# Vulnerabilities published in 2026


- [CVE-2026-41567](https://insights.sbomify.com/CVE-2026-41567/): Docker: `PUT /containers/{id}/archive` executes container binary on the host (high 7.2)
- [CVE-2026-41566](https://insights.sbomify.com/CVE-2026-41566/): Apache Kvrocks: Improper permission for the APPLYBATCH command (critical 9.4)
- [CVE-2026-41565](https://insights.sbomify.com/CVE-2026-41565/): CryptX versions before 0.088_001 for Perl have a stack buffer overflow in four AEAD decrypt_verify helpers (high 7.5)
- [CVE-2026-41564](https://insights.sbomify.com/CVE-2026-41564/): CryptX versions before 0.088 for Perl do not reseed the Crypt::PK PRNG state after forking (high 7.5)
- [CVE-2026-41563](https://insights.sbomify.com/CVE-2026-41563/): WordPress Sitemovr plugin <= 1.0.1 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2026-41562](https://insights.sbomify.com/CVE-2026-41562/): WordPress Norvis Backup plugin <= 1.1.0 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2026-41561](https://insights.sbomify.com/CVE-2026-41561/): WordPress Museder RestoreOne plugin <= 2.7.276 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2026-41560](https://insights.sbomify.com/CVE-2026-41560/): WordPress WXD Backup Lite plugin <= 1.0.2 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-4156](https://insights.sbomify.com/CVE-2026-4156/): ChargePoint Home Flex OCPP getpreq Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 7.5)
- [CVE-2026-41559](https://insights.sbomify.com/CVE-2026-41559/): WordPress SafeSnap – Verified WordPress Backup & Restore plugin <= 2.1.2 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2026-41558](https://insights.sbomify.com/CVE-2026-41558/): WordPress WP Migration Plugin DB & Files – WP Synchro plugin <= 1.16.1 - 2FA Bypass vulnerability (high 7.5)
- [CVE-2026-41557](https://insights.sbomify.com/CVE-2026-41557/): WordPress Kapee theme < 1.7.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-41556](https://insights.sbomify.com/CVE-2026-41556/): WordPress ProfilePress plugin <= 4.16.13 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-41555](https://insights.sbomify.com/CVE-2026-41555/): SQL injection in Newsletter Subscription Form – User Subscriptions Form, Capture Email (critical 9.3)
- [CVE-2026-41554](https://insights.sbomify.com/CVE-2026-41554/): WordPress Bricks Builder theme 1.9.2-2.2 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-41553](https://insights.sbomify.com/CVE-2026-41553/): Remote Code Execution in PDF Export Module (critical 10.0)
- [CVE-2026-41552](https://insights.sbomify.com/CVE-2026-41552/): Path Traversal in PDF Export Module (critical 9.2)
- [CVE-2026-41551](https://insights.sbomify.com/CVE-2026-41551/): Path traversal in ROS# (critical 9.3)
- [CVE-2026-4155](https://insights.sbomify.com/CVE-2026-4155/): ChargePoint Home Flex Inclusion of Sensitive Information in Source Code Information Disclosure Vulnerability (high 7.5)
- [CVE-2026-41545](https://insights.sbomify.com/CVE-2026-41545/): WebSocket timelapse path traversal and command injection (high 8.6)
- [CVE-2026-41544](https://insights.sbomify.com/CVE-2026-41544/): Path Traversal leading to Arbitrary File Move, Docker Escape, and Host RCE in /calapi/renameUpload endpoint (high 8.7)
- [CVE-2026-41541](https://insights.sbomify.com/CVE-2026-41541/): Symlink creation in qsyncsrv.cgi (medium 5.3)
- [CVE-2026-4154](https://insights.sbomify.com/CVE-2026-4154/): GIMP XPM File Parsing Integer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-41539](https://insights.sbomify.com/CVE-2026-41539/): QTS, QuTS hero (medium 6.3)
- [CVE-2026-41530](https://insights.sbomify.com/CVE-2026-41530/): Path traversal in Lhaz (medium 4.6)
- [CVE-2026-4153](https://insights.sbomify.com/CVE-2026-4153/): GIMP PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-41527](https://insights.sbomify.com/CVE-2026-41527/): Privilege escalation in Kleopatra (medium 6.9)
- [CVE-2026-41526](https://insights.sbomify.com/CVE-2026-41526/): Command injection in KCoreAddons (medium 6.5)
- [CVE-2026-41525](https://insights.sbomify.com/CVE-2026-41525/): Security feature bypass in Dolphin (medium 6.5)
- [CVE-2026-41524](https://insights.sbomify.com/CVE-2026-41524/): Ajax30/BraveCMS-2.0: Stored XSS in Page / Article Content (high 8.7)
- [CVE-2026-41523](https://insights.sbomify.com/CVE-2026-41523/): vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution (high 7.5)
- [CVE-2026-41522](https://insights.sbomify.com/CVE-2026-41522/): Iris has an Improper Authorization issue (high 7.1)
- [CVE-2026-41521](https://insights.sbomify.com/CVE-2026-41521/): xrdp: lib_framebuffer_update Has Integer Overflow Heap Info Leak & ASLR Bypass (high 8.2)
- [CVE-2026-41520](https://insights.sbomify.com/CVE-2026-41520/): Cillium exposes sensitive information included in the cilium-bugtool debug archive (high 7.9)
- [CVE-2026-4152](https://insights.sbomify.com/CVE-2026-4152/): GIMP JP2 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-41519](https://insights.sbomify.com/CVE-2026-41519/): Weblate's API Token Not Invalidated on Password Change (medium 4.2)
- [CVE-2026-41518](https://insights.sbomify.com/CVE-2026-41518/): Chartbrew has a stored DOM XSS via Chart Tooltip innerHTML (ChartDatasetConfig.legend) (high 7.6)
- [CVE-2026-41517](https://insights.sbomify.com/CVE-2026-41517/): Emlog: Remote Code Execution via Malicious Plugin Upload (not scored)
- [CVE-2026-41516](https://insights.sbomify.com/CVE-2026-41516/): OP-TEE: Hisilicon HPRE PKCS#1 v1.5 Decryption Padding Oracle (low 2.5)
- [CVE-2026-41515](https://insights.sbomify.com/CVE-2026-41515/): OP-TEE: RSA-OAEP padding oracle in NXP CAAM driver enables plaintext recovery (low 2.5)
- [CVE-2026-41514](https://insights.sbomify.com/CVE-2026-41514/): OP-TEE: RSA-OAEP padding oracle in Hisilicon HPRE driver enables plaintext recovery (low 2.5)
- [CVE-2026-41513](https://insights.sbomify.com/CVE-2026-41513/): Horilla: Open Redirect via Unvalidated `next` Parameter in Notification Endpoints (medium 4.8)
- [CVE-2026-41512](https://insights.sbomify.com/CVE-2026-41512/): Remote code execution via JavaScript injection in `BrowserAutomation::PlaywrightService` (critical 9.9)
- [CVE-2026-41511](https://insights.sbomify.com/CVE-2026-41511/): OpenMcdf has an Infinite loop DoS via crafted CFB directory cycle (medium 6.2)
- [CVE-2026-41510](https://insights.sbomify.com/CVE-2026-41510/): OWASP Coraza WAF: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding (high 7.2)
- [CVE-2026-4151](https://insights.sbomify.com/CVE-2026-4151/): GIMP ANI File Parsing Integer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-41509](https://insights.sbomify.com/CVE-2026-41509/): Integer underflow in crypto_sign_open() leads to buffer overflow (medium 6.9)
- [CVE-2026-41508](https://insights.sbomify.com/CVE-2026-41508/): Coraza: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling (medium 5.8)
- [CVE-2026-41507](https://insights.sbomify.com/CVE-2026-41507/): Remote Code Execution (RCE) via String Literal Injection into math-codegen (critical 9.8)
- [CVE-2026-41506](https://insights.sbomify.com/CVE-2026-41506/): go-git Credential leak via cross-host redirect in smart HTTP transport (medium 4.7)
- [CVE-2026-41505](https://insights.sbomify.com/CVE-2026-41505/): RELATE: Predictable Token Generation in auth.py and exam.py (high 8.7)
- [CVE-2026-41504](https://insights.sbomify.com/CVE-2026-41504/): OWASP Coraza WAF: Native audit-log format allows CRLF injection and log forgery via request body and header fields (medium 5.8)
- [CVE-2026-41503](https://insights.sbomify.com/CVE-2026-41503/): BACnet Stack: Out-of-Bounds Read in ReadPropertyMultiple Property Decoder via Deprecated Tag Parser (high 8.7)
- [CVE-2026-41502](https://insights.sbomify.com/CVE-2026-41502/): BACnet Stack: Off-by-One Out-of-Bounds Read in ReadPropertyMultiple Object ID Decoder (high 8.7)
- [CVE-2026-41501](https://insights.sbomify.com/CVE-2026-41501/): electerm has Command Injection Vulnerability via runLinux function (critical 9.8)
- [CVE-2026-41500](https://insights.sbomify.com/CVE-2026-41500/): electerm has Command Injection Vulnerability via runMac function (critical 9.8)
- [CVE-2026-4150](https://insights.sbomify.com/CVE-2026-4150/): GIMP PSD File Parsing Integer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-41499](https://insights.sbomify.com/CVE-2026-41499/): Wazuh: Multiple Heap-based NULL WRITE Buffer Underflows in parse_uname_string() (medium 6.5)
- [CVE-2026-41498](https://insights.sbomify.com/CVE-2026-41498/): Kimai: Team API Missing Object-Level Authorization (low 3.3)
- [CVE-2026-41497](https://insights.sbomify.com/CVE-2026-41497/): Incomplete fix for CVE-2026-34935: Command Injection in MervinPraison/PraisonAI (critical 9.8)
- [CVE-2026-41496](https://insights.sbomify.com/CVE-2026-41496/): PraisonAI: SQL Injection via unvalidated `table_prefix` in 9 conversation store backends (incomplete fix for CVE-2026-40315) (high 8.1)
- [CVE-2026-41495](https://insights.sbomify.com/CVE-2026-41495/): n8n-MCP Logs Sensitive Request Data on Unauthorized /mcp Requests (medium 5.3)
- [CVE-2026-41493](https://insights.sbomify.com/CVE-2026-41493/): yard: Possible arbitrary path traversal and file access via yard server (medium 6.9)
- [CVE-2026-41492](https://insights.sbomify.com/CVE-2026-41492/): Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars in Dgraph (critical 9.8)
- [CVE-2026-41491](https://insights.sbomify.com/CVE-2026-41491/): Dapr: Service Invocation path traversal ACL bypass (high 8.1)
- [CVE-2026-41490](https://insights.sbomify.com/CVE-2026-41490/): Dagster Vulnerable to SQL Injection via Dynamic Partition Keys in Database I/O Manager Integrations (high 8.3)
- [CVE-2026-4149](https://insights.sbomify.com/CVE-2026-4149/): Sonos Era 300 SMB Response Out-Of-Bounds Access Remote Code Execution Vulnerability (critical 10.0)
- [CVE-2026-41489](https://insights.sbomify.com/CVE-2026-41489/): Pi-hole: Local privilege escalation via config-controlled path in root-executed service hooks (high 8.8)
- [CVE-2026-41488](https://insights.sbomify.com/CVE-2026-41488/): angchain-openai: Image token counting SSRF protection can be bypassed via DNS rebinding (low 3.1)
- [CVE-2026-41487](https://insights.sbomify.com/CVE-2026-41487/): Missing authorization in langfuse (medium 5.3)
- [CVE-2026-41486](https://insights.sbomify.com/CVE-2026-41486/): Ray: Remote Code Execution via Parquet Arrow Extension Type Deserialization (high 8.9)
- [CVE-2026-41485](https://insights.sbomify.com/CVE-2026-41485/): Kyverno Controller Denial of Service via forEach Mutation Panic (high 7.7)
- [CVE-2026-41484](https://insights.sbomify.com/CVE-2026-41484/): OpenTelemetry.Exporter.OneCollector vulnerable to denial of service via unbounded HTTP error response body (medium 5.3)
- [CVE-2026-41483](https://insights.sbomify.com/CVE-2026-41483/): Unbounded HTTP response body read in OpenTelemetry.Resources.Azure (medium 5.9)
- [CVE-2026-41482](https://insights.sbomify.com/CVE-2026-41482/): Frappe: Possible Path Traversal and Local File Inclusion via Chrome PDF Generator (high 7.1)
- [CVE-2026-41481](https://insights.sbomify.com/CVE-2026-41481/): LangChain: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass (medium 6.5)
- [CVE-2026-4148](https://insights.sbomify.com/CVE-2026-4148/): ExpressionContext use-after-free in classic engine $lookup and $graphLookup aggregation operators (high 8.7)
- [CVE-2026-41479](https://insights.sbomify.com/CVE-2026-41479/): Authlib OAuth 2.0 has Open Redirect in Authorization API that allows attacker-controlled redirect_uri through unsupported response_type (medium 5.4)
- [CVE-2026-41478](https://insights.sbomify.com/CVE-2026-41478/): Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId) (critical 10.0)
- [CVE-2026-41477](https://insights.sbomify.com/CVE-2026-41477/): Deskflow: Local privilege escalation via unauthenticated IPC (high 7.8)
- [CVE-2026-41476](https://insights.sbomify.com/CVE-2026-41476/): Deskflow: clipboard deserialization global-buffer-overflow (high 7.4)
- [CVE-2026-41475](https://insights.sbomify.com/CVE-2026-41475/): BACnet Stack: Out-of-Bounds Read in WritePropertyMultiple Decoder via Deprecated Tag Parser (high 8.7)
- [CVE-2026-41473](https://insights.sbomify.com/CVE-2026-41473/): CyberPanel < 2.4.5 Unauthenticated API Access via AI Scanner Endpoints (high 8.8)
- [CVE-2026-41472](https://insights.sbomify.com/CVE-2026-41472/): CyberPanel < 2.4.5 Stored XSS via AI Scanner Dashboard (medium 5.3)
- [CVE-2026-41471](https://insights.sbomify.com/CVE-2026-41471/): Easy PayPal Events & Tickets < 1.4 Information Disclosure via QR Code Endpoint (high 8.2)
- [CVE-2026-41470](https://insights.sbomify.com/CVE-2026-41470/): LIVE555 < 2026.04.22 RTSP Server Authorization Bypass via Session Token (high 8.2)
- [CVE-2026-4147](https://insights.sbomify.com/CVE-2026-4147/): Stack memory disclosure in filemd5 command (high 7.1)
- [CVE-2026-41469](https://insights.sbomify.com/CVE-2026-41469/): Beghelli Sicuro24 SicuroWeb Missing Content Security Policy (medium 5.1)
- [CVE-2026-41468](https://insights.sbomify.com/CVE-2026-41468/): Beghelli Sicuro24 SicuroWeb AngularJS Sandbox Escape via Template Injection (critical 9.3)
- [CVE-2026-41467](https://insights.sbomify.com/CVE-2026-41467/): ProjeQtor < 12.4.4 Stored XSS via checkValidFileName() (medium 5.1)
- [CVE-2026-41466](https://insights.sbomify.com/CVE-2026-41466/): ProjeQtor < 12.4.4 Stored XSS via checkValidHtmlText() (medium 5.1)
- [CVE-2026-41465](https://insights.sbomify.com/CVE-2026-41465/): ProjeQtor < 12.4.4 Path Traversal via dynamicDialog.php (high 7.1)
- [CVE-2026-41464](https://insights.sbomify.com/CVE-2026-41464/): ProjeQtor < 12.4.4 Missing Authorization via objectDetail.php (high 7.1)
- [CVE-2026-41463](https://insights.sbomify.com/CVE-2026-41463/): ProjeQtor < 12.4.4 ZipSlip Path Traversal via uploadPlugin.php (high 8.7)
- [CVE-2026-41462](https://insights.sbomify.com/CVE-2026-41462/): ProjeQtor < 12.4.4 Unauthenticated SQL Injection via Login (critical 9.3)
- [CVE-2026-41461](https://insights.sbomify.com/CVE-2026-41461/): SocialEngine <= 7.8.0 Blind SSRF via /core/link/preview (medium 6.3)
- [CVE-2026-41460](https://insights.sbomify.com/CVE-2026-41460/): SocialEngine <= 7.8.0 SQL Injection via activity/index/get-memberall (critical 9.3)
- [CVE-2026-4146](https://insights.sbomify.com/CVE-2026-4146/): Loco Translate <= 2.8.2 - Reflected Cross-Site Scripting via 'update_href' Parameter (medium 6.1)
- [CVE-2026-41459](https://insights.sbomify.com/CVE-2026-41459/): Xerte Online Toolkits Path Disclosure via /setup (medium 6.9)
- [CVE-2026-41458](https://insights.sbomify.com/CVE-2026-41458/): OwnTone Server < 29.1 Race Condition DoS via DAAP Login (high 8.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/658/