# Vulnerabilities published in 2026


- [CVE-2026-48824](https://insights.sbomify.com/CVE-2026-48824/): Mailpit: Sibling-endpoint memory-exhaustion DoS via unbounded JSON body on /api/v1/messages, /api/v1/tags, and /api/v1/message/{id}/release (incomplete fix of GHSA-fpxj-m5q8-fphw) (medium 5.3)
- [CVE-2026-48823](https://insights.sbomify.com/CVE-2026-48823/): Shaarli has Stored Cross-Site Scripting (XSS) via Tags Search (medium 4.8)
- [CVE-2026-48822](https://insights.sbomify.com/CVE-2026-48822/): Shaarli has Stored Cross-Site Scripting (XSS) via Markdown Reference Links (medium 5.8)
- [CVE-2026-48821](https://insights.sbomify.com/CVE-2026-48821/): Shaarli: DOM-based Cross-Site Scripting (XSS) in Thumbnail Synchronizer (medium 5.8)
- [CVE-2026-48820](https://insights.sbomify.com/CVE-2026-48820/): CakePHP: View::element() is missing a path containment check (medium 6.3)
- [CVE-2026-4882](https://insights.sbomify.com/CVE-2026-4882/): User Registration Advanced Fields <= 1.6.20 - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2026-48819](https://insights.sbomify.com/CVE-2026-48819/): Hey API: `buildClientParams` template: prototype chain substitution via unknown `$<slot>___proto__` key (medium 4.8)
- [CVE-2026-48818](https://insights.sbomify.com/CVE-2026-48818/): Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows (high 7.5)
- [CVE-2026-48817](https://insights.sbomify.com/CVE-2026-48817/): Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr` (medium 5.3)
- [CVE-2026-48816](https://insights.sbomify.com/CVE-2026-48816/): sigstore-js: Insufficient Verification of Data Authenticity (medium 6.5)
- [CVE-2026-48815](https://insights.sbomify.com/CVE-2026-48815/): sigstore-js: `certificateOIDs` verification constraints are silently dropped and never enforced (high 7.5)
- [CVE-2026-48814](https://insights.sbomify.com/CVE-2026-48814/): Network-AI: Empty default secret still authorizes all requests (Incomplete fix for CVE-2026-46701) (critical 9.1)
- [CVE-2026-48813](https://insights.sbomify.com/CVE-2026-48813/): Flawfinder output manipulation via untrusted filenames and source text (high 8.7)
- [CVE-2026-48812](https://insights.sbomify.com/CVE-2026-48812/): FreeScout Allows Unauthenticated Access to Legacy Attachment Files (high 7.5)
- [CVE-2026-48811](https://insights.sbomify.com/CVE-2026-48811/): FreeScout: Thread Deletion Bypasses Mailbox Access Revocation (medium 4.3)
- [CVE-2026-48810](https://insights.sbomify.com/CVE-2026-48810/): FreeScout: Thread Edit Authorization Bypass via Missing Mailbox Check (medium 4.3)
- [CVE-2026-4881](https://insights.sbomify.com/CVE-2026-4881/): Missing authorization in Octopus Server (medium 6.0)
- [CVE-2026-48809](https://insights.sbomify.com/CVE-2026-48809/): python-engineio has possible denial of service due to maximum payload size sometimes not being enforced (high 7.5)
- [CVE-2026-48808](https://insights.sbomify.com/CVE-2026-48808/): Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface` (medium 6.0)
- [CVE-2026-48807](https://insights.sbomify.com/CVE-2026-48807/): Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters (high 7.1)
- [CVE-2026-48806](https://insights.sbomify.com/CVE-2026-48806/): Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys (high 7.1)
- [CVE-2026-48805](https://insights.sbomify.com/CVE-2026-48805/): Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php` (medium 5.3)
- [CVE-2026-48804](https://insights.sbomify.com/CVE-2026-48804/): python-socketio: Binary attachment accumulation can cause denial of service (high 7.5)
- [CVE-2026-48802](https://insights.sbomify.com/CVE-2026-48802/): python-engineio has unbound thread allocation that can cause denial of service (high 7.5)
- [CVE-2026-48801](https://insights.sbomify.com/CVE-2026-48801/): linkify-it: Quadratic algorithmic complexity in LinkifyIt#match scan loop (high 8.7)
- [CVE-2026-48800](https://insights.sbomify.com/CVE-2026-48800/): Notepad++: Arbitrary Code Execution via shortcuts.xml UserCommand Injection (high 7.8)
- [CVE-2026-4880](https://insights.sbomify.com/CVE-2026-4880/): Barcode Scanner (+Mobile App) <= 1.11.0 - Unauthenticated Privilege Escalation via Insecure Token Authentication (critical 9.8)
- [CVE-2026-48799](https://insights.sbomify.com/CVE-2026-48799/): Postiz: Unauthenticated arbitrary lifetime PRO grant via Nowpayments webhook (high 7.7)
- [CVE-2026-48798](https://insights.sbomify.com/CVE-2026-48798/): SSH.NET: ScpClient Recursive Download Allows Arbitrary File Write via Server-Controlled SCP Filenames (high 7.1)
- [CVE-2026-48797](https://insights.sbomify.com/CVE-2026-48797/): Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication (critical 9.3)
- [CVE-2026-48796](https://insights.sbomify.com/CVE-2026-48796/): CefSharp: `FolderSchemeHandlerFactory` path boundary check can expose files outside the configured root folder (medium 5.3)
- [CVE-2026-48795](https://insights.sbomify.com/CVE-2026-48795/): Incomplete fix for CVE-2026-25754 in @adonisjs/bodyparser (high 8.6)
- [CVE-2026-48794](https://insights.sbomify.com/CVE-2026-48794/): Authelia has an Edge Case Access Control Rule Mismatch (low 1.3)
- [CVE-2026-48793](https://insights.sbomify.com/CVE-2026-48793/): Jellyfin: Potential FFmpeg argument injection via unescaped subtitle file path (high 8.8)
- [CVE-2026-48792](https://insights.sbomify.com/CVE-2026-48792/): Auth bypass in pam usb (medium 4.4)
- [CVE-2026-48791](https://insights.sbomify.com/CVE-2026-48791/): Sigstore Java has a vulnerability with bundle verification of integratedTime (low 2.0)
- [CVE-2026-48790](https://insights.sbomify.com/CVE-2026-48790/): turso-cli persists Turso platform JWT with world-readable (0o644) file permissions (medium 5.5)
- [CVE-2026-4879](https://insights.sbomify.com/CVE-2026-4879/): Missing Authorization in GitLab (medium 4.3)
- [CVE-2026-48789](https://insights.sbomify.com/CVE-2026-48789/): AnythingLLM: Windows path containment bypass in document folder route (medium 4.3)
- [CVE-2026-48788](https://insights.sbomify.com/CVE-2026-48788/): Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing (high 8.2)
- [CVE-2026-48787](https://insights.sbomify.com/CVE-2026-48787/): gin-vue-admin vulnerable to RCE (high 7.4)
- [CVE-2026-48786](https://insights.sbomify.com/CVE-2026-48786/): Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint (medium 6.5)
- [CVE-2026-48785](https://insights.sbomify.com/CVE-2026-48785/): Apptainer: Incorrect path matching for 'limit container paths' directive (medium 4.8)
- [CVE-2026-48784](https://insights.sbomify.com/CVE-2026-48784/): Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization (medium 5.1)
- [CVE-2026-48783](https://insights.sbomify.com/CVE-2026-48783/): Postiz has an unauthenticated billing-enforcement bypass via /public/modify-subscription (medium 4.8)
- [CVE-2026-48782](https://insights.sbomify.com/CVE-2026-48782/): pydantic-ai: SSRF blocklist bypass via IPv4-compatible, SIIT/IVI, and local NAT64 IPv6 addresses (incomplete fix of CVE-2026-46678) (medium 6.8)
- [CVE-2026-48781](https://insights.sbomify.com/CVE-2026-48781/): Postiz has cross-tenant SUPERADMIN takeover via Skool-provider JWT forgery (critical 9.9)
- [CVE-2026-48780](https://insights.sbomify.com/CVE-2026-48780/): Forem vulnerable to bypass of email address domain restrictions (high 8.2)
- [CVE-2026-4878](https://insights.sbomify.com/CVE-2026-4878/): Libcap: libcap: privilege escalation via toctou race condition in cap_set_file() (medium 6.7)
- [CVE-2026-48779](https://insights.sbomify.com/CVE-2026-48779/): ws: Memory exhaustion DoS from tiny fragments and data chunks (high 7.5)
- [CVE-2026-48778](https://insights.sbomify.com/CVE-2026-48778/): Notepad++: Arbitrary Code Execution via config.xml commandLineInterpreter (high 7.8)
- [CVE-2026-48777](https://insights.sbomify.com/CVE-2026-48777/): FileBrowser Quantum: Path Traversal in public share PATCH allows file ops outside shared directory (critical 9.3)
- [CVE-2026-48776](https://insights.sbomify.com/CVE-2026-48776/): LangGraph SDK has unsafe URL path construction (medium 4.2)
- [CVE-2026-48775](https://insights.sbomify.com/CVE-2026-48775/): LangGraph Checkpoint: Unsafe JSON deserialization in checkpoint loading (medium 6.8)
- [CVE-2026-48774](https://insights.sbomify.com/CVE-2026-48774/): ProxySQL MCP run_sql_readonly executes side-effecting MySQL multi-statements despite read-only contract (high 7.5)
- [CVE-2026-48773](https://insights.sbomify.com/CVE-2026-48773/): ProxySQL pre-auth heap overflow in MySQL and PostgreSQL first-packet handling (critical 9.8)
- [CVE-2026-48772](https://insights.sbomify.com/CVE-2026-48772/): ProxySQL: PROXY-Protocol-v1 UNKNOWN parses spoofed source IP, bypassing mysql_query_rules.client_addr ACL (critical 10.0)
- [CVE-2026-48771](https://insights.sbomify.com/CVE-2026-48771/): ishankportfolio: Stored Contact Form Submission Exposure via Public Client-Side Database Configuration (high 8.2)
- [CVE-2026-48770](https://insights.sbomify.com/CVE-2026-48770/): Notepad++ WM_COPYDATA COPYDATA_FULL_CMDLINE local DoS crash (medium 5.0)
- [CVE-2026-4877](https://insights.sbomify.com/CVE-2026-4877/): itsourcecode Payroll Management System index.php cross site scripting (medium 5.3)
- [CVE-2026-48769](https://insights.sbomify.com/CVE-2026-48769/): Incus has an arbitrary file write on its client due to trusted image hash (critical 9.9)
- [CVE-2026-48768](https://insights.sbomify.com/CVE-2026-48768/): TypeBot: Unauthenticated arbitrary s3 object write in generate-upload-url via unsanitized fileName (critical 9.3)
- [CVE-2026-48767](https://insights.sbomify.com/CVE-2026-48767/): Google Sheets OAuth access token disclosure to guest members via getAccessToken (high 7.6)
- [CVE-2026-48766](https://insights.sbomify.com/CVE-2026-48766/): TypeBot vulnerable to OpenAI API key exfiltration in listModels via attacker-controlled baseUrl (high 7.6)
- [CVE-2026-48765](https://insights.sbomify.com/CVE-2026-48765/): TypeBot vulnerable to cross-workspace OAuth credential takeover in updateOAuthCredentials via missing object binding (critical 9.9)
- [CVE-2026-48764](https://insights.sbomify.com/CVE-2026-48764/): TypeBot has SSRF in HTTP request and script fetch flows via DNS rebinding bypass (high 8.2)
- [CVE-2026-48763](https://insights.sbomify.com/CVE-2026-48763/): TypeBot has Arbitrary S3 Object Write in deprecated public upload endpoint via attacker-controlled filePath (high 8.2)
- [CVE-2026-48762](https://insights.sbomify.com/CVE-2026-48762/): TypeBot Vulnerable to Server-Side Request Forgery (SSRF) in OpenAI Transcription Handler (medium 5.4)
- [CVE-2026-48761](https://insights.sbomify.com/CVE-2026-48761/): Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes (medium 5.3)
- [CVE-2026-48760](https://insights.sbomify.com/CVE-2026-48760/): Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense (medium 5.3)
- [CVE-2026-4876](https://insights.sbomify.com/CVE-2026-4876/): itsourcecode Free Hotel Reservation System index.php sql injection (medium 5.3)
- [CVE-2026-48759](https://insights.sbomify.com/CVE-2026-48759/): TypeBot: Cross-Workspace Theme Template IDOR (Modification and Deletion) (high 7.1)
- [CVE-2026-48758](https://insights.sbomify.com/CVE-2026-48758/): sigstore-js: DSSE payloadType type-binding failure (medium 5.4)
- [CVE-2026-48756](https://insights.sbomify.com/CVE-2026-48756/): Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) (low 2.1)
- [CVE-2026-48755](https://insights.sbomify.com/CVE-2026-48755/): Incus has an argument injection in backup compression algorithm leading to AFW and ACE (critical 9.9)
- [CVE-2026-48754](https://insights.sbomify.com/CVE-2026-48754/): Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} (low 2.1)
- [CVE-2026-48753](https://insights.sbomify.com/CVE-2026-48753/): Incus has an arbitrary file write via path traversal in S3 multipart upload (critical 9.9)
- [CVE-2026-48752](https://insights.sbomify.com/CVE-2026-48752/): Incus has arbitrary file read+write on host via templates/ symlink in malicious image (critical 9.9)
- [CVE-2026-48751](https://insights.sbomify.com/CVE-2026-48751/): Incus has a restricted project bypass leading to arbitrary command execution (critical 9.9)
- [CVE-2026-48750](https://insights.sbomify.com/CVE-2026-48750/): Incus has an arbitrary file write on host via `exec-output` symlink in crafted image (critical 9.9)
- [CVE-2026-4875](https://insights.sbomify.com/CVE-2026-4875/): itsourcecode Free Hotel Reservation System index.php unrestricted upload (medium 5.1)
- [CVE-2026-48749](https://insights.sbomify.com/CVE-2026-48749/): Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image (critical 9.9)
- [CVE-2026-48748](https://insights.sbomify.com/CVE-2026-48748/): Netty HTTP/3 QPACK Blocked Streams Memory Exhaustion (high 7.5)
- [CVE-2026-48747](https://insights.sbomify.com/CVE-2026-48747/): Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade (medium 6.3)
- [CVE-2026-48746](https://insights.sbomify.com/CVE-2026-48746/): vLLM: OpenAI auth bypass (critical 9.1)
- [CVE-2026-48745](https://insights.sbomify.com/CVE-2026-48745/): Traccar Client: silent configuration hijack via unverified deep link redirects all GPS telemetry (critical 9.3)
- [CVE-2026-48744](https://insights.sbomify.com/CVE-2026-48744/): Saleor: Anonymous users can modify channel settings via `channelUpdate` due to `all([])` bypass in permission check (medium 6.5)
- [CVE-2026-48743](https://insights.sbomify.com/CVE-2026-48743/): Envoy: HTTP/3 to HTTP/1 request smuggling via headers-only request with nonzero Content-Length (high 7.5)
- [CVE-2026-48741](https://insights.sbomify.com/CVE-2026-48741/): libIEC61850: Remote NULL dereference in MMS Read alternate-access sub-array path leads to server-side DoS (high 7.5)
- [CVE-2026-4874](https://insights.sbomify.com/CVE-2026-4874/): Keycloak Server-Side Request Forgery via OIDC token endpoint manipulation (low 3.1)
- [CVE-2026-48737](https://insights.sbomify.com/CVE-2026-48737/): pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs (medium 4.9)
- [CVE-2026-48736](https://insights.sbomify.com/CVE-2026-48736/): Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient (medium 6.9)
- [CVE-2026-48735](https://insights.sbomify.com/CVE-2026-48735/): pypdf: Manipulated XMP metadata streams can exhaust RAM (medium 6.9)
- [CVE-2026-48734](https://insights.sbomify.com/CVE-2026-48734/): ImageMagick: Stack Overflow in MVG decoder (medium 5.5)
- [CVE-2026-48733](https://insights.sbomify.com/CVE-2026-48733/): ImageMagick: Infinite Loop in subimage-search with crafted image (medium 4.7)
- [CVE-2026-48732](https://insights.sbomify.com/CVE-2026-48732/): Warp: Remote SSH cwd can lead to unauthorized remote command execution (high 8.8)
- [CVE-2026-48731](https://insights.sbomify.com/CVE-2026-48731/): Warp: Linux external editor command injection (high 7.8)
- [CVE-2026-4873](https://insights.sbomify.com/CVE-2026-4873/): connection reuse ignores TLS requirement (medium 5.9)
- [CVE-2026-48726](https://insights.sbomify.com/CVE-2026-48726/): Apache Airflow: revoke_token() unreachable in FabAuthManager / KeycloakAuthManager logout path (medium 6.5)
- [CVE-2026-48725](https://insights.sbomify.com/CVE-2026-48725/): Warp may allow terminal output to access the local clipboard through OSC 52 (high 8.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/590/