# Vulnerabilities published in 2026


- [CVE-2026-55452](https://insights.sbomify.com/CVE-2026-55452/): Snipe-IT: CSV formula injection in Activity Report export (medium 4.8)
- [CVE-2026-55451](https://insights.sbomify.com/CVE-2026-55451/): gettext-converter: Prototype pollution in js2i18next() via crafted translation keys (high 8.3)
- [CVE-2026-55450](https://insights.sbomify.com/CVE-2026-55450/): Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak (critical 9.3)
- [CVE-2026-5545](https://insights.sbomify.com/CVE-2026-5545/): wrong reuse of HTTP Negotiate connection (medium 6.5)
- [CVE-2026-55448](https://insights.sbomify.com/CVE-2026-55448/): mise: Local credential_command executes untrusted config (medium 6.3)
- [CVE-2026-55447](https://insights.sbomify.com/CVE-2026-55447/): Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit (critical 9.6)
- [CVE-2026-55446](https://insights.sbomify.com/CVE-2026-55446/): Langflow: Unauthenticated DoS through multipart form boundary file upload (high 7.5)
- [CVE-2026-55445](https://insights.sbomify.com/CVE-2026-55445/): Qinglong: Incomplete fix for CVE-2026-3965: Improper Authentication (critical 9.3)
- [CVE-2026-55444](https://insights.sbomify.com/CVE-2026-55444/): Goobi viewer: Solr query injection via the legacy RSS servlet q and filterQuery parameters (medium 5.3)
- [CVE-2026-55443](https://insights.sbomify.com/CVE-2026-55443/): LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders (medium 5.1)
- [CVE-2026-55442](https://insights.sbomify.com/CVE-2026-55442/): Goobi viewer: cleanUpQuery double-brace bypass allows arbitrary Solr local-param injection (medium 5.3)
- [CVE-2026-55441](https://insights.sbomify.com/CVE-2026-55441/): mise: Arbitrary command execution via task-include files in an untrusted, config-less repository (high 8.6)
- [CVE-2026-55440](https://insights.sbomify.com/CVE-2026-55440/): Missing authorization in UFO (medium 6.5)
- [CVE-2026-5544](https://insights.sbomify.com/CVE-2026-5544/): UTT HiPER 1250GW formRemoteControl stack-based overflow (high 8.7)
- [CVE-2026-55439](https://insights.sbomify.com/CVE-2026-55439/): Halo: Path Traversal in Backup Download Leads to Arbitrary File Read (medium 5.5)
- [CVE-2026-55438](https://insights.sbomify.com/CVE-2026-55438/): Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing (medium 5.8)
- [CVE-2026-55437](https://insights.sbomify.com/CVE-2026-55437/): Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component (medium 5.4)
- [CVE-2026-55436](https://insights.sbomify.com/CVE-2026-55436/): Coder's AI Bridge Proxy skips TLS certificate verification in default configuration (high 7.4)
- [CVE-2026-55435](https://insights.sbomify.com/CVE-2026-55435/): Suspended Coder users retain access to AI Bridge LLM proxy endpoints (medium 5.4)
- [CVE-2026-55434](https://insights.sbomify.com/CVE-2026-55434/): Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints (medium 6.5)
- [CVE-2026-55433](https://insights.sbomify.com/CVE-2026-55433/): Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers (medium 5.4)
- [CVE-2026-55432](https://insights.sbomify.com/CVE-2026-55432/): Coder's sub-agent app registration bypasses template port-sharing policy enforcement (medium 5.4)
- [CVE-2026-55431](https://insights.sbomify.com/CVE-2026-55431/): Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps (high 7.7)
- [CVE-2026-55430](https://insights.sbomify.com/CVE-2026-55430/): Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access (medium 5.8)
- [CVE-2026-5543](https://insights.sbomify.com/CVE-2026-5543/): PHPGurukul User Registration & Login and User Management System yesterday-reg-users.php sql injection (medium 5.3)
- [CVE-2026-55429](https://insights.sbomify.com/CVE-2026-55429/): Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID (high 8.7)
- [CVE-2026-55428](https://insights.sbomify.com/CVE-2026-55428/): Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator (high 8.2)
- [CVE-2026-55427](https://insights.sbomify.com/CVE-2026-55427/): Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` (high 8.3)
- [CVE-2026-55426](https://insights.sbomify.com/CVE-2026-55426/): linuxfabrik-lib: Local privilege escalation using embedded command (high 7.8)
- [CVE-2026-55425](https://insights.sbomify.com/CVE-2026-55425/): Graylog: System Catalog titles endpoint can be used to retrieve values of protected database fields (medium 5.0)
- [CVE-2026-55424](https://insights.sbomify.com/CVE-2026-55424/): Discourse: Topic featured link susceptible to stored XSS (high 7.4)
- [CVE-2026-55423](https://insights.sbomify.com/CVE-2026-55423/): Langflow: Logout button does not clear session (medium 6.1)
- [CVE-2026-55422](https://insights.sbomify.com/CVE-2026-55422/): conda-forge.org: Stored DOM XSS via unsanitized dangerouslySetInnerHTML in the status dashboard (medium 4.6)
- [CVE-2026-55421](https://insights.sbomify.com/CVE-2026-55421/): Open edX Platform: SSRF in Studio Video Download Endpoint (medium 6.8)
- [CVE-2026-55420](https://insights.sbomify.com/CVE-2026-55420/): Discourse: Remote code execution via pdf uploads (high 7.5)
- [CVE-2026-5542](https://insights.sbomify.com/CVE-2026-5542/): code-projects Simple Laundry System Parameter modstaffinfo.php cross site scripting (medium 5.3)
- [CVE-2026-55419](https://insights.sbomify.com/CVE-2026-55419/): Reachy Mini: Unrestricted Upload of File with Dangerous Type (medium 5.3)
- [CVE-2026-55418](https://insights.sbomify.com/CVE-2026-55418/): FastGPT: S3 presign/read handlers do not bind the object key to the caller's team (cross-team file disclosure) (high 8.6)
- [CVE-2026-55417](https://insights.sbomify.com/CVE-2026-55417/): Chevereto private profile setting leaks username on /json endpoint (medium 6.9)
- [CVE-2026-55416](https://insights.sbomify.com/CVE-2026-55416/): Pimcore: SQL Injection in Custom Reports via Malicious Report Configuration (high 8.8)
- [CVE-2026-55415](https://insights.sbomify.com/CVE-2026-55415/): datamodel-code-generator vulnerable to code injection via `x-python-import` / `customTypePath` in generated import statements (high 7.5)
- [CVE-2026-55414](https://insights.sbomify.com/CVE-2026-55414/): NL Portal Backend Libraries: Unauthenticated form resolver forwards the privileged Objecten-API token to a caller-supplied URL (SSRF) (medium 5.3)
- [CVE-2026-55413](https://insights.sbomify.com/CVE-2026-55413/): ToolJet - Marketplace Plugin Poisoning Enables Instance-Wide Remote Code Execution (critical 9.4)
- [CVE-2026-55412](https://insights.sbomify.com/CVE-2026-55412/): ToolJet Cloud - SSRF to Azure Cloud Infrastructure Compromise (high 8.3)
- [CVE-2026-55411](https://insights.sbomify.com/CVE-2026-55411/): Missing authorization in ToolJet (medium 6.8)
- [CVE-2026-55410](https://insights.sbomify.com/CVE-2026-55410/): NocoBase backup restore schema name allows command injection (medium 6.7)
- [CVE-2026-5541](https://insights.sbomify.com/CVE-2026-5541/): code-projects Simple Laundry System Parameter modmemberinfo.php cross site scripting (medium 5.3)
- [CVE-2026-55409](https://insights.sbomify.com/CVE-2026-55409/): Filament: Disabled RichEditor field state can be used for XSS (high 7.6)
- [CVE-2026-55408](https://insights.sbomify.com/CVE-2026-55408/): Koodo Reader: Remote code execution via malicious epub file (high 8.4)
- [CVE-2026-55407](https://insights.sbomify.com/CVE-2026-55407/): Buffa: Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded Allocation (medium 6.3)
- [CVE-2026-55406](https://insights.sbomify.com/CVE-2026-55406/): Buffa: Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Deref (medium 5.9)
- [CVE-2026-55405](https://insights.sbomify.com/CVE-2026-55405/): LangChain4j: SQL injection via metadata filters in langchain4j-mariadb and langchain4j-pgvector (high 7.6)
- [CVE-2026-55404](https://insights.sbomify.com/CVE-2026-55404/): yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output (high 7.5)
- [CVE-2026-55403](https://insights.sbomify.com/CVE-2026-55403/): datamodel-code-generator: Authorization / request headers leaked to cross-origin redirect target when fetching remote schemas (low 3.7)
- [CVE-2026-55402](https://insights.sbomify.com/CVE-2026-55402/): Memory corruption in Secure Access (high 8.7)
- [CVE-2026-55401](https://insights.sbomify.com/CVE-2026-55401/): Null dereference in Secure Access (medium 6.9)
- [CVE-2026-55400](https://insights.sbomify.com/CVE-2026-55400/): Integer overflow in Secure Access (medium 6.0)
- [CVE-2026-5540](https://insights.sbomify.com/CVE-2026-5540/): code-projects Simple Laundry System Parameter modifymember.php sql injection (medium 6.9)
- [CVE-2026-55399](https://insights.sbomify.com/CVE-2026-55399/): Resource exhaustion vulnerability in the Secure Access publisher (medium 5.1)
- [CVE-2026-55398](https://insights.sbomify.com/CVE-2026-55398/): Memory management vulnerability in Secure Access clients (medium 6.9)
- [CVE-2026-55396](https://insights.sbomify.com/CVE-2026-55396/): Unencrypted UDP Control Traffic in Teledyne FLIR Robots running Aware2 (high 8.5)
- [CVE-2026-55395](https://insights.sbomify.com/CVE-2026-55395/): Hardcoded Passwords in Teledyne FLIR Robots running Aware2 (critical 9.4)
- [CVE-2026-55394](https://insights.sbomify.com/CVE-2026-55394/): Unencrypted 802.11 Network in Teledyne FLIR Robots running Aware2 (medium 5.3)
- [CVE-2026-55393](https://insights.sbomify.com/CVE-2026-55393/): Local File Inclusion in Teledyne FLIR Robots running Aware2 (critical 10.0)
- [CVE-2026-55392](https://insights.sbomify.com/CVE-2026-55392/): NILFS utilities - Undefined Behavior and Out-of-Memory via Unvalidated s_log_block_size (medium 6.7)
- [CVE-2026-55391](https://insights.sbomify.com/CVE-2026-55391/): datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding (high 7.5)
- [CVE-2026-55390](https://insights.sbomify.com/CVE-2026-55390/): Arbitrary local file read via XSD `schemaLocation` (`xs:include`/`xs:import`) path traversal, with no remote-ref gate (high 7.5)
- [CVE-2026-5539](https://insights.sbomify.com/CVE-2026-5539/): code-projects Simple Laundry System Parameter modifymember.php cross site scripting (medium 5.3)
- [CVE-2026-55389](https://insights.sbomify.com/CVE-2026-55389/): datamodel-code-generator vulnerable to arbitrary local file read via JSON-Schema `$ref` (`file://` and `../` traversal), bypassing `--no-allow-remote-refs` (high 7.5)
- [CVE-2026-55388](https://insights.sbomify.com/CVE-2026-55388/): piscina: Prototype Pollution Gadget → RCE via inherited options.filename (high 8.1)
- [CVE-2026-55387](https://insights.sbomify.com/CVE-2026-55387/): InvoiceShelf bulk deletion lacks company scoping (high 7.2)
- [CVE-2026-55386](https://insights.sbomify.com/CVE-2026-55386/): InvoiceShelf ORDER BY SQL injection through orderByField (high 7.1)
- [CVE-2026-55385](https://insights.sbomify.com/CVE-2026-55385/): InvoiceShelf: SSRF via unvalidated Gotenberg PDF renderer host in PDF configuration (medium 6.8)
- [CVE-2026-55384](https://insights.sbomify.com/CVE-2026-55384/): InvoiceShelf trusts client-supplied document totals (medium 5.3)
- [CVE-2026-55383](https://insights.sbomify.com/CVE-2026-55383/): InvoiceShelf: Public EmailLog token type confusion allows cross-company invoice disclosure (high 8.2)
- [CVE-2026-55382](https://insights.sbomify.com/CVE-2026-55382/): InvoiceShelf: Cross-company read/modify/delete of notes via missing company scope in NotePolicy (BOLA/IDOR) (high 7.6)
- [CVE-2026-55381](https://insights.sbomify.com/CVE-2026-55381/): Missing authorization in InvoiceShelf (high 7.1)
- [CVE-2026-55380](https://insights.sbomify.com/CVE-2026-55380/): Pillow GdImageFile decompression bomb protection bypass (high 7.5)
- [CVE-2026-5538](https://insights.sbomify.com/CVE-2026-5538/): QingdaoU OnlineJudge judge_server_heartbeat Endpoint JudgeServer.service_url server-side request forgery (medium 5.3)
- [CVE-2026-55379](https://insights.sbomify.com/CVE-2026-55379/): Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading (high 7.5)
- [CVE-2026-55378](https://insights.sbomify.com/CVE-2026-55378/): JS Recon: Command injection in PR Branch Checker workflow via untrusted pull request context values (critical 9.3)
- [CVE-2026-55377](https://insights.sbomify.com/CVE-2026-55377/): Logto: Account Center MFA management step-up bypass via WebAuthn registration verification (high 8.1)
- [CVE-2026-55376](https://insights.sbomify.com/CVE-2026-55376/): heym Python Tool Sandbox Escape (high 8.8)
- [CVE-2026-55375](https://insights.sbomify.com/CVE-2026-55375/): canto-saas-api: OAuth credentials exposed in URL query string and exception messages (medium 5.3)
- [CVE-2026-55374](https://insights.sbomify.com/CVE-2026-55374/): canto-saas-api: Authenticated API requests can be redirected via unencoded path variables (medium 4.8)
- [CVE-2026-55373](https://insights.sbomify.com/CVE-2026-55373/): OpenEXR: OpenEXRUtil SampleCountChannel endEdit() can loop forever on UINT_MAX sample counts (medium 6.2)
- [CVE-2026-55371](https://insights.sbomify.com/CVE-2026-55371/): OpenEXR: OpenEXRCore exr_attr_set_bytes() accepts NULL type_hint with positive hint_length (medium 6.9)
- [CVE-2026-55370](https://insights.sbomify.com/CVE-2026-55370/): Logto: TOTP code can be replayed within the RFC 6238 validity window (one-time use violation) (medium 6.4)
- [CVE-2026-5537](https://insights.sbomify.com/CVE-2026-5537/): halex CourseSEL HTTP GET Parameter IndexController.class.php check_sel sql injection (medium 5.3)
- [CVE-2026-55369](https://insights.sbomify.com/CVE-2026-55369/): Waline login accepts a non-string email as a match-all MongoDB query (medium 6.5)
- [CVE-2026-55366](https://insights.sbomify.com/CVE-2026-55366/): Auth bypass in Android (critical 9.8)
- [CVE-2026-55365](https://insights.sbomify.com/CVE-2026-55365/): Memory corruption in Android (medium 6.7)
- [CVE-2026-5536](https://insights.sbomify.com/CVE-2026-5536/): FedML-AI FedML gRPC server grpc_server.py sendMessage deserialization (medium 6.9)
- [CVE-2026-55359](https://insights.sbomify.com/CVE-2026-55359/): Security feature bypass in Android (high 7.8)
- [CVE-2026-55351](https://insights.sbomify.com/CVE-2026-55351/): Integer overflow in Android (high 7.8)
- [CVE-2026-5535](https://insights.sbomify.com/CVE-2026-5535/): FedML-AI FedML MQTT Message FileUtils.java path traversal (medium 5.3)
- [CVE-2026-55343](https://insights.sbomify.com/CVE-2026-55343/): Memory corruption in Android (high 8.0)
- [CVE-2026-5534](https://insights.sbomify.com/CVE-2026-5534/): itsourcecode Online Enrollment System Parameter index.php sql injection (medium 6.9)
- [CVE-2026-55332](https://insights.sbomify.com/CVE-2026-55332/): Memory corruption in Android (medium 6.7)
- [CVE-2026-55331](https://insights.sbomify.com/CVE-2026-55331/): Memory corruption in Android (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/543/