# Vulnerabilities published in 2026


- [CVE-2026-73253](https://insights.sbomify.com/CVE-2026-73253/): Mongoose: TLS Hostname Verification Bypass via Overly Permissive Wildcard Matching (critical 9.1)
- [CVE-2026-73252](https://insights.sbomify.com/CVE-2026-73252/): Memory corruption in mongoose (high 7.5)
- [CVE-2026-73251](https://insights.sbomify.com/CVE-2026-73251/): Mongoose Built-in TLS: CA-bundle certificate chain accepted without any signature verification (critical 9.3)
- [CVE-2026-73250](https://insights.sbomify.com/CVE-2026-73250/): Notepad++: Install-time PowerShell command injection through installation path (medium 5.4)
- [CVE-2026-7325](https://insights.sbomify.com/CVE-2026-7325/): Server-side request forgery in Server (high 7.1)
- [CVE-2026-73249](https://insights.sbomify.com/CVE-2026-73249/): Missing authorization in calibre (high 7.5)
- [CVE-2026-73248](https://insights.sbomify.com/CVE-2026-73248/): calibre: Bypass of Python template restrictions via nested `template()` leading to RCE (high 8.5)
- [CVE-2026-73247](https://insights.sbomify.com/CVE-2026-73247/): Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata (high 8.6)
- [CVE-2026-73246](https://insights.sbomify.com/CVE-2026-73246/): Kestra: Unauthenticated management `/worker` endpoint exposes live task configuration and plaintext credentials (high 7.5)
- [CVE-2026-73245](https://insights.sbomify.com/CVE-2026-73245/): Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-auth (medium 6.5)
- [CVE-2026-73244](https://insights.sbomify.com/CVE-2026-73244/): kkFileView: Unauthenticated path traversal in POST /listFiles allows arbitrary directory listing (medium 5.3)
- [CVE-2026-73243](https://insights.sbomify.com/CVE-2026-73243/): kkFileView: Unauthenticated SSRF via /addTask with fullfilename type-confusion bypass (medium 5.8)
- [CVE-2026-73242](https://insights.sbomify.com/CVE-2026-73242/): FreeRDP: Kerberos GSS Wrap-token `EC` field is unbounded, causing an out-of-bounds decrypt in `kerberos_DecryptMessage` (high 8.3)
- [CVE-2026-73241](https://insights.sbomify.com/CVE-2026-73241/): Auth bypass in FreeRDP (high 8.3)
- [CVE-2026-73240](https://insights.sbomify.com/CVE-2026-73240/): Apache Allura: Git command injection (critical 9.8)
- [CVE-2026-7324](https://insights.sbomify.com/CVE-2026-7324/): Memory safety bugs fixed in Thunderbird 150.0.1 (high 7.3)
- [CVE-2026-73239](https://insights.sbomify.com/CVE-2026-73239/): Apache Allura: Missing permission checks IDOR (medium 6.5)
- [CVE-2026-73238](https://insights.sbomify.com/CVE-2026-73238/): Apache Allura: XSS in code display (medium 6.1)
- [CVE-2026-73237](https://insights.sbomify.com/CVE-2026-73237/): Apache Allura: XSS in markdown pipeline (medium 6.1)
- [CVE-2026-73236](https://insights.sbomify.com/CVE-2026-73236/): Apache Syncope: Cross-Realm authorization bypass in delegated administration (high 7.5)
- [CVE-2026-73235](https://insights.sbomify.com/CVE-2026-73235/): FreeCAD: XXE file read and SSRF via external entity injection in Document.xml SAX parser (medium 6.1)
- [CVE-2026-73234](https://insights.sbomify.com/CVE-2026-73234/): Path traversal in FreeCAD (high 7.8)
- [CVE-2026-73233](https://insights.sbomify.com/CVE-2026-73233/): FreeCAD: FEM formula incomplete escape (high 8.5)
- [CVE-2026-73232](https://insights.sbomify.com/CVE-2026-73232/): ffuf denial of service (OOM) via HTTP response decompression bomb (high 7.5)
- [CVE-2026-73231](https://insights.sbomify.com/CVE-2026-73231/): Faker: helpers.fake exploitable into arbritary code execution (high 7.8)
- [CVE-2026-73230](https://insights.sbomify.com/CVE-2026-73230/): Ente: 2of3 cards v1 contain a checksum that enables offline guessing of low-entropy secrets (medium 5.9)
- [CVE-2026-7323](https://insights.sbomify.com/CVE-2026-7323/): Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1 (high 7.3)
- [CVE-2026-73229](https://insights.sbomify.com/CVE-2026-73229/): Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests (medium 4.3)
- [CVE-2026-73228](https://insights.sbomify.com/CVE-2026-73228/): Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data` (medium 5.3)
- [CVE-2026-73227](https://insights.sbomify.com/CVE-2026-73227/): electerm's RDP clipboard file download may parse unsafe file name (high 8.1)
- [CVE-2026-73226](https://insights.sbomify.com/CVE-2026-73226/): Code injection in electerm (high 8.8)
- [CVE-2026-73225](https://insights.sbomify.com/CVE-2026-73225/): electerm: Path traversal in FTP/SFTP recursive folder download via unsanitized server filename (high 8.1)
- [CVE-2026-73224](https://insights.sbomify.com/CVE-2026-73224/): Electerm check folder size function may get attacked by unsafe folder name (high 8.8)
- [CVE-2026-73223](https://insights.sbomify.com/CVE-2026-73223/): electerm: Path traversal in editWithSystemEditor temp file path via unsanitized SFTP filename (high 8.1)
- [CVE-2026-73222](https://insights.sbomify.com/CVE-2026-73222/): Claude Code Templates: Unauthenticated OS command injection (RCE) in Claude Code Studio server (--studio) (high 8.8)
- [CVE-2026-73221](https://insights.sbomify.com/CVE-2026-73221/): CVAT: Flawed authorization logic in endpoints related to lambda requests (medium 5.3)
- [CVE-2026-73220](https://insights.sbomify.com/CVE-2026-73220/): CVAT: Stored XSS via annotation guides in audio tasks (high 8.5)
- [CVE-2026-7322](https://insights.sbomify.com/CVE-2026-7322/): Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1 (high 7.3)
- [CVE-2026-73219](https://insights.sbomify.com/CVE-2026-73219/): CVAT: Denial of service with regards to automatic annotation (medium 5.3)
- [CVE-2026-73218](https://insights.sbomify.com/CVE-2026-73218/): Cursor: Sandbox escape via launching privileged containers (high 7.7)
- [CVE-2026-73217](https://insights.sbomify.com/CVE-2026-73217/): Cursor: Sandbox escape via tampered Python virtual environments (high 7.7)
- [CVE-2026-73216](https://insights.sbomify.com/CVE-2026-73216/): coturn: mobility disconnects bypass allocation quotas and exhaust relay capacity (medium 6.5)
- [CVE-2026-73215](https://insights.sbomify.com/CVE-2026-73215/): The coturn server can end in a state where it does not accept more requests with "even-port" enabled. (high 7.1)
- [CVE-2026-73214](https://insights.sbomify.com/CVE-2026-73214/): Denial of service in coturn (high 8.2)
- [CVE-2026-73213](https://insights.sbomify.com/CVE-2026-73213/): Server-side request forgery in coturn (medium 5.8)
- [CVE-2026-73212](https://insights.sbomify.com/CVE-2026-73212/): Server-side request forgery in coturn (medium 5.8)
- [CVE-2026-73211](https://insights.sbomify.com/CVE-2026-73211/): PeerTube: Unauthenticated remote SQL injection in ActorFollowModel.updateScore() (critical 9.8)
- [CVE-2026-73210](https://insights.sbomify.com/CVE-2026-73210/): Server-Side Request Forgery via Favicon Retrieval in Lookyloo PlaywrightCapture (medium 5.1)
- [CVE-2026-7321](https://insights.sbomify.com/CVE-2026-7321/): Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component (critical 9.6)
- [CVE-2026-73209](https://insights.sbomify.com/CVE-2026-73209/): Denial of service in OX Dovecot CE (medium 6.5)
- [CVE-2026-73208](https://insights.sbomify.com/CVE-2026-73208/): Auth bypass in OX Dovecot CE (high 7.4)
- [CVE-2026-7320](https://insights.sbomify.com/CVE-2026-7320/): Information disclosure due to incorrect boundary conditions in the Audio/Video component (high 7.5)
- [CVE-2026-73199](https://insights.sbomify.com/CVE-2026-73199/): Ipa: freeipa: null pointer dereference in `ipa-enrollment` extended operation (`join_oid`) via missing request value (medium 6.5)
- [CVE-2026-73198](https://insights.sbomify.com/CVE-2026-73198/): Ipa: freeipa: unauthenticated dos in `/ipa/i18n_messages` via unbounded request body read (high 7.5)
- [CVE-2026-73197](https://insights.sbomify.com/CVE-2026-73197/): Ipa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body read (high 7.5)
- [CVE-2026-73196](https://insights.sbomify.com/CVE-2026-73196/): Ipa: freeipa: authenticated dos in `otptoken-add` via unbounded otp key decoding/re-encoding (medium 4.3)
- [CVE-2026-73195](https://insights.sbomify.com/CVE-2026-73195/): Apache Syncope: CSV export spreadsheet formula injection (high 7.3)
- [CVE-2026-73194](https://insights.sbomify.com/CVE-2026-73194/): DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in preparse. (critical 9.1)
- [CVE-2026-73193](https://insights.sbomify.com/CVE-2026-73193/): DBI versions before 1.652 for Perl allow a heap out-of-bounds write on 32-bit perl via an integer wraparound in the output buffer size computed by preparse. (critical 9.8)
- [CVE-2026-73192](https://insights.sbomify.com/CVE-2026-73192/): Apache Sling XSS: XSS possible through XSSAPI.getValidHref() (medium 6.1)
- [CVE-2026-73191](https://insights.sbomify.com/CVE-2026-73191/): Apache Syncope: CAS service URL injection via Forwarded HTTP headers (medium 6.1)
- [CVE-2026-73190](https://insights.sbomify.com/CVE-2026-73190/): WordPress WPDM – Premium Packages plugin <= 7.0.5 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-7319](https://insights.sbomify.com/CVE-2026-7319/): elinsky execution-system-mcp add_action Tool server.py _get_context_file_path path traversal (medium 6.9)
- [CVE-2026-73187](https://insights.sbomify.com/CVE-2026-73187/): WordPress Sticky Chat Widget plugin <= 1.4.2 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-73185](https://insights.sbomify.com/CVE-2026-73185/): WordPress NGG Smart Image Search plugin < 4.0.0 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-73184](https://insights.sbomify.com/CVE-2026-73184/): WordPress Global Gallery plugin <= 11.1.2 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-73183](https://insights.sbomify.com/CVE-2026-73183/): WordPress Maps Marker Pro plugin <= 4.32 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-73182](https://insights.sbomify.com/CVE-2026-73182/): WordPress BBQ Pro plugin <= 3.9 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-73181](https://insights.sbomify.com/CVE-2026-73181/): WordPress Extra Product Options & Add-Ons for WooCommerce plugin < 7.6 - Arbitrary File Download vulnerability (high 7.5)
- [CVE-2026-73180](https://insights.sbomify.com/CVE-2026-73180/): Apache Tomcat: Authenticated WebSocket session survives end of HTTP session (medium 6.8)
- [CVE-2026-7318](https://insights.sbomify.com/CVE-2026-7318/): elie mcp-project research_server.py search_papers path traversal (medium 5.1)
- [CVE-2026-73179](https://insights.sbomify.com/CVE-2026-73179/): Apache CXF: JPA authorization-code consume is non-atomic (high 8.1)
- [CVE-2026-73178](https://insights.sbomify.com/CVE-2026-73178/): Apache Syncope: JWT Access Token takeover (high 7.5)
- [CVE-2026-73177](https://insights.sbomify.com/CVE-2026-73177/): Security feature bypass in EKI-1242EIMS (high 8.6)
- [CVE-2026-73176](https://insights.sbomify.com/CVE-2026-73176/): Command injection in EKI-1242EIMS (high 8.6)
- [CVE-2026-73175](https://insights.sbomify.com/CVE-2026-73175/): Denial of service in EKI-1242EIMS (high 7.1)
- [CVE-2026-73174](https://insights.sbomify.com/CVE-2026-73174/): Information disclosure in EKI-1242EIMS (high 8.7)
- [CVE-2026-73173](https://insights.sbomify.com/CVE-2026-73173/): Missing authorization in EKI-1242EIMS (high 8.8)
- [CVE-2026-73172](https://insights.sbomify.com/CVE-2026-73172/): Command injection in EKI-1242EIMS (critical 9.3)
- [CVE-2026-73171](https://insights.sbomify.com/CVE-2026-73171/): Path traversal in EKI-1242EIMS (high 8.6)
- [CVE-2026-73170](https://insights.sbomify.com/CVE-2026-73170/): Code injection in EKI-1242EIMS (high 8.6)
- [CVE-2026-7317](https://insights.sbomify.com/CVE-2026-7317/): Grav CMS Cache Value FileCache.php doGet deserialization (low 2.3)
- [CVE-2026-73169](https://insights.sbomify.com/CVE-2026-73169/): Cross-site scripting in EKI-1242EIMS (medium 6.3)
- [CVE-2026-73167](https://insights.sbomify.com/CVE-2026-73167/): Command injection in EKI-1242EIMS (high 8.6)
- [CVE-2026-73166](https://insights.sbomify.com/CVE-2026-73166/): Code injection in EKI-1242EIMS (high 8.6)
- [CVE-2026-73165](https://insights.sbomify.com/CVE-2026-73165/): Command injection in EKI-1242EIMS (high 8.6)
- [CVE-2026-73164](https://insights.sbomify.com/CVE-2026-73164/): Command injection in EKI-1242EIMS (high 8.6)
- [CVE-2026-73163](https://insights.sbomify.com/CVE-2026-73163/): Command injection in EKI-1242EIMS (high 8.6)
- [CVE-2026-73162](https://insights.sbomify.com/CVE-2026-73162/): cti-transmute CSRF Allows Unauthorized Follow and Notification State Changes (medium 5.3)
- [CVE-2026-73161](https://insights.sbomify.com/CVE-2026-73161/): cti-transmute Conversion Table Allows XSS via Unescaped Cell Content During Search Highlighting (medium 5.1)
- [CVE-2026-73160](https://insights.sbomify.com/CVE-2026-73160/): cti-transmute Unauthenticated SSRF via Hostnames Resolving to Internal IP Addresses (high 8.7)
- [CVE-2026-7316](https://insights.sbomify.com/CVE-2026-7316/): eiliyaabedini aider-mcp code_with_ai aider_mcp.py command injection (medium 6.9)
- [CVE-2026-73159](https://insights.sbomify.com/CVE-2026-73159/): cti-transmute Stored XSS via Crafted Tag Icon on Admin Triage Interface (medium 5.1)
- [CVE-2026-73158](https://insights.sbomify.com/CVE-2026-73158/): cti-transmute Saved Graph Configuration Allows Stored Cross-Site Scripting via svgIcon (medium 5.1)
- [CVE-2026-73157](https://insights.sbomify.com/CVE-2026-73157/): cti-transmute Remote MISP Event Browser Allows Cross-Site Scripting via Malicious Event Metadata (low 2.3)
- [CVE-2026-73156](https://insights.sbomify.com/CVE-2026-73156/): cti-transmute Sunburst and Treemap Tooltips Allow Cross-Site Scripting via Crafted Conversion Data (medium 5.3)
- [CVE-2026-73155](https://insights.sbomify.com/CVE-2026-73155/): cti-transmute Missing Authorization Allows Reactions to Private Comments (medium 5.3)
- [CVE-2026-7315](https://insights.sbomify.com/CVE-2026-7315/): eiceblue spire-pdf-mcp-server PDF File server.py get_pdf_path path traversal (medium 6.9)
- [CVE-2026-73140](https://insights.sbomify.com/CVE-2026-73140/): cti-transmute Evaluation Report Exports Expose Private Comments and Author Information (medium 5.3)
- [CVE-2026-7314](https://insights.sbomify.com/CVE-2026-7314/): eiceblue spire-doc-mcp-server base.py get_doc_path path traversal (medium 6.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/403/