# Vulnerabilities published in 2026


- [CVE-2026-47712](https://insights.sbomify.com/CVE-2026-47712/): Dulwich doesn't sanitize commit subjects in `porcelain.format_patch` (low 3.3)
- [CVE-2026-47709](https://insights.sbomify.com/CVE-2026-47709/): libheif has a NULL pointer dereference in heif_image_handle_get_image_tiling for malformed unci image missing ispe (medium 6.9)
- [CVE-2026-47708](https://insights.sbomify.com/CVE-2026-47708/): MCP-for-Stata: Command injection via log_file_name parameter in Stata command wrapper (critical 9.3)
- [CVE-2026-47707](https://insights.sbomify.com/CVE-2026-47707/): Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification (medium 5.3)
- [CVE-2026-47706](https://insights.sbomify.com/CVE-2026-47706/): Strawberry GraphQL has a Circular Fragment Reference DOS (medium 5.3)
- [CVE-2026-47705](https://insights.sbomify.com/CVE-2026-47705/): TypeBot vulnerable to CSV injection in result export (critical 9.6)
- [CVE-2026-47704](https://insights.sbomify.com/CVE-2026-47704/): Missing authorization in typebot.io (high 7.1)
- [CVE-2026-47703](https://insights.sbomify.com/CVE-2026-47703/): AdGuard Home: DoQ-to-UDP State Reduction and Source-Port Oracle (medium 6.3)
- [CVE-2026-47702](https://insights.sbomify.com/CVE-2026-47702/): TypeBot API tokens stored in plaintext (critical 9.1)
- [CVE-2026-47701](https://insights.sbomify.com/CVE-2026-47701/): OpenTelemetry Operator: ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth (high 7.7)
- [CVE-2026-4770](https://insights.sbomify.com/CVE-2026-4770/): DOM-Based XSS in TR7's WAF-ASP (medium 4.6)
- [CVE-2026-47699](https://insights.sbomify.com/CVE-2026-47699/): Path traversal in guest-components (medium 6.4)
- [CVE-2026-47698](https://insights.sbomify.com/CVE-2026-47698/): vm2: Sandbox Breakout Using Dangerous Host Proto Mutators (critical 9.8)
- [CVE-2026-47697](https://insights.sbomify.com/CVE-2026-47697/): Missing authorization in shelf.nu (high 7.1)
- [CVE-2026-47696](https://insights.sbomify.com/CVE-2026-47696/): WWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpoint (high 7.1)
- [CVE-2026-47695](https://insights.sbomify.com/CVE-2026-47695/): CC-Tweaked has an SSRF Protection Bypass with NAT64 (high 7.1)
- [CVE-2026-47694](https://insights.sbomify.com/CVE-2026-47694/): WWBN AVideo: Stored XSS via unescaped Gallery category description (medium 5.4)
- [CVE-2026-47693](https://insights.sbomify.com/CVE-2026-47693/): Poweradmin: CSV Injection in log export endpoints allows formula execution in spreadsheet applications (medium 6.9)
- [CVE-2026-47692](https://insights.sbomify.com/CVE-2026-47692/): Other in envoy (medium 4.8)
- [CVE-2026-47691](https://insights.sbomify.com/CVE-2026-47691/): Netty has Insufficient Bailiwick Validation for NS Records (high 8.7)
- [CVE-2026-47690](https://insights.sbomify.com/CVE-2026-47690/): MeltanoHub vulnerable to command injection in the `test_dispatcher` GitHub Actions workflow (high 7.5)
- [CVE-2026-4769](https://insights.sbomify.com/CVE-2026-4769/): Unauthenticated Access to Internal Diagnostic Interface (critical 9.3)
- [CVE-2026-47689](https://insights.sbomify.com/CVE-2026-47689/): FOGProject has stored XSS via unescaped inventory data in buildRow() rendered on Group Inventory tab (medium 4.6)
- [CVE-2026-47688](https://insights.sbomify.com/CVE-2026-47688/): Missing authorization in fogproject (high 8.2)
- [CVE-2026-47687](https://insights.sbomify.com/CVE-2026-47687/): FOGProject has stored XSS via unescaped option label in selectForm() accessible from unauthenticated inventory endpoint (high 7.3)
- [CVE-2026-47686](https://insights.sbomify.com/CVE-2026-47686/): vm2: Missing Error.cause Sanitization Enables VM2 Sandbox Escape to RCE (critical 9.9)
- [CVE-2026-47685](https://insights.sbomify.com/CVE-2026-47685/): FOGProject has stored XSS via unauthenticated inventory service renders unescaped in Host Management page (high 7.3)
- [CVE-2026-47684](https://insights.sbomify.com/CVE-2026-47684/): Sync-in Server: SSRF protection bypass via IPv4-mapped IPv6 addresses in regExpPrivateIP (high 7.7)
- [CVE-2026-47683](https://insights.sbomify.com/CVE-2026-47683/): vm2: bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike (high 8.7)
- [CVE-2026-47682](https://insights.sbomify.com/CVE-2026-47682/): CVAT: Missing path-containment validation in multiple entry points allows arbitrary path writes (high 7.1)
- [CVE-2026-47680](https://insights.sbomify.com/CVE-2026-47680/): Source controller: Improper path handling allows traversal (medium 5.3)
- [CVE-2026-47679](https://insights.sbomify.com/CVE-2026-47679/): GLPI: arbitrary file deletion (high 8.5)
- [CVE-2026-47676](https://insights.sbomify.com/CVE-2026-47676/): Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths (medium 5.3)
- [CVE-2026-47675](https://insights.sbomify.com/CVE-2026-47675/): Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection (medium 4.3)
- [CVE-2026-47674](https://insights.sbomify.com/CVE-2026-47674/): Hono: IP Restriction bypasses static deny rules for non-canonical IPv6 (medium 5.3)
- [CVE-2026-47673](https://insights.sbomify.com/CVE-2026-47673/): Hono: JWT middleware accepts any Authorization scheme, not only Bearer (medium 4.8)
- [CVE-2026-47672](https://insights.sbomify.com/CVE-2026-47672/): epa4all-client: Unauthenticated REST API for Patient Record Writes (medium 6.5)
- [CVE-2026-47671](https://insights.sbomify.com/CVE-2026-47671/): Nhost CLI local configserver allows cross-origin unauthenticated read/write access to local development configuration and secrets (medium 5.4)
- [CVE-2026-47670](https://insights.sbomify.com/CVE-2026-47670/): DbGate Vulnerable to Authenticated Remote Code Execution via loadReader functionName code injection (critical 9.4)
- [CVE-2026-4767](https://insights.sbomify.com/CVE-2026-4767/): Improper Access Control in TR7's WAF-ASP (critical 9.8)
- [CVE-2026-47669](https://insights.sbomify.com/CVE-2026-47669/): DbGate: Zip Slip in archive/unzip allows arbitrary file write leading to RCE (critical 9.3)
- [CVE-2026-47668](https://insights.sbomify.com/CVE-2026-47668/): DbGate: Unauthenticated Remote Code Execution via JSON Script Runner (critical 10.0)
- [CVE-2026-47667](https://insights.sbomify.com/CVE-2026-47667/): CImg Library: Uncontrolled Memory Allocation and Memory Leak in `_load_analyze()` via Crafted NIfTI/Analyze Header (high 7.5)
- [CVE-2026-47666](https://insights.sbomify.com/CVE-2026-47666/): Penpot: Stored XSS via custom font family name injected into a @font-face style rule (high 7.6)
- [CVE-2026-47665](https://insights.sbomify.com/CVE-2026-47665/): Penpot: Stored XSS via comment content, innerHTML renders unsanitized HTML (high 8.7)
- [CVE-2026-47664](https://insights.sbomify.com/CVE-2026-47664/): Pathling: $import-pnp operation enables authenticated SSRF, credential leakage, and warehouse data poisoning (high 8.6)
- [CVE-2026-47663](https://insights.sbomify.com/CVE-2026-47663/): Pathling: Typed CRUD/search/batch providers can lead to server-wide PHI exfiltration and cross-resource mutation (high 8.7)
- [CVE-2026-47662](https://insights.sbomify.com/CVE-2026-47662/): Missing authorization in pathling (high 8.7)
- [CVE-2026-47661](https://insights.sbomify.com/CVE-2026-47661/): Pathling has path traversal in $result endpoint that allows arbitrary warehouse file read (high 8.7)
- [CVE-2026-47660](https://insights.sbomify.com/CVE-2026-47660/): Pathling: Explicit oauthMetadataUrl in bulk-submit allows OAuth client credential exfiltration (high 8.7)
- [CVE-2026-4766](https://insights.sbomify.com/CVE-2026-4766/): Easy Image Gallery <= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Shortcode Post Meta (medium 6.4)
- [CVE-2026-47659](https://insights.sbomify.com/CVE-2026-47659/): Pathling has path traversal in $import-pnp manifest that enables read-capable SSRF via /jobs/{jobId}/{filename} (high 8.7)
- [CVE-2026-47657](https://insights.sbomify.com/CVE-2026-47657/): HumHub Missing Authorization on Remove All Space Members Action (high 7.1)
- [CVE-2026-47656](https://insights.sbomify.com/CVE-2026-47656/): Windows Boot Manager Security Feature Bypass Vulnerability (high 7.9)
- [CVE-2026-47655](https://insights.sbomify.com/CVE-2026-47655/): Microsoft Graph Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-47654](https://insights.sbomify.com/CVE-2026-47654/): Remote Desktop Client Remote Code Execution Vulnerability (high 7.5)
- [CVE-2026-47653](https://insights.sbomify.com/CVE-2026-47653/): Remote Desktop Client Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-47652](https://insights.sbomify.com/CVE-2026-47652/): Windows Hyper-V Remote Code Execution Vulnerability (high 8.2)
- [CVE-2026-4765](https://insights.sbomify.com/CVE-2026-4765/): Self Cross-Site Scripting (Self-XSS) in Tallos Chat by RD Station Conversas (not scored)
- [CVE-2026-47648](https://insights.sbomify.com/CVE-2026-47648/): Windows Storage Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-47647](https://insights.sbomify.com/CVE-2026-47647/): Dynamics 365 Elevation of Privilege Vulnerability (critical 9.9)
- [CVE-2026-47646](https://insights.sbomify.com/CVE-2026-47646/): Dynamics 365 Customer Voice Spoofing Vulnerability (critical 9.3)
- [CVE-2026-47645](https://insights.sbomify.com/CVE-2026-47645/): Microsoft 365 Copilot's Business Chat Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-47644](https://insights.sbomify.com/CVE-2026-47644/): Copilot Chat (Microsoft Edge) Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-47643](https://insights.sbomify.com/CVE-2026-47643/): Azure Stack Edge Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-47642](https://insights.sbomify.com/CVE-2026-47642/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-47641](https://insights.sbomify.com/CVE-2026-47641/): Microsoft SharePoint Server Spoofing Vulnerability (medium 4.6)
- [CVE-2026-47640](https://insights.sbomify.com/CVE-2026-47640/): Microsoft SharePoint Server Spoofing Vulnerability (medium 4.6)
- [CVE-2026-4764](https://insights.sbomify.com/CVE-2026-4764/): Privilege Escalation in Dialogflow CX via Playbook Import (critical 9.4)
- [CVE-2026-47639](https://insights.sbomify.com/CVE-2026-47639/): Microsoft SharePoint Server Spoofing Vulnerability (medium 5.4)
- [CVE-2026-47638](https://insights.sbomify.com/CVE-2026-47638/): Microsoft SharePoint Server Spoofing Vulnerability (medium 4.6)
- [CVE-2026-47637](https://insights.sbomify.com/CVE-2026-47637/): Microsoft SharePoint Server Spoofing Vulnerability (medium 4.6)
- [CVE-2026-47636](https://insights.sbomify.com/CVE-2026-47636/): Microsoft SharePoint Server Spoofing Vulnerability (medium 5.4)
- [CVE-2026-47635](https://insights.sbomify.com/CVE-2026-47635/): Microsoft Outlook and Word Remote Code Execution Vulnerability (high 8.4)
- [CVE-2026-47634](https://insights.sbomify.com/CVE-2026-47634/): Microsoft SharePoint Server Spoofing Vulnerability (high 7.3)
- [CVE-2026-47633](https://insights.sbomify.com/CVE-2026-47633/): Microsoft Cost Management Information Disclosure Vulnerability (high 7.5)
- [CVE-2026-47632](https://insights.sbomify.com/CVE-2026-47632/): Azure Connected Machine Agent Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-47631](https://insights.sbomify.com/CVE-2026-47631/): Microsoft Exchange Server Spoofing Vulnerability (high 8.1)
- [CVE-2026-47630](https://insights.sbomify.com/CVE-2026-47630/): Path traversal in Triton Inference Server (medium 5.5)
- [CVE-2026-47629](https://insights.sbomify.com/CVE-2026-47629/): Denial of service in Triton Inference Server (high 7.5)
- [CVE-2026-47628](https://insights.sbomify.com/CVE-2026-47628/): Denial of service in Triton Inference Server (high 7.5)
- [CVE-2026-47627](https://insights.sbomify.com/CVE-2026-47627/): Path traversal in Triton Inference Server (critical 9.8)
- [CVE-2026-47626](https://insights.sbomify.com/CVE-2026-47626/): Memory corruption in DGX Spark (high 8.2)
- [CVE-2026-47625](https://insights.sbomify.com/CVE-2026-47625/): Missing authorization in Triton Inference Server (high 7.5)
- [CVE-2026-47624](https://insights.sbomify.com/CVE-2026-47624/): Security feature bypass in DGX Spark (medium 6.0)
- [CVE-2026-47623](https://insights.sbomify.com/CVE-2026-47623/): Deserialization in Dynamo (high 8.2)
- [CVE-2026-47622](https://insights.sbomify.com/CVE-2026-47622/): Information disclosure in Dynamo (medium 5.3)
- [CVE-2026-47621](https://insights.sbomify.com/CVE-2026-47621/): Race condition in Dynamo (medium 6.5)
- [CVE-2026-47620](https://insights.sbomify.com/CVE-2026-47620/): Race condition in Dynamo (medium 6.5)
- [CVE-2026-47619](https://insights.sbomify.com/CVE-2026-47619/): Other in Dynamo (medium 6.6)
- [CVE-2026-47618](https://insights.sbomify.com/CVE-2026-47618/): Server-side request forgery in Dynamo (high 7.5)
- [CVE-2026-47617](https://insights.sbomify.com/CVE-2026-47617/): Server-side request forgery in Dynamo (high 7.5)
- [CVE-2026-47616](https://insights.sbomify.com/CVE-2026-47616/): Server-side request forgery in Dynamo (high 7.5)
- [CVE-2026-47615](https://insights.sbomify.com/CVE-2026-47615/): Server-side request forgery in Dynamo (high 7.5)
- [CVE-2026-47614](https://insights.sbomify.com/CVE-2026-47614/): Server-side request forgery in Dynamo (high 7.5)
- [CVE-2026-47613](https://insights.sbomify.com/CVE-2026-47613/): Server-side request forgery in Dynamo (high 7.5)
- [CVE-2026-47612](https://insights.sbomify.com/CVE-2026-47612/): Path traversal in Dynamo (high 7.5)
- [CVE-2026-4761](https://insights.sbomify.com/CVE-2026-4761/): Unnecessary permissions on private keys of certificates installed by Network and Security Wizard (low 3.3)
- [CVE-2026-47606](https://insights.sbomify.com/CVE-2026-47606/): Path traversal in Triton Inference Server (medium 6.5)
- [CVE-2026-47604](https://insights.sbomify.com/CVE-2026-47604/): Missing authorization in GeForce (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/600/