# Vulnerabilities published in 2026


- [CVE-2026-66053](https://insights.sbomify.com/CVE-2026-66053/): Apache Thrift: Python TSSLSocket Hostname Matcher Import (medium 5.9)
- [CVE-2026-66050](https://insights.sbomify.com/CVE-2026-66050/): NitroShare Desktop 0.3.4 Path Traversal via LAN File Transfer Server (high 8.7)
- [CVE-2026-6605](https://insights.sbomify.com/CVE-2026-6605/): modelscope agentscope Internal Service _common.py _get_bytes_from_web_url server-side request forgery (medium 6.9)
- [CVE-2026-66047](https://insights.sbomify.com/CVE-2026-66047/): ProfilePress WordPress Plugin < 4.17.2 Unauthenticated Arbitrary Plugin Installation RCE (critical 9.2)
- [CVE-2026-66046](https://insights.sbomify.com/CVE-2026-66046/): Expat Denial of Service via storeAtts() Quadratic Complexity (high 8.7)
- [CVE-2026-66041](https://insights.sbomify.com/CVE-2026-66041/): FFmpeg 7.0 - 8.1.2 Heap Out-of-Bounds Write via vf_quirc Filter (high 7.7)
- [CVE-2026-66040](https://insights.sbomify.com/CVE-2026-66040/): FFmpeg Heap Out-of-Bounds Write via PNG/APNG eXIf Encoder (high 8.7)
- [CVE-2026-6604](https://insights.sbomify.com/CVE-2026-6604/): modelscope agentscope Cloud Metadata Endpoint _openai_tools.py openai_audio_to_text server-side request forgery (medium 6.9)
- [CVE-2026-66039](https://insights.sbomify.com/CVE-2026-66039/): FFmpeg MACE6 Audio Decoder Heap Out-of-Bounds Write via CAF File (high 8.7)
- [CVE-2026-66038](https://insights.sbomify.com/CVE-2026-66038/): FFmpeg LCL/ZLIB Video Decoder Information Disclosure via lcldec.c (high 7.1)
- [CVE-2026-66037](https://insights.sbomify.com/CVE-2026-66037/): FFmpeg IAMF Demuxer Uncontrolled Resource Consumption via mix_presentation_obu() (high 7.1)
- [CVE-2026-66036](https://insights.sbomify.com/CVE-2026-66036/): FFmpeg Heap Out-of-Bounds Write in vf_hqdn3d Filter (high 7.7)
- [CVE-2026-66035](https://insights.sbomify.com/CVE-2026-66035/): libssh2 Heap Buffer Overflow via ETM Cipher Negotiation (high 7.7)
- [CVE-2026-66034](https://insights.sbomify.com/CVE-2026-66034/): libssh2 Heap Out-of-Bounds Read via publickey subsystem (high 7.7)
- [CVE-2026-66033](https://insights.sbomify.com/CVE-2026-66033/): libssh2 Integer Underflow DoS via AES-GCM Cipher Negotiation (high 8.7)
- [CVE-2026-66032](https://insights.sbomify.com/CVE-2026-66032/): libssh2 Double-Free Heap Corruption via sftp_open() (high 8.7)
- [CVE-2026-66031](https://insights.sbomify.com/CVE-2026-66031/): Ekushey Project Manager CRM 5.0 Stored XSS via Reply Ticket Field (medium 5.1)
- [CVE-2026-66030](https://insights.sbomify.com/CVE-2026-66030/): Ekushey Project Manager CRM 5.0 Stored XSS via Ticket Title Field (medium 5.1)
- [CVE-2026-6603](https://insights.sbomify.com/CVE-2026-6603/): modelscope agentscope _python.py execute_shell_command code injection (medium 6.9)
- [CVE-2026-66029](https://insights.sbomify.com/CVE-2026-66029/): Ekushey Project Manager CRM 5.0 Stored XSS via Client Name Field (medium 5.1)
- [CVE-2026-66028](https://insights.sbomify.com/CVE-2026-66028/): Ekushey Project Manager CRM 5.0 Missing Uniqueness Constraint via Client Email (high 7.1)
- [CVE-2026-66027](https://insights.sbomify.com/CVE-2026-66027/): Suna < 0.9.102 Broken Access Control via Message Queue API (high 8.7)
- [CVE-2026-6602](https://insights.sbomify.com/CVE-2026-6602/): rickxy Hospital Management System his_admin_account.php unrestricted upload (medium 6.9)
- [CVE-2026-66018](https://insights.sbomify.com/CVE-2026-66018/): JFrog Artifactory build environment properties exposure (medium 6.5)
- [CVE-2026-66016](https://insights.sbomify.com/CVE-2026-66016/): Rendered Artifactory Helm manifests may contain generated TLS private keys (medium 6.7)
- [CVE-2026-66015](https://insights.sbomify.com/CVE-2026-66015/): JFrog Platform contains an authorization flaw that may allow authenticated privilege escalation. (high 7.2)
- [CVE-2026-66014](https://insights.sbomify.com/CVE-2026-66014/): Potential authentication bypass leading to privilege escalation in Artifactory (high 8.8)
- [CVE-2026-66013](https://insights.sbomify.com/CVE-2026-66013/): OpenRemote before 1.26.2 Authentication Bypass via Console Registration (critical 9.3)
- [CVE-2026-66012](https://insights.sbomify.com/CVE-2026-66012/): SiYuan before v3.7.2 Unauthenticated Administrator Takeover via MCP (critical 10.0)
- [CVE-2026-66011](https://insights.sbomify.com/CVE-2026-66011/): ImageMagick before 7.1.2-27 Memory Leak via Invalid CLI Options (medium 4.8)
- [CVE-2026-66010](https://insights.sbomify.com/CVE-2026-66010/): DOMPurify before 3.4.12 Hook Bypass via CUSTOM_ELEMENT_HANDLING (medium 5.1)
- [CVE-2026-6601](https://insights.sbomify.com/CVE-2026-6601/): Lagom WHMCS Template Datatables resource consumption (medium 5.3)
- [CVE-2026-66009](https://insights.sbomify.com/CVE-2026-66009/): Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages (medium 6.3)
- [CVE-2026-66008](https://insights.sbomify.com/CVE-2026-66008/): Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages (medium 6.3)
- [CVE-2026-66007](https://insights.sbomify.com/CVE-2026-66007/): Datasets Path Traversal via Unsanitized file_name Metadata (medium 6.9)
- [CVE-2026-66006](https://insights.sbomify.com/CVE-2026-66006/): lakeFS Unauthenticated Operator Metadata Overwrite via setup_comm_prefs (medium 6.9)
- [CVE-2026-66005](https://insights.sbomify.com/CVE-2026-66005/): Jan Local API Server CORS Origin Reflection via 0.0.0.0 Binding (medium 5.3)
- [CVE-2026-66004](https://insights.sbomify.com/CVE-2026-66004/): BlenderMCP Path Traversal via download_polyhaven_asset API (medium 6.0)
- [CVE-2026-66003](https://insights.sbomify.com/CVE-2026-66003/): Frappe: Access control bypass via REST API dot-notation fields on linked doctypes (high 7.1)
- [CVE-2026-66002](https://insights.sbomify.com/CVE-2026-66002/): Frappe: User Enumeration via PDDR (medium 6.9)
- [CVE-2026-66001](https://insights.sbomify.com/CVE-2026-66001/): Frappe: Improper Authorization in OAuth2 Consent Endpoint (high 8.5)
- [CVE-2026-66000](https://insights.sbomify.com/CVE-2026-66000/): Frappe: Unrestricted access to Document Follow APIs (low 2.3)
- [CVE-2026-6600](https://insights.sbomify.com/CVE-2026-6600/): langflow-ai langflow Frontend React Component Rendering edit-message.tsx cross site scripting (medium 5.1)
- [CVE-2026-6599](https://insights.sbomify.com/CVE-2026-6599/): langflow-ai langflow Model Context Protocol Configuration API mcp_projects.py install_mcp_config injection (medium 5.3)
- [CVE-2026-65986](https://insights.sbomify.com/CVE-2026-65986/): CVAT has stored XSS via annotation guide assets (high 8.5)
- [CVE-2026-65985](https://insights.sbomify.com/CVE-2026-65985/): FUXA: SSRF hardening for `device-webapi-request` (medium 6.0)
- [CVE-2026-65984](https://insights.sbomify.com/CVE-2026-65984/): FUXA: JWT lifecycle flaws allow deleted or demoted users to retain privileged sessions (high 7.5)
- [CVE-2026-65981](https://insights.sbomify.com/CVE-2026-65981/): Coturn: MOBILITY-TICKET session-resume authorization bypass allows cross-user TURN allocation takeover (high 7.1)
- [CVE-2026-65980](https://insights.sbomify.com/CVE-2026-65980/): Chartbrew: SQL Injection via Missing Backslash Escaping in ClickHouse Variable Substitution (high 7.9)
- [CVE-2026-6598](https://insights.sbomify.com/CVE-2026-6598/): langflow-ai langflow Project Creation Endpoint projects.py encrypt_auth_settings cleartext storage in file (medium 5.3)
- [CVE-2026-65979](https://insights.sbomify.com/CVE-2026-65979/): OpenEXR: Out-of-bounds read in HTJ2K decoder from unvalidated chunk header length (PLEN) (medium 6.7)
- [CVE-2026-65976](https://insights.sbomify.com/CVE-2026-65976/): Deskflow: Clipboard receiver can accumulate data beyond Deskflow's configured clipboard size limit (medium 6.5)
- [CVE-2026-65975](https://insights.sbomify.com/CVE-2026-65975/): Security feature bypass in pydantic-ai (medium 6.5)
- [CVE-2026-65974](https://insights.sbomify.com/CVE-2026-65974/): ERPNext: Server-Side Template Injection leading to Remote Code Execution (critical 9.9)
- [CVE-2026-65970](https://insights.sbomify.com/CVE-2026-65970/): OpenImageIO: TIFF multithreaded scanline read use-after-scope in `TIFFInput::read_native_scanlines` (medium 5.3)
- [CVE-2026-6597](https://insights.sbomify.com/CVE-2026-6597/): langflow-ai langflow Flow Using API core.py has_api_terms credentials storage (medium 5.1)
- [CVE-2026-65969](https://insights.sbomify.com/CVE-2026-65969/): OpenImageIO: TGA-to-GIF palette split signed overflow causes SIGSEGV (medium 5.5)
- [CVE-2026-6596](https://insights.sbomify.com/CVE-2026-6596/): langflow-ai langflow API Endpoint endpoints.py create_upload_file unrestricted upload (medium 6.9)
- [CVE-2026-65959](https://insights.sbomify.com/CVE-2026-65959/): Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data (medium 5.3)
- [CVE-2026-65956](https://insights.sbomify.com/CVE-2026-65956/): KubePi: Unauthenticated SSO/OIDC configuration allows admin account takeover and SSRF (critical 10.0)
- [CVE-2026-65954](https://insights.sbomify.com/CVE-2026-65954/): PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey() (high 8.6)
- [CVE-2026-6595](https://insights.sbomify.com/CVE-2026-6595/): ProjectsAndPrograms School Management System HTTP GET Parameter buslocation.php sql injection (medium 6.9)
- [CVE-2026-65948](https://insights.sbomify.com/CVE-2026-65948/): Apache Ranger: UnixAuth lacks brute-force protection (high 7.3)
- [CVE-2026-65947](https://insights.sbomify.com/CVE-2026-65947/): Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox < 2.20.2 (high 7.3)
- [CVE-2026-65946](https://insights.sbomify.com/CVE-2026-65946/): Joomla Extension - rolandd.com - XSS vectors in AJAX endpoint handlers RO CSVI < 9.11.0 (medium 6.1)
- [CVE-2026-65945](https://insights.sbomify.com/CVE-2026-65945/): Apache Ranger: Logs contain replayable JWT bearer tokens (medium 6.5)
- [CVE-2026-65944](https://insights.sbomify.com/CVE-2026-65944/): Joomla Extension - rolandd.com - CSRF vectors in AJAX endpoint handlers RO CSVI < 9.11.0 (high 8.8)
- [CVE-2026-65943](https://insights.sbomify.com/CVE-2026-65943/): Joomla Extension - rolandd.com - Unauthenticated directory creation RO CSVI < 9.11.0 (high 7.5)
- [CVE-2026-65942](https://insights.sbomify.com/CVE-2026-65942/): Apache Ranger: Clients accept TLS certificates issued for other hostnames (high 7.5)
- [CVE-2026-65941](https://insights.sbomify.com/CVE-2026-65941/): Code injection in WhatsUp Gold (high 8.8)
- [CVE-2026-65940](https://insights.sbomify.com/CVE-2026-65940/): Misconfiguration in WhatsUp Gold (medium 6.8)
- [CVE-2026-6594](https://insights.sbomify.com/CVE-2026-6594/): brikcss merge prototype pollution (medium 6.9)
- [CVE-2026-65939](https://insights.sbomify.com/CVE-2026-65939/): WhatsUp Gold versions prior to 26.0.2 contain an arbitrary file write vulnerability in the LogToFile action handler. (medium 6.8)
- [CVE-2026-65938](https://insights.sbomify.com/CVE-2026-65938/): WhatsUp Gold versions prior to 26.0.2 contain an improper authorization vulnerability in the Scheduled Reports API. (medium 4.3)
- [CVE-2026-65937](https://insights.sbomify.com/CVE-2026-65937/): Cross-site scripting in WhatsUp Gold (high 8.0)
- [CVE-2026-65936](https://insights.sbomify.com/CVE-2026-65936/): RS9116W/SiWx917 malformed packet with increased length field causes memory leak (medium 5.3)
- [CVE-2026-65935](https://insights.sbomify.com/CVE-2026-65935/): Bypassing passkey entry in legacy pairing (high 7.6)
- [CVE-2026-65934](https://insights.sbomify.com/CVE-2026-65934/): BT122 plaintext pause encryption request causes DOS (high 7.1)
- [CVE-2026-65933](https://insights.sbomify.com/CVE-2026-65933/): BT122 malformed packet with increased length field causes memory leak (medium 5.3)
- [CVE-2026-65932](https://insights.sbomify.com/CVE-2026-65932/): BT122 stops advertising (medium 5.3)
- [CVE-2026-65931](https://insights.sbomify.com/CVE-2026-65931/): LimeSurvey Community Edition 7.0.5 - Improper authorization in survey menu entry creation endpoint (medium 5.1)
- [CVE-2026-65930](https://insights.sbomify.com/CVE-2026-65930/): LimeSurvey Community Edition 7.0.5 - Stored XSS in replacement-fields (medium 4.8)
- [CVE-2026-6593](https://insights.sbomify.com/CVE-2026-6593/): ComfyUI View Endpoint server.py cross site scripting (medium 5.1)
- [CVE-2026-65927](https://insights.sbomify.com/CVE-2026-65927/): Apache Tomcat: RewriteValve [N] restarts at the second rule and may bypass access control (high 7.5)
- [CVE-2026-65926](https://insights.sbomify.com/CVE-2026-65926/): Private Release Bundle versions may be disclosed under specific configurations (low 3.1)
- [CVE-2026-65925](https://insights.sbomify.com/CVE-2026-65925/): Server-Side Request Forgery (SSRF) via JFrog Artifactory Cargo remote repository (medium 6.5)
- [CVE-2026-65924](https://insights.sbomify.com/CVE-2026-65924/): Server-Side Request Forgery (SSRF) via Terraform Remote repository (medium 6.5)
- [CVE-2026-65923](https://insights.sbomify.com/CVE-2026-65923/): Potential server-side request forgery in Artifactory Ansible repository handling (medium 6.8)
- [CVE-2026-65922](https://insights.sbomify.com/CVE-2026-65922/): Potential unauthorized modification of Artifactory internal metadata (high 7.1)
- [CVE-2026-65921](https://insights.sbomify.com/CVE-2026-65921/): Potential path traversal leading to unauthorized file writes (high 8.8)
- [CVE-2026-65920](https://insights.sbomify.com/CVE-2026-65920/): Diffusers Path Traversal via weight_map Arbitrary File Read (medium 5.3)
- [CVE-2026-6592](https://insights.sbomify.com/CVE-2026-6592/): ComfyUI userdata Endpoint user_manager.py getuserdata cross site scripting (medium 5.1)
- [CVE-2026-65919](https://insights.sbomify.com/CVE-2026-65919/): Meshery < 1.0.57 Unauthenticated Arbitrary File Read via fileView and fileDownload (high 8.7)
- [CVE-2026-65918](https://insights.sbomify.com/CVE-2026-65918/): PyTorch torchvision GIF Decoder Out-of-bounds Heap Read (high 7.1)
- [CVE-2026-65917](https://insights.sbomify.com/CVE-2026-65917/): CyberPanel IncBackups IDOR via Sequential Backup ID (high 8.7)
- [CVE-2026-65916](https://insights.sbomify.com/CVE-2026-65916/): CyberPanel Missing Authorization in cancelBackupCreation Handler (high 7.2)
- [CVE-2026-65915](https://insights.sbomify.com/CVE-2026-65915/): NLTK before 3.10.0 Arbitrary File Read via FileSystemPathPointer (high 7.1)
- [CVE-2026-65914](https://insights.sbomify.com/CVE-2026-65914/): DOMPurify before 3.3.2 Mutation XSS via Re-Contextualization (medium 5.3)
- [CVE-2026-65913](https://insights.sbomify.com/CVE-2026-65913/): DOMPurify before 3.3.2 Prototype Pollution via USE_PROFILES (medium 5.1)
- [CVE-2026-65912](https://insights.sbomify.com/CVE-2026-65912/): DOMPurify before 3.3.2 URI Validation Bypass via ADD_ATTR (medium 5.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/458/