# Vulnerabilities published in 2026


- [CVE-2026-5588](https://insights.sbomify.com/CVE-2026-5588/): PKIX draft CompositeVerifier accepts empty signature sequence as valid. (medium 6.3)
- [CVE-2026-55879](https://insights.sbomify.com/CVE-2026-55879/): OpenReplay: Unauthenticated stored XSS leads to dashboard account takeover (critical 9.3)
- [CVE-2026-55878](https://insights.sbomify.com/CVE-2026-55878/): Symfony: Path Traversal in symfony/ux-toolkit Allows Arbitrary File Write and Read via Crafted Recipe Manifest (high 7.8)
- [CVE-2026-55877](https://insights.sbomify.com/CVE-2026-55877/): Symfony UX: XSS in symfony/ux-icons via unsanitized SVG content in local files and Iconify on-demand responses (medium 6.1)
- [CVE-2026-55876](https://insights.sbomify.com/CVE-2026-55876/): Helium: Stored XSS via Unrestricted SVG File Upload — Authenticated Users Can Store Executable Scripts (low 3.5)
- [CVE-2026-55875](https://insights.sbomify.com/CVE-2026-55875/): Helium: SSRF via External Calendar URL Allows Authenticated Users to Probe Internal Network (medium 4.3)
- [CVE-2026-55874](https://insights.sbomify.com/CVE-2026-55874/): SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read (high 7.7)
- [CVE-2026-55873](https://insights.sbomify.com/CVE-2026-55873/): SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned table buckets (medium 4.3)
- [CVE-2026-55872](https://insights.sbomify.com/CVE-2026-55872/): GYM One admin user list is vulnerable to stored cross-site scripting (high 8.7)
- [CVE-2026-55871](https://insights.sbomify.com/CVE-2026-55871/): GYM One: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in admin/users/index.php (medium 6.5)
- [CVE-2026-55870](https://insights.sbomify.com/CVE-2026-55870/): GoCD is vulnerable to credential exposure when admins insecurely configure material URLs (low 2.3)
- [CVE-2026-5587](https://insights.sbomify.com/CVE-2026-5587/): wbbeyourself MAC-SQL Refiner Agent agents.py _execute_sql sql injection (medium 5.3)
- [CVE-2026-55867](https://insights.sbomify.com/CVE-2026-55867/): Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens (medium 5.3)
- [CVE-2026-55866](https://insights.sbomify.com/CVE-2026-55866/): SpiceDB: Checks involving relations with caveats can result in unconditional permission when conditional permission is expected (low 3.7)
- [CVE-2026-55865](https://insights.sbomify.com/CVE-2026-55865/): Python Liquid: Infinite loop when parsing malformed `{% case %}` tags (high 7.1)
- [CVE-2026-55864](https://insights.sbomify.com/CVE-2026-55864/): GeoNetwork: Unauthenticaded Server-Side Request Forgery in SLD Tool (high 7.8)
- [CVE-2026-55863](https://insights.sbomify.com/CVE-2026-55863/): motionEye: Missing authentication on ActionHandler allows unauthenticated camera action execution (medium 5.3)
- [CVE-2026-55862](https://insights.sbomify.com/CVE-2026-55862/): pupnp: Incomplete fix for CVE-2021-28302: recursive DOM functions cause stack overflow (medium 6.5)
- [CVE-2026-55860](https://insights.sbomify.com/CVE-2026-55860/): org.mariadb:r2dbc-mariadb vulnerable to cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport) (medium 5.9)
- [CVE-2026-5586](https://insights.sbomify.com/CVE-2026-5586/): zhongyu09 openchatbi Multi-stage Text2SQL Workflow sql injection (medium 5.3)
- [CVE-2026-55859](https://insights.sbomify.com/CVE-2026-55859/): org.mariadb:r2dbc-mariadb has Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Output (medium 5.9)
- [CVE-2026-55858](https://insights.sbomify.com/CVE-2026-55858/): MariaDB Connector/J: Inappropriate Encoding for Output Context in org.mariadb.jdbc:mariadb-java-client (medium 5.9)
- [CVE-2026-55857](https://insights.sbomify.com/CVE-2026-55857/): MariaDB Connector/J: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials (medium 5.9)
- [CVE-2026-55856](https://insights.sbomify.com/CVE-2026-55856/): MariaDB Connector/J: Cleartext password disclosure to a MITM on the initial-handshake (medium 5.9)
- [CVE-2026-55855](https://insights.sbomify.com/CVE-2026-55855/): MariaDB has possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsets (medium 6.5)
- [CVE-2026-55854](https://insights.sbomify.com/CVE-2026-55854/): MariaDB has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials (medium 5.9)
- [CVE-2026-55852](https://insights.sbomify.com/CVE-2026-55852/): Frappe: TarSlip RCE in Package Import (high 8.6)
- [CVE-2026-55851](https://insights.sbomify.com/CVE-2026-55851/): Netty codec-haproxy: Signed-Byte Sentinel Collision in HAProxyMessageDecoder Leads to Unbounded Memory Exhaustion (high 8.7)
- [CVE-2026-55850](https://insights.sbomify.com/CVE-2026-55850/): Element Web: A malicious homeserver can inject HTML in Element Web using its homepage (medium 5.3)
- [CVE-2026-5585](https://insights.sbomify.com/CVE-2026-5585/): Tencent AI-Infra-Guard Task Detail Endpoint task_manager.go information disclosure (medium 6.9)
- [CVE-2026-55849](https://insights.sbomify.com/CVE-2026-55849/): @cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized `--workspace` Argument (high 8.5)
- [CVE-2026-55848](https://insights.sbomify.com/CVE-2026-55848/): mapfish-print: XXE on MapFish Print allows reading arbitrary files of certain types (high 8.6)
- [CVE-2026-55847](https://insights.sbomify.com/CVE-2026-55847/): Allure: Stored XSS via unescaped ANSI helper in Allure report status message/trace rendering (medium 6.1)
- [CVE-2026-55846](https://insights.sbomify.com/CVE-2026-55846/): Allure: Path Traversal in Allure Report HTTP Server Allows Arbitrary File Read (medium 6.2)
- [CVE-2026-55844](https://insights.sbomify.com/CVE-2026-55844/): Information disclosure in core (high 7.5)
- [CVE-2026-55843](https://insights.sbomify.com/CVE-2026-55843/): Snipe-IT: Improper Privilege Management (high 7.0)
- [CVE-2026-55842](https://insights.sbomify.com/CVE-2026-55842/): Scoold: CORS wildcard origin with credentials enabled allows cross-origin authenticated API access from any domain (medium 5.4)
- [CVE-2026-55841](https://insights.sbomify.com/CVE-2026-55841/): Graylog: Fortigate syslog message parser can be exploited to modify or delete fields from the original message (high 7.5)
- [CVE-2026-55840](https://insights.sbomify.com/CVE-2026-55840/): Scoold: Open Redirect in getBackToUrl() allows phishing via domain-prefix startsWith bypass (medium 5.4)
- [CVE-2026-5584](https://insights.sbomify.com/CVE-2026-5584/): Fosowl agenticSeek query Endpoint PyInterpreter.py PyInterpreter.execute code injection (medium 6.9)
- [CVE-2026-55839](https://insights.sbomify.com/CVE-2026-55839/): Kestra: Stored XSS via custom Markdown [[link]] attribute injection (high 8.7)
- [CVE-2026-55838](https://insights.sbomify.com/CVE-2026-55838/): RustFS: Missing admin authorization on /rustfs/admin/v3/metrics allows any authenticated user to read server metrics (medium 4.3)
- [CVE-2026-55837](https://insights.sbomify.com/CVE-2026-55837/): dbt-mcp: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens (medium 6.8)
- [CVE-2026-55836](https://insights.sbomify.com/CVE-2026-55836/): Open Zaak: Path traversal / arbitrary server-file read via Documenten API document import (bestandspad) (medium 6.8)
- [CVE-2026-55835](https://insights.sbomify.com/CVE-2026-55835/): Lookyloo: Potential sub-system DoS due to parameter missmatch in notification (medium 6.9)
- [CVE-2026-55834](https://insights.sbomify.com/CVE-2026-55834/): Pocket ID: Open Redirect on the OIDC /authorize page via unvalidated redirect_uri with prompt=none (medium 4.3)
- [CVE-2026-55833](https://insights.sbomify.com/CVE-2026-55833/): Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation (high 7.5)
- [CVE-2026-55832](https://insights.sbomify.com/CVE-2026-55832/): Tract: Arbitrary file read via unsanitized ONNX external_data `location` (path traversal) on model load in tract-onnx (medium 6.1)
- [CVE-2026-55831](https://insights.sbomify.com/CVE-2026-55831/): Netty SPDY SETTINGS frame count materializes unbounded settings map (high 7.5)
- [CVE-2026-55830](https://insights.sbomify.com/CVE-2026-55830/): RestrictedPython guard hooks can be shadowed via positional-only arguments (high 8.3)
- [CVE-2026-5583](https://insights.sbomify.com/CVE-2026-5583/): PHPGurukul Online Shopping Portal Project Parameter my-profile.php sql injection (medium 5.3)
- [CVE-2026-55828](https://insights.sbomify.com/CVE-2026-55828/): qbee transport: Symlink-chain path traversal in tar extraction (one level outside destination) (medium 6.0)
- [CVE-2026-55827](https://insights.sbomify.com/CVE-2026-55827/): FreeRDP: Heap out-of-bounds write in RemoteFX (RFX) Cache Bitmap V3 decode (high 7.5)
- [CVE-2026-55826](https://insights.sbomify.com/CVE-2026-55826/): Information disclosure in gtm-server-side-wordpress-plugin (high 8.7)
- [CVE-2026-55825](https://insights.sbomify.com/CVE-2026-55825/): Contao: Possible path traversal in job download URIs (low 3.1)
- [CVE-2026-55824](https://insights.sbomify.com/CVE-2026-55824/): Contao crawler leaks auth credentials to external hosts (low 2.6)
- [CVE-2026-55823](https://insights.sbomify.com/CVE-2026-55823/): Frappe: Possibility of SQL injection in reportview (high 8.7)
- [CVE-2026-5582](https://insights.sbomify.com/CVE-2026-5582/): FuseWP <= 1.1.24.2 - Cross-Site Request Forgery to Sync Rule Status Toggle (medium 4.3)
- [CVE-2026-55814](https://insights.sbomify.com/CVE-2026-55814/): Apache Ranger: Download APIs expose plugin data without authentication (high 7.5)
- [CVE-2026-55810](https://insights.sbomify.com/CVE-2026-55810/): Plotly.js Graphing - Critical - PHP object injection - SA-CONTRIB-2026-050 (high 8.1)
- [CVE-2026-5581](https://insights.sbomify.com/CVE-2026-5581/): Multi Uploader for Gravity Forms <= 1.1.8 - Missing Authorization to Unauthenticated Arbitrary Media Deletion (critical 9.1)
- [CVE-2026-55809](https://insights.sbomify.com/CVE-2026-55809/): Flag attendance field - Critical - PHP object injection - SA-CONTRIB-2026-049 (high 8.1)
- [CVE-2026-55808](https://insights.sbomify.com/CVE-2026-55808/): Drupal core - Moderately critical - Improper validation - SA-CORE-2026-009 (medium 5.4)
- [CVE-2026-55807](https://insights.sbomify.com/CVE-2026-55807/): Drupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008 (low 3.1)
- [CVE-2026-55806](https://insights.sbomify.com/CVE-2026-55806/): Drupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-007 (medium 5.9)
- [CVE-2026-55805](https://insights.sbomify.com/CVE-2026-55805/): Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012 (medium 5.4)
- [CVE-2026-55804](https://insights.sbomify.com/CVE-2026-55804/): Drupal core - Moderately critical - Gadget chain - SA-CORE-2026-006 (medium 5.9)
- [CVE-2026-55803](https://insights.sbomify.com/CVE-2026-55803/): Drupal core - Critical - PHP object injection - SA-CORE-2026-005 (medium 5.9)
- [CVE-2026-5580](https://insights.sbomify.com/CVE-2026-5580/): CodeAstro Online Classroom Parameter addvideos.php sql injection (medium 5.3)
- [CVE-2026-55799](https://insights.sbomify.com/CVE-2026-55799/): Apache Ranger: Remote Code Execution Vulnerability in GraalScriptEngineCreator (critical 9.8)
- [CVE-2026-55798](https://insights.sbomify.com/CVE-2026-55798/): Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path (medium 4.5)
- [CVE-2026-55797](https://insights.sbomify.com/CVE-2026-55797/): Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL (high 8.8)
- [CVE-2026-55796](https://insights.sbomify.com/CVE-2026-55796/): Frappe HR: SQL Injection in HRMS Salary Payments via ECS Report (medium 6.5)
- [CVE-2026-55795](https://insights.sbomify.com/CVE-2026-55795/): Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass (medium 6.9)
- [CVE-2026-55794](https://insights.sbomify.com/CVE-2026-55794/): Craft CMS: Potential authenticated Remote Code Execution via referrer redirect (high 8.7)
- [CVE-2026-55793](https://insights.sbomify.com/CVE-2026-55793/): Craft CMS: Stored XSS via Structure entry title in table view (medium 5.9)
- [CVE-2026-55792](https://insights.sbomify.com/CVE-2026-55792/): Craft CMS: Sensitive File Disclosure / Server-Side File Read (medium 6.0)
- [CVE-2026-55791](https://insights.sbomify.com/CVE-2026-55791/): Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs (medium 6.9)
- [CVE-2026-55790](https://insights.sbomify.com/CVE-2026-55790/): Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget (high 7.4)
- [CVE-2026-5579](https://insights.sbomify.com/CVE-2026-5579/): CodeAstro Online Classroom Parameter updatedetailsfromfaculty.php sql injection (medium 5.3)
- [CVE-2026-55789](https://insights.sbomify.com/CVE-2026-55789/): Code injection in logto (high 8.5)
- [CVE-2026-55787](https://insights.sbomify.com/CVE-2026-55787/): Flyto2 Core: SSRF guard bypass via IPv6 transition addresses (IPv4-mapped / 6to4 / NAT64) in validate_url_ssrf (high 7.1)
- [CVE-2026-55786](https://insights.sbomify.com/CVE-2026-55786/): Flyto2 Core: Unauthenticated Command Execution via HTTP MCP `execute_module` (high 8.4)
- [CVE-2026-55785](https://insights.sbomify.com/CVE-2026-55785/): free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA (low 3.7)
- [CVE-2026-55784](https://insights.sbomify.com/CVE-2026-55784/): free5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPI (high 7.5)
- [CVE-2026-55783](https://insights.sbomify.com/CVE-2026-55783/): Null dereference in NanaZip (low 2.4)
- [CVE-2026-55782](https://insights.sbomify.com/CVE-2026-55782/): Denial of service in NanaZip (low 2.4)
- [CVE-2026-55781](https://insights.sbomify.com/CVE-2026-55781/): NanaZip: Unbounded memory allocation (DoS) in NanaZip UFS parser via unvalidated fs_bsize/fs_fsize superblock fields (low 2.4)
- [CVE-2026-55780](https://insights.sbomify.com/CVE-2026-55780/): NanaZip: Uncaught exception / unbounded allocation in NanaZip .NET single-file Extract() via unvalidated entry Size (low 2.4)
- [CVE-2026-5578](https://insights.sbomify.com/CVE-2026-5578/): CodeAstro Online Classroom Parameter addassessment.php sql injection (medium 5.3)
- [CVE-2026-55779](https://insights.sbomify.com/CVE-2026-55779/): Silverstripe Versioned: XSS in archive admin restore (medium 5.4)
- [CVE-2026-55778](https://insights.sbomify.com/CVE-2026-55778/): Parse Server: Stored XSS via non-standard file extension bypassing file upload extension blocklist (low 2.1)
- [CVE-2026-55777](https://insights.sbomify.com/CVE-2026-55777/): GoAccess: Out-of-bounds heap read in parse_ios() via crafted User-Agent leads to remote crash/DoS (medium 5.3)
- [CVE-2026-55776](https://insights.sbomify.com/CVE-2026-55776/): OpenBao: Transit secrets engine crashes on key creation with `derived: true` for asymmetric key types (medium 6.5)
- [CVE-2026-55775](https://insights.sbomify.com/CVE-2026-55775/): OpenBao's System Backend allows Unauthorized Management of the containing Namespace (low 2.3)
- [CVE-2026-55774](https://insights.sbomify.com/CVE-2026-55774/): OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808 (low 2.1)
- [CVE-2026-55773](https://insights.sbomify.com/CVE-2026-55773/): CedarJava has a policy injection vulnerability (high 8.8)
- [CVE-2026-55772](https://insights.sbomify.com/CVE-2026-55772/): CedarJava has a type confusion vulnerability (high 8.8)
- [CVE-2026-55771](https://insights.sbomify.com/CVE-2026-55771/): CedarJava has policy injection, type confusion, and incorrect equality comparison vulnerabilities (high 8.8)
- [CVE-2026-55770](https://insights.sbomify.com/CVE-2026-55770/): OpenBao: LDAPi ldaputil (wrong escape func) (medium 6.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/539/