# Vulnerabilities published in 2026


- [CVE-2026-23991](https://insights.sbomify.com/CVE-2026-23991/): go-tuf affected by client DoS via malformed server response (medium 5.9)
- [CVE-2026-23990](https://insights.sbomify.com/CVE-2026-23990/): Flux Operator Web UI Impersonation Bypass via Empty OIDC Claims (medium 5.3)
- [CVE-2026-2399](https://insights.sbomify.com/CVE-2026-2399/): Path traversal in PowerChute™ Serial Shutdown (medium 6.9)
- [CVE-2026-23989](https://insights.sbomify.com/CVE-2026-23989/): REVA Public Link Exploit (high 8.2)
- [CVE-2026-23988](https://insights.sbomify.com/CVE-2026-23988/): Rufus has Local Privilege Escalation via TOCTOU Race Condition in Fido Script Handling (high 7.3)
- [CVE-2026-23986](https://insights.sbomify.com/CVE-2026-23986/): Copier safe template has arbitrary filesystem write access via directory symlinks when _preserve_symlinks: true (medium 6.9)
- [CVE-2026-23985](https://insights.sbomify.com/CVE-2026-23985/): Apache Superset: Regular Expression Denial of Service (ReDoS) in SQL Parser (medium 5.3)
- [CVE-2026-23984](https://insights.sbomify.com/CVE-2026-23984/): Apache Superset: SQLLab Read-Only Bypass on PostgreSQL (high 7.1)
- [CVE-2026-23983](https://insights.sbomify.com/CVE-2026-23983/): Apache Superset: Sensitive Data Exposure via REST API (disabled by default) (low 2.3)
- [CVE-2026-23982](https://insights.sbomify.com/CVE-2026-23982/): Apache Superset: Improper Authorization in Dataset Creation Allows Access Control Bypass (high 7.1)
- [CVE-2026-23981](https://insights.sbomify.com/CVE-2026-23981/): Apache Superset: Improper Authorization in Chart Update allowing Dashboard Modification (medium 5.3)
- [CVE-2026-23980](https://insights.sbomify.com/CVE-2026-23980/): Apache Superset: Improper Neutralization of Special Elements used in a SQL Command (medium 5.3)
- [CVE-2026-2398](https://insights.sbomify.com/CVE-2026-2398/): IDOR in AdamPOS' MobilMen 20T (high 8.8)
- [CVE-2026-23979](https://insights.sbomify.com/CVE-2026-23979/): WordPress Gyan Elements plugin <= 2.2.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-23978](https://insights.sbomify.com/CVE-2026-23978/): WordPress Gyan Elements plugin <= 2.2.1 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-23977](https://insights.sbomify.com/CVE-2026-23977/): WordPress Helpdesk Support Ticket System for WooCommerce plugin <= 2.1.2 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-23976](https://insights.sbomify.com/CVE-2026-23976/): WordPress Modula Image Gallery plugin <= 2.13.4 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2026-23975](https://insights.sbomify.com/CVE-2026-23975/): WordPress Golo theme < 1.7.5 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-23974](https://insights.sbomify.com/CVE-2026-23974/): WordPress Golo theme < 1.7.5 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-23973](https://insights.sbomify.com/CVE-2026-23973/): WordPress Golo theme < 1.7.5 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-23972](https://insights.sbomify.com/CVE-2026-23972/): WordPress Booking and Rental Manager plugin <= 2.6.0 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-23971](https://insights.sbomify.com/CVE-2026-23971/): WordPress WoodMart theme <= 8.3.8 - PHP Object Injection vulnerability (high 8.1)
- [CVE-2026-23970](https://insights.sbomify.com/CVE-2026-23970/): WordPress Redirection for Contact Form 7 plugin <= 3.2.8 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-2397](https://insights.sbomify.com/CVE-2026-2397/): SQLi in AdamPOS' MobilMen 20T (critical 9.8)
- [CVE-2026-23969](https://insights.sbomify.com/CVE-2026-23969/): Apache Superset: Exposure of Sensitive Information via Incomplete ClickHouse Function Filtering (medium 5.3)
- [CVE-2026-23968](https://insights.sbomify.com/CVE-2026-23968/): Copier safe template has arbitrary filesystem read access via symlinks when _preserve_symlinks: false (medium 6.8)
- [CVE-2026-23967](https://insights.sbomify.com/CVE-2026-23967/): sm-crypto Affected by Signature Malleability in SM2-DSA (high 7.5)
- [CVE-2026-23966](https://insights.sbomify.com/CVE-2026-23966/): sm-crypto Affected by Private Key Recovery in SM2-PKE (critical 9.1)
- [CVE-2026-23965](https://insights.sbomify.com/CVE-2026-23965/): sm-crypto Affected by Signature Forgery in SM2-DSA (high 7.5)
- [CVE-2026-23964](https://insights.sbomify.com/CVE-2026-23964/): Mastodon has insufficient access control to push notification settings (medium 6.5)
- [CVE-2026-23963](https://insights.sbomify.com/CVE-2026-23963/): Mastodon missing length limits on list names, filter names, and filter keywords (medium 4.3)
- [CVE-2026-23962](https://insights.sbomify.com/CVE-2026-23962/): Mastodon vulnerable to Denial of Service from a single post (client/server) (high 7.5)
- [CVE-2026-23961](https://insights.sbomify.com/CVE-2026-23961/): Mastodon may allow a remote suspension bypass (medium 5.3)
- [CVE-2026-23960](https://insights.sbomify.com/CVE-2026-23960/): Argo Workflows affected by stored XSS in the artifact directory listing (high 7.3)
- [CVE-2026-2396](https://insights.sbomify.com/CVE-2026-2396/): List View Google Calendar <= 7.4.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via Event Description (medium 4.4)
- [CVE-2026-23959](https://insights.sbomify.com/CVE-2026-23959/): CoreShop Vulnerable to SQL Injection via Admin customer-company-modifier (medium 6.9)
- [CVE-2026-23958](https://insights.sbomify.com/CVE-2026-23958/): DataEase Vulnerable to Brute-Force Attack on Admin JWT Secret Derived from Password that Enables Full Account Takeover (high 8.8)
- [CVE-2026-23957](https://insights.sbomify.com/CVE-2026-23957/): seroval is vulnerable to Denial of Service via array serialization (high 7.5)
- [CVE-2026-23956](https://insights.sbomify.com/CVE-2026-23956/): seroval affected by Denial of Service via RegExp serialization (high 7.5)
- [CVE-2026-23955](https://insights.sbomify.com/CVE-2026-23955/): EVerest vulnerable to concatenation of strings literal and integers (medium 4.2)
- [CVE-2026-23954](https://insights.sbomify.com/CVE-2026-23954/): Incus container image templating arbitrary host file read and write (high 8.7)
- [CVE-2026-23953](https://insights.sbomify.com/CVE-2026-23953/): Incus container environment configuration newline injection (high 8.7)
- [CVE-2026-23952](https://insights.sbomify.com/CVE-2026-23952/): ImageMagick has a NULL pointer dereference in MSL parser via <comment> tag before image load (medium 6.5)
- [CVE-2026-23951](https://insights.sbomify.com/CVE-2026-23951/): SumatraPDF's Integer Underflow in PalmDbReader Leads to Crash (medium 5.5)
- [CVE-2026-23950](https://insights.sbomify.com/CVE-2026-23950/): node-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFS (high 8.8)
- [CVE-2026-2395](https://insights.sbomify.com/CVE-2026-2395/): SQLi in Xpoda Türkiye Informatics Technology's No Code Platform (critical 9.8)
- [CVE-2026-23949](https://insights.sbomify.com/CVE-2026-23949/): jaraco.context Has a Path Traversal Vulnerability (high 8.6)
- [CVE-2026-23948](https://insights.sbomify.com/CVE-2026-23948/): FreeRDP has a NULL Pointer Dereference in rdp_write_logon_info_v2() (medium 6.9)
- [CVE-2026-23947](https://insights.sbomify.com/CVE-2026-23947/): Orval MCP client is vulnerable to code injection via unsanitized x-enum-descriptions in enum generation (critical 9.3)
- [CVE-2026-23946](https://insights.sbomify.com/CVE-2026-23946/): Tendenci has Authenticated Remote Code Execution via Pickle Deserialization (medium 6.8)
- [CVE-2026-23944](https://insights.sbomify.com/CVE-2026-23944/): Arcane allows unauthenticated proxy access to remote environments (high 8.0)
- [CVE-2026-23943](https://insights.sbomify.com/CVE-2026-23943/): Pre-auth SSH DoS via unbounded zlib inflate (medium 6.9)
- [CVE-2026-23942](https://insights.sbomify.com/CVE-2026-23942/): SFTP root escape via component-agnostic prefix check in ssh_sftpd (medium 5.3)
- [CVE-2026-23941](https://insights.sbomify.com/CVE-2026-23941/): Request smuggling via first-wins Content-Length parsing in inets httpd (high 7.0)
- [CVE-2026-23940](https://insights.sbomify.com/CVE-2026-23940/): Denial of Service via Oversized Package Upload (high 7.1)
- [CVE-2026-2394](https://insights.sbomify.com/CVE-2026-2394/): Buffer Over-read vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers. (medium 6.3)
- [CVE-2026-23939](https://insights.sbomify.com/CVE-2026-23939/): Path Traversal in Local File Store Backend (medium 6.9)
- [CVE-2026-23938](https://insights.sbomify.com/CVE-2026-23938/): Server DoS via JavaScript preprocessing or script items (low 2.1)
- [CVE-2026-23937](https://insights.sbomify.com/CVE-2026-23937/): Host PSK extraction in Zabbix API (medium 6.0)
- [CVE-2026-23935](https://insights.sbomify.com/CVE-2026-23935/): Use-after-free read in script item/preprocessing HttpRequest body (medium 6.8)
- [CVE-2026-23934](https://insights.sbomify.com/CVE-2026-23934/): Frontend DoS via the validate.api.exists action (medium 5.1)
- [CVE-2026-23933](https://insights.sbomify.com/CVE-2026-23933/): Hardcoded session key in Zabbix 7.4 (high 7.7)
- [CVE-2026-23931](https://insights.sbomify.com/CVE-2026-23931/): Frontend plaintext macro value enumeration via the validatate.api.exists action (medium 5.3)
- [CVE-2026-23930](https://insights.sbomify.com/CVE-2026-23930/): Frontend DoS via the popup.testtriggerexpr action (medium 5.3)
- [CVE-2026-2393](https://insights.sbomify.com/CVE-2026-2393/): Server-Side Request Forgery (SSRF) in mlflow/mlflow (high 7.1)
- [CVE-2026-23929](https://insights.sbomify.com/CVE-2026-23929/): Prototype pollution leading to stored XSS (high 8.5)
- [CVE-2026-23928](https://insights.sbomify.com/CVE-2026-23928/): Stored XSS vulnerability in the Item history/Plain text widget (high 7.3)
- [CVE-2026-23927](https://insights.sbomify.com/CVE-2026-23927/): Agent 2 Oracle plugin TNS connection string injection via the 'service' parameter (medium 5.1)
- [CVE-2026-23926](https://insights.sbomify.com/CVE-2026-23926/): Stored XSS vulnerability in Host navigator widget maintenance tooltip (high 7.3)
- [CVE-2026-23925](https://insights.sbomify.com/CVE-2026-23925/): Unauthorized host creation via configuration.import API by low-privilege user with write permissions (medium 5.1)
- [CVE-2026-23924](https://insights.sbomify.com/CVE-2026-23924/): Agent 2 Docker plugin arbitrary file read via Docker API injection (medium 6.1)
- [CVE-2026-23923](https://insights.sbomify.com/CVE-2026-23923/): Unauthenticated arbitrary PHP class instantiation (medium 6.9)
- [CVE-2026-23922](https://insights.sbomify.com/CVE-2026-23922/): Email media OAuth secret leak to Super Admin (low 2.1)
- [CVE-2026-23921](https://insights.sbomify.com/CVE-2026-23921/): Blind, read-only SQL injection in Zabbix API via sortfield parameter (high 8.7)
- [CVE-2026-23920](https://insights.sbomify.com/CVE-2026-23920/): Command injection in Zabbix (high 7.7)
- [CVE-2026-23919](https://insights.sbomify.com/CVE-2026-23919/): Insufficient isolation of JavaScript (Duktape) execution context on Zabbix Server (high 7.1)
- [CVE-2026-23918](https://insights.sbomify.com/CVE-2026-23918/): Apache HTTP Server: http2: double free and possible RCE on early reset (high 8.8)
- [CVE-2026-2391](https://insights.sbomify.com/CVE-2026-2391/): qs's arrayLimit bypass in comma parsing allows denial of service (medium 6.3)
- [CVE-2026-23907](https://insights.sbomify.com/CVE-2026-23907/): Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code (medium 5.3)
- [CVE-2026-23906](https://insights.sbomify.com/CVE-2026-23906/): Apache Druid: Authentication Bypass via LDAP Anonymous Bind (critical 9.8)
- [CVE-2026-23904](https://insights.sbomify.com/CVE-2026-23904/): Apache Kyuubi: Unrestricted access via Kyuubi engine-ui proxy (high 7.3)
- [CVE-2026-23903](https://insights.sbomify.com/CVE-2026-23903/): Apache Shiro: Auth bypass when accessing static files only on case-insensitive filesystems (medium 5.3)
- [CVE-2026-23902](https://insights.sbomify.com/CVE-2026-23902/): Apache DolphinScheduler: Users are able to use tenants that are not defined on the platform during workflow execution. (high 8.1)
- [CVE-2026-23901](https://insights.sbomify.com/CVE-2026-23901/): Apache Shiro: Brute force attack possible to determine valid user names (low 1.0)
- [CVE-2026-23900](https://insights.sbomify.com/CVE-2026-23900/): Extension - phoca.cz - Stored XSS vectors in Phoca Maps component 5.0.0 - 6.0.2 for Joomla (medium 6.5)
- [CVE-2026-2390](https://insights.sbomify.com/CVE-2026-2390/): Powerkit <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy Load Image Processing (medium 6.4)
- [CVE-2026-23899](https://insights.sbomify.com/CVE-2026-23899/): Joomla! Core - [20260306] - Improper access check in webservice endpoints (high 8.6)
- [CVE-2026-23898](https://insights.sbomify.com/CVE-2026-23898/): Joomla! Core - [20260305] - Arbitrary file deletion in com_joomlaupdate (high 8.6)
- [CVE-2026-23897](https://insights.sbomify.com/CVE-2026-23897/): Apollo Server is vulnerable to denial of service with `startStandaloneServer` (high 7.5)
- [CVE-2026-23896](https://insights.sbomify.com/CVE-2026-23896/): immich API Key Privilege Escalation vulnerability (high 7.2)
- [CVE-2026-23893](https://insights.sbomify.com/CVE-2026-23893/): openCryptoki has improper link resolution before file access (link following) (medium 6.8)
- [CVE-2026-23892](https://insights.sbomify.com/CVE-2026-23892/): OctoPrint has Timing Side-Channel Vulnerability in API Key Authentication (medium 6.0)
- [CVE-2026-23891](https://insights.sbomify.com/CVE-2026-23891/): Decidim has a Cross-site scripting (XSS) vulnerability via user name field (critical 9.3)
- [CVE-2026-23890](https://insights.sbomify.com/CVE-2026-23890/): pnpm scoped bin name Path Traversal allows arbitrary file creation outside node_modules/.bin (medium 6.5)
- [CVE-2026-2389](https://insights.sbomify.com/CVE-2026-2389/): Cross-site scripting in Complianz – GDPR/CCPA Cookie Consent (medium 4.9)
- [CVE-2026-23889](https://insights.sbomify.com/CVE-2026-23889/): pnpm has Windows-specific tarball Path Traversal (medium 6.5)
- [CVE-2026-23888](https://insights.sbomify.com/CVE-2026-23888/): pnpm: Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip) (medium 6.5)
- [CVE-2026-23887](https://insights.sbomify.com/CVE-2026-23887/): Group-Office has stored XSS vulnerability via unsanitized filenames (medium 5.1)
- [CVE-2026-23886](https://insights.sbomify.com/CVE-2026-23886/): Swift W3C TraceContext has malformed HTTP header that can cause a crash (medium 5.3)
- [CVE-2026-23885](https://insights.sbomify.com/CVE-2026-23885/): AlchemyCMS has Authenticated Remote Code Execution (RCE) via eval injection in ResourcesHelper (medium 6.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/784/