# Vulnerabilities published in 2026


- [CVE-2026-88046](https://insights.sbomify.com/CVE-2026-88046/): rclone: source object names can escape the configured root on upload (medium 5.3)
- [CVE-2026-88045](https://insights.sbomify.com/CVE-2026-88045/): rclone: S3 multipart declared-length memory exhaustion (high 7.5)
- [CVE-2026-88044](https://insights.sbomify.com/CVE-2026-88044/): rclone: RC per-server auth-proxy bypass (critical 9.1)
- [CVE-2026-88043](https://insights.sbomify.com/CVE-2026-88043/): Mang Board WP <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via 'data_type' Parameter (high 7.2)
- [CVE-2026-88041](https://insights.sbomify.com/CVE-2026-88041/): Apache Tomcat: HTTP/2 trailer header cross-contamination (high 7.5)
- [CVE-2026-8804](https://insights.sbomify.com/CVE-2026-8804/): Cleartext Storage of Sensitive Information for Puppet Resource API (medium 6.7)
- [CVE-2026-88038](https://insights.sbomify.com/CVE-2026-88038/): cookies vulnerable to Set-Cookie attribute injection via unvalidated domain and path options (medium 4.8)
- [CVE-2026-88037](https://insights.sbomify.com/CVE-2026-88037/): Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_service title (medium 6.4)
- [CVE-2026-88036](https://insights.sbomify.com/CVE-2026-88036/): GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C Driver (medium 6.1)
- [CVE-2026-88035](https://insights.sbomify.com/CVE-2026-88035/): Heap buffer overflow via wrapped size check during SASL username canonicalization in MongoDB C Driver (medium 5.7)
- [CVE-2026-88034](https://insights.sbomify.com/CVE-2026-88034/): GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C++ Driver (medium 6.1)
- [CVE-2026-88033](https://insights.sbomify.com/CVE-2026-88033/): GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Java Driver (medium 6.1)
- [CVE-2026-88032](https://insights.sbomify.com/CVE-2026-88032/): Application denial of service via cancellation race in reactive client-side encryption in MongoDB Java Driver (high 8.2)
- [CVE-2026-88031](https://insights.sbomify.com/CVE-2026-88031/): GridFS data deletion via query-operator injection in file IDs in the MongoDB Go Driver (medium 6.1)
- [CVE-2026-88030](https://insights.sbomify.com/CVE-2026-88030/): GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Ruby Driver (medium 6.1)
- [CVE-2026-8803](https://insights.sbomify.com/CVE-2026-8803/): opensourcepos Open Source Point of Sale Employee Login Employee.php login weak hash (medium 6.3)
- [CVE-2026-88029](https://insights.sbomify.com/CVE-2026-88029/): GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Python Driver (medium 6.1)
- [CVE-2026-88028](https://insights.sbomify.com/CVE-2026-88028/): SQL injection in Laravel MongoDB (PHP) (high 7.1)
- [CVE-2026-88027](https://insights.sbomify.com/CVE-2026-88027/): SQL injection in Laravel MongoDB (PHP) (high 7.1)
- [CVE-2026-88026](https://insights.sbomify.com/CVE-2026-88026/): Regular expression injection via unescaped characters in LINQ query translation in MongoDB C# Driver (high 7.1)
- [CVE-2026-88025](https://insights.sbomify.com/CVE-2026-88025/): GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C# Driver (medium 6.1)
- [CVE-2026-88024](https://insights.sbomify.com/CVE-2026-88024/): GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Rust Driver (medium 6.1)
- [CVE-2026-88023](https://insights.sbomify.com/CVE-2026-88023/): GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB PHP Library (medium 6.1)
- [CVE-2026-88022](https://insights.sbomify.com/CVE-2026-88022/): SQL injection in Laravel MongoDB (PHP) (high 8.4)
- [CVE-2026-88021](https://insights.sbomify.com/CVE-2026-88021/): Consul vulnerable to an authorization bypass in the Connect service mesh (high 7.5)
- [CVE-2026-88020](https://insights.sbomify.com/CVE-2026-88020/): Improper Neutralization of Input During Web Page Generation in OpenPLC Runtime v3 (medium 5.3)
- [CVE-2026-8802](https://insights.sbomify.com/CVE-2026-8802/): opensourcepos Open Source Point of Sale Items.php getPicThumb path traversal (medium 5.3)
- [CVE-2026-88018](https://insights.sbomify.com/CVE-2026-88018/): rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass (critical 9.8)
- [CVE-2026-88017](https://insights.sbomify.com/CVE-2026-88017/): rclone: FTP cross-session auth-proxy backend confusion (high 7.3)
- [CVE-2026-88016](https://insights.sbomify.com/CVE-2026-88016/): rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination (high 7.1)
- [CVE-2026-88015](https://insights.sbomify.com/CVE-2026-88015/): rclone local: crafted Range request against a translated symlink panics (DoS) (medium 5.3)
- [CVE-2026-88014](https://insights.sbomify.com/CVE-2026-88014/): rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace (medium 6.3)
- [CVE-2026-88013](https://insights.sbomify.com/CVE-2026-88013/): rclone: http backend forwards custom/auth headers to a different host on redirect (low 3.7)
- [CVE-2026-88012](https://insights.sbomify.com/CVE-2026-88012/): Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded (medium 5.3)
- [CVE-2026-88011](https://insights.sbomify.com/CVE-2026-88011/): Traefik: ForwardAuth identity spoofing via dot-form header alias (medium 5.3)
- [CVE-2026-88010](https://insights.sbomify.com/CVE-2026-88010/): Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle (medium 6.3)
- [CVE-2026-8801](https://insights.sbomify.com/CVE-2026-8801/): File Extension Restriction Bypass in MOVEit Transfer (low 3.5)
- [CVE-2026-88009](https://insights.sbomify.com/CVE-2026-88009/): Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging (high 8.8)
- [CVE-2026-88008](https://insights.sbomify.com/CVE-2026-88008/): Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization (high 7.0)
- [CVE-2026-88007](https://insights.sbomify.com/CVE-2026-88007/): Traefik HTTP/3 Backend NTLM Connection Reuse (critical 9.1)
- [CVE-2026-88006](https://insights.sbomify.com/CVE-2026-88006/): Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange (medium 6.5)
- [CVE-2026-88005](https://insights.sbomify.com/CVE-2026-88005/): Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange (medium 6.5)
- [CVE-2026-88004](https://insights.sbomify.com/CVE-2026-88004/): Traefik entrypoint header-name sanitization bypassed via request trailers (high 7.0)
- [CVE-2026-88003](https://insights.sbomify.com/CVE-2026-88003/): InvoicePlane: Failure to Revoke Administrative Privileges After Role Downgrade (high 7.5)
- [CVE-2026-88002](https://insights.sbomify.com/CVE-2026-88002/): Open WebUI: Any authenticated user can hang the server via a cyclic chat message history (medium 6.5)
- [CVE-2026-88001](https://insights.sbomify.com/CVE-2026-88001/): Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets (medium 5.0)
- [CVE-2026-88000](https://insights.sbomify.com/CVE-2026-88000/): Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree (medium 6.5)
- [CVE-2026-8800](https://insights.sbomify.com/CVE-2026-8800/): Cross-Org External Token Metadata accessible to AuditUser role (low 2.7)
- [CVE-2026-87999](https://insights.sbomify.com/CVE-2026-87999/): Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch (high 7.1)
- [CVE-2026-87998](https://insights.sbomify.com/CVE-2026-87998/): Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion (high 7.1)
- [CVE-2026-87997](https://insights.sbomify.com/CVE-2026-87997/): Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions (medium 4.3)
- [CVE-2026-87996](https://insights.sbomify.com/CVE-2026-87996/): Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader (high 7.7)
- [CVE-2026-87995](https://insights.sbomify.com/CVE-2026-87995/): Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin (high 8.7)
- [CVE-2026-87994](https://insights.sbomify.com/CVE-2026-87994/): Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint (medium 4.3)
- [CVE-2026-87993](https://insights.sbomify.com/CVE-2026-87993/): Consul-template vulnerable to an information disclosure issue in error handling (high 7.7)
- [CVE-2026-87988](https://insights.sbomify.com/CVE-2026-87988/): Path traversal in mistral-vibe (critical 10.0)
- [CVE-2026-87987](https://insights.sbomify.com/CVE-2026-87987/): Code injection in mistral-vibe (critical 10.0)
- [CVE-2026-87986](https://insights.sbomify.com/CVE-2026-87986/): Security feature bypass in mistral-vibe (critical 10.0)
- [CVE-2026-87985](https://insights.sbomify.com/CVE-2026-87985/): Security feature bypass in mistral-vibe (critical 10.0)
- [CVE-2026-87984](https://insights.sbomify.com/CVE-2026-87984/): Path traversal in mistral-vibe (critical 9.3)
- [CVE-2026-87983](https://insights.sbomify.com/CVE-2026-87983/): Path traversal in mistral-vibe (critical 9.2)
- [CVE-2026-87981](https://insights.sbomify.com/CVE-2026-87981/): Missing authorization in Paymob for WooCommerce (medium 4.7)
- [CVE-2026-87980](https://insights.sbomify.com/CVE-2026-87980/): Security vulnerability affects the UNIX S-TAP component as part of IBM Guardium Data Protection (low 3.1)
- [CVE-2026-8798](https://insights.sbomify.com/CVE-2026-8798/): Native entropy source retries the CPU entropy instructions without limit (high 8.7)
- [CVE-2026-87979](https://insights.sbomify.com/CVE-2026-87979/): Paymob for WooCommerce < 4.1.14 - Unauthenticated Saved Card Token Write to Any User via Webhook (medium 5.3)
- [CVE-2026-87978](https://insights.sbomify.com/CVE-2026-87978/): Paymob for WooCommerce < 4.1.14 - Unauthenticated Payment Bypass via Unverified Subscription Transaction Callback (medium 5.3)
- [CVE-2026-87976](https://insights.sbomify.com/CVE-2026-87976/): Apache NiFi Registry: Improper Limitation of Pathname in Persisted Extension Bundles (high 7.2)
- [CVE-2026-87975](https://insights.sbomify.com/CVE-2026-87975/): Privilege abuse in model formsets with editable primary keys (medium 5.3)
- [CVE-2026-87974](https://insights.sbomify.com/CVE-2026-87974/): Asaas Gateway for WooCommerce < 2.7.8 - Unauthenticated Order Payment Bypass via Webhook (medium 5.3)
- [CVE-2026-87973](https://insights.sbomify.com/CVE-2026-87973/): If-So Dynamic Content 1.9.9 - 1.10.1 - Editor+ Stored XSS via Conversion Name (low 3.1)
- [CVE-2026-87971](https://insights.sbomify.com/CVE-2026-87971/): If-So Dynamic Content 1.4.4 - 1.10.1 - Reflected XSS via 'message' Parameter (high 7.1)
- [CVE-2026-87970](https://insights.sbomify.com/CVE-2026-87970/): If-So Dynamic Content 1.8 - 1.10.1 - Reflected XSS via render_ifso_shortcodes (medium 4.7)
- [CVE-2026-8797](https://insights.sbomify.com/CVE-2026-8797/): Privilege escalation in ExpressUpdate Agent for Windows (high 8.5)
- [CVE-2026-87969](https://insights.sbomify.com/CVE-2026-87969/): WatchGuard AP Authenticated Command Injection in Diagnostic CLI (high 8.6)
- [CVE-2026-87968](https://insights.sbomify.com/CVE-2026-87968/): Product Feed for Google Shopping < 5.3.2 - Unauthenticated Forced Store Registration (medium 5.3)
- [CVE-2026-87966](https://insights.sbomify.com/CVE-2026-87966/): Easy Appointments 4.0 - 4.0.2.1 - Unauthenticated Arbitrary Appointment Modification and Deletion via IDOR (medium 5.3)
- [CVE-2026-87965](https://insights.sbomify.com/CVE-2026-87965/): Easy Appointments < 4.0.2.2 - Unauthenticated Appointment Cancellation/Confirmation via Forgeable Email-Link Token (medium 4.8)
- [CVE-2026-87963](https://insights.sbomify.com/CVE-2026-87963/): Yo 1.1 - 1.3.1 - Unauthenticated SQL Injection via username Parameter (high 8.6)
- [CVE-2026-87962](https://insights.sbomify.com/CVE-2026-87962/): t-digest 3.1 through 3.3 Denial of Service via Unvalidated Length Fields in MergingDigest.fromBytes (high 8.7)
- [CVE-2026-87961](https://insights.sbomify.com/CVE-2026-87961/): ESP32-audioI2S 3.4.4 through 4.0.0 Heap-based Out-of-Bounds Read via Shadowed Length Parameter in read_ID3_Header (high 7.1)
- [CVE-2026-8796](https://insights.sbomify.com/CVE-2026-8796/): Sereal::Decoder versions before 5.005 for Perl allow heap out-of-bounds read via crafted input (high 8.1)
- [CVE-2026-87959](https://insights.sbomify.com/CVE-2026-87959/): WPBot 8.7.2 - 8.7.5 - Subscriber+ Claude AI Settings Update (medium 5.4)
- [CVE-2026-87958](https://insights.sbomify.com/CVE-2026-87958/): Privilege escalation in Db2 (high 8.1)
- [CVE-2026-87955](https://insights.sbomify.com/CVE-2026-87955/): Ultimate Table Field - Critical - Access bypass - SA-CONTRIB-2026-153 (medium 4.3)
- [CVE-2026-87954](https://insights.sbomify.com/CVE-2026-87954/): Taxonomy Term Glossary - Critical - Access bypass - SA-CONTRIB-2026-152 (medium 4.3)
- [CVE-2026-87953](https://insights.sbomify.com/CVE-2026-87953/): SAML SSO - Service Provider - Moderately critical - Server Side Request Forgery - SA-CONTRIB-2026-151 (low 3.3)
- [CVE-2026-87952](https://insights.sbomify.com/CVE-2026-87952/): SAML SSO - Service Provider - Moderately critical - Insufficient replay protection - SA-CONTRIB-2026-150 (low 3.1)
- [CVE-2026-87951](https://insights.sbomify.com/CVE-2026-87951/): SAML SSO - Service Provider - Moderately critical - Information disclosure - SA-CONTRIB-2026-149 (low 3.8)
- [CVE-2026-87950](https://insights.sbomify.com/CVE-2026-87950/): SAML SSO - Service Provider - Moderately critical - Embedded credentials - SA-CONTRIB-2026-148 (medium 5.3)
- [CVE-2026-8795](https://insights.sbomify.com/CVE-2026-8795/): Code injection in Velociraptor (high 7.8)
- [CVE-2026-87949](https://insights.sbomify.com/CVE-2026-87949/): SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-147 (low 3.3)
- [CVE-2026-87948](https://insights.sbomify.com/CVE-2026-87948/): SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-146 (low 3.5)
- [CVE-2026-87947](https://insights.sbomify.com/CVE-2026-87947/): SAML SSO - Service Provider - Moderately critical - Authentication bypass - SA-CONTRIB-2026-145 (medium 4.8)
- [CVE-2026-87946](https://insights.sbomify.com/CVE-2026-87946/): SAML SSO - Service Provider - Critical - Weak cryptographic practices - SA-CONTRIB-2026-144 (medium 4.8)
- [CVE-2026-87945](https://insights.sbomify.com/CVE-2026-87945/): SAML SSO - Service Provider - Critical - Open redirect - SA-CONTRIB-2026-143 (medium 5.4)
- [CVE-2026-87944](https://insights.sbomify.com/CVE-2026-87944/): SAML SSO - Service Provider - Critical - Improper certificate validation - SA-CONTRIB-2026-142 (medium 4.8)
- [CVE-2026-87943](https://insights.sbomify.com/CVE-2026-87943/): SAML SSO - Service Provider - Critical - Improper access control - SA-CONTRIB-2026-141 (medium 6.5)
- [CVE-2026-87942](https://insights.sbomify.com/CVE-2026-87942/): SafeDelete - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-140 (medium 4.6)
- [CVE-2026-87941](https://insights.sbomify.com/CVE-2026-87941/): Patreon - Critical - Unsupported - SA-CONTRIB-2026-139 (not scored)
- [CVE-2026-87940](https://insights.sbomify.com/CVE-2026-87940/): Key auth - Moderately critical - Access bypass - SA-CONTRIB-2026-138 (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/284/