# Vulnerabilities published in 2026


- [CVE-2026-62362](https://insights.sbomify.com/CVE-2026-62362/): PeerBanHelper: SQL injection via ${field} interpolation in MyBatis mapper for analysis endpoint (medium 4.9)
- [CVE-2026-62361](https://insights.sbomify.com/CVE-2026-62361/): SQL injection in listmonk (medium 5.5)
- [CVE-2026-6236](https://insights.sbomify.com/CVE-2026-6236/): Posts map <= 0.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'name' Shortcode Attribute (medium 6.4)
- [CVE-2026-62357](https://insights.sbomify.com/CVE-2026-62357/): DragonflyDB `CMS.INITBYDIM` integer overflow leads to a remote, attacker-controlled heap out-of-bounds write (high 8.8)
- [CVE-2026-62355](https://insights.sbomify.com/CVE-2026-62355/): TDengine: Standard User permission unexpect (medium 5.4)
- [CVE-2026-62354](https://insights.sbomify.com/CVE-2026-62354/): Apache NiFi: Incorrect Authorization for Parameter Context Validation Requests (high 7.7)
- [CVE-2026-62353](https://insights.sbomify.com/CVE-2026-62353/): TDengine: Authenticated Out-of-Bounds Read in SQL Lexer tGetToken (medium 5.4)
- [CVE-2026-62351](https://insights.sbomify.com/CVE-2026-62351/): TDengine: Unauthenticated Remote Denial of Service via Out-of-Bounds Read in transDecompressMsg (high 7.5)
- [CVE-2026-62350](https://insights.sbomify.com/CVE-2026-62350/): TDengine: UDF lead to RCE (high 7.2)
- [CVE-2026-6235](https://insights.sbomify.com/CVE-2026-6235/): Sendmachine for WordPress <= 1.0.20 - Unauthenticated SMTP Hijack to Privilege Escalation via manage_admin_requests (critical 9.8)
- [CVE-2026-62349](https://insights.sbomify.com/CVE-2026-62349/): TDengine: Off-by-One Buffer Overflow (high 8.3)
- [CVE-2026-62348](https://insights.sbomify.com/CVE-2026-62348/): TDengine: KILL SSMIGRATE missing authorization lets low-privilege users interrupt shared-storage migrations (medium 5.4)
- [CVE-2026-62343](https://insights.sbomify.com/CVE-2026-62343/): ImageMagick: Heap Buffer Over-Write in morphology operation when an invalid kernel is provided (medium 4.7)
- [CVE-2026-62328](https://insights.sbomify.com/CVE-2026-62328/): 9Router 0.4.41 - Unauthenticated Information Disclosure via API Usage Endpoints (high 8.7)
- [CVE-2026-62327](https://insights.sbomify.com/CVE-2026-62327/): 9Router 0.4.41 - Unauthenticated API Key Exposure via /api/usage/stats (critical 9.3)
- [CVE-2026-62326](https://insights.sbomify.com/CVE-2026-62326/): Weblate Has Uncontrolled Resource Consumption via (medium 6.5)
- [CVE-2026-62325](https://insights.sbomify.com/CVE-2026-62325/): goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884) (critical 9.1)
- [CVE-2026-62324](https://insights.sbomify.com/CVE-2026-62324/): Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS (medium 5.4)
- [CVE-2026-62323](https://insights.sbomify.com/CVE-2026-62323/): Cloudreve: Unauthorized file write via WOPI view sessions whose access token secret is ignored (medium 6.3)
- [CVE-2026-62322](https://insights.sbomify.com/CVE-2026-62322/): Python Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign) (medium 6.5)
- [CVE-2026-6232](https://insights.sbomify.com/CVE-2026-6232/): Out-of-bounds write in LR11xx Transceiver (medium 5.2)
- [CVE-2026-62317](https://insights.sbomify.com/CVE-2026-62317/): Logto: ReDoS via unescaped user input in email subaddressing regex (blockSubaddressing) (high 7.5)
- [CVE-2026-62316](https://insights.sbomify.com/CVE-2026-62316/): Microsoft UFO: DNS Rebinding → Unauthenticated File Read / Command Execution (high 8.8)
- [CVE-2026-62315](https://insights.sbomify.com/CVE-2026-62315/): Frappe: Mass assignment via set_value (high 7.1)
- [CVE-2026-62314](https://insights.sbomify.com/CVE-2026-62314/): Anubis: Policy bypass via client controlled X-Original-URI header (medium 5.8)
- [CVE-2026-62313](https://insights.sbomify.com/CVE-2026-62313/): Incus: Project restriction `restricted.containers.privilege=isolated` bypassable by omitting `security.idmap.isolated` (medium 4.3)
- [CVE-2026-62312](https://insights.sbomify.com/CVE-2026-62312/): 9Router: Authenticated RCE via Unvalidated MCP Plugin Arguments (high 8.8)
- [CVE-2026-6231](https://insights.sbomify.com/CVE-2026-6231/): bson_validate may skip validation when processing certain inputs (medium 5.3)
- [CVE-2026-62309](https://insights.sbomify.com/CVE-2026-62309/): CoreDNS: proxyproto plugin panics on PPv2 datagram with non-UDP transport — single 28-byte packet remote DoS (high 7.5)
- [CVE-2026-62308](https://insights.sbomify.com/CVE-2026-62308/): Tugtainer: Authenticated SSRF via arbitrary notification URLs in test_notification endpoint (critical 9.1)
- [CVE-2026-6230](https://insights.sbomify.com/CVE-2026-6230/): Tainacan <= 1.0.3 - Unauthenticated SQL Injection via 'geoquery' REST API Parameter (high 7.5)
- [CVE-2026-62299](https://insights.sbomify.com/CVE-2026-62299/): Null dereference in coredns (medium 5.3)
- [CVE-2026-62296](https://insights.sbomify.com/CVE-2026-62296/): HAPI FHIR: XHTML narrative parser unbounded recursion causes StackOverflow denial of service (high 7.5)
- [CVE-2026-62295](https://insights.sbomify.com/CVE-2026-62295/): HAPI FHIR: JSON utility parser unbounded recursion causes StackOverflow denial of service (high 7.5)
- [CVE-2026-62294](https://insights.sbomify.com/CVE-2026-62294/): Flameshot: OCTOU symlink attack via predictable /tmp path in Flameshot "Open With" (medium 5.1)
- [CVE-2026-62293](https://insights.sbomify.com/CVE-2026-62293/): HAPI FHIR: Stored XSS in scan report via unescaped IG and profile titles (medium 5.0)
- [CVE-2026-62292](https://insights.sbomify.com/CVE-2026-62292/): libheif: Out-of-bounds read in uncompressed unci tile range slicing (high 8.7)
- [CVE-2026-62291](https://insights.sbomify.com/CVE-2026-62291/): Memory corruption in libheif (medium 5.3)
- [CVE-2026-62290](https://insights.sbomify.com/CVE-2026-62290/): cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials (high 7.3)
- [CVE-2026-6229](https://insights.sbomify.com/CVE-2026-6229/): Royal Addons for Elementor <= 1.7.1057 - Authenticated (Contributor+) Server-Side Request Forgery via CSV URL Parameter (high 7.2)
- [CVE-2026-62289](https://insights.sbomify.com/CVE-2026-62289/): libheif: Integer underflow in Fraction constructor via double clap transform application (medium 4.3)
- [CVE-2026-62286](https://insights.sbomify.com/CVE-2026-62286/): Dozzle label filters do not restrict container event and statistics streams (medium 4.3)
- [CVE-2026-62283](https://insights.sbomify.com/CVE-2026-62283/): Nezha Monitoring: Cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check (critical 9.9)
- [CVE-2026-62282](https://insights.sbomify.com/CVE-2026-62282/): OpenCVE: Server-Side Request Forgery (SSRF) in notifications (medium 6.5)
- [CVE-2026-62280](https://insights.sbomify.com/CVE-2026-62280/): OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page (medium 6.1)
- [CVE-2026-6228](https://insights.sbomify.com/CVE-2026-6228/): Frontend Admin by DynamiApps <= 3.28.36 - Unauthenticated Privilege Escalation via Edit User Form (high 8.8)
- [CVE-2026-62279](https://insights.sbomify.com/CVE-2026-62279/): Missing authorization in lubelog (high 7.1)
- [CVE-2026-62278](https://insights.sbomify.com/CVE-2026-62278/): Path traversal in lubelog (high 8.1)
- [CVE-2026-6227](https://insights.sbomify.com/CVE-2026-6227/): BackWPup <= 5.6.6 - Authenticated (Administrator+) Local File Inclusion via 'block_name' Parameter (high 7.2)
- [CVE-2026-62263](https://insights.sbomify.com/CVE-2026-62263/): OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass (critical 9.2)
- [CVE-2026-62262](https://insights.sbomify.com/CVE-2026-62262/): Piwigo: Unauthenticated SQL injection in `pwg.images.filteredSearch.create` (critical 9.1)
- [CVE-2026-6226](https://insights.sbomify.com/CVE-2026-6226/): Frontend Admin by DynamiApps <= 3.29.2 - Unauthenticated Privilege Escalation via Form Configuration Injection (high 8.8)
- [CVE-2026-62253](https://insights.sbomify.com/CVE-2026-62253/): Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default) (critical 9.8)
- [CVE-2026-62252](https://insights.sbomify.com/CVE-2026-62252/): Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login (critical 9.8)
- [CVE-2026-62251](https://insights.sbomify.com/CVE-2026-62251/): Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query (high 8.1)
- [CVE-2026-6225](https://insights.sbomify.com/CVE-2026-6225/): SQL injection in Taskbuilder – Project Management & Task Management Tool With Kanban Board (medium 6.5)
- [CVE-2026-62249](https://insights.sbomify.com/CVE-2026-62249/): Missing authorization in weblate (medium 4.3)
- [CVE-2026-62247](https://insights.sbomify.com/CVE-2026-62247/): Supabase Realtime: Incorrect Authorization (medium 6.5)
- [CVE-2026-62246](https://insights.sbomify.com/CVE-2026-62246/): Business logic in kamaji (high 8.5)
- [CVE-2026-62243](https://insights.sbomify.com/CVE-2026-62243/): Netty 4.2.0 through 4.2.16 TLS Hostname Verification Bypass (high 8.7)
- [CVE-2026-62242](https://insights.sbomify.com/CVE-2026-62242/): Spring Boot Admin Server < 4.1.2 SSRF via Unauthenticated Instance Registration (high 7.7)
- [CVE-2026-62241](https://insights.sbomify.com/CVE-2026-62241/): clawvet < 0.7.5 Hard-coded JWT Secret Session Forgery (critical 9.3)
- [CVE-2026-62240](https://insights.sbomify.com/CVE-2026-62240/): CrewAI < 1.15.1 SSRF Filter Bypass via HTTP Redirect in Scrape Tools (high 8.3)
- [CVE-2026-6224](https://insights.sbomify.com/CVE-2026-6224/): nocobase plugin-workflow-javascript Vm.js createSafeConsole sandbox (medium 6.9)
- [CVE-2026-62239](https://insights.sbomify.com/CVE-2026-62239/): FlashAttention Symlink Attack via tarfile.extractall in hopper/setup.py (medium 5.3)
- [CVE-2026-62238](https://insights.sbomify.com/CVE-2026-62238/): OpenRemote < 1.26.0 SQL Injection via Crosstab Export (high 7.2)
- [CVE-2026-62237](https://insights.sbomify.com/CVE-2026-62237/): Grav < 2.0.4 ReDoS via regex_replace in Sandbox (medium 6.0)
- [CVE-2026-62236](https://insights.sbomify.com/CVE-2026-62236/): grav-plugin-login < 3.8.11 CSRF via regenerate2FASecret (low 2.3)
- [CVE-2026-62235](https://insights.sbomify.com/CVE-2026-62235/): Grav Flex-Objects < 1.4.3 Authorization Bypass via API (low 2.3)
- [CVE-2026-62234](https://insights.sbomify.com/CVE-2026-62234/): Grav < 2.0.4 SSRF via Unrestricted cURL Protocols (high 8.4)
- [CVE-2026-62233](https://insights.sbomify.com/CVE-2026-62233/): grav-plugin-api < 1.0.6 Privilege Escalation via createApiKey (high 8.7)
- [CVE-2026-62232](https://insights.sbomify.com/CVE-2026-62232/): Grav < 2.0.4 2FA Bypass via Secret Regeneration (critical 9.1)
- [CVE-2026-62231](https://insights.sbomify.com/CVE-2026-62231/): Grav < 1.0.6 API Key Scope Bypass via ApiKeyAuthenticator (high 8.6)
- [CVE-2026-62230](https://insights.sbomify.com/CVE-2026-62230/): Grav < 2.0.4 File Access Bypass via Case Variation (high 8.7)
- [CVE-2026-6223](https://insights.sbomify.com/CVE-2026-6223/): OTP Bypass in Bahçelievler Muncipality's BiHayat App (critical 9.4)
- [CVE-2026-62229](https://insights.sbomify.com/CVE-2026-62229/): OpenClaw < 2026.5.18 Authorization Bypass via Glob Matching (high 7.7)
- [CVE-2026-62228](https://insights.sbomify.com/CVE-2026-62228/): OpenClaw < 2026.6.5 Authorization Bypass via Node Exec Approvals (high 7.7)
- [CVE-2026-62227](https://insights.sbomify.com/CVE-2026-62227/): OpenClaw 2026.4.14 < 2026.5.26 SSRF via Browser Snapshot (medium 4.9)
- [CVE-2026-62226](https://insights.sbomify.com/CVE-2026-62226/): OpenClaw 2026.3.28 < 2026.5.19 Authorization Bypass via Browser Act Route (medium 5.1)
- [CVE-2026-62225](https://insights.sbomify.com/CVE-2026-62225/): OpenClaw < 2026.5.18 Authorization Bypass via Skill Command Dispatch (low 2.3)
- [CVE-2026-62224](https://insights.sbomify.com/CVE-2026-62224/): OpenClaw MS Teams < 2026.5.12 Authorization Bypass (low 2.3)
- [CVE-2026-62223](https://insights.sbomify.com/CVE-2026-62223/): OpenClaw < 2026.5.18 Authorization Bypass via Device-pair (high 7.7)
- [CVE-2026-62222](https://insights.sbomify.com/CVE-2026-62222/): OpenClaw < 2026.5.22 Untrusted Plugin Loading via Setup-mode (high 7.1)
- [CVE-2026-62221](https://insights.sbomify.com/CVE-2026-62221/): OpenClaw 2026.5.12 < 2026.5.26 Authorization Bypass via allowFrom (low 2.3)
- [CVE-2026-62220](https://insights.sbomify.com/CVE-2026-62220/): OpenClaw 2026.2.25 < 2026.5.26 WebSocket Rate Limit Bypass (medium 6.3)
- [CVE-2026-6222](https://insights.sbomify.com/CVE-2026-6222/): Missing authorization in Forminator Forms – Contact Form, Payment Form & Custom Form Builder (medium 5.3)
- [CVE-2026-62219](https://insights.sbomify.com/CVE-2026-62219/): OpenClaw 2026.2.12 < 2026.5.26 Authorization Bypass via Blank Agent IDs (medium 6.0)
- [CVE-2026-62218](https://insights.sbomify.com/CVE-2026-62218/): OpenClaw 2026.1.20 < 2026.5.27 Authorization Bypass via device.pair.approve (high 8.7)
- [CVE-2026-62217](https://insights.sbomify.com/CVE-2026-62217/): OpenClaw 2026.5.14-beta.1 < 2026.5.27 Authentication Bypass via exec approvals (high 7.7)
- [CVE-2026-62216](https://insights.sbomify.com/CVE-2026-62216/): OpenClaw 2026.4.20 < 2026.5.28 Policy Bypass via Media Upload (low 2.3)
- [CVE-2026-62215](https://insights.sbomify.com/CVE-2026-62215/): OpenClaw < 2026.6.5 Authentication Bypass via HTTP Canvas (medium 5.1)
- [CVE-2026-62214](https://insights.sbomify.com/CVE-2026-62214/): OpenClaw < 2026.5.28 Bot Framework SSRF via serviceUrl Parameter Validation (medium 6.0)
- [CVE-2026-62213](https://insights.sbomify.com/CVE-2026-62213/): OpenClaw < 2026.5.27 Token Leakage via MS Teams Outbound Requests (medium 6.0)
- [CVE-2026-62212](https://insights.sbomify.com/CVE-2026-62212/): OpenClaw < 2026.5.28 Authentication Bypass via safeFetch (medium 5.1)
- [CVE-2026-62211](https://insights.sbomify.com/CVE-2026-62211/): OpenClaw < 2026.6.1 Credential Redaction Bypass via Trajectory Export (medium 4.1)
- [CVE-2026-62210](https://insights.sbomify.com/CVE-2026-62210/): OpenClaw < 2026.6.1 Denial of Service via Remote Media URLs (medium 6.0)
- [CVE-2026-62209](https://insights.sbomify.com/CVE-2026-62209/): OpenClaw 2026.5.10-beta.1 < 2026.6.5 Authorization Bypass via agent-mode dispatch (high 7.6)
- [CVE-2026-62208](https://insights.sbomify.com/CVE-2026-62208/): OpenClaw < 2026.6.5 Authorization Header Forwarding via SSE (medium 6.0)
- [CVE-2026-62207](https://insights.sbomify.com/CVE-2026-62207/): OpenClaw < 2026.6.5 Authentication Bypass via Admin Tools (high 7.7)
- [CVE-2026-62206](https://insights.sbomify.com/CVE-2026-62206/): OpenClaw < 2026.6.9 Authentication Bypass via Moderation Actions (medium 6.0)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/488/