# Vulnerabilities published in 2026


- [CVE-2026-21520](https://insights.sbomify.com/CVE-2026-21520/): Copilot Studio Information Disclosure Vulnerability (high 7.5)
- [CVE-2026-2152](https://insights.sbomify.com/CVE-2026-2152/): D-Link DIR-615 Web Configuration adv_routing.php os command injection (high 8.6)
- [CVE-2026-21519](https://insights.sbomify.com/CVE-2026-21519/): Microsoft Windows Type Confusion (high 7.8, exploited in the wild)
- [CVE-2026-21518](https://insights.sbomify.com/CVE-2026-21518/): GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability (high 8.8)
- [CVE-2026-21517](https://insights.sbomify.com/CVE-2026-21517/): Windows App for Mac Installer Elevation of Privilege Vulnerability (medium 4.7)
- [CVE-2026-21516](https://insights.sbomify.com/CVE-2026-21516/): GitHub Copilot for Jetbrains Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-21515](https://insights.sbomify.com/CVE-2026-21515/): Azure IoT Central Elevation of Privilege Vulnerability (critical 9.9)
- [CVE-2026-21514](https://insights.sbomify.com/CVE-2026-21514/): Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision (high 7.8, exploited in the wild)
- [CVE-2026-21513](https://insights.sbomify.com/CVE-2026-21513/): Microsoft MSHTML Framework Protection Mechanism Failure (high 8.8, exploited in the wild)
- [CVE-2026-21512](https://insights.sbomify.com/CVE-2026-21512/): Azure DevOps Server Cross-Site Scripting Vulnerability (medium 6.5)
- [CVE-2026-21511](https://insights.sbomify.com/CVE-2026-21511/): Microsoft Outlook Spoofing Vulnerability (high 7.5)
- [CVE-2026-21510](https://insights.sbomify.com/CVE-2026-21510/): Microsoft Windows Shell Protection Mechanism Failure (high 8.8, exploited in the wild)
- [CVE-2026-2151](https://insights.sbomify.com/CVE-2026-2151/): D-Link DIR-615 DMZ Host Feature adv_firewall.php os command injection (high 8.6)
- [CVE-2026-21509](https://insights.sbomify.com/CVE-2026-21509/): Microsoft Office Security Feature Bypass (high 7.8, exploited in the wild)
- [CVE-2026-21508](https://insights.sbomify.com/CVE-2026-21508/): Windows Storage Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-21507](https://insights.sbomify.com/CVE-2026-21507/): iccDEV is Vulnerable to Denial of Service via Infinite Loop in CalcProfileID() (high 7.5)
- [CVE-2026-21506](https://insights.sbomify.com/CVE-2026-21506/): iccDEV is Vulnerable to Null Pointer Dereference in CIccProfileXml::ParseBasic() Leading to Denial of Service (medium 5.5)
- [CVE-2026-21505](https://insights.sbomify.com/CVE-2026-21505/): iccDEV has Undefined Behavior (UB) - Invalid Enum Value (medium 5.5)
- [CVE-2026-21504](https://insights.sbomify.com/CVE-2026-21504/): Heap Buffer Overflow in iccDEV ToneMap Parser (medium 6.6)
- [CVE-2026-21503](https://insights.sbomify.com/CVE-2026-21503/): iccDEV has Undefined Behavior - Null Pointer Passed to memcpy() in CIccTagSparseMatrixArray (medium 6.1)
- [CVE-2026-21502](https://insights.sbomify.com/CVE-2026-21502/): NULL Pointer Dereference in iccDEV XML Tag Parser (medium 5.5)
- [CVE-2026-21501](https://insights.sbomify.com/CVE-2026-21501/): Stack Overflow in iccDEV Calculator Parser (medium 5.5)
- [CVE-2026-21500](https://insights.sbomify.com/CVE-2026-21500/): Stack Overflow in iccDEV XML Calculator Macro Expansion (medium 5.5)
- [CVE-2026-2150](https://insights.sbomify.com/CVE-2026-2150/): SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System checkin.php cross site scripting (medium 5.3)
- [CVE-2026-21499](https://insights.sbomify.com/CVE-2026-21499/): NULL Pointer Dereference in iccDEV XML Parser (medium 5.5)
- [CVE-2026-21498](https://insights.sbomify.com/CVE-2026-21498/): NULL Pointer Dereference in iccDEV XML Calculator Parser (medium 5.5)
- [CVE-2026-21497](https://insights.sbomify.com/CVE-2026-21497/): NULL Pointer Dereference in iccDEV Unknown Tag Parser (medium 5.5)
- [CVE-2026-21496](https://insights.sbomify.com/CVE-2026-21496/): NULL Pointer Dereference in iccDEV Signature Parser (medium 5.5)
- [CVE-2026-21495](https://insights.sbomify.com/CVE-2026-21495/): Division by Zero in iccDEV TIFF Image Reader (medium 5.5)
- [CVE-2026-21494](https://insights.sbomify.com/CVE-2026-21494/): iccDEV has heap buffer overflow in CIccTagLut8::Validate() (medium 6.1)
- [CVE-2026-21493](https://insights.sbomify.com/CVE-2026-21493/): iccDEV has Type Confusion during XML Curve Serialization (medium 6.6)
- [CVE-2026-21492](https://insights.sbomify.com/CVE-2026-21492/): iccDEV ToneMap Writer has NULL Pointer Member Call (medium 5.5)
- [CVE-2026-21491](https://insights.sbomify.com/CVE-2026-21491/): iccDEV has unicode buffer overflow in CIccTagTextDescription (medium 6.1)
- [CVE-2026-21490](https://insights.sbomify.com/CVE-2026-21490/): iccDEV has heap buffer overflow in CIccTagLut16::Validate() (medium 6.1)
- [CVE-2026-2149](https://insights.sbomify.com/CVE-2026-2149/): SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System appointments.php cross site scripting (medium 5.3)
- [CVE-2026-21489](https://insights.sbomify.com/CVE-2026-21489/): iccDEV has Out-of-bounds Read and Integer Underflow (Wrap or Wraparound) (medium 6.1)
- [CVE-2026-21488](https://insights.sbomify.com/CVE-2026-21488/): iccDEV has Out-of-bounds Read, Heap-based Buffer Overflow and Improper Null Termination (medium 6.1)
- [CVE-2026-21487](https://insights.sbomify.com/CVE-2026-21487/): iccDEV has Out-of-bounds Read, Use of Out-of-range Pointer Offset and Improper Input Validation (medium 6.1)
- [CVE-2026-21486](https://insights.sbomify.com/CVE-2026-21486/): Use After Free and Heap-based Buffer Overflow and Integer Overflow or Wraparound and Out-of-bounds Write in iccDEV (high 7.8)
- [CVE-2026-21485](https://insights.sbomify.com/CVE-2026-21485/): iccDEV Undefined Behavior (UB) and Out of Memory in CIccProfile::LoadTag() (high 8.8)
- [CVE-2026-21484](https://insights.sbomify.com/CVE-2026-21484/): AnythingLLM Vulnerable to Username Enumeration w/ Password Recovery (medium 5.3)
- [CVE-2026-21483](https://insights.sbomify.com/CVE-2026-21483/): listmonk Vulnerable to Stored XSS Leading to Admin Account Takeover (medium 5.4)
- [CVE-2026-2148](https://insights.sbomify.com/CVE-2026-2148/): Tenda AC21 Web Management DownloadFlash information disclosure (medium 6.9)
- [CVE-2026-2147](https://insights.sbomify.com/CVE-2026-2147/): Tenda AC21 Web Management DownloadLog information disclosure (medium 6.9)
- [CVE-2026-2146](https://insights.sbomify.com/CVE-2026-2146/): guchengwuyue yshopmall co.yixiang.utils.FileUtil updateAvatar unrestricted upload (medium 5.3)
- [CVE-2026-21452](https://insights.sbomify.com/CVE-2026-21452/): MessagePack for Java Vulnerable to Remote DoS via Malicious EXT Payload Allocation (high 7.5)
- [CVE-2026-21451](https://insights.sbomify.com/CVE-2026-21451/): Bagisto has HTML Filter Bypass that Enables Stored XSS (medium 5.2)
- [CVE-2026-21450](https://insights.sbomify.com/CVE-2026-21450/): Bagisto has SSTI in parameter that can lead to RCE (high 7.3)
- [CVE-2026-2145](https://insights.sbomify.com/CVE-2026-2145/): cym1102 nginxWebUI Web Management check cross site scripting (medium 5.1)
- [CVE-2026-21449](https://insights.sbomify.com/CVE-2026-21449/): Bagisto has SSTI via first and last name from low-privilege user (not admin) (high 7.4)
- [CVE-2026-21448](https://insights.sbomify.com/CVE-2026-21448/): Bagisto has Normal & Blind SSTI from low-privilege user when ordering product (high 8.9)
- [CVE-2026-21447](https://insights.sbomify.com/CVE-2026-21447/): Bagisto has IDOR in Customer Order Reorder Functionality (high 7.1)
- [CVE-2026-21446](https://insights.sbomify.com/CVE-2026-21446/): Bagisto Missing Authentication on Installer API Endpoints (high 8.8)
- [CVE-2026-21445](https://insights.sbomify.com/CVE-2026-21445/): Langflow Missing Authentication on Critical API Endpoints (high 8.8)
- [CVE-2026-21444](https://insights.sbomify.com/CVE-2026-21444/): libtpms returns wrong initialization vector when certain symmetric ciphers are used (medium 5.5)
- [CVE-2026-21443](https://insights.sbomify.com/CVE-2026-21443/): OpenEMR allows inconsistent escaping of translation function output (low 1.2)
- [CVE-2026-21441](https://insights.sbomify.com/CVE-2026-21441/): urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) (high 8.9)
- [CVE-2026-21440](https://insights.sbomify.com/CVE-2026-21440/): AdonisJS Path Traversal in Multipart File Handling (critical 9.2)
- [CVE-2026-2144](https://insights.sbomify.com/CVE-2026-2144/): Magic Login Mail or QR Code <= 2.05 - Unauthenticated Privilege Escalation via Insecure QR Code File Storage (high 8.1)
- [CVE-2026-21439](https://insights.sbomify.com/CVE-2026-21439/): badkeys vulnerable to ASCII control character injection on console via malformed input (low 2.0)
- [CVE-2026-21438](https://insights.sbomify.com/CVE-2026-21438/): webtransport-go affected by a Memory Exhaustion Attack due to Missing Cleanup of Streams Map (medium 5.3)
- [CVE-2026-21437](https://insights.sbomify.com/CVE-2026-21437/): eopkg vulnerable to package file list integrity bypass (low 2.0)
- [CVE-2026-21436](https://insights.sbomify.com/CVE-2026-21436/): eopkg has Path Traversal: '../filedir' vulnerability (medium 5.8)
- [CVE-2026-21435](https://insights.sbomify.com/CVE-2026-21435/): webtransport-go CloseWithError can block indefinitely (medium 5.3)
- [CVE-2026-21434](https://insights.sbomify.com/CVE-2026-21434/): webtransport-go affected by Memory Exhaustion Attack due to Missing Length Check in WT_CLOSE_SESSION Capsule (medium 5.3)
- [CVE-2026-21433](https://insights.sbomify.com/CVE-2026-21433/): Emlog vulnerable to Server-Side Request Forgery (SSRF) (high 7.7)
- [CVE-2026-21432](https://insights.sbomify.com/CVE-2026-21432/): Emlog has stored Cross-site Scripting issue that can lead to admin or another account ATO (medium 6.8)
- [CVE-2026-21431](https://insights.sbomify.com/CVE-2026-21431/): Emlog vulnerable to stored Cross-site Scripting via image name (low 2.0)
- [CVE-2026-21430](https://insights.sbomify.com/CVE-2026-21430/): Emlog: CSRF chained with stored XSS leads to ATO (high 7.0)
- [CVE-2026-2143](https://insights.sbomify.com/CVE-2026-2143/): D-Link DIR-823X DDNS Service set_ddns os command injection (high 8.6)
- [CVE-2026-21429](https://insights.sbomify.com/CVE-2026-21429/): Emlog has Broken Access Control (BAC) (low 2.0)
- [CVE-2026-21428](https://insights.sbomify.com/CVE-2026-21428/): cpp-httplib has CRLF injection in http headers (high 7.7)
- [CVE-2026-21427](https://insights.sbomify.com/CVE-2026-21427/): Other in Stellanova APS-S301 series (high 8.5)
- [CVE-2026-21426](https://insights.sbomify.com/CVE-2026-21426/): Privilege escalation in PowerScale OneFS (medium 6.7)
- [CVE-2026-21425](https://insights.sbomify.com/CVE-2026-21425/): Privilege escalation in PowerScale OneFS (medium 6.7)
- [CVE-2026-21424](https://insights.sbomify.com/CVE-2026-21424/): Privilege escalation in PowerScale OneFS (medium 6.7)
- [CVE-2026-21423](https://insights.sbomify.com/CVE-2026-21423/): Misconfiguration in PowerScale OneFS (medium 6.7)
- [CVE-2026-21422](https://insights.sbomify.com/CVE-2026-21422/): Security feature bypass in PowerScale OneFS (low 3.4)
- [CVE-2026-21421](https://insights.sbomify.com/CVE-2026-21421/): Privilege escalation in PowerScale OneFS (medium 6.7)
- [CVE-2026-21420](https://insights.sbomify.com/CVE-2026-21420/): Privilege escalation in Repository Manager (high 7.3)
- [CVE-2026-2142](https://insights.sbomify.com/CVE-2026-2142/): D-Link DIR-823X set_qos sub_420688 os command injection (high 8.6)
- [CVE-2026-21419](https://insights.sbomify.com/CVE-2026-21419/): Privilege escalation in Display and Peripheral Manager (Windows) (medium 6.6)
- [CVE-2026-21418](https://insights.sbomify.com/CVE-2026-21418/): Command injection in Unity (high 7.8)
- [CVE-2026-21417](https://insights.sbomify.com/CVE-2026-21417/): Information disclosure in CloudBoost Virtual Appliance (high 7.0)
- [CVE-2026-21413](https://insights.sbomify.com/CVE-2026-21413/): Memory corruption in LibRaw (critical 9.8)
- [CVE-2026-21411](https://insights.sbomify.com/CVE-2026-21411/): Auth bypass in OpenBlocks IDM RX1 (FW5.0.x) (high 8.7)
- [CVE-2026-21410](https://insights.sbomify.com/CVE-2026-21410/): InSAT MasterSCADA BUK-TS SQL Injection (critical 9.3)
- [CVE-2026-2141](https://insights.sbomify.com/CVE-2026-2141/): WuKongOpenSource WukongCRM URL PermissionServiceImpl.java improper authorization (medium 5.3)
- [CVE-2026-21409](https://insights.sbomify.com/CVE-2026-21409/): Missing authorization in RICOH Streamline NX (high 8.2)
- [CVE-2026-21408](https://insights.sbomify.com/CVE-2026-21408/): Privilege escalation in beat-access for Windows (medium 5.4)
- [CVE-2026-21404](https://insights.sbomify.com/CVE-2026-21404/): NAVTOR NavBox Use of Hard-coded Credentials (medium 5.8)
- [CVE-2026-21400](https://insights.sbomify.com/CVE-2026-21400/): Security feature bypass in Intel(R) AI Reference Models (medium 5.4)
- [CVE-2026-2140](https://insights.sbomify.com/CVE-2026-2140/): Tenda TX9 setMacFilterCfg sub_4223E0 buffer overflow (high 8.7)
- [CVE-2026-21399](https://insights.sbomify.com/CVE-2026-21399/): Memory corruption in Intel(R) Open Volume Kernel Library (Intel(R) Open VKL) library maintained by intel(R) (medium 6.9)
- [CVE-2026-21393](https://insights.sbomify.com/CVE-2026-21393/): Cross-site scripting in Movable Type (Cloud Edition) (medium 4.8)
- [CVE-2026-21391](https://insights.sbomify.com/CVE-2026-21391/): Improper Claim Validation in PingAM OIDC Provider (critical 9.5)
- [CVE-2026-2139](https://insights.sbomify.com/CVE-2026-2139/): Tenda TX9 fast_setting_wifi_set sub_432580 buffer overflow (high 8.7)
- [CVE-2026-21389](https://insights.sbomify.com/CVE-2026-21389/): Copeland XWEB and XWEB Pro OS Command Injection (high 8.0)
- [CVE-2026-21388](https://insights.sbomify.com/CVE-2026-21388/): Unbounded Request Body Read in MS Teams Plugin {{/lifecycle}} Webhook Endpoint (low 3.7)
- [CVE-2026-21387](https://insights.sbomify.com/CVE-2026-21387/): Security feature bypass in Intel(R) LLM Library for PyTorch (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/806/