# Vulnerabilities published in 2026


- [CVE-2026-47176](https://insights.sbomify.com/CVE-2026-47176/): Quest Bot: Logging module can disclose private-channel message contents to a lower-visibility log channel (medium 5.7)
- [CVE-2026-47175](https://insights.sbomify.com/CVE-2026-47175/): Quest Bot: Moderation reason fields allow bot-powered `@everyone` / `@here` pings (low 2.3)
- [CVE-2026-47174](https://insights.sbomify.com/CVE-2026-47174/): Duck Site: Untrusted pull request code can trigger privileged production deployment (critical 9.5)
- [CVE-2026-47173](https://insights.sbomify.com/CVE-2026-47173/): Quest Bot: Ticket reason allows mass-mention injection (medium 6.3)
- [CVE-2026-47172](https://insights.sbomify.com/CVE-2026-47172/): Quest Bot: Untrusted pull request code can be built and deployed by privileged `workflow_run` deployment. (critical 9.5)
- [CVE-2026-47171](https://insights.sbomify.com/CVE-2026-47171/): Quest Bot: Reminder messages allow stored mass mentions through `@everyone` and `@here` (high 8.8)
- [CVE-2026-47170](https://insights.sbomify.com/CVE-2026-47170/): Garlic-Hub: SSRF vulnerability in uploadFromUrl endpoint (high 7.7)
- [CVE-2026-4717](https://insights.sbomify.com/CVE-2026-4717/): Privilege escalation in the Netmonitor component (critical 9.8)
- [CVE-2026-47169](https://insights.sbomify.com/CVE-2026-47169/): Quest Bot: Manage Server users can configure AutoRole to grant Administrator to controlled joining accounts (high 7.5)
- [CVE-2026-47168](https://insights.sbomify.com/CVE-2026-47168/): EspoCRM: Authenticated RCE via Unsafe PHP Object Deserialization in MassAction/Export params (critical 9.1)
- [CVE-2026-47167](https://insights.sbomify.com/CVE-2026-47167/): Vim: Vimscript Code Injection in cucumber filetype plugin via crafted step-definition regex (medium 5.1)
- [CVE-2026-47166](https://insights.sbomify.com/CVE-2026-47166/): ImageMagick: Heap Buffer Over-Read in distributed pixel cache server (medium 5.7)
- [CVE-2026-47165](https://insights.sbomify.com/CVE-2026-47165/): ImageMagick: Information Disclosure in distributed pixel cache server because it is not using a challenge–response authentication model (medium 4.1)
- [CVE-2026-47164](https://insights.sbomify.com/CVE-2026-47164/): Vaultwarden: SSO Email Auto-Link Can Bind an Existing Local Account to an Attacker-Controlled IdP Identity (high 7.7)
- [CVE-2026-47163](https://insights.sbomify.com/CVE-2026-47163/): Quest Bot: Unprivileged users can create and remove AutoMod rules. (high 7.2)
- [CVE-2026-47162](https://insights.sbomify.com/CVE-2026-47162/): Vim: Vimscript Code Injection in netrw NetrwBookHistSave() via crafted directory name (high 7.3)
- [CVE-2026-47161](https://insights.sbomify.com/CVE-2026-47161/): RELATE Vulnerable to Remote Code Execution (RCE) via Insecure Celery Pickle Deserialization (high 8.7)
- [CVE-2026-47160](https://insights.sbomify.com/CVE-2026-47160/): Vaultwarden: Server-side request forgery (SSRF) via Icon Endpoint Decimal/Hex/Octal IP Bypass (medium 5.8)
- [CVE-2026-4716](https://insights.sbomify.com/CVE-2026-4716/): Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component (critical 9.1)
- [CVE-2026-47159](https://insights.sbomify.com/CVE-2026-47159/): Auth bypass in vaultwarden (medium 6.9)
- [CVE-2026-47158](https://insights.sbomify.com/CVE-2026-47158/): Vaultwarden: CSRF in SSO Authorization Flow (high 8.3)
- [CVE-2026-47157](https://insights.sbomify.com/CVE-2026-47157/): aiograpi: Unsafe signup challenge path handling (medium 6.5)
- [CVE-2026-47156](https://insights.sbomify.com/CVE-2026-47156/): MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator (critical 9.3)
- [CVE-2026-47155](https://insights.sbomify.com/CVE-2026-47155/): vLLM: Artifact Pin Decay in vLLM allows pinned deployments to load unpinned code, weights, and processors (medium 6.5)
- [CVE-2026-47154](https://insights.sbomify.com/CVE-2026-47154/): Simple Metering GetProfileResponse interval-bounds bug in EmberZNet v9.0.2 (high 7.1)
- [CVE-2026-47153](https://insights.sbomify.com/CVE-2026-47153/): Level Control Step With On/Off divide-by-zero in EmberZNet v9.0.2 (high 7.1)
- [CVE-2026-47152](https://insights.sbomify.com/CVE-2026-47152/): Level Control Move divide-by-zero in EmberZNet v9.0.2 (high 7.1)
- [CVE-2026-47151](https://insights.sbomify.com/CVE-2026-47151/): Door Lock ClearWeekdaySchedule invalid table index and write in EmberZNet v9.0.2 (high 7.1)
- [CVE-2026-47150](https://insights.sbomify.com/CVE-2026-47150/): IAS Zone enroll invalid table index and write in EmberZNet 9.0.2 (high 7.1)
- [CVE-2026-4715](https://insights.sbomify.com/CVE-2026-4715/): Uninitialized memory in the Graphics: Canvas2D component (critical 9.1)
- [CVE-2026-47149](https://insights.sbomify.com/CVE-2026-47149/): Door Lock GetUserType invalid table index in EmberZNet v9.0.2 (high 7.1)
- [CVE-2026-47148](https://insights.sbomify.com/CVE-2026-47148/): Groups GetGroupMembership count/list-length mismatch in EmberZNet v9.0.2 (high 7.1)
- [CVE-2026-47147](https://insights.sbomify.com/CVE-2026-47147/): OTA server raw parser missing per-field bounds validation in EmberZNet v9.0.2 (high 7.1)
- [CVE-2026-47146](https://insights.sbomify.com/CVE-2026-47146/): Color Control color-temperature assertion abort in EmberZNet v9.0.2 (high 7.1)
- [CVE-2026-47145](https://insights.sbomify.com/CVE-2026-47145/): Color Control hue/saturation assertion abort in EmberZNet v9.0.2 (high 7.1)
- [CVE-2026-47144](https://insights.sbomify.com/CVE-2026-47144/): Shamefile has an arbitrary file read via shamefile.yaml in shame next (medium 5.5)
- [CVE-2026-47143](https://insights.sbomify.com/CVE-2026-47143/): Capstone has a NULL Pointer Dereference with 3DNow! opcodes (medium 5.1)
- [CVE-2026-47141](https://insights.sbomify.com/CVE-2026-47141/): vm2: NodeVM observability builtins leak host process and HTTP request data (medium 6.9)
- [CVE-2026-47140](https://insights.sbomify.com/CVE-2026-47140/): vm2: NodeVM builtin denylist bypass via process and inspector/promises allows host code execution (critical 10.0)
- [CVE-2026-4714](https://insights.sbomify.com/CVE-2026-4714/): Incorrect boundary conditions in the Audio/Video component (high 7.5)
- [CVE-2026-47139](https://insights.sbomify.com/CVE-2026-47139/): vm2: NodeVM network builtin exclusions bypass via internal _http_client and _http_server (high 8.6)
- [CVE-2026-47138](https://insights.sbomify.com/CVE-2026-47138/): Parse Server: Pre-authentication denial of service via client version header regex backtracking (high 8.7)
- [CVE-2026-47137](https://insights.sbomify.com/CVE-2026-47137/): vm2: GHSA-8hg8-63c5-gwmx patch bypass: nesting:true without explicit require still allows full RCE (critical 10.0)
- [CVE-2026-47136](https://insights.sbomify.com/CVE-2026-47136/): RustFS: Unauthenticated RustFS console license endpoint exposes license metadata (medium 6.9)
- [CVE-2026-47135](https://insights.sbomify.com/CVE-2026-47135/): vm2: Sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checks (high 8.7)
- [CVE-2026-47134](https://insights.sbomify.com/CVE-2026-47134/): Misconfiguration in clearancekit (medium 6.9)
- [CVE-2026-47133](https://insights.sbomify.com/CVE-2026-47133/): ClearanceKit's signed policy tables lack monotonic counter, allowing replay of older legitimately-signed snapshots (medium 6.9)
- [CVE-2026-47132](https://insights.sbomify.com/CVE-2026-47132/): phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration (medium 5.4)
- [CVE-2026-47131](https://insights.sbomify.com/CVE-2026-47131/): vm2: Sandbox Escape (critical 10.0)
- [CVE-2026-47130](https://insights.sbomify.com/CVE-2026-47130/): NextCRM has a BOLA/IDOR in PATCH /api/crm/contacts/[id] that allows Cross-Tenant CRM Data Tampering (high 7.1)
- [CVE-2026-4713](https://insights.sbomify.com/CVE-2026-4713/): Incorrect boundary conditions in the Graphics component (high 7.5)
- [CVE-2026-47129](https://insights.sbomify.com/CVE-2026-47129/): Missing authorization in nextcrm-app (high 8.1)
- [CVE-2026-47128](https://insights.sbomify.com/CVE-2026-47128/): nono: Sandbox escape on Linux via D-Bus: `systemd-run --user` (medium 6.1)
- [CVE-2026-47127](https://insights.sbomify.com/CVE-2026-47127/): Ghostfolio has a Stripe subscription bypass (medium 6.5)
- [CVE-2026-47125](https://insights.sbomify.com/CVE-2026-47125/): Arcane: Missing admin authorization on global variables endpoint (high 8.8)
- [CVE-2026-47124](https://insights.sbomify.com/CVE-2026-47124/): Nezha WebSocket server stream discloses cross-tenant server telemetry to authenticated members (medium 6.5)
- [CVE-2026-47123](https://insights.sbomify.com/CVE-2026-47123/): FreeScout: Agent Impersonation via Missing HMAC Verification on Notification Reply Message-ID Path (high 7.5)
- [CVE-2026-47122](https://insights.sbomify.com/CVE-2026-47122/): Sparkle's AppInstaller post-stage-1 XPC listener accepts unvalidated connections, allowing spoofed appcast item data injection (medium 4.2)
- [CVE-2026-47121](https://insights.sbomify.com/CVE-2026-47121/): Sparkle: Binary delta apply intermediate-symlink traversal in malicious .delta (medium 6.1)
- [CVE-2026-47120](https://insights.sbomify.com/CVE-2026-47120/): Nezha Monitoring: RoleMember can fire other users' cron tasks via AlertRule.FailTriggerTasks (no ownership check) (high 7.1)
- [CVE-2026-4712](https://insights.sbomify.com/CVE-2026-4712/): Information disclosure in the Widget: Cocoa component (high 7.5)
- [CVE-2026-47119](https://insights.sbomify.com/CVE-2026-47119/): Agent Zero < 1.15 Stored XSS via image_get API Endpoint (medium 5.3)
- [CVE-2026-47118](https://insights.sbomify.com/CVE-2026-47118/): Agent Zero < 1.15 Path Traversal File Read via image_get API (high 7.1)
- [CVE-2026-47117](https://insights.sbomify.com/CVE-2026-47117/): OpenMed < 1.5.2 Remote Code Execution via PII Model Loading (critical 9.3)
- [CVE-2026-47116](https://insights.sbomify.com/CVE-2026-47116/): LTSecurity LTK3500SF Hard-coded Credentials via Telnet/SSH (critical 9.2)
- [CVE-2026-47114](https://insights.sbomify.com/CVE-2026-47114/): IINA < 1.4.3 Command Execution via iina://open URL Scheme (high 8.6)
- [CVE-2026-47110](https://insights.sbomify.com/CVE-2026-47110/): Tiptap for PHP < 2.1.1 DoS via Malformed href Attribute (high 7.1)
- [CVE-2026-4711](https://insights.sbomify.com/CVE-2026-4711/): Use-after-free in the Widget: Cocoa component (critical 9.8)
- [CVE-2026-47107](https://insights.sbomify.com/CVE-2026-47107/): Windmill < 1.703.2 Incorrect Default Permissions in nsjail Configuration (high 8.6)
- [CVE-2026-47106](https://insights.sbomify.com/CVE-2026-47106/): Ellucian Banner Self-Service Stored XSS via getFacultyMeetingTimes API (medium 5.1)
- [CVE-2026-47104](https://insights.sbomify.com/CVE-2026-47104/): libusb < 1.0.30 Out-of-Bounds Read in parse_iad_array() (medium 5.1)
- [CVE-2026-47103](https://insights.sbomify.com/CVE-2026-47103/): Python StateMachine 3.0.0 < 3.2.0 RCE via SCXML eval() Injection (critical 9.3)
- [CVE-2026-47102](https://insights.sbomify.com/CVE-2026-47102/): LiteLLM < 1.83.10 Privilege Escalation via User Update (high 8.7)
- [CVE-2026-47101](https://insights.sbomify.com/CVE-2026-47101/): LiteLLM < 1.83.14 Privilege Escalation via API Key Generation (high 8.7)
- [CVE-2026-47100](https://insights.sbomify.com/CVE-2026-47100/): Funnel Builder for WooCommerce Checkout < 3.15.0.3 Missing Authorization via AJAX (high 8.7)
- [CVE-2026-4710](https://insights.sbomify.com/CVE-2026-4710/): Incorrect boundary conditions in the Audio/Video component (critical 9.8)
- [CVE-2026-47099](https://insights.sbomify.com/CVE-2026-47099/): TeleJSON < 6.0.0 DOM-based XSS via parse() Function (low 2.1)
- [CVE-2026-47097](https://insights.sbomify.com/CVE-2026-47097/): AJA HELO Plus < 2.1.7 Hardcoded AES Passphrase for Diagnostics Export Bundle (high 8.7)
- [CVE-2026-47096](https://insights.sbomify.com/CVE-2026-47096/): AJA HELO Plus < 2.1.7 Stored XSS via System Name Parameter (medium 5.3)
- [CVE-2026-47094](https://insights.sbomify.com/CVE-2026-47094/): SIMAC MyPHR 1.1 IDOR Account Takeover via /api/employes/put/{id} (high 8.7)
- [CVE-2026-47092](https://insights.sbomify.com/CVE-2026-47092/): Claude HUD 0.0.12 Arbitrary Command Execution via COMSPEC Environment Variable (high 7.3)
- [CVE-2026-47091](https://insights.sbomify.com/CVE-2026-47091/): Claude HUD 0.0.12 Path Traversal via transcript_path (medium 4.8)
- [CVE-2026-47090](https://insights.sbomify.com/CVE-2026-47090/): Claude HUD 0.0.12 Terminal Injection via OSC 8 Hyperlinks (low 2.4)
- [CVE-2026-4709](https://insights.sbomify.com/CVE-2026-4709/): Incorrect boundary conditions in the Audio/Video: GMP component (high 7.5)
- [CVE-2026-47089](https://insights.sbomify.com/CVE-2026-47089/): Missing authorization in Cyrus IMAP (medium 4.3)
- [CVE-2026-47088](https://insights.sbomify.com/CVE-2026-47088/): Memory corruption in Cyrus IMAP (low 3.1)
- [CVE-2026-47087](https://insights.sbomify.com/CVE-2026-47087/): Auth bypass in Cyrus IMAP (low 3.5)
- [CVE-2026-47086](https://insights.sbomify.com/CVE-2026-47086/): Missing authorization in Cyrus IMAP (low 3.5)
- [CVE-2026-47085](https://insights.sbomify.com/CVE-2026-47085/): Weak cryptography in Cyrus IMAP (medium 4.0)
- [CVE-2026-47084](https://insights.sbomify.com/CVE-2026-47084/): Missing authorization in Cyrus IMAP (medium 6.5)
- [CVE-2026-47083](https://insights.sbomify.com/CVE-2026-47083/): Information disclosure in Cyrus IMAP (medium 4.3)
- [CVE-2026-47082](https://insights.sbomify.com/CVE-2026-47082/): Missing authorization in Cyrus IMAP (medium 5.4)
- [CVE-2026-47081](https://insights.sbomify.com/CVE-2026-47081/): Missing authorization in Cyrus IMAP (low 3.1)
- [CVE-2026-47080](https://insights.sbomify.com/CVE-2026-47080/): CDATA Section Breakout via Unsanitised ]]> in xml_builder (low 2.1)
- [CVE-2026-4708](https://insights.sbomify.com/CVE-2026-4708/): Incorrect boundary conditions in the Graphics component (high 7.5)
- [CVE-2026-47079](https://insights.sbomify.com/CVE-2026-47079/): Round-trip Corruption via Improper Entity Escaping in xml_builder (low 2.1)
- [CVE-2026-47078](https://insights.sbomify.com/CVE-2026-47078/): Relative path traversal in zip:unzip/zip:extract via check_dir_level depth-counter bypass (medium 4.8)
- [CVE-2026-47077](https://insights.sbomify.com/CVE-2026-47077/): Unbounded body accumulation in HTTP/3 response loop in hackney (high 8.2)
- [CVE-2026-47076](https://insights.sbomify.com/CVE-2026-47076/): SSRF allowlist bypass via percent-encoded host in hackney (medium 6.9)
- [CVE-2026-47075](https://insights.sbomify.com/CVE-2026-47075/): CR/LF injection in query parameter in hackney (medium 6.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/605/