# Vulnerabilities published in 2026


- [CVE-2026-55653](https://insights.sbomify.com/CVE-2026-55653/): Memory corruption in Red Hat Enterprise Linux 10 (medium 4.3)
- [CVE-2026-55652](https://insights.sbomify.com/CVE-2026-55652/): Auth bypass in wekan (critical 9.8)
- [CVE-2026-55651](https://insights.sbomify.com/CVE-2026-55651/): Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data Exposure (high 7.1)
- [CVE-2026-55650](https://insights.sbomify.com/CVE-2026-55650/): Outerbase Studio: Stored XSS in Text Widget Leads to Authentication Token Exposure (medium 4.4)
- [CVE-2026-5565](https://insights.sbomify.com/CVE-2026-5565/): code-projects Simple Laundry System Parameter delmemberinfo.php sql injection (medium 6.9)
- [CVE-2026-55648](https://insights.sbomify.com/CVE-2026-55648/): FreeRDP: Integer Overflow in `freerdp_image_copy_from_icon_data` Bypasses Bounds Check (medium 6.1)
- [CVE-2026-55647](https://insights.sbomify.com/CVE-2026-55647/): DataEase: authenticated stored XSS in the dashboard text components (medium 5.1)
- [CVE-2026-55646](https://insights.sbomify.com/CVE-2026-55646/): vLLM speech-to-text endpoints allocate full upload before enforcing the audio file-size limit (medium 6.5)
- [CVE-2026-55645](https://insights.sbomify.com/CVE-2026-55645/): xrdp: Out-of-bounds read in Client Control PDU processing (xrdp_rdp_process_data_control) (medium 6.5)
- [CVE-2026-55644](https://insights.sbomify.com/CVE-2026-55644/): Element X iOS: io.element.call deeplink allows attacker-controlled HTTPS origin and may grant mic/camera to that origin (medium 5.1)
- [CVE-2026-55643](https://insights.sbomify.com/CVE-2026-55643/): Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode (high 7.6)
- [CVE-2026-55642](https://insights.sbomify.com/CVE-2026-55642/): dbx: Unauthenticated arbitrary SQL execution in dbx-web (authentication fails open when no password is configured) (critical 9.8)
- [CVE-2026-55641](https://insights.sbomify.com/CVE-2026-55641/): 9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRF (high 8.2)
- [CVE-2026-55640](https://insights.sbomify.com/CVE-2026-55640/): nextcloud-mcp-server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default ) (critical 9.1)
- [CVE-2026-5564](https://insights.sbomify.com/CVE-2026-5564/): code-projects Simple Laundry System Parameter searchguest.php sql injection (medium 6.9)
- [CVE-2026-55639](https://insights.sbomify.com/CVE-2026-55639/): Memory corruption in xrdp (medium 5.3)
- [CVE-2026-55638](https://insights.sbomify.com/CVE-2026-55638/): 9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass (high 8.6)
- [CVE-2026-55637](https://insights.sbomify.com/CVE-2026-55637/): genieacs-mcp: DNS rebinding reaches local GenieACS MCP Streamable HTTP transport (high 8.8)
- [CVE-2026-55636](https://insights.sbomify.com/CVE-2026-55636/): Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotected (medium 5.7)
- [CVE-2026-55635](https://insights.sbomify.com/CVE-2026-55635/): DataEase: Authenticated SQL Injection in Chart Quota Filters (high 8.7)
- [CVE-2026-55634](https://insights.sbomify.com/CVE-2026-55634/): Pimcore: Remote Code Execution via DataObject Class-Definition Field Name (critical 9.9)
- [CVE-2026-55633](https://insights.sbomify.com/CVE-2026-55633/): DataEase H2 RCE via Zip Protocol & File Dropper Fix bypass (high 8.7)
- [CVE-2026-55632](https://insights.sbomify.com/CVE-2026-55632/): GoCD is vulnerable to authorization bypass via pipeline structure API (medium 4.3)
- [CVE-2026-55631](https://insights.sbomify.com/CVE-2026-55631/): DataEase: Path Traversal Leading to Arbitrary File Deletion via Font Management (high 7.2)
- [CVE-2026-55630](https://insights.sbomify.com/CVE-2026-55630/): Kiwi TCMS: Stored XSS via javascript: URI in extra_link field (TestPlan & TestCase) (not scored)
- [CVE-2026-5563](https://insights.sbomify.com/CVE-2026-5563/): AutohomeCorp frostmourne Alarm Preview previewData httpTest sql injection (medium 5.3)
- [CVE-2026-55629](https://insights.sbomify.com/CVE-2026-55629/): Whistle: Path traversal (high 8.7)
- [CVE-2026-55628](https://insights.sbomify.com/CVE-2026-55628/): ImageMagick: Policy Bypass in concatenate operation due to missing checks (medium 5.5)
- [CVE-2026-55626](https://insights.sbomify.com/CVE-2026-55626/): xrdp: No authentication required with Xvnc backend on RHEL 9 (high 8.0)
- [CVE-2026-55625](https://insights.sbomify.com/CVE-2026-55625/): GoCD is vulnerable to authorization bypass via material connection test APIs (medium 4.9)
- [CVE-2026-55624](https://insights.sbomify.com/CVE-2026-55624/): MintyItanium Lost-Auction takes items like barrier blocks out from search GUI (medium 5.3)
- [CVE-2026-55622](https://insights.sbomify.com/CVE-2026-55622/): Incus has a project restriction bypass in instance copy across projects (high 7.7)
- [CVE-2026-55621](https://insights.sbomify.com/CVE-2026-55621/): Incus has a project restriction bypass for custom volume copy across projects (high 7.7)
- [CVE-2026-55620](https://insights.sbomify.com/CVE-2026-55620/): eml_parser: DoS via deeply nested parens in Received headers (high 7.5)
- [CVE-2026-5562](https://insights.sbomify.com/CVE-2026-5562/): provectus kafka-ui Endpoint testexecutions validateAccess code injection (medium 6.9)
- [CVE-2026-55619](https://insights.sbomify.com/CVE-2026-55619/): eml_parser: Parser DoS via deeply nested parentheses in e-mail headers (medium 5.3)
- [CVE-2026-55618](https://insights.sbomify.com/CVE-2026-55618/): eml_parser: URL extraction bypass via HTML entities in URLs (medium 6.5)
- [CVE-2026-55617](https://insights.sbomify.com/CVE-2026-55617/): Hydro: Insufficient session expiration when recreating sessions (medium 6.9)
- [CVE-2026-55615](https://insights.sbomify.com/CVE-2026-55615/): Langroid: Neo4jChatAgent executes LLM-generated Cypher without validation (prompt-to-Cypher injection; config-conditional RCE), mirroring the SQLChatAgent bug fixed in CVE-2026-25879 (critical 9.2)
- [CVE-2026-55611](https://insights.sbomify.com/CVE-2026-55611/): Missing authorization in anything-llm (not scored)
- [CVE-2026-55610](https://insights.sbomify.com/CVE-2026-55610/): InvoiceShelf has cross-company user read/update IDOR that enables cross-tenant account takeover (high 8.7)
- [CVE-2026-5561](https://insights.sbomify.com/CVE-2026-5561/): Campcodes Complete POS Management and Inventory System Environment Variable SettingsController.php injection (medium 5.3)
- [CVE-2026-55609](https://insights.sbomify.com/CVE-2026-55609/): sublinear-time-solver: Arbitrary file write in consciousness-explorer / sublinear-time-solver MCP export_state (high 7.1)
- [CVE-2026-55608](https://insights.sbomify.com/CVE-2026-55608/): n8n-MCP: Incorrect authorization can expose default-scope workflow version backups in multi-tenant HTTP mode (medium 4.2)
- [CVE-2026-55607](https://insights.sbomify.com/CVE-2026-55607/): Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution (high 7.7)
- [CVE-2026-55606](https://insights.sbomify.com/CVE-2026-55606/): odhcpd: Stack buffer overread via DUID length endianness mismatch in memcmp() (medium 6.5)
- [CVE-2026-55605](https://insights.sbomify.com/CVE-2026-55605/): @arikusi/deepseek-mcp-server Missing Authentication on Self-Hosted HTTP MCP Endpoint (medium 5.3)
- [CVE-2026-55604](https://insights.sbomify.com/CVE-2026-55604/): @arikusi/deepseek-mcp-server has an Authorization Bypass Through User-Controlled Key (high 8.6)
- [CVE-2026-55603](https://insights.sbomify.com/CVE-2026-55603/): http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in `fixRequestBody` (high 7.5)
- [CVE-2026-55602](https://insights.sbomify.com/CVE-2026-55602/): http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass (medium 6.9)
- [CVE-2026-55601](https://insights.sbomify.com/CVE-2026-55601/): MultiTail: Shell injection in execute-on-match command handling (high 7.3)
- [CVE-2026-55600](https://insights.sbomify.com/CVE-2026-55600/): Part-DB: Stored HTML injection in BOM validation results via unescaped Part name (medium 5.7)
- [CVE-2026-5560](https://insights.sbomify.com/CVE-2026-5560/): PHPGurukul Online Shopping Portal Project Parameter payment-method.php sql injection (medium 5.3)
- [CVE-2026-55599](https://insights.sbomify.com/CVE-2026-55599/): phpseclib: X.509 certificate validation sends attacker-controlled outbound requests (server-side request forgery) via Authority Information Access (medium 5.8)
- [CVE-2026-55597](https://insights.sbomify.com/CVE-2026-55597/): ImageMagick: Heap Buffer Over-Write in JP2 encoder when due to incorrect handling of arguments (medium 5.5)
- [CVE-2026-55596](https://insights.sbomify.com/CVE-2026-55596/): Plate: Media embed provider metadata can bypass URL sanitization and execute iframe JavaScript (high 8.7)
- [CVE-2026-55595](https://insights.sbomify.com/CVE-2026-55595/): ImageMagick: Infinite Loop in connected-components when providing invalid arguments (medium 4.7)
- [CVE-2026-55594](https://insights.sbomify.com/CVE-2026-55594/): ImageMagick: Stack Overflow in MVG decoder due to missing depth check. (medium 5.3)
- [CVE-2026-55593](https://insights.sbomify.com/CVE-2026-55593/): Froxlor: CSRF Vulnerability in Froxlor AJAX Endpoint — Missing Cross-Site Request Forgery Protection (medium 6.5)
- [CVE-2026-55592](https://insights.sbomify.com/CVE-2026-55592/): Dashy: XSS in workspace url parameter (low 3.9)
- [CVE-2026-55591](https://insights.sbomify.com/CVE-2026-55591/): Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints (medium 5.8)
- [CVE-2026-55590](https://insights.sbomify.com/CVE-2026-55590/): CakePHP: Open redirect weakness via backslash bypass (medium 5.1)
- [CVE-2026-5559](https://insights.sbomify.com/CVE-2026-5559/): AntaresMugisho PyBlade AST Validation sandbox.py _is_safe_ast special elements used in a template engine (medium 5.3)
- [CVE-2026-55588](https://insights.sbomify.com/CVE-2026-55588/): ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption (medium 6.5)
- [CVE-2026-55587](https://insights.sbomify.com/CVE-2026-55587/): AliasVault: Browser extension WebAuthn bridge accepts forged origin/RP ID (high 8.1)
- [CVE-2026-55586](https://insights.sbomify.com/CVE-2026-55586/): SumatraPDF: Heap out-of-bounds write in vendored CHMLib LZX Huffman table construction reachable from crafted CHM files (medium 6.6)
- [CVE-2026-55585](https://insights.sbomify.com/CVE-2026-55585/): QWED: Authenticated Remote Code Execution via Unsafe SymPy `parse_expr()` (high 8.8)
- [CVE-2026-55584](https://insights.sbomify.com/CVE-2026-55584/): phpSysInfo: IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers (high 7.5)
- [CVE-2026-55583](https://insights.sbomify.com/CVE-2026-55583/): Twenty: Cross-workspace IDOR in AgentTurnResolver (high 7.6)
- [CVE-2026-55582](https://insights.sbomify.com/CVE-2026-55582/): mcp-shell: Secure Mode Allowlist Bypass via Git Shell Alias (high 8.4)
- [CVE-2026-55581](https://insights.sbomify.com/CVE-2026-55581/): mcp-shell: Secure Mode Allowlist Bypass via Default `/bin/bash` Executable (high 8.4)
- [CVE-2026-55580](https://insights.sbomify.com/CVE-2026-55580/): mcp-shell — Security Disabled by Default in Bare-Binary Deploy Path + Shell Interpreter in Secure-Mode Allowlist (high 8.6)
- [CVE-2026-5558](https://insights.sbomify.com/CVE-2026-5558/): PHPGurukul PHPGurukul Online Shopping Portal Project Parameter pending-orders.php sql injection (medium 5.3)
- [CVE-2026-55579](https://insights.sbomify.com/CVE-2026-55579/): Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise (critical 9.8)
- [CVE-2026-55578](https://insights.sbomify.com/CVE-2026-55578/): Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injection (high 8.8)
- [CVE-2026-55577](https://insights.sbomify.com/CVE-2026-55577/): ImageMagick: Heap Buffer Overflow in ImageMagick MVG decoder (medium 5.9)
- [CVE-2026-55576](https://insights.sbomify.com/CVE-2026-55576/): MaaAssistantArknights: PR-title expression injection in release-preparation.yml (high 8.8)
- [CVE-2026-55575](https://insights.sbomify.com/CVE-2026-55575/): LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce (high 8.2)
- [CVE-2026-55574](https://insights.sbomify.com/CVE-2026-55574/): vLLM: ReDoS via structured_outputs.regex compiled without timeout in xgrammar and outlines backends (high 8.7)
- [CVE-2026-55573](https://insights.sbomify.com/CVE-2026-55573/): e107: Unsafe deserialization in install.php allows unauthenticated RCE via POP chain (critical 9.8)
- [CVE-2026-55572](https://insights.sbomify.com/CVE-2026-55572/): e107: SQL injection in alt_auth plugin (otherdb / e107db backends) via login username (critical 10.0)
- [CVE-2026-55571](https://insights.sbomify.com/CVE-2026-55571/): djust authentication bypass: a login_required / on_mount LiveView mount redirect does not close the WebSocket, allowing an unauthenticated client to dispatch event-handler calls (high 8.2)
- [CVE-2026-55570](https://insights.sbomify.com/CVE-2026-55570/): Cross-site scripting in siyuan (critical 9.0)
- [CVE-2026-5557](https://insights.sbomify.com/CVE-2026-5557/): badlogic pi-mono pi-mom Slack Bot slack.ts authentication bypass (medium 5.3)
- [CVE-2026-55569](https://insights.sbomify.com/CVE-2026-55569/): aqua: Archive extraction in aqua follows attacker-planted symlinks, allowing writes outside the install directory (medium 6.6)
- [CVE-2026-55568](https://insights.sbomify.com/CVE-2026-55568/): Guzzle: Silent HTTPS-Proxy Downgrade to Cleartext (medium 5.9)
- [CVE-2026-55567](https://insights.sbomify.com/CVE-2026-55567/): BleachBit: Exploit File Delete to Escalate Privilege (high 7.8)
- [CVE-2026-55566](https://insights.sbomify.com/CVE-2026-55566/): Yamcs: DOM XSS in Extension Routing (medium 4.3)
- [CVE-2026-55565](https://insights.sbomify.com/CVE-2026-55565/): Yamcs: Authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`) (critical 9.9)
- [CVE-2026-55564](https://insights.sbomify.com/CVE-2026-55564/): FreeRDP: Out-of-bounds read in glyph_cache_get via crafted glyph fragments (medium 5.4)
- [CVE-2026-55563](https://insights.sbomify.com/CVE-2026-55563/): Supply chain in feast (high 8.9)
- [CVE-2026-55562](https://insights.sbomify.com/CVE-2026-55562/): Cronicle: Stored XSS in admin Activity Log via account full_name field (critical 9.0)
- [CVE-2026-55561](https://insights.sbomify.com/CVE-2026-55561/): InvoicePlane: Guest user IDOR in quote approval and rejection (medium 5.3)
- [CVE-2026-5556](https://insights.sbomify.com/CVE-2026-5556/): badlogic pi-mono loader.ts discoverAndLoadExtensions code injection (medium 5.3)
- [CVE-2026-55559](https://insights.sbomify.com/CVE-2026-55559/): Yamcs: Remote Code Execution via instance-template argument YAML injection (createInstance) (critical 9.8)
- [CVE-2026-55558](https://insights.sbomify.com/CVE-2026-55558/): aiosmtplib: STARTTLS response injection (medium 5.9)
- [CVE-2026-55557](https://insights.sbomify.com/CVE-2026-55557/): browse-mcp: Arbitrary file write via unconfined download and state paths (high 8.6)
- [CVE-2026-55556](https://insights.sbomify.com/CVE-2026-55556/): Rsyslog: Heap buffer overflow in imhttp plugin Basic Authentication handling (high 8.2)
- [CVE-2026-55555](https://insights.sbomify.com/CVE-2026-55555/): Dompdf: File existence oracle via font-face stylesheet declaration (low 2.3)
- [CVE-2026-55554](https://insights.sbomify.com/CVE-2026-55554/): Dompdf: Chroot Validation Bypass (low 2.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/541/