# Vulnerabilities published in 2026


- [CVE-2026-42327](https://insights.sbomify.com/CVE-2026-42327/): rust-openssl: undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs (high 8.7)
- [CVE-2026-42326](https://insights.sbomify.com/CVE-2026-42326/): ImageMagick: Heap Buffer Over-Read in IPTC encoder (medium 5.1)
- [CVE-2026-42324](https://insights.sbomify.com/CVE-2026-42324/): Piwigo: Second-Order SQL Injection (high 7.2)
- [CVE-2026-42323](https://insights.sbomify.com/CVE-2026-42323/): Piwigo: SQL Injection in Batch Manager (high 7.2)
- [CVE-2026-42322](https://insights.sbomify.com/CVE-2026-42322/): Piwigo: Authenticated RCE via File Upload in Logo Upload Feature (critical 9.1)
- [CVE-2026-42321](https://insights.sbomify.com/CVE-2026-42321/): GLPI has stored XSS in asset locks (high 8.4)
- [CVE-2026-42320](https://insights.sbomify.com/CVE-2026-42320/): GLPI vulnerable to arbitrary file access (medium 5.9)
- [CVE-2026-4232](https://insights.sbomify.com/CVE-2026-4232/): Tiandy Integrated Management Platform getAuthorityByUserId sql injection (medium 6.9)
- [CVE-2026-42318](https://insights.sbomify.com/CVE-2026-42318/): GLPI Vulnerable to Arbitrary Item Deletion via Planning Endpoint (high 7.0)
- [CVE-2026-42317](https://insights.sbomify.com/CVE-2026-42317/): GLPI vulnerable to arbitrary files deletion by technician (high 7.0)
- [CVE-2026-42316](https://insights.sbomify.com/CVE-2026-42316/): KQL injection via kusto.tables.topics.mapping in kafka-sink-azure-kusto (medium 5.9)
- [CVE-2026-42315](https://insights.sbomify.com/CVE-2026-42315/): pyLoad: Path Traversal via Package Folder Name in set_package_data (high 8.1)
- [CVE-2026-42314](https://insights.sbomify.com/CVE-2026-42314/): pyLoad: Path Traversal via Package Folder Name (medium 6.5)
- [CVE-2026-42313](https://insights.sbomify.com/CVE-2026-42313/): pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy (high 8.3)
- [CVE-2026-42312](https://insights.sbomify.com/CVE-2026-42312/): pyload-ng: non-admin SETTINGS users can disable outbound TLS peer verification (medium 6.8)
- [CVE-2026-42311](https://insights.sbomify.com/CVE-2026-42311/): Pillow: OOB Write with Invalid PSD Tile Extents (Integer Overflow) (high 8.6)
- [CVE-2026-42310](https://insights.sbomify.com/CVE-2026-42310/): Pillow: PDF Parsing Trailer Infinite Loop (DoS) (medium 5.1)
- [CVE-2026-4231](https://insights.sbomify.com/CVE-2026-4231/): vanna-ai vanna Endpoint __init__.py run_sql server-side request forgery (medium 6.9)
- [CVE-2026-42309](https://insights.sbomify.com/CVE-2026-42309/): Pillow: Heap buffer overflow with nested list coordinates (medium 5.1)
- [CVE-2026-42308](https://insights.sbomify.com/CVE-2026-42308/): Pillow: Integer overflow when processing fonts (medium 5.1)
- [CVE-2026-42307](https://insights.sbomify.com/CVE-2026-42307/): Vim: OS Command Injection in netrw (medium 4.4)
- [CVE-2026-42306](https://insights.sbomify.com/CVE-2026-42306/): Moby: Race condition in docker cp allows bind mount redirection to host path (high 7.2)
- [CVE-2026-42305](https://insights.sbomify.com/CVE-2026-42305/): Dulwich has an arbitrary file write via NTFS-hostile tree entries on Windows (high 8.8)
- [CVE-2026-42304](https://insights.sbomify.com/CVE-2026-42304/): Twisted: Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains (high 7.5)
- [CVE-2026-42303](https://insights.sbomify.com/CVE-2026-42303/): Fides: Privacy Request Identity Verification Bypass Vulnerability via Duplicate Detection (medium 6.1)
- [CVE-2026-42302](https://insights.sbomify.com/CVE-2026-42302/): FastGPT: Unauthenticated Remote Code Execution (RCE) via code-server Misconfiguration in agent-sandbox (critical 9.8)
- [CVE-2026-42301](https://insights.sbomify.com/CVE-2026-42301/): Improper Input Validation leading to Improper Control of Generation of Code ('Code Injection') in pyp2spec (high 7.8)
- [CVE-2026-42300](https://insights.sbomify.com/CVE-2026-42300/): DevGuard: Unauthenticated identity assertion via `X-Admin-Token` header (critical 9.3)
- [CVE-2026-4230](https://insights.sbomify.com/CVE-2026-4230/): vanna-ai vanna Endpoint __init__.py update_sql sql injection (medium 5.3)
- [CVE-2026-42298](https://insights.sbomify.com/CVE-2026-42298/): Postiz: Arbitrary Code Execution and Token Exfiltration in pr-docker-build.yml via untrusted Dockerfile.dev (critical 10.0)
- [CVE-2026-42297](https://insights.sbomify.com/CVE-2026-42297/): Argo Workflows Is Missing Authorization in Sync ConfigMap Provider (high 8.5)
- [CVE-2026-42296](https://insights.sbomify.com/CVE-2026-42296/): Argo has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure (high 8.1)
- [CVE-2026-42295](https://insights.sbomify.com/CVE-2026-42295/): Argo Workflows: Exposure of artifact repository credentials (high 8.5)
- [CVE-2026-42294](https://insights.sbomify.com/CVE-2026-42294/): Argo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor (high 8.2)
- [CVE-2026-42291](https://insights.sbomify.com/CVE-2026-42291/): SysReptor: Read-write access to personal notes by sharing-link creation with no authorization in SysReptor Professional (medium 6.8)
- [CVE-2026-42290](https://insights.sbomify.com/CVE-2026-42290/): protobufjs-cli: OS Command Injection (high 7.8)
- [CVE-2026-4229](https://insights.sbomify.com/CVE-2026-4229/): vanna-ai vanna bigquery_vector.py remove_training_data sql injection (medium 6.9)
- [CVE-2026-42289](https://insights.sbomify.com/CVE-2026-42289/): ChurchCRM: Cross-Site Request Forgery (CSRF) Leading to Admin Privilege Escalation (high 8.8)
- [CVE-2026-42288](https://insights.sbomify.com/CVE-2026-42288/): ChurchCRM: Incomplete fix for CVE-2026-39337: Unauthenticated RCE in Setup Wizard via unsanitized DB_PASSWORD (critical 10.0)
- [CVE-2026-42287](https://insights.sbomify.com/CVE-2026-42287/): Emlog: SQL Injection Vulnerability in log_model.php within addLog() and updateLog() Functions (critical 10.0)
- [CVE-2026-42286](https://insights.sbomify.com/CVE-2026-42286/): Emlog: Cross-Site Request Forgery in Admin Functions (high 8.4)
- [CVE-2026-42285](https://insights.sbomify.com/CVE-2026-42285/): GoBGP: Panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference) (high 7.5)
- [CVE-2026-42284](https://insights.sbomify.com/CVE-2026-42284/): GitPython: Unsafe option check validates multi_options before shlex.split transforms it (high 8.1)
- [CVE-2026-42283](https://insights.sbomify.com/CVE-2026-42283/): DevSpace UI Server WebSocket CheckOrigin does not validate source (high 7.7)
- [CVE-2026-42282](https://insights.sbomify.com/CVE-2026-42282/): n8n-MCP: Sensitive MCP tool-call arguments logged on authenticated requests in HTTP mode (medium 4.3)
- [CVE-2026-42281](https://insights.sbomify.com/CVE-2026-42281/): MagicMirror²: Unauthenticated SSRF via /cors endpoint (critical 9.2)
- [CVE-2026-42280](https://insights.sbomify.com/CVE-2026-42280/): Improper Permission Checking in Auth.js SDK (high 7.1)
- [CVE-2026-4228](https://insights.sbomify.com/CVE-2026-4228/): LB-LINK BL-WR9000 set_wifi sub_458754 command injection (medium 5.3)
- [CVE-2026-42279](https://insights.sbomify.com/CVE-2026-42279/): solidtime: Time entry update endpoint allows cross-organization modification of a known time-entry UUID (medium 5.8)
- [CVE-2026-42278](https://insights.sbomify.com/CVE-2026-42278/): UltraDAG: Smart Account Spending Policy Bypass via Pockets (high 8.8)
- [CVE-2026-42277](https://insights.sbomify.com/CVE-2026-42277/): Onyx: IDOR in /chat/file/{file_id} allows any authenticated user to download other users files (medium 6.5)
- [CVE-2026-42276](https://insights.sbomify.com/CVE-2026-42276/): Onyx: IDOR in /chat/stop-chat-session allows any authenticated user to interrupt other users chat sessions (medium 4.3)
- [CVE-2026-42275](https://insights.sbomify.com/CVE-2026-42275/): zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write (high 8.7)
- [CVE-2026-42274](https://insights.sbomify.com/CVE-2026-42274/): Heimdall: Authorization bypass via path normalization mismatch (high 7.8)
- [CVE-2026-42273](https://insights.sbomify.com/CVE-2026-42273/): Heimdall: Case-sensitive host matching may lead to policy bypass (high 7.8)
- [CVE-2026-42272](https://insights.sbomify.com/CVE-2026-42272/): Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretation (high 7.8)
- [CVE-2026-42271](https://insights.sbomify.com/CVE-2026-42271/): BerriAI LiteLLM Command Injection (high 8.7, exploited in the wild)
- [CVE-2026-42270](https://insights.sbomify.com/CVE-2026-42270/): countly-server: Unauthenticated Denial of Service (DoS) via Unhandled Stream Exception (high 7.5)
- [CVE-2026-4227](https://insights.sbomify.com/CVE-2026-4227/): LB-LINK BL-WR9000 get_hidessid_cfg sub_44D844 buffer overflow (high 8.7)
- [CVE-2026-42269](https://insights.sbomify.com/CVE-2026-42269/): countly-server: Path Traversal in delete_import Endpoint Allows Arbitrary File and Directory Deletion (high 8.1)
- [CVE-2026-42268](https://insights.sbomify.com/CVE-2026-42268/): ModSecurity: Unsigned integer underflow in @verifySSN / @verifyCPF / @verifySVNR operators (high 8.2)
- [CVE-2026-42267](https://insights.sbomify.com/CVE-2026-42267/): Kimai: Formula Injection via tag names in XLSX export (medium 5.4)
- [CVE-2026-42266](https://insights.sbomify.com/CVE-2026-42266/): JupyterLab has an Extension Manager API/GUI Policy Discrepancy, allowing 3rd party (malicious) extensions install via POST request (high 8.8)
- [CVE-2026-42264](https://insights.sbomify.com/CVE-2026-42264/): Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking (high 7.4)
- [CVE-2026-42261](https://insights.sbomify.com/CVE-2026-42261/): PromptHub: Authenticated SSRF via IPv6 filter bypass in `POST /api/skills/fetch-remote` (high 7.1)
- [CVE-2026-42260](https://insights.sbomify.com/CVE-2026-42260/): open-websearch has SSRF in `fetchWebContent` MCP tool: bracketed IPv6 literals and non-resolving hostname check bypass `isPrivateOrLocalHostname` (high 8.2)
- [CVE-2026-4226](https://insights.sbomify.com/CVE-2026-4226/): LB-LINK BL-WR9000 get_virtual_cfg sub_44E8D0 stack-based overflow (high 8.7)
- [CVE-2026-42259](https://insights.sbomify.com/CVE-2026-42259/): Saltcorn: Open Redirect in `POST /auth/login` due to incomplete `is_relative_url` validation (backslash bypass) (medium 5.1)
- [CVE-2026-42258](https://insights.sbomify.com/CVE-2026-42258/): net-imap: Command Injection via unvalidated Symbol inputs (medium 5.8)
- [CVE-2026-42257](https://insights.sbomify.com/CVE-2026-42257/): net-imap: Command Injection via "raw" arguments to multiple commands (medium 5.8)
- [CVE-2026-42256](https://insights.sbomify.com/CVE-2026-42256/): net-imap: Denial of service via high iteration count for `SCRAM-*` authentication (medium 6.0)
- [CVE-2026-42255](https://insights.sbomify.com/CVE-2026-42255/): Denial of service in DnsServer (high 7.2)
- [CVE-2026-42254](https://insights.sbomify.com/CVE-2026-42254/): Other in Hickory DNS (medium 4.0)
- [CVE-2026-42253](https://insights.sbomify.com/CVE-2026-42253/): Apache ActiveMQ, Apache ActiveMQ Web: HTTP Response Header Injection via JMS Message Properties (medium 6.1)
- [CVE-2026-42252](https://insights.sbomify.com/CVE-2026-42252/): Apache Airflow: BashOperator Jinja2 injection via dag_run.conf — low-privilege user pattern (critical 9.1)
- [CVE-2026-42251](https://insights.sbomify.com/CVE-2026-42251/): Hard-coded credentials in KS-SOMED (high 8.7)
- [CVE-2026-42250](https://insights.sbomify.com/CVE-2026-42250/): Off-by-One Leading to Out-of-Bounds Write in bzip2 (medium 4.8)
- [CVE-2026-4225](https://insights.sbomify.com/CVE-2026-4225/): CMS Made Simple User Management listusers.php cross site scripting (medium 4.8)
- [CVE-2026-42249](https://insights.sbomify.com/CVE-2026-42249/): Remote Code Execution in Ollama via Update Mechanism (high 7.7)
- [CVE-2026-42248](https://insights.sbomify.com/CVE-2026-42248/): Missing Signature Verification for Updates in Ollama (high 7.7)
- [CVE-2026-42246](https://insights.sbomify.com/CVE-2026-42246/): net-imap vulnerable to STARTTLS stripping via invalid response timing (high 7.6)
- [CVE-2026-42245](https://insights.sbomify.com/CVE-2026-42245/): net-imap: Quadratic complexity when reading response literals (low 2.3)
- [CVE-2026-42241](https://insights.sbomify.com/CVE-2026-42241/): ParquetSharp: Possible Stack Overflow When Reading a ParquetFile with Large Decimal Type Width (medium 5.3)
- [CVE-2026-4224](https://insights.sbomify.com/CVE-2026-4224/): Stack overflow parsing XML with deeply nested DTD content models (medium 6.0)
- [CVE-2026-42239](https://insights.sbomify.com/CVE-2026-42239/): Budibase auth session cookies are set with httpOnly:false — any XSS can lead to full account takeover (high 8.1)
- [CVE-2026-42238](https://insights.sbomify.com/CVE-2026-42238/): Unauthenticated Remote Code Execution via Backup Restore in nginx-ui (critical 9.0)
- [CVE-2026-42237](https://insights.sbomify.com/CVE-2026-42237/): n8n: SQL Injection in Snowflake and MySQL Nodes (medium 5.3)
- [CVE-2026-42236](https://insights.sbomify.com/CVE-2026-42236/): n8n: Unauthenticated Denial of Service via MCP Client Registration (high 8.7)
- [CVE-2026-42235](https://insights.sbomify.com/CVE-2026-42235/): n8n: XSS via MCP OAuth client (high 8.8)
- [CVE-2026-42234](https://insights.sbomify.com/CVE-2026-42234/): n8n: Python Task Runner Sandbox Escape (high 7.1)
- [CVE-2026-42233](https://insights.sbomify.com/CVE-2026-42233/): n8n: SQL Injection in Oracle Database Node via Limit Field (medium 5.3)
- [CVE-2026-42232](https://insights.sbomify.com/CVE-2026-42232/): n8n: XML Node Prototype Pollution to RCE (critical 9.4)
- [CVE-2026-42231](https://insights.sbomify.com/CVE-2026-42231/): n8n: Prototype Pollution in XML Webhook Body Parser Leads to RCE (critical 9.4)
- [CVE-2026-42230](https://insights.sbomify.com/CVE-2026-42230/): n8n: Open Redirect in MCP OAuth Consent Flow (medium 5.1)
- [CVE-2026-4223](https://insights.sbomify.com/CVE-2026-4223/): itsourcecode Payroll Management System manage_employee.php sql injection (medium 6.9)
- [CVE-2026-42229](https://insights.sbomify.com/CVE-2026-42229/): n8n: SQL Injection in SeaTable Node (medium 5.3)
- [CVE-2026-42228](https://insights.sbomify.com/CVE-2026-42228/): n8n: Hijacking of Unauthenticated Chat Execution (medium 6.3)
- [CVE-2026-42227](https://insights.sbomify.com/CVE-2026-42227/): n8n: Public API Variables IDOR Allows Cross-Project Secret Disclosure (medium 6.0)
- [CVE-2026-42226](https://insights.sbomify.com/CVE-2026-42226/): n8n: Credential Authorization Bypass in dynamic-node-parameters Allows Foreign API Key Replay (high 7.1)
- [CVE-2026-42225](https://insights.sbomify.com/CVE-2026-42225/): GnuTLS backend silently skips certificate chain verification when verify_peer is false (high 8.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/652/