# Vulnerabilities published in 2026


- [CVE-2026-61567](https://insights.sbomify.com/CVE-2026-61567/): AVideo-Encoder: unauthenticated command execution through streamer login trust (critical 10.0)
- [CVE-2026-61564](https://insights.sbomify.com/CVE-2026-61564/): AVideo-Encoder: unauthenticated installer PHP code injection (critical 10.0)
- [CVE-2026-61560](https://insights.sbomify.com/CVE-2026-61560/): @zereight/mcp-gitlab: Unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeover (critical 9.8)
- [CVE-2026-6156](https://insights.sbomify.com/CVE-2026-6156/): Totolink A7100RU CGI cstecgi.cgi setIpQosRules os command injection (critical 9.3)
- [CVE-2026-61559](https://insights.sbomify.com/CVE-2026-61559/): @zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery (critical 9.6)
- [CVE-2026-61556](https://insights.sbomify.com/CVE-2026-61556/): LiquidJS: An infinite loop vulnerability in `strip_html` filter (high 8.7)
- [CVE-2026-61555](https://insights.sbomify.com/CVE-2026-61555/): OpenEXR: Empty multiView viewFromChannelName file crash (medium 5.5)
- [CVE-2026-61554](https://insights.sbomify.com/CVE-2026-61554/): emp3r0r has an unauthenticated HTTP Polling DoS (high 7.5)
- [CVE-2026-61552](https://insights.sbomify.com/CVE-2026-61552/): Icinga 2 DSL Injection via Unescaped Import Template Name (high 7.2)
- [CVE-2026-61551](https://insights.sbomify.com/CVE-2026-61551/): Icinga 2: Stack overflow via deeply nested JSON objects (high 8.6)
- [CVE-2026-61550](https://insights.sbomify.com/CVE-2026-61550/): Icinga 2: Improper access control for JSON-RPC update certificate messages (critical 9.8)
- [CVE-2026-6155](https://insights.sbomify.com/CVE-2026-6155/): Totolink A7100RU CGI cstecgi.cgi setWanCfg os command injection (critical 9.3)
- [CVE-2026-61549](https://insights.sbomify.com/CVE-2026-61549/): Woodpecker: Privilege escalation via unrestricted serviceAccountName in the Kubernetes backend (critical 9.0)
- [CVE-2026-61548](https://insights.sbomify.com/CVE-2026-61548/): Rsyslog: mmpstrucdata stack buffer overflow with oversized RFC5424 structured data (high 8.1)
- [CVE-2026-61546](https://insights.sbomify.com/CVE-2026-61546/): AnkiMCP: DNS rebinding reaches unauthenticated local AnkiMCP HTTP tools (high 8.8)
- [CVE-2026-61544](https://insights.sbomify.com/CVE-2026-61544/): libp2p-quic: Remote panic via certificate expiry race during QUIC handshake (high 8.2)
- [CVE-2026-61542](https://insights.sbomify.com/CVE-2026-61542/): Gearboy advisory / Gearsystem body: Unauthenticated network exposure of MCP HTTP tools (high 8.6)
- [CVE-2026-61541](https://insights.sbomify.com/CVE-2026-61541/): Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service (medium 6.9)
- [CVE-2026-6154](https://insights.sbomify.com/CVE-2026-6154/): Totolink A7100RU CGI cstecgi.cgi setWizardCfg os command injection (critical 9.3)
- [CVE-2026-61539](https://insights.sbomify.com/CVE-2026-61539/): Xinference: Remote code execution via unsafe `eval()` in Llama3 tool-call parsing (critical 10.0)
- [CVE-2026-61536](https://insights.sbomify.com/CVE-2026-61536/): Banks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCE (high 7.5)
- [CVE-2026-61534](https://insights.sbomify.com/CVE-2026-61534/): Yayson: Prototype pollution in the Store/LegacyStore deserialization (critical 9.1)
- [CVE-2026-6153](https://insights.sbomify.com/CVE-2026-6153/): code-projects Vehicle Showroom Management System StaffDetailsFunction.php sql injection (medium 6.9)
- [CVE-2026-61529](https://insights.sbomify.com/CVE-2026-61529/): Endatix: Blind second-order SSRF via anonymous form-submission file URLs (`SubmissionFileExtractor`) (medium 4.7)
- [CVE-2026-61526](https://insights.sbomify.com/CVE-2026-61526/): AdonisJS HTTP Server is vulnerable to reflected XSS through its exception handler (medium 6.1)
- [CVE-2026-61525](https://insights.sbomify.com/CVE-2026-61525/): Zammad: Arbitrary File Deletion via Unvalidated Session Identifier in Long Polling Controller (high 8.8)
- [CVE-2026-61524](https://insights.sbomify.com/CVE-2026-61524/): WebsiteBaker CMS < 2.13.10 File Upload RCE via Module Installation (high 8.6)
- [CVE-2026-61523](https://insights.sbomify.com/CVE-2026-61523/): WebsiteBaker CMS < 2.13.10 Code Injection via Droplets Editor (high 8.6)
- [CVE-2026-61520](https://insights.sbomify.com/CVE-2026-61520/): Simple Machines Forum SSRF via image proxy (medium 6.3)
- [CVE-2026-6152](https://insights.sbomify.com/CVE-2026-6152/): code-projects Vehicle Showroom Management System StaffAddingFunction.php sql injection (medium 6.9)
- [CVE-2026-61519](https://insights.sbomify.com/CVE-2026-61519/): Liberu CRM 0.9.1 < 10.0.0 Broken Access Control via TeamPolicy::addTeamMember() (high 8.7)
- [CVE-2026-61518](https://insights.sbomify.com/CVE-2026-61518/): ISPConfig Authenticated SQL Injection via Remote API primary_id Parameter (high 8.7)
- [CVE-2026-61517](https://insights.sbomify.com/CVE-2026-61517/): Netis NX10 OS Command Injection via Ping Diagnostic Handler (high 8.6)
- [CVE-2026-61516](https://insights.sbomify.com/CVE-2026-61516/): Netis NX10 Credential Disclosure via sysinfo Diagnostic Endpoint (critical 9.3)
- [CVE-2026-61515](https://insights.sbomify.com/CVE-2026-61515/): Puwell IP Camera 2.x - 4.x Unauthenticated Command Injection via DebugShell (critical 9.3)
- [CVE-2026-61514](https://insights.sbomify.com/CVE-2026-61514/): Puwell IP Camera 2.x - 4.x Unauthenticated Access via TCP Port 23456 (critical 9.3)
- [CVE-2026-61511](https://insights.sbomify.com/CVE-2026-61511/): vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php (critical 9.3)
- [CVE-2026-6151](https://insights.sbomify.com/CVE-2026-6151/): code-projects Vehicle Showroom Management System PaymentStatusFunction.php sql injection (medium 6.9)
- [CVE-2026-61505](https://insights.sbomify.com/CVE-2026-61505/): Rejetto HFS < 3.2.1 Limited File Disclosure via Path Traversal in lang Parameter (medium 6.9)
- [CVE-2026-61504](https://insights.sbomify.com/CVE-2026-61504/): Rejetto HFS < 3.2.1 Stored XSS via File Names in Basic Web Listing (medium 5.1)
- [CVE-2026-61503](https://insights.sbomify.com/CVE-2026-61503/): Rejetto HFS < 3.2.1 Username Enumeration via Login Response Differences (medium 6.9)
- [CVE-2026-61502](https://insights.sbomify.com/CVE-2026-61502/): Rejetto HFS < 3.2.1 Cross-Site Request Forgery via GET Requests (medium 5.1)
- [CVE-2026-61501](https://insights.sbomify.com/CVE-2026-61501/): Rejetto HFS < 3.2.1 Stored XSS in Admin Log Viewer (medium 5.3)
- [CVE-2026-61500](https://insights.sbomify.com/CVE-2026-61500/): Rejetto HFS < 3.2.1 Session Forgery via Predictable Signing Key (critical 9.3)
- [CVE-2026-6150](https://insights.sbomify.com/CVE-2026-6150/): code-projects Simple Laundry System checkupdatestatus.php cross site scripting (medium 5.3)
- [CVE-2026-61498](https://insights.sbomify.com/CVE-2026-61498/): Vitec Flamingo 4.12.2 Unauthenticated OS Command Injection via gen_graphs.php (critical 9.3)
- [CVE-2026-61492](https://insights.sbomify.com/CVE-2026-61492/): Cross-site scripting in YouTrack (low 3.5)
- [CVE-2026-6149](https://insights.sbomify.com/CVE-2026-6149/): code-projects Vehicle Showroom Management System BookVehicleFunction.php sql injection (medium 6.9)
- [CVE-2026-61487](https://insights.sbomify.com/CVE-2026-61487/): Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authorization bypass via temporary composite destinations (medium 6.5)
- [CVE-2026-61486](https://insights.sbomify.com/CVE-2026-61486/): Apache Lucy: stack-buffer-overflow in JSON parser error reporter on malformed input (critical 9.8)
- [CVE-2026-61484](https://insights.sbomify.com/CVE-2026-61484/): Apache Lucy: LucyX::Remote::SearchServer unauthenticated remote Storable::thaw -> RCE/DoS (critical 9.8)
- [CVE-2026-61483](https://insights.sbomify.com/CVE-2026-61483/): Apache Lucy: QueryParser unbounded recursion on deeply-nested query -> C-stack-overflow DoS (high 7.5)
- [CVE-2026-6148](https://insights.sbomify.com/CVE-2026-6148/): code-projects Vehicle Showroom Management System MonthTotalReportUpdateFunction.php sql injection (medium 6.9)
- [CVE-2026-61477](https://insights.sbomify.com/CVE-2026-61477/): Libvirt: libvirt: newline injection in network xml dns txt/srv fields allows dnsmasq config directive injection (low 2.3)
- [CVE-2026-61474](https://insights.sbomify.com/CVE-2026-61474/): MISP: Improper sharing group authorization check when adding attributes (medium 5.3)
- [CVE-2026-6147](https://insights.sbomify.com/CVE-2026-6147/): LightSync Pro <= 2.1.6 - Authenticated (Author+) Arbitrary File Upload (high 8.8)
- [CVE-2026-61466](https://insights.sbomify.com/CVE-2026-61466/): Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalation (critical 9.1)
- [CVE-2026-61465](https://insights.sbomify.com/CVE-2026-61465/): ImageMagick before 7.1.2-26 Memory Allocation Policy Bypass (medium 4.8)
- [CVE-2026-61464](https://insights.sbomify.com/CVE-2026-61464/): ImageMagick before 7.1.2-26 Heap Buffer Over-Write via X11 (low 1.0)
- [CVE-2026-61463](https://insights.sbomify.com/CVE-2026-61463/): Shiori Authenticated Privilege Escalation via PATCH /api/v1/auth/account (high 8.7)
- [CVE-2026-61462](https://insights.sbomify.com/CVE-2026-61462/): mcp-gitlab Path Traversal via job_id Parameter (critical 9.2)
- [CVE-2026-61461](https://insights.sbomify.com/CVE-2026-61461/): Dify < 1.16.0-rc1 SQL Injection via MyScale Vector Store search_by_full_text (high 8.7)
- [CVE-2026-61460](https://insights.sbomify.com/CVE-2026-61460/): Krayin CRM Insecure Direct Object Reference via Controllers (high 8.7)
- [CVE-2026-6146](https://insights.sbomify.com/CVE-2026-6146/): Amazon::Credentials versions through 1.2.0 for Perl uses rand to generate encryption keys (medium 5.3)
- [CVE-2026-61459](https://insights.sbomify.com/CVE-2026-61459/): MCP Server Kubernetes < 3.9.0 Argument Injection via kubectl Structured Tools (critical 9.3)
- [CVE-2026-61458](https://insights.sbomify.com/CVE-2026-61458/): PasswordPusher < 2.9.2 Passphrase Brute-Force via Unthrottled Endpoint (high 8.7)
- [CVE-2026-61457](https://insights.sbomify.com/CVE-2026-61457/): Grav before 1.0.3 Remote Code Execution via File Upload Extension Bypass (medium 5.3)
- [CVE-2026-61456](https://insights.sbomify.com/CVE-2026-61456/): Grav before 1.0.3 Stored XSS via SVG Upload API (medium 5.1)
- [CVE-2026-61455](https://insights.sbomify.com/CVE-2026-61455/): Grav before 2.0.1 Decompression Bomb via ZipArchiver (high 7.1)
- [CVE-2026-61454](https://insights.sbomify.com/CVE-2026-61454/): Grav before 2.0.4 Information Disclosure via __GRAV_CONFIG__ (high 8.7)
- [CVE-2026-61453](https://insights.sbomify.com/CVE-2026-61453/): Grav before 2.0.1 XSS via Twig String Concatenation (medium 5.1)
- [CVE-2026-61452](https://insights.sbomify.com/CVE-2026-61452/): Grav before 2.0.4 Improper Session Invalidation JWT Access Tokens (medium 6.9)
- [CVE-2026-61451](https://insights.sbomify.com/CVE-2026-61451/): Grav API Plugin before 1.0.4 Password Reset Token Poisoning via admin_base_url (critical 9.4)
- [CVE-2026-61450](https://insights.sbomify.com/CVE-2026-61450/): Grav before 2.0.2 Config Exfiltration via offsetGet Filter (high 7.1)
- [CVE-2026-6145](https://insights.sbomify.com/CVE-2026-6145/): Missing authorization in User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder (medium 5.3)
- [CVE-2026-61449](https://insights.sbomify.com/CVE-2026-61449/): Grav before 2.0.2 Decompression Bomb via Forged ZIP Size (high 7.1)
- [CVE-2026-61448](https://insights.sbomify.com/CVE-2026-61448/): Parse Server 9.0.0 Stored XSS via malformed Content-Type (low 2.1)
- [CVE-2026-61447](https://insights.sbomify.com/CVE-2026-61447/): PraisonAI before 1.6.78 Remote Code Execution via CodeAgent (critical 10.0)
- [CVE-2026-61446](https://insights.sbomify.com/CVE-2026-61446/): PraisonAI before 1.6.78 Remote Code Execution via Plugin Auto-Discovery (high 8.6)
- [CVE-2026-61445](https://insights.sbomify.com/CVE-2026-61445/): PraisonAI before 4.6.78 Arbitrary File Write and Command Execution (critical 9.4)
- [CVE-2026-61444](https://insights.sbomify.com/CVE-2026-61444/): PraisonAI before 4.6.78 Code Injection via f-string (critical 9.4)
- [CVE-2026-61443](https://insights.sbomify.com/CVE-2026-61443/): PraisonAI before 1.6.78 Remote Code Execution via SkillTools (high 8.6)
- [CVE-2026-61442](https://insights.sbomify.com/CVE-2026-61442/): PraisonAI Platform before 0.1.9 Authorization Bypass via PATCH (high 7.1)
- [CVE-2026-61441](https://insights.sbomify.com/CVE-2026-61441/): PraisonAI Platform before 0.1.9 Authorization Bypass via Dependencies (high 7.1)
- [CVE-2026-61440](https://insights.sbomify.com/CVE-2026-61440/): PraisonAI Platform before 0.1.9 Authorization Bypass via Label Endpoints (high 7.1)
- [CVE-2026-61439](https://insights.sbomify.com/CVE-2026-61439/): PraisonAI before 4.6.78 Prompt Injection Defense Bypass (high 8.7)
- [CVE-2026-61438](https://insights.sbomify.com/CVE-2026-61438/): PraisonAI before 4.6.78 Remote Code Execution via Broken AST Sandbox (high 7.0)
- [CVE-2026-61437](https://insights.sbomify.com/CVE-2026-61437/): PraisonAI before 1.6.78 Remote Code Execution via tools.py (high 8.5)
- [CVE-2026-61436](https://insights.sbomify.com/CVE-2026-61436/): PraisonAI before 4.6.78 Missing Webhook Signature Verification (high 8.8)
- [CVE-2026-61435](https://insights.sbomify.com/CVE-2026-61435/): PraisonAI before 4.6.78 Authentication Bypass via Host Header Spoofing (high 8.8)
- [CVE-2026-61434](https://insights.sbomify.com/CVE-2026-61434/): PraisonAI before 4.6.78 Allowlist Bypass via find -exec (high 8.7)
- [CVE-2026-61433](https://insights.sbomify.com/CVE-2026-61433/): PraisonAI before 4.6.78 Code Injection via API deployment generator (high 8.5)
- [CVE-2026-61432](https://insights.sbomify.com/CVE-2026-61432/): PraisonAI FastContext before 1.6.78 Path Traversal (medium 6.9)
- [CVE-2026-61431](https://insights.sbomify.com/CVE-2026-61431/): PraisonAI before 4.6.78 Path Traversal via ContextGatherer (medium 6.8)
- [CVE-2026-61430](https://insights.sbomify.com/CVE-2026-61430/): PraisonAI before 1.6.78 DNS Rebinding SSRF via web_crawl (high 8.4)
- [CVE-2026-6143](https://insights.sbomify.com/CVE-2026-6143/): farion1231 cc-switch ProxyServer server.rs cross-domain policy (medium 5.3)
- [CVE-2026-61429](https://insights.sbomify.com/CVE-2026-61429/): PraisonAI before 1.6.78 SSRF via Crawl4AI Chromium backend (high 8.4)
- [CVE-2026-61428](https://insights.sbomify.com/CVE-2026-61428/): PraisonAI AgentMail before 4.6.78 Message Injection via Webhook (medium 6.9)
- [CVE-2026-61427](https://insights.sbomify.com/CVE-2026-61427/): PraisonAI before 4.6.78 Authentication Bypass via HTTP-stream (medium 6.9)
- [CVE-2026-61426](https://insights.sbomify.com/CVE-2026-61426/): PraisonAI before 1.7.3 Unauthenticated Agent Access via Insecure Defaults (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/494/