# Vulnerabilities published in 2026


- [CVE-2026-72917](https://insights.sbomify.com/CVE-2026-72917/): AnythingLLM: Password recovery accepts one recovery code twice after whitespace normalization (medium 5.9)
- [CVE-2026-72916](https://insights.sbomify.com/CVE-2026-72916/): Mastodon: SSRF Protection Bypass via IPv4-compatible IPv6 Addresses (medium 6.3)
- [CVE-2026-72915](https://insights.sbomify.com/CVE-2026-72915/): Mastodon: Personally-identifying information disclosure due to incorrect access control validation (high 7.5)
- [CVE-2026-72914](https://insights.sbomify.com/CVE-2026-72914/): Mastodon: Exhausting data by an unauthenticated request to the admin retention API (high 7.5)
- [CVE-2026-72913](https://insights.sbomify.com/CVE-2026-72913/): Kitty: Command injection into the child shell via chained @kitty-echo + @kitty-ssh DCS escape sequences (high 7.3)
- [CVE-2026-72912](https://insights.sbomify.com/CVE-2026-72912/): CyberChef’s pretty-recipe parser vulnerable to client-side ReDoS / CPU exhaustion when parsing a malformed #recipe= URL (medium 4.3)
- [CVE-2026-72911](https://insights.sbomify.com/CVE-2026-72911/): ERPNext: Possibility of server-side template injection due to missing validation (critical 9.9)
- [CVE-2026-72910](https://insights.sbomify.com/CVE-2026-72910/): ERPNext: Unauthorised modification of master data due to missing validation (high 7.1)
- [CVE-2026-7291](https://insights.sbomify.com/CVE-2026-7291/): o2oa URL Fetching FileAction.java FileAction server-side request forgery (medium 5.3)
- [CVE-2026-72909](https://insights.sbomify.com/CVE-2026-72909/): ERPNext: Broken Access Control on certain endpoints (high 7.1)
- [CVE-2026-72908](https://insights.sbomify.com/CVE-2026-72908/): ERPNext: Possibility of SQL injection due to missing validation (medium 6.5)
- [CVE-2026-72907](https://insights.sbomify.com/CVE-2026-72907/): ERPNext: Broken Access Control on certain endpoint (medium 6.5)
- [CVE-2026-72906](https://insights.sbomify.com/CVE-2026-72906/): ERPNext: Unauthorised triggering of automated emails due to missing validation (medium 4.3)
- [CVE-2026-72904](https://insights.sbomify.com/CVE-2026-72904/): Firecrawl: Arbitrary file read via JSON Schema $ref expansion (critical 9.3)
- [CVE-2026-72903](https://insights.sbomify.com/CVE-2026-72903/): Tabby: Windows SFTP path traversal allows a malicious server to write files outside the selected download directory (high 8.1)
- [CVE-2026-72902](https://insights.sbomify.com/CVE-2026-72902/): Dokploy: Authenticated RCE via Command Injection in registry.testRegistry / registry.testRegistryById (critical 9.9)
- [CVE-2026-72901](https://insights.sbomify.com/CVE-2026-72901/): Dokploy: Remote Code Execution via volume-backup (critical 9.9)
- [CVE-2026-72900](https://insights.sbomify.com/CVE-2026-72900/): Metabase information exposure (high 7.1)
- [CVE-2026-7290](https://insights.sbomify.com/CVE-2026-7290/): JeecgBoot loadDict Endpoint SqlInjectionUtil.java SqlInjectionUtil sql injection (medium 5.3)
- [CVE-2026-72899](https://insights.sbomify.com/CVE-2026-72899/): Metabase SQL injection via public card or dashboard (critical 10.0)
- [CVE-2026-72898](https://insights.sbomify.com/CVE-2026-72898/): Metabase SQL Injection (critical 10.0, exploited in the wild)
- [CVE-2026-72897](https://insights.sbomify.com/CVE-2026-72897/): Out-of-Bounds Access After SSL_set_SSL_CTX() During a Handshake (high 7.5)
- [CVE-2026-72895](https://insights.sbomify.com/CVE-2026-72895/): Security feature bypass in SIMATIC IPC BX-21A (high 8.4)
- [CVE-2026-7289](https://insights.sbomify.com/CVE-2026-7289/): D-Link DIR-825M formWanConfigSetup sub_414BA8 buffer overflow (high 8.7)
- [CVE-2026-72889](https://insights.sbomify.com/CVE-2026-72889/): Net::OAuth versions before 0.33 for Perl allow the sender to choose the signature algorithm in verify (critical 9.8)
- [CVE-2026-72888](https://insights.sbomify.com/CVE-2026-72888/): Net::OAuth versions before 0.32 for Perl allow memory exhaustion via unbounded caching of failed module loads in smart_require. (medium 6.5)
- [CVE-2026-72887](https://insights.sbomify.com/CVE-2026-72887/): Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in get_request_token. (critical 9.8)
- [CVE-2026-72886](https://insights.sbomify.com/CVE-2026-72886/): Privilege escalation in dokploy (critical 9.9)
- [CVE-2026-72885](https://insights.sbomify.com/CVE-2026-72885/): Dokploy: Authenticated Command Injection in Dokploy Dockerfile Builder (not scored)
- [CVE-2026-72884](https://insights.sbomify.com/CVE-2026-72884/): Dokploy: Command Injection via Compose Custom Command (high 8.7)
- [CVE-2026-72883](https://insights.sbomify.com/CVE-2026-72883/): Dokploy: WebSocket Terminal Missing Service-Level Access Control (high 8.8)
- [CVE-2026-72882](https://insights.sbomify.com/CVE-2026-72882/): Dokploy: Authenticated blind command injection via file mounts leads to direct remote host RCE on managed servers (critical 9.9)
- [CVE-2026-72881](https://insights.sbomify.com/CVE-2026-72881/): Dokploy: Command Injection via database credentials in backup/restore commands (medium 6.4)
- [CVE-2026-72880](https://insights.sbomify.com/CVE-2026-72880/): Dokploy: Arbitrary File Write + Remote OS Command Injection via `certificatePath` (critical 9.9)
- [CVE-2026-7288](https://insights.sbomify.com/CVE-2026-7288/): D-Link DIR-825M formVpnConfigSetup sub_4151FC buffer overflow (high 8.7)
- [CVE-2026-72879](https://insights.sbomify.com/CVE-2026-72879/): Dokploy: Command Injection via Registry Credentials in Swarm Upload (critical 9.4)
- [CVE-2026-72878](https://insights.sbomify.com/CVE-2026-72878/): Dokploy: OS Command Injection in backup/restore pipeline via unescaped user-controlled shell arguments (critical 9.6)
- [CVE-2026-72877](https://insights.sbomify.com/CVE-2026-72877/): Dokploy: Command Injection via dockerImage in buildRemoteDocker (critical 9.6)
- [CVE-2026-72876](https://insights.sbomify.com/CVE-2026-72876/): Dokploy: Cross-organization IDOR leads to root RCE on another tenant's server via swarm.* (critical 9.9)
- [CVE-2026-72875](https://insights.sbomify.com/CVE-2026-72875/): Dokploy: Remote Code Execution (RCE) via Command Injection in settings.readTraefikFile (high 8.8)
- [CVE-2026-72874](https://insights.sbomify.com/CVE-2026-72874/): Dokploy: Command Injection via Unescaped Git URL in Clone Commands (high 8.7)
- [CVE-2026-72873](https://insights.sbomify.com/CVE-2026-72873/): Dokploy: Cross-tenant Git provider secrets are disclosed to low-privileged service readers via `application.one` (medium 6.5)
- [CVE-2026-72872](https://insights.sbomify.com/CVE-2026-72872/): Dokploy: OS Command Injection via Bitbucket `owner`/`repository` in `git clone` (critical 9.9)
- [CVE-2026-72871](https://insights.sbomify.com/CVE-2026-72871/): Dokploy: Unauthenticated Git Provider Injection via GitHub OAuth Callback (high 7.5)
- [CVE-2026-72870](https://insights.sbomify.com/CVE-2026-72870/): Dokploy: Command Injection via Docker Credentials in buildRemoteDocker (high 8.7)
- [CVE-2026-7287](https://insights.sbomify.com/CVE-2026-7287/): Memory corruption in NWA1100-N firmware (high 7.5)
- [CVE-2026-72869](https://insights.sbomify.com/CVE-2026-72869/): Dokploy: Authenticated OS command injection in backup.restoreBackupWithLogs (databaseName) leading to host RCE (critical 9.9)
- [CVE-2026-72868](https://insights.sbomify.com/CVE-2026-72868/): Dokploy: Member-role RCE as host root via destination.testConnection rclone shell injection (critical 9.9)
- [CVE-2026-72867](https://insights.sbomify.com/CVE-2026-72867/): Command injection in dokploy (critical 9.9)
- [CVE-2026-72866](https://insights.sbomify.com/CVE-2026-72866/): WebSocket Terminal Auth Bypass (high 8.8)
- [CVE-2026-72865](https://insights.sbomify.com/CVE-2026-72865/): Dokploy: OS Command Injection via compose `composePath` (critical 9.9)
- [CVE-2026-72864](https://insights.sbomify.com/CVE-2026-72864/): Dokploy Broken Access Control on docker-container-terminal WebSocket (Member -> Root in Arbitrary Containers) (critical 9.9)
- [CVE-2026-72863](https://insights.sbomify.com/CVE-2026-72863/): Dokploy: Missing authorization in WebSocket handlers allows a low-privilege member to gain root on the Docker host (critical 9.9)
- [CVE-2026-72862](https://insights.sbomify.com/CVE-2026-72862/): Dokploy: OS Command Injection via dockerImage field in database service deployment functions → HOST RCE (critical 9.9)
- [CVE-2026-72861](https://insights.sbomify.com/CVE-2026-72861/): Appwrite Templates github-issue-bot Skips Webhook Signature Verification When the X-Hub-Signature-256 Header Is Absent (medium 6.9)
- [CVE-2026-72860](https://insights.sbomify.com/CVE-2026-72860/): Server-side request forgery in 9router (medium 6.3)
- [CVE-2026-72859](https://insights.sbomify.com/CVE-2026-72859/): Budibase 3.39.4 before 3.40.0 Authorization Regression via S3 Presigned URL (high 8.3)
- [CVE-2026-72857](https://insights.sbomify.com/CVE-2026-72857/): Budibase before 3.40.0 Credential Exposure via STRING Fields (high 8.3)
- [CVE-2026-72856](https://insights.sbomify.com/CVE-2026-72856/): Budibase before 3.40.0 Authentication Bypass via Tenant Owner Email (high 8.6)
- [CVE-2026-72855](https://insights.sbomify.com/CVE-2026-72855/): Budibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and REST (high 8.4)
- [CVE-2026-72854](https://insights.sbomify.com/CVE-2026-72854/): msgpack-c Integer Overflow in msgpack_unpacker_expand_buffer Causes a False-Success Undersized Reservation (medium 5.8)
- [CVE-2026-72853](https://insights.sbomify.com/CVE-2026-72853/): Budibase before 3.40.0 SQL Injection via Oracle connector (high 8.8)
- [CVE-2026-72852](https://insights.sbomify.com/CVE-2026-72852/): darknet Integer Overflow in Convolutional Layer Buffer Sizing Leads to Heap Buffer Overflow (high 8.5)
- [CVE-2026-72851](https://insights.sbomify.com/CVE-2026-72851/): Budibase before 3.40.0 SQL Injection via Unauthenticated Webhook (critical 9.0)
- [CVE-2026-72850](https://insights.sbomify.com/CVE-2026-72850/): Budibase before 3.40.0 Arbitrary File Write via Path Traversal (critical 9.4)
- [CVE-2026-72849](https://insights.sbomify.com/CVE-2026-72849/): Budibase before 3.40.0 Identity Confusion via Chat-Link Handoff CSRF (high 8.7)
- [CVE-2026-72848](https://insights.sbomify.com/CVE-2026-72848/): Server-side request forgery in langchain-community (high 7.7)
- [CVE-2026-72847](https://insights.sbomify.com/CVE-2026-72847/): broot Terminal Escape Sequence Injection via Unsanitized File and Directory Names in the Tree View (low 2.4)
- [CVE-2026-72846](https://insights.sbomify.com/CVE-2026-72846/): Lightdash Scheduled Delivery Webhook URLs Are Not Validated, Allowing Server-Side Request Forgery (medium 5.3)
- [CVE-2026-72844](https://insights.sbomify.com/CVE-2026-72844/): Lean 4 Kernel Type Checking Bypass via Mismatched Structure Projections (medium 6.8)
- [CVE-2026-72843](https://insights.sbomify.com/CVE-2026-72843/): EverShop Missing Authorization on PATCH /api/customers/:id Allows Unauthenticated Account Takeover (critical 9.3)
- [CVE-2026-72842](https://insights.sbomify.com/CVE-2026-72842/): OpenWrt luci-app-lxc ACL Inconsistency Authentication Bypass (critical 9.4)
- [CVE-2026-72841](https://insights.sbomify.com/CVE-2026-72841/): luci-app-openvpn Path Traversal RCE via instance_name2 (critical 9.4)
- [CVE-2026-72840](https://insights.sbomify.com/CVE-2026-72840/): OpenWrt LuCI luci-mod-system-mounts ACL Root RCE via Crontab Write (high 8.7)
- [CVE-2026-7284](https://insights.sbomify.com/CVE-2026-7284/): Easy Elements for Elementor <= 1.4.4 - Unauthenticated Privilege Escalation via easyel_handle_register (critical 9.8)
- [CVE-2026-72839](https://insights.sbomify.com/CVE-2026-72839/): filebrowser through 2.63.16 Privilege Escalation via Signup (critical 9.3)
- [CVE-2026-72838](https://insights.sbomify.com/CVE-2026-72838/): FileBrowser before 2.63.19 Disk Exhaustion via TUS Upload (high 7.1)
- [CVE-2026-72837](https://insights.sbomify.com/CVE-2026-72837/): File Browser before 2.63.20 Privilege Escalation via Proxy Authentication (high 8.7)
- [CVE-2026-72836](https://insights.sbomify.com/CVE-2026-72836/): FileBrowser before 2.63.19 Case Sensitivity Authentication Bypass (critical 9.2)
- [CVE-2026-72835](https://insights.sbomify.com/CVE-2026-72835/): filebrowser before v2.63.21 Access Rule Bypass via Path Canonicalization (high 7.6)
- [CVE-2026-72834](https://insights.sbomify.com/CVE-2026-72834/): filebrowser before 2.63.19 Permission Bypass via checksum (medium 5.3)
- [CVE-2026-72833](https://insights.sbomify.com/CVE-2026-72833/): Grav 1.0.6 through 1.0.11 Privilege Escalation via Scoped API Keys (high 8.7)
- [CVE-2026-72832](https://insights.sbomify.com/CVE-2026-72832/): Grav before 2.0.13 Stored XSS via quoted-attribute bypass (medium 5.1)
- [CVE-2026-72831](https://insights.sbomify.com/CVE-2026-72831/): Grav through 2.0.11 Authentication Bypass via Flex Objects (high 8.7)
- [CVE-2026-72830](https://insights.sbomify.com/CVE-2026-72830/): Grav API Plugin before 1.0.13 RCE via ConfigController scope bypass (high 8.7)
- [CVE-2026-7283](https://insights.sbomify.com/CVE-2026-7283/): SourceCodester Pharmacy Sales and Inventory System ajax.php save_expired sql injection (medium 5.1)
- [CVE-2026-72829](https://insights.sbomify.com/CVE-2026-72829/): Grav before 1.0.13 API Key Scope Bypass via UsersController (high 8.7)
- [CVE-2026-72828](https://insights.sbomify.com/CVE-2026-72828/): Grav before 1.0.13 API Key Scope Bypass via InvitationsController (high 8.6)
- [CVE-2026-72827](https://insights.sbomify.com/CVE-2026-72827/): Grav CMS before 2.0.13 Remote Code Execution via Twig (high 8.7)
- [CVE-2026-72826](https://insights.sbomify.com/CVE-2026-72826/): Grav API Plugin before 1.0.13 Scope Bypass via createApiKey (high 8.7)
- [CVE-2026-72825](https://insights.sbomify.com/CVE-2026-72825/): Grav API Plugin before 1.0.13 API-key scope cap bypass via ReportsController (high 7.2)
- [CVE-2026-72824](https://insights.sbomify.com/CVE-2026-72824/): Grav before 1.0.13 API Key Scope Bypass via PagesController (high 8.7)
- [CVE-2026-72823](https://insights.sbomify.com/CVE-2026-72823/): Grav before 1.0.13 API-key scope cap bypass via DemoController (medium 5.3)
- [CVE-2026-72822](https://insights.sbomify.com/CVE-2026-72822/): Grav before 1.0.13 Authentication Bypass via disable2fa (high 8.7)
- [CVE-2026-72821](https://insights.sbomify.com/CVE-2026-72821/): Grav Form Plugin before 9.1.15 Stored XSS via Radio Toggle (medium 5.1)
- [CVE-2026-72820](https://insights.sbomify.com/CVE-2026-72820/): Grav 2.0.11 Path Traversal via Backup Profile Configuration (medium 6.9)
- [CVE-2026-7282](https://insights.sbomify.com/CVE-2026-7282/): SourceCodester Pharmacy Sales and Inventory System ajax.php delete_expired sql injection (medium 5.1)
- [CVE-2026-72819](https://insights.sbomify.com/CVE-2026-72819/): Grav CMS before 2.0.13 Remote Code Execution via ZIP Upload (high 8.7)
- [CVE-2026-72818](https://insights.sbomify.com/CVE-2026-72818/): NLTK TweetTokenizer URL Pattern Backtracks Catastrophically on Naked-Domain-Like Input (high 8.7)
- [CVE-2026-72817](https://insights.sbomify.com/CVE-2026-72817/): go-chi chi 0.9.0 before 5.3.0 IP Spoofing via X-Forwarded-For (medium 6.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/406/