# Vulnerabilities published in 2026


- [CVE-2026-43944](https://insights.sbomify.com/CVE-2026-43944/): electerm: dangerous code can be run through links or command line (critical 9.4)
- [CVE-2026-43943](https://insights.sbomify.com/CVE-2026-43943/): electerm: RCE via malicious SSH server filename in openFileWithEditor (high 7.8)
- [CVE-2026-43942](https://insights.sbomify.com/CVE-2026-43942/): electerm: Full process.env exposed to renderer via window.pre.env in electerm (medium 5.5)
- [CVE-2026-43941](https://insights.sbomify.com/CVE-2026-43941/): Unvalidated shell.openExternal in electerm allows arbitrary protocol execution via terminal link click (critical 9.6)
- [CVE-2026-43940](https://insights.sbomify.com/CVE-2026-43940/): electerm: Path traversal in electerm runWidget leads to arbitrary code execution (high 8.4)
- [CVE-2026-4394](https://insights.sbomify.com/CVE-2026-4394/): Gravity Forms <= 2.9.30 - Unauthenticated Stored Cross-Site Scripting via Credit Card 'Card Type' Sub-Field (medium 6.1)
- [CVE-2026-43939](https://insights.sbomify.com/CVE-2026-43939/): YAF.NET: Stored XSS in Forum Thread Posts/Replies Allowing Arbitrary JavaScript Execution for All Thread Viewers (high 7.3)
- [CVE-2026-43938](https://insights.sbomify.com/CVE-2026-43938/): YAF.NET: Unauthenticated Stored Second-Order XSS in Admin Event Log via Reflected `User-Agent` Header (high 8.1)
- [CVE-2026-43937](https://insights.sbomify.com/CVE-2026-43937/): YAF.NET: Pre-Handler Authorization Bypass on Admin Pages Enabling Blind SQL Execution via `/Admin/RunSql` (high 8.8)
- [CVE-2026-43936](https://insights.sbomify.com/CVE-2026-43936/): e107: Server-Side Request Forgery (SSRF) in the remote file fetcher (medium 4.3)
- [CVE-2026-43935](https://insights.sbomify.com/CVE-2026-43935/): e107: Host Header Injection in e107 password reset enables phishing (high 8.1)
- [CVE-2026-43934](https://insights.sbomify.com/CVE-2026-43934/): e107: Broken Access Control in e107 comment edit allows cross-user comment modification (medium 6.5)
- [CVE-2026-43930](https://insights.sbomify.com/CVE-2026-43930/): Parse Server: MFA SMS one-time password accepted twice under concurrent login (low 2.1)
- [CVE-2026-4393](https://insights.sbomify.com/CVE-2026-4393/): Automated Logout - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-030 (medium 4.3)
- [CVE-2026-43929](https://insights.sbomify.com/CVE-2026-43929/): ssrfcheck: Server-Side Request Forgery (SSRF) and Incomplete List of Disallowed Inputs (high 8.2)
- [CVE-2026-43928](https://insights.sbomify.com/CVE-2026-43928/): FOSSBilling: Payment amount not validated in PayPalEmail adapter allows invoice underpayment (low 2.3)
- [CVE-2026-43927](https://insights.sbomify.com/CVE-2026-43927/): FOSSBilling has race condition in cart checkout that bypasses promo code usage limits (medium 6.9)
- [CVE-2026-43926](https://insights.sbomify.com/CVE-2026-43926/): FOSSBilling's password reset confirmation endpoint lacks rate limiting (medium 6.3)
- [CVE-2026-43925](https://insights.sbomify.com/CVE-2026-43925/): FOSSBilling: Mass assignment of group_id in guest client registration allows unauthorized promo code use (medium 6.9)
- [CVE-2026-43924](https://insights.sbomify.com/CVE-2026-43924/): FOSSBilling has an open redirect via administrator-configured redirect targets (medium 4.8)
- [CVE-2026-43921](https://insights.sbomify.com/CVE-2026-43921/): FOSSBilling vulnerable to arbitrary PHP code injection via unescaped config serialization (high 8.9)
- [CVE-2026-43920](https://insights.sbomify.com/CVE-2026-43920/): FOSSBilling: Unauthenticated update patcher endpoint allows remote maintenance execution (medium 6.9)
- [CVE-2026-4392](https://insights.sbomify.com/CVE-2026-4392/): TeamSpeak 3 Server clientek Handshake assertion (medium 6.9)
- [CVE-2026-43918](https://insights.sbomify.com/CVE-2026-43918/): Auth bypass in FOSSBilling (high 8.7)
- [CVE-2026-43917](https://insights.sbomify.com/CVE-2026-43917/): Dokploy: Cross-Organization IDOR - Multiple tRPC endpoints missing activeOrganizationId validation (medium 5.3)
- [CVE-2026-43916](https://insights.sbomify.com/CVE-2026-43916/): pam_authnft: Heap buffer overflow in NETLINK_SOCK_DIAG reply walker (high 8.7)
- [CVE-2026-43915](https://insights.sbomify.com/CVE-2026-43915/): Coturn: Stored Cross-Site Scripting (XSS) in web-admin interface via TURN username (medium 5.4)
- [CVE-2026-43914](https://insights.sbomify.com/CVE-2026-43914/): Vaultwarden: Brute-force protection bypass vulnerability (high 7.3)
- [CVE-2026-43913](https://insights.sbomify.com/CVE-2026-43913/): Vaultwarden: Unconfirmed Owner Can Purge Entire Organization Vault (high 8.1)
- [CVE-2026-43912](https://insights.sbomify.com/CVE-2026-43912/): Vaultwarden: Cross-Org Group Binding Enables Unauthorized Read And Write Access Into Another Organization (high 8.7)
- [CVE-2026-43911](https://insights.sbomify.com/CVE-2026-43911/): Vaultwarden: Refresh tokens not invalidated on security stamp rotation (medium 6.8)
- [CVE-2026-43910](https://insights.sbomify.com/CVE-2026-43910/): Appium java-client Allows Network Pivot via Unvalidated directConnect Redirect in AppiumCommandExecutor (high 8.2)
- [CVE-2026-4391](https://insights.sbomify.com/CVE-2026-4391/): TeamSpeak 3 Server ECC Key heap-based overflow (medium 6.9)
- [CVE-2026-43909](https://insights.sbomify.com/CVE-2026-43909/): OpenImageIO: Signed integer overflow in SwapRGBABytes loop index leads to out-of-bounds read/write in DPX ABGR decoder (high 8.8)
- [CVE-2026-43908](https://insights.sbomify.com/CVE-2026-43908/): OpenImageIO: Signed integer overflow in ConvertCbYCrYToRGB leads to heap out-of-bounds write in DPX 4:2:2 decoder (high 8.8)
- [CVE-2026-43907](https://insights.sbomify.com/CVE-2026-43907/): Integer overflow in OpenImageIO (high 8.3)
- [CVE-2026-43906](https://insights.sbomify.com/CVE-2026-43906/): OpenImageIO: HEIF Heap overflow (high 8.5)
- [CVE-2026-43905](https://insights.sbomify.com/CVE-2026-43905/): OpenImageIO: JPEG2000 (OpenJPH) signed integer overflow in buffer allocation (high 7.1)
- [CVE-2026-43904](https://insights.sbomify.com/CVE-2026-43904/): OpenImageIO: Softimage PIC RLE decoder heap buffer overflow — longCount not clamped to image width (high 8.4)
- [CVE-2026-43903](https://insights.sbomify.com/CVE-2026-43903/): OpenImageIO: SGI RLE decoder heap buffer overflow OIIO_DASSERT bounds checks are no-ops in release builds (high 8.4)
- [CVE-2026-43901](https://insights.sbomify.com/CVE-2026-43901/): Wireshark MCP: Arbitrary file write via export_objects when WIRESHARK_MCP_ALLOWED_DIRS is not configured (medium 6.8)
- [CVE-2026-43900](https://insights.sbomify.com/CVE-2026-43900/): DeepChat: Persistent DOM XSS via HTML Entity Encoding in `<antArtifact>` SVG Rendering (Bypass of `svgSanitizer.ts`) (critical 9.3)
- [CVE-2026-4390](https://insights.sbomify.com/CVE-2026-4390/): TeamSpeak 3 Server Connection State Management process_resend_queue use after free (medium 5.3)
- [CVE-2026-43899](https://insights.sbomify.com/CVE-2026-43899/): Code injection in deepchat (critical 9.6)
- [CVE-2026-43898](https://insights.sbomify.com/CVE-2026-43898/): SandboxJS: Sandbox escape via Function.caller leakage of internal call op (critical 10.0)
- [CVE-2026-43897](https://insights.sbomify.com/CVE-2026-43897/): Link Preview JS: vunerable to IPv6 and internal loopback attacks (high 8.7)
- [CVE-2026-43896](https://insights.sbomify.com/CVE-2026-43896/): jq: Stack Overflow in Recursive Object Merge (medium 6.2)
- [CVE-2026-43895](https://insights.sbomify.com/CVE-2026-43895/): Security feature bypass in jq (medium 4.4)
- [CVE-2026-43894](https://insights.sbomify.com/CVE-2026-43894/): jq: Wild stack write via signed-integer overflow in decNumber D2U() macro (medium 6.2)
- [CVE-2026-43893](https://insights.sbomify.com/CVE-2026-43893/): exiftool-vendored: Argument injection via newline characters in tag names (high 8.2)
- [CVE-2026-43892](https://insights.sbomify.com/CVE-2026-43892/): AntSword: Incomplete noxss() sanitization leads to 1-click RCE via jquery.terminal format code injection (high 8.8)
- [CVE-2026-43891](https://insights.sbomify.com/CVE-2026-43891/): changedetection.io: Arbitrary Local File Read via crafted backup restore (high 7.5)
- [CVE-2026-43890](https://insights.sbomify.com/CVE-2026-43890/): Missing authorization in outline (high 7.7)
- [CVE-2026-4389](https://insights.sbomify.com/CVE-2026-4389/): Cross-site scripting in DSGVO snippet for Leaflet Map and its Extensions (medium 6.4)
- [CVE-2026-43889](https://insights.sbomify.com/CVE-2026-43889/): Outline: Unauthorized Document Publication via Mixed collectionId+documentId Share (medium 6.5)
- [CVE-2026-43888](https://insights.sbomify.com/CVE-2026-43888/): Outline: Zip Extraction Path Escape via PATH_MAX Truncation in Collection Import (high 8.7)
- [CVE-2026-43887](https://insights.sbomify.com/CVE-2026-43887/): Outline: Stored XSS via Comment Mentions (high 7.3)
- [CVE-2026-43886](https://insights.sbomify.com/CVE-2026-43886/): Outline: OAuth Scope Validation Logic Error Allows Privilege Escalation to Wildcard API Access (high 8.2)
- [CVE-2026-43885](https://insights.sbomify.com/CVE-2026-43885/): WWBN AVideo: Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization (high 7.7)
- [CVE-2026-43884](https://insights.sbomify.com/CVE-2026-43884/): WWBN AVideo: SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL() (high 7.7)
- [CVE-2026-43883](https://insights.sbomify.com/CVE-2026-43883/): AVideo: IDOR in PayPalYPT Plugin Allows Any Authenticated User to Cancel Arbitrary PayPal Subscription Agreements (medium 4.2)
- [CVE-2026-43882](https://insights.sbomify.com/CVE-2026-43882/): WWBN AVideo: Unauthenticated CRLF/ICS Injection in Scheduler downloadICS.php Allows Calendar Event Spoofing (medium 4.3)
- [CVE-2026-43881](https://insights.sbomify.com/CVE-2026-43881/): AVideo: Unauthenticated User Enumeration in objects/users.json.php via isCompany Parameter Allows Bypass of the Admin-Only Listing Restriction (medium 5.3)
- [CVE-2026-43880](https://insights.sbomify.com/CVE-2026-43880/): AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Enables Phishing from the Site’s Legitimate From Address (medium 5.3)
- [CVE-2026-4388](https://insights.sbomify.com/CVE-2026-4388/): Form Maker by 10Web <= 1.15.40 - Unauthenticated Stored Cross-Site Scripting via Matrix Field Text Box (high 7.2)
- [CVE-2026-43879](https://insights.sbomify.com/CVE-2026-43879/): AVideo has Blind SSRF in YPTWallet Donation Webhook via Missing isSSRFSafeURL() Check and CURLOPT_FOLLOWLOCATION Redirect Bypass (medium 5.4)
- [CVE-2026-43878](https://insights.sbomify.com/CVE-2026-43878/): Video: Reflected XSS in plugin/Meet/iframe.php via Unescaped user and pass Parameters in JavaScript String Literal (medium 6.1)
- [CVE-2026-43877](https://insights.sbomify.com/CVE-2026-43877/): AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Authenticated Users' Profile Photos with Arbitrary Content (medium 5.4)
- [CVE-2026-43876](https://insights.sbomify.com/CVE-2026-43876/): AVideo: HTML Injection in notifySubscribers.json.php Allows Platform-Branded Phishing Emails to Channel Subscribers (medium 6.4)
- [CVE-2026-43875](https://insights.sbomify.com/CVE-2026-43875/): WWBN AVideo: Password Hash Leaked in MobileManager OAuth Redirect URL Enables Account Takeover (medium 6.8)
- [CVE-2026-43874](https://insights.sbomify.com/CVE-2026-43874/): AVideo has an Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross-User JavaScript Execution via `$msg['json']` Relay Bypass (high 7.2)
- [CVE-2026-43873](https://insights.sbomify.com/CVE-2026-43873/): AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the Configured Clone Server (high 7.5)
- [CVE-2026-43872](https://insights.sbomify.com/CVE-2026-43872/): actual-server has a path traversal vulnerability (medium 5.3)
- [CVE-2026-43871](https://insights.sbomify.com/CVE-2026-43871/): Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TCompactProtocol varint byte-count limit (high 8.7)
- [CVE-2026-43870](https://insights.sbomify.com/CVE-2026-43870/): Apache Thrift: Node.js web_server.js multi-vulnerability (high 7.3)
- [CVE-2026-4387](https://insights.sbomify.com/CVE-2026-4387/): Unencrypted storage of authentication state in StrongDM Desktop Application state.kv file (low 2.0)
- [CVE-2026-43869](https://insights.sbomify.com/CVE-2026-43869/): Apache Thrift: TSSLTransportFactory.java hostname verification (high 7.3)
- [CVE-2026-43868](https://insights.sbomify.com/CVE-2026-43868/): Apache Thrift: Rust implementation vulnerable to CVE-2020-13949 pattern (medium 5.3)
- [CVE-2026-43867](https://insights.sbomify.com/CVE-2026-43867/): Apache Camel-PQC: The AWS Secrets Manager key-lifecycle manager deserializes persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter (critical 9.8)
- [CVE-2026-43866](https://insights.sbomify.com/CVE-2026-43866/): Apache Camel, Apache Camel: Camel JMS - CVE-2026-40860 fix bypass via DefaultExchangeHolder (high 7.3)
- [CVE-2026-43865](https://insights.sbomify.com/CVE-2026-43865/): Apache Camel-Hazelcast: Unsafe Java deserialization in default-configured managed Hazelcast instances enables remote code execution (high 8.1)
- [CVE-2026-43864](https://insights.sbomify.com/CVE-2026-43864/): Null dereference in mutt (low 2.5)
- [CVE-2026-43863](https://insights.sbomify.com/CVE-2026-43863/): Denial of service in mutt (low 3.7)
- [CVE-2026-43862](https://insights.sbomify.com/CVE-2026-43862/): Security feature bypass in mutt (low 3.7)
- [CVE-2026-43861](https://insights.sbomify.com/CVE-2026-43861/): Other in mutt (low 3.7)
- [CVE-2026-43860](https://insights.sbomify.com/CVE-2026-43860/): Weak cryptography in mutt (low 3.7)
- [CVE-2026-43859](https://insights.sbomify.com/CVE-2026-43859/): Memory corruption in mutt (low 3.7)
- [CVE-2026-43858](https://insights.sbomify.com/CVE-2026-43858/): Memory corruption in ADAM-3600 (high 8.6)
- [CVE-2026-43857](https://insights.sbomify.com/CVE-2026-43857/): Code injection in ADAM-3600 (high 8.6)
- [CVE-2026-43856](https://insights.sbomify.com/CVE-2026-43856/): Memory corruption in ADAM-3600 (high 8.6)
- [CVE-2026-43855](https://insights.sbomify.com/CVE-2026-43855/): Memory corruption in ADAM-3600 (high 7.5)
- [CVE-2026-43854](https://insights.sbomify.com/CVE-2026-43854/): Information disclosure in ADAM-3600 (medium 6.3)
- [CVE-2026-43853](https://insights.sbomify.com/CVE-2026-43853/): Denial of service in ADAM-3600 (high 8.2)
- [CVE-2026-43852](https://insights.sbomify.com/CVE-2026-43852/): Path traversal in ADAM-3600 (high 8.2)
- [CVE-2026-43851](https://insights.sbomify.com/CVE-2026-43851/): Path traversal in ADAM-3600 (high 8.2)
- [CVE-2026-43850](https://insights.sbomify.com/CVE-2026-43850/): Command injection in ADAM-3600 (high 8.6)
- [CVE-2026-43849](https://insights.sbomify.com/CVE-2026-43849/): Memory corruption in ADAM-3600 (medium 6.9)
- [CVE-2026-43848](https://insights.sbomify.com/CVE-2026-43848/): Denial of service in ADAM-3600 (medium 6.9)
- [CVE-2026-43847](https://insights.sbomify.com/CVE-2026-43847/): Auth bypass in ADAM-3600 (high 8.2)
- [CVE-2026-43846](https://insights.sbomify.com/CVE-2026-43846/): Memory corruption in ADAM-3600 (high 8.6)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/636/