# Vulnerabilities published in 2026


- [CVE-2026-46556](https://insights.sbomify.com/CVE-2026-46556/): FlaskBB: SSRF in get_image_info() via unrestricted avatar URL (medium 6.5)
- [CVE-2026-46555](https://insights.sbomify.com/CVE-2026-46555/): WhatsApp MCP: Unauthenticated bridge API allows message sending and arbitrary file exfiltration (high 7.7)
- [CVE-2026-46554](https://insights.sbomify.com/CVE-2026-46554/): NocoDB: Stale Auth Cache After API Token Deletion (low 2.3)
- [CVE-2026-46553](https://insights.sbomify.com/CVE-2026-46553/): NocoDB: Attachment Size Limit Bypass via Upload-by-URL (low 2.1)
- [CVE-2026-46552](https://insights.sbomify.com/CVE-2026-46552/): NocoDB: Shared-base link access can invite arbitrary users as persistent base members (medium 5.8)
- [CVE-2026-46551](https://insights.sbomify.com/CVE-2026-46551/): NocoDB: Missing File Size Enforcement in Upload-by-URL Allows Denial of Service via Disk Exhaustion (medium 6.5)
- [CVE-2026-46550](https://insights.sbomify.com/CVE-2026-46550/): NocoDB: Refresh Token Cookie Set Without `Secure` and `SameSite` Flags (medium 5.4)
- [CVE-2026-4655](https://insights.sbomify.com/CVE-2026-4655/): Cross-site scripting in Element Pack – Widgets, Templates & Addons for Elementor (medium 6.4)
- [CVE-2026-46549](https://insights.sbomify.com/CVE-2026-46549/): NocoDB: OAuth Token Scope Not Enforced at ACL Layer Allows Scope Escalation (low 2.0)
- [CVE-2026-46548](https://insights.sbomify.com/CVE-2026-46548/): NocoDB: SSRF Protection Bypass in Notification Webhook Plugins (Slack, Discord, Mattermost, Teams) (medium 4.3)
- [CVE-2026-46547](https://insights.sbomify.com/CVE-2026-46547/): NocoDB: Reflected Cross-Site Scripting via Page Leaving Redirect URL (medium 6.1)
- [CVE-2026-46546](https://insights.sbomify.com/CVE-2026-46546/): Frappe LMS: HTML injection in user-controlled metadata (low 2.1)
- [CVE-2026-46545](https://insights.sbomify.com/CVE-2026-46545/): nimiq-primitives: Panic DoS in trie chunk processing via ROOT-keyed item (high 7.5)
- [CVE-2026-46544](https://insights.sbomify.com/CVE-2026-46544/): Missing authorization in UFO (medium 5.3)
- [CVE-2026-46543](https://insights.sbomify.com/CVE-2026-46543/): nimiq-blockchain: Genesis batch set request (medium 5.3)
- [CVE-2026-46542](https://insights.sbomify.com/CVE-2026-46542/): nimiq-keys: Denial of service in Ed25519 multisig delinearization via invalid curve points (medium 4.3)
- [CVE-2026-46541](https://insights.sbomify.com/CVE-2026-46541/): Nimiq network-libp2p: DHT query poisoning via first-record verification failure (high 7.5)
- [CVE-2026-46540](https://insights.sbomify.com/CVE-2026-46540/): Nimiq light-blockchain: Light blockchain rebranch issue (medium 6.5)
- [CVE-2026-4654](https://insights.sbomify.com/CVE-2026-4654/): Missing authorization in Awesome Support – WordPress HelpDesk & Support Plugin (medium 5.3)
- [CVE-2026-46539](https://insights.sbomify.com/CVE-2026-46539/): nimiq-primitives: BlockInclusionProof interlink issue when hops are empty (medium 5.9)
- [CVE-2026-46538](https://insights.sbomify.com/CVE-2026-46538/): Microsoft UFO accepts cross-device TASK_END messages by session_id only, allowing peer task-result injection (medium 5.9)
- [CVE-2026-46532](https://insights.sbomify.com/CVE-2026-46532/): ESF-IDF: Heap Out-of-Bounds Read in Bluedroid AVRCP Target Parser (medium 4.6)
- [CVE-2026-46531](https://insights.sbomify.com/CVE-2026-46531/): SQL injection in cacti (medium 5.5)
- [CVE-2026-4653](https://insights.sbomify.com/CVE-2026-4653/): Cross-site scripting in Block, Suspend, Report for BuddyPress (medium 6.4)
- [CVE-2026-46529](https://insights.sbomify.com/CVE-2026-46529/): PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen (high 8.4)
- [CVE-2026-46527](https://insights.sbomify.com/CVE-2026-46527/): Null dereference in cpp-httplib (high 8.7)
- [CVE-2026-46526](https://insights.sbomify.com/CVE-2026-46526/): Local Deep Research: SSRF bypass in `safe_get` (medium 5.0)
- [CVE-2026-46523](https://insights.sbomify.com/CVE-2026-46523/): ImageMagick: Use-After-Free in MSL decoder. (medium 6.2)
- [CVE-2026-46522](https://insights.sbomify.com/CVE-2026-46522/): ImageMagick: Infinite Loop in the MIFF decoder can lead to CPU exhaustion (high 7.5)
- [CVE-2026-46521](https://insights.sbomify.com/CVE-2026-46521/): ImageMagick: Heap Buffer Over-Write in MIFF encoder when using LZMA compression (medium 5.5)
- [CVE-2026-46520](https://insights.sbomify.com/CVE-2026-46520/): ImageMagick: Heap Buffer Over-Write in IPL decoder when reading multiple images of different dimensions (high 7.5)
- [CVE-2026-4652](https://insights.sbomify.com/CVE-2026-4652/): Remote denial of service via null pointer dereference (high 7.5)
- [CVE-2026-46519](https://insights.sbomify.com/CVE-2026-46519/): MCP Server Kubernetes: Tool Access Control Bypass via Presentation-Layer Filtering Without Execution-Layer Enforcement (high 8.8)
- [CVE-2026-46518](https://insights.sbomify.com/CVE-2026-46518/): OpenEMR: Stored XSS in prescription CSS/HTML print view via patient demographics (high 7.7)
- [CVE-2026-46517](https://insights.sbomify.com/CVE-2026-46517/): LMDeploy: Hardcoded trust_remote_code=True is an implicit unsafe remote-code load path with no user opt-out (high 7.8)
- [CVE-2026-46516](https://insights.sbomify.com/CVE-2026-46516/): Frogman vulnerable to stored XSS in chat console formatter (escalation vector in multi-admin deployments) (medium 4.8)
- [CVE-2026-46515](https://insights.sbomify.com/CVE-2026-46515/): Frogman: Multiple read-tier tools expose admin-grade data and arbitrary GraphQL execution (critical 9.3)
- [CVE-2026-46514](https://insights.sbomify.com/CVE-2026-46514/): Frogman: Plaintext passwords and secrets persisted to audit log (medium 6.5)
- [CVE-2026-46513](https://insights.sbomify.com/CVE-2026-46513/): Frogman: API tokens stored in plaintext (high 7.4)
- [CVE-2026-46512](https://insights.sbomify.com/CVE-2026-46512/): Frogman: Dialplan template parameters interpolated into extensions_custom.conf without escaping (critical 9.9)
- [CVE-2026-46511](https://insights.sbomify.com/CVE-2026-46511/): HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack (high 8.7)
- [CVE-2026-46510](https://insights.sbomify.com/CVE-2026-46510/): Prototype pollution in form-data-objectizer via bracket-notation form keys (high 8.2)
- [CVE-2026-46509](https://insights.sbomify.com/CVE-2026-46509/): deepobj: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (high 8.2)
- [CVE-2026-46508](https://insights.sbomify.com/CVE-2026-46508/): Turborepo: VSCode Extension command injection (high 8.4)
- [CVE-2026-4650](https://insights.sbomify.com/CVE-2026-4650/): Missing authorization in FundPress – WordPress Donation Plugin (medium 5.3)
- [CVE-2026-46498](https://insights.sbomify.com/CVE-2026-46498/): OpenAM Arbitrary OAuth Token Minting via Push Registration (high 7.6)
- [CVE-2026-46497](https://insights.sbomify.com/CVE-2026-46497/): SSRF via sitemap-derived URLs in Crawlee for Python (low 2.3)
- [CVE-2026-46496](https://insights.sbomify.com/CVE-2026-46496/): HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft (critical 9.3)
- [CVE-2026-46495](https://insights.sbomify.com/CVE-2026-46495/): OpenDJ Pre-Auth RCE via Java Deserialization in JMX RMI (critical 9.2)
- [CVE-2026-46493](https://insights.sbomify.com/CVE-2026-46493/): haxtheweb/haxcms-php uses insecure method for generating salt (high 7.5)
- [CVE-2026-46492](https://insights.sbomify.com/CVE-2026-46492/): md-fileserver: Stored/Reflected XSS when viewing Markdown (raw HTML allowed) (high 7.2)
- [CVE-2026-46491](https://insights.sbomify.com/CVE-2026-46491/): SimpleSAMLphp casserver FileSystemTicketStore path traversal allows out-of-ticket-directory read/unserialize and conditional deletion (high 8.6)
- [CVE-2026-46490](https://insights.sbomify.com/CVE-2026-46490/): samlify: XML Injection in AttributeValue Allows Privilege Escalation in Signed SAML Assertions (high 8.7)
- [CVE-2026-4649](https://insights.sbomify.com/CVE-2026-4649/): Auth bypass in Apache Artemis allows reading all internal messages (medium 5.3)
- [CVE-2026-46489](https://insights.sbomify.com/CVE-2026-46489/): SolidInvoice: Unrestricted file upload with no MIME validation allows stored XSS via malicious SVG logo (high 8.1)
- [CVE-2026-46488](https://insights.sbomify.com/CVE-2026-46488/): motionEye: Authentication possible via password hash (critical 9.1)
- [CVE-2026-46486](https://insights.sbomify.com/CVE-2026-46486/): Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing (medium 5.3)
- [CVE-2026-46485](https://insights.sbomify.com/CVE-2026-46485/): Dash: Users can write to config despire permissions (OIDC tested) (high 8.2)
- [CVE-2026-46484](https://insights.sbomify.com/CVE-2026-46484/): Headplane: Path Traversal + RBAC Bypass in renameNode allows authenticated OIDC users to expire or rename any node/user (high 8.1)
- [CVE-2026-46483](https://insights.sbomify.com/CVE-2026-46483/): Vim: Command injection in tar#Vimuntar via missing shellescape {special} flag (low 3.6)
- [CVE-2026-46482](https://insights.sbomify.com/CVE-2026-46482/): MyBB: Security Question insufficient validation (medium 5.3)
- [CVE-2026-46481](https://insights.sbomify.com/CVE-2026-46481/): OpenMetadata: TEST_CONNECTION workflow leaks ingestion-bot JWT and database password to regular users (high 8.3)
- [CVE-2026-46480](https://insights.sbomify.com/CVE-2026-46480/): Flowise: Evaluator create+update mass-assignment allows cross-workspace evaluator takeover (high 7.7)
- [CVE-2026-4648](https://insights.sbomify.com/CVE-2026-4648/): Insufficient Encryption Level in CasfID Servicios Tecnológicos NFC Wristbands (medium 6.8)
- [CVE-2026-46479](https://insights.sbomify.com/CVE-2026-46479/): Flowise: Evaluation create+update mass-assignment allows cross-workspace evaluation takeover (high 7.7)
- [CVE-2026-46478](https://insights.sbomify.com/CVE-2026-46478/): Flowise: DatasetRow create+update mass-assignment allows cross-workspace row takeover (high 7.7)
- [CVE-2026-46477](https://insights.sbomify.com/CVE-2026-46477/): Flowise: Dataset create+update mass-assignment allows cross-workspace dataset takeover (high 7.7)
- [CVE-2026-46476](https://insights.sbomify.com/CVE-2026-46476/): Flowise: CustomTemplate create+update mass-assignment allows cross-workspace template takeover (high 7.7)
- [CVE-2026-46475](https://insights.sbomify.com/CVE-2026-46475/): Flowise: Assistant create+update mass-assignment allows cross-workspace assistant takeover (high 7.7)
- [CVE-2026-46474](https://insights.sbomify.com/CVE-2026-46474/): Trog::TOTP versions before 1.006 for Perl generate secrets using rand (high 7.5)
- [CVE-2026-46473](https://insights.sbomify.com/CVE-2026-46473/): Authen::TOTP versions before 0.1.1 for Perl generate secrets using rand (high 7.5)
- [CVE-2026-46472](https://insights.sbomify.com/CVE-2026-46472/): An issue was discovered in GStreamer gst-plugins-good before 1.28.2. (high 7.5)
- [CVE-2026-46471](https://insights.sbomify.com/CVE-2026-46471/): An issue was discovered in GStreamer gst-plugins-good before 1.28.2. (medium 5.5)
- [CVE-2026-46470](https://insights.sbomify.com/CVE-2026-46470/): Denial of service in Good Plug-ins (medium 4.0)
- [CVE-2026-4647](https://insights.sbomify.com/CVE-2026-4647/): Binutils: out-of-bounds read in xcoff relocation processing in gnu binutils bfd library (medium 6.1)
- [CVE-2026-46469](https://insights.sbomify.com/CVE-2026-46469/): Denial of service in Good Plug-ins (medium 4.0)
- [CVE-2026-46468](https://insights.sbomify.com/CVE-2026-46468/): Path traversal in PowerProtect Data Domain (medium 4.4)
- [CVE-2026-46467](https://insights.sbomify.com/CVE-2026-46467/): Information disclosure in PowerProtect Data Domain (medium 5.8)
- [CVE-2026-46466](https://insights.sbomify.com/CVE-2026-46466/): Security feature bypass in PowerProtect Data Domain (low 2.7)
- [CVE-2026-46465](https://insights.sbomify.com/CVE-2026-46465/): Memory corruption in PowerProtect Data Domain (medium 5.5)
- [CVE-2026-46464](https://insights.sbomify.com/CVE-2026-46464/): Path traversal in PowerProtect Data Domain (medium 4.9)
- [CVE-2026-46463](https://insights.sbomify.com/CVE-2026-46463/): Integer overflow in PowerProtect Data Domain (medium 6.5)
- [CVE-2026-46461](https://insights.sbomify.com/CVE-2026-46461/): Privilege escalation in Server Hardware Manager (high 7.8)
- [CVE-2026-46460](https://insights.sbomify.com/CVE-2026-46460/): Missing authorization in PowerScale OneFS (low 3.5)
- [CVE-2026-4646](https://insights.sbomify.com/CVE-2026-4646/): Insufficient input validation in GitHub plugin API causes denial of service (medium 4.3)
- [CVE-2026-46459](https://insights.sbomify.com/CVE-2026-46459/): Missing Authorization in ICU Scandinavia Boomerang (medium 5.3)
- [CVE-2026-46458](https://insights.sbomify.com/CVE-2026-46458/): Credential exposure in ICU Scandinavia Boomerang (high 7.1)
- [CVE-2026-46457](https://insights.sbomify.com/CVE-2026-46457/): Apache Camel-NATS: Inbound NATS message headers are mapped into the Exchange without a configured HeaderFilterStrategy, allowing a client that can publish to the subject to inject Camel control headers (high 7.5)
- [CVE-2026-46456](https://insights.sbomify.com/CVE-2026-46456/): Apache Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message sender to inject Camel control headers (critical 9.8)
- [CVE-2026-46455](https://insights.sbomify.com/CVE-2026-46455/): Apache Camel-Keycloak: The access-token validity window is not verified because the IS_ACTIVE check is missing from the TokenVerifier, allowing expired tokens to be accepted (critical 9.8)
- [CVE-2026-46454](https://insights.sbomify.com/CVE-2026-46454/): Apache Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated clients to inject Camel control headers (critical 9.8)
- [CVE-2026-46453](https://insights.sbomify.com/CVE-2026-46453/): Apache Camel-Elasticsearch-Rest-Client: Exchange header constants without the Camel prefix bypass inbound HTTP header filtering, allowing untrusted clients to override the Elasticsearch query and operation (medium 5.3)
- [CVE-2026-46452](https://insights.sbomify.com/CVE-2026-46452/): Apache NimBLE: Mesh Proxy SAR reassembly unbounded append and unchecked failure (medium 5.3)
- [CVE-2026-46449](https://insights.sbomify.com/CVE-2026-46449/): Command injection in Guardicore Platform Agent (medium 6.7)
- [CVE-2026-46448](https://insights.sbomify.com/CVE-2026-46448/): OpenStack Nova: Nova scheduler hint injection bypasses Placement resource claims and scheduling constraints (medium 5.4)
- [CVE-2026-46447](https://insights.sbomify.com/CVE-2026-46447/): OpenStack Ironic allows Boot Script Injection (medium 5.8)
- [CVE-2026-46446](https://insights.sbomify.com/CVE-2026-46446/): SQL injection in SOGo (high 7.1)
- [CVE-2026-46445](https://insights.sbomify.com/CVE-2026-46445/): SQL injection in SOGo (high 7.1)
- [CVE-2026-46444](https://insights.sbomify.com/CVE-2026-46444/): Flowise: Vector Store No Permission Checks (high 8.7)
- [CVE-2026-46443](https://insights.sbomify.com/CVE-2026-46443/): Flowise: Credential Data Leak (high 7.0)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/611/