# Vulnerabilities published in 2026


- [CVE-2026-20731](https://insights.sbomify.com/CVE-2026-20731/): Memory corruption in Intel(R) NPU Driver (medium 6.9)
- [CVE-2026-20730](https://insights.sbomify.com/CVE-2026-20730/): BIG-IP Edge Client for Windows vulnerability (low 2.0)
- [CVE-2026-2073](https://insights.sbomify.com/CVE-2026-2073/): itsourcecode School Management System index.php sql injection (medium 6.9)
- [CVE-2026-20728](https://insights.sbomify.com/CVE-2026-20728/): Security feature bypass in Intel Extension for TensorFlow software (medium 5.4)
- [CVE-2026-20727](https://insights.sbomify.com/CVE-2026-20727/): Null dereference in Intel(R) PROSet/Wireless WiFi Software for Windows (high 8.3)
- [CVE-2026-20726](https://insights.sbomify.com/CVE-2026-20726/): Memory corruption in Affinity (medium 6.1)
- [CVE-2026-2072](https://insights.sbomify.com/CVE-2026-2072/): Cross-Site Scripting vulnerability in Hitachi Infrastructure Analytics Advisor and Hitachi Ops Center Analyzer (high 8.2)
- [CVE-2026-20719](https://insights.sbomify.com/CVE-2026-20719/): DoS via URL Previews Rendering Malicious SVGs (medium 4.3)
- [CVE-2026-20718](https://insights.sbomify.com/CVE-2026-20718/): Misconfiguration in Intel(R) NPU Driver software installers (medium 5.4)
- [CVE-2026-20717](https://insights.sbomify.com/CVE-2026-20717/): Denial of service in Intel(R) QAT software drivers for Windows (medium 6.9)
- [CVE-2026-20716](https://insights.sbomify.com/CVE-2026-20716/): Privilege escalation in Intel(R) Processors (high 7.2)
- [CVE-2026-20715](https://insights.sbomify.com/CVE-2026-20715/): Denial of service in Intel(R) Active Management Technology (Intel(R) AMT) and some Intel(R) Standard Manageability may allow a denial of service. Network adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via network access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. (high 8.2)
- [CVE-2026-20714](https://insights.sbomify.com/CVE-2026-20714/): Memory corruption in Intel(R) QAT software drivers for Windows (high 8.5)
- [CVE-2026-20713](https://insights.sbomify.com/CVE-2026-20713/): Privilege escalation in Intel(R) Xeon(R) processors may allow an escalation of privilege. System software adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (none) impacts. (medium 4.5)
- [CVE-2026-20712](https://insights.sbomify.com/CVE-2026-20712/): Information disclosure in Intel(R) reference platforms (medium 4.0)
- [CVE-2026-20711](https://insights.sbomify.com/CVE-2026-20711/): Cross-site scripting in Cybozu Garoon (medium 6.9)
- [CVE-2026-2071](https://insights.sbomify.com/CVE-2026-2071/): UTT 进取 520W formP2PLimitConfig strcpy buffer overflow (high 8.7)
- [CVE-2026-20709](https://insights.sbomify.com/CVE-2026-20709/): Hardcoded credentials in Intel(R) Pentium(R) Processor Silver Series, Intel(R) Celeron(R) Processor J Series, Intel(R) Celeron(R) Processor N Series may allow an escalation of privilege. Hardware reverse engineer adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via physical access when attack requirements are present with special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (none) impacts. (medium 5.8)
- [CVE-2026-20708](https://insights.sbomify.com/CVE-2026-20708/): Information disclosure in Intel(R) AMT and Intel(R) Standard Manageability may allow an information disclosure. Network adversary with a privileged user combined with a high complexity attack may enable data exposure. This result may potentially occur via network access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. (medium 5.9)
- [CVE-2026-20707](https://insights.sbomify.com/CVE-2026-20707/): Race condition in 3rd Gen Intel(R) Xeon(R) Scalable Processors (medium 6.8)
- [CVE-2026-20706](https://insights.sbomify.com/CVE-2026-20706/): Gitea repository archive downloads bypass token scope checks (critical 9.1)
- [CVE-2026-20705](https://insights.sbomify.com/CVE-2026-20705/): Information disclosure in Intel(R) platform (medium 6.8)
- [CVE-2026-20704](https://insights.sbomify.com/CVE-2026-20704/): Cross-site request forgery in WRC-X1500GS-B (medium 5.1)
- [CVE-2026-20702](https://insights.sbomify.com/CVE-2026-20702/): Security feature bypass in Intel(R) Data Center Attestation Primitives (Intel(R) DCAP) may allow information disclosure. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable data exposure. This result may potentially occur via network access when attack requirements are present with special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (high) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (none) and availability (none) impacts. (high 8.9)
- [CVE-2026-20701](https://insights.sbomify.com/CVE-2026-20701/): Security feature bypass in macOS (high 7.5)
- [CVE-2026-20700](https://insights.sbomify.com/CVE-2026-20700/): Apple Multiple Buffer Overflow (high 7.8, exploited in the wild)
- [CVE-2026-2070](https://insights.sbomify.com/CVE-2026-2070/): UTT 进取 520W formPolicyRouteConf strcpy buffer overflow (high 8.7)
- [CVE-2026-20699](https://insights.sbomify.com/CVE-2026-20699/): Security feature bypass in macOS (medium 6.2)
- [CVE-2026-20698](https://insights.sbomify.com/CVE-2026-20698/): Memory corruption in iOS and iPadOS (medium 5.5)
- [CVE-2026-20697](https://insights.sbomify.com/CVE-2026-20697/): Missing authorization in macOS (medium 5.3)
- [CVE-2026-20696](https://insights.sbomify.com/CVE-2026-20696/): Missing authorization in macOS (medium 5.5)
- [CVE-2026-20695](https://insights.sbomify.com/CVE-2026-20695/): Information disclosure in macOS (medium 6.2)
- [CVE-2026-20694](https://insights.sbomify.com/CVE-2026-20694/): Path traversal in iOS and iPadOS (medium 5.5)
- [CVE-2026-20693](https://insights.sbomify.com/CVE-2026-20693/): Misconfiguration in macOS (medium 4.9)
- [CVE-2026-20692](https://insights.sbomify.com/CVE-2026-20692/): Security feature bypass in iOS and iPadOS (medium 5.3)
- [CVE-2026-20691](https://insights.sbomify.com/CVE-2026-20691/): Information disclosure in Safari (medium 4.3)
- [CVE-2026-20690](https://insights.sbomify.com/CVE-2026-20690/): Memory corruption in iOS and iPadOS (medium 6.5)
- [CVE-2026-2069](https://insights.sbomify.com/CVE-2026-2069/): ggml-org llama.cpp GBNF Grammar llama-grammar.cpp llama_grammar_advance_stack stack-based overflow (medium 4.8)
- [CVE-2026-20688](https://insights.sbomify.com/CVE-2026-20688/): Path traversal in iOS and iPadOS (critical 9.3)
- [CVE-2026-20687](https://insights.sbomify.com/CVE-2026-20687/): Use after free in iOS and iPadOS (high 7.1)
- [CVE-2026-20686](https://insights.sbomify.com/CVE-2026-20686/): Information disclosure in iOS and iPadOS (medium 5.3)
- [CVE-2026-20685](https://insights.sbomify.com/CVE-2026-20685/): Path traversal in Private Cloud Compute Server Software (medium 6.5)
- [CVE-2026-20684](https://insights.sbomify.com/CVE-2026-20684/): Security feature bypass in macOS (low 3.3)
- [CVE-2026-20683](https://insights.sbomify.com/CVE-2026-20683/): Auth bypass in iOS and iPadOS (high 7.1)
- [CVE-2026-20682](https://insights.sbomify.com/CVE-2026-20682/): Information disclosure in iOS and iPadOS (medium 5.3)
- [CVE-2026-20681](https://insights.sbomify.com/CVE-2026-20681/): Information disclosure in macOS (low 3.3)
- [CVE-2026-20680](https://insights.sbomify.com/CVE-2026-20680/): Information disclosure in iOS and iPadOS (medium 5.5)
- [CVE-2026-2068](https://insights.sbomify.com/CVE-2026-2068/): UTT 进取 520W formSyslogConf strcpy buffer overflow (high 8.7)
- [CVE-2026-20679](https://insights.sbomify.com/CVE-2026-20679/): Use after free in macOS (medium 4.3)
- [CVE-2026-20678](https://insights.sbomify.com/CVE-2026-20678/): Missing authorization in iOS and iPadOS (medium 5.5)
- [CVE-2026-20677](https://insights.sbomify.com/CVE-2026-20677/): Race condition in iOS and iPadOS (critical 9.0)
- [CVE-2026-20676](https://insights.sbomify.com/CVE-2026-20676/): Information disclosure in Safari (medium 4.3)
- [CVE-2026-20675](https://insights.sbomify.com/CVE-2026-20675/): Memory corruption in iOS and iPadOS (high 7.8)
- [CVE-2026-20674](https://insights.sbomify.com/CVE-2026-20674/): Information disclosure in iOS and iPadOS (medium 4.6)
- [CVE-2026-20673](https://insights.sbomify.com/CVE-2026-20673/): Security feature bypass in iOS and iPadOS (medium 5.3)
- [CVE-2026-20672](https://insights.sbomify.com/CVE-2026-20672/): Information disclosure in macOS (medium 5.5)
- [CVE-2026-20671](https://insights.sbomify.com/CVE-2026-20671/): Other in iOS and iPadOS (low 3.1)
- [CVE-2026-20670](https://insights.sbomify.com/CVE-2026-20670/): Missing authorization in macOS (medium 5.5)
- [CVE-2026-2067](https://insights.sbomify.com/CVE-2026-2067/): UTT 进取 520W formTimeGroupConfig strcpy buffer overflow (high 8.7)
- [CVE-2026-20669](https://insights.sbomify.com/CVE-2026-20669/): Path traversal in macOS (medium 5.5)
- [CVE-2026-20668](https://insights.sbomify.com/CVE-2026-20668/): Information disclosure in iOS and iPadOS (medium 5.5)
- [CVE-2026-20667](https://insights.sbomify.com/CVE-2026-20667/): Security feature bypass in iOS and iPadOS (high 8.8)
- [CVE-2026-20666](https://insights.sbomify.com/CVE-2026-20666/): Missing authorization in macOS (medium 5.5)
- [CVE-2026-20665](https://insights.sbomify.com/CVE-2026-20665/): Security feature bypass in Safari (medium 6.5)
- [CVE-2026-20664](https://insights.sbomify.com/CVE-2026-20664/): Memory corruption in Safari (medium 4.3)
- [CVE-2026-20663](https://insights.sbomify.com/CVE-2026-20663/): Information disclosure in iOS and iPadOS (low 3.3)
- [CVE-2026-20662](https://insights.sbomify.com/CVE-2026-20662/): Information disclosure in macOS (medium 4.6)
- [CVE-2026-20661](https://insights.sbomify.com/CVE-2026-20661/): Missing authorization in iOS and iPadOS (medium 4.6)
- [CVE-2026-20660](https://insights.sbomify.com/CVE-2026-20660/): Path traversal in Safari (medium 5.5)
- [CVE-2026-2066](https://insights.sbomify.com/CVE-2026-2066/): UTT 进取 520W formIpGroupConfig strcpy buffer overflow (high 8.7)
- [CVE-2026-20658](https://insights.sbomify.com/CVE-2026-20658/): Privilege escalation in macOS (high 7.8)
- [CVE-2026-20657](https://insights.sbomify.com/CVE-2026-20657/): Memory corruption in iOS and iPadOS (medium 6.5)
- [CVE-2026-20656](https://insights.sbomify.com/CVE-2026-20656/): Business logic in Safari (low 3.3)
- [CVE-2026-20655](https://insights.sbomify.com/CVE-2026-20655/): Auth bypass in iOS and iPadOS (medium 5.5)
- [CVE-2026-20654](https://insights.sbomify.com/CVE-2026-20654/): Memory corruption in iOS and iPadOS (medium 5.5)
- [CVE-2026-20653](https://insights.sbomify.com/CVE-2026-20653/): Path traversal in iOS and iPadOS (medium 5.5)
- [CVE-2026-20652](https://insights.sbomify.com/CVE-2026-20652/): Memory corruption in Safari (high 7.5)
- [CVE-2026-20651](https://insights.sbomify.com/CVE-2026-20651/): Information disclosure in macOS (medium 6.2)
- [CVE-2026-20650](https://insights.sbomify.com/CVE-2026-20650/): Denial of service in iOS and iPadOS (high 7.5)
- [CVE-2026-2065](https://insights.sbomify.com/CVE-2026-2065/): Flycatcher Toys smART Pixelator Bluetooth Low Energy missing authentication (medium 5.3)
- [CVE-2026-20649](https://insights.sbomify.com/CVE-2026-20649/): Information disclosure in iOS and iPadOS (medium 5.5)
- [CVE-2026-20648](https://insights.sbomify.com/CVE-2026-20648/): Information disclosure in macOS (medium 5.5)
- [CVE-2026-20647](https://insights.sbomify.com/CVE-2026-20647/): Information disclosure in macOS (medium 5.5)
- [CVE-2026-20646](https://insights.sbomify.com/CVE-2026-20646/): Information disclosure in macOS (low 3.3)
- [CVE-2026-20645](https://insights.sbomify.com/CVE-2026-20645/): Security feature bypass in iOS and iPadOS (medium 4.6)
- [CVE-2026-20644](https://insights.sbomify.com/CVE-2026-20644/): Memory corruption in Safari (medium 6.5)
- [CVE-2026-20643](https://insights.sbomify.com/CVE-2026-20643/): Security feature bypass in Safari (medium 5.4)
- [CVE-2026-20642](https://insights.sbomify.com/CVE-2026-20642/): Security feature bypass in iOS and iPadOS (low 2.4)
- [CVE-2026-20641](https://insights.sbomify.com/CVE-2026-20641/): Information disclosure in iOS and iPadOS (high 7.1)
- [CVE-2026-20640](https://insights.sbomify.com/CVE-2026-20640/): Information disclosure in iOS and iPadOS (medium 4.6)
- [CVE-2026-2064](https://insights.sbomify.com/CVE-2026-2064/): Portabilis i-Educar User Data meusdadod.php cross site scripting (medium 5.1)
- [CVE-2026-20639](https://insights.sbomify.com/CVE-2026-20639/): Integer overflow in macOS (high 7.5)
- [CVE-2026-20638](https://insights.sbomify.com/CVE-2026-20638/): Business logic in iOS and iPadOS (medium 5.5)
- [CVE-2026-20637](https://insights.sbomify.com/CVE-2026-20637/): Use after free in iOS and iPadOS (medium 6.2)
- [CVE-2026-20636](https://insights.sbomify.com/CVE-2026-20636/): Memory corruption in Safari (medium 6.5)
- [CVE-2026-20635](https://insights.sbomify.com/CVE-2026-20635/): Memory corruption in Safari (medium 4.3)
- [CVE-2026-20634](https://insights.sbomify.com/CVE-2026-20634/): Information disclosure in iOS and iPadOS (medium 5.5)
- [CVE-2026-20633](https://insights.sbomify.com/CVE-2026-20633/): Path traversal in macOS (medium 5.5)
- [CVE-2026-20632](https://insights.sbomify.com/CVE-2026-20632/): Path traversal in macOS (medium 5.3)
- [CVE-2026-20631](https://insights.sbomify.com/CVE-2026-20631/): Privilege escalation in macOS (high 8.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/813/