# Vulnerabilities published in 2026


- [CVE-2026-56776](https://insights.sbomify.com/CVE-2026-56776/): n8n - Incorrect OAuth Scope Validation in Workflow Test Run Endpoint (medium 5.3)
- [CVE-2026-56775](https://insights.sbomify.com/CVE-2026-56775/): n8n - Incorrect OAuth Scope Validation in Evaluation Test Runs Endpoints (medium 5.3)
- [CVE-2026-56774](https://insights.sbomify.com/CVE-2026-56774/): Kanboard - Cross-User Deletion of Persistent Login Sessions via Unvalidated Session ID (medium 5.3)
- [CVE-2026-56773](https://insights.sbomify.com/CVE-2026-56773/): Teable - Missing Authorization in v2 REST API (high 8.7)
- [CVE-2026-56772](https://insights.sbomify.com/CVE-2026-56772/): NewsBlur < 14.5.0 - Insecure Direct Object Reference in Social Interactions Endpoint (medium 5.3)
- [CVE-2026-56771](https://insights.sbomify.com/CVE-2026-56771/): NewsBlur < 14.5.0 - Server-Side Request Forgery via add_url Endpoint (medium 6.3)
- [CVE-2026-56770](https://insights.sbomify.com/CVE-2026-56770/): libais 0.15 - Out-of-bounds Vector Access in VdmStream::AddLine via Invalid Sequential Message ID (high 8.7)
- [CVE-2026-5677](https://insights.sbomify.com/CVE-2026-5677/): Totolink A7100RU cstecgi.cgi CsteSystem os command injection (medium 6.9)
- [CVE-2026-56769](https://insights.sbomify.com/CVE-2026-56769/): Huly Platform - Server-Side Request Forgery via /import Endpoint (medium 6.3)
- [CVE-2026-56768](https://insights.sbomify.com/CVE-2026-56768/): Seahub < 13.0.23 - Authentication Bypass in ShareLinkZipTaskView GET Method (high 8.7)
- [CVE-2026-56767](https://insights.sbomify.com/CVE-2026-56767/): Maxun < 0.0.42 - Cross-Tenant IDOR in Storage and Webhook API Handlers (high 8.7)
- [CVE-2026-56766](https://insights.sbomify.com/CVE-2026-56766/): Hydra - Stack Buffer Overflow in NTLM Authentication Handler (high 8.6)
- [CVE-2026-56765](https://insights.sbomify.com/CVE-2026-56765/): Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR (critical 9.3)
- [CVE-2026-56764](https://insights.sbomify.com/CVE-2026-56764/): Hono - Timing Attack in basicAuth and bearerAuth Middleware (medium 6.3)
- [CVE-2026-56763](https://insights.sbomify.com/CVE-2026-56763/): Hono - Prototype Pollution via __proto__ Key in parseBody with dot Option (medium 6.3)
- [CVE-2026-56762](https://insights.sbomify.com/CVE-2026-56762/): Hono - Missing Cookie Name Validation in setCookie() (medium 6.9)
- [CVE-2026-56761](https://insights.sbomify.com/CVE-2026-56761/): hono - HTML Injection via Improper JSX Attribute Name Handling in SSR (medium 5.3)
- [CVE-2026-5676](https://insights.sbomify.com/CVE-2026-5676/): Totolink A8000R cstecgi.cgi setLanguageCfg missing authentication (medium 6.9)
- [CVE-2026-56758](https://insights.sbomify.com/CVE-2026-56758/): MZ Automation libiec61850 Out-of-bounds Read (medium 6.9)
- [CVE-2026-56755](https://insights.sbomify.com/CVE-2026-56755/): Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload (medium 6.2)
- [CVE-2026-56750](https://insights.sbomify.com/CVE-2026-56750/): Gitea Remember-Me Token Theft Not Invalidating Attacker Session (critical 9.1)
- [CVE-2026-5675](https://insights.sbomify.com/CVE-2026-5675/): itsourcecode Construction Management System Parameter borrowed_tool.php sql injection (medium 5.3)
- [CVE-2026-56748](https://insights.sbomify.com/CVE-2026-56748/): Authenticated RCE via Symlink Following in Cribl Stream Pack Git Import (high 8.7)
- [CVE-2026-56747](https://insights.sbomify.com/CVE-2026-56747/): Code Injection in JSON Pointer Processing Component in Cribl Stream (high 8.7)
- [CVE-2026-56746](https://insights.sbomify.com/CVE-2026-56746/): Netty has a Security Control Bypass via CORS Short-Circuit Failure (medium 6.5)
- [CVE-2026-56745](https://insights.sbomify.com/CVE-2026-56745/): Netty SpdyHttpDecoder: ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion (high 8.7)
- [CVE-2026-56744](https://insights.sbomify.com/CVE-2026-56744/): `@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction (high 8.7)
- [CVE-2026-56743](https://insights.sbomify.com/CVE-2026-56743/): Cilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured with an ipBlock match (medium 5.4)
- [CVE-2026-56742](https://insights.sbomify.com/CVE-2026-56742/): Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces (medium 5.9)
- [CVE-2026-56741](https://insights.sbomify.com/CVE-2026-56741/): JLine: Unauthenticated Remote DoS via Unbounded Telnet NAWS Terminal Geometry (high 7.5)
- [CVE-2026-56740](https://insights.sbomify.com/CVE-2026-56740/): JLine: Unauthenticated Remote Memory Exhaustion via Unbounded Telnet NEW-ENVIRON Variables (high 7.5)
- [CVE-2026-5674](https://insights.sbomify.com/CVE-2026-5674/): Pipewire: pipewire: sandbox escape and arbitrary code execution via malicious library loading (high 8.8)
- [CVE-2026-56739](https://insights.sbomify.com/CVE-2026-56739/): Logto: SSRF via Webhooks and Custom OAuth2 Connector UserInfo Endpoint (high 8.5)
- [CVE-2026-56738](https://insights.sbomify.com/CVE-2026-56738/): phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion (high 8.5)
- [CVE-2026-56737](https://insights.sbomify.com/CVE-2026-56737/): phpMyFAQ's two-factor authentication login bypasses the password factor (high 8.1)
- [CVE-2026-56736](https://insights.sbomify.com/CVE-2026-56736/): phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission (high 8.2)
- [CVE-2026-56735](https://insights.sbomify.com/CVE-2026-56735/): Zammad: Improper neutralization of `srcset` attribute in IMG tags in Zammad (medium 5.3)
- [CVE-2026-56734](https://insights.sbomify.com/CVE-2026-56734/): Zammad: Avatar Image URL Server-Side Request Forwarding (medium 5.3)
- [CVE-2026-56733](https://insights.sbomify.com/CVE-2026-56733/): Zammad: Incorrect Authorization and Improper Privilege Management (high 8.7)
- [CVE-2026-56732](https://insights.sbomify.com/CVE-2026-56732/): Zammad: Malicious input in Ticket Body Enables Session Termination (medium 5.3)
- [CVE-2026-56731](https://insights.sbomify.com/CVE-2026-56731/): Zammad: Cross-Site Scripting in Ticket Notifications (high 8.4)
- [CVE-2026-56730](https://insights.sbomify.com/CVE-2026-56730/): Zammad: Missing authorization in GraphQL mutation for suggesting knowledge base answers (low 2.1)
- [CVE-2026-5673](https://insights.sbomify.com/CVE-2026-5673/): Libtheora: libtheora: denial of service or information disclosure via malformed avi file processing (medium 5.6)
- [CVE-2026-56729](https://insights.sbomify.com/CVE-2026-56729/): Zammad: Titles of knowledge base answers will be shown across all categories via the global search (low 2.1)
- [CVE-2026-56728](https://insights.sbomify.com/CVE-2026-56728/): Zammad: Cross-User Taskbar Item Access Control Vulnerability (medium 5.3)
- [CVE-2026-56727](https://insights.sbomify.com/CVE-2026-56727/): Zammad: PGP signature spoofing via unvalidated verification return (high 7.1)
- [CVE-2026-56726](https://insights.sbomify.com/CVE-2026-56726/): Zammad: Missing authorization check in GitHub + GitLab integration allows cross-ticket data leak (medium 5.1)
- [CVE-2026-56725](https://insights.sbomify.com/CVE-2026-56725/): Zammad: Denial of Service via OTRS Import Controller (high 8.7)
- [CVE-2026-56724](https://insights.sbomify.com/CVE-2026-56724/): Zammad: Incorrect implementation of permission checks in the knowledge base module (high 7.1)
- [CVE-2026-56723](https://insights.sbomify.com/CVE-2026-56723/): Zammad: Missing authorization on ticket attachment download (high 7.1)
- [CVE-2026-56722](https://insights.sbomify.com/CVE-2026-56722/): Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI (medium 6.3)
- [CVE-2026-56721](https://insights.sbomify.com/CVE-2026-56721/): CamaleonCMS 2.9.2 Privilege Escalation via Parameter Confusion in UsersController (high 8.7)
- [CVE-2026-56720](https://insights.sbomify.com/CVE-2026-56720/): CamaleonCMS 2.9.2 and earlier Missing Authorization via profile Action (medium 5.3)
- [CVE-2026-5672](https://insights.sbomify.com/CVE-2026-5672/): code-projects Simple IT Discussion Forum Parameter edit-category.php sql injection (medium 6.9)
- [CVE-2026-56719](https://insights.sbomify.com/CVE-2026-56719/): MikroTik RouterOS < 7.24 Out-of-Bounds Read via SMB1 SessionSetupAndX (medium 6.3)
- [CVE-2026-56718](https://insights.sbomify.com/CVE-2026-56718/): AJCloud AJY IPC Firmware Path Traversal via jdbhttpd (high 8.7)
- [CVE-2026-56711](https://insights.sbomify.com/CVE-2026-56711/): VLC media player 3.0.0 through 3.0.23 memory corruption vulnerability (high 7.3)
- [CVE-2026-56710](https://insights.sbomify.com/CVE-2026-56710/): Grav Login Plugin before 1.0.16 Privilege Escalation via Unlock (critical 9.3)
- [CVE-2026-5671](https://insights.sbomify.com/CVE-2026-5671/): Cyber-III Student-Management-System Class Schedule Deletion Endpoint delete_batch.php cross site scripting (medium 5.3)
- [CVE-2026-56709](https://insights.sbomify.com/CVE-2026-56709/): Grav before 3.9.2 Host Header Injection via sendInvitationEmail (high 8.7)
- [CVE-2026-56708](https://insights.sbomify.com/CVE-2026-56708/): Grav API Plugin before 1.0.16 SSRF via DNS Rebinding (medium 6.9)
- [CVE-2026-56707](https://insights.sbomify.com/CVE-2026-56707/): Grav Flex Objects 1.4.0 through 1.4.7 Authorization Bypass via Shortcode (high 8.3)
- [CVE-2026-56706](https://insights.sbomify.com/CVE-2026-56706/): Adminer before 5.4.3 CSRF Token Secret Recovery via XOR Masking (medium 6.1)
- [CVE-2026-56705](https://insights.sbomify.com/CVE-2026-56705/): Adminer before 5.4.3 Remote Code Execution via MSSQL PDO DSN Injection (critical 9.3)
- [CVE-2026-56704](https://insights.sbomify.com/CVE-2026-56704/): Adminer before 5.4.3 Cross-Site Scripting via MySQL Version String (medium 5.3)
- [CVE-2026-56703](https://insights.sbomify.com/CVE-2026-56703/): Adminer before 5.4.3 Remote Code Execution via SQLite VACUUM INTO (high 8.6)
- [CVE-2026-56702](https://insights.sbomify.com/CVE-2026-56702/): Adminer before 5.4.3 Unrestricted File Upload via AdminerFileUpload (high 7.1)
- [CVE-2026-56701](https://insights.sbomify.com/CVE-2026-56701/): Grav - XML External Entity Injection via SVG Upload (high 7.1)
- [CVE-2026-56700](https://insights.sbomify.com/CVE-2026-56700/): Grav - Multiple Remote Code Execution Vulnerabilities via Unsafe Unserialize and Command Injection (critical 9.3)
- [CVE-2026-5670](https://insights.sbomify.com/CVE-2026-5670/): Cyber-III Student-Management-System upload.php move_uploaded_file unrestricted upload (medium 5.3)
- [CVE-2026-56698](https://insights.sbomify.com/CVE-2026-56698/): Nuxt - Cross-Site Scripting via navigateTo open Option (medium 5.3)
- [CVE-2026-56697](https://insights.sbomify.com/CVE-2026-56697/): Nuxt - Open Redirect via Protocol-Relative Paths in reloadNuxtApp (medium 5.3)
- [CVE-2026-56696](https://insights.sbomify.com/CVE-2026-56696/): OpenHarness - Prompt Injection via /issue and /pr_comments Slash Commands (medium 5.3)
- [CVE-2026-56695](https://insights.sbomify.com/CVE-2026-56695/): OpenHarness - Cross-Session Disclosure via /resume and /summary Commands (high 7.1)
- [CVE-2026-56694](https://insights.sbomify.com/CVE-2026-56694/): NanoClaw < 2.1.0 - Privilege Escalation via Forged Channel Approval Callback (medium 5.3)
- [CVE-2026-56693](https://insights.sbomify.com/CVE-2026-56693/): NanoClaw < 2.1.17 - Privilege Escalation via Unauthorized create_agent System Action (medium 6.8)
- [CVE-2026-56692](https://insights.sbomify.com/CVE-2026-56692/): NanoClaw < 2.1.17 - Arbitrary File Read via Symlink Following in forwardAttachedFiles (medium 6.8)
- [CVE-2026-56690](https://insights.sbomify.com/CVE-2026-56690/): SQL injection in PowerFlex Manager (high 8.5)
- [CVE-2026-5669](https://insights.sbomify.com/CVE-2026-5669/): Cyber-III Student-Management-System Parameter login.php sql injection (medium 6.9)
- [CVE-2026-56689](https://insights.sbomify.com/CVE-2026-56689/): SQL injection in PowerFlex Manager (high 7.7)
- [CVE-2026-56688](https://insights.sbomify.com/CVE-2026-56688/): Command injection in PowerFlex Manager (critical 9.1)
- [CVE-2026-56687](https://insights.sbomify.com/CVE-2026-56687/): Security feature bypass in ThinOS 10 (high 7.8)
- [CVE-2026-56686](https://insights.sbomify.com/CVE-2026-56686/): Command injection in ObjectScale (high 7.8)
- [CVE-2026-56685](https://insights.sbomify.com/CVE-2026-56685/): Command injection in ObjectScale (high 7.3)
- [CVE-2026-56684](https://insights.sbomify.com/CVE-2026-56684/): Valkey: TLS pending-data processing use-after-free may allow remote code execution (high 7.5)
- [CVE-2026-56682](https://insights.sbomify.com/CVE-2026-56682/): 9Router: Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header (medium 5.3)
- [CVE-2026-56681](https://insights.sbomify.com/CVE-2026-56681/): 9Router: Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header (high 7.3)
- [CVE-2026-5668](https://insights.sbomify.com/CVE-2026-5668/): Cyber-III Student-Management-System add%20notice.php cross site scripting (medium 4.8)
- [CVE-2026-56679](https://insights.sbomify.com/CVE-2026-56679/): 9Router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade (high 8.7)
- [CVE-2026-56678](https://insights.sbomify.com/CVE-2026-56678/): 9Router: Kiro region injection allows authenticated SSRF with Authorization header forwarding (medium 6.4)
- [CVE-2026-56677](https://insights.sbomify.com/CVE-2026-56677/): 9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint (high 8.6)
- [CVE-2026-56676](https://insights.sbomify.com/CVE-2026-56676/): 9router: Image prefetch DNS rebinding allows SSRF to internal services (high 7.4)
- [CVE-2026-56675](https://insights.sbomify.com/CVE-2026-56675/): 9router: Reverse proxy locality collapse allows unauthenticated access to 9router /v1 APIs (high 8.3)
- [CVE-2026-56673](https://insights.sbomify.com/CVE-2026-56673/): ComfyUI: Path traversal in LoadImage via the /prompt API allows arbitrary file existence probing and image exfiltration (high 7.5)
- [CVE-2026-56672](https://insights.sbomify.com/CVE-2026-56672/): ComfyUI: Stored XSS via /userdata/{file} due to Missing Content-Type Sanitization (high 8.2)
- [CVE-2026-56671](https://insights.sbomify.com/CVE-2026-56671/): ComfyUI: Path traversal in /experiment/models/preview allows arbitrary image file read (high 7.5)
- [CVE-2026-56670](https://insights.sbomify.com/CVE-2026-56670/): ComfyUI: Stored XSS via SVG file upload on the /view endpoint (high 8.2)
- [CVE-2026-5667](https://insights.sbomify.com/CVE-2026-5667/): Information Disclosure, Information Tampering, or Denial-of-Service (DoS) Vulnerability in Multiple Home Appliances (high 7.2)
- [CVE-2026-56669](https://insights.sbomify.com/CVE-2026-56669/): Elysia: Inefficient Algorithmic Complexity and Interpretation Conflict (high 7.5)
- [CVE-2026-56668](https://insights.sbomify.com/CVE-2026-56668/): ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange (high 8.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/532/