# Vulnerabilities published in 2026


- [CVE-2026-53625](https://insights.sbomify.com/CVE-2026-53625/): GLPI: Privilege Escalation via authtype API manipulation (high 7.5)
- [CVE-2026-53624](https://insights.sbomify.com/CVE-2026-53624/): Fiber: HSTS header never set in helmet middleware due to incorrect protocol check (medium 4.8)
- [CVE-2026-53622](https://insights.sbomify.com/CVE-2026-53622/): Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts (high 7.8)
- [CVE-2026-53620](https://insights.sbomify.com/CVE-2026-53620/): Missing authorization in GROWI (medium 5.3)
- [CVE-2026-5362](https://insights.sbomify.com/CVE-2026-5362/): Pimcore Platform v12.3.3 - Stored XSS in Document Editable Embed rendering (medium 4.8)
- [CVE-2026-53615](https://insights.sbomify.com/CVE-2026-53615/): util-linux libblkid DOS extended-partition overflow produces invalid partition metadata (high 8.0)
- [CVE-2026-53614](https://insights.sbomify.com/CVE-2026-53614/): util-linux LIBMOUNT_FORCE_MOUNT2 allows nosuid and noexec bypass (high 7.0)
- [CVE-2026-53613](https://insights.sbomify.com/CVE-2026-53613/): util-linux mount target TOCTOU allows local privilege escalation (high 7.0)
- [CVE-2026-53612](https://insights.sbomify.com/CVE-2026-53612/): util-linux mount hook_owner TOCTOU allows local privilege escalation (high 7.0)
- [CVE-2026-53611](https://insights.sbomify.com/CVE-2026-53611/): Looking Glass: Remote Code Execution via Unanchored Regular Expression in BGPASPath Input Validation (critical 9.8)
- [CVE-2026-53610](https://insights.sbomify.com/CVE-2026-53610/): GLPI: Reflected XSS in dashboards (high 7.5)
- [CVE-2026-5361](https://insights.sbomify.com/CVE-2026-5361/): Envira Gallery <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via 'arrows' Parameter (medium 6.4)
- [CVE-2026-53609](https://insights.sbomify.com/CVE-2026-53609/): Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass (critical 9.1)
- [CVE-2026-53608](https://insights.sbomify.com/CVE-2026-53608/): @apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag (high 8.7)
- [CVE-2026-53607](https://insights.sbomify.com/CVE-2026-53607/): @apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header (low 3.7)
- [CVE-2026-53606](https://insights.sbomify.com/CVE-2026-53606/): sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes (medium 5.4)
- [CVE-2026-53605](https://insights.sbomify.com/CVE-2026-53605/): Reachy Mini Wireless: Local Privilege Escalation via Unrestricted sudo systemctl Grant (high 7.8)
- [CVE-2026-53604](https://insights.sbomify.com/CVE-2026-53604/): nebula-mesh: CA private key not zeroized on web mobile-bundle error paths (high 7.1)
- [CVE-2026-53603](https://insights.sbomify.com/CVE-2026-53603/): nebula-mesh: Operator session tokens stored in plaintext in the database (high 7.1)
- [CVE-2026-53602](https://insights.sbomify.com/CVE-2026-53602/): nebula-mesh - Host revocation is not durable: blocked/offboarded hosts can regain a valid certificate (medium 6.9)
- [CVE-2026-53600](https://insights.sbomify.com/CVE-2026-53600/): async-tar PAX extension-header desync enables tar entry/content smuggling (medium 6.3)
- [CVE-2026-5360](https://insights.sbomify.com/CVE-2026-5360/): Free5GC aper type confusion (medium 6.3)
- [CVE-2026-53599](https://insights.sbomify.com/CVE-2026-53599/): Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers (high 7.5)
- [CVE-2026-53598](https://insights.sbomify.com/CVE-2026-53598/): Prompty: Arbitrary File Read via ${file:path} Reference Expansion (high 7.5)
- [CVE-2026-53597](https://insights.sbomify.com/CVE-2026-53597/): Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loader (high 8.7)
- [CVE-2026-53596](https://insights.sbomify.com/CVE-2026-53596/): FreeScout has unrestricted file upload without rate limiting that leads to resource exhaustion (DoS) (medium 5.3)
- [CVE-2026-53595](https://insights.sbomify.com/CVE-2026-53595/): FreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQL (critical 9.4)
- [CVE-2026-53594](https://insights.sbomify.com/CVE-2026-53594/): FreeScout has Arbitrary File Read in App Logs Viewer via Forged Encrypted Path (medium 4.9)
- [CVE-2026-53593](https://insights.sbomify.com/CVE-2026-53593/): File upload in freescout (high 8.8)
- [CVE-2026-53592](https://insights.sbomify.com/CVE-2026-53592/): FreeScout vulnerable to prototype pollution in getQueryParam (medium 4.6)
- [CVE-2026-53591](https://insights.sbomify.com/CVE-2026-53591/): FreeScout Vulnerable to Unauthenticated Conversation Thread Injection via HMAC Length Bypass in FetchEmails (high 8.6)
- [CVE-2026-53587](https://insights.sbomify.com/CVE-2026-53587/): libgit2 - Unauthenticated network-reachable heap out-of-bounds read in transports/smart_pkt.c:set_data (high 7.5)
- [CVE-2026-53586](https://insights.sbomify.com/CVE-2026-53586/): libgit2: HTTP transport can leak credentials to an offsite redirect target (medium 6.5)
- [CVE-2026-53585](https://insights.sbomify.com/CVE-2026-53585/): libgit2: Unbounded Memory Allocation via Delta Object Result-Size Header (medium 5.3)
- [CVE-2026-53584](https://insights.sbomify.com/CVE-2026-53584/): libgit2: Submodule path traversal (medium 4.3)
- [CVE-2026-53583](https://insights.sbomify.com/CVE-2026-53583/): libgit2: Inverted IP SubjectAltName Comparison in OpenSSL Backend (medium 6.5)
- [CVE-2026-53582](https://insights.sbomify.com/CVE-2026-53582/): OPNsense: XPATH Injection can disclose any secret in config.xml (high 7.1)
- [CVE-2026-53581](https://insights.sbomify.com/CVE-2026-53581/): ntp: write path traversal (critical 9.0)
- [CVE-2026-53580](https://insights.sbomify.com/CVE-2026-53580/): Trilium arbitrary file read and denial of service via file:// URLs in the automatic image-download feature (high 8.1)
- [CVE-2026-53579](https://insights.sbomify.com/CVE-2026-53579/): Trilium: Note Import to RCE via Book Note (critical 9.3)
- [CVE-2026-53578](https://insights.sbomify.com/CVE-2026-53578/): Trilium: Note Import to RCE via Mind Elixir dangerouslySetInnerHtml (critical 9.3)
- [CVE-2026-53577](https://insights.sbomify.com/CVE-2026-53577/): Kestra: Cross-Execution File Read via Preview Endpoint (IDOR) (medium 6.5)
- [CVE-2026-53576](https://insights.sbomify.com/CVE-2026-53576/): Kestra: Unauthenticated RCE via /configs path-suffix auth-filter bypass (critical 10.0)
- [CVE-2026-53575](https://insights.sbomify.com/CVE-2026-53575/): EspoCRM: Persistent XSS via CSP nonce injection in applicationName setting by admin user (low 2.7)
- [CVE-2026-53574](https://insights.sbomify.com/CVE-2026-53574/): EspoCRM: Blind SQL injection via streamAttachments where-clause complex expression (high 7.6)
- [CVE-2026-53573](https://insights.sbomify.com/CVE-2026-53573/): core-geonetwork has an Open Redirect Bypass (medium 4.8)
- [CVE-2026-53572](https://insights.sbomify.com/CVE-2026-53572/): KEDA: PostgreSQL connection string parameter injection via incomplete whitespace escaping (medium 5.9)
- [CVE-2026-53571](https://insights.sbomify.com/CVE-2026-53571/): Vite: `server.fs.deny` bypass on Windows alternate paths (high 8.2)
- [CVE-2026-5357](https://insights.sbomify.com/CVE-2026-5357/): Download Manager <= 3.3.52 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-53569](https://insights.sbomify.com/CVE-2026-53569/): Frappe: Missing authorization in toggle_like and mark_as_seen (medium 5.3)
- [CVE-2026-53568](https://insights.sbomify.com/CVE-2026-53568/): Frappe: Stored XSS in Frappe Report/List View via 'set_link_title_field_value' (medium 6.9)
- [CVE-2026-53566](https://insights.sbomify.com/CVE-2026-53566/): Out-of-bounds memory read (medium 6.8)
- [CVE-2026-53565](https://insights.sbomify.com/CVE-2026-53565/): Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges (high 8.5)
- [CVE-2026-53564](https://insights.sbomify.com/CVE-2026-53564/): Arbitrary file read and write (medium 5.1)
- [CVE-2026-53563](https://insights.sbomify.com/CVE-2026-53563/): Persistent Command Execution (medium 6.9)
- [CVE-2026-53562](https://insights.sbomify.com/CVE-2026-53562/): Local Privilege Escalation (high 8.5)
- [CVE-2026-53561](https://insights.sbomify.com/CVE-2026-53561/): Auth bypass in Apache Hive (high 7.4)
- [CVE-2026-5356](https://insights.sbomify.com/CVE-2026-5356/): Business logic in LatePoint – Calendar Booking Plugin for Appointments and Events (high 7.5)
- [CVE-2026-53557](https://insights.sbomify.com/CVE-2026-53557/): SQLBot: Second-Order SQL Injection via Excel Datasource Leading to Remote Command Execution (high 7.7)
- [CVE-2026-53556](https://insights.sbomify.com/CVE-2026-53556/): SQLBot: Authenticated SQL Injection in previewData Resulting in Arbitrary File Read (medium 6.0)
- [CVE-2026-53555](https://insights.sbomify.com/CVE-2026-53555/): Stored XSS via SVG Upload (medium 5.1)
- [CVE-2026-53554](https://insights.sbomify.com/CVE-2026-53554/): SQLBot: Arbitrary File Write via parseExcel Leading to Code Execution Through Alembic Import Processing (high 7.3)
- [CVE-2026-53553](https://insights.sbomify.com/CVE-2026-53553/): Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise (high 7.7)
- [CVE-2026-53552](https://insights.sbomify.com/CVE-2026-53552/): Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers (critical 9.6)
- [CVE-2026-53551](https://insights.sbomify.com/CVE-2026-53551/): free5GC AUSF: null byte injection in supiOrSuci causes HTTP 500 internal service failure (medium 6.9)
- [CVE-2026-53550](https://insights.sbomify.com/CVE-2026-53550/): js-yaml: Quadratic-complexity DoS in merge key handling via repeated aliases (medium 5.3)
- [CVE-2026-5355](https://insights.sbomify.com/CVE-2026-5355/): Trendnet TEW-657BRM setup.cgi vpn_drop os command injection (medium 5.3)
- [CVE-2026-53549](https://insights.sbomify.com/CVE-2026-53549/): Termix: Server-Side Request Forgery via Proxy Connectivity Test (high 7.7)
- [CVE-2026-53548](https://insights.sbomify.com/CVE-2026-53548/): Termix: IDOR — Authenticated user can fetch SSH passwords for hosts owned by other users (critical 9.6)
- [CVE-2026-53547](https://insights.sbomify.com/CVE-2026-53547/): Termix: Account Takeover via Global Settings Disclosure (high 8.8)
- [CVE-2026-53546](https://insights.sbomify.com/CVE-2026-53546/): Termix: Missing authorization in SSH host credential resolution exposes stored credentials (critical 9.6)
- [CVE-2026-53545](https://insights.sbomify.com/CVE-2026-53545/): Termix: Remote Code Execution via Tunnel Disconnect pkill Command Injection (critical 9.8)
- [CVE-2026-53542](https://insights.sbomify.com/CVE-2026-53542/): Termix: Tar option injection in file-manager archive creation allows command execution on managed SSH hosts (high 8.8)
- [CVE-2026-53541](https://insights.sbomify.com/CVE-2026-53541/): OliveTin has Unvalidated `ot_`-prefixed Arguments that Bypass Input Filtering (medium 4.3)
- [CVE-2026-53540](https://insights.sbomify.com/CVE-2026-53540/): Python-Multipart: Negative Content-Length in parse_form buffers the entire body in memory (low 3.7)
- [CVE-2026-5354](https://insights.sbomify.com/CVE-2026-5354/): Trendnet TEW-657BRM setup.cgi vpn_connect os command injection (medium 5.3)
- [CVE-2026-53539](https://insights.sbomify.com/CVE-2026-53539/): Python-Multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service (high 7.5)
- [CVE-2026-53538](https://insights.sbomify.com/CVE-2026-53538/): Python-Multipart: Semicolon treated as querystring field separator enables parameter smuggling (low 3.7)
- [CVE-2026-53537](https://insights.sbomify.com/CVE-2026-53537/): Python-Multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters (low 3.7)
- [CVE-2026-53536](https://insights.sbomify.com/CVE-2026-53536/): Activepieces: Cross-tenant file download via missing JWT audience check on step-files signed URL (medium 5.3)
- [CVE-2026-53535](https://insights.sbomify.com/CVE-2026-53535/): Activepieces: Arbitrary file write in git-sync via path traversal and symlinks (medium 5.9)
- [CVE-2026-53534](https://insights.sbomify.com/CVE-2026-53534/): JabRef CAYW Sublime Text integration permits operating-system command injection (high 7.5)
- [CVE-2026-53533](https://insights.sbomify.com/CVE-2026-53533/): aiosmtplib: SMTP command injection via CR/LF in sender/recipient address (medium 6.9)
- [CVE-2026-53532](https://insights.sbomify.com/CVE-2026-53532/): OpenEXR: Unhandled assert abort in HTJ2K decoder via crafted QCD marker (DoS) (high 7.1)
- [CVE-2026-53531](https://insights.sbomify.com/CVE-2026-53531/): ratex-parser has unbounded parser recursion that leads to stack overflow (process abort) (medium 6.9)
- [CVE-2026-53530](https://insights.sbomify.com/CVE-2026-53530/): ratex-parser panics on `\verb` with a multibyte delimiter (UTF-8 byte-boundary slice) (high 8.7)
- [CVE-2026-5353](https://insights.sbomify.com/CVE-2026-5353/): Trendnet TEW-657BRM setup.cgi ping_test os command injection (medium 5.3)
- [CVE-2026-53529](https://insights.sbomify.com/CVE-2026-53529/): LeafWiki vulnerable to stored XSS via search-result title (highlight() returns raw title into dangerouslySetInnerHTML) (medium 4.8)
- [CVE-2026-53528](https://insights.sbomify.com/CVE-2026-53528/): FileWiki has path traversal in RenameAsset via unsanitized oldFilename parameter (high 8.8)
- [CVE-2026-53527](https://insights.sbomify.com/CVE-2026-53527/): LeafWiki Vulnerable to Privilege Escalation via User Self-Service Update (high 8.8)
- [CVE-2026-53525](https://insights.sbomify.com/CVE-2026-53525/): WeeChat has Non-Constant-Time Password Hash Comparison in Relay Authentication (high 7.4)
- [CVE-2026-53524](https://insights.sbomify.com/CVE-2026-53524/): WeeChat has a Decompression Bomb in Relay WebSocket (DoS) (medium 6.5)
- [CVE-2026-53523](https://insights.sbomify.com/CVE-2026-53523/): Nezha Monitoring: OAuth2 Redirect URL — Host Header Injection (medium 6.8)
- [CVE-2026-53522](https://insights.sbomify.com/CVE-2026-53522/): Nezha Monitoring: Unbounded WebSocket Streams — Resource Exhaustion DoS (medium 6.5)
- [CVE-2026-53521](https://insights.sbomify.com/CVE-2026-53521/): Nezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile context (medium 6.4)
- [CVE-2026-53520](https://insights.sbomify.com/CVE-2026-53520/): Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing (medium 6.5)
- [CVE-2026-5352](https://insights.sbomify.com/CVE-2026-5352/): Trendnet TEW-657BRM setup.cgi edit os command injection (medium 5.3)
- [CVE-2026-53519](https://insights.sbomify.com/CVE-2026-53519/): Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key (critical 9.1)
- [CVE-2026-53518](https://insights.sbomify.com/CVE-2026-53518/): Better Auth OAuth Provider: Race Condition in Authorization Code Exchange Enables Multi-Use Code Redemption (high 7.6)
- [CVE-2026-53517](https://insights.sbomify.com/CVE-2026-53517/): Better Auth OAuth Provider: Refresh Token Rotation Race Condition Allows Concurrent Replay and Token Family Forking (high 8.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/559/