# Vulnerabilities published in 2026


- [CVE-2026-54714](https://insights.sbomify.com/CVE-2026-54714/): Logto: XSS via unescaped RelayState in SAML auto-submit form (medium 6.1)
- [CVE-2026-54713](https://insights.sbomify.com/CVE-2026-54713/): CakePHP Queue: Incomplete Comparison in getUniqueId vulnerable to collisions (low 3.7)
- [CVE-2026-54712](https://insights.sbomify.com/CVE-2026-54712/): OpenTelemetry Javaagent RMI context propagation allows resource exhaustion (medium 5.3)
- [CVE-2026-54711](https://insights.sbomify.com/CVE-2026-54711/): PGHoard: Password written to debug log (low 2.4)
- [CVE-2026-54710](https://insights.sbomify.com/CVE-2026-54710/): FreePBX: Authenticated Superfecta Arbitrary PHP Code Execution (RCE via Unsafe File Inclusion) (high 8.6)
- [CVE-2026-5471](https://insights.sbomify.com/CVE-2026-5471/): Investory Toy Planet Trouble App app.investory.toyfactory google-services-desktop.json hard-coded key (medium 4.8)
- [CVE-2026-54708](https://insights.sbomify.com/CVE-2026-54708/): Authenticated Remote Code Execution via Path Traversal in FreePBX Backup Module (high 8.6)
- [CVE-2026-54707](https://insights.sbomify.com/CVE-2026-54707/): OnionShare Receive mode writes uploaded files even when file uploads are disabled (medium 5.4)
- [CVE-2026-54706](https://insights.sbomify.com/CVE-2026-54706/): OnionShare follows symlinks in shared directories, allowing unintended disclosure of local files (medium 4.8)
- [CVE-2026-54705](https://insights.sbomify.com/CVE-2026-54705/): mathlive's Lack of Escaping of HTML allows for XSS (medium 6.3)
- [CVE-2026-54704](https://insights.sbomify.com/CVE-2026-54704/): OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords (medium 6.5)
- [CVE-2026-54703](https://insights.sbomify.com/CVE-2026-54703/): Markdown Preview Enhanced: Arbitrary File Write via updateMarkdown Command Without Path Validation (medium 5.8)
- [CVE-2026-54702](https://insights.sbomify.com/CVE-2026-54702/): Markdown Preview Enhanced: Blind Command Dispatch via Unvalidated Webview Message Handler (high 7.3)
- [CVE-2026-54701](https://insights.sbomify.com/CVE-2026-54701/): Markdown Preview Enhanced: Stored XSS via Unsanitized `.crossnote/head.html` Injection in Webview (medium 6.9)
- [CVE-2026-54700](https://insights.sbomify.com/CVE-2026-54700/): ConnectBot SSH: Unbounded SSH field lengths can cause excessive memory allocation (medium 6.9)
- [CVE-2026-5470](https://insights.sbomify.com/CVE-2026-5470/): Server-side request forgery in Google-Research-MCP (medium 5.3)
- [CVE-2026-54699](https://insights.sbomify.com/CVE-2026-54699/): Warp: OS command injection when opening terminal links from WSL (high 7.7)
- [CVE-2026-54698](https://insights.sbomify.com/CVE-2026-54698/): Hasura: Row-level authorization bypass on table computed fields (medium 6.0)
- [CVE-2026-54697](https://insights.sbomify.com/CVE-2026-54697/): ConnectBot SSH: Excessive allocation and integer overflow in DER private-key parsing (medium 6.7)
- [CVE-2026-54696](https://insights.sbomify.com/CVE-2026-54696/): Ruby JSON: JSON generator heap buffer overflow when streaming to an IO (low 3.7)
- [CVE-2026-54695](https://insights.sbomify.com/CVE-2026-54695/): Pipecat: Telephony WebSocket `/ws` Unauthenticated Call-Control Abuse via Attacker-Supplied Call SID (high 7.5)
- [CVE-2026-54694](https://insights.sbomify.com/CVE-2026-54694/): NationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account Takeover (critical 9.6)
- [CVE-2026-54693](https://insights.sbomify.com/CVE-2026-54693/): ZITADEL Users Can Self-Verify Email/Phone via API (high 8.2)
- [CVE-2026-54692](https://insights.sbomify.com/CVE-2026-54692/): SAIL: XBM X10 decoder writes 2 bytes per literal into a 1-byte-per-literal buffer (heap out-of-bounds write) (high 7.8)
- [CVE-2026-54691](https://insights.sbomify.com/CVE-2026-54691/): datamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirects (high 8.2)
- [CVE-2026-54690](https://insights.sbomify.com/CVE-2026-54690/): datamodel-code-generator vulnerable to SSRF via JSON-Schema `$ref` to HTTP URL (silent by default) (high 8.2)
- [CVE-2026-5469](https://insights.sbomify.com/CVE-2026-5469/): Casdoor Webhook URL server-side request forgery (medium 5.1)
- [CVE-2026-54689](https://insights.sbomify.com/CVE-2026-54689/): mcp-searxng hardened-mode SSRF bypasses permit internal URL access (medium 6.3)
- [CVE-2026-54688](https://insights.sbomify.com/CVE-2026-54688/): mcp-searxng: SSRF in web_url_read: the internal-address guard is disabled by default (MCP_HTTP_HARDEN off) (medium 6.5)
- [CVE-2026-54687](https://insights.sbomify.com/CVE-2026-54687/): n8n-nodes-sqlite3: Path traversal via user-controlled database file path (db_path parameter) (medium 6.1)
- [CVE-2026-54686](https://insights.sbomify.com/CVE-2026-54686/): Warp: DCS lifecycle hook spoofing can alter terminal session metadata (medium 4.3)
- [CVE-2026-54685](https://insights.sbomify.com/CVE-2026-54685/): FileBrowser Quantum has Username Enumeration via Authentication Timing Side-Channel (medium 5.3)
- [CVE-2026-54684](https://insights.sbomify.com/CVE-2026-54684/): Path traversal in jadx (high 7.0)
- [CVE-2026-54683](https://insights.sbomify.com/CVE-2026-54683/): NL Portal Backend Libraries: Document contents remained downloadable by any logged-in user (incomplete fix of CVE-2026-49463) (medium 6.5)
- [CVE-2026-54682](https://insights.sbomify.com/CVE-2026-54682/): DiscordChatExporter: Stored XSS in HTML export when markdown formatting is disabled (high 8.2)
- [CVE-2026-54681](https://insights.sbomify.com/CVE-2026-54681/): DiscordChatExporter: HTML attribute injection via unescaped emoji name in HTML export (medium 4.1)
- [CVE-2026-54680](https://insights.sbomify.com/CVE-2026-54680/): Logging operator has Fluentd configuration injection that allows remote code execution (critical 9.9)
- [CVE-2026-5468](https://insights.sbomify.com/CVE-2026-5468/): Casdoor dangerouslySetInnerHTML cross site scripting (medium 5.1)
- [CVE-2026-54679](https://insights.sbomify.com/CVE-2026-54679/): jq: potential integer overflow in jvp_string_append (medium 6.9)
- [CVE-2026-54677](https://insights.sbomify.com/CVE-2026-54677/): Scoold: Authenticated user can post replies and comments to private-space questions without space membership (medium 6.5)
- [CVE-2026-54676](https://insights.sbomify.com/CVE-2026-54676/): Scoold: GET /api/posts/{id}/answers leaks private-space replies when personal API tokens are enabled (medium 6.5)
- [CVE-2026-54675](https://insights.sbomify.com/CVE-2026-54675/): FreePBX: Authenticated Remote Code Execution via File Upload and Convert in Soundlang Module (high 8.7)
- [CVE-2026-54674](https://insights.sbomify.com/CVE-2026-54674/): Authenticated Command Injection in FreePBX UCP Interface (high 8.6)
- [CVE-2026-54673](https://insights.sbomify.com/CVE-2026-54673/): electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime` (high 8.2)
- [CVE-2026-54672](https://insights.sbomify.com/CVE-2026-54672/): electron-updater: Uncontrolled search path elements within `AppImage` built by `app-builder-lib` (high 7.8)
- [CVE-2026-54671](https://insights.sbomify.com/CVE-2026-54671/): WeGIA: Authorization Bypass via Empty Resource Array in InternoControle (high 8.8)
- [CVE-2026-54670](https://insights.sbomify.com/CVE-2026-54670/): WeGIA: Unauthenticated Auth Bypass + Local File Inclusion (critical 9.1)
- [CVE-2026-5467](https://insights.sbomify.com/CVE-2026-5467/): Casdoor OAuth Authorization Request redirect (medium 5.3)
- [CVE-2026-54668](https://insights.sbomify.com/CVE-2026-54668/): XML external entity in kitodo-production (high 8.7)
- [CVE-2026-54666](https://insights.sbomify.com/CVE-2026-54666/): swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies (high 8.3)
- [CVE-2026-54665](https://insights.sbomify.com/CVE-2026-54665/): Apache NiFi: Missing Validation for Proxy Host Headers (medium 6.3)
- [CVE-2026-54664](https://insights.sbomify.com/CVE-2026-54664/): swagger-typescript-api vulnerable to code injection via unescaped enum string values (high 8.3)
- [CVE-2026-54663](https://insights.sbomify.com/CVE-2026-54663/): swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref` (medium 6.1)
- [CVE-2026-54662](https://insights.sbomify.com/CVE-2026-54662/): swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template (high 8.3)
- [CVE-2026-54661](https://insights.sbomify.com/CVE-2026-54661/): swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client template (high 8.3)
- [CVE-2026-54660](https://insights.sbomify.com/CVE-2026-54660/): swagger-typescript-api vulnerable to authorization-token exfiltration via spec `$ref` (high 7.4)
- [CVE-2026-5466](https://insights.sbomify.com/CVE-2026-5466/): wc_VerifyEccsiHash missing sanity check (high 7.6)
- [CVE-2026-54659](https://insights.sbomify.com/CVE-2026-54659/): Pagy I18n locale option is not validated before being used in a file path (medium 6.9)
- [CVE-2026-54658](https://insights.sbomify.com/CVE-2026-54658/): @hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution (critical 9.8)
- [CVE-2026-54657](https://insights.sbomify.com/CVE-2026-54657/): Missing authorization in open-zaak (medium 6.5)
- [CVE-2026-54656](https://insights.sbomify.com/CVE-2026-54656/): `datamodel-code-generator` vulnerable to code execution on import via unescaped `validators` entries in --extra-template-data (high 7.8)
- [CVE-2026-54655](https://insights.sbomify.com/CVE-2026-54655/): `datamodel-code-generator` vulnerable to code execution on import via `x-python-type` JSON-Schema extension in datamodel-code-generator (high 7.8)
- [CVE-2026-54654](https://insights.sbomify.com/CVE-2026-54654/): `datamodel-code-generator` vulnerable to code injection via unescaped carriage return in `--extra-template-data` `comment` field (high 7.8)
- [CVE-2026-54653](https://insights.sbomify.com/CVE-2026-54653/): `datamodel-code-generator` vulnerable to code injection in via attacker-controlled `default_factory` schema field (high 8.8)
- [CVE-2026-54652](https://insights.sbomify.com/CVE-2026-54652/): Frigate viewer can read logs exposing admin and camera credentials (high 8.1)
- [CVE-2026-54651](https://insights.sbomify.com/CVE-2026-54651/): pypdf: Possible infinite loop when processing threads/articles in writer (medium 6.9)
- [CVE-2026-54650](https://insights.sbomify.com/CVE-2026-54650/): openhole-server vulnerable to path traversal via URL-decoded request path (high 8.6)
- [CVE-2026-5465](https://insights.sbomify.com/CVE-2026-5465/): Privilege escalation in Booking for Appointments and Events Calendar – Amelia (high 8.8)
- [CVE-2026-54649](https://insights.sbomify.com/CVE-2026-54649/): Information disclosure in punchin-email (low 2.1)
- [CVE-2026-54648](https://insights.sbomify.com/CVE-2026-54648/): CubeCart: Missing Authorization Check in customers.gdpr.inc.php Leads to Unauthorized Customer Data Deletion (medium 6.5)
- [CVE-2026-54647](https://insights.sbomify.com/CVE-2026-54647/): CubeCart : SQL Injection via download_expire Parameter in settings.index.inc.php (high 7.2)
- [CVE-2026-54646](https://insights.sbomify.com/CVE-2026-54646/): CubeCart: SQL Identifier Injection via Backtick Bypass in maintenance.index.inc.php (high 7.2)
- [CVE-2026-54645](https://insights.sbomify.com/CVE-2026-54645/): CubeCart: Stored XSS in Product Description Editor via Global Sanitizer Bypass (medium 4.8)
- [CVE-2026-54644](https://insights.sbomify.com/CVE-2026-54644/): CubeCart: XSS via Anchor Tag Attribute Injection in gui.class.php Message System (medium 6.1)
- [CVE-2026-54643](https://insights.sbomify.com/CVE-2026-54643/): CubeCart: Missing Authorization Check for Order Note Deletion in orders.index.inc.php (medium 5.4)
- [CVE-2026-54642](https://insights.sbomify.com/CVE-2026-54642/): CubeCart: CSRF Protection Missing for Download Resets and Card Deletions in orders.index.inc.php (medium 5.3)
- [CVE-2026-54641](https://insights.sbomify.com/CVE-2026-54641/): OpenRemote: Cross-Realm User Information Disclosure in UserResourceImpl (high 7.7)
- [CVE-2026-54640](https://insights.sbomify.com/CVE-2026-54640/): OpenRemote: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory (high 7.6)
- [CVE-2026-5464](https://insights.sbomify.com/CVE-2026-5464/): Missing authorization in ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin) (high 7.2)
- [CVE-2026-54639](https://insights.sbomify.com/CVE-2026-54639/): Style Dictionary - Prototype Pollution in convertTokenData utility function (high 8.8)
- [CVE-2026-54638](https://insights.sbomify.com/CVE-2026-54638/): td has pre-auth denial of service via unbounded memory allocation in proto.UnencryptedMessage.Decode (high 7.5)
- [CVE-2026-54637](https://insights.sbomify.com/CVE-2026-54637/): Dragonfly scheduler v1 gRPC unauthenticated SSRF via attacker-controlled PeerHost in DownloadTinyFile (medium 5.5)
- [CVE-2026-54636](https://insights.sbomify.com/CVE-2026-54636/): Dokku: OS Command Injection via app.json managed Cron (critical 9.0)
- [CVE-2026-54635](https://insights.sbomify.com/CVE-2026-54635/): pytonapi has a Webhook Custom Path Authentication Bypass (high 7.5)
- [CVE-2026-54634](https://insights.sbomify.com/CVE-2026-54634/): Hamlib: rigctld `send_raw` Stack Out-of-Bounds Write and Uninitialized Memory Disclosure (high 7.3)
- [CVE-2026-54633](https://insights.sbomify.com/CVE-2026-54633/): PoDoFo: Heap Out-of-Bounds Read in Indexed Color Space Image Decoding (FetchScanLine) (medium 6.9)
- [CVE-2026-54632](https://insights.sbomify.com/CVE-2026-54632/): SIPSorcery: Malformed UDP packet on the RTP/ICE socket can remotely terminate a media session (DoS) (high 7.5)
- [CVE-2026-54631](https://insights.sbomify.com/CVE-2026-54631/): Part-DB: Hardcoded APP_SECRET enables forged remember-me cookie (medium 6.3)
- [CVE-2026-54630](https://insights.sbomify.com/CVE-2026-54630/): Part-DB: Authenticated RCE via .phar attachment upload served from public/media (critical 9.6)
- [CVE-2026-5463](https://insights.sbomify.com/CVE-2026-5463/): pymetasploit3 - Command Injection via Newline Injection in console.run_module_with_output() (critical 9.3)
- [CVE-2026-54629](https://insights.sbomify.com/CVE-2026-54629/): Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Mode (high 7.5)
- [CVE-2026-54628](https://insights.sbomify.com/CVE-2026-54628/): Anyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server Mode (high 8.6)
- [CVE-2026-54627](https://insights.sbomify.com/CVE-2026-54627/): SAIL: Heap out-of-bounds write in SAIL PSD decoder (Bitmap mode ignores depth) (critical 9.8)
- [CVE-2026-54626](https://insights.sbomify.com/CVE-2026-54626/): SAIL: Heap out-of-bounds write in SAIL TGA decoder (indexed-RLE bpp/stride mismatch) (critical 9.8)
- [CVE-2026-54625](https://insights.sbomify.com/CVE-2026-54625/): django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning) (medium 4.8)
- [CVE-2026-54624](https://insights.sbomify.com/CVE-2026-54624/): django CMS: Structure endpoint bypasses page-view permission (medium 6.5)
- [CVE-2026-54623](https://insights.sbomify.com/CVE-2026-54623/): django CMS: Plugin move endpoint allows cyclic reparenting (DoS) (high 7.1)
- [CVE-2026-54622](https://insights.sbomify.com/CVE-2026-54622/): django CMS: Clipboard copy IDOR discloses unauthorized plugin content (medium 6.5)
- [CVE-2026-54621](https://insights.sbomify.com/CVE-2026-54621/): `datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union description (high 7.8)
- [CVE-2026-54620](https://insights.sbomify.com/CVE-2026-54620/): sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks (low 2.0)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/549/