# Vulnerabilities published in 2026


- [CVE-2026-47847](https://insights.sbomify.com/CVE-2026-47847/): Hardcoded credentials in bitnami/mariadb-galera (medium 5.3)
- [CVE-2026-47846](https://insights.sbomify.com/CVE-2026-47846/): Hardcoded credentials in bitnami/cassandra (critical 9.8)
- [CVE-2026-47845](https://insights.sbomify.com/CVE-2026-47845/): Reactor Netty HTTP Server may incorrectly evaluate proxy addresses (medium 5.3)
- [CVE-2026-47844](https://insights.sbomify.com/CVE-2026-47844/): Reactor Netty HTTP Server Leaks Exception Details (medium 5.3)
- [CVE-2026-47843](https://insights.sbomify.com/CVE-2026-47843/): Reactor Netty may incorrectly route traffic due to DNS resolver reuse (low 3.7)
- [CVE-2026-47842](https://insights.sbomify.com/CVE-2026-47842/): Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Correlation (medium 6.5)
- [CVE-2026-47841](https://insights.sbomify.com/CVE-2026-47841/): WebAuthn User Verification Bypass via Session Serialization (high 7.4)
- [CVE-2026-47840](https://insights.sbomify.com/CVE-2026-47840/): LDAP StartTLS unconditionally disables hostname verification (high 8.3)
- [CVE-2026-4784](https://insights.sbomify.com/CVE-2026-4784/): code-projects Simple Laundry System Parameter checkcheckout.php sql injection (medium 6.9)
- [CVE-2026-47839](https://insights.sbomify.com/CVE-2026-47839/): Federated OIDC Users Can Bypass externalGroupsWhitelist to Gain uaa.admin (critical 9.2)
- [CVE-2026-47838](https://insights.sbomify.com/CVE-2026-47838/): Unauthorized User Impersonation when Using X.509 Client Certificates (medium 6.8)
- [CVE-2026-47837](https://insights.sbomify.com/CVE-2026-47837/): Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests (medium 6.8)
- [CVE-2026-47836](https://insights.sbomify.com/CVE-2026-47836/): Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN (high 7.2)
- [CVE-2026-47835](https://insights.sbomify.com/CVE-2026-47835/): Spring AI vector store metadata filtering to handle special characters in Elasticsearch, OpenSearch, and GemFire Vector Stores (high 8.6)
- [CVE-2026-47834](https://insights.sbomify.com/CVE-2026-47834/): Spring Data JPA Sort expression validation bypass (medium 4.8)
- [CVE-2026-47833](https://insights.sbomify.com/CVE-2026-47833/): Privilege escalation in bpm-release (medium 6.8)
- [CVE-2026-47831](https://insights.sbomify.com/CVE-2026-47831/): Cryptographically Weak Password Generation in bosh-windows-stemcell-builder Allows Remote SSH Brute-Force Attacks (high 7.7)
- [CVE-2026-47830](https://insights.sbomify.com/CVE-2026-47830/): Incorrect Permission Assignment Allows Local Privilege Escalation to SYSTEM via Executable Overwrite (high 8.5)
- [CVE-2026-4783](https://insights.sbomify.com/CVE-2026-4783/): itsourcecode College Management System Parameter add-single-student-results.php sql injection (medium 5.3)
- [CVE-2026-47829](https://insights.sbomify.com/CVE-2026-47829/): Argument Injection in BOSH CLI Allows Local Command Execution on Operator Workstations via Compromised Director (high 7.7)
- [CVE-2026-47828](https://insights.sbomify.com/CVE-2026-47828/): Missing TLS Certificate Verification in BOSH CLI Allows Root Code Execution via Man-in-the-Middle Credential Replay (high 8.9)
- [CVE-2026-47827](https://insights.sbomify.com/CVE-2026-47827/): CVE-2026-47827 – BOSH CLI Powershell Injection (high 7.5)
- [CVE-2026-47826](https://insights.sbomify.com/CVE-2026-47826/): blobs.yaml Path Traversal Allows File Writes (high 8.5)
- [CVE-2026-47825](https://insights.sbomify.com/CVE-2026-47825/): Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies in certain situations (high 8.6)
- [CVE-2026-4782](https://insights.sbomify.com/CVE-2026-4782/): Avada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameter (medium 6.5)
- [CVE-2026-4781](https://insights.sbomify.com/CVE-2026-4781/): SourceCodester Sales and Inventory System HTTP GET Parameter update_purchase.php sql injection (medium 5.3)
- [CVE-2026-4780](https://insights.sbomify.com/CVE-2026-4780/): SourceCodester Sales and Inventory System HTTP GET Parameter update_out_standing.php sql injection (medium 5.3)
- [CVE-2026-47790](https://insights.sbomify.com/CVE-2026-47790/): Privilege Escalation via QuFTP Log-based XSS (medium 6.3)
- [CVE-2026-4779](https://insights.sbomify.com/CVE-2026-4779/): SourceCodester Sales and Inventory System HTTP GET Parameter update_customer_details.php sql injection (medium 5.3)
- [CVE-2026-47786](https://insights.sbomify.com/CVE-2026-47786/): Pre-Authentication Command Injection (critical 9.3)
- [CVE-2026-47784](https://insights.sbomify.com/CVE-2026-47784/): Information disclosure in memcached (high 8.1)
- [CVE-2026-47783](https://insights.sbomify.com/CVE-2026-47783/): Information disclosure in memcached (high 8.1)
- [CVE-2026-47782](https://insights.sbomify.com/CVE-2026-47782/): Security feature bypass in Android App "RoboForm Password Manager" (medium 4.6)
- [CVE-2026-47781](https://insights.sbomify.com/CVE-2026-47781/): pdm: Project-Controlled `.pdm-plugins` Content Executes Before CLI Parsing (high 8.4)
- [CVE-2026-47780](https://insights.sbomify.com/CVE-2026-47780/): free5GC: UDR Improper ueId validation in free5GC EE subscription handlers allows arbitrary identifier persistence (medium 6.9)
- [CVE-2026-4778](https://insights.sbomify.com/CVE-2026-4778/): SourceCodester Sales and Inventory System HTTP GET Parameter update_category.php sql injection (medium 5.3)
- [CVE-2026-47778](https://insights.sbomify.com/CVE-2026-47778/): Envoy: Embedded NUL in TLS DNS SAN Truncation in the Default TLS Certificate Validator. (Auth Bypass) (medium 4.4)
- [CVE-2026-47777](https://insights.sbomify.com/CVE-2026-47777/): Mastodon has a consent-check bypass in its remote Collections (high 7.5)
- [CVE-2026-47775](https://insights.sbomify.com/CVE-2026-47775/): Envoy OAuth2 Filter: Padding Oracle via AES-256-CBC Cookie Decryption (medium 6.8)
- [CVE-2026-47774](https://insights.sbomify.com/CVE-2026-47774/): Envoy vulnerable to HTTP/2 memory exhaustion via cookie header size bypass and HPACK amplification (high 7.5)
- [CVE-2026-47773](https://insights.sbomify.com/CVE-2026-47773/): ArduinoBLE: Memory corruption via malformed ATT write request (high 7.2)
- [CVE-2026-47770](https://insights.sbomify.com/CVE-2026-47770/): jq: stack overflow in deep structural equality (medium 6.8)
- [CVE-2026-4777](https://insights.sbomify.com/CVE-2026-4777/): SourceCodester Sales and Inventory System POST Parameter view_supplier.php sql injection (medium 5.3)
- [CVE-2026-47769](https://insights.sbomify.com/CVE-2026-47769/): APIFold Vulnerable to Unauthenticated Webhook Event Injection (medium 5.3)
- [CVE-2026-47768](https://insights.sbomify.com/CVE-2026-47768/): nebula-mesh: Newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs) (medium 5.5)
- [CVE-2026-47767](https://insights.sbomify.com/CVE-2026-47767/): SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch (high 8.3)
- [CVE-2026-47766](https://insights.sbomify.com/CVE-2026-47766/): crun follows rootfs /dev symlink while creating default devices (medium 5.1)
- [CVE-2026-47765](https://insights.sbomify.com/CVE-2026-47765/): Frappe: Lack of Permissions in restore/bulk_restore (high 7.1)
- [CVE-2026-47764](https://insights.sbomify.com/CVE-2026-47764/): pdm: Path traversal in wheel installation via overridden write_to_fs (high 8.4)
- [CVE-2026-47763](https://insights.sbomify.com/CVE-2026-47763/): pdm: Project-Local State and Config Writes Follow Symlinks (medium 6.8)
- [CVE-2026-47762](https://insights.sbomify.com/CVE-2026-47762/): TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments (high 8.7)
- [CVE-2026-47761](https://insights.sbomify.com/CVE-2026-47761/): TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection (high 8.7)
- [CVE-2026-47760](https://insights.sbomify.com/CVE-2026-47760/): TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs (high 8.7)
- [CVE-2026-4776](https://insights.sbomify.com/CVE-2026-4776/): Mautic has SQL Injection in API Contact Filtering (high 7.1)
- [CVE-2026-47759](https://insights.sbomify.com/CVE-2026-47759/): TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes (high 8.7)
- [CVE-2026-47755](https://insights.sbomify.com/CVE-2026-47755/): ITFlow Vulnerable to Authenticated Cross-Tenant Credential Disclosure via Unprotected Credential Modal (medium 6.5)
- [CVE-2026-47754](https://insights.sbomify.com/CVE-2026-47754/): unauthenticated path traversal in Metacat 2.x (critical 9.3)
- [CVE-2026-47753](https://insights.sbomify.com/CVE-2026-47753/): Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) (medium 4.4)
- [CVE-2026-47752](https://insights.sbomify.com/CVE-2026-47752/): Tugtainer has Server-Side Template Injection in notification templates that leads to Remote Code Execution (critical 9.9)
- [CVE-2026-47751](https://insights.sbomify.com/CVE-2026-47751/): Claude Code Action: Malicious MCP Server Configuration in PRs Enables Remote Code Execution and Secret Exfiltration (medium 5.3)
- [CVE-2026-47750](https://insights.sbomify.com/CVE-2026-47750/): stable-diffusion.cpp: Heap buffer overflow in GLOBAL opcode parsing for PyTorch checkpoint files (high 7.8)
- [CVE-2026-4775](https://insights.sbomify.com/CVE-2026-4775/): Libtiff: libtiff: arbitrary code execution or denial of service via signed integer overflow in tiff file processing (high 7.8)
- [CVE-2026-47749](https://insights.sbomify.com/CVE-2026-47749/): stable-diffusion.cpp: Heap buffer overflow in SHORT_BINUNICODE parsing for PyTorch checkpoint files (high 7.8)
- [CVE-2026-47748](https://insights.sbomify.com/CVE-2026-47748/): stable-diffusion.cpp: Out-of-bounds reads in PyTorch checkpoint pickle opcode parsing (medium 5.5)
- [CVE-2026-47747](https://insights.sbomify.com/CVE-2026-47747/): stable-diffusion.cpp has a Heap-based Buffer Overflow (high 7.8)
- [CVE-2026-47746](https://insights.sbomify.com/CVE-2026-47746/): Misskey: JSON-LD signature validation + compaction is vulnerable to timing attacks (high 8.9)
- [CVE-2026-47745](https://insights.sbomify.com/CVE-2026-47745/): Shopper: Missing per-action authorization on PaymentMethods, Currencies and Carriers admin tables (medium 6.5)
- [CVE-2026-47744](https://insights.sbomify.com/CVE-2026-47744/): Shopper: Authorization bypass and RBAC privilege escalation in team settings (critical 9.9)
- [CVE-2026-47743](https://insights.sbomify.com/CVE-2026-47743/): Shopper: Multiple data integrity and disclosure issues in admin Livewire components (high 8.7)
- [CVE-2026-47742](https://insights.sbomify.com/CVE-2026-47742/): Shopper: Missing authorization on Product admin Livewire sub-form components (medium 6.5)
- [CVE-2026-47741](https://insights.sbomify.com/CVE-2026-47741/): Shopper: Race condition on Discount.usage_limit allows silent over-redemption (medium 5.9)
- [CVE-2026-47740](https://insights.sbomify.com/CVE-2026-47740/): Shopper: Authorization bypass in multiple Livewire admin components (high 8.1)
- [CVE-2026-47739](https://insights.sbomify.com/CVE-2026-47739/): Frappe: Stored XSS in Note (medium 6.9)
- [CVE-2026-47737](https://insights.sbomify.com/CVE-2026-47737/): Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections (high 7.5)
- [CVE-2026-47736](https://insights.sbomify.com/CVE-2026-47736/): Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion (high 7.5)
- [CVE-2026-47735](https://insights.sbomify.com/CVE-2026-47735/): Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks (high 7.1)
- [CVE-2026-47734](https://insights.sbomify.com/CVE-2026-47734/): Dulwich has unbounded memory allocation in receive-pack from crafted thin packs (medium 5.7)
- [CVE-2026-47733](https://insights.sbomify.com/CVE-2026-47733/): Rocket.Chat: Missing URL protocol sanitization in ImageElement allows javascript: URLs in markdown images (medium 4.4)
- [CVE-2026-47732](https://insights.sbomify.com/CVE-2026-47732/): Twig Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points (high 7.1)
- [CVE-2026-47731](https://insights.sbomify.com/CVE-2026-47731/): NASA AMMOS Instrument Toolkit: Path traversal resulting in arbitrary file append (can be triggered over the network by unauthenticated attacker) (critical 9.1)
- [CVE-2026-47730](https://insights.sbomify.com/CVE-2026-47730/): Twig: XSS in profiler HtmlDumper via unescaped template and profile names (medium 5.1)
- [CVE-2026-4773](https://insights.sbomify.com/CVE-2026-4773/): OTP Bypass in Magarsus' IDM-MFA (high 8.1)
- [CVE-2026-47729](https://insights.sbomify.com/CVE-2026-47729/): Squid: Memory disclosure in FTP gateway (medium 6.5)
- [CVE-2026-47728](https://insights.sbomify.com/CVE-2026-47728/): Bugsink: Project scoping missing in sourcemap and debug-file lookup (medium 4.3)
- [CVE-2026-47727](https://insights.sbomify.com/CVE-2026-47727/): Code injection in Trilium (high 8.6)
- [CVE-2026-47726](https://insights.sbomify.com/CVE-2026-47726/): nebula-mesh: GET /api/v1/audit-log discloses all entries to any operator (high 7.1)
- [CVE-2026-47725](https://insights.sbomify.com/CVE-2026-47725/): nebula-mesh: Web UI lacks CSRF tokens on /ui/* mutating endpoints (medium 6.9)
- [CVE-2026-47724](https://insights.sbomify.com/CVE-2026-47724/): nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalation (critical 9.9)
- [CVE-2026-47723](https://insights.sbomify.com/CVE-2026-47723/): nebula-mesh: Web UI and API responses lack security headers (CSP, X-Frame-Options, HSTS, etc.) (high 7.1)
- [CVE-2026-47722](https://insights.sbomify.com/CVE-2026-47722/): nebula-mesh: Host advanced overrides allow YAML injection into agent config.yml (high 8.7)
- [CVE-2026-47721](https://insights.sbomify.com/CVE-2026-47721/): FUXA: Scheduler API missing admin check enables operator-to-admin escalation via scheduled device actions (medium 6.3)
- [CVE-2026-47720](https://insights.sbomify.com/CVE-2026-47720/): FUXA: SQL injection in TDengine DAQ connector via backslash bypass of escapeTdString (medium 5.3)
- [CVE-2026-4772](https://insights.sbomify.com/CVE-2026-4772/): Stored XSS in TR7's WAF-ASP (medium 5.4)
- [CVE-2026-47719](https://insights.sbomify.com/CVE-2026-47719/): FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response reading (high 8.2)
- [CVE-2026-47718](https://insights.sbomify.com/CVE-2026-47718/): FUXA provides guest and invalid-token access to protected read APIs in secure mode (medium 5.5)
- [CVE-2026-47717](https://insights.sbomify.com/CVE-2026-47717/): FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurations (high 7.5)
- [CVE-2026-47716](https://insights.sbomify.com/CVE-2026-47716/): Bugsink: Issue bulk actions can affect another project’s issue if its UUID is known (low 3.1)
- [CVE-2026-47715](https://insights.sbomify.com/CVE-2026-47715/): Bugsink: Issue event views can show an event from another project if its UUID is known (low 3.1)
- [CVE-2026-47714](https://insights.sbomify.com/CVE-2026-47714/): libheif has integer overflow in inline mask size calculation that causes undersized buffer allocation (medium 6.1)
- [CVE-2026-47713](https://insights.sbomify.com/CVE-2026-47713/): AnythingLLM: Legacy mobile device tokens bypass multi-user workspace scoping after mode migration (low 2.0)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/599/