# Vulnerabilities published in 2026


- [CVE-2026-54297](https://insights.sbomify.com/CVE-2026-54297/): Faraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parameters (high 7.5)
- [CVE-2026-54293](https://insights.sbomify.com/CVE-2026-54293/): NLTK: URL-Encoded Path Traversal in nltk.data.load() Allows Arbitrary Local File Read (high 7.5)
- [CVE-2026-54291](https://insights.sbomify.com/CVE-2026-54291/): Silent channel-binding authentication downgrade via unsupported certificate algorithms (high 8.2)
- [CVE-2026-54290](https://insights.sbomify.com/CVE-2026-54290/): Hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard (high 7.1)
- [CVE-2026-5429](https://insights.sbomify.com/CVE-2026-5429/): Kiro IDE Webview Cross-Site Scripting via Workspace Color Theme (high 7.1)
- [CVE-2026-54289](https://insights.sbomify.com/CVE-2026-54289/): Hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest (medium 4.8)
- [CVE-2026-54288](https://insights.sbomify.com/CVE-2026-54288/): Hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length` (medium 6.5)
- [CVE-2026-54287](https://insights.sbomify.com/CVE-2026-54287/): hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice (medium 5.3)
- [CVE-2026-54286](https://insights.sbomify.com/CVE-2026-54286/): Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`) (medium 5.9)
- [CVE-2026-54285](https://insights.sbomify.com/CVE-2026-54285/): opentelemetry-js: Unbounded memory allocation in W3C Baggage propagation (medium 5.3)
- [CVE-2026-54284](https://insights.sbomify.com/CVE-2026-54284/): sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger (high 8.7)
- [CVE-2026-54283](https://insights.sbomify.com/CVE-2026-54283/): Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS (high 7.5)
- [CVE-2026-54282](https://insights.sbomify.com/CVE-2026-54282/): Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname (low 3.7)
- [CVE-2026-54281](https://insights.sbomify.com/CVE-2026-54281/): Nest: Middleware Bypass on Fastify via Trailing Slash (high 8.7)
- [CVE-2026-54280](https://insights.sbomify.com/CVE-2026-54280/): AIOHTTP: Payload Response Resources Are Not Closed After Mid-Body Disconnect (low 1.7)
- [CVE-2026-5428](https://insights.sbomify.com/CVE-2026-5428/): Royal Addons for Elementor <= 1.7.1056 - Authenticated (Author+) Stored Cross-Site Scripting via Image Caption Field (medium 6.4)
- [CVE-2026-54279](https://insights.sbomify.com/CVE-2026-54279/): AIOHTTP: Host-Only Cookies Become Domain Cookies After CookieJar Persistence (low 1.3)
- [CVE-2026-54278](https://insights.sbomify.com/CVE-2026-54278/): AIOHTTP: Unread Compressed Request Bodies Bypass client_max_size During Cleanup (medium 6.6)
- [CVE-2026-54277](https://insights.sbomify.com/CVE-2026-54277/): AIOHTTP: C HTTP Parser Bypasses max_line_size for Fragmented Lines (medium 6.6)
- [CVE-2026-54276](https://insights.sbomify.com/CVE-2026-54276/): AIOHTTP: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges (medium 6.3)
- [CVE-2026-54275](https://insights.sbomify.com/CVE-2026-54275/): AIOHTTP: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections (low 2.7)
- [CVE-2026-54274](https://insights.sbomify.com/CVE-2026-54274/): AIOHTTP: Incomplete websocket frame payloads bypass memory limits (medium 6.6)
- [CVE-2026-54273](https://insights.sbomify.com/CVE-2026-54273/): AIOHTTP: HTTP/1 Pipelined Requests Queue Without Limit (medium 6.6)
- [CVE-2026-54272](https://insights.sbomify.com/CVE-2026-54272/): ip-address: Misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks (medium 6.9)
- [CVE-2026-54271](https://insights.sbomify.com/CVE-2026-54271/): protobufjs-cli: Code injection in pbjs static output from crafted JSON descriptor names (high 8.2)
- [CVE-2026-54270](https://insights.sbomify.com/CVE-2026-54270/): protobufjs: Memory amplification from preserved unknown fields in binary decode (medium 5.3)
- [CVE-2026-5427](https://insights.sbomify.com/CVE-2026-5427/): Missing authorization in Kubio AI Page Builder (medium 5.3)
- [CVE-2026-54269](https://insights.sbomify.com/CVE-2026-54269/): protobufjs: Schema-derived names can shadow runtime-significant properties (medium 5.3)
- [CVE-2026-54268](https://insights.sbomify.com/CVE-2026-54268/): Angular: Denial of Service (DoS) via OOM in Date Formatting (formatDate) (high 8.2)
- [CVE-2026-54267](https://insights.sbomify.com/CVE-2026-54267/): Angular Client Hydration DOM Clobbering & Response-Cache Poisoning (high 8.6)
- [CVE-2026-54266](https://insights.sbomify.com/CVE-2026-54266/): Angular: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning (high 8.8)
- [CVE-2026-54265](https://insights.sbomify.com/CVE-2026-54265/): Angular: Two-Way Property Binding Sanitization Bypass (XSS) (medium 5.3)
- [CVE-2026-54264](https://insights.sbomify.com/CVE-2026-54264/): Angular: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker (high 8.3)
- [CVE-2026-54263](https://insights.sbomify.com/CVE-2026-54263/): Wagtail: Reflected XSS in dynamic image URL generator view (high 7.3)
- [CVE-2026-54262](https://insights.sbomify.com/CVE-2026-54262/): Wagtail: Pages translations can be created without page permissions when using simple_translation (medium 4.3)
- [CVE-2026-54261](https://insights.sbomify.com/CVE-2026-54261/): Wagtail: Improper permission handling in image preview (medium 6.5)
- [CVE-2026-54260](https://insights.sbomify.com/CVE-2026-54260/): Wagtail: Denial of service via unbounded filter specs in the image preview (medium 4.3)
- [CVE-2026-5426](https://insights.sbomify.com/CVE-2026-5426/): KnowledgeDeliver deployments before February 24, 2026 use a static ASP.NET/IIS machineKey value (critical 9.1)
- [CVE-2026-54259](https://insights.sbomify.com/CVE-2026-54259/): Wagtail: Improper restriction handling on Documents and Images chosen endpoints (medium 4.3)
- [CVE-2026-54258](https://insights.sbomify.com/CVE-2026-54258/): Cross-monitor event media authorization bypass in direct event media endpoints (medium 6.5)
- [CVE-2026-54257](https://insights.sbomify.com/CVE-2026-54257/): Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow (critical 9.3)
- [CVE-2026-54256](https://insights.sbomify.com/CVE-2026-54256/): Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata (medium 5.4)
- [CVE-2026-54254](https://insights.sbomify.com/CVE-2026-54254/): Cyberdrop-DL: Pixeldrain API key shared with unverified thirdparty sites (medium 5.9)
- [CVE-2026-54253](https://insights.sbomify.com/CVE-2026-54253/): TS3 Manager: Reflected XSS via /api/download port parameter steals operator session (high 8.2)
- [CVE-2026-54251](https://insights.sbomify.com/CVE-2026-54251/): netty-incubator-codec-ohttp: [OHttpServerCodec] Native Direct-Memory Leak on AEAD Decryption Failure Leads to Gateway Denial of Service (high 8.7)
- [CVE-2026-54250](https://insights.sbomify.com/CVE-2026-54250/): K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression (medium 5.8)
- [CVE-2026-5425](https://insights.sbomify.com/CVE-2026-5425/): Widgets for Social Photo Feed <= 1.7.9 - Unauthenticated Stored Cross-Site Scripting via feed_data (high 7.2)
- [CVE-2026-54249](https://insights.sbomify.com/CVE-2026-54249/): Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials (medium 6.8)
- [CVE-2026-54248](https://insights.sbomify.com/CVE-2026-54248/): Doco-CD has an OCI Trust Policy Bypass via Artifact-Contained Configuration (medium 6.5)
- [CVE-2026-54247](https://insights.sbomify.com/CVE-2026-54247/): Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoS (medium 4.3)
- [CVE-2026-54246](https://insights.sbomify.com/CVE-2026-54246/): Skipper routesrv-no-auth: All routesrv API Endpoints Lack Authentication (medium 5.7)
- [CVE-2026-54245](https://insights.sbomify.com/CVE-2026-54245/): Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database (high 7.6)
- [CVE-2026-54244](https://insights.sbomify.com/CVE-2026-54244/): Statamic: Incorrect authorization lets view-only users submit Live Preview content reserved for editors (low 3.5)
- [CVE-2026-54243](https://insights.sbomify.com/CVE-2026-54243/): Statamic: CSV formula injection in form submission exports (medium 6.1)
- [CVE-2026-54242](https://insights.sbomify.com/CVE-2026-54242/): Statamic: Server-Side Request Forgery via Glide (DNS rebinding) (medium 4.9)
- [CVE-2026-54241](https://insights.sbomify.com/CVE-2026-54241/): libde265: SAO sequential filter heap buffer overflow via signed integer overflow (high 7.4)
- [CVE-2026-54240](https://insights.sbomify.com/CVE-2026-54240/): libde265: Pixel accessor signed integer overflow causes heap OOB read/write (high 7.4)
- [CVE-2026-54239](https://insights.sbomify.com/CVE-2026-54239/): FaustWP — Authentication Bypass via Initialization Vector Modification in Token Envelope (high 8.8)
- [CVE-2026-54238](https://insights.sbomify.com/CVE-2026-54238/): Supabase Realtime: Expired JWTs with string exp are accepted by REST broadcast authorization (low 3.1)
- [CVE-2026-54237](https://insights.sbomify.com/CVE-2026-54237/): Wavelog: Unauthenticated Remote Code Execution (critical 9.3)
- [CVE-2026-54236](https://insights.sbomify.com/CVE-2026-54236/): vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router (medium 5.3)
- [CVE-2026-54235](https://insights.sbomify.com/CVE-2026-54235/): vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels (medium 6.9)
- [CVE-2026-54234](https://insights.sbomify.com/CVE-2026-54234/): vLLM: Remote DoS in vLLM via Invalid Recovered Token Reinjection (high 7.5)
- [CVE-2026-54233](https://insights.sbomify.com/CVE-2026-54233/): vLLM: OOM Denial of Service via Audio Decompression Bomb (medium 6.5)
- [CVE-2026-54232](https://insights.sbomify.com/CVE-2026-54232/): vLLM: Dependency Confusion Vulnerability in vLLM Dockerfile (high 8.8)
- [CVE-2026-54231](https://insights.sbomify.com/CVE-2026-54231/): Abrt: unsanitized systemd journal content written to dump directory files enables content injection (medium 5.5)
- [CVE-2026-54230](https://insights.sbomify.com/CVE-2026-54230/): Abrt: event handler scripts follow symlinks when writing output files, allowing arbitrary file overwrites (high 7.0)
- [CVE-2026-5423](https://insights.sbomify.com/CVE-2026-5423/): Subscription Authentication Bypass via Unverified connectionParams.jwt (high 8.2)
- [CVE-2026-54229](https://insights.sbomify.com/CVE-2026-54229/): Abrt: chownproblemdir succeeds during active post-create event processing due to inadequate locking (high 7.0)
- [CVE-2026-54228](https://insights.sbomify.com/CVE-2026-54228/): Abrt: toctou race condition in abrt-dbus setelement allows arbitrary file writes to dump directories (high 7.8)
- [CVE-2026-54226](https://insights.sbomify.com/CVE-2026-54226/): Apache Kvrocks: RESTORE IntSet Integer Overflow Leads to Remote DoS (medium 6.4)
- [CVE-2026-54225](https://insights.sbomify.com/CVE-2026-54225/): Apache CXF: Denial of Service attack via large attachments (high 7.5)
- [CVE-2026-54224](https://insights.sbomify.com/CVE-2026-54224/): Denial of Service in UBB.threads (high 7.1)
- [CVE-2026-54223](https://insights.sbomify.com/CVE-2026-54223/): Remote Code Execution via arbitrary file read and write in UBB.threads (high 8.6)
- [CVE-2026-54222](https://insights.sbomify.com/CVE-2026-54222/): Blind SQL Injection in UBB.threads (high 8.6)
- [CVE-2026-54221](https://insights.sbomify.com/CVE-2026-54221/): Reflected XSS in UBB.threads (medium 5.1)
- [CVE-2026-54220](https://insights.sbomify.com/CVE-2026-54220/): Cross-Site Request Forgery in UBB.threads (high 8.6)
- [CVE-2026-5422](https://insights.sbomify.com/CVE-2026-5422/): Path Traversal in jupyter/jupyter (medium 6.8)
- [CVE-2026-54219](https://insights.sbomify.com/CVE-2026-54219/): Stored XSS in UBB.threads (medium 5.1)
- [CVE-2026-54218](https://insights.sbomify.com/CVE-2026-54218/): TeamDavid: Weak Cryptography and Insecure Password Storage (high 8.8)
- [CVE-2026-54217](https://insights.sbomify.com/CVE-2026-54217/): TeamDavid: Stored XSS in web application (medium 5.3)
- [CVE-2026-54216](https://insights.sbomify.com/CVE-2026-54216/): TeamDavid: Reflected Cross Site Scripting (XSS) via the 'EntryInfo' parameter (medium 5.3)
- [CVE-2026-54215](https://insights.sbomify.com/CVE-2026-54215/): TeamDavid: Open Redirect via the 'replyUrl' parameter (medium 5.3)
- [CVE-2026-54214](https://insights.sbomify.com/CVE-2026-54214/): TeamDavid: Header Injection through the 'cType' URL parameter (medium 5.3)
- [CVE-2026-54213](https://insights.sbomify.com/CVE-2026-54213/): TeamDavid: Denial of Service via endpoint 'internalRestart' (critical 9.2)
- [CVE-2026-54212](https://insights.sbomify.com/CVE-2026-54212/): TeamDavid: Buffer Overflow in JSON-parsing (critical 9.5)
- [CVE-2026-54211](https://insights.sbomify.com/CVE-2026-54211/): TeamDavid: Buffer Overflow in multiple form data parameters (critical 9.5)
- [CVE-2026-54210](https://insights.sbomify.com/CVE-2026-54210/): TeamDavid: Buffer Overflow in file names of file upload functionalities (critical 9.5)
- [CVE-2026-54209](https://insights.sbomify.com/CVE-2026-54209/): TeamDavid: Buffer Overflow in 'editini' function (high 8.9)
- [CVE-2026-54208](https://insights.sbomify.com/CVE-2026-54208/): TeamDavid: Arbitrary File Write leading to Stored XSS (high 8.5)
- [CVE-2026-54207](https://insights.sbomify.com/CVE-2026-54207/): TeamDavid: Server-Side Request Forgery (SSRF) via 'pathname' parameter in move archive functionality (medium 6.3)
- [CVE-2026-54206](https://insights.sbomify.com/CVE-2026-54206/): TeamDavid: Server-Side Request Forgery (SSRF) via 'pathname' parameter in sending functionality (medium 6.3)
- [CVE-2026-54205](https://insights.sbomify.com/CVE-2026-54205/): TeamDavid: Server-Side Request Forgery (SSRF) via 'pathname' parameter in link storing functionality (medium 6.3)
- [CVE-2026-54204](https://insights.sbomify.com/CVE-2026-54204/): TeamDavid: Server-Side Request Forgery (SSRF) via 'pathnameroot' parameter in search functionality (high 7.7)
- [CVE-2026-54203](https://insights.sbomify.com/CVE-2026-54203/): TeamDavid: Memory Leak leaking sensitive information (critical 9.2)
- [CVE-2026-54202](https://insights.sbomify.com/CVE-2026-54202/): TeamDavid: Path Traversal in the archive creation functionality (high 8.5)
- [CVE-2026-54201](https://insights.sbomify.com/CVE-2026-54201/): TeamDavid: Missing Authorization (medium 6.9)
- [CVE-2026-54200](https://insights.sbomify.com/CVE-2026-54200/): TeamDavid: Local File Inclusion via the form field 'scjob' (high 8.4)
- [CVE-2026-5420](https://insights.sbomify.com/CVE-2026-5420/): Shinrays Games Goods Triple App cats.goods.sort.sorting.games jRwTX.java hard-coded key (low 2.0)
- [CVE-2026-54199](https://insights.sbomify.com/CVE-2026-54199/): TeamDavid: Header Injection through request body in link storing functionality (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/553/