# Vulnerabilities published in 2026


- [CVE-2026-49252](https://insights.sbomify.com/CVE-2026-49252/): deepstream is vulnerable to prototype pollution (critical 9.9)
- [CVE-2026-49250](https://insights.sbomify.com/CVE-2026-49250/): Conform: parseSubmission vulnerable to CPU exhaustion when parsing many unique form fields (high 8.7)
- [CVE-2026-4925](https://insights.sbomify.com/CVE-2026-4925/): Missing authorization in Server (medium 5.0)
- [CVE-2026-49249](https://insights.sbomify.com/CVE-2026-49249/): Boruta: Authenticated atom-exhaustion DoS in BorutaIdentityWeb.UserSettingsController.update/2 (high 7.1)
- [CVE-2026-49248](https://insights.sbomify.com/CVE-2026-49248/): Path traversal in onedev (high 8.3)
- [CVE-2026-49247](https://insights.sbomify.com/CVE-2026-49247/): Jellyfin: Potential Authenticated path traversal in /ClientLog/Document (high 8.8)
- [CVE-2026-49246](https://insights.sbomify.com/CVE-2026-49246/): Jellyfin: Potential MKV attachment filename path traversal to RCE (low 1.7)
- [CVE-2026-49245](https://insights.sbomify.com/CVE-2026-49245/): SFTPGo: Stored XSS via inline parameter on public shares and user file download (low 3.7)
- [CVE-2026-49244](https://insights.sbomify.com/CVE-2026-49244/): SFTPGo: Path confinement bypass in public browsable share partial ZIP download (medium 5.9)
- [CVE-2026-49243](https://insights.sbomify.com/CVE-2026-49243/): Webmin: Reflected XSS in the Configuration module (critical 9.6)
- [CVE-2026-49241](https://insights.sbomify.com/CVE-2026-49241/): Angular: Multiple Remote Code Execution Vulnerabilities in Angular Language Service VS Code Extension (high 8.7)
- [CVE-2026-4924](https://insights.sbomify.com/CVE-2026-4924/): Auth bypass in Server (high 8.2)
- [CVE-2026-49238](https://insights.sbomify.com/CVE-2026-49238/): SFTP Server VM Escape in Canonical Multipass (high 8.4)
- [CVE-2026-49237](https://insights.sbomify.com/CVE-2026-49237/): Local Privilege Escalation in Canonical Multipass (high 7.8)
- [CVE-2026-49235](https://insights.sbomify.com/CVE-2026-49235/): Routinator crashes on specifically crafted RRDP XML files (high 8.7)
- [CVE-2026-49234](https://insights.sbomify.com/CVE-2026-49234/): Routinator crashes on specifically crafted ASN strings in the API (high 8.2)
- [CVE-2026-49233](https://insights.sbomify.com/CVE-2026-49233/): Routinator cache path traversal using rogue rsync URIs (high 8.3)
- [CVE-2026-49232](https://insights.sbomify.com/CVE-2026-49232/): Routinator exits when accepting an incoming HTTP or RTR connection fails (high 8.7)
- [CVE-2026-49231](https://insights.sbomify.com/CVE-2026-49231/): Apache APISIX: Identity spoofing issue in APISIX opa plugin (low 2.3)
- [CVE-2026-49230](https://insights.sbomify.com/CVE-2026-49230/): Apache APISIX: Authentication bypass in jwe-decrypt (medium 6.3)
- [CVE-2026-4923](https://insights.sbomify.com/CVE-2026-4923/): path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards (medium 5.9)
- [CVE-2026-49229](https://insights.sbomify.com/CVE-2026-49229/): Actual: Disabled OpenID users keep access through existing session tokens (high 8.3)
- [CVE-2026-49228](https://insights.sbomify.com/CVE-2026-49228/): Vvveb product authorization bypass allows Vendors to read, duplicate, or delete other Vendors' products (high 8.8)
- [CVE-2026-49227](https://insights.sbomify.com/CVE-2026-49227/): Vvveb comment authorization bypass allows Authors to read, approve, edit, or delete comments under other Authors' posts (high 7.6)
- [CVE-2026-49226](https://insights.sbomify.com/CVE-2026-49226/): Vvveb post authorization bypass allows Authors to view, duplicate, or delete other Authors' posts (high 8.3)
- [CVE-2026-49225](https://insights.sbomify.com/CVE-2026-49225/): Vvveb product revision authorization bypass allows Vendors to read, restore, or delete other Vendors' product revisions (high 8.3)
- [CVE-2026-49224](https://insights.sbomify.com/CVE-2026-49224/): Vvveb post revision authorization bypass allows Authors to read, restore, or delete other Authors' post revisions (high 8.3)
- [CVE-2026-49223](https://insights.sbomify.com/CVE-2026-49223/): Missing authorization in Vvveb (high 7.6)
- [CVE-2026-49222](https://insights.sbomify.com/CVE-2026-49222/): Missing authorization in Vvveb (high 7.6)
- [CVE-2026-49221](https://insights.sbomify.com/CVE-2026-49221/): Vvveb digital asset authorization bypass allows Vendors to list, read, edit, or delete other Vendors' digital assets (high 8.8)
- [CVE-2026-49220](https://insights.sbomify.com/CVE-2026-49220/): Jellyfin: Potential XSS in user management (medium 5.7)
- [CVE-2026-4922](https://insights.sbomify.com/CVE-2026-4922/): Cross-Site Request Forgery (CSRF) in GitLab (high 8.1)
- [CVE-2026-49219](https://insights.sbomify.com/CVE-2026-49219/): ImageMagick: Policy Bypass can read disallowed files (medium 5.5)
- [CVE-2026-49218](https://insights.sbomify.com/CVE-2026-49218/): ImageMagick: Policy Bypass in DCM decoder could result in image with invalid dimensions (high 7.5)
- [CVE-2026-49217](https://insights.sbomify.com/CVE-2026-49217/): Mailu missing authentication on PATCH /api/v1/token/<id>, which allows unauthenticated removal of IP restrictions (high 7.5)
- [CVE-2026-49216](https://insights.sbomify.com/CVE-2026-49216/): Symfony UX: XSS in symfony/ux-autocomplete via unescaped AJAX response data (medium 5.1)
- [CVE-2026-49215](https://insights.sbomify.com/CVE-2026-49215/): Symfony UX: CSRF Protection Bypass in symfony/ux-live-component — Accept Header is CORS-Safelisted (low 2.1)
- [CVE-2026-49214](https://insights.sbomify.com/CVE-2026-49214/): guzzlehttp/psr7 has CRLF Injection via URI Host Component (medium 5.3)
- [CVE-2026-49213](https://insights.sbomify.com/CVE-2026-49213/): TypeBot: SSRF protection bypass via IPv6 unspecified address in Typebot HTTP request execution (high 8.1)
- [CVE-2026-49212](https://insights.sbomify.com/CVE-2026-49212/): Symfony UX: LiveComponentHydrator HMAC checksum lacks component and slot binding (medium 6.9)
- [CVE-2026-49211](https://insights.sbomify.com/CVE-2026-49211/): Symfony UX: Information exposure via unescaped LIKE wildcards in EntitySearchUtil (medium 6.9)
- [CVE-2026-49210](https://insights.sbomify.com/CVE-2026-49210/): Symfony UX: XSS in symfony/ux-live-component via attacker-controlled child component tag (low 2.3)
- [CVE-2026-4921](https://insights.sbomify.com/CVE-2026-4921/): IBM Guardium Data Protection is affected by multiple vulnerabilities. (low 2.7)
- [CVE-2026-49209](https://insights.sbomify.com/CVE-2026-49209/): Symfony UX: Denial of service in symfony/ux-live-component via unbounded batch action requests (medium 5.3)
- [CVE-2026-49208](https://insights.sbomify.com/CVE-2026-49208/): Symfony UX: Format-less date LiveProps parsed with the permissive DateTime constructor (medium 6.9)
- [CVE-2026-49206](https://insights.sbomify.com/CVE-2026-49206/): rapidcsv: Integer overflow in iterator arithmetic causes out-of-bounds access (low 2.9)
- [CVE-2026-49205](https://insights.sbomify.com/CVE-2026-49205/): phpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix) (medium 6.5)
- [CVE-2026-49204](https://insights.sbomify.com/CVE-2026-49204/): Hard-coded AWS Cognito Testing Accounts (medium 6.9)
- [CVE-2026-49203](https://insights.sbomify.com/CVE-2026-49203/): Unauthenticated eSIM Configuration Manipulation (high 7.2)
- [CVE-2026-49202](https://insights.sbomify.com/CVE-2026-49202/): Unverified Meeting Recording Endpoints & Permissive CORS (high 8.8)
- [CVE-2026-49201](https://insights.sbomify.com/CVE-2026-49201/): Acer Wave 7 router: Hardcoded Cryptographic Key (critical 10.0)
- [CVE-2026-49200](https://insights.sbomify.com/CVE-2026-49200/): Acer Wave 7 router: Broken Access Control (critical 10.0)
- [CVE-2026-4920](https://insights.sbomify.com/CVE-2026-4920/): Next Date <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'default' Shortcode Attribute (medium 6.4)
- [CVE-2026-49199](https://insights.sbomify.com/CVE-2026-49199/): Predator Connect W6x: RCE via MQTT (critical 10.0)
- [CVE-2026-49198](https://insights.sbomify.com/CVE-2026-49198/): Predator Connect W6x: MQTT Broker Access Control (high 8.3)
- [CVE-2026-49197](https://insights.sbomify.com/CVE-2026-49197/): Predator Connect W6x: Improper Authentication (critical 10.0)
- [CVE-2026-49196](https://insights.sbomify.com/CVE-2026-49196/): Predator Connect W6x: Web Interface Command Injection (high 8.6)
- [CVE-2026-49195](https://insights.sbomify.com/CVE-2026-49195/): Predator Connect W6x: unauthenticated Debug Service (high 8.7)
- [CVE-2026-49194](https://insights.sbomify.com/CVE-2026-49194/): SCREEN_CLICK Authentication Bypass (critical 9.4)
- [CVE-2026-49193](https://insights.sbomify.com/CVE-2026-49193/): Publicly Readable AWS S3 Telemetry Buckets (high 8.7)
- [CVE-2026-49192](https://insights.sbomify.com/CVE-2026-49192/): Summary Service Insecure Direct Object Reference (medium 5.3)
- [CVE-2026-49191](https://insights.sbomify.com/CVE-2026-49191/): Exposed Hard-coded M3WebServer Backend API Key (critical 9.3)
- [CVE-2026-49190](https://insights.sbomify.com/CVE-2026-49190/): Missing Per-Instruction Authorization Checks (critical 9.4)
- [CVE-2026-4919](https://insights.sbomify.com/CVE-2026-4919/): IBM Guardium Data Protection is affected by multiple vulnerabilities (medium 4.8)
- [CVE-2026-49189](https://insights.sbomify.com/CVE-2026-49189/): Broadcast Receiver Privilege Escalation (high 8.5)
- [CVE-2026-49188](https://insights.sbomify.com/CVE-2026-49188/): Elevated Root Command Execution via ai_cmd Sockets (high 8.7)
- [CVE-2026-49187](https://insights.sbomify.com/CVE-2026-49187/): Hard-coded APK Resource Credentials & Scepters (high 8.7)
- [CVE-2026-49186](https://insights.sbomify.com/CVE-2026-49186/): Lack of MQTT Broker Topic Access Control Lists (high 8.6)
- [CVE-2026-49185](https://insights.sbomify.com/CVE-2026-49185/): Instruction Injection via FieldX MDM (critical 10.0)
- [CVE-2026-49184](https://insights.sbomify.com/CVE-2026-49184/): Windows NTFS Remote Code Execution Vulnerability (high 8.4)
- [CVE-2026-49183](https://insights.sbomify.com/CVE-2026-49183/): Windows Clipboard Server Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-49181](https://insights.sbomify.com/CVE-2026-49181/): Windows DHCP Client Elevation of Privilege Vulnerability (high 7.5)
- [CVE-2026-49180](https://insights.sbomify.com/CVE-2026-49180/): Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-4918](https://insights.sbomify.com/CVE-2026-4918/): IBM Guardium Data Protection is affected by multiple vulnerabilities (medium 5.5)
- [CVE-2026-49179](https://insights.sbomify.com/CVE-2026-49179/): Windows Active Directory Domain Services Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-49178](https://insights.sbomify.com/CVE-2026-49178/): Windows Active Directory Domain Services Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-49177](https://insights.sbomify.com/CVE-2026-49177/): Windows TCP/IP Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-49176](https://insights.sbomify.com/CVE-2026-49176/): Windows WalletService Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-49175](https://insights.sbomify.com/CVE-2026-49175/): Windows DNS Client Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-49174](https://insights.sbomify.com/CVE-2026-49174/): DNS Client Tampering Vulnerability (medium 6.1)
- [CVE-2026-49173](https://insights.sbomify.com/CVE-2026-49173/): Windows Kernel Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-49172](https://insights.sbomify.com/CVE-2026-49172/): Windows FTP Service Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-49171](https://insights.sbomify.com/CVE-2026-49171/): Windows Speech Runtime Elevation of Privilege Vulnerability (high 7.5)
- [CVE-2026-49170](https://insights.sbomify.com/CVE-2026-49170/): Windows StateRepository API Server file Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-4917](https://insights.sbomify.com/CVE-2026-4917/): IBM Guardium Data Protection is affected by multiple vulnerabilities (medium 4.9)
- [CVE-2026-49169](https://insights.sbomify.com/CVE-2026-49169/): Windows DNS Server Remote Code Execution Vulnerability (high 8.0)
- [CVE-2026-49168](https://insights.sbomify.com/CVE-2026-49168/): Storage Spaces Direct Elevation of Privilege Vulnerability (medium 6.8)
- [CVE-2026-49167](https://insights.sbomify.com/CVE-2026-49167/): Windows Kernel Elevation of Privilege Vulnerability (medium 4.7)
- [CVE-2026-49166](https://insights.sbomify.com/CVE-2026-49166/): Windows Print Configuration Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-49165](https://insights.sbomify.com/CVE-2026-49165/): Microsoft Windows App Store Information Disclosure Vulnerability (high 7.1)
- [CVE-2026-49164](https://insights.sbomify.com/CVE-2026-49164/): Windows Active Directory Domain Services Remote Code Execution Vulnerability (high 8.1)
- [CVE-2026-49163](https://insights.sbomify.com/CVE-2026-49163/): Application Insights Profiler Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-49162](https://insights.sbomify.com/CVE-2026-49162/): Microsoft Brokering File System Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-49161](https://insights.sbomify.com/CVE-2026-49161/): Microsoft PC Manager Security Feature Bypass Vulnerability (high 7.8)
- [CVE-2026-49160](https://insights.sbomify.com/CVE-2026-49160/): HTTP.sys Denial of Service Vulnerability (high 7.5)
- [CVE-2026-4916](https://insights.sbomify.com/CVE-2026-4916/): Missing Authorization in GitLab (low 2.7)
- [CVE-2026-49159](https://insights.sbomify.com/CVE-2026-49159/): Microsoft Graph Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-49158](https://insights.sbomify.com/CVE-2026-49158/): Apache Thrift: Ruby THeaderTransport ZLIB Decompression Bomb (high 7.5)
- [CVE-2026-49157](https://insights.sbomify.com/CVE-2026-49157/): Apache ActiveMQ: Authenticated low-privilege Web users retain Jolokia broker-management capability by default (high 8.8)
- [CVE-2026-4915](https://insights.sbomify.com/CVE-2026-4915/): Server panic via outgoing webhook responses (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/586/