# Vulnerabilities published in 2026


- [CVE-2026-52850](https://insights.sbomify.com/CVE-2026-52850/): Docmost: Broken access control in transclusion lookup API leaks sync-block content across private spaces (medium 4.3)
- [CVE-2026-5285](https://insights.sbomify.com/CVE-2026-5285/): Use after free in Chrome (high 8.8)
- [CVE-2026-52846](https://insights.sbomify.com/CVE-2026-52846/): Caddy: stripHTML template function bypass (medium 4.2)
- [CVE-2026-52845](https://insights.sbomify.com/CVE-2026-52845/): Caddy: FastCGI header normalization bypass in `forward_auth copy_headers` (high 8.1)
- [CVE-2026-52844](https://insights.sbomify.com/CVE-2026-52844/): Caddy: Windows `file_server` path authorization bypass via encoded backslash (high 7.5)
- [CVE-2026-52843](https://insights.sbomify.com/CVE-2026-52843/): Lightpanda: fetch() and XMLHttpRequest attach session cookies to cross-origin requests regardless of credentials mode (critical 9.3)
- [CVE-2026-52842](https://insights.sbomify.com/CVE-2026-52842/): Lightpanda:URL parser misidentifies page origin for URLs containing @ in the path - Same-Origin Policy bypass (critical 9.3)
- [CVE-2026-52841](https://insights.sbomify.com/CVE-2026-52841/): Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google sync (low 3.1)
- [CVE-2026-52840](https://insights.sbomify.com/CVE-2026-52840/): Easy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal network (low 2.7)
- [CVE-2026-5284](https://insights.sbomify.com/CVE-2026-5284/): Use after free in Chrome (high 7.5)
- [CVE-2026-52839](https://insights.sbomify.com/CVE-2026-52839/): Easy!Appointments appointments/store and appointments/update allow cross-provider appointment injection — Authorization Bypass (low 3.3)
- [CVE-2026-52838](https://insights.sbomify.com/CVE-2026-52838/): Easy!Appointments disable_booking_message rendered as raw HTML on public booking page — Stored XSS (low 2.6)
- [CVE-2026-52837](https://insights.sbomify.com/CVE-2026-52837/): Easy!Appointments has unauthenticated customer PII disclosure on booking reschedule page (medium 6.9)
- [CVE-2026-52836](https://insights.sbomify.com/CVE-2026-52836/): Memory corruption in OpenDDS (high 8.7)
- [CVE-2026-52835](https://insights.sbomify.com/CVE-2026-52835/): Tautulli: Path traversal / arbitrary file write via unsanitized upload filename in import_config and import_database (high 7.0)
- [CVE-2026-52834](https://insights.sbomify.com/CVE-2026-52834/): jxl-oxide: Out-of-bounds writes due to integer overflow in jxl-grid on 32-bit platforms (high 7.3)
- [CVE-2026-52833](https://insights.sbomify.com/CVE-2026-52833/): Nuclio: Unsanitized runtimeAttributes.repositories injected into Groovy build.gradle leads to build-time RCE (high 8.0)
- [CVE-2026-52832](https://insights.sbomify.com/CVE-2026-52832/): Nuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard container (medium 4.9)
- [CVE-2026-52831](https://insights.sbomify.com/CVE-2026-52831/): Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE (high 8.0)
- [CVE-2026-52830](https://insights.sbomify.com/CVE-2026-52830/): fast-mcp-telegram: Bearer token path traversal bypasses reserved Telegram session protection (critical 9.4)
- [CVE-2026-5283](https://insights.sbomify.com/CVE-2026-5283/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-52829](https://insights.sbomify.com/CVE-2026-52829/): ZEBRA: IPv4-Mapped Mempool Misbehavior Update Aborts Zebra Address Book (high 7.5)
- [CVE-2026-52828](https://insights.sbomify.com/CVE-2026-52828/): Kimai: ExportTemplate CRUD Missing Authorization Check Allows Unauthorized TEAMLEAD Access (medium 5.3)
- [CVE-2026-52827](https://insights.sbomify.com/CVE-2026-52827/): Kimai: Two-factor authentication bypass on the Kimai API (high 7.1)
- [CVE-2026-52826](https://insights.sbomify.com/CVE-2026-52826/): Kimai: Improper Authorization in Project, Customer, and Activity Rate Edit Endpoints Allows Cross-Scope Rate Manipulation (medium 5.3)
- [CVE-2026-52825](https://insights.sbomify.com/CVE-2026-52825/): Kimai has Improper Authorization in Team Member and Team Activity Assignment APIs Which Allows Expansion of Team Scope Beyond Authorized Visibility (medium 5.3)
- [CVE-2026-52824](https://insights.sbomify.com/CVE-2026-52824/): Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover (critical 9.1)
- [CVE-2026-52823](https://insights.sbomify.com/CVE-2026-52823/): Kimai: Login CSRF in Kimai Timesheet Stop and Restart API Endpoints Allows Unauthorized State Changes (medium 5.3)
- [CVE-2026-52822](https://insights.sbomify.com/CVE-2026-52822/): Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets After Project Access Revocation (medium 5.3)
- [CVE-2026-52821](https://insights.sbomify.com/CVE-2026-52821/): Kimai: Improper Authorization Through Activity Creation with Preset Project Allows Creation Under Unauthorized Projects (medium 5.3)
- [CVE-2026-52820](https://insights.sbomify.com/CVE-2026-52820/): Kimai: Timesheet PATCH/POST allows assigning to project outside user's team via query_builder OR-bypass (medium 5.3)
- [CVE-2026-5282](https://insights.sbomify.com/CVE-2026-5282/): Memory corruption in Chrome (high 8.1)
- [CVE-2026-52819](https://insights.sbomify.com/CVE-2026-52819/): Kimai: Teamlead authorization bypass in GET /api/timesheets allows reading other users' timesheet records without being teamlead of the target (medium 6.3)
- [CVE-2026-52817](https://insights.sbomify.com/CVE-2026-52817/): Linuxfabrik Monitoring Plugins Sudoers: /usr/bin/apt-get arguments allow privilege escalation (high 7.0)
- [CVE-2026-52816](https://insights.sbomify.com/CVE-2026-52816/): Gogs: Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS (medium 5.4)
- [CVE-2026-52815](https://insights.sbomify.com/CVE-2026-52815/): Gogs: Unauthenticated Organization Teams Information Disclosure via API (medium 5.5)
- [CVE-2026-52814](https://insights.sbomify.com/CVE-2026-52814/): Gogs: Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake Stall (File Descriptor Exhaustion) (medium 5.5)
- [CVE-2026-52813](https://insights.sbomify.com/CVE-2026-52813/): Gogs: Path Traversal in organization name results in RCE through Git hooks (critical 10.0)
- [CVE-2026-52812](https://insights.sbomify.com/CVE-2026-52812/): Gogs: LFS dedupe path leaks private repo content across tenants (high 7.1)
- [CVE-2026-52811](https://insights.sbomify.com/CVE-2026-52811/): Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym (critical 9.0)
- [CVE-2026-52810](https://insights.sbomify.com/CVE-2026-52810/): Gogs: Write to readonly repositories using receive-pack + service=git-upload-pack confusion (high 7.1)
- [CVE-2026-5281](https://insights.sbomify.com/CVE-2026-5281/): Google Dawn Use-After-Free (high 8.8, exploited in the wild)
- [CVE-2026-52809](https://insights.sbomify.com/CVE-2026-52809/): Gogs: Password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_LIVES (medium 6.8)
- [CVE-2026-52808](https://insights.sbomify.com/CVE-2026-52808/): Gogs: Write-level collaborators can mutate admin-only repository settings via API (high 7.1)
- [CVE-2026-52807](https://insights.sbomify.com/CVE-2026-52807/): Gogs: DOM-based XSS via Milestone Name on New Issue Page (medium 4.8)
- [CVE-2026-52806](https://insights.sbomify.com/CVE-2026-52806/): Gogs: RCE via git rebase --exec argument injection in pull request merge (critical 9.9)
- [CVE-2026-52805](https://insights.sbomify.com/CVE-2026-52805/): Gogs: Migration Redirect Bypass Leads to Internal Repository Theft (high 8.7)
- [CVE-2026-52804](https://insights.sbomify.com/CVE-2026-52804/): Gogs: Privilege Escalation via Collaboration Access Mode Validation (medium 5.5)
- [CVE-2026-52802](https://insights.sbomify.com/CVE-2026-52802/): Gogs: Open Redirect via redirect_to in Gogs (medium 5.4)
- [CVE-2026-52801](https://insights.sbomify.com/CVE-2026-52801/): Gogs: Ability to import local repositories via Mirror Settings (high 8.1)
- [CVE-2026-52800](https://insights.sbomify.com/CVE-2026-52800/): Gogs: CSRF Leading to Organization Owner Takeover (high 8.8)
- [CVE-2026-5280](https://insights.sbomify.com/CVE-2026-5280/): Use after free in Chrome (high 8.8)
- [CVE-2026-52799](https://insights.sbomify.com/CVE-2026-52799/): Gogs: Missing Authorization in Attachment Download (high 7.5)
- [CVE-2026-52798](https://insights.sbomify.com/CVE-2026-52798/): Gogs: Stored XSS in `.ipynb` Preview (high 8.9)
- [CVE-2026-52797](https://insights.sbomify.com/CVE-2026-52797/): Gogs: Overwriting critical files results in a denial of service (high 8.5)
- [CVE-2026-52796](https://insights.sbomify.com/CVE-2026-52796/): Gogs: DoS in rendering issue index pattern (low 3.5)
- [CVE-2026-52795](https://insights.sbomify.com/CVE-2026-52795/): Gogs: Authorization Bypass in Watch API allows any user to monitor private repository activity (medium 4.3)
- [CVE-2026-52794](https://insights.sbomify.com/CVE-2026-52794/): Sentry: Inefficient Regular Expression Complexity in sentry (high 7.5)
- [CVE-2026-52793](https://insights.sbomify.com/CVE-2026-52793/): Froxlor: API Authentication bypasses 2FA Authentication (high 8.1)
- [CVE-2026-52792](https://insights.sbomify.com/CVE-2026-52792/): Algernon: Server-side script source disclosure on Windows via NTFS filename (high 8.7)
- [CVE-2026-52791](https://insights.sbomify.com/CVE-2026-52791/): fuse-overlayfs release-1.x preserves SUID/SGID bits after truncate/open(O_TRUNC) (low 2.0)
- [CVE-2026-5279](https://insights.sbomify.com/CVE-2026-5279/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-52785](https://insights.sbomify.com/CVE-2026-52785/): OpenProject: SQL injection in timestamps functionality (critical 9.9)
- [CVE-2026-52784](https://insights.sbomify.com/CVE-2026-52784/): OpenProject: CSRF on TARGET through /users/:id via POST parameter "user[admin]" (high 8.8)
- [CVE-2026-52783](https://insights.sbomify.com/CVE-2026-52783/): Information disclosure in openproject (high 8.2)
- [CVE-2026-52782](https://insights.sbomify.com/CVE-2026-52782/): Missing authorization in openproject (critical 9.9)
- [CVE-2026-52781](https://insights.sbomify.com/CVE-2026-52781/): Cross-site scripting in openproject (medium 6.4)
- [CVE-2026-52780](https://insights.sbomify.com/CVE-2026-52780/): OpenProject: Cache store poisoning leads to Remote Code Execution (RCE) (critical 9.6)
- [CVE-2026-5278](https://insights.sbomify.com/CVE-2026-5278/): Use after free in Chrome (high 8.8)
- [CVE-2026-52779](https://insights.sbomify.com/CVE-2026-52779/): Missing authorization in openproject (medium 5.4)
- [CVE-2026-52778](https://insights.sbomify.com/CVE-2026-52778/): YesWiki has Unsafe eval() in Formula Calculator - Remote Code Execution (RCE) & Denial of Service (DoS) (critical 9.8)
- [CVE-2026-52777](https://insights.sbomify.com/CVE-2026-52777/): YesWiki: Authenticated PHP Object Injection in BazarImportAction via unserialize (critical 9.4)
- [CVE-2026-52776](https://insights.sbomify.com/CVE-2026-52776/): Trestle URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0 (high 8.6)
- [CVE-2026-52775](https://insights.sbomify.com/CVE-2026-52775/): YesWiki Authenticated SQL Injection in ReactionManager (high 8.8)
- [CVE-2026-52774](https://insights.sbomify.com/CVE-2026-52774/): Reflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes in YesWiki (medium 6.1)
- [CVE-2026-52773](https://insights.sbomify.com/CVE-2026-52773/): Reflected XSS via Unescaped Archived-Revision `time` Parameter in `handlers/page/show.php` in YesWiki (medium 6.1)
- [CVE-2026-52772](https://insights.sbomify.com/CVE-2026-52772/): YesWiki has stored XSS in Bazar form-field templates via unescaped field.label / field.hint (|raw('html')) (medium 5.5)
- [CVE-2026-52771](https://insights.sbomify.com/CVE-2026-52771/): YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (`ApiController::deletePage`) (high 8.3)
- [CVE-2026-52770](https://insights.sbomify.com/CVE-2026-52770/): Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in yeswiki/yeswiki (high 7.5)
- [CVE-2026-5277](https://insights.sbomify.com/CVE-2026-5277/): Integer overflow in Chrome (high 7.5)
- [CVE-2026-52769](https://insights.sbomify.com/CVE-2026-52769/): YesWiki: Unauthenticated Server-Side Request Forgery via ActivityPub `Signature.keyId` (high 8.3)
- [CVE-2026-52767](https://insights.sbomify.com/CVE-2026-52767/): YesWiki: Unauthenticated ActivityPub Signature-Verification Bypass via `!openssl_verify(...)` accepting `int(-1)` (high 8.2)
- [CVE-2026-52766](https://insights.sbomify.com/CVE-2026-52766/): YesWiki: Unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action (critical 9.1)
- [CVE-2026-52763](https://insights.sbomify.com/CVE-2026-52763/): YesWiki: SQL injection via the `recentchanges` action `period` argument leading to arbitrary DB read (medium 6.5)
- [CVE-2026-52762](https://insights.sbomify.com/CVE-2026-52762/): YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic Templates (high 7.1)
- [CVE-2026-52761](https://insights.sbomify.com/CVE-2026-52761/): ModSecurity: Transformation utf8toUnicode produces wrong output on i386 architecture (medium 5.8)
- [CVE-2026-52760](https://insights.sbomify.com/CVE-2026-52760/): Apache ActiveMQ, Apache ActiveMQ Web Console: Stored XSS via Unescaped values in ActiveMQ Web Console (medium 6.1)
- [CVE-2026-5276](https://insights.sbomify.com/CVE-2026-5276/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-52759](https://insights.sbomify.com/CVE-2026-52759/): Ghidra < 12.1.1 - Denial of Service via Uncontrolled Memory Allocation in Mach-O Parser (medium 6.7)
- [CVE-2026-52758](https://insights.sbomify.com/CVE-2026-52758/): Ghidra < 12.1 - SQL Injection via Unescaped Filter Values in BSim Search (high 8.7)
- [CVE-2026-52757](https://insights.sbomify.com/CVE-2026-52757/): Ghidra < 12.1 - Heap-use-after-free in HighVariable::merge() during decompilation (medium 4.6)
- [CVE-2026-52756](https://insights.sbomify.com/CVE-2026-52756/): Ghidra < 12.2 - Unauthenticated Path Traversal in Debugger ISF Server (medium 6.3)
- [CVE-2026-52755](https://insights.sbomify.com/CVE-2026-52755/): Ghidra < 12.0.4 - Path Traversal via Zip Slip in Theme Import (high 8.4)
- [CVE-2026-52754](https://insights.sbomify.com/CVE-2026-52754/): Ghidra < 12.1 - Authentication Bypass via Null Signature in PKIAuthenticationModule (high 8.7)
- [CVE-2026-52753](https://insights.sbomify.com/CVE-2026-52753/): Ghidra < 12.0.3 - Out-of-Memory in Rust Symbol Demangler via Malformed Symbol (medium 6.7)
- [CVE-2026-52752](https://insights.sbomify.com/CVE-2026-52752/): Ghidra < 12.0.2 - Path Traversal in Extension Installer via ZIP Entry Names (high 8.4)
- [CVE-2026-52751](https://insights.sbomify.com/CVE-2026-52751/): Ghidra < 12.1 - Remote Code Execution via Unfiltered RMI Deserialization in Shared Project Connection (high 8.6)
- [CVE-2026-52750](https://insights.sbomify.com/CVE-2026-52750/): Ghidra < 12.1- Command Injection via URL Annotation Click (high 7.3)
- [CVE-2026-5275](https://insights.sbomify.com/CVE-2026-5275/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-52749](https://insights.sbomify.com/CVE-2026-52749/): Improper Authentication in Kaon AR2140X (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/567/