com/CVE-2026-24697/): Command injection in cisco:rv110w firmware (high 7.2)
- [CVE-2026-24696](https://insights.sbomify.com/CVE-2026-24696/): Everon api.everon.io Improper Restriction of Excessive Authentication Attempts (high 8.7)
- [CVE-2026-24695](https://insights.sbomify.com/CVE-2026-24695/): Copeland XWEB and XWEB Pro OS Command Injection (high 8.0)
- [CVE-2026-24694](https://insights.sbomify.com/CVE-2026-24694/): Other in Roland Cloud Manager (high 8.4)
- [CVE-2026-24693](https://insights.sbomify.com/CVE-2026-24693/): Security feature bypass in Intel(R) oneCCL Bindings for PyTorch (medium 5.4)
- [CVE-2026-24692](https://insights.sbomify.com/CVE-2026-24692/): Guest users can bypass read permissions via search API (medium 4.3)
- [CVE-2026-24690](https://insights.sbomify.com/CVE-2026-24690/): Gitea pull-request branch updates use insufficient permission checks (high 7.5)
- [CVE-2026-2469](https://insights.sbomify.com/CVE-2026-2469/): ImapEngine affected by command injection via the ID command parameters (high 7.2)
- [CVE-2026-24689](https://insights.sbomify.com/CVE-2026-24689/): Copeland XWEB and XWEB Pro OS Command Injection (high 8.0)
- [CVE-2026-24688](https://insights.sbomify.com/CVE-2026-24688/): pypdf has possible Infinite Loop when processing outlines/bookmarks (medium 5.1)
- [CVE-2026-24687](https://insights.sbomify.com/CVE-2026-24687/): Umbraco.Forms has path traversal and file enumeration vulnerability in Linux/Mac (medium 6.0)
- [CVE-2026-24686](https://insights.sbomify.com/CVE-2026-24686/): go-tuf Path Traversal in TAP 4 Multirepo Client Allows Arbitrary File Write via Malicious Repository Names (medium 4.7)
- [CVE-2026-24685](https://insights.sbomify.com/CVE-2026-24685/): OpenProject has Argument Injection on Repository module that allows Arbitrary File Write (critical 9.4)
- [CVE-2026-24684](https://insights.sbomify.com/CVE-2026-24684/): FreeRDP has a Heap-use-after-free in play_thread (high 8.7)
- [CVE-2026-24683](https://insights.sbomify.com/CVE-2026-24683/): FreeRDP has a heap-use-after-free in ainput_send_input_event (high 8.7)
- [CVE-2026-24682](https://insights.sbomify.com/CVE-2026-24682/): FreeRDP has a Heap-buffer-overflow in audio_formats_free (high 8.7)
- [CVE-2026-24681](https://insights.sbomify.com/CVE-2026-24681/): FreeRDP has a heap-use-after-free in urb_bulk_transfer_cb (high 8.7)
- [CVE-2026-24680](https://insights.sbomify.com/CVE-2026-24680/): FreeRDP has a heap-use-after-free in update_pointer_new(SDL) (high 8.7)
- [CVE-2026-2468](https://insights.sbomify.com/CVE-2026-2468/): Quentn WP <= 1.2.12 - Unauthenticated SQL Injection via 'qntn_wp_access' Cookie (high 7.5)
- [CVE-2026-24679](https://insights.sbomify.com/CVE-2026-24679/): FreeRDP has a heap-buffer-overflow in urb_select_interface (high 8.7)
- [CVE-2026-24678](https://insights.sbomify.com/CVE-2026-24678/): FreeRDP has a Heap-use-after-free in cam_v4l_stream_capture_thread (high 8.7)
- [CVE-2026-24677](https://insights.sbomify.com/CVE-2026-24677/): FreeRDP has a heap-buffer-overflow in ecam_encoder_compress_h264 (high 8.7)
- [CVE-2026-24676](https://insights.sbomify.com/CVE-2026-24676/): FreeRDP has a heap-use-after-free in audio_format_compatible (high 7.7)
- [CVE-2026-24675](https://insights.sbomify.com/CVE-2026-24675/): FreeRDP has a Heap-use-after-free in urb_select_interface (high 7.7)
- [CVE-2026-24674](https://insights.sbomify.com/CVE-2026-24674/): Open eClass is Vulnerable to Reflected Cross-Site Scripting (XSS) in Multiple Endpoints (medium 4.7)
- [CVE-2026-24673](https://insights.sbomify.com/CVE-2026-24673/): Open eClass Has File Upload Filter Bypass via ZIP Archive Extraction (medium 4.3)
- [CVE-2026-24672](https://insights.sbomify.com/CVE-2026-24672/): Open eClass is Vulnerable to Stored Cross-Site Scripting (XSS) in User Profile Fields (high 7.3)
- [CVE-2026-24671](https://insights.sbomify.com/CVE-2026-24671/): Open eClass is Vulnerable to Stored Cross-Site Scripting (XSS) in Multiple High-Privilege User Fields (medium 6.1)
- [CVE-2026-24670](https://insights.sbomify.com/CVE-2026-24670/): Open eClass Has Broken Access Control in Course Units Module Allows Students to Create Units (medium 6.5)
- [CVE-2026-2467](https://insights.sbomify.com/CVE-2026-2467/): Memory corruption in Connext Professional (critical 9.2)
- [CVE-2026-24669](https://insights.sbomify.com/CVE-2026-24669/): Open eClass Insecure Password Reset Token Reuse Enables Account Takeover (high 7.8)
- [CVE-2026-24668](https://insights.sbomify.com/CVE-2026-24668/): Open eClass Broken Access Control Allows Students to Add Content to Course Units (medium 6.5)
- [CVE-2026-24667](https://insights.sbomify.com/CVE-2026-24667/): Open eClass's Active Sessions Not Invalidated After Password Change Allow Persistent Account Access (medium 5.0)
- [CVE-2026-24666](https://insights.sbomify.com/CVE-2026-24666/): Open eClass is Vulnerable to CSRF in Teacher-Restricted Endpoints Allows Unauthorized Actions (medium 6.5)
- [CVE-2026-24665](https://insights.sbomify.com/CVE-2026-24665/): Open eClass is Vulnerable to Stored Cross-Site Scripting (XSS) via Student Assignment Upload (high 8.7)
- [CVE-2026-24664](https://insights.sbomify.com/CVE-2026-24664/): Open eClass is Vulnerable to Username Enumeration via Login Response Discrepancies (medium 5.3)
- [CVE-2026-24663](https://insights.sbomify.com/CVE-2026-24663/): Copeland XWEB and XWEB Pro OS Command Injection (critical 9.0)
- [CVE-2026-24662](https://insights.sbomify.com/CVE-2026-24662/): Cross-site scripting in Musetheque V4 Information Disclosure for IPKNOWLEDGE (medium 4.8)
- [CVE-2026-24661](https://insights.sbomify.com/CVE-2026-24661/): Unbounded Request Body Read in MS Teams Plugin {{/changes}} Webhook Endpoint (low 3.7)
- [CVE-2026-24660](https://insights.sbomify.com/CVE-2026-24660/): Memory corruption in LibRaw (high 8.1)
- [CVE-2026-2466](https://insights.sbomify.com/CVE-2026-2466/): DukaPress <= 3.2.4 - Reflected XSS (high 7.1)
- [CVE-2026-24656](https://insights.sbomify.com/CVE-2026-24656/): Apache Karaf: Decanter log-socket collector has deserialization vulnerability (low 3.7)
- [CVE-2026-2465](https://insights.sbomify.com/CVE-2026-2465/): Improper Authorization in E-Kalite's Turboard FOR-S (high 8.8)
- [CVE-2026-24641](https://insights.sbomify.com/CVE-2026-24641/): Null dereference in FortiWeb (low 2.5)
- [CVE-2026-24640](https://insights.sbomify.com/CVE-2026-24640/): Memory corruption in FortiWeb (medium 5.9)
- [CVE-2026-2464](https://insights.sbomify.com/CVE-2026-2464/): Directory Traversal in AMR Printer Management by AMR (high 8.7)
- [CVE-2026-24639](https://insights.sbomify.com/CVE-2026-24639/): WordPress Photo Block plugin <= 1.7.1 - Server Side Request Forgery (SSRF) vulnerability (medium 4.4)
- [CVE-2026-24638](https://insights.sbomify.com/CVE-2026-24638/): WordPress RepairBuddy plugin <= 4.1121 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-24637](https://insights.sbomify.com/CVE-2026-24637/): WordPress PowerPress Podcasting plugin <= 11.15.10 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-24636](https://insights.sbomify.com/CVE-2026-24636/): WordPress Sugar Calendar (Lite) plugin <= 3.9.1 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-24635](https://insights.sbomify.com/CVE-2026-24635/): WordPress EduBlink Core plugin <= 2.0.7 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-24634](https://insights.sbomify.com/CVE-2026-24634/): WordPress Ultimate Reviews plugin <= 3.2.16 - Insecure Direct Object References (IDOR) vulnerability (medium 5.3)
- [CVE-2026-24633](https://insights.sbomify.com/CVE-2026-24633/): WordPress Add Expires Headers & Optimized Minify plugin <= 3.2.0 - Broken Access Control vulnerability (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/777/