# Vulnerabilities published in 2026


- [CVE-2026-84380](https://insights.sbomify.com/CVE-2026-84380/): HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated (medium 5.6)
- [CVE-2026-8438](https://insights.sbomify.com/CVE-2026-8438/): All-In-One Security (AIOS) <= 5.4.7 - Unauthenticated Stored Cross-Site Scripting via REST API Request Path (high 7.2)
- [CVE-2026-84379](https://insights.sbomify.com/CVE-2026-84379/): HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers (medium 5.3)
- [CVE-2026-84378](https://insights.sbomify.com/CVE-2026-84378/): HTTPX2: Quadratic SSE line buffering can cause CPU denial of service (medium 5.9)
- [CVE-2026-84377](https://insights.sbomify.com/CVE-2026-84377/): LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters (medium 6.5)
- [CVE-2026-84376](https://insights.sbomify.com/CVE-2026-84376/): Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base (medium 6.3)
- [CVE-2026-84375](https://insights.sbomify.com/CVE-2026-84375/): js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources (high 7.5)
- [CVE-2026-84374](https://insights.sbomify.com/CVE-2026-84374/): Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path (high 7.5)
- [CVE-2026-84373](https://insights.sbomify.com/CVE-2026-84373/): Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock (medium 5.9)
- [CVE-2026-84372](https://insights.sbomify.com/CVE-2026-84372/): Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections (critical 9.8)
- [CVE-2026-84371](https://insights.sbomify.com/CVE-2026-84371/): ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass (medium 5.4)
- [CVE-2026-84370](https://insights.sbomify.com/CVE-2026-84370/): SVGO: removeScripts allows executable links through namespace and control-character bypasses (high 8.2)
- [CVE-2026-84369](https://insights.sbomify.com/CVE-2026-84369/): SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements (medium 6.1)
- [CVE-2026-84368](https://insights.sbomify.com/CVE-2026-84368/): joi: Prototype pollution via a `__proto__` language key in custom messages (low 3.7)
- [CVE-2026-84367](https://insights.sbomify.com/CVE-2026-84367/): joi: object().rename() with a template target can set the validated object's prototype (low 3.7)
- [CVE-2026-84366](https://insights.sbomify.com/CVE-2026-84366/): Scrapy: S3DownloadHandler sends signed S3 requests over plaintext HTTP by default (high 7.4)
- [CVE-2026-84365](https://insights.sbomify.com/CVE-2026-84365/): Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory (medium 6.5)
- [CVE-2026-84364](https://insights.sbomify.com/CVE-2026-84364/): Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion (medium 5.3)
- [CVE-2026-84363](https://insights.sbomify.com/CVE-2026-84363/): Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials (medium 5.9)
- [CVE-2026-84361](https://insights.sbomify.com/CVE-2026-84361/): Composer: Perforce source URL permits P4PORT `rsh:` command execution (high 7.7)
- [CVE-2026-84360](https://insights.sbomify.com/CVE-2026-84360/): Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools (high 8.1)
- [CVE-2026-84359](https://insights.sbomify.com/CVE-2026-84359/): Information disclosure in Chrome (low 3.1)
- [CVE-2026-84358](https://insights.sbomify.com/CVE-2026-84358/): Privilege escalation in Chrome (medium 4.2)
- [CVE-2026-84357](https://insights.sbomify.com/CVE-2026-84357/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-84356](https://insights.sbomify.com/CVE-2026-84356/): Other in Chrome (medium 4.3)
- [CVE-2026-84355](https://insights.sbomify.com/CVE-2026-84355/): Security feature bypass in Chrome (low 3.1)
- [CVE-2026-84354](https://insights.sbomify.com/CVE-2026-84354/): Missing authorization in Chrome (critical 9.6)
- [CVE-2026-84353](https://insights.sbomify.com/CVE-2026-84353/): Use after free in Chrome (critical 9.6)
- [CVE-2026-84352](https://insights.sbomify.com/CVE-2026-84352/): Use after free in Chrome (critical 9.6)
- [CVE-2026-84351](https://insights.sbomify.com/CVE-2026-84351/): Memory corruption in Chrome (high 8.3)
- [CVE-2026-84350](https://insights.sbomify.com/CVE-2026-84350/): Use after free in Chrome (high 8.8)
- [CVE-2026-8435](https://insights.sbomify.com/CVE-2026-8435/): Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file approveVersion() (low 2.3)
- [CVE-2026-84349](https://insights.sbomify.com/CVE-2026-84349/): Use after free in Chrome (high 8.3)
- [CVE-2026-84348](https://insights.sbomify.com/CVE-2026-84348/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-84347](https://insights.sbomify.com/CVE-2026-84347/): Use after free in Chrome (high 8.8)
- [CVE-2026-8434](https://insights.sbomify.com/CVE-2026-8434/): Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescanMultiple() (low 2.3)
- [CVE-2026-84335](https://insights.sbomify.com/CVE-2026-84335/): Missing authorization in Chrome (high 8.3)
- [CVE-2026-84334](https://insights.sbomify.com/CVE-2026-84334/): Missing authorization in Chrome (high 8.1)
- [CVE-2026-84333](https://insights.sbomify.com/CVE-2026-84333/): Use after free in Chrome (critical 9.6)
- [CVE-2026-84332](https://insights.sbomify.com/CVE-2026-84332/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-84331](https://insights.sbomify.com/CVE-2026-84331/): Security feature bypass in Chrome (low 3.1)
- [CVE-2026-84330](https://insights.sbomify.com/CVE-2026-84330/): Other in Chrome (medium 5.4)
- [CVE-2026-8433](https://insights.sbomify.com/CVE-2026-8433/): Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescan() (low 2.3)
- [CVE-2026-84329](https://insights.sbomify.com/CVE-2026-84329/): Information disclosure in Chrome (medium 5.3)
- [CVE-2026-84328](https://insights.sbomify.com/CVE-2026-84328/): Missing authorization in Chrome (low 3.1)
- [CVE-2026-84327](https://insights.sbomify.com/CVE-2026-84327/): Missing authorization in Chrome (medium 6.5)
- [CVE-2026-84326](https://insights.sbomify.com/CVE-2026-84326/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-84325](https://insights.sbomify.com/CVE-2026-84325/): Security feature bypass in Chrome (critical 9.8)
- [CVE-2026-84324](https://insights.sbomify.com/CVE-2026-84324/): Use after free in Chrome (critical 9.0)
- [CVE-2026-84323](https://insights.sbomify.com/CVE-2026-84323/): Missing authorization in Chrome (medium 5.3)
- [CVE-2026-84321](https://insights.sbomify.com/CVE-2026-84321/): Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable (medium 5.4)
- [CVE-2026-84320](https://insights.sbomify.com/CVE-2026-84320/): Nginx UI: Auto backup name allows path traversal outside validated storage path (medium 6.3)
- [CVE-2026-8432](https://insights.sbomify.com/CVE-2026-8432/): Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file star() (low 2.3)
- [CVE-2026-84319](https://insights.sbomify.com/CVE-2026-84319/): Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context (high 8.3)
- [CVE-2026-84318](https://insights.sbomify.com/CVE-2026-84318/): Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE (high 8.8)
- [CVE-2026-84317](https://insights.sbomify.com/CVE-2026-84317/): Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image) (high 8.8)
- [CVE-2026-84316](https://insights.sbomify.com/CVE-2026-84316/): Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image) (high 8.8)
- [CVE-2026-84315](https://insights.sbomify.com/CVE-2026-84315/): Nginx UI OTP secure-session step-up is missing on sensitive mutation routes (high 8.3)
- [CVE-2026-84314](https://insights.sbomify.com/CVE-2026-84314/): Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint (high 8.7)
- [CVE-2026-84313](https://insights.sbomify.com/CVE-2026-84313/): Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover (high 8.8)
- [CVE-2026-84312](https://insights.sbomify.com/CVE-2026-84312/): Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF) (high 7.1)
- [CVE-2026-84311](https://insights.sbomify.com/CVE-2026-84311/): pypdf: Possible long runtimes/large memory usage when extracting XForm objects (medium 4.8)
- [CVE-2026-84310](https://insights.sbomify.com/CVE-2026-84310/): pypdf: Possible long runtimes/large memory usage when retrieving outlines (medium 4.8)
- [CVE-2026-8431](https://insights.sbomify.com/CVE-2026-8431/): Ops Manager RCE via webhook body (critical 9.4)
- [CVE-2026-84309](https://insights.sbomify.com/CVE-2026-84309/): pypdf: Possible infinite loop for TreeObject.insert_child (medium 6.9)
- [CVE-2026-84308](https://insights.sbomify.com/CVE-2026-84308/): phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery (medium 6.3)
- [CVE-2026-84307](https://insights.sbomify.com/CVE-2026-84307/): Filament: Password validity disclosure for accounts denied panel access on login page (low 3.7)
- [CVE-2026-84306](https://insights.sbomify.com/CVE-2026-84306/): Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used (medium 6.5)
- [CVE-2026-84305](https://insights.sbomify.com/CVE-2026-84305/): sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption (medium 5.1)
- [CVE-2026-84304](https://insights.sbomify.com/CVE-2026-84304/): gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation (high 8.7)
- [CVE-2026-84303](https://insights.sbomify.com/CVE-2026-84303/): gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion (medium 6.3)
- [CVE-2026-84302](https://insights.sbomify.com/CVE-2026-84302/): Discourse: Non-participant moderators can read, edit, and delete PM content through Discourse AI reviewables (medium 4.2)
- [CVE-2026-84301](https://insights.sbomify.com/CVE-2026-84301/): FastGPT safe axios SSRF guard still allows DNS rebinding TOCTOU on protected outbound requests (medium 6.3)
- [CVE-2026-8430](https://insights.sbomify.com/CVE-2026-8430/): SPIP < 4.4.14 Remote Code Execution via nginx (critical 9.2)
- [CVE-2026-84298](https://insights.sbomify.com/CVE-2026-84298/): Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher (low 3.1)
- [CVE-2026-84296](https://insights.sbomify.com/CVE-2026-84296/): SSH Multi-Factor Authentication Bypass in Progress WS_FTP Server (medium 6.8)
- [CVE-2026-84295](https://insights.sbomify.com/CVE-2026-84295/): Improper Authentication in Progress WS_FTP Server (critical 10.0)
- [CVE-2026-84294](https://insights.sbomify.com/CVE-2026-84294/): Information Disclosure in Ad Hoc Transfer in Progress WS_FTP Server (high 7.7)
- [CVE-2026-84293](https://insights.sbomify.com/CVE-2026-84293/): Cross-site scripting in Repeater Fields for Gravity Forms (high 7.2)
- [CVE-2026-84292](https://insights.sbomify.com/CVE-2026-84292/): fast-uri vulnerable to authority injection via an unvalidated port in serialize (high 7.5)
- [CVE-2026-84290](https://insights.sbomify.com/CVE-2026-84290/): Security vulnerability affects the Windows S-TAP component as part of IBM Guardium Data Protection (medium 5.1)
- [CVE-2026-8429](https://insights.sbomify.com/CVE-2026-8429/): SPIP < 4.4.14 Remote Code Execution via Private Space (high 8.7)
- [CVE-2026-84289](https://insights.sbomify.com/CVE-2026-84289/): NousResearch hermes-agent MCP Tool mcp_tool.py list_tools memory allocation (medium 5.3)
- [CVE-2026-84288](https://insights.sbomify.com/CVE-2026-84288/): NousResearch hermes-agent ACP Prompt Workflow session.py HermesACPAgent.prompt denial of service (medium 5.3)
- [CVE-2026-84287](https://insights.sbomify.com/CVE-2026-84287/): NousResearch hermes-agent Session Chat api_server.py denial of service (medium 5.3)
- [CVE-2026-84286](https://insights.sbomify.com/CVE-2026-84286/): OOB Read/Write via Negative Array Index in exllamav3_ext Kernel Table (critical 9.8)
- [CVE-2026-84285](https://insights.sbomify.com/CVE-2026-84285/): OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.3 through 17.5 (high 8.8)
- [CVE-2026-84284](https://insights.sbomify.com/CVE-2026-84284/): Incorrect Authorization in GitLab (medium 5.3)
- [CVE-2026-84283](https://insights.sbomify.com/CVE-2026-84283/): FluteCode Secure Folder 1.2 -Plaintext vault files in shared storage bypass the PIN gate (medium 6.8)
- [CVE-2026-84282](https://insights.sbomify.com/CVE-2026-84282/): A Server-Side Request Forgery (SSRF) vulnerability exists in the ONLYOFFICE ownCloud Integration plugin (version 9.12) (medium 6.5)
- [CVE-2026-84281](https://insights.sbomify.com/CVE-2026-84281/): Cross-site scripting in Fancy Product Designer (high 7.2)
- [CVE-2026-84280](https://insights.sbomify.com/CVE-2026-84280/): Cross-site scripting in Fancy Product Designer (high 7.2)
- [CVE-2026-8428](https://insights.sbomify.com/CVE-2026-8428/): CSRF token is not validated in the core CMS update controller for Concrete CMS 9.5.0 and below (high 7.5)
- [CVE-2026-84279](https://insights.sbomify.com/CVE-2026-84279/): Cross-site scripting in Fancy Product Designer (high 7.2)
- [CVE-2026-84278](https://insights.sbomify.com/CVE-2026-84278/): IBM Guardium Data Protection Command Injection (high 7.2)
- [CVE-2026-84276](https://insights.sbomify.com/CVE-2026-84276/): IBM Guardium Data Protection Denial of Service (high 7.5)
- [CVE-2026-84275](https://insights.sbomify.com/CVE-2026-84275/): IBM Guardium Data Protection Path Traversal (high 7.5)
- [CVE-2026-84274](https://insights.sbomify.com/CVE-2026-84274/): IBM Guardium Data Protection Information Disclosure (medium 6.5)
- [CVE-2026-84272](https://insights.sbomify.com/CVE-2026-84272/): IBM Guardium Data Protection Missing Authentication (critical 9.8)
- [CVE-2026-84271](https://insights.sbomify.com/CVE-2026-84271/): IBM Guardium Data Protection Signature Verification Bypass (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/316/