# Vulnerabilities published in 2026


- [CVE-2026-24099](https://insights.sbomify.com/CVE-2026-24099/): Use after free in Intel(R) PROSet/Wireless WiFi Software for Windows (medium 5.9)
- [CVE-2026-24098](https://insights.sbomify.com/CVE-2026-24098/): Apache Airflow: Assigning single DAG permission leaked all DAGs Import Errors (medium 6.5)
- [CVE-2026-24097](https://insights.sbomify.com/CVE-2026-24097/): Authenticated Host Enumeration via Observable Response Discrepancy on Agent Register Existing Endpoint (medium 5.3)
- [CVE-2026-24096](https://insights.sbomify.com/CVE-2026-24096/): Insufficient permission validation on multiple REST API Quick Setup endpoints (medium 5.3)
- [CVE-2026-24095](https://insights.sbomify.com/CVE-2026-24095/): Missing Permission Check on Analyze Configuration Page (medium 5.3)
- [CVE-2026-24092](https://insights.sbomify.com/CVE-2026-24092/): Improper Validation of Syntactic Correctness of Input in Display (high 7.2)
- [CVE-2026-24091](https://insights.sbomify.com/CVE-2026-24091/): Improper Validation of Syntactic Correctness of Input in Display (high 7.2)
- [CVE-2026-24090](https://insights.sbomify.com/CVE-2026-24090/): Missing Authentication for Critical Function in HLOS (high 7.1)
- [CVE-2026-2409](https://insights.sbomify.com/CVE-2026-2409/): SQL injection in Cloud Suite (critical 9.3)
- [CVE-2026-24089](https://insights.sbomify.com/CVE-2026-24089/): Improper Validation of Syntactic Correctness of Input in Kernel (high 7.2)
- [CVE-2026-24088](https://insights.sbomify.com/CVE-2026-24088/): Missing Authentication for Critical Function in Boot (high 8.2)
- [CVE-2026-24087](https://insights.sbomify.com/CVE-2026-24087/): Improper Validation of Syntactic Correctness of Input in Kernel (high 7.2)
- [CVE-2026-24085](https://insights.sbomify.com/CVE-2026-24085/): Stack-based Buffer Overflow in Display (high 7.2)
- [CVE-2026-24084](https://insights.sbomify.com/CVE-2026-24084/): Insecure Security Identifier Mechanism in Multi-Mode Call Processor (high 7.5)
- [CVE-2026-24083](https://insights.sbomify.com/CVE-2026-24083/): Untrusted Pointer Dereference in Automotive Security (high 7.8)
- [CVE-2026-24082](https://insights.sbomify.com/CVE-2026-24082/): Use After Free in Automotive GPU (high 7.8)
- [CVE-2026-24081](https://insights.sbomify.com/CVE-2026-24081/): Buffer Over-read in BT Controller (high 7.4)
- [CVE-2026-24080](https://insights.sbomify.com/CVE-2026-24080/): Buffer Copy Without Checking Size of Input in Biometrics (high 7.8)
- [CVE-2026-2408](https://insights.sbomify.com/CVE-2026-2408/): Use-after-free in Cloud Workloads (medium 4.7)
- [CVE-2026-24079](https://insights.sbomify.com/CVE-2026-24079/): Missing Authentication for Critical Function in Data Modem (high 8.1)
- [CVE-2026-24078](https://insights.sbomify.com/CVE-2026-24078/): Exposure of Private Personal Information to an Unauthorized Actor in Data Modem (medium 6.5)
- [CVE-2026-24077](https://insights.sbomify.com/CVE-2026-24077/): Integer Underflow (Wrap or Wraparound) in WLAN Host (medium 6.5)
- [CVE-2026-24076](https://insights.sbomify.com/CVE-2026-24076/): Buffer Copy Without Checking Size of Input in Bluetooth HOST (medium 6.7)
- [CVE-2026-24075](https://insights.sbomify.com/CVE-2026-24075/): Buffer Over-read in Qualcomm IPC (high 7.8)
- [CVE-2026-24074](https://insights.sbomify.com/CVE-2026-24074/): Out-of-bounds Write in Video (high 7.8)
- [CVE-2026-24073](https://insights.sbomify.com/CVE-2026-24073/): Out-of-bounds Write in Video (high 7.8)
- [CVE-2026-24072](https://insights.sbomify.com/CVE-2026-24072/): Apache HTTP Server: mod_rewrite elevation of privileges via ap_expr (high 8.8)
- [CVE-2026-24071](https://insights.sbomify.com/CVE-2026-24071/): XPC Client Validation via PID leading to Local Privilege Escalation in Native Instruments Native Access (high 7.8)
- [CVE-2026-24070](https://insights.sbomify.com/CVE-2026-24070/): Local Privilege Escalation via DYLIB Injection in Native Instruments Native Access (high 8.8)
- [CVE-2026-24069](https://insights.sbomify.com/CVE-2026-24069/): Improper Enforcement of Disabled Accounts in WebUI SSO in Kiuwan SAST (medium 5.4)
- [CVE-2026-24068](https://insights.sbomify.com/CVE-2026-24068/): Privilege escalation in Vienna Assistant (high 8.8)
- [CVE-2026-24067](https://insights.sbomify.com/CVE-2026-24067/): Slate Digital Connect macOS XPC PID validation privilege escalation (high 8.4)
- [CVE-2026-24066](https://insights.sbomify.com/CVE-2026-24066/): Slate Digital Connect macOS XPC certificate validation privilege escalation (high 8.4)
- [CVE-2026-24065](https://insights.sbomify.com/CVE-2026-24065/): Local Privilege Escalation via Insecure XPC Client Validation in Waves Central for macOS (high 8.1)
- [CVE-2026-24064](https://insights.sbomify.com/CVE-2026-24064/): Local Privilege Escalation via Dynamic Library Injection in Waves Central for macOS (high 7.8)
- [CVE-2026-24063](https://insights.sbomify.com/CVE-2026-24063/): World-writable uninstall script executed as root in Arturia Software Center (high 8.2)
- [CVE-2026-24062](https://insights.sbomify.com/CVE-2026-24062/): Insufficient XPC Client validation leading to local privilege escalation in Arturia Software Center (high 7.8)
- [CVE-2026-24061](https://insights.sbomify.com/CVE-2026-24061/): GNU InetUtils Argument Injection (critical 9.8, exploited in the wild)
- [CVE-2026-24060](https://insights.sbomify.com/CVE-2026-24060/): Automated Logic WebCTRL Premium Server Cleartext Transmission of Sensitive Information (critical 9.1)
- [CVE-2026-2406](https://insights.sbomify.com/CVE-2026-2406/): IDOR in Universe Software's Online Registration and Workflow Management System (medium 6.5)
- [CVE-2026-24059](https://insights.sbomify.com/CVE-2026-24059/): Gitea runner registration-token GET endpoint performs a write under a read-only token scope (medium 6.5)
- [CVE-2026-24058](https://insights.sbomify.com/CVE-2026-24058/): Soft Serve has Critical Authentication Bypass (high 8.1)
- [CVE-2026-24056](https://insights.sbomify.com/CVE-2026-24056/): pnpm has symlink traversal in file:/git dependencies (medium 6.7)
- [CVE-2026-24055](https://insights.sbomify.com/CVE-2026-24055/): Langfuse Slack OAuth Installation Endpoint Lacks Authentication, Enabling Arbitrary Project Linking (medium 6.3)
- [CVE-2026-24054](https://insights.sbomify.com/CVE-2026-24054/): Other in kata-containers (high 8.8)
- [CVE-2026-24053](https://insights.sbomify.com/CVE-2026-24053/): Cluade Code has a Path Restriction Bypass via ZSH Clobber which Allows Arbitrary File Writes (high 7.7)
- [CVE-2026-24052](https://insights.sbomify.com/CVE-2026-24052/): Claude Code has a Domain Validation Bypass which Allows Automatic Requests to Attacker-Controlled Domains (high 7.1)
- [CVE-2026-24051](https://insights.sbomify.com/CVE-2026-24051/): OpenTelemetry-Go Affected by Arbitrary Code Execution via PATH Hijacking (high 7.0)
- [CVE-2026-24050](https://insights.sbomify.com/CVE-2026-24050/): Zulip affected by Stored XSS in user profile modal (low 1.1)
- [CVE-2026-2405](https://insights.sbomify.com/CVE-2026-2405/): Denial of service in PowerChute™ Serial Shutdown (medium 5.3)
- [CVE-2026-24049](https://insights.sbomify.com/CVE-2026-24049/): wheel Allows Arbitrary File Permission Modification via Path Traversal (high 7.1)
- [CVE-2026-24048](https://insights.sbomify.com/CVE-2026-24048/): Backstage has a Possible SSRF when reading from allowed URL's in `backend.reading.allow` (low 3.5)
- [CVE-2026-24047](https://insights.sbomify.com/CVE-2026-24047/): @backstage/cli-common has a possible `resolveSafeChildPath` Symlink Chain Bypass (medium 6.3)
- [CVE-2026-24046](https://insights.sbomify.com/CVE-2026-24046/): Backstage has a Possible Symlink Path Traversal in Scaffolder Actions (high 7.1)
- [CVE-2026-24045](https://insights.sbomify.com/CVE-2026-24045/): Docmost Affected by Stored XSS in Public Share Page (high 7.3)
- [CVE-2026-24044](https://insights.sbomify.com/CVE-2026-24044/): ESS Community Helm Chart has a weak server key generation method (critical 9.2)
- [CVE-2026-24043](https://insights.sbomify.com/CVE-2026-24043/): jsPDF Affected by Stored XMP Metadata Injection (Spoofing & Integrity Violation) (medium 6.9)
- [CVE-2026-24042](https://insights.sbomify.com/CVE-2026-24042/): Appsmith public apps can execute unpublished actions (viewMode confusion) (critical 9.4)
- [CVE-2026-24040](https://insights.sbomify.com/CVE-2026-24040/): jsPDF has a Shared State Race Condition in addJS Plugin (medium 6.3)
- [CVE-2026-2404](https://insights.sbomify.com/CVE-2026-2404/): Other in PowerChute™ Serial Shutdown (medium 6.9)
- [CVE-2026-24039](https://insights.sbomify.com/CVE-2026-24039/): Horilla's Improper Access Control Allows Employees to Auto-Approve Documents (medium 4.3)
- [CVE-2026-24038](https://insights.sbomify.com/CVE-2026-24038/): Horilla HR has 2FA Bypass through its OTP Handling Logic (high 8.1)
- [CVE-2026-24037](https://insights.sbomify.com/CVE-2026-24037/): Horilla HRM has XSS Bypass through Project Name (medium 4.8)
- [CVE-2026-24036](https://insights.sbomify.com/CVE-2026-24036/): Horilla Exposes Unpublished Job Disclosures through Unauthenticated API (medium 5.3)
- [CVE-2026-24035](https://insights.sbomify.com/CVE-2026-24035/): Horilla has Improper Access Control Issue that Allows Unauthorized Document Upload on Behalf of Another Employee (medium 4.3)
- [CVE-2026-24034](https://insights.sbomify.com/CVE-2026-24034/): Horilla has File Upload XSS (medium 5.4)
- [CVE-2026-24033](https://insights.sbomify.com/CVE-2026-24033/): Apache Traffic Server: Request smuggling via chunked extension quoted-string parsing (medium 6.9)
- [CVE-2026-24032](https://insights.sbomify.com/CVE-2026-24032/): Auth bypass in SINEC NMS (medium 6.9)
- [CVE-2026-24031](https://insights.sbomify.com/CVE-2026-24031/): SQL injection in OX Dovecot Pro (high 7.7)
- [CVE-2026-24030](https://insights.sbomify.com/CVE-2026-24030/): Unbounded memory allocation for DoQ and DoH3 (medium 5.3)
- [CVE-2026-2403](https://insights.sbomify.com/CVE-2026-2403/): Other in PowerChute™ Serial Shutdown (medium 5.3)
- [CVE-2026-24029](https://insights.sbomify.com/CVE-2026-24029/): DNS over HTTPS ACL bypass (medium 6.5)
- [CVE-2026-24028](https://insights.sbomify.com/CVE-2026-24028/): Out-of-bounds read when parsing DNS packets via Lua (medium 5.3)
- [CVE-2026-24027](https://insights.sbomify.com/CVE-2026-24027/): Crafted zones can lead to increased incoming network traffic (medium 5.3)
- [CVE-2026-2402](https://insights.sbomify.com/CVE-2026-2402/): Auth bypass in PowerChute™ Serial Shutdown (medium 6.9)
- [CVE-2026-24018](https://insights.sbomify.com/CVE-2026-24018/): Privilege escalation in FortiClientLinux (high 7.4)
- [CVE-2026-24017](https://insights.sbomify.com/CVE-2026-24017/): Security feature bypass in FortiWeb (high 7.3)
- [CVE-2026-24016](https://insights.sbomify.com/CVE-2026-24016/): Other in ServerView Agents for Windows (high 8.4)
- [CVE-2026-24015](https://insights.sbomify.com/CVE-2026-24015/): Apache IoTDB: Insecure Default Configuration Vulnerability (critical 9.8)
- [CVE-2026-24014](https://insights.sbomify.com/CVE-2026-24014/): Apache IoTDB: Path Traversal in DataNode Internal RPC Trigger JAR Upload Allows Arbitrary File Write (critical 9.8)
- [CVE-2026-24013](https://insights.sbomify.com/CVE-2026-24013/): Apache IoTDB: Authentication Bypass via Forged SessionID in Thrift RPC (critical 9.1)
- [CVE-2026-24012](https://insights.sbomify.com/CVE-2026-24012/): Apache IoTDB: Denial of Service via Resource Exhaustion in Aggregation Query (high 7.5)
- [CVE-2026-24010](https://insights.sbomify.com/CVE-2026-24010/): Horilla has HTML Injection Issue that, with Phishing, Leads to Account Takeover (high 8.8)
- [CVE-2026-2401](https://insights.sbomify.com/CVE-2026-2401/): Information disclosure in PowerChute™ Serial Shutdown (low 2.4)
- [CVE-2026-24009](https://insights.sbomify.com/CVE-2026-24009/): Docling Core vulnerable to Remote Code Execution via unsafe PyYAML usage (high 8.1)
- [CVE-2026-24007](https://insights.sbomify.com/CVE-2026-24007/): Tuleap is missing CSRF protection in the Overview inconsistent items (medium 4.6)
- [CVE-2026-24006](https://insights.sbomify.com/CVE-2026-24006/): Seroval affected by Denial of Service via Deeply Nested Objects (high 7.5)
- [CVE-2026-24005](https://insights.sbomify.com/CVE-2026-24005/): OpenKruise PodProbeMarker is Vulnerable to SSRF via Unrestricted Host Field (not scored)
- [CVE-2026-24004](https://insights.sbomify.com/CVE-2026-24004/): Fleet: Unauthenticated Android device disenrollment vulnerability via Pub/Sub endpoint (low 1.7)
- [CVE-2026-24003](https://insights.sbomify.com/CVE-2026-24003/): EvseV2G has sequence state validation bypass (medium 4.3)
- [CVE-2026-24002](https://insights.sbomify.com/CVE-2026-24002/): pyodide sandbox option is insecure (critical 9.1)
- [CVE-2026-24001](https://insights.sbomify.com/CVE-2026-24001/): jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch (low 2.7)
- [CVE-2026-24000](https://insights.sbomify.com/CVE-2026-24000/): Fleet has a rate limiting bypass via untrusted client IP headers (medium 6.9)
- [CVE-2026-2400](https://insights.sbomify.com/CVE-2026-2400/): Other in PowerChute™ Serial Shutdown (medium 5.3)
- [CVE-2026-23999](https://insights.sbomify.com/CVE-2026-23999/): Fleet: Device lock PIN can be predicted if lock time is known (low 0.6)
- [CVE-2026-23998](https://insights.sbomify.com/CVE-2026-23998/): Fleet has a Windows MDM management endpoint authentication bypass (high 8.2)
- [CVE-2026-23997](https://insights.sbomify.com/CVE-2026-23997/): FacturaScripts has a Stored Cross-Site Scripting (XSS) in "Observations" field via History View (high 8.0)
- [CVE-2026-23996](https://insights.sbomify.com/CVE-2026-23996/): FastAPI Api Key has a timing side-channel in verify_key that allows statistical key validity detection (low 3.7)
- [CVE-2026-23995](https://insights.sbomify.com/CVE-2026-23995/): EVerest has stack buffer overflow in ifreq.ifr_name when interface name exceeds IFNAMSIZ (high 8.4)
- [CVE-2026-23992](https://insights.sbomify.com/CVE-2026-23992/): go-tuf improperly validates the configured threshold for delegations (medium 5.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/783/