# Vulnerabilities published in 2026


- [CVE-2026-4406](https://insights.sbomify.com/CVE-2026-4406/): Gravity Forms <= 2.9.30 - Reflected Cross-Site Scripting via 'form_ids' Parameter (medium 4.7)
- [CVE-2026-44059](https://insights.sbomify.com/CVE-2026-44059/): Non-reentrant privilege toggle (low 3.9)
- [CVE-2026-44058](https://insights.sbomify.com/CVE-2026-44058/): Authentication bypass via admin auth user (medium 6.4)
- [CVE-2026-44057](https://insights.sbomify.com/CVE-2026-44057/): Dead bounds check in Spotlight RPC unmarshaller (low 3.1)
- [CVE-2026-44056](https://insights.sbomify.com/CVE-2026-44056/): Stack buffer overflow in desktop.c (medium 6.0)
- [CVE-2026-44055](https://insights.sbomify.com/CVE-2026-44055/): Bitwise OR logic bug enables shell injection (high 7.5)
- [CVE-2026-44054](https://insights.sbomify.com/CVE-2026-44054/): Predictable afpd session token (medium 6.5)
- [CVE-2026-44053](https://insights.sbomify.com/CVE-2026-44053/): Weak cryptography in DHCAST128 UAM (high 7.4)
- [CVE-2026-44052](https://insights.sbomify.com/CVE-2026-44052/): LDAP simple-bind password exposure in log output (high 7.5)
- [CVE-2026-44051](https://insights.sbomify.com/CVE-2026-44051/): Arbitrary file read via attacker-controlled symlink creation (high 8.1)
- [CVE-2026-44050](https://insights.sbomify.com/CVE-2026-44050/): Heap buffer overflow in CNID daemon comm_rcv() (critical 9.9)
- [CVE-2026-4405](https://insights.sbomify.com/CVE-2026-4405/): IBM Concert Software Use of Web Browser Cache Containing Sensitive Information (medium 4.0)
- [CVE-2026-44049](https://insights.sbomify.com/CVE-2026-44049/): Out-of-bounds write in convert_charset() null termination (high 7.5)
- [CVE-2026-44048](https://insights.sbomify.com/CVE-2026-44048/): Stack buffer overflow via UCS-2 type confusion in convert_charset() (high 8.8)
- [CVE-2026-44047](https://insights.sbomify.com/CVE-2026-44047/): SQL injection in MySQL CNID backend (high 8.8)
- [CVE-2026-44046](https://insights.sbomify.com/CVE-2026-44046/): Apache APISIX: wolf-rbac plugin Identity Spoofing (low 2.3)
- [CVE-2026-44042](https://insights.sbomify.com/CVE-2026-44042/): UltraVNC repeater wi_uudecode off-by-one in base64 decode boundary check (low 3.7)
- [CVE-2026-44041](https://insights.sbomify.com/CVE-2026-44041/): UltraVNC vncWc2Mb calls wcslen() before validating that the wide string is NUL-terminated (medium 4.3)
- [CVE-2026-44040](https://insights.sbomify.com/CVE-2026-44040/): UltraVNC vncauth.c uses time-seeded libc rand() to generate VNC authentication challenge bytes (medium 4.8)
- [CVE-2026-4404](https://insights.sbomify.com/CVE-2026-4404/): Use of hard coded credentials in GoHarbor Harbor (critical 9.4)
- [CVE-2026-44038](https://insights.sbomify.com/CVE-2026-44038/): Global buffer out-of-bounds read in DCMTK JPEG Huffman decoding (medium 4.8)
- [CVE-2026-44037](https://insights.sbomify.com/CVE-2026-44037/): Uncontrolled recursion in DCMTK JSON reader allows denial of service (medium 6.8)
- [CVE-2026-44036](https://insights.sbomify.com/CVE-2026-44036/): Uncontrolled recursion in DCMTK xml2dcm allows denial of service (medium 6.8)
- [CVE-2026-44035](https://insights.sbomify.com/CVE-2026-44035/): Uncontrolled recursion in DCMTK DICOMDIR parsing allows denial of service (medium 6.8)
- [CVE-2026-44034](https://insights.sbomify.com/CVE-2026-44034/): Heap out-of-bounds read in DCMTK RLE decodeFrame() (medium 4.8)
- [CVE-2026-44033](https://insights.sbomify.com/CVE-2026-44033/): Uncontrolled recursion in the DCMTK bundled XML parser allows denial of service (medium 6.8)
- [CVE-2026-44031](https://insights.sbomify.com/CVE-2026-44031/): Uncontrolled recursion in the DCMTK DICOM dataset parser allows unauthenticated remote denial of service (high 8.7)
- [CVE-2026-44029](https://insights.sbomify.com/CVE-2026-44029/): Path traversal in Nix (medium 5.3)
- [CVE-2026-44028](https://insights.sbomify.com/CVE-2026-44028/): Memory corruption in Lix (high 7.5)
- [CVE-2026-44025](https://insights.sbomify.com/CVE-2026-44025/): Fluentd: Exposure of Sensitive Information via Monitor Agent API (high 7.5)
- [CVE-2026-44024](https://insights.sbomify.com/CVE-2026-44024/): Fluentd: Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Placeholder (critical 9.8)
- [CVE-2026-44023](https://insights.sbomify.com/CVE-2026-44023/): Docling Core has unsafe remote filename resolution (high 8.6)
- [CVE-2026-44022](https://insights.sbomify.com/CVE-2026-44022/): Docling: Potential Path Traversal via LaTeX \includegraphics and \input Commands (medium 5.5)
- [CVE-2026-44020](https://insights.sbomify.com/CVE-2026-44020/): Docling: Unsafe XML Entity Expansion in USPTO Patent Backend (high 7.5)
- [CVE-2026-44019](https://insights.sbomify.com/CVE-2026-44019/): Docling Core has insufficient validation of image reference URIs (high 8.1)
- [CVE-2026-44018](https://insights.sbomify.com/CVE-2026-44018/): Docling: Unsafe Archive Extraction and XML Parsing in METS-GBS Backend (medium 5.5)
- [CVE-2026-44017](https://insights.sbomify.com/CVE-2026-44017/): Docling: Unsafe Zip Extraction in EasyOCR Model Download (high 7.5)
- [CVE-2026-44016](https://insights.sbomify.com/CVE-2026-44016/): Docling: Unsafe Playwright-based HTML Rendering (high 8.2)
- [CVE-2026-44015](https://insights.sbomify.com/CVE-2026-44015/): Nginx UI: Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware Allows Access to Internal Services (high 8.5)
- [CVE-2026-44012](https://insights.sbomify.com/CVE-2026-44012/): Craft CMS: Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure (high 7.1)
- [CVE-2026-44011](https://insights.sbomify.com/CVE-2026-44011/): Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior (high 8.6)
- [CVE-2026-44010](https://insights.sbomify.com/CVE-2026-44010/): Craft CMS: Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure (high 7.1)
- [CVE-2026-4401](https://insights.sbomify.com/CVE-2026-4401/): Download Monitor <= 5.1.10 - Cross-Site Request Forgery to Download Path Deletion and Disabling (medium 5.4)
- [CVE-2026-44009](https://insights.sbomify.com/CVE-2026-44009/): vm2: Sandbox Breakout Through Null Proto Exception (critical 9.8)
- [CVE-2026-44008](https://insights.sbomify.com/CVE-2026-44008/): vm2: Snabox breakout via `neutralizeArraySpeciesBatch` (critical 9.8)
- [CVE-2026-44007](https://insights.sbomify.com/CVE-2026-44007/): vm2: nesting: true bypasses require: false, allowing sandbox escape to arbitrary OS command execution (critical 9.1)
- [CVE-2026-44006](https://insights.sbomify.com/CVE-2026-44006/): vm2: Sandbox Escape (critical 10.0)
- [CVE-2026-44005](https://insights.sbomify.com/CVE-2026-44005/): vm2: Sandbox escape (critical 10.0)
- [CVE-2026-44004](https://insights.sbomify.com/CVE-2026-44004/): vm2: Host Process OOM DoS via Buffer.alloc (Timeout Bypass) (high 7.5)
- [CVE-2026-44003](https://insights.sbomify.com/CVE-2026-44003/): vm2: Transformer Fast-Path Bypass Exposes Internal State Variable (medium 5.3)
- [CVE-2026-44002](https://insights.sbomify.com/CVE-2026-44002/): vm2: Host File Path Disclosure via Stack Trace Information Leak (medium 5.8)
- [CVE-2026-44001](https://insights.sbomify.com/CVE-2026-44001/): vm2: Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS) (high 8.6)
- [CVE-2026-44000](https://insights.sbomify.com/CVE-2026-44000/): vm2: sandbox boundary bypass via host Promise resolution preserving host object identity (medium 6.5)
- [CVE-2026-4400](https://insights.sbomify.com/CVE-2026-4400/): Multiple vulnerabilities in 1millionbot Millie chatbot (high 7.0)
- [CVE-2026-43999](https://insights.sbomify.com/CVE-2026-43999/): vm2: NodeVM builtin allowlist bypass via `module` builtin's `Module._load` allows sandbox escape (critical 9.9)
- [CVE-2026-43998](https://insights.sbomify.com/CVE-2026-43998/): vm2: NodeVM require.root bypass via symlink traversal allows sandbox escape (high 8.5)
- [CVE-2026-43997](https://insights.sbomify.com/CVE-2026-43997/): vm2: Sandbox Escape (critical 10.0)
- [CVE-2026-43996](https://insights.sbomify.com/CVE-2026-43996/): Integer overflow in OpenImageIO (medium 5.5)
- [CVE-2026-43995](https://insights.sbomify.com/CVE-2026-43995/): Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure) (medium 5.3)
- [CVE-2026-43994](https://insights.sbomify.com/CVE-2026-43994/): Coturn: Stack buffer overflow in decode_oauth_token_gcm() (high 8.1)
- [CVE-2026-43993](https://insights.sbomify.com/CVE-2026-43993/): JunoClaw: SSRF in WAVS computeDataVerify allows cloud-metadata and internal-service access (high 8.2)
- [CVE-2026-43992](https://insights.sbomify.com/CVE-2026-43992/): JunoClaw: MCP write tools exposed raw BIP-39 mnemonic as a tool-call parameter (critical 9.8)
- [CVE-2026-43991](https://insights.sbomify.com/CVE-2026-43991/): JunoClaw: plugin-shell shell-injection bypass via substring blocklist (high 8.4)
- [CVE-2026-43990](https://insights.sbomify.com/CVE-2026-43990/): JunoClaw: plugin-shell shell-metacharacter injection via shell wrapper (high 8.4)
- [CVE-2026-4399](https://insights.sbomify.com/CVE-2026-4399/): Multiple vulnerabilities in 1millionbot Millie chatbot (high 8.7)
- [CVE-2026-43989](https://insights.sbomify.com/CVE-2026-43989/): JunoClaw: upload_wasm accepted arbitrary filesystem paths without validation (high 8.5)
- [CVE-2026-43988](https://insights.sbomify.com/CVE-2026-43988/): Vanetza: Remote Denial of Service via Uncaught Exception in ASN.1/OER Parsing (high 7.5)
- [CVE-2026-43986](https://insights.sbomify.com/CVE-2026-43986/): Tautulli vulnerable to unauthenticated SSRF in /image/<hash> via attacker-seeded image hash replay (critical 9.9)
- [CVE-2026-43985](https://insights.sbomify.com/CVE-2026-43985/): Taultulli has CSRF in /configUpdate via missing anti-CSRF and method restriction that allows admin credential takeover (high 8.8)
- [CVE-2026-43984](https://insights.sbomify.com/CVE-2026-43984/): Tautulli has stored XSS in logFile via guest-controlled log_js_errors input (high 8.9)
- [CVE-2026-43983](https://insights.sbomify.com/CVE-2026-43983/): Pocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictions (high 8.5)
- [CVE-2026-43982](https://insights.sbomify.com/CVE-2026-43982/): Algernon: Path traversal file write via savein() (high 8.7)
- [CVE-2026-43981](https://insights.sbomify.com/CVE-2026-43981/): Algernon: Race Condition in handle() shared LState (high 8.2)
- [CVE-2026-43980](https://insights.sbomify.com/CVE-2026-43980/): Malla: Stored XSS via Meshtastic node names in multiple frontend pages (medium 6.3)
- [CVE-2026-4398](https://insights.sbomify.com/CVE-2026-4398/): Authorization Bypass Through User-Controlled Key in GitLab (medium 5.4)
- [CVE-2026-43979](https://insights.sbomify.com/CVE-2026-43979/): Local Deep Research: HTML Injection via Unescaped User Input in PDF Export (`pdf_service.py:_markdown_to_html`) (medium 5.0)
- [CVE-2026-43978](https://insights.sbomify.com/CVE-2026-43978/): wger: Privilege escalation via trainer-login session chaining allows gym trainers to impersonate gym managers (high 8.1)
- [CVE-2026-43977](https://insights.sbomify.com/CVE-2026-43977/): wger IDOR: Authenticated Users Can Read Others' Private Workout Session Data via Template Routine API (high 7.5)
- [CVE-2026-43976](https://insights.sbomify.com/CVE-2026-43976/): wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views) (high 7.1)
- [CVE-2026-43975](https://insights.sbomify.com/CVE-2026-43975/): Apache Wicket: Possible malicious path traversal in FolderUploadsFileManager (medium 6.5)
- [CVE-2026-43974](https://insights.sbomify.com/CVE-2026-43974/): gun HTTP/1.1 client accepts unsolicited 101 Switching Protocols response allowing server-driven protocol hijack and OOM (high 8.7)
- [CVE-2026-43973](https://insights.sbomify.com/CVE-2026-43973/): gun HTTP/1.1 response buffer has no size limit allowing server-controlled memory exhaustion (high 8.7)
- [CVE-2026-43972](https://insights.sbomify.com/CVE-2026-43972/): gun HTTP/2 PUSH_PROMISE authority not validated against connection origin allows cross-origin cookie injection (medium 6.3)
- [CVE-2026-43971](https://insights.sbomify.com/CVE-2026-43971/): Link Header Directive Smuggling via Unescaped target/rel/Attribute Keys in cow_link:link/1 (medium 6.3)
- [CVE-2026-43970](https://insights.sbomify.com/CVE-2026-43970/): Decompression Bomb in cow_spdy:inflate/2 Allows Memory Exhaustion via Crafted SPDY Frame (high 8.2)
- [CVE-2026-43969](https://insights.sbomify.com/CVE-2026-43969/): Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1 (low 2.1)
- [CVE-2026-43968](https://insights.sbomify.com/CVE-2026-43968/): CR Injection in SSE Encoder Enables Event Splitting via cow_sse:event/1 (medium 6.3)
- [CVE-2026-43967](https://insights.sbomify.com/CVE-2026-43967/): Quadratic fragment-name uniqueness check causes denial of service in absinthe (high 8.7)
- [CVE-2026-43966](https://insights.sbomify.com/CVE-2026-43966/): HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2 (medium 6.3)
- [CVE-2026-43965](https://insights.sbomify.com/CVE-2026-43965/): Path Traversal in build/packages/packages.toml Allows Arbitrary Directory Deletion (medium 5.6)
- [CVE-2026-43964](https://insights.sbomify.com/CVE-2026-43964/): Memory corruption in Postfix (low 3.7)
- [CVE-2026-43961](https://insights.sbomify.com/CVE-2026-43961/): Code injection in Red Hat Enterprise Linux 10 (high 7.8)
- [CVE-2026-4396](https://insights.sbomify.com/CVE-2026-4396/): Security feature bypass in Hub Reporting Service (high 8.3)
- [CVE-2026-43958](https://insights.sbomify.com/CVE-2026-43958/): Rrdtool: rrdtool: stack buffer overflow allows local code execution or denial of service (high 7.8)
- [CVE-2026-43951](https://insights.sbomify.com/CVE-2026-43951/): Apache HTTP Server: OOB Read in `merge_response_headers` can cause crash (medium 6.5)
- [CVE-2026-4395](https://insights.sbomify.com/CVE-2026-4395/): Heap-based buffer overflow in wc_ecc_import_x963_ex KCAPI path (low 1.3)
- [CVE-2026-43948](https://insights.sbomify.com/CVE-2026-43948/): wger: cross-tenant password reset and plaintext disclosure via gym=None bypass (critical 9.9)
- [CVE-2026-43947](https://insights.sbomify.com/CVE-2026-43947/): FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass (high 8.9)
- [CVE-2026-43946](https://insights.sbomify.com/CVE-2026-43946/): FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue (high 7.7)
- [CVE-2026-43945](https://insights.sbomify.com/CVE-2026-43945/): FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection (high 8.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/635/