# Vulnerabilities published in 2026


- [CVE-2026-48557](https://insights.sbomify.com/CVE-2026-48557/): Spatie Laravel Media Library < 11.23.0 File Upload Restriction Bypass via FileAdder.php (high 8.7)
- [CVE-2026-48555](https://insights.sbomify.com/CVE-2026-48555/): Spatie Laravel Media Library < 11.23.0 SSRF via addMediaFromUrl() (medium 5.3)
- [CVE-2026-48554](https://insights.sbomify.com/CVE-2026-48554/): Nagios Core / XI Authenticated RCE via Unfiltered NOTIFICATION-Family Macro Substitution (high 7.7)
- [CVE-2026-48553](https://insights.sbomify.com/CVE-2026-48553/): Nagios Core / XI Authenticated RCE via Custom-Variable Macro Injection (high 7.7)
- [CVE-2026-48552](https://insights.sbomify.com/CVE-2026-48552/): Nagios Core / XI DOM-based XSS via jsonquery.js (medium 5.1)
- [CVE-2026-48551](https://insights.sbomify.com/CVE-2026-48551/): Nagios Core / XI CSRF Protection Bypass via Double-Submit Cookie (medium 6.1)
- [CVE-2026-48550](https://insights.sbomify.com/CVE-2026-48550/): Nagios Core / XI cmd.cgi Reflected XSS via NagFormId Parameter (medium 5.1)
- [CVE-2026-48549](https://insights.sbomify.com/CVE-2026-48549/): Nagios Core / XI CSRF via cmd.cgi Double-Submit Cookie (medium 6.9)
- [CVE-2026-48548](https://insights.sbomify.com/CVE-2026-48548/): Nagios Core CSRF via cmd.cgi (medium 6.9)
- [CVE-2026-48547](https://insights.sbomify.com/CVE-2026-48547/): KanaDojo < 0.1.18 Command Injection via patchNotesData.json in release.yml (high 8.5)
- [CVE-2026-48546](https://insights.sbomify.com/CVE-2026-48546/): KanaDojo < 0.1.18 Sandbox Escape RCE via messages.cjs (high 8.5)
- [CVE-2026-48545](https://insights.sbomify.com/CVE-2026-48545/): Gradio < 6.15.0 Cookie Injection via Shared Proxy Client (high 7.6)
- [CVE-2026-48544](https://insights.sbomify.com/CVE-2026-48544/): Taipy 4.1.1 Path Traversal via ElementLibrary.get_resource() (high 8.7)
- [CVE-2026-48543](https://insights.sbomify.com/CVE-2026-48543/): Krayin CRM 2.2.6 Stored Template Injection XSS via Web Form Description (medium 5.1)
- [CVE-2026-48542](https://insights.sbomify.com/CVE-2026-48542/): Krayin CRM 2.2.6 Stored Template Injection XSS via Product Name Field (medium 5.1)
- [CVE-2026-48541](https://insights.sbomify.com/CVE-2026-48541/): Krayin CRM 2.2.6 Stored Template Injection XSS via Contact Name Field (medium 5.1)
- [CVE-2026-48540](https://insights.sbomify.com/CVE-2026-48540/): Krayin CRM 2.2.6 Stored Template Injection XSS via Lead Title (medium 5.1)
- [CVE-2026-48539](https://insights.sbomify.com/CVE-2026-48539/): GFI Archiver < 15.14 Stored XSS via MailInsights.aspx (medium 5.1)
- [CVE-2026-48538](https://insights.sbomify.com/CVE-2026-48538/): GFI Archiver < 15.13 Stored XSS via ImportSettingsWizard.ashx (medium 5.1)
- [CVE-2026-48537](https://insights.sbomify.com/CVE-2026-48537/): GFI Archiver < 15.13 Stored XSS via FileArchiveAssistantWizard.aspx (medium 5.1)
- [CVE-2026-48536](https://insights.sbomify.com/CVE-2026-48536/): GFI Archiver < 15.13 Stored XSS via GeneralSettingsWizard.aspx (medium 5.1)
- [CVE-2026-48535](https://insights.sbomify.com/CVE-2026-48535/): GFI Archiver < 15.13 Stored XSS via CallHomeSettingsWizard.aspx (medium 5.1)
- [CVE-2026-48534](https://insights.sbomify.com/CVE-2026-48534/): GFI Archiver < 15.13 Stored XSS via ImapServerWizard.aspx (medium 5.1)
- [CVE-2026-48532](https://insights.sbomify.com/CVE-2026-48532/): GFI Archiver < 15.13 Stored XSS via FAARetentionPolicyWizard.aspx (medium 5.1)
- [CVE-2026-48531](https://insights.sbomify.com/CVE-2026-48531/): GFI Archiver < 15.13 Stored XSS via RetentionPolicyWizard.aspx (medium 5.1)
- [CVE-2026-48530](https://insights.sbomify.com/CVE-2026-48530/): GFI Archiver < 15.14 Stored XSS via CategorizationPolicyWizard.aspx (medium 5.1)
- [CVE-2026-4853](https://insights.sbomify.com/CVE-2026-4853/): Path traversal in JetBackup – Backup, Restore & Migrate (medium 4.9)
- [CVE-2026-48529](https://insights.sbomify.com/CVE-2026-48529/): GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion (medium 6.0)
- [CVE-2026-48528](https://insights.sbomify.com/CVE-2026-48528/): Metacat has an unauthenticated SQL injection vulnerability (critical 9.8)
- [CVE-2026-48527](https://insights.sbomify.com/CVE-2026-48527/): HaxCMS has a stored Cross-Site Scripting (XSS) bypass in saveNode endpoint (high 8.7)
- [CVE-2026-48526](https://insights.sbomify.com/CVE-2026-48526/): PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed (high 7.4)
- [CVE-2026-48525](https://insights.sbomify.com/CVE-2026-48525/): PyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWS (medium 5.3)
- [CVE-2026-48524](https://insights.sbomify.com/CVE-2026-48524/): PyJWT: PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS) (low 3.7)
- [CVE-2026-48523](https://insights.sbomify.com/CVE-2026-48523/): PyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keys (medium 5.4)
- [CVE-2026-48522](https://insights.sbomify.com/CVE-2026-48522/): PyJWKClient: missing scheme allowlist enables SSRF + token forgery via file://, ftp://, data: schemes (medium 4.2)
- [CVE-2026-48521](https://insights.sbomify.com/CVE-2026-48521/): Null dereference in envoy (medium 5.9)
- [CVE-2026-48520](https://insights.sbomify.com/CVE-2026-48520/): Langflow: Unauthenticated Shareable Playground arbitrary local or S3 file read (medium 6.1)
- [CVE-2026-4852](https://insights.sbomify.com/CVE-2026-4852/): Cross-site scripting in Image Source Control Lite – Show Image Credits and Captions (medium 6.4)
- [CVE-2026-48519](https://insights.sbomify.com/CVE-2026-48519/): Langflow: Unauthenticated RCE in Shareable Playgrounds (critical 9.6)
- [CVE-2026-48518](https://insights.sbomify.com/CVE-2026-48518/): MultiJuicer: Login CSRF allows attacker to force victims into their team (medium 4.3)
- [CVE-2026-48517](https://insights.sbomify.com/CVE-2026-48517/): MessagePack-CSharp: Typeless deserialization type restrictions do not recurse into arrays or generic arguments (medium 6.3)
- [CVE-2026-48516](https://insights.sbomify.com/CVE-2026-48516/): MessagePack-CSharp: InterfaceLookupFormatter bypasses collision-resistant comparer settings (medium 6.3)
- [CVE-2026-48515](https://insights.sbomify.com/CVE-2026-48515/): MessagePack-CSharp: Multi-dimensional array formatters allocate from unchecked dimensions (medium 6.3)
- [CVE-2026-48514](https://insights.sbomify.com/CVE-2026-48514/): MessagePack-CSharp: Unity unsafe blit formatter allocates from unbounded byte length (medium 6.3)
- [CVE-2026-48513](https://insights.sbomify.com/CVE-2026-48513/): MessagePack-CSharp: DynamicUnionResolver generated deserializers miss depth enforcement (medium 6.3)
- [CVE-2026-48512](https://insights.sbomify.com/CVE-2026-48512/): MessagePack-CSharp: JSON conversion APIs can recurse without consistent depth enforcement (medium 6.3)
- [CVE-2026-48511](https://insights.sbomify.com/CVE-2026-48511/): MessagePack-CSharp: ExpandoObject formatter can perform quadratic insertion work on untrusted maps (medium 6.3)
- [CVE-2026-48510](https://insights.sbomify.com/CVE-2026-48510/): MessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengths (medium 6.3)
- [CVE-2026-4851](https://insights.sbomify.com/CVE-2026-4851/): GRID::Machine versions through 0.127 for Perl allows arbitrary code execution via unsafe deserialization (critical 9.8)
- [CVE-2026-48509](https://insights.sbomify.com/CVE-2026-48509/): MessagePack-CSharp: ASP.NET Core MessagePackInputFormatter defaults to TrustedData for HTTP request bodies (medium 6.3)
- [CVE-2026-48508](https://insights.sbomify.com/CVE-2026-48508/): Lemur: Authorization bypass in StrictRolePermission / AuthorityCreatorPermission (high 8.8)
- [CVE-2026-48507](https://insights.sbomify.com/CVE-2026-48507/): Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users (high 7.1)
- [CVE-2026-48506](https://insights.sbomify.com/CVE-2026-48506/): MessagePack-CSharp: MessagePackReader.Skip can recurse without enforcing maximum object graph depth (high 7.5)
- [CVE-2026-48505](https://insights.sbomify.com/CVE-2026-48505/): Filament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submission (high 7.4)
- [CVE-2026-48504](https://insights.sbomify.com/CVE-2026-48504/): OpenTelemetry Rust: Unbounded memory allocation in W3C Baggage propagation (medium 5.3)
- [CVE-2026-48503](https://insights.sbomify.com/CVE-2026-48503/): Information disclosure in libiec61850 (high 7.5)
- [CVE-2026-48502](https://insights.sbomify.com/CVE-2026-48502/): MessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflows (high 8.2)
- [CVE-2026-48501](https://insights.sbomify.com/CVE-2026-48501/): GitHub CLI tokens leak via `gh attestation` commands (high 7.4)
- [CVE-2026-48500](https://insights.sbomify.com/CVE-2026-48500/): Filament: Unauthenticated temporary file upload on auth pages (medium 6.5)
- [CVE-2026-4850](https://insights.sbomify.com/CVE-2026-4850/): code-projects Simple Laundry System Parameter checkregisitem.php sql injection (medium 6.9)
- [CVE-2026-48499](https://insights.sbomify.com/CVE-2026-48499/): Activepieces: Cross-tenant data exposure and code injection via the Code piece sandbox cache (critical 9.3)
- [CVE-2026-48497](https://insights.sbomify.com/CVE-2026-48497/): Envoy: Abnormal process termination in DNS UDP filter (medium 5.9)
- [CVE-2026-48496](https://insights.sbomify.com/CVE-2026-48496/): opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent (medium 6.2)
- [CVE-2026-48495](https://insights.sbomify.com/CVE-2026-48495/): TypeBot Google Sheets OAuth callback can create credentials in unauthorized workspaces and modify arbitrary typebots (high 7.1)
- [CVE-2026-48494](https://insights.sbomify.com/CVE-2026-48494/): TypeBot vulnerable to cross-typebot WhatsApp preview webhook resume via global `wa-preview-{phone}` session ids (high 7.1)
- [CVE-2026-48493](https://insights.sbomify.com/CVE-2026-48493/): Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment (medium 5.5)
- [CVE-2026-48492](https://insights.sbomify.com/CVE-2026-48492/): Snipe-IT's selectlist visibility is too permissive (medium 4.9)
- [CVE-2026-48491](https://insights.sbomify.com/CVE-2026-48491/): Traefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypass (high 7.8)
- [CVE-2026-48490](https://insights.sbomify.com/CVE-2026-48490/): ArduinoCore-AVR: Stack-Based Buffer Overflow in String float/double concatenation handler (medium 6.9)
- [CVE-2026-4849](https://insights.sbomify.com/CVE-2026-4849/): code-projects Simple Laundry System Parameter modify.php cross site scripting (medium 5.3)
- [CVE-2026-48489](https://insights.sbomify.com/CVE-2026-48489/): Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes (high 8.7)
- [CVE-2026-48488](https://insights.sbomify.com/CVE-2026-48488/): phpMyFAQ has Weak Cryptography - SHA1 for Password Hashing (low 2.7)
- [CVE-2026-48487](https://insights.sbomify.com/CVE-2026-48487/): Zeroconf: Unvalidated rdlength in record payload readers allows LAN-local cache corruption via crafted mDNS packet (medium 5.3)
- [CVE-2026-48486](https://insights.sbomify.com/CVE-2026-48486/): Signum Node: Integer overflow in SMART_FEES fee distribution allows arbitrary miner reward inflation (high 7.5)
- [CVE-2026-48485](https://insights.sbomify.com/CVE-2026-48485/): Quest Bot: Stored warn reasons can still trigger bot-powered mass mentions through `/warns`. (low 2.1)
- [CVE-2026-48484](https://insights.sbomify.com/CVE-2026-48484/): pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination (medium 6.5)
- [CVE-2026-48483](https://insights.sbomify.com/CVE-2026-48483/): TypeBot's WhatsApp status forwarding uses unvalidated user-controlled URLs, allowing SSRF from the Typebot server (medium 5.4)
- [CVE-2026-48482](https://insights.sbomify.com/CVE-2026-48482/): GLPI: RCE via Form import (critical 9.4)
- [CVE-2026-48480](https://insights.sbomify.com/CVE-2026-48480/): OHttpVersionChunkDraft: Missing Final-Chunk Enforcement Leads to Undetected Stream Truncation (medium 6.6)
- [CVE-2026-4848](https://insights.sbomify.com/CVE-2026-4848/): dameng100 muucmf list.html cross site scripting (medium 5.3)
- [CVE-2026-4847](https://insights.sbomify.com/CVE-2026-4847/): dameng100 muucmf list.html cross site scripting (medium 5.3)
- [CVE-2026-4846](https://insights.sbomify.com/CVE-2026-4846/): dameng100 muucmf autoReply.html cross site scripting (medium 5.3)
- [CVE-2026-4845](https://insights.sbomify.com/CVE-2026-4845/): dameng100 muucmf index.html cross site scripting (medium 5.3)
- [CVE-2026-48449](https://insights.sbomify.com/CVE-2026-48449/): Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863) (critical 10.0)
- [CVE-2026-48448](https://insights.sbomify.com/CVE-2026-48448/): SQL injection in Adobe Campaign Classic (high 8.6)
- [CVE-2026-48447](https://insights.sbomify.com/CVE-2026-48447/): Lightroom Classic | Incorrect Authorization (CWE-863) (high 7.7)
- [CVE-2026-48446](https://insights.sbomify.com/CVE-2026-48446/): CAI Content Credentials | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) (medium 5.5)
- [CVE-2026-48445](https://insights.sbomify.com/CVE-2026-48445/): CAI Content Credentials | Integer Overflow or Wraparound (CWE-190) (medium 6.2)
- [CVE-2026-48444](https://insights.sbomify.com/CVE-2026-48444/): CAI Content Credentials | Integer Overflow or Wraparound (CWE-190) (medium 6.2)
- [CVE-2026-48443](https://insights.sbomify.com/CVE-2026-48443/): CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400) (medium 6.2)
- [CVE-2026-48442](https://insights.sbomify.com/CVE-2026-48442/): CAI Content Credentials | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) (high 7.1)
- [CVE-2026-48441](https://insights.sbomify.com/CVE-2026-48441/): Lightroom Classic | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) (high 8.6)
- [CVE-2026-48440](https://insights.sbomify.com/CVE-2026-48440/): ColdFusion | Heap-based Buffer Overflow (CWE-122) (high 8.1)
- [CVE-2026-4844](https://insights.sbomify.com/CVE-2026-4844/): code-projects Online Food Ordering System Admin Login admin.php sql injection (medium 6.9)
- [CVE-2026-48439](https://insights.sbomify.com/CVE-2026-48439/): CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400) (high 7.5)
- [CVE-2026-48438](https://insights.sbomify.com/CVE-2026-48438/): CAI Content Credentials | NULL Pointer Dereference (CWE-476) (high 7.5)
- [CVE-2026-48437](https://insights.sbomify.com/CVE-2026-48437/): CAI Content Credentials | Improper Certificate Validation (CWE-295) (medium 5.5)
- [CVE-2026-48436](https://insights.sbomify.com/CVE-2026-48436/): CAI Content Credentials | Improper Input Validation (CWE-20) (medium 6.5)
- [CVE-2026-48435](https://insights.sbomify.com/CVE-2026-48435/): CAI Content Credentials | Integer Underflow (Wrap or Wraparound) (CWE-191) (medium 6.2)
- [CVE-2026-48434](https://insights.sbomify.com/CVE-2026-48434/): CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400) (medium 6.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/592/