# Vulnerabilities published in 2026


- [CVE-2026-53964](https://insights.sbomify.com/CVE-2026-53964/): Document Merge Service vulnerable to RCE via SSTI (xlsx tempaltes) (high 7.2)
- [CVE-2026-53963](https://insights.sbomify.com/CVE-2026-53963/): Discourse: Stored-XSS in 2FA delete confirmation modal (high 7.3)
- [CVE-2026-53962](https://insights.sbomify.com/CVE-2026-53962/): Discourse: Insufficient SVG sanitization logic (medium 5.4)
- [CVE-2026-53961](https://insights.sbomify.com/CVE-2026-53961/): Discourse: Forged AWS SNS bounce notifications can disable a targeted user's email (missing TopicArn binding) (medium 6.5)
- [CVE-2026-53960](https://insights.sbomify.com/CVE-2026-53960/): Discourse: Hidden first-post excerpt is emitted in Q&A schema JSON-LD (medium 5.3)
- [CVE-2026-5396](https://insights.sbomify.com/CVE-2026-5396/): Fluent Forms <= 6.1.21 - Authenticated (Subscriber+) Authorization Bypass via 'form_id' Parameter (high 8.2)
- [CVE-2026-53959](https://insights.sbomify.com/CVE-2026-53959/): 4gaBoards: Mass Information Disclosure (Internal PII Leakage) on /api/users to any authenticated user (medium 6.5)
- [CVE-2026-53958](https://insights.sbomify.com/CVE-2026-53958/): 4gaBoards: SSO Pre-Account Takeover / Hijacking via Mass Assignment (high 7.6)
- [CVE-2026-53957](https://insights.sbomify.com/CVE-2026-53957/): Contentful MCP Server: export_space/import_space tools pass LLM-controlled `host`/`proxy` args to CMA client, redirecting server PAT to attacker-controlled endpoint (high 7.7)
- [CVE-2026-53956](https://insights.sbomify.com/CVE-2026-53956/): Rattler vulnerable to package cache path traversal via conda package build string (medium 5.4)
- [CVE-2026-53954](https://insights.sbomify.com/CVE-2026-53954/): Bugsink: DOS using large numbers of event tags (medium 4.3)
- [CVE-2026-53953](https://insights.sbomify.com/CVE-2026-53953/): GetSimple CMS: Predictable Password Reset Password Allows Administrator Account Takeover (critical 9.1)
- [CVE-2026-53952](https://insights.sbomify.com/CVE-2026-53952/): GetSimple CMS & GetSimpleCMS-CE have an Unauthenticated Admin Account Creation via Setup Logic Flaw (critical 9.8)
- [CVE-2026-53951](https://insights.sbomify.com/CVE-2026-53951/): Copier: trust-prefix bypass via path traversal runs tasks unprompted (high 8.8)
- [CVE-2026-53950](https://insights.sbomify.com/CVE-2026-53950/): @tryghost/activitypub: XSS in Ghost's ActivityPub client (high 7.5)
- [CVE-2026-5395](https://insights.sbomify.com/CVE-2026-5395/): Fluent Forms <= 6.2.0 - Authenticated (Subscriber+) Authorization Bypass via 'table' Parameter (high 8.2)
- [CVE-2026-53949](https://insights.sbomify.com/CVE-2026-53949/): Ghost Content API filter bypass reveals private fields (medium 5.3)
- [CVE-2026-53948](https://insights.sbomify.com/CVE-2026-53948/): Ghost: File Upload Content-Type Spoofing (medium 5.4)
- [CVE-2026-53947](https://insights.sbomify.com/CVE-2026-53947/): Ghost: Member existence leak via magic link sign-in response (medium 5.3)
- [CVE-2026-53946](https://insights.sbomify.com/CVE-2026-53946/): Ghost: Mobiledoc image-size fetch SSRF (medium 5.4)
- [CVE-2026-53945](https://insights.sbomify.com/CVE-2026-53945/): Ghost: Server-side request forgery via DNS rebinding in external request handling (medium 4.0)
- [CVE-2026-53944](https://insights.sbomify.com/CVE-2026-53944/): Ghost: Private IP filtering bypass to make server-side requests to internal services (medium 5.8)
- [CVE-2026-53943](https://insights.sbomify.com/CVE-2026-53943/): Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header (critical 9.6)
- [CVE-2026-53942](https://insights.sbomify.com/CVE-2026-53942/): Code injection in infrastructure (critical 9.9)
- [CVE-2026-53941](https://insights.sbomify.com/CVE-2026-53941/): Uprobe gadgets: unprivileged container's ld.so.cache causes high CPU utilization and container startup DoS (medium 6.9)
- [CVE-2026-53940](https://insights.sbomify.com/CVE-2026-53940/): Conda: Entry-point path traversal in noarch:python install (arbitrary file write) — canonical Python implementation (high 8.8)
- [CVE-2026-5394](https://insights.sbomify.com/CVE-2026-5394/): Pimcore Platform v12.3.3 - SQL Injection in DataObject composite index handling (high 7.0)
- [CVE-2026-53939](https://insights.sbomify.com/CVE-2026-53939/): OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption (critical 9.1)
- [CVE-2026-53938](https://insights.sbomify.com/CVE-2026-53938/): OpenIDC/cjose has a heap buffer overflow in AES Key Wrap decryption (A128KW/A192KW/A256KW) (high 8.2)
- [CVE-2026-53937](https://insights.sbomify.com/CVE-2026-53937/): MCP Kotlin SDK's unbounded line buffer in StdioServerTransport/StdioClientTransport leads to memory exhaustion (DoS) (medium 6.2)
- [CVE-2026-53935](https://insights.sbomify.com/CVE-2026-53935/): CiliumLocalRedirectPolicy addressMatcher allows cross-namespace service traffic hijacking and can break service translation (medium 6.9)
- [CVE-2026-53933](https://insights.sbomify.com/CVE-2026-53933/): Maravel-Framework Vulnerable to Side-Channel Information Disclosure (Error Oracle) via Dynamic Route Fuzzing (medium 6.9)
- [CVE-2026-53932](https://insights.sbomify.com/CVE-2026-53932/): laravel-backup-restore has an OS Command Injection during database restore (high 8.0)
- [CVE-2026-53931](https://insights.sbomify.com/CVE-2026-53931/): NocoDB: Server-Side Request Forgery via Spreadsheet Import Endpoint (medium 6.9)
- [CVE-2026-53930](https://insights.sbomify.com/CVE-2026-53930/): NocoDB: Server-Side Request Forgery via Base Migration URL (medium 5.1)
- [CVE-2026-5393](https://insights.sbomify.com/CVE-2026-5393/): OOB Read in DoTls13CertificateVerify with WOLFSSL_DUAL_ALG_CERTS (medium 6.3)
- [CVE-2026-53929](https://insights.sbomify.com/CVE-2026-53929/): NocoDB: Stored Cross-Site Scripting via Secure Attachment (medium 5.1)
- [CVE-2026-53928](https://insights.sbomify.com/CVE-2026-53928/): NocoDB: Refresh Tokens Persist Through Password Recovery (medium 6.3)
- [CVE-2026-53927](https://insights.sbomify.com/CVE-2026-53927/): NocoDB: Server-Side Request Forgery via Spreadsheet Fetch URL (medium 5.1)
- [CVE-2026-53926](https://insights.sbomify.com/CVE-2026-53926/): NocoDB: OAuth Tokens Persist Through Security Events (medium 6.3)
- [CVE-2026-53925](https://insights.sbomify.com/CVE-2026-53925/): Glances has arbitrary file write and command execution via `secure_popen` redirection and chaining operators in AMP command configuration (high 7.8)
- [CVE-2026-53924](https://insights.sbomify.com/CVE-2026-53924/): Gardens v2: Permissionless syncOutflow bypasses streaming proposal disputes (high 8.7)
- [CVE-2026-53923](https://insights.sbomify.com/CVE-2026-53923/): vLLM GGUF Kernels: int64_t to int truncation of tensor dimensions causes GPU buffer overflow (medium 5.3)
- [CVE-2026-53922](https://insights.sbomify.com/CVE-2026-53922/): odhcpd: pre-auth remote DoS via size_t underflow in dhcpv6_ia_handle_IAs (stack BOF, canary-terminated) (medium 6.5)
- [CVE-2026-53921](https://insights.sbomify.com/CVE-2026-53921/): odhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites) (critical 9.8)
- [CVE-2026-53920](https://insights.sbomify.com/CVE-2026-53920/): odhcpd DHCPv6 Short IA_NA/IA_PD Body Stack Disclosure (high 8.7)
- [CVE-2026-5392](https://insights.sbomify.com/CVE-2026-5392/): wolfSSL heap OOB read in PKCS7 SignedData streaming (low 2.3)
- [CVE-2026-53918](https://insights.sbomify.com/CVE-2026-53918/): odhcpd DHCPv6 IA dangling first pointer use-after-free (high 8.8)
- [CVE-2026-53917](https://insights.sbomify.com/CVE-2026-53917/): Denial of service in Apache ActiveMQ (high 7.5)
- [CVE-2026-53916](https://insights.sbomify.com/CVE-2026-53916/): Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: Unbounded header buffer in STOMP NIO codec (high 7.5)
- [CVE-2026-53915](https://insights.sbomify.com/CVE-2026-53915/): Code injection in GoLand (high 7.1)
- [CVE-2026-53914](https://insights.sbomify.com/CVE-2026-53914/): JetBrains Kotlin: Unsafe Deserialization in Kotlin Build Cache Enables Code Execution (medium 6.7)
- [CVE-2026-53913](https://insights.sbomify.com/CVE-2026-53913/): Apache Camel: KeycloakSecurityPolicy has Improper Authentication, Missing Authentication for Critical Function and Failing Open Vulnerabilities (critical 9.8)
- [CVE-2026-53912](https://insights.sbomify.com/CVE-2026-53912/): Cerebrate self-registration password hash exposure via inbox and audit log views (medium 5.1)
- [CVE-2026-53911](https://insights.sbomify.com/CVE-2026-53911/): Cerebrate primary key mass assignment in CRUD edit operations allows authenticated users to overwrite unrelated records (medium 6.3)
- [CVE-2026-53910](https://insights.sbomify.com/CVE-2026-53910/): Heap-based Buffer Overflow in GNU diffutils (low 2.1)
- [CVE-2026-5391](https://insights.sbomify.com/CVE-2026-5391/): LatePoint <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-53909](https://insights.sbomify.com/CVE-2026-53909/): Arbitrary File Upload in MCO (medium 5.3)
- [CVE-2026-53908](https://insights.sbomify.com/CVE-2026-53908/): User Enumeration in MCO (medium 6.9)
- [CVE-2026-53907](https://insights.sbomify.com/CVE-2026-53907/): Stored Cross‑Site Scripting in MCO (medium 4.8)
- [CVE-2026-53906](https://insights.sbomify.com/CVE-2026-53906/): Path Disclosure and Path Traversal in MCO (medium 5.1)
- [CVE-2026-53905](https://insights.sbomify.com/CVE-2026-53905/): Unauthorized Access to Administrator ACL View in MCO (medium 5.3)
- [CVE-2026-53904](https://insights.sbomify.com/CVE-2026-53904/): Account Denial of Service in MCO (medium 6.3)
- [CVE-2026-53903](https://insights.sbomify.com/CVE-2026-53903/): Insecure Direct Object Reference in MCO (medium 5.3)
- [CVE-2026-53902](https://insights.sbomify.com/CVE-2026-53902/): Privilege Escalation in MCO (high 7.1)
- [CVE-2026-53901](https://insights.sbomify.com/CVE-2026-53901/): Cerebrate before v1.37 allows mass assignment of record identifiers during object creation (high 8.7)
- [CVE-2026-53900](https://insights.sbomify.com/CVE-2026-53900/): Cookie injection was possible when opening a PDF link (medium 4.3)
- [CVE-2026-53899](https://insights.sbomify.com/CVE-2026-53899/): Cross-origin cookies could be leaked when opening a PDF link (medium 6.5)
- [CVE-2026-5389](https://insights.sbomify.com/CVE-2026-5389/): justhtml before 1.13.0 XSS via code fence breakout (medium 5.1)
- [CVE-2026-53882](https://insights.sbomify.com/CVE-2026-53882/): Path Traversal in Virtualization Station VM Import (high 8.7)
- [CVE-2026-5388](https://insights.sbomify.com/CVE-2026-5388/): justhtml before 1.15.0 Multiple Security Issues (critical 9.3)
- [CVE-2026-53878](https://insights.sbomify.com/CVE-2026-53878/): Header injection possibility since DomainNameValidator accepted newlines in input (medium 5.3)
- [CVE-2026-53877](https://insights.sbomify.com/CVE-2026-53877/): Heap buffer over-read in GDALRaster (medium 6.3)
- [CVE-2026-53876](https://insights.sbomify.com/CVE-2026-53876/): Command injection in RadiX AX6600 WiFi 6 Tri-Band Gaming Router (high 8.6)
- [CVE-2026-53875](https://insights.sbomify.com/CVE-2026-53875/): picklescan - Scanning Bypass via Dynamic Eval in scan_pytorch (high 7.1)
- [CVE-2026-53874](https://insights.sbomify.com/CVE-2026-53874/): picklescan - Arbitrary Code Execution via Obfuscated eval Call (critical 9.3)
- [CVE-2026-53873](https://insights.sbomify.com/CVE-2026-53873/): picklescan - Arbitrary Code Execution via profile.run() Blocklist Bypass (critical 9.3)
- [CVE-2026-53872](https://insights.sbomify.com/CVE-2026-53872/): picklescan - Arbitrary File Read via Unsafe Pickle Deserialization (high 8.7)
- [CVE-2026-53871](https://insights.sbomify.com/CVE-2026-53871/): Hermes WebUI < 0.51.368 - Profile-Scoped Authorization Bypass via Forged hermes_profile Cookie (high 8.6)
- [CVE-2026-53870](https://insights.sbomify.com/CVE-2026-53870/): Hermes Agent < 0.16.0 - Sensitive File Permission Vulnerability in Store Files (medium 6.8)
- [CVE-2026-5387](https://insights.sbomify.com/CVE-2026-5387/): AVEVA Pipeline Simulation Missing Authorization (critical 9.3)
- [CVE-2026-53869](https://insights.sbomify.com/CVE-2026-53869/): Hermes Agent < 0.16.0 - DNS Rebinding Bypass via WebSocket Endpoints (high 8.7)
- [CVE-2026-53868](https://insights.sbomify.com/CVE-2026-53868/): Capgo < 12.128.2 - Denial of Service via Unverified Email Account Registration and Deletion (high 8.7)
- [CVE-2026-53867](https://insights.sbomify.com/CVE-2026-53867/): Capgo < 12.128.2 - Orphaned File Retention via Profile Image Replacement (medium 5.3)
- [CVE-2026-53866](https://insights.sbomify.com/CVE-2026-53866/): OpenClaw < 2026.5.12 - Allowlist Bypass in Shell Inline-Command Parsing (high 7.6)
- [CVE-2026-53865](https://insights.sbomify.com/CVE-2026-53865/): OpenClaw < 2026.5.2 - Arbitrary Command Execution via Workspace-Derived Service PATH (high 7.2)
- [CVE-2026-53864](https://insights.sbomify.com/CVE-2026-53864/): OpenClaw < 2026.5.26 - Insufficient Environment Variable Sanitization in Node.js Control Variables (high 7.6)
- [CVE-2026-53863](https://insights.sbomify.com/CVE-2026-53863/): OpenClaw < 2026.4.25 - Unvalidated Group ID Acceptance in Tool Group Policy (medium 6.0)
- [CVE-2026-53862](https://insights.sbomify.com/CVE-2026-53862/): OpenClaw < 2026.5.12 - Bootstrap Token Replay via Pending Pairing Scope Widening (low 2.3)
- [CVE-2026-53861](https://insights.sbomify.com/CVE-2026-53861/): OpenClaw < 2026.5.6 - Allowlist Bypass via Combined POSIX Inline Flags on macOS (medium 5.3)
- [CVE-2026-53860](https://insights.sbomify.com/CVE-2026-53860/): OpenClaw < 2026.5.7 - Sender Policy Bypass via Mutable Conversation Identifiers in BlueBubbles (low 2.3)
- [CVE-2026-5386](https://insights.sbomify.com/CVE-2026-5386/): KMW CCTV Security Cameras Unverified Password Change (critical 9.1)
- [CVE-2026-53859](https://insights.sbomify.com/CVE-2026-53859/): OpenClaw < 2026.5.26 - Hostname Validation Bypass via Trailing-Dot Inconsistency (medium 6.0)
- [CVE-2026-53858](https://insights.sbomify.com/CVE-2026-53858/): OpenClaw < 2026.5.2 - Arbitrary Runtime Dependency Loading via STATE_DIRECTORY Environment Variable (high 7.0)
- [CVE-2026-53857](https://insights.sbomify.com/CVE-2026-53857/): OpenClaw < 2026.5.3 - Mutable Display Name Binding in Zalo allowFrom Policy (high 8.6)
- [CVE-2026-53856](https://insights.sbomify.com/CVE-2026-53856/): OpenClaw 2026.4.23 < 2026.4.24 - Insecure File Permissions in Config Recovery via OpenClaw.json (medium 5.7)
- [CVE-2026-53855](https://insights.sbomify.com/CVE-2026-53855/): OpenClaw < 2026.4.2 - Shell Positional Parameters Bypass in Inline-Eval Checks (high 7.6)
- [CVE-2026-53854](https://insights.sbomify.com/CVE-2026-53854/): OpenClaw < 2026.4.25 - Privilege Escalation via ownerAllowFrom Wildcard Inheritance in Internal/Webchat Commands (medium 6.0)
- [CVE-2026-53853](https://insights.sbomify.com/CVE-2026-53853/): OpenClaw < 2026.5.12 - Argument Pattern Bypass in Exec Allowlist via Linux and macOS (high 7.6)
- [CVE-2026-53852](https://insights.sbomify.com/CVE-2026-53852/): OpenClaw < 2026.4.25 - Scope Bypass via Empty-Scope Device Re-pairing (low 2.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/556/