# Vulnerabilities published in 2026 - [CVE-2026-50043](https://insights.sbomify.com/CVE-2026-50043/): Command injection in SkyBridge MB-A100/MB-A110 (high 8.6) - [CVE-2026-50040](https://insights.sbomify.com/CVE-2026-50040/): Cross-site Scripting in StoneFly Storage Concentrator (medium 5.1) - [CVE-2026-5004](https://insights.sbomify.com/CVE-2026-5004/): Wavlink WL-WN579X3-C UPNP firewall.cgi sub_4019FC stack-based overflow (high 8.7) - [CVE-2026-50039](https://insights.sbomify.com/CVE-2026-50039/): Stack-based Buffer Overflow in MZ Automation libIEC61850 (high 8.7) - [CVE-2026-50034](https://insights.sbomify.com/CVE-2026-50034/): Apollo Pharmacy Blood Glucose Monitoring System APG-01 BT Cleartext Transmission of Sensitive Information (high 7.1) - [CVE-2026-50033](https://insights.sbomify.com/CVE-2026-50033/): Privilege escalation in Acronis DeviceLock DLP (high 7.3) - [CVE-2026-50032](https://insights.sbomify.com/CVE-2026-50032/): NULL Pointer Dereference in MZ Automation libIEC61850 (high 8.7) - [CVE-2026-50031](https://insights.sbomify.com/CVE-2026-50031/): Memory corruption in FreeIPMI (high 7.5) - [CVE-2026-50030](https://insights.sbomify.com/CVE-2026-50030/): DataEase: Arbitrary SQL execution in preview path (direct data disclosure) (high 7.1) - [CVE-2026-5003](https://insights.sbomify.com/CVE-2026-5003/): PromtEngineer localGPT Web api_server.py handle_index information disclosure (medium 6.9) - [CVE-2026-50029](https://insights.sbomify.com/CVE-2026-50029/): js-toml has silent type confusion via falsy-primitive duplicate-key bypass (medium 5.3) - [CVE-2026-50027](https://insights.sbomify.com/CVE-2026-50027/): mcp-memory-service: Missing Authentication on Document API Endpoints Allows Unauthenticated Memory Read/Write/Delete (critical 9.8) - [CVE-2026-50026](https://insights.sbomify.com/CVE-2026-50026/): Frappe: Lack of permissions checks in 'relink' and 'set_email_password' endpoints (medium 6.9) - [CVE-2026-50025](https://insights.sbomify.com/CVE-2026-50025/): Mousehole: Unauthenticated HTTP/WebSocket boundary exposes and mutates MAM cookie state (medium 6.9) - [CVE-2026-50024](https://insights.sbomify.com/CVE-2026-50024/): GitHacker: Path traversal in ref/hash parsing enables existence oracle and hex-fragment exfiltration via malicious .git server (medium 5.3) - [CVE-2026-50023](https://insights.sbomify.com/CVE-2026-50023/): yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519) (high 8.3) - [CVE-2026-50022](https://insights.sbomify.com/CVE-2026-50022/): Metacat acts as unintended proxy to backend Apache SOLR engine (medium 5.8) - [CVE-2026-50021](https://insights.sbomify.com/CVE-2026-50021/): pnpm: Integrity Check Bypass via Missing Lockfile Integrity Field (medium 6.8) - [CVE-2026-50020](https://insights.sbomify.com/CVE-2026-50020/): Netty's HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted (medium 5.3) - [CVE-2026-5002](https://insights.sbomify.com/CVE-2026-5002/): PromtEngineer localGPT LLM Prompt server.py _route_using_overviews injection (medium 6.9) - [CVE-2026-50019](https://insights.sbomify.com/CVE-2026-50019/): yt-dlp: File Downloader cookie leak with curl (medium 6.1) - [CVE-2026-50018](https://insights.sbomify.com/CVE-2026-50018/): Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions (medium 6.5) - [CVE-2026-50017](https://insights.sbomify.com/CVE-2026-50017/): pnpm binds unscoped user-level npm auth credentials to a repository-selected registry (medium 6.9) - [CVE-2026-50016](https://insights.sbomify.com/CVE-2026-50016/): pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement (high 8.8) - [CVE-2026-50015](https://insights.sbomify.com/CVE-2026-50015/): pnpm: Arbitrary File Write/Delete via Malicious Patch File (Path Traversal) (high 7.3) - [CVE-2026-50014](https://insights.sbomify.com/CVE-2026-50014/): pnpm: Git Fetch Argument Injection via Lockfile resolution.commit (medium 6.4) - [CVE-2026-50013](https://insights.sbomify.com/CVE-2026-50013/): Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff Mode (high 7.5) - [CVE-2026-50012](https://insights.sbomify.com/CVE-2026-50012/): Squid: Memory corruption in cache_digest reply handling (medium 5.5) - [CVE-2026-50011](https://insights.sbomify.com/CVE-2026-50011/): Netty has unbounded pre-allocation in RedisArrayAggregator from RESP array length (high 7.5) - [CVE-2026-50010](https://insights.sbomify.com/CVE-2026-50010/): Netty's wrapping plain trust manager silently disables hostname verification (high 7.5) - [CVE-2026-5001](https://insights.sbomify.com/CVE-2026-5001/): PromtEngineer localGPT server.py do_POST unrestricted upload (medium 6.9) - [CVE-2026-50009](https://insights.sbomify.com/CVE-2026-50009/): Netty QUIC stateless reset token material exposed through header-visible connection IDs (medium 4.8) - [CVE-2026-50008](https://insights.sbomify.com/CVE-2026-50008/): Parse Server: Server option routeAllowList is bypassable through batch sub-requests (medium 6.9) - [CVE-2026-50007](https://insights.sbomify.com/CVE-2026-50007/): Actual: Shared users can perform owner-only file management actions (high 7.2) - [CVE-2026-50006](https://insights.sbomify.com/CVE-2026-50006/): Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode (critical 9.1) - [CVE-2026-50005](https://insights.sbomify.com/CVE-2026-50005/): Brickcom Cameras Use of Default Credentials (high 8.3) - [CVE-2026-50003](https://insights.sbomify.com/CVE-2026-50003/): OFFIS DCMTK Toolkit Path Traversal (critical 9.3) - [CVE-2026-5000](https://insights.sbomify.com/CVE-2026-5000/): PromtEngineer localGPT API Endpoint server.py LocalGPTHandler missing authentication (medium 6.9) - [CVE-2026-49998](https://insights.sbomify.com/CVE-2026-49998/): Centrifugo: Dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass (high 8.2) - [CVE-2026-49997](https://insights.sbomify.com/CVE-2026-49997/): SurrealDB: Edge PERMISSIONS FOR delete bypassed when a connected node is deleted (medium 5.4) - [CVE-2026-49996](https://insights.sbomify.com/CVE-2026-49996/): securedrop-proxy origin limitation can be bypassed with redirects (low 3.7) - [CVE-2026-49995](https://insights.sbomify.com/CVE-2026-49995/): Tautulli: Stored Cross-Site Scripting (XSS) in the newsletter (medium 4.8) - [CVE-2026-49994](https://insights.sbomify.com/CVE-2026-49994/): Bluehood: Missing authentication on Bluehood API routes when web auth is enabled (critical 9.1) - [CVE-2026-49993](https://insights.sbomify.com/CVE-2026-49993/): @nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g) (medium 5.9) - [CVE-2026-49992](https://insights.sbomify.com/CVE-2026-49992/): Kimai: Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team and Permission Structure Changes (medium 6.3) - [CVE-2026-49991](https://insights.sbomify.com/CVE-2026-49991/): RustFS Snowball Auto-Extract: Path Traversal allows cross-bucket object injection (high 8.6) - [CVE-2026-4999](https://insights.sbomify.com/CVE-2026-4999/): z-9527 admin isImg Check upload.js uploadFile path traversal (medium 5.3) - [CVE-2026-49989](https://insights.sbomify.com/CVE-2026-49989/): CrateDB's Blob HTTP handler bypasses authorization (high 7.1) - [CVE-2026-49988](https://insights.sbomify.com/CVE-2026-49988/): Repomix: attach_packed_output can bypass file-read secret scanning for supported local files (medium 6.8) - [CVE-2026-49987](https://insights.sbomify.com/CVE-2026-49987/): Repomix: Command Injection (RCE) via `--remote-branch` Argument Injection (high 7.5) - [CVE-2026-49986](https://insights.sbomify.com/CVE-2026-49986/): Cortex has Untrusted Project Bootstrap Code Execution via `CLAUDE_PROJECT_DIR` (high 7.1) - [CVE-2026-49984](https://insights.sbomify.com/CVE-2026-49984/): Path traversal in kestra (high 7.7) - [CVE-2026-49983](https://insights.sbomify.com/CVE-2026-49983/): Deno: process.loadEnvFile() bypasses env permission checks and mutates process.env with only read access (medium 5.2) - [CVE-2026-49982](https://insights.sbomify.com/CVE-2026-49982/): tmp: Type-confusion bypass of _assertPath in tmp@0.2.6 allows path traversal via non-string prefix/postfix/template (high 8.2) - [CVE-2026-49981](https://insights.sbomify.com/CVE-2026-49981/): Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template` (medium 6.0) - [CVE-2026-49980](https://insights.sbomify.com/CVE-2026-49980/): Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix (critical 9.8) - [CVE-2026-4998](https://insights.sbomify.com/CVE-2026-4998/): Sinaptik AI PandasAI Chat Message code_executor.py CodeExecutor.execute code injection (medium 6.9) - [CVE-2026-49979](https://insights.sbomify.com/CVE-2026-49979/): Appsmith: SSRF via `POST /api/v1/admin/send-test-email` — JavaMail Bypasses WebClient IP Filter (medium 5.1) - [CVE-2026-49978](https://insights.sbomify.com/CVE-2026-49978/): DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside