# Vulnerabilities published in 2026


- [CVE-2026-50183](https://insights.sbomify.com/CVE-2026-50183/): WWBN AVideo: Stored XSS via Hostile YouTube Video Title in AVideo YouTubeAPI Gallery Section (medium 4.7)
- [CVE-2026-50182](https://insights.sbomify.com/CVE-2026-50182/): AVideo Has Unauthenticated Reflected XSS via $_GET['search'] in YouTubeAPI Gallery Pagination (medium 6.1)
- [CVE-2026-50181](https://insights.sbomify.com/CVE-2026-50181/): Langroid: Path traversal in the file tools allows read/write outside configured current directory (high 7.1)
- [CVE-2026-50180](https://insights.sbomify.com/CVE-2026-50180/): Langroid: SQLChatAgent _validate_query blocklist misses pg_read_file family enabling arbitrary file read (high 8.7)
- [CVE-2026-5018](https://insights.sbomify.com/CVE-2026-5018/): code-projects Simple Food Order System Parameter register-router.php sql injection (medium 6.9)
- [CVE-2026-50179](https://insights.sbomify.com/CVE-2026-50179/): Actual: CSV Formula Injection in Transaction Export via Imported Payee/Notes Fields (medium 4.2)
- [CVE-2026-50178](https://insights.sbomify.com/CVE-2026-50178/): Angular: Remote Code Execution via JSDoc Hover Command Injection in VS Code Angular Language Service Extension (high 8.7)
- [CVE-2026-50176](https://insights.sbomify.com/CVE-2026-50176/): EVoke Systems EVoke CSMS Improper Restriction of Excessive Authentication Attempts (high 8.7)
- [CVE-2026-50173](https://insights.sbomify.com/CVE-2026-50173/): Flow-Like: Azure invoke presign grants app content write SAS to ExecuteEvents-only users (high 7.2)
- [CVE-2026-50171](https://insights.sbomify.com/CVE-2026-50171/): Angular: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo) (high 8.2)
- [CVE-2026-50170](https://insights.sbomify.com/CVE-2026-50170/): Angular: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache (high 8.2)
- [CVE-2026-5017](https://insights.sbomify.com/CVE-2026-5017/): code-projects Simple Food Order System Parameter all-tickets.php sql injection (medium 6.9)
- [CVE-2026-50169](https://insights.sbomify.com/CVE-2026-50169/): Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities (medium 5.7)
- [CVE-2026-50168](https://insights.sbomify.com/CVE-2026-50168/): Angular: URL Parser Differential in @angular/platform-server leading to SSRF Allowlist Bypass (high 8.8)
- [CVE-2026-50167](https://insights.sbomify.com/CVE-2026-50167/): Kurrier: Authenticated cross-user authorization bypass in Kurrier API (medium 5.3)
- [CVE-2026-50166](https://insights.sbomify.com/CVE-2026-50166/): Kuma: kumactl connects to control plane without verifying TLS certificate when no CA is configured (medium 5.5)
- [CVE-2026-50165](https://insights.sbomify.com/CVE-2026-50165/): alf.io has Improper Access Control for Organization Owners that Exposes System Secrets (high 7.1)
- [CVE-2026-50163](https://insights.sbomify.com/CVE-2026-50163/): `oras-go` tar extraction: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution (high 7.1)
- [CVE-2026-50162](https://insights.sbomify.com/CVE-2026-50162/): oras-go: file store write outside workingDir via symlink traversal (medium 6.9)
- [CVE-2026-50161](https://insights.sbomify.com/CVE-2026-50161/): libre: Integer overflow in websock_decode() masked frame length check leads to heap buffer overflow (critical 9.3)
- [CVE-2026-50160](https://insights.sbomify.com/CVE-2026-50160/): Mass Assignment via Onboarding Endpoint Allows Unauthenticated JWT_SECRET Overwrite (critical 10.0)
- [CVE-2026-5016](https://insights.sbomify.com/CVE-2026-5016/): elecV2 elecV2P URL mock eAxios server-side request forgery (medium 6.9)
- [CVE-2026-50159](https://insights.sbomify.com/CVE-2026-50159/): Mermaid allows CSS injection applying to sibling elements of the diagram (medium 5.3)
- [CVE-2026-50158](https://insights.sbomify.com/CVE-2026-50158/): yutu: Arbitrary File Write via MCP `caption-download` Tool (high 7.7)
- [CVE-2026-50157](https://insights.sbomify.com/CVE-2026-50157/): Auth0 Symfony: Bearer Token Accepted via URL Query Parameter in Auth0 Symfony SDK (medium 6.5)
- [CVE-2026-50152](https://insights.sbomify.com/CVE-2026-50152/): Missing authorization in ceph (critical 9.1)
- [CVE-2026-50151](https://insights.sbomify.com/CVE-2026-50151/): oras-go: credential forwarding via unvalidated Location header in blob upload (high 7.5)
- [CVE-2026-5015](https://insights.sbomify.com/CVE-2026-5015/): elecV2 elecV2P Endpoint logs cross site scripting (medium 5.3)
- [CVE-2026-50149](https://insights.sbomify.com/CVE-2026-50149/): Contour has Improper JWT Verification for Non-SNI Requests on Virtual Hosts with Fallback Certificate Enabled (medium 6.5)
- [CVE-2026-50148](https://insights.sbomify.com/CVE-2026-50148/): Metabase: Remote Code Execution via Snowflake JDBC Driver Arbitrary File Write (critical 10.0)
- [CVE-2026-50147](https://insights.sbomify.com/CVE-2026-50147/): Metabase: Arbitrary File Read via MySQL Connection Property Injection (high 7.6)
- [CVE-2026-50146](https://insights.sbomify.com/CVE-2026-50146/): Astro: Reflected XSS via unescaped slot name (high 7.1)
- [CVE-2026-50144](https://insights.sbomify.com/CVE-2026-50144/): ncnn: Out-of-bounds heap write in ParamDict::load_param via unchecked negative parameter id (high 7.1)
- [CVE-2026-50143](https://insights.sbomify.com/CVE-2026-50143/): Actor MCP path authority injection leaks Apify token (high 8.1)
- [CVE-2026-50142](https://insights.sbomify.com/CVE-2026-50142/): libheif: unbounded heap allocation in HEIF sequence parser (stsz fixed-size mode missing bound check) (high 7.5)
- [CVE-2026-50141](https://insights.sbomify.com/CVE-2026-50141/): Woodpecker gRPC agent_id metadata can be spoofed- cross-tenant agent impersonation (high 7.1)
- [CVE-2026-5014](https://insights.sbomify.com/CVE-2026-5014/): elecV2 elecV2P Wildcard log path.join path traversal (medium 6.9)
- [CVE-2026-50139](https://insights.sbomify.com/CVE-2026-50139/): goshs: Share-link ?token=… redemption races past download limit (medium 5.9)
- [CVE-2026-50138](https://insights.sbomify.com/CVE-2026-50138/): goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags (high 8.1)
- [CVE-2026-50137](https://insights.sbomify.com/CVE-2026-50137/): Budibase: POST /api/attachments/:datasourceId/url is unauthenticated and lets anonymous callers mint S3 PUT pre-signed URLs using stored datasource IAM credentials (high 8.2)
- [CVE-2026-50136](https://insights.sbomify.com/CVE-2026-50136/): Budibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentials (high 7.4)
- [CVE-2026-50135](https://insights.sbomify.com/CVE-2026-50135/): Hugo: Symlink confinement bypass in resources.Get (medium 6.9)
- [CVE-2026-50134](https://insights.sbomify.com/CVE-2026-50134/): Hugo: security.http.urls allow-list bypass via HTTP redirects (medium 6.3)
- [CVE-2026-50133](https://insights.sbomify.com/CVE-2026-50133/): Hugo: XSS via text/html content files (medium 5.1)
- [CVE-2026-50132](https://insights.sbomify.com/CVE-2026-50132/): Budibase: Chat Identity Link Hijacking via Missing Consent & CSRF — Account Impersonation in Budibase (high 7.3)
- [CVE-2026-50131](https://insights.sbomify.com/CVE-2026-50131/): Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges (high 8.6)
- [CVE-2026-50130](https://insights.sbomify.com/CVE-2026-50130/): Pi-hole: Local privilege escalation from `pihole` user to root via `/etc/pihole/logrotate` (high 8.8)
- [CVE-2026-5013](https://insights.sbomify.com/CVE-2026-5013/): elecV2 elecV2P :key path.join path traversal (medium 6.9)
- [CVE-2026-50129](https://insights.sbomify.com/CVE-2026-50129/): Mastodon: Persistent anonymous DoS via unhandled NoMethodError in MATH_TRANSFORMER (high 7.5)
- [CVE-2026-50128](https://insights.sbomify.com/CVE-2026-50128/): Mastodon: Spoofing of attribution domains (medium 5.3)
- [CVE-2026-50127](https://insights.sbomify.com/CVE-2026-50127/): Weblate SSRF: outbound URL guard misses the NAT64 well-known prefix (64:ff9b::/96) (medium 5.9)
- [CVE-2026-50126](https://insights.sbomify.com/CVE-2026-50126/): Null dereference in adaguc-server (medium 4.0)
- [CVE-2026-50125](https://insights.sbomify.com/CVE-2026-50125/): MKP: Unbounded Pod Log Read via Attacker-Controlled `limitBytes`/`tailLines` Causes Memory Exhaustion (high 7.5)
- [CVE-2026-50124](https://insights.sbomify.com/CVE-2026-50124/): DataEase: Remote Code Execution (RCE) via Zip Protocol & File Dropper (high 7.1)
- [CVE-2026-5012](https://insights.sbomify.com/CVE-2026-5012/): elecV2 elecV2P rpc pm2run os command injection (medium 6.9)
- [CVE-2026-50112](https://insights.sbomify.com/CVE-2026-50112/): Apache CloudStack: RCE and SSRF in direct download, metalink and NFS templates (high 8.8)
- [CVE-2026-50110](https://insights.sbomify.com/CVE-2026-50110/): Use of Hard-coded Credentials in StoneFly Storage Concentrator (critical 9.3)
- [CVE-2026-5011](https://insights.sbomify.com/CVE-2026-5011/): elecV2 elecV2P JSON webhook runJSFile code injection (medium 5.3)
- [CVE-2026-50108](https://insights.sbomify.com/CVE-2026-50108/): Naxclow IoT Platform Missing Authorization (high 8.7)
- [CVE-2026-50107](https://insights.sbomify.com/CVE-2026-50107/): NGINX Gateway Fabric vulnerability (high 8.6)
- [CVE-2026-50106](https://insights.sbomify.com/CVE-2026-50106/): Security feature bypass in Unbound (medium 6.5)
- [CVE-2026-50105](https://insights.sbomify.com/CVE-2026-50105/): RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698) (medium 4.3)
- [CVE-2026-50103](https://insights.sbomify.com/CVE-2026-50103/): Improper Handling of Syntactically Invalid Structure in MZ Automation libIEC61850 (high 7.1)
- [CVE-2026-50101](https://insights.sbomify.com/CVE-2026-50101/): Naxclow IoT Platform Not using password aging (critical 9.2)
- [CVE-2026-50100](https://insights.sbomify.com/CVE-2026-50100/): Privilege escalation in Multiple printer drivers (high 8.5)
- [CVE-2026-5010](https://insights.sbomify.com/CVE-2026-5010/): Reflected Cross-Site Scripting (XSS) in Sanoma’s Clickedu (medium 5.1)
- [CVE-2026-50099](https://insights.sbomify.com/CVE-2026-50099/): Naxclow IoT Platform Insertion of sensitive information into Externally-Accessible file or directory (medium 5.1)
- [CVE-2026-50096](https://insights.sbomify.com/CVE-2026-50096/): BUG-000187164 - ArcGIS Server has a security vulnerability. (medium 6.1)
- [CVE-2026-50095](https://insights.sbomify.com/CVE-2026-50095/): BUG-000187165 - ArcGIS Server has a security vulnerability. (medium 6.1)
- [CVE-2026-50093](https://insights.sbomify.com/CVE-2026-50093/): File upload in Siveillance Control Pro V3.0 (high 8.9)
- [CVE-2026-50091](https://insights.sbomify.com/CVE-2026-50091/): Aqara Home Android SDK hardcoded keys (critical 9.1)
- [CVE-2026-50090](https://insights.sbomify.com/CVE-2026-50090/): Aqara OAuth redirect_uri validation bypass (critical 9.3)
- [CVE-2026-50089](https://insights.sbomify.com/CVE-2026-50089/): Aqara IAM/SSO Gateway open redirect (medium 6.1)
- [CVE-2026-50088](https://insights.sbomify.com/CVE-2026-50088/): Aqara Developer Portal cross-origin resource sharing (high 8.2)
- [CVE-2026-50087](https://insights.sbomify.com/CVE-2026-50087/): Aqara IAM/SSO Gateway cross-origin resource sharing (high 8.2)
- [CVE-2026-50086](https://insights.sbomify.com/CVE-2026-50086/): Aqara unauthenticated AES oracle (critical 10.0)
- [CVE-2026-50085](https://insights.sbomify.com/CVE-2026-50085/): Aqara Board IoT insecure debug API (high 8.6)
- [CVE-2026-50084](https://insights.sbomify.com/CVE-2026-50084/): Aqara API cross-account access (critical 9.6)
- [CVE-2026-50083](https://insights.sbomify.com/CVE-2026-50083/): Aqara hardcoded OAuth client credentials (critical 9.1)
- [CVE-2026-50082](https://insights.sbomify.com/CVE-2026-50082/): Aqara Developer Portal insecure authentication token (medium 6.5)
- [CVE-2026-50076](https://insights.sbomify.com/CVE-2026-50076/): Apache Fory: Java ReplaceResolverSerializer deserialization checks bypass (critical 9.1)
- [CVE-2026-5007](https://insights.sbomify.com/CVE-2026-5007/): kazuph mcp-docs-rag add_git_repository/add_text_file index.ts cloneRepository os command injection (medium 4.8)
- [CVE-2026-50064](https://insights.sbomify.com/CVE-2026-50064/): Memory corruption in Solid Edge SE2025 (high 7.3)
- [CVE-2026-50063](https://insights.sbomify.com/CVE-2026-50063/): Memory corruption in Solid Edge SE2025 (high 7.3)
- [CVE-2026-50062](https://insights.sbomify.com/CVE-2026-50062/): Memory corruption in Solid Edge SE2025 (high 7.3)
- [CVE-2026-50061](https://insights.sbomify.com/CVE-2026-50061/): Use after free in Solid Edge SE2025 (high 7.3)
- [CVE-2026-50060](https://insights.sbomify.com/CVE-2026-50060/): Use after free in Solid Edge SE2025 (high 7.3)
- [CVE-2026-5006](https://insights.sbomify.com/CVE-2026-5006/): Vault Vulnerable to Privilege Escalation via Slash Injection in Templated Policy Paths (medium 6.8)
- [CVE-2026-50059](https://insights.sbomify.com/CVE-2026-50059/): Memory corruption in Solid Edge SE2025 (high 7.3)
- [CVE-2026-50058](https://insights.sbomify.com/CVE-2026-50058/): Memory corruption in Solid Edge SE2025 (high 7.3)
- [CVE-2026-50057](https://insights.sbomify.com/CVE-2026-50057/): Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted Postfix Sudo Permissions (high 7.8)
- [CVE-2026-50056](https://insights.sbomify.com/CVE-2026-50056/): Zimbra Collaboration Suite Local Privilege Escalation via zmmailboxdmgr JVM Argument Injection (high 7.8)
- [CVE-2026-50055](https://insights.sbomify.com/CVE-2026-50055/): Zimbra Collaboration Suite Sieve Notify Filter Action Bypasses Mail Forwarding Restriction via Variable Expansion (medium 6.5)
- [CVE-2026-50054](https://insights.sbomify.com/CVE-2026-50054/): Privilege escalation in Zimbra Collaboration Suite (high 7.1)
- [CVE-2026-50053](https://insights.sbomify.com/CVE-2026-50053/): Zimbra Collaboration Suite RestFilter Request Attribute Override via Unauthenticated URL Parameters (high 8.7)
- [CVE-2026-50052](https://insights.sbomify.com/CVE-2026-50052/): Other in Varnish Cache (pre split) (low 2.3)
- [CVE-2026-5005](https://insights.sbomify.com/CVE-2026-5005/): Stored XSS in Twiser's OKRs & Goals (medium 5.4)
- [CVE-2026-50046](https://insights.sbomify.com/CVE-2026-50046/): Possible heap use-after-free in an error path when a DoT forwarded query is jostled out (medium 5.9)
- [CVE-2026-50045](https://insights.sbomify.com/CVE-2026-50045/): 'max-global-quota' reset by DNSSEC validation restarts (medium 5.3)
- [CVE-2026-50044](https://insights.sbomify.com/CVE-2026-50044/): Inadequate Encryption Strength in Panduit IntraVUE by Pronetiqs (high 7.6)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/580/