# Vulnerabilities published in 2026


- [CVE-2026-5462](https://insights.sbomify.com/CVE-2026-5462/): Wahoo Fitness SYSTM App com.WahooFitness.SYSTM BuildConfig.java hard-coded key (medium 4.8)
- [CVE-2026-54619](https://insights.sbomify.com/CVE-2026-54619/): sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different Arity (low 2.0)
- [CVE-2026-54618](https://insights.sbomify.com/CVE-2026-54618/): Obsidian Web MCP: Unauthenticated vault access: /oauth/authorize auto-approves without authenticating the user (critical 9.4)
- [CVE-2026-54617](https://insights.sbomify.com/CVE-2026-54617/): GravitLauncher: Unauthenticated path traversal in LaunchServer FileServerHandler (critical 9.8)
- [CVE-2026-54616](https://insights.sbomify.com/CVE-2026-54616/): NanaZip: Heap out-of-bounds read in NanaZip SquashFS LZ4 decompressor via unchecked negative return value (high 7.1)
- [CVE-2026-54615](https://insights.sbomify.com/CVE-2026-54615/): Cross-site scripting in Part-DB-server (medium 6.0)
- [CVE-2026-54614](https://insights.sbomify.com/CVE-2026-54614/): DebugKit: MailPreview contains unsafe reflection (medium 4.3)
- [CVE-2026-54613](https://insights.sbomify.com/CVE-2026-54613/): Vvveb: Path Traversal in Revision Backup Reader/Deleter via Unsanitized theme Parameter (medium 5.4)
- [CVE-2026-54612](https://insights.sbomify.com/CVE-2026-54612/): Vvveb: Authenticated editor path traversal to PHP file write/RCE via data-v-save-global (high 8.8)
- [CVE-2026-54611](https://insights.sbomify.com/CVE-2026-54611/): InstantCMS has Remote Code Execution in package installer (medium 5.5)
- [CVE-2026-54609](https://insights.sbomify.com/CVE-2026-54609/): QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding (high 8.6)
- [CVE-2026-54608](https://insights.sbomify.com/CVE-2026-54608/): MythicalDash: Unauthenticated payment bypass in Stripe success-redirect endpoint allows arbitrary free credit top-up (high 7.1)
- [CVE-2026-54607](https://insights.sbomify.com/CVE-2026-54607/): FastGPT: SSRF in HTTP-tool OpenAPI schema importer via SwaggerParser $ref (bypasses the isInternalAddress guard) (high 7.7)
- [CVE-2026-54606](https://insights.sbomify.com/CVE-2026-54606/): SunEditor: DOM XSS in SunEditor Embed Plugin via External Script Element After Iframe Embed (high 8.5)
- [CVE-2026-54605](https://insights.sbomify.com/CVE-2026-54605/): OAuth: Cross-origin token-request redirects can expose signed request metadata (high 7.2)
- [CVE-2026-54604](https://insights.sbomify.com/CVE-2026-54604/): OpenSlide: openslide_read_region() returns uninitialized memory with libtiff 4.7.1 (medium 5.3)
- [CVE-2026-54603](https://insights.sbomify.com/CVE-2026-54603/): OAuth2::Client#request: Protocol-relative redirect Location overrides authority, leaking bearer Authorization to attacker host (high 8.6)
- [CVE-2026-54602](https://insights.sbomify.com/CVE-2026-54602/): FastGPT: Cross-team LLM request/response disclosure (IDOR) via /api/core/ai/record/getRecord (high 7.1)
- [CVE-2026-54601](https://insights.sbomify.com/CVE-2026-54601/): FastGPT: reTrainingCollection allows server-owned datasetId override causing cross-tenant authorization confusion (medium 6.3)
- [CVE-2026-54600](https://insights.sbomify.com/CVE-2026-54600/): Wallos: Unauthenticated database replacement via import endpoint on fresh install (high 8.2)
- [CVE-2026-5460](https://insights.sbomify.com/CVE-2026-5460/): Heap Use-After-Free in PQC Hybrid KeyShare Error Cleanup in wolfSSL TLS 1.3 (medium 6.3)
- [CVE-2026-54599](https://insights.sbomify.com/CVE-2026-54599/): Wallos: OIDC state parameter never validated — login CSRF / account takeover (high 7.5)
- [CVE-2026-54598](https://insights.sbomify.com/CVE-2026-54598/): Missing Authentication for Critical Function in wallos (high 7.5)
- [CVE-2026-54597](https://insights.sbomify.com/CVE-2026-54597/): ITFlow: Authenticated Time-Based Blind SQL Injection in ITFlow via expires Parameter (high 8.3)
- [CVE-2026-54596](https://insights.sbomify.com/CVE-2026-54596/): ITFlow: Authenticated SQL Injection via recurring_invoice_frequency Parameter Enables Full Database Exfiltration (high 8.1)
- [CVE-2026-54594](https://insights.sbomify.com/CVE-2026-54594/): OmniBlocks: Spamming in Discussions tab possible via disc.yml (medium 5.3)
- [CVE-2026-54593](https://insights.sbomify.com/CVE-2026-54593/): Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions (high 8.1)
- [CVE-2026-54592](https://insights.sbomify.com/CVE-2026-54592/): Oj: Stack Buffer Overflow in Oj::Doc#each_child via Deeply Nested Input (high 7.5)
- [CVE-2026-54591](https://insights.sbomify.com/CVE-2026-54591/): AsyncSSH: SCP Path Traversal to Arbitrary File Write (high 8.1)
- [CVE-2026-54590](https://insights.sbomify.com/CVE-2026-54590/): AsyncSSH AuthorizedKeysFile username substitution bypass through ~ and environment expansion (medium 5.9)
- [CVE-2026-5459](https://insights.sbomify.com/CVE-2026-5459/): Missing authorization in User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration (medium 5.3)
- [CVE-2026-54588](https://insights.sbomify.com/CVE-2026-54588/): Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction. (critical 9.6)
- [CVE-2026-54587](https://insights.sbomify.com/CVE-2026-54587/): mport directory asset installation is vulnerable to symlink and path traversal races (medium 5.8)
- [CVE-2026-54586](https://insights.sbomify.com/CVE-2026-54586/): mport permits repository and package mirror fetches over insecure transport (medium 6.0)
- [CVE-2026-54585](https://insights.sbomify.com/CVE-2026-54585/): mport sample file handling can write outside the configured root (medium 6.0)
- [CVE-2026-54584](https://insights.sbomify.com/CVE-2026-54584/): mport trusts environment-controlled temporary directories in privileged metadata extraction (medium 5.3)
- [CVE-2026-54583](https://insights.sbomify.com/CVE-2026-54583/): mport package bundle downloads allow unsafe destination filenames (high 8.3)
- [CVE-2026-54582](https://insights.sbomify.com/CVE-2026-54582/): mport package installation can overwrite existing unmanaged or differently owned files (medium 6.0)
- [CVE-2026-54581](https://insights.sbomify.com/CVE-2026-54581/): mport bootstrap index fetch can continue after hash verification failure (high 8.3)
- [CVE-2026-54580](https://insights.sbomify.com/CVE-2026-54580/): mport index decompression can leave partial or corrupt index data after zstd failures (high 8.3)
- [CVE-2026-5458](https://insights.sbomify.com/CVE-2026-5458/): Noelse Individuals & Pro App com.afone.noelse BuildConfig.java hard-coded key (medium 4.8)
- [CVE-2026-54579](https://insights.sbomify.com/CVE-2026-54579/): mport mirror-selection ping accepts insufficiently validated ICMP replies (low 2.3)
- [CVE-2026-54578](https://insights.sbomify.com/CVE-2026-54578/): mport verify can compare stale checksum data after hashing failures (low 2.0)
- [CVE-2026-54577](https://insights.sbomify.com/CVE-2026-54577/): mport audit can inspect the wrong package when options are present (low 2.0)
- [CVE-2026-54576](https://insights.sbomify.com/CVE-2026-54576/): mport package installation has symlink TOCTOU in chown and chmod handling (medium 5.8)
- [CVE-2026-54575](https://insights.sbomify.com/CVE-2026-54575/): mport package fetch and clean paths are vulnerable to TOCTOU filesystem races (medium 5.8)
- [CVE-2026-54574](https://insights.sbomify.com/CVE-2026-54574/): `proot-distro install` has a Symlink Escape (Arbitrary Host File Write) via Malicious Tar Archive (high 8.2)
- [CVE-2026-54573](https://insights.sbomify.com/CVE-2026-54573/): Authorization Bypass in API Key/OAuth Scopes via Path Parsing Discrepancy (medium 5.3)
- [CVE-2026-54572](https://insights.sbomify.com/CVE-2026-54572/): rclone: Unvalidated symlink target in local `--links` — arbitrary file write from an untrusted remote (high 7.5)
- [CVE-2026-54571](https://insights.sbomify.com/CVE-2026-54571/): ESPAsyncWebServer: Integer overflow in multipart boundary parser causes denial of service (high 8.7)
- [CVE-2026-54570](https://insights.sbomify.com/CVE-2026-54570/): AngleSharp: HTML5 Spec Compliance: mXSS via annotation-xml HTML Integration Point Bypass (medium 6.9)
- [CVE-2026-5457](https://insights.sbomify.com/CVE-2026-5457/): PropertyGuru AgentNet Singapore App com.allproperty.android.agentnet BuildConfig.java hard-coded key (medium 4.8)
- [CVE-2026-54569](https://insights.sbomify.com/CVE-2026-54569/): senaite.core Vulnerable to Eval Injection and Missing Authorization (critical 9.8)
- [CVE-2026-54568](https://insights.sbomify.com/CVE-2026-54568/): Microsoft UFO: Missing Authorization in DEVICE_INFO_REQUEST Allows a DEVICE Client to Read Another Device's system_info (medium 4.3)
- [CVE-2026-54567](https://insights.sbomify.com/CVE-2026-54567/): Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641) (high 7.5)
- [CVE-2026-54566](https://insights.sbomify.com/CVE-2026-54566/): Code injection in vscode-markdown-preview-enhanced (high 8.5)
- [CVE-2026-54565](https://insights.sbomify.com/CVE-2026-54565/): rhwp browser extension performs SSRF / private-network requests and leaks HWP preview data to untrusted pages (medium 4.7)
- [CVE-2026-54563](https://insights.sbomify.com/CVE-2026-54563/): Cloudreve WebDAV (`/dav`) has Path Traversal / Broken Access Control — scoped DAV credential escapes its configured account root (high 7.1)
- [CVE-2026-54562](https://insights.sbomify.com/CVE-2026-54562/): Cloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responses (medium 6.5)
- [CVE-2026-54561](https://insights.sbomify.com/CVE-2026-54561/): MCP Memory Keeper: Arbitrary local file read in mcp-memory-keeper context_import via unvalidated filePath (medium 6.2)
- [CVE-2026-54560](https://insights.sbomify.com/CVE-2026-54560/): Cloudreve: OAuth access tokens bypass scope enforcement due to missing client_id claim (high 7.6)
- [CVE-2026-5456](https://insights.sbomify.com/CVE-2026-5456/): Align Technology My Invisalign App com.aligntech.myinvisalign.emea BuildConfig.java hard-coded key (medium 4.8)
- [CVE-2026-54559](https://insights.sbomify.com/CVE-2026-54559/): PocketSphinx: Buffer overflows in language and acoustic model loading code (medium 6.9)
- [CVE-2026-54557](https://insights.sbomify.com/CVE-2026-54557/): mise HTTP backend uses raw version path for install symlink destination (medium 5.5)
- [CVE-2026-54556](https://insights.sbomify.com/CVE-2026-54556/): Http4s: HTTP/2 Denial of Service with Ember Backend (high 8.2)
- [CVE-2026-54555](https://insights.sbomify.com/CVE-2026-54555/): rtk: Permission-gate bypass in rtk rewrite auto-allow via unsplit shell separators (high 7.8)
- [CVE-2026-54554](https://insights.sbomify.com/CVE-2026-54554/): FOG adInfo endpoint is reported to disclose the Active Directory join password (high 7.5)
- [CVE-2026-54553](https://insights.sbomify.com/CVE-2026-54553/): Starlette-Admin's unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS (medium 5.4)
- [CVE-2026-54552](https://insights.sbomify.com/CVE-2026-54552/): sh _uid does not drop supplementary groups (incomplete privilege drop) (high 7.9)
- [CVE-2026-54551](https://insights.sbomify.com/CVE-2026-54551/): Missing authorization in wg-portal (medium 4.3)
- [CVE-2026-54550](https://insights.sbomify.com/CVE-2026-54550/): IzPack has Path Traversal in UnpackerBase that allows writing files outside the installation directory via malicious pack entries (high 7.4)
- [CVE-2026-5455](https://insights.sbomify.com/CVE-2026-5455/): Dialogue App ca.diagram.dialogue config.json hard-coded key (medium 4.8)
- [CVE-2026-54549](https://insights.sbomify.com/CVE-2026-54549/): Meta Ads MCP: Server-Side Request Forgery (SSRF) in `upload_ad_image` via Unrestricted `image_url` Fetch (high 8.3)
- [CVE-2026-54548](https://insights.sbomify.com/CVE-2026-54548/): kas: Persistent SSH Host Key Checking Disablement (low 3.3)
- [CVE-2026-54547](https://insights.sbomify.com/CVE-2026-54547/): Meta Ads MCP: X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token (high 7.4)
- [CVE-2026-54546](https://insights.sbomify.com/CVE-2026-54546/): CloudTAK: Authenticated full-read SSRF in CloudTAK basemap import (PUT /api/basemap) — no IP-classification guard (medium 5.0)
- [CVE-2026-54545](https://insights.sbomify.com/CVE-2026-54545/): @wakaru/cli arbitrary file write during bundle unpack (high 7.1)
- [CVE-2026-54544](https://insights.sbomify.com/CVE-2026-54544/): Fireshare has unauthenticated SSRF via missing login_required on webhook test endpoints (high 7.2)
- [CVE-2026-54543](https://insights.sbomify.com/CVE-2026-54543/): Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields (medium 5.4)
- [CVE-2026-54542](https://insights.sbomify.com/CVE-2026-54542/): Nimiq: Out-of-bounds panic in KeyNibbles::Add from oversized child suffix in a deserialized proof (low 3.7)
- [CVE-2026-54541](https://insights.sbomify.com/CVE-2026-54541/): Nimiq: Panic in TrieProof::verify via child_index unwrap on equal-length keys (low 3.7)
- [CVE-2026-54540](https://insights.sbomify.com/CVE-2026-54540/): Authenticated terminal command whitelist bypass in Pheditor (high 8.8)
- [CVE-2026-5454](https://insights.sbomify.com/CVE-2026-5454/): GRID Organiser App co.gridapp.organiser app.json hard-coded key (medium 4.8)
- [CVE-2026-54538](https://insights.sbomify.com/CVE-2026-54538/): xrdp: Pre-auth infinite loop via totalLength=0 in TS_SHARECONTROLHEADER (high 7.5)
- [CVE-2026-54533](https://insights.sbomify.com/CVE-2026-54533/): vantage6 node has an Improper Access Control issue (medium 6.9)
- [CVE-2026-54532](https://insights.sbomify.com/CVE-2026-54532/): CloudPirates Open Source Helm Charts: pull_request_target workflow vulnerable to cache poisoning and OIDC token theft (medium 6.9)
- [CVE-2026-54531](https://insights.sbomify.com/CVE-2026-54531/): pypdf: Possible infinite loop when processing outlines/bookmarks in writer (medium 6.9)
- [CVE-2026-54530](https://insights.sbomify.com/CVE-2026-54530/): pypdf: Possible infinite loop when retrieving fonts for layout-mode text extraction (medium 6.9)
- [CVE-2026-5453](https://insights.sbomify.com/CVE-2026-5453/): Rico só vantagem pra investir App br.com.rico.mobile SegmentSettingsModule.java hard-coded key (medium 4.8)
- [CVE-2026-54529](https://insights.sbomify.com/CVE-2026-54529/): SQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list` (medium 5.3)
- [CVE-2026-54528](https://insights.sbomify.com/CVE-2026-54528/): jupyterlab-git excluded_paths Case-Sensitivity Bypass Allows Reading Excluded Directories (high 7.1)
- [CVE-2026-54527](https://insights.sbomify.com/CVE-2026-54527/): JupyterLab Git: Stored XSS leading to RCE (critical 9.3)
- [CVE-2026-54526](https://insights.sbomify.com/CVE-2026-54526/): Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing (high 8.9)
- [CVE-2026-54525](https://insights.sbomify.com/CVE-2026-54525/): Markdown Preview Enhanced: One Click RCE via Markdown Link Command Injection on Windows (high 8.8)
- [CVE-2026-54524](https://insights.sbomify.com/CVE-2026-54524/): Frappe HR: SQL Injection in HRMS Salary Payments Based on Payment Mode Report (high 7.1)
- [CVE-2026-54523](https://insights.sbomify.com/CVE-2026-54523/): Kyverno's NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system (critical 9.6)
- [CVE-2026-54522](https://insights.sbomify.com/CVE-2026-54522/): MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure (low 2.1)
- [CVE-2026-54521](https://insights.sbomify.com/CVE-2026-54521/): FairEmail: Cross-site scripting (XSS) in AMP message rendering (ActivityAMP) (medium 6.1)
- [CVE-2026-54520](https://insights.sbomify.com/CVE-2026-54520/): AI Agent Automation: Workflow file step path traversal allows read and write outside the expected directory (high 8.1)
- [CVE-2026-5452](https://insights.sbomify.com/CVE-2026-5452/): UCC CampusConnect App campusconnect.ucc BuildConfig.java hard-coded key (medium 4.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/550/