# Vulnerabilities published in 2026


- [CVE-2026-44414](https://insights.sbomify.com/CVE-2026-44414/): Other in Industrial Edge Cloud Device (IECD) (medium 6.9)
- [CVE-2026-44413](https://insights.sbomify.com/CVE-2026-44413/): Missing authorization in TeamCity (high 8.2)
- [CVE-2026-44412](https://insights.sbomify.com/CVE-2026-44412/): Memory corruption in Solid Edge SE2026 (high 7.3)
- [CVE-2026-44411](https://insights.sbomify.com/CVE-2026-44411/): Memory corruption in Solid Edge SE2026 (high 7.3)
- [CVE-2026-44410](https://insights.sbomify.com/CVE-2026-44410/): Function Abusement Vulnerability in ZTE ZXUniPOS NDS-LTE (low 3.8)
- [CVE-2026-4441](https://insights.sbomify.com/CVE-2026-4441/): Use after free in Chrome (high 8.8)
- [CVE-2026-44409](https://insights.sbomify.com/CVE-2026-44409/): Information disclosure vulnerability in ZTE MU5250 (medium 5.7)
- [CVE-2026-44408](https://insights.sbomify.com/CVE-2026-44408/): Unauthorized access vulnerability in ZTE MU5250 (medium 6.3)
- [CVE-2026-44407](https://insights.sbomify.com/CVE-2026-44407/): Remote Denial of Service Vulnerability Exists in ZTE Cloud PC Client uSmartview (medium 4.7)
- [CVE-2026-44406](https://insights.sbomify.com/CVE-2026-44406/): DLL Hijacking Vulnerability in ZTE Cloud PC Client uSmartview (medium 5.7)
- [CVE-2026-44405](https://insights.sbomify.com/CVE-2026-44405/): Paramiko rsakey.py allows the SHA-1 algorithm (low 3.4)
- [CVE-2026-44403](https://insights.sbomify.com/CVE-2026-44403/): Wing FTP Server < 8.1.3 Authenticated Remote Code Execution via Session Serialization (high 8.6)
- [CVE-2026-44402](https://insights.sbomify.com/CVE-2026-44402/): Voltronic Power SNMP Web Pro 1.1 Unauthenticated RCE via upload.cgi (critical 9.3)
- [CVE-2026-44401](https://insights.sbomify.com/CVE-2026-44401/): Typemill CMS 2.x Persistent XSS via Markdown javascript URI (medium 4.6)
- [CVE-2026-44400](https://insights.sbomify.com/CVE-2026-44400/): MailEnable Enterprise Premium < 10.55 Authorization Bypass via WebAdmin (high 8.7)
- [CVE-2026-4440](https://insights.sbomify.com/CVE-2026-4440/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-44394](https://insights.sbomify.com/CVE-2026-44394/): OpenStack Keystone's federated token rescoping mechanism doesn't propagate the original token's expiry to the newly issued token (medium 6.0)
- [CVE-2026-44393](https://insights.sbomify.com/CVE-2026-44393/): OpenStack oslo.messaging does not verify RabbitMQ broker hostname during TLS handshake (high 7.4)
- [CVE-2026-44392](https://insights.sbomify.com/CVE-2026-44392/): Missing authorization in Movable Type (medium 5.3)
- [CVE-2026-44390](https://insights.sbomify.com/CVE-2026-44390/): Unbounded name compression in certain cases causes degradation of service (medium 6.9)
- [CVE-2026-4439](https://insights.sbomify.com/CVE-2026-4439/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-44387](https://insights.sbomify.com/CVE-2026-44387/): Cross-site scripting in WAB-I1750-PS (medium 5.1)
- [CVE-2026-44383](https://insights.sbomify.com/CVE-2026-44383/): Hydro-Québec Le Circuit Electrique charging station backend Insufficient Session Expiration (high 8.7)
- [CVE-2026-44381](https://insights.sbomify.com/CVE-2026-44381/): MISP: SQL injection via unvalidated ordering parameters in event and shadow attribute listings (critical 9.3)
- [CVE-2026-44380](https://insights.sbomify.com/CVE-2026-44380/): MISP: Improper access control in auth key reset allows privilege escalation to site administrator (high 8.6)
- [CVE-2026-4438](https://insights.sbomify.com/CVE-2026-4438/): gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames (medium 5.4)
- [CVE-2026-44379](https://insights.sbomify.com/CVE-2026-44379/): MISP: Improper UUID validation in MISP Collections (medium 5.3)
- [CVE-2026-44378](https://insights.sbomify.com/CVE-2026-44378/): Botan: Quadratic complexity decoding BER indefinite length encodings (medium 6.9)
- [CVE-2026-44377](https://insights.sbomify.com/CVE-2026-44377/): CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE (critical 9.1)
- [CVE-2026-44376](https://insights.sbomify.com/CVE-2026-44376/): CubeCart: Reflected XSS in Store Search Bar (medium 6.1)
- [CVE-2026-44375](https://insights.sbomify.com/CVE-2026-44375/): Nerdbank.MessagePack: Attacker-controlled stackalloc in DateTime decoding causes process-terminating StackOverflowException (high 7.5)
- [CVE-2026-44374](https://insights.sbomify.com/CVE-2026-44374/): Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks (medium 4.3)
- [CVE-2026-44373](https://insights.sbomify.com/CVE-2026-44373/): Nitro: Proxy scope bypass via percent-encoded path traversal in `routeRules` (medium 5.3)
- [CVE-2026-44372](https://insights.sbomify.com/CVE-2026-44372/): Nitro: Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules (medium 5.3)
- [CVE-2026-44371](https://insights.sbomify.com/CVE-2026-44371/): Open OnDemand: Specially crafted filenames can execute javascript in the file browser (medium 5.3)
- [CVE-2026-4437](https://insights.sbomify.com/CVE-2026-4437/): gethostbyaddr and gethostbyaddr_r may incorrectly handle DNS response (high 7.5)
- [CVE-2026-44369](https://insights.sbomify.com/CVE-2026-44369/): CVAT: Stored XSS via annotation guides (high 8.5)
- [CVE-2026-44368](https://insights.sbomify.com/CVE-2026-44368/): PyQuorum: Timing side‑channel in mul_mod (medium 6.9)
- [CVE-2026-44367](https://insights.sbomify.com/CVE-2026-44367/): Klaw: user lockout due to case sensitivity inconsistency (low 2.7)
- [CVE-2026-44366](https://insights.sbomify.com/CVE-2026-44366/): Vvveb: Stored XSS via Comment Author Field (medium 6.1)
- [CVE-2026-44364](https://insights.sbomify.com/CVE-2026-44364/): misp-modules website - Missing CSRF protection in the website home blueprint (critical 9.3)
- [CVE-2026-44363](https://insights.sbomify.com/CVE-2026-44363/): Unsafe remote resource fetching in expansion misp-modules (medium 5.8)
- [CVE-2026-44362](https://insights.sbomify.com/CVE-2026-44362/): OP-TEE's subkey rollback protection can be bypassed with older subkey versions (medium 5.5)
- [CVE-2026-4436](https://insights.sbomify.com/CVE-2026-4436/): GPL Odorizers GPL750 Missing Authentication for Critical Function (high 8.6)
- [CVE-2026-44359](https://insights.sbomify.com/CVE-2026-44359/): Meshtastic GitHub repo vulnerable to Arbitrary Code Execution via pull_request_target Fork Checkout in CI Workflow (critical 10.0)
- [CVE-2026-44358](https://insights.sbomify.com/CVE-2026-44358/): Espressif Shared GitHub DangerJS: Untrusted Search Path in DangerJS Action Entrypoint (high 8.2)
- [CVE-2026-44353](https://insights.sbomify.com/CVE-2026-44353/): Streamlink: Arbitrary local file read via file:// URI in HLS and DASH (medium 6.5)
- [CVE-2026-44352](https://insights.sbomify.com/CVE-2026-44352/): Flowsint: Broken Access Control allows reading of sketch logs from any user (medium 5.3)
- [CVE-2026-44351](https://insights.sbomify.com/CVE-2026-44351/): fast-jwt: Empty HMAC secret accepted via async key resolver - JWT auth bypass (critical 9.1)
- [CVE-2026-44349](https://insights.sbomify.com/CVE-2026-44349/): Daptin fuzzy search injects unvalidated column name into raw SQL (high 7.1)
- [CVE-2026-44348](https://insights.sbomify.com/CVE-2026-44348/): PoDoFo: Double-free vulnerability in compute_hash_to_sign() (low 2.5)
- [CVE-2026-44347](https://insights.sbomify.com/CVE-2026-44347/): Warpgate: SSO CSRF -- State Token Not Validated on Return (medium 5.8)
- [CVE-2026-44346](https://insights.sbomify.com/CVE-2026-44346/): BentoML: Dockerfile command injection via envs[*].name in bentofile.yaml (high 8.8)
- [CVE-2026-44345](https://insights.sbomify.com/CVE-2026-44345/): BentoML: Dockerfile command injection via docker.base_image (high 8.8)
- [CVE-2026-44343](https://insights.sbomify.com/CVE-2026-44343/): WGDashboard: Critical Vulnerability in 4.3.2 (critical 9.3)
- [CVE-2026-44342](https://insights.sbomify.com/CVE-2026-44342/): New API CSRF in email and WeChat account binding endpoints (medium 5.3)
- [CVE-2026-44341](https://insights.sbomify.com/CVE-2026-44341/): GoJobs: Insecure Direct Object Reference (IDOR) in Job Retrieval Endpoint (medium 5.3)
- [CVE-2026-44340](https://insights.sbomify.com/CVE-2026-44340/): PraisonAI: Symlink-extraction bypass of `_safe_extractall` writes outside `dest_dir` (high 8.7)
- [CVE-2026-4434](https://insights.sbomify.com/CVE-2026-4434/): Security feature bypass in Server (high 8.1)
- [CVE-2026-44339](https://insights.sbomify.com/CVE-2026-44339/): PraisonAI has unsafe tool resolution in `ToolExecutionMixin.execute_tool`: undeclared `__main__` callables execute (high 8.6)
- [CVE-2026-44338](https://insights.sbomify.com/CVE-2026-44338/): PraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow execution (high 7.3)
- [CVE-2026-44337](https://insights.sbomify.com/CVE-2026-44337/): PraisonAI knowledge-store backends interpolate unvalidated collection names into SQL and CQL queries (medium 6.3)
- [CVE-2026-44336](https://insights.sbomify.com/CVE-2026-44336/): PraisonAI MCP `tools/call` path-traversal and RCE via Python `.pth` injection (critical 9.4)
- [CVE-2026-44335](https://insights.sbomify.com/CVE-2026-44335/): SSRF bypass in PraisonAI (high 7.7)
- [CVE-2026-44334](https://insights.sbomify.com/CVE-2026-44334/): PraisonAI: Unauthenticated RCE via `tool_override.py` (high 8.4)
- [CVE-2026-44332](https://insights.sbomify.com/CVE-2026-44332/): Fiber: Username Enumeration via Timing Oracle in BasicAuth Default Authorizer (medium 5.3)
- [CVE-2026-44331](https://insights.sbomify.com/CVE-2026-44331/): SQL injection in ProFTPD (high 8.1)
- [CVE-2026-44330](https://insights.sbomify.com/CVE-2026-44330/): free5GC's NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens can read PFD data and create/delete PFD subscriptions (critical 10.0)
- [CVE-2026-4433](https://insights.sbomify.com/CVE-2026-4433/): Misconfiguration in Tenable Operation Technology (low 1.9)
- [CVE-2026-44329](https://insights.sbomify.com/CVE-2026-44329/): free5GC's SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlers (critical 10.0)
- [CVE-2026-44328](https://insights.sbomify.com/CVE-2026-44328/): free5GC's SMF UPI DELETE /upi/v1/upNodesLinks/{ref} panics on AN-node deletion via nil UPF dereference; unauthenticated, state-mutating (high 8.2)
- [CVE-2026-44327](https://insights.sbomify.com/CVE-2026-44327/): free5GC: NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler (critical 10.0)
- [CVE-2026-44326](https://insights.sbomify.com/CVE-2026-44326/): free5GC's NEF 3gpp-traffic-influence API is unauthenticated; missing or forged bearer tokens can create, read, patch, and delete subscriptions (critical 9.4)
- [CVE-2026-44325](https://insights.sbomify.com/CVE-2026-44325/): free5GC: NRF POST /oauth2/token structured-form parser type-confusion panic family (Reflect.Set on incompatible types) (high 7.5)
- [CVE-2026-44324](https://insights.sbomify.com/CVE-2026-44324/): free5GC's UDR nudr-dr DELETE amf-subscriptions panics on missing UE state via nil interface type assertion (single authenticated request) (medium 6.5)
- [CVE-2026-44323](https://insights.sbomify.com/CVE-2026-44323/): free5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing subsId when UE state exists (nil pointer dereference) (medium 4.3)
- [CVE-2026-44322](https://insights.sbomify.com/CVE-2026-44322/): free5GC's NEF 3gpp-pfd-management PATCH applications/{appId} panics on UDR access failure due to nil ProblemDetails dereference (high 7.5)
- [CVE-2026-44321](https://insights.sbomify.com/CVE-2026-44321/): free5GC's SMF UPI POST /upi/v1/upNodesLinks exits the SMF process on overlapping UE pools (unauthenticated, reachable Fatalf) (high 7.5)
- [CVE-2026-44320](https://insights.sbomify.com/CVE-2026-44320/): free5GC's NEF nnef-callback route group is unauthenticated; forged callback requests are accepted into the processing path (high 7.3)
- [CVE-2026-4432](https://insights.sbomify.com/CVE-2026-4432/): YITH WooCommerce Wishlist < 4.13.0 - Unauthenticated Arbitrary Wishlist Renaming via IDOR (medium 6.5)
- [CVE-2026-44319](https://insights.sbomify.com/CVE-2026-44319/): free5GC: NEF crashes via logger.Fatal on PFD notification delivery failure (attacker-controlled notifyUri) (high 7.5)
- [CVE-2026-44318](https://insights.sbomify.com/CVE-2026-44318/): free5GC's BSF concurrent PUT /nbsf-management/v1/subscriptions/{subId} crashes the BSF process via concurrent map read/write on Subscriptions (medium 6.5)
- [CVE-2026-44317](https://insights.sbomify.com/CVE-2026-44317/): free5GC's PCF npcf-policyauthorization POST /app-sessions panics on suppFeat=1 with missing AfRoutReq via nil pointer dereference (medium 6.5)
- [CVE-2026-44316](https://insights.sbomify.com/CVE-2026-44316/): free5GC: PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/OpenAPI 404 via nil pointer dereference (high 7.5)
- [CVE-2026-44315](https://insights.sbomify.com/CVE-2026-44315/): free5GC's NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactions (critical 9.4)
- [CVE-2026-44314](https://insights.sbomify.com/CVE-2026-44314/): Traccar: Missing edit authorization on device image upload allows read-only users to write files (medium 5.3)
- [CVE-2026-44313](https://insights.sbomify.com/CVE-2026-44313/): LinkWarden: Server-Side Request Forgery (SSRF) in Link Creation via fetchTitleAndHeaders Function (critical 9.1)
- [CVE-2026-44312](https://insights.sbomify.com/CVE-2026-44312/): css_parser allows to MITM included https css urls (medium 5.8)
- [CVE-2026-44311](https://insights.sbomify.com/CVE-2026-44311/): Fabric.js: Improper escaping in fabric.Gradient colorStops leads to XSS in SVG serialization (medium 5.4)
- [CVE-2026-44310](https://insights.sbomify.com/CVE-2026-44310/): gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callers (medium 5.4)
- [CVE-2026-4431](https://insights.sbomify.com/CVE-2026-4431/): Easy Post Submission <= 2.3.0 - Missing Authorization (critical 9.1)
- [CVE-2026-44309](https://insights.sbomify.com/CVE-2026-44309/): gitsign verify accepts signatures over go-git-normalized bytes, enabling trust confusion on malformed commits (medium 5.3)
- [CVE-2026-44308](https://insights.sbomify.com/CVE-2026-44308/): Spring Cloud AWS: Missing SNS message signature verification allows spoofing of HTTP/HTTPS endpoint notifications (medium 6.3)
- [CVE-2026-44307](https://insights.sbomify.com/CVE-2026-44307/): Mako: Path traversal via backslash URI on Windows in TemplateLookup (high 8.7)
- [CVE-2026-44306](https://insights.sbomify.com/CVE-2026-44306/): Statamic: Email enumeration via forgot password endpoint (medium 5.3)
- [CVE-2026-44305](https://insights.sbomify.com/CVE-2026-44305/): Lemur: LDAP TLS certificate verification globally disabled enables credential interception (medium 6.8)
- [CVE-2026-44304](https://insights.sbomify.com/CVE-2026-44304/): Lemur: LDAP Filter Injection enables post-authentication privilege escalation (high 8.1)
- [CVE-2026-44302](https://insights.sbomify.com/CVE-2026-44302/): Snappier: Infinite loop in SnappyStream decompression on malformed framed input (high 7.5)
- [CVE-2026-44301](https://insights.sbomify.com/CVE-2026-44301/): Hugo: Node tool execution allows file system access outside the project directory (medium 6.2)
- [CVE-2026-44300](https://insights.sbomify.com/CVE-2026-44300/): OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/632/