# Vulnerabilities published in 2026


- [CVE-2026-22988](https://insights.sbomify.com/CVE-2026-22988/): arp: do not assume dev_hard_header() does not change skb->head (high 7.8)
- [CVE-2026-22987](https://insights.sbomify.com/CVE-2026-22987/): net/sched: act_api: avoid dereferencing ERR_PTR in tcf_idrinfo_destroy (medium 5.5)
- [CVE-2026-22986](https://insights.sbomify.com/CVE-2026-22986/): gpiolib: fix race condition for gdev->srcu (medium 4.7)
- [CVE-2026-22985](https://insights.sbomify.com/CVE-2026-22985/): idpf: Fix RSS LUT NULL pointer crash on early ethtool operations (medium 5.5)
- [CVE-2026-22984](https://insights.sbomify.com/CVE-2026-22984/): libceph: prevent potential out-of-bounds reads in handle_auth_done() (critical 9.8)
- [CVE-2026-22983](https://insights.sbomify.com/CVE-2026-22983/): net: do not write to msg_get_inq in callee (medium 5.5)
- [CVE-2026-22982](https://insights.sbomify.com/CVE-2026-22982/): net: mscc: ocelot: Fix crash when adding interface under a lag (medium 5.5)
- [CVE-2026-22981](https://insights.sbomify.com/CVE-2026-22981/): idpf: detach and close netdevs while handling a reset (medium 5.5)
- [CVE-2026-22980](https://insights.sbomify.com/CVE-2026-22980/): nfsd: provide locking for v4_end_grace (high 7.8)
- [CVE-2026-2298](https://insights.sbomify.com/CVE-2026-2298/): Command injection in Marketing Cloud Engagement (critical 9.4)
- [CVE-2026-22979](https://insights.sbomify.com/CVE-2026-22979/): net: fix memory leak in skb_segment_list for GRO packets (medium 5.5)
- [CVE-2026-22978](https://insights.sbomify.com/CVE-2026-22978/): wifi: avoid kernel-infoleak from struct iw_point (low 3.3)
- [CVE-2026-22977](https://insights.sbomify.com/CVE-2026-22977/): net: sock: fix hardened usercopy panic in sock_recv_errqueue (medium 5.5)
- [CVE-2026-22976](https://insights.sbomify.com/CVE-2026-22976/): net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset (medium 5.5)
- [CVE-2026-2297](https://insights.sbomify.com/CVE-2026-2297/): SourcelessFileLoader does not use io.open_code() (medium 5.7)
- [CVE-2026-2296](https://insights.sbomify.com/CVE-2026-2296/): Code injection in Product Addons for Woocommerce – Product Options with Custom Fields (high 7.2)
- [CVE-2026-2295](https://insights.sbomify.com/CVE-2026-2295/): Missing authorization in WPZOOM Addons for Elementor – Starter Templates & Widgets (medium 5.3)
- [CVE-2026-2294](https://insights.sbomify.com/CVE-2026-2294/): Missing authorization in UiPress lite | Effortless custom dashboards, admin themes and pages (medium 4.3)
- [CVE-2026-2293](https://insights.sbomify.com/CVE-2026-2293/): NestJS 11.1.13 - Lack of data validation allowing authentication/authorization bypass (high 8.2)
- [CVE-2026-22927](https://insights.sbomify.com/CVE-2026-22927/): Path traversal in Omnissa Workspace ONE® Tunnel for Windows (high 7.8)
- [CVE-2026-22926](https://insights.sbomify.com/CVE-2026-22926/): Path traversal in Omnissa Workspace ONE® Assist for macOS (high 7.8)
- [CVE-2026-22925](https://insights.sbomify.com/CVE-2026-22925/): Denial of service in SIMATIC CN 4100 (high 8.7)
- [CVE-2026-22924](https://insights.sbomify.com/CVE-2026-22924/): Missing authorization in SIMATIC CN 4100 (high 8.8)
- [CVE-2026-22923](https://insights.sbomify.com/CVE-2026-22923/): Memory corruption in NX (high 7.3)
- [CVE-2026-22922](https://insights.sbomify.com/CVE-2026-22922/): Apache Airflow: Airflow externalLogUrl Permission Bypass (medium 6.5)
- [CVE-2026-2292](https://insights.sbomify.com/CVE-2026-2292/): Morkva UA Shipping <= 1.7.9 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Weight, kg' Field (medium 4.4)
- [CVE-2026-22919](https://insights.sbomify.com/CVE-2026-22919/): Cross-site scripting in TDC-X401GL (low 3.8)
- [CVE-2026-22918](https://insights.sbomify.com/CVE-2026-22918/): Other in TDC-X401GL (medium 4.3)
- [CVE-2026-22917](https://insights.sbomify.com/CVE-2026-22917/): Denial of service in TDC-X401GL (medium 4.3)
- [CVE-2026-22916](https://insights.sbomify.com/CVE-2026-22916/): Missing authorization in TDC-X401GL (medium 4.3)
- [CVE-2026-22915](https://insights.sbomify.com/CVE-2026-22915/): Information disclosure in TDC-X401GL (medium 4.3)
- [CVE-2026-22914](https://insights.sbomify.com/CVE-2026-22914/): Privilege escalation in TDC-X401GL (medium 4.3)
- [CVE-2026-22913](https://insights.sbomify.com/CVE-2026-22913/): Cross-site scripting in TDC-X401GL (medium 4.3)
- [CVE-2026-22912](https://insights.sbomify.com/CVE-2026-22912/): Open redirect in TDC-X401GL (medium 4.3)
- [CVE-2026-22911](https://insights.sbomify.com/CVE-2026-22911/): Hardcoded credentials in TDC-X401GL (medium 5.3)
- [CVE-2026-22910](https://insights.sbomify.com/CVE-2026-22910/): Hardcoded credentials in TDC-X401GL (high 7.5)
- [CVE-2026-2291](https://insights.sbomify.com/CVE-2026-2291/): CVE-2026-2291 (high 7.3)
- [CVE-2026-22909](https://insights.sbomify.com/CVE-2026-22909/): Missing authorization in TDC-X401GL (high 7.5)
- [CVE-2026-22908](https://insights.sbomify.com/CVE-2026-22908/): File upload in TDC-X401GL (critical 9.1)
- [CVE-2026-22907](https://insights.sbomify.com/CVE-2026-22907/): Privilege escalation in TDC-X401GL (critical 9.9)
- [CVE-2026-22906](https://insights.sbomify.com/CVE-2026-22906/): Hardcoded Key Allows Credential Disclosure (critical 9.8)
- [CVE-2026-22905](https://insights.sbomify.com/CVE-2026-22905/): Authentication Bypass via URI Traversal (high 7.5)
- [CVE-2026-22904](https://insights.sbomify.com/CVE-2026-22904/): Stack Overflow via Oversized Cookie Fields in lighttpd (critical 9.8)
- [CVE-2026-22903](https://insights.sbomify.com/CVE-2026-22903/): Stack Overflow via SESSIONID Cookie in lighttpd (critical 9.8)
- [CVE-2026-22902](https://insights.sbomify.com/CVE-2026-22902/): QuNetSwitch (medium 5.7)
- [CVE-2026-22901](https://insights.sbomify.com/CVE-2026-22901/): QuNetSwitch (medium 6.3)
- [CVE-2026-22900](https://insights.sbomify.com/CVE-2026-22900/): QuNetSwitch (medium 6.8)
- [CVE-2026-2290](https://insights.sbomify.com/CVE-2026-2290/): Server-side request forgery in Post Affiliate Pro (low 3.8)
- [CVE-2026-22899](https://insights.sbomify.com/CVE-2026-22899/): File Station 5 (low 1.3)
- [CVE-2026-22898](https://insights.sbomify.com/CVE-2026-22898/): QVR Pro (critical 9.3)
- [CVE-2026-22897](https://insights.sbomify.com/CVE-2026-22897/): QuNetSwitch (high 8.1)
- [CVE-2026-22896](https://insights.sbomify.com/CVE-2026-22896/): Stored XSS via Interface Name in Network & Virtual Switch App (medium 6.2)
- [CVE-2026-22895](https://insights.sbomify.com/CVE-2026-22895/): QuFTP Service (medium 6.2)
- [CVE-2026-22894](https://insights.sbomify.com/CVE-2026-22894/): File Station 5 (low 1.3)
- [CVE-2026-22893](https://insights.sbomify.com/CVE-2026-22893/): QTS, QuTS hero (high 8.6)
- [CVE-2026-22892](https://insights.sbomify.com/CVE-2026-22892/): Insufficient Authorization in Mattermost Jira Plugin Allows Unauthorized Access to Post Attachments (medium 4.3)
- [CVE-2026-22891](https://insights.sbomify.com/CVE-2026-22891/): Memory corruption in libbiosig (critical 9.8)
- [CVE-2026-22890](https://insights.sbomify.com/CVE-2026-22890/): EV2GO ev2go.io Insufficiently Protected Credentials (medium 6.9)
- [CVE-2026-2289](https://insights.sbomify.com/CVE-2026-2289/): Taskbuilder <= 5.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Block Emails' Field (medium 4.4)
- [CVE-2026-22888](https://insights.sbomify.com/CVE-2026-22888/): Other in Cybozu Garoon (medium 6.9)
- [CVE-2026-22887](https://insights.sbomify.com/CVE-2026-22887/): Memory corruption in Intel(R) PROSet/Wireless WiFi Software for Windows (high 8.3)
- [CVE-2026-22886](https://insights.sbomify.com/CVE-2026-22886/): Hardcoded credentials in Eclipse OpenMQ (critical 9.8)
- [CVE-2026-22885](https://insights.sbomify.com/CVE-2026-22885/): EnOcean SmartServer IoT Out-of-bounds Read (low 3.7)
- [CVE-2026-22882](https://insights.sbomify.com/CVE-2026-22882/): Memory corruption in Affinity (medium 6.1)
- [CVE-2026-22881](https://insights.sbomify.com/CVE-2026-22881/): Cross-site scripting in Cybozu Garoon (medium 6.8)
- [CVE-2026-22880](https://insights.sbomify.com/CVE-2026-22880/): Mobile SSO authentication flow allows credential theft via malicious server (medium 6.1)
- [CVE-2026-2288](https://insights.sbomify.com/CVE-2026-2288/): myLinksDump <= 1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'link_title' Parameter (medium 4.8)
- [CVE-2026-22879](https://insights.sbomify.com/CVE-2026-22879/): Memory corruption in vtk (high 8.1)
- [CVE-2026-22878](https://insights.sbomify.com/CVE-2026-22878/): Mobility46 mobility46.se Insufficiently Protected Credentials (medium 6.9)
- [CVE-2026-22877](https://insights.sbomify.com/CVE-2026-22877/): Copeland XWEB and XWEB Pro Path Traversal (low 3.7)
- [CVE-2026-22876](https://insights.sbomify.com/CVE-2026-22876/): Path traversal in Multiple Network Cameras TRIFORA 3 series (high 7.1)
- [CVE-2026-22875](https://insights.sbomify.com/CVE-2026-22875/): Cross-site scripting in Movable Type (Cloud Edition) (medium 4.8)
- [CVE-2026-22874](https://insights.sbomify.com/CVE-2026-22874/): Gitea webhook and migration allow-list filtering permits SSRF (critical 9.6)
- [CVE-2026-22872](https://insights.sbomify.com/CVE-2026-22872/): Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability (medium 6.9)
- [CVE-2026-22871](https://insights.sbomify.com/CVE-2026-22871/): GuardDog Path Traversal Vulnerability Leads to Arbitrary File Overwrite and RCE (high 8.7)
- [CVE-2026-22870](https://insights.sbomify.com/CVE-2026-22870/): GuardDog Zip Bomb Vulnerability in safe_extract() Allows DoS (high 7.1)
- [CVE-2026-2287](https://insights.sbomify.com/CVE-2026-2287/): CVE-2026-2287 (critical 9.8)
- [CVE-2026-22869](https://insights.sbomify.com/CVE-2026-22869/): Eigent Allows Arbitrary Code Execution via pull_request_target CI Workflow (high 8.9)
- [CVE-2026-22868](https://insights.sbomify.com/CVE-2026-22868/): go-ethereum has a DoS via malicious p2p message (high 7.1)
- [CVE-2026-22867](https://insights.sbomify.com/CVE-2026-22867/): LaSuite Doc affected by Stored XSS via Interlinking Block (high 8.7)
- [CVE-2026-22866](https://insights.sbomify.com/CVE-2026-22866/): ENS DNSSEC Oracle Vulnerable to RSA Signature Forgery via Missing PKCS#1 v1.5 Padding Validation (low 2.7)
- [CVE-2026-22865](https://insights.sbomify.com/CVE-2026-22865/): Gradle's failure to disable repositories failing to answer can expose builds to malicious artifacts (high 8.6)
- [CVE-2026-22864](https://insights.sbomify.com/CVE-2026-22864/): Deno has an incomplete fix for command-injection prevention on Windows — case-insensitive extension bypass (high 8.1)
- [CVE-2026-22863](https://insights.sbomify.com/CVE-2026-22863/): Deno node:crypto doesn't finalize cipher (critical 9.2)
- [CVE-2026-22862](https://insights.sbomify.com/CVE-2026-22862/): go-ethereum has a DoS via malicious p2p message (high 7.1)
- [CVE-2026-22861](https://insights.sbomify.com/CVE-2026-22861/): iccDEV has a heap-buffer-overflow in SIccCalcOp::Describe() at IccProfLib/IccMpeCalc.cpp (high 8.8)
- [CVE-2026-22860](https://insights.sbomify.com/CVE-2026-22860/): Rack has a Directory Traversal via Rack:Directory (high 7.5)
- [CVE-2026-2286](https://insights.sbomify.com/CVE-2026-2286/): CVE-2026-2286 (critical 9.8)
- [CVE-2026-22859](https://insights.sbomify.com/CVE-2026-22859/): FreeRDP has a heap-buffer-overflow in urb_select_configuration (medium 5.6)
- [CVE-2026-22858](https://insights.sbomify.com/CVE-2026-22858/): FreeRDP has a global-buffer-overflow in crypto_base64_decode (medium 5.6)
- [CVE-2026-22857](https://insights.sbomify.com/CVE-2026-22857/): FreeRDP has a heap-use-after-free in irp_thread_func (medium 6.8)
- [CVE-2026-22856](https://insights.sbomify.com/CVE-2026-22856/): FreeRDP has a heap-use-after-free in create_irp_thread (medium 6.8)
- [CVE-2026-22855](https://insights.sbomify.com/CVE-2026-22855/): FreeRDP has a heap-buffer-overflow in smartcard_unpack_set_attrib_call (medium 5.6)
- [CVE-2026-22854](https://insights.sbomify.com/CVE-2026-22854/): FreeRDP has a heap-buffer-overflow in drive_process_irp_read (medium 6.8)
- [CVE-2026-22853](https://insights.sbomify.com/CVE-2026-22853/): FreeRDP has a heap-buffer-overflow in ndr_read_uint8Array (medium 6.8)
- [CVE-2026-22852](https://insights.sbomify.com/CVE-2026-22852/): FreeRDP has a heap-buffer-overflow in audin_process_formats (medium 6.8)
- [CVE-2026-22851](https://insights.sbomify.com/CVE-2026-22851/): FreeRDP RDPGFX ResetGraphics race leads to use-after-free in SDL client (sdl->primary) (medium 6.9)
- [CVE-2026-22850](https://insights.sbomify.com/CVE-2026-22850/): SQL injection in koko-analytics (high 8.4)
- [CVE-2026-2285](https://insights.sbomify.com/CVE-2026-2285/): CVE-2026-2285 (high 7.5)
- [CVE-2026-22849](https://insights.sbomify.com/CVE-2026-22849/): Saleor lacks proper HTML sanitization in rich text fields (high 7.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/794/