# Vulnerabilities published in 2026


- [CVE-2026-72719](https://insights.sbomify.com/CVE-2026-72719/): Chatwoot: Cross-Account Resource Transfer via `account_id` Parameter (medium 6.7)
- [CVE-2026-72718](https://insights.sbomify.com/CVE-2026-72718/): goose: Arbitrary command execution in goose CLI via `goose review` via git core.fsmonitor (high 7.0)
- [CVE-2026-72717](https://insights.sbomify.com/CVE-2026-72717/): Orval: Import-time RCE via schema default -> zod module-level template literal (critical 9.3)
- [CVE-2026-72716](https://insights.sbomify.com/CVE-2026-72716/): Orval: Import-time RCE via query-parameter default -> zod module-level template literal (critical 9.3)
- [CVE-2026-72714](https://insights.sbomify.com/CVE-2026-72714/): Rocq Prover through 9.2.0 Universe Checking State Desynchronised After Module Close (medium 6.8)
- [CVE-2026-72713](https://insights.sbomify.com/CVE-2026-72713/): XAgent Path Traversal Arbitrary File Read via /workspace/file (high 8.7)
- [CVE-2026-72712](https://insights.sbomify.com/CVE-2026-72712/): Nmap 7.99 Denial of Service via Zero-Length TCP Option Packet (medium 6.9)
- [CVE-2026-72711](https://insights.sbomify.com/CVE-2026-72711/): Lean 4 before 4.32.2 Kernel Accepts Opaque Declaration With an Unbound Free Variable (medium 6.8)
- [CVE-2026-72710](https://insights.sbomify.com/CVE-2026-72710/): SPIP < 4.4.18 RCE via editer_objet.php Job Queue Injection (critical 9.3)
- [CVE-2026-7271](https://insights.sbomify.com/CVE-2026-7271/): DV0x creative-ad-agent creative-ad-agent-server sdk-server.ts path traversal (medium 6.9)
- [CVE-2026-72709](https://insights.sbomify.com/CVE-2026-72709/): SPIP < 4.4.18 Missing Authorization via ecrire/action/ (critical 9.3)
- [CVE-2026-72708](https://insights.sbomify.com/CVE-2026-72708/): SPIP < 4.4.18 Unauthenticated Blind SQL Injection via sitemap.xml.html (high 8.7)
- [CVE-2026-72705](https://insights.sbomify.com/CVE-2026-72705/): Rocq Prover before 9.2.0 Guard Checker Accepts Fixpoint Passed as a Higher-Order Argument (medium 6.8)
- [CVE-2026-72704](https://insights.sbomify.com/CVE-2026-72704/): Rocq Prover through 9.2.0 Guard Checker Trusts Corrupted Recursive Tree After Transport (medium 6.8)
- [CVE-2026-72703](https://insights.sbomify.com/CVE-2026-72703/): Rocq Prover 8.20 before 9.2.0 Guard Checker Accepts Non-Terminating Fixpoint via Unchecked Cross-Calls (medium 6.8)
- [CVE-2026-72702](https://insights.sbomify.com/CVE-2026-72702/): Grav CMS before 2.0.16 Origin Validation Bypass via Referer (critical 9.3)
- [CVE-2026-72701](https://insights.sbomify.com/CVE-2026-72701/): Grav CMS before 2.0.16 Timing Attack via verifyNonce (medium 6.3)
- [CVE-2026-72700](https://insights.sbomify.com/CVE-2026-72700/): Grav before 3.9.1 Timing Attack via Non-Constant-Time Token Comparison (high 8.7)
- [CVE-2026-7270](https://insights.sbomify.com/CVE-2026-7270/): Local privilege escalation via execve() (high 7.8)
- [CVE-2026-72699](https://insights.sbomify.com/CVE-2026-72699/): Grav Login Plugin before 3.9.1 Email Enumeration via Registration (critical 9.3)
- [CVE-2026-72698](https://insights.sbomify.com/CVE-2026-72698/): Grav CMS before 2.0.16 Information Disclosure via Twig Sandbox Bypass (high 7.1)
- [CVE-2026-72697](https://insights.sbomify.com/CVE-2026-72697/): Grav CMS before 2.0.16 Path Traversal via media_directory (high 7.1)
- [CVE-2026-72696](https://insights.sbomify.com/CVE-2026-72696/): Grav CMS before 2.0.16 Symlink Following via createLockFile (high 8.6)
- [CVE-2026-72695](https://insights.sbomify.com/CVE-2026-72695/): Grav before 2.0.16 Path Traversal via MediaUploadTrait deleteFile (high 7.1)
- [CVE-2026-72694](https://insights.sbomify.com/CVE-2026-72694/): Mrtg: mrtg daemon symlink-following chown allows local privilege escalation via pid file path manipulation (high 7.1)
- [CVE-2026-72693](https://insights.sbomify.com/CVE-2026-72693/): Kbd: local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login (high 7.8)
- [CVE-2026-72692](https://insights.sbomify.com/CVE-2026-72692/): OpenSignLabs opensignserver - Missing Authorization (high 7.5)
- [CVE-2026-72691](https://insights.sbomify.com/CVE-2026-72691/): OpenSignLabs opensignserver - Authentication Bypass (high 7.5)
- [CVE-2026-72690](https://insights.sbomify.com/CVE-2026-72690/): Attendize Attendize - Cross-Tenant Authorization Bypass (medium 5.4)
- [CVE-2026-7269](https://insights.sbomify.com/CVE-2026-7269/): SourceCodester Pharmacy Sales and Inventory System index.php cross site scripting (medium 4.8)
- [CVE-2026-72689](https://insights.sbomify.com/CVE-2026-72689/): OpenSignLabs opensignserver - Broken Object Level Authorization (high 7.5)
- [CVE-2026-72688](https://insights.sbomify.com/CVE-2026-72688/): OpenSignLabs opensignserver - Missing Authentication for Critical Function (high 7.5)
- [CVE-2026-72687](https://insights.sbomify.com/CVE-2026-72687/): Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service (medium 6.5)
- [CVE-2026-72686](https://insights.sbomify.com/CVE-2026-72686/): Uncontrolled Recursion in Elasticsearch Leading to Denial of Service (medium 6.5)
- [CVE-2026-72685](https://insights.sbomify.com/CVE-2026-72685/): Inefficient Algorithmic Complexity in Elasticsearch Leading to Denial of Service (medium 4.3)
- [CVE-2026-72684](https://insights.sbomify.com/CVE-2026-72684/): Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service (medium 6.5)
- [CVE-2026-72683](https://insights.sbomify.com/CVE-2026-72683/): Uncontrolled Recursion in Elasticsearch Leading to Denial of Service (medium 6.5)
- [CVE-2026-72682](https://insights.sbomify.com/CVE-2026-72682/): Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service (medium 6.5)
- [CVE-2026-72681](https://insights.sbomify.com/CVE-2026-72681/): Missing Authorization in Kibana Leading to Privilege Escalation and Information Disclosure (medium 6.5)
- [CVE-2026-72680](https://insights.sbomify.com/CVE-2026-72680/): Authorization Bypass Through User-Controlled Key in Kibana Agent Builder Leading to Unauthorized Data Modification (medium 6.5)
- [CVE-2026-7268](https://insights.sbomify.com/CVE-2026-7268/): SourceCodester Pizzafy Ecommerce System ajax.php save_category sql injection (medium 5.3)
- [CVE-2026-72679](https://insights.sbomify.com/CVE-2026-72679/): Uncontrolled Recursion in Elasticsearch Leading to Denial of Service (medium 6.5)
- [CVE-2026-72678](https://insights.sbomify.com/CVE-2026-72678/): Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service (medium 6.5)
- [CVE-2026-72677](https://insights.sbomify.com/CVE-2026-72677/): Relative Path Traversal in Kibana Fleet Leading to Unauthorized Deletion of Users and Other Resources (high 7.3)
- [CVE-2026-72676](https://insights.sbomify.com/CVE-2026-72676/): Improper Control of Generation of Code in Fleet Server Leading to Code Injection (medium 6.5)
- [CVE-2026-72675](https://insights.sbomify.com/CVE-2026-72675/): Missing authorization in Kibana (high 7.1)
- [CVE-2026-72674](https://insights.sbomify.com/CVE-2026-72674/): Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service (medium 6.5)
- [CVE-2026-72673](https://insights.sbomify.com/CVE-2026-72673/): Incorrect Authorization in Kibana Leading to Unauthorized Deletion of Synthetics Private Locations (medium 5.4)
- [CVE-2026-72672](https://insights.sbomify.com/CVE-2026-72672/): Incorrect Authorization in Kibana Leading to Disclosure of Elastic Defend Endpoint Event Data (high 7.7)
- [CVE-2026-72671](https://insights.sbomify.com/CVE-2026-72671/): Missing authorization in Kibana (medium 4.3)
- [CVE-2026-72670](https://insights.sbomify.com/CVE-2026-72670/): Exposure of Sensitive Information to an Unauthorized Actor in Kibana Leading to Disclosure of Fleet Proxy Credentials (high 7.7)
- [CVE-2026-7267](https://insights.sbomify.com/CVE-2026-7267/): SourceCodester Pizzafy Ecommerce System view_prod.php sql injection (medium 5.3)
- [CVE-2026-72669](https://insights.sbomify.com/CVE-2026-72669/): Missing Authorization in Kibana Leading to Cross-User Information Disclosure and Data Tampering (high 7.6)
- [CVE-2026-72668](https://insights.sbomify.com/CVE-2026-72668/): Unintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Privilege Escalation (high 7.3)
- [CVE-2026-72667](https://insights.sbomify.com/CVE-2026-72667/): Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service (medium 6.5)
- [CVE-2026-72666](https://insights.sbomify.com/CVE-2026-72666/): Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Query Execution on Managed Hosts (medium 6.8)
- [CVE-2026-72665](https://insights.sbomify.com/CVE-2026-72665/): Missing Authorization in Kibana Leading to Unauthorized Execution of Host Response Actions (high 8.1)
- [CVE-2026-72664](https://insights.sbomify.com/CVE-2026-72664/): Missing Authorization in Kibana Leading to Unauthorized Execution of Endpoint Response Actions (medium 6.5)
- [CVE-2026-72663](https://insights.sbomify.com/CVE-2026-72663/): Inefficient Algorithmic Complexity in Kibana Leading to Denial of Service (medium 6.5)
- [CVE-2026-72662](https://insights.sbomify.com/CVE-2026-72662/): Missing authorization in Kibana (medium 6.3)
- [CVE-2026-72661](https://insights.sbomify.com/CVE-2026-72661/): Missing Authorization in Kibana Leading to Information Disclosure (medium 6.5)
- [CVE-2026-72660](https://insights.sbomify.com/CVE-2026-72660/): Uncaught Exception in Kibana Leading to Denial of Service (medium 6.5)
- [CVE-2026-7266](https://insights.sbomify.com/CVE-2026-7266/): SourceCodester Pizzafy Ecommerce System ajax.php save_order sql injection (medium 5.3)
- [CVE-2026-72659](https://insights.sbomify.com/CVE-2026-72659/): Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service (medium 6.5)
- [CVE-2026-72658](https://insights.sbomify.com/CVE-2026-72658/): Cross-Site Request Forgery in Kibana Leading to Privilege Escalation (high 7.3)
- [CVE-2026-72657](https://insights.sbomify.com/CVE-2026-72657/): Authorization Bypass Through User-Controlled Key in Fleet Server Leading to Information Disclosure (medium 6.5)
- [CVE-2026-72656](https://insights.sbomify.com/CVE-2026-72656/): Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service (medium 6.5)
- [CVE-2026-72655](https://insights.sbomify.com/CVE-2026-72655/): Missing authorization in Kibana (medium 4.3)
- [CVE-2026-72654](https://insights.sbomify.com/CVE-2026-72654/): Execution with Unnecessary Privileges in Kibana Leading to Information Disclosure (medium 6.5)
- [CVE-2026-72653](https://insights.sbomify.com/CVE-2026-72653/): Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service (medium 6.5)
- [CVE-2026-72652](https://insights.sbomify.com/CVE-2026-72652/): Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service (medium 6.5)
- [CVE-2026-72651](https://insights.sbomify.com/CVE-2026-72651/): Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service (medium 6.5)
- [CVE-2026-72650](https://insights.sbomify.com/CVE-2026-72650/): Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure (medium 4.3)
- [CVE-2026-7265](https://insights.sbomify.com/CVE-2026-7265/): SourceCodester Pizzafy Ecommerce System index.php category sql injection (medium 5.3)
- [CVE-2026-72649](https://insights.sbomify.com/CVE-2026-72649/): Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution (high 8.8)
- [CVE-2026-72648](https://insights.sbomify.com/CVE-2026-72648/): Information disclosure in Eck Operator (medium 6.5)
- [CVE-2026-72647](https://insights.sbomify.com/CVE-2026-72647/): Uncontrolled Recursion in Elasticsearch Leading to Denial of Service (medium 6.5)
- [CVE-2026-72645](https://insights.sbomify.com/CVE-2026-72645/): Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service (medium 6.5)
- [CVE-2026-72644](https://insights.sbomify.com/CVE-2026-72644/): Uncaught Exception in Kibana Leading to Denial of Service (medium 6.5)
- [CVE-2026-72643](https://insights.sbomify.com/CVE-2026-72643/): Incorrect Authorization in Kibana Agent Builder Leading to Disclosure and Tampering of Private Agents (high 7.1)
- [CVE-2026-72642](https://insights.sbomify.com/CVE-2026-72642/): Use of Out-of-range Pointer Offset in the Elasticsearch Machine Learning Native Inference Process (high 8.8)
- [CVE-2026-72641](https://insights.sbomify.com/CVE-2026-72641/): Incorrect Authorization in Kibana Leading to Unauthorized Modification of Data (medium 5.4)
- [CVE-2026-72640](https://insights.sbomify.com/CVE-2026-72640/): Unintended Proxy or Intermediary in Elastic Cloud on Kubernetes Leading to Cross-Namespace Secret Disclosure (medium 6.5)
- [CVE-2026-7264](https://insights.sbomify.com/CVE-2026-7264/): SourceCodester Pizzafy Ecommerce System ajax.php get_cart_items sql injection (medium 5.3)
- [CVE-2026-72639](https://insights.sbomify.com/CVE-2026-72639/): Memory Allocation with Excessive Size Value in Elasticsearch Highlighting Leading to Denial of Service (medium 6.5)
- [CVE-2026-72638](https://insights.sbomify.com/CVE-2026-72638/): Uncontrolled Recursion in Elasticsearch Leading to Denial of Service (medium 6.5)
- [CVE-2026-72636](https://insights.sbomify.com/CVE-2026-72636/): Uncontrolled Recursion in Elasticsearch Wildcard Matching Leading to Denial of Service (medium 6.5)
- [CVE-2026-72633](https://insights.sbomify.com/CVE-2026-72633/): Incorrect Authorization in Kibana Leading to Unauthorized Disabling of Privilege Monitoring (medium 4.3)
- [CVE-2026-72632](https://insights.sbomify.com/CVE-2026-72632/): Observable Discrepancy in Kibana Fleet Leading to Disclosure of Elastic Agent Elasticsearch API Keys (high 7.1)
- [CVE-2026-72631](https://insights.sbomify.com/CVE-2026-72631/): Improper Privilege Management in Kibana Fleet Leading to Over-Scoped Elastic Agent API Keys (medium 6.5)
- [CVE-2026-72630](https://insights.sbomify.com/CVE-2026-72630/): Incorrect Authorization in Kibana Fleet Leading to Privilege Escalation (high 7.1)
- [CVE-2026-7263](https://insights.sbomify.com/CVE-2026-7263/): DoS attack via DOMNode::C14N() (medium 6.3)
- [CVE-2026-72629](https://insights.sbomify.com/CVE-2026-72629/): Missing authorization in Kibana (high 7.1)
- [CVE-2026-72628](https://insights.sbomify.com/CVE-2026-72628/): Improper Handling of Highly Compressed Data in Kibana Leading to Denial of Service (medium 6.5)
- [CVE-2026-72627](https://insights.sbomify.com/CVE-2026-72627/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-72626](https://insights.sbomify.com/CVE-2026-72626/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-7262](https://insights.sbomify.com/CVE-2026-7262/): NULL pointer dereference in SOAP apache:Map decoder with missing <value> (low 2.9)
- [CVE-2026-72610](https://insights.sbomify.com/CVE-2026-72610/): Koha Community Koha - Stored SQL Injection via Patron lang Field in Issue Slip Generation (medium 4.3)
- [CVE-2026-7261](https://insights.sbomify.com/CVE-2026-7261/): SoapServer session-persisted object use-after-free via SOAP header fault (medium 6.3)
- [CVE-2026-72609](https://insights.sbomify.com/CVE-2026-72609/): Koha Community Koha - SQL Injection via ORDER BY Direction in acqui/parcels.pl (high 7.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/408/