# Vulnerabilities published in 2026


- [CVE-2026-55330](https://insights.sbomify.com/CVE-2026-55330/): Use after free in Android (critical 9.8)
- [CVE-2026-5533](https://insights.sbomify.com/CVE-2026-5533/): badlogic pi-mono SVG Artifact SvgArtifact.ts cross site scripting (medium 5.3)
- [CVE-2026-55323](https://insights.sbomify.com/CVE-2026-55323/): Memory corruption in Android (high 7.8)
- [CVE-2026-5532](https://insights.sbomify.com/CVE-2026-5532/): ScrapeGraphAI scrapegraph-ai GenerateCodeNode generate_code_node.py create_sandbox_and_execute os command injection (medium 5.3)
- [CVE-2026-55318](https://insights.sbomify.com/CVE-2026-55318/): Use after free in Android (high 8.8)
- [CVE-2026-55317](https://insights.sbomify.com/CVE-2026-55317/): Memory corruption in Android (medium 6.7)
- [CVE-2026-5531](https://insights.sbomify.com/CVE-2026-5531/): SourceCodester Student Result Management System HTTP GET Request login_credentials.txt cleartext storage in file (medium 6.9)
- [CVE-2026-55307](https://insights.sbomify.com/CVE-2026-55307/): Information disclosure in Android (medium 4.4)
- [CVE-2026-55306](https://insights.sbomify.com/CVE-2026-55306/): Denial of service in Android (high 7.5)
- [CVE-2026-55304](https://insights.sbomify.com/CVE-2026-55304/): Privilege escalation in Android (medium 6.7)
- [CVE-2026-55302](https://insights.sbomify.com/CVE-2026-55302/): Privilege escalation in Android (medium 6.7)
- [CVE-2026-55301](https://insights.sbomify.com/CVE-2026-55301/): Memory corruption in Android (high 8.4)
- [CVE-2026-5530](https://insights.sbomify.com/CVE-2026-5530/): Ollama Model Pull API download.go server-side request forgery (medium 5.3)
- [CVE-2026-55294](https://insights.sbomify.com/CVE-2026-55294/): Memory corruption in Android (high 7.8)
- [CVE-2026-55290](https://insights.sbomify.com/CVE-2026-55290/): Memory corruption in Android (low 3.3)
- [CVE-2026-5529](https://insights.sbomify.com/CVE-2026-5529/): Dromara lamp-cloud DefUserController pageUser improper authorization (medium 5.3)
- [CVE-2026-55286](https://insights.sbomify.com/CVE-2026-55286/): Memory corruption in Android (high 7.8)
- [CVE-2026-55285](https://insights.sbomify.com/CVE-2026-55285/): Memory corruption in Android (high 7.8)
- [CVE-2026-55280](https://insights.sbomify.com/CVE-2026-55280/): Memory corruption in Android (high 8.8)
- [CVE-2026-5528](https://insights.sbomify.com/CVE-2026-5528/): MoussaabBadla code-screenshot-mcp HTTP os command injection (medium 5.3)
- [CVE-2026-55277](https://insights.sbomify.com/CVE-2026-55277/): Memory corruption in Android (high 8.0)
- [CVE-2026-55276](https://insights.sbomify.com/CVE-2026-55276/): Apache Tomcat: Logged effective web.xml is incomplete (critical 9.1)
- [CVE-2026-55273](https://insights.sbomify.com/CVE-2026-55273/): Supply chain in Android (high 7.8)
- [CVE-2026-55270](https://insights.sbomify.com/CVE-2026-55270/): Privilege escalation in Android (high 7.8)
- [CVE-2026-5527](https://insights.sbomify.com/CVE-2026-5527/): Tenda 4G03 Pro ECDSA P-256 Private Key server.key hard-coded key (medium 6.9)
- [CVE-2026-55269](https://insights.sbomify.com/CVE-2026-55269/): Memory corruption in Android (high 7.8)
- [CVE-2026-55266](https://insights.sbomify.com/CVE-2026-55266/): Memory corruption in Android (high 7.8)
- [CVE-2026-55265](https://insights.sbomify.com/CVE-2026-55265/): Memory corruption in Android (medium 6.5)
- [CVE-2026-5526](https://insights.sbomify.com/CVE-2026-5526/): Tenda 4G03 Pro httpd access control (medium 6.9)
- [CVE-2026-55256](https://insights.sbomify.com/CVE-2026-55256/): Denial of service in Android (medium 6.5)
- [CVE-2026-55255](https://insights.sbomify.com/CVE-2026-55255/): Langflow Authorization Bypass Through User-Controlled Key (high 8.4, exploited in the wild)
- [CVE-2026-55254](https://insights.sbomify.com/CVE-2026-55254/): NCalc: Denial of Service via Unbounded and Non-Terminating Factorial Evaluation (medium 4.8)
- [CVE-2026-55253](https://insights.sbomify.com/CVE-2026-55253/): LangChain MongoDB: NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure (high 7.7)
- [CVE-2026-55252](https://insights.sbomify.com/CVE-2026-55252/): OpenRun: Redirect URL validation bypass using //host paths leads to Open Redirect (medium 5.1)
- [CVE-2026-55251](https://insights.sbomify.com/CVE-2026-55251/): Code injection in devicetype-library (medium 6.5)
- [CVE-2026-55250](https://insights.sbomify.com/CVE-2026-55250/): Maravel-Framework Token Replay Vulnerability via Premature JWT Blacklist Eviction in Tagged Caches (high 8.7)
- [CVE-2026-5525](https://insights.sbomify.com/CVE-2026-5525/): Stack-Based Buffer Overflow in Notepad++ File Drop Handler leads to DoS (medium 6.0)
- [CVE-2026-55249](https://insights.sbomify.com/CVE-2026-55249/): @rtk-ai/rtk-rewrite: OpenClaw Rewrite Plugin Command Injection via execSync Template String (medium 6.3)
- [CVE-2026-55248](https://insights.sbomify.com/CVE-2026-55248/): plone.app.portlets: Denial of service via RSS feed portlet (critical 9.1)
- [CVE-2026-55247](https://insights.sbomify.com/CVE-2026-55247/): plone.app.event: Denial of service via iCalendar import (critical 9.1)
- [CVE-2026-55246](https://insights.sbomify.com/CVE-2026-55246/): bincookie: Heap buffer overflow via unvalidated `num_pages` when parsing a `.binarycookies` file (high 7.8)
- [CVE-2026-55245](https://insights.sbomify.com/CVE-2026-55245/): Bifrost: SSRF deny-list incomplete: isPublicIP permits CGNAT, IPv6 6to4/NAT64, and site-local in FetchAndEncodeURL (high 8.7)
- [CVE-2026-55244](https://insights.sbomify.com/CVE-2026-55244/): ASTEVAL: Sandbox Escape via BaseException Subclasses (medium 5.0)
- [CVE-2026-55242](https://insights.sbomify.com/CVE-2026-55242/): ERPNext: Server-Side Template Injection (SSTI) in Batch autonaming via Stock Settings.naming_series_prefix (high 8.8)
- [CVE-2026-55241](https://insights.sbomify.com/CVE-2026-55241/): Checkmate: Pre-auth Denial of Service via File Upload on Registration (high 7.5)
- [CVE-2026-55240](https://insights.sbomify.com/CVE-2026-55240/): Tianji: Remote Code Execution via lodash template evaluate pattern in survey feed templates (critical 9.1)
- [CVE-2026-5524](https://insights.sbomify.com/CVE-2026-5524/): File upload in Divi Form Builder (critical 9.8)
- [CVE-2026-55239](https://insights.sbomify.com/CVE-2026-55239/): Tianji: SQL Injection via unsanitized timezone parameter in analytics queries (high 8.8)
- [CVE-2026-55238](https://insights.sbomify.com/CVE-2026-55238/): xrdp: Malformed Confirm Active capability sets cause out-of-bounds reads (medium 5.3)
- [CVE-2026-55237](https://insights.sbomify.com/CVE-2026-55237/): AutoGPT SignUp Page has DOM-Based XSS and Open Redirect (high 8.8)
- [CVE-2026-55236](https://insights.sbomify.com/CVE-2026-55236/): langgraph-api: Incomplete assistant authorization in LangGraph Server run creation (medium 5.9)
- [CVE-2026-55235](https://insights.sbomify.com/CVE-2026-55235/): langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authentication (medium 5.9)
- [CVE-2026-55234](https://insights.sbomify.com/CVE-2026-55234/): Missing authorization in wekan (high 8.5)
- [CVE-2026-55233](https://insights.sbomify.com/CVE-2026-55233/): OpenResty: Buffer overflow when writing PROXY protocol v2 header to upstream (high 7.5)
- [CVE-2026-55232](https://insights.sbomify.com/CVE-2026-55232/): Vvveb: Server-side request forgery in Vvveb via IPv6 bypass of validateUrl() in editor oEmbed proxy (high 7.6)
- [CVE-2026-55231](https://insights.sbomify.com/CVE-2026-55231/): Path traversal in Vvveb (high 7.2)
- [CVE-2026-55230](https://insights.sbomify.com/CVE-2026-55230/): Vvveb: Stored XSS in Vvveb via sanitizeHTML() filter bypass using a quoted greater-than character (high 8.7)
- [CVE-2026-5523](https://insights.sbomify.com/CVE-2026-5523/): Missing authorization in Divi Form Builder (high 8.8)
- [CVE-2026-55229](https://insights.sbomify.com/CVE-2026-55229/): Gotenberg: SSRF via LibreOffice document processing (high 7.5)
- [CVE-2026-55228](https://insights.sbomify.com/CVE-2026-55228/): Weblate has IDOR in GroupViewSet that allows authenticated project manager to gain unauthorized read access to any private project (high 8.1)
- [CVE-2026-55227](https://insights.sbomify.com/CVE-2026-55227/): Observable object existence disclosure in private Weblate projects via globally scoped object lookups (medium 4.3)
- [CVE-2026-55226](https://insights.sbomify.com/CVE-2026-55226/): Strimzi: Unrestricted access to all Secrets within namespace watched by the Topic operator (medium 5.4)
- [CVE-2026-55225](https://insights.sbomify.com/CVE-2026-55225/): Strimzi: Cross-namespace privilege escalation via `Kafka.spec.entityOperator` (high 8.0)
- [CVE-2026-55224](https://insights.sbomify.com/CVE-2026-55224/): MineAdmin: Path Traversal via Unsanitized identifier in Plugin Install/Uninstall (high 8.7)
- [CVE-2026-55223](https://insights.sbomify.com/CVE-2026-55223/): c3p0 exposes a deserialization "sink" via JDBC DataSource bean properties (medium 6.3)
- [CVE-2026-55222](https://insights.sbomify.com/CVE-2026-55222/): Isar: Unprivileged user ownership of trusted repository GPG public keys storage after bootstrap (medium 5.1)
- [CVE-2026-55221](https://insights.sbomify.com/CVE-2026-55221/): Boruta: OAuth credentials exposed in Boruta business logs (medium 6.5)
- [CVE-2026-55220](https://insights.sbomify.com/CVE-2026-55220/): Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (critical 9.3)
- [CVE-2026-5522](https://insights.sbomify.com/CVE-2026-5522/): QRadar contains hard-coded credentials (medium 6.7)
- [CVE-2026-55219](https://insights.sbomify.com/CVE-2026-55219/): Paymenter: Race condition in payWithCredit() enables credit double-spend (medium 5.3)
- [CVE-2026-55217](https://insights.sbomify.com/CVE-2026-55217/): GLPI: Unallowed modfication of knowbase items comments and translations (medium 5.3)
- [CVE-2026-55215](https://insights.sbomify.com/CVE-2026-55215/): MariaDB Connector/Node.js: Connector leaks the cleartext password to an MitM despite `ssl: true` (high 7.5)
- [CVE-2026-55214](https://insights.sbomify.com/CVE-2026-55214/): GLPI: Stored XSS in suppliers (high 8.5)
- [CVE-2026-55213](https://insights.sbomify.com/CVE-2026-55213/): h2o: musl libc stack overflow (QPACK) (high 7.5)
- [CVE-2026-55212](https://insights.sbomify.com/CVE-2026-55212/): Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation (high 7.1)
- [CVE-2026-55211](https://insights.sbomify.com/CVE-2026-55211/): surfio IRAP header size fields cause out-of-bounds reads (critical 9.8)
- [CVE-2026-55210](https://insights.sbomify.com/CVE-2026-55210/): Joplin: SAML SSO account takeover via email-based account linking (missing is_external check in ssoLogin) (high 7.4)
- [CVE-2026-55209](https://insights.sbomify.com/CVE-2026-55209/): resdata insufficiently validates untrusted GRDECL files (critical 9.8)
- [CVE-2026-55208](https://insights.sbomify.com/CVE-2026-55208/): Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashes (high 7.7)
- [CVE-2026-55207](https://insights.sbomify.com/CVE-2026-55207/): Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass (high 8.8)
- [CVE-2026-55206](https://insights.sbomify.com/CVE-2026-55206/): py7zr: O(n^2) algorithmic complexity DoS in PackInfo._read() (high 8.7)
- [CVE-2026-55205](https://insights.sbomify.com/CVE-2026-55205/): Hermes WebUI < 0.51.468 - Resource Exhaustion via Unauthenticated OAuth Flow Endpoint (medium 6.9)
- [CVE-2026-55204](https://insights.sbomify.com/CVE-2026-55204/): HAProxy - NULL Pointer Dereference in hpack_dht_insert Function (high 8.7)
- [CVE-2026-55203](https://insights.sbomify.com/CVE-2026-55203/): HAProxy - Integer Overflow in FCGI Demux Record Length Field (critical 9.0)
- [CVE-2026-55202](https://insights.sbomify.com/CVE-2026-55202/): Tinyproxy - Stathost Detection Bypass via Host Header Manipulation (high 8.8)
- [CVE-2026-55201](https://insights.sbomify.com/CVE-2026-55201/): Evil-WinRM - Path Traversal in download_dir() Function (high 7.4)
- [CVE-2026-55200](https://insights.sbomify.com/CVE-2026-55200/): libssh2 - Out-of-Bounds Write via Unchecked packet_length in transport.c (critical 9.2)
- [CVE-2026-55199](https://insights.sbomify.com/CVE-2026-55199/): libssh2 - Pre-Authentication DoS via SSH_MSG_EXT_INFO Handler (high 8.2)
- [CVE-2026-55198](https://insights.sbomify.com/CVE-2026-55198/): Hermes WebUI < 0.51.443 - Cross-Profile Session Data Exfiltration via Session Export Endpoint (high 7.1)
- [CVE-2026-55197](https://insights.sbomify.com/CVE-2026-55197/): Hermes WebUI < 0.51.443 - Broken Access Control in /api/session Endpoint (high 7.1)
- [CVE-2026-55196](https://insights.sbomify.com/CVE-2026-55196/): Hermes WebUI < 0.51.409 - Unauthenticated Passkey Registration via Authentication Bypass (critical 9.1)
- [CVE-2026-55195](https://insights.sbomify.com/CVE-2026-55195/): py7zr: Decompression bomb (zip bomb) denial of service via unchecked extraction size (high 8.7)
- [CVE-2026-55194](https://insights.sbomify.com/CVE-2026-55194/): FreeRDPHeap-buffer-overflow write in TS Gateway RPC RESPONSE reassembly due to alloc_hint capacity mismatch (high 8.7)
- [CVE-2026-55193](https://insights.sbomify.com/CVE-2026-55193/): FreeRDP: Heap-buffer-overflow write in TS Gateway RPC fragment receive due to uncapped bind_ack max_xmit_frag (high 8.7)
- [CVE-2026-55192](https://insights.sbomify.com/CVE-2026-55192/): FreeRDP: Out-of-bounds read in H.264 YUV-to-RGB conversion due to decoder/surface dimension mismatch (high 7.2)
- [CVE-2026-55191](https://insights.sbomify.com/CVE-2026-55191/): FreeRDP: Heap-buffer-overflow write in AVC444 YUV buffer allocation (high 8.7)
- [CVE-2026-55190](https://insights.sbomify.com/CVE-2026-55190/): Server-side request forgery in eventschedule (medium 6.5)
- [CVE-2026-55189](https://insights.sbomify.com/CVE-2026-55189/): RustFS: FTP frontend skips IAM authorization on object reads (high 7.7)
- [CVE-2026-55188](https://insights.sbomify.com/CVE-2026-55188/): RustFS: ListRemoteTargetHandler authorization bypass leaks replication target credentials (high 8.2)
- [CVE-2026-55187](https://insights.sbomify.com/CVE-2026-55187/): Mailpit: Incomplete SSRF protection in Link Check API via IPv6 transition mechanisms (follow-up to CVE-2026-27808) (medium 5.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/544/