# Vulnerabilities published in 2026


- [CVE-2026-24201](https://insights.sbomify.com/CVE-2026-24201/): Memory corruption in Virtual GPU Manager (medium 5.8)
- [CVE-2026-24200](https://insights.sbomify.com/CVE-2026-24200/): Use after free in Virtual GPU Manager (high 7.0)
- [CVE-2026-2420](https://insights.sbomify.com/CVE-2026-2420/): LotekMedia Popup Form <= 1.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings (medium 4.4)
- [CVE-2026-24199](https://insights.sbomify.com/CVE-2026-24199/): Race condition in GeForce (medium 4.7)
- [CVE-2026-24198](https://insights.sbomify.com/CVE-2026-24198/): Race condition in GeForce (medium 5.6)
- [CVE-2026-24197](https://insights.sbomify.com/CVE-2026-24197/): Misconfiguration in GeForce (medium 6.5)
- [CVE-2026-24196](https://insights.sbomify.com/CVE-2026-24196/): Memory corruption in GeForce (high 7.1)
- [CVE-2026-24195](https://insights.sbomify.com/CVE-2026-24195/): Denial of service in Guest driver (high 7.1)
- [CVE-2026-24194](https://insights.sbomify.com/CVE-2026-24194/): Privilege escalation in GeForce (high 7.8)
- [CVE-2026-24193](https://insights.sbomify.com/CVE-2026-24193/): Memory corruption in GeForce (high 7.8)
- [CVE-2026-24192](https://insights.sbomify.com/CVE-2026-24192/): Integer overflow in GeForce (high 7.8)
- [CVE-2026-24191](https://insights.sbomify.com/CVE-2026-24191/): Race condition in GeForce (high 7.8)
- [CVE-2026-24190](https://insights.sbomify.com/CVE-2026-24190/): Missing authorization in GeForce (high 7.8)
- [CVE-2026-2419](https://insights.sbomify.com/CVE-2026-2419/): Path traversal in WP-DownloadManager (low 2.7)
- [CVE-2026-24189](https://insights.sbomify.com/CVE-2026-24189/): Memory corruption in CUDA-Q (high 8.2)
- [CVE-2026-24188](https://insights.sbomify.com/CVE-2026-24188/): Memory corruption in TensorRT (high 8.2)
- [CVE-2026-24187](https://insights.sbomify.com/CVE-2026-24187/): Use after free in GeForce (high 8.8)
- [CVE-2026-24186](https://insights.sbomify.com/CVE-2026-24186/): Deserialization in FLARE SDK (high 8.8)
- [CVE-2026-24185](https://insights.sbomify.com/CVE-2026-24185/): Auth bypass in NVOS (high 7.1)
- [CVE-2026-24184](https://insights.sbomify.com/CVE-2026-24184/): Memory corruption in Cumulus Linux GA (high 7.5)
- [CVE-2026-24183](https://insights.sbomify.com/CVE-2026-24183/): Privilege escalation in Cumulus Linux GA (high 7.8)
- [CVE-2026-24182](https://insights.sbomify.com/CVE-2026-24182/): Denial of service in GeForce (medium 6.5)
- [CVE-2026-24181](https://insights.sbomify.com/CVE-2026-24181/): Memory corruption in DALI (high 7.3)
- [CVE-2026-24180](https://insights.sbomify.com/CVE-2026-24180/): Memory corruption in DALI (high 7.3)
- [CVE-2026-2418](https://insights.sbomify.com/CVE-2026-2418/): Login with Salesforce <= 1.0.2 - Unauthenticated Authentication Bypass (critical 9.1)
- [CVE-2026-24178](https://insights.sbomify.com/CVE-2026-24178/): NVIDIA NVFlare Dashboard: Authorization bypass through user-controlled key via user management and authentication system (critical 9.8)
- [CVE-2026-24177](https://insights.sbomify.com/CVE-2026-24177/): Missing authorization in KAI Scheduler (high 7.7)
- [CVE-2026-24176](https://insights.sbomify.com/CVE-2026-24176/): Missing authorization in KAI Scheduler (medium 4.3)
- [CVE-2026-24175](https://insights.sbomify.com/CVE-2026-24175/): Denial of service in Triton Inference Server (high 7.5)
- [CVE-2026-24174](https://insights.sbomify.com/CVE-2026-24174/): Denial of service in Triton Inference Server (high 7.5)
- [CVE-2026-24173](https://insights.sbomify.com/CVE-2026-24173/): Integer overflow in Triton Inference Server (high 7.5)
- [CVE-2026-24170](https://insights.sbomify.com/CVE-2026-24170/): Auth bypass in Unified Fabric Manager Enterprise - GA (high 8.8)
- [CVE-2026-2417](https://insights.sbomify.com/CVE-2026-2417/): Missing Authentication for Critical Function in Pharos Controls Mosaic Show Controller (critical 9.3)
- [CVE-2026-24169](https://insights.sbomify.com/CVE-2026-24169/): Command injection in Unified Fabric Manager Enterprise - GA (high 8.0)
- [CVE-2026-24168](https://insights.sbomify.com/CVE-2026-24168/): Command injection in Unified Fabric Manager Enterprise - GA (medium 6.8)
- [CVE-2026-24167](https://insights.sbomify.com/CVE-2026-24167/): Command injection in Unified Fabric Manager Enterprise - GA (medium 6.8)
- [CVE-2026-24166](https://insights.sbomify.com/CVE-2026-24166/): Hardcoded credentials in Unified Fabric Manager Enterprise - GA (medium 5.1)
- [CVE-2026-24165](https://insights.sbomify.com/CVE-2026-24165/): Deserialization in BioNeMo Framework (high 7.8)
- [CVE-2026-24164](https://insights.sbomify.com/CVE-2026-24164/): Deserialization in BioNeMo Framework (high 8.8)
- [CVE-2026-24163](https://insights.sbomify.com/CVE-2026-24163/): Deserialization in TensorRT-LLM (high 7.5)
- [CVE-2026-24162](https://insights.sbomify.com/CVE-2026-24162/): Deserialization in Merlin Transformers4Rec (high 7.8)
- [CVE-2026-24160](https://insights.sbomify.com/CVE-2026-24160/): Null dereference in TensorRT-LLM (medium 5.5)
- [CVE-2026-2416](https://insights.sbomify.com/CVE-2026-2416/): Geo Mashup <= 1.13.17 - Unauthenticated SQL Injection via 'sort' Parameter (high 7.5)
- [CVE-2026-24159](https://insights.sbomify.com/CVE-2026-24159/): NVIDIA NeMo Framework contains a vulnerability leading to Remote Code Execution (high 7.8)
- [CVE-2026-24158](https://insights.sbomify.com/CVE-2026-24158/): Denial of service in Triton Inference Server (high 7.5)
- [CVE-2026-24157](https://insights.sbomify.com/CVE-2026-24157/): NVIDIA NeMo Framework contains an RCE vulnerability in checkpoint loading (high 7.8)
- [CVE-2026-24156](https://insights.sbomify.com/CVE-2026-24156/): Deserialization in DALI (high 7.3)
- [CVE-2026-24155](https://insights.sbomify.com/CVE-2026-24155/): Code injection in NeMo Framework (high 7.8)
- [CVE-2026-24154](https://insights.sbomify.com/CVE-2026-24154/): Command injection in Jetson Xavier Series, Jetson Orin Series and Jetson Thor (high 7.6)
- [CVE-2026-24153](https://insights.sbomify.com/CVE-2026-24153/): Information disclosure in Jetson Xavier Series, Jetson Orin Series and Jetson Thor (medium 5.2)
- [CVE-2026-24152](https://insights.sbomify.com/CVE-2026-24152/): Deserialization in Megatron LM (high 7.8)
- [CVE-2026-24151](https://insights.sbomify.com/CVE-2026-24151/): Deserialization in Megatron LM (high 7.8)
- [CVE-2026-24150](https://insights.sbomify.com/CVE-2026-24150/): Deserialization in Megatron LM (high 7.8)
- [CVE-2026-2415](https://insights.sbomify.com/CVE-2026-2415/): Unsafe variable evaluation in email templates (high 7.5)
- [CVE-2026-24149](https://insights.sbomify.com/CVE-2026-24149/): Code injection in Megatron-LM (high 7.8)
- [CVE-2026-24148](https://insights.sbomify.com/CVE-2026-24148/): Misconfiguration in Jetson Xavier Series and Jetson Orin Series (high 8.3)
- [CVE-2026-24147](https://insights.sbomify.com/CVE-2026-24147/): Path traversal in Triton Inference Server (medium 4.8)
- [CVE-2026-24146](https://insights.sbomify.com/CVE-2026-24146/): Denial of service in Triton Inference Server (high 7.5)
- [CVE-2026-24142](https://insights.sbomify.com/CVE-2026-24142/): Deserialization in TensorRT-LLM (medium 6.3)
- [CVE-2026-24141](https://insights.sbomify.com/CVE-2026-24141/): Deserialization in NVIDIA Model Optimizer (high 7.8)
- [CVE-2026-24140](https://insights.sbomify.com/CVE-2026-24140/): MyTube has Mass Assignment via Settings Management (low 2.7)
- [CVE-2026-2414](https://insights.sbomify.com/CVE-2026-2414/): Auth bypass in Server (medium 5.6)
- [CVE-2026-24139](https://insights.sbomify.com/CVE-2026-24139/): MyTube Allows Unauthorized Database Export by Guest Users (high 8.7)
- [CVE-2026-24138](https://insights.sbomify.com/CVE-2026-24138/): FOG vulnerable to unauthenticated SSRF via `/fog/service/getversion.php` (high 7.5)
- [CVE-2026-24137](https://insights.sbomify.com/CVE-2026-24137/): sigstore legacy TUF client allows for arbitrary file writes with target cache path traversal (medium 5.8)
- [CVE-2026-24136](https://insights.sbomify.com/CVE-2026-24136/): Saleor has an Insecure Direct Object Reference (IDOR) in GraphQL API (high 8.7)
- [CVE-2026-24135](https://insights.sbomify.com/CVE-2026-24135/): Gogs vulnerable to arbitrary file deletion via path traversal in wiki page update (high 7.2)
- [CVE-2026-24134](https://insights.sbomify.com/CVE-2026-24134/): StudioCMS has an Authorization Bypass Through User-Controlled Key (medium 6.5)
- [CVE-2026-24133](https://insights.sbomify.com/CVE-2026-24133/): jsPDF Affected by Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder (high 8.7)
- [CVE-2026-24132](https://insights.sbomify.com/CVE-2026-24132/): Orval Mock Generation Code Injection via const (high 7.7)
- [CVE-2026-24131](https://insights.sbomify.com/CVE-2026-24131/): pnpm has Path Traversal via arbitrary file permission modification (medium 6.7)
- [CVE-2026-24130](https://insights.sbomify.com/CVE-2026-24130/): Moonraker with LDAP Enabled Allows Malicious Search Filter Injection (low 2.7)
- [CVE-2026-2413](https://insights.sbomify.com/CVE-2026-2413/): Ally – Web Accessibility & Usability <= 4.0.3 - Unauthenticated SQL Injection via URL Path (high 7.5)
- [CVE-2026-24129](https://insights.sbomify.com/CVE-2026-24129/): Runtipi is Vulnerable to Authenticated Arbitrary Remote Code Execution (high 8.1)
- [CVE-2026-24128](https://insights.sbomify.com/CVE-2026-24128/): XWiki Affected by Reflected Cross-Site Scripting (XSS) in Error Messages (medium 6.5)
- [CVE-2026-24127](https://insights.sbomify.com/CVE-2026-24127/): Typemill has Reflected XSS via login error view template (medium 5.4)
- [CVE-2026-24126](https://insights.sbomify.com/CVE-2026-24126/): Weblate has an argument injection in management console (medium 6.6)
- [CVE-2026-24125](https://insights.sbomify.com/CVE-2026-24125/): Path Traversal in @tinacms/graphql (medium 6.3)
- [CVE-2026-24124](https://insights.sbomify.com/CVE-2026-24124/): Dragonfly Manager Job API Allows Unauthenticated Access (high 8.9)
- [CVE-2026-24123](https://insights.sbomify.com/CVE-2026-24123/): BentoML has a Path Traversal via Bentofile Configuration (high 7.4)
- [CVE-2026-24122](https://insights.sbomify.com/CVE-2026-24122/): Cosign Certificate Chain Expiry Validation Issue Allows Issuing Certificate Expiry to Be Overlooked (low 3.7)
- [CVE-2026-24120](https://insights.sbomify.com/CVE-2026-24120/): vm2: Sandbox Breakout Through Promise Species (critical 9.8)
- [CVE-2026-2412](https://insights.sbomify.com/CVE-2026-2412/): Quiz and Survey Master (QSM) <= 10.3.5 - Authenticated (Contributor+) SQL Injection via 'merged_question' Parameter (medium 6.5)
- [CVE-2026-24118](https://insights.sbomify.com/CVE-2026-24118/): VM2 Sandbox Breakout Through __lookupGetter__ (critical 9.8)
- [CVE-2026-24117](https://insights.sbomify.com/CVE-2026-24117/): Rekor affected by Server-Side Request Forgery (SSRF) via provided public key URL (medium 5.3)
- [CVE-2026-24116](https://insights.sbomify.com/CVE-2026-24116/): Wasmtime segfault or unused out-of-sandbox load with f64.copysign operator on x86-64 (medium 4.1)
- [CVE-2026-24115](https://insights.sbomify.com/CVE-2026-24115/): Memory corruption in tenda:w20e firmware (critical 9.8)
- [CVE-2026-24114](https://insights.sbomify.com/CVE-2026-24114/): Memory corruption in tenda:w20e firmware (high 7.5)
- [CVE-2026-24113](https://insights.sbomify.com/CVE-2026-24113/): Memory corruption in tenda:w20e firmware (critical 9.8)
- [CVE-2026-24112](https://insights.sbomify.com/CVE-2026-24112/): Memory corruption in tenda:w20e firmware (high 7.5)
- [CVE-2026-24111](https://insights.sbomify.com/CVE-2026-24111/): Memory corruption in tenda:w20e firmware (critical 9.8)
- [CVE-2026-24110](https://insights.sbomify.com/CVE-2026-24110/): Memory corruption in tenda:w20e firmware (critical 9.8)
- [CVE-2026-2411](https://insights.sbomify.com/CVE-2026-2411/): Security feature bypass in zephyr (medium 6.5)
- [CVE-2026-24109](https://insights.sbomify.com/CVE-2026-24109/): Memory corruption in tenda:w20e firmware (critical 9.8)
- [CVE-2026-24108](https://insights.sbomify.com/CVE-2026-24108/): Memory corruption in tenda:w20e firmware (critical 9.8)
- [CVE-2026-24107](https://insights.sbomify.com/CVE-2026-24107/): Command injection in tenda:w20e firmware (critical 9.8)
- [CVE-2026-24105](https://insights.sbomify.com/CVE-2026-24105/): Command injection in tenda:ac15 firmware (critical 9.8)
- [CVE-2026-24103](https://insights.sbomify.com/CVE-2026-24103/): Memory corruption in tenda:ac15 firmware (critical 9.8)
- [CVE-2026-24101](https://insights.sbomify.com/CVE-2026-24101/): Command injection in tenda:ac15 firmware (critical 9.8)
- [CVE-2026-2410](https://insights.sbomify.com/CVE-2026-2410/): Disable Admin Notices – Hide Dashboard Notifications <= 1.4.2 - Cross-Site Request Forgery to Plugin Settings Update (medium 4.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/782/