# Vulnerabilities published in 2026


- [CVE-2026-55185](https://insights.sbomify.com/CVE-2026-55185/): Miniflux 2: Open Redirect Bypass (medium 5.1)
- [CVE-2026-55184](https://insights.sbomify.com/CVE-2026-55184/): EspoCRM: Stored XSS in wysiwyg template fields if CSP is disabled (low 3.5)
- [CVE-2026-55183](https://insights.sbomify.com/CVE-2026-55183/): RClone Manager: Unauthenticated RClone Daemon Enables Remote Attack via Malicious Web Page (critical 9.6)
- [CVE-2026-55182](https://insights.sbomify.com/CVE-2026-55182/): LibreNMS: Remote Code Execution by Signal Alert Transportation Module (high 8.6)
- [CVE-2026-55181](https://insights.sbomify.com/CVE-2026-55181/): Tugtainer: OIDC login remains accessible when OIDC_ENABLED is false (critical 9.4)
- [CVE-2026-55180](https://insights.sbomify.com/CVE-2026-55180/): pnpm: Repository config can expand victim environment secrets into registry requests before scripts run (medium 6.5)
- [CVE-2026-55179](https://insights.sbomify.com/CVE-2026-55179/): Joplin: Logic error in Joplin Server allows a signed-in user to read any note from its internal server ID (medium 6.5)
- [CVE-2026-55178](https://insights.sbomify.com/CVE-2026-55178/): GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data (high 7.5)
- [CVE-2026-55177](https://insights.sbomify.com/CVE-2026-55177/): CloudTAK: Authenticated full-read SSRF in the /api/esri* routes — user-controlled URL fetched with no IP-classification guard (high 7.6)
- [CVE-2026-55176](https://insights.sbomify.com/CVE-2026-55176/): Soft Machine: Cross-tenant workspace API auth bypass via shared `CONTAINER_SHARED_SECRET` bearer token (critical 9.0)
- [CVE-2026-55175](https://insights.sbomify.com/CVE-2026-55175/): Spinnaker: Improper yaml processing on kustomize bake operations (high 7.5)
- [CVE-2026-55174](https://insights.sbomify.com/CVE-2026-55174/): UltrafastSecp256k1: ECDSA adaptor verification accepts non-adaptable pre-signatures due to missing DLEQ binding (medium 5.9)
- [CVE-2026-55173](https://insights.sbomify.com/CVE-2026-55173/): AVideo has an incomplete fix of CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving OS command execution at the same execAsync sh -c sink (high 8.1)
- [CVE-2026-55170](https://insights.sbomify.com/CVE-2026-55170/): OpenFGA MySQL backend: case-insensitive collation on identifier columns causes incorrect authorization decisions (low 2.1)
- [CVE-2026-55168](https://insights.sbomify.com/CVE-2026-55168/): Runtipi: Authenticated arbitrary file write via backup restore symlink planting (medium 6.5)
- [CVE-2026-55167](https://insights.sbomify.com/CVE-2026-55167/): LDAP Account Manager: WebAuthn authentication challenge is kept in the PHP session (medium 4.2)
- [CVE-2026-55166](https://insights.sbomify.com/CVE-2026-55166/): Lemur: ACME SSRF + creator-equality IDOR lead to AWS IAM/PKI compromise (critical 9.9)
- [CVE-2026-55165](https://insights.sbomify.com/CVE-2026-55165/): Lemur: JWT verifier honors attacker-supplied alg, enabling ATO (medium 4.8)
- [CVE-2026-55164](https://insights.sbomify.com/CVE-2026-55164/): Lemur: Plaintext password storage in Lemur user-update path (medium 4.9)
- [CVE-2026-55163](https://insights.sbomify.com/CVE-2026-55163/): Lemur: Privilege escalation via PUT /api/1/roles/<id> — non-admin role members can rewrite role membership (medium 6.3)
- [CVE-2026-55162](https://insights.sbomify.com/CVE-2026-55162/): Lemur: Crafted CRL/OCSP URLs in uploaded certificates lead to post-authentication SSRF (medium 6.3)
- [CVE-2026-55160](https://insights.sbomify.com/CVE-2026-55160/): Authenticated Server-Side Request Forgery (SSRF) via feed URL in Stringer (high 7.6)
- [CVE-2026-5516](https://insights.sbomify.com/CVE-2026-5516/): IBM WebSphere Application Server Liberty is affected by a security bypass vulnerability (medium 4.4)
- [CVE-2026-55159](https://insights.sbomify.com/CVE-2026-55159/): Command injection in luci-app-adblock-fast (high 8.8)
- [CVE-2026-55158](https://insights.sbomify.com/CVE-2026-55158/): Conflibot: Command injection via crafted pull request branch names under pull_request_target (critical 9.1)
- [CVE-2026-55157](https://insights.sbomify.com/CVE-2026-55157/): Token Optimizer MCP: OS command injection in smart_user via username in get-user-info (high 8.4)
- [CVE-2026-55156](https://insights.sbomify.com/CVE-2026-55156/): Token Optimizer MCP: Unauthenticated Path Traversal in Dashboard Session Log API Endpoints (medium 5.3)
- [CVE-2026-55154](https://insights.sbomify.com/CVE-2026-55154/): EspoCRM: CSV/Formula Injection sanitizer bypass via leading whitespace/control characters in export (medium 5.4)
- [CVE-2026-55153](https://insights.sbomify.com/CVE-2026-55153/): mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets" (high 7.1)
- [CVE-2026-5515](https://insights.sbomify.com/CVE-2026-5515/): IBM App Connect Enterprise is vulnerable to a confidential disclosure (medium 5.5)
- [CVE-2026-55149](https://insights.sbomify.com/CVE-2026-55149/): Vouch Proxy: Unbounded Multipart Cookie Allocation DoS (high 7.5)
- [CVE-2026-55145](https://insights.sbomify.com/CVE-2026-55145/): Outlook Copilot Tampering Vulnerability (medium 6.3)
- [CVE-2026-55144](https://insights.sbomify.com/CVE-2026-55144/): Windows Cryptography API: Next Generation (CNG) Tampering Vulnerability (high 7.1)
- [CVE-2026-55142](https://insights.sbomify.com/CVE-2026-55142/): Microsoft Word Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-55141](https://insights.sbomify.com/CVE-2026-55141/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-55140](https://insights.sbomify.com/CVE-2026-55140/): Microsoft Office Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-55139](https://insights.sbomify.com/CVE-2026-55139/): Microsoft Office Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-55138](https://insights.sbomify.com/CVE-2026-55138/): Microsoft Excel Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-55137](https://insights.sbomify.com/CVE-2026-55137/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-55136](https://insights.sbomify.com/CVE-2026-55136/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-55135](https://insights.sbomify.com/CVE-2026-55135/): Microsoft SharePoint Server Spoofing Vulnerability (medium 4.6)
- [CVE-2026-55134](https://insights.sbomify.com/CVE-2026-55134/): Microsoft Word Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-55133](https://insights.sbomify.com/CVE-2026-55133/): Microsoft OneNote Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-55132](https://insights.sbomify.com/CVE-2026-55132/): Microsoft Word Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-55131](https://insights.sbomify.com/CVE-2026-55131/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-55130](https://insights.sbomify.com/CVE-2026-55130/): Microsoft Word Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-5513](https://insights.sbomify.com/CVE-2026-5513/): Cross-site scripting in Online Scheduling and Appointment Booking System – Bookly (high 7.2)
- [CVE-2026-55129](https://insights.sbomify.com/CVE-2026-55129/): Microsoft Office Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-55128](https://insights.sbomify.com/CVE-2026-55128/): Microsoft Word Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-55127](https://insights.sbomify.com/CVE-2026-55127/): Microsoft Word Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-55126](https://insights.sbomify.com/CVE-2026-55126/): Microsoft SharePoint Server Spoofing Vulnerability (high 7.3)
- [CVE-2026-55125](https://insights.sbomify.com/CVE-2026-55125/): Microsoft Office Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-55124](https://insights.sbomify.com/CVE-2026-55124/): Microsoft Word Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-55123](https://insights.sbomify.com/CVE-2026-55123/): Microsoft PowerPoint Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-55122](https://insights.sbomify.com/CVE-2026-55122/): Microsoft Excel Information Disclosure Vulnerability (high 7.1)
- [CVE-2026-55121](https://insights.sbomify.com/CVE-2026-55121/): Microsoft Office Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-55120](https://insights.sbomify.com/CVE-2026-55120/): Microsoft PowerPoint Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-5512](https://insights.sbomify.com/CVE-2026-5512/): Missing authorization in Enterprise Server (medium 5.3)
- [CVE-2026-55119](https://insights.sbomify.com/CVE-2026-55119/): Privilege escalation in UniFi Talk Application (high 8.1)
- [CVE-2026-55118](https://insights.sbomify.com/CVE-2026-55118/): Privilege escalation in UniFi Network Application (high 8.3)
- [CVE-2026-55117](https://insights.sbomify.com/CVE-2026-55117/): Path traversal in UniFi Access Application (high 8.6)
- [CVE-2026-55116](https://insights.sbomify.com/CVE-2026-55116/): Missing authorization in Cloud Gateways (critical 9.0)
- [CVE-2026-55115](https://insights.sbomify.com/CVE-2026-55115/): Server-side request forgery in UniFi Protect Application (critical 9.9)
- [CVE-2026-55114](https://insights.sbomify.com/CVE-2026-55114/): Privilege escalation in UniFi Network Application (high 8.8)
- [CVE-2026-55113](https://insights.sbomify.com/CVE-2026-55113/): Server-side request forgery in UniFi Talk Application (high 7.5)
- [CVE-2026-55112](https://insights.sbomify.com/CVE-2026-55112/): Privilege escalation in Cloud Gateways (high 7.5)
- [CVE-2026-55111](https://insights.sbomify.com/CVE-2026-55111/): Path traversal in UniFi Protect Floodlight (high 7.5)
- [CVE-2026-55110](https://insights.sbomify.com/CVE-2026-55110/): Misconfiguration in Cloud Gateways (high 7.5)
- [CVE-2026-5511](https://insights.sbomify.com/CVE-2026-5511/): Information Disclosure via Diagnostic Interface Due to Improper Input Validation on TP-Link's Archer AX72 (medium 4.6)
- [CVE-2026-55108](https://insights.sbomify.com/CVE-2026-55108/): KubeVela Terraform remote loader DoS via unbounded file read (high 8.5)
- [CVE-2026-55107](https://insights.sbomify.com/CVE-2026-55107/): Kobako Vulnerable to Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service) (critical 10.0)
- [CVE-2026-55106](https://insights.sbomify.com/CVE-2026-55106/): authentik: Unauthenticated LDAP directory data disclosure (medium 5.3)
- [CVE-2026-55105](https://insights.sbomify.com/CVE-2026-55105/): Joplin: Fountain embeds allow arbitrary script execution in published notes and the note viewer (high 7.7)
- [CVE-2026-55103](https://insights.sbomify.com/CVE-2026-55103/): Discourse ActivityPub: Fix inbound actor validation and apply outbound request SSRF hardening (high 8.6)
- [CVE-2026-55102](https://insights.sbomify.com/CVE-2026-55102/): hashi-vault-js: Vault token and secret values exposed in thrown errors (medium 5.8)
- [CVE-2026-55100](https://insights.sbomify.com/CVE-2026-55100/): hashi-vault-js has a path traversal and query parameter injection (high 8.7)
- [CVE-2026-5510](https://insights.sbomify.com/CVE-2026-5510/): GiveWP <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-55099](https://insights.sbomify.com/CVE-2026-55099/): icalendar: Algorithmic Complexity in Equality (high 7.5)
- [CVE-2026-55096](https://insights.sbomify.com/CVE-2026-55096/): SSRF via DNS-resolution gap in _validate_url_security (file download by URL) (high 7.1)
- [CVE-2026-55095](https://insights.sbomify.com/CVE-2026-55095/): OpenProject: Inplace-edit dialog exposes comments from hidden admin-only project custom fields (medium 5.3)
- [CVE-2026-55094](https://insights.sbomify.com/CVE-2026-55094/): Taskcluster: Unauthenticated remote code execution in `web-server` via GraphQL `filter` argument (sift `$where`) (high 8.7)
- [CVE-2026-55093](https://insights.sbomify.com/CVE-2026-55093/): tract-nnef: integer overflow in NNEF `.dat` tensor parser yields an out-of-bounds read on model load (medium 6.1)
- [CVE-2026-55092](https://insights.sbomify.com/CVE-2026-55092/): Trivy: Path traversal via a crafted vulnerability database or other downloaded artifacts (high 7.0)
- [CVE-2026-55091](https://insights.sbomify.com/CVE-2026-55091/): flat-to-nested: Prototype pollution in flat-to-nested convert() via __proto__ parent/id key (high 7.5)
- [CVE-2026-55090](https://insights.sbomify.com/CVE-2026-55090/): Etherpad: Stored XSS in HTML export via unescaped attribute-pool values (medium 5.3)
- [CVE-2026-5509](https://insights.sbomify.com/CVE-2026-5509/): Arbitrary Command Injection via Browser Developer Console in TP-Link Archer BE450 and BE7200 (high 8.5)
- [CVE-2026-55089](https://insights.sbomify.com/CVE-2026-55089/): Etherpad: JWT `admin` claim presence-only check lets non-admin OAuth users invoke every Etherpad HTTP API endpoint (critical 9.9)
- [CVE-2026-55088](https://insights.sbomify.com/CVE-2026-55088/): ep_etherpad-lite: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token (medium 6.8)
- [CVE-2026-55087](https://insights.sbomify.com/CVE-2026-55087/): ep_etherpad-lite: Cache-poisoning Cross-site Scripting and Open Redirect via x-proxy-path Header (medium 6.1)
- [CVE-2026-55086](https://insights.sbomify.com/CVE-2026-55086/): ep_etherpad-lite: Import/export uses Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwrite (medium 4.2)
- [CVE-2026-55085](https://insights.sbomify.com/CVE-2026-55085/): Etherpad: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in etherpad-lite (critical 9.6)
- [CVE-2026-55084](https://insights.sbomify.com/CVE-2026-55084/): SQL Injection in SqlView Filter Parameter Leading to Arbitrary Database Read (high 8.8)
- [CVE-2026-55083](https://insights.sbomify.com/CVE-2026-55083/): DHIS2: Unsafe Java Deserialization - Remote Code Execution (RCE) (critical 9.1)
- [CVE-2026-55082](https://insights.sbomify.com/CVE-2026-55082/): DHIS2 SQL injection in SQL View filter values (high 8.7)
- [CVE-2026-55081](https://insights.sbomify.com/CVE-2026-55081/): DHIS2 Reflected XSS in OpenAPI HTML scope parameter (high 7.3)
- [CVE-2026-5508](https://insights.sbomify.com/CVE-2026-5508/): WowPress <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-55079](https://insights.sbomify.com/CVE-2026-55079/): Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service (medium 4.9)
- [CVE-2026-55078](https://insights.sbomify.com/CVE-2026-55078/): Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service (medium 6.5)
- [CVE-2026-55077](https://insights.sbomify.com/CVE-2026-55077/): Coder: User-admin role can reset owner account password (high 7.2)
- [CVE-2026-55076](https://insights.sbomify.com/CVE-2026-55076/): Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking (high 7.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/545/