# Vulnerabilities published in 2026


- [CVE-2026-42091](https://insights.sbomify.com/CVE-2026-42091/): goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS (medium 6.5)
- [CVE-2026-42090](https://insights.sbomify.com/CVE-2026-42090/): Notesnook: RCE via stored XSS in note export rendering (critical 9.6)
- [CVE-2026-4209](https://insights.sbomify.com/CVE-2026-4209/): D-Link DNS-1550-04 account_mgr.cgi cgi_chg_admin_pw command injection (medium 5.3)
- [CVE-2026-42089](https://insights.sbomify.com/CVE-2026-42089/): yeoman-environment Vulnerable to Arbitrary Package Installation without User Confirmation (high 8.6)
- [CVE-2026-42088](https://insights.sbomify.com/CVE-2026-42088/): OpenC3 COSMOS: Administrative Actions via the Script Runner Tool (critical 9.6)
- [CVE-2026-42087](https://insights.sbomify.com/CVE-2026-42087/): OpenC3 COSMOS: SQL Injection in QuestDB Time-Series Data Base (critical 9.6)
- [CVE-2026-42086](https://insights.sbomify.com/CVE-2026-42086/): OpenC3 COSMOS: Self-XSS in the Command Sender (medium 4.6)
- [CVE-2026-42085](https://insights.sbomify.com/CVE-2026-42085/): OpenC3 COSMOS: Arbitrary write to plugins directory via path-traversed config filenames (medium 4.3)
- [CVE-2026-42084](https://insights.sbomify.com/CVE-2026-42084/): OpenC3 COSMOS: Hijacked session token can be used to reset password for persistence (high 8.1)
- [CVE-2026-42083](https://insights.sbomify.com/CVE-2026-42083/): Free5GC PCF: Missing authentication middleware in Npcf_SMPolicyControl allows access to SM policy handlers and disclosure of subscriber SUPI (high 8.2)
- [CVE-2026-42082](https://insights.sbomify.com/CVE-2026-42082/): free5GC: Missing Concurrent NAS SMC Validation During NGAP Handover (low 3.7)
- [CVE-2026-42081](https://insights.sbomify.com/CVE-2026-42081/): free5GC: UE Security Capability bypass on NGAP PathSwitchRequest (medium 6.1)
- [CVE-2026-42080](https://insights.sbomify.com/CVE-2026-42080/): PPTAgent: Arbitrary File Write via `save_generated_slides` (medium 4.6)
- [CVE-2026-4208](https://insights.sbomify.com/CVE-2026-4208/): Authentication Bypass in extension "E-Mail MFA Provider" (mfa_email) (high 7.7)
- [CVE-2026-42079](https://insights.sbomify.com/CVE-2026-42079/): PPTAgent: Arbitrary Code Execution via Python eval() of LLM-Generated Code with Builtins in Scope (high 8.6)
- [CVE-2026-42078](https://insights.sbomify.com/CVE-2026-42078/): PPTAgent: Arbitrary File Write + Directory Creation via markdown_table_to_image (medium 4.6)
- [CVE-2026-42077](https://insights.sbomify.com/CVE-2026-42077/): Evolver: Prototype Pollution via `Object.assign()` in mailbox store operations (medium 5.2)
- [CVE-2026-42076](https://insights.sbomify.com/CVE-2026-42076/): Evolver: Command Injection via `execSync` in `_extractLLM()` function allows Remote Code Execution (critical 9.8)
- [CVE-2026-42075](https://insights.sbomify.com/CVE-2026-42075/): Evolver: Path Traversal via `--out` flag in `fetch` command allows Arbitrary File Write (high 8.1)
- [CVE-2026-42074](https://insights.sbomify.com/CVE-2026-42074/): OpenClaude: Sandbox Bypass via Model-Controlled `dangerouslyDisableSandbox` Input (critical 9.3)
- [CVE-2026-42073](https://insights.sbomify.com/CVE-2026-42073/): OpenClaude's MCP OAuth Callback: State Check Bypass via error Param Leads to DoS (medium 6.5)
- [CVE-2026-42072](https://insights.sbomify.com/CVE-2026-42072/): Nornicdb: Improper Network Binding in NornicDB Bolt Server allows unauthorized remote access (critical 9.8)
- [CVE-2026-42071](https://insights.sbomify.com/CVE-2026-42071/): MantisBT: Private Bugnote Attachment Content Leak via REST API (high 7.2)
- [CVE-2026-42070](https://insights.sbomify.com/CVE-2026-42070/): MantisBT: Authorization Bypass in Bugnote Editing via Issue Update API (medium 5.3)
- [CVE-2026-4207](https://insights.sbomify.com/CVE-2026-4207/): D-Link DNS-1550-04 system_mgr.cgi cgi_ntp_time command injection (medium 5.3)
- [CVE-2026-42069](https://insights.sbomify.com/CVE-2026-42069/): Kirby: Read access to site, user and role information is not gated by permissions (high 7.1)
- [CVE-2026-42063](https://insights.sbomify.com/CVE-2026-42063/): iControl SOAP vulnerability (medium 6.9)
- [CVE-2026-42062](https://insights.sbomify.com/CVE-2026-42062/): Command injection in WRC-BE65QSD-B (critical 9.3)
- [CVE-2026-42061](https://insights.sbomify.com/CVE-2026-42061/): Privilege escalation in Acronis DeviceLock DLP (high 7.3)
- [CVE-2026-4206](https://insights.sbomify.com/CVE-2026-4206/): D-Link DNS-1550-04 dsk_mgr.cgi ScanDisk_run_e2fsck command injection (medium 5.3)
- [CVE-2026-42058](https://insights.sbomify.com/CVE-2026-42058/): BIG-IP iControl REST vulnerability (medium 5.3)
- [CVE-2026-42057](https://insights.sbomify.com/CVE-2026-42057/): Memory corruption in vtk (high 7.5)
- [CVE-2026-42055](https://insights.sbomify.com/CVE-2026-42055/): NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability (critical 9.2)
- [CVE-2026-42052](https://insights.sbomify.com/CVE-2026-42052/): beets is Vulnerable to XSS (medium 6.0)
- [CVE-2026-42051](https://insights.sbomify.com/CVE-2026-42051/): Kirby: System API endpoint leaks license data and installed version to authenticated users (medium 5.3)
- [CVE-2026-42050](https://insights.sbomify.com/CVE-2026-42050/): ImageMagick: Stack buffer overflow in XTileImage (medium 5.5)
- [CVE-2026-4205](https://insights.sbomify.com/CVE-2026-4205/): D-Link DNS-1550-04 app_mgr.cgi FTP_Server_BlockIP_Del command injection (medium 5.3)
- [CVE-2026-42049](https://insights.sbomify.com/CVE-2026-42049/): jadx: RCE Via Groovy Code Injection in Gradle Export (high 8.4)
- [CVE-2026-42048](https://insights.sbomify.com/CVE-2026-42048/): Langflow: Path Traversal in Langflow Knowledge Bases API (critical 9.6)
- [CVE-2026-42047](https://insights.sbomify.com/CVE-2026-42047/): Inngest TypeScript SDK exposes environment variables via serve() handler on unhandled HTTP methods (high 8.6)
- [CVE-2026-42046](https://insights.sbomify.com/CVE-2026-42046/): libcaca: Heap OOB write in canvas import functions caused by int overflow (high 7.8)
- [CVE-2026-42045](https://insights.sbomify.com/CVE-2026-42045/): LobeHub: Cross-Site Scripting(XSS) escalate to Remote Code Execution(RCE) (medium 6.2)
- [CVE-2026-42044](https://insights.sbomify.com/CVE-2026-42044/): Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver` (medium 6.5)
- [CVE-2026-42043](https://insights.sbomify.com/CVE-2026-42043/): Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0 (high 7.2)
- [CVE-2026-42042](https://insights.sbomify.com/CVE-2026-42042/): Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion (medium 5.4)
- [CVE-2026-42041](https://insights.sbomify.com/CVE-2026-42041/): Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy (medium 4.8)
- [CVE-2026-42040](https://insights.sbomify.com/CVE-2026-42040/): Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams (low 3.7)
- [CVE-2026-4204](https://insights.sbomify.com/CVE-2026-4204/): D-Link DNS-1550-04 gui_mgr.cgi cgi_mycloud_auto_downlaod command injection (medium 5.3)
- [CVE-2026-42039](https://insights.sbomify.com/CVE-2026-42039/): Axios: unbounded recursion in toFormData causes DoS via deeply nested request data (medium 6.9)
- [CVE-2026-42038](https://insights.sbomify.com/CVE-2026-42038/): Axios: no_proxy bypass via IP alias allows SSRF (medium 6.8)
- [CVE-2026-42037](https://insights.sbomify.com/CVE-2026-42037/): Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream (medium 5.3)
- [CVE-2026-42036](https://insights.sbomify.com/CVE-2026-42036/): Axios: HTTP adapter streamed responses bypass maxContentLength (medium 5.3)
- [CVE-2026-42035](https://insights.sbomify.com/CVE-2026-42035/): Axios: Header Injection via Prototype Pollution (high 7.4)
- [CVE-2026-42034](https://insights.sbomify.com/CVE-2026-42034/): Axios: HTTP adapter streamed uploads bypass maxBodyLength when maxRedirects: 0 (medium 5.3)
- [CVE-2026-42033](https://insights.sbomify.com/CVE-2026-42033/): Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking (high 7.4)
- [CVE-2026-42032](https://insights.sbomify.com/CVE-2026-42032/): CKAN: Unauthenticated Authorization Bypass in `datastore_search_sql` (medium 6.7)
- [CVE-2026-42031](https://insights.sbomify.com/CVE-2026-42031/): CKAN: Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql` (high 8.3)
- [CVE-2026-42030](https://insights.sbomify.com/CVE-2026-42030/): MapServer: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in OpenLayers viewer (medium 6.1)
- [CVE-2026-4203](https://insights.sbomify.com/CVE-2026-4203/): D-Link DNS-1550-04 network_mgr.cgi cgi_dhcpd command injection (medium 5.3)
- [CVE-2026-42028](https://insights.sbomify.com/CVE-2026-42028/): novaGallery: Unauthenticated Path Traversal in Album and Cached Image Routes Allows Reading Images Outside Gallery Root (medium 5.3)
- [CVE-2026-42027](https://insights.sbomify.com/CVE-2026-42027/): Apache OpenNLP: Arbitrary Class Instantiation via Model Manifest in ExtensionLoader (critical 9.8)
- [CVE-2026-42026](https://insights.sbomify.com/CVE-2026-42026/): Memory corruption in Totolink (critical 9.1)
- [CVE-2026-42025](https://insights.sbomify.com/CVE-2026-42025/): Memory corruption in Totolink (critical 9.1)
- [CVE-2026-42024](https://insights.sbomify.com/CVE-2026-42024/): Memory corruption in Totolink (critical 9.1)
- [CVE-2026-42023](https://insights.sbomify.com/CVE-2026-42023/): Memory corruption in Totolink (critical 9.1)
- [CVE-2026-42022](https://insights.sbomify.com/CVE-2026-42022/): Memory corruption in Totolink (critical 9.1)
- [CVE-2026-42021](https://insights.sbomify.com/CVE-2026-42021/): Memory corruption in Totolink (critical 9.1)
- [CVE-2026-42020](https://insights.sbomify.com/CVE-2026-42020/): Memory corruption in Totolink (critical 9.1)
- [CVE-2026-4202](https://insights.sbomify.com/CVE-2026-4202/): Broken Access Control in extension "Redirect Tab" (low 2.3)
- [CVE-2026-42019](https://insights.sbomify.com/CVE-2026-42019/): Memory corruption in Totolink (critical 9.1)
- [CVE-2026-42018](https://insights.sbomify.com/CVE-2026-42018/): JFrog Artifactory Improper Authentication (high 7.5, exploited in the wild)
- [CVE-2026-42017](https://insights.sbomify.com/CVE-2026-42017/): Privilege escalation via JFrog Worker event token exposure (high 8.8)
- [CVE-2026-42016](https://insights.sbomify.com/CVE-2026-42016/): JFrog Artifactory Incorrect Authorization (high 8.1, exploited in the wild)
- [CVE-2026-42015](https://insights.sbomify.com/CVE-2026-42015/): Gnutls: gnutls: memory corruption due to off-by-one error in pkcs#12 bag handling (medium 5.3)
- [CVE-2026-42014](https://insights.sbomify.com/CVE-2026-42014/): Gnutls: gnutls: use-after-free in gnutls_pkcs11_token_set_pin (medium 6.6)
- [CVE-2026-42013](https://insights.sbomify.com/CVE-2026-42013/): Gnutls: gnutls: certificate validation bypass due to oversized subject alternative name (high 8.2)
- [CVE-2026-42012](https://insights.sbomify.com/CVE-2026-42012/): Gnutls: gnutls: certificate validation bypass due to improper handling of uri and srv sans (high 7.1)
- [CVE-2026-42011](https://insights.sbomify.com/CVE-2026-42011/): Gnutls: gnutls: security bypass due to incorrect name constraint handling (high 7.4)
- [CVE-2026-42010](https://insights.sbomify.com/CVE-2026-42010/): Gnutls: gnutls: authentication bypass via nul character in username (high 7.1)
- [CVE-2026-4201](https://insights.sbomify.com/CVE-2026-4201/): glowxq glowxq-oj SysFileController.java upload unrestricted upload (medium 6.9)
- [CVE-2026-42009](https://insights.sbomify.com/CVE-2026-42009/): Gnutls: gnutls: denial of service via dtls packet reordering vulnerability (high 7.5)
- [CVE-2026-42008](https://insights.sbomify.com/CVE-2026-42008/): Auth bypass in OX Dovecot CE (medium 4.3)
- [CVE-2026-42007](https://insights.sbomify.com/CVE-2026-42007/): Use after free in OX Dovecot CE (critical 9.1)
- [CVE-2026-42006](https://insights.sbomify.com/CVE-2026-42006/): Denial of service in OX Dovecot Pro (medium 4.3)
- [CVE-2026-42005](https://insights.sbomify.com/CVE-2026-42005/): Insufficient input validation of internal web server (medium 4.3)
- [CVE-2026-42004](https://insights.sbomify.com/CVE-2026-42004/): EDNS options smuggling (low 3.7)
- [CVE-2026-42002](https://insights.sbomify.com/CVE-2026-42002/): Concurrency and locking defects in GSS-TSIG (medium 5.9)
- [CVE-2026-42001](https://insights.sbomify.com/CVE-2026-42001/): Insufficient Validation of Autoprimary SOA Queries (high 7.5)
- [CVE-2026-42000](https://insights.sbomify.com/CVE-2026-42000/): Insufficient Validation of Names During AXFR (medium 6.8)
- [CVE-2026-4200](https://insights.sbomify.com/CVE-2026-4200/): glowxq glowxq-oj ProblemCaseController.java uploadTestcaseZipUrl server-side request forgery (medium 6.9)
- [CVE-2026-41999](https://insights.sbomify.com/CVE-2026-41999/): Incorrect Behaviour of Views with TCP PROXY Requests (medium 4.8)
- [CVE-2026-41993](https://insights.sbomify.com/CVE-2026-41993/): Security feature bypass in SafePortAgent (medium 6.7)
- [CVE-2026-41992](https://insights.sbomify.com/CVE-2026-41992/): Global Buffer Overflow in GNU gzip (medium 6.9)
- [CVE-2026-41991](https://insights.sbomify.com/CVE-2026-41991/): Predictable Temporary File in GNU gzip (low 2.0)
- [CVE-2026-41990](https://insights.sbomify.com/CVE-2026-41990/): Memory corruption in Libgcrypt (medium 4.0)
- [CVE-2026-4199](https://insights.sbomify.com/CVE-2026-4199/): bazinga012 mcp_code_executor index.ts installDependencies command injection (medium 4.8)
- [CVE-2026-41989](https://insights.sbomify.com/CVE-2026-41989/): Memory corruption in Libgcrypt (medium 6.7)
- [CVE-2026-41988](https://insights.sbomify.com/CVE-2026-41988/): Other in uuid (low 3.2)
- [CVE-2026-41987](https://insights.sbomify.com/CVE-2026-41987/): Missing authorization in EMUI (medium 6.2)
- [CVE-2026-41986](https://insights.sbomify.com/CVE-2026-41986/): Business logic in HarmonyOS (low 2.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/654/