# Vulnerabilities published in 2026


- [CVE-2026-24317](https://insights.sbomify.com/CVE-2026-24317/): DLL Hijacking vulnerability in SAP GUI for Windows with active GuiXT (medium 5.0)
- [CVE-2026-24316](https://insights.sbomify.com/CVE-2026-24316/): Server-Side Request Forgery (SSRF) in SAP NetWeaver Application Server for ABAP (medium 6.4)
- [CVE-2026-24315](https://insights.sbomify.com/CVE-2026-24315/): Path Traversal Vulnerability in SAP Fiori (launchpad) (medium 4.2)
- [CVE-2026-24314](https://insights.sbomify.com/CVE-2026-24314/): Information Disclosure vulnerability in S/4HANA (Manage Payment Media) (medium 4.3)
- [CVE-2026-24313](https://insights.sbomify.com/CVE-2026-24313/): Missing Authorization check in SAP Solution Tools Plug-In (ST-PI) (medium 5.0)
- [CVE-2026-24312](https://insights.sbomify.com/CVE-2026-24312/): Missing authorization check in SAP Business Workflow (medium 5.2)
- [CVE-2026-24311](https://insights.sbomify.com/CVE-2026-24311/): Insecure Storage Protection vulnerability in SAP Customer Checkout 2.0 (medium 5.6)
- [CVE-2026-24310](https://insights.sbomify.com/CVE-2026-24310/): Missing Authorization check in SAP NetWeaver Application Server for ABAP (low 3.5)
- [CVE-2026-2431](https://insights.sbomify.com/CVE-2026-2431/): CM Custom Reports <= 1.2.7 - Reflected Cross-Site Scripting via 'date_from' and 'date_to' Parameters (medium 6.1)
- [CVE-2026-24309](https://insights.sbomify.com/CVE-2026-24309/): Missing Authorization check in SAP NetWeaver Application Server for ABAP (medium 6.4)
- [CVE-2026-24308](https://insights.sbomify.com/CVE-2026-24308/): Apache ZooKeeper: Sensitive information disclosure in client configuration handling (medium 6.5)
- [CVE-2026-24307](https://insights.sbomify.com/CVE-2026-24307/): M365 Copilot Information Disclosure Vulnerability (critical 9.3)
- [CVE-2026-24306](https://insights.sbomify.com/CVE-2026-24306/): Azure Front Door Elevation of Privilege Vulnerability (critical 9.8)
- [CVE-2026-24305](https://insights.sbomify.com/CVE-2026-24305/): Azure Entra ID Elevation of Privilege Vulnerability (critical 9.3)
- [CVE-2026-24304](https://insights.sbomify.com/CVE-2026-24304/): Azure Resource Manager Elevation of Privilege Vulnerability (critical 9.9)
- [CVE-2026-24303](https://insights.sbomify.com/CVE-2026-24303/): Microsoft Partner Center Elevation of Privilege Vulnerability (critical 9.6)
- [CVE-2026-24302](https://insights.sbomify.com/CVE-2026-24302/): Azure Arc Elevation of Privilege Vulnerability (high 8.6)
- [CVE-2026-24301](https://insights.sbomify.com/CVE-2026-24301/): Microsoft Copilot Information Disclosure Vulnerability (high 8.8)
- [CVE-2026-24300](https://insights.sbomify.com/CVE-2026-24300/): Azure Front Door Elevation of Privilege Vulnerability (critical 9.8)
- [CVE-2026-2430](https://insights.sbomify.com/CVE-2026-2430/): Autoptimize <= 3.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy-loaded Image Attributes (medium 6.4)
- [CVE-2026-24299](https://insights.sbomify.com/CVE-2026-24299/): M365 Copilot Information Disclosure Vulnerability (medium 5.3)
- [CVE-2026-24297](https://insights.sbomify.com/CVE-2026-24297/): Windows Kerberos Security Feature Bypass Vulnerability (medium 6.5)
- [CVE-2026-24296](https://insights.sbomify.com/CVE-2026-24296/): Windows Device Association Service Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-24295](https://insights.sbomify.com/CVE-2026-24295/): Windows Device Association Service Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-24294](https://insights.sbomify.com/CVE-2026-24294/): Windows SMB Server Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-24293](https://insights.sbomify.com/CVE-2026-24293/): Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-24292](https://insights.sbomify.com/CVE-2026-24292/): Windows Connected Devices Platform Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-24291](https://insights.sbomify.com/CVE-2026-24291/): Windows Accessibility Infrastructure (ATBroker.exe) Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-24290](https://insights.sbomify.com/CVE-2026-24290/): Windows Projected File System Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-2429](https://insights.sbomify.com/CVE-2026-2429/): Community Events <= 1.5.8 - Authenticated (Administrator+) SQL Injection via 'ce_venue_name' CSV Field (medium 4.9)
- [CVE-2026-24289](https://insights.sbomify.com/CVE-2026-24289/): Windows Kernel Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-24288](https://insights.sbomify.com/CVE-2026-24288/): Windows Mobile Broadband Driver Remote Code Execution Vulnerability (medium 6.8)
- [CVE-2026-24287](https://insights.sbomify.com/CVE-2026-24287/): Windows Kernel Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-24285](https://insights.sbomify.com/CVE-2026-24285/): Win32k Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-24283](https://insights.sbomify.com/CVE-2026-24283/): Multiple UNC Provider Kernel Driver Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-24282](https://insights.sbomify.com/CVE-2026-24282/): Push message Routing Service Elevation of Privilege Vulnerability (medium 5.5)
- [CVE-2026-24281](https://insights.sbomify.com/CVE-2026-24281/): Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager (medium 5.9)
- [CVE-2026-2428](https://insights.sbomify.com/CVE-2026-2428/): Fluent Forms Pro Add On Pack <= 6.1.17 - Missing Authorization to Unauthenticated Payment Status modification (high 7.5)
- [CVE-2026-24272](https://insights.sbomify.com/CVE-2026-24272/): Memory corruption in TensorRT (high 7.8)
- [CVE-2026-24271](https://insights.sbomify.com/CVE-2026-24271/): Denial of service in TensorRT-LLM (medium 6.2)
- [CVE-2026-24270](https://insights.sbomify.com/CVE-2026-24270/): Auth bypass in AIStore framework (critical 9.8)
- [CVE-2026-2427](https://insights.sbomify.com/CVE-2026-2427/): itsukaita <= 0.1.2 - Reflected Cross-Site Scripting via 'day_from' Parameter (medium 6.1)
- [CVE-2026-24269](https://insights.sbomify.com/CVE-2026-24269/): Server-side request forgery in TensorRT-LLM (high 7.1)
- [CVE-2026-24268](https://insights.sbomify.com/CVE-2026-24268/): Memory corruption in TensorRT (high 7.8)
- [CVE-2026-24267](https://insights.sbomify.com/CVE-2026-24267/): Deserialization in NeMo Speech (high 7.8)
- [CVE-2026-24266](https://insights.sbomify.com/CVE-2026-24266/): Use after free in Triton Inference Server (medium 5.9)
- [CVE-2026-24264](https://insights.sbomify.com/CVE-2026-24264/): Denial of service in Triton Inference Server (high 7.5)
- [CVE-2026-24263](https://insights.sbomify.com/CVE-2026-24263/): Null dereference in DGX Spark (high 8.2)
- [CVE-2026-24262](https://insights.sbomify.com/CVE-2026-24262/): Memory corruption in DGX Spark (high 8.2)
- [CVE-2026-24260](https://insights.sbomify.com/CVE-2026-24260/): Race condition in Container Toolkit (high 8.5)
- [CVE-2026-2426](https://insights.sbomify.com/CVE-2026-2426/): Path traversal in WP-DownloadManager (medium 6.5)
- [CVE-2026-24259](https://insights.sbomify.com/CVE-2026-24259/): Auth bypass in TensorRT-LLM (medium 6.4)
- [CVE-2026-24255](https://insights.sbomify.com/CVE-2026-24255/): Other in Dynamo (high 7.5)
- [CVE-2026-24254](https://insights.sbomify.com/CVE-2026-24254/): Memory corruption in Dynamo (critical 9.8)
- [CVE-2026-24253](https://insights.sbomify.com/CVE-2026-24253/): Memory corruption in Dynamo (high 8.2)
- [CVE-2026-24252](https://insights.sbomify.com/CVE-2026-24252/): Command injection in NeMo Framework (high 7.8)
- [CVE-2026-24251](https://insights.sbomify.com/CVE-2026-24251/): Deserialization in Megatron-Bridge (high 7.8)
- [CVE-2026-24250](https://insights.sbomify.com/CVE-2026-24250/): Deserialization in Megatron-Bridge (high 7.8)
- [CVE-2026-2425](https://insights.sbomify.com/CVE-2026-2425/): hiWeb Migration Simple <= 2.0.0.1 - Reflected Cross-Site Scripting via 'new_domain' Parameter (medium 6.1)
- [CVE-2026-24249](https://insights.sbomify.com/CVE-2026-24249/): Deserialization in Megatron-Bridge (high 7.8)
- [CVE-2026-24248](https://insights.sbomify.com/CVE-2026-24248/): Code injection in Megatron-Bridge (high 7.8)
- [CVE-2026-24247](https://insights.sbomify.com/CVE-2026-24247/): Deserialization in Megatron-Bridge (high 7.8)
- [CVE-2026-24246](https://insights.sbomify.com/CVE-2026-24246/): Other in Megatron-Bridge (high 7.8)
- [CVE-2026-24245](https://insights.sbomify.com/CVE-2026-24245/): Deserialization in Megatron-Bridge (high 7.8)
- [CVE-2026-24244](https://insights.sbomify.com/CVE-2026-24244/): Deserialization in Megatron-Bridge (high 7.8)
- [CVE-2026-24243](https://insights.sbomify.com/CVE-2026-24243/): Deserialization in Megatron-Bridge (high 7.8)
- [CVE-2026-24242](https://insights.sbomify.com/CVE-2026-24242/): Server-side request forgery in Megatron-Bridge (high 7.8)
- [CVE-2026-24241](https://insights.sbomify.com/CVE-2026-24241/): Auth bypass in DLS component of NVIDIA License System (medium 4.3)
- [CVE-2026-24240](https://insights.sbomify.com/CVE-2026-24240/): Deserialization in Megatron-Bridge (high 7.8)
- [CVE-2026-2424](https://insights.sbomify.com/CVE-2026-2424/): Reward Video Ad for WordPress <= 1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via Admin Settings (medium 4.4)
- [CVE-2026-24239](https://insights.sbomify.com/CVE-2026-24239/): Deserialization in NeMo Speech (high 7.8)
- [CVE-2026-24238](https://insights.sbomify.com/CVE-2026-24238/): Memory corruption in TensorRT (high 7.8)
- [CVE-2026-24237](https://insights.sbomify.com/CVE-2026-24237/): Deserialization in NVTabular (high 7.8)
- [CVE-2026-24234](https://insights.sbomify.com/CVE-2026-24234/): Server-side request forgery in TensorRT-LLM (medium 6.8)
- [CVE-2026-24233](https://insights.sbomify.com/CVE-2026-24233/): Deserialization in TensorRT-LLM (high 8.4)
- [CVE-2026-24232](https://insights.sbomify.com/CVE-2026-24232/): Deserialization in Tranformers4Rec (medium 4.3)
- [CVE-2026-24231](https://insights.sbomify.com/CVE-2026-24231/): Server-side request forgery in NemoClaw (medium 6.3)
- [CVE-2026-24229](https://insights.sbomify.com/CVE-2026-24229/): Missing authorization in TensorRT-LLM (high 7.3)
- [CVE-2026-24228](https://insights.sbomify.com/CVE-2026-24228/): Deserialization in NeMo Framework (high 7.8)
- [CVE-2026-24227](https://insights.sbomify.com/CVE-2026-24227/): Deserialization in TensorRT (medium 5.3)
- [CVE-2026-24226](https://insights.sbomify.com/CVE-2026-24226/): Code injection in TensorRT-LLM (medium 6.3)
- [CVE-2026-24225](https://insights.sbomify.com/CVE-2026-24225/): Memory corruption in DGX Spark (medium 6.0)
- [CVE-2026-24222](https://insights.sbomify.com/CVE-2026-24222/): Information disclosure in NemoClaw (high 8.6)
- [CVE-2026-24221](https://insights.sbomify.com/CVE-2026-24221/): Deserialization in NVTabular (high 7.8)
- [CVE-2026-24220](https://insights.sbomify.com/CVE-2026-24220/): Deserialization in TensorRT-LLM (medium 6.4)
- [CVE-2026-2422](https://insights.sbomify.com/CVE-2026-2422/): WP Composer <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pbwp_raw_shortcode' Shortcode (medium 6.4)
- [CVE-2026-24218](https://insights.sbomify.com/CVE-2026-24218/): Hardcoded credentials in DGX Spark (high 8.1)
- [CVE-2026-24217](https://insights.sbomify.com/CVE-2026-24217/): Path traversal in BioNeMo Framework (high 8.8)
- [CVE-2026-24216](https://insights.sbomify.com/CVE-2026-24216/): Deserialization in BioNeMo Framework (high 7.8)
- [CVE-2026-24215](https://insights.sbomify.com/CVE-2026-24215/): Denial of service in Triton Inference Server (medium 5.7)
- [CVE-2026-24214](https://insights.sbomify.com/CVE-2026-24214/): Integer overflow in Triton Inference Server (high 8.0)
- [CVE-2026-24213](https://insights.sbomify.com/CVE-2026-24213/): Memory corruption in Triton Inference Server (high 8.0)
- [CVE-2026-24212](https://insights.sbomify.com/CVE-2026-24212/): Information disclosure in Isaac Launchable (high 7.5)
- [CVE-2026-24210](https://insights.sbomify.com/CVE-2026-24210/): Integer overflow in Triton Inference Server (high 7.5)
- [CVE-2026-2421](https://insights.sbomify.com/CVE-2026-2421/): Path traversal in ilGhera Carta Docente for WooCommerce (medium 6.5)
- [CVE-2026-24209](https://insights.sbomify.com/CVE-2026-24209/): Path traversal in Triton Inference Server (high 7.5)
- [CVE-2026-24208](https://insights.sbomify.com/CVE-2026-24208/): Path traversal in Triton Inference Server (medium 5.3)
- [CVE-2026-24207](https://insights.sbomify.com/CVE-2026-24207/): Auth bypass in Triton Inference Server (critical 9.8)
- [CVE-2026-24206](https://insights.sbomify.com/CVE-2026-24206/): Auth bypass in Triton Inference Server (high 7.3)
- [CVE-2026-24204](https://insights.sbomify.com/CVE-2026-24204/): Path traversal in FLARE SDK (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/781/