# Vulnerabilities published in 2026


- [CVE-2026-4430](https://insights.sbomify.com/CVE-2026-4430/): Heap Buffer Overflow in AgileEngine (medium 5.4)
- [CVE-2026-44298](https://insights.sbomify.com/CVE-2026-44298/): Kimai: Arbitrary file read in invoice PDF renderer (admin) (medium 4.1)
- [CVE-2026-44296](https://insights.sbomify.com/CVE-2026-44296/): Deskflow: TLS multiplexer DoS on failed `SSL_accept` (high 7.5)
- [CVE-2026-44295](https://insights.sbomify.com/CVE-2026-44295/): protobufjs-cli: Code injection in pbjs static output from crafted schema names (high 8.7)
- [CVE-2026-44294](https://insights.sbomify.com/CVE-2026-44294/): protobufjs: Denial of service from crafted field names in generated code (medium 5.3)
- [CVE-2026-44293](https://insights.sbomify.com/CVE-2026-44293/): protobufjs: Code injection through bytes field defaults in generated toObject code (high 7.7)
- [CVE-2026-44292](https://insights.sbomify.com/CVE-2026-44292/): protobufjs: Prototype injection in generated message constructors (medium 5.3)
- [CVE-2026-44291](https://insights.sbomify.com/CVE-2026-44291/): protobufjs: Code generation gadget after prototype pollution (high 8.1)
- [CVE-2026-44290](https://insights.sbomify.com/CVE-2026-44290/): protobufjs: Process-wide denial of service through unsafe option paths (high 7.5)
- [CVE-2026-4429](https://insights.sbomify.com/CVE-2026-4429/): OSM <= 6.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'marker_name' Shortcode Attribute (medium 6.4)
- [CVE-2026-44289](https://insights.sbomify.com/CVE-2026-44289/): protobufjs: Denial of service through unbounded protobuf recursion (high 7.5)
- [CVE-2026-44288](https://insights.sbomify.com/CVE-2026-44288/): protobufjs: Overlong UTF-8 decoding (medium 5.3)
- [CVE-2026-44287](https://insights.sbomify.com/CVE-2026-44287/): FastGPT: sandbox escape to RCE - code-sandbox regex /\bimport\s*\(/ is bypassable (medium 6.3)
- [CVE-2026-44286](https://insights.sbomify.com/CVE-2026-44286/): FastGPT: SSRF Vulnerability in Laf Workflow Node via Missing Internal Address Validation (low 2.3)
- [CVE-2026-44285](https://insights.sbomify.com/CVE-2026-44285/): FastGPT: SSRF Protection Bypass via `externalFile` in Dataset Preview API (high 7.7)
- [CVE-2026-44284](https://insights.sbomify.com/CVE-2026-44284/): FastGPT: Stored MCP tool URL SSRF in FastGPT workflow execution (medium 6.3)
- [CVE-2026-44283](https://insights.sbomify.com/CVE-2026-44283/): etcd: Read access via PrevKv in etcd transactions may bypass RBAC authorization checks (not scored)
- [CVE-2026-44282](https://insights.sbomify.com/CVE-2026-44282/): Election question titles allow stored script execution (medium 4.8)
- [CVE-2026-44281](https://insights.sbomify.com/CVE-2026-44281/): GLPI vulnerable to unauthorized reading of a specific asset object (high 7.0)
- [CVE-2026-4428](https://insights.sbomify.com/CVE-2026-4428/): CRL Distribution Point Scope Check Logic Error in AWS-LC (critical 9.1)
- [CVE-2026-44279](https://insights.sbomify.com/CVE-2026-44279/): Information disclosure in FortiTokenAndroid (medium 5.0)
- [CVE-2026-44278](https://insights.sbomify.com/CVE-2026-44278/): Hardcoded credentials in FortiClientWindows (low 2.1)
- [CVE-2026-44277](https://insights.sbomify.com/CVE-2026-44277/): Missing authorization in FortiAuthenticator (critical 9.1)
- [CVE-2026-44276](https://insights.sbomify.com/CVE-2026-44276/): Information disclosure in PowerProtect Data Manager (medium 6.0)
- [CVE-2026-44275](https://insights.sbomify.com/CVE-2026-44275/): Path traversal in Dell/Alienware Purchased Apps (medium 6.3)
- [CVE-2026-44274](https://insights.sbomify.com/CVE-2026-44274/): Path traversal in Wyse Management Suite (WMS) (high 7.8)
- [CVE-2026-44273](https://insights.sbomify.com/CVE-2026-44273/): Hardcoded credentials in Wyse Management Suite (WMS) (medium 6.0)
- [CVE-2026-44272](https://insights.sbomify.com/CVE-2026-44272/): SQL injection in Wyse Management Suite (WMS) (high 8.8)
- [CVE-2026-44271](https://insights.sbomify.com/CVE-2026-44271/): SQL injection in Wyse Management Suite (WMS) (high 8.1)
- [CVE-2026-44269](https://insights.sbomify.com/CVE-2026-44269/): Path traversal in PowerProtect Data Domain (medium 4.4)
- [CVE-2026-44268](https://insights.sbomify.com/CVE-2026-44268/): Misconfiguration in PowerProtect Data Domain (medium 4.4)
- [CVE-2026-44264](https://insights.sbomify.com/CVE-2026-44264/): Weblate is vulnerable to XSS via crafted Markdown (medium 4.3)
- [CVE-2026-44263](https://insights.sbomify.com/CVE-2026-44263/): Weblate: Private Translation Enumeration via Screenshot API (medium 4.3)
- [CVE-2026-44262](https://insights.sbomify.com/CVE-2026-44262/): Scramble: Remote code execution via evaluation of user-controlled input in validation rules (critical 9.4)
- [CVE-2026-44260](https://insights.sbomify.com/CVE-2026-44260/): efw4.X: readonly Flag Not Enforced Server-Side (high 8.1)
- [CVE-2026-4426](https://insights.sbomify.com/CVE-2026-4426/): Libarchive: libarchive: denial of service via malformed iso file processing (medium 6.5)
- [CVE-2026-44259](https://insights.sbomify.com/CVE-2026-44259/): efw4.X: Stored XSS via previewServlet (medium 4.6)
- [CVE-2026-44258](https://insights.sbomify.com/CVE-2026-44258/): efw4.X: Path Traversal via Unchecked dst Parameter leads to Remote Code Execution (critical 9.3)
- [CVE-2026-44257](https://insights.sbomify.com/CVE-2026-44257/): efw4.X: RCE via zipslip (critical 9.3)
- [CVE-2026-44256](https://insights.sbomify.com/CVE-2026-44256/): Wazuh: CRLF Log Injection via Unsanitized Basic-Auth Username (medium 5.3)
- [CVE-2026-44255](https://insights.sbomify.com/CVE-2026-44255/): Wazuh: Username Enumeration via Timing Side-Channel (medium 5.3)
- [CVE-2026-44254](https://insights.sbomify.com/CVE-2026-44254/): Wazuh: Stack Out-of-Bounds Write in remoted Decompression Path (medium 5.3)
- [CVE-2026-44253](https://insights.sbomify.com/CVE-2026-44253/): Wazuh: Cluster Protocol Memory Exhaustion (DoS) via unbounded receive_str allocation and div_msg_box accumulation (medium 4.9)
- [CVE-2026-44252](https://insights.sbomify.com/CVE-2026-44252/): Wazuh Manager dapi RBAC Bypass Allows Privilege Escalation (high 7.7)
- [CVE-2026-44251](https://insights.sbomify.com/CVE-2026-44251/): Integer overflow in wazuh (medium 6.5)
- [CVE-2026-44250](https://insights.sbomify.com/CVE-2026-44250/): Netty: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested Arrays (high 7.5)
- [CVE-2026-44249](https://insights.sbomify.com/CVE-2026-44249/): Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking (high 8.1)
- [CVE-2026-44248](https://insights.sbomify.com/CVE-2026-44248/): Netty: Resource exhaustion in MqttDecoder (medium 5.3)
- [CVE-2026-44247](https://insights.sbomify.com/CVE-2026-44247/): Volcano: Webhook server vulnerable to OOM due to unbounded HTTP request body size (medium 6.8)
- [CVE-2026-44246](https://insights.sbomify.com/CVE-2026-44246/): nnU-Net: Agentic workflow injection in `.github/workflows/issue-triage.yml` of `MIC-DKFZ/nnUNet` (high 7.2)
- [CVE-2026-44245](https://insights.sbomify.com/CVE-2026-44245/): Kyverno: [policy-reporter-ui] XSS via Stored Property Values in PropertyCard Component (medium 6.1)
- [CVE-2026-44244](https://insights.sbomify.com/CVE-2026-44244/): GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath (high 7.8)
- [CVE-2026-44243](https://insights.sbomify.com/CVE-2026-44243/): GitPython: Path traversal in GitPython reference APIs allows arbitrary file write and delete outside the repository (high 7.8)
- [CVE-2026-44242](https://insights.sbomify.com/CVE-2026-44242/): Micronaut has Unbounded `bundleCache` in `ResourceBundleMessageSource` that Allows Memory Exhaustion via `Accept-Language` Header (low 3.7)
- [CVE-2026-44241](https://insights.sbomify.com/CVE-2026-44241/): Micronaut has unbounded `formattersCache` in `TimeConverterRegistrar` that Allows Memory Exhaustion via `Accept-Language` Header (high 7.5)
- [CVE-2026-44240](https://insights.sbomify.com/CVE-2026-44240/): basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering (high 7.5)
- [CVE-2026-4424](https://insights.sbomify.com/CVE-2026-4424/): Libarchive: libarchive: information disclosure via heap out-of-bounds read in rar archive processing (high 7.5)
- [CVE-2026-44239](https://insights.sbomify.com/CVE-2026-44239/): FreePBX: Authenticated Local File Inclusion in Dashboard Module (high 7.6)
- [CVE-2026-44238](https://insights.sbomify.com/CVE-2026-44238/): FreePBX: Authenticated SQL Injection via ORDER BY in CDR Reports (high 8.5)
- [CVE-2026-44237](https://insights.sbomify.com/CVE-2026-44237/): FreePBX: Authenticated Access can lead to Subsequent OAuth2 Authentication Bypass in API Module (high 7.6)
- [CVE-2026-44236](https://insights.sbomify.com/CVE-2026-44236/): rabbitmq-c: Heap buffer overflow in AMQP login handshake via undersized connection.tune.frame_max (high 7.1)
- [CVE-2026-44235](https://insights.sbomify.com/CVE-2026-44235/): rabbitmq-c: size_t underflow in AMQP frame length computation leads to out-of-bounds read (medium 6.5)
- [CVE-2026-44232](https://insights.sbomify.com/CVE-2026-44232/): dssrf: every IPv6 category bypasses is_url_safe (high 8.7)
- [CVE-2026-44231](https://insights.sbomify.com/CVE-2026-44231/): RT: Privilege escalation and information disclosure via REST 2.0 user collection endpoint (critical 9.1)
- [CVE-2026-44230](https://insights.sbomify.com/CVE-2026-44230/): RT: Reflected Cross-Site Scripting in search results chart (medium 6.1)
- [CVE-2026-44229](https://insights.sbomify.com/CVE-2026-44229/): RT: Cross-Site Scripting via inline-served uploaded content (medium 5.4)
- [CVE-2026-44228](https://insights.sbomify.com/CVE-2026-44228/): RT: Stored Cross-Site Scripting via insufficient template escaping (medium 5.4)
- [CVE-2026-44227](https://insights.sbomify.com/CVE-2026-44227/): RT: Reflected Cross-Site Scripting via URL parameters (medium 6.1)
- [CVE-2026-44226](https://insights.sbomify.com/CVE-2026-44226/): pyLoad: Unauthenticated traceback disclosure via global exception handler in WebUI (medium 5.3)
- [CVE-2026-44225](https://insights.sbomify.com/CVE-2026-44225/): Pulpy: Incomplete filesystem sandbox in pulpy.fs bridge allows packaged web apps to read arbitrary user files (critical 9.3)
- [CVE-2026-44224](https://insights.sbomify.com/CVE-2026-44224/): Wiki.js: Privilege Escalation via Missing Group Validation in users.update (high 8.6)
- [CVE-2026-44223](https://insights.sbomify.com/CVE-2026-44223/): vLLM: extract_hidden_states speculative decoding crashes server on any request with penalty parameters (medium 6.5)
- [CVE-2026-44222](https://insights.sbomify.com/CVE-2026-44222/): vLLM: Remote DoS via Special-Token Placeholders (medium 6.5)
- [CVE-2026-44221](https://insights.sbomify.com/CVE-2026-44221/): ArcadeDB: Cross-database authorization bypass and unsecured newly-created databases (critical 9.0)
- [CVE-2026-44220](https://insights.sbomify.com/CVE-2026-44220/): ciguard: discover_pipeline_files follows symlinks out of scan root (low 3.2)
- [CVE-2026-44219](https://insights.sbomify.com/CVE-2026-44219/): ciguard: SCA HTTP client reads response body without size cap (low 3.7)
- [CVE-2026-44218](https://insights.sbomify.com/CVE-2026-44218/): ciguard: Container image runs as root (no USER directive) (low 3.0)
- [CVE-2026-44217](https://insights.sbomify.com/CVE-2026-44217/): sse-channel: SSE Injection via unsanitized event fields (medium 6.6)
- [CVE-2026-44216](https://insights.sbomify.com/CVE-2026-44216/): Wasmtime: Panic when allocating a table exceeding the size of the host's address space (medium 5.9)
- [CVE-2026-44215](https://insights.sbomify.com/CVE-2026-44215/): NanaZip: Heap out-of-bounds write in NanaZip UFS directory parser (medium 4.4)
- [CVE-2026-44214](https://insights.sbomify.com/CVE-2026-44214/): eventsource-encoder: SSE event injection via unsanitized event and id fields (medium 5.8)
- [CVE-2026-44213](https://insights.sbomify.com/CVE-2026-44213/): OpenTelemetry.Exporter.Instana bypasses TLS certificate validation when a proxy is configured (medium 6.5)
- [CVE-2026-44212](https://insights.sbomify.com/CVE-2026-44212/): PrestaShop: Stored XSS executable in customer service view (critical 9.3)
- [CVE-2026-44211](https://insights.sbomify.com/CVE-2026-44211/): Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability (critical 9.6)
- [CVE-2026-44210](https://insights.sbomify.com/CVE-2026-44210/): Kata Containers have VM Escape via virtiofsd Argument Injection through Default-Enabled Pod Annotations (medium 5.8)
- [CVE-2026-44209](https://insights.sbomify.com/CVE-2026-44209/): Banks: Critical Remote Code Execution (RCE) via Jinja2 SSTI (high 7.5)
- [CVE-2026-44208](https://insights.sbomify.com/CVE-2026-44208/): Frappe: IDOR in `submit_discussion()` (medium 6.9)
- [CVE-2026-44207](https://insights.sbomify.com/CVE-2026-44207/): Frappe: Insecure Direct Object Reference for email accounts (medium 6.9)
- [CVE-2026-44206](https://insights.sbomify.com/CVE-2026-44206/): Frappe: DB Schema Enumeration via Frappe-Authorization-Source (medium 6.9)
- [CVE-2026-44205](https://insights.sbomify.com/CVE-2026-44205/): Frappe: Stored Cross-Site Scripting (XSS) in User Profile through Image Upload (medium 6.9)
- [CVE-2026-44204](https://insights.sbomify.com/CVE-2026-44204/): Shelf: SQL Injection via sortBy Parameter (medium 6.5)
- [CVE-2026-44203](https://insights.sbomify.com/CVE-2026-44203/): OpenAM: Pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl) (high 8.3)
- [CVE-2026-44202](https://insights.sbomify.com/CVE-2026-44202/): OpenAM Authenticated Server-Side Request Forgery (SSRF) via `/sessionservice` (medium 5.3)
- [CVE-2026-44201](https://insights.sbomify.com/CVE-2026-44201/): Wagtail: Improper restriction handling on Documents and Images API (medium 5.3)
- [CVE-2026-44200](https://insights.sbomify.com/CVE-2026-44200/): Wagtail: Improper permission handling when copying pages (medium 6.5)
- [CVE-2026-4420](https://insights.sbomify.com/CVE-2026-4420/): Stored XSS via Page Creating functionality in Bludit (medium 5.1)
- [CVE-2026-44199](https://insights.sbomify.com/CVE-2026-44199/): Wagtail: Improper permission handling when deleting form submissions (medium 6.5)
- [CVE-2026-44198](https://insights.sbomify.com/CVE-2026-44198/): Wagtail: Improper permission handling when viewing page history (medium 4.3)
- [CVE-2026-44197](https://insights.sbomify.com/CVE-2026-44197/): Wagtail: Improper permission handling when comparing revisions (medium 6.5)
- [CVE-2026-44196](https://insights.sbomify.com/CVE-2026-44196/): Pingvin Share X: TOTP Authentication Bypass via Password-only Login (critical 9.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/633/