# Vulnerabilities published in 2026


- [CVE-2026-50890](https://insights.sbomify.com/CVE-2026-50890/): Bernd Bestel grocy v4.6.0 was discovered to contain a SQL injection vulnerability in the product-group parameter at /stockreports/spendings. (critical 9.8)
- [CVE-2026-5089](https://insights.sbomify.com/CVE-2026-5089/): YAML::Syck versions before 1.38 for Perl has an out-of-bounds read (high 7.3)
- [CVE-2026-50889](https://insights.sbomify.com/CVE-2026-50889/): Denial of service in lldap:lldap (high 7.5)
- [CVE-2026-50888](https://insights.sbomify.com/CVE-2026-50888/): Koillection has an authenticated Server-Side Request Forgery issue (high 8.1)
- [CVE-2026-50887](https://insights.sbomify.com/CVE-2026-50887/): shlink has a Server-Side Request Forgery issue (critical 9.1)
- [CVE-2026-50886](https://insights.sbomify.com/CVE-2026-50886/): Project Firefly III has incorrect access control in the webhook management component (critical 9.1)
- [CVE-2026-50885](https://insights.sbomify.com/CVE-2026-50885/): Incorrect access control in the share-based read endpoints of Sismics Docs (Teedy) v1.11 allow unauthorized attackers to access sensitive en (high 7.5)
- [CVE-2026-50884](https://insights.sbomify.com/CVE-2026-50884/): statping-ng allows attackers to escalate privileges to Administrator and access sensitive components (high 8.8)
- [CVE-2026-50883](https://insights.sbomify.com/CVE-2026-50883/): An HTML injection vulnerability in the /src/highlight.rs component of matze wastebin v3.4.1 allows attackers to execute arbitrary scripts via a crafted payload. (critical 9.6)
- [CVE-2026-50882](https://insights.sbomify.com/CVE-2026-50882/): An issue in the /api/v0/pastes endpoint of anna-is-cute paste v0.1.1 allows attackers to cause a Denial of Service (DoS) via a crafted POST request. (high 7.5)
- [CVE-2026-50881](https://insights.sbomify.com/CVE-2026-50881/): Incorrect access control in the impworks Bonsai v6.0 allows authenticated attackers with Editor privileges to escalate privileges to Adminis (high 8.1)
- [CVE-2026-50880](https://insights.sbomify.com/CVE-2026-50880/): YouTransfer has an issue in the sendmail transport integration that allows arbitrary code execution (critical 9.8)
- [CVE-2026-5088](https://insights.sbomify.com/CVE-2026-5088/): Apache::API::Password versions through 0.5.2 for Perl can generate insecure random values for salts (high 7.5)
- [CVE-2026-50879](https://insights.sbomify.com/CVE-2026-50879/): linx-server has an issue in the uploadPostHandler component that allows attackers to cause a Denial of Service (DoS) via a crafted POST request (high 7.5)
- [CVE-2026-50878](https://insights.sbomify.com/CVE-2026-50878/): An issue in the attachment handling component of Feuerhamster MailForm v1.1.0 allows attackers to cause a Denial of Service (DoS) via a crafted request. (high 7.5)
- [CVE-2026-50877](https://insights.sbomify.com/CVE-2026-50877/): An issue in Zhoros SuperBin v1.0.0 allows attackers to execute a directory traversal via supplying files with names containing traversal characters. (high 7.5)
- [CVE-2026-50876](https://insights.sbomify.com/CVE-2026-50876/): A cross-site scripting (XSS) vulnerability in Deck9 Input v2.0.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. (medium 5.4)
- [CVE-2026-50875](https://insights.sbomify.com/CVE-2026-50875/): Incorrect access control in the /{form}/webhooks/{webhook} endpoint of Deck9 Input v2.0.1 allows authenticated attackers to arbitrarily modi (high 8.1)
- [CVE-2026-50874](https://insights.sbomify.com/CVE-2026-50874/): An OS command injection vulnerability in the /manage/features/media component of kanishka-linux Reminiscence v0.3.0 allows attackers to exec (high 8.1)
- [CVE-2026-50873](https://insights.sbomify.com/CVE-2026-50873/): An arbitrary file upload vulnerability in the attachment handling component of flatnotes v5.5.4 allows attackers to execute arbitrary code v (critical 9.8)
- [CVE-2026-50872](https://insights.sbomify.com/CVE-2026-50872/): An issue in the loopback request handling component of fossar selfoss v2.20-SNAPSHOT allows attackers to execute arbitrary commands and obta (critical 9.8)
- [CVE-2026-50871](https://insights.sbomify.com/CVE-2026-50871/): An OS command injection vulnerability in the media archiving and export pipeline component of kanishka-linux Reminiscence v0.3.0 allows atta (critical 9.8)
- [CVE-2026-50870](https://insights.sbomify.com/CVE-2026-50870/): An information disclosure vulnerability in the configuration endpoint of Ben Busby whoogle-search v1.2.3 allows attackers to obtain sensitiv (high 7.5)
- [CVE-2026-5087](https://insights.sbomify.com/CVE-2026-5087/): PAGI::Middleware::Session::Store::Cookie versions through 0.001003 for Perl generates random bytes insecurely (high 7.5)
- [CVE-2026-50869](https://insights.sbomify.com/CVE-2026-50869/): An issue in the api/plugin.php component of Bludit v3.19.0 allows attackers to execute a directory traversal via supplying a crafted request. (critical 9.8)
- [CVE-2026-5086](https://insights.sbomify.com/CVE-2026-5086/): Crypt::SecretBuffer versions before 0.019 for Perl is suseceptible to timing attacks (high 7.5)
- [CVE-2026-5085](https://insights.sbomify.com/CVE-2026-5085/): Solstice::Session versions through 1440 for Perl generates session ids insecurely (critical 9.1)
- [CVE-2026-5084](https://insights.sbomify.com/CVE-2026-5084/): WebDyne::Session versions before 3.003_704 for Perl generate the session id insecurely (medium 6.5)
- [CVE-2026-5083](https://insights.sbomify.com/CVE-2026-5083/): Ado::Sessions versions through 0.935 for Perl generates insecure session ids (medium 5.3)
- [CVE-2026-5082](https://insights.sbomify.com/CVE-2026-5082/): Amon2::Plugin::Web::CSRFDefender versions from 7.00 through 7.03 for Perl generate an insecure session id (medium 5.3)
- [CVE-2026-50813](https://insights.sbomify.com/CVE-2026-50813/): An issue in SQLite before Fossil check-in 869a51ae84df allows a local attacker to obtain sensitive information via the Session Extension cha (medium 6.1)
- [CVE-2026-50812](https://insights.sbomify.com/CVE-2026-50812/): A NULL pointer dereference in the SQLite Session Extension in SQLite 3.53.1 and SQLite trunk builds before check-in e807d4e3798efd53 allows (medium 5.5)
- [CVE-2026-50811](https://insights.sbomify.com/CVE-2026-50811/): An out-of-bounds read vulnerability exists in FreeType 2.14.3 and versions before commit 5a280ecde6f324de0d226261036e736e0cb49a71 in src/tru (medium 6.5)
- [CVE-2026-50810](https://insights.sbomify.com/CVE-2026-50810/): A NULL pointer dereference in smooth_parse_stream_index() in src/media_tools/mpd.c in GPAC master HEAD before commit b35c61f104b85fbb16520ac (medium 5.5)
- [CVE-2026-5081](https://insights.sbomify.com/CVE-2026-5081/): Apache::Session::Generate::ModUniqueId versions from 1.54 through 1.94 for Perl session ids are insecure (critical 9.1)
- [CVE-2026-5080](https://insights.sbomify.com/CVE-2026-5080/): Dancer::Session::Abstract versions through 1.3522 for Perl generates session ids insecurely (medium 5.9)
- [CVE-2026-5079](https://insights.sbomify.com/CVE-2026-5079/): multer vulnerable to Denial of Service via deeply nested field names (high 7.5)
- [CVE-2026-50787](https://insights.sbomify.com/CVE-2026-50787/): e-SIC Livre (esiclivre) v0.2.2 and earlier contains an uncontrolled resource consumption vulnerability in restrito/inc/captcha.php. (high 7.5)
- [CVE-2026-50782](https://insights.sbomify.com/CVE-2026-50782/): Jinher OA C6 contains an XML External Entity (XXE) injection vulnerability in the /c6/JHSoft.Web.HrmAttendance/sp_manager_getUserlist.aspx/GetXmlHttp endpoint. (high 7.5)
- [CVE-2026-5078](https://insights.sbomify.com/CVE-2026-5078/): morgan vulnerable to Log Forging via unneutralized control characters in :remote-user (medium 5.3)
- [CVE-2026-50776](https://insights.sbomify.com/CVE-2026-50776/): Directory Traversal vulnerability in Pronis Loisirs Billetterie CSE - < 04/2026 allows a remote attacker to obtain sensitive information and (high 7.5)
- [CVE-2026-50775](https://insights.sbomify.com/CVE-2026-50775/): A blind SSRF attack in DataHub v.1.5.0.1 allows a remote attacker to execute arbitrary code via the server retrieving an image from a crafte (critical 9.8)
- [CVE-2026-50774](https://insights.sbomify.com/CVE-2026-50774/): An issue in GAPTEQ Designer v.3.5 allows a remote attacker to escalate privileges via the Company Manger role. (critical 9.8)
- [CVE-2026-50773](https://insights.sbomify.com/CVE-2026-50773/): An issue in CGM Germany - CompuGroup Medical CGM ISIS MED 2510.1.0.20 allows a remote attacker to execute arbtirary code via a crafted .dll file. (high 7.8)
- [CVE-2026-50772](https://insights.sbomify.com/CVE-2026-50772/): An issue in Squirro Cognitive Search < 3.14.2 allows a remote attacker to execute arbitrary code via a crafted payload to the password reset function. (critical 9.8)
- [CVE-2026-50771](https://insights.sbomify.com/CVE-2026-50771/): Cross Site Scripting vulnerability in Squirro Cognitive Search < 3.14.2 allows a remote attacker to execute arbtirary code via the Email Not (medium 6.1)
- [CVE-2026-50770](https://insights.sbomify.com/CVE-2026-50770/): An issue in Squirro Cognitive Search before v.3.14.2 allows a remote attacker to escalate privileges via a crafted request. (critical 9.8)
- [CVE-2026-5077](https://insights.sbomify.com/CVE-2026-5077/): Cross-site scripting in Total (medium 5.4)
- [CVE-2026-50769](https://insights.sbomify.com/CVE-2026-50769/): The CRM+ application before and including version 2025.6 from Brainformatik is vulnerable to SQL Injection (time-based) vulnerability. (critical 9.8)
- [CVE-2026-50768](https://insights.sbomify.com/CVE-2026-50768/): File Upload vulnerability in T-Systems International GmbH ImageMaster Version: 9.14.2.8.1 allows a remote attacker to execute arbitrary code (high 8.8)
- [CVE-2026-50767](https://insights.sbomify.com/CVE-2026-50767/): Cross-site scripting in koha:koha (medium 5.4)
- [CVE-2026-50766](https://insights.sbomify.com/CVE-2026-50766/): Cross-site scripting in koha:koha (medium 5.4)
- [CVE-2026-50765](https://insights.sbomify.com/CVE-2026-50765/): Cross-site scripting in koha:koha (medium 6.1)
- [CVE-2026-5076](https://insights.sbomify.com/CVE-2026-5076/): ARMember Premium <= 7.3.1 - Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation (critical 9.8)
- [CVE-2026-50759](https://insights.sbomify.com/CVE-2026-50759/): An issue in exo-explore exo 1.0.69 allows a remote attacker to escalate privileges via the GET /state and DELETE /instance/{instance_id} end (high 7.5)
- [CVE-2026-50758](https://insights.sbomify.com/CVE-2026-50758/): Cross Site Scripting vulnerability in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to execute arbitrary code via the mcp para (high 8.1)
- [CVE-2026-50757](https://insights.sbomify.com/CVE-2026-50757/): Directory Traversal vulnerability in DayuanJiang next-ai-draw-io 0.4.13 allowsa remote attacker to execute arbitrary code via the nex-ai-dra (high 7.8)
- [CVE-2026-50756](https://insights.sbomify.com/CVE-2026-50756/): An issue in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to obtain sensitive information via the x-ai-provider component (high 7.5)
- [CVE-2026-50755](https://insights.sbomify.com/CVE-2026-50755/): An issue in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to obtain sensitive information via the X-Forwarded-For header value (critical 9.8)
- [CVE-2026-50752](https://insights.sbomify.com/CVE-2026-50752/): Certificate Validation Bypass in VPN Site-to-Site Connections Using IKEv1 (high 7.4)
- [CVE-2026-50751](https://insights.sbomify.com/CVE-2026-50751/): Check Point Security Gateway Improper Authentication (critical 9.3, exploited in the wild)
- [CVE-2026-50750](https://insights.sbomify.com/CVE-2026-50750/): Denial of service in Apache ActiveMQ (high 7.5)
- [CVE-2026-5075](https://insights.sbomify.com/CVE-2026-5075/): Information disclosure in All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic (medium 4.3)
- [CVE-2026-50749](https://insights.sbomify.com/CVE-2026-50749/): Apache Answer: Missing authorization in revision audit reject allows authenticated users to reject pending revisions (medium 6.5)
- [CVE-2026-50748](https://insights.sbomify.com/CVE-2026-50748/): Command injection in UniFi Access Application (critical 9.9)
- [CVE-2026-50747](https://insights.sbomify.com/CVE-2026-50747/): SQL injection in UniFi Talk Application (critical 9.9)
- [CVE-2026-50746](https://insights.sbomify.com/CVE-2026-50746/): Command injection in UniFi Connect Application (critical 10.0)
- [CVE-2026-50745](https://insights.sbomify.com/CVE-2026-50745/): Cross-site scripting in Adserver (medium 4.7)
- [CVE-2026-50744](https://insights.sbomify.com/CVE-2026-50744/): Auth bypass in Adserver (medium 4.3)
- [CVE-2026-50743](https://insights.sbomify.com/CVE-2026-50743/): Cross-site request forgery in Adserver (medium 5.4)
- [CVE-2026-50742](https://insights.sbomify.com/CVE-2026-50742/): Cross-site scripting in Adserver (medium 4.4)
- [CVE-2026-50741](https://insights.sbomify.com/CVE-2026-50741/): Code injection in Adserver (high 8.8)
- [CVE-2026-50740](https://insights.sbomify.com/CVE-2026-50740/): Cross-site scripting in Adserver (medium 6.1)
- [CVE-2026-5074](https://insights.sbomify.com/CVE-2026-5074/): ARMember Premium <= 7.3.1 - Authenticated (Subscriber+) SQL Injection via 'sSortDir_0' Parameter (medium 6.5)
- [CVE-2026-50739](https://insights.sbomify.com/CVE-2026-50739/): Missing authorization in Adserver (medium 4.3)
- [CVE-2026-50738](https://insights.sbomify.com/CVE-2026-50738/): Use after free in pglogical (high 7.7)
- [CVE-2026-50737](https://insights.sbomify.com/CVE-2026-50737/): Privilege escalation in pglogical (critical 9.0)
- [CVE-2026-50736](https://insights.sbomify.com/CVE-2026-50736/): SQL injection in pglogical (critical 9.0)
- [CVE-2026-50735](https://insights.sbomify.com/CVE-2026-50735/): Memory corruption in pglogical (medium 6.1)
- [CVE-2026-50734](https://insights.sbomify.com/CVE-2026-50734/): Denial of service in Apache ActiveMQ (high 7.5)
- [CVE-2026-50733](https://insights.sbomify.com/CVE-2026-50733/): Markdown Preview Enhanced Arbitrary Code Execution via WaveDrom eval() (high 8.6)
- [CVE-2026-5073](https://insights.sbomify.com/CVE-2026-5073/): ARMember Premium <= 7.3.1 - Unauthenticated SQL Injection via 'order' Parameter (high 7.5)
- [CVE-2026-50722](https://insights.sbomify.com/CVE-2026-50722/): IKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payload (high 7.5)
- [CVE-2026-50721](https://insights.sbomify.com/CVE-2026-50721/): IKEv1 Denial of Service via RSA-SHA1 (PKCS#1 Version 1.5 Encrypted) authentication payload (high 7.5)
- [CVE-2026-50720](https://insights.sbomify.com/CVE-2026-50720/): The Ingenic T31 SoC boot ROM flash-boot verification path compares only a single 32-bit word of the RSA signature output against a single 32 (medium 6.4)
- [CVE-2026-5072](https://insights.sbomify.com/CVE-2026-5072/): ptp: Potential Denial of Service via PTP Interval Shift (medium 6.5)
- [CVE-2026-50719](https://insights.sbomify.com/CVE-2026-50719/): The Ingenic T41, and probably also T32, T40, and A1 SoC boot ROMs parse and execute an attacker-controlled init table from the SPL header be (medium 6.8)
- [CVE-2026-50712](https://insights.sbomify.com/CVE-2026-50712/): Frappe Framework 17.0.0-dev - Stored XSS in Tree View node label rendering (medium 4.8)
- [CVE-2026-50711](https://insights.sbomify.com/CVE-2026-50711/): Frappe Framework 17.0.0-dev - Stored XSS in Number Card filter fields rendering (medium 4.6)
- [CVE-2026-50710](https://insights.sbomify.com/CVE-2026-50710/): Frappe Framework 17.0.0-dev - Stored XSS via eval in Number Card filters_config (medium 4.6)
- [CVE-2026-5071](https://insights.sbomify.com/CVE-2026-5071/): can: Local Denial of Service via SocketCAN Send (medium 6.1)
- [CVE-2026-50709](https://insights.sbomify.com/CVE-2026-50709/): Frappe Framework 17.0.0-dev - Stored XSS in Notifications Events color rendering (medium 4.8)
- [CVE-2026-50708](https://insights.sbomify.com/CVE-2026-50708/): Frappe Framework 17.0.0-dev - Stored XSS in Multi Select Dialog result rendering (medium 4.8)
- [CVE-2026-50705](https://insights.sbomify.com/CVE-2026-50705/): Frappe Framework 17.0.0-dev - Stored XSS in Form Dashboard headline rendering (medium 4.6)
- [CVE-2026-50704](https://insights.sbomify.com/CVE-2026-50704/): Frappe Framework 17.0.0-dev - Reflected/Stored XSS in File View breadcrumbs rendering (medium 4.6)
- [CVE-2026-50703](https://insights.sbomify.com/CVE-2026-50703/): Frappe Framework 17.0.0-dev - Stored XSS in Desktop Icon label rendering (medium 4.8)
- [CVE-2026-50701](https://insights.sbomify.com/CVE-2026-50701/): Frappe Framework 17.0.0-dev - Reflected DOM XSS in dashboard-view breadcrumb rendering (medium 5.1)
- [CVE-2026-50700](https://insights.sbomify.com/CVE-2026-50700/): Frappe Framework 17.0.0-dev - Stored XSS in frappe.get_avatar image rendering (medium 4.6)
- [CVE-2026-5070](https://insights.sbomify.com/CVE-2026-5070/): Vantage <= 1.20.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Block Text Content (medium 6.4)
- [CVE-2026-50699](https://insights.sbomify.com/CVE-2026-50699/): Frappe Framework 17.0.0-dev - Stored XSS in Auto Repeat dashboard schedule rendering (medium 4.6)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/574/