# Vulnerabilities published in 2026


- [CVE-2026-63216](https://insights.sbomify.com/CVE-2026-63216/): Zammad: Stored XSS via unescaped option labels in the object attribute options context UI (medium 5.3)
- [CVE-2026-6321](https://insights.sbomify.com/CVE-2026-6321/): fast-uri vulnerable to path traversal via percent-encoded dot segments (high 7.5)
- [CVE-2026-63209](https://insights.sbomify.com/CVE-2026-63209/): Integer Overflow or Wraparound and Out-of-bounds Write in compress (high 7.5)
- [CVE-2026-63208](https://insights.sbomify.com/CVE-2026-63208/): Zammad: Microsoft Graph error logs expose partially masked OAuth access tokens (medium 5.1)
- [CVE-2026-63207](https://insights.sbomify.com/CVE-2026-63207/): Zammad: Sensitive Information Exposure in Integration Administration API (medium 6.9)
- [CVE-2026-63206](https://insights.sbomify.com/CVE-2026-63206/): Zammad: Remote image tracking bypass via shortened URL scheme (medium 5.3)
- [CVE-2026-63205](https://insights.sbomify.com/CVE-2026-63205/): Zammad: Channel admins can read unauthorized attachments via signature rich-text body (medium 5.1)
- [CVE-2026-63204](https://insights.sbomify.com/CVE-2026-63204/): Zammad: Authenticated agents can read AI summary error messages from inaccessible tickets (low 2.3)
- [CVE-2026-63203](https://insights.sbomify.com/CVE-2026-63203/): Logto: Account API can disclose stored third-party provider tokens without the identities scope (high 7.6)
- [CVE-2026-6320](https://insights.sbomify.com/CVE-2026-6320/): Path traversal in Salon Booking System – Free Version (high 7.5)
- [CVE-2026-63199](https://insights.sbomify.com/CVE-2026-63199/): Perses: Missing authorization in datasource proxy allows cross-scope secret disclosure (high 8.3)
- [CVE-2026-63190](https://insights.sbomify.com/CVE-2026-63190/): FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS (critical 9.4)
- [CVE-2026-6319](https://insights.sbomify.com/CVE-2026-6319/): Use after free in Chrome (high 7.5)
- [CVE-2026-63188](https://insights.sbomify.com/CVE-2026-63188/): logto-tunnel serves files outside --experience-path via path traversal (high 8.7)
- [CVE-2026-63187](https://insights.sbomify.com/CVE-2026-63187/): Logto: OS command injection vulnerability exists in the Commitlint workflow (medium 6.3)
- [CVE-2026-6318](https://insights.sbomify.com/CVE-2026-6318/): Use after free in Chrome (high 8.8)
- [CVE-2026-63179](https://insights.sbomify.com/CVE-2026-63179/): Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets (medium 4.9)
- [CVE-2026-63178](https://insights.sbomify.com/CVE-2026-63178/): Missing authorization in onyx (medium 6.5)
- [CVE-2026-63177](https://insights.sbomify.com/CVE-2026-63177/): Malcolm Vulnerable to Authorization Bypass via URI Normalization Differential in Nginx Lua RBAC (high 7.1)
- [CVE-2026-63175](https://insights.sbomify.com/CVE-2026-63175/): Cross-Capture Session Data Leakage Due to Shared Mutable State in Looklyloo - PlaywrightCapture (high 7.1)
- [CVE-2026-63174](https://insights.sbomify.com/CVE-2026-63174/): Omnispace Agora Project < 26.10.0 Broken Access Control via spaceAffectList (high 8.6)
- [CVE-2026-63172](https://insights.sbomify.com/CVE-2026-63172/): Omnispace Agora Project < 26.10.0 Broken Function-Level Authorization via User-Edit (high 7.1)
- [CVE-2026-63171](https://insights.sbomify.com/CVE-2026-63171/): Omnispace Agora Project < 26.10.0 Stored XSS via Category Description (medium 5.1)
- [CVE-2026-6317](https://insights.sbomify.com/CVE-2026-6317/): Use after free in Chrome (high 8.8)
- [CVE-2026-63169](https://insights.sbomify.com/CVE-2026-63169/): Omnispace Agora Project < 26.10.0 Stored XSS via Messenger Iframe (medium 5.3)
- [CVE-2026-63168](https://insights.sbomify.com/CVE-2026-63168/): Omnispace Agora Project < 26.10.0 Stored XSS via Nested POST Array Bypass (medium 5.1)
- [CVE-2026-63165](https://insights.sbomify.com/CVE-2026-63165/): Omnispace Agora Project < 26.10.0 SQL Injection via sortEvents Parameter (high 8.6)
- [CVE-2026-63163](https://insights.sbomify.com/CVE-2026-63163/): Omnispace Agora Project < 26.10.0 Broken Access Control via MobileFileDownload (high 8.7)
- [CVE-2026-63162](https://insights.sbomify.com/CVE-2026-63162/): Omnispace Agora Project < 26.10.0 Path Traversal via tmpFolderName Parameter (high 8.7)
- [CVE-2026-63161](https://insights.sbomify.com/CVE-2026-63161/): Omnispace Agora Project < 26.10.0 Session Fixation via Authentication (high 8.6)
- [CVE-2026-63160](https://insights.sbomify.com/CVE-2026-63160/): Omnispace Agora Project < 26.10.0 Insecure Remember-Me Token Storage (critical 9.1)
- [CVE-2026-6316](https://insights.sbomify.com/CVE-2026-6316/): Use after free in Chrome (high 8.8)
- [CVE-2026-63159](https://insights.sbomify.com/CVE-2026-63159/): Omnispace Agora Project < 26.10.0 Predictable Password-Reset Token Account Takeover (critical 9.1)
- [CVE-2026-63158](https://insights.sbomify.com/CVE-2026-63158/): Omnispace Agora Project < 26.10.0 Pass-the-Hash Authentication Bypass via Cookies (critical 9.1)
- [CVE-2026-63157](https://insights.sbomify.com/CVE-2026-63157/): Omnispace Agora Project < 26.10.0 Stored XSS via Links Module (medium 5.1)
- [CVE-2026-63156](https://insights.sbomify.com/CVE-2026-63156/): Omnispace Agora Project < 26.10.0 Reflected XSS via visioUrl Parameter (medium 5.1)
- [CVE-2026-63154](https://insights.sbomify.com/CVE-2026-63154/): Omnispace Agora Project < 26.10.0 SQL Identifier Injection via agoraFields[] (high 8.7)
- [CVE-2026-63153](https://insights.sbomify.com/CVE-2026-63153/): Omnispace Agora Project < 26.10.0 Broken Access Control via setAffectations() (high 8.6)
- [CVE-2026-63152](https://insights.sbomify.com/CVE-2026-63152/): Omnispace Agora Project < 26.10.0 Second-Order SQL Injection via _idCategoryFilter (high 8.6)
- [CVE-2026-6315](https://insights.sbomify.com/CVE-2026-6315/): Use after free in Chrome (high 8.8)
- [CVE-2026-63149](https://insights.sbomify.com/CVE-2026-63149/): Omnispace Agora Project < 26.10.0 Predictable Default Password via uniqid() (critical 9.1)
- [CVE-2026-63148](https://insights.sbomify.com/CVE-2026-63148/): Omnispace Agora Project < 26.10.0 Stored XSS via Poll-Response Attachment Filename (medium 5.1)
- [CVE-2026-63147](https://insights.sbomify.com/CVE-2026-63147/): Omnispace Agora Project < 26.10.0 Stored XSS via Uploaded File Name (medium 5.1)
- [CVE-2026-63146](https://insights.sbomify.com/CVE-2026-63146/): Omnispace Agora Project < 26.10.0 PHP Code Injection via config.inc.php (critical 9.3)
- [CVE-2026-63145](https://insights.sbomify.com/CVE-2026-63145/): Incorrect Authorization in Kibana Leading to Machine Learning Audit Log Integrity Compromise (medium 4.3)
- [CVE-2026-63144](https://insights.sbomify.com/CVE-2026-63144/): Uncontrolled Recursion in Elasticsearch Leading to Denial of Service (medium 6.5)
- [CVE-2026-63143](https://insights.sbomify.com/CVE-2026-63143/): Missing Authorization in Kibana Leading to Unauthorized Information Disclosure (medium 4.3)
- [CVE-2026-63142](https://insights.sbomify.com/CVE-2026-63142/): Incomplete List of Disallowed Inputs in Kibana Leading to Server-Side Request Forgery (medium 5.0)
- [CVE-2026-63141](https://insights.sbomify.com/CVE-2026-63141/): Missing Authorization in Kibana Leading to Unauthorized Access to Cloud Connect Management Functions (medium 6.3)
- [CVE-2026-63140](https://insights.sbomify.com/CVE-2026-63140/): Reachable Assertion in Elasticsearch Leading to Denial of Service (medium 6.5)
- [CVE-2026-6314](https://insights.sbomify.com/CVE-2026-6314/): Memory corruption in Chrome (high 8.3)
- [CVE-2026-63139](https://insights.sbomify.com/CVE-2026-63139/): Uncontrolled Resource Consumption in Kibana Leading to Denial of Service (medium 6.5)
- [CVE-2026-63138](https://insights.sbomify.com/CVE-2026-63138/): Improper Neutralization of Special Elements in Data Query Logic in Kibana Leading to Information Disclosure (medium 6.5)
- [CVE-2026-63137](https://insights.sbomify.com/CVE-2026-63137/): Incorrect Authorization in Kibana Leading to Privilege Escalation (high 8.3)
- [CVE-2026-63136](https://insights.sbomify.com/CVE-2026-63136/): Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service (medium 6.5)
- [CVE-2026-63135](https://insights.sbomify.com/CVE-2026-63135/): YOURLS: Stored XSS in referrer statistics chart via crafted Referer header (high 8.2)
- [CVE-2026-63134](https://insights.sbomify.com/CVE-2026-63134/): Malcolm's Path Traversal in Archive Extraction Allows Arbitrary Directory Creation (medium 5.3)
- [CVE-2026-63133](https://insights.sbomify.com/CVE-2026-63133/): Malcolm has Uncontrolled Resource Consumption in Archive Extraction (Inode-Exhaustion DoS) (high 7.1)
- [CVE-2026-63132](https://insights.sbomify.com/CVE-2026-63132/): OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack (critical 9.2)
- [CVE-2026-63131](https://insights.sbomify.com/CVE-2026-63131/): OpenBao LIST ACL bypass: a trailing-slash LIST request skips a more-specific deny rule (unported Vault v2.0.3 fix) (medium 6.0)
- [CVE-2026-63130](https://insights.sbomify.com/CVE-2026-63130/): Path traversal in espocrm (medium 5.5)
- [CVE-2026-6313](https://insights.sbomify.com/CVE-2026-6313/): Security feature bypass in Chrome (low 3.1)
- [CVE-2026-63128](https://insights.sbomify.com/CVE-2026-63128/): RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-service (high 7.5)
- [CVE-2026-63127](https://insights.sbomify.com/CVE-2026-63127/): RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata Discovery (high 8.2)
- [CVE-2026-63126](https://insights.sbomify.com/CVE-2026-63126/): Wire: Unauthenticated decoder crash via 32-bit length integer overflow in ByteArrayProtoReader32 (incomplete fix of CVE-2026-45799) (high 7.5)
- [CVE-2026-63125](https://insights.sbomify.com/CVE-2026-63125/): Incus vulnerable to root RCE via image backup.yaml symlink (critical 9.9)
- [CVE-2026-63123](https://insights.sbomify.com/CVE-2026-63123/): Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root (medium 6.5)
- [CVE-2026-63120](https://insights.sbomify.com/CVE-2026-63120/): PGHoard: Incomplete Path Traversal fix in restore.py allows Arbitrary File Write (high 8.4)
- [CVE-2026-6312](https://insights.sbomify.com/CVE-2026-6312/): Security feature bypass in Chrome (low 3.1)
- [CVE-2026-63119](https://insights.sbomify.com/CVE-2026-63119/): MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS) (medium 6.2)
- [CVE-2026-63118](https://insights.sbomify.com/CVE-2026-63118/): MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protection (medium 6.9)
- [CVE-2026-63117](https://insights.sbomify.com/CVE-2026-63117/): FreeRDP: Denial of service through ADPCM frame size calculation (medium 6.5)
- [CVE-2026-63116](https://insights.sbomify.com/CVE-2026-63116/): deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes (high 8.8)
- [CVE-2026-6311](https://insights.sbomify.com/CVE-2026-6311/): Memory corruption in Chrome (high 8.3)
- [CVE-2026-63108](https://insights.sbomify.com/CVE-2026-63108/): Roo Code 3.54.0 Command Injection via Parameter Expansion Parsing (high 7.7)
- [CVE-2026-63107](https://insights.sbomify.com/CVE-2026-63107/): LimeSurvey SSRF via REST API Survey Template Host Header (medium 6.3)
- [CVE-2026-63106](https://insights.sbomify.com/CVE-2026-63106/): ReadyEcommerce < 4.5.2 Unauthenticated SQL Injection via ProductController.php (critical 9.3)
- [CVE-2026-63105](https://insights.sbomify.com/CVE-2026-63105/): ReadyEcommerce < 4.5.2 Stored XSS via Chat and Support Ticket Systems (medium 5.1)
- [CVE-2026-63104](https://insights.sbomify.com/CVE-2026-63104/): Kaneo 2.3.12 < 2.12.2 Missing Authorization via Bulk Task Endpoint (high 7.2)
- [CVE-2026-63102](https://insights.sbomify.com/CVE-2026-63102/): rConfig Core < 8.2.8 Privilege Escalation via Users API role field (medium 5.3)
- [CVE-2026-63101](https://insights.sbomify.com/CVE-2026-63101/): Open Event Server 1.19.1 Unauthenticated Member Roster Export via CSV Export Endpoint (high 8.7)
- [CVE-2026-63100](https://insights.sbomify.com/CVE-2026-63100/): Maybe 0.6.0 Missing Authorization via HostingsController show/update (high 7.1)
- [CVE-2026-6310](https://insights.sbomify.com/CVE-2026-6310/): Use after free in Chrome (high 8.3)
- [CVE-2026-63099](https://insights.sbomify.com/CVE-2026-63099/): TheHive 4.1.24 Broken Object Level Authorization via Attachment Download Endpoints (high 7.1)
- [CVE-2026-63098](https://insights.sbomify.com/CVE-2026-63098/): TheHive 4.1.24 Unauthenticated Information Disclosure via /api/status Endpoint (medium 6.9)
- [CVE-2026-63097](https://insights.sbomify.com/CVE-2026-63097/): Dendrite 0.13.8 syncapi /context Endpoint Post-Leave State Exposure (medium 5.3)
- [CVE-2026-63096](https://insights.sbomify.com/CVE-2026-63096/): Dendrite 0.13.8 SSRF via Unauthenticated Legacy Media Download Endpoint (medium 6.9)
- [CVE-2026-63095](https://insights.sbomify.com/CVE-2026-63095/): Dendrite 0.13.8 Improper Authorization via POST account/3pid/delete Endpoint (high 7.1)
- [CVE-2026-63094](https://insights.sbomify.com/CVE-2026-63094/): SigNoz < 0.134.0 SSO OAuth State Manipulation Session Token Theft (high 7.6)
- [CVE-2026-63093](https://insights.sbomify.com/CVE-2026-63093/): Cursor for Windows 3.2.16 RCE via Malicious git.exe in Workspace (high 8.7)
- [CVE-2026-63092](https://insights.sbomify.com/CVE-2026-63092/): kirby-modules License Key Disclosure via modules/activate Dialog (medium 5.3)
- [CVE-2026-63091](https://insights.sbomify.com/CVE-2026-63091/): ProFTPD mod_sftp Signed Integer Overflow via SCP Size-Record Parser (high 7.1)
- [CVE-2026-63090](https://insights.sbomify.com/CVE-2026-63090/): ProFTPD mod_sftp Heap Buffer Overflow via SFTP Packet Reassembly (high 8.7)
- [CVE-2026-6309](https://insights.sbomify.com/CVE-2026-6309/): Use after free in Chrome (high 8.3)
- [CVE-2026-63089](https://insights.sbomify.com/CVE-2026-63089/): WireGuard Easy Weak Token Generation Information Disclosure via OTL Route (critical 9.0)
- [CVE-2026-63088](https://insights.sbomify.com/CVE-2026-63088/): stoatchat < 0.14.0 SSRF via DNS-based IP Blocklist Bypass (high 7.7)
- [CVE-2026-63087](https://insights.sbomify.com/CVE-2026-63087/): Grafana OnCall 1.16.11 Unauthenticated Token Hijack via Plugin Install Endpoint (critical 9.3)
- [CVE-2026-63086](https://insights.sbomify.com/CVE-2026-63086/): text-generation-inference 3.3.7 SSRF via fetch_image in multimodal chat completions (medium 6.9)
- [CVE-2026-63085](https://insights.sbomify.com/CVE-2026-63085/): Axelor Open Platform 8.x < 8.2.2 Authorization Bypass via Nested Relational Record Persistence (high 8.7)
- [CVE-2026-63082](https://insights.sbomify.com/CVE-2026-63082/): Perfect Support Ticketing System 1.7 Broken Access Control via Agent Assignment (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/481/