# Vulnerabilities published in 2026


- [OSV-2026-166](https://insights.sbomify.com/OSV-2026-166/): Use-of-uninitialized-value in ntrip_parse_url (not scored)
- [OSV-2026-156](https://insights.sbomify.com/OSV-2026-156/): Segv on unknown address in aivdm_analyze (not scored)
- [OSV-2026-150](https://insights.sbomify.com/OSV-2026-150/): Null-dereference READ in wasm_runtime_invoke_native (not scored)
- [OSV-2026-144](https://insights.sbomify.com/OSV-2026-144/): Use-of-uninitialized-value in initFilter (not scored)
- [OSV-2026-1437](https://insights.sbomify.com/OSV-2026-1437/): Use-of-uninitialized-value in processHandshakeTLSBlock (not scored)
- [OSV-2026-1429](https://insights.sbomify.com/OSV-2026-1429/): Use-of-uninitialized-value in nlohmann::json_abi_v3_12_0::detail::binary_reader<nlohmann::json_abi_v3_12_0::ba (not scored)
- [OSV-2026-141](https://insights.sbomify.com/OSV-2026-141/): Segv on unknown address in yuv2rgb4_X_c (not scored)
- [OSV-2026-1408](https://insights.sbomify.com/OSV-2026-1408/): UNKNOWN READ in hobbes::castexp::apply (not scored)
- [OSV-2026-1381](https://insights.sbomify.com/OSV-2026-1381/): Use-of-uninitialized-value in processHandshakeTLSBlock (not scored)
- [OSV-2026-1361](https://insights.sbomify.com/OSV-2026-1361/): OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=568595812 ``` Crash type: Bad parameters to --sanitizer-annotate-cont (not scored)
- [OSV-2026-136](https://insights.sbomify.com/OSV-2026-136/): Memcpy-param-overlap in grk::memStreamRead (not scored)
- [OSV-2026-1356](https://insights.sbomify.com/OSV-2026-1356/): Use-of-uninitialized-value in jxl::RenderPipeline::InputReady (not scored)
- [OSV-2026-1345](https://insights.sbomify.com/OSV-2026-1345/): Heap-buffer-overflow in load_u64 (not scored)
- [OSV-2026-1332](https://insights.sbomify.com/OSV-2026-1332/): Heap-buffer-overflow in screen_resize_cursor (not scored)
- [OSV-2026-1314](https://insights.sbomify.com/OSV-2026-1314/): Heap-buffer-overflow in vacm_getAccessEntry (not scored)
- [OSV-2026-1309](https://insights.sbomify.com/OSV-2026-1309/): Heap-buffer-overflow in janet_bytecode_movopt_basic_block (not scored)
- [OSV-2026-1303](https://insights.sbomify.com/OSV-2026-1303/): Heap-buffer-overflow in sas7bdat_parse_all_pages_pass2 (not scored)
- [OSV-2026-1302](https://insights.sbomify.com/OSV-2026-1302/): Heap-use-after-free in unregister_sysORTable_by_session (not scored)
- [OSV-2026-1297](https://insights.sbomify.com/OSV-2026-1297/): UNKNOWN READ in janet_to_string_b (not scored)
- [OSV-2026-1294](https://insights.sbomify.com/OSV-2026-1294/): UNKNOWN WRITE in av1_cdef_mse_calc_frame_mt (not scored)
- [OSV-2026-1293](https://insights.sbomify.com/OSV-2026-1293/): UNKNOWN READ in md_is_link_title (not scored)
- [OSV-2026-1287](https://insights.sbomify.com/OSV-2026-1287/): Heap-buffer-overflow in pcpp::SSLServerNameIndicationExtension::getHostName (not scored)
- [OSV-2026-1281](https://insights.sbomify.com/OSV-2026-1281/): Heap-buffer-overflow in md_decode_utf8__ (not scored)
- [OSV-2026-1279](https://insights.sbomify.com/OSV-2026-1279/): Heap-buffer-overflow in H5T__bit_find (not scored)
- [OSV-2026-1274](https://insights.sbomify.com/OSV-2026-1274/): Heap-buffer-overflow in md_analyze_inlines (not scored)
- [OSV-2026-1267](https://insights.sbomify.com/OSV-2026-1267/): Security exception in com.code_intelligence.jazzer.sanitizers.RegexInjection.hookInternal (not scored)
- [OSV-2026-1239](https://insights.sbomify.com/OSV-2026-1239/): Security exception in org.apache.lucene.util.ArrayUtil.copyOfSubArray (not scored)
- [OSV-2026-1235](https://insights.sbomify.com/OSV-2026-1235/): UNKNOWN READ in renumber_by_map (not scored)
- [OSV-2026-1224](https://insights.sbomify.com/OSV-2026-1224/): Heap-buffer-overflow in mp_load_float (not scored)
- [OSV-2026-1220](https://insights.sbomify.com/OSV-2026-1220/): Use-of-uninitialized-value in str_escape (not scored)
- [OSV-2026-122](https://insights.sbomify.com/OSV-2026-122/): Use-of-uninitialized-value in rtcm2_unpack (not scored)
- [OSV-2026-1210](https://insights.sbomify.com/OSV-2026-1210/): Heap-buffer-overflow in decode_get_histogram_format_resp (not scored)
- [OSV-2026-121](https://insights.sbomify.com/OSV-2026-121/): Use-of-uninitialized-value in trySubset (not scored)
- [OSV-2026-1205](https://insights.sbomify.com/OSV-2026-1205/): Heap-buffer-overflow in decode_get_fpga_diagnostics_settings_resp (not scored)
- [OSV-2026-1198](https://insights.sbomify.com/OSV-2026-1198/): Stack-buffer-overflow in msLayoutTextSymbol (not scored)
- [OSV-2026-1196](https://insights.sbomify.com/OSV-2026-1196/): Heap-buffer-overflow in yylex (not scored)
- [OSV-2026-1195](https://insights.sbomify.com/OSV-2026-1195/): Heap-buffer-overflow in lua_error (not scored)
- [OSV-2026-119](https://insights.sbomify.com/OSV-2026-119/): Segv on unknown address in gpsd_poll (not scored)
- [OSV-2026-1189](https://insights.sbomify.com/OSV-2026-1189/): Global-buffer-overflow in oidc_cfg_redirect_urls_allowed_get (not scored)
- [OSV-2026-1161](https://insights.sbomify.com/OSV-2026-1161/): Heap-buffer-overflow in ppp_tx_frame (not scored)
- [OSV-2026-1157](https://insights.sbomify.com/OSV-2026-1157/): Memcpy-param-overlap in zxc_decompress_chunk_wrapper_default (not scored)
- [OSV-2026-1127](https://insights.sbomify.com/OSV-2026-1127/): Heap-buffer-overflow in read_data (not scored)
- [OSV-2026-1126](https://insights.sbomify.com/OSV-2026-1126/): Heap-buffer-overflow in isvcd_nal_byte_swap_emulation (not scored)
- [OSV-2026-1125](https://insights.sbomify.com/OSV-2026-1125/): Segv on unknown address in match_many_CHARACTER_REV (not scored)
- [OSV-2026-112](https://insights.sbomify.com/OSV-2026-112/): Use-of-uninitialized-value in PrintSERPacket (not scored)
- [OSV-2026-1110](https://insights.sbomify.com/OSV-2026-1110/): Check failed in CheckUnwind (not scored)
- [OSV-2026-1109](https://insights.sbomify.com/OSV-2026-1109/): UNKNOWN READ in sens_to_cil (not scored)
- [OSV-2026-1101](https://insights.sbomify.com/OSV-2026-1101/): Security exception in com.google.re2j.Machine$Queue.<init> (not scored)
- [OSV-2026-1095](https://insights.sbomify.com/OSV-2026-1095/): Heap-buffer-overflow in grk::t1::CodeblockDecompressImpl::parsePacketData (not scored)
- [OSV-2026-1092](https://insights.sbomify.com/OSV-2026-1092/): Security exception in com.github.javaparser.ast.expr.Name.accept (not scored)
- [OSV-2026-1089](https://insights.sbomify.com/OSV-2026-1089/): Security exception in com.code_intelligence.jazzer.sanitizers.RegexInjection.hookInternal (not scored)
- [OSV-2026-1084](https://insights.sbomify.com/OSV-2026-1084/): UNKNOWN READ in bytes1_char_at (not scored)
- [OSV-2026-1083](https://insights.sbomify.com/OSV-2026-1083/): Heap-buffer-overflow in parseGoosePayload (not scored)
- [OSV-2026-1077](https://insights.sbomify.com/OSV-2026-1077/): Heap-buffer-overflow in std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<ch (not scored)
- [OSV-2026-1072](https://insights.sbomify.com/OSV-2026-1072/): UNKNOWN READ in _regex.cpython-311-x86_64-linux-gnu.so (not scored)
- [OSV-2026-1071](https://insights.sbomify.com/OSV-2026-1071/): Security exception in com.github.javaparser.ast.expr.FieldAccessExpr.accept (not scored)
- [OSV-2026-1070](https://insights.sbomify.com/OSV-2026-1070/): UNKNOWN READ in bytes1_char_at (not scored)
- [OSV-2026-1069](https://insights.sbomify.com/OSV-2026-1069/): Segv on unknown address in glslang::TPpContext::tokenPaste (not scored)
- [OSV-2026-1068](https://insights.sbomify.com/OSV-2026-1068/): UNKNOWN READ in jpeg_abort (not scored)
- [OSV-2026-1064](https://insights.sbomify.com/OSV-2026-1064/): Heap-buffer-overflow in _wcsnlen (not scored)
- [OSV-2026-1054](https://insights.sbomify.com/OSV-2026-1054/): Heap-buffer-overflow in ihevcd_cabac_decode_bins_tunary (not scored)
- [OSV-2026-1052](https://insights.sbomify.com/OSV-2026-1052/): UNKNOWN READ in eprosima::fastdds::dds::QosPoliciesSerializer<eprosima::fastdds::dds::PartitionQ (not scored)
- [OSV-2026-105](https://insights.sbomify.com/OSV-2026-105/): Use-of-uninitialized-value in pcpp::SSLServerHelloMessage::ServerHelloTLSFingerprint::toString (not scored)
- [OSV-2026-1049](https://insights.sbomify.com/OSV-2026-1049/): Heap-buffer-overflow in Assimp::X3DExporter::CheckAndExport_Light (not scored)
- [OSV-2026-1043](https://insights.sbomify.com/OSV-2026-1043/): Index-out-of-bounds in impd_drc_gen_instructions_derived_data (not scored)
- [OSV-2026-1041](https://insights.sbomify.com/OSV-2026-1041/): Heap-buffer-overflow in Assimp::ObjExporter::indexMap<Assimp::ObjExporter::vertexData, Assimp::ObjExport (not scored)
- [OSV-2026-1039](https://insights.sbomify.com/OSV-2026-1039/): Index-out-of-bounds in iusace_estimate_scfs_chan (not scored)
- [OSV-2026-1035](https://insights.sbomify.com/OSV-2026-1035/): Heap-buffer-overflow in Assimp::D3MF::D3MFExporter::writeFaces (not scored)
- [OSV-2026-1033](https://insights.sbomify.com/OSV-2026-1033/): Heap-buffer-overflow in ppp_tx_frame (not scored)
- [OSV-2026-1032](https://insights.sbomify.com/OSV-2026-1032/): Use-of-uninitialized-value in Assimp::PbrtExporter::WriteTextures (not scored)
- [OSV-2026-1030](https://insights.sbomify.com/OSV-2026-1030/): Use-of-uninitialized-value in Assimp::glTFExporter::GetTexSampler (not scored)
- [OSV-2026-1027](https://insights.sbomify.com/OSV-2026-1027/): Heap-buffer-overflow in mp_load_float (not scored)
- [OSV-2026-1026](https://insights.sbomify.com/OSV-2026-1026/): Global-buffer-overflow in txt2sd (not scored)
- [OSV-2026-1025](https://insights.sbomify.com/OSV-2026-1025/): Heap-buffer-overflow in decode_common_resp (not scored)
- [OSV-2026-1022](https://insights.sbomify.com/OSV-2026-1022/): Heap-buffer-overflow in decode_common_resp (not scored)
- [OSV-2026-1018](https://insights.sbomify.com/OSV-2026-1018/): Heap-buffer-overflow in decode_reason_code_and_cc (not scored)
- [OSV-2026-1016](https://insights.sbomify.com/OSV-2026-1016/): Heap-buffer-overflow in decode_query_device_identification_resp (not scored)
- [OSV-2026-1015](https://insights.sbomify.com/OSV-2026-1015/): Security exception in com.code_intelligence.jazzer.sanitizers.RegexInjection.hookInternal (not scored)
- [OSV-2025-1097](https://insights.sbomify.com/OSV-2025-1097/): Security exception in org.htmlunit.cyberneko.HTMLTagBalancer.reopenFormattingElements (not scored)
- [OSV-2025-1075](https://insights.sbomify.com/OSV-2025-1075/): Stack-use-after-return in mark_alt_bonds_and_taut_groups (not scored)
- [OSV-2025-1061](https://insights.sbomify.com/OSV-2025-1061/): Security exception in org.apache.poi.hssf.record.aggregates.SharedValueManager$SharedFormulaGroup.<ini (not scored)
- [OSV-2025-1059](https://insights.sbomify.com/OSV-2025-1059/): Security exception in com.google.re2j.Machine.add (not scored)
- [OSV-2024-1464](https://insights.sbomify.com/OSV-2024-1464/): Use-of-uninitialized-value in Splash::compositeBackground (not scored)
- [MAL-2026-9999](https://insights.sbomify.com/MAL-2026-9999/): Malicious code in zztxtwtmp12 (RubyGems) (malicious package)
- [MAL-2026-9998](https://insights.sbomify.com/MAL-2026-9998/): Malicious code in zztxtwtmp11 (RubyGems) (malicious package)
- [MAL-2026-9997](https://insights.sbomify.com/MAL-2026-9997/): Malicious code in zztxtwtmp10 (RubyGems) (malicious package)
- [MAL-2026-9996](https://insights.sbomify.com/MAL-2026-9996/): Malicious code in zztxtwtmp09 (RubyGems) (malicious package)
- [MAL-2026-9995](https://insights.sbomify.com/MAL-2026-9995/): Malicious code in zztxtwtmp08 (RubyGems) (malicious package)
- [MAL-2026-9994](https://insights.sbomify.com/MAL-2026-9994/): Malicious code in zztxtwtmp07 (RubyGems) (malicious package)
- [MAL-2026-9993](https://insights.sbomify.com/MAL-2026-9993/): Malicious code in zztxtwtmp06 (RubyGems) (malicious package)
- [MAL-2026-9992](https://insights.sbomify.com/MAL-2026-9992/): Malicious code in zztxtwtmp05 (RubyGems) (malicious package)
- [MAL-2026-9991](https://insights.sbomify.com/MAL-2026-9991/): Malicious code in zztxtwtmp04 (RubyGems) (malicious package)
- [MAL-2026-9990](https://insights.sbomify.com/MAL-2026-9990/): Malicious code in zztxtwtmp03 (RubyGems) (malicious package)
- [MAL-2026-999](https://insights.sbomify.com/MAL-2026-999/): Malicious code in react-dropzone-truffle (npm) (malicious package)
- [MAL-2026-9989](https://insights.sbomify.com/MAL-2026-9989/): Malicious code in zztxtwtmp02 (RubyGems) (malicious package)
- [MAL-2026-9988](https://insights.sbomify.com/MAL-2026-9988/): Malicious code in zztxtwtmp01 (RubyGems) (malicious package)
- [MAL-2026-9987](https://insights.sbomify.com/MAL-2026-9987/): Malicious code in zztestproxyfooabcxyz (RubyGems) (malicious package)
- [MAL-2026-9986](https://insights.sbomify.com/MAL-2026-9986/): Malicious code in zztestownedtmp1 (RubyGems) (malicious package)
- [MAL-2026-9985](https://insights.sbomify.com/MAL-2026-9985/): Malicious code in zztestno44 (RubyGems) (malicious package)
- [MAL-2026-9984](https://insights.sbomify.com/MAL-2026-9984/): Malicious code in zztestno33 (RubyGems) (malicious package)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/9/