# Vulnerabilities published in 2026


- [CVE-2026-41887](https://insights.sbomify.com/CVE-2026-41887/): Flarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577) (medium 4.9)
- [CVE-2026-41886](https://insights.sbomify.com/CVE-2026-41886/): locize Client SDK: Cross-origin DOM XSS & Handler Hijack Through Missing e.origin Validation in InContext Editor (high 7.5)
- [CVE-2026-41885](https://insights.sbomify.com/CVE-2026-41885/): Path traversal / URL injection via unsanitised lng/ns/projectId/version in i18next-locize-backend (medium 6.5)
- [CVE-2026-41883](https://insights.sbomify.com/CVE-2026-41883/): OmniFaces: EL injection via crafted resource name in wildcard CDN mapping (high 8.1)
- [CVE-2026-41882](https://insights.sbomify.com/CVE-2026-41882/): Path traversal in IntelliJ IDEA (high 7.4)
- [CVE-2026-41880](https://insights.sbomify.com/CVE-2026-41880/): OS Command Injection in R-SOFT DMS (critical 9.0)
- [CVE-2026-4188](https://insights.sbomify.com/CVE-2026-4188/): D-Link DIR-619L boa formSchedule stack-based overflow (high 8.7)
- [CVE-2026-41879](https://insights.sbomify.com/CVE-2026-41879/): Weak password hashing in R-SOFT DMS (high 8.2)
- [CVE-2026-41878](https://insights.sbomify.com/CVE-2026-41878/): Insecure Direct Object Reference in R-SOFT DMS (high 7.1)
- [CVE-2026-41877](https://insights.sbomify.com/CVE-2026-41877/): Stored XSS in R-SOFT DMS (medium 5.1)
- [CVE-2026-41876](https://insights.sbomify.com/CVE-2026-41876/): OS Command Injection in R-SOFT DMS (high 8.7)
- [CVE-2026-41875](https://insights.sbomify.com/CVE-2026-41875/): Cross-Site Request Forgery in admin panel of Quick.Cart (medium 6.9)
- [CVE-2026-41874](https://insights.sbomify.com/CVE-2026-41874/): Hard-coded admin credentials in Quick.Cart (medium 6.8)
- [CVE-2026-41873](https://insights.sbomify.com/CVE-2026-41873/): Pony Mail: Admin account takeover via request smuggling (critical 9.8)
- [CVE-2026-41872](https://insights.sbomify.com/CVE-2026-41872/): Weak cryptography in "Kura Sushi Official App" for Android (critical 9.1)
- [CVE-2026-41871](https://insights.sbomify.com/CVE-2026-41871/): Apache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST API) (critical 9.8)
- [CVE-2026-41870](https://insights.sbomify.com/CVE-2026-41870/): Apache Nutch: Unauthenticated remote code execution (RCE) via JEXL injection in Nutch Server (Nutch REST API) (high 8.8)
- [CVE-2026-4187](https://insights.sbomify.com/CVE-2026-4187/): Tiandy Easy7 Integrated Management Platform Device Identifier UpdateLocalDevInfo.jsp missing authentication (medium 6.9)
- [CVE-2026-41869](https://insights.sbomify.com/CVE-2026-41869/): Apache Nutch: Unauthenticated forced shutdown and job interruption in Nutch Server (Nutch REST API) (critical 9.1)
- [CVE-2026-41863](https://insights.sbomify.com/CVE-2026-41863/): Spring AI's support for Anthropic's Skills API used LLM-influenced filenames unsanitized in Path.resolve before writing files to disk (medium 6.5)
- [CVE-2026-41862](https://insights.sbomify.com/CVE-2026-41862/): Spring Statemachine's Kryo-based persistence backends deserialize persisted state-machine contexts without enforcing a class allowlist (high 8.8)
- [CVE-2026-41861](https://insights.sbomify.com/CVE-2026-41861/): Arbitrary Root File Write via Path Traversal in BOSH agent (medium 4.2)
- [CVE-2026-41860](https://insights.sbomify.com/CVE-2026-41860/): Weak cryptography in BOSH (high 7.1)
- [CVE-2026-4186](https://insights.sbomify.com/CVE-2026-4186/): UEditor JSONP Callback controller.php cross site scripting (medium 5.1)
- [CVE-2026-41859](https://insights.sbomify.com/CVE-2026-41859/): Weak cryptography in BOSH (high 7.1)
- [CVE-2026-41858](https://insights.sbomify.com/CVE-2026-41858/): Weak cryptography in windows-utilities-release (medium 6.5)
- [CVE-2026-41857](https://insights.sbomify.com/CVE-2026-41857/): BOSH CLI Shell Injection (high 7.1)
- [CVE-2026-41856](https://insights.sbomify.com/CVE-2026-41856/): Spring GraphQL Annotation Detection Vulnerability (high 7.5)
- [CVE-2026-41855](https://insights.sbomify.com/CVE-2026-41855/): Spring Framework Unsafe Deserialization via Jackson JMS Converters (high 8.1)
- [CVE-2026-41854](https://insights.sbomify.com/CVE-2026-41854/): Spring Framework Server-Side Request Forgery via UriComponentsBuilder (medium 4.2)
- [CVE-2026-41853](https://insights.sbomify.com/CVE-2026-41853/): Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux (medium 5.3)
- [CVE-2026-41852](https://insights.sbomify.com/CVE-2026-41852/): Spring Framework Arbitrary Method Invocation in SpEL Expressions (low 3.7)
- [CVE-2026-41851](https://insights.sbomify.com/CVE-2026-41851/): Spring Framework Denial of Service via Unbounded Cache in SpEL (medium 5.3)
- [CVE-2026-41850](https://insights.sbomify.com/CVE-2026-41850/): Spring Framework Algorithmic Denial of Service via SpEL Expressions (high 7.5)
- [CVE-2026-4185](https://insights.sbomify.com/CVE-2026-4185/): GPAC MP4Box swf_parse.c swf_def_bits_jpeg stack-based overflow (medium 5.3)
- [CVE-2026-41849](https://insights.sbomify.com/CVE-2026-41849/): Spring Framework Denial of Service via Integer Overflow in SpEL Expressions (high 7.5)
- [CVE-2026-41848](https://insights.sbomify.com/CVE-2026-41848/): Spring Framework Denial of Service via AntPathMatcher (low 3.7)
- [CVE-2026-41847](https://insights.sbomify.com/CVE-2026-41847/): Spring Framework Security Filter Bypass in WebFlux Kotlin Router DSL (medium 4.8)
- [CVE-2026-41846](https://insights.sbomify.com/CVE-2026-41846/): Spring Framework Cross-site Scripting via JSP Form Tags (medium 5.9)
- [CVE-2026-41845](https://insights.sbomify.com/CVE-2026-41845/): Spring Framework Cross-site Scripting via JavaScriptUtils (high 7.1)
- [CVE-2026-41844](https://insights.sbomify.com/CVE-2026-41844/): Spring Framework Open Redirect in Spring MVC and WebFlux (medium 4.2)
- [CVE-2026-41843](https://insights.sbomify.com/CVE-2026-41843/): Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux (medium 5.9)
- [CVE-2026-41842](https://insights.sbomify.com/CVE-2026-41842/): Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux (high 7.5)
- [CVE-2026-41841](https://insights.sbomify.com/CVE-2026-41841/): Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux (medium 5.9)
- [CVE-2026-41840](https://insights.sbomify.com/CVE-2026-41840/): Spring Framework Denial of Service via Multipart Requests in WebFlux (medium 5.9)
- [CVE-2026-4184](https://insights.sbomify.com/CVE-2026-4184/): D-Link DIR-816 goahead form2Wl5BasicSetup.cgi stack-based overflow (critical 9.3)
- [CVE-2026-41839](https://insights.sbomify.com/CVE-2026-41839/): Spring Framework Escalation via Session Fixation in WebFlux (medium 4.2)
- [CVE-2026-41838](https://insights.sbomify.com/CVE-2026-41838/): Spring Framework Predictable Session ID in WebSocket Module (medium 4.8)
- [CVE-2026-41837](https://insights.sbomify.com/CVE-2026-41837/): Spring Data REST Querydsl integration exposes Jackson-hidden persistent fields as filter keys (medium 5.3)
- [CVE-2026-4183](https://insights.sbomify.com/CVE-2026-4183/): D-Link DIR-816 goahead form2WlanBasicSetup.cgi stack-based overflow (critical 9.3)
- [CVE-2026-4182](https://insights.sbomify.com/CVE-2026-4182/): D-Link DIR-816 goahead form2Wl5RepeaterStep2.cgi stack-based overflow (critical 9.3)
- [CVE-2026-4181](https://insights.sbomify.com/CVE-2026-4181/): D-Link DIR-816 goahead form2RepeaterStep2.cgi stack-based overflow (critical 9.3)
- [CVE-2026-4180](https://insights.sbomify.com/CVE-2026-4180/): D-Link DIR-816 goahead redirect.asp access control (medium 6.9)
- [CVE-2026-4179](https://insights.sbomify.com/CVE-2026-4179/): stm32: usb: Infinite while loop in Interrupt Handler (medium 6.1)
- [CVE-2026-4177](https://insights.sbomify.com/CVE-2026-4177/): Memory corruption in YAML::Syck (critical 9.1)
- [CVE-2026-4176](https://insights.sbomify.com/CVE-2026-4176/): Supply chain in perl (critical 9.8)
- [CVE-2026-4175](https://insights.sbomify.com/CVE-2026-4175/): Aureus ERP Chatter Message content-text-entry.blade.php cross site scripting (medium 5.1)
- [CVE-2026-4174](https://insights.sbomify.com/CVE-2026-4174/): Radare2 Mach-O File mach0.c walk_exports_trie resource consumption (medium 4.8)
- [CVE-2026-41732](https://insights.sbomify.com/CVE-2026-41732/): Spring for Apache Pulsar: JsonPulsarHeaderMapper Trusted-Package Prefix Check Allows Unintended Subpackage Deserialization (high 8.1)
- [CVE-2026-41731](https://insights.sbomify.com/CVE-2026-41731/): In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization (high 8.1)
- [CVE-2026-41730](https://insights.sbomify.com/CVE-2026-41730/): Spring Data REST exposes persistence-layer internals in error responses (medium 5.3)
- [CVE-2026-4173](https://insights.sbomify.com/CVE-2026-4173/): CodePhiliaX Chat2DB Database Export DMDBManage.java updateProcedure sql injection (medium 5.3)
- [CVE-2026-41729](https://insights.sbomify.com/CVE-2026-41729/): Spring Data REST SpEL Injection via Map Key in JSON Patch (high 8.1)
- [CVE-2026-41728](https://insights.sbomify.com/CVE-2026-41728/): Spring Data REST JSON Patch bypasses Jackson read-only property protection on nested objects and collections (high 7.5)
- [CVE-2026-41727](https://insights.sbomify.com/CVE-2026-41727/): In Spring for Apache Kafka, forged retry topic headers subvert retry routing and backoff behavior (medium 6.5)
- [CVE-2026-41726](https://insights.sbomify.com/CVE-2026-41726/): In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector header (medium 6.5)
- [CVE-2026-41724](https://insights.sbomify.com/CVE-2026-41724/): Cross-site scripting in VCF operations (high 8.0)
- [CVE-2026-41723](https://insights.sbomify.com/CVE-2026-41723/): Cross-site scripting in VCF operations (high 8.0)
- [CVE-2026-41722](https://insights.sbomify.com/CVE-2026-41722/): Cross-site scripting in VCF operations (high 8.0)
- [CVE-2026-41721](https://insights.sbomify.com/CVE-2026-41721/): Spring Data Commons Denial of Service via Data Binding (medium 5.9)
- [CVE-2026-41720](https://insights.sbomify.com/CVE-2026-41720/): Authentication Bypass with Empty Password in Spring LDAP (high 7.4)
- [CVE-2026-4172](https://insights.sbomify.com/CVE-2026-4172/): TRENDnet TEW-632BRP HTTP POST Request ping_response.cgi stack-based overflow (high 8.6)
- [CVE-2026-41719](https://insights.sbomify.com/CVE-2026-41719/): Spring Data KeyValue - SpEL Injection vulnerability in SpelPropertyComparator (medium 6.4)
- [CVE-2026-41717](https://insights.sbomify.com/CVE-2026-41717/): Spring Data MongoDB - SpEL Expression Injection via Annotated Query Parameter Binding (high 8.1)
- [CVE-2026-41716](https://insights.sbomify.com/CVE-2026-41716/): Spring Data web support unbounded negative-result cache keyed on attacker-supplied property names (high 7.5)
- [CVE-2026-41715](https://insights.sbomify.com/CVE-2026-41715/): Reactor Netty HTTP Client Leaks Credentials On Protocol Downgrade Redirect (medium 6.1)
- [CVE-2026-41714](https://insights.sbomify.com/CVE-2026-41714/): Spring AMQP Core: Missing Certificate and Hostname Verification for amqps URIs in RabbitConnectionFactoryBean (medium 4.0)
- [CVE-2026-41713](https://insights.sbomify.com/CVE-2026-41713/): Prompt Injection via Memory Poisoning in PromptChatMemoryAdvisor (high 8.2)
- [CVE-2026-41712](https://insights.sbomify.com/CVE-2026-41712/): ChatMemory DEFAULT_CONVERSATION_ID causes unintended cross-user data leakage (high 7.5)
- [CVE-2026-41711](https://insights.sbomify.com/CVE-2026-41711/): Potential Denial of Service through crafted Sort Parameters (medium 5.9)
- [CVE-2026-41710](https://insights.sbomify.com/CVE-2026-41710/): Cache Exhaustion in Stateful Retries leads to Denial of Service (medium 5.9)
- [CVE-2026-4171](https://insights.sbomify.com/CVE-2026-4171/): CodeGenieApp serverless-express API Endpoint TodoList.ts authorization (medium 5.3)
- [CVE-2026-41709](https://insights.sbomify.com/CVE-2026-41709/): Broadcom VMWare ESX Insufficient Logging (low 2.7, exploited in the wild)
- [CVE-2026-41708](https://insights.sbomify.com/CVE-2026-41708/): Spring Cloud Sleuth instrumentation of Spring TX DoS vulnerability (high 7.5)
- [CVE-2026-41707](https://insights.sbomify.com/CVE-2026-41707/): Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay (high 7.4)
- [CVE-2026-41706](https://insights.sbomify.com/CVE-2026-41706/): Open Redirect When Using CookieRequestCache (medium 6.1)
- [CVE-2026-41705](https://insights.sbomify.com/CVE-2026-41705/): Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized document IDs (high 8.6)
- [CVE-2026-41704](https://insights.sbomify.com/CVE-2026-41704/): Compromised VM can make arbitrary blobstore deletes (medium 6.8)
- [CVE-2026-41703](https://insights.sbomify.com/CVE-2026-41703/): Out-of-bounds read vulnerability (high 7.6)
- [CVE-2026-41702](https://insights.sbomify.com/CVE-2026-41702/): TOCTOU local privilege escalation vulnerability (high 7.8)
- [CVE-2026-41701](https://insights.sbomify.com/CVE-2026-41701/): In Spring AMQP sequential correlation IDs enable reply poisoning on fixed reply queues (medium 4.4)
- [CVE-2026-41700](https://insights.sbomify.com/CVE-2026-41700/): Cross-Site WebSocket Hijacking in Spring for GraphQL (high 8.1)
- [CVE-2026-4170](https://insights.sbomify.com/CVE-2026-4170/): Topsec TopACM HTTP Request nmc_sync.php os command injection (critical 9.3)
- [CVE-2026-41699](https://insights.sbomify.com/CVE-2026-41699/): Unsafe Deserialization in Spring GraphQL (high 8.1)
- [CVE-2026-41697](https://insights.sbomify.com/CVE-2026-41697/): Spring Data Relational Parameter not Escaped for Query By Example LIKE Pattern (medium 4.8)
- [CVE-2026-41696](https://insights.sbomify.com/CVE-2026-41696/): Spring Data MongoDB Bind Parameter Literal Quoting Breakout (medium 5.9)
- [CVE-2026-41695](https://insights.sbomify.com/CVE-2026-41695/): Denial of Service in Spring Data Commons Property Path Resolution (high 7.5)
- [CVE-2026-41694](https://insights.sbomify.com/CVE-2026-41694/): SAML Payloads Decrypted Without Valid Signature (low 3.7)
- [CVE-2026-41693](https://insights.sbomify.com/CVE-2026-41693/): i18next-fs-backend: Path traversal via unsanitised lng/ns allows arbitrary file read/overwrite (high 8.2)
- [CVE-2026-41692](https://insights.sbomify.com/CVE-2026-41692/): i18nextify is vulnerable to DOM XSS via javascript:/data: URL schemes in translated href/src attributes (medium 4.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/656/