# Vulnerabilities published in 2026


- [CVE-2026-5577](https://insights.sbomify.com/CVE-2026-5577/): Song-Li cross_browser details Endpoint uniquemachine_app.py sql injection (medium 6.9)
- [CVE-2026-55769](https://insights.sbomify.com/CVE-2026-55769/): Privilege escalation in cloudnative-pg (critical 9.4)
- [CVE-2026-55768](https://insights.sbomify.com/CVE-2026-55768/): Integer overflow in goaccess (high 8.7)
- [CVE-2026-55767](https://insights.sbomify.com/CVE-2026-55767/): Guzzle: Dot-Only Cookie Domains Match All Hosts in guzzlehttp/guzzle (medium 5.8)
- [CVE-2026-55766](https://insights.sbomify.com/CVE-2026-55766/): guzzlehttp/psr7: CRLF Injection in HTTP Start-Line Serialization (medium 4.8)
- [CVE-2026-55765](https://insights.sbomify.com/CVE-2026-55765/): Information disclosure in cloudnative-pg (high 8.5)
- [CVE-2026-55764](https://insights.sbomify.com/CVE-2026-55764/): Klever-Go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupply (high 8.7)
- [CVE-2026-55763](https://insights.sbomify.com/CVE-2026-55763/): Klever-Go: Percentage-transfer royalty skips the source debit at exactly-100% splits (high 8.7)
- [CVE-2026-55762](https://insights.sbomify.com/CVE-2026-55762/): Missing authorization in Rocket.Chat (high 8.1)
- [CVE-2026-55761](https://insights.sbomify.com/CVE-2026-55761/): Portainer: Unauthenticated Restore Endpoint Allows Admin Takeover on Uninitialised Portainer Instances (high 7.1)
- [CVE-2026-55760](https://insights.sbomify.com/CVE-2026-55760/): handlebars.java FileTemplateLoader Path Traversal (high 7.5)
- [CVE-2026-5576](https://insights.sbomify.com/CVE-2026-5576/): SourceCodester/jkev Record Management System Add Employee save_emp.php unrestricted upload (medium 5.1)
- [CVE-2026-55759](https://insights.sbomify.com/CVE-2026-55759/): Rocket.Chat: Apple Sign-In skips JWT claims validation, allowing expired and cross-audience token replay (high 7.4)
- [CVE-2026-55758](https://insights.sbomify.com/CVE-2026-55758/): CC: Tweaked: Incomplete fix for GHSA-5jh9-2h63-pw4q: RFC 8215 NAT64 prefix (64:ff9b:1::/96) bypasses SSRF protection (medium 6.9)
- [CVE-2026-5575](https://insights.sbomify.com/CVE-2026-5575/): SourceCodester/jkev Record Management System Login index.php sql injection (medium 6.9)
- [CVE-2026-55748](https://insights.sbomify.com/CVE-2026-55748/): OpenStack Horizon RC file generation does not escape special characters in project names (medium 6.0)
- [CVE-2026-55747](https://insights.sbomify.com/CVE-2026-55747/): PocketFlow - Path Traversal in pocketflow-coding-agent Cookbook Example File Tools (medium 6.8)
- [CVE-2026-55746](https://insights.sbomify.com/CVE-2026-55746/): Cotonti stored XSS via PFS folder title (high 7.0)
- [CVE-2026-55745](https://insights.sbomify.com/CVE-2026-55745/): Cotonti CSRF in PFS folder edit allows unauthorized folder modification (medium 5.3)
- [CVE-2026-55744](https://insights.sbomify.com/CVE-2026-55744/): Cotonti CSRF in PFS allows forced arbitrary file upload (high 8.6)
- [CVE-2026-55743](https://insights.sbomify.com/CVE-2026-55743/): OpenHuman desktop agent shell tool sandbox bypass leads to arbitrary command execution (critical 9.4)
- [CVE-2026-55742](https://insights.sbomify.com/CVE-2026-55742/): Cotonti CSRF in admin.rights.php allows privilege escalation (critical 9.4)
- [CVE-2026-55741](https://insights.sbomify.com/CVE-2026-55741/): Cotonti CSRF in admin.config.php allows unauthorized configuration changes (high 8.7)
- [CVE-2026-55740](https://insights.sbomify.com/CVE-2026-55740/): SQL Injection in Nur-Alam39 bus-ticket bus_info.php via busid parameter (critical 9.3)
- [CVE-2026-5574](https://insights.sbomify.com/CVE-2026-5574/): Technostrobe HI-LED-WR120-G2 FsBrowseClean deletefile authorization (medium 6.9)
- [CVE-2026-55739](https://insights.sbomify.com/CVE-2026-55739/): Crater - Missing Tenant-Ownership Check in CustomerPolicy Allows Cross-Company Customer Data Theft and Deletion (high 8.2)
- [CVE-2026-55738](https://insights.sbomify.com/CVE-2026-55738/): Stack Buffer Overflow in rxi/microtar raw_to_header() via non-null-terminated TAR name field (high 8.7)
- [CVE-2026-55737](https://insights.sbomify.com/CVE-2026-55737/): Heap pointer corruption via signed/unsigned mismatch in LARGE_TUPLE_EXT decoding in erts external term format decoder (medium 5.1)
- [CVE-2026-55736](https://insights.sbomify.com/CVE-2026-55736/): Private action arguments can be set by user input in Ash (medium 5.9)
- [CVE-2026-55735](https://insights.sbomify.com/CVE-2026-55735/): Guardian.revoke/3 acts on unverified token claims, allowing forged-token session revocation (high 8.2)
- [CVE-2026-55734](https://insights.sbomify.com/CVE-2026-55734/): guardian atom exhaustion in Guardian.Permissions.encode_permissions!/1 (medium 6.9)
- [CVE-2026-55733](https://insights.sbomify.com/CVE-2026-55733/): Atom-table exhaustion denial of service in Guardian permissions AtomEncoding via unbounded atom creation (medium 6.9)
- [CVE-2026-55732](https://insights.sbomify.com/CVE-2026-55732/): Loytec LINX firmware: Out-of-bounds Read in BACnet packet parsing (bacdt_datetime_to_tod) (high 8.7)
- [CVE-2026-55731](https://insights.sbomify.com/CVE-2026-55731/): Loytec LINX firmware: Unchecked input for loop condition in the SNMP agent (medium 6.6)
- [CVE-2026-55730](https://insights.sbomify.com/CVE-2026-55730/): Loytec LWEB802: Reflected Cross-Site Scripting in LWEB802 (high 8.7)
- [CVE-2026-5573](https://insights.sbomify.com/CVE-2026-5573/): Technostrobe HI-LED-WR120-G2 fs unrestricted upload (medium 6.9)
- [CVE-2026-55729](https://insights.sbomify.com/CVE-2026-55729/): Loytec LWEB802: Exposure of Sensitive Information in browser localStorage (high 7.7)
- [CVE-2026-55728](https://insights.sbomify.com/CVE-2026-55728/): Loytec LINX firmware: Stack-based Buffer Overflow in cmd_ipaddr_conflict (low 3.8)
- [CVE-2026-55727](https://insights.sbomify.com/CVE-2026-55727/): Auth bypass in Genetec Security Center (high 7.5)
- [CVE-2026-55726](https://insights.sbomify.com/CVE-2026-55726/): Gardyn IoT Hub Exposure of Sensitive System Information to an Unauthorized Control Sphere (medium 6.9)
- [CVE-2026-55723](https://insights.sbomify.com/CVE-2026-55723/): NGINX Ingress Controller vulnerability (high 8.7)
- [CVE-2026-55721](https://insights.sbomify.com/CVE-2026-55721/): SQL Injection in StoneFly Storage Concentrator (critical 9.2)
- [CVE-2026-5572](https://insights.sbomify.com/CVE-2026-5572/): Technostrobe HI-LED-WR120-G2 cross-site request forgery (medium 5.3)
- [CVE-2026-55717](https://insights.sbomify.com/CVE-2026-55717/): 'serve-expired-client-timeout' and 'response-ip' CNAME redirect could lead to a crash (medium 5.9)
- [CVE-2026-5571](https://insights.sbomify.com/CVE-2026-5571/): Technostrobe HI-LED-WR120-G2 Configuration Data fs information disclosure (medium 6.9)
- [CVE-2026-55708](https://insights.sbomify.com/CVE-2026-55708/): Privacy/configuration issue when adding local data in views through 'unbound-control' (low 3.1)
- [CVE-2026-55707](https://insights.sbomify.com/CVE-2026-55707/): Missing authorization in Neutron (high 7.1)
- [CVE-2026-55706](https://insights.sbomify.com/CVE-2026-55706/): Auth bypass in OpenBSD (medium 5.8)
- [CVE-2026-55704](https://insights.sbomify.com/CVE-2026-55704/): Discourse: Shared-draft titles and excerpts leak through group post serialization (medium 4.3)
- [CVE-2026-55703](https://insights.sbomify.com/CVE-2026-55703/): Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GET (medium 4.3)
- [CVE-2026-55701](https://insights.sbomify.com/CVE-2026-55701/): OpenTelemetry githubreceiver silently ignores configured required_headers authentication (medium 6.9)
- [CVE-2026-55700](https://insights.sbomify.com/CVE-2026-55700/): pnpm: stage download writes outside destination via manifest version traversal (high 7.1)
- [CVE-2026-5570](https://insights.sbomify.com/CVE-2026-5570/): Technostrobe HI-LED-WR120-G2 LoginCB index_config improper authentication (medium 6.9)
- [CVE-2026-55699](https://insights.sbomify.com/CVE-2026-55699/): pnpm: reserved bin name deletes PNPM_HOME during global remove (medium 6.5)
- [CVE-2026-55698](https://insights.sbomify.com/CVE-2026-55698/): pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes (high 8.8)
- [CVE-2026-55697](https://insights.sbomify.com/CVE-2026-55697/): pnpm: Repository-controlled configDependencies can select a pacquet native install engine (high 7.5)
- [CVE-2026-55696](https://insights.sbomify.com/CVE-2026-55696/): PrivateBin has stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interaction (medium 4.3)
- [CVE-2026-55695](https://insights.sbomify.com/CVE-2026-55695/): FearlessCMS: Remote Code Execution via Unvalidated Update Repository URL in System Updater (critical 9.1)
- [CVE-2026-55694](https://insights.sbomify.com/CVE-2026-55694/): Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover (high 7.1)
- [CVE-2026-55693](https://insights.sbomify.com/CVE-2026-55693/): Vim: Out-of-bounds Write in Spell File Word Count (medium 5.7)
- [CVE-2026-55692](https://insights.sbomify.com/CVE-2026-55692/): EmbedVideo Extension: Stored XSS via malformed src url with $wgEmbedVideoRequireConsent enabled (high 7.5)
- [CVE-2026-55691](https://insights.sbomify.com/CVE-2026-55691/): EmbedVideo Extension : Stored XSS via unsanitized class passed to template (high 8.6)
- [CVE-2026-55690](https://insights.sbomify.com/CVE-2026-55690/): EmbedVideo Extension: Stored XSS via unsanitized service name in exception text (high 7.5)
- [CVE-2026-5569](https://insights.sbomify.com/CVE-2026-5569/): Technostrobe HI-LED-WR120-G2 Endpoint access control (medium 6.9)
- [CVE-2026-55689](https://insights.sbomify.com/CVE-2026-55689/): OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset (medium 6.8)
- [CVE-2026-55688](https://insights.sbomify.com/CVE-2026-55688/): AsyncHttpClient: Cookie stored for an unrelated domain (cookie tossing) via ThreadSafeCookieStore (medium 4.0)
- [CVE-2026-55687](https://insights.sbomify.com/CVE-2026-55687/): ESF-IDF: Stack-Based Out-of-Bounds Write in JPEG Decoder DQT Marker Parsing (high 7.5)
- [CVE-2026-55686](https://insights.sbomify.com/CVE-2026-55686/): Podman: WORKDIR symlink traversal vulnerability (medium 5.3)
- [CVE-2026-55685](https://insights.sbomify.com/CVE-2026-55685/): React Router: Unauthenticated Denial of Service via Inefficient Route Matching (high 8.7)
- [CVE-2026-55684](https://insights.sbomify.com/CVE-2026-55684/): WeGIA: SQL Injection in html/socio/sistema/cadastro_cobrancas_geracao.php (critical 9.8)
- [CVE-2026-55683](https://insights.sbomify.com/CVE-2026-55683/): WeGIA: SQL Injection in html/socio/sistema/cadastro_cobranca.php (critical 9.8)
- [CVE-2026-55682](https://insights.sbomify.com/CVE-2026-55682/): WeGIA: Session Fixation via User-Controlled PHPSESSID Cookie + DB_HOST Leak in html/seguranca/sessionStart.php (high 8.1)
- [CVE-2026-55681](https://insights.sbomify.com/CVE-2026-55681/): WeGIA: SQL Injection in html/matPat/restaurar_produto_desocultar.php via id_produto parameter (high 8.8)
- [CVE-2026-55680](https://insights.sbomify.com/CVE-2026-55680/): WeGIA: Unauthenticated SQL Injection in cadastro_cobranca.php via "codigo" parameter (critical 9.8)
- [CVE-2026-5568](https://insights.sbomify.com/CVE-2026-5568/): Akaunting Invoice/Billing cross site scripting (medium 5.1)
- [CVE-2026-55679](https://insights.sbomify.com/CVE-2026-55679/): WeGIA: Pre-auth Installer Injection Chain Enables Command Execution and Arbitrary PHP Code Injection (medium 6.5)
- [CVE-2026-55678](https://insights.sbomify.com/CVE-2026-55678/): Arc: Unauthenticated cluster node admission when `cluster.shared_secret` is unset (medium 6.9)
- [CVE-2026-55677](https://insights.sbomify.com/CVE-2026-55677/): Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files (high 7.5)
- [CVE-2026-55676](https://insights.sbomify.com/CVE-2026-55676/): Malcolm vulnerable to RCE via unrestricted .php upload to the file-upload component (high 8.7)
- [CVE-2026-55675](https://insights.sbomify.com/CVE-2026-55675/): Salty documentation workflow executes fork-controlled Python build hooks with deployment secrets (critical 10.0)
- [CVE-2026-55674](https://insights.sbomify.com/CVE-2026-55674/): Discourse: Cache poisoning/XSS via color scheme cookies (critical 9.3)
- [CVE-2026-55673](https://insights.sbomify.com/CVE-2026-55673/): PowSyBl: Command Injection in LocalCommandExecutor-s (high 7.1)
- [CVE-2026-55672](https://insights.sbomify.com/CVE-2026-55672/): ZITADEL: Missing client_id binding in OIDC authorization code exchange and refresh token flows (RFC 6749 Section 4.1.3 violation) (high 7.4)
- [CVE-2026-55671](https://insights.sbomify.com/CVE-2026-55671/): ZITADEL: Server-Side Request Forgery (SSRF) and Denylist Bypass in Outgoing HTTP Components (low 2.3)
- [CVE-2026-55670](https://insights.sbomify.com/CVE-2026-55670/): ZITADEL: Cross-Tenant User Leakage via Recycled Identifiers (low 2.3)
- [CVE-2026-5567](https://insights.sbomify.com/CVE-2026-5567/): Tenda M3 Destination setAdvPolicyData buffer overflow (high 8.7)
- [CVE-2026-55669](https://insights.sbomify.com/CVE-2026-55669/): ZITADEL: Missing Token Audience Validation (`aud`) in JWT IdP Provider (medium 4.2)
- [CVE-2026-55668](https://insights.sbomify.com/CVE-2026-55668/): File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope (medium 6.3)
- [CVE-2026-55667](https://insights.sbomify.com/CVE-2026-55667/): File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup (high 8.2)
- [CVE-2026-55666](https://insights.sbomify.com/CVE-2026-55666/): Rocket.Chat: Email Parameter Fallback Leads To Account Takeover Within Apple OAuth (critical 9.3)
- [CVE-2026-55665](https://insights.sbomify.com/CVE-2026-55665/): DOM-based XSS in Grist via unsanitized links, enabling privilege escalation (high 8.5)
- [CVE-2026-55664](https://insights.sbomify.com/CVE-2026-55664/): Grist: Insufficient access control in the /forms endpoint exposes table metadata (medium 4.3)
- [CVE-2026-55663](https://insights.sbomify.com/CVE-2026-55663/): mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation) (medium 5.6)
- [CVE-2026-55661](https://insights.sbomify.com/CVE-2026-55661/): TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes (medium 4.8)
- [CVE-2026-55660](https://insights.sbomify.com/CVE-2026-55660/): TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover (high 7.6)
- [CVE-2026-5566](https://insights.sbomify.com/CVE-2026-5566/): UTT HiPER 1250GW formNatStaticMap strcpy buffer overflow (high 8.7)
- [CVE-2026-55659](https://insights.sbomify.com/CVE-2026-55659/): Grist: XSS through unsafe value interpolation in server-rendered pages (high 7.7)
- [CVE-2026-55658](https://insights.sbomify.com/CVE-2026-55658/): Gardens v2: StreamingEscrow buffer drains to the proposal beneficiary on cancel via the permissionless claim() (high 7.7)
- [CVE-2026-55655](https://insights.sbomify.com/CVE-2026-55655/): Security feature bypass in Red Hat Enterprise Linux 10 (medium 5.0)
- [CVE-2026-55654](https://insights.sbomify.com/CVE-2026-55654/): Memory corruption in Red Hat Enterprise Linux 10 (low 3.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/540/