# Vulnerabilities published in 2026


- [CVE-2026-54085](https://insights.sbomify.com/CVE-2026-54085/): Wazuh: Missing input validation in multiple active response scripts allows argument injection (high 7.1)
- [CVE-2026-54084](https://insights.sbomify.com/CVE-2026-54084/): Wazuh agent enrollment NULL pointer dereference via malformed manager response (medium 5.3)
- [CVE-2026-54083](https://insights.sbomify.com/CVE-2026-54083/): Wazuh: Path traversal in ip-customblock active response allows arbitrary file creation and deletion (high 8.1)
- [CVE-2026-54082](https://insights.sbomify.com/CVE-2026-54082/): veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFs (medium 6.5)
- [CVE-2026-54081](https://insights.sbomify.com/CVE-2026-54081/): veraPDF Parser DoS via PostScript Type 1 Font Programs (medium 6.9)
- [CVE-2026-54080](https://insights.sbomify.com/CVE-2026-54080/): veraPDF Parser DoS via PostScript CMap Streams (medium 6.9)
- [CVE-2026-5408](https://insights.sbomify.com/CVE-2026-5408/): Uncontrolled Recursion in Wireshark (medium 5.5)
- [CVE-2026-54079](https://insights.sbomify.com/CVE-2026-54079/): veraPDF Validation XXE via XFA (high 8.7)
- [CVE-2026-54078](https://insights.sbomify.com/CVE-2026-54078/): veraPDF Validation XXE via Rich Text (high 8.7)
- [CVE-2026-54077](https://insights.sbomify.com/CVE-2026-54077/): ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users (high 7.1)
- [CVE-2026-54076](https://insights.sbomify.com/CVE-2026-54076/): ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221) (high 8.1)
- [CVE-2026-54074](https://insights.sbomify.com/CVE-2026-54074/): @tinacms/cli: Remote Code Execution in @tinacms/cli via Forestry migration — unsanitised __TINA_INTERNAL__ marker in user-controlled YAML labels (high 7.8)
- [CVE-2026-54073](https://insights.sbomify.com/CVE-2026-54073/): VeraCrypt: Hidden volume quick format weakens plausible deniability (medium 4.6)
- [CVE-2026-54072](https://insights.sbomify.com/CVE-2026-54072/): Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URL (critical 9.3)
- [CVE-2026-54071](https://insights.sbomify.com/CVE-2026-54071/): BabelDOC: Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py (high 7.8)
- [CVE-2026-54070](https://insights.sbomify.com/CVE-2026-54070/): SiYuan: Stored XSS in Bazaar marketplace via package README event handlers (high 7.1)
- [CVE-2026-5407](https://insights.sbomify.com/CVE-2026-5407/): Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark (medium 5.5)
- [CVE-2026-54069](https://insights.sbomify.com/CVE-2026-54069/): SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist (critical 9.2)
- [CVE-2026-54068](https://insights.sbomify.com/CVE-2026-54068/): SiYuan: Unauthenticated SQLite Data Exfiltration via Template Injection in /api/icon/getDynamicIcon (medium 5.9)
- [CVE-2026-54067](https://insights.sbomify.com/CVE-2026-54067/): SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet() (critical 9.9)
- [CVE-2026-54066](https://insights.sbomify.com/CVE-2026-54066/): SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read) (high 7.5)
- [CVE-2026-54063](https://insights.sbomify.com/CVE-2026-54063/): Excelize: Unbounded Row Index Allocation in Worksheet Parser (checkSheet OOM/Panic DoS) (high 7.5)
- [CVE-2026-54061](https://insights.sbomify.com/CVE-2026-54061/): Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import (critical 9.1)
- [CVE-2026-54060](https://insights.sbomify.com/CVE-2026-54060/): Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()` (high 7.5)
- [CVE-2026-5406](https://insights.sbomify.com/CVE-2026-5406/): Uncontrolled Recursion in Wireshark (medium 5.5)
- [CVE-2026-54059](https://insights.sbomify.com/CVE-2026-54059/): Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading (high 7.5)
- [CVE-2026-54058](https://insights.sbomify.com/CVE-2026-54058/): Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files) (high 8.3)
- [CVE-2026-54057](https://insights.sbomify.com/CVE-2026-54057/): Kitty vulnerable to command injection via unsanitized OSC 21 query reply (high 7.3)
- [CVE-2026-54056](https://insights.sbomify.com/CVE-2026-54056/): Kitty has an arbitrary file overwrite via symlink following in `kitten dnd` remote drop staging (high 7.6)
- [CVE-2026-54055](https://insights.sbomify.com/CVE-2026-54055/): Kitty has an Arbitrary File Write via Symlink Race Condition in File Transmission Protocol (medium 5.0)
- [CVE-2026-54054](https://insights.sbomify.com/CVE-2026-54054/): Transmute has full-read SSRF in URL file import (POST /api/files/url) — no host/IP validation, follows redirects (medium 6.5)
- [CVE-2026-54053](https://insights.sbomify.com/CVE-2026-54053/): Many Notes: Path Traversal via ZIP import allows arbitrary file write and stored XSS in other users' vaults (critical 9.6)
- [CVE-2026-54052](https://insights.sbomify.com/CVE-2026-54052/): n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deployments (critical 9.9)
- [CVE-2026-54051](https://insights.sbomify.com/CVE-2026-54051/): Network-AI has an an OS Command Injection issue (critical 9.9)
- [CVE-2026-54050](https://insights.sbomify.com/CVE-2026-54050/): Sakai: IDOR in Profile Image Deletion Allows Any Authenticated User to Delete Any User's Profile Image (medium 6.5)
- [CVE-2026-5405](https://insights.sbomify.com/CVE-2026-5405/): Heap-based Buffer Overflow in Wireshark (high 7.8)
- [CVE-2026-54049](https://insights.sbomify.com/CVE-2026-54049/): Sakai Conversations has a Stored XSS Issue (high 8.7)
- [CVE-2026-54048](https://insights.sbomify.com/CVE-2026-54048/): Apache Impala: Avro Schema URL Server-Side Request Forgery (medium 5.3)
- [CVE-2026-54047](https://insights.sbomify.com/CVE-2026-54047/): Laci Synchroni Backend Vulnerable to Account Takeover / User Impersonation via Client-Side Configuration Manipulation (critical 9.2)
- [CVE-2026-54040](https://insights.sbomify.com/CVE-2026-54040/): LibreChat: 2FA Backup Code Regeneration Without OTP Verification Allows 2FA Bypass (medium 5.9)
- [CVE-2026-5404](https://insights.sbomify.com/CVE-2026-5404/): Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in Wireshark (medium 4.7)
- [CVE-2026-54037](https://insights.sbomify.com/CVE-2026-54037/): LibreChat: Incomplete Fix for CVE-2025-7105 — /api/convos/duplicate Lacks Rate Limiting Applied to /api/convos/fork (medium 6.5)
- [CVE-2026-54036](https://insights.sbomify.com/CVE-2026-54036/): LibreChat: 2FA Re-enrollment Allows Full Account 2FA Takeover Without OTP Verification (medium 5.3)
- [CVE-2026-54033](https://insights.sbomify.com/CVE-2026-54033/): LibreChat: SSRF via User-Provided Custom Endpoint baseURL — no private IP validation on user-configured API base URLs (high 7.7)
- [CVE-2026-54030](https://insights.sbomify.com/CVE-2026-54030/): LibreChat: Missing Resource Parameter Validation in MCP OAuth Flow (high 8.0)
- [CVE-2026-5403](https://insights.sbomify.com/CVE-2026-5403/): Heap-based Buffer Overflow in Wireshark (high 7.8)
- [CVE-2026-54029](https://insights.sbomify.com/CVE-2026-54029/): LibreChat: IDOR in Message Deletion — Incomplete Fix for CVE-2024-41703 Leaves deleteMessages() Without User Filter (medium 5.3)
- [CVE-2026-54027](https://insights.sbomify.com/CVE-2026-54027/): LibreChat: Image Upload Route Bypasses Agent Permission Check — Incomplete Fix for File Upload Authorization (medium 6.5)
- [CVE-2026-54025](https://insights.sbomify.com/CVE-2026-54025/): LibreChat: Stored XSS via unescaped image alt text in markdown artifact preview (medium 5.4)
- [CVE-2026-54024](https://insights.sbomify.com/CVE-2026-54024/): LibreChat: Incomplete Fix for CVE-2024-11171 — Conversation Import Multer Instance Missing File Size Limits (medium 6.5)
- [CVE-2026-54022](https://insights.sbomify.com/CVE-2026-54022/): Open WebUI: Any authenticated user can read other users' private notes via Socket.IO (medium 5.3)
- [CVE-2026-54021](https://insights.sbomify.com/CVE-2026-54021/): Open WebUI: Authenticated users can target arbitrary configured Ollama backends via unguarded url_idx path parameter (medium 6.3)
- [CVE-2026-54020](https://insights.sbomify.com/CVE-2026-54020/): Open WebUI: DNS Rebinding SSRF Bypass (medium 6.3)
- [CVE-2026-5402](https://insights.sbomify.com/CVE-2026-5402/): Heap-based Buffer Overflow in Wireshark (high 8.8)
- [CVE-2026-54019](https://insights.sbomify.com/CVE-2026-54019/): Open WebUI: RAG ACL Bypass in Milvus Multitenancy Mode (medium 6.5)
- [CVE-2026-54018](https://insights.sbomify.com/CVE-2026-54018/): Open WebUI: SSRF Protection Bypass in Playwright Web Loader via HTTP Redirects (high 7.7)
- [CVE-2026-54017](https://insights.sbomify.com/CVE-2026-54017/): Open WebUI: Path traversal / SSRF in terminal server proxy via encoded path traversal (high 7.7)
- [CVE-2026-54016](https://insights.sbomify.com/CVE-2026-54016/): Open WebUI: Open WebUI BOLA: `search_knowledge_files` Allows Unauthorized Knowledge Base File Enumeration (medium 4.3)
- [CVE-2026-54015](https://insights.sbomify.com/CVE-2026-54015/): Open WebUI: Prompt history IDOR: unbound history_id allows cross-prompt read and deletion (medium 6.4)
- [CVE-2026-54014](https://insights.sbomify.com/CVE-2026-54014/): Open WebUI: Sibling-Prefix Path Traversal via /cache/{path} in open-webui/open-webui (medium 4.3)
- [CVE-2026-54013](https://insights.sbomify.com/CVE-2026-54013/): Open WebUI: Stored XSS to Account Takeover via Model Profile Images in Open WebUI (high 7.6)
- [CVE-2026-54012](https://insights.sbomify.com/CVE-2026-54012/): Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion (high 7.1)
- [CVE-2026-54011](https://insights.sbomify.com/CVE-2026-54011/): Open WebUI: Stored XSS in Mermaid Markdown Preview (high 8.7)
- [CVE-2026-54010](https://insights.sbomify.com/CVE-2026-54010/): Open WebUI: Forged chat-file link allows cross-user file read and deletion (high 8.3)
- [CVE-2026-5401](https://insights.sbomify.com/CVE-2026-5401/): Uncontrolled Recursion in Wireshark (medium 5.5)
- [CVE-2026-54009](https://insights.sbomify.com/CVE-2026-54009/): Open WebUI: Cross-user file disclosure via /api/chat/completions image_url field (medium 6.5)
- [CVE-2026-54008](https://insights.sbomify.com/CVE-2026-54008/): Open WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url` (high 8.5)
- [CVE-2026-54007](https://insights.sbomify.com/CVE-2026-54007/): Open WebUI: Cross-origin postMessage confirmation bypass via action:submit (high 7.1)
- [CVE-2026-54006](https://insights.sbomify.com/CVE-2026-54006/): Open WebUI: Calendar event re-parenting allows writing events into another user's calendar (medium 4.3)
- [CVE-2026-54005](https://insights.sbomify.com/CVE-2026-54005/): Kirby: `pages.access` permission is not checked in the `site/find` REST API route (high 7.1)
- [CVE-2026-54004](https://insights.sbomify.com/CVE-2026-54004/): Kirby: Access to files of top-level drafts is not protected by permissions (medium 6.3)
- [CVE-2026-54003](https://insights.sbomify.com/CVE-2026-54003/): Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header (critical 9.1)
- [CVE-2026-54002](https://insights.sbomify.com/CVE-2026-54002/): Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()` (high 8.5)
- [CVE-2026-54001](https://insights.sbomify.com/CVE-2026-54001/): osquery: Heap buffer overflow via `authenticode` table (Windows) (high 7.0)
- [CVE-2026-54000](https://insights.sbomify.com/CVE-2026-54000/): osquery: Heap buffer overflow in `getProcessCurrentDirectory()` via `processes` table (Windows) (high 7.0)
- [CVE-2026-5400](https://insights.sbomify.com/CVE-2026-5400/): Redux Framework <= 4.5.13 - Authenticated (Subscriber+) Cross-Site Scripting via User Input (medium 6.4)
- [CVE-2026-53999](https://insights.sbomify.com/CVE-2026-53999/): Radius Controller May Delete a Container Resource via an Injected Deployment Annotation (Multi-Tenant Installs) (high 7.7)
- [CVE-2026-53997](https://insights.sbomify.com/CVE-2026-53997/): Netherman Portal del Hermano Account Takeover via Password Reset Oracle (critical 9.1)
- [CVE-2026-53996](https://insights.sbomify.com/CVE-2026-53996/): NetBSD hdaudio(4) Driver Privilege Bypass Use-After-Free via HDAUDIO_FGRP_SETCONFIG ioctl (high 7.3)
- [CVE-2026-53995](https://insights.sbomify.com/CVE-2026-53995/): MLflow 3.17.1 and prior Path Traversal via Trace ID API (high 8.8)
- [CVE-2026-53994](https://insights.sbomify.com/CVE-2026-53994/): ProFTPD mod_sftp Heap Buffer Overflow via Unsigned Integer Underflow and Size Truncation (high 7.7)
- [CVE-2026-53992](https://insights.sbomify.com/CVE-2026-53992/): Reflected XSS in ProjectSend thumbnails-regenerate.php via start_date / end_date Parameters (medium 5.1)
- [CVE-2026-5399](https://insights.sbomify.com/CVE-2026-5399/): Redux Framework <= 4.5.13.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Slider Field Value (medium 6.4)
- [CVE-2026-53989](https://insights.sbomify.com/CVE-2026-53989/): Dockhand < 1.0.36 Open Redirect via OIDC Initiation Endpoint (medium 5.3)
- [CVE-2026-53988](https://insights.sbomify.com/CVE-2026-53988/): Dockhand < 1.0.40 Unauthenticated Webhook Trigger via Git Webhook Endpoints (critical 9.2)
- [CVE-2026-53987](https://insights.sbomify.com/CVE-2026-53987/): Tag Plugin for GLPI 11 before 2.14.4 Stored Cross-Site Scripting in Kanban Badge Rendering (high 7.3)
- [CVE-2026-53986](https://insights.sbomify.com/CVE-2026-53986/): Girafit Camera App 1.9.1 Hardcoded TURN Credentials Disclosure (medium 6.9)
- [CVE-2026-53985](https://insights.sbomify.com/CVE-2026-53985/): Ground Station prior to 0.6.0 Unauthenticated DoS via service_control Socket.IO (high 8.7)
- [CVE-2026-53984](https://insights.sbomify.com/CVE-2026-53984/): Missing authorization in Ground Station (high 8.8)
- [CVE-2026-53983](https://insights.sbomify.com/CVE-2026-53983/): Ground Station prior to 0.6.0 Unauthenticated Persistent Blind Server-Side Request Forgery via Orbital Data Source URL (critical 9.2)
- [CVE-2026-53982](https://insights.sbomify.com/CVE-2026-53982/): Cap-go Console < 12.28.2 Account Deletion DoS via Device Identifier Association (high 7.1)
- [CVE-2026-53981](https://insights.sbomify.com/CVE-2026-53981/): Cap-go < v12.128.2 Account Takeover via Unauthenticated Email Change Mechanism (high 7.2)
- [CVE-2026-5398](https://insights.sbomify.com/CVE-2026-5398/): Kernel use-after-free bug in the TIOCNOTTY handler (high 8.4)
- [CVE-2026-53977](https://insights.sbomify.com/CVE-2026-53977/): OpenChamber 1.11.7 Unauthenticated DoS via /api/system/shutdown (high 8.7)
- [CVE-2026-53976](https://insights.sbomify.com/CVE-2026-53976/): OpenChamber 1.11.7 Path Traversal File Read via allowOutsideWorkspace Parameter (critical 9.3)
- [CVE-2026-53975](https://insights.sbomify.com/CVE-2026-53975/): OpenChamber 1.11.7 Unauthenticated RCE via /api/fs/exec (critical 9.3)
- [CVE-2026-53970](https://insights.sbomify.com/CVE-2026-53970/): ZeroBrew version 0.3.1 and prior Missing Checksum Verification RCE via shim.rb (high 7.5)
- [CVE-2026-5397](https://insights.sbomify.com/CVE-2026-5397/): Vulnerability Related to an Uncontrolled Search Path Element in a UPS Management Application (high 7.8)
- [CVE-2026-53966](https://insights.sbomify.com/CVE-2026-53966/): XWiki Platform: Privilege escalation from edit to script right through Live Data editing (high 7.1)
- [CVE-2026-53965](https://insights.sbomify.com/CVE-2026-53965/): MCP PHP SDK: Unbounded SSE buffer in HttpTransport enables client-side denial of service (medium 6.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/555/