# Vulnerabilities published in 2026


- [CVE-2026-46442](https://insights.sbomify.com/CVE-2026-46442/): Flowise: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape (critical 9.4)
- [CVE-2026-46441](https://insights.sbomify.com/CVE-2026-46441/): Flowise: Mass Assignment in Assistant Update Endpoint Allows Cross-Workspace Resource Reassignment (high 7.6)
- [CVE-2026-46440](https://insights.sbomify.com/CVE-2026-46440/): Flowise: Basic Auth Credentials Exposed via API (high 7.5)
- [CVE-2026-4644](https://insights.sbomify.com/CVE-2026-4644/): Improper Authorization in Google Cloud Integration Connectors Leads to Project Takeover (high 8.5)
- [CVE-2026-46439](https://insights.sbomify.com/CVE-2026-46439/): compliance-trestle Vulnerable to Remote Code Execution via Recursive Server-Side Template Injection (SSTI) (high 7.8)
- [CVE-2026-46438](https://insights.sbomify.com/CVE-2026-46438/): wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry (medium 6.5)
- [CVE-2026-46437](https://insights.sbomify.com/CVE-2026-46437/): wger: API credentials remain valid after logout/password change (medium 4.8)
- [CVE-2026-46434](https://insights.sbomify.com/CVE-2026-46434/): wger: Trainer Privilege Escalation - Improper Privilege Management (high 7.1)
- [CVE-2026-46433](https://insights.sbomify.com/CVE-2026-46433/): lldpd: Heap OOB Read in VLAN Decapsulation memmove (medium 6.5)
- [CVE-2026-46432](https://insights.sbomify.com/CVE-2026-46432/): LMDeploy: Arbitrary code execution via hardcoded trust_remote_code=True in lmdeploy model initialization (high 7.8)
- [CVE-2026-46431](https://insights.sbomify.com/CVE-2026-46431/): Algernon: Auto-refresh SSE event server sets Access-Control-Allow-Origin: * (medium 4.3)
- [CVE-2026-46430](https://insights.sbomify.com/CVE-2026-46430/): Algernon: Auto-refresh SSE event server binds to all interfaces by default on Linux/macOS (medium 4.3)
- [CVE-2026-4643](https://insights.sbomify.com/CVE-2026-4643/): Calling window.close() from server-side content causes crash in the Mattermost Desktop App (low 3.5)
- [CVE-2026-46428](https://insights.sbomify.com/CVE-2026-46428/): lettre has TLS hostname verification disabled when using Boring TLS backend (critical 9.1)
- [CVE-2026-46427](https://insights.sbomify.com/CVE-2026-46427/): Budibase: Snowflake private key returned unmasked from datasource API to BASIC users (high 7.7)
- [CVE-2026-46426](https://insights.sbomify.com/CVE-2026-46426/): Budibase: Unrestricted Upload of File with Dangerous Type (high 7.6)
- [CVE-2026-46425](https://insights.sbomify.com/CVE-2026-46425/): Budibase: SCIM endpoints lack role-based authorization, BASIC users CRUD tenant users (critical 9.9)
- [CVE-2026-46424](https://insights.sbomify.com/CVE-2026-46424/): Budibase: Missing Cache Invalidation on Public API Role Unassignment Allows Revoked Users to Retain Privileges for Up to 1 Hour (medium 4.2)
- [CVE-2026-46423](https://insights.sbomify.com/CVE-2026-46423/): Rocket.Chat: SAML signature validation skipped when IdP certificate field is empty (critical 9.3)
- [CVE-2026-46421](https://insights.sbomify.com/CVE-2026-46421/): Supply chain compromise via malicious package versions (@cap-js/sqlite, @cap-js/postgres, @cap-js/db-service) (critical 9.3)
- [CVE-2026-46420](https://insights.sbomify.com/CVE-2026-46420/): setup-php: Command Injection in Repository-Derived PHP Version Resolution (medium 5.6)
- [CVE-2026-46419](https://insights.sbomify.com/CVE-2026-46419/): Auth bypass in webauthn-server-core (high 7.5)
- [CVE-2026-46417](https://insights.sbomify.com/CVE-2026-46417/): Angular: SSRF via Hostname Hijacking in @angular/platform-server (high 8.8)
- [CVE-2026-46416](https://insights.sbomify.com/CVE-2026-46416/): Microsoft UFO shared WebSocket handler state causes cross-client response hijacking (medium 6.3)
- [CVE-2026-46415](https://insights.sbomify.com/CVE-2026-46415/): Caddy Defender trusted proxy client IP bypass (high 8.2)
- [CVE-2026-46414](https://insights.sbomify.com/CVE-2026-46414/): Microsoft UFO WebSocket role spoofing allows authenticated peer task hijacking (high 8.8)
- [CVE-2026-46413](https://insights.sbomify.com/CVE-2026-46413/): Discourse: Regular users can route multipart uploads into the admin backup store (medium 6.5)
- [CVE-2026-46412](https://insights.sbomify.com/CVE-2026-46412/): Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud worm (critical 10.0)
- [CVE-2026-46411](https://insights.sbomify.com/CVE-2026-46411/): FlashMQ: Client can trigger uncaught exception on FlashMQ 1.26.1 and older (medium 6.5)
- [CVE-2026-46410](https://insights.sbomify.com/CVE-2026-46410/): FileBrowser Quantum: unauthenticated user share share info (high 8.7)
- [CVE-2026-46409](https://insights.sbomify.com/CVE-2026-46409/): OpenYak local API: unauthenticated CSRF chain leads to Remote Code Execution (critical 9.6)
- [CVE-2026-46408](https://insights.sbomify.com/CVE-2026-46408/): Vvveb: checkout IDOR allows unauthorized reuse of another user's cart (high 7.6)
- [CVE-2026-46407](https://insights.sbomify.com/CVE-2026-46407/): Vvveb: admin/auth-token IDOR allows unauthorized disclosure of administrator REST API tokens (high 8.1)
- [CVE-2026-46406](https://insights.sbomify.com/CVE-2026-46406/): Claude Code: Insecure Temporary File in /copy Command Enables Response Disclosure and Symlink-Based File Write (medium 4.4)
- [CVE-2026-46405](https://insights.sbomify.com/CVE-2026-46405/): OpenBao's Kerberos Auth Method Accumulates Unaccessible Tokens (medium 5.3)
- [CVE-2026-46404](https://insights.sbomify.com/CVE-2026-46404/): BigBlueButton: Presentation URL Security Hardening (medium 6.8)
- [CVE-2026-46403](https://insights.sbomify.com/CVE-2026-46403/): Klever-Go KVM read-only execution can commit contract delete and upgrade side effects (medium 6.3)
- [CVE-2026-46402](https://insights.sbomify.com/CVE-2026-46402/): Path traversal in UFO (high 8.1)
- [CVE-2026-46401](https://insights.sbomify.com/CVE-2026-46401/): HAX CMS PHP has Insufficient Session Expiration (medium 5.3)
- [CVE-2026-46400](https://insights.sbomify.com/CVE-2026-46400/): HAXCMS PHP has a File Upload Validation Bypass (high 8.7)
- [CVE-2026-4640](https://insights.sbomify.com/CVE-2026-4640/): Galaxy Software Services｜Vitals ESP - Missing Authentication (high 8.7)
- [CVE-2026-46399](https://insights.sbomify.com/CVE-2026-46399/): Authenticated Remote Code Execution via File Overwrite (critical 9.4)
- [CVE-2026-46398](https://insights.sbomify.com/CVE-2026-46398/): HAX CMS Missing Secure Flag on Cookie (high 8.8)
- [CVE-2026-46397](https://insights.sbomify.com/CVE-2026-46397/): haxcms-php Local File Inclusion via saveOutline API Location Parameter v2.0 (medium 6.5)
- [CVE-2026-46396](https://insights.sbomify.com/CVE-2026-46396/): HAX CMS has a stored XSS via <iframe> that allows access to sensitive client-side data and account takeover (critical 9.3)
- [CVE-2026-46395](https://insights.sbomify.com/CVE-2026-46395/): HAX CMS Vulnerable to Private Key Disclosure via Broken HMAC Implementation (critical 9.3)
- [CVE-2026-46394](https://insights.sbomify.com/CVE-2026-46394/): HAX CMS Vulnerable to Command Injection using Git.php (high 7.7)
- [CVE-2026-46393](https://insights.sbomify.com/CVE-2026-46393/): HAXcms createSite SSRF Enables Arbitrary File Read (high 7.1)
- [CVE-2026-46392](https://insights.sbomify.com/CVE-2026-46392/): HAX CMS PHP Has a Stored XSS via Case-Sensitivity Mismatch in HTML Upload Validation (high 8.7)
- [CVE-2026-46391](https://insights.sbomify.com/CVE-2026-46391/): HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis (high 8.7)
- [CVE-2026-46390](https://insights.sbomify.com/CVE-2026-46390/): HAX CMS has Unauthenticated Git Access via User-Controlled Key (medium 6.9)
- [CVE-2026-4639](https://insights.sbomify.com/CVE-2026-4639/): Galaxy Software Services｜Vitals ESP - Incorrect Authorization (high 8.7)
- [CVE-2026-46389](https://insights.sbomify.com/CVE-2026-46389/): UDS Identity Config has a client authentication bypass in `ClientIdAndKubernetesSecretAuthenticator` (critical 10.0)
- [CVE-2026-46388](https://insights.sbomify.com/CVE-2026-46388/): osquery: Unprivileged users can temporarily read file carve contents (medium 4.4)
- [CVE-2026-46387](https://insights.sbomify.com/CVE-2026-46387/): Suricata http2: decompression bomb can cause denial of service in Suricata (high 7.5)
- [CVE-2026-46386](https://insights.sbomify.com/CVE-2026-46386/): Hardcoded credentials in openproject (critical 9.9)
- [CVE-2026-46385](https://insights.sbomify.com/CVE-2026-46385/): iskorotkov/avro: CPU Exhaustion in Avro Decoder (high 8.7)
- [CVE-2026-46384](https://insights.sbomify.com/CVE-2026-46384/): iskorotkov/avro: Integer Overflow in Avro Decoder (high 8.7)
- [CVE-2026-46383](https://insights.sbomify.com/CVE-2026-46383/): Microsoft APM: Windows absolute-path tar member overwrite during legacy-bundle probing in `apm install` (medium 5.5)
- [CVE-2026-46382](https://insights.sbomify.com/CVE-2026-46382/): Meeting Room Booking System has server-side request forgery in import functionality (high 8.7)
- [CVE-2026-46380](https://insights.sbomify.com/CVE-2026-46380/): compliance-trestle Vulnerable to SSRF in Remote Fetching Subsystem (medium 6.7)
- [CVE-2026-4638](https://insights.sbomify.com/CVE-2026-4638/): Plaintext Password Disclosure via VBScript Sensor Error Message in Paessler PRTG Network Monitor (high 7.1)
- [CVE-2026-46378](https://insights.sbomify.com/CVE-2026-46378/): Dasel: Denial of service in dasel selector lexer due to infinite loop on unterminated regex literal (medium 6.2)
- [CVE-2026-46377](https://insights.sbomify.com/CVE-2026-46377/): Dasel: Index-out-of-range panic in dasel selector lexer on trailing backslash in quoted string (medium 6.2)
- [CVE-2026-46376](https://insights.sbomify.com/CVE-2026-46376/): FreePBX: Unauthenticated Use of Hard-Coded Credentials Vulnerability in FreePBX UCP Interface (critical 9.3)
- [CVE-2026-46374](https://insights.sbomify.com/CVE-2026-46374/): SQLFluff: Uncontrolled Resource Consumption in Parser (high 7.5)
- [CVE-2026-46373](https://insights.sbomify.com/CVE-2026-46373/): SQLFluff: Recursive Stack Overflow in Parser (high 7.5)
- [CVE-2026-46372](https://insights.sbomify.com/CVE-2026-46372/): SillyTavern: SSRF in SearXNG Search Proxy via Unvalidated baseUrl (high 8.5)
- [CVE-2026-46371](https://insights.sbomify.com/CVE-2026-46371/): Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint (medium 6.5)
- [CVE-2026-46370](https://insights.sbomify.com/CVE-2026-46370/): Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpoint (medium 6.5)
- [CVE-2026-4637](https://insights.sbomify.com/CVE-2026-4637/): Reflected Cross-Site Scripting via URL Path in Paessler PRTG Network Monitor (medium 5.1)
- [CVE-2026-46369](https://insights.sbomify.com/CVE-2026-46369/): Nimiq: Validity store off by one error (high 7.5)
- [CVE-2026-46368](https://insights.sbomify.com/CVE-2026-46368/): luci-app-https-dns-proxy Authenticated Command Injection via setInitAction (high 8.7)
- [CVE-2026-46367](https://insights.sbomify.com/CVE-2026-46367/): phpMyFAQ - Stored XSS via Utils::parseUrl() in Comment Rendering (high 8.3)
- [CVE-2026-46366](https://insights.sbomify.com/CVE-2026-46366/): phpMyFAQ - Unauthenticated Information Disclosure via getIdFromSolutionId Permission Bypass (high 8.7)
- [CVE-2026-46365](https://insights.sbomify.com/CVE-2026-46365/): phpMyFAQ - Missing Authorization in Tag Deletion Endpoint (medium 5.3)
- [CVE-2026-46364](https://insights.sbomify.com/CVE-2026-46364/): phpMyFAQ - SQL Injection via User-Agent Header in BuiltinCaptcha (critical 9.3)
- [CVE-2026-46363](https://insights.sbomify.com/CVE-2026-46363/): phpMyFAQ - Stored XSS in FAQ Question/Answer via Encode-Decode Bypass (medium 5.1)
- [CVE-2026-46362](https://insights.sbomify.com/CVE-2026-46362/): phpMyFAQ - Authorization Bypass in Admin Pages via Non-Terminating Permission Check (high 7.1)
- [CVE-2026-46361](https://insights.sbomify.com/CVE-2026-46361/): phpMyFAQ - Stored Cross-Site Scripting via raw Filter in search.twig (high 8.2)
- [CVE-2026-46360](https://insights.sbomify.com/CVE-2026-46360/): phpMyFAQ - Stored XSS via Entity Decoding Depth Limit Bypass in SVG Sanitizer (medium 5.1)
- [CVE-2026-4636](https://insights.sbomify.com/CVE-2026-4636/): Keycloak: keycloak: uma policy bypass allows authenticated users to gain unauthorized access to victim-owned resources. (high 8.1)
- [CVE-2026-46359](https://insights.sbomify.com/CVE-2026-46359/): phpMyFAQ - SQL Injection in CurrentUser::setTokenData via Unescaped OAuth Token Fields (high 7.7)
- [CVE-2026-46358](https://insights.sbomify.com/CVE-2026-46358/): OpenBao's Inline Auth Incorrectly Redacted Headers (medium 5.4)
- [CVE-2026-46357](https://insights.sbomify.com/CVE-2026-46357/): HAX CMS NodeJS application Vulnerable to Denial of Service using Malicious Import Request (medium 6.5)
- [CVE-2026-46356](https://insights.sbomify.com/CVE-2026-46356/): Fleet: IP spoofing allows bypassing API rate limiting (medium 6.9)
- [CVE-2026-46355](https://insights.sbomify.com/CVE-2026-46355/): BigBlueButton: Unauthenticated Session Hijack via Exposed /bigbluebutton/api/handleJoinExistingUser (high 7.1)
- [CVE-2026-46354](https://insights.sbomify.com/CVE-2026-46354/): Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft (critical 9.1)
- [CVE-2026-46353](https://insights.sbomify.com/CVE-2026-46353/): BigBlueButton API checksum bypass via presentationUploadExternalUrl (high 8.1)
- [CVE-2026-46352](https://insights.sbomify.com/CVE-2026-46352/): Suricata defrag: fragmented encapsulated traffic with fragments can lead to deadlock (high 7.5)
- [CVE-2026-46351](https://insights.sbomify.com/CVE-2026-46351/): BigBlueButton: Insecure Randomness allows to guess user's conference session token and impersonate them (high 8.1)
- [CVE-2026-4635](https://insights.sbomify.com/CVE-2026-4635/): Persistent notification timing attack causing server denial of service (medium 6.5)
- [CVE-2026-46349](https://insights.sbomify.com/CVE-2026-46349/): Mastodon: LD-Signature Bypass via JSON-LD Named-Graph Restructuring (medium 5.3)
- [CVE-2026-46348](https://insights.sbomify.com/CVE-2026-46348/): Mastodon: SSRF Bypass via IPv6 Unspecified Address (::) (high 8.7)
- [CVE-2026-46347](https://insights.sbomify.com/CVE-2026-46347/): Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Reset (medium 6.8)
- [CVE-2026-46346](https://insights.sbomify.com/CVE-2026-46346/): Goobi viewer: Predictable Password Reset Token Allows Unauthorized Password Reset (medium 6.5)
- [CVE-2026-46345](https://insights.sbomify.com/CVE-2026-46345/): compliance-trestle - jinja has an Arbitrary File Write via Path Traversal (high 8.4)
- [CVE-2026-46344](https://insights.sbomify.com/CVE-2026-46344/): liboqs: Heap-buffer-overflow in XMSS verification path via OID-controlled parameter mismatch (xmss_commons.c:194) (medium 5.3)
- [CVE-2026-46343](https://insights.sbomify.com/CVE-2026-46343/): Wazuh: Arbitrary File Deletion via Cluster Protocol – Incomplete Path Validation in end_receiving_file() (high 7.5)
- [CVE-2026-46342](https://insights.sbomify.com/CVE-2026-46342/): Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning (low 2.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/612/