# Vulnerabilities published in 2026


- [CVE-2026-56667](https://insights.sbomify.com/CVE-2026-56667/): ZITADEL: Stored XSS via Default URI Redirect in Login V2 (high 7.3)
- [CVE-2026-56666](https://insights.sbomify.com/CVE-2026-56666/): ZITADEL: Auto-linking by email: IdP-side email verification is not checked (medium 4.8)
- [CVE-2026-56665](https://insights.sbomify.com/CVE-2026-56665/): ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider (medium 4.2)
- [CVE-2026-56664](https://insights.sbomify.com/CVE-2026-56664/): ZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) in JWT IdP Provider (medium 4.2)
- [CVE-2026-56663](https://insights.sbomify.com/CVE-2026-56663/): AutoGPT: SSRF-to-RCE Chain in `SendWebRequestBlock` via IP validation bypass and internal `pg-meta` access (high 8.5)
- [CVE-2026-56662](https://insights.sbomify.com/CVE-2026-56662/): GetSimple CMS: Missing CSRF protection in UpdateCE allows forging a privileged server-side update request (critical 9.6)
- [CVE-2026-56661](https://insights.sbomify.com/CVE-2026-56661/): GetSimple CMS: Server-Side Request Forgery in the UpdateCE update endpoint (high 7.5)
- [CVE-2026-56660](https://insights.sbomify.com/CVE-2026-56660/): GetSimple CMS: CSRF, SSRF, and Unrestricted Zip Extraction (critical 9.1)
- [CVE-2026-5666](https://insights.sbomify.com/CVE-2026-5666/): code-projects Online FIR System SQL Database Backup File complaints.sql sensitive information (medium 6.9)
- [CVE-2026-56657](https://insights.sbomify.com/CVE-2026-56657/): Gitea SSH Key Parser Denial of Service (medium 6.2)
- [CVE-2026-56654](https://insights.sbomify.com/CVE-2026-56654/): Privilege Escalation via Access Token Scope Escalation in API (critical 9.8)
- [CVE-2026-56652](https://insights.sbomify.com/CVE-2026-56652/): Formula Injection in dool project (medium 4.6)
- [CVE-2026-56651](https://insights.sbomify.com/CVE-2026-56651/): Arbitrary File Overwrite via Symlink Following in dool project (low 2.0)
- [CVE-2026-56650](https://insights.sbomify.com/CVE-2026-56650/): Windows Network File System Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-5665](https://insights.sbomify.com/CVE-2026-5665/): code-projects Online FIR System Login checklogin.php sql injection (medium 6.9)
- [CVE-2026-56649](https://insights.sbomify.com/CVE-2026-56649/): Windows Network File System Remote Code Execution Vulnerability (medium 5.9)
- [CVE-2026-56648](https://insights.sbomify.com/CVE-2026-56648/): Windows NFS Server Elevation of Privilege Vulnerability (high 7.5)
- [CVE-2026-56647](https://insights.sbomify.com/CVE-2026-56647/): Windows Remote Access Service Infrastructure Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-56646](https://insights.sbomify.com/CVE-2026-56646/): Microsoft Edge (Chromium-based) Spoofing Vulnerability (medium 6.5)
- [CVE-2026-56645](https://insights.sbomify.com/CVE-2026-56645/): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-56644](https://insights.sbomify.com/CVE-2026-56644/): DirectX Graphics Kernel Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-56643](https://insights.sbomify.com/CVE-2026-56643/): DirectX Graphics Kernel Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-56642](https://insights.sbomify.com/CVE-2026-56642/): Microsoft Fabric Data Warehouse Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-5663](https://insights.sbomify.com/CVE-2026-5663/): OFFIS DCMTK storescp storescp.cc executeOnEndOfStudy os command injection (medium 6.9)
- [CVE-2026-56624](https://insights.sbomify.com/CVE-2026-56624/): Apache MINA SSHD: SSH certificate options lack validations (high 7.3)
- [CVE-2026-56623](https://insights.sbomify.com/CVE-2026-56623/): Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git on Windows (high 7.1)
- [CVE-2026-56620](https://insights.sbomify.com/CVE-2026-56620/): HCL BigFix Mobile is vulnerable to information disclosure (medium 4.3)
- [CVE-2026-56619](https://insights.sbomify.com/CVE-2026-56619/): HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting (Reflected XSS) (medium 5.4)
- [CVE-2026-5661](https://insights.sbomify.com/CVE-2026-5661/): Free5GC NGSetupRequest denial of service (medium 6.9)
- [CVE-2026-56609](https://insights.sbomify.com/CVE-2026-56609/): HCL iControl is affected by multiple security vulnerabilities(CVE-2026-56608 and CVE-2026-56609). (medium 4.8)
- [CVE-2026-56608](https://insights.sbomify.com/CVE-2026-56608/): HCL iControl is affected by multiple security vulnerabilities(CVE-2026-56608 and CVE-2026-56609). (low 3.7)
- [CVE-2026-5660](https://insights.sbomify.com/CVE-2026-5660/): itsourcecode Construction Management System Parameter borrowed_equip.php sql injection (medium 5.3)
- [CVE-2026-56599](https://insights.sbomify.com/CVE-2026-56599/): HCL BigFix Service Management is affected by multiple security vulnerabilities. (low 2.2)
- [CVE-2026-56597](https://insights.sbomify.com/CVE-2026-56597/): HCL BigFix Service Management is affected by multiple security vulnerabilities. (low 3.1)
- [CVE-2026-56596](https://insights.sbomify.com/CVE-2026-56596/): HCL BigFix Service Management is affected by multiple security vulnerabilities. (low 3.5)
- [CVE-2026-56595](https://insights.sbomify.com/CVE-2026-56595/): HCL BigFix Service Management is affected by multiple security vulnerabilities. (low 3.1)
- [CVE-2026-56592](https://insights.sbomify.com/CVE-2026-56592/): HCL BigFix Service Management is affected by multiple security vulnerabilities. (medium 6.5)
- [CVE-2026-56590](https://insights.sbomify.com/CVE-2026-56590/): HCL BigFix Service Management is affected by multiple security vulnerabilities. (medium 6.4)
- [CVE-2026-5659](https://insights.sbomify.com/CVE-2026-5659/): pytries datrie trie File datrie.pyx Trie.__setstate__ deserialization (medium 5.3)
- [CVE-2026-56589](https://insights.sbomify.com/CVE-2026-56589/): HCL BigFix Service Management is affected by multiple security vulnerabilities. (high 7.2)
- [CVE-2026-56587](https://insights.sbomify.com/CVE-2026-56587/): HCL IEM was affected with Strict transport security not enforced (low 3.7)
- [CVE-2026-56586](https://insights.sbomify.com/CVE-2026-56586/): HCL IEM was affected with X-Content-Type-Options Header Missing (low 3.1)
- [CVE-2026-56585](https://insights.sbomify.com/CVE-2026-56585/): HCL IEM was affected with the Anti Clickjacking XFrame Options Header Missing (low 3.1)
- [CVE-2026-56584](https://insights.sbomify.com/CVE-2026-56584/): HCL IEM was affected with the Information disclosure nginx server (low 3.7)
- [CVE-2026-56583](https://insights.sbomify.com/CVE-2026-56583/): HCL MyCloud was affected with Concurrent Login Vulnerability. (low 3.1)
- [CVE-2026-56582](https://insights.sbomify.com/CVE-2026-56582/): HCL MyCloud was affected with SSL/TLS Protocol Affected with LUCKY13 Vulnerability. (low 3.1)
- [CVE-2026-56581](https://insights.sbomify.com/CVE-2026-56581/): HCL MyCloud was affected with Cookie Attribute Path Not Set (low 2.6)
- [CVE-2026-56580](https://insights.sbomify.com/CVE-2026-56580/): HCL MyCloud was affected by Using Components with Known Vulnerability (low 2.2)
- [CVE-2026-56579](https://insights.sbomify.com/CVE-2026-56579/): HCL MyCloud was affected with Exposure of Sensitive Information to an Unauthorized Actor. (low 3.1)
- [CVE-2026-56578](https://insights.sbomify.com/CVE-2026-56578/): HCL MyCloud was affected by Server Version Disclosure (low 2.2)
- [CVE-2026-56577](https://insights.sbomify.com/CVE-2026-56577/): HCL MyCloud affected by Weak Password Policy (low 3.1)
- [CVE-2026-56571](https://insights.sbomify.com/CVE-2026-56571/): HCL iControl is affected by multiple security vulnerabilities. (low 3.7)
- [CVE-2026-56570](https://insights.sbomify.com/CVE-2026-56570/): HCL iControl is affected by multiple security vulnerabilities. (low 3.7)
- [CVE-2026-5657](https://insights.sbomify.com/CVE-2026-5657/): Double Free in Wireshark (medium 5.5)
- [CVE-2026-56569](https://insights.sbomify.com/CVE-2026-56569/): HCL iControl is affected by multiple security vulnerabilities. (medium 4.0)
- [CVE-2026-56568](https://insights.sbomify.com/CVE-2026-56568/): HCL iControl is affected by multiple security vulnerabilities. (low 3.7)
- [CVE-2026-56567](https://insights.sbomify.com/CVE-2026-56567/): HCL iControl is affected by multiple security vulnerabilities. (medium 5.1)
- [CVE-2026-5656](https://insights.sbomify.com/CVE-2026-5656/): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Wireshark (high 7.0)
- [CVE-2026-5655](https://insights.sbomify.com/CVE-2026-5655/): Use After Free in Wireshark (medium 5.5)
- [CVE-2026-56547](https://insights.sbomify.com/CVE-2026-56547/): An input reflection vulnerability affects HCL Traveler (low 3.5)
- [CVE-2026-5654](https://insights.sbomify.com/CVE-2026-5654/): Stack-based Buffer Overflow in Wireshark (medium 5.5)
- [CVE-2026-56538](https://insights.sbomify.com/CVE-2026-56538/): HCL Connections is vulnerable to information disclosure (low 3.5)
- [CVE-2026-56537](https://insights.sbomify.com/CVE-2026-56537/): HCL Connections is vulnerable to information disclosure (low 3.5)
- [CVE-2026-5653](https://insights.sbomify.com/CVE-2026-5653/): Heap-based Buffer Overflow in Wireshark (medium 5.5)
- [CVE-2026-5652](https://insights.sbomify.com/CVE-2026-5652/): Authorization Bypass Through User-Controlled Key in Crafty Controller (critical 9.0)
- [CVE-2026-5651](https://insights.sbomify.com/CVE-2026-5651/): Askeet <= 3.0 - Authenticated (Administrator+) SQL Injection via 'sql_query' Parameter (medium 4.9)
- [CVE-2026-5650](https://insights.sbomify.com/CVE-2026-5650/): code-projects Online Application System for Admission oas.sql sensitive information (medium 6.9)
- [CVE-2026-5649](https://insights.sbomify.com/CVE-2026-5649/): code-projects Online Application System for Admission Endpoint admsnform.php sql injection (medium 5.3)
- [CVE-2026-5648](https://insights.sbomify.com/CVE-2026-5648/): code-projects Simple Laundry System Parameter userfinishregister.php sql injection (medium 6.9)
- [CVE-2026-5647](https://insights.sbomify.com/CVE-2026-5647/): code-projects Online Shoe Store Add Product admin_feature.php cross site scripting (medium 4.8)
- [CVE-2026-56460](https://insights.sbomify.com/CVE-2026-56460/): HCL DevOps Deploy / HCL Launch is susceptible to an Insertion of Sensitive Information Into Sent Data vulnerability (medium 6.5)
- [CVE-2026-5646](https://insights.sbomify.com/CVE-2026-5646/): code-projects Easy Blog Site login.php sql injection (medium 6.9)
- [CVE-2026-56459](https://insights.sbomify.com/CVE-2026-56459/): HCL DevOps Deploy / HCL Launch is susceptible to sensitive information disclosure (medium 6.2)
- [CVE-2026-56458](https://insights.sbomify.com/CVE-2026-56458/): HCL DevOps Deploy is susceptible to a Permissive Cross-domain Security Policy with Untrusted Domains (medium 5.4)
- [CVE-2026-56457](https://insights.sbomify.com/CVE-2026-56457/): HCL DevOps Deploy / HCL Launch is susceptible to an exposure of sensitive information (medium 4.3)
- [CVE-2026-56456](https://insights.sbomify.com/CVE-2026-56456/): HCL DFXAnalytics is affected by an Internal File Path Disclosure vulnerability. (medium 5.3)
- [CVE-2026-56455](https://insights.sbomify.com/CVE-2026-56455/): HCL DFXAnalytics is affected by a Buffer Overflow vulnerability that can lead to a Denial of Service (DoS). (medium 5.3)
- [CVE-2026-56454](https://insights.sbomify.com/CVE-2026-56454/): HCL DFXAnalytics is affected by a Deprecated Protocol vulnerability due to the use of TLS 1.0 and TLS 1.1. (medium 5.9)
- [CVE-2026-56453](https://insights.sbomify.com/CVE-2026-56453/): HCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vulnerability. (medium 5.5)
- [CVE-2026-56452](https://insights.sbomify.com/CVE-2026-56452/): Apache MINA SSHD: Path traversal in SCP file reception (high 7.5)
- [CVE-2026-56451](https://insights.sbomify.com/CVE-2026-56451/): Auth bypass in Opcenter X (critical 10.0)
- [CVE-2026-56450](https://insights.sbomify.com/CVE-2026-56450/): AIL Framework - Missing Rate Limiting Enables Brute-Force Attacks Against Two-Factor Authentication Codes (medium 5.1)
- [CVE-2026-5645](https://insights.sbomify.com/CVE-2026-5645/): projectworlds Car Rental System Parameter pay.php sql injection (medium 6.9)
- [CVE-2026-56449](https://insights.sbomify.com/CVE-2026-56449/): Apache HTTP Server: mod_proxy_html: crash in dump_content (high 7.5)
- [CVE-2026-56448](https://insights.sbomify.com/CVE-2026-56448/): Authenticated Path Traversal in AIL Framework Investigation Downloads Allows Arbitrary File Read (high 8.3)
- [CVE-2026-56447](https://insights.sbomify.com/CVE-2026-56447/): MISP remote code execution via arbitrary rdkafka configuration path (critical 9.3)
- [CVE-2026-56446](https://insights.sbomify.com/CVE-2026-56446/): Authenticated Remote Code Execution via Arbitrary NDJSON Error Log Path in MISP (high 8.7)
- [CVE-2026-56445](https://insights.sbomify.com/CVE-2026-56445/): pydicom pynetdicom Library Path Traversal (high 8.8)
- [CVE-2026-56444](https://insights.sbomify.com/CVE-2026-56444/): Denial of service in Unbound (medium 5.9)
- [CVE-2026-56443](https://insights.sbomify.com/CVE-2026-56443/): Gitea: Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118 (critical 9.6)
- [CVE-2026-5644](https://insights.sbomify.com/CVE-2026-5644/): Cyber-III Student-Management-System batch-notice.php cross site scripting (medium 4.8)
- [CVE-2026-56437](https://insights.sbomify.com/CVE-2026-56437/): Other in Pupsman (high 8.4)
- [CVE-2026-56434](https://insights.sbomify.com/CVE-2026-56434/): NGINX ngx_http_ssi_module vulnerability (high 8.3)
- [CVE-2026-5643](https://insights.sbomify.com/CVE-2026-5643/): Cyber-III Student-Management-System Admin Add Endpoint notice.php cross site scripting (medium 4.8)
- [CVE-2026-56428](https://insights.sbomify.com/CVE-2026-56428/): Hardcoded credentials in BSH ELP (Electronic Platform) Modules (high 8.1)
- [CVE-2026-56425](https://insights.sbomify.com/CVE-2026-56425/): Auth bypass in misp (critical 9.3)
- [CVE-2026-56424](https://insights.sbomify.com/CVE-2026-56424/): Missing authorization in misp (high 7.1)
- [CVE-2026-56423](https://insights.sbomify.com/CVE-2026-56423/): Missing authorization in misp (critical 9.4)
- [CVE-2026-56422](https://insights.sbomify.com/CVE-2026-56422/): MISP Core: Mass Assignment and Object Re-ownership via Unvalidated Request Fields (critical 9.4)
- [CVE-2026-5642](https://insights.sbomify.com/CVE-2026-5642/): Cyber-III Student-Management-System HTTP POST Request update.php improper authorization (medium 6.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/533/