# Vulnerabilities published in 2026


- [CVE-2026-22844](https://insights.sbomify.com/CVE-2026-22844/): Zoom Node Deployments - Command Injection (critical 9.9)
- [CVE-2026-2284](https://insights.sbomify.com/CVE-2026-2284/): News Element Elementor Blog Magazine <= 1.0.8 - Missing Authorization to Authenticated (Subscriber+) Data Loss (medium 5.4)
- [CVE-2026-2283](https://insights.sbomify.com/CVE-2026-2283/): User Login History <= 2.1.7 - Authenticated (Administrator+) SQL Injection via 'blog_id' Parameter (medium 4.9)
- [CVE-2026-22828](https://insights.sbomify.com/CVE-2026-22828/): Memory corruption in FortiAnalyzer Cloud (high 7.3)
- [CVE-2026-22822](https://insights.sbomify.com/CVE-2026-22822/): External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function (critical 9.3)
- [CVE-2026-22821](https://insights.sbomify.com/CVE-2026-22821/): mreporting affected by a SQLI on date change (medium 4.9)
- [CVE-2026-22820](https://insights.sbomify.com/CVE-2026-22820/): Outray cli is vulnerable to race conditions in tunnels creation (medium 6.3)
- [CVE-2026-2282](https://insights.sbomify.com/CVE-2026-2282/): Slidorion <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Slidorion Settings (medium 4.4)
- [CVE-2026-22819](https://insights.sbomify.com/CVE-2026-22819/): Outray has a Race Condition in main/apps/web/src/routes/api/$orgSlug/subdomains/index.ts (medium 5.9)
- [CVE-2026-22818](https://insights.sbomify.com/CVE-2026-22818/): JWT algorithm confusion in Hono JWK Auth Middleware when JWK lacks "alg" (untrusted header.alg fallback) (high 8.2)
- [CVE-2026-22817](https://insights.sbomify.com/CVE-2026-22817/): JWT Algorithm Confusion via Unsafe Default (HS256) in Hono JWT Middleware Allows Token Forgery and Auth Bypass (high 8.2)
- [CVE-2026-22816](https://insights.sbomify.com/CVE-2026-22816/): Gradle fails to disable repositories which can expose builds to malicious artifacts (high 8.6)
- [CVE-2026-22815](https://insights.sbomify.com/CVE-2026-22815/): AIOHTTP: Uncapped memory usage possible through aiohttp allowing unlimited trailer headers (medium 6.9)
- [CVE-2026-22814](https://insights.sbomify.com/CVE-2026-22814/): Mass Assignment in AdonisJS Lucid Allows Overwriting Internal ORM State (high 8.2)
- [CVE-2026-22813](https://insights.sbomify.com/CVE-2026-22813/): Malicious website can execute commands on the local system through XSS in the OpenCode web UI (critical 9.4)
- [CVE-2026-22812](https://insights.sbomify.com/CVE-2026-22812/): OpenCode's Unauthenticated HTTP Server Allows Arbitrary Command Execution (high 8.8)
- [CVE-2026-22810](https://insights.sbomify.com/CVE-2026-22810/): Joplin: Path traversal in OneNote importer allows overwriting arbitrary files (high 8.2)
- [CVE-2026-2281](https://insights.sbomify.com/CVE-2026-2281/): Private Comment <= 0.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Label Text Setting (medium 4.4)
- [CVE-2026-22809](https://insights.sbomify.com/CVE-2026-22809/): tarteaucitron.js has Regular Expression Denial of Service (ReDoS) vulnerability (medium 4.4)
- [CVE-2026-22808](https://insights.sbomify.com/CVE-2026-22808/): Fleet Windows MDM endpoint has a Cross-site Scripting vulnerability (medium 5.5)
- [CVE-2026-22807](https://insights.sbomify.com/CVE-2026-22807/): vLLM affected by RCE via auto_map dynamic module loading during model initialization (high 8.8)
- [CVE-2026-22806](https://insights.sbomify.com/CVE-2026-22806/): vCluster Platform's Access Keys Allows Access Beyond Scope (critical 9.1)
- [CVE-2026-22805](https://insights.sbomify.com/CVE-2026-22805/): Metabase channel test endpoint can reach internal local addresses (low 2.1)
- [CVE-2026-22804](https://insights.sbomify.com/CVE-2026-22804/): Cross-site scripting in Termix (high 8.0)
- [CVE-2026-22803](https://insights.sbomify.com/CVE-2026-22803/): SvelteKit has a memory amplification DoS in Remote Functions binary form deserializer (high 8.2)
- [CVE-2026-22801](https://insights.sbomify.com/CVE-2026-22801/): LIBPNG has an integer truncation causing heap buffer over-read in png_image_write_* (medium 6.8)
- [CVE-2026-22800](https://insights.sbomify.com/CVE-2026-22800/): PILOS affected by a CSRF via GET request allows unintentional termination of all active video conferences (low 2.4)
- [CVE-2026-2280](https://insights.sbomify.com/CVE-2026-2280/): rexCrawler <= 1.0.15 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings (medium 4.8)
- [CVE-2026-22799](https://insights.sbomify.com/CVE-2026-22799/): emlog Arbitrary File Upload Vulnerability (critical 9.3)
- [CVE-2026-22798](https://insights.sbomify.com/CVE-2026-22798/): hermes's raw options logging may disclose secrets passed in via subcommand options argument (medium 5.9)
- [CVE-2026-22797](https://insights.sbomify.com/CVE-2026-22797/): Auth bypass in keystonemiddleware (critical 9.9)
- [CVE-2026-22796](https://insights.sbomify.com/CVE-2026-22796/): ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function (medium 5.3)
- [CVE-2026-22795](https://insights.sbomify.com/CVE-2026-22795/): Missing ASN1_TYPE validation in PKCS#12 parsing (medium 5.5)
- [CVE-2026-22794](https://insights.sbomify.com/CVE-2026-22794/): Account Takeover Vulnerability in Appsmith (critical 9.7)
- [CVE-2026-22793](https://insights.sbomify.com/CVE-2026-22793/): 5ire vulnerable to Remote Code Execution (RCE) via ECharts (critical 9.7)
- [CVE-2026-22792](https://insights.sbomify.com/CVE-2026-22792/): 5ire vulnerable to Remote Code Execution (RCE) (critical 9.7)
- [CVE-2026-22791](https://insights.sbomify.com/CVE-2026-22791/): openCryptoki incorrectly calculates the buffer size in C_WrapKey with CKM_ECDH_AES_KEY_WRAP (medium 6.6)
- [CVE-2026-22790](https://insights.sbomify.com/CVE-2026-22790/): EVerest's unchecked SLAC payload length causes stack overflow in HomeplugMessage::setup_payload (high 8.8)
- [CVE-2026-2279](https://insights.sbomify.com/CVE-2026-2279/): myLinksDump <= 1.6 - Authenticated (Administrator+) SQL Injection via 'sort_by' and 'sort_order' Parameters (high 7.2)
- [CVE-2026-22789](https://insights.sbomify.com/CVE-2026-22789/): WebErpMesv2 has a File Upload Validation Bypass Leading to RCE (medium 5.4)
- [CVE-2026-22788](https://insights.sbomify.com/CVE-2026-22788/): WebErpMesv2 allows unauthenticated API Access (high 8.2)
- [CVE-2026-22787](https://insights.sbomify.com/CVE-2026-22787/): html2pdf.js has a cross-site scripting vulnerability (high 8.7)
- [CVE-2026-22786](https://insights.sbomify.com/CVE-2026-22786/): Gin-vue-admin has arbitrary file upload vulnerability caused by path traversal (high 7.3)
- [CVE-2026-22785](https://insights.sbomify.com/CVE-2026-22785/): orval MCP client is vulnerable to a code injection attack. (critical 9.3)
- [CVE-2026-22784](https://insights.sbomify.com/CVE-2026-22784/): Lychee cross-album password propagation on Album unlocking (low 2.3)
- [CVE-2026-22783](https://insights.sbomify.com/CVE-2026-22783/): Iris Allows Arbitrary File Deletion via Mass Assignment in Datastore File Management (critical 9.6)
- [CVE-2026-22782](https://insights.sbomify.com/CVE-2026-22782/): RustFS RPC signature verification logs shared secret (low 2.9)
- [CVE-2026-22781](https://insights.sbomify.com/CVE-2026-22781/): TinyWeb CGI Command Injection (critical 10.0)
- [CVE-2026-22780](https://insights.sbomify.com/CVE-2026-22780/): Rizin has a heap overflow on mach0_chained_fixups.c (medium 4.4)
- [CVE-2026-2278](https://insights.sbomify.com/CVE-2026-2278/): VW Writer Blog <= 1.3.8 - Missing Authorization to Authenticated (Subscriber+) Theme Settings Reset (medium 4.3)
- [CVE-2026-22779](https://insights.sbomify.com/CVE-2026-22779/): BlackSheep ClientSession is vulnerable to CRLF injection (medium 6.3)
- [CVE-2026-22778](https://insights.sbomify.com/CVE-2026-22778/): vLLM leaks a heap address when PIL throws an error (critical 9.8)
- [CVE-2026-22777](https://insights.sbomify.com/CVE-2026-22777/): ComfyUI-Manager is Vulnerable to CRLF Injection in Configuration Handler (high 7.5)
- [CVE-2026-22776](https://insights.sbomify.com/CVE-2026-22776/): cpp-httplib vulnerable to a denial of service (DOS) using a zip bomb (high 8.7)
- [CVE-2026-22775](https://insights.sbomify.com/CVE-2026-22775/): devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse (high 7.5)
- [CVE-2026-22774](https://insights.sbomify.com/CVE-2026-22774/): devalue vulnerable to denial of service due to memory exhaustion in devalue.parse (high 7.5)
- [CVE-2026-22773](https://insights.sbomify.com/CVE-2026-22773/): vLLM is vulnerable to DoS in Idefics3 vision models via image payload with ambiguous dimensions (medium 6.5)
- [CVE-2026-22772](https://insights.sbomify.com/CVE-2026-22772/): Fulcio vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass (medium 5.8)
- [CVE-2026-22771](https://insights.sbomify.com/CVE-2026-22771/): Envoy Extension Policy lua scripts injection causes arbitrary command execution (high 8.8)
- [CVE-2026-22770](https://insights.sbomify.com/CVE-2026-22770/): ImageMagick vulnerable to Release of Invalid Pointer in BilateralBlur when memory allocation fails (medium 6.5)
- [CVE-2026-2277](https://insights.sbomify.com/CVE-2026-2277/): rexCrawler <= 1.0.15 - Reflected Cross-Site Scripting via 'url' and 'regex' Parameters (medium 6.1)
- [CVE-2026-22769](https://insights.sbomify.com/CVE-2026-22769/): Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials (critical 10.0, exploited in the wild)
- [CVE-2026-22768](https://insights.sbomify.com/CVE-2026-22768/): Privilege escalation in AppSync (high 7.3)
- [CVE-2026-22767](https://insights.sbomify.com/CVE-2026-22767/): Path traversal in AppSync (high 7.3)
- [CVE-2026-22766](https://insights.sbomify.com/CVE-2026-22766/): File upload in Wyse Management Suite (high 7.2)
- [CVE-2026-22765](https://insights.sbomify.com/CVE-2026-22765/): Missing authorization in Wyse Management Suite (high 8.8)
- [CVE-2026-22764](https://insights.sbomify.com/CVE-2026-22764/): Auth bypass in OpenManage Network Integration (medium 4.3)
- [CVE-2026-22762](https://insights.sbomify.com/CVE-2026-22762/): Path traversal in Avamar Server (medium 6.5)
- [CVE-2026-22761](https://insights.sbomify.com/CVE-2026-22761/): Command injection in PowerProtect Data Domain (medium 6.7)
- [CVE-2026-22760](https://insights.sbomify.com/CVE-2026-22760/): Denial of service in Device Management Agent (DDMA) (low 3.3)
- [CVE-2026-2276](https://insights.sbomify.com/CVE-2026-2276/): Reflected Cross-Site Scripting in the Wix web application (medium 5.3)
- [CVE-2026-22755](https://insights.sbomify.com/CVE-2026-22755/): Legacy Vivotek Camera Firmware Command Injection in upload_map.cgi (critical 9.3)
- [CVE-2026-22754](https://insights.sbomify.com/CVE-2026-22754/): ervlet Path Not Correctly Included in Path Matching of XML Authorization Rules (high 7.5)
- [CVE-2026-22753](https://insights.sbomify.com/CVE-2026-22753/): Servlet Path Not Correctly Included in Path Matching of HttpSecurity#securityMatchers (high 7.5)
- [CVE-2026-22752](https://insights.sbomify.com/CVE-2026-22752/): Auth bypass in Spring Authorization Server (critical 9.6)
- [CVE-2026-22751](https://insights.sbomify.com/CVE-2026-22751/): Spring Security JdbcOneTimeTokenService allows a one-time token to authenticate multiple sessions (medium 4.8)
- [CVE-2026-22750](https://insights.sbomify.com/CVE-2026-22750/): SSL bundle configuration silently bypassed in Spring Cloud Gateway (high 7.5)
- [CVE-2026-2275](https://insights.sbomify.com/CVE-2026-2275/): CVE-2026-2275 (critical 9.6)
- [CVE-2026-22748](https://insights.sbomify.com/CVE-2026-22748/): Potential Security Misconfiguration when Using withIssuerLocation (medium 5.3)
- [CVE-2026-22747](https://insights.sbomify.com/CVE-2026-22747/): Unauthorized User Impersonation when Using X.509 Client Certificates (medium 6.8)
- [CVE-2026-22746](https://insights.sbomify.com/CVE-2026-22746/): User Attribute Enumeration when Using DaoAuthenticationProvider (low 3.7)
- [CVE-2026-22745](https://insights.sbomify.com/CVE-2026-22745/): CVE-2026-22745 : Denial of service in static resource handling on Windows platforms (medium 5.3)
- [CVE-2026-22744](https://insights.sbomify.com/CVE-2026-22744/): Spring AI Redis Store has TAG Field Query Injection Through Improper Neutralization of Special Characters (high 7.5)
- [CVE-2026-22743](https://insights.sbomify.com/CVE-2026-22743/): Server-Side Request Forgery via Filter Expression Keys in Neo4jVectorStore (high 7.5)
- [CVE-2026-22742](https://insights.sbomify.com/CVE-2026-22742/): Server-Side Request Forgery in BedrockProxyChatModel via Unvalidated Media URL Fetching (high 8.6)
- [CVE-2026-22741](https://insights.sbomify.com/CVE-2026-22741/): Static resource cache poisoning in Spring MVC and WebFlux (low 3.1)
- [CVE-2026-22740](https://insights.sbomify.com/CVE-2026-22740/): Spring Framework DoS with Multipart Temp Files in WebFlux (medium 6.5)
- [CVE-2026-2274](https://insights.sbomify.com/CVE-2026-2274/): Arbitrary File Read and SSRF in Google AppSheet (high 8.5)
- [CVE-2026-22739](https://insights.sbomify.com/CVE-2026-22739/): Spring Cloud Config Profile Substitution Can Allow Unintended Access To Files And Enable SSRF Attacks (high 8.6)
- [CVE-2026-22738](https://insights.sbomify.com/CVE-2026-22738/): SpEL Injection via Unescaped Filter Key in SimpleVectorStore Leads to Remote Code Execution (critical 9.8)
- [CVE-2026-22737](https://insights.sbomify.com/CVE-2026-22737/): Spring Framework Improper Path Limitation with Script View Templates (medium 5.9)
- [CVE-2026-22735](https://insights.sbomify.com/CVE-2026-22735/): Server Sent Event stream corruption (low 2.6)
- [CVE-2026-22734](https://insights.sbomify.com/CVE-2026-22734/): Cloud Foundry UAA SAML 2.0 Signature Bypass (high 8.6)
- [CVE-2026-22733](https://insights.sbomify.com/CVE-2026-22733/): Authentication Bypass under Actuator CloudFoundry endpoints (high 8.2)
- [CVE-2026-22732](https://insights.sbomify.com/CVE-2026-22732/): Under Some Conditions Spring Security HTTP Headers Are not Written (critical 9.1)
- [CVE-2026-22731](https://insights.sbomify.com/CVE-2026-22731/): Authentication Bypass under Actuator Health groups paths (high 8.2)
- [CVE-2026-22730](https://insights.sbomify.com/CVE-2026-22730/): CVE-2026-22730: SQL Injection in Spring AI MariaDBFilterExpressionConverter (high 8.8)
- [CVE-2026-2273](https://insights.sbomify.com/CVE-2026-2273/): Code injection in EcoStruxure™ Automation Expert (high 7.2)
- [CVE-2026-22729](https://insights.sbomify.com/CVE-2026-22729/): CVE-2026-22729: JSONPath Injection in Spring AI Vector Stores FilterExpressionConverter (high 8.6)
- [CVE-2026-22728](https://insights.sbomify.com/CVE-2026-22728/): sealed-secrets /v1/rotate can widen sealing scope to cluster-wide via attacker-controlled template annotations (medium 4.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/795/