# Vulnerabilities published in 2026


- [CVE-2026-7741](https://insights.sbomify.com/CVE-2026-7741/): CodeAstro Online Classroom studentlogin sql injection (medium 5.3)
- [CVE-2026-77409](https://insights.sbomify.com/CVE-2026-77409/): RabbitMQ amqp091-go: Denial of Service via Synchronous Event Channel Blocking (high 8.2)
- [CVE-2026-77408](https://insights.sbomify.com/CVE-2026-77408/): RabbitMQ amqp091-go: Silent Data Truncation and State Corruption via Shortstr Integer Overflow (critical 9.1)
- [CVE-2026-77407](https://insights.sbomify.com/CVE-2026-77407/): RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct Fields (high 7.0)
- [CVE-2026-77406](https://insights.sbomify.com/CVE-2026-77406/): RabbitMQ amqp091-go: Consumer Message Flooding via Signed-to-Unsigned Integer Casting in Qos Configuration (high 8.2)
- [CVE-2026-77405](https://insights.sbomify.com/CVE-2026-77405/): RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser (critical 9.4)
- [CVE-2026-77404](https://insights.sbomify.com/CVE-2026-77404/): RabbitMQ amqp091-go: Connection Configuration Overwrite via Unsanitized TLS Path Parameter Injection (high 8.7)
- [CVE-2026-77403](https://insights.sbomify.com/CVE-2026-77403/): RabbitMQ amqp091-go: Denial of Service via Sub-Spec Frame Size Negotiation (high 8.9)
- [CVE-2026-77401](https://insights.sbomify.com/CVE-2026-77401/): Zope AccessControl: Information disclosure through Python string `format` and `format_map` functions (medium 6.8)
- [CVE-2026-7740](https://insights.sbomify.com/CVE-2026-7740/): justdan96 tsMuxer vvc.cpp setFPS denial of service (medium 4.8)
- [CVE-2026-77399](https://insights.sbomify.com/CVE-2026-77399/): icalendar: Denial of service via unbounded VALARM REPEAT expansion (medium 6.5)
- [CVE-2026-77396](https://insights.sbomify.com/CVE-2026-77396/): PJSIP: Heap buffer overflow in the AVI parser (medium 6.9)
- [CVE-2026-77394](https://insights.sbomify.com/CVE-2026-77394/): OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget (high 7.6)
- [CVE-2026-77393](https://insights.sbomify.com/CVE-2026-77393/): Inductive Automation Ignition Incorrect Default Permissions (high 8.7)
- [CVE-2026-77392](https://insights.sbomify.com/CVE-2026-77392/): SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP submit.php saveUser sql injection (medium 5.3)
- [CVE-2026-77391](https://insights.sbomify.com/CVE-2026-77391/): SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP cross-site request forgery (medium 5.3)
- [CVE-2026-7739](https://insights.sbomify.com/CVE-2026-7739/): justdan96 tsMuxer hevc.cpp setFPS denial of service (medium 4.8)
- [CVE-2026-77387](https://insights.sbomify.com/CVE-2026-77387/): geopy: Regular Expression Denial of Service (ReDoS) in geopy.Point (medium 4.0)
- [CVE-2026-77386](https://insights.sbomify.com/CVE-2026-77386/): Kyoo: OIDC login token can be redirected to an attacker-controlled URL (medium 6.5)
- [CVE-2026-77385](https://insights.sbomify.com/CVE-2026-77385/): Kyoo: Transcoder serves uncataloged files from the media directory (medium 4.3)
- [CVE-2026-77384](https://insights.sbomify.com/CVE-2026-77384/): libp2p: Circuit relay v2 server reservation refresh leaks abort listeners and allows remote resource exhaustion (high 7.5)
- [CVE-2026-7738](https://insights.sbomify.com/CVE-2026-7738/): puchunjie doc-tools-mcp MCP mcp-server.ts open_document path traversal (medium 5.3)
- [CVE-2026-77375](https://insights.sbomify.com/CVE-2026-77375/): SFTPGo: Denial of service via malformed SSH channel request (medium 6.5)
- [CVE-2026-77371](https://insights.sbomify.com/CVE-2026-77371/): Redash: DuckDB query runner allows arbitrary file read/write via unrestricted external access (critical 9.3)
- [CVE-2026-7737](https://insights.sbomify.com/CVE-2026-7737/): osrg GoBGP BMP Parser bmp.go BMPStatisticsReport.ParseBody out-of-bounds (medium 6.9)
- [CVE-2026-77368](https://insights.sbomify.com/CVE-2026-77368/): SeaweedFS: Authenticated Cross-Prefix IDOR in Filer TUS Handler Enables Arbitrary Write to Tenant-Forbidden Paths (high 7.6)
- [CVE-2026-77366](https://insights.sbomify.com/CVE-2026-77366/): obsidian-tc tokens can access arbitrary configured vaults (critical 9.9)
- [CVE-2026-77365](https://insights.sbomify.com/CVE-2026-77365/): Optimole <= 4.2.10 - Unauthenticated Stored Cross-Site Scripting via 'a' (above_fold_images) Parameter (high 7.2)
- [CVE-2026-77364](https://insights.sbomify.com/CVE-2026-77364/): obsidian-tc fail-open default ACL exposes Obsidian control-directory secrets (medium 6.5)
- [CVE-2026-77363](https://insights.sbomify.com/CVE-2026-77363/): obsidian-tc Streamable HTTP transport permits cross-origin loopback vault access (high 8.8)
- [CVE-2026-77362](https://insights.sbomify.com/CVE-2026-77362/): obsidian-tc bridge tools expose data outside the read ACL (medium 4.3)
- [CVE-2026-77361](https://insights.sbomify.com/CVE-2026-77361/): obsidian-tc symlink path mismatch bypasses read ACL restrictions (medium 4.7)
- [CVE-2026-77360](https://insights.sbomify.com/CVE-2026-77360/): oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass (medium 6.3)
- [CVE-2026-7736](https://insights.sbomify.com/CVE-2026-7736/): osrg GoBGP mrt.go parseRibEntry integer underflow (medium 6.9)
- [CVE-2026-77358](https://insights.sbomify.com/CVE-2026-77358/): cpp-httplib: Use-after-free of TLS session in WebSocketClient::shutdown_and_close() (high 8.2)
- [CVE-2026-77357](https://insights.sbomify.com/CVE-2026-77357/): Mesop: DoS in /hot-reload endpoint allows unauthenticated attacker to exhaust worker threads and crash the server (high 8.7)
- [CVE-2026-77354](https://insights.sbomify.com/CVE-2026-77354/): kin-openapi: Uncontrolled resource consumption in openapi3filter deepObject query parameter decoding (high 8.7)
- [CVE-2026-77353](https://insights.sbomify.com/CVE-2026-77353/): Wallos: iCalendar Injection via CRLF in Subscription Name/Notes Export (medium 4.6)
- [CVE-2026-77352](https://insights.sbomify.com/CVE-2026-77352/): Wallos: Authenticated SSRF via per-user SMTP notification host (low-privilege user) (medium 4.3)
- [CVE-2026-77351](https://insights.sbomify.com/CVE-2026-77351/): Wallos: SSRF via Unvalidated User-Level SMTP Host in Email Notification Settings (low 3.5)
- [CVE-2026-7735](https://insights.sbomify.com/CVE-2026-7735/): osrg GoBGP AIGP Attribute bgp.go PathAttributeAigp.DecodeFromBytes buffer overflow (medium 6.9)
- [CVE-2026-77348](https://insights.sbomify.com/CVE-2026-77348/): Server-side request forgery in Wallos (high 8.2)
- [CVE-2026-77341](https://insights.sbomify.com/CVE-2026-77341/): cpp-httplib: CRLF injection via unvalidated HTTP trailer headers in chunked response writing (medium 5.3)
- [CVE-2026-7734](https://insights.sbomify.com/CVE-2026-7734/): osrg GoBGP SRv6 L3 Service prefix_sid.go SRv6L3ServiceAttribute.DecodeFromBytes denial of service (medium 6.9)
- [CVE-2026-77339](https://insights.sbomify.com/CVE-2026-77339/): Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools (medium 5.1)
- [CVE-2026-77337](https://insights.sbomify.com/CVE-2026-77337/): CakePHP: Potential Authentication bypass with CookieAuthenticator (critical 9.1)
- [CVE-2026-7733](https://insights.sbomify.com/CVE-2026-7733/): funadmin Frontend Chunked Upload Endpoint UploadService.php chunkUpload unrestricted upload (medium 6.9)
- [CVE-2026-77322](https://insights.sbomify.com/CVE-2026-77322/): SIPGO: DoS via unvalidated WebSocket frame length (high 7.5)
- [CVE-2026-77321](https://insights.sbomify.com/CVE-2026-77321/): TREK MCP trip summary bypasses delegated OAuth read scopes (medium 4.3)
- [CVE-2026-77320](https://insights.sbomify.com/CVE-2026-77320/): Missing authorization in TREK (medium 5.3)
- [CVE-2026-7732](https://insights.sbomify.com/CVE-2026-7732/): code-projects BloodBank Managing System request_blood.php unrestricted upload (medium 5.3)
- [CVE-2026-77317](https://insights.sbomify.com/CVE-2026-77317/): SeaweedFS: SFTP path ACL literal prefix match permits cross-tenant file read and overwrite (high 8.1)
- [CVE-2026-77310](https://insights.sbomify.com/CVE-2026-77310/): jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization (medium 5.3)
- [CVE-2026-7731](https://insights.sbomify.com/CVE-2026-7731/): code-projects BloodBank Managing System get_state.php sql injection (medium 5.3)
- [CVE-2026-77301](https://insights.sbomify.com/CVE-2026-77301/): adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS) (high 7.5)
- [CVE-2026-7730](https://insights.sbomify.com/CVE-2026-7730/): privsim mcp-test-runner MCP index.ts child_process.spawn os command injection (medium 5.3)
- [CVE-2026-77298](https://insights.sbomify.com/CVE-2026-77298/): SeaweedFS S3 OIDC Bearer authentication bypasses IAM role trust policy (high 8.7)
- [CVE-2026-77294](https://insights.sbomify.com/CVE-2026-77294/): TREK: Server-Side Request Forgery via User-Configurable LLM Base URL (high 8.1)
- [CVE-2026-77293](https://insights.sbomify.com/CVE-2026-77293/): TREK: Cross-user note-file deletion (IDOR / Broken Access Control) (high 7.1)
- [CVE-2026-7729](https://insights.sbomify.com/CVE-2026-7729/): pixelsock directus-mcp MCP index.ts validateUrl server-side request forgery (medium 5.3)
- [CVE-2026-77285](https://insights.sbomify.com/CVE-2026-77285/): OpenBao Agent Writes Secrets to Stdout (low 2.4)
- [CVE-2026-77281](https://insights.sbomify.com/CVE-2026-77281/): Caddy: rewrite placeholder re-expansion (medium 6.5)
- [CVE-2026-7728](https://insights.sbomify.com/CVE-2026-7728/): ryanjoachim mcp-rtfm MCP update_doc path traversal (medium 5.3)
- [CVE-2026-77274](https://insights.sbomify.com/CVE-2026-77274/): MCP Atlassian: SSRF Protection Bypass (high 8.8)
- [CVE-2026-77272](https://insights.sbomify.com/CVE-2026-77272/): MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler (medium 5.4)
- [CVE-2026-77271](https://insights.sbomify.com/CVE-2026-77271/): MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of CVE-2026-27825) (high 8.3)
- [CVE-2026-77270](https://insights.sbomify.com/CVE-2026-77270/): MCP Atlassian: Arbitrary File Read via Upload Attachment Tools (medium 6.5)
- [CVE-2026-7727](https://insights.sbomify.com/CVE-2026-7727/): Shandong Hoteam Software PDM Product Data Management System DataService GetQueryMachineGridOnePageData sql injection (medium 6.9)
- [CVE-2026-77269](https://insights.sbomify.com/CVE-2026-77269/): MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read (incomplete fix for CVE-2026-27825) (medium 6.5)
- [CVE-2026-77268](https://insights.sbomify.com/CVE-2026-77268/): MCP Atlassian: Insecure File Permissions on OAuth Token Storage (medium 5.5)
- [CVE-2026-77267](https://insights.sbomify.com/CVE-2026-77267/): mcp-atlassian has an incomplete SSRF remediation (high 8.3)
- [CVE-2026-77266](https://insights.sbomify.com/CVE-2026-77266/): MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read and exfiltration via MCP tool call (medium 6.5)
- [CVE-2026-77265](https://insights.sbomify.com/CVE-2026-77265/): MCP Atlassian: SSRF via DNS Rebinding in Header-Based Authentication Flow (medium 5.9)
- [CVE-2026-77264](https://insights.sbomify.com/CVE-2026-77264/): Automation Web Platform <= 4.8.6 - Unauthenticated Authentication Bypass via 'otp_transient' Token Disclosure (critical 9.8)
- [CVE-2026-77263](https://insights.sbomify.com/CVE-2026-77263/): Cross-site scripting in iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more (high 7.2)
- [CVE-2026-77262](https://insights.sbomify.com/CVE-2026-77262/): MCP Atlassian: Path Traversal / Arbitrary File Read in confluence_upload_attachment MCP tool (incomplete fix of GHSA-xjgw-4wvw-rgm4) (high 8.6)
- [CVE-2026-77261](https://insights.sbomify.com/CVE-2026-77261/): MCP Atlassian: SSRF redirect protection missing for basic-auth and OAuth authentication branches (high 7.1)
- [CVE-2026-77260](https://insights.sbomify.com/CVE-2026-77260/): MCP Atlassian: Arbitrary local file READ via unconstrained file_path in upload_attachment (Confluence + Jira) (high 8.3)
- [CVE-2026-7726](https://insights.sbomify.com/CVE-2026-7726/): Missing authorization in Layouts for WPBakery (medium 6.5)
- [CVE-2026-77259](https://insights.sbomify.com/CVE-2026-77259/): MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentials (high 7.7)
- [CVE-2026-77258](https://insights.sbomify.com/CVE-2026-77258/): MCP Atlassian: Arbitrary file read/exfiltration via upload_attachment missing validate_safe_path() (high 7.7)
- [CVE-2026-77257](https://insights.sbomify.com/CVE-2026-77257/): MCP Atlassian: HTTP upload tools accept arbitrary server-local file paths (high 8.3)
- [CVE-2026-77256](https://insights.sbomify.com/CVE-2026-77256/): MCP Atlassian: OAuth refresh-token backup file is world-readable under default Unix umask (high 8.3)
- [CVE-2026-77255](https://insights.sbomify.com/CVE-2026-77255/): MCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update_issue (high 8.6)
- [CVE-2026-77254](https://insights.sbomify.com/CVE-2026-77254/): MCP Atlassian: Unauthenticated HTTP MCP requests can use globally configured Jira and Confluence credentials (critical 9.1)
- [CVE-2026-77253](https://insights.sbomify.com/CVE-2026-77253/): MCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local files (high 7.1)
- [CVE-2026-77252](https://insights.sbomify.com/CVE-2026-77252/): MCP Atlassian: JIRA_PROJECTS_FILTER and CONFLUENCE_SPACES_FILTER can be bypassed in search tools (medium 6.5)
- [CVE-2026-77251](https://insights.sbomify.com/CVE-2026-77251/): MCP Atlassian: JIRA_PROJECTS_FILTER / CONFLUENCE_SPACES_FILTER allow forbidden-project content exfiltration (one LIVE-proven on Atlassian Cloud) (high 8.3)
- [CVE-2026-77250](https://insights.sbomify.com/CVE-2026-77250/): MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissions (medium 6.1)
- [CVE-2026-7725](https://insights.sbomify.com/CVE-2026-7725/): PrefectHQ prefect GitRepository Pull storage.py argument injection (medium 5.3)
- [CVE-2026-77249](https://insights.sbomify.com/CVE-2026-77249/): MCP Atlassian: Incomplete fix for GHSA-7r34-79r5-rcc9: redirect-based SSRF via unhooked requests session in Jira user-permission lookup (medium 5.3)
- [CVE-2026-77248](https://insights.sbomify.com/CVE-2026-77248/): MCP Atlassian: Unauthenticated arbitrary local file read via upload_attachment file_path, chained with missing auth on streamable-http transport (high 8.6)
- [CVE-2026-77247](https://insights.sbomify.com/CVE-2026-77247/): MCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file_path parameters (high 8.3)
- [CVE-2026-77246](https://insights.sbomify.com/CVE-2026-77246/): MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path (high 7.4)
- [CVE-2026-77244](https://insights.sbomify.com/CVE-2026-77244/): [mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token (critical 10.0)
- [CVE-2026-77243](https://insights.sbomify.com/CVE-2026-77243/): MCP Atlassian: ENABLED_TOOLS / Toolset authorization bypass (high 8.8)
- [CVE-2026-77242](https://insights.sbomify.com/CVE-2026-77242/): MCP Atlassian: Incomplete fix for CVE-2026-27826: DNS rebinding bypasses SSRF validation (validated IP not pinned) (high 7.5)
- [CVE-2026-77240](https://insights.sbomify.com/CVE-2026-77240/): WACRM: Database-layer authorization bypasses (critical 9.9)
- [CVE-2026-7724](https://insights.sbomify.com/CVE-2026-7724/): PrefectHQ prefect Webhook/Notification validate_restricted_url toctou (low 2.3)
- [CVE-2026-77239](https://insights.sbomify.com/CVE-2026-77239/): WACRM: Service-role routes missing a role check (high 8.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/370/