# Vulnerabilities published in 2026


- [CVE-2026-56321](https://insights.sbomify.com/CVE-2026-56321/): Capgo - Missing Authentication Middleware on GET /private/role_bindings Endpoint (medium 6.9)
- [CVE-2026-56320](https://insights.sbomify.com/CVE-2026-56320/): Capgo - Org/App Scope Mismatch in Device Creation Endpoint (high 7.1)
- [CVE-2026-5632](https://insights.sbomify.com/CVE-2026-5632/): assafelovic gpt-researcher HTTP REST API Endpoint missing authentication (medium 6.9)
- [CVE-2026-56319](https://insights.sbomify.com/CVE-2026-56319/): Capgo - App Existence Oracle via GET /statistics/app/:app_id (medium 5.3)
- [CVE-2026-56318](https://insights.sbomify.com/CVE-2026-56318/): Capgo - Information Disclosure via /private/validate_password_compliance Endpoint (medium 6.9)
- [CVE-2026-56317](https://insights.sbomify.com/CVE-2026-56317/): Nuxt - Cross-Site Scripting via NoScript Component Slot Content (low 2.3)
- [CVE-2026-56316](https://insights.sbomify.com/CVE-2026-56316/): Cap-go - Job Existence Oracle via Unauthenticated OPTIONS /build/upload/:jobId/* (medium 6.9)
- [CVE-2026-56315](https://insights.sbomify.com/CVE-2026-56315/): picklescan - Remote Code Execution via Unblocked Standard Library Modules (critical 9.3)
- [CVE-2026-56314](https://insights.sbomify.com/CVE-2026-56314/): Capgo - Deleted Bundle Selection via Missing Deletion Filter in /updates Endpoint (high 7.1)
- [CVE-2026-56313](https://insights.sbomify.com/CVE-2026-56313/): Capgo - Cross-Organization Account Disruption via SSO Prelink Endpoint (high 7.2)
- [CVE-2026-56312](https://insights.sbomify.com/CVE-2026-56312/): Capgo - Account Creation Before CAPTCHA Validation in accept_invitation Endpoint (medium 6.9)
- [CVE-2026-56311](https://insights.sbomify.com/CVE-2026-56311/): Capgo - Unauthenticated Cross-Tenant Disclosure via get_current_plan_max_org RPC (medium 6.9)
- [CVE-2026-56310](https://insights.sbomify.com/CVE-2026-56310/): Cap-go - Authorization Bypass in Organization Members Endpoint via API Key Scope Bypass (medium 5.3)
- [CVE-2026-5631](https://insights.sbomify.com/CVE-2026-5631/): assafelovic gpt-researcher ws Endpoint server_utils.py extract_command_data code injection (medium 6.9)
- [CVE-2026-56309](https://insights.sbomify.com/CVE-2026-56309/): Capgo - Plan Bypass via Unrestricted Attachment Upload Endpoint (medium 5.3)
- [CVE-2026-56308](https://insights.sbomify.com/CVE-2026-56308/): Capgo - Insufficient Authentication in Email Change Endpoint (high 8.4)
- [CVE-2026-56307](https://insights.sbomify.com/CVE-2026-56307/): Cap-go - Broken Cursor Pagination in /private/devices Endpoint (medium 5.3)
- [CVE-2026-56306](https://insights.sbomify.com/CVE-2026-56306/): Capgo - Subkey Enforcement Bypass via x-limited-key-id Header Parsing (medium 5.3)
- [CVE-2026-56305](https://insights.sbomify.com/CVE-2026-56305/): Capgo - Authentication Bypass in Password Change via Missing Current Password Validation (high 8.7)
- [CVE-2026-56304](https://insights.sbomify.com/CVE-2026-56304/): picklescan - Arbitrary File Creation via logging.FileHandler Deserialization (medium 6.9)
- [CVE-2026-56303](https://insights.sbomify.com/CVE-2026-56303/): Capgo - Unauthenticated API Key Metadata Disclosure via SECURITY DEFINER RPC Function (high 8.7)
- [CVE-2026-56302](https://insights.sbomify.com/CVE-2026-56302/): Capgo - Unsecured Supabase Images Bucket via Missing Row Level Security (medium 6.9)
- [CVE-2026-56301](https://insights.sbomify.com/CVE-2026-56301/): Nuxt - Arbitrary File Read via World-Connectable vite-node IPC Socket on Linux (medium 6.8)
- [CVE-2026-56300](https://insights.sbomify.com/CVE-2026-56300/): Capgo - Unauthenticated API Key Validity and Permission Oracle via RPC Functions (high 8.7)
- [CVE-2026-5630](https://insights.sbomify.com/CVE-2026-5630/): assafelovic gpt-researcher Report API app.py cross site scripting (medium 5.3)
- [CVE-2026-56299](https://insights.sbomify.com/CVE-2026-56299/): Capgo - Denial of Service via Unauthenticated OPTIONS Request to /build/upload Endpoint (medium 6.9)
- [CVE-2026-56298](https://insights.sbomify.com/CVE-2026-56298/): Capgo - EXIF Metadata Exposure in App Information Image Upload (medium 5.3)
- [CVE-2026-56297](https://insights.sbomify.com/CVE-2026-56297/): FreeRDP - Use-After-Free via Race Condition in DRDYNVC Channel Callback (high 8.3)
- [CVE-2026-56296](https://insights.sbomify.com/CVE-2026-56296/): Cap-go - App Existence Oracle via Unauthenticated transfer_app RPC (medium 6.9)
- [CVE-2026-56295](https://insights.sbomify.com/CVE-2026-56295/): Capgo - Policy Enforcement Bypass in Webhook Management Endpoints via Non-Expiring API Keys (medium 5.3)
- [CVE-2026-56294](https://insights.sbomify.com/CVE-2026-56294/): capacitor-native-biometric - Authentication Bypass via Unvalidated CryptoObject in onAuthenticationSucceeded (medium 4.3)
- [CVE-2026-56293](https://insights.sbomify.com/CVE-2026-56293/): Capgo - Stale Cross-Organization Authorization via Incomplete deploy_history Update in transfer_app() (medium 5.3)
- [CVE-2026-56292](https://insights.sbomify.com/CVE-2026-56292/): Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1 (critical 9.2)
- [CVE-2026-56291](https://insights.sbomify.com/CVE-2026-56291/): Balbooa Forms Unrestricted Upload of File with Dangerous Type (critical 10.0, exploited in the wild)
- [CVE-2026-56290](https://insights.sbomify.com/CVE-2026-56290/): Joomlack Page Builder Improper Access Control (critical 10.0, exploited in the wild)
- [CVE-2026-5629](https://insights.sbomify.com/CVE-2026-5629/): Belkin F9K1015 formSetFirewall stack-based overflow (high 8.7)
- [CVE-2026-56289](https://insights.sbomify.com/CVE-2026-56289/): Loop with Unreachable Exit Condition in GNU patch (medium 4.6)
- [CVE-2026-56288](https://insights.sbomify.com/CVE-2026-56288/): NULL Pointer Dereference in GNU patch (medium 4.6)
- [CVE-2026-56287](https://insights.sbomify.com/CVE-2026-56287/): Apache Fineract: Boolean SQL Injection in Client Search API (orderBy parameter) leading to Local File Disclosure (high 8.1)
- [CVE-2026-56286](https://insights.sbomify.com/CVE-2026-56286/): Capgo - Account Deletion Without Password Confirmation (high 7.0)
- [CVE-2026-56285](https://insights.sbomify.com/CVE-2026-56285/): Nitter - Server-Side Request Forgery in /video Media Proxy Endpoint (high 7.7)
- [CVE-2026-56284](https://insights.sbomify.com/CVE-2026-56284/): Capgo - Unauthenticated Metrics Disclosure via get_total_metrics RPC (medium 6.9)
- [CVE-2026-56283](https://insights.sbomify.com/CVE-2026-56283/): Capgo - HTML Injection Leading to Open Redirection in Organization Settings (medium 4.8)
- [CVE-2026-56282](https://insights.sbomify.com/CVE-2026-56282/): Capgo - Information Disclosure via Unauthenticated /replication Endpoint (medium 6.9)
- [CVE-2026-56281](https://insights.sbomify.com/CVE-2026-56281/): Capgo - SQL Injection via Unvalidated limit Parameter in Admin Stats Endpoint (medium 5.1)
- [CVE-2026-56280](https://insights.sbomify.com/CVE-2026-56280/): Cap-go - Privilege Inversion in Build Log Stream via SSE Disconnect (high 7.1)
- [CVE-2026-5628](https://insights.sbomify.com/CVE-2026-5628/): Belkin F9K1015 Setting formSetSystemSettings stack-based overflow (high 8.7)
- [CVE-2026-56279](https://insights.sbomify.com/CVE-2026-56279/): Capgo - Information Disclosure via get_orgs_v7 RPC Endpoint (high 8.7)
- [CVE-2026-56278](https://insights.sbomify.com/CVE-2026-56278/): Flowise - Session Hijacking via Weak Default Express Session Secret (critical 9.3)
- [CVE-2026-56277](https://insights.sbomify.com/CVE-2026-56277/): Flowise - Hardcoded CORS Wildcard in TTS Endpoint (medium 6.9)
- [CVE-2026-56276](https://insights.sbomify.com/CVE-2026-56276/): Flowise - Mass Assignment in PUT /api/v1/user Allows Password Hash Override (medium 6.0)
- [CVE-2026-56275](https://insights.sbomify.com/CVE-2026-56275/): Flowise - Server-Side Request Forgery via Execute Flow Base URL (medium 6.0)
- [CVE-2026-56274](https://insights.sbomify.com/CVE-2026-56274/): Flowise - Remote Code Execution via MCP Security Bypass in validateCommandFlags and validateArgsForLocalFileAccess (high 8.7)
- [CVE-2026-56273](https://insights.sbomify.com/CVE-2026-56273/): Flowise - Path Traversal in Vector Store basePath Parameter (medium 4.9)
- [CVE-2026-56272](https://insights.sbomify.com/CVE-2026-56272/): Flowise - Insufficient Password Salt Rounds in Bcrypt Hashing (medium 5.6)
- [CVE-2026-56271](https://insights.sbomify.com/CVE-2026-56271/): Flowise - Weak Default JWT Secrets in Authentication Middleware (critical 9.3)
- [CVE-2026-56270](https://insights.sbomify.com/CVE-2026-56270/): Flowise - Unauthenticated OAuth Secrets Disclosure via /api/v1/loginmethod Endpoint (high 8.7)
- [CVE-2026-5627](https://insights.sbomify.com/CVE-2026-5627/): Path Traversal in mintplex-labs/anything-llm (critical 9.1)
- [CVE-2026-56269](https://insights.sbomify.com/CVE-2026-56269/): Flowise - Weak Default Token Hash Secret in JWT Token Encryption (medium 4.3)
- [CVE-2026-56268](https://insights.sbomify.com/CVE-2026-56268/): Flowise - Cross-Workspace Information Disclosure via chatflows/apikey Endpoint (medium 5.3)
- [CVE-2026-56267](https://insights.sbomify.com/CVE-2026-56267/): Flowise - PII Disclosure via Unauthenticated Forgot Password Endpoint (medium 6.9)
- [CVE-2026-56266](https://insights.sbomify.com/CVE-2026-56266/): Crawl4AI - Server-Side Request Forgery via Direct Crawl Endpoints (critical 9.2)
- [CVE-2026-56265](https://insights.sbomify.com/CVE-2026-56265/): Crawl4AI - Authentication Bypass via Hardcoded JWT Signing Key (critical 9.3)
- [CVE-2026-56264](https://insights.sbomify.com/CVE-2026-56264/): Crawl4AI - Arbitrary JavaScript Execution via /execute_js Endpoint (critical 9.2)
- [CVE-2026-56263](https://insights.sbomify.com/CVE-2026-56263/): Crawl4AI - Stored Cross-Site Scripting in Monitor Dashboard (medium 5.3)
- [CVE-2026-56262](https://insights.sbomify.com/CVE-2026-56262/): Crawl4AI - Unauthenticated Access to Monitor Endpoints via Docker API Server (medium 6.9)
- [CVE-2026-56261](https://insights.sbomify.com/CVE-2026-56261/): Crawl4AI - Server-Side Request Forgery via Webhook URLs (critical 9.2)
- [CVE-2026-56260](https://insights.sbomify.com/CVE-2026-56260/): Crawl4AI - Arbitrary File Write via output_path Parameter (high 8.8)
- [CVE-2026-5626](https://insights.sbomify.com/CVE-2026-5626/): Survey Form Block <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Survey Submission Data Export (medium 4.3)
- [CVE-2026-56259](https://insights.sbomify.com/CVE-2026-56259/): Crawl4AI - LLM Credential Exfiltration via base_url and Environment Variable Resolution (high 8.8)
- [CVE-2026-56258](https://insights.sbomify.com/CVE-2026-56258/): Crawl4AI - Arbitrary File Write via output_path Symlink and TOCTOU (critical 9.2)
- [CVE-2026-56257](https://insights.sbomify.com/CVE-2026-56257/): Capgo - Authorization Bypass in App Ownership Transfer via Direct PostgREST Update (high 7.1)
- [CVE-2026-56256](https://insights.sbomify.com/CVE-2026-56256/): Capgo - Two-Factor Authentication Bypass via Organization Management API (high 7.1)
- [CVE-2026-56255](https://insights.sbomify.com/CVE-2026-56255/): Capgo - Denial of Service via Unlimited Demo App Creation (medium 5.3)
- [CVE-2026-56254](https://insights.sbomify.com/CVE-2026-56254/): capacitor-updater - End-to-End Encryption Bypass via Private Key Distribution (high 8.3)
- [CVE-2026-56253](https://insights.sbomify.com/CVE-2026-56253/): Capgo - Unauthenticated Organization Member Email Disclosure via get_org_members RPC (high 8.7)
- [CVE-2026-56252](https://insights.sbomify.com/CVE-2026-56252/): Capgo - Scope Isolation Failure in Webhook Test Endpoint (medium 5.3)
- [CVE-2026-56251](https://insights.sbomify.com/CVE-2026-56251/): Capgo - Privilege Escalation via Broken Row Level Security in org_users (high 7.0)
- [CVE-2026-56250](https://insights.sbomify.com/CVE-2026-56250/): Capgo - Arbitrary R2 Object Deletion via Mutable r2_path in app_versions (high 8.7)
- [CVE-2026-5625](https://insights.sbomify.com/CVE-2026-5625/): assafelovic gpt-researcher WebSocket researcher.py cross site scripting (medium 5.3)
- [CVE-2026-56249](https://insights.sbomify.com/CVE-2026-56249/): Capgo - Unauthorized Channel Overwrite and Ownership Takeover via POST /channel Name Collision (high 7.2)
- [CVE-2026-56248](https://insights.sbomify.com/CVE-2026-56248/): Capgo - Unauthenticated Denial-of-Service via audit_logs RLS Policy (high 8.7)
- [CVE-2026-56247](https://insights.sbomify.com/CVE-2026-56247/): Capgo - Privilege Escalation via Cross-Scope RBAC Role Assignment (high 8.7)
- [CVE-2026-56246](https://insights.sbomify.com/CVE-2026-56246/): Capgo - Cross-Organization Authorization Bypass via Scoped API Key Privilege Inheritance (high 7.2)
- [CVE-2026-56245](https://insights.sbomify.com/CVE-2026-56245/): Supabase Capgo - Unauthenticated Cross-Tenant Build-Time Accounting Poisoning via record_build_time RPC (high 8.8)
- [CVE-2026-56244](https://insights.sbomify.com/CVE-2026-56244/): Capgo - Webhook Signing Secret Disclosure via Non-Admin API Key (high 7.1)
- [CVE-2026-56243](https://insights.sbomify.com/CVE-2026-56243/): Capgo - Hashed API Key Enforcement Bypass via PostgREST/RLS Plane (high 8.6)
- [CVE-2026-56242](https://insights.sbomify.com/CVE-2026-56242/): Capgo - Unauthenticated API Key Validity Oracle and User Identity Disclosure via get_identity_apikey_only RPC (high 8.7)
- [CVE-2026-56241](https://insights.sbomify.com/CVE-2026-56241/): Capgo - RBAC Demotion Privilege Retention via Stale org_users.user_right (high 7.2)
- [CVE-2026-56240](https://insights.sbomify.com/CVE-2026-56240/): Capgo - Billing Authorization Bypass via Exhausted Usage Credits (medium 5.3)
- [CVE-2026-5624](https://insights.sbomify.com/CVE-2026-5624/): ProjectSend upload.php cross-site request forgery (medium 5.3)
- [CVE-2026-56239](https://insights.sbomify.com/CVE-2026-56239/): Capgo - Privilege Escalation via SECURITY DEFINER Function apply_usage_overage (high 7.2)
- [CVE-2026-56238](https://insights.sbomify.com/CVE-2026-56238/): Capgo - Unauthenticated Information Disclosure via PostgREST global_stats Endpoint (high 8.7)
- [CVE-2026-56237](https://insights.sbomify.com/CVE-2026-56237/): Capgo - Unauthenticated API Key Generation via Client-Side Parameter Manipulation (critical 9.3)
- [CVE-2026-56236](https://insights.sbomify.com/CVE-2026-56236/): Capgo CLI - Arbitrary File Overwrite via Symlink-Following in Local Credential Operations (medium 6.8)
- [CVE-2026-56235](https://insights.sbomify.com/CVE-2026-56235/): Capgo - Unauthenticated Cross-Tenant Metrics Disclosure via RPC Functions (medium 6.9)
- [CVE-2026-56234](https://insights.sbomify.com/CVE-2026-56234/): Capgo - Password Spraying via Public-Key Accessible Credential Validation Endpoint (medium 6.9)
- [CVE-2026-56233](https://insights.sbomify.com/CVE-2026-56233/): Capgo - SSRF and Privilege Escalation via Path Traversal in Builder Upload Proxy (high 8.7)
- [CVE-2026-56232](https://insights.sbomify.com/CVE-2026-56232/): Capgo - Subkey Scope Bypass in middlewareKey via x-limited-key-id Header (high 8.7)
- [CVE-2026-56231](https://insights.sbomify.com/CVE-2026-56231/): Capgo - Broken Object Level Authorization in Build Job Control via jobId Parameter (high 7.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/535/