# Vulnerabilities published in 2026


- [CVE-2026-58218](https://insights.sbomify.com/CVE-2026-58218/): Samba: dns signing dos via tkey name cache exhaustion (medium 5.3)
- [CVE-2026-58216](https://insights.sbomify.com/CVE-2026-58216/): Memory corruption in Red Hat Enterprise Linux 10 (medium 5.3)
- [CVE-2026-58214](https://insights.sbomify.com/CVE-2026-58214/): NATS Server: MQTT subscribe ACL bypass via $MQTT.deliver.pubrel prefix (incomplete fix for CVE-2026-33217) (medium 4.3)
- [CVE-2026-58213](https://insights.sbomify.com/CVE-2026-58213/): NATS Server: MQTT SUBSCRIBE Protocol Injection via Leaf Node/Route Forwarding allows arbitrary NATS command injection (high 7.1)
- [CVE-2026-58211](https://insights.sbomify.com/CVE-2026-58211/): NATS Server: `no_auth_user` pre-CONNECT fast path bypasses user connection restrictions (medium 5.4)
- [CVE-2026-58210](https://insights.sbomify.com/CVE-2026-58210/): NATS Server: MQTT partial CONNECT packets can exhaust pre-auth memory (high 7.5)
- [CVE-2026-5821](https://insights.sbomify.com/CVE-2026-5821/): Image Optimizer <= 1.7.4 - Authenticated (Author+) Arbitrary File Deletion via Post Meta Field Injection (high 8.1)
- [CVE-2026-58209](https://insights.sbomify.com/CVE-2026-58209/): NATS Server: MQTT retained and QoS replay bypass subscribe deny filters (medium 4.3)
- [CVE-2026-58208](https://insights.sbomify.com/CVE-2026-58208/): NATS Server: MQTT-over-WebSocket Path Can Crash WebSocket-Only JetStream Servers Before MQTT Is Enabled (medium 6.8)
- [CVE-2026-58207](https://insights.sbomify.com/CVE-2026-58207/): NATS Server: Remote crash via integer overflow in Connz pagination (high 7.7)
- [CVE-2026-58205](https://insights.sbomify.com/CVE-2026-58205/): GRR has a Reflected XSS issue (high 8.1)
- [CVE-2026-58203](https://insights.sbomify.com/CVE-2026-58203/): pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size (medium 5.3)
- [CVE-2026-58202](https://insights.sbomify.com/CVE-2026-58202/): Business logic in appointment-booking-software (high 8.3)
- [CVE-2026-58201](https://insights.sbomify.com/CVE-2026-58201/): Lokka: Azure Resource Manager URL path validation issue (high 8.7)
- [CVE-2026-58200](https://insights.sbomify.com/CVE-2026-58200/): @jhb.software/payload-cloudinary-plugin: Arbitrary Cloudinary API Parameter Signing (high 7.1)
- [CVE-2026-5820](https://insights.sbomify.com/CVE-2026-5820/): Zypento Blocks <= 1.0.6 - Authenticated (Author+) Stored Cross-Site Scripting via Table of Contents Block (medium 6.4)
- [CVE-2026-58198](https://insights.sbomify.com/CVE-2026-58198/): ChatterBot: Symlink-Following Arbitrary Write via UbuntuCorpusTrainer (medium 5.5)
- [CVE-2026-58197](https://insights.sbomify.com/CVE-2026-58197/): ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement (high 8.8)
- [CVE-2026-58196](https://insights.sbomify.com/CVE-2026-58196/): ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) (medium 4.7)
- [CVE-2026-58195](https://insights.sbomify.com/CVE-2026-58195/): Agentic-Flow: OS Command Injection in agentic-flow MCP server tools via unsanitized tool-parameter interpolation into execSync (high 8.8)
- [CVE-2026-58192](https://insights.sbomify.com/CVE-2026-58192/): Appium: Unauthenticated arbitrary file/directory deletion in @appium/storage-plugin (high 8.6)
- [CVE-2026-58191](https://insights.sbomify.com/CVE-2026-58191/): Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig* routes (medium 6.5)
- [CVE-2026-58189](https://insights.sbomify.com/CVE-2026-58189/): Apache Traffic Server: Plugins resetting the redirect counter enable SSRF amplification (high 8.2)
- [CVE-2026-58188](https://insights.sbomify.com/CVE-2026-58188/): Apache Traffic Server: Memory-safety and limit-bypass errors across experimental plugins (high 8.4)
- [CVE-2026-58187](https://insights.sbomify.com/CVE-2026-58187/): Apache Traffic Server: Multiplexer plugin chunk decoder enables a denial of service (medium 6.3)
- [CVE-2026-58186](https://insights.sbomify.com/CVE-2026-58186/): Apache Traffic Server: webp_transform plugin decodes unsafely and mislabels degraded responses (high 8.2)
- [CVE-2026-58185](https://insights.sbomify.com/CVE-2026-58185/): Apache Traffic Server: Use-after-free in the intercept plugin (high 8.2)
- [CVE-2026-58184](https://insights.sbomify.com/CVE-2026-58184/): Apache Traffic Server: header_rewrite plugin cookie handling can corrupt memory (high 8.3)
- [CVE-2026-58183](https://insights.sbomify.com/CVE-2026-58183/): Apache Traffic Server: prefetch plugin can crash on attacker-influenced input (high 8.2)
- [CVE-2026-58182](https://insights.sbomify.com/CVE-2026-58182/): Apache Traffic Server: ts_lua plugin has initialization and resource-handling errors (high 8.2)
- [CVE-2026-58181](https://insights.sbomify.com/CVE-2026-58181/): Apache Traffic Server: uri_signing and url_sig plugins can exhaust the stack or crash (high 8.2)
- [CVE-2026-58180](https://insights.sbomify.com/CVE-2026-58180/): Apache Traffic Server: txn_box plugin overflows the stack from attacker input (high 8.2)
- [CVE-2026-5818](https://insights.sbomify.com/CVE-2026-5818/): MCU Firmware Update Authentication Bypass on Caliptra Core (high 7.2)
- [CVE-2026-58179](https://insights.sbomify.com/CVE-2026-58179/): Apache Traffic Server: regex_remap plugin overflows the stack from attacker input (critical 9.2)
- [CVE-2026-58178](https://insights.sbomify.com/CVE-2026-58178/): Apache Traffic Server: ESI plugin allows uncontrolled recursion and server-side request forgery (high 8.2)
- [CVE-2026-58177](https://insights.sbomify.com/CVE-2026-58177/): Apache Traffic Server: Memory-safety and path-traversal errors in the Cripts framework (high 8.3)
- [CVE-2026-58176](https://insights.sbomify.com/CVE-2026-58176/): RuoYi-Vue-Plus - Missing Authorization on Workflow Task Management Endpoints (high 7.1)
- [CVE-2026-58175](https://insights.sbomify.com/CVE-2026-58175/): Apache Traffic Server: HostDB SRV handling leaks memory (high 8.2)
- [CVE-2026-58174](https://insights.sbomify.com/CVE-2026-58174/): Hermes WebUI < 0.51.521 - Cross-Profile Authorization Bypass via Unset Session Profile on Import (medium 6.0)
- [CVE-2026-58173](https://insights.sbomify.com/CVE-2026-58173/): Vibe-Trading < 0.1.10 - Path Traversal via Persistent Memory Type (medium 6.0)
- [CVE-2026-58172](https://insights.sbomify.com/CVE-2026-58172/): Ocelot - IP Allow/Block List Bypass for WebSocket Upgrade Requests (critical 9.3)
- [CVE-2026-58171](https://insights.sbomify.com/CVE-2026-58171/): Vibe-Trading < 0.1.10 - Path Traversal via Swarm Run Identifier (low 2.3)
- [CVE-2026-58170](https://insights.sbomify.com/CVE-2026-58170/): Vibe-Trading < 0.1.10 - Path Traversal in Proposal Identifier Allows Forging Live Trading Mandates (high 7.2)
- [CVE-2026-5817](https://insights.sbomify.com/CVE-2026-5817/): Docker Model Runner container-to-host code execution via unsandboxed trust_remote_code in Python inference backends (high 8.8)
- [CVE-2026-58169](https://insights.sbomify.com/CVE-2026-58169/): Auth bypass in Vibe-Trading (high 7.7)
- [CVE-2026-58168](https://insights.sbomify.com/CVE-2026-58168/): DeepTutor < 1.4.10 - Insecure Default Grants Unrestricted MCP Tool Access to Non-Admin Users (high 7.7)
- [CVE-2026-58167](https://insights.sbomify.com/CVE-2026-58167/): Nightingale < 9.0.0-beta.2 - Datasource Credential Disclosure to Low-Privilege Users (high 7.1)
- [CVE-2026-58166](https://insights.sbomify.com/CVE-2026-58166/): OpenBMB ChatDev - Unauthenticated Path Traversal in Upload Handler Allows Arbitrary File Write and Delete (high 8.8)
- [CVE-2026-58165](https://insights.sbomify.com/CVE-2026-58165/): OpenZiti - Privilege Escalation to Admin via Unauthorized Enrollment Creation (high 8.7)
- [CVE-2026-58164](https://insights.sbomify.com/CVE-2026-58164/): Apache Traffic Server: Remap configuration lifetime and TOCTOU errors cause use-after-free (high 8.3)
- [CVE-2026-58163](https://insights.sbomify.com/CVE-2026-58163/): Apache Traffic Server: Cache deserialization and lifetime errors can corrupt state or crash the server (high 8.3)
- [CVE-2026-58162](https://insights.sbomify.com/CVE-2026-58162/): Apache Traffic Server: Certifier plugin trusts client SNI when generating certificates (high 8.4)
- [CVE-2026-58161](https://insights.sbomify.com/CVE-2026-58161/): Apache Traffic Server: Memory-safety errors in TLS and SNI handling can crash the server (critical 9.2)
- [CVE-2026-58160](https://insights.sbomify.com/CVE-2026-58160/): Apache Traffic Server: Out-of-bounds reads while parsing DNS responses (medium 6.3)
- [CVE-2026-5816](https://insights.sbomify.com/CVE-2026-5816/): Improper Resolution of Path Equivalence in GitLab (high 8.0)
- [CVE-2026-58159](https://insights.sbomify.com/CVE-2026-58159/): Apache Traffic Server: Listener and ACL handling allow access-control bypass (high 7.0)
- [CVE-2026-58158](https://insights.sbomify.com/CVE-2026-58158/): Apache Traffic Server: PROXY protocol parsing has port truncation and a stack overflow (high 8.2)
- [CVE-2026-58157](https://insights.sbomify.com/CVE-2026-58157/): Apache Traffic Server: Improper server-session reuse can expose data across client connections (medium 6.9)
- [CVE-2026-58156](https://insights.sbomify.com/CVE-2026-58156/): Apache Traffic Server: URL and port parsing errors allow access-control bypass (medium 6.3)
- [CVE-2026-58155](https://insights.sbomify.com/CVE-2026-58155/): Apache Traffic Server: Header-name length truncation enables header aliasing and request smuggling (critical 9.2)
- [CVE-2026-58154](https://insights.sbomify.com/CVE-2026-58154/): Apache Traffic Server: Memory-safety errors in MIME and header parsing (critical 9.2)
- [CVE-2026-58153](https://insights.sbomify.com/CVE-2026-58153/): Apache Traffic Server: HTTP/2 to HTTP/1 conversion forwards origin trailers to clients unsafely (medium 6.3)
- [CVE-2026-58152](https://insights.sbomify.com/CVE-2026-58152/): Apache Traffic Server: Integer-handling errors in HPACK/XPACK decoding corrupt memory (medium 6.9)
- [CVE-2026-58151](https://insights.sbomify.com/CVE-2026-58151/): Apache Traffic Server: Abusive HTTP/2 framing can exhaust resources and crash the server (high 8.7)
- [CVE-2026-58150](https://insights.sbomify.com/CVE-2026-58150/): Apache Traffic Server: HTTP/2 requests with Transfer-Encoding are not rejected, allowing request smuggling (high 7.8)
- [CVE-2026-5815](https://insights.sbomify.com/CVE-2026-5815/): D-Link DIR-645 hedwig.cgi hedwigcgi_main stack-based overflow (high 8.7)
- [CVE-2026-58149](https://insights.sbomify.com/CVE-2026-58149/): Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0 (medium 5.3)
- [CVE-2026-58148](https://insights.sbomify.com/CVE-2026-58148/): Joomla Extension - chronoengine.com - Stored XSS in ChronoForms extension for Joomla 8.0 - 8.0.52 (high 8.7)
- [CVE-2026-58147](https://insights.sbomify.com/CVE-2026-58147/): Authorized remote code execution via password change functionality in T-Mobile 5G Box IDU routers (critical 9.3)
- [CVE-2026-58146](https://insights.sbomify.com/CVE-2026-58146/): Unauthorized remote code execution in T-Mobile 5G Box IDU routers (critical 9.4)
- [CVE-2026-58144](https://insights.sbomify.com/CVE-2026-58144/): Cotonti Siena 0.9.26 Stored XSS via PFS Module ntitle Parameter (medium 5.1)
- [CVE-2026-58143](https://insights.sbomify.com/CVE-2026-58143/): Cotonti Siena 0.9.26 CSRF via admin.php Config Update Endpoint (high 8.7)
- [CVE-2026-5814](https://insights.sbomify.com/CVE-2026-5814/): PHPGurukul Online Course Registration check_availability.php sql injection (medium 6.9)
- [CVE-2026-58139](https://insights.sbomify.com/CVE-2026-58139/): DuckDB AWS Extension Security Policy Bypass via load_aws_credentials Procedure (medium 6.0)
- [CVE-2026-58138](https://insights.sbomify.com/CVE-2026-58138/): Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators (critical 9.3)
- [CVE-2026-5813](https://insights.sbomify.com/CVE-2026-5813/): PHPGurukul Online Course Registration check_availability.php sql injection (medium 6.9)
- [CVE-2026-58127](https://insights.sbomify.com/CVE-2026-58127/): PACSgear MediaWriter 5.2.1 Unauthenticated RCE via .NET Remoting TCP Service (critical 9.3)
- [CVE-2026-58126](https://insights.sbomify.com/CVE-2026-58126/): PACSgear PACS Scan 5.2.1 Unauthenticated RCE via .NET Remoting TCP Service (critical 9.3)
- [CVE-2026-58123](https://insights.sbomify.com/CVE-2026-58123/): Hermes WebUI < 0.51.788 Unauthenticated RCE via Terminal API (critical 9.3)
- [CVE-2026-58122](https://insights.sbomify.com/CVE-2026-58122/): Hermes WebUI < 0.51.307 Authentication Bypass via X-Forwarded-For Header Spoofing (critical 9.3)
- [CVE-2026-5812](https://insights.sbomify.com/CVE-2026-5812/): SourceCodester Pharmacy Product Management System POST Parameter add-sales.php logic error (medium 5.3)
- [CVE-2026-58116](https://insights.sbomify.com/CVE-2026-58116/): LLaMA-Factory 0.9.5 Remote Code Execution via WebUI Model Path (critical 9.3)
- [CVE-2026-58115](https://insights.sbomify.com/CVE-2026-58115/): Missing authorization in SIMATIC IoT2050 Advanced (critical 10.0)
- [CVE-2026-58113](https://insights.sbomify.com/CVE-2026-58113/): Cross-site scripting in Teamcenter V2412 (high 8.5)
- [CVE-2026-5811](https://insights.sbomify.com/CVE-2026-5811/): SourceCodester Online Food Ordering System POST Parameter Actions.php save_product logic error (medium 5.3)
- [CVE-2026-58108](https://insights.sbomify.com/CVE-2026-58108/): Personal access token delete filters on Session columns while deleting from PersonalAccessTokenDB (low 1.2)
- [CVE-2026-58107](https://insights.sbomify.com/CVE-2026-58107/): Authenticated Remote Denial of Service via Unbounded zlib Decompression in massStoreRun (medium 5.5)
- [CVE-2026-58106](https://insights.sbomify.com/CVE-2026-58106/): Memory corruption in CodeChecker (low 2.0)
- [CVE-2026-58102](https://insights.sbomify.com/CVE-2026-58102/): Memory corruption in Crypt::OpenSSL::X509 (critical 9.1)
- [CVE-2026-58101](https://insights.sbomify.com/CVE-2026-58101/): Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow denial of service via NULL pointer dereference (high 7.5)
- [CVE-2026-58100](https://insights.sbomify.com/CVE-2026-58100/): Memory safety bugs in kqueue copy-on-fork implementation (high 7.0)
- [CVE-2026-5810](https://insights.sbomify.com/CVE-2026-5810/): SourceCodester Sales and Inventory System GET Parameter delete.php cross site scripting (medium 5.1)
- [CVE-2026-58099](https://insights.sbomify.com/CVE-2026-58099/): Memory safety bugs in kqueue copy-on-fork implementation (high 7.0)
- [CVE-2026-58098](https://insights.sbomify.com/CVE-2026-58098/): Heap out-of-bounds access in semop(2) (high 8.4)
- [CVE-2026-58097](https://insights.sbomify.com/CVE-2026-58097/): ppp(8): missing length validation in mp_SetEnddisc() (high 7.8)
- [CVE-2026-58096](https://insights.sbomify.com/CVE-2026-58096/): ppp(8): missing length validation in LcpDecodeConfig() (high 8.8)
- [CVE-2026-58095](https://insights.sbomify.com/CVE-2026-58095/): ppp(8): incorrect length calculation in mp_Enddisc() (high 8.8)
- [CVE-2026-58094](https://insights.sbomify.com/CVE-2026-58094/): TOCTOU race in POSIX shared memory large page configuration (high 7.8)
- [CVE-2026-58093](https://insights.sbomify.com/CVE-2026-58093/): Kernel use-after-free via tty ioctls (high 7.0)
- [CVE-2026-58092](https://insights.sbomify.com/CVE-2026-58092/): Unauthorized credential switching (high 8.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/520/