# Vulnerabilities published in 2026


- [CVE-2026-56915](https://insights.sbomify.com/CVE-2026-56915/): Race condition in Android (medium 6.4)
- [CVE-2026-56914](https://insights.sbomify.com/CVE-2026-56914/): Use after free in Android (high 8.4)
- [CVE-2026-5691](https://insights.sbomify.com/CVE-2026-5691/): Totolink A7100RU cstecgi.cgi setFirewallType os command injection (medium 6.9)
- [CVE-2026-56907](https://insights.sbomify.com/CVE-2026-56907/): Memory corruption in Android (medium 6.7)
- [CVE-2026-56906](https://insights.sbomify.com/CVE-2026-56906/): Use after free in Android (high 7.0)
- [CVE-2026-5690](https://insights.sbomify.com/CVE-2026-5690/): Totolink A7100RU cstecgi.cgi setRemoteCfg os command injection (medium 6.9)
- [CVE-2026-56892](https://insights.sbomify.com/CVE-2026-56892/): Information disclosure in Android (medium 6.2)
- [CVE-2026-5689](https://insights.sbomify.com/CVE-2026-5689/): Totolink A7100RU cstecgi.cgi setNtpCfg os command injection (medium 6.9)
- [CVE-2026-56889](https://insights.sbomify.com/CVE-2026-56889/): Integer overflow in Android (medium 6.7)
- [CVE-2026-56888](https://insights.sbomify.com/CVE-2026-56888/): Information disclosure in Android (medium 6.2)
- [CVE-2026-56882](https://insights.sbomify.com/CVE-2026-56882/): Information disclosure in Android (high 8.8)
- [CVE-2026-56881](https://insights.sbomify.com/CVE-2026-56881/): Privilege escalation in Android (high 8.4)
- [CVE-2026-5688](https://insights.sbomify.com/CVE-2026-5688/): Totolink A7100RU cstecgi.cgi setDdnsCfg os command injection (medium 6.9)
- [CVE-2026-56879](https://insights.sbomify.com/CVE-2026-56879/): Memory corruption in Android (medium 6.7)
- [CVE-2026-56877](https://insights.sbomify.com/CVE-2026-56877/): Business logic in SCORM Lab Launch Integration (medium 6.3)
- [CVE-2026-56876](https://insights.sbomify.com/CVE-2026-56876/): extract-zip unvalidated symlink path traversal (high 8.6)
- [CVE-2026-5687](https://insights.sbomify.com/CVE-2026-5687/): Tenda CX12L NatStaticSetting fromNatStaticSetting stack-based overflow (high 8.7)
- [CVE-2026-56866](https://insights.sbomify.com/CVE-2026-56866/): HTTP/1 client connection desynchronization after CONNECT rejection in net/http (high 7.5)
- [CVE-2026-56865](https://insights.sbomify.com/CVE-2026-56865/): Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog (high 8.4)
- [CVE-2026-56864](https://insights.sbomify.com/CVE-2026-56864/): Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb (high 7.5)
- [CVE-2026-56862](https://insights.sbomify.com/CVE-2026-56862/): Limit handshake messages we are willing to accept post-handshake in crypto/tls (high 7.5)
- [CVE-2026-56860](https://insights.sbomify.com/CVE-2026-56860/): Avoid quadratic complexity in resolvePath in net/url (medium 5.9)
- [CVE-2026-5686](https://insights.sbomify.com/CVE-2026-5686/): Tenda CX12L RouteStatic fromRouteStatic stack-based overflow (high 8.7)
- [CVE-2026-56859](https://insights.sbomify.com/CVE-2026-56859/): Add recursion depth guard during decode in encoding/xml (high 7.5)
- [CVE-2026-56858](https://insights.sbomify.com/CVE-2026-56858/): Fix Javascript regexp context tracking in html/template (medium 6.1)
- [CVE-2026-56857](https://insights.sbomify.com/CVE-2026-56857/): Root.Mkdir(All) can follow junctions out of the root on Windows in os (critical 9.8)
- [CVE-2026-56855](https://insights.sbomify.com/CVE-2026-56855/): Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh (high 7.5)
- [CVE-2026-56854](https://insights.sbomify.com/CVE-2026-56854/): Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh (high 7.5)
- [CVE-2026-56853](https://insights.sbomify.com/CVE-2026-56853/): Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http (high 7.5)
- [CVE-2026-56852](https://insights.sbomify.com/CVE-2026-56852/): Infinite loop on invalid input in golang.org/x/text (high 7.5)
- [CVE-2026-56851](https://insights.sbomify.com/CVE-2026-56851/): Panic parsing crafted input in x/text/secure/precis in golang.org/x/text (high 7.5)
- [CVE-2026-56850](https://insights.sbomify.com/CVE-2026-56850/): Auth bypass in node (medium 4.1)
- [CVE-2026-5685](https://insights.sbomify.com/CVE-2026-5685/): Tenda CX12L addressNat fromAddressNat stack-based overflow (high 8.7)
- [CVE-2026-56848](https://insights.sbomify.com/CVE-2026-56848/): Use after free in node (high 7.5)
- [CVE-2026-56847](https://insights.sbomify.com/CVE-2026-56847/): Security feature bypass in node (low 3.3)
- [CVE-2026-56846](https://insights.sbomify.com/CVE-2026-56846/): Denial of service in node (high 7.5)
- [CVE-2026-56845](https://insights.sbomify.com/CVE-2026-56845/): Path traversal in Rocket.Chat (high 7.5)
- [CVE-2026-56844](https://insights.sbomify.com/CVE-2026-56844/): Path traversal in Backup and Replication (high 8.4)
- [CVE-2026-56843](https://insights.sbomify.com/CVE-2026-56843/): Missing authorization in Plesk (critical 9.9)
- [CVE-2026-56842](https://insights.sbomify.com/CVE-2026-56842/): Privilege escalation in UniFi Network Application (high 7.5)
- [CVE-2026-56841](https://insights.sbomify.com/CVE-2026-56841/): SQL injection in UniFi Protect Application (high 8.8)
- [CVE-2026-56840](https://insights.sbomify.com/CVE-2026-56840/): PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools (high 8.8)
- [CVE-2026-5684](https://insights.sbomify.com/CVE-2026-5684/): Tenda CX12L webExcptypemanFilter fromwebExcptypemanFilter stack-based overflow (high 8.6)
- [CVE-2026-56839](https://insights.sbomify.com/CVE-2026-56839/): PraisonAI Code agent tools fail open without a workspace boundary (high 7.3)
- [CVE-2026-56838](https://insights.sbomify.com/CVE-2026-56838/): PraisonAI recipe.run_stream skips dangerous-tool policy enforcement (high 7.8)
- [CVE-2026-56837](https://insights.sbomify.com/CVE-2026-56837/): PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing (high 8.6)
- [CVE-2026-56836](https://insights.sbomify.com/CVE-2026-56836/): PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard (high 8.2)
- [CVE-2026-56835](https://insights.sbomify.com/CVE-2026-56835/): PraisonAI Slack app_mention bypasses configured user/channel authorization (high 8.3)
- [CVE-2026-56834](https://insights.sbomify.com/CVE-2026-56834/): PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage (high 7.5)
- [CVE-2026-56833](https://insights.sbomify.com/CVE-2026-56833/): PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal (high 7.5)
- [CVE-2026-56832](https://insights.sbomify.com/CVE-2026-56832/): PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals (high 8.8)
- [CVE-2026-56831](https://insights.sbomify.com/CVE-2026-56831/): Shopper: Negative discount values accepted and propagated through order calculation pipeline (medium 6.5)
- [CVE-2026-56830](https://insights.sbomify.com/CVE-2026-56830/): Shopper: Incomplete fix for GHSA-h4mp-g9c6-xwph: Media sub-form store() still lacks authorization (medium 6.5)
- [CVE-2026-5683](https://insights.sbomify.com/CVE-2026-5683/): Tenda CX12L P2pListFilter fromP2pListFilter stack-based overflow (medium 5.1)
- [CVE-2026-56829](https://insights.sbomify.com/CVE-2026-56829/): Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component (high 8.1)
- [CVE-2026-56828](https://insights.sbomify.com/CVE-2026-56828/): Shopper: read-only team permissions allow administrator creation and permission escalation (high 8.8)
- [CVE-2026-56827](https://insights.sbomify.com/CVE-2026-56827/): Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers (high 8.1)
- [CVE-2026-56826](https://insights.sbomify.com/CVE-2026-56826/): Shopping privilege escalation through missing authorization in Settings components (medium 5.4)
- [CVE-2026-56825](https://insights.sbomify.com/CVE-2026-56825/): Shopper: Missing authorization on product removal actions in CollectionProducts component (high 8.1)
- [CVE-2026-56823](https://insights.sbomify.com/CVE-2026-56823/): AutoGPT: IDOR in Webhook Ping Endpoint Allows Enumeration and Cross-User Ping Triggering (medium 5.4)
- [CVE-2026-56822](https://insights.sbomify.com/CVE-2026-56822/): Netty: TOCTOU in OcspServerCertificateValidator (high 7.4)
- [CVE-2026-56821](https://insights.sbomify.com/CVE-2026-56821/): Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator (high 7.4)
- [CVE-2026-56820](https://insights.sbomify.com/CVE-2026-56820/): Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks (high 7.4)
- [CVE-2026-5682](https://insights.sbomify.com/CVE-2026-5682/): Meesho Online Shopping App com.meesho.supply endpoint risky encryption (medium 6.3)
- [CVE-2026-56819](https://insights.sbomify.com/CVE-2026-56819/): Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS) (high 7.5)
- [CVE-2026-56818](https://insights.sbomify.com/CVE-2026-56818/): Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate state (medium 6.5)
- [CVE-2026-56817](https://insights.sbomify.com/CVE-2026-56817/): Netty: XML External Entity (XXE) injection via unconfigured XML factory when DTD and entity processing are enabled (high 8.3)
- [CVE-2026-56816](https://insights.sbomify.com/CVE-2026-56816/): Netty: Memory Exhaustion via HTTP/3 Reserved Frame Types (high 7.5)
- [CVE-2026-56815](https://insights.sbomify.com/CVE-2026-56815/): Path traversal in pwnlift (high 7.4)
- [CVE-2026-56814](https://insights.sbomify.com/CVE-2026-56814/): Denial of service in plug (medium 6.9)
- [CVE-2026-56813](https://insights.sbomify.com/CVE-2026-56813/): Cookie attribute injection in Plug.Conn.Cookies.encode/2 (low 2.1)
- [CVE-2026-56812](https://insights.sbomify.com/CVE-2026-56812/): Phoenix: Presence keys colliding with `Object.prototype` members break existence checks (medium 6.3)
- [CVE-2026-56811](https://insights.sbomify.com/CVE-2026-56811/): Phoenix transports do not limit channel joins per connection, enabling process-exhaustion denial of service (high 8.7)
- [CVE-2026-56810](https://insights.sbomify.com/CVE-2026-56810/): mint buffers an entire chunked response chunk in memory in Mint.HTTP1.decode_body/5 (high 8.7)
- [CVE-2026-5681](https://insights.sbomify.com/CVE-2026-5681/): itsourcecode sanitize or validate this input Parameter borrowedequip.php sql injection (medium 5.3)
- [CVE-2026-56809](https://insights.sbomify.com/CVE-2026-56809/): Cross-site scripting in Multiple MFPs which implement Ricoh Web Image Monitor (medium 5.1)
- [CVE-2026-56808](https://insights.sbomify.com/CVE-2026-56808/): Command injection in DGM3103SCT (high 8.6)
- [CVE-2026-5680](https://insights.sbomify.com/CVE-2026-5680/): Undertow-core: undertow: denial of service via websocket permessage-deflate processing (high 7.5)
- [CVE-2026-56797](https://insights.sbomify.com/CVE-2026-56797/): Race condition in Dell Command Update (DCU) (high 7.3)
- [CVE-2026-56796](https://insights.sbomify.com/CVE-2026-56796/): Privilege escalation in Dell Command Update (DCU) (medium 6.6)
- [CVE-2026-56795](https://insights.sbomify.com/CVE-2026-56795/): Privilege escalation in Driver Pack For Linux OS (high 8.2)
- [CVE-2026-56794](https://insights.sbomify.com/CVE-2026-56794/): Path traversal in Dell OpenManage Server Administrator Managed Node (Patch) for Windows (medium 6.5)
- [CVE-2026-56793](https://insights.sbomify.com/CVE-2026-56793/): Auth bypass in Dell OpenManage Server Administrator Managed Node for RHEL 8.10 (high 7.7)
- [CVE-2026-56792](https://insights.sbomify.com/CVE-2026-56792/): Privilege escalation in Rugged Control Center (RCC) (medium 4.4)
- [CVE-2026-56790](https://insights.sbomify.com/CVE-2026-56790/): CANBoat - Off-by-One Global Buffer Overflow in searchForPgn() (high 7.0)
- [CVE-2026-5679](https://insights.sbomify.com/CVE-2026-5679/): Totolink A3300R cstecgi.cgi vsetTr069Cfg os command injection (medium 5.1)
- [CVE-2026-56789](https://insights.sbomify.com/CVE-2026-56789/): RTKLIB 2.4.3 - Heap Buffer Overflow and Stack Read via Oversized RINEX Epoch Satellite Count (high 7.1)
- [CVE-2026-56788](https://insights.sbomify.com/CVE-2026-56788/): RTKLIB 2.4.3 - Out-of-bounds Read via Negative Array Index in getcodepri (medium 4.8)
- [CVE-2026-56787](https://insights.sbomify.com/CVE-2026-56787/): RTKLIB 2.4.3 - Off-by-One Out-of-Bounds Read in decode_ssr3 via RTCM3 SSR Message (medium 6.9)
- [CVE-2026-56786](https://insights.sbomify.com/CVE-2026-56786/): RTKLIB 2.4.3 - Out-of-bounds Write in decode_type1033 via Crafted RTCM3 Message (critical 9.3)
- [CVE-2026-56785](https://insights.sbomify.com/CVE-2026-56785/): FlatPress - Stored Cross-Site Scripting via Unescaped Comment and Contact Form Fields (high 8.4)
- [CVE-2026-56784](https://insights.sbomify.com/CVE-2026-56784/): OpenRemote < 1.25.0 IDOR via Bulk Alarm Deletion Endpoint (high 8.6)
- [CVE-2026-56783](https://insights.sbomify.com/CVE-2026-56783/): Parseable < 2.9.2 - Cleartext Credential Exposure in Notification Target API (high 7.1)
- [CVE-2026-56782](https://insights.sbomify.com/CVE-2026-56782/): Gorse - Unauthenticated Database Dump and Restore via /api/dump and /api/restore Endpoints (critical 9.3)
- [CVE-2026-56781](https://insights.sbomify.com/CVE-2026-56781/): Teable - Unauthenticated Hidden Field Disclosure via Projection Parameter Override (medium 6.9)
- [CVE-2026-56780](https://insights.sbomify.com/CVE-2026-56780/): Modoboa < 2.9.0 - Insecure Direct Object Reference in Account Password Change API (high 7.7)
- [CVE-2026-5678](https://insights.sbomify.com/CVE-2026-5678/): Totolink A7100RU cstecgi.cgi setScheduleCfg os command injection (medium 6.9)
- [CVE-2026-56779](https://insights.sbomify.com/CVE-2026-56779/): MaxKB < 2.10.0 - Server-Side Request Forgery via downloadCallbackUrl and download_url Parameters (medium 5.3)
- [CVE-2026-56778](https://insights.sbomify.com/CVE-2026-56778/): n8n - Authorization Bypass in Public API Execution Retry Endpoint (medium 5.3)
- [CVE-2026-56777](https://insights.sbomify.com/CVE-2026-56777/): n8n - AST Validator Bypass in Python Code Node (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/531/