# Vulnerabilities published in 2026


- [CVE-2026-61722](https://insights.sbomify.com/CVE-2026-61722/): FluidSynth: DLS Articulation Chunk Integer Overflow (medium 6.8)
- [CVE-2026-61721](https://insights.sbomify.com/CVE-2026-61721/): FluidSynth: Heap-based buffer overrun for DLS samples (high 8.0)
- [CVE-2026-61720](https://insights.sbomify.com/CVE-2026-61720/): FluidSynth: SF2 DMOD Chunk Unsigned Underflow (medium 6.2)
- [CVE-2026-6172](https://insights.sbomify.com/CVE-2026-6172/): Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'caption' Parameter (medium 6.4)
- [CVE-2026-61719](https://insights.sbomify.com/CVE-2026-61719/): WeGIA: Stored Cross-Site Scripting (XSS) in "historico_prontuarios.php" via "textoProntuario" Field (high 8.9)
- [CVE-2026-61718](https://insights.sbomify.com/CVE-2026-61718/): bunkerweb: Read-only Web UI users can delete job cache files due to missing authorization on /cache/ routes (medium 5.4)
- [CVE-2026-61714](https://insights.sbomify.com/CVE-2026-61714/): FluidSynth: Heap Buffer Overflow in MIDI Player (high 7.8)
- [CVE-2026-61712](https://insights.sbomify.com/CVE-2026-61712/): BuildKit: Possible runtime DoS via unbounded group parsing (low 2.3)
- [CVE-2026-61711](https://insights.sbomify.com/CVE-2026-61711/): BuildKit: Custom frontend could bypass Seccomp/AppArmor (medium 5.3)
- [CVE-2026-6171](https://insights.sbomify.com/CVE-2026-6171/): Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute (medium 6.4)
- [CVE-2026-61709](https://insights.sbomify.com/CVE-2026-61709/): OpenFGA: ListUsers returns a deliberately-excluded user when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that user (medium 5.3)
- [CVE-2026-61707](https://insights.sbomify.com/CVE-2026-61707/): SOCFortress CoPilot: Stored case-report template injection permits backend code execution (critical 9.0)
- [CVE-2026-61704](https://insights.sbomify.com/CVE-2026-61704/): link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897 (high 7.5)
- [CVE-2026-61702](https://insights.sbomify.com/CVE-2026-61702/): OpenPrinting CUPS: root-side banner file disclosure (medium 5.3)
- [CVE-2026-61701](https://insights.sbomify.com/CVE-2026-61701/): Laravel MagicLink: Insecure Deserialization of MagicLink Actions Leads to Remote Code Execution (high 8.8)
- [CVE-2026-61700](https://insights.sbomify.com/CVE-2026-61700/): MariaDB Connector/J does not enforce allowLocalInfile=false on server-initiated LOCAL INFILE requests (low 3.7)
- [CVE-2026-6170](https://insights.sbomify.com/CVE-2026-6170/): Cross-site scripting in Bold Page Builder (medium 6.4)
- [CVE-2026-61699](https://insights.sbomify.com/CVE-2026-61699/): nebula-mesh: Certificate revocation is never enforced at the mesh (high 8.1)
- [CVE-2026-61696](https://insights.sbomify.com/CVE-2026-61696/): Forem: Stored XSS in Admin Abuse Report Rendering (medium 6.3)
- [CVE-2026-61695](https://insights.sbomify.com/CVE-2026-61695/): Wire Swift runtime: negative LENGTH_DELIMITED length in skipGroup() crashes any protobuf-decoding service (high 7.5)
- [CVE-2026-61690](https://insights.sbomify.com/CVE-2026-61690/): Grav: Decompression Bomb via ZipArchiver - Missing Extraction Limits (medium 6.5)
- [CVE-2026-6169](https://insights.sbomify.com/CVE-2026-6169/): affiliate-toolkit <= 3.8.5 - Authenticated (Editor+) Remote Code Execution (high 7.2)
- [CVE-2026-61688](https://insights.sbomify.com/CVE-2026-61688/): SolidInvoice allows cross-user access to API token request history via writable DataGrid LiveComponent props (medium 6.5)
- [CVE-2026-61687](https://insights.sbomify.com/CVE-2026-61687/): hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState (high 7.1)
- [CVE-2026-61686](https://insights.sbomify.com/CVE-2026-61686/): SolidInvoice: PHP unserialize() called on client-controlled data in DataGrid LiveComponent context prop (high 7.5)
- [CVE-2026-61685](https://insights.sbomify.com/CVE-2026-61685/): ReactPress has SQL injection via dynamic column names in TypeORM query builders (high 7.5)
- [CVE-2026-61684](https://insights.sbomify.com/CVE-2026-61684/): FastGPT: Unauthenticated cross-tenant data access via forgeable plugin-invoke JWT (default INVOKE_TOKEN_SECRET='token') (high 8.8)
- [CVE-2026-61682](https://insights.sbomify.com/CVE-2026-61682/): kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace (critical 9.9)
- [CVE-2026-61681](https://insights.sbomify.com/CVE-2026-61681/): Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler (medium 4.1)
- [CVE-2026-6168](https://insights.sbomify.com/CVE-2026-6168/): TOTOLINK A7000R cstecgi.cgi setWiFiEasyGuestCfg stack-based overflow (high 8.7)
- [CVE-2026-61674](https://insights.sbomify.com/CVE-2026-61674/): Fluent Bit: Remote stack buffer overflow in Fluent Bit `out_forward` Secure-Forward `PONG` handler (critical 9.2)
- [CVE-2026-61673](https://insights.sbomify.com/CVE-2026-61673/): WeGIA: Stored DOM XSS in listar_despachos.php Allows Account Takeover (medium 6.3)
- [CVE-2026-61672](https://insights.sbomify.com/CVE-2026-61672/): Capsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcement (high 7.1)
- [CVE-2026-61671](https://insights.sbomify.com/CVE-2026-61671/): WeGIA: Systemic IDOR + Missing CSRF — extract($_REQUEST) in All Controle Classes (high 8.1)
- [CVE-2026-61670](https://insights.sbomify.com/CVE-2026-61670/): microsandbox: Secret values exposed in world-readable process arguments (medium 6.5)
- [CVE-2026-6167](https://insights.sbomify.com/CVE-2026-6167/): code-projects Faculty Management System subject-print.php sql injection (medium 6.9)
- [CVE-2026-61668](https://insights.sbomify.com/CVE-2026-61668/): DIRAC: Pilot code downloaded over unverified HTTPS connection (high 8.1)
- [CVE-2026-61667](https://insights.sbomify.com/CVE-2026-61667/): DIRAC: RCE in FileCatalog DatasetManager via SQL injection + eval (critical 9.9)
- [CVE-2026-61666](https://insights.sbomify.com/CVE-2026-61666/): websocket-driver: Denial of service via malformed Host header (high 8.9)
- [CVE-2026-61663](https://insights.sbomify.com/CVE-2026-61663/): django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff (medium 4.3)
- [CVE-2026-6166](https://insights.sbomify.com/CVE-2026-6166/): code-projects Vehicle Showroom Management System UpdateVehicleFunction.php sql injection (medium 6.9)
- [CVE-2026-61654](https://insights.sbomify.com/CVE-2026-61654/): Lightdash: Unauthenticated dbt Cloud webhook with path injection leaks API key (high 8.3)
- [CVE-2026-61652](https://insights.sbomify.com/CVE-2026-61652/): Zapros: Streaming decoders ignored the requested chunk size, allowing a single compressed response chunk to allocate unbounded memory (decompression bomb) (high 8.7)
- [CVE-2026-6165](https://insights.sbomify.com/CVE-2026-6165/): code-projects Vehicle Showroom Management System Login_check.php sql injection (medium 6.9)
- [CVE-2026-61647](https://insights.sbomify.com/CVE-2026-61647/): @roomi-fields/notebooklm-mcp has a path traversal in vault.batch tool that allows arbitrary file write outside intended vault directory (high 7.1)
- [CVE-2026-61646](https://insights.sbomify.com/CVE-2026-61646/): FastGPT: Shared axios SSRF guard validates only the initial URL before following redirects (medium 6.3)
- [CVE-2026-61645](https://insights.sbomify.com/CVE-2026-61645/): Docat has Arbitrary File Upload exists in Upload API (critical 9.1)
- [CVE-2026-61644](https://insights.sbomify.com/CVE-2026-61644/): Missing authorization in FastGPT (high 7.7)
- [CVE-2026-61643](https://insights.sbomify.com/CVE-2026-61643/): FastGPT: workflow runtime can execute another user's private HTTP toolset (medium 5.9)
- [CVE-2026-61642](https://insights.sbomify.com/CVE-2026-61642/): Squid Request Smuggling in HTTP Transfer-Encoding (high 7.7)
- [CVE-2026-61641](https://insights.sbomify.com/CVE-2026-61641/): Wallos: OIDC account takeover via email-based account linking without `email_verified` check (high 8.1)
- [CVE-2026-61640](https://insights.sbomify.com/CVE-2026-61640/): Wallos: SSRF via OIDC Token/UserInfo URL Configuration (high 8.5)
- [CVE-2026-6164](https://insights.sbomify.com/CVE-2026-6164/): code-projects Lost and Found Thing Management addcat.php sql injection (medium 6.9)
- [CVE-2026-61639](https://insights.sbomify.com/CVE-2026-61639/): Wallos: Zip Slip path traversal in database restore writes files to webroot (high 8.5)
- [CVE-2026-61638](https://insights.sbomify.com/CVE-2026-61638/): Wallos: SSRF via Test Email Notification - unvalidated SMTP host/port (high 8.2)
- [CVE-2026-61634](https://insights.sbomify.com/CVE-2026-61634/): RabbitMQ Java client accepts broker frames larger than the negotiated AMQP frame_max (not scored)
- [CVE-2026-61633](https://insights.sbomify.com/CVE-2026-61633/): NanoMQ: Infinite Loop in UNSUBSCRIBE Decoder Leading to Remote DoS (low 2.0)
- [CVE-2026-61632](https://insights.sbomify.com/CVE-2026-61632/): PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path (medium 5.3)
- [CVE-2026-61630](https://insights.sbomify.com/CVE-2026-61630/): nginx ignition has TOTP Reuse During Validity Window (medium 4.2)
- [CVE-2026-6163](https://insights.sbomify.com/CVE-2026-6163/): code-projects Lost and Found Thing Management catageory.php sql injection (medium 6.9)
- [CVE-2026-61629](https://insights.sbomify.com/CVE-2026-61629/): nginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddleware (high 7.5)
- [CVE-2026-61628](https://insights.sbomify.com/CVE-2026-61628/): nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition (high 8.1)
- [CVE-2026-61625](https://insights.sbomify.com/CVE-2026-61625/): VictoriaMetrics vmrestore: path traversal via crafted backup part names escapes restore root (medium 6.8)
- [CVE-2026-6162](https://insights.sbomify.com/CVE-2026-6162/): PHPGurukul Company Visitor Management System bwdates-reports-details.php cross site scripting (medium 5.1)
- [CVE-2026-61617](https://insights.sbomify.com/CVE-2026-61617/): Pterodactyl Wings SFTP write path does not enforce disk quota, allowing node-wide disk exhaustion (high 7.7)
- [CVE-2026-61614](https://insights.sbomify.com/CVE-2026-61614/): Information disclosure in SolidInvoice (medium 5.9)
- [CVE-2026-61613](https://insights.sbomify.com/CVE-2026-61613/): Cursor: Cloud Agent Browser Sandbox Escape (high 7.7)
- [CVE-2026-61612](https://insights.sbomify.com/CVE-2026-61612/): @aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509 (medium 5.7)
- [CVE-2026-61611](https://insights.sbomify.com/CVE-2026-61611/): Lychee: Missing rate limiting on album password unlock endpoint allows brute-force attacks (high 7.5)
- [CVE-2026-61610](https://insights.sbomify.com/CVE-2026-61610/): Lychee: unauthenticated photo starring reveals existence of private photos when photos_star_visibility=anonymous (low 2.3)
- [CVE-2026-6161](https://insights.sbomify.com/CVE-2026-6161/): code-projects Simple ChatBox Endpoint insert.php sql injection (medium 6.9)
- [CVE-2026-61609](https://insights.sbomify.com/CVE-2026-61609/): Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS) (high 7.5)
- [CVE-2026-61608](https://insights.sbomify.com/CVE-2026-61608/): Auth bypass in SolidInvoice (medium 6.8)
- [CVE-2026-61607](https://insights.sbomify.com/CVE-2026-61607/): Grav API Plugin: Stored XSS via SVG Upload - API Media Pipeline Bypasses Sanitizer (medium 4.6)
- [CVE-2026-61604](https://insights.sbomify.com/CVE-2026-61604/): ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass (critical 9.3)
- [CVE-2026-6160](https://insights.sbomify.com/CVE-2026-6160/): code-projects Simple ChatBox Endpoint chatbox.sql SimpleChatbox_PHP file information disclosure (medium 6.9)
- [CVE-2026-61599](https://insights.sbomify.com/CVE-2026-61599/): djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path (high 8.8)
- [CVE-2026-61598](https://insights.sbomify.com/CVE-2026-61598/): Client mass-assignment of arbitrary view attributes via the default dj-model update_model handler (high 7.1)
- [CVE-2026-61597](https://insights.sbomify.com/CVE-2026-61597/): djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags (medium 5.1)
- [CVE-2026-61596](https://insights.sbomify.com/CVE-2026-61596/): djust has broken object-level access control (IDOR) (high 7.1)
- [CVE-2026-61595](https://insights.sbomify.com/CVE-2026-61595/): djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data (high 7.7)
- [CVE-2026-61594](https://insights.sbomify.com/CVE-2026-61594/): djust has an authorization bypass on the WebSocket/SSE mount path (critical 9.1)
- [CVE-2026-61593](https://insights.sbomify.com/CVE-2026-61593/): djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE session (high 8.1)
- [CVE-2026-61592](https://insights.sbomify.com/CVE-2026-61592/): djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id is the sole authorization capability (session hijack) (high 7.4)
- [CVE-2026-61591](https://insights.sbomify.com/CVE-2026-61591/): djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection) (high 8.1)
- [CVE-2026-61590](https://insights.sbomify.com/CVE-2026-61590/): djust's observability endpoints are network-exposed: the localhost gate is an opt-in middleware the docs omit, and the views enforce only DEBUG (high 7.4)
- [CVE-2026-6159](https://insights.sbomify.com/CVE-2026-6159/): code-projects Simple ChatBox Endpoint insert.php cross site scripting (medium 5.3)
- [CVE-2026-61589](https://insights.sbomify.com/CVE-2026-61589/): djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live path (medium 6.3)
- [CVE-2026-61588](https://insights.sbomify.com/CVE-2026-61588/): djust's Django model serialization has no sensitive-field denylist: password hashes, privilege flags, and PII on a public view attribute are sent to the client (medium 6.5)
- [CVE-2026-6158](https://insights.sbomify.com/CVE-2026-6158/): Totolink N300RH upgrade.so setUpgradeUboot os command injection (medium 6.9)
- [CVE-2026-61576](https://insights.sbomify.com/CVE-2026-61576/): Lightdash: Unauthenticated dbt Cloud webhook with path injection leaks API key (high 8.3)
- [CVE-2026-61575](https://insights.sbomify.com/CVE-2026-61575/): AVideo-Encoder vulnerable to stored DOM cross-site scripting through queue titles (medium 4.7)
- [CVE-2026-61574](https://insights.sbomify.com/CVE-2026-61574/): authentik RAC: access any endpoint via an unrelated application (high 8.8)
- [CVE-2026-61573](https://insights.sbomify.com/CVE-2026-61573/): AVideo-Encoder: reflected cross-site scripting in the login interface (medium 6.1)
- [CVE-2026-61572](https://insights.sbomify.com/CVE-2026-61572/): AVideo-Encoder: unauthenticated full-response server-side request forgery (high 8.6)
- [CVE-2026-61571](https://insights.sbomify.com/CVE-2026-61571/): AVideo-Encoder: missing authentication on control and status endpoints (high 7.3)
- [CVE-2026-61570](https://insights.sbomify.com/CVE-2026-61570/): MPXJ: XXE Vulnerability in MerlinReader (high 7.5)
- [CVE-2026-6157](https://insights.sbomify.com/CVE-2026-6157/): Totolink A800R app.so setAppEasyWizardConfig buffer overflow (high 8.7)
- [CVE-2026-61569](https://insights.sbomify.com/CVE-2026-61569/): AVideo-Encoder: pre-authentication streamer-login SQL injection (high 7.5)
- [CVE-2026-61568](https://insights.sbomify.com/CVE-2026-61568/): @zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport (critical 9.6)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/493/