# Vulnerabilities published in 2026


- [CVE-2026-42224](https://insights.sbomify.com/CVE-2026-42224/): ipl/web is vulnerable to reflected XSS by malformed search requests (high 7.6)
- [CVE-2026-42223](https://insights.sbomify.com/CVE-2026-42223/): nginx-ui: Settings API Exposes Protected Secrets (medium 6.5)
- [CVE-2026-42222](https://insights.sbomify.com/CVE-2026-42222/): nginx-ui: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeover (high 8.1)
- [CVE-2026-42221](https://insights.sbomify.com/CVE-2026-42221/): nginx-ui: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim (high 8.1)
- [CVE-2026-42220](https://insights.sbomify.com/CVE-2026-42220/): Nginx-UI: Authenticated settings disclosure exposes node.secret and enables trusted-node authentication abuse, backup exfiltration, and restore-based nginx-ui state rollback (medium 6.5)
- [CVE-2026-4222](https://insights.sbomify.com/CVE-2026-4222/): SSCMS download PathUtils.RemoveParentPath path traversal (medium 5.1)
- [CVE-2026-42219](https://insights.sbomify.com/CVE-2026-42219/): Frappe: Path Traversal via /backups Route (medium 6.9)
- [CVE-2026-42218](https://insights.sbomify.com/CVE-2026-42218/): XRDP is vulnerable to a server timing attack, leading to user enumeration (medium 5.3)
- [CVE-2026-42217](https://insights.sbomify.com/CVE-2026-42217/): OpenEXR: Shift exponent overflow in `readVariableLengthInteger()` (`ImfIDManifest.cpp`) (medium 6.3)
- [CVE-2026-42216](https://insights.sbomify.com/CVE-2026-42216/): OpenEXR: Out-of-bounds read in `IDManifest::init()` during prefix expansion (high 8.8)
- [CVE-2026-42215](https://insights.sbomify.com/CVE-2026-42215/): GitPython: Command injection via Git options bypass (high 8.8)
- [CVE-2026-42214](https://insights.sbomify.com/CVE-2026-42214/): Improper Control of Generation of Code ('Code Injection') in dail8859/NotepadNext (high 7.8)
- [CVE-2026-42213](https://insights.sbomify.com/CVE-2026-42213/): SolidCAM-GPPL-IDE: Path traversal in `inc` directive enables file probing and NTLM-hash leak (medium 5.1)
- [CVE-2026-42212](https://insights.sbomify.com/CVE-2026-42212/): SolidCAM-GPPL-IDE: XML External Entity (XXE) and billion-laughs DoS in VMID parser (high 7.1)
- [CVE-2026-42211](https://insights.sbomify.com/CVE-2026-42211/): React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE (high 8.1)
- [CVE-2026-42210](https://insights.sbomify.com/CVE-2026-42210/): Webmin 2FA requirement bypass (medium 5.3)
- [CVE-2026-4221](https://insights.sbomify.com/CVE-2026-4221/): Tiandy Easy7 Integrated Management Platform Endpoint uploadLedImage unrestricted upload (medium 6.9)
- [CVE-2026-42209](https://insights.sbomify.com/CVE-2026-42209/): FlashMQ: Division by zero crash when using non-default deferred retained message setting (medium 6.5)
- [CVE-2026-42208](https://insights.sbomify.com/CVE-2026-42208/): BerriAI LiteLLM SQL Injection (critical 9.3, exploited in the wild)
- [CVE-2026-42207](https://insights.sbomify.com/CVE-2026-42207/): Magento LTS: Open Redirect via Unvalidated `uenc` Parameter in `stockAction()` - magento-lts (medium 6.1)
- [CVE-2026-42206](https://insights.sbomify.com/CVE-2026-42206/): Roadiz OpenID Connect nonce generated but never validated — ID token replay attack (medium 5.7)
- [CVE-2026-42205](https://insights.sbomify.com/CVE-2026-42205/): Avo: Broken Access Control: Unauthorized Execution of Arbitrary Action Classes Across Resources (high 8.8)
- [CVE-2026-42204](https://insights.sbomify.com/CVE-2026-42204/): Coolify: Authenticated RCE via SHELL_SAFE_COMMAND_PATTERN regression → host root (high 8.8)
- [CVE-2026-42203](https://insights.sbomify.com/CVE-2026-42203/): LiteLLM: Server-Side Template Injection in /prompts/test endpoint (high 8.6)
- [CVE-2026-42202](https://insights.sbomify.com/CVE-2026-42202/): nova-toggle-5: Improper authorization on toggle endpoint allowed non-Nova users to modify boolean fields (medium 6.5)
- [CVE-2026-42201](https://insights.sbomify.com/CVE-2026-42201/): Coolify: OS Command Injection via Database Credential Fields in Docker Compose Service Commands (low 3.3)
- [CVE-2026-42200](https://insights.sbomify.com/CVE-2026-42200/): Coolify: PostgreSQL Init Script Path Traversal Leads to Arbitrary File Write and Root RCE (high 8.8)
- [CVE-2026-4220](https://insights.sbomify.com/CVE-2026-4220/): Technologies Integrated Management Platform SetWebpagePic.jsp unrestricted upload (medium 6.9)
- [CVE-2026-42199](https://insights.sbomify.com/CVE-2026-42199/): Grid: Integer Overflow in Grid::expand_rows Leads to Safe-API Undefined Behavior (medium 6.2)
- [CVE-2026-42198](https://insights.sbomify.com/CVE-2026-42198/): pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS (high 7.5)
- [CVE-2026-42197](https://insights.sbomify.com/CVE-2026-42197/): RELATE Vulnerable to Stored XSS via Unprivileged User Profile (high 8.7)
- [CVE-2026-42196](https://insights.sbomify.com/CVE-2026-42196/): django-s3file: Relative path traversal (critical 9.9)
- [CVE-2026-42195](https://insights.sbomify.com/CVE-2026-42195/): Unvalidated gitlab URL parameter redirects OAuth authorize step to attacker-controlled host (low 3.4)
- [CVE-2026-42194](https://insights.sbomify.com/CVE-2026-42194/): Incomplete fix for CVE-2026-32812: SSRF in admidio (medium 6.8)
- [CVE-2026-42193](https://insights.sbomify.com/CVE-2026-42193/): Plunk: SNS webhook forgery (critical 9.1)
- [CVE-2026-42192](https://insights.sbomify.com/CVE-2026-42192/): Plunk: Stored XSS in campaign view (medium 5.4)
- [CVE-2026-42191](https://insights.sbomify.com/CVE-2026-42191/): OpenTelemetry's disk retry default temp path enables local blob injection via OTLP Exporter (medium 6.5)
- [CVE-2026-42190](https://insights.sbomify.com/CVE-2026-42190/): RedwoodSDK: Same-site CSRF in in server actions (medium 5.3)
- [CVE-2026-4219](https://insights.sbomify.com/CVE-2026-4219/): INDEX Conferences & Exhibitions Organization YWF BPOF APGCS App ae.index.apgcs BuildConfig.java hard-coded credentials (medium 4.8)
- [CVE-2026-42189](https://insights.sbomify.com/CVE-2026-42189/): Russh: Pre-auth DoS via unbounded allocation in keyboard-interactive auth (high 7.5)
- [CVE-2026-42188](https://insights.sbomify.com/CVE-2026-42188/): Geyser: Server-Side Request Forgery (SSRF) via Player Head Texture URL (low 2.4)
- [CVE-2026-42186](https://insights.sbomify.com/CVE-2026-42186/): OpenBao's Namespace Deletion May Not Delete Data Properly (low 2.3)
- [CVE-2026-42185](https://insights.sbomify.com/CVE-2026-42185/): People: Privilege Escalation via Missing Role Ceiling in Mail Domain Invitation (medium 5.5)
- [CVE-2026-42184](https://insights.sbomify.com/CVE-2026-42184/): Tauri: Origin Confusion Allows Remote Pages to Invoke Local-Only IPC Commands (medium 6.1)
- [CVE-2026-42183](https://insights.sbomify.com/CVE-2026-42183/): Argo Workflows: SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go) (low 2.3)
- [CVE-2026-42181](https://insights.sbomify.com/CVE-2026-42181/): Lemmy: SSRF and internal image disclosure in post link metadata via unvalidated og:image (medium 6.5)
- [CVE-2026-42180](https://insights.sbomify.com/CVE-2026-42180/): Lemmy: SSRF in /api/v3/post via Webmention dispatch (medium 6.3)
- [CVE-2026-4218](https://insights.sbomify.com/CVE-2026-4218/): myAEDES App aedes.me.beta EngageBayUtils.java information disclosure (low 2.0)
- [CVE-2026-42177](https://insights.sbomify.com/CVE-2026-42177/): linux-entra-sso: PRT SSO cookie can leak to attacker-controlled hosts when broad host permissions are granted (medium 5.3)
- [CVE-2026-42176](https://insights.sbomify.com/CVE-2026-42176/): Auth bypass in scoold (medium 6.7)
- [CVE-2026-42175](https://insights.sbomify.com/CVE-2026-42175/): requests-hardened: Server-Side Request Forgery (SSRF) in requests-hardened RFC 6598 (medium 6.5)
- [CVE-2026-42174](https://insights.sbomify.com/CVE-2026-42174/): Kirby: User avatar creation, replacement and deletion are not gated by user update permissions (medium 5.3)
- [CVE-2026-42172](https://insights.sbomify.com/CVE-2026-42172/): Coolify: Sanctum API Tokens Have No Expiration — Leaked Tokens Grant Permanent Access (low 3.1)
- [CVE-2026-42171](https://insights.sbomify.com/CVE-2026-42171/): Privilege escalation in Nullsoft Scriptable Install System (high 7.8)
- [CVE-2026-42170](https://insights.sbomify.com/CVE-2026-42170/): Gimp: gimp dds plug-in heap-based buffer overflow via bpp mismatch in load_layer() (ddsread.c) (high 7.8)
- [CVE-2026-4217](https://insights.sbomify.com/CVE-2026-4217/): XREAL Nebula App ai.nreal.nebula.universal CloudStoragePlugin.java credentials storage (low 2.0)
- [CVE-2026-42169](https://insights.sbomify.com/CVE-2026-42169/): Gimp: gimp apng loader heap-buffer-overflow when fctl width exceeds ihdr width (file-png.c) (high 7.3)
- [CVE-2026-42168](https://insights.sbomify.com/CVE-2026-42168/): django-pyas2 through 1.2.3 is vulnerable to OS command injection via the cmd_receive and cmd_send fields on the Partner model. (critical 9.1)
- [CVE-2026-42167](https://insights.sbomify.com/CVE-2026-42167/): SQL injection in ProFTPD (high 8.1)
- [CVE-2026-42164](https://insights.sbomify.com/CVE-2026-42164/): Mahara before 25.04.5 and 26.04.0 is vulnerable in the Text block/section functionality when a call is crafted in a certain way that allows (critical 9.8)
- [CVE-2026-42163](https://insights.sbomify.com/CVE-2026-42163/): Mahara before 25.04.5 and 26.04.0 is vulnerable to unauthorized access to internal accounts via Learning Tools Interoperability (LTI) under (critical 9.8)
- [CVE-2026-42162](https://insights.sbomify.com/CVE-2026-42162/): Mahara before 25.04.5 and 26.04.0 is vulnerable to artefacts being accessible to others under certain circumstances when the file path to an (critical 9.1)
- [CVE-2026-42160](https://insights.sbomify.com/CVE-2026-42160/): Missing authorization in dataspace-portal (critical 10.0)
- [CVE-2026-4216](https://insights.sbomify.com/CVE-2026-4216/): i-SENS SmartLog App air.SmartLog.android hard-coded credentials (medium 4.8)
- [CVE-2026-42159](https://insights.sbomify.com/CVE-2026-42159/): Flowsint: Stored XSS in description of node (medium 5.3)
- [CVE-2026-42158](https://insights.sbomify.com/CVE-2026-42158/): Flowsint: Broken Access Control allows modification of investigation metadata from any user (low 2.3)
- [CVE-2026-42157](https://insights.sbomify.com/CVE-2026-42157/): Flowsint: Stored XSS on map node marker in map page (medium 5.1)
- [CVE-2026-42156](https://insights.sbomify.com/CVE-2026-42156/): Flowsint: Cypher query injection in node type on node creation (high 7.1)
- [CVE-2026-42155](https://insights.sbomify.com/CVE-2026-42155/): Magento LTS: Weak API Session ID — Predictable MD5 of Time-Derived Inputs (critical 9.3)
- [CVE-2026-42154](https://insights.sbomify.com/CVE-2026-42154/): Prometheus: remote read endpoint allows denial of service via crafted snappy payload (high 7.5)
- [CVE-2026-42153](https://insights.sbomify.com/CVE-2026-42153/): Coolify: PostgreSQL Healthcheck Command Injection Allows Root Code Execution in Container (high 8.8)
- [CVE-2026-42151](https://insights.sbomify.com/CVE-2026-42151/): Prometheus Azure AD remote write OAuth client secret exposed via config API (high 7.5)
- [CVE-2026-42150](https://insights.sbomify.com/CVE-2026-42150/): wlc: print_html outputs API data without HTML escaping, enabling stored XSS (medium 5.1)
- [CVE-2026-4215](https://insights.sbomify.com/CVE-2026-4215/): FlowCI flow-core-x SMTP Host ConfigServiceImpl.java save server-side request forgery (medium 5.3)
- [CVE-2026-42148](https://insights.sbomify.com/CVE-2026-42148/): Coolify: Command Injection via Unescaped Version String in Docker Build (low 3.8)
- [CVE-2026-42147](https://insights.sbomify.com/CVE-2026-42147/): Coolify: SSRF via S3 Storage Endpoint in testConnection() (medium 4.9)
- [CVE-2026-42146](https://insights.sbomify.com/CVE-2026-42146/): CImg Library: Uncontrolled memory allocation via nb_colors field in _load_bmp (medium 5.5)
- [CVE-2026-42145](https://insights.sbomify.com/CVE-2026-42145/): Coolify: File Upload Without Type or Size Validation in Database Backup Restore (low 3.1)
- [CVE-2026-42144](https://insights.sbomify.com/CVE-2026-42144/): CImg Library: Integer overflow in PNM size check bypasses memory guard (_load_pnm) (medium 6.1)
- [CVE-2026-42143](https://insights.sbomify.com/CVE-2026-42143/): Coolify: OS Command Injection via Persistent Volume Names - Root RCE on Managed Servers (high 8.8)
- [CVE-2026-42142](https://insights.sbomify.com/CVE-2026-42142/): TypeBot has Authorization Bypass in Google Sheets `getSheets` Endpoint that Allows Cross-Workspace Credential Access (high 7.1)
- [CVE-2026-42141](https://insights.sbomify.com/CVE-2026-42141/): Xibo: Authenticated Server-Side Request Forgery (SSRF) in Library Upload via URL functionality (high 7.7)
- [CVE-2026-42140](https://insights.sbomify.com/CVE-2026-42140/): Server-Side Request Forgery (SSRF) in PlantUML Macro via 'server' parameter (medium 4.4)
- [CVE-2026-4214](https://insights.sbomify.com/CVE-2026-4214/): D-Link DNS-1550-04 app_mgr.cgi UPnP_AV_Server_Path_Setting stack-based overflow (high 8.7)
- [CVE-2026-42138](https://insights.sbomify.com/CVE-2026-42138/): Dify Vulnerable to Stored XSS via SVG-file upload (medium 6.9)
- [CVE-2026-42137](https://insights.sbomify.com/CVE-2026-42137/): Kirby CMS's `pages.access/list` and `files.access/list` permissions are not consistently checked in the Panel and REST API (high 7.1)
- [CVE-2026-4213](https://insights.sbomify.com/CVE-2026-4213/): D-Link DNS-1550-04 gui_mgr.cgi cgi_myfavorite_verify stack-based overflow (high 8.7)
- [CVE-2026-42129](https://insights.sbomify.com/CVE-2026-42129/): Path traversal in the Loki data source plugin (high 7.7)
- [CVE-2026-42127](https://insights.sbomify.com/CVE-2026-42127/): Pre-authentication denial of service in the public dashboard query endpoint (high 7.5)
- [CVE-2026-4212](https://insights.sbomify.com/CVE-2026-4212/): D-Link DNS-1550-04 download_mgr.cgi Downloads_Schedule_Info stack-based overflow (high 8.7)
- [CVE-2026-4211](https://insights.sbomify.com/CVE-2026-4211/): D-Link DNS-1550-04 local_backup_mgr.cgi Local_Backup_Info stack-based overflow (high 8.7)
- [CVE-2026-42100](https://insights.sbomify.com/CVE-2026-42100/): DoS in Sparx Pro Cloud Server (high 7.1)
- [CVE-2026-4210](https://insights.sbomify.com/CVE-2026-4210/): D-Link DNS-1550-04 time_machine.cgi cgi_tm_set_share command injection (medium 5.3)
- [CVE-2026-42099](https://insights.sbomify.com/CVE-2026-42099/): Race Condition in Sparx Pro Cloud Server (high 7.7)
- [CVE-2026-42098](https://insights.sbomify.com/CVE-2026-42098/): Authorization Bypass in Sparx Enterprise Architect (high 8.7)
- [CVE-2026-42097](https://insights.sbomify.com/CVE-2026-42097/): Authentication Bypass in Sparx Pro Cloud Server (critical 9.3)
- [CVE-2026-42096](https://insights.sbomify.com/CVE-2026-42096/): Broken Access Control in Sparx Pro Cloud Server (high 8.7)
- [CVE-2026-42095](https://insights.sbomify.com/CVE-2026-42095/): Missing authorization in Arianna (medium 4.0)
- [CVE-2026-42093](https://insights.sbomify.com/CVE-2026-42093/): Redash: SQL Injection via Query Results parameterized query substitution (high 8.7)
- [CVE-2026-42092](https://insights.sbomify.com/CVE-2026-42092/): Global Settings Publication Exposes Sensitive Configuration to Any Authenticated User in Titra (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/653/