# Vulnerabilities published in 2026


- [CVE-2026-72816](https://insights.sbomify.com/CVE-2026-72816/): go-chi chi before 5.3.0 IP Spoofing via RealIP Middleware (medium 6.9)
- [CVE-2026-72815](https://insights.sbomify.com/CVE-2026-72815/): go-chi chi v5.2.1 IP Spoofing via X-Forwarded-For Header (medium 6.9)
- [CVE-2026-72814](https://insights.sbomify.com/CVE-2026-72814/): actix-files before 0.6.10 Information Disclosure via Files (medium 6.3)
- [CVE-2026-72813](https://insights.sbomify.com/CVE-2026-72813/): actix-files before 0.6.10 Denial of Service via empty Range header (medium 6.9)
- [CVE-2026-72812](https://insights.sbomify.com/CVE-2026-72812/): SiYuan before v3.7.4 Missing Authorization via refreshBacklink (medium 6.9)
- [CVE-2026-72811](https://insights.sbomify.com/CVE-2026-72811/): SiYuan before v3.7.4 SQL Injection via backlink search (critical 9.9)
- [CVE-2026-72810](https://insights.sbomify.com/CVE-2026-72810/): SiYuan before v3.7.4 Publish-Boundary Bypass via WebSocket (critical 9.2)
- [CVE-2026-7281](https://insights.sbomify.com/CVE-2026-7281/): SourceCodester Pharmacy Sales and Inventory System index.php supplier cross site scripting (medium 4.8)
- [CVE-2026-72809](https://insights.sbomify.com/CVE-2026-72809/): SiYuan before v3.7.4 Authentication Bypass via Localhost Trust (high 7.1)
- [CVE-2026-72808](https://insights.sbomify.com/CVE-2026-72808/): SiYuan before v3.7.4 Information Disclosure via getFileAnnotation (medium 6.9)
- [CVE-2026-72807](https://insights.sbomify.com/CVE-2026-72807/): SiYuan before v3.7.4 SQL Injection via queryBlocks template (high 8.8)
- [CVE-2026-72806](https://insights.sbomify.com/CVE-2026-72806/): SiYuan before v3.7.4 Authentication Bypass via Attribute View (medium 6.9)
- [CVE-2026-72805](https://insights.sbomify.com/CVE-2026-72805/): SiYuan before v3.7.4 Information Disclosure via Block Endpoints (medium 6.9)
- [CVE-2026-72804](https://insights.sbomify.com/CVE-2026-72804/): SiYuan before v3.7.4 Authentication Bypass via Graph Endpoints (critical 9.2)
- [CVE-2026-72803](https://insights.sbomify.com/CVE-2026-72803/): SiYuan before v3.7.4 Information Disclosure via getBlockAttrs (medium 6.9)
- [CVE-2026-72802](https://insights.sbomify.com/CVE-2026-72802/): SiYuan before v3.7.4 Information Disclosure via resolveAssetPath (medium 6.9)
- [CVE-2026-72801](https://insights.sbomify.com/CVE-2026-72801/): SiYuan before v3.7.4 Information Disclosure via Encryption Key Material (high 8.7)
- [CVE-2026-72800](https://insights.sbomify.com/CVE-2026-72800/): SiYuan before v3.7.4 Information Disclosure via Unfiltered API (medium 6.9)
- [CVE-2026-7280](https://insights.sbomify.com/CVE-2026-7280/): eMPIA Technology｜AVACAST - Unquoted Service Path (high 8.4)
- [CVE-2026-72799](https://insights.sbomify.com/CVE-2026-72799/): SiYuan before v3.7.4 Information Disclosure via Path Resolution (medium 6.9)
- [CVE-2026-72798](https://insights.sbomify.com/CVE-2026-72798/): SiYuan before v3.7.4 Information Disclosure via renderAttributeView (critical 9.2)
- [CVE-2026-72797](https://insights.sbomify.com/CVE-2026-72797/): SiYuan before v3.7.4 Information Disclosure via getEncryptedNotebookStatus (medium 6.9)
- [CVE-2026-72796](https://insights.sbomify.com/CVE-2026-72796/): SiYuan before v3.7.4 Access Control Bypass via Static Routes (medium 6.9)
- [CVE-2026-72795](https://insights.sbomify.com/CVE-2026-72795/): SiYuan before v3.7.4 Information Disclosure via Embed Block (critical 9.2)
- [CVE-2026-72794](https://insights.sbomify.com/CVE-2026-72794/): siyuan before v3.7.4 Session Cookie Key Disclosure via getConf (critical 9.2)
- [CVE-2026-72793](https://insights.sbomify.com/CVE-2026-72793/): SiYuan before v3.7.4 Information Disclosure via /api/system/getConf (critical 9.2)
- [CVE-2026-72792](https://insights.sbomify.com/CVE-2026-72792/): SiYuan before v3.7.4 Information Disclosure via Tag API (medium 6.9)
- [CVE-2026-72791](https://insights.sbomify.com/CVE-2026-72791/): SiYuan v3.7.4-alpha.1 Information Disclosure via getAttributeViewFieldViews (medium 6.9)
- [CVE-2026-72790](https://insights.sbomify.com/CVE-2026-72790/): SiYuan before v3.7.4 Information Disclosure via getNotebookInfo (medium 6.9)
- [CVE-2026-7279](https://insights.sbomify.com/CVE-2026-7279/): eMPIA Technology｜AVACAST - DLL Hijacking (high 8.5)
- [CVE-2026-72789](https://insights.sbomify.com/CVE-2026-72789/): SiYuan before v3.7.4 Authentication Bypass via Encrypted Notebooks (critical 9.2)
- [CVE-2026-72788](https://insights.sbomify.com/CVE-2026-72788/): SiYuan before v3.7.4 Information Disclosure via UILayout Filter (medium 6.9)
- [CVE-2026-72787](https://insights.sbomify.com/CVE-2026-72787/): Craft CMS 5.0.0-RC1 before 5.10.8 Stored XSS via Draft Name (medium 5.1)
- [CVE-2026-72786](https://insights.sbomify.com/CVE-2026-72786/): Craft CMS 5.0.0-RC1 before 5.10.8 Authentication Bypass via Password Reset (high 7.1)
- [CVE-2026-72785](https://insights.sbomify.com/CVE-2026-72785/): Craft CMS before 5.10.6 Authorization Bypass via structures/move-element (critical 9.3)
- [CVE-2026-72784](https://insights.sbomify.com/CVE-2026-72784/): Craft CMS 5.0.0-RC1 before 5.10.6 SSRF via GraphQL asset mutation (medium 6.9)
- [CVE-2026-72783](https://insights.sbomify.com/CVE-2026-72783/): Craft CMS 5.0.0-RC1 before 5.10.6 Path Traversal via ensurePathIsContained (medium 6.9)
- [CVE-2026-72782](https://insights.sbomify.com/CVE-2026-72782/): Craft CMS 5.0.0-RC1 before 5.10.6 Environment Variable Leak (high 7.1)
- [CVE-2026-72781](https://insights.sbomify.com/CVE-2026-72781/): Craft CMS 5.0.0-RC1 before 5.10.7 Remote Code Execution via Twig Sandbox Escape (high 8.7)
- [CVE-2026-72780](https://insights.sbomify.com/CVE-2026-72780/): Craft CMS before 5.10.5 WebAuthn Assertion Replay via login-with-passkey (high 7.1)
- [CVE-2026-72779](https://insights.sbomify.com/CVE-2026-72779/): Craft CMS 5.0.0-RC1 before 5.10.6 Arbitrary File Read via SplFileObject (high 8.7)
- [CVE-2026-72778](https://insights.sbomify.com/CVE-2026-72778/): Craft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.config (high 8.7)
- [CVE-2026-72777](https://insights.sbomify.com/CVE-2026-72777/): Next AI Draw.io 0.4.16 SSRF via DNS Rebinding in parse-url (high 7.7)
- [CVE-2026-72776](https://insights.sbomify.com/CVE-2026-72776/): AgenticSeek Unauthenticated RCE via /query API Endpoint (critical 9.3)
- [CVE-2026-72775](https://insights.sbomify.com/CVE-2026-72775/): n8n before 1.123.67 SQL Injection via PostgresTrigger Node (medium 5.8)
- [CVE-2026-72774](https://insights.sbomify.com/CVE-2026-72774/): n8n before 1.123.67 Authentication Bypass via HTTP Request Node (high 7.1)
- [CVE-2026-72773](https://insights.sbomify.com/CVE-2026-72773/): n8n before 2.32.1 Path Traversal via computer-use search_files (medium 4.9)
- [CVE-2026-72772](https://insights.sbomify.com/CVE-2026-72772/): n8n before 2.32.1 Authentication Bypass via Token Exchange (high 8.9)
- [CVE-2026-72771](https://insights.sbomify.com/CVE-2026-72771/): n8n before 2.32.1 Credential Restriction Bypass via AI/LLM Nodes (high 7.1)
- [CVE-2026-72770](https://insights.sbomify.com/CVE-2026-72770/): n8n before 1.123.67 Path Traversal via Git Node Operations (high 7.1)
- [CVE-2026-72769](https://insights.sbomify.com/CVE-2026-72769/): n8n before 1.123.67 Prototype Pollution via VM Expression Engine (medium 6.1)
- [CVE-2026-72768](https://insights.sbomify.com/CVE-2026-72768/): n8n before 2.32.1 SSRF Protection Bypass via MCP Client (medium 6.4)
- [CVE-2026-72767](https://insights.sbomify.com/CVE-2026-72767/): n8n before 1.123.67 Remote Code Execution via Git node (high 8.7)
- [CVE-2026-72766](https://insights.sbomify.com/CVE-2026-72766/): n8n before 1.123.67 Arbitrary File Read via Send Email Node (high 8.2)
- [CVE-2026-72765](https://insights.sbomify.com/CVE-2026-72765/): n8n before 2.32.1 Remote Code Execution via Expression Sandbox Escape (high 8.7)
- [CVE-2026-72764](https://insights.sbomify.com/CVE-2026-72764/): n8n before 1.123.67 Module Cache Poisoning via Code Node (medium 5.8)
- [CVE-2026-72763](https://insights.sbomify.com/CVE-2026-72763/): n8n before 1.123.67 Credential Exfiltration via Sub-Workflow (high 7.2)
- [CVE-2026-72762](https://insights.sbomify.com/CVE-2026-72762/): n8n before 1.123.67 Arbitrary File Write via Edit Image Node (high 7.7)
- [CVE-2026-72761](https://insights.sbomify.com/CVE-2026-72761/): Server-side request forgery in vulnerability-lookup (medium 6.9)
- [CVE-2026-72760](https://insights.sbomify.com/CVE-2026-72760/): cti-transmute Following List Exposes User Email Addresses to Authenticated Users (medium 5.3)
- [CVE-2026-72759](https://insights.sbomify.com/CVE-2026-72759/): cti-transmute Conversion History Authorization Bypass Leads to Sensitive Data Disclosure After Conversion Deletion (medium 6.9)
- [CVE-2026-72758](https://insights.sbomify.com/CVE-2026-72758/): Routinator may exit on malformed ranges (high 7.5)
- [CVE-2026-72757](https://insights.sbomify.com/CVE-2026-72757/): Routinator HTTP server becomes unavailable with many unclosed connections (medium 5.3)
- [CVE-2026-72756](https://insights.sbomify.com/CVE-2026-72756/): Routinator exits on malformed rsync URIs (high 7.5)
- [CVE-2026-72755](https://insights.sbomify.com/CVE-2026-72755/): Routinator stores TA certificate in cache without validation (low 3.8)
- [CVE-2026-72754](https://insights.sbomify.com/CVE-2026-72754/): Routinator exits when parsing an incorrect or very large CRL file (high 7.5)
- [CVE-2026-72753](https://insights.sbomify.com/CVE-2026-72753/): Routinator incorrectly handles delta updates (high 8.2)
- [CVE-2026-72752](https://insights.sbomify.com/CVE-2026-72752/): Routinator exits when requesting the output repeatedly (medium 6.5)
- [CVE-2026-72751](https://insights.sbomify.com/CVE-2026-72751/): Stored Cross-Site Scripting in CTI-Transmute Conversion Graph via Malicious STIX/MISP Content (medium 5.1)
- [CVE-2026-72750](https://insights.sbomify.com/CVE-2026-72750/): n8n before 1.123.67 SQL Injection via executeQuery Operation (medium 5.3)
- [CVE-2026-72749](https://insights.sbomify.com/CVE-2026-72749/): n8n before 1.123.67 Prototype Pollution via Edit Fields (high 7.1)
- [CVE-2026-72748](https://insights.sbomify.com/CVE-2026-72748/): AVideo Unauthenticated Arbitrary File Write via aVideoEncoderChunk.json.php (medium 6.9)
- [CVE-2026-72747](https://insights.sbomify.com/CVE-2026-72747/): AVideo Stored Cross-Site Scripting via Unauthenticated Registration (medium 5.1)
- [CVE-2026-72744](https://insights.sbomify.com/CVE-2026-72744/): Nuxt before 4.5.1 Information Disclosure via Chrome DevTools (medium 6.9)
- [CVE-2026-72743](https://insights.sbomify.com/CVE-2026-72743/): SQLBot 1.10.0 SQText Dashboard Component Stored XSS via v-html (medium 5.1)
- [CVE-2026-72742](https://insights.sbomify.com/CVE-2026-72742/): DSPy 3.3.0b1 Local File Read via Image/Audio Output Field Parsing (critical 9.2)
- [CVE-2026-72741](https://insights.sbomify.com/CVE-2026-72741/): Rainbond 6.9.7 Region API Cross-Enterprise IDOR via Tenant Access (high 8.6)
- [CVE-2026-72740](https://insights.sbomify.com/CVE-2026-72740/): Dokploy: OS Command Injection via SSH-form `customGitUrl` domain in `ssh-keyscan` (critical 9.9)
- [CVE-2026-72739](https://insights.sbomify.com/CVE-2026-72739/): Dokploy: Command Injection via Compose Shell Execution (medium 6.5)
- [CVE-2026-72738](https://insights.sbomify.com/CVE-2026-72738/): Dokploy: Authenticated RCE via Command Injection in backup.listBackupFiles search Parameter (critical 9.9)
- [CVE-2026-72737](https://insights.sbomify.com/CVE-2026-72737/): Dokploy: Cross-organization IDOR in Dokploy backup destinations exposes another tenant's S3 credentials and backups (critical 9.6)
- [CVE-2026-72736](https://insights.sbomify.com/CVE-2026-72736/): Dokploy: OS Command Injection in registry credential testing and Swarm cluster management → HOST RCE (critical 9.9)
- [CVE-2026-72735](https://insights.sbomify.com/CVE-2026-72735/): Command injection in dokploy (critical 9.9)
- [CVE-2026-72734](https://insights.sbomify.com/CVE-2026-72734/): Missing authorization in dokploy (high 8.4)
- [CVE-2026-72733](https://insights.sbomify.com/CVE-2026-72733/): Dokploy: OS Command Injection via `databaseName` / `backupFile` in database restore (critical 9.9)
- [CVE-2026-72732](https://insights.sbomify.com/CVE-2026-72732/): Discourse: Templates endpoint exposes hidden tag names (medium 4.3)
- [CVE-2026-72731](https://insights.sbomify.com/CVE-2026-72731/): Discourse: Strip SQL comments and use non-recursive parameter interpolation in Data Explorer (high 7.1)
- [CVE-2026-72730](https://insights.sbomify.com/CVE-2026-72730/): Discourse: Stored XSS chat-transcript username unescaped in Rich Text Editor (high 8.7)
- [CVE-2026-7273](https://insights.sbomify.com/CVE-2026-7273/): Zyxel GS1900 Series Switches Stack-Based Buffer Overflow (high 8.8, exploited in the wild)
- [CVE-2026-72729](https://insights.sbomify.com/CVE-2026-72729/): Discourse: Stored XSS in discourse-local-dates plugin (low 2.0)
- [CVE-2026-72728](https://insights.sbomify.com/CVE-2026-72728/): Discourse: Onebox iframe origin allowlist enforces URL authority boundary (medium 6.3)
- [CVE-2026-72727](https://insights.sbomify.com/CVE-2026-72727/): Discourse: Stored XSS in the moderation review queue (medium 4.8)
- [CVE-2026-72726](https://insights.sbomify.com/CVE-2026-72726/): Discourse: Unauthorized eavesdropping on private AI bot conversations. (medium 6.5)
- [CVE-2026-72725](https://insights.sbomify.com/CVE-2026-72725/): Discourse: Stored XSS in staff action logs injects staff UI (medium 5.4)
- [CVE-2026-72724](https://insights.sbomify.com/CVE-2026-72724/): Discourse: Private Chat Threat Message Disclosure via Chat Onebox Channel/Threat ID Mismatch (medium 4.3)
- [CVE-2026-72723](https://insights.sbomify.com/CVE-2026-72723/): Discourse: Anonymous sidebar serialization exposes descriptions of category-restricted tags (medium 5.3)
- [CVE-2026-72722](https://insights.sbomify.com/CVE-2026-72722/): Discourse: Duplicate lookup reveals restricted topic titles through canonicalized URLs (medium 4.3)
- [CVE-2026-72721](https://insights.sbomify.com/CVE-2026-72721/): Discourse: Onebox Domain Blocklist Bypass via Case-Sensitive Comparison (medium 5.3)
- [CVE-2026-72720](https://insights.sbomify.com/CVE-2026-72720/): Discourse: HTML injection in PrettyText.format_for_email from cooked-attribute reparsing (medium 6.4)
- [CVE-2026-7272](https://insights.sbomify.com/CVE-2026-7272/): WilliamCloudQi matlab-mcp-server MCP index.ts execute_matlab_code path traversal (medium 6.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/407/