# Vulnerabilities published in 2026 - [CVE-2026-5375](https://insights.sbomify.com/CVE-2026-5375/): runZero Platform API credential information leak (low 2.7) - [CVE-2026-53742](https://insights.sbomify.com/CVE-2026-53742/): Simple Link Directory through 9.0.4 Stored XSS via Embed Shortcode Attributes (medium 5.1) - [CVE-2026-53741](https://insights.sbomify.com/CVE-2026-53741/): Simple Link Directory through 9.0.4 Stored XSS via sld_no_results_found Option (medium 5.1) - [CVE-2026-53740](https://insights.sbomify.com/CVE-2026-53740/): Yoast Duplicate Post through 4.6 Stored Cross-Site Scripting via Scheduled Republish Notice (medium 5.1) - [CVE-2026-5374](https://insights.sbomify.com/CVE-2026-5374/): runZero Platform MCP information leak (medium 5.8) - [CVE-2026-53739](https://insights.sbomify.com/CVE-2026-53739/): Yoast Duplicate Post through 4.6 Cross-Site Request Forgery via duplicate_post_dismiss_notice (medium 5.1) - [CVE-2026-53738](https://insights.sbomify.com/CVE-2026-53738/): Copy & Delete Posts through 1.5.4 Privilege Escalation via cdp_action_handling Handler (high 7.2) - [CVE-2026-53737](https://insights.sbomify.com/CVE-2026-53737/): Juicer through 1.12.18 Stored Cross-Site Scripting via Unescaped API Response (medium 5.3) - [CVE-2026-53736](https://insights.sbomify.com/CVE-2026-53736/): Easy Twitter Feeds before 1.2.13 Cross-Site Request Forgery via duplicate_post Action (medium 5.1) - [CVE-2026-53730](https://insights.sbomify.com/CVE-2026-53730/): DataEase: Unauthorized Access to Engine Database via previewSql Endpoint (high 8.7) - [CVE-2026-5373](https://insights.sbomify.com/CVE-2026-5373/): runZero Platform superuser privilege escalation (high 8.1) - [CVE-2026-53729](https://insights.sbomify.com/CVE-2026-53729/): DataEase ExportCenter IDOR allows cross-user export task access (high 8.7) - [CVE-2026-53728](https://insights.sbomify.com/CVE-2026-53728/): Medplum - Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage (high 7.1) - [CVE-2026-53727](https://insights.sbomify.com/CVE-2026-53727/): css_parser: SSRF and Local File Disclosure in `CssParser::Parser#read_remote_file` (high 8.9) - [CVE-2026-53726](https://insights.sbomify.com/CVE-2026-53726/): Parse Server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL (medium 6.9) - [CVE-2026-53725](https://insights.sbomify.com/CVE-2026-53725/): parse-server: Endpoints `/login` and `/verifyPassword` disclose MFA secrets and protected fields when `_User` get is denied (medium 5.9) - [CVE-2026-53724](https://insights.sbomify.com/CVE-2026-53724/): Parse Server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist (low 2.1) - [CVE-2026-53723](https://insights.sbomify.com/CVE-2026-53723/): guzzlehttp/guzzle-services' XML Request Serialization Vulnerable to XML Injection via CDATA Terminator (medium 5.8) - [CVE-2026-53722](https://insights.sbomify.com/CVE-2026-53722/): Nuxt: Reflected XSS in `` via unsanitised `javascript:` or `data:` URL (medium 5.1) - [CVE-2026-53721](https://insights.sbomify.com/CVE-2026-53721/): Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher (high 8.8) - [CVE-2026-53720](https://insights.sbomify.com/CVE-2026-53720/): pymonocypher: Potential heap buffer overflow on nb_blocks in argon2i_32 when provided buffer is too small (medium 5.1) - [CVE-2026-5372](https://insights.sbomify.com/CVE-2026-5372/): runZero Platform SQL injection in saved queries (medium 6.4) - [CVE-2026-53719](https://insights.sbomify.com/CVE-2026-53719/): Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorization (medium 6.5) - [CVE-2026-53718](https://insights.sbomify.com/CVE-2026-53718/): Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypass (medium 6.4) - [CVE-2026-53717](https://insights.sbomify.com/CVE-2026-53717/): Envoy Gateway: OCI layer extraction allocates make([]byte, h.Size) from untrusted tar header (medium 6.5) - [CVE-2026-53716](https://insights.sbomify.com/CVE-2026-53716/): Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit (medium 6.5) - [CVE-2026-53715](https://insights.sbomify.com/CVE-2026-53715/): Envoy Gateway: Wasm cache ServeHTTP reads mappingPath2Cache without lock (medium 5.3) - [CVE-2026-53714](https://insights.sbomify.com/CVE-2026-53714/): Envoy Gateway: xDS Control Plane Information Disclosure when Envoy Gateway operates in GatewayNamespaceMode (high 7.4) - [CVE-2026-53713](https://insights.sbomify.com/CVE-2026-53713/): Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure (critical 9.1) - [CVE-2026-53712](https://insights.sbomify.com/CVE-2026-53712/): SCRAM: Silent channel-binding authentication downgrade via unsupported certificate algorithms (high 8.2) - [CVE-2026-53711](https://insights.sbomify.com/CVE-2026-53711/): MCP ContextForge: Global Prompts stored cross-site scripting compromises the Admin UI (medium 5.1) - [CVE-2026-53710](https://insights.sbomify.com/CVE-2026-53710/): MCP Context Forge: RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server (critical 10.0) - [CVE-2026-5371](https://insights.sbomify.com/CVE-2026-5371/): Missing authorization in MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy) (high 7.1) - [CVE-2026-53709](https://insights.sbomify.com/CVE-2026-53709/): Hardcoded credentials in mcp-context-forge (critical 9.8) - [CVE-2026-53708](https://insights.sbomify.com/CVE-2026-53708/): ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`) (medium 6.6) - [CVE-2026-53706](https://insights.sbomify.com/CVE-2026-53706/): Security feature bypass in prevail (high 8.8) - [CVE-2026-53705](https://insights.sbomify.com/CVE-2026-53705/): Gstreamer1-plugins-good: gstreamer: heap buffer overflow in wavpack decoder via integer overflow (high 7.6) - [CVE-2026-53704](https://insights.sbomify.com/CVE-2026-53704/): Gstreamer1-plugins-ugly-free: gstreamer: out-of-bounds read in realmedia demuxer fileinfo metadata parser (high 7.1) - [CVE-2026-53703](https://insights.sbomify.com/CVE-2026-53703/): Gstreamer1-plugins-ugly-free: gstreamer: out-of-bounds read in realmedia demuxer audio stream header parser (high 7.1) - [CVE-2026-53702](https://insights.sbomify.com/CVE-2026-53702/): Gstreamer1-plugins-bad-free: gstreamer: stack buffer overflow in h.265 buffering period sei parser (medium 6.5) - [CVE-2026-53701](https://insights.sbomify.com/CVE-2026-53701/): Gstreamer1-plugins-bad-free: gstreamer: out-of-bounds write in h.266/vvc pps picture partition parser (medium 6.5) - [CVE-2026-5370](https://insights.sbomify.com/CVE-2026-5370/): krayin laravel-crm Activities Module/Notes inbox.spec.ts composeMail cross site scripting (medium 5.1) - [CVE-2026-53698](https://insights.sbomify.com/CVE-2026-53698/): Silverpeas mishandles the "Personal space" feature that is selected when no componentId is set (medium 6.5) - [CVE-2026-53694](https://insights.sbomify.com/CVE-2026-53694/): Potential local privileges escalation through argument injection in the nxchmod.sh script (high 7.3) - [CVE-2026-53693](https://insights.sbomify.com/CVE-2026-53693/): MISP BSimVis stored cross-site scripting in tag and cluster rendering paths via unescaped tag metadata and UI labels (medium 6.9) - [CVE-2026-53692](https://insights.sbomify.com/CVE-2026-53692/): Weak hashing algorithm in Redeight CMS (medium 5.9) - [CVE-2026-53691](https://insights.sbomify.com/CVE-2026-53691/): Remote Code Execution in Redeight CMS (high 8.6) - [CVE-2026-53690](https://insights.sbomify.com/CVE-2026-53690/): SQL Injection in Redeight CMS (critical 9.3) - [CVE-2026-53689](https://insights.sbomify.com/CVE-2026-53689/): Integer overflow in libnfs (high 7.1) - [CVE-2026-53683](https://insights.sbomify.com/CVE-2026-53683/): Freeipa: idm: idm/freeipa web ui - client-side open redirect in reset_password.html (medium 4.3) - [CVE-2026-53682](https://insights.sbomify.com/CVE-2026-53682/): Pki-core: dogtag-pki: unauthenticated dogtag ca rest api exposes security domain hosts (medium 5.3) - [CVE-2026-5368](https://insights.sbomify.com/CVE-2026-5368/): projectworlds Car Rental Project Parameter login.php sql injection (medium 6.9) - [CVE-2026-53676](https://insights.sbomify.com/CVE-2026-53676/): Code injection in ThingsBoard (high 8.6) - [CVE-2026-53675](https://insights.sbomify.com/CVE-2026-53675/): BuddyPress 14.4.0 Friends List IDOR via REST API (medium 5.3) - [CVE-2026-53674](https://insights.sbomify.com/CVE-2026-53674/): BuddyPress 14.4.0 REGEXP Injection via @Mention Username Resolution (high 7.1) - [CVE-2026-53673](https://insights.sbomify.com/CVE-2026-53673/): BuddyPress 14.4.0 Private Message IDOR via REST API user_id Parameter (high 8.6) - [CVE-2026-53671](https://insights.sbomify.com/CVE-2026-53671/): PREVAIL: Context-write no-op in do_mem_store allows unsafe eBPF programs to pass verification (critical 9.3) - [CVE-2026-53670](https://insights.sbomify.com/CVE-2026-53670/): PREVAIL: Non-singleton typeset in add() skips offset update, allowing OOB access to pass eBPF verification (critical 9.3) - [CVE-2026-5367](https://insights.sbomify.com/CVE-2026-5367/): Ovn: ovn: information disclosure via crafted dhcpv6 packets (high 8.6) - [CVE-2026-53669](https://insights.sbomify.com/CVE-2026-53669/): React Router: Open redirect via backslash in and useNavigate (CVE-2025-68470 bypass) (medium 5.1) - [CVE-2026-53668](https://insights.sbomify.com/CVE-2026-53668/): React Router: Open redirect can lead to XSS (medium 6.9) - [CVE-2026-53667](https://insights.sbomify.com/CVE-2026-53667/): React Router: RSCErrorHandler Missing Protocol Validation (XSS) (medium 6.9) - [CVE-2026-53666](https://insights.sbomify.com/CVE-2026-53666/): React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration (medium 6.1) - [CVE-2026-53663](https://insights.sbomify.com/CVE-2026-53663/): React Router: `handleDocumentRequest` CSRF check covers `POST` only; PUT/PATCH/DELETE bypass (low 3.1) - [CVE-2026-53662](https://insights.sbomify.com/CVE-2026-53662/): immich: One-click account takeover via XSS in login page continue redirect (critical 9.6) - [CVE-2026-53661](https://insights.sbomify.com/CVE-2026-53661/): boruta-server sent sensitive session cookies without the Secure attribute (high 8.8) - [CVE-2026-53660](https://insights.sbomify.com/CVE-2026-53660/): OpenAM Insecure SSO Cookie Initialization (high 7.4) - [CVE-2026-5366](https://insights.sbomify.com/CVE-2026-5366/): Git Argument Injection in prefecthq/prefect (critical 9.9) - [CVE-2026-53659](https://insights.sbomify.com/CVE-2026-53659/): http4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoS (high 7.5) - [CVE-2026-53658](https://insights.sbomify.com/CVE-2026-53658/): Fabric CA: LDAP Injection via Unescaped Username in GetUser Filter (medium 6.3) - [CVE-2026-53657](https://insights.sbomify.com/CVE-2026-53657/): Lima: An arbitrary user in a QEMU VM could gain the root privilege in the VM via the guest agent socket (high 8.2) - [CVE-2026-53656](https://insights.sbomify.com/CVE-2026-53656/): FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data (medium 6.3) - [CVE-2026-53655](https://insights.sbomify.com/CVE-2026-53655/): node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling) (medium 6.9) - [CVE-2026-53654](https://insights.sbomify.com/CVE-2026-53654/): Grav: Unauthenticated open redirect via login twofa_cancel _redirect (medium 5.3) - [CVE-2026-53653](https://insights.sbomify.com/CVE-2026-53653/): Grav: Unauthenticated denial of service via unbounded image derivative dimensions (high 8.7) - [CVE-2026-5365](https://insights.sbomify.com/CVE-2026-5365/): LatePoint <= 5.3.2 - Cross-Site Request Forgery via 'customer_cabinet__request_cancellation' AJAX Route (medium 4.3) - [CVE-2026-53649](https://insights.sbomify.com/CVE-2026-53649/): Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE (critical 9.6) - [CVE-2026-53648](https://insights.sbomify.com/CVE-2026-53648/): FOSSBilling: Downloadable product files can be overwritten through filename collisions (medium 5.1) - [CVE-2026-53647](https://insights.sbomify.com/CVE-2026-53647/): FOSSBilling vulnerable to unauthenticated API key configuration disclosure via guest Serviceapikey get_info endpoint (medium 6.9) - [CVE-2026-53646](https://insights.sbomify.com/CVE-2026-53646/): FOSSBilling: Client password reset token reuse allows persistent account takeover (high 7.7) - [CVE-2026-53645](https://insights.sbomify.com/CVE-2026-53645/): FOSSBilling's missing self-edit prevention in staff permission management allows persistent privilege escalation (high 8.5) - [CVE-2026-53644](https://insights.sbomify.com/CVE-2026-53644/): FOSSBilling's missing order-state validation allows clients to read and reset API key secrets for non-active orders (high 8.6) - [CVE-2026-53643](https://insights.sbomify.com/CVE-2026-53643/): FOSSBilling allows low-privileged staff accounts to perform unauthorized actions via admin API endpoints (high 8.7) - [CVE-2026-53642](https://insights.sbomify.com/CVE-2026-53642/): FOSSBilling: Unverified clients can access client-area pages when email confirmation is required (medium 5.3) - [CVE-2026-53641](https://insights.sbomify.com/CVE-2026-53641/): FOSSBilling has stored XSS in client email views via unescaped content in JavaScript template literal (medium 4.8) - [CVE-2026-53640](https://insights.sbomify.com/CVE-2026-53640/): Missing authorization in FOSSBilling (low 2.3) - [CVE-2026-5364](https://insights.sbomify.com/CVE-2026-5364/): File upload in Drag and Drop File Upload for Contact Form 7 (high 8.1) - [CVE-2026-53639](https://insights.sbomify.com/CVE-2026-53639/): Sylius: IDOR on Shop Payment Request API endpoints (medium 6.3) - [CVE-2026-53638](https://insights.sbomify.com/CVE-2026-53638/): Sylius: Channel-based payment method restriction bypass on shop account orders API endpoint (medium 4.3) - [CVE-2026-53637](https://insights.sbomify.com/CVE-2026-53637/): Sylius: Cart FormComponent allows modification or deletion of an already-completed order (medium 6.5) - [CVE-2026-53636](https://insights.sbomify.com/CVE-2026-53636/): Open edX LTI OAuth Replay Attack (medium 4.7) - [CVE-2026-53635](https://insights.sbomify.com/CVE-2026-53635/): Open edX Platform: Insufficient Permission on set_course_mode_price() (high 7.6) - [CVE-2026-53634](https://insights.sbomify.com/CVE-2026-53634/): Sharp: Missing Authorization Check in Quick Creation Command Endpoints (medium 4.3) - [CVE-2026-53633](https://insights.sbomify.com/CVE-2026-53633/): Vitest: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE (critical 9.8) - [CVE-2026-53632](https://insights.sbomify.com/CVE-2026-53632/): NTLMv2 hash disclosure via UNC path handling on Windows (medium 5.5) - [CVE-2026-5363](https://insights.sbomify.com/CVE-2026-5363/): Use of weak cryptographic key in TP-Link Archer C7 (medium 5.4) - [CVE-2026-53629](https://insights.sbomify.com/CVE-2026-53629/): GLPI: SQL injection in history tab (high 7.1) - [CVE-2026-53628](https://insights.sbomify.com/CVE-2026-53628/): GLPI: Unallowed authentication method update by administrator (medium 5.9) - [CVE-2026-53627](https://insights.sbomify.com/CVE-2026-53627/): GLPI: Unexpected access to update operations through the API (medium 6.0) - [CVE-2026-53626](https://insights.sbomify.com/CVE-2026-53626/): GLPI: Arbitrary Document Read via Form Context Authorization Bypass (high 7.1) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/558/