# Vulnerabilities published in 2026


- [CVE-2026-75595](https://insights.sbomify.com/CVE-2026-75595/): Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext (critical 9.1)
- [CVE-2026-75594](https://insights.sbomify.com/CVE-2026-75594/): Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling (high 8.2)
- [CVE-2026-75593](https://insights.sbomify.com/CVE-2026-75593/): BuildKit: Malicious client can bypass destination directory validation on local sources upload (high 7.2)
- [CVE-2026-75592](https://insights.sbomify.com/CVE-2026-75592/): Kirby: Access to image files outside of the site root via path traversal in the media handling (medium 6.9)
- [CVE-2026-7559](https://insights.sbomify.com/CVE-2026-7559/): Affilia <= 3.3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Status Modification (medium 4.3)
- [CVE-2026-75589](https://insights.sbomify.com/CVE-2026-75589/): Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify. (high 7.5)
- [CVE-2026-75588](https://insights.sbomify.com/CVE-2026-75588/): Mattermost Desktop App plugin popout scheme validation bypass (low 2.6)
- [CVE-2026-75587](https://insights.sbomify.com/CVE-2026-75587/): Plaintext pre-auth secret exposure via Desktop App diagnostics report (low 3.6)
- [CVE-2026-75586](https://insights.sbomify.com/CVE-2026-75586/): Unlimited Elements For Elementor <= 2.0.17 - Reflected Cross-Site Scripting via 'formData[id]' Parameter (medium 6.1)
- [CVE-2026-75584](https://insights.sbomify.com/CVE-2026-75584/): ION-DTN < 4.2.1-a.1 Denial of Service via canonicalizePayloadBlock() Assertion (high 8.7)
- [CVE-2026-75583](https://insights.sbomify.com/CVE-2026-75583/): keeper.sh Calendar version prior to 2.18.14 SSRF Guard Bypass via DNS Rebinding (low 2.3)
- [CVE-2026-7558](https://insights.sbomify.com/CVE-2026-7558/): Missing authorization in Age Verification & Identity Verification by Token of Trust (medium 5.3)
- [CVE-2026-75575](https://insights.sbomify.com/CVE-2026-75575/): Rocket.Chat Missing DDP Rate Limit on the sendForgotPasswordEmail Meteor Method (medium 6.9)
- [CVE-2026-75574](https://insights.sbomify.com/CVE-2026-75574/): Grav before 4.2.2 Remote Code Execution via Email Twig (high 8.7)
- [CVE-2026-75573](https://insights.sbomify.com/CVE-2026-75573/): MongoDB Connector for BI mongodrdl Logs TLS Private-Key Password When Duplicate Options Are Supplied (medium 4.1)
- [CVE-2026-7557](https://insights.sbomify.com/CVE-2026-7557/): SAML authentication bypass in Progress MarkLogic Server (critical 9.1)
- [CVE-2026-75569](https://insights.sbomify.com/CVE-2026-75569/): Mce-operator-bundle: all github actions pinned by mutable tag, not commit sha (high 7.7)
- [CVE-2026-7556](https://insights.sbomify.com/CVE-2026-7556/): FV Flowplayer Video Player <= 7.5.49.7212 - Unauthenticated Stored Cross-Site Scripting via Comment Text (high 7.2)
- [CVE-2026-75559](https://insights.sbomify.com/CVE-2026-75559/): Information disclosure in Vehicle Inspection Certificate Viewer (for Android) (medium 6.9)
- [CVE-2026-75558](https://insights.sbomify.com/CVE-2026-75558/): Botslab G980H Dashcams Use of Hard-coded Cryptographic Key (medium 6.0)
- [CVE-2026-75554](https://insights.sbomify.com/CVE-2026-75554/): Explicit organization scopes survive token refresh after membership ends (low 2.3)
- [CVE-2026-75553](https://insights.sbomify.com/CVE-2026-75553/): Hardcoded credentials in Tohoku Electric Power "Yorisou e Net" Android App (low 2.4)
- [CVE-2026-7555](https://insights.sbomify.com/CVE-2026-7555/): itsourcecode Electronic Judging System login.php sql injection (medium 6.9)
- [CVE-2026-75548](https://insights.sbomify.com/CVE-2026-75548/): Ebyte NA111-M Improper Restriction of Rendered UI Layers or Frames (medium 5.3)
- [CVE-2026-75542](https://insights.sbomify.com/CVE-2026-75542/): OAuth token exchange grants repository scopes for organizations the principal cannot access (high 8.3)
- [CVE-2026-7554](https://insights.sbomify.com/CVE-2026-7554/): D-Link M60 httpd password recovery (medium 6.3)
- [CVE-2026-75538](https://insights.sbomify.com/CVE-2026-75538/): Integer overflow in OTP (high 8.2)
- [CVE-2026-75531](https://insights.sbomify.com/CVE-2026-75531/): Stored Cross-Site Scripting in URL Observables via Lookyloo Submission Handler in Pandora (high 7.0)
- [CVE-2026-7553](https://insights.sbomify.com/CVE-2026-7553/): code-projects Gym Management System edit_exercises.php sql injection (medium 5.1)
- [CVE-2026-75529](https://insights.sbomify.com/CVE-2026-75529/): Stored Cross-Site Scripting via MIME-Type Confusion in PDF Downloads of Pandora (medium 6.9)
- [CVE-2026-75528](https://insights.sbomify.com/CVE-2026-75528/): Broken Link Checker <= 2.4.13 - Unauthenticated Stored Cross-Site Scripting via Comment Author URL / Link Log (high 7.2)
- [CVE-2026-75526](https://insights.sbomify.com/CVE-2026-75526/): django CMS: Stored XSS in edit-mode plugin exception rendering (medium 4.4)
- [CVE-2026-75525](https://insights.sbomify.com/CVE-2026-75525/): OpenReception: unauthenticated ML-KEM key injection into the staff-crypto recipient directory in any tenant (medium 5.3)
- [CVE-2026-75524](https://insights.sbomify.com/CVE-2026-75524/): OpenReception: race condition in add-to-tunnel and create-new-client allows overlapping appointments for one agent (medium 5.4)
- [CVE-2026-75523](https://insights.sbomify.com/CVE-2026-75523/): Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secrets (medium 5.9)
- [CVE-2026-75520](https://insights.sbomify.com/CVE-2026-75520/): Domoticz: Missing authorization and path traversal in the udevices Lua parser handler (medium 5.4)
- [CVE-2026-7552](https://insights.sbomify.com/CVE-2026-7552/): Missing authorization in Geo Mashup (medium 5.3)
- [CVE-2026-75517](https://insights.sbomify.com/CVE-2026-75517/): Novu: Cross-Environment Integration Manipulation (IDOR) (medium 6.5)
- [CVE-2026-75516](https://insights.sbomify.com/CVE-2026-75516/): RabbitMQ Java client: Frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcement (high 8.7)
- [CVE-2026-75514](https://insights.sbomify.com/CVE-2026-75514/): BunkerWeb: rDNS bypass via missing forward-confirmation (FCrDNS) in blacklist, greylist, and antibot (medium 5.9)
- [CVE-2026-75513](https://insights.sbomify.com/CVE-2026-75513/): Marten: SQL injection in Marten's LINQ provider via unescaped string literals (critical 9.1)
- [CVE-2026-75511](https://insights.sbomify.com/CVE-2026-75511/): Novu: Server-Side Request Forgery (SSRF) via Chat Provider Webhook URLs (medium 5.3)
- [CVE-2026-75510](https://insights.sbomify.com/CVE-2026-75510/): Novu: Stored XSS in In-App Inbox via notification redirect.url javascript: scheme (medium 5.1)
- [CVE-2026-7551](https://insights.sbomify.com/CVE-2026-7551/): HKUDS OpenHarness Remote Command Execution via /bridge Slash Command (high 8.7)
- [CVE-2026-75509](https://insights.sbomify.com/CVE-2026-75509/): joserfc claim-validation bypass via array-typed single-string claims (iss/sub/jti) (medium 6.5)
- [CVE-2026-75508](https://insights.sbomify.com/CVE-2026-75508/): GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit (high 7.5)
- [CVE-2026-75507](https://insights.sbomify.com/CVE-2026-75507/): GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule (high 7.5)
- [CVE-2026-75505](https://insights.sbomify.com/CVE-2026-75505/): EspoCRM: Access control bypass in Mass Update letting regular user with Mass Update permission read any attachment (medium 6.0)
- [CVE-2026-7550](https://insights.sbomify.com/CVE-2026-7550/): SourceCodester Pharmacy Sales and Inventory System ajax.php save_customer sql injection (medium 6.9)
- [CVE-2026-75498](https://insights.sbomify.com/CVE-2026-75498/): Webkul QloApps SQL injection (high 8.6)
- [CVE-2026-75497](https://insights.sbomify.com/CVE-2026-75497/): Webkul QloApps SQL injection (high 8.6)
- [CVE-2026-75496](https://insights.sbomify.com/CVE-2026-75496/): Webkul QloApps improper file upload validation (high 8.6)
- [CVE-2026-7549](https://insights.sbomify.com/CVE-2026-7549/): SourceCodester Pharmacy Sales and Inventory System ajax.php delete_customer sql injection (medium 6.9)
- [CVE-2026-75486](https://insights.sbomify.com/CVE-2026-75486/): Synk Sweater Comb < 3.8.8 Command Injection via .vervet.yaml Branch Name (high 8.5)
- [CVE-2026-75485](https://insights.sbomify.com/CVE-2026-75485/): Must-gather: /tmp/kubeconfig retention (medium 5.5)
- [CVE-2026-75484](https://insights.sbomify.com/CVE-2026-75484/): HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit (medium 6.9)
- [CVE-2026-75483](https://insights.sbomify.com/CVE-2026-75483/): powerlevel10k Control Character Injection via package.json Version (medium 4.8)
- [CVE-2026-75482](https://insights.sbomify.com/CVE-2026-75482/): SWE-agent Trajectory Inspector Path Traversal File Disclosure (high 8.7)
- [CVE-2026-75481](https://insights.sbomify.com/CVE-2026-75481/): SkyPilot Authentication Bypass via Service Account Role Escalation (high 8.7)
- [CVE-2026-75480](https://insights.sbomify.com/CVE-2026-75480/): OpenViking Debug Vector Endpoints Multi-tenant Data Exposure (high 7.1)
- [CVE-2026-7548](https://insights.sbomify.com/CVE-2026-7548/): Totolink NR1800X cstecgi.cgi sub_41A68C command injection (high 8.7)
- [CVE-2026-75479](https://insights.sbomify.com/CVE-2026-75479/): JimuReport Unauthenticated Report Listing and Share Token Disclosure (high 8.7)
- [CVE-2026-75476](https://insights.sbomify.com/CVE-2026-75476/): Tanium addressed a compression bomb vulnerability in Threat Response. (low 3.1)
- [CVE-2026-7547](https://insights.sbomify.com/CVE-2026-7547/): Woosa <= 2.0.5 - Authenticated (Administrator+) Arbitrary File Read via 'log_file' Parameter (medium 4.9)
- [CVE-2026-75466](https://insights.sbomify.com/CVE-2026-75466/): libjpeg-turbo 3.2.0 contains an integer division-by-zero vulnerability in the PNG loader. (medium 6.5)
- [CVE-2026-75465](https://insights.sbomify.com/CVE-2026-75465/): The /api.php/user/get_list endpoint in Maccms v10 v2026.1000.4055 is vulnerable to an Incorrect Access Control issue. (high 7.5)
- [CVE-2026-75464](https://insights.sbomify.com/CVE-2026-75464/): OneNav 1.2.4 contains an authenticated arbitrary file deletion vulnerability via import_link(). (high 8.1)
- [CVE-2026-75460](https://insights.sbomify.com/CVE-2026-75460/): XueZhiSi Open Source Exam System <= 3.9.0 has a privilege escalation vulnerability in the teacher-end interface POST /api/teacher/user/page/list. (medium 6.5)
- [CVE-2026-7546](https://insights.sbomify.com/CVE-2026-7546/): Totolink NR1800X lighttpd find_host_ip stack-based overflow (critical 9.3)
- [CVE-2026-75458](https://insights.sbomify.com/CVE-2026-75458/): The teacher-end interface POST /api/teacher/user/delete/{id} in XueZhiSi Open Source Exam System <= 3.9.0 contains a vertical privilege escalatio vulnerability. (high 8.1)
- [CVE-2026-7545](https://insights.sbomify.com/CVE-2026-7545/): SourceCodester Advanced School Management System checkEmail Endpoint commonController.php sql injection (medium 6.9)
- [CVE-2026-7544](https://insights.sbomify.com/CVE-2026-7544/): Mux Video Uploader <= 1.1.4 - Authenticated (Subscriber+) Information Exposure (medium 4.3)
- [CVE-2026-75439](https://insights.sbomify.com/CVE-2026-75439/): An issue in Free5GC v.4.2.2 allows a remote attacker to cause a denial of service via the UPF component (high 7.5)
- [CVE-2026-75438](https://insights.sbomify.com/CVE-2026-75438/): Buffer Overflow vulnerability in Open5GS v2.7.7 allows a remote attacker to cause a denial of service via the ogs_sbi_time_parse() function (high 7.5)
- [CVE-2026-75432](https://insights.sbomify.com/CVE-2026-75432/): An issue in yaml-cpp 0.9.0 allows a remote attacker to obtain sensitive information via the src/scanner.cpp, Scanner::PopIndent(), and Scann (medium 5.1)
- [CVE-2026-75431](https://insights.sbomify.com/CVE-2026-75431/): PowerJob Server version 5.1.2 (and likely earlier) uses a predictable JWT signing key for HS256-based authentication. (critical 9.1)
- [CVE-2026-75430](https://insights.sbomify.com/CVE-2026-75430/): PowerJob Worker version 5.1.2 (and likely earlier versions) exposes the /worker/deployContainer HTTP endpoint without authentication on the (critical 9.8)
- [CVE-2026-7543](https://insights.sbomify.com/CVE-2026-7543/): Breakdance <= 2.7.1 - Unauthenticated Stored Cross-Site Scripting via Webhook Action Details (high 7.2)
- [CVE-2026-75429](https://insights.sbomify.com/CVE-2026-75429/): PowerJob versions 4.x through 5.1.2 contain an unauthenticated remote code execution vulnerability in the /friend/process endpoint of the Se (critical 9.8)
- [CVE-2026-75421](https://insights.sbomify.com/CVE-2026-75421/): aria2 <=1.37.0 has a stack-buffer-underflow vulnerability in the IOFile::getLine() function. (medium 4.0)
- [CVE-2026-7542](https://insights.sbomify.com/CVE-2026-7542/): Slider Revolution 7.0 - 7.0.10 - Authenticated (Subscriber+) Sensitive Information Disclosure (medium 6.5)
- [CVE-2026-75419](https://insights.sbomify.com/CVE-2026-75419/): go-wind-cms (GoWind) before 1.0.0 has a missing authorization vulnerability. (high 8.8)
- [CVE-2026-75418](https://insights.sbomify.com/CVE-2026-75418/): A path traversal vulnerability exists in the built-in preview/development web server of Lektor <3.3.14 on Windows. (high 7.5)
- [CVE-2026-75417](https://insights.sbomify.com/CVE-2026-75417/): A SQL injection vulnerability was found in YzmCMS 7.5. (high 7.2)
- [CVE-2026-75415](https://insights.sbomify.com/CVE-2026-75415/): AntFlow V2.0.0 is vulnerable to Incorrect Access Control. (high 7.5)
- [CVE-2026-75414](https://insights.sbomify.com/CVE-2026-75414/): In AntFlow V2.0.0, ActivitiTest.java enables users to execute JUEL expressions without filtering the user input, which leads to a command ex (critical 9.8)
- [CVE-2026-75413](https://insights.sbomify.com/CVE-2026-75413/): DocSys V2.02.80 is vulnerable to Any File Download. (high 7.5)
- [CVE-2026-75411](https://insights.sbomify.com/CVE-2026-75411/): JeecgBoot v3.9.2 is vulnerable to Remote command execution. (critical 9.8)
- [CVE-2026-7541](https://insights.sbomify.com/CVE-2026-7541/): Denial of service vulnerability in GitHub Enterprise Server allowed service disruption via unauthenticated API endpoint (medium 6.3)
- [CVE-2026-7539](https://insights.sbomify.com/CVE-2026-7539/): HP Dock Accessory WMI Provider Installer Security Update (high 7.3)
- [CVE-2026-7538](https://insights.sbomify.com/CVE-2026-7538/): Totolink A8000RU CGI cstecgi.cgi vulnerability os command injection (critical 9.3)
- [CVE-2026-75371](https://insights.sbomify.com/CVE-2026-75371/): An integer handling flaw in the cobs_decode function of SpaceDot AcubeSAT OBC software commit eaf90ec allows physically-proximate attackers (high 7.5)
- [CVE-2026-75370](https://insights.sbomify.com/CVE-2026-75370/): An out-of-bounds read/write vulnerability in the MessageParser::parseECSSTCHeader component of SpaceDot AcubeSAT OBC software commit eaf90ec (medium 6.5)
- [CVE-2026-7537](https://insights.sbomify.com/CVE-2026-7537/): File upload in MDJM Event Management (high 7.2)
- [CVE-2026-75369](https://insights.sbomify.com/CVE-2026-75369/): An out-of-bounds read vulnerability in the CAN::Application::parsePerformFunctionMessage component of SpaceDot AcubeSAT OBC software commit (high 7.1)
- [CVE-2026-75368](https://insights.sbomify.com/CVE-2026-75368/): A stack overflow in the loadRawData function of SpaceDot AcubeSAT OBC software commit eaf90ec allows attackers to cause a Denial of Service (high 7.5)
- [CVE-2026-75364](https://insights.sbomify.com/CVE-2026-75364/): Comfast CF-N1-S firmware 2.6.0.1 and CF-WR630AX (2024-01-30 build), the update_interface_png SET handler in /usr/bin/webmgnt fails to saniti (medium 6.8)
- [CVE-2026-75363](https://insights.sbomify.com/CVE-2026-75363/): An issue in Comfast CF-WR630AX v.2.7.0.2 allows a remote attacker to execute arbitrary code via the /usr/bin/webmgnt, /cgi-bin/mbox-config, (medium 6.8)
- [CVE-2026-7536](https://insights.sbomify.com/CVE-2026-7536/): Open5GS BSF pcfBindings bsf_sess_add_by_ip_address denial of service (medium 6.9)
- [CVE-2026-75357](https://insights.sbomify.com/CVE-2026-75357/): An issue in Bilibili Desktop v.1.17.9 allows a remote attacker to execute arbitrary code via the bili-inject.js and bili-bridge.js components. (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/385/