# Vulnerabilities published in 2026


- [CVE-2026-22727](https://insights.sbomify.com/CVE-2026-22727/): Cloud Foundry unprotected internal endpoints (high 7.5)
- [CVE-2026-22726](https://insights.sbomify.com/CVE-2026-22726/): Route Services Firewall Bypass (medium 5.0)
- [CVE-2026-22723](https://insights.sbomify.com/CVE-2026-22723/): UAA User Token Revocation logic error (medium 6.5)
- [CVE-2026-22722](https://insights.sbomify.com/CVE-2026-22722/): VMware Workstation for Windows null pointer dereference may allow an authenticated user to trigger a crash (medium 6.1)
- [CVE-2026-22721](https://insights.sbomify.com/CVE-2026-22721/): VMware Aria Operations privilege escalation vulnerability (medium 6.2)
- [CVE-2026-22720](https://insights.sbomify.com/CVE-2026-22720/): VMware Aria Operations stored cross-site scripting vulnerability (high 8.0)
- [CVE-2026-2272](https://insights.sbomify.com/CVE-2026-2272/): Gimp: gimp: memory corruption due to integer overflow in ico file handling (medium 4.3)
- [CVE-2026-22719](https://insights.sbomify.com/CVE-2026-22719/): Broadcom VMware Aria Operations Command Injection (high 8.1, exploited in the wild)
- [CVE-2026-22718](https://insights.sbomify.com/CVE-2026-22718/): Command injection vulnerability (medium 6.8)
- [CVE-2026-22717](https://insights.sbomify.com/CVE-2026-22717/): VMware Workstation out-of-bound read vulnerability (low 2.7)
- [CVE-2026-22716](https://insights.sbomify.com/CVE-2026-22716/): VMware Workstation out-of-bounds write vulnerability (medium 5.0)
- [CVE-2026-22715](https://insights.sbomify.com/CVE-2026-22715/): VMware Workstation/Fusion NAT vulnerability (medium 5.9)
- [CVE-2026-22714](https://insights.sbomify.com/CVE-2026-22714/): i18n XSS, DoS and config SQLI in Monaco (low 2.3)
- [CVE-2026-22713](https://insights.sbomify.com/CVE-2026-22713/): Stored XSS through edit summaries in GrowthExperiments (low 2.3)
- [CVE-2026-22712](https://insights.sbomify.com/CVE-2026-22712/): ApprovedRevs allows bypassing the inline CSS sanitizer (low 2.3)
- [CVE-2026-22711](https://insights.sbomify.com/CVE-2026-22711/): Stored XSS through system messages in WikiLove (medium 6.9)
- [CVE-2026-22710](https://insights.sbomify.com/CVE-2026-22710/): Stored XSS through autocomment system messages in Wikibase (low 2.3)
- [CVE-2026-2271](https://insights.sbomify.com/CVE-2026-2271/): Gimp: gimp: denial of service via crafted psp image file (low 3.3)
- [CVE-2026-22709](https://insights.sbomify.com/CVE-2026-22709/): vm2 has a Sandbox Escape (critical 9.8)
- [CVE-2026-22708](https://insights.sbomify.com/CVE-2026-22708/): Cursor has a Terminal Tool Allowlist Bypass via Environment Variables (high 7.2)
- [CVE-2026-22707](https://insights.sbomify.com/CVE-2026-22707/): Strapi Upload Plugin MIME Validation Bypass via Content API (medium 5.3)
- [CVE-2026-22706](https://insights.sbomify.com/CVE-2026-22706/): Strapi: Password Reset Does Not Revoke Existing Refresh Sessions (low 2.1)
- [CVE-2026-22705](https://insights.sbomify.com/CVE-2026-22705/): RustCrypto: Signatures has timing side-channel in ML-DSA decomposition (medium 6.4)
- [CVE-2026-22704](https://insights.sbomify.com/CVE-2026-22704/): HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover (high 8.1)
- [CVE-2026-22703](https://insights.sbomify.com/CVE-2026-22703/): Cosign verification accepts any valid Rekor entry under certain conditions (medium 5.5)
- [CVE-2026-22702](https://insights.sbomify.com/CVE-2026-22702/): virtualenv Has TOCTOU Vulnerabilities in Directory Creation (medium 4.5)
- [CVE-2026-22701](https://insights.sbomify.com/CVE-2026-22701/): filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock (medium 5.3)
- [CVE-2026-22700](https://insights.sbomify.com/CVE-2026-22700/): RustCrypto Has Insufficient Length Validation in decrypt() in SM2-PKE (high 7.5)
- [CVE-2026-2270](https://insights.sbomify.com/CVE-2026-2270/): StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation (medium 5.9)
- [CVE-2026-22699](https://insights.sbomify.com/CVE-2026-22699/): RustCrypto SM2-PKE has Unchecked AffinePoint Decoding (unwrap) in decrypt() (high 7.5)
- [CVE-2026-22698](https://insights.sbomify.com/CVE-2026-22698/): RustCrypto SM2-PKE has 32-bit Biased Nonce Vulnerability (high 8.7)
- [CVE-2026-22697](https://insights.sbomify.com/CVE-2026-22697/): Memory corruption in CryptoLib (high 7.5)
- [CVE-2026-22696](https://insights.sbomify.com/CVE-2026-22696/): dcap-qvl has Missing Verification for QE Identity (critical 9.3)
- [CVE-2026-22695](https://insights.sbomify.com/CVE-2026-22695/): LIBPNG has a heap buffer over-read in png_image_read_direct_scaled (regression from CVE-2025-65018 fix) (medium 6.1)
- [CVE-2026-22694](https://insights.sbomify.com/CVE-2026-22694/): AliasVault is Missing Origin Validation in Android Passkey Credential Provider (medium 6.1)
- [CVE-2026-22693](https://insights.sbomify.com/CVE-2026-22693/): Null Pointer Dereference in SubtableUnicodesCache::create leading to DoS (medium 5.3)
- [CVE-2026-22692](https://insights.sbomify.com/CVE-2026-22692/): October CMS: Twig Sandbox Bypass via Collection Methods (medium 4.9)
- [CVE-2026-22691](https://insights.sbomify.com/CVE-2026-22691/): pypdf has possible long runtimes for malformed startxref (low 2.7)
- [CVE-2026-22690](https://insights.sbomify.com/CVE-2026-22690/): pypdf has possible long runtimes for missing /Root object with large /Size values (low 2.7)
- [CVE-2026-2269](https://insights.sbomify.com/CVE-2026-2269/): Server-side request forgery in Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin (high 7.2)
- [CVE-2026-22689](https://insights.sbomify.com/CVE-2026-22689/): Mailpit is vulnerable to Cross-Site WebSocket Hijacking (CSWSH) allowing unauthenticated access to emails (medium 6.5)
- [CVE-2026-22688](https://insights.sbomify.com/CVE-2026-22688/): WeKnora has Command Injection in MCP stdio test (critical 10.0)
- [CVE-2026-22687](https://insights.sbomify.com/CVE-2026-22687/): WeKnora vulnerable to SQL Injection (medium 5.6)
- [CVE-2026-22686](https://insights.sbomify.com/CVE-2026-22686/): Sandbox Escape via Host Error Prototype Chain in enclave-vm (critical 10.0)
- [CVE-2026-22685](https://insights.sbomify.com/CVE-2026-22685/): DevToys Path Traversal (“Zip Slip”) Vulnerability in DevToys Extension Installation (high 8.8)
- [CVE-2026-22683](https://insights.sbomify.com/CVE-2026-22683/): Windmill < 1.615.0 Operator Role Missing Authorization Checks RCE (high 8.7)
- [CVE-2026-22682](https://insights.sbomify.com/CVE-2026-22682/): OpenHarness Improper Access Control via File Tools (high 8.4)
- [CVE-2026-22681](https://insights.sbomify.com/CVE-2026-22681/): OpenViking < 0.3.4 SSRF via /api/v1/resources (high 8.3)
- [CVE-2026-22680](https://insights.sbomify.com/CVE-2026-22680/): OpenViking < 0.3.3 Missing Authorization via Task Polling (medium 6.9)
- [CVE-2026-2268](https://insights.sbomify.com/CVE-2026-2268/): Ninja Forms <= 3.14.0 - Unauthenticated Information Disclosure in nf_ajax_submit AJAX Action (high 7.5)
- [CVE-2026-22679](https://insights.sbomify.com/CVE-2026-22679/): Weaver E-cology 10.0 Unauthenticated RCE via dubboApi Debug Endpoint (critical 9.3)
- [CVE-2026-22678](https://insights.sbomify.com/CVE-2026-22678/): Webmin < 2.641 Stored XSS via System and Server Status (medium 5.1)
- [CVE-2026-22677](https://insights.sbomify.com/CVE-2026-22677/): Hermes WebUI < 0.51.44 Path Traversal via Session Import Endpoint (medium 6.0)
- [CVE-2026-22676](https://insights.sbomify.com/CVE-2026-22676/): Barracuda RMM < 2025.2.2 Privilege Escalation via Insecure Directory Permissions (high 8.5)
- [CVE-2026-22675](https://insights.sbomify.com/CVE-2026-22675/): OCS Inventory NG Server Stored XSS via User-Agent (medium 5.1)
- [CVE-2026-22674](https://insights.sbomify.com/CVE-2026-22674/): Hashgraph Guardian Stored XSS via branding companyName field (medium 4.8)
- [CVE-2026-22666](https://insights.sbomify.com/CVE-2026-22666/): Dolibarr ERP/CRM < 23.0.2 Authenticated RCE via dol_eval_standard() (high 8.6)
- [CVE-2026-22665](https://insights.sbomify.com/CVE-2026-22665/): prompts.chat Identity Confusion via Case-Sensitive Username Handling (high 8.6)
- [CVE-2026-22664](https://insights.sbomify.com/CVE-2026-22664/): prompts.chat SSRF via Fal.ai Media Status Polling (high 7.1)
- [CVE-2026-22663](https://insights.sbomify.com/CVE-2026-22663/): prompts.chat Authorization Bypass Information Disclosure (high 8.7)
- [CVE-2026-22662](https://insights.sbomify.com/CVE-2026-22662/): prompts.chat Blind SSRF via media-generate (medium 5.3)
- [CVE-2026-22661](https://insights.sbomify.com/CVE-2026-22661/): prompts.chat Path Traversal via Skill File Handling (high 8.6)
- [CVE-2026-22660](https://insights.sbomify.com/CVE-2026-22660/): FlaskBB Logic Flaw Authorization Group Deletion via Bulk AJAX Endpoint (high 8.6)
- [CVE-2026-2266](https://insights.sbomify.com/CVE-2026-2266/): Cross-site scripting in Enterprise Server (high 7.4)
- [CVE-2026-22659](https://insights.sbomify.com/CVE-2026-22659/): FlaskBB Authorization Bypass via Topic ID Manipulation (high 7.2)
- [CVE-2026-2265](https://insights.sbomify.com/CVE-2026-2265/): Replicator 1.0.5 is vulnerable to Remote Code Execution through Insecure Deserialization (medium 6.5)
- [CVE-2026-22646](https://insights.sbomify.com/CVE-2026-22646/): Information disclosure in Incoming Goods Suite (medium 4.3)
- [CVE-2026-22645](https://insights.sbomify.com/CVE-2026-22645/): Information disclosure in Incoming Goods Suite (medium 5.3)
- [CVE-2026-22644](https://insights.sbomify.com/CVE-2026-22644/): Information disclosure in Incoming Goods Suite (medium 5.3)
- [CVE-2026-2264](https://insights.sbomify.com/CVE-2026-2264/): Server-Side Request Forgery and Credential Exfiltration in Google Cloud Apigee via SetIntegrationRequest Policy. (critical 9.2)
- [CVE-2026-2263](https://insights.sbomify.com/CVE-2026-2263/): Missing authorization in Hustle – Email Marketing, Lead Generation, Optins, Popups (medium 5.3)
- [CVE-2026-22629](https://insights.sbomify.com/CVE-2026-22629/): Security feature bypass in FortiAnalyzer (low 3.4)
- [CVE-2026-22628](https://insights.sbomify.com/CVE-2026-22628/): Command injection in FortiSwitchAXFixed (medium 5.1)
- [CVE-2026-22627](https://insights.sbomify.com/CVE-2026-22627/): Memory corruption in FortiSwitchAXFixed (high 7.7)
- [CVE-2026-22626](https://insights.sbomify.com/CVE-2026-22626/): Other in HS-AFS-S1H1 (medium 4.9)
- [CVE-2026-22625](https://insights.sbomify.com/CVE-2026-22625/): Path traversal in HS-AFS-S1H1 (medium 4.6)
- [CVE-2026-22624](https://insights.sbomify.com/CVE-2026-22624/): Missing authorization in HS-AFS-S1H1 (medium 4.3)
- [CVE-2026-22623](https://insights.sbomify.com/CVE-2026-22623/): Command injection in HS-AFS-S1H1 (high 7.2)
- [CVE-2026-22622](https://insights.sbomify.com/CVE-2026-22622/): Command injection in PADM (high 8.8)
- [CVE-2026-22621](https://insights.sbomify.com/CVE-2026-22621/): Command injection in PADM (high 8.3)
- [CVE-2026-22620](https://insights.sbomify.com/CVE-2026-22620/): Auth bypass in PADM (high 8.6)
- [CVE-2026-2262](https://insights.sbomify.com/CVE-2026-2262/): Easy Appointments <= 3.12.21 - Unauthenticated Sensitive Information Exposure via REST API (high 7.5)
- [CVE-2026-22619](https://insights.sbomify.com/CVE-2026-22619/): Other in IPP software (high 7.8)
- [CVE-2026-22618](https://insights.sbomify.com/CVE-2026-22618/): Misconfiguration in IPP software (medium 5.9)
- [CVE-2026-22617](https://insights.sbomify.com/CVE-2026-22617/): Misconfiguration in IPP Software (medium 5.7)
- [CVE-2026-22616](https://insights.sbomify.com/CVE-2026-22616/): Auth bypass in IPP Software (medium 6.5)
- [CVE-2026-22615](https://insights.sbomify.com/CVE-2026-22615/): Command injection in IPP Software (medium 6.0)
- [CVE-2026-22614](https://insights.sbomify.com/CVE-2026-22614/): Weak cryptography in EasySoft (medium 6.1)
- [CVE-2026-22613](https://insights.sbomify.com/CVE-2026-22613/): Security feature bypass in Network M3 (medium 5.7)
- [CVE-2026-22612](https://insights.sbomify.com/CVE-2026-22612/): Fickling vulnerable to detection bypass due to "builtins" blindness (high 8.9)
- [CVE-2026-22611](https://insights.sbomify.com/CVE-2026-22611/): AWS SDK for .NET V4 adopted defense in depth enhancement for region parameter value (low 3.7)
- [CVE-2026-22610](https://insights.sbomify.com/CVE-2026-22610/): Angular has XSS Vulnerability via Unsanitized SVG Script Attributes (high 8.5)
- [CVE-2026-2261](https://insights.sbomify.com/CVE-2026-2261/): blocklistd(8) socket leak (high 7.5)
- [CVE-2026-22609](https://insights.sbomify.com/CVE-2026-22609/): Fickling has Static Analysis Bypass via Incomplete Dangerous Module Blocklist (high 8.9)
- [CVE-2026-22608](https://insights.sbomify.com/CVE-2026-22608/): Fickling vulnerable to use of ctypes and pydoc gadget chain to bypass detection (high 8.9)
- [CVE-2026-22607](https://insights.sbomify.com/CVE-2026-22607/): Fickling Blocklist Bypass: cProfile.run() (high 8.9)
- [CVE-2026-22606](https://insights.sbomify.com/CVE-2026-22606/): Fickling has a bypass via runpy.run_path() and runpy.run_module() (high 8.9)
- [CVE-2026-22605](https://insights.sbomify.com/CVE-2026-22605/): OpenProject is Vulnerable to Insecure Direct Object Reference in Meetings (medium 4.3)
- [CVE-2026-22604](https://insights.sbomify.com/CVE-2026-22604/): OpenProject is vulnerable to user enumeration via the change password function (medium 6.9)
- [CVE-2026-22603](https://insights.sbomify.com/CVE-2026-22603/): OpenProject has no protection against brute-force attacks in the Change Password function (medium 6.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/796/