# Vulnerabilities published in 2026


- [CVE-2026-106557](https://insights.sbomify.com/CVE-2026-106557/): Backstage: Improper input validation in TechDocs Markdown extension configuration (high 7.7)
- [CVE-2026-106556](https://insights.sbomify.com/CVE-2026-106556/): Backstage: Configuration bypass in TechDocs mkdocs.yml sanitization (high 7.7)
- [CVE-2026-106555](https://insights.sbomify.com/CVE-2026-106555/): Other in OpenSSH (low 2.2)
- [CVE-2026-106553](https://insights.sbomify.com/CVE-2026-106553/): Information disclosure in OpenSSH (low 2.2)
- [CVE-2026-106552](https://insights.sbomify.com/CVE-2026-106552/): Path traversal in OpenSSH (medium 4.2)
- [CVE-2026-106550](https://insights.sbomify.com/CVE-2026-106550/): CVE-2026-106550 (high 7.5)
- [CVE-2026-10655](https://insights.sbomify.com/CVE-2026-10655/): Use-after-free race in SNTP async client when closing the socket while the socket service is still polling it (medium 6.5)
- [CVE-2026-106547](https://insights.sbomify.com/CVE-2026-106547/): HDF5 heap buffer overflow in H5VM_array_fill via crafted fill-value metadata (high 8.5)
- [CVE-2026-10654](https://insights.sbomify.com/CVE-2026-10654/): RFCOMM session-disconnect race leaks session/L2CAP and denies further RFCOMM service in Zephyr Bluetooth Classic (low 3.1)
- [CVE-2026-10653](https://insights.sbomify.com/CVE-2026-10653/): Non-atomic `net_buf` reference counts cause double-free / free-list corruption under concurrent unref (medium 6.4)
- [CVE-2026-10652](https://insights.sbomify.com/CVE-2026-10652/): Out-of-bounds read in Zephyr DNS resolver TXT/SRV record parsing (unvalidated `rdlength`) (medium 4.8)
- [CVE-2026-106513](https://insights.sbomify.com/CVE-2026-106513/): MISP: Site-Admin Can Repoint Redis Workers to Attacker-Controlled Server via UI/API Configuration Change (medium 6.9)
- [CVE-2026-106512](https://insights.sbomify.com/CVE-2026-106512/): MISP sachertortephp - CakeResponse::download() HTTP Response Splitting via Unsanitized Filename Enables Stored XSS (high 8.4)
- [CVE-2026-106511](https://insights.sbomify.com/CVE-2026-106511/): CVE-2026-106511 (critical 9.8)
- [CVE-2026-106510](https://insights.sbomify.com/CVE-2026-106510/): Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml (high 7.7)
- [CVE-2026-10651](https://insights.sbomify.com/CVE-2026-10651/): Out-of-bounds read in Bluetooth Classic SDP attribute parsing (`bt_sdp_parse_attribute`) (high 7.1)
- [CVE-2026-106509](https://insights.sbomify.com/CVE-2026-106509/): Backstage: Improper validation of MkDocs theme configuration in TechDocs (high 7.7)
- [CVE-2026-106508](https://insights.sbomify.com/CVE-2026-106508/): Backstage: Potential file exposure through local TechDocs publisher (medium 5.3)
- [CVE-2026-106507](https://insights.sbomify.com/CVE-2026-106507/): Backstage: TechDocs arbitrary file read via mkdocs snippets (medium 5.3)
- [CVE-2026-106506](https://insights.sbomify.com/CVE-2026-106506/): Backstage: Improper input validation in scaffolder task list ordering (medium 5.3)
- [CVE-2026-106505](https://insights.sbomify.com/CVE-2026-106505/): Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend (high 7.7)
- [CVE-2026-106504](https://insights.sbomify.com/CVE-2026-106504/): Backstage: Sensitive information exposure in scaffolder task logs (medium 6.5)
- [CVE-2026-106503](https://insights.sbomify.com/CVE-2026-106503/): Backstage: Scaffolder action input authorization bypass (high 8.1)
- [CVE-2026-106502](https://insights.sbomify.com/CVE-2026-106502/): Backstage: Sensitive information may be exposed in Scaffolder task failure events (medium 5.3)
- [CVE-2026-106501](https://insights.sbomify.com/CVE-2026-106501/): Backstage: Sensitive information exposure in Scaffolder (critical 9.6)
- [CVE-2026-106500](https://insights.sbomify.com/CVE-2026-106500/): Backstage: Improper task state validation in Scaffolder backend (high 8.5)
- [CVE-2026-10650](https://insights.sbomify.com/CVE-2026-10650/): warmcat libwebsockets SSH Protocol sshd.c lws_ssh_parse_plaintext resource consumption (medium 6.9)
- [CVE-2026-1065](https://insights.sbomify.com/CVE-2026-1065/): Form Maker by 10Web <= 1.15.35 - Unauthenticated Stored Cross-Site Scripting via SVG file (high 7.2)
- [CVE-2026-106499](https://insights.sbomify.com/CVE-2026-106499/): Backstage: Secret-derived values may be exposed in scaffolder task logs (medium 4.9)
- [CVE-2026-106498](https://insights.sbomify.com/CVE-2026-106498/): Backstage: Improper URL validation in catalog entity placeholder resolution (high 7.7)
- [CVE-2026-106497](https://insights.sbomify.com/CVE-2026-106497/): Backstage: Inconsistent catalog property permission evaluation (medium 4.3)
- [CVE-2026-106496](https://insights.sbomify.com/CVE-2026-106496/): Backstage: Inconsistent enforcement of allowed location types during catalog processing (low 3.1)
- [CVE-2026-106495](https://insights.sbomify.com/CVE-2026-106495/): Backstage: Improper access control in backend action invocation (medium 4.3)
- [CVE-2026-106494](https://insights.sbomify.com/CVE-2026-106494/): Backstage: Improper input validation in cloud storage URL readers (medium 4.4)
- [CVE-2026-106493](https://insights.sbomify.com/CVE-2026-106493/): Backstage: Cloud storage catalog locations may cross configured storage boundaries (low 3.0)
- [CVE-2026-106492](https://insights.sbomify.com/CVE-2026-106492/): Backstage: Improper preservation of access restrictions during service credential delegation (high 7.6)
- [CVE-2026-106491](https://insights.sbomify.com/CVE-2026-106491/): Backstage: Improper input validation in proxy-backend (medium 6.4)
- [CVE-2026-106490](https://insights.sbomify.com/CVE-2026-106490/): Backstage: Improper input validation in TechDocs static content requests (medium 6.5)
- [CVE-2026-10649](https://insights.sbomify.com/CVE-2026-10649/): Pacemaker: pacemaker: denial of service via integer overflow in remote message decompression (high 8.6)
- [CVE-2026-106489](https://insights.sbomify.com/CVE-2026-106489/): Backstage: Improper authorization enforcement for TechDocs static content (medium 6.5)
- [CVE-2026-106488](https://insights.sbomify.com/CVE-2026-106488/): Backstage: Improper authentication in the OIDC provider (high 8.1)
- [CVE-2026-106487](https://insights.sbomify.com/CVE-2026-106487/): Backstage: Unsupported catalog cluster authentication mode in kubernetes backend (low 3.5)
- [CVE-2026-106486](https://insights.sbomify.com/CVE-2026-106486/): Backstage: Improper filesystem validation in Bitbucket pull-request scaffolder actions (high 8.5)
- [CVE-2026-106484](https://insights.sbomify.com/CVE-2026-106484/): Security feature bypass in chrome-devtools-mcp (medium 4.4)
- [CVE-2026-10648](https://insights.sbomify.com/CVE-2026-10648/): NULL-pointer dereference in MCUmgr serial/console SMP transport on buffer-pool exhaustion (medium 6.2)
- [CVE-2026-106471](https://insights.sbomify.com/CVE-2026-106471/): Candlepin: candlepin: broken object-level authorization via verifyauthorizationfilter multi-@verify hasaccess latching (high 8.1)
- [CVE-2026-106470](https://insights.sbomify.com/CVE-2026-106470/): WP Data Access < 5.5.88 - Subscriber+ SSRF (medium 5.0)
- [CVE-2026-10647](https://insights.sbomify.com/CVE-2026-10647/): Deadlock denial of service in USB CDC-NCM device class on TX enqueue failure (medium 5.3)
- [CVE-2026-106469](https://insights.sbomify.com/CVE-2026-106469/): Gutenverse Form < 3.0.11 - Contributor+ Stored XSS via SVG Icon (medium 6.8)
- [CVE-2026-106465](https://insights.sbomify.com/CVE-2026-106465/): Security feature bypass in NetX Duo (high 8.7)
- [CVE-2026-106464](https://insights.sbomify.com/CVE-2026-106464/): Memory corruption in NetX Duo (high 8.7)
- [CVE-2026-106463](https://insights.sbomify.com/CVE-2026-106463/): Backstage: Improper authorization in GitLab organizational user ingestion (medium 5.4)
- [CVE-2026-106462](https://insights.sbomify.com/CVE-2026-106462/): Backstage: Scaffolder credential handling may allow unintended GitHub authentication fallback (medium 6.4)
- [CVE-2026-106461](https://insights.sbomify.com/CVE-2026-106461/): Backstage: Incorrect authorization in scaffolder task listing (medium 4.3)
- [CVE-2026-106460](https://insights.sbomify.com/CVE-2026-106460/): Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization (medium 6.8)
- [CVE-2026-10646](https://insights.sbomify.com/CVE-2026-10646/): Use-after-return in `zsock_getaddrinfo()` when a timed-out DNS query is retried without cancellation (high 7.4)
- [CVE-2026-106459](https://insights.sbomify.com/CVE-2026-106459/): Backstage: Improper input validation in Sentry scaffolder actions (high 8.5)
- [CVE-2026-106458](https://insights.sbomify.com/CVE-2026-106458/): Backstage: Inconsistent repository filtering in Bitbucket Server catalog event updates (medium 6.5)
- [CVE-2026-106457](https://insights.sbomify.com/CVE-2026-106457/): Backstage: Insufficient audience validation in the Cloudflare Access auth provider (medium 6.8)
- [CVE-2026-106456](https://insights.sbomify.com/CVE-2026-106456/): Backstage: Inconsistent credential enforcement for overlapping proxy routes (medium 4.8)
- [CVE-2026-106455](https://insights.sbomify.com/CVE-2026-106455/): Backstage: Improper validation of MkDocs plugin configuration in TechDocs (high 7.7)
- [CVE-2026-106454](https://insights.sbomify.com/CVE-2026-106454/): Twisted: IMAP wildcardToRegexp() ReDoS (medium 4.3)
- [CVE-2026-106453](https://insights.sbomify.com/CVE-2026-106453/): yawkat LZ4 Java: LZ4DecompressorWithLength allocates the unvalidated size from the 4-byte length header, so a 5-byte input triggers a 1 GiB allocation and OutOfMemoryError (medium 5.3)
- [CVE-2026-106452](https://insights.sbomify.com/CVE-2026-106452/): yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream header (medium 5.3)
- [CVE-2026-106451](https://insights.sbomify.com/CVE-2026-106451/): yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user (high 7.3)
- [CVE-2026-106450](https://insights.sbomify.com/CVE-2026-106450/): yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs (medium 5.3)
- [CVE-2026-10645](https://insights.sbomify.com/CVE-2026-10645/): Out-of-bounds read in Zephyr ext2 directory entry traversal from a crafted filesystem image (medium 4.9)
- [CVE-2026-106449](https://insights.sbomify.com/CVE-2026-106449/): yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError (low 3.7)
- [CVE-2026-106448](https://insights.sbomify.com/CVE-2026-106448/): StableLib: Prototype poisoning via `__proto__` map keys in CBOR decoding (high 8.9)
- [CVE-2026-106447](https://insights.sbomify.com/CVE-2026-106447/): StableLib: Stack exhaustion denial of service via deeply nested CBOR arrays, maps, or tags (high 8.7)
- [CVE-2026-106446](https://insights.sbomify.com/CVE-2026-106446/): Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams) (critical 9.8)
- [CVE-2026-106445](https://insights.sbomify.com/CVE-2026-106445/): Handlebars: JavaScript Injection via Own Property Check Bypass (critical 9.2)
- [CVE-2026-106444](https://insights.sbomify.com/CVE-2026-106444/): Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates (medium 4.7)
- [CVE-2026-106443](https://insights.sbomify.com/CVE-2026-106443/): WeasyPrint: EPS images reach the Ghostscript interpreter resulting in RCE (high 8.8)
- [CVE-2026-106442](https://insights.sbomify.com/CVE-2026-106442/): Hydra instantiate target blacklist bypasses permit code execution (high 7.8)
- [CVE-2026-106441](https://insights.sbomify.com/CVE-2026-106441/): Hydra logging configuration permits unsafe callable resolution (high 7.8)
- [CVE-2026-106440](https://insights.sbomify.com/CVE-2026-106440/): Hydra: Optuna custom_search_space can resolve and execute untrusted callables via get_method (high 7.8)
- [CVE-2026-10644](https://insights.sbomify.com/CVE-2026-10644/): Out-of-bounds write in Microchip SERCOM-G1 (PIC32CM-JH) async UART RX with 1-byte buffer (medium 4.2)
- [CVE-2026-106439](https://insights.sbomify.com/CVE-2026-106439/): Hydra: Mutable instantiate policy sets allow target blocklist bypass (high 8.5)
- [CVE-2026-106438](https://insights.sbomify.com/CVE-2026-106438/): Silent Decimal128 value corruption via incorrect exactness check in MongoDB C Driver (medium 5.1)
- [CVE-2026-106437](https://insights.sbomify.com/CVE-2026-106437/): Out-of-bounds read and write via undersized BSON buffer reservation in MongoDB C Driver (medium 5.9)
- [CVE-2026-106436](https://insights.sbomify.com/CVE-2026-106436/): Application denial of service and data truncation via unchecked BSON append failures in MongoDB PHP Driver (medium 6.3)
- [CVE-2026-106435](https://insights.sbomify.com/CVE-2026-106435/): Application denial of service via out-of-bounds read in BSON Regex decoding in MongoDB Python Driver (medium 5.9)
- [CVE-2026-106434](https://insights.sbomify.com/CVE-2026-106434/): Unrecognized payload acceptance in explicit decryption in MongoDB libmongocrypt (medium 5.3)
- [CVE-2026-106433](https://insights.sbomify.com/CVE-2026-106433/): Heap corruption via duplicate masterKey fields in MongoDB libmongocrypt (high 8.7)
- [CVE-2026-106432](https://insights.sbomify.com/CVE-2026-106432/): Heap buffer overflow via 32-bit string-length truncation in MongoDB PHP Driver (low 2.0)
- [CVE-2026-106431](https://insights.sbomify.com/CVE-2026-106431/): One-byte heap buffer overflow in BSON bulk document writer in MongoDB C Driver (medium 5.9)
- [CVE-2026-106430](https://insights.sbomify.com/CVE-2026-106430/): Query and rename target confusion via embedded NUL truncation in MongoDB C++ Driver (medium 6.0)
- [CVE-2026-10643](https://insights.sbomify.com/CVE-2026-10643/): Memory corruption in zephyr (high 8.7)
- [CVE-2026-106429](https://insights.sbomify.com/CVE-2026-106429/): Application denial of service via malformed KMS endpoint in MongoDB libmongocrypt (high 7.1)
- [CVE-2026-106428](https://insights.sbomify.com/CVE-2026-106428/): Out-of-bounds read in SCRAM response parsing in MongoDB C Driver (medium 6.3)
- [CVE-2026-106427](https://insights.sbomify.com/CVE-2026-106427/): Security feature bypass in Chrome (medium 5.4)
- [CVE-2026-106426](https://insights.sbomify.com/CVE-2026-106426/): Race condition in Chrome (high 8.3)
- [CVE-2026-106425](https://insights.sbomify.com/CVE-2026-106425/): Missing authorization in Chrome (medium 4.2)
- [CVE-2026-106424](https://insights.sbomify.com/CVE-2026-106424/): Information disclosure in Chrome (medium 4.0)
- [CVE-2026-106423](https://insights.sbomify.com/CVE-2026-106423/): Use after free in Chrome (high 8.8)
- [CVE-2026-106422](https://insights.sbomify.com/CVE-2026-106422/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2026-106421](https://insights.sbomify.com/CVE-2026-106421/): Use after free in Chrome (high 8.8)
- [CVE-2026-106420](https://insights.sbomify.com/CVE-2026-106420/): Other in Chrome (medium 5.4)
- [CVE-2026-10642](https://insights.sbomify.com/CVE-2026-10642/): Unbounded TX busy-loop DoS in Zephyr PL011 UART driver under CTS hardware flow control (medium 4.6)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/961/