# Vulnerabilities published in 2026


- [CVE-2026-54408](https://insights.sbomify.com/CVE-2026-54408/): Auth bypass in UniFi Protect Application (high 8.6)
- [CVE-2026-54407](https://insights.sbomify.com/CVE-2026-54407/): Auth bypass in UniFi Protect Application (high 8.6)
- [CVE-2026-54406](https://insights.sbomify.com/CVE-2026-54406/): Path traversal in UniFi Network Application (high 8.7)
- [CVE-2026-54405](https://insights.sbomify.com/CVE-2026-54405/): Denial of service in UniFi Network Application (high 7.5)
- [CVE-2026-54404](https://insights.sbomify.com/CVE-2026-54404/): SQL injection in Cloud Gateways (high 8.8)
- [CVE-2026-54403](https://insights.sbomify.com/CVE-2026-54403/): Path traversal in Cloud Gateways (high 8.6)
- [CVE-2026-54402](https://insights.sbomify.com/CVE-2026-54402/): Command injection in Cloud Gateways (critical 9.9)
- [CVE-2026-54401](https://insights.sbomify.com/CVE-2026-54401/): Server-side request forgery in Cloud Gateways (high 7.7)
- [CVE-2026-54400](https://insights.sbomify.com/CVE-2026-54400/): Privilege escalation in UniFi Access Application (critical 9.1)
- [CVE-2026-5440](https://insights.sbomify.com/CVE-2026-5440/): Memory Exhaustion via Unbounded Content-Length (high 7.5)
- [CVE-2026-54399](https://insights.sbomify.com/CVE-2026-54399/): Apache HttpComponents Core: Unbounded HTTP Header/Line Length in Default Configuration (high 7.5)
- [CVE-2026-54398](https://insights.sbomify.com/CVE-2026-54398/): MISP object edit authorization bypass allows unauthorized sharing group assignment (medium 5.3)
- [CVE-2026-54397](https://insights.sbomify.com/CVE-2026-54397/): MISP event editing allows unauthorized assignment to undisclosed sharing groups (medium 6.1)
- [CVE-2026-54396](https://insights.sbomify.com/CVE-2026-54396/): MISP AuthKey edit endpoint allows authenticated user email enumeration (medium 5.3)
- [CVE-2026-54395](https://insights.sbomify.com/CVE-2026-54395/): MISP UiBeta event index reflected XSS in advanced filter popup (medium 5.3)
- [CVE-2026-54394](https://insights.sbomify.com/CVE-2026-54394/): MISP organisation logo path traversal allows retrieval of arbitrary PNG/SVG files (medium 5.3)
- [CVE-2026-54393](https://insights.sbomify.com/CVE-2026-54393/): MISP Overmind theme stored XSS via unvalidated homepage setting (medium 5.1)
- [CVE-2026-54390](https://insights.sbomify.com/CVE-2026-54390/): JTL Shop < 5.7.2 Server-Side Template Injection via Smarty Renderer (critical 9.3)
- [CVE-2026-5439](https://insights.sbomify.com/CVE-2026-5439/): Memory Exhaustion via Forged ZIP Metadata (high 7.5)
- [CVE-2026-54389](https://insights.sbomify.com/CVE-2026-54389/): Ghidra < 12.1.3 PDB Parser Uncontrolled Heap Growth DoS via AbstractPdb (medium 6.7)
- [CVE-2026-54388](https://insights.sbomify.com/CVE-2026-54388/): Tinyproxy - HTTP Request Smuggling via Duplicate Content-Length Headers (critical 9.3)
- [CVE-2026-54387](https://insights.sbomify.com/CVE-2026-54387/): Tinyproxy - HTTP Request Smuggling via CL/TE Desynchronization (critical 9.3)
- [CVE-2026-54386](https://insights.sbomify.com/CVE-2026-54386/): marimo < 0.23.9 XSS via file Query Parameter in assets.py (medium 5.1)
- [CVE-2026-5438](https://insights.sbomify.com/CVE-2026-5438/): Gzip Decompression Bomb via Content-Encoding Header (high 7.5)
- [CVE-2026-54371](https://insights.sbomify.com/CVE-2026-54371/): attr < 2.6.0 Symlink Traversal Privilege Escalation via getfattr/setfattr (high 8.4)
- [CVE-2026-54370](https://insights.sbomify.com/CVE-2026-54370/): acl < 2.4.0 TOCTOU Symlink Traversal via getfacl/setfacl/chacl (high 7.2)
- [CVE-2026-5437](https://insights.sbomify.com/CVE-2026-5437/): Out-of-Bounds Read in DicomStreamReader (high 7.5)
- [CVE-2026-54369](https://insights.sbomify.com/CVE-2026-54369/): acl < 2.4.0 Symlink Traversal Privilege Escalation via libacl Functions (high 8.4)
- [CVE-2026-54368](https://insights.sbomify.com/CVE-2026-54368/): CentreStack < 17.4 SQL Injection via x-glad-filter Header (high 8.7)
- [CVE-2026-54367](https://insights.sbomify.com/CVE-2026-54367/): CentreStack < 17.2 Unauthenticated API Authorization Bypass (high 8.8)
- [CVE-2026-54366](https://insights.sbomify.com/CVE-2026-54366/): CentreStack < 17.4 XXE via SharePoint Storage Configuration (high 8.7)
- [CVE-2026-54365](https://insights.sbomify.com/CVE-2026-54365/): CentreStack < 17.3 Unauthenticated User Creation via Deserialization in GSNamespace.dll (high 8.7)
- [CVE-2026-54364](https://insights.sbomify.com/CVE-2026-54364/): CentreStack < 17.4 Session Injection via SelectProvider.aspx (medium 6.9)
- [CVE-2026-54363](https://insights.sbomify.com/CVE-2026-54363/): CentreStack < 17.5 Hardcoded Key Token Forgery RCE (critical 9.3)
- [CVE-2026-54362](https://insights.sbomify.com/CVE-2026-54362/): MISP template builder exposes non-visible custom galaxies across organisations (medium 5.3)
- [CVE-2026-54361](https://insights.sbomify.com/CVE-2026-54361/): MISP mass assignment vulnerabilities allow unauthorized modification of ownership and delegation records (high 8.8)
- [CVE-2026-54360](https://insights.sbomify.com/CVE-2026-54360/): MISP sharing group creation mass assignment allows unauthorized takeover of existing sharing groups (high 8.4)
- [CVE-2026-5436](https://insights.sbomify.com/CVE-2026-5436/): MW WP Form <= 5.1.1 - Unauthenticated Arbitrary File Move via regenerate_upload_file_keys (high 8.1)
- [CVE-2026-54359](https://insights.sbomify.com/CVE-2026-54359/): MISP automation endpoints may be exposed to CSRF when Sec-Fetch-Site protection is disabled by default (high 7.1)
- [CVE-2026-54358](https://insights.sbomify.com/CVE-2026-54358/): MISP organization administrators can target site administrator accounts for password reset (high 7.5)
- [CVE-2026-54357](https://insights.sbomify.com/CVE-2026-54357/): MISP improper authorization allows organization administrators to modify site administrator user settings (medium 5.1)
- [CVE-2026-54356](https://insights.sbomify.com/CVE-2026-54356/): Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url` (high 7.1)
- [CVE-2026-54355](https://insights.sbomify.com/CVE-2026-54355/): MapServer: Reflected XSS in OpenLayers HTML Output via `HTTP_X_FORWARDED_HOST` (medium 5.3)
- [CVE-2026-54354](https://insights.sbomify.com/CVE-2026-54354/): MapServer: PostGIS Numeric Filter Value SQL Injection in MapServer Runtime Query Translation (high 8.2)
- [CVE-2026-54353](https://insights.sbomify.com/CVE-2026-54353/): Budibase: Potential SSRF DNS rebinding bypass in outbound fetch validation (high 8.5)
- [CVE-2026-54352](https://insights.sbomify.com/CVE-2026-54352/): Budibase: Arbitrary file read by workspace-builder via PWA-zip symlink upload (critical 9.6)
- [CVE-2026-54351](https://insights.sbomify.com/CVE-2026-54351/): Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override (high 8.2)
- [CVE-2026-54350](https://insights.sbomify.com/CVE-2026-54350/): Budibase: Anonymous NoSQL operator injection via published-app query templates (critical 10.0)
- [CVE-2026-5435](https://insights.sbomify.com/CVE-2026-5435/): Potential buffer overflow in ns_sprintrrf TSIG handling path (high 7.3)
- [CVE-2026-54348](https://insights.sbomify.com/CVE-2026-54348/): Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltration (high 7.2)
- [CVE-2026-54347](https://insights.sbomify.com/CVE-2026-54347/): Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover (high 8.7)
- [CVE-2026-54345](https://insights.sbomify.com/CVE-2026-54345/): GoPacket's Diameter AVP decoder: uint32 underflow on vendor header size leads to unbounded ~4 GiB allocation (unauthenticated remote DoS) (medium 6.9)
- [CVE-2026-54344](https://insights.sbomify.com/CVE-2026-54344/): ToolJet GitHub Actions comment body shell injection exposes deployment secrets (medium 4.7)
- [CVE-2026-54343](https://insights.sbomify.com/CVE-2026-54343/): Frappe LMS: Path Traversal in SCORM File Serving (high 8.7)
- [CVE-2026-54342](https://insights.sbomify.com/CVE-2026-54342/): TLS Certificate Verification Disabled on CXF Transport Clients in epa4all (high 8.1)
- [CVE-2026-54341](https://insights.sbomify.com/CVE-2026-54341/): Dragonfly: RESTORE operations may crash the server (high 7.5)
- [CVE-2026-54340](https://insights.sbomify.com/CVE-2026-54340/): h2o has HTTP/2 state amplification (high 7.5)
- [CVE-2026-5434](https://insights.sbomify.com/CVE-2026-5434/): Improper storage of sensitive information (medium 5.9)
- [CVE-2026-54339](https://insights.sbomify.com/CVE-2026-54339/): Glean: Server-Side Request Forgery (SSRF) with Full Response Disclosure via Malicious RSS Feed in /api/feeds/discover (high 7.7)
- [CVE-2026-54338](https://insights.sbomify.com/CVE-2026-54338/): JupyterHub: Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login (medium 5.3)
- [CVE-2026-54337](https://insights.sbomify.com/CVE-2026-54337/): Fireshare has Unauthenticated Argument Injection to Arbitrary File Write/Overwrite (critical 9.8)
- [CVE-2026-54336](https://insights.sbomify.com/CVE-2026-54336/): JumpServer: KoKo Web Terminal SFTP Path Traversal on Authorized Asset (medium 5.4)
- [CVE-2026-54335](https://insights.sbomify.com/CVE-2026-54335/): Feathersjs: Prototype pollution in @feathersjs/commons _.merge via JSON-parsed __proto__ (low 3.7)
- [CVE-2026-54334](https://insights.sbomify.com/CVE-2026-54334/): UEFI Firmware Parser: Heap out-of-bounds write in tiano decompressor `ReadCLen` (critical 9.8)
- [CVE-2026-54333](https://insights.sbomify.com/CVE-2026-54333/): UEFI Firmware Parser: Stack out-of-bounds write in tiano decompressor MakeTable (critical 9.8)
- [CVE-2026-54332](https://insights.sbomify.com/CVE-2026-54332/): GoPacket's sFlow ExtendedGatewayFlow decoder: unbounded attacker-controlled allocation (104-byte UDP datagram -> up to 16 GiB make) -> unauthenticated remote DoS (medium 6.9)
- [CVE-2026-54330](https://insights.sbomify.com/CVE-2026-54330/): Ceph RGW SigV4 handler accepts unsigned x-amz-* headers on presigned requests, allowing privilege escalation (high 8.1)
- [CVE-2026-5433](https://insights.sbomify.com/CVE-2026-5433/): Improper sanitization (critical 9.1)
- [CVE-2026-54329](https://insights.sbomify.com/CVE-2026-54329/): Snipe-IT: Cross-Tenant Accessory Injection in Snipe-IT API (high 8.5)
- [CVE-2026-54328](https://insights.sbomify.com/CVE-2026-54328/): Pi: Predictable temporary extension install paths allow local privilege escalation on shared Linux hosts (high 7.3)
- [CVE-2026-54327](https://insights.sbomify.com/CVE-2026-54327/): Pi: Race condition in auth.json writes could expose stored credentials (low 2.2)
- [CVE-2026-54326](https://insights.sbomify.com/CVE-2026-54326/): Pi: Potential XSS in HTML session exports via Markdown URL sanitization bypass (low 2.5)
- [CVE-2026-54325](https://insights.sbomify.com/CVE-2026-54325/): Pi loads project-local extensions without approval (medium 4.4)
- [CVE-2026-54324](https://insights.sbomify.com/CVE-2026-54324/): Daytona: Cross-tenant data leak in notification WebSocket gateway via unverified organizationId join (medium 6.5)
- [CVE-2026-54323](https://insights.sbomify.com/CVE-2026-54323/): Daytona: Git credential leak via git clone with TLS verification disabled (medium 5.9)
- [CVE-2026-54322](https://insights.sbomify.com/CVE-2026-54322/): Daytona: Cross-org IDOR in organization role update/delete — any org owner can rewrite or destroy another org's roles (high 7.7)
- [CVE-2026-54321](https://insights.sbomify.com/CVE-2026-54321/): Daytona: Public sandbox previews remain accessible for up to one hour after being made private (high 7.0)
- [CVE-2026-54320](https://insights.sbomify.com/CVE-2026-54320/): Daytona: Cross-tenant organization takeover via invitation acceptance with an unverified email (high 8.4)
- [CVE-2026-54319](https://insights.sbomify.com/CVE-2026-54319/): Daytona: Path traversal in sandbox volume id mounts arbitrary host paths into the sandbox — cross-tenant data access and host escape (medium 4.2)
- [CVE-2026-54318](https://insights.sbomify.com/CVE-2026-54318/): Home Assistant: Exported BroadcastReceiver allows local apps to spoof device location (high 7.1)
- [CVE-2026-54317](https://insights.sbomify.com/CVE-2026-54317/): Home Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN (high 7.6)
- [CVE-2026-54316](https://insights.sbomify.com/CVE-2026-54316/): Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch (medium 6.0)
- [CVE-2026-54314](https://insights.sbomify.com/CVE-2026-54314/): n8n: Denial of Service via ZIP decompression in webhook workflow (medium 6.3)
- [CVE-2026-54313](https://insights.sbomify.com/CVE-2026-54313/): n8n: NoSQL Injection in MongoDB Node Find And Replace Operation (medium 6.5)
- [CVE-2026-54312](https://insights.sbomify.com/CVE-2026-54312/): n8n: Microsoft SQL Node Prototype Pollution (high 7.2)
- [CVE-2026-54311](https://insights.sbomify.com/CVE-2026-54311/): n8n: Merge Node SQL Mode Prototype Pollution (medium 6.0)
- [CVE-2026-54310](https://insights.sbomify.com/CVE-2026-54310/): n8n: SQL Injection in Postgres v1/TimesclaeDB Nodes (medium 6.5)
- [CVE-2026-54309](https://insights.sbomify.com/CVE-2026-54309/): n8n: n8n MCP Browser HTTP Transport Exposes Unauthenticated Browser-Control Sessions (high 8.8)
- [CVE-2026-54308](https://insights.sbomify.com/CVE-2026-54308/): n8n: Missing Token Validation on Microsoft Agent 365 Trigger Node (medium 6.3)
- [CVE-2026-54307](https://insights.sbomify.com/CVE-2026-54307/): n8n: Credential Exfiltration via Permission Bypass (high 8.5)
- [CVE-2026-54306](https://insights.sbomify.com/CVE-2026-54306/): n8n: Prototype Pollution enables confused-deputy execution via public webhooks (medium 6.3)
- [CVE-2026-54305](https://insights.sbomify.com/CVE-2026-54305/): n8n: Cross-Tenant Credential Takeover via Dynamic Credentials EE Endpoints (high 8.9)
- [CVE-2026-54304](https://insights.sbomify.com/CVE-2026-54304/): n8n: SecurityScorecard Node Leaks API Token to User-Controlled Host (high 7.1)
- [CVE-2026-54303](https://insights.sbomify.com/CVE-2026-54303/): n8n: Reflected XSS via Facebook, WhatsApp, and Microsoft Teams Trigger Webhook Verification Endpoints (medium 6.8)
- [CVE-2026-54302](https://insights.sbomify.com/CVE-2026-54302/): n8n: Stored XSS in Chat Trigger Node (high 7.0)
- [CVE-2026-54301](https://insights.sbomify.com/CVE-2026-54301/): n8n: Same-Origin XSS in Respond to Webhook Node (high 7.0)
- [CVE-2026-54300](https://insights.sbomify.com/CVE-2026-54300/): @astrojs/netlify broadens Astro image.remotePatterns in Netlify Image CDN config (medium 5.3)
- [CVE-2026-5430](https://insights.sbomify.com/CVE-2026-5430/): WSO2 Multiple Products Path Traversal Vulnerability (critical 10.0, exploited in the wild)
- [CVE-2026-54299](https://insights.sbomify.com/CVE-2026-54299/): Astro: Host header SSRF in prerendered error page fetch (high 7.5)
- [CVE-2026-54298](https://insights.sbomify.com/CVE-2026-54298/): Astro: XSS via Unescaped Attribute Names in Spread Props (medium 4.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/552/