# Vulnerabilities published in 2026


- [CVE-2026-56416](https://insights.sbomify.com/CVE-2026-56416/): Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name (medium 4.8)
- [CVE-2026-56415](https://insights.sbomify.com/CVE-2026-56415/): OS Command Injection in StoneFly Storage Concentrator (critical 10.0)
- [CVE-2026-56414](https://insights.sbomify.com/CVE-2026-56414/): H.VIEW HV-500S6 IP Camera Unrestricted Upload of File with Dangerous Type (high 8.6)
- [CVE-2026-56413](https://insights.sbomify.com/CVE-2026-56413/): OS Command Injection in StoneFly Storage Concentrator (critical 10.0)
- [CVE-2026-56412](https://insights.sbomify.com/CVE-2026-56412/): Use after free in libexpat (medium 4.9)
- [CVE-2026-56411](https://insights.sbomify.com/CVE-2026-56411/): Integer overflow in libexpat (medium 6.9)
- [CVE-2026-56410](https://insights.sbomify.com/CVE-2026-56410/): Integer overflow in libexpat (medium 6.9)
- [CVE-2026-5641](https://insights.sbomify.com/CVE-2026-5641/): PHPGurukul Online Shopping Portal Project Parameter update-image1.php sql injection (medium 5.3)
- [CVE-2026-56409](https://insights.sbomify.com/CVE-2026-56409/): Integer overflow in libexpat (medium 6.5)
- [CVE-2026-56408](https://insights.sbomify.com/CVE-2026-56408/): Integer overflow in libexpat (medium 6.9)
- [CVE-2026-56407](https://insights.sbomify.com/CVE-2026-56407/): Integer overflow in libexpat (medium 6.9)
- [CVE-2026-56406](https://insights.sbomify.com/CVE-2026-56406/): Integer overflow in libexpat (medium 6.9)
- [CVE-2026-56405](https://insights.sbomify.com/CVE-2026-56405/): Integer overflow in libexpat (medium 6.9)
- [CVE-2026-56404](https://insights.sbomify.com/CVE-2026-56404/): Integer overflow in libexpat (medium 6.9)
- [CVE-2026-56403](https://insights.sbomify.com/CVE-2026-56403/): Integer overflow in libexpat (medium 6.9)
- [CVE-2026-56402](https://insights.sbomify.com/CVE-2026-56402/): NanoClaw < 2.1.17 - Privilege Escalation via Unverified Approval Response Handler (high 7.1)
- [CVE-2026-56400](https://insights.sbomify.com/CVE-2026-56400/): open-webui - Remote Code Execution via CORS Misconfiguration and Session Validation (critical 9.0)
- [CVE-2026-5640](https://insights.sbomify.com/CVE-2026-5640/): PHPGurukul Online Shopping Portal Project Parameter update-image2.php sql injection (medium 5.3)
- [CVE-2026-56399](https://insights.sbomify.com/CVE-2026-56399/): Open WebUI - Server-Side Request Forgery via Location Redirect in /api/v1/retrieval/process/web (medium 5.3)
- [CVE-2026-56398](https://insights.sbomify.com/CVE-2026-56398/): Open WebUI - Stored Cross-Site Scripting via OAuth Picture Claim SVG Data URI (high 8.5)
- [CVE-2026-56397](https://insights.sbomify.com/CVE-2026-56397/): SiYuan - Remote Code Execution via Malicious Bazaar Package Metadata and README (critical 9.4)
- [CVE-2026-56396](https://insights.sbomify.com/CVE-2026-56396/): phpMyFAQ - Privilege Escalation via Missing Authorization in editUser() and updateUserRights() (high 8.7)
- [CVE-2026-56394](https://insights.sbomify.com/CVE-2026-56394/): Craft CMS - Authenticated Path Traversal in assets/icon Extension Parameter (high 7.1)
- [CVE-2026-56393](https://insights.sbomify.com/CVE-2026-56393/): Craft CMS - Multiple Stored Cross-Site Scripting in Settings Names and Field Options (medium 4.6)
- [CVE-2026-56392](https://insights.sbomify.com/CVE-2026-56392/): Heap-based Buffer Overflow in GNU coreutils (low 1.8)
- [CVE-2026-56391](https://insights.sbomify.com/CVE-2026-56391/): Out‑of‑bounds Read in GNU coreutils (medium 4.6)
- [CVE-2026-56390](https://insights.sbomify.com/CVE-2026-56390/): Arbitrary Output Location Change in GNU Bison (medium 4.6)
- [CVE-2026-5639](https://insights.sbomify.com/CVE-2026-5639/): PHPGurukul Online Shopping Portal Project Parameter update-image3.php sql injection (medium 5.3)
- [CVE-2026-56389](https://insights.sbomify.com/CVE-2026-56389/): Arbitrary Command Execution in GNU Bison (medium 6.8)
- [CVE-2026-56388](https://insights.sbomify.com/CVE-2026-56388/): Apache bRPC: Out-of-Bounds Write in Redis Command Parser (not scored)
- [CVE-2026-56387](https://insights.sbomify.com/CVE-2026-56387/): Apache bRPC: Remote Memory Exhaustion in RTMP AMF Parser (not scored)
- [CVE-2026-56386](https://insights.sbomify.com/CVE-2026-56386/): Apache bRPC: Integer Underflow and Out-of-Bounds Read in HTTP/2 DATA Frame Parser (high 7.5)
- [CVE-2026-56385](https://insights.sbomify.com/CVE-2026-56385/): Craft CMS - Authorization Bypass in assets/preview-file Endpoint (medium 5.3)
- [CVE-2026-56384](https://insights.sbomify.com/CVE-2026-56384/): Craft CMS - Missing Authorization in assets/preview-thumb Endpoint (medium 5.3)
- [CVE-2026-56383](https://insights.sbomify.com/CVE-2026-56383/): Craft CMS - Stored XSS in Table Field via Row Heading Column Type (medium 4.6)
- [CVE-2026-56382](https://insights.sbomify.com/CVE-2026-56382/): Craft CMS - Remote Code Execution via Missing Config Sanitization in FieldsController (high 8.6)
- [CVE-2026-56381](https://insights.sbomify.com/CVE-2026-56381/): Craft CMS - Stored XSS via User Group Name in User Permissions Page (medium 4.6)
- [CVE-2026-56380](https://insights.sbomify.com/CVE-2026-56380/): AVideo feed/index.php Exposure of Channel Owner Email Address (medium 6.9)
- [CVE-2026-5638](https://insights.sbomify.com/CVE-2026-5638/): HerikLyma CPPWebFramework path traversal (medium 6.9)
- [CVE-2026-56379](https://insights.sbomify.com/CVE-2026-56379/): ImageMagick - Command Injection via SVG Decoder (critical 9.2)
- [CVE-2026-56378](https://insights.sbomify.com/CVE-2026-56378/): ImageMagick - Heap Out-of-Bounds Read in PCD Decoder (medium 6.3)
- [CVE-2026-56377](https://insights.sbomify.com/CVE-2026-56377/): ImageMagick - Policy Bypass via Incorrect Path Validation (medium 4.8)
- [CVE-2026-56376](https://insights.sbomify.com/CVE-2026-56376/): ImageMagick - Heap Use-After-Free in Meta Coder (medium 6.3)
- [CVE-2026-56375](https://insights.sbomify.com/CVE-2026-56375/): ImageMagick - Memory Leak in ASHLAR Coder Action Failure (medium 4.8)
- [CVE-2026-56374](https://insights.sbomify.com/CVE-2026-56374/): ImageMagick - Heap Buffer Overflow in FTXT Encoder via format Parameter (medium 4.8)
- [CVE-2026-56373](https://insights.sbomify.com/CVE-2026-56373/): ImageMagick - Use-After-Free Write in PDB Decoder (medium 6.3)
- [CVE-2026-56372](https://insights.sbomify.com/CVE-2026-56372/): ImageMagick - Heap Buffer Overflow Read via Unrecognized Magnify Method (medium 4.8)
- [CVE-2026-56371](https://insights.sbomify.com/CVE-2026-56371/): ImageMagick - Memory Leak in TXT File Processing via Texture Attribute (medium 6.9)
- [CVE-2026-56370](https://insights.sbomify.com/CVE-2026-56370/): ImageMagick - Out-of-bounds Access in ConnectedComponentsImage via connected-components Artifact (medium 4.8)
- [CVE-2026-5637](https://insights.sbomify.com/CVE-2026-5637/): projectworlds Car Rental System Parameter message_admin.php sql injection (medium 6.9)
- [CVE-2026-56369](https://insights.sbomify.com/CVE-2026-56369/): ImageMagick - Information Disclosure via AES-CTR Nonce Reuse in PasskeyEncipherImage (medium 6.3)
- [CVE-2026-56368](https://insights.sbomify.com/CVE-2026-56368/): ImageMagick - Memory Leak in Raw Pixel Data Coders (medium 6.3)
- [CVE-2026-56367](https://insights.sbomify.com/CVE-2026-56367/): ImageMagick - Heap Out-of-Bounds Read in PSB RLE Decoding (medium 6.3)
- [CVE-2026-56366](https://insights.sbomify.com/CVE-2026-56366/): ImageMagick - Memory Leak in META Reader APP1JPEG Error Path (medium 4.8)
- [CVE-2026-56365](https://insights.sbomify.com/CVE-2026-56365/): ImageMagick - Memory Leak in PNG Encoder via MNG Image Writing (medium 6.3)
- [CVE-2026-56364](https://insights.sbomify.com/CVE-2026-56364/): ImageMagick - Memory Leak in LoadOpenCLDeviceBenchmark() via Malformed XML (low 1.8)
- [CVE-2026-56363](https://insights.sbomify.com/CVE-2026-56363/): ImageMagick - Division by Zero in Binomial Kernel Processing (medium 4.8)
- [CVE-2026-56362](https://insights.sbomify.com/CVE-2026-56362/): ImageMagick - Heap-buffer-overflow Read in GetPixelIndex via OpenPixelCache Metadata Desynchronization (low 2.1)
- [CVE-2026-56361](https://insights.sbomify.com/CVE-2026-56361/): ImageMagick - Heap Buffer Overflow via Off-by-One in Morphology Processing (medium 4.8)
- [CVE-2026-56360](https://insights.sbomify.com/CVE-2026-56360/): n8n - Webhook Forgery via Unsigned POST Requests in ZendeskTrigger (medium 6.3)
- [CVE-2026-5636](https://insights.sbomify.com/CVE-2026-5636/): PHPGurukul Online Shopping Portal Project Parameter cancelorder.php sql injection (medium 5.3)
- [CVE-2026-56359](https://insights.sbomify.com/CVE-2026-56359/): n8n - Cross-Site Scripting in Credential Management OAuth2 Authorization URL (medium 4.8)
- [CVE-2026-56358](https://insights.sbomify.com/CVE-2026-56358/): n8n - Stored Cross-Site Scripting in Form Trigger Node (medium 5.1)
- [CVE-2026-56357](https://insights.sbomify.com/CVE-2026-56357/): n8n - Webhook Forgery via Missing HMAC-SHA256 Signature Verification in GitHub Webhook Trigger (medium 6.3)
- [CVE-2026-56356](https://insights.sbomify.com/CVE-2026-56356/): n8n - Stored Cross-Site Scripting in Chat Trigger Node Custom CSS Field (medium 5.1)
- [CVE-2026-56355](https://insights.sbomify.com/CVE-2026-56355/): Auth bypass in Savane (low 3.7)
- [CVE-2026-56354](https://insights.sbomify.com/CVE-2026-56354/): n8n - Cross-Site Scripting and Open Redirect in Form Node (medium 5.1)
- [CVE-2026-56353](https://insights.sbomify.com/CVE-2026-56353/): n8n - Authentication Bypass in Chat Trigger Node (medium 6.3)
- [CVE-2026-56352](https://insights.sbomify.com/CVE-2026-56352/): n8n - Arbitrary File Read and Execution via ExecuteWorkflow localFile Parameter (medium 5.3)
- [CVE-2026-56351](https://insights.sbomify.com/CVE-2026-56351/): n8n - SQL Injection in MySQL, PostgreSQL, and Microsoft SQL Nodes (medium 5.3)
- [CVE-2026-56350](https://insights.sbomify.com/CVE-2026-56350/): n8n - SSO Enforcement Bypass via API (medium 6.0)
- [CVE-2026-5635](https://insights.sbomify.com/CVE-2026-5635/): PHPGurukul Online Shopping Portal Project Parameter categorywise-products.php sql injection (medium 5.3)
- [CVE-2026-56349](https://insights.sbomify.com/CVE-2026-56349/): n8n - Guardrail Node Bypass via Crafted Input (medium 6.3)
- [CVE-2026-56348](https://insights.sbomify.com/CVE-2026-56348/): n8n - Credential Exfiltration via Allowed HTTP Request Domains Bypass in Dynamic Node Parameters Endpoint (medium 5.3)
- [CVE-2026-56347](https://insights.sbomify.com/CVE-2026-56347/): AVideo TopMenu Plugin - Stored Cross-Site Scripting via Unescaped Menu Item Fields (medium 5.3)
- [CVE-2026-56346](https://insights.sbomify.com/CVE-2026-56346/): AVideo - Unauthenticated PGP Message Decryption via decryptMessage.json.php Endpoint (medium 6.9)
- [CVE-2026-56345](https://insights.sbomify.com/CVE-2026-56345/): AVideo - Arbitrary User Session Hijacking via Meet Plugin uploadRecordedVideo Endpoint (critical 9.2)
- [CVE-2026-56342](https://insights.sbomify.com/CVE-2026-56342/): AVideo - Server-Side Request Forgery in Live/test.php via statsURL Parameter (medium 6.1)
- [CVE-2026-56341](https://insights.sbomify.com/CVE-2026-56341/): AVideo - Unauthenticated Access to Payment Log DataTables Endpoints via list.json.php (high 8.7)
- [CVE-2026-56340](https://insights.sbomify.com/CVE-2026-56340/): vLLM - Denial of Service via Unvalidated Multimodal Embeddings (high 8.7)
- [CVE-2026-5634](https://insights.sbomify.com/CVE-2026-5634/): projectworlds Car Rental Project Parameter book_car.php sql injection (medium 6.9)
- [CVE-2026-56339](https://insights.sbomify.com/CVE-2026-56339/): Capgo - Unauthenticated Organization Existence Enumeration via rescind_invitation RPC (high 8.7)
- [CVE-2026-56338](https://insights.sbomify.com/CVE-2026-56338/): Capgo - Denial of Service in 2FA Email Verification via /auth/v1/otp Endpoint (medium 6.9)
- [CVE-2026-56337](https://insights.sbomify.com/CVE-2026-56337/): Capgo - Information Disclosure via Unauthenticated RPC Function exist_app_v2 (medium 6.9)
- [CVE-2026-56336](https://insights.sbomify.com/CVE-2026-56336/): Capgo - Information Disclosure via Unauthenticated SSO check-domain Endpoint (medium 6.9)
- [CVE-2026-56335](https://insights.sbomify.com/CVE-2026-56335/): Capgo - Channel Configuration Mutation via Write-Scoped API Keys (high 7.1)
- [CVE-2026-56334](https://insights.sbomify.com/CVE-2026-56334/): Capgo - Missing UPDATE RLS Policy for Build Status Persistence (medium 5.3)
- [CVE-2026-56333](https://insights.sbomify.com/CVE-2026-56333/): Capgo - Server-Side Validation Bypass via Direct Browser-Side Organization Security Settings Updates (medium 5.3)
- [CVE-2026-56332](https://insights.sbomify.com/CVE-2026-56332/): Capgo - Open Redirect via confirmation_url Parameter (medium 5.1)
- [CVE-2026-56331](https://insights.sbomify.com/CVE-2026-56331/): Capgo - Improper Error Handling in Accept Invitation Endpoint via Invalid Magic String (medium 6.9)
- [CVE-2026-56330](https://insights.sbomify.com/CVE-2026-56330/): Capgo - Open Redirect via Unvalidated Stripe Billing URLs (medium 4.8)
- [CVE-2026-5633](https://insights.sbomify.com/CVE-2026-5633/): assafelovic gpt-researcher ws Endpoint server-side request forgery (medium 6.9)
- [CVE-2026-56329](https://insights.sbomify.com/CVE-2026-56329/): Capgo - Cross-Tenant Preview Namespace Collision via Non-Bijective Underscore Decoding (medium 5.3)
- [CVE-2026-56328](https://insights.sbomify.com/CVE-2026-56328/): Capgo - Integrity Issue in Release Routing via Multiple Public Channels (high 7.1)
- [CVE-2026-56327](https://insights.sbomify.com/CVE-2026-56327/): Capgo - Unauthenticated Organization Existence Oracle via public.invite_user_to_org RPC (medium 6.9)
- [CVE-2026-56326](https://insights.sbomify.com/CVE-2026-56326/): Nuxt - Server-Side Open Redirect via Path-Normalization Bypass in navigateTo (medium 5.3)
- [CVE-2026-56325](https://insights.sbomify.com/CVE-2026-56325/): Capgo - App ID Confusion via ILIKE Wildcard in Preview Subdomain Lookup (low 2.3)
- [CVE-2026-56324](https://insights.sbomify.com/CVE-2026-56324/): Capgo - Rate Limit Bypass via User-Controlled device_id Parameter (high 8.8)
- [CVE-2026-56323](https://insights.sbomify.com/CVE-2026-56323/): Capgo - Unauthenticated Channel Enumeration and App Oracle via GET /channel_self (high 8.7)
- [CVE-2026-56322](https://insights.sbomify.com/CVE-2026-56322/): Capgo - Information Disclosure via Unauthenticated /updates defaultChannel Parameter (high 8.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/534/