# Vulnerabilities published in 2026


- [CVE-2026-41691](https://insights.sbomify.com/CVE-2026-41691/): i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns (medium 6.5)
- [CVE-2026-41690](https://insights.sbomify.com/CVE-2026-41690/): Prototype pollution and path traversal in i18next-http-middleware via user-controlled language and namespace parameters (high 8.6)
- [CVE-2026-4169](https://insights.sbomify.com/CVE-2026-4169/): Tecnick TCExam XML Export tce_xml_users.php F_xml_export_users cross site scripting (medium 4.8)
- [CVE-2026-41689](https://insights.sbomify.com/CVE-2026-41689/): Server-side request forgery in Wallos (medium 6.0)
- [CVE-2026-41688](https://insights.sbomify.com/CVE-2026-41688/): Incomplete fix for CVE-2026-33399: SSRF in Wallos (high 7.7)
- [CVE-2026-41687](https://insights.sbomify.com/CVE-2026-41687/): Wallos: SSRF CGNAT Bypass in subscription/payments Logo URL — is_cgnat_ip() Not Used in Inline Checks (medium 4.3)
- [CVE-2026-41686](https://insights.sbomify.com/CVE-2026-41686/): Claude SDK for TypeScript has Insecure Default File Permissions in Local Filesystem Memory Tool (medium 4.8)
- [CVE-2026-41685](https://insights.sbomify.com/CVE-2026-41685/): Incus: Unbounded binary import disk exhaustion (medium 4.3)
- [CVE-2026-41684](https://insights.sbomify.com/CVE-2026-41684/): Incus: Nil Dereferences on Restore via Malformed YAML (medium 6.5)
- [CVE-2026-41683](https://insights.sbomify.com/CVE-2026-41683/): HTTP response splitting and DoS in i18next-http-middleware via unsanitised Content-Language header (high 8.6)
- [CVE-2026-41682](https://insights.sbomify.com/CVE-2026-41682/): pupnp: Port truncation via atoi() cast in parse_uri() allows SSRF port confusion (medium 6.9)
- [CVE-2026-41681](https://insights.sbomify.com/CVE-2026-41681/): rust-openssl: MdCtxRef::digest_final() writes past caller buffer with no length check (high 8.1)
- [CVE-2026-41680](https://insights.sbomify.com/CVE-2026-41680/): Marked: OOM Denial of Service via Infinite Recursion in marked Tokenizer (high 8.7)
- [CVE-2026-4168](https://insights.sbomify.com/CVE-2026-4168/): Tecnick TCExam Group tce_edit_group.php cross site scripting (medium 4.8)
- [CVE-2026-41679](https://insights.sbomify.com/CVE-2026-41679/): Paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass (critical 10.0)
- [CVE-2026-41678](https://insights.sbomify.com/CVE-2026-41678/): rust-openssl: Incorrect bounds assertion in aes key wrap (high 7.2)
- [CVE-2026-41677](https://insights.sbomify.com/CVE-2026-41677/): rust-openssl: Out-of-bounds read in PEM password callback when user callback returns an oversized length (low 1.7)
- [CVE-2026-41676](https://insights.sbomify.com/CVE-2026-41676/): rust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.1 (high 7.2)
- [CVE-2026-41675](https://insights.sbomify.com/CVE-2026-41675/): xmldom: XML node injection through unvalidated processing instruction serialization (high 8.7)
- [CVE-2026-41674](https://insights.sbomify.com/CVE-2026-41674/): xmldom: XML injection through unvalidated DocumentType serialization (high 8.7)
- [CVE-2026-41673](https://insights.sbomify.com/CVE-2026-41673/): xmldom: Denial of service via uncontrolled recursion in XML serialization (high 8.7)
- [CVE-2026-41672](https://insights.sbomify.com/CVE-2026-41672/): xmldom: XML node injection through unvalidated comment serialization (high 8.7)
- [CVE-2026-41671](https://insights.sbomify.com/CVE-2026-41671/): Admidio: OIDC Token Introspection Endpoint Returns Active for All Tokens Without Validation (medium 6.8)
- [CVE-2026-41670](https://insights.sbomify.com/CVE-2026-41670/): Admidio: SAML Response Sent to Unvalidated Assertion Consumer Service URL from AuthnRequest (high 8.2)
- [CVE-2026-4167](https://insights.sbomify.com/CVE-2026-4167/): Belkin F9K1122 formReboot stack-based overflow (high 8.7)
- [CVE-2026-41669](https://insights.sbomify.com/CVE-2026-41669/): Admidio: SAML Signature Validation Result Ignored — Forged AuthnRequests and LogoutRequests Processed (high 8.2)
- [CVE-2026-41667](https://insights.sbomify.com/CVE-2026-41667/): Integer overflow in ONE (medium 6.6)
- [CVE-2026-41666](https://insights.sbomify.com/CVE-2026-41666/): Integer overflow in ONE (medium 6.6)
- [CVE-2026-41665](https://insights.sbomify.com/CVE-2026-41665/): Integer overflow in ONE (medium 6.1)
- [CVE-2026-41664](https://insights.sbomify.com/CVE-2026-41664/): Integer overflow in ONE (medium 6.6)
- [CVE-2026-41663](https://insights.sbomify.com/CVE-2026-41663/): Admidio: CSRF on Admin Preferences Triggers Unauthorized Backup, .htaccess Write, and Email Send (low 3.5)
- [CVE-2026-41662](https://insights.sbomify.com/CVE-2026-41662/): Admidio: Missing Minimum Administrator Check in Role Membership Removal (medium 5.2)
- [CVE-2026-41661](https://insights.sbomify.com/CVE-2026-41661/): Admidio: Reflected XSS in msg_window.php via Square Bracket to HTML Tag Conversion (medium 6.1)
- [CVE-2026-41660](https://insights.sbomify.com/CVE-2026-41660/): Admidio: Inverted 2FA Reset Authorization Check Lets Group Leaders Strip Admin TOTP (high 7.1)
- [CVE-2026-4166](https://insights.sbomify.com/CVE-2026-4166/): Wavlink WL-NU516U1 login.cgi sub_404F68 cross site scripting (medium 5.1)
- [CVE-2026-41659](https://insights.sbomify.com/CVE-2026-41659/): Admidio: Hidden Profile Field Values Leaked via Blind Search Oracle in Member Assignment (low 2.7)
- [CVE-2026-41658](https://insights.sbomify.com/CVE-2026-41658/): Admidio: Missing Authorization on Inventory Module Destructive Endpoints Allows Any Authenticated User to Delete Items (medium 6.5)
- [CVE-2026-41657](https://insights.sbomify.com/CVE-2026-41657/): Admidio: Cross-Organization Member Data Exposure via Permission Check Mismatch in contacts_data.php (medium 4.9)
- [CVE-2026-41656](https://insights.sbomify.com/CVE-2026-41656/): Admidio: Path Traversal via Unvalidated `name` Parameter in Document Add Mode Enables Arbitrary Server File Read (medium 4.5)
- [CVE-2026-41655](https://insights.sbomify.com/CVE-2026-41655/): Admidio: Path Traversal in ECard Preview Allows Reading Arbitrary Server Files Including Database Credentials (medium 6.5)
- [CVE-2026-41654](https://insights.sbomify.com/CVE-2026-41654/): Weblate is Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url (medium 5.3)
- [CVE-2026-41653](https://insights.sbomify.com/CVE-2026-41653/): BentoPDF: Stored XSS via Markdown Editor Leading to Persistent File Exfiltration (high 7.0)
- [CVE-2026-41651](https://insights.sbomify.com/CVE-2026-41651/): PackageKit vulnerable to TOCTOU Race on Transaction Flags leads to arbitrary package installation as root (high 8.8)
- [CVE-2026-41650](https://insights.sbomify.com/CVE-2026-41650/): fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters (medium 6.1)
- [CVE-2026-4165](https://insights.sbomify.com/CVE-2026-4165/): Worksuite HR, CRM and Project Management create cross site scripting (medium 4.8)
- [CVE-2026-41649](https://insights.sbomify.com/CVE-2026-41649/): Outline has IDOR in document share creation that allows unauthorized access to private documents across workspaces (high 7.7)
- [CVE-2026-41648](https://insights.sbomify.com/CVE-2026-41648/): Incus: Unbounded YAML Metadata Decode via Parsing (medium 5.3)
- [CVE-2026-41647](https://insights.sbomify.com/CVE-2026-41647/): Incus: Nil-Pointer Dereference via S3 Bucket Import (medium 6.5)
- [CVE-2026-41646](https://insights.sbomify.com/CVE-2026-41646/): Nuclei: Local File Read via require() Module Loader Bypass (medium 5.5)
- [CVE-2026-41645](https://insights.sbomify.com/CVE-2026-41645/): Nuclei: Environment variable disclosure via Response-Derived DSL Expressions (medium 5.3)
- [CVE-2026-41644](https://insights.sbomify.com/CVE-2026-41644/): monetr is vulnerable to server-side request forgery in Lunch Flow link creation and refresh (high 8.3)
- [CVE-2026-41643](https://insights.sbomify.com/CVE-2026-41643/): GoBGP: Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE (high 7.5)
- [CVE-2026-41642](https://insights.sbomify.com/CVE-2026-41642/): GoBGP: Remote Denial of Service (Panic) via Malformed Well-known Path Attribute (high 7.5)
- [CVE-2026-41641](https://insights.sbomify.com/CVE-2026-41641/): NocoBase Vulnerable to SQL Validation Bypass via `sqlCollection:update` Missing `checkSQL` Call (high 7.2)
- [CVE-2026-41640](https://insights.sbomify.com/CVE-2026-41640/): NocoBase Vulnerable to SQL Injection via String Concatenation in Recursive Eager Loading (high 7.5)
- [CVE-2026-4164](https://insights.sbomify.com/CVE-2026-4164/): Wavlink WL-WN578W2 POST Request wireless.cgi GuestWifi command injection (critical 9.3)
- [CVE-2026-41637](https://insights.sbomify.com/CVE-2026-41637/): Degradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queries (low 3.7)
- [CVE-2026-41636](https://insights.sbomify.com/CVE-2026-41636/): Apache Thrift: Node.js skip() recursion (high 8.7)
- [CVE-2026-41635](https://insights.sbomify.com/CVE-2026-41635/): Apache MINA vulnerable to Deserialization of Untrusted Data (critical 9.8)
- [CVE-2026-4163](https://insights.sbomify.com/CVE-2026-4163/): Wavlink WL-WN579A3 POST Request wireless.cgi GuestWifi command injection (critical 9.3)
- [CVE-2026-4162](https://insights.sbomify.com/CVE-2026-4162/): Gravity SMTP <= 2.1.4 - Missing Authorization to Authenticated (Subscriber+) Plugin Uninstall (high 7.1)
- [CVE-2026-41615](https://insights.sbomify.com/CVE-2026-41615/): Microsoft Authenticator Information Disclosure Vulnerability (critical 9.6)
- [CVE-2026-41614](https://insights.sbomify.com/CVE-2026-41614/): M365 Copilot for Desktop Spoofing Vulnerability (medium 6.2)
- [CVE-2026-41613](https://insights.sbomify.com/CVE-2026-41613/): Visual Studio Code Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-41612](https://insights.sbomify.com/CVE-2026-41612/): Visual Studio Code Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-41611](https://insights.sbomify.com/CVE-2026-41611/): Visual Studio Code Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-41610](https://insights.sbomify.com/CVE-2026-41610/): Visual Studio Code Security Feature Bypass Vulnerability (medium 6.3)
- [CVE-2026-4161](https://insights.sbomify.com/CVE-2026-4161/): Review Map by RevuKangaroo <= 1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings (medium 4.4)
- [CVE-2026-41608](https://insights.sbomify.com/CVE-2026-41608/): Apache Thrift: Unbounded Zlib Decompression in Python THeaderTransport (high 7.5)
- [CVE-2026-41607](https://insights.sbomify.com/CVE-2026-41607/): Apache Thrift: C++ JSON OOB read (medium 6.5)
- [CVE-2026-41606](https://insights.sbomify.com/CVE-2026-41606/): Apache Thrift: c_glib dispatch stack overflow (medium 5.3)
- [CVE-2026-41605](https://insights.sbomify.com/CVE-2026-41605/): Apache Thrift: Swift Compact Protocol integer overflow (high 7.3)
- [CVE-2026-41604](https://insights.sbomify.com/CVE-2026-41604/): Apache Thrift: Swift Range crash in skip() (high 8.2)
- [CVE-2026-41602](https://insights.sbomify.com/CVE-2026-41602/): Apache Thrift: Go TFramedTransport uint32 overflow (high 7.5)
- [CVE-2026-4160](https://insights.sbomify.com/CVE-2026-4160/): Missing authorization in Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder (medium 5.3)
- [CVE-2026-41591](https://insights.sbomify.com/CVE-2026-41591/): Marko: XSS via case-insensitive script/style closing tag bypass in runtime HTML escaping (medium 6.4)
- [CVE-2026-4159](https://insights.sbomify.com/CVE-2026-4159/): wc_PKCS7_DecodeEnvelopedData 1 byte out-of-bounds read (low 1.2)
- [CVE-2026-41589](https://insights.sbomify.com/CVE-2026-41589/): Wish has SCP Path Traversal that allows arbitrary file read/write (critical 9.6)
- [CVE-2026-41588](https://insights.sbomify.com/CVE-2026-41588/): RELATE: Timing Attack Vulnerability in course/auth.py — check_sign_in_key() (critical 9.0)
- [CVE-2026-41587](https://insights.sbomify.com/CVE-2026-41587/): CI4MS: Unrestricted PHP File Upload via Theme Installation Leads to Authenticated Remote Code Execution (high 8.6)
- [CVE-2026-41586](https://insights.sbomify.com/CVE-2026-41586/): ObjectInputStream.readObject() without ObjectInputFilter in fabric-sdk-java allows Java deserialization RCE (critical 9.3)
- [CVE-2026-41585](https://insights.sbomify.com/CVE-2026-41585/): ZEBRA: Denial of Service via Interrupted JSON-RPC Requests from Authenticated Clients (medium 6.9)
- [CVE-2026-41584](https://insights.sbomify.com/CVE-2026-41584/): ZEBRA: rk Identity Point Panic in Transaction Verification (critical 9.2)
- [CVE-2026-41583](https://insights.sbomify.com/CVE-2026-41583/): ZEBRA: Consensus Divergence in Transparent Sighash Hash-Type Handling (critical 9.3)
- [CVE-2026-41582](https://insights.sbomify.com/CVE-2026-41582/): countly-server: Unauthenticated Path Traversal via Public Image and Screenshot Routes Leads to Read Internal Files (high 7.5)
- [CVE-2026-41581](https://insights.sbomify.com/CVE-2026-41581/): Frappe Vulnerable to Possible SQL Injection via get_blog_list (medium 6.9)
- [CVE-2026-41580](https://insights.sbomify.com/CVE-2026-41580/): Stirling-PDF: Reflected XSS through crafted PDF metadata fields (Title and Author) (medium 6.1)
- [CVE-2026-4158](https://insights.sbomify.com/CVE-2026-4158/): KeePassXC OpenSSL Configuration Uncontrolled Search Path Element Local Privilege Escalation Vulnerability (high 7.3)
- [CVE-2026-41579](https://insights.sbomify.com/CVE-2026-41579/): runc: Malicious image with /dev symlink can trigger limited host filesystem integrity violations (low 3.3)
- [CVE-2026-41577](https://insights.sbomify.com/CVE-2026-41577/): authentik: SAML source does not validate Conditions, timing, or audience on assertions (medium 6.9)
- [CVE-2026-41576](https://insights.sbomify.com/CVE-2026-41576/): Ajax30/BraveCMS-2.0: Stored HTML Injection in Contact Email via nl2br() and Unescaped Blade Template (high 7.1)
- [CVE-2026-41575](https://insights.sbomify.com/CVE-2026-41575/): th30d4y/IP: DOM-Based Cross-Site Scripting (XSS) Vulnerability (medium 6.1)
- [CVE-2026-41574](https://insights.sbomify.com/CVE-2026-41574/): Nhost Vulnerable to Account Takeover via OAuth Email Verification Bypass (critical 9.3)
- [CVE-2026-41573](https://insights.sbomify.com/CVE-2026-41573/): OpenAM LDAP Injection via `_queryId` Parameter (high 7.1)
- [CVE-2026-41572](https://insights.sbomify.com/CVE-2026-41572/): Note Mark: Unauthenticated read of notes and assets in soft-deleted public books (medium 5.3)
- [CVE-2026-41571](https://insights.sbomify.com/CVE-2026-41571/): Note Mark: OIDC-registered users authenticated by submitting password "null" (critical 9.4)
- [CVE-2026-41570](https://insights.sbomify.com/CVE-2026-41570/): PHPUnit: Argument injection via newline in PHP INI values forwarded to child processes (high 7.8)
- [CVE-2026-4157](https://insights.sbomify.com/CVE-2026-4157/): ChargePoint Home Flex revssh Service Command Injection Remote Code Execution Vulnerability (high 7.5)
- [CVE-2026-41569](https://insights.sbomify.com/CVE-2026-41569/): authentik: WS-Federation wreply origin bypass can exfiltrate signed login responses to attacker-controlled endpoints (medium 6.9)
- [CVE-2026-41568](https://insights.sbomify.com/CVE-2026-41568/): Moby: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/657/