# Vulnerabilities published in 2026


- [CVE-2026-48136](https://insights.sbomify.com/CVE-2026-48136/): Authenticated Administrator Role-Based Access Control Bypass in Compliance (medium 4.1)
- [CVE-2026-48135](https://insights.sbomify.com/CVE-2026-48135/): HTTP service can incorrectly process malformed HTTP requests (medium 5.3)
- [CVE-2026-48134](https://insights.sbomify.com/CVE-2026-48134/): SQL injection issue in UserCheck Portal when DLP Software Blade is active (medium 5.6)
- [CVE-2026-48133](https://insights.sbomify.com/CVE-2026-48133/): Identity Awareness Captive Portal - Unauthenticated Local File Inclusion (high 7.5)
- [CVE-2026-48132](https://insights.sbomify.com/CVE-2026-48132/): VPN service may restart unexpectedly when processing IKE traffic over NAT-T 4500/UDP (high 8.1)
- [CVE-2026-48131](https://insights.sbomify.com/CVE-2026-48131/): VPND IKE Fragment Reassembly - Heap Out-of-Bounds Write via Sequence Number Zero (high 8.1)
- [CVE-2026-4813](https://insights.sbomify.com/CVE-2026-4813/): Code injection in the Lutece Core (critical 9.4)
- [CVE-2026-48129](https://insights.sbomify.com/CVE-2026-48129/): Kestra task inputFiles accepts traversal filenames for worker file writes (medium 6.5)
- [CVE-2026-48128](https://insights.sbomify.com/CVE-2026-48128/): Budibase: SSRF via User-Controlled queryId in Automation Execute Query Step (medium 5.1)
- [CVE-2026-48127](https://insights.sbomify.com/CVE-2026-48127/): Frappe: Arbitrary Attachment Injection via add_attachments and upload_file (medium 5.3)
- [CVE-2026-48126](https://insights.sbomify.com/CVE-2026-48126/): Algernon: Host header path traversal in --domain mode reads files and runs Lua from parent dir (high 8.2)
- [CVE-2026-48125](https://insights.sbomify.com/CVE-2026-48125/): UAParser.js: Unbounded `Sec-CH-UA-Model` parsing can trigger ReDoS in `withClientHints()` (medium 5.3)
- [CVE-2026-48124](https://insights.sbomify.com/CVE-2026-48124/): Cursor Desktop sandbox escape via Claude hook configuration (high 8.5)
- [CVE-2026-48122](https://insights.sbomify.com/CVE-2026-48122/): Workspace settings can override executable and Gemfile paths used by the Ruby LSP VS Code extension (medium 5.4)
- [CVE-2026-48121](https://insights.sbomify.com/CVE-2026-48121/): @langchain/langgraph-checkpoint-mongodb: NoSQL parameter injection in MongoDBSaver allows cross-tenant state access (medium 6.7)
- [CVE-2026-48120](https://insights.sbomify.com/CVE-2026-48120/): Kakoune has a Critical RCE via Autorestore Backup Filename Injection (high 8.6)
- [CVE-2026-4812](https://insights.sbomify.com/CVE-2026-4812/): Missing authorization in Advanced Custom Fields (ACF®) (medium 5.3)
- [CVE-2026-48119](https://insights.sbomify.com/CVE-2026-48119/): Nezha Monitoring: Authenticated agents can forge service-monitor results for other users' services (high 7.1)
- [CVE-2026-48117](https://insights.sbomify.com/CVE-2026-48117/): DroneAware's Improper Account Activation in Registration and SSO Flows Leads to Account Takeover (medium 6.8)
- [CVE-2026-48116](https://insights.sbomify.com/CVE-2026-48116/): AnythingLLM: RCE via ripgrep --pre argument injection in filesystem-search-files agent skill (high 7.5)
- [CVE-2026-48115](https://insights.sbomify.com/CVE-2026-48115/): Misskey: Improper Authorization in the Announcements API (medium 6.3)
- [CVE-2026-48114](https://insights.sbomify.com/CVE-2026-48114/): Metacat has an unauthenticated SQL injection vulnerability (critical 9.8)
- [CVE-2026-48113](https://insights.sbomify.com/CVE-2026-48113/): Chisel: ACL Bypass via Post-Handshake SSH Channel ExtraData Injection (high 8.5)
- [CVE-2026-48112](https://insights.sbomify.com/CVE-2026-48112/): GHSL-2026-122 7-Zip Ar SYMDEF OOB Read (medium 6.5)
- [CVE-2026-48111](https://insights.sbomify.com/CVE-2026-48111/): GHSL-2026-121 7-Zip UEFI DEPEX OOB Read (medium 4.3)
- [CVE-2026-48110](https://insights.sbomify.com/CVE-2026-48110/): Russh: SSH message fields were decoded through allocation-first parsers before field-specific bounds (high 7.5)
- [CVE-2026-4811](https://insights.sbomify.com/CVE-2026-4811/): Cross-site scripting in WPB Floating Menu or Categories – Sticky Floating Side Menu & Categories with Icons (medium 4.9)
- [CVE-2026-48109](https://insights.sbomify.com/CVE-2026-48109/): MessagePack-CSharp: LZ4 decompression may fail with AccessViolationException after dereferencing memory from bad input (high 8.2)
- [CVE-2026-48108](https://insights.sbomify.com/CVE-2026-48108/): Russh: SSH identification parsing accepted non-canonical client banners and did not bound pre-banner input (medium 5.3)
- [CVE-2026-48107](https://insights.sbomify.com/CVE-2026-48107/): Russh: Unchecked keyboard-interactive prompt count in client auth path (medium 6.5)
- [CVE-2026-48106](https://insights.sbomify.com/CVE-2026-48106/): Auth bypass in arc (high 8.3)
- [CVE-2026-48105](https://insights.sbomify.com/CVE-2026-48105/): Path traversal in arc (high 8.3)
- [CVE-2026-48104](https://insights.sbomify.com/CVE-2026-48104/): GHSL-2026-120: 7-Zip SquashFS BlockToNode uninitialized heap read (medium 4.2)
- [CVE-2026-48103](https://insights.sbomify.com/CVE-2026-48103/): GHSL-2026-119 7-Zip WIM SecurityId OOB read (medium 4.3)
- [CVE-2026-48102](https://insights.sbomify.com/CVE-2026-48102/): GHSL-2026-118: 7-Zip UDF Field OOB Read (low 3.1)
- [CVE-2026-48101](https://insights.sbomify.com/CVE-2026-48101/): GHSL-2026-117: 7-Zip UEFI Capsule uninitialized heap memory disclosure (medium 6.5)
- [CVE-2026-48100](https://insights.sbomify.com/CVE-2026-48100/): Payy: agg_agg trailing message slots are unconstrained and allow forged burn messages (high 8.7)
- [CVE-2026-4810](https://insights.sbomify.com/CVE-2026-4810/): Remote Code Execution in Google Agent Development Kit (ADK) (critical 9.3)
- [CVE-2026-48099](https://insights.sbomify.com/CVE-2026-48099/): WsgiDAV encoded dot segments can escape filesystem share roots (high 7.1)
- [CVE-2026-48098](https://insights.sbomify.com/CVE-2026-48098/): NexTOR IP Changer Unsafely Uses sudo and shell=True (high 7.3)
- [CVE-2026-48097](https://insights.sbomify.com/CVE-2026-48097/): NexTOR_IP_CHANGER has PATH Injection Leading to Arbitrary Command Execution (high 7.8)
- [CVE-2026-48096](https://insights.sbomify.com/CVE-2026-48096/): OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning (medium 5.0)
- [CVE-2026-48095](https://insights.sbomify.com/CVE-2026-48095/): GHSL-2026-140_7-Zip: 7-Zip has a heap buffer overflow via NTFS compressed stream buffer under-allocation (high 8.8)
- [CVE-2026-48094](https://insights.sbomify.com/CVE-2026-48094/): ShareOpenly has Cross-Site Scripting (XSS) via Missing esc_url() on Shared URL in Content Output (medium 5.3)
- [CVE-2026-48093](https://insights.sbomify.com/CVE-2026-48093/): Code Embed - Contributor Stored Cross-Site Scripting via Remote URL Embed (medium 6.5)
- [CVE-2026-48092](https://insights.sbomify.com/CVE-2026-48092/): 7-Zip SquashFS Fragment Offset Overflow (GHSL-2026-116) (medium 4.3)
- [CVE-2026-48090](https://insights.sbomify.com/CVE-2026-48090/): Envoy HTTP: OAuth2 filter late async token completion after stream teardown (UAF / crash risk) (medium 5.9)
- [CVE-2026-4809](https://insights.sbomify.com/CVE-2026-4809/): Unsafe Client MIME Type Handling Can Enable Arbitrary File Upload in plank/laravel-mediable (critical 9.3)
- [CVE-2026-48089](https://insights.sbomify.com/CVE-2026-48089/): DevGuard has improper authorization on public assets (high 7.1)
- [CVE-2026-48088](https://insights.sbomify.com/CVE-2026-48088/): OpenReception vulnerable to unauthenticated staff crypto poisoning that breaks E2E recipient directory (critical 9.4)
- [CVE-2026-48087](https://insights.sbomify.com/CVE-2026-48087/): OpenReception: WebAuthn passkey injection allows account takeover (critical 9.8)
- [CVE-2026-48086](https://insights.sbomify.com/CVE-2026-48086/): OpenReception: Tenant admin self-promotes to GLOBAL_ADMIN (critical 9.9)
- [CVE-2026-48085](https://insights.sbomify.com/CVE-2026-48085/): OpenReception has unauthenticated GLOBAL_ADMIN account creation post-bootstrap (critical 9.8)
- [CVE-2026-48084](https://insights.sbomify.com/CVE-2026-48084/): OpenReception doesn't rate limit passphrase login attempts (high 7.4)
- [CVE-2026-48083](https://insights.sbomify.com/CVE-2026-48083/): OpenReception: Unauthenticated POST /api/log accepts arbitrary content with CRLF injection and no size or rate limits (medium 6.5)
- [CVE-2026-48082](https://insights.sbomify.com/CVE-2026-48082/): Security feature bypass in appointment-booking-software (low 3.7)
- [CVE-2026-48081](https://insights.sbomify.com/CVE-2026-48081/): OpenReception vulnerable to stored click-triggered XSS via javascript: tenant links rendered into patient-facing footer (high 8.1)
- [CVE-2026-48080](https://insights.sbomify.com/CVE-2026-48080/): Information disclosure in appointment-booking-software (high 8.0)
- [CVE-2026-4808](https://insights.sbomify.com/CVE-2026-4808/): Gerador de Certificados – DevApps <= 1.3.6 - Authenticated (Administrator+) Arbitrary File Upload (high 7.2)
- [CVE-2026-48079](https://insights.sbomify.com/CVE-2026-48079/): Auth bypass in appointment-booking-software (high 7.4)
- [CVE-2026-48078](https://insights.sbomify.com/CVE-2026-48078/): OpenReception's schedule endpoint discloses isPublic=false channels and slot availability to unauthenticated callers (medium 5.3)
- [CVE-2026-48077](https://insights.sbomify.com/CVE-2026-48077/): OpenReception: GET appointment by ID returns full appointment record without authorization (medium 5.3)
- [CVE-2026-48076](https://insights.sbomify.com/CVE-2026-48076/): OpenReception's bootstrap booking flow allows unauthenticated booking on isPublic=false channels (medium 6.5)
- [CVE-2026-48075](https://insights.sbomify.com/CVE-2026-48075/): OpenReception's unauthenticated add-to-tunnel endpoint accepts arbitrary appointment injections (medium 6.5)
- [CVE-2026-48074](https://insights.sbomify.com/CVE-2026-48074/): OpenReception: Staff deletion removes pending invites cross-tenant by email match (low 2.7)
- [CVE-2026-48073](https://insights.sbomify.com/CVE-2026-48073/): Docmost: Page export can include restricted same-space attachments through forged attachmentId (medium 4.3)
- [CVE-2026-48072](https://insights.sbomify.com/CVE-2026-48072/): Docmost: Public image fileName path traversal leads to unauthorized local file read (medium 5.3)
- [CVE-2026-48071](https://insights.sbomify.com/CVE-2026-48071/): OpenReception's client PIN challenge throttle is keyed by emailHash only, allowing cross-tenant lockout (medium 5.8)
- [CVE-2026-48070](https://insights.sbomify.com/CVE-2026-48070/): Docmost: Avatar URL path traversal in avatar cleanup leads to arbitrary local file deletion (high 7.1)
- [CVE-2026-4807](https://insights.sbomify.com/CVE-2026-4807/): Appointment Booking Calendar <= 1.6.10.6 - Unauthenticated Arbitrary Appointment View, Modification and Deletion (medium 6.5)
- [CVE-2026-48069](https://insights.sbomify.com/CVE-2026-48069/): @grpc/grps-js: An incoming malformed compressed message can cause a client or server crash (high 7.5)
- [CVE-2026-48068](https://insights.sbomify.com/CVE-2026-48068/): @grpc/grps-js: A malformed request can cause a server crash (high 7.5)
- [CVE-2026-48067](https://insights.sbomify.com/CVE-2026-48067/): Filament: Inconsistent scope enforcement for AttachAction and AssociateAction Select fields (medium 6.5)
- [CVE-2026-48066](https://insights.sbomify.com/CVE-2026-48066/): pam_usb: Thread-unsafe static pointer in log.c causes data race under concurrent PAM authentication (medium 5.7)
- [CVE-2026-48065](https://insights.sbomify.com/CVE-2026-48065/): Integer overflow in pam usb (medium 6.7)
- [CVE-2026-48064](https://insights.sbomify.com/CVE-2026-48064/): pam_usb: PAM_RHOST check skipped when deny_remote=false allows XDMCP authentication bypass (high 8.1)
- [CVE-2026-48063](https://insights.sbomify.com/CVE-2026-48063/): Baileys has message upsert / hist sync spoofing and app state corruption when using maliciously crafted protocolMessage payload (critical 9.3)
- [CVE-2026-48062](https://insights.sbomify.com/CVE-2026-48062/): CodeIgniter: Uploaded file extension validation bypass in `ext_in` rule (critical 9.8)
- [CVE-2026-48061](https://insights.sbomify.com/CVE-2026-48061/): Litestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host header (medium 5.9)
- [CVE-2026-48060](https://insights.sbomify.com/CVE-2026-48060/): Litestar: HTML Injection Through CSRF Token (high 8.1)
- [CVE-2026-4806](https://insights.sbomify.com/CVE-2026-4806/): Missing authorization in Custom Thank You Page for WooCommerce (medium 6.5)
- [CVE-2026-48059](https://insights.sbomify.com/CVE-2026-48059/): Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustion (high 8.7)
- [CVE-2026-48058](https://insights.sbomify.com/CVE-2026-48058/): nebula-mesh: Session and OIDC state cookies lack the Secure attribute (medium 4.6)
- [CVE-2026-48056](https://insights.sbomify.com/CVE-2026-48056/): Streambert Vulnerable to Arbitrary Binary Execution via Downloader IPC Handler (critical 10.0)
- [CVE-2026-48055](https://insights.sbomify.com/CVE-2026-48055/): Streambert: Arbitrary File Write (Zip Slip) via Subtitle Extraction (critical 10.0)
- [CVE-2026-48054](https://insights.sbomify.com/CVE-2026-48054/): OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts.uri (high 8.8)
- [CVE-2026-48053](https://insights.sbomify.com/CVE-2026-48053/): Kolibri has Unauthenticated Server-Side Request Forgery (SSRF) in RemoteFacilityUserViewset (medium 5.8)
- [CVE-2026-48052](https://insights.sbomify.com/CVE-2026-48052/): Papra: Cross-organization tag deletion and modification via authenticated cross-tenant request (medium 5.4)
- [CVE-2026-48051](https://insights.sbomify.com/CVE-2026-48051/): Papra: SSRF via HTTP redirect bypass in webhook delivery (low 3.5)
- [CVE-2026-48050](https://insights.sbomify.com/CVE-2026-48050/): Arc: Unauthenticated access to Go debug pprof endpoints leaks runtime state and enables CPU-burn DoS (high 8.8)
- [CVE-2026-4805](https://insights.sbomify.com/CVE-2026-4805/): Cross-site scripting in Woostify (medium 6.4)
- [CVE-2026-48049](https://insights.sbomify.com/CVE-2026-48049/): @hapi/inert: Static-file confinement bypass via sibling-prefix path (medium 5.3)
- [CVE-2026-48048](https://insights.sbomify.com/CVE-2026-48048/): XWiki Platform's Livetable results still allow reconstructing password hashes using 768 requests (high 7.5)
- [CVE-2026-48047](https://insights.sbomify.com/CVE-2026-48047/): XWiki Platform vulnerable to potential arbitrary file writing using path traversal from (subwiki) admin (medium 5.9)
- [CVE-2026-48046](https://insights.sbomify.com/CVE-2026-48046/): Streambert Vulnerable to Remote Code Execution (RCE) via Unvalidated Auto-Updater IPC Handler (critical 9.3)
- [CVE-2026-48045](https://insights.sbomify.com/CVE-2026-48045/): Zeroconf: Unbounded TC-deferred queue allows LAN-local memory exhaustion via spoofed-source flood (medium 6.5)
- [CVE-2026-48044](https://insights.sbomify.com/CVE-2026-48044/): Envoy Zstd Decompressor: Ratio Check at Wrong Loop Depth lead to memory explosion (high 7.5)
- [CVE-2026-48043](https://insights.sbomify.com/CVE-2026-48043/): netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion (medium 5.3)
- [CVE-2026-48042](https://insights.sbomify.com/CVE-2026-48042/): Envoy: Stack overflow in destructor of highly nested JSON (high 7.5)
- [CVE-2026-48040](https://insights.sbomify.com/CVE-2026-48040/): netty-incubator-codec-ohttp's Incorrect Native Pointer Derivation in Pooled Direct ByteBuf Fallback Leads to Out-of-Bounds Native Memory Access (medium 6.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/596/