# Vulnerabilities published in 2026


- [CVE-2026-61859](https://insights.sbomify.com/CVE-2026-61859/): ImageMagick before 7.1.2-26 Policy Bypass via script operation (medium 4.8)
- [CVE-2026-61858](https://insights.sbomify.com/CVE-2026-61858/): ImageMagick before 7.1.2-26 Policy Bypass via APNG encoder (medium 4.8)
- [CVE-2026-61857](https://insights.sbomify.com/CVE-2026-61857/): ImageMagick before 7.1.2-26 Heap Use-After-Free via XMP (medium 6.3)
- [CVE-2026-61855](https://insights.sbomify.com/CVE-2026-61855/): Zammad: Invalid PGP Detached Signatures Reported as Good Signature on Inbound Mail (medium 5.3)
- [CVE-2026-61852](https://insights.sbomify.com/CVE-2026-61852/): Chartbrew: SQL Injection via row_limit Parameter in AI runQuery Tool (medium 5.8)
- [CVE-2026-61851](https://insights.sbomify.com/CVE-2026-61851/): Chartbrew: Incomplete Read-Only Keyword Blocklist in AI runQuery Tool (medium 6.5)
- [CVE-2026-61844](https://insights.sbomify.com/CVE-2026-61844/): FileRise: Folder Metadata Filename Collisions Bypass "read_own" Isolation (high 7.1)
- [CVE-2026-61843](https://insights.sbomify.com/CVE-2026-61843/): FileRise: Unauthenticated File Overwrite Through Upload-Enabled Folder Shares (high 8.2)
- [CVE-2026-61842](https://insights.sbomify.com/CVE-2026-61842/): Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass) (medium 6.5)
- [CVE-2026-6184](https://insights.sbomify.com/CVE-2026-6184/): code-projects Simple Content Management System welcome.php cross site scripting (medium 4.8)
- [CVE-2026-61838](https://insights.sbomify.com/CVE-2026-61838/): Lychee: Album password bypass in ZIP downloads (high 8.2)
- [CVE-2026-61837](https://insights.sbomify.com/CVE-2026-61837/): Missing authorization in rabbitmq-server (medium 6.3)
- [CVE-2026-61836](https://insights.sbomify.com/CVE-2026-61836/): Directus: Authorization-dependent response served from unsegmented cache key (high 8.6)
- [CVE-2026-61835](https://insights.sbomify.com/CVE-2026-61835/): Directus: SSRF Protection Bypass via 0.0.0.0 in File Import (high 7.7)
- [CVE-2026-61834](https://insights.sbomify.com/CVE-2026-61834/): scim-patch: Mutation of Inherited Built-in Method Objects (medium 4.3)
- [CVE-2026-61833](https://insights.sbomify.com/CVE-2026-61833/): zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion (high 8.1)
- [CVE-2026-6183](https://insights.sbomify.com/CVE-2026-6183/): code-projects Simple Content Management System index.php sql injection (medium 6.9)
- [CVE-2026-61828](https://insights.sbomify.com/CVE-2026-61828/): Misconfiguration in nixpkgs (high 8.5)
- [CVE-2026-61825](https://insights.sbomify.com/CVE-2026-61825/): code16/sharp has a stored XSS via data-html-content Sanitizer Bypass (high 8.7)
- [CVE-2026-61824](https://insights.sbomify.com/CVE-2026-61824/): Defuddle: XSS via unescaped attribute interpolation in site extractors (high 8.2)
- [CVE-2026-61823](https://insights.sbomify.com/CVE-2026-61823/): code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute (high 7.3)
- [CVE-2026-61822](https://insights.sbomify.com/CVE-2026-61822/): pg_partman disable maintenance for all partition sets (medium 6.5)
- [CVE-2026-61821](https://insights.sbomify.com/CVE-2026-61821/): pg_partman authorization bypass to move child tables between schemas during retention (high 8.5)
- [CVE-2026-61820](https://insights.sbomify.com/CVE-2026-61820/): pg_partman privilege escalation via SQL injection when inheriting template properties (high 8.5)
- [CVE-2026-6182](https://insights.sbomify.com/CVE-2026-6182/): code-projects Simple Content Management System login.php sql injection (medium 6.9)
- [CVE-2026-61819](https://insights.sbomify.com/CVE-2026-61819/): pg_partman privilege escalation via SQL injection in when using pg_jobmon and encountering exception (high 8.5)
- [CVE-2026-61818](https://insights.sbomify.com/CVE-2026-61818/): pg_partman SQL injection in undo partition time encoder (high 8.5)
- [CVE-2026-61817](https://insights.sbomify.com/CVE-2026-61817/): pg_partman privilege escalation via SQL injection in several functions via time decoder (high 8.5)
- [CVE-2026-61816](https://insights.sbomify.com/CVE-2026-61816/): zbateson/mail-mime-parser has uncontrolled resource consumption (CPU/memory DoS) parsing untrusted MIME (high 7.5)
- [CVE-2026-61815](https://insights.sbomify.com/CVE-2026-61815/): zbateson/mail-mime-parser has CRLF header injection via attachment filename (high 7.2)
- [CVE-2026-61814](https://insights.sbomify.com/CVE-2026-61814/): Jawn: Quadratic parsing effort in AsyncParser (high 7.5)
- [CVE-2026-61811](https://insights.sbomify.com/CVE-2026-61811/): Wazuh: Unbounded Recursion in os_xml `_getattributes()` Causes analysisd Worker Thread Stack Exhaustion (medium 6.5)
- [CVE-2026-6181](https://insights.sbomify.com/CVE-2026-6181/): Auth bypass in AXIS OS (medium 5.9)
- [CVE-2026-61808](https://insights.sbomify.com/CVE-2026-61808/): LightRAG: Missing Authentication for Critical API Functions in Default Configuration (critical 9.8)
- [CVE-2026-61807](https://insights.sbomify.com/CVE-2026-61807/): Snipe-IT: Stored DOM XSS via table selected-count IDs (medium 6.3)
- [CVE-2026-61802](https://insights.sbomify.com/CVE-2026-61802/): Wazuh discloses cleartext cluster key to low-privilege API users via GET /cluster/local/config (medium 6.5)
- [CVE-2026-61801](https://insights.sbomify.com/CVE-2026-61801/): github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files (medium 5.5)
- [CVE-2026-61800](https://insights.sbomify.com/CVE-2026-61800/): Wazuh cluster worker file sync allows arbitrary file write under /var/ossec (incomplete fix for CVE-2026-30893) (critical 9.1)
- [CVE-2026-6180](https://insights.sbomify.com/CVE-2026-6180/): PaperCut MF: Card truncation on HP readers (medium 4.1)
- [CVE-2026-61795](https://insights.sbomify.com/CVE-2026-61795/): Capsule: hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validation (medium 6.8)
- [CVE-2026-61794](https://insights.sbomify.com/CVE-2026-61794/): Capsule: Malformed ForbiddenAnnotations.Regex can bypass Tenant validation and trigger namespace admission panic (medium 6.8)
- [CVE-2026-61793](https://insights.sbomify.com/CVE-2026-61793/): Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter (medium 6.9)
- [CVE-2026-61792](https://insights.sbomify.com/CVE-2026-61792/): Path traversal in weblate (high 7.7)
- [CVE-2026-61791](https://insights.sbomify.com/CVE-2026-61791/): OCO-Server: Stored XSS through agent hostnames in command buttons (high 7.4)
- [CVE-2026-61790](https://insights.sbomify.com/CVE-2026-61790/): Weblate: Team-enforced 2FA is bypassed for global permissions (medium 4.4)
- [CVE-2026-6179](https://insights.sbomify.com/CVE-2026-6179/): Stored Cross Site Scripting in NightWolf Penetration Testing Platform (medium 6.3)
- [CVE-2026-61788](https://insights.sbomify.com/CVE-2026-61788/): @bytebase/dbhub's read-only mode does not prevent database writes (high 7.4)
- [CVE-2026-61784](https://insights.sbomify.com/CVE-2026-61784/): xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSS (medium 6.1)
- [CVE-2026-61783](https://insights.sbomify.com/CVE-2026-61783/): Wazuh: RBAC permission-effect check in mask_sensitive_config allows low-privilege users to read cluster.key (high 7.0)
- [CVE-2026-61782](https://insights.sbomify.com/CVE-2026-61782/): @rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata (high 7.5)
- [CVE-2026-61781](https://insights.sbomify.com/CVE-2026-61781/): pg_partman has privilege escalation through SQL injection in create_partition_time() (critical 9.9)
- [CVE-2026-6178](https://insights.sbomify.com/CVE-2026-6178/): Betheme <= 28.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_box_2' Shortcode (medium 6.4)
- [CVE-2026-61779](https://insights.sbomify.com/CVE-2026-61779/): Deserialization in Megatron Bridge (high 7.8)
- [CVE-2026-61778](https://insights.sbomify.com/CVE-2026-61778/): Deserialization in Megatron Bridge (high 7.8)
- [CVE-2026-61777](https://insights.sbomify.com/CVE-2026-61777/): Deserialization in Megatron Bridge (high 7.8)
- [CVE-2026-61776](https://insights.sbomify.com/CVE-2026-61776/): Deserialization in Megatron Bridge (high 7.8)
- [CVE-2026-61775](https://insights.sbomify.com/CVE-2026-61775/): Deserialization in Megatron Bridge (high 7.8)
- [CVE-2026-61774](https://insights.sbomify.com/CVE-2026-61774/): Deserialization in Megatron Bridge (high 7.8)
- [CVE-2026-61773](https://insights.sbomify.com/CVE-2026-61773/): Deserialization in Megatron Bridge (high 7.8)
- [CVE-2026-61772](https://insights.sbomify.com/CVE-2026-61772/): Deserialization in Megatron Bridge (high 7.8)
- [CVE-2026-61771](https://insights.sbomify.com/CVE-2026-61771/): Deserialization in Megatron Bridge (high 7.8)
- [CVE-2026-61770](https://insights.sbomify.com/CVE-2026-61770/): Deserialization in Megatron Bridge (high 7.8)
- [CVE-2026-6177](https://insights.sbomify.com/CVE-2026-6177/): Custom Twitter Feeds <= 2.5.4 - Unauthenticated Stored Cross-Site Scripting via Cached Tweet Text (high 7.2)
- [CVE-2026-61769](https://insights.sbomify.com/CVE-2026-61769/): Deserialization in Megatron Bridge (high 7.8)
- [CVE-2026-61768](https://insights.sbomify.com/CVE-2026-61768/): Deserialization in Megatron Bridge (high 7.8)
- [CVE-2026-61767](https://insights.sbomify.com/CVE-2026-61767/): Deserialization in Megatron Bridge (high 7.8)
- [CVE-2026-61766](https://insights.sbomify.com/CVE-2026-61766/): Deserialization in Megatron Bridge (high 7.8)
- [CVE-2026-61765](https://insights.sbomify.com/CVE-2026-61765/): Deserialization in Megatron Bridge (high 7.8)
- [CVE-2026-61764](https://insights.sbomify.com/CVE-2026-61764/): Deserialization in Megatron Bridge (high 7.8)
- [CVE-2026-61763](https://insights.sbomify.com/CVE-2026-61763/): Deserialization in Megatron Bridge (high 7.8)
- [CVE-2026-61762](https://insights.sbomify.com/CVE-2026-61762/): Deserialization in Megatron Bridge (high 7.8)
- [CVE-2026-61761](https://insights.sbomify.com/CVE-2026-61761/): Deserialization in Megatron Bridge (high 7.8)
- [CVE-2026-61760](https://insights.sbomify.com/CVE-2026-61760/): Deserialization in Megatron Bridge (high 7.8)
- [CVE-2026-6176](https://insights.sbomify.com/CVE-2026-6176/): Customer Reviews for WooCommerce <= 5.106.0 - Unauthenticated Stored Cross-Site Scripting via Aggregated Review Form (high 7.2)
- [CVE-2026-61759](https://insights.sbomify.com/CVE-2026-61759/): Deserialization in Megatron Bridge (high 7.8)
- [CVE-2026-61758](https://insights.sbomify.com/CVE-2026-61758/): Deserialization in Megatron Bridge (high 7.8)
- [CVE-2026-61757](https://insights.sbomify.com/CVE-2026-61757/): Deserialization in Megatron Bridge (high 7.8)
- [CVE-2026-61756](https://insights.sbomify.com/CVE-2026-61756/): Deserialization in Megatron Bridge (high 7.8)
- [CVE-2026-61755](https://insights.sbomify.com/CVE-2026-61755/): Deserialization in Megatron Bridge (high 7.8)
- [CVE-2026-61754](https://insights.sbomify.com/CVE-2026-61754/): Deserialization in Megatron Bridge (high 7.8)
- [CVE-2026-61753](https://insights.sbomify.com/CVE-2026-61753/): Deserialization in Megatron Bridge (high 7.8)
- [CVE-2026-61752](https://insights.sbomify.com/CVE-2026-61752/): Deserialization in Megatron Bridge (high 7.8)
- [CVE-2026-61751](https://insights.sbomify.com/CVE-2026-61751/): Deserialization in Megatron Bridge (high 7.8)
- [CVE-2026-61750](https://insights.sbomify.com/CVE-2026-61750/): Deserialization in Megatron Bridge (high 7.8)
- [CVE-2026-61749](https://insights.sbomify.com/CVE-2026-61749/): InvenTree: Administrative staff users can trigger Arbitrary File Read leading to Credential Disclosure (medium 6.5)
- [CVE-2026-61748](https://insights.sbomify.com/CVE-2026-61748/): InvenTree: Report/Label print endpoints ignore per-model permissions (medium 4.3)
- [CVE-2026-61747](https://insights.sbomify.com/CVE-2026-61747/): Missing authorization in InvenTree (medium 4.3)
- [CVE-2026-61746](https://insights.sbomify.com/CVE-2026-61746/): InvenTree: Plugin-settings GET endpoints are readable without authentication (medium 5.3)
- [CVE-2026-61745](https://insights.sbomify.com/CVE-2026-61745/): Missing authorization in InvenTree (medium 4.3)
- [CVE-2026-61744](https://insights.sbomify.com/CVE-2026-61744/): Missing authorization in InvenTree (medium 6.5)
- [CVE-2026-61743](https://insights.sbomify.com/CVE-2026-61743/): Chartbrew: DNS Rebinding SSRF Bypass in Outbound Request Validation (medium 6.3)
- [CVE-2026-61742](https://insights.sbomify.com/CVE-2026-61742/): DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution (critical 9.3)
- [CVE-2026-61741](https://insights.sbomify.com/CVE-2026-61741/): http4s-scala-xml has an XML External Entity (XXE) processing issue (critical 9.3)
- [CVE-2026-61740](https://insights.sbomify.com/CVE-2026-61740/): LightRAG is Vulnerable to Authentication Bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection (critical 9.3)
- [CVE-2026-6174](https://insights.sbomify.com/CVE-2026-6174/): CC Child Pages <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'more' Parameter (medium 6.4)
- [CVE-2026-61736](https://insights.sbomify.com/CVE-2026-61736/): LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests (critical 9.3)
- [CVE-2026-61732](https://insights.sbomify.com/CVE-2026-61732/): Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context (critical 10.0)
- [CVE-2026-6173](https://insights.sbomify.com/CVE-2026-6173/): Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'background_image' Parameter (medium 6.4)
- [CVE-2026-61726](https://insights.sbomify.com/CVE-2026-61726/): Missing authorization in recipes (high 8.1)
- [CVE-2026-61723](https://insights.sbomify.com/CVE-2026-61723/): FluidSynth: DLS ptbl Chunk Integer Overflow (medium 6.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/492/