# Vulnerabilities published in 2026


- [CVE-2026-60001](https://insights.sbomify.com/CVE-2026-60001/): Security feature bypass in OpenSSH (medium 6.5)
- [CVE-2026-60000](https://insights.sbomify.com/CVE-2026-60000/): Denial of service in OpenSSH (low 3.7)
- [CVE-2026-6000](https://insights.sbomify.com/CVE-2026-6000/): code-projects Online Library Management System SQL Database Backup File library.sql information disclosure (medium 5.3)
- [CVE-2026-59999](https://insights.sbomify.com/CVE-2026-59999/): Security feature bypass in OpenSSH (medium 5.9)
- [CVE-2026-59998](https://insights.sbomify.com/CVE-2026-59998/): Security feature bypass in OpenSSH (medium 4.8)
- [CVE-2026-59997](https://insights.sbomify.com/CVE-2026-59997/): Security feature bypass in OpenSSH (medium 4.2)
- [CVE-2026-59996](https://insights.sbomify.com/CVE-2026-59996/): Path traversal in OpenSSH (medium 4.2)
- [CVE-2026-59995](https://insights.sbomify.com/CVE-2026-59995/): Path traversal in OpenSSH (medium 4.2)
- [CVE-2026-59994](https://insights.sbomify.com/CVE-2026-59994/): EspoCRM: Pre-authentication stored HTML injection in stream notification emails about email received (medium 4.3)
- [CVE-2026-59992](https://insights.sbomify.com/CVE-2026-59992/): Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters) (medium 5.4)
- [CVE-2026-59991](https://insights.sbomify.com/CVE-2026-59991/): psd-tools: Uncontrolled memory allocation in psd-tools composite/numpy via crafted PSD geometry (high 7.5)
- [CVE-2026-59990](https://insights.sbomify.com/CVE-2026-59990/): Jawn: Uncontrolled nesting depth in JSON parser (high 7.5)
- [CVE-2026-5999](https://insights.sbomify.com/CVE-2026-5999/): JeecgBoot SysAnnouncementController improper authorization (medium 5.3)
- [CVE-2026-59989](https://insights.sbomify.com/CVE-2026-59989/): Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI lead to RCE) (critical 9.2)
- [CVE-2026-59985](https://insights.sbomify.com/CVE-2026-59985/): OpenEXR: Heap out-of-bounds read in OpenEXRCore RLE decoding on ILP32 (medium 5.5)
- [CVE-2026-59984](https://insights.sbomify.com/CVE-2026-59984/): OpenEXR: Scratch buffer overflow decoding B44-compressed InputFile on ILP32 (medium 5.5)
- [CVE-2026-59983](https://insights.sbomify.com/CVE-2026-59983/): OpenEXR: Out-of-bounds read in DeepTiledInputFile sample-count table decode on ILP32 (medium 5.5)
- [CVE-2026-59982](https://insights.sbomify.com/CVE-2026-59982/): OpenEXR: DWAA InputFile AC buffer overflow on ILP32 platforms (high 7.1)
- [CVE-2026-59981](https://insights.sbomify.com/CVE-2026-59981/): OpenEXR: Heap OOB read in SampleCountChannel row when using nonzero dataWindow (high 7.1)
- [CVE-2026-59980](https://insights.sbomify.com/CVE-2026-59980/): hpack: Unbounded variable integer decoding can cause run-away computation on malformed input (medium 6.3)
- [CVE-2026-5998](https://insights.sbomify.com/CVE-2026-5998/): zhayujie chatgpt-on-wechat CowAgent API Memory Content Endpoint service.py dispatch path traversal (medium 6.9)
- [CVE-2026-59979](https://insights.sbomify.com/CVE-2026-59979/): YosemiteCrew: Missing organization authorization on service and PMS library/template routes (high 8.3)
- [CVE-2026-59977](https://insights.sbomify.com/CVE-2026-59977/): ConvertX: Cross-Site Request Forgery (CSRF) leading to Unauthorized Data Destruction (high 8.1)
- [CVE-2026-59976](https://insights.sbomify.com/CVE-2026-59976/): ConvertX: Path Traversal vulnerability leading to Arbitrary File Write (high 8.1)
- [CVE-2026-59974](https://insights.sbomify.com/CVE-2026-59974/): Stanza: Zip Slip Path Traversal in Model/Resource Extraction (high 7.8)
- [CVE-2026-59973](https://insights.sbomify.com/CVE-2026-59973/): mcp-from-openapi: Bypass of OpenAPI external $ref SSRF fix in latest FrontMCP and mcp-from-openapi (high 8.5)
- [CVE-2026-59971](https://insights.sbomify.com/CVE-2026-59971/): MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure) (critical 10.0)
- [CVE-2026-59970](https://insights.sbomify.com/CVE-2026-59970/): Tandoor Recipes: Blind SSRF via AI provider URL (api_base) (high 7.7)
- [CVE-2026-5997](https://insights.sbomify.com/CVE-2026-5997/): Totolink A7100RU CGI cstecgi.cgi setLoginPasswordCfg os command injection (critical 9.3)
- [CVE-2026-59969](https://insights.sbomify.com/CVE-2026-59969/): Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode (high 7.5)
- [CVE-2026-59967](https://insights.sbomify.com/CVE-2026-59967/): Missing authorization in recipes (medium 5.4)
- [CVE-2026-59966](https://insights.sbomify.com/CVE-2026-59966/): Tandoor Recipes: ReDoS (Regular Expression Denial of Service) via User-Controlled Automation Regex Patterns (medium 5.7)
- [CVE-2026-59965](https://insights.sbomify.com/CVE-2026-59965/): @jhb.software/payload-alt-text-plugin: Alt Text Endpoint Authorization Bypass via Payload Local API `overrideAccess` Omission (high 7.1)
- [CVE-2026-59963](https://insights.sbomify.com/CVE-2026-59963/): Tandoor Recipes: Private recipe file and share-link authorization bypass in recipe utility API endpoints (high 7.1)
- [CVE-2026-59962](https://insights.sbomify.com/CVE-2026-59962/): Tandoor Recipes: ORM ORDER BY Injection via FK Traversal in Tandoor Recipes (medium 6.5)
- [CVE-2026-59960](https://insights.sbomify.com/CVE-2026-59960/): Argos JavaScript: CI Branch Name OS Command Injection in @argos-ci/core (high 7.5)
- [CVE-2026-5996](https://insights.sbomify.com/CVE-2026-5996/): Totolink A7100RU CGI cstecgi.cgi setAdvancedInfoShow os command injection (critical 9.3)
- [CVE-2026-59959](https://insights.sbomify.com/CVE-2026-59959/): SAIL: WebP decoder division by zero through malformed animated canvas metadata (medium 4.8)
- [CVE-2026-59956](https://insights.sbomify.com/CVE-2026-59956/): OpenImageIO: Heap-buffer-overread in IffInput::readimg() when ZBUFFER flag is set (medium 6.1)
- [CVE-2026-59955](https://insights.sbomify.com/CVE-2026-59955/): Apollo ConfigService access key authentication bypass via raw config file appId parsing (high 7.5)
- [CVE-2026-59954](https://insights.sbomify.com/CVE-2026-59954/): Apollo ConfigService access key authentication bypass via appId parsing and non-canonical matching (high 7.5)
- [CVE-2026-59952](https://insights.sbomify.com/CVE-2026-59952/): Valibot: record() issue paths can make flatten() throw for inherited Object property names (medium 6.9)
- [CVE-2026-59951](https://insights.sbomify.com/CVE-2026-59951/): MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion (medium 6.9)
- [CVE-2026-59950](https://insights.sbomify.com/CVE-2026-59950/): MCP Python SDK: WebSocket server transport does not support Host/Origin validation (high 7.6)
- [CVE-2026-5995](https://insights.sbomify.com/CVE-2026-5995/): Totolink A7100RU CGI cstecgi.cgi setMiniuiHomeInfoShow os command injection (critical 9.3)
- [CVE-2026-59949](https://insights.sbomify.com/CVE-2026-59949/): LZ4 Java: Native XXHash implementations can crash the JVM when passed invalid byte array ranges (medium 6.5)
- [CVE-2026-59948](https://insights.sbomify.com/CVE-2026-59948/): Composer: Arbitrary file write outside vendor via malicious transitive package name (high 7.0)
- [CVE-2026-59947](https://insights.sbomify.com/CVE-2026-59947/): Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure) (medium 4.7)
- [CVE-2026-59946](https://insights.sbomify.com/CVE-2026-59946/): Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files (medium 6.1)
- [CVE-2026-59944](https://insights.sbomify.com/CVE-2026-59944/): Composer: CVE-2026-59946 fix bypass via symlinked package bin path (medium 6.1)
- [CVE-2026-59943](https://insights.sbomify.com/CVE-2026-59943/): Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem (medium 6.3)
- [CVE-2026-59942](https://insights.sbomify.com/CVE-2026-59942/): Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps (medium 6.3)
- [CVE-2026-59941](https://insights.sbomify.com/CVE-2026-59941/): Dompdf: Uncontrolled resource consumption based on declared BMP dimensions (medium 6.3)
- [CVE-2026-59940](https://insights.sbomify.com/CVE-2026-59940/): seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization (critical 9.8)
- [CVE-2026-5994](https://insights.sbomify.com/CVE-2026-5994/): Totolink A7100RU CGI cstecgi.cgi setTelnetCfg os command injection (critical 9.3)
- [CVE-2026-59939](https://insights.sbomify.com/CVE-2026-59939/): httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling (high 7.5)
- [CVE-2026-59938](https://insights.sbomify.com/CVE-2026-59938/): pypdf: Possible large memory usage for wrong image dimensions (medium 6.9)
- [CVE-2026-59937](https://insights.sbomify.com/CVE-2026-59937/): pypdf: Possible long runtimes for repeated malformed cross-reference entries (medium 6.9)
- [CVE-2026-59936](https://insights.sbomify.com/CVE-2026-59936/): pypdf: Possible infinite loop for not terminated inline images (high 8.7)
- [CVE-2026-59935](https://insights.sbomify.com/CVE-2026-59935/): pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter) (high 8.7)
- [CVE-2026-59933](https://insights.sbomify.com/CVE-2026-59933/): PhpSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion (high 7.5)
- [CVE-2026-59932](https://insights.sbomify.com/CVE-2026-59932/): PhpSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion (high 7.5)
- [CVE-2026-59931](https://insights.sbomify.com/CVE-2026-59931/): PhpSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist (high 7.7)
- [CVE-2026-59930](https://insights.sbomify.com/CVE-2026-59930/): Mistune toc / TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with attacker-controlled `id="toc_N"` content (medium 4.3)
- [CVE-2026-5993](https://insights.sbomify.com/CVE-2026-5993/): Totolink A7100RU CGI cstecgi.cgi setWiFiGuestCfg os command injection (critical 9.3)
- [CVE-2026-59929](https://insights.sbomify.com/CVE-2026-59929/): Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution (medium 6.1)
- [CVE-2026-59928](https://insights.sbomify.com/CVE-2026-59928/): Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions (high 7.5)
- [CVE-2026-59927](https://insights.sbomify.com/CVE-2026-59927/): Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files (medium 5.3)
- [CVE-2026-59926](https://insights.sbomify.com/CVE-2026-59926/): Mistune: XSS via unescaped class option in Admonition directive (medium 5.3)
- [CVE-2026-59925](https://insights.sbomify.com/CVE-2026-59925/): inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs (high 7.5)
- [CVE-2026-59924](https://insights.sbomify.com/CVE-2026-59924/): Mistune: Arbitrary File Read via Include directive path traversal (medium 5.9)
- [CVE-2026-59923](https://insights.sbomify.com/CVE-2026-59923/): Mistune: XSS via percent-encoded javascript URI bypass in safe_url() (medium 6.1)
- [CVE-2026-59922](https://insights.sbomify.com/CVE-2026-59922/): Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert) (high 7.5)
- [CVE-2026-59921](https://insights.sbomify.com/CVE-2026-59921/): Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder (medium 5.7)
- [CVE-2026-59920](https://insights.sbomify.com/CVE-2026-59920/): Netty: STOMP CONNECT Frame Header Injection (medium 6.5)
- [CVE-2026-5992](https://insights.sbomify.com/CVE-2026-5992/): Tenda F451 P2pListFilter fromP2pListFilter stack-based overflow (high 8.7)
- [CVE-2026-59919](https://insights.sbomify.com/CVE-2026-59919/): Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address (medium 5.5)
- [CVE-2026-59917](https://insights.sbomify.com/CVE-2026-59917/): Privilege escalation in Display and Peripheral Manager (DDPM Windows) (high 7.8)
- [CVE-2026-59916](https://insights.sbomify.com/CVE-2026-59916/): Privilege escalation in Display and Peripheral Manager (DDPM Windows) (high 7.8)
- [CVE-2026-59915](https://insights.sbomify.com/CVE-2026-59915/): Privilege escalation in Alienware Command Center (AWCC) (high 7.3)
- [CVE-2026-59914](https://insights.sbomify.com/CVE-2026-59914/): Auth bypass in Display and Peripheral Manager (DDPM Windows) (high 7.8)
- [CVE-2026-59913](https://insights.sbomify.com/CVE-2026-59913/): Missing authorization in Display and Peripheral Manager (DDPM Mac) (high 7.8)
- [CVE-2026-59912](https://insights.sbomify.com/CVE-2026-59912/): Privilege escalation in Display and Peripheral Manager (DDPM Mac) (high 7.8)
- [CVE-2026-59911](https://insights.sbomify.com/CVE-2026-59911/): Information disclosure in ObjectScale (medium 5.5)
- [CVE-2026-59910](https://insights.sbomify.com/CVE-2026-59910/): Command injection in ObjectScale (high 7.8)
- [CVE-2026-5991](https://insights.sbomify.com/CVE-2026-5991/): Tenda F451 WrlExtraSet formWrlExtraSet stack-based overflow (high 8.7)
- [CVE-2026-59909](https://insights.sbomify.com/CVE-2026-59909/): Path traversal in ObjectScale (high 7.1)
- [CVE-2026-59903](https://insights.sbomify.com/CVE-2026-59903/): Netty: Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite (medium 6.5)
- [CVE-2026-59902](https://insights.sbomify.com/CVE-2026-59902/): Netty: Memory Exhaustion in SctpMessageCompletionHandler (high 7.5)
- [CVE-2026-59901](https://insights.sbomify.com/CVE-2026-59901/): Netty Bzip2Decoder: Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang (high 8.7)
- [CVE-2026-59900](https://insights.sbomify.com/CVE-2026-59900/): Netty codec-http2: Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass (medium 6.9)
- [CVE-2026-5990](https://insights.sbomify.com/CVE-2026-5990/): Tenda F451 SafeEmailFilter fromSafeEmailFilter stack-based overflow (high 8.7)
- [CVE-2026-59899](https://insights.sbomify.com/CVE-2026-59899/): Netty HttpContentEncoder: Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service (medium 6.9)
- [CVE-2026-59898](https://insights.sbomify.com/CVE-2026-59898/): Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation (medium 6.3)
- [CVE-2026-59897](https://insights.sbomify.com/CVE-2026-59897/): Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication (medium 4.8)
- [CVE-2026-59896](https://insights.sbomify.com/CVE-2026-59896/): hono/jsx does not isolate context per request, leading to cross-request data disclosure (medium 6.5)
- [CVE-2026-59895](https://insights.sbomify.com/CVE-2026-59895/): Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility (medium 6.1)
- [CVE-2026-59894](https://insights.sbomify.com/CVE-2026-59894/): sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes (medium 6.2)
- [CVE-2026-59893](https://insights.sbomify.com/CVE-2026-59893/): sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service) (high 7.5)
- [CVE-2026-59892](https://insights.sbomify.com/CVE-2026-59892/): OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/509/