# Vulnerabilities published in 2026


- [CVE-2026-46687](https://insights.sbomify.com/CVE-2026-46687/): Emlog Local File Inclusion (LFI) (high 7.7)
- [CVE-2026-46686](https://insights.sbomify.com/CVE-2026-46686/): Emlog Reflected Cross-Site Scripting (high 8.5)
- [CVE-2026-46685](https://insights.sbomify.com/CVE-2026-46685/): RustFS: Reflective CORS with credentials on S3 listener; unauthenticated license metadata endpoint on console (medium 6.0)
- [CVE-2026-46684](https://insights.sbomify.com/CVE-2026-46684/): DataEase: Unauthorized Command Execution Vulnerability (critical 9.5)
- [CVE-2026-46683](https://insights.sbomify.com/CVE-2026-46683/): Snappy: SSRF and local file read via the xsl-style-sheet option (medium 6.9)
- [CVE-2026-46682](https://insights.sbomify.com/CVE-2026-46682/): BigBlueButton: Blind SQL Injection AUTH (Moderator) (high 8.5)
- [CVE-2026-46681](https://insights.sbomify.com/CVE-2026-46681/): @nevware21/ts-utils: Prototype Pollution in objDeepCopy/objCopyProps via for...in without hasOwnProperty (high 7.2)
- [CVE-2026-46680](https://insights.sbomify.com/CVE-2026-46680/): containerd user ID handling bypass allows runAsNonRoot evasion (high 7.3)
- [CVE-2026-4668](https://insights.sbomify.com/CVE-2026-4668/): Amelia <= 2.1.2 - Authenticated (Manager+) SQL Injection via 'sort' Parameter (medium 6.5)
- [CVE-2026-46679](https://insights.sbomify.com/CVE-2026-46679/): libp2p: Memory DoS via subscription flood of unique topics (high 7.5)
- [CVE-2026-46678](https://insights.sbomify.com/CVE-2026-46678/): Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of CVE-2026-25580) (medium 6.8)
- [CVE-2026-46673](https://insights.sbomify.com/CVE-2026-46673/): Russh: Unchecked CryptoVec allocation and growth handling is reachable (high 7.5)
- [CVE-2026-46672](https://insights.sbomify.com/CVE-2026-46672/): Actual: CSV Formula Injection in `@actual-app/cli` `--format csv` Output via Custom `escapeCsv` Helper (medium 4.6)
- [CVE-2026-46671](https://insights.sbomify.com/CVE-2026-46671/): Rust OneNote File Parser: Path traversal in `Parser::parse_notebook` allows reading files outside the notebook directory (medium 4.4)
- [CVE-2026-46670](https://insights.sbomify.com/CVE-2026-46670/): YesWiki: Unauthenticated SQL Injection (critical 9.8)
- [CVE-2026-4667](https://insights.sbomify.com/CVE-2026-4667/): HP System Optimizer - Escalation of Privilege (high 7.3)
- [CVE-2026-46669](https://insights.sbomify.com/CVE-2026-46669/): `openvm-pairing` pairing check missing proper subfield check on scaling factor (high 8.7)
- [CVE-2026-46668](https://insights.sbomify.com/CVE-2026-46668/): SpiceDB: Caveat structures with nested lists can result in improper cache reuse (low 2.3)
- [CVE-2026-4666](https://insights.sbomify.com/CVE-2026-4666/): Missing authorization in wpForo Forum (medium 6.5)
- [CVE-2026-46657](https://insights.sbomify.com/CVE-2026-46657/): Bludit's persistent authentication tokens not revoked upon account disablement (high 7.1)
- [CVE-2026-46656](https://insights.sbomify.com/CVE-2026-46656/): Bludit CMS has improper authorization and mediation failure leading to persistent ghost sessions (high 8.8)
- [CVE-2026-46655](https://insights.sbomify.com/CVE-2026-46655/): virtio-win: Integer overflow causing a heap overflow in Viosock driver (high 7.8)
- [CVE-2026-46654](https://insights.sbomify.com/CVE-2026-46654/): Plonky3 MultiField32Challenger: transcript malleability and challenge entropy loss (high 8.9)
- [CVE-2026-46652](https://insights.sbomify.com/CVE-2026-46652/): Path traversal in goobi-viewer-core (critical 9.8)
- [CVE-2026-46651](https://insights.sbomify.com/CVE-2026-46651/): Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewer (critical 9.8)
- [CVE-2026-46650](https://insights.sbomify.com/CVE-2026-46650/): Joplin: Stored XSS in public share viewer via javascript: URL bypass in isAcceptedUrl (medium 4.4)
- [CVE-2026-4665](https://insights.sbomify.com/CVE-2026-4665/): WP Carousel Free <= 2.7.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-caption' Attribute (medium 6.4)
- [CVE-2026-46649](https://insights.sbomify.com/CVE-2026-46649/): Joplin: SSO Auth Code Login Missing Rate Limiting — 9-Digit Numeric Code Brute-Forceable via Unprotected Endpoint (critical 9.1)
- [CVE-2026-46645](https://insights.sbomify.com/CVE-2026-46645/): SQLAdmin: Authorization Bypass on `ajax_lookup` (medium 4.3)
- [CVE-2026-46644](https://insights.sbomify.com/CVE-2026-46644/): symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload decodes to ASCII-only: insecure equivalence (medium 6.9)
- [CVE-2026-46643](https://insights.sbomify.com/CVE-2026-46643/): Snappy: Binary path is never shell-escaped due to an inverted is_executable check (high 7.5)
- [CVE-2026-46642](https://insights.sbomify.com/CVE-2026-46642/): draw.io: XSS via crafted cell label when opening a .drawio file (medium 6.1)
- [CVE-2026-46640](https://insights.sbomify.com/CVE-2026-46640/): Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation (high 8.7)
- [CVE-2026-4664](https://insights.sbomify.com/CVE-2026-4664/): Auth bypass in Customer Reviews for WooCommerce (medium 5.3)
- [CVE-2026-46639](https://insights.sbomify.com/CVE-2026-46639/): Twig: Sandbox property and method bypass via object-destructuring assignment (high 7.1)
- [CVE-2026-46638](https://insights.sbomify.com/CVE-2026-46638/): Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411) (medium 6.0)
- [CVE-2026-46637](https://insights.sbomify.com/CVE-2026-46637/): Twig: HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']` (medium 5.1)
- [CVE-2026-46636](https://insights.sbomify.com/CVE-2026-46636/): Twig: Sandbox method allowlist bypass via `Markup` subclass (high 8.7)
- [CVE-2026-46635](https://insights.sbomify.com/CVE-2026-46635/): Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects) (medium 5.3)
- [CVE-2026-46634](https://insights.sbomify.com/CVE-2026-46634/): Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name (high 7.7)
- [CVE-2026-46633](https://insights.sbomify.com/CVE-2026-46633/): Twig: PHP code injection via `{% use %}` template name (high 8.7)
- [CVE-2026-46629](https://insights.sbomify.com/CVE-2026-46629/): Twig: Unbounded formatter memoisation in twig/intl-extra keyed on template-controlled arguments (medium 5.3)
- [CVE-2026-46628](https://insights.sbomify.com/CVE-2026-46628/): Twig: The `spaceless` filter implicitly marks its output as safe (medium 5.1)
- [CVE-2026-46627](https://insights.sbomify.com/CVE-2026-46627/): Twig: Sandbox resource exhaustion via unbounded `for` / `range()` (high 7.1)
- [CVE-2026-46625](https://insights.sbomify.com/CVE-2026-46625/): JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection (high 7.5)
- [CVE-2026-46624](https://insights.sbomify.com/CVE-2026-46624/): Twenty: SQL Injection via the timeZone field (critical 9.9)
- [CVE-2026-46623](https://insights.sbomify.com/CVE-2026-46623/): OpenAM Account Takeover via Unverified Password Change in OAuth2 Module (high 7.4)
- [CVE-2026-46622](https://insights.sbomify.com/CVE-2026-46622/): SolidInvoice: API tokens stored as plaintext in the database allowing full credential compromise on database breach (high 8.1)
- [CVE-2026-46621](https://insights.sbomify.com/CVE-2026-46621/): Yamcs: Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injection (critical 9.1)
- [CVE-2026-46620](https://insights.sbomify.com/CVE-2026-46620/): e107: CSRF in comment.php moderation endpoints via token-optional validation in session_handler::check() (medium 6.5)
- [CVE-2026-4662](https://insights.sbomify.com/CVE-2026-4662/): JetEngine <= 3.8.6.1 - Unauthenticated SQL Injection via Listing Grid 'filtered_query' Parameter (high 7.5)
- [CVE-2026-46619](https://insights.sbomify.com/CVE-2026-46619/): OpenAM Authentication Bypass via MSISDN LDAP Injection (critical 9.3)
- [CVE-2026-46618](https://insights.sbomify.com/CVE-2026-46618/): Fission builder accepts arbitrary buildcmd strings from Environment.spec.builder.command, allowing the builder pod to invoke arbitrary executables (medium 6.9)
- [CVE-2026-46617](https://insights.sbomify.com/CVE-2026-46617/): Fission runtime pods automount the fission-fetcher service-account token into the user function container, granting function code namespace-wide secret / configmap read (high 8.7)
- [CVE-2026-46616](https://insights.sbomify.com/CVE-2026-46616/): Umbraco.Cms: Open Redirect Vulnerability in Surface Controllers (medium 5.4)
- [CVE-2026-46614](https://insights.sbomify.com/CVE-2026-46614/): Fission router exposes /fission-function/<ns>/<name> on its public listener, allowing invocation of any function without an HTTPTrigger (critical 9.8)
- [CVE-2026-46612](https://insights.sbomify.com/CVE-2026-46612/): Fission StorageSvc /v1/archive endpoint exposes unauthenticated CRUD over all function archives (high 8.8)
- [CVE-2026-46611](https://insights.sbomify.com/CVE-2026-46611/): Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack (medium 5.3)
- [CVE-2026-4661](https://insights.sbomify.com/CVE-2026-4661/): WP CTA <= 2.2.2 - Unauthenticated Time-Based Blind SQL Injection via 'fildname' Parameter (high 7.5)
- [CVE-2026-46609](https://insights.sbomify.com/CVE-2026-46609/): Umbraco.Cms: XSS/HTML Injection in Umbraco Backoffice confirmation dialog (medium 4.6)
- [CVE-2026-46608](https://insights.sbomify.com/CVE-2026-46608/): Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533) (high 7.4)
- [CVE-2026-46607](https://insights.sbomify.com/CVE-2026-46607/): Glances: Insecure Pickle Deserialization in Version Cache Leads to Arbitrary Code Execution (high 7.8)
- [CVE-2026-46606](https://insights.sbomify.com/CVE-2026-46606/): Glances: Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py (high 7.8)
- [CVE-2026-46605](https://insights.sbomify.com/CVE-2026-46605/): Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incomplete authorization during destination removal (medium 4.3)
- [CVE-2026-46604](https://insights.sbomify.com/CVE-2026-46604/): Panic decoding image with out-of-bounds strip offset in x/image/tiff in golang.org/x/image (high 7.5)
- [CVE-2026-46603](https://insights.sbomify.com/CVE-2026-46603/): Excessive memory allocation during VP8L decoding in golang.org/x/image (high 7.5)
- [CVE-2026-46602](https://insights.sbomify.com/CVE-2026-46602/): Lack of limit on tile sizes in x/image/tiff in golang.org/x/image (high 7.5)
- [CVE-2026-46601](https://insights.sbomify.com/CVE-2026-46601/): Panic on VP8 alpha channel size mismatch in x/image/webp in golang.org/x/image (high 7.5)
- [CVE-2026-46600](https://insights.sbomify.com/CVE-2026-46600/): Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage (high 7.5)
- [CVE-2026-4660](https://insights.sbomify.com/CVE-2026-4660/): Go-getter may allow to arbitrary filesystem reads through git operations (high 7.5)
- [CVE-2026-46599](https://insights.sbomify.com/CVE-2026-46599/): Excessive resource consumption in PackBits decompression in golang.org/x/image/tiff (high 7.5)
- [CVE-2026-46598](https://insights.sbomify.com/CVE-2026-46598/): Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (medium 5.3)
- [CVE-2026-46597](https://insights.sbomify.com/CVE-2026-46597/): Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (high 7.5)
- [CVE-2026-46595](https://insights.sbomify.com/CVE-2026-46595/): Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (critical 10.0)
- [CVE-2026-46594](https://insights.sbomify.com/CVE-2026-46594/): Reflected XSS in PHP Poll Script (medium 5.1)
- [CVE-2026-46593](https://insights.sbomify.com/CVE-2026-46593/): Authenticated SQL Injection in PHP Poll Script (high 8.6)
- [CVE-2026-46592](https://insights.sbomify.com/CVE-2026-46592/): Apache Camel-CXF: The SOAP operation-selection headers used non-Camel-prefixed names (operationName, operationNamespace) that bypass the HTTP header filter, allowing an HTTP client to redirect the invoked SOAP operation (high 7.5)
- [CVE-2026-46591](https://insights.sbomify.com/CVE-2026-46591/): Apache Camel-Neo4j: JSON property names from the CamelNeo4jMatchProperties header are interpolated into the Cypher WHERE clause without validation, allowing Cypher injection (incomplete remediation of CVE-2025-66169) (high 8.2)
- [CVE-2026-46590](https://insights.sbomify.com/CVE-2026-46590/): Apache Camel-PQC: The HashiCorp Vault and AWS Secrets Manager key-lifecycle managers deserialize persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter (incomplete remediation of CVE-2026-40048) (high 8.8)
- [CVE-2026-4659](https://insights.sbomify.com/CVE-2026-4659/): Path traversal in Unlimited Elements For Elementor (high 7.5)
- [CVE-2026-46588](https://insights.sbomify.com/CVE-2026-46588/): Apache Camel-CouchDB: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted input (high 7.3)
- [CVE-2026-46587](https://insights.sbomify.com/CVE-2026-46587/): Apache Camel-Couchbase: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted input (high 7.3)
- [CVE-2026-46586](https://insights.sbomify.com/CVE-2026-46586/): Apache OFBiz: Improper Validation in traverseContent Service Enables Authenticated Groovy Code Execution (high 8.8)
- [CVE-2026-46585](https://insights.sbomify.com/CVE-2026-46585/): Apache Camel-Lucene: The query control headers used non-Camel-prefixed names (QUERY, RETURN_LUCENE_DOCS) that bypass the HTTP header filter, allowing an HTTP client to inject the full-text search query (high 7.5)
- [CVE-2026-46584](https://insights.sbomify.com/CVE-2026-46584/): Apache Camel-Mail: The mail producer applied attacker-supplied mail.smtp.* / mail.smtps.* message headers as JavaMail session properties (low 3.7)
- [CVE-2026-46582](https://insights.sbomify.com/CVE-2026-46582/): A wildcard replay, as another piece of data, triggers poisoning in the serve expired reply path (low 3.7)
- [CVE-2026-46581](https://insights.sbomify.com/CVE-2026-46581/): Code injection in Eclipse Mojarra (high 7.5)
- [CVE-2026-46580](https://insights.sbomify.com/CVE-2026-46580/): [Eclipse Theia] Indirect Prompt Injection via Auto-Loaded Workspace Prompt Template Files in AI Chat (high 8.4)
- [CVE-2026-4658](https://insights.sbomify.com/CVE-2026-4658/): Gutenberg Essential Blocks <= 6.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes (medium 6.4)
- [CVE-2026-46579](https://insights.sbomify.com/CVE-2026-46579/): Auth bypass in Red Hat OpenShift Container Platform 4.12 (high 7.4)
- [CVE-2026-46572](https://insights.sbomify.com/CVE-2026-46572/): Memory corruption in tuxera:ntfs-3g (high 7.4)
- [CVE-2026-46571](https://insights.sbomify.com/CVE-2026-46571/): Memory corruption in tuxera:ntfs-3g (medium 5.5)
- [CVE-2026-46570](https://insights.sbomify.com/CVE-2026-46570/): Memory corruption in tuxera:ntfs-3g (high 8.1)
- [CVE-2026-4657](https://insights.sbomify.com/CVE-2026-4657/): Easy Google Fonts <= 2.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via control_selectors Meta Field (medium 6.4)
- [CVE-2026-46569](https://insights.sbomify.com/CVE-2026-46569/): Memory corruption in tuxera:ntfs-3g (high 7.7)
- [CVE-2026-46562](https://insights.sbomify.com/CVE-2026-46562/): Yamcs: Remote Code Execution via Mission Database algorithm override (critical 9.8)
- [CVE-2026-46561](https://insights.sbomify.com/CVE-2026-46561/): pyLoad: SSRF via HTTP Redirect Bypass in parse_urls API (medium 5.0)
- [CVE-2026-46559](https://insights.sbomify.com/CVE-2026-46559/): ImageMagick: Heap Buffer Over-Write of a single byte in the JP2 encoder (medium 4.0)
- [CVE-2026-46558](https://insights.sbomify.com/CVE-2026-46558/): Missing authorization in plane (high 8.3)
- [CVE-2026-46557](https://insights.sbomify.com/CVE-2026-46557/): ImageMagick: Stack overflow in fx operation (medium 6.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/610/