# Vulnerabilities published in 2026


- [CVE-2026-45779](https://insights.sbomify.com/CVE-2026-45779/): Open XDMoD Vulnerable to Unauthenticated SQL Injection Leading to Full Database Compromise (critical 9.3)
- [CVE-2026-45778](https://insights.sbomify.com/CVE-2026-45778/): Open XDMoD Vulnerable to Reflected Cross-Site Scripting (XSS) in Password Reset (high 8.6)
- [CVE-2026-45777](https://insights.sbomify.com/CVE-2026-45777/): Open XDMoD Vulnerable to Unauthenticated Remote Code Execution (RCE) via OS Command Injection (critical 9.3)
- [CVE-2026-45776](https://insights.sbomify.com/CVE-2026-45776/): Open XDMoD has Broken Access Control via Client-Controlled Session Variable (medium 5.3)
- [CVE-2026-45775](https://insights.sbomify.com/CVE-2026-45775/): Discourse: Cross-site backup access via path traversal in multisite local backups (medium 6.8)
- [CVE-2026-45774](https://insights.sbomify.com/CVE-2026-45774/): compliance-trestle Profile Import has an Arbitrary File Read via trestle:// URI and Relative Path Traversal (medium 6.9)
- [CVE-2026-45773](https://insights.sbomify.com/CVE-2026-45773/): Turborepo: Login callback CSRF/session fixation (medium 5.1)
- [CVE-2026-45772](https://insights.sbomify.com/CVE-2026-45772/): Turborepo: Unexpected local code execution during Yarn Berry detection (not scored)
- [CVE-2026-45771](https://insights.sbomify.com/CVE-2026-45771/): Freeswitch Denial-of-Service in SIP PUBLISH Requests via XML Entity Expansion (high 7.5)
- [CVE-2026-45770](https://insights.sbomify.com/CVE-2026-45770/): Suricata lua: excessive flow variable registration can bypass sandbox (high 7.5)
- [CVE-2026-4577](https://insights.sbomify.com/CVE-2026-4577/): code-projects Exam Form Submission update_s4.php cross site scripting (medium 4.8)
- [CVE-2026-45769](https://insights.sbomify.com/CVE-2026-45769/): ikev2: unbounded client transform storage can lead to resource exhaustion (high 7.5)
- [CVE-2026-45768](https://insights.sbomify.com/CVE-2026-45768/): Suricata ldap: unbounded responses per transaction can lead to resource exhaustion (high 7.5)
- [CVE-2026-45767](https://insights.sbomify.com/CVE-2026-45767/): Suricata datasets: save to absolute filename can be bypassed when combined with load command (medium 4.4)
- [CVE-2026-45766](https://insights.sbomify.com/CVE-2026-45766/): Suricata nfs: unbounded stateful structures can lead to resource exhaustion (high 7.5)
- [CVE-2026-45765](https://insights.sbomify.com/CVE-2026-45765/): Suricata dnp3: unbounded reassembly can lead to resource exhaustion (high 7.5)
- [CVE-2026-45764](https://insights.sbomify.com/CVE-2026-45764/): Suricata http2: protocol-change type confusion can lead to denial of service (critical 9.1)
- [CVE-2026-45763](https://insights.sbomify.com/CVE-2026-45763/): Suricata lua: sandbox allocation limit not enforced for new allocations (medium 5.9)
- [CVE-2026-45762](https://insights.sbomify.com/CVE-2026-45762/): Suricata defrag: missing address-family check can lead to remote crash (high 7.5)
- [CVE-2026-45761](https://insights.sbomify.com/CVE-2026-45761/): Suricata detect: case-insensitive frame handling can cause heap buffer overflow during rule load (low 3.3)
- [CVE-2026-45760](https://insights.sbomify.com/CVE-2026-45760/): Apache Camel K: Camel K Cross-Namespace Build Deputy Attack (high 8.1)
- [CVE-2026-4576](https://insights.sbomify.com/CVE-2026-4576/): code-projects Exam Form Submission update_s5.php cross site scripting (medium 4.8)
- [CVE-2026-45759](https://insights.sbomify.com/CVE-2026-45759/): Suricata http1: quadratic Content-Disposition processing can lead to denial of service (high 7.5)
- [CVE-2026-45758](https://insights.sbomify.com/CVE-2026-45758/): Malicious code in guardrails-ai 0.10.1 (supply chain compromise) (critical 9.6)
- [CVE-2026-45757](https://insights.sbomify.com/CVE-2026-45757/): Rocket.Chat: users.deactivateIdle` deactivates accounts without revoking existing login tokens (low 2.3)
- [CVE-2026-45756](https://insights.sbomify.com/CVE-2026-45756/): Symfony: JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoS (high 8.2)
- [CVE-2026-45755](https://insights.sbomify.com/CVE-2026-45755/): Symfony's Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection (medium 6.9)
- [CVE-2026-45754](https://insights.sbomify.com/CVE-2026-45754/): Symfony: Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection (medium 6.9)
- [CVE-2026-45753](https://insights.sbomify.com/CVE-2026-45753/): Symfony's HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — `javascript`: URI Survives Sanitization (XSS) (low 2.1)
- [CVE-2026-45752](https://insights.sbomify.com/CVE-2026-45752/): Suricata detect/transform: use-after-free in decompress transforms (medium 5.9)
- [CVE-2026-45751](https://insights.sbomify.com/CVE-2026-45751/): Suricata detect/transform: use-after-free in dotprefix transform (medium 5.9)
- [CVE-2026-45750](https://insights.sbomify.com/CVE-2026-45750/): Termix Vulnerable to Arbitrary Command Execution in File Manager (critical 9.0)
- [CVE-2026-4575](https://insights.sbomify.com/CVE-2026-4575/): code-projects Exam Form Submission update_s2.php cross site scripting (medium 4.8)
- [CVE-2026-45749](https://insights.sbomify.com/CVE-2026-45749/): Termix's TOTP two-factor authentication can be disabled or bypassed using only the account password (high 8.1)
- [CVE-2026-45748](https://insights.sbomify.com/CVE-2026-45748/): Termix Vulnerable to Remote Code Execution via SSH Tunnel Forward Command Injection (critical 9.8)
- [CVE-2026-45747](https://insights.sbomify.com/CVE-2026-45747/): Suricata lua/tls: null dereference in TlsGetCertInfo (high 7.5)
- [CVE-2026-45746](https://insights.sbomify.com/CVE-2026-45746/): Termix Vulnerable to Arbitrary Command Execution via Session Hijacking (critical 9.0)
- [CVE-2026-45745](https://insights.sbomify.com/CVE-2026-45745/): Termix has improper certificate validation in Electron desktop client that enables MITM credential/token theft (high 8.0)
- [CVE-2026-45744](https://insights.sbomify.com/CVE-2026-45744/): Termix has an OS Command Injection in File Manager resolvePath endpoint (critical 9.9)
- [CVE-2026-45743](https://insights.sbomify.com/CVE-2026-45743/): Termix has a File-Manager Session Hijack via Missing Ownership Check (IDOR) (high 8.1)
- [CVE-2026-45742](https://insights.sbomify.com/CVE-2026-45742/): Gotenberg: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') (high 7.5)
- [CVE-2026-45741](https://insights.sbomify.com/CVE-2026-45741/): Gotenberg: SSRF deny-list bypass in IsPublicIP via IPv6 6to4 / NAT64 / site-local prefixes (high 7.5)
- [CVE-2026-45740](https://insights.sbomify.com/CVE-2026-45740/): protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion (medium 5.3)
- [CVE-2026-4574](https://insights.sbomify.com/CVE-2026-4574/): SourceCodester Simple E-learning System User Profile Update sql injection (medium 5.3)
- [CVE-2026-45739](https://insights.sbomify.com/CVE-2026-45739/): Strawberry GraphQL: Default GraphiQL may expose HTTP headers in URLs (low 3.1)
- [CVE-2026-45738](https://insights.sbomify.com/CVE-2026-45738/): Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation (high 7.3)
- [CVE-2026-45737](https://insights.sbomify.com/CVE-2026-45737/): Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations (medium 6.3)
- [CVE-2026-45736](https://insights.sbomify.com/CVE-2026-45736/): ws: Uninitialized memory disclosure (medium 4.4)
- [CVE-2026-45734](https://insights.sbomify.com/CVE-2026-45734/): MyBB: Default CAPTCHA missing invalidation (medium 5.3)
- [CVE-2026-45733](https://insights.sbomify.com/CVE-2026-45733/): Trilium: Stored XSS in note icon rendering leads to Remote Code Execution in Electron desktop app (high 8.3)
- [CVE-2026-45732](https://insights.sbomify.com/CVE-2026-45732/): n8n: Cross-user Authorization Bypass in Dynamic Credential OAuth Endpoints (high 8.3)
- [CVE-2026-45731](https://insights.sbomify.com/CVE-2026-45731/): WWBN AVideo: Authenticated Arbitrary File Read in view/update.php (medium 6.9)
- [CVE-2026-45730](https://insights.sbomify.com/CVE-2026-45730/): Nuclio: Missing authorization on project write paths allows any authenticated user to modify or delete any project (high 8.3)
- [CVE-2026-4573](https://insights.sbomify.com/CVE-2026-4573/): SourceCodester Simple E-learning System HTTP GET Parameter delete_post.php sql injection (medium 5.3)
- [CVE-2026-45729](https://insights.sbomify.com/CVE-2026-45729/): ThorVG: Null pointer dereference in SVG loader causes crash via 6-byte malformed input (medium 4.3)
- [CVE-2026-45728](https://insights.sbomify.com/CVE-2026-45728/): Algernon: Single-file mode unconditionally enables debug mode (high 7.5)
- [CVE-2026-45727](https://insights.sbomify.com/CVE-2026-45727/): CloakBrowser: Unauthenticated path traversal via fingerprint parameter in cloakserve leads to arbitrary directory deletion (high 8.8)
- [CVE-2026-45726](https://insights.sbomify.com/CVE-2026-45726/): Omni: Reader-level users can retrieve imported cluster CA keys via ResourceService (high 7.6)
- [CVE-2026-45725](https://insights.sbomify.com/CVE-2026-45725/): compliance-trestle Remote Fetching Mechanism has an Arbitrary File Write via Cache Path Traversal (high 7.1)
- [CVE-2026-45723](https://insights.sbomify.com/CVE-2026-45723/): Omni: Operator can traverse image-factory API paths via unsanitized `talos_version` in CreateSchematic (low 2.7)
- [CVE-2026-45722](https://insights.sbomify.com/CVE-2026-45722/): Nextcloud: Tables app allows limited SQLi in ORDER BY with malicious sort order argument for Table Views (high 7.1)
- [CVE-2026-45721](https://insights.sbomify.com/CVE-2026-45721/): Algernon: handler.lua discovery walks parent directories above the server root (critical 9.0)
- [CVE-2026-45720](https://insights.sbomify.com/CVE-2026-45720/): Omni: TOCTOU race condition allows multiple concurrent uses of a single-use SAML session token (high 7.0)
- [CVE-2026-4572](https://insights.sbomify.com/CVE-2026-4572/): SourceCodester Sales and Inventory System HTTP POST Request view_product.php sql injection (medium 5.3)
- [CVE-2026-45719](https://insights.sbomify.com/CVE-2026-45719/): Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API (medium 6.5)
- [CVE-2026-45718](https://insights.sbomify.com/CVE-2026-45718/): Budibase: Row Action Trigger Bypasses View Row Filter Security Boundary Allowing Action on Out-of-Scope Rows (medium 5.4)
- [CVE-2026-45717](https://insights.sbomify.com/CVE-2026-45717/): Budibase: `PUT /api/datasources/:datasourceId` is protected only by `TABLE/READ` permission instead of builder access, allowing any authenticated app user to overwrite datasource connection parameters including host, port, and URL (high 8.8)
- [CVE-2026-45716](https://insights.sbomify.com/CVE-2026-45716/): Budibase: Builder-to-Admin Privilege Escalation via onboardUsers Endpoint Without SMTP Configuration (high 8.8)
- [CVE-2026-45715](https://insights.sbomify.com/CVE-2026-45715/): Budibase: SSRF Bypass via HTTP Redirect in REST Datasource Integration (high 7.7)
- [CVE-2026-45714](https://insights.sbomify.com/CVE-2026-45714/): CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE (critical 9.1)
- [CVE-2026-45713](https://insights.sbomify.com/CVE-2026-45713/): Mailpit: Unauthenticated remote memory-exhaustion DoS via unlimited SMTP DATA and /api/v1/send body sizes (high 7.5)
- [CVE-2026-45712](https://insights.sbomify.com/CVE-2026-45712/): Mailpit: Concurrent map read & write in proxy CSS rewriter - remote unauth crash (fatal error: concurrent map read and map write) (medium 5.9)
- [CVE-2026-45711](https://insights.sbomify.com/CVE-2026-45711/): Mailpit: Path traversal & arbitrary file write in mailpit dump --http via attacker-controlled message IDs (medium 5.9)
- [CVE-2026-4571](https://insights.sbomify.com/CVE-2026-4571/): SourceCodester Sales and Inventory System HTTP POST Request view_payments.php sql injection (medium 5.3)
- [CVE-2026-45709](https://insights.sbomify.com/CVE-2026-45709/): Mailpit has an incomplete fix for GHSA-6jxm: HTML check still permits SSRF to private/loopback/IMDS via missing IP-filter dialer (medium 5.8)
- [CVE-2026-45708](https://insights.sbomify.com/CVE-2026-45708/): CubeCart: Authenticated RCE via Invoice Template → Order Print (high 7.2)
- [CVE-2026-45707](https://insights.sbomify.com/CVE-2026-45707/): n8n-MCP: Multi-tenant MCP requests fall back to process-level n8n credentials when tenant headers are absent or incomplete (high 8.1)
- [CVE-2026-45705](https://insights.sbomify.com/CVE-2026-45705/): OpenSIPS: OOB Read in Multipart Body Boundary Parsing (medium 5.3)
- [CVE-2026-45704](https://insights.sbomify.com/CVE-2026-45704/): Pimcore: CustomReports Share Bypass (high 7.1)
- [CVE-2026-45703](https://insights.sbomify.com/CVE-2026-45703/): Pimcore: WordExport Authorization Bypass for Unauthorized Document Export (medium 6.4)
- [CVE-2026-45702](https://insights.sbomify.com/CVE-2026-45702/): OP-TEE has FF-A type confusion in SPMC tmem path that causes S-EL1 kernel panic (medium 4.4)
- [CVE-2026-45701](https://insights.sbomify.com/CVE-2026-45701/): Sulu: Weak Cryptographical usage for API Key generation and Reset Tokens (medium 6.9)
- [CVE-2026-45700](https://insights.sbomify.com/CVE-2026-45700/): Heap-buffer-overflow write in planar bitmap decoder (high 7.7)
- [CVE-2026-4570](https://insights.sbomify.com/CVE-2026-4570/): SourceCodester Sales and Inventory System HTTP POST Request view_customers.php sql injection (medium 5.3)
- [CVE-2026-45699](https://insights.sbomify.com/CVE-2026-45699/): Netatalk has Integer Underflow → Stack Buffer Overflow in copydir() (high 7.5)
- [CVE-2026-45698](https://insights.sbomify.com/CVE-2026-45698/): Netatalk has Integer Underflow → Stack Buffer Overflow in deletedir() (high 7.5)
- [CVE-2026-45697](https://insights.sbomify.com/CVE-2026-45697/): Formie: Pre-authenticated server-side template injection in Hidden fields (critical 9.8)
- [CVE-2026-45696](https://insights.sbomify.com/CVE-2026-45696/): OpenEXR HTJ2K decoder heap buffer over-read in ht_undo_impl() (DoS) (high 8.3)
- [CVE-2026-45695](https://insights.sbomify.com/CVE-2026-45695/): Kopia: Unauthenticated RCE via SSH ProxyCommand Injection when --insecure --without-password is used (critical 9.8)
- [CVE-2026-45694](https://insights.sbomify.com/CVE-2026-45694/): LibreNMS: Reflected XSS in the Proxmox app view via unsanitized instance/vmid parameters (medium 5.4)
- [CVE-2026-45692](https://insights.sbomify.com/CVE-2026-45692/): Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization (medium 5.4)
- [CVE-2026-45691](https://insights.sbomify.com/CVE-2026-45691/): Nextcloud: Bypass of second factor authentication on DAV endpoints (medium 5.9)
- [CVE-2026-45690](https://insights.sbomify.com/CVE-2026-45690/): Nextcloud: Two-Factor Authentication Bypass via Pending Session Token Replay (medium 5.9)
- [CVE-2026-4569](https://insights.sbomify.com/CVE-2026-4569/): SourceCodester Sales and Inventory System HTTP POST Request view_category.php sql injection (medium 5.3)
- [CVE-2026-45689](https://insights.sbomify.com/CVE-2026-45689/): Rocket.Chat: Pre-Auth NoSQL Injection in OAuth2 Token Endpoint leading to Arbitrary User ATO (critical 9.1)
- [CVE-2026-45688](https://insights.sbomify.com/CVE-2026-45688/): Rocket.Chat: Pre-Auth NoSQL Injection in CAS Login Handler leading to Arbitrary CAS/SAML User Session Hijack (critical 9.1)
- [CVE-2026-45687](https://insights.sbomify.com/CVE-2026-45687/): Rocket.Chat: Authenticated Arbitrary Data Export Theft via Mass Assignment in sendFileMessage (high 8.5)
- [CVE-2026-45686](https://insights.sbomify.com/CVE-2026-45686/): OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI (high 7.5)
- [CVE-2026-45685](https://insights.sbomify.com/CVE-2026-45685/): OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages (high 7.5)
- [CVE-2026-45684](https://insights.sbomify.com/CVE-2026-45684/): OpenTelemetry eBPF Instrumentation: Log enricher writev path can overread and overwrite user buffers (medium 4.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/619/