# Vulnerabilities published in 2026


- [CVE-2026-42618](https://insights.sbomify.com/CVE-2026-42618/): Memory corruption in tuxera:ntfs-3g (high 7.1)
- [CVE-2026-42617](https://insights.sbomify.com/CVE-2026-42617/): Memory corruption in tuxera:ntfs-3g (high 7.1)
- [CVE-2026-42616](https://insights.sbomify.com/CVE-2026-42616/): Memory corruption in tuxera:ntfs-3g (high 7.8)
- [CVE-2026-42615](https://insights.sbomify.com/CVE-2026-42615/): CyberChef has a Cross-site Scripting issue (high 7.2)
- [CVE-2026-42613](https://insights.sbomify.com/CVE-2026-42613/): Grav: Privilege Escalation via Missing Server-Side Validation of groups/access (critical 9.4)
- [CVE-2026-42612](https://insights.sbomify.com/CVE-2026-42612/): Grav: Publisher-Level Stored XSS via Unquoted Event Attributes (high 8.5)
- [CVE-2026-42611](https://insights.sbomify.com/CVE-2026-42611/): Grav: Stored XSS via Tag Injection (high 8.9)
- [CVE-2026-42610](https://insights.sbomify.com/CVE-2026-42610/): Grav: Sensitive Information Disclosure via Accounts Service Bypass (medium 6.5)
- [CVE-2026-4261](https://insights.sbomify.com/CVE-2026-4261/): Privilege escalation in Expire Users (high 8.8)
- [CVE-2026-42609](https://insights.sbomify.com/CVE-2026-42609/): Grav: Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic (high 8.1)
- [CVE-2026-42608](https://insights.sbomify.com/CVE-2026-42608/): Grav: Unauthenticated Path Traversal & Arbitrary File Write in FormFlash component. (high 8.8)
- [CVE-2026-42607](https://insights.sbomify.com/CVE-2026-42607/): Grav: Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature (critical 9.1)
- [CVE-2026-42606](https://insights.sbomify.com/CVE-2026-42606/): AzuraCast: Password Reset Poisoning via Untrusted X-Forwarded-Host Header Leads to Account Takeover and 2FA Bypass (high 8.1)
- [CVE-2026-42605](https://insights.sbomify.com/CVE-2026-42605/): AzuraCast: Path Traversal in `currentDirectory` Parameter Enables Remote Code Execution via Media Upload (high 8.8)
- [CVE-2026-42604](https://insights.sbomify.com/CVE-2026-42604/): Actual has an OpenID `client_secret` Disclosure via Broken Authorization Guard in `/openid/config` (medium 6.9)
- [CVE-2026-42603](https://insights.sbomify.com/CVE-2026-42603/): OWASP BLT: pre-commit-fix.yaml executes untrusted fork code via pull_request_target (high 8.8)
- [CVE-2026-42602](https://insights.sbomify.com/CVE-2026-42602/): azureauthextension Authenticate method does not validate bearer tokens, allowing auth bypass via replay (high 8.1)
- [CVE-2026-42601](https://insights.sbomify.com/CVE-2026-42601/): ArchiveBox Vulnerable to RCE via unvalidated per-crawl config overrides in AddView (critical 9.3)
- [CVE-2026-42600](https://insights.sbomify.com/CVE-2026-42600/): MinIO: Path Traversal via msgpack Body in `ReadMultiple` Storage-REST Endpoint (medium 6.9)
- [CVE-2026-42599](https://insights.sbomify.com/CVE-2026-42599/): Cross-site scripting via spread attributes in Svelte SSR (medium 5.1)
- [CVE-2026-42598](https://insights.sbomify.com/CVE-2026-42598/): Pode: Directory Traversal is possible on Static Routes (medium 6.9)
- [CVE-2026-42597](https://insights.sbomify.com/CVE-2026-42597/): Gotenberg: Chromium URL conversion routes read arbitrary files under /tmp via file:// scheme (medium 5.9)
- [CVE-2026-42596](https://insights.sbomify.com/CVE-2026-42596/): Gotenberg: Unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook (critical 9.4)
- [CVE-2026-42595](https://insights.sbomify.com/CVE-2026-42595/): Gotenberg: Server-Side Request Forgery via Chromium URL Endpoint with Redirect-Based Deny-List Bypass (high 8.6)
- [CVE-2026-42594](https://insights.sbomify.com/CVE-2026-42594/): Gotenberg: Unauthenticated denial of service via echo.Context pool reuse in webhook async goroutine (high 7.5)
- [CVE-2026-42593](https://insights.sbomify.com/CVE-2026-42593/): Gotenberg: Arbitrary PDF read via stampExpression and watermarkExpression in merge, split, and convert routes (medium 5.3)
- [CVE-2026-42592](https://insights.sbomify.com/CVE-2026-42592/): Gotenberg: DNS rebinding bypasses SSRF validation on Chromium URL conversion routes (medium 5.3)
- [CVE-2026-42591](https://insights.sbomify.com/CVE-2026-42591/): Gotenberg: Server-Side Request Forgery (SSRF) in github.com/gotenberg/gotenberg/v8 (high 8.2)
- [CVE-2026-42590](https://insights.sbomify.com/CVE-2026-42590/): Gotenberg: ExifTool group-prefix syntax bypasses dangerous-tag blocklist (high 8.2)
- [CVE-2026-4259](https://insights.sbomify.com/CVE-2026-4259/): Ultimate WooCommerce Auction Pro <= 2.4.5 - Reflected XSS via uwa_manage_auctions (high 7.1)
- [CVE-2026-42589](https://insights.sbomify.com/CVE-2026-42589/): Gotenberg: Unauthenticated RCE via ExifTool Metadata Key Injection (critical 9.8)
- [CVE-2026-42588](https://insights.sbomify.com/CVE-2026-42588/): Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Remote Code Execution via Jolokia addNetworkConnector (high 8.1)
- [CVE-2026-42587](https://insights.sbomify.com/CVE-2026-42587/): Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS (high 7.5)
- [CVE-2026-42586](https://insights.sbomify.com/CVE-2026-42586/): Netty: CRLF Injection in Netty Redis Codec Encoder (medium 6.8)
- [CVE-2026-42585](https://insights.sbomify.com/CVE-2026-42585/): Netty: HTTP Request Smuggling due to malformed Transfer-Encoding (medium 6.5)
- [CVE-2026-42584](https://insights.sbomify.com/CVE-2026-42584/): Netty: HttpClientCodec response desynchronization (high 7.3)
- [CVE-2026-42583](https://insights.sbomify.com/CVE-2026-42583/): Netty: Lz4FrameDecoder resource exhaustion (high 7.5)
- [CVE-2026-42582](https://insights.sbomify.com/CVE-2026-42582/): Netty: HTTP/3 QPACK literal unbounded allocation (high 7.5)
- [CVE-2026-42581](https://insights.sbomify.com/CVE-2026-42581/): Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization (medium 5.8)
- [CVE-2026-42580](https://insights.sbomify.com/CVE-2026-42580/): Netty: HTTP Request Smuggling due to incorrect chunk size parsing (medium 6.5)
- [CVE-2026-4258](https://insights.sbomify.com/CVE-2026-4258/): sjcl is missing point-on-curve validation in sjcl.ecc.basicKey.publicKey (high 8.7)
- [CVE-2026-42579](https://insights.sbomify.com/CVE-2026-42579/): Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder) (high 7.5)
- [CVE-2026-42578](https://insights.sbomify.com/CVE-2026-42578/): Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation (low 2.9)
- [CVE-2026-42577](https://insights.sbomify.com/CVE-2026-42577/): Netty: epoll transport denial of service via RST on half-closed TCP connection (high 7.5)
- [CVE-2026-42576](https://insights.sbomify.com/CVE-2026-42576/): apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery (medium 6.5)
- [CVE-2026-42575](https://insights.sbomify.com/CVE-2026-42575/): apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) (high 7.5)
- [CVE-2026-42574](https://insights.sbomify.com/CVE-2026-42574/): apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root (high 7.5)
- [CVE-2026-42573](https://insights.sbomify.com/CVE-2026-42573/): Svelte: XSS via DOM Clobbering of Internal Framework State (medium 5.3)
- [CVE-2026-42572](https://insights.sbomify.com/CVE-2026-42572/): Hatchet: Cross-tenant information disclosure in `listTasksByDAGIds` (medium 5.3)
- [CVE-2026-42571](https://insights.sbomify.com/CVE-2026-42571/): Privilege Escalation Attack affecting Pelican Web UI (critical 9.0)
- [CVE-2026-42570](https://insights.sbomify.com/CVE-2026-42570/): Svelte devalue: DoS via sparse array deserialization (high 7.5)
- [CVE-2026-4257](https://insights.sbomify.com/CVE-2026-4257/): Contact Form by Supsystic <= 1.7.36 - Unauthenticated Server-Side Template Injection via Prefill Functionality (critical 9.8)
- [CVE-2026-42569](https://insights.sbomify.com/CVE-2026-42569/): phpvms: /importer authorization bypass causing full database wipe (critical 9.4)
- [CVE-2026-42568](https://insights.sbomify.com/CVE-2026-42568/): Yamcs Vulnerable to LDAP Injection in LdapAuthModule (medium 4.3)
- [CVE-2026-42567](https://insights.sbomify.com/CVE-2026-42567/): Svelte: ReDoS in `<svelte:element>` Tag Validation (medium 5.9)
- [CVE-2026-42566](https://insights.sbomify.com/CVE-2026-42566/): Meshtastic: Malformed UTF-8 in User.long_name broadcast over LoRa causes mesh-wide client decode failure (high 7.5)
- [CVE-2026-42565](https://insights.sbomify.com/CVE-2026-42565/): @workos/authkit-session: Open Redirect via state-derived redirect target (medium 4.3)
- [CVE-2026-42564](https://insights.sbomify.com/CVE-2026-42564/): jotty·page: Unauthenticated Path Traversal leads to sensitive file disclosure and session-token reuse impact (high 8.2)
- [CVE-2026-42563](https://insights.sbomify.com/CVE-2026-42563/): Dulwich Vulnerable to Command Injection via Merge Driver Path (high 7.7)
- [CVE-2026-42562](https://insights.sbomify.com/CVE-2026-42562/): Plainpad: Privilege Escalation via Writable Admin Field in Profile Update (Access Control) (high 8.3)
- [CVE-2026-42561](https://insights.sbomify.com/CVE-2026-42561/): Python-Multipart: Denial of Service via unbounded multipart part headers (high 7.5)
- [CVE-2026-42560](https://insights.sbomify.com/CVE-2026-42560/): auth: Patreon provider assigns the same local user ID to every authenticated Patreon account, enabling cross‑user impersonation (critical 9.1)
- [CVE-2026-4256](https://insights.sbomify.com/CVE-2026-4256/): LDAP Injection in PEAKUP's PassGate (high 8.2)
- [CVE-2026-42559](https://insights.sbomify.com/CVE-2026-42559/): RMCP: DNS rebinding vulnerability in rmcp Streamable HTTP server transport (high 8.8)
- [CVE-2026-42558](https://insights.sbomify.com/CVE-2026-42558/): Xibo Vulnerable to Stored XSS and Iframe Sandbox Escape via Data Connector Script in DataSet (high 7.6)
- [CVE-2026-42557](https://insights.sbomify.com/CVE-2026-42557/): jupyterlab: Command linker attributes in HTML enable one-click command execution from untrusted content (high 8.6)
- [CVE-2026-42556](https://insights.sbomify.com/CVE-2026-42556/): Postiz stored XSS in public preview page (high 8.9)
- [CVE-2026-42555](https://insights.sbomify.com/CVE-2026-42555/): Valtimo: SpEL injection via StandardEvaluationContext allows Remote Code Execution by admin users (critical 9.1)
- [CVE-2026-42554](https://insights.sbomify.com/CVE-2026-42554/): Fiber: XSS in AutoFormat Content Negotiation (medium 5.3)
- [CVE-2026-42553](https://insights.sbomify.com/CVE-2026-42553/): Cinny: Access token disclosure via invalidated emoji pack avatar URL in service worker (high 7.1)
- [CVE-2026-42552](https://insights.sbomify.com/CVE-2026-42552/): Flight: Sensitive information disclosure via default error handler in flightphp/core (high 7.5)
- [CVE-2026-42551](https://insights.sbomify.com/CVE-2026-42551/): Flight: HTTP method override enabled by default enables CSRF escalation and middleware bypass in flightphp/core (high 7.5)
- [CVE-2026-42550](https://insights.sbomify.com/CVE-2026-42550/): Flight: SQL Injection via unvalidated identifiers in SimplePdo::insert / update / delete (high 8.8)
- [CVE-2026-4255](https://insights.sbomify.com/CVE-2026-4255/): DLL Injection Privilege Escalation (high 8.4)
- [CVE-2026-42549](https://insights.sbomify.com/CVE-2026-42549/): Flight: Path traversal in `make:controller` CLI creates arbitrary directories outside project root (medium 4.4)
- [CVE-2026-42548](https://insights.sbomify.com/CVE-2026-42548/): Flight: Reflected XSS via unvalidated JSONP callback in Flight::jsonp() (high 8.6)
- [CVE-2026-42547](https://insights.sbomify.com/CVE-2026-42547/): IRIS Alerts Can be Falsely Attributed to Customers (medium 5.4)
- [CVE-2026-42546](https://insights.sbomify.com/CVE-2026-42546/): OP-TEE has missing OPTEE_MSG_ATTR_TYPE_MASK in cleanup_shm_refs() leaks mobj references (low 3.8)
- [CVE-2026-42545](https://insights.sbomify.com/CVE-2026-42545/): Granian: DoS via WSGI response header panic (medium 5.9)
- [CVE-2026-42544](https://insights.sbomify.com/CVE-2026-42544/): Granian: Unauthenticated DoS via WebSocket subprotocol header panic (high 7.5)
- [CVE-2026-42543](https://insights.sbomify.com/CVE-2026-42543/): IRIS has a Cross-Site Request Forgery (CSRF) issue (medium 4.3)
- [CVE-2026-42542](https://insights.sbomify.com/CVE-2026-42542/): TDengine has an integer underflow in uvConnMayGetUserInfo() allows unauthenticated remote crash (DoS) (high 7.5)
- [CVE-2026-42541](https://insights.sbomify.com/CVE-2026-42541/): Kubewarden: RBAC Reconnaissance via unchecked can_i host capability call (medium 4.3)
- [CVE-2026-42540](https://insights.sbomify.com/CVE-2026-42540/): IRIS has a Mass Assignment issue (medium 4.3)
- [CVE-2026-4254](https://insights.sbomify.com/CVE-2026-4254/): Tenda AC8 HTTP Endpoint SysToolChangePwd doSystemCmd stack-based overflow (critical 9.3)
- [CVE-2026-42539](https://insights.sbomify.com/CVE-2026-42539/): IRIS has an Excessive Data Exposure issue (medium 6.5)
- [CVE-2026-42538](https://insights.sbomify.com/CVE-2026-42538/): IRIS has an Insecure File Upload (medium 6.3)
- [CVE-2026-42537](https://insights.sbomify.com/CVE-2026-42537/): Apache Ranger: Remote Code Execution via JDBC URL Injection (critical 9.8)
- [CVE-2026-42536](https://insights.sbomify.com/CVE-2026-42536/): Apache HTTP Server: mod_xml2enc heap overflow (high 7.5)
- [CVE-2026-42535](https://insights.sbomify.com/CVE-2026-42535/): Apache HTTP Server: mod_dav_fs protected directory access (critical 9.1)
- [CVE-2026-42534](https://insights.sbomify.com/CVE-2026-42534/): Jostle logic bypass degrades resolution performance (medium 6.9)
- [CVE-2026-42533](https://insights.sbomify.com/CVE-2026-42533/): NGINX Map directive and Regex matching vulnerability (critical 9.2)
- [CVE-2026-42532](https://insights.sbomify.com/CVE-2026-42532/): Path traversal in visidata (medium 5.5)
- [CVE-2026-42530](https://insights.sbomify.com/CVE-2026-42530/): NGINX Open-Source ngx_http_v3_module vulnerability (critical 9.2)
- [CVE-2026-4253](https://insights.sbomify.com/CVE-2026-4253/): Tenda AC8 Web UploadCfg route_set_user_policy_rule os command injection (medium 5.1)
- [CVE-2026-42528](https://insights.sbomify.com/CVE-2026-42528/): Apache HTTP Server: mod_dav shared lock overflow (medium 4.3)
- [CVE-2026-42527](https://insights.sbomify.com/CVE-2026-42527/): Apache Camel: Permissive default ObjectInputFilter pattern admits java.net.** and enables DNS-based information disclosure (high 8.1)
- [CVE-2026-42526](https://insights.sbomify.com/CVE-2026-42526/): Apache Airflow Amazon provider: Prevent unauthorized access to team-scoped secrets in AWS Secrets Manager and SSM Parameter Store backends (medium 5.3)
- [CVE-2026-42525](https://insights.sbomify.com/CVE-2026-42525/): Jenkins Microsoft Entra ID (previously Azure AD) Plugin has an open redirect vulnerability (medium 4.3)
- [CVE-2026-42524](https://insights.sbomify.com/CVE-2026-42524/): Jenkins HTML Publisher Plugin has a XSS vulnerability in the legacy wrapper file (high 8.0)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/649/