# Vulnerabilities published in 2026


- [CVE-2026-59891](https://insights.sbomify.com/CVE-2026-59891/): Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry (critical 9.6)
- [CVE-2026-59890](https://insights.sbomify.com/CVE-2026-59890/): setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+ (medium 6.1)
- [CVE-2026-5989](https://insights.sbomify.com/CVE-2026-5989/): Tenda F451 RouteStatic fromRouteStatic stack-based overflow (high 8.7)
- [CVE-2026-59889](https://insights.sbomify.com/CVE-2026-59889/): jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization (medium 6.5)
- [CVE-2026-59888](https://insights.sbomify.com/CVE-2026-59888/): jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy (medium 6.5)
- [CVE-2026-59887](https://insights.sbomify.com/CVE-2026-59887/): linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text (high 7.5)
- [CVE-2026-59886](https://insights.sbomify.com/CVE-2026-59886/): pyasn1: Uncontrolled resource consumption when converting decoded REAL values (high 7.5)
- [CVE-2026-59885](https://insights.sbomify.com/CVE-2026-59885/): pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service (high 7.5)
- [CVE-2026-59884](https://insights.sbomify.com/CVE-2026-59884/): pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs (high 7.5)
- [CVE-2026-59883](https://insights.sbomify.com/CVE-2026-59883/): Guzzle: Cookie Disclosure and Injection via IP-Address Domains (medium 4.7)
- [CVE-2026-59882](https://insights.sbomify.com/CVE-2026-59882/): guzzlehttp/psr7: Host Confusion via Weak URI Host Validation (medium 4.2)
- [CVE-2026-59881](https://insights.sbomify.com/CVE-2026-59881/): AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate (medium 6.9)
- [CVE-2026-59880](https://insights.sbomify.com/CVE-2026-59880/): Immutable.js: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set (high 8.7)
- [CVE-2026-5988](https://insights.sbomify.com/CVE-2026-5988/): Tenda F451 AdvSetWrlsafeset formWrlsafeset stack-based overflow (high 8.7)
- [CVE-2026-59879](https://insights.sbomify.com/CVE-2026-59879/): Immutable.js `List` 32-bit trie overflow → unrecoverable DoS (high 8.7)
- [CVE-2026-59878](https://insights.sbomify.com/CVE-2026-59878/): Denial of service in Apache ActiveMQ (high 7.5)
- [CVE-2026-59877](https://insights.sbomify.com/CVE-2026-59877/): protobufjs: Denial of Service via infinite loop in .proto option parsing (medium 5.3)
- [CVE-2026-59876](https://insights.sbomify.com/CVE-2026-59876/): protobufjs: Text Format string map parsing can mutate returned map object prototype (medium 4.8)
- [CVE-2026-59875](https://insights.sbomify.com/CVE-2026-59875/): node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records (medium 5.3)
- [CVE-2026-59874](https://insights.sbomify.com/CVE-2026-59874/): node-tar: Negative tar entry size causes infinite loop in archive replace (high 8.7)
- [CVE-2026-59873](https://insights.sbomify.com/CVE-2026-59873/): node-tar: Decompression/parse DoS via unlimited input (critical 9.2)
- [CVE-2026-59871](https://insights.sbomify.com/CVE-2026-59871/): node-tar: Process crash via PAX numeric path type confusion (medium 5.3)
- [CVE-2026-59870](https://insights.sbomify.com/CVE-2026-59870/): js-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsing (high 7.5)
- [CVE-2026-5987](https://insights.sbomify.com/CVE-2026-5987/): Code injection in PublicCMS (medium 5.1)
- [CVE-2026-59869](https://insights.sbomify.com/CVE-2026-59869/): js-yaml: YAML merge-key chains can force quadratic CPU consumption (high 7.5)
- [CVE-2026-59868](https://insights.sbomify.com/CVE-2026-59868/): js-yaml: YAML merge-key chains can force quadratic CPU consumption (medium 5.3)
- [CVE-2026-59867](https://insights.sbomify.com/CVE-2026-59867/): Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref (high 7.1)
- [CVE-2026-59866](https://insights.sbomify.com/CVE-2026-59866/): Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName (critical 9.3)
- [CVE-2026-59865](https://insights.sbomify.com/CVE-2026-59865/): Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info` (critical 9.3)
- [CVE-2026-59864](https://insights.sbomify.com/CVE-2026-59864/): Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions (critical 9.3)
- [CVE-2026-59863](https://insights.sbomify.com/CVE-2026-59863/): Kiota: Workspace-config poisoning: out-of-repo file write + generation-time SSRF (high 7.0)
- [CVE-2026-59862](https://insights.sbomify.com/CVE-2026-59862/): Kiota: Code Generation Literal Injection in the Python Generator (high 7.5)
- [CVE-2026-59861](https://insights.sbomify.com/CVE-2026-59861/): Kiota: Code Generation Literal Injection in Kiota Ruby Generator (high 7.5)
- [CVE-2026-59860](https://insights.sbomify.com/CVE-2026-59860/): Kiota: XML Doc-Comment Newline Breakout Code Injection (high 8.7)
- [CVE-2026-5986](https://insights.sbomify.com/CVE-2026-5986/): Zod jsVideoUrlParser util.js getTime redos (medium 6.9)
- [CVE-2026-59859](https://insights.sbomify.com/CVE-2026-59859/): Kiota: Code Generation Literal Injection in the PHP Generator (high 8.7)
- [CVE-2026-59858](https://insights.sbomify.com/CVE-2026-59858/): Vim: Arbitrary Code Execution via C Omni-Completion (high 8.4)
- [CVE-2026-59857](https://insights.sbomify.com/CVE-2026-59857/): Vim: Out-of-bounds Write in SAL Soundfolding (medium 5.6)
- [CVE-2026-59856](https://insights.sbomify.com/CVE-2026-59856/): Vim: Arbitrary Code Execution via PHP Omni-Completion (high 8.4)
- [CVE-2026-59855](https://insights.sbomify.com/CVE-2026-59855/): SiYuan: Store XSS To Rce via Asset.render (high 8.6)
- [CVE-2026-59854](https://insights.sbomify.com/CVE-2026-59854/): SiYuan: Incomplete IsSensitivePath denylist: globalCopyFiles reads home-dir credential dotfiles into the workspace (medium 4.9)
- [CVE-2026-59853](https://insights.sbomify.com/CVE-2026-59853/): Missing authorization in siyuan (medium 6.5)
- [CVE-2026-59851](https://insights.sbomify.com/CVE-2026-59851/): Libssh: libssh: authentication bypass via missing gssapi principal check (high 8.8)
- [CVE-2026-59850](https://insights.sbomify.com/CVE-2026-59850/): Libssh: libssh: use-after-free via data callbacks on closed channels (medium 4.3)
- [CVE-2026-5985](https://insights.sbomify.com/CVE-2026-5985/): code-projects Simple IT Discussion Forum crud.php sql injection (medium 6.9)
- [CVE-2026-59849](https://insights.sbomify.com/CVE-2026-59849/): Libssh: libssh: denial of service via automatic certificate authentication loop (low 3.1)
- [CVE-2026-59848](https://insights.sbomify.com/CVE-2026-59848/): Libssh: libssh: denial of service via sftp responses with unknown request ids (medium 5.3)
- [CVE-2026-59847](https://insights.sbomify.com/CVE-2026-59847/): Libssh: libssh: integrity downgrade via openssl aes-gcm tag verification (medium 5.9)
- [CVE-2026-59846](https://insights.sbomify.com/CVE-2026-59846/): Libssh: libssh: information disclosure via proxycommand %r username expansion (low 3.9)
- [CVE-2026-59845](https://insights.sbomify.com/CVE-2026-59845/): Libssh: libssh: denial of service via unchecked proxycommand fork() failure (medium 5.3)
- [CVE-2026-59844](https://insights.sbomify.com/CVE-2026-59844/): Libssh: libssh: denial of service via oversized sftp read length (medium 6.5)
- [CVE-2026-59843](https://insights.sbomify.com/CVE-2026-59843/): Libssh: libssh: denial of service via zero advertised channel packet size (medium 6.5)
- [CVE-2026-59842](https://insights.sbomify.com/CVE-2026-59842/): Libssh: libssh: information disclosure via short gssapi curve25519 public key (low 3.7)
- [CVE-2026-59841](https://insights.sbomify.com/CVE-2026-59841/): Privilege escalation in FortiSIEMWindowsAgent (medium 6.9)
- [CVE-2026-59840](https://insights.sbomify.com/CVE-2026-59840/): Memory corruption in FortiOS (medium 4.1)
- [CVE-2026-5984](https://insights.sbomify.com/CVE-2026-5984/): D-Link DIR-605L POST Request formSetLog buffer overflow (high 8.7)
- [CVE-2026-59839](https://insights.sbomify.com/CVE-2026-59839/): Path traversal in FortiOS (medium 5.0)
- [CVE-2026-59838](https://insights.sbomify.com/CVE-2026-59838/): Cross-site scripting in FortiSIEM (medium 5.3)
- [CVE-2026-59837](https://insights.sbomify.com/CVE-2026-59837/): Memory corruption in FortiOS (medium 5.9)
- [CVE-2026-59836](https://insights.sbomify.com/CVE-2026-59836/): Security feature bypass in FortiClientEMS (medium 6.7)
- [CVE-2026-59835](https://insights.sbomify.com/CVE-2026-59835/): Information disclosure in FortiSandbox (high 7.7)
- [CVE-2026-59834](https://insights.sbomify.com/CVE-2026-59834/): SiYuan: SQL Query in Block Search Exposes Hidden Published Document Content (high 7.5)
- [CVE-2026-59833](https://insights.sbomify.com/CVE-2026-59833/): SiYuan: Stored XSS to RCE in SiYuan via a per-attribute URL-scheme sanitizer gap in Lute (form action / SVG xlink:href) (high 8.6)
- [CVE-2026-59832](https://insights.sbomify.com/CVE-2026-59832/): Siyuan: Authenticated path traversal in /snippets/ static handler (serveSnippets) leaks conf/conf.json secrets and siyuan.db (high 7.7)
- [CVE-2026-59831](https://insights.sbomify.com/CVE-2026-59831/): GitHub CLI `gh codespace jupyter` could allow remote code execution when connecting to a malicious Codespace (medium 4.4)
- [CVE-2026-59830](https://insights.sbomify.com/CVE-2026-59830/): Discourse: Stored XSS via unescaped actor name in post actions (medium 5.4)
- [CVE-2026-5983](https://insights.sbomify.com/CVE-2026-5983/): D-Link DIR-605L POST Request formSetDDNS buffer overflow (high 8.7)
- [CVE-2026-59829](https://insights.sbomify.com/CVE-2026-59829/): Discourse: Review queue exposes flag-related private message excerpts to category group moderators (medium 4.3)
- [CVE-2026-59828](https://insights.sbomify.com/CVE-2026-59828/): Discourse: Hidden post revisions leak through adjacent visible diffs (medium 5.3)
- [CVE-2026-59827](https://insights.sbomify.com/CVE-2026-59827/): Metabase: Unsafe Deserialization of H2 Query Results (critical 9.9)
- [CVE-2026-59826](https://insights.sbomify.com/CVE-2026-59826/): Metabase: Arbitrary Code Execution via Database Connection Detail Bypass (critical 9.1)
- [CVE-2026-59825](https://insights.sbomify.com/CVE-2026-59825/): Mastodon: Unwanted deactivation of SSL/TLS certificate verification (high 7.4)
- [CVE-2026-59823](https://insights.sbomify.com/CVE-2026-59823/): LiteLLM: Server-side request forgery via the `user_config` request parameter in LiteLLM Proxy (medium 5.3)
- [CVE-2026-59822](https://insights.sbomify.com/CVE-2026-59822/): BerriAI LiteLLM Improper Authentication (high 8.8, exploited in the wild)
- [CVE-2026-59821](https://insights.sbomify.com/CVE-2026-59821/): LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks (low 2.1)
- [CVE-2026-59820](https://insights.sbomify.com/CVE-2026-59820/): LiteLLM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (medium 6.1)
- [CVE-2026-5982](https://insights.sbomify.com/CVE-2026-5982/): D-Link DIR-605L POST Request formAdvNetwork buffer overflow (high 8.7)
- [CVE-2026-59819](https://insights.sbomify.com/CVE-2026-59819/): LiteLLM: Local file read via request-supplied OIDC file references (low 2.1)
- [CVE-2026-59818](https://insights.sbomify.com/CVE-2026-59818/): etcd: gRPC client listener does not enforce `--client-crl-file` certificate revocation (medium 6.5)
- [CVE-2026-59817](https://insights.sbomify.com/CVE-2026-59817/): Ghost: Paid gift memberships obtainable at minimal cost via the donations feature (medium 5.3)
- [CVE-2026-59816](https://insights.sbomify.com/CVE-2026-59816/): Joplin: Path traversal in transcribe proxy endpoint via URL-encoded slash (medium 4.3)
- [CVE-2026-59815](https://insights.sbomify.com/CVE-2026-59815/): Joplin: Pending share recipients can write items into shared folders before accepting invitations (medium 4.3)
- [CVE-2026-59814](https://insights.sbomify.com/CVE-2026-59814/): Joplin: Stored XSS via inline-served note attachment on published shares (high 7.6)
- [CVE-2026-5981](https://insights.sbomify.com/CVE-2026-5981/): D-Link DIR-605L POST Request formAdvFirewall buffer overflow (high 8.7)
- [CVE-2026-59809](https://insights.sbomify.com/CVE-2026-59809/): SiYuan before v3.8.0 Secret Exfiltration via http_request URL (medium 6.9)
- [CVE-2026-59808](https://insights.sbomify.com/CVE-2026-59808/): AVideo Authentication Bypass via Unkeyed Video Hash Disclosure (high 8.7)
- [CVE-2026-59807](https://insights.sbomify.com/CVE-2026-59807/): Composio SDK < 0.2.32-beta.283 - Sensitive File Upload via tool-file-uploads.ts (high 8.9)
- [CVE-2026-59806](https://insights.sbomify.com/CVE-2026-59806/): Gradio < 6.20.0 - Open Redirect and SSRF via /gradio_api/file= endpoint (medium 4.9)
- [CVE-2026-59805](https://insights.sbomify.com/CVE-2026-59805/): Gumroad < 2026.07.06.2 - Insecure Direct Object Reference in PurchasesController (high 7.1)
- [CVE-2026-59804](https://insights.sbomify.com/CVE-2026-59804/): Midscene Bridge Server - Session Hijack via Unauthenticated WebSocket (high 7.6)
- [CVE-2026-59803](https://insights.sbomify.com/CVE-2026-59803/): rpcx - Denial of Service via Gzip Decompression Bomb in Wire Protocol (high 8.7)
- [CVE-2026-59802](https://insights.sbomify.com/CVE-2026-59802/): PasswordPusher < 2.8.1 - Redirect-Based XSS via data URI in URL Push Payload (medium 6.3)
- [CVE-2026-59801](https://insights.sbomify.com/CVE-2026-59801/): 9Router 0.4.41 - Unauthenticated API Exposure via /api/providers (critical 9.3)
- [CVE-2026-59800](https://insights.sbomify.com/CVE-2026-59800/): 9Router < 0.4.44 - OS Command Injection via sudoPassword Parameter in Tailscale Install Endpoint (critical 9.2)
- [CVE-2026-5980](https://insights.sbomify.com/CVE-2026-5980/): D-Link DIR-605L POST Request formSetMACFilter buffer overflow (high 8.7)
- [CVE-2026-59799](https://insights.sbomify.com/CVE-2026-59799/): Apache CloudStack: Missing Privilege Check in Two-Factor Authentication Disable Flow (high 8.8)
- [CVE-2026-59797](https://insights.sbomify.com/CVE-2026-59797/): Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function (critical 9.8)
- [CVE-2026-59796](https://insights.sbomify.com/CVE-2026-59796/): Missing authorization in TeamCity (high 8.1)
- [CVE-2026-59795](https://insights.sbomify.com/CVE-2026-59795/): Cross-site scripting in TeamCity (high 8.1)
- [CVE-2026-59794](https://insights.sbomify.com/CVE-2026-59794/): Cross-site scripting in TeamCity (high 7.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/510/