# Vulnerabilities published in 2026


- [CVE-2026-45153](https://insights.sbomify.com/CVE-2026-45153/): Nextcloud: PIN bypass in PassCodeActivity via back button (medium 4.6)
- [CVE-2026-45152](https://insights.sbomify.com/CVE-2026-45152/): uniget: Command Injection in tool.Check Leading to Arbitrary Code Execution (high 7.8)
- [CVE-2026-45151](https://insights.sbomify.com/CVE-2026-45151/): NanoMQ: NULL Pointer Dereference (low 2.9)
- [CVE-2026-45150](https://insights.sbomify.com/CVE-2026-45150/): Zen Browser - Missing Fullscreen Security Notification Allows Origin Spoofing (medium 6.3)
- [CVE-2026-4515](https://insights.sbomify.com/CVE-2026-4515/): Foundation Agents MetaGPT operator.py code_generate code injection (medium 5.3)
- [CVE-2026-45149](https://insights.sbomify.com/CVE-2026-45149/): brace-expansion: Large numeric range defeats documented `max` DoS protection (medium 6.5)
- [CVE-2026-45148](https://insights.sbomify.com/CVE-2026-45148/): SiYuan: Broken access control in SiYuan publish-mode Readers can enumerate metadata (medium 4.3)
- [CVE-2026-45147](https://insights.sbomify.com/CVE-2026-45147/): SiYuan: Broken access control in SiYuan `/api/tag/getTag` — Reader role can mutate `Conf.Tag.Sort` and persist to disk (medium 4.3)
- [CVE-2026-45143](https://insights.sbomify.com/CVE-2026-45143/): Chamilo LMS: Student-to-admin stored XSS in private messages via v-html (critical 9.0)
- [CVE-2026-45140](https://insights.sbomify.com/CVE-2026-45140/): Chamilo LMS CStudio upload flow allows unauthenticated remote code execution (critical 9.8)
- [CVE-2026-4514](https://insights.sbomify.com/CVE-2026-4514/): PbootCMS Backend UserController.php access control (medium 5.3)
- [CVE-2026-45139](https://insights.sbomify.com/CVE-2026-45139/): CI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operations (medium 6.5)
- [CVE-2026-45138](https://insights.sbomify.com/CVE-2026-45138/): CI4MS: Stored XSS in Blog Content via Broken `html_purify` Validation Rule (medium 5.4)
- [CVE-2026-45137](https://insights.sbomify.com/CVE-2026-45137/): Anchor: Program<'info, System> is not properly validated (high 8.2)
- [CVE-2026-45136](https://insights.sbomify.com/CVE-2026-45136/): claude-code-cache-fix: Local code execution via Python triple-quote injection in tools/quota-statusline.sh (high 8.6)
- [CVE-2026-45135](https://insights.sbomify.com/CVE-2026-45135/): Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files (high 8.1)
- [CVE-2026-45134](https://insights.sbomify.com/CVE-2026-45134/): LangSmith Client SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning (high 7.1)
- [CVE-2026-45133](https://insights.sbomify.com/CVE-2026-45133/): Symfony: [Yaml] Harden the parser when handling untrusted input (high 8.2)
- [CVE-2026-45132](https://insights.sbomify.com/CVE-2026-45132/): Information disclosure in helm-charts (critical 10.0)
- [CVE-2026-45131](https://insights.sbomify.com/CVE-2026-45131/): Code injection in helm-charts (critical 10.0)
- [CVE-2026-45130](https://insights.sbomify.com/CVE-2026-45130/): Vim: Heap Buffer Overflow in spell file loading (medium 6.6)
- [CVE-2026-4513](https://insights.sbomify.com/CVE-2026-4513/): vanna-ai vanna base.py ask sql injection (medium 5.3)
- [CVE-2026-45129](https://insights.sbomify.com/CVE-2026-45129/): MyBB: ACP Recovery Codes CSRF (medium 4.6)
- [CVE-2026-45128](https://insights.sbomify.com/CVE-2026-45128/): MyBB: ACP Users View Manager default CSRF (low 3.5)
- [CVE-2026-45127](https://insights.sbomify.com/CVE-2026-45127/): MyBB: ACP Mass Mail draft resend CSRF (low 3.5)
- [CVE-2026-45126](https://insights.sbomify.com/CVE-2026-45126/): MyBB: ACP Questions state CSRF (low 3.5)
- [CVE-2026-45125](https://insights.sbomify.com/CVE-2026-45125/): MyBB: Email User CRLF injection (medium 5.3)
- [CVE-2026-45124](https://insights.sbomify.com/CVE-2026-45124/): MyBB: Mod CP report resolution missing authorization (medium 4.3)
- [CVE-2026-45123](https://insights.sbomify.com/CVE-2026-45123/): MyBB: IPv6 SSRF (medium 4.3)
- [CVE-2026-45122](https://insights.sbomify.com/CVE-2026-45122/): MyBB: Insufficient permission check for calendar event move (medium 4.3)
- [CVE-2026-45121](https://insights.sbomify.com/CVE-2026-45121/): MyBB: Insufficient permission check for calendar select (medium 4.3)
- [CVE-2026-45120](https://insights.sbomify.com/CVE-2026-45120/): MyBB: Insufficient authorization for private calendar events (medium 5.4)
- [CVE-2026-4512](https://insights.sbomify.com/CVE-2026-4512/): WP reCaptcha by WebDesignBy < 2.0 – Admin+ Stored XSS (low 3.5)
- [CVE-2026-45119](https://insights.sbomify.com/CVE-2026-45119/): MyBB: ACP UTF-8 Conversion CSRF (medium 4.6)
- [CVE-2026-45118](https://insights.sbomify.com/CVE-2026-45118/): MyBB: Contact page reflected XSS (critical 9.3)
- [CVE-2026-45117](https://insights.sbomify.com/CVE-2026-45117/): MyBB: Installer database configuration RCE (critical 9.8)
- [CVE-2026-45116](https://insights.sbomify.com/CVE-2026-45116/): MyBB: Profile field type confusion XSS (high 8.7)
- [CVE-2026-45115](https://insights.sbomify.com/CVE-2026-45115/): MyBB: Buddy/ignore list username XSS (high 8.7)
- [CVE-2026-45112](https://insights.sbomify.com/CVE-2026-45112/): Apache Thrift: Unbounded Read Leading to Denial of Service (medium 6.9)
- [CVE-2026-4511](https://insights.sbomify.com/CVE-2026-4511/): vanna-ai vanna legacy exec injection (medium 5.3)
- [CVE-2026-45109](https://insights.sbomify.com/CVE-2026-45109/): Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes (high 7.5)
- [CVE-2026-45108](https://insights.sbomify.com/CVE-2026-45108/): Himmelblau: Authentication Bypass via Cross-User Local Session Impersonation in Device Authorization Grant (DAG) Flow (high 8.4)
- [CVE-2026-45106](https://insights.sbomify.com/CVE-2026-45106/): Weblate: Stored HTML injection in editor search preview (medium 4.6)
- [CVE-2026-45104](https://insights.sbomify.com/CVE-2026-45104/): MapServer: NULL pointer dereference in SLD `<ElseFilter>` rule parsing reachable via WMS `SLD_BODY` (high 7.5)
- [CVE-2026-45103](https://insights.sbomify.com/CVE-2026-45103/): OpenSIPS: SIP Message Smuggling via TCP Content-Length Integer Overflow (high 7.5)
- [CVE-2026-45102](https://insights.sbomify.com/CVE-2026-45102/): OneUptime: RCE due to Node.js' vm module escape via error objects and infinite recursion (critical 9.9)
- [CVE-2026-45100](https://insights.sbomify.com/CVE-2026-45100/): OpenSIPS: Buffer Overflow in Base64 Encode Transformation (critical 9.1)
- [CVE-2026-4510](https://insights.sbomify.com/CVE-2026-4510/): PbootCMS Parameter MemberController.php alert_location cross site scripting (medium 5.3)
- [CVE-2026-45099](https://insights.sbomify.com/CVE-2026-45099/): Terragrunt: Arbitrary File Deletion via Malicious Module Manifest (medium 6.9)
- [CVE-2026-45091](https://insights.sbomify.com/CVE-2026-45091/): sealed-env: TOTP secret embedded in unseal token payload (enterprise mode) (critical 9.1)
- [CVE-2026-45090](https://insights.sbomify.com/CVE-2026-45090/): Dalfox: Unauthenticated Remote DoS via Closed-Channel Write in `ParameterAnalysis` (server mode) (high 7.5)
- [CVE-2026-4509](https://insights.sbomify.com/CVE-2026-4509/): PbootCMS File Upload file.php incomplete blacklist (medium 5.3)
- [CVE-2026-45089](https://insights.sbomify.com/CVE-2026-45089/): Dalfox: Unauthenticated Arbitrary File Create/Append via `output` Option in Dalfox Server Mode (high 8.2)
- [CVE-2026-45088](https://insights.sbomify.com/CVE-2026-45088/): Dalfox Server Mode has an Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via `custom-payload-file` (high 7.5)
- [CVE-2026-45087](https://insights.sbomify.com/CVE-2026-45087/): Dalfox: Unauthenticated Remote Code Execution via `found-action` in Dalfox Server Mode (critical 10.0)
- [CVE-2026-45086](https://insights.sbomify.com/CVE-2026-45086/): Decidim: Forms admin question editor lacks authorization (medium 5.4)
- [CVE-2026-45085](https://insights.sbomify.com/CVE-2026-45085/): Discourse: Chat misauthorization and information disclosure (medium 5.3)
- [CVE-2026-45084](https://insights.sbomify.com/CVE-2026-45084/): OpenSIPS: Denial of service in presence.handle_publish() from unchecked Content-Type state (high 8.7)
- [CVE-2026-45083](https://insights.sbomify.com/CVE-2026-45083/): Goobi viewer: Unauthenticated Solr Streaming Expression Proxy (critical 9.8)
- [CVE-2026-45082](https://insights.sbomify.com/CVE-2026-45082/): Karakeep has a SSRF Protection Bypass via Redirect Handling (high 7.6)
- [CVE-2026-45081](https://insights.sbomify.com/CVE-2026-45081/): Frappe HR: Permission Bypass in HRMS Leave Details API (medium 6.5)
- [CVE-2026-45080](https://insights.sbomify.com/CVE-2026-45080/): Klaw: Improper Access Control Allows Disclosure of Password Hash (medium 6.9)
- [CVE-2026-4508](https://insights.sbomify.com/CVE-2026-4508/): PbootCMS Member Login MemberController.php checkUsername sql injection (medium 6.9)
- [CVE-2026-45078](https://insights.sbomify.com/CVE-2026-45078/): Synapse CPU starvation (Denial of Service) (medium 6.8)
- [CVE-2026-45077](https://insights.sbomify.com/CVE-2026-45077/): Symfony: Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener (high 8.3)
- [CVE-2026-45076](https://insights.sbomify.com/CVE-2026-45076/): Synapse pagination denial of service (medium 5.1)
- [CVE-2026-45075](https://insights.sbomify.com/CVE-2026-45075/): Symfony: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid] (high 8.3)
- [CVE-2026-45074](https://insights.sbomify.com/CVE-2026-45074/): Symfony: Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay (high 7.6)
- [CVE-2026-45073](https://insights.sbomify.com/CVE-2026-45073/): Symfony: SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix (medium 6.3)
- [CVE-2026-45072](https://insights.sbomify.com/CVE-2026-45072/): Symfony: Stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering (low 2.0)
- [CVE-2026-45071](https://insights.sbomify.com/CVE-2026-45071/): Symfony: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true (high 8.7)
- [CVE-2026-45070](https://insights.sbomify.com/CVE-2026-45070/): Symfony: Email Header Injection via Non-Token Characters in Mime Parameter Names (medium 6.3)
- [CVE-2026-4507](https://insights.sbomify.com/CVE-2026-4507/): Mindinventory MindSQL mindsql_core.py ask_db sql injection (medium 5.3)
- [CVE-2026-45069](https://insights.sbomify.com/CVE-2026-45069/): Symfony: OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims (high 8.8)
- [CVE-2026-45068](https://insights.sbomify.com/CVE-2026-45068/): Symfony: Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address (high 8.7)
- [CVE-2026-45067](https://insights.sbomify.com/CVE-2026-45067/): Symfony: Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address (medium 6.3)
- [CVE-2026-45066](https://insights.sbomify.com/CVE-2026-45066/): Symfony has an HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification (low 2.3)
- [CVE-2026-45065](https://insights.sbomify.com/CVE-2026-45065/): Symfony: UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection (low 2.3)
- [CVE-2026-45064](https://insights.sbomify.com/CVE-2026-45064/): Symfony: HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing (low 2.3)
- [CVE-2026-45063](https://insights.sbomify.com/CVE-2026-45063/): Symfony: Identity Spoofing via Unanchored DN Regex in X509Authenticator (critical 9.1)
- [CVE-2026-45062](https://insights.sbomify.com/CVE-2026-45062/): FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files (high 8.1)
- [CVE-2026-45061](https://insights.sbomify.com/CVE-2026-45061/): Budibase: SSRF via trivial `.tar.gz` substring bypass in Plugin URL upload (`/api/plugin`) (high 7.7)
- [CVE-2026-45060](https://insights.sbomify.com/CVE-2026-45060/): ClipBucket: Blind SQL Injection in progress_video.php (critical 9.8)
- [CVE-2026-4506](https://insights.sbomify.com/CVE-2026-4506/): Mindinventory MindSQL mindsql_core.py ask_db code injection (medium 5.3)
- [CVE-2026-45058](https://insights.sbomify.com/CVE-2026-45058/): electerm: Import unsafe bookmark data could lead to unsafe operation when click local type bookmark (critical 9.4)
- [CVE-2026-45057](https://insights.sbomify.com/CVE-2026-45057/): matrix-sdk-ui: Incomplete edit validation (medium 4.9)
- [CVE-2026-45056](https://insights.sbomify.com/CVE-2026-45056/): Matrix Rust SDK: Sender-binding gaps in to-device and room-key attribution (medium 6.9)
- [CVE-2026-45055](https://insights.sbomify.com/CVE-2026-45055/): CubeCart: Pre-Authenticated Password Reset Link Poisoning via HTTP Host Header (high 8.1)
- [CVE-2026-45054](https://insights.sbomify.com/CVE-2026-45054/): CubeCart: Authenticated SQL Injection via `sort[]` Parameter in Admin Orders Transactions Listing (medium 4.9)
- [CVE-2026-45053](https://insights.sbomify.com/CVE-2026-45053/): CubeCart: Authenticated Arbitrary File Upload to RCE in REST Files API (critical 9.1)
- [CVE-2026-45052](https://insights.sbomify.com/CVE-2026-45052/): OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints (critical 9.3)
- [CVE-2026-45051](https://insights.sbomify.com/CVE-2026-45051/): OpenAM Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage (critical 9.2)
- [CVE-2026-4505](https://insights.sbomify.com/CVE-2026-4505/): eosphoros-ai DB-GPT FastAPI Endpoint controller.py module_plugin.refresh_plugins unrestricted upload (medium 5.3)
- [CVE-2026-45049](https://insights.sbomify.com/CVE-2026-45049/): OpenAM Session Hijacking via CDSSO (high 8.3)
- [CVE-2026-45048](https://insights.sbomify.com/CVE-2026-45048/): OpenAM Authenticated Privilege Escalation via Raw Token Disclosure Session RPC (high 8.5)
- [CVE-2026-45047](https://insights.sbomify.com/CVE-2026-45047/): bird-lg-go: Fatal Out-of-Memory (OOM) Denial of Service via Unbounded JSON Decoding (high 7.5)
- [CVE-2026-45046](https://insights.sbomify.com/CVE-2026-45046/): Gryph Agents Payload Filter Fails to Strip Tool Payload for Sensitive Content (medium 5.5)
- [CVE-2026-45045](https://insights.sbomify.com/CVE-2026-45045/): Fiber: X-Real-IP Spoofing via Header.Add() in BalancerForward (medium 5.3)
- [CVE-2026-45044](https://insights.sbomify.com/CVE-2026-45044/): RustFS: Authentication bypass in /profile/cpu and /profile/memory allows unauthenticated access to profiling handlers (high 8.8)
- [CVE-2026-45043](https://insights.sbomify.com/CVE-2026-45043/): RustFS: ImportIam Allows Creation of Backdoor Service Accounts Under Any Parent Including Root (critical 9.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/625/