# Vulnerabilities published in 2026


- [CVE-2026-53516](https://insights.sbomify.com/CVE-2026-53516/): Better Auth: Account takeover via OAuth auto-link to unverified pre-registered email (high 8.3)
- [CVE-2026-53515](https://insights.sbomify.com/CVE-2026-53515/): Better Auth: Privilege escalation via SSO provider registration: missing admin role check in @better-auth/sso (high 7.1)
- [CVE-2026-53514](https://insights.sbomify.com/CVE-2026-53514/): Better Auth: Unauthorized invitation acceptance via unverified email match in organization plugin (high 7.7)
- [CVE-2026-53513](https://insights.sbomify.com/CVE-2026-53513/): Better Auth: Server-side request forgery via unvalidated OIDC endpoints on @better-auth/sso provider registration (critical 9.6)
- [CVE-2026-53512](https://insights.sbomify.com/CVE-2026-53512/): Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins (critical 9.1)
- [CVE-2026-53511](https://insights.sbomify.com/CVE-2026-53511/): calibre: Arbitrary Code Execution in Template Formatter via Book Metadata (high 8.5)
- [CVE-2026-53510](https://insights.sbomify.com/CVE-2026-53510/): Savon::Model evaluates WSDL operation names as Ruby source (high 8.1)
- [CVE-2026-5351](https://insights.sbomify.com/CVE-2026-5351/): Trendnet TEW-657BRM setup.cgi add_wps_client os command injection (medium 5.3)
- [CVE-2026-53509](https://insights.sbomify.com/CVE-2026-53509/): @aborruso/ckan-mcp-server: SSRF via base_url allows access to internal networks (Potential fix bypass of CVE-2026-33060) (medium 5.7)
- [CVE-2026-53508](https://insights.sbomify.com/CVE-2026-53508/): oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read) (medium 6.0)
- [CVE-2026-53507](https://insights.sbomify.com/CVE-2026-53507/): Server-side request forgery in oasdiff-action (high 8.3)
- [CVE-2026-53505](https://insights.sbomify.com/CVE-2026-53505/): Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS (high 7.5)
- [CVE-2026-53504](https://insights.sbomify.com/CVE-2026-53504/): Thumbor has Regex Denial of Service (ReDoS) in `convolution` filter (high 7.5)
- [CVE-2026-53503](https://insights.sbomify.com/CVE-2026-53503/): Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS (high 7.5)
- [CVE-2026-53502](https://insights.sbomify.com/CVE-2026-53502/): Thumbor has path traversal via post-validation URL decoding bypass in file_loader (high 8.7)
- [CVE-2026-53501](https://insights.sbomify.com/CVE-2026-53501/): Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature (high 8.2)
- [CVE-2026-53500](https://insights.sbomify.com/CVE-2026-53500/): Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot (high 8.2)
- [CVE-2026-5350](https://insights.sbomify.com/CVE-2026-5350/): Trendnet TEW-657BRM setup.cgi update_pcdb stack-based overflow (high 8.7)
- [CVE-2026-53499](https://insights.sbomify.com/CVE-2026-53499/): FORT-validator Vulnerable to RRDP Shared Snapshot Cache Poisoning (high 7.2)
- [CVE-2026-53497](https://insights.sbomify.com/CVE-2026-53497/): CrossWatch: Unauthenticated /api/app-auth/status endpoint leaks active session metadata (IP, User-Agent, session IDs) (medium 5.3)
- [CVE-2026-53496](https://insights.sbomify.com/CVE-2026-53496/): ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxes (medium 5.3)
- [CVE-2026-53495](https://insights.sbomify.com/CVE-2026-53495/): containerd CRI ExecSync Goroutine Leak Leading to Node-Level Denial of Service (medium 6.8)
- [CVE-2026-53493](https://insights.sbomify.com/CVE-2026-53493/): Containerd has image-pull DoS via crafted OCI index graph amplification (medium 6.9)
- [CVE-2026-53492](https://insights.sbomify.com/CVE-2026-53492/): containerd CRI checkpoint restore CDI annotation smuggling (high 8.4)
- [CVE-2026-5349](https://insights.sbomify.com/CVE-2026-5349/): Trendnet TEW-657BRM setup.cgi add_apcdb stack-based overflow (high 8.7)
- [CVE-2026-53489](https://insights.sbomify.com/CVE-2026-53489/): containerd: Arbitrary host CRI log file read via symlink following in CRI checkpoint restore (high 8.2)
- [CVE-2026-53488](https://insights.sbomify.com/CVE-2026-53488/): containerd CRI — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull (critical 9.4)
- [CVE-2026-53487](https://insights.sbomify.com/CVE-2026-53487/): Kite has an authenticated cluster RBAC bypass in /api/v1/overview (medium 4.3)
- [CVE-2026-53486](https://insights.sbomify.com/CVE-2026-53486/): decompress: Archive extraction can create files and links outside the target directory (critical 9.1)
- [CVE-2026-53483](https://insights.sbomify.com/CVE-2026-53483/): Auth bypass in PowerProtect Data Domain (critical 9.8)
- [CVE-2026-53482](https://insights.sbomify.com/CVE-2026-53482/): Integer overflow in PowerProtect Data Domain (high 7.5)
- [CVE-2026-53481](https://insights.sbomify.com/CVE-2026-53481/): Path traversal in PowerProtect Data Domain (critical 9.8)
- [CVE-2026-53480](https://insights.sbomify.com/CVE-2026-53480/): Path traversal in PowerProtect Data Domain (low 2.7)
- [CVE-2026-5348](https://insights.sbomify.com/CVE-2026-5348/): Academy LMS <= 3.8.1 - Unauthenticated Insecure Direct Object Reference to Private Topic Disclosure (medium 5.3)
- [CVE-2026-53479](https://insights.sbomify.com/CVE-2026-53479/): Command injection in PowerProtect Data Domain (high 7.2)
- [CVE-2026-53478](https://insights.sbomify.com/CVE-2026-53478/): Command injection in PowerProtect Data Domain (high 7.2)
- [CVE-2026-53477](https://insights.sbomify.com/CVE-2026-53477/): Race condition in Dell Command Update (DCU) (high 7.8)
- [CVE-2026-53476](https://insights.sbomify.com/CVE-2026-53476/): Assisted-migration-agent: vddk tarball chained-symlink arbitrary file write (critical 9.6)
- [CVE-2026-53475](https://insights.sbomify.com/CVE-2026-53475/): Assisted-migration-agent: tls verification disabled on all vcenter connections (critical 9.3)
- [CVE-2026-53474](https://insights.sbomify.com/CVE-2026-53474/): Migration-planner: second-order sql injection via rvtools upload (critical 9.6)
- [CVE-2026-53473](https://insights.sbomify.com/CVE-2026-53473/): Migration-planner-ui-app: stored xss via javascript: url in agent credential link (high 7.3)
- [CVE-2026-53472](https://insights.sbomify.com/CVE-2026-53472/): Migration-planner: credentialurl validator accepts javascript: urls (medium 6.3)
- [CVE-2026-53471](https://insights.sbomify.com/CVE-2026-53471/): Migration-planner: agent api ignores jwt source_id claim (critical 9.6)
- [CVE-2026-53470](https://insights.sbomify.com/CVE-2026-53470/): Migration-planner: getsourcedownloadurl missing organization check (critical 9.6)
- [CVE-2026-5347](https://insights.sbomify.com/CVE-2026-5347/): Missing authorization in WP Books Gallery – Build Stunning Book Showcases & Libraries in Minutes (medium 5.3)
- [CVE-2026-53469](https://insights.sbomify.com/CVE-2026-53469/): Migration-planner: unprotected delete endpoint wipes all tenant data (critical 9.1)
- [CVE-2026-53468](https://insights.sbomify.com/CVE-2026-53468/): Typemill has Stored HTML Attribute Injection in Metadata Fields (medium 4.6)
- [CVE-2026-53467](https://insights.sbomify.com/CVE-2026-53467/): ImageMagick: Information Disclosure in MNG decoder because allocated memory is left unchanged (medium 5.3)
- [CVE-2026-53466](https://insights.sbomify.com/CVE-2026-53466/): ImageMagick: Heap Buffer Over-Read in XCF decoder due to integer conversion overflow (medium 6.5)
- [CVE-2026-53465](https://insights.sbomify.com/CVE-2026-53465/): ImageMagick: Heap Buffer Over-Write in SF3 encoder when writing multi-frame image (medium 6.2)
- [CVE-2026-53464](https://insights.sbomify.com/CVE-2026-53464/): ImageMagick: Memory Leak in wand option parser when providing invalid arguments (medium 4.0)
- [CVE-2026-53463](https://insights.sbomify.com/CVE-2026-53463/): ImageMagick: Null Pointer Dereference in distort operation when passing incorrect arguments (medium 4.3)
- [CVE-2026-53462](https://insights.sbomify.com/CVE-2026-53462/): ImageMagick: Use-After-Free when allocation in CheckPrimitiveExtent fails (medium 5.9)
- [CVE-2026-53461](https://insights.sbomify.com/CVE-2026-53461/): ImageMagick: Out-of-bounds write in ICON decoder due to incorrect loop (high 7.5)
- [CVE-2026-53460](https://insights.sbomify.com/CVE-2026-53460/): ImageMagick: Policy Bypass can trigger out-of-Memory condition (high 7.5)
- [CVE-2026-5346](https://insights.sbomify.com/CVE-2026-5346/): huimeicloud hm_editor image-to-base64 Endpoint mcp-server.js client.get server-side request forgery (medium 6.9)
- [CVE-2026-53459](https://insights.sbomify.com/CVE-2026-53459/): Bambuddy's authentication fails open on database errors, allowing unauthenticated access to all endpoints (critical 9.3)
- [CVE-2026-53458](https://insights.sbomify.com/CVE-2026-53458/): Blueprint Studio API exposed internal exception details (medium 5.3)
- [CVE-2026-53457](https://insights.sbomify.com/CVE-2026-53457/): Blueprint Studio terminal command working directory not bounded to config directory (medium 5.1)
- [CVE-2026-53456](https://insights.sbomify.com/CVE-2026-53456/): Blueprint Studio terminal SSH private key written to disk (medium 5.6)
- [CVE-2026-53455](https://insights.sbomify.com/CVE-2026-53455/): Blueprint Studio Git credential helper command injection (high 8.6)
- [CVE-2026-53454](https://insights.sbomify.com/CVE-2026-53454/): Blueprint Studio stored Git credentials in plaintext Git credential store (medium 6.9)
- [CVE-2026-53453](https://insights.sbomify.com/CVE-2026-53453/): Blueprint Studio API authorization bypass for non-admin Home Assistant users (high 8.7)
- [CVE-2026-53452](https://insights.sbomify.com/CVE-2026-53452/): Ground Station: Unauthenticated out-of-containment file read via `sigmfplayback` `recordingPath` (medium 5.3)
- [CVE-2026-53451](https://insights.sbomify.com/CVE-2026-53451/): Path traversal in ground-station (critical 9.8)
- [CVE-2026-53450](https://insights.sbomify.com/CVE-2026-53450/): Coturn: IPv4-mapped 127.0.0.1 bypasses default loopback peer protection (high 7.4)
- [CVE-2026-53449](https://insights.sbomify.com/CVE-2026-53449/): Coturn: Arbitrary File Write via CLI psd Command (medium 6.0)
- [CVE-2026-53448](https://insights.sbomify.com/CVE-2026-53448/): Coturn: SQL Injection in HTTPS Admin Panel Delete Operations (high 7.2)
- [CVE-2026-53447](https://insights.sbomify.com/CVE-2026-53447/): Wekan: `cloneBoard` Meteor method has no authorization check — any user can clone (read) any private board by ID (medium 6.5)
- [CVE-2026-53446](https://insights.sbomify.com/CVE-2026-53446/): Wekan: Server-Side Request Forgery (SSRF) via webhook integration URLs (medium 6.2)
- [CVE-2026-53445](https://insights.sbomify.com/CVE-2026-53445/): Wekan: Authorization bypass in copyBoard DDP method allows any user to copy private boards (high 7.1)
- [CVE-2026-53444](https://insights.sbomify.com/CVE-2026-53444/): Wekan: Missing authorization on OIDC Meteor methods allows privilege escalation to admin (high 7.6)
- [CVE-2026-53442](https://insights.sbomify.com/CVE-2026-53442/): Jenkins does not encrypt secrets from POST config.xml submissions before storing them in job configurations (medium 5.3)
- [CVE-2026-53441](https://insights.sbomify.com/CVE-2026-53441/): Jenkins: Stored XSS vulnerability in node offline cause description (medium 5.4)
- [CVE-2026-53440](https://insights.sbomify.com/CVE-2026-53440/): Jenkins: Open Redirect phishing attacks possible via "from" parameter in "Delegate to servlet container" (medium 4.3)
- [CVE-2026-5344](https://insights.sbomify.com/CVE-2026-5344/): Textpattern XML-RPC TXP_RPCServer.php mt_uploadImage path traversal (medium 5.3)
- [CVE-2026-53439](https://insights.sbomify.com/CVE-2026-53439/): Jenkins exposes other users' timezone and view names to users with Overall/Read permission (medium 4.3)
- [CVE-2026-53438](https://insights.sbomify.com/CVE-2026-53438/): Jenkins: Missing permission check allows unauthorized cancellation of queue items (medium 4.3)
- [CVE-2026-53437](https://insights.sbomify.com/CVE-2026-53437/): Jenkins Open Redirect Through Newline/Tab Characters in Redirect URL (medium 4.3)
- [CVE-2026-53436](https://insights.sbomify.com/CVE-2026-53436/): Jenkins Open Redirect via Relative Path Segments in Post-Login Redirect URL (medium 4.3)
- [CVE-2026-53435](https://insights.sbomify.com/CVE-2026-53435/): Jenkins arbitrary type deserialization from attacker-controlled config.xml allows remote code execution and user impersonation (high 8.8)
- [CVE-2026-53434](https://insights.sbomify.com/CVE-2026-53434/): Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector (critical 9.1)
- [CVE-2026-53433](https://insights.sbomify.com/CVE-2026-53433/): Denial of Service in fzf (medium 5.7)
- [CVE-2026-53432](https://insights.sbomify.com/CVE-2026-53432/): Integer Overflow in fzf (medium 5.6)
- [CVE-2026-53431](https://insights.sbomify.com/CVE-2026-53431/): Boruta accepts expired JWT client assertions due to missing exp claim validation (critical 9.1)
- [CVE-2026-53430](https://insights.sbomify.com/CVE-2026-53430/): grpc gzip decompression bomb in GRPC.Compressor.Gzip.decompress/1 (high 8.7)
- [CVE-2026-5343](https://insights.sbomify.com/CVE-2026-5343/): SAML SSO - Service Provider - Critical - Authentication bypass - SA-CONTRIB-2026-031 (high 7.4)
- [CVE-2026-53429](https://insights.sbomify.com/CVE-2026-53429/): Unbounded native memory leak in mdex escaped-tag rendering enables unauthenticated denial of service (medium 6.9)
- [CVE-2026-53428](https://insights.sbomify.com/CVE-2026-53428/): Unbounded memory allocation in highlight_lines range expansion in mdex (medium 6.9)
- [CVE-2026-53427](https://insights.sbomify.com/CVE-2026-53427/): Cross-site scripting in MDEx via unescaped highlight_lines_class code-fence attribute (low 2.3)
- [CVE-2026-53426](https://insights.sbomify.com/CVE-2026-53426/): Atom-table exhaustion denial-of-service via JSON parse_document in MDEx (high 8.2)
- [CVE-2026-53425](https://insights.sbomify.com/CVE-2026-53425/): Missing InResponseTo validation in Samly allows acceptance of unsolicited SAML responses (high 7.6)
- [CVE-2026-53424](https://insights.sbomify.com/CVE-2026-53424/): Missing one-time-use enforcement in Samly allows replay of SAML bearer assertions (critical 9.1)
- [CVE-2026-53423](https://insights.sbomify.com/CVE-2026-53423/): Unauthenticated denial-of-service via BEAM atom table exhaustion in membrane_mp4_plugin (medium 5.9)
- [CVE-2026-53422](https://insights.sbomify.com/CVE-2026-53422/): SFTP REALPATH path-existence oracle allowing filesystem enumeration outside configured root (low 2.3)
- [CVE-2026-53421](https://insights.sbomify.com/CVE-2026-53421/): Apache Syncope: Remote Code Execution via Scripted Connector (critical 9.8)
- [CVE-2026-53420](https://insights.sbomify.com/CVE-2026-53420/): Memory corruption in Zoom Workplace (high 8.0)
- [CVE-2026-5342](https://insights.sbomify.com/CVE-2026-5342/): LibRaw TIFF/NEF decoders_libraw.cpp nikon_load_padded_packed_raw out-of-bounds (medium 6.9)
- [CVE-2026-53418](https://insights.sbomify.com/CVE-2026-53418/): Privilege escalation in Zoom Workplace (high 8.1)
- [CVE-2026-53416](https://insights.sbomify.com/CVE-2026-53416/): Zoom VDI - Path Traversal (high 7.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/560/