# Vulnerabilities published in 2026


- [CVE-2026-41257](https://insights.sbomify.com/CVE-2026-41257/): jq: Signed-int overflow in `stack_reallocate` (jq VM stack) (medium 6.4)
- [CVE-2026-41256](https://insights.sbomify.com/CVE-2026-41256/): jq: Embedded NUL truncates top-level jq programs loaded with -f (medium 5.5)
- [CVE-2026-41255](https://insights.sbomify.com/CVE-2026-41255/): CKAN: CSRF exemption primed by anonymous requests (medium 6.1)
- [CVE-2026-41254](https://insights.sbomify.com/CVE-2026-41254/): Integer overflow in little cms color engine (medium 4.0)
- [CVE-2026-41253](https://insights.sbomify.com/CVE-2026-41253/): Code injection in iTerm2 (medium 6.9)
- [CVE-2026-41252](https://insights.sbomify.com/CVE-2026-41252/): xrdp: lib_palette_update Heap Buffer Overflow & RCE (critical 9.8)
- [CVE-2026-41250](https://insights.sbomify.com/CVE-2026-41250/): XSS in taiga-front (medium 5.7)
- [CVE-2026-4125](https://insights.sbomify.com/CVE-2026-4125/): WPMK Block <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-41249](https://insights.sbomify.com/CVE-2026-41249/): CoreShop Vulnerable to Remote Code Execution (RCE) via Insecure `pull_request_target` Configuration (high 8.2)
- [CVE-2026-41248](https://insights.sbomify.com/CVE-2026-41248/): Official Clerk JavaScript SDKs: Middleware-based route protection bypass (critical 9.1)
- [CVE-2026-41247](https://insights.sbomify.com/CVE-2026-41247/): elFinder: Command injection in resize background color parameter when using ImageMagick CLI (high 8.9)
- [CVE-2026-41246](https://insights.sbomify.com/CVE-2026-41246/): Contour: Lua code injection via Cookie Path Rewrite Policy (high 8.1)
- [CVE-2026-41245](https://insights.sbomify.com/CVE-2026-41245/): Junrar: Path Traversal (Zip-Slip) via Sibling Directory Name Prefix (medium 5.9)
- [CVE-2026-41244](https://insights.sbomify.com/CVE-2026-41244/): Mojic: Observable Timing Discrepancy in HMAC Verification (medium 4.7)
- [CVE-2026-41243](https://insights.sbomify.com/CVE-2026-41243/): OpenLearn's pending forum posts remain publicly readable by direct ID when moderation mode is enabled (medium 6.9)
- [CVE-2026-41242](https://insights.sbomify.com/CVE-2026-41242/): protobufjs has an arbitrary code execution issue (critical 9.4)
- [CVE-2026-41241](https://insights.sbomify.com/CVE-2026-41241/): pretalx: Stored cross-site scripting in organiser search typeahead (high 8.7)
- [CVE-2026-41240](https://insights.sbomify.com/CVE-2026-41240/): DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix) (medium 6.0)
- [CVE-2026-4124](https://insights.sbomify.com/CVE-2026-4124/): Missing authorization in Ziggeo (medium 5.4)
- [CVE-2026-41239](https://insights.sbomify.com/CVE-2026-41239/): DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode (medium 6.8)
- [CVE-2026-41238](https://insights.sbomify.com/CVE-2026-41238/): DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback (medium 6.9)
- [CVE-2026-41237](https://insights.sbomify.com/CVE-2026-41237/): Froxlor has an incomplete fix for CVE-2026-30932 (high 8.6)
- [CVE-2026-41236](https://insights.sbomify.com/CVE-2026-41236/): Froxlor has privilege escalation in SSH key synchronization via symlinked `authorized_keys` path (high 8.8)
- [CVE-2026-41235](https://insights.sbomify.com/CVE-2026-41235/): Froxlor has an authorization bypass in FTP shell assignment via missing server-side `available_shells` enforcement (high 8.6)
- [CVE-2026-41234](https://insights.sbomify.com/CVE-2026-41234/): Froxlor: BIND Zone File Injection via TXT Record Content (high 7.6)
- [CVE-2026-41233](https://insights.sbomify.com/CVE-2026-41233/): Froxlor has a Reseller Domain Quota Bypass via Unvalidated adminid Parameter in Domains.add() (medium 5.4)
- [CVE-2026-41232](https://insights.sbomify.com/CVE-2026-41232/): Froxlor has an Email Sender Alias Domain Ownership Bypass via Wrong Array Index Allows Cross-Customer Email Spoofing (medium 5.0)
- [CVE-2026-41231](https://insights.sbomify.com/CVE-2026-41231/): Froxlor has Incomplete Symlink Validation in DataDump.add() that Allows Arbitrary Directory Ownership Takeover via Cron (high 7.5)
- [CVE-2026-41230](https://insights.sbomify.com/CVE-2026-41230/): Froxlor has a BIND Zone File Injection via Unsanitized DNS Record Content in DomainZones::add() (high 8.5)
- [CVE-2026-4123](https://insights.sbomify.com/CVE-2026-4123/): Missing authorization in RW Elephant Rental Inventory (medium 4.3)
- [CVE-2026-41229](https://insights.sbomify.com/CVE-2026-41229/): Froxlor has a PHP Code Injection via Unescaped Single Quotes in userdata.inc.php Generation (MysqlServer API) (critical 9.1)
- [CVE-2026-41228](https://insights.sbomify.com/CVE-2026-41228/): Froxlor has Local File Inclusion via path traversal in API `def_language` parameter that leads to Remote Code Execution (critical 10.0)
- [CVE-2026-41227](https://insights.sbomify.com/CVE-2026-41227/): BIG-IP HTTP/2 Layer 7 Dos Protection vulnerability (high 8.7)
- [CVE-2026-41226](https://insights.sbomify.com/CVE-2026-41226/): Open redirect in Multiple MFPs which implement Ricoh Web Image Monitor (medium 5.1)
- [CVE-2026-41225](https://insights.sbomify.com/CVE-2026-41225/): iControl REST vulnerability (high 8.6)
- [CVE-2026-41223](https://insights.sbomify.com/CVE-2026-41223/): Memory corruption in Totolink (critical 9.1)
- [CVE-2026-41222](https://insights.sbomify.com/CVE-2026-41222/): Memory corruption in Totolink (critical 9.1)
- [CVE-2026-41220](https://insights.sbomify.com/CVE-2026-41220/): Memory corruption in Acronis Cyber Protect Cloud Agent (high 7.8)
- [CVE-2026-41219](https://insights.sbomify.com/CVE-2026-41219/): BIG-IP QKView vulnerability (high 7.1)
- [CVE-2026-41218](https://insights.sbomify.com/CVE-2026-41218/): BIG-IP PEM iRules vulnerability (high 8.7)
- [CVE-2026-41217](https://insights.sbomify.com/CVE-2026-41217/): BIG-IP tmsh vulnerability (high 8.3)
- [CVE-2026-41216](https://insights.sbomify.com/CVE-2026-41216/): Memory corruption in vtk (high 7.5)
- [CVE-2026-41213](https://insights.sbomify.com/CVE-2026-41213/): @node-oauth/oauth2-server: PKCE code_verifier ABNF not enforced in token exchange allows brute-force redemption of intercepted authorization codes (medium 5.9)
- [CVE-2026-41211](https://insights.sbomify.com/CVE-2026-41211/): `vite-plus/binding` has path traversal `downloadPackageManager()` that leads to writes outside of `VP_HOME` (high 8.4)
- [CVE-2026-41210](https://insights.sbomify.com/CVE-2026-41210/): Moonlight Qt: Remote heap buffer overflow in Moonlight Qt H.264 SPS fixup path via crafted seq_parameter_set_id (medium 6.5)
- [CVE-2026-4121](https://insights.sbomify.com/CVE-2026-4121/): Kcaptcha <= 1.0.1 - Cross-Site Request Forgery to Settings Update (medium 4.3)
- [CVE-2026-41208](https://insights.sbomify.com/CVE-2026-41208/): Paperclip: Privilege Escalation via Agent-Controlled workspaceStrategy.provisionCommand Leading to OS Command Execution (high 8.8)
- [CVE-2026-41207](https://insights.sbomify.com/CVE-2026-41207/): netty-incubator-codec-ohttp's HPKEContext operations may produce empty byte[] on failures (medium 6.9)
- [CVE-2026-41206](https://insights.sbomify.com/CVE-2026-41206/): PySpector has a Plugin Code Execution Bypass via Incomplete Static Analysis in PluginSecurity.validate_plugin_code (medium 6.9)
- [CVE-2026-41205](https://insights.sbomify.com/CVE-2026-41205/): Mako: Path traversal via double-slash URI prefix in TemplateLookup (high 7.7)
- [CVE-2026-41203](https://insights.sbomify.com/CVE-2026-41203/): ci4ms Theme::upload is vulnerable to Zip Slip leading to RCE (critical 9.4)
- [CVE-2026-41202](https://insights.sbomify.com/CVE-2026-41202/): ci4ms Backup::restore is vulnerable to Zip Slip leading to RCE (critical 9.4)
- [CVE-2026-41201](https://insights.sbomify.com/CVE-2026-41201/): CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS Version 2 (critical 9.1)
- [CVE-2026-41200](https://insights.sbomify.com/CVE-2026-41200/): STIG Manager has reflected XSS vulnerability in the Web App (high 8.5)
- [CVE-2026-4120](https://insights.sbomify.com/CVE-2026-4120/): Info Cards <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes (medium 6.4)
- [CVE-2026-41197](https://insights.sbomify.com/CVE-2026-41197/): Brillig: Heap corruption in foreign call results with nested tuple arrays (critical 9.3)
- [CVE-2026-41196](https://insights.sbomify.com/CVE-2026-41196/): Luanti has a mod security sandbox escape (critical 9.0)
- [CVE-2026-41195](https://insights.sbomify.com/CVE-2026-41195/): mosparo: Rule package source URL stored SSRF enables internal HTTP probing (medium 5.0)
- [CVE-2026-41194](https://insights.sbomify.com/CVE-2026-41194/): FreeScout's Mailbox OAuth disconnect uses a state-changing GET and is CSRFable (medium 5.4)
- [CVE-2026-41193](https://insights.sbomify.com/CVE-2026-41193/): FreeScout has Zip Slip path traversal in module installation that allows arbitrary file write leading to RCE (critical 9.1)
- [CVE-2026-41192](https://insights.sbomify.com/CVE-2026-41192/): FreeScout's client-controlled attachment IDs allow deletion of existing conversation attachments (high 7.1)
- [CVE-2026-41191](https://insights.sbomify.com/CVE-2026-41191/): FreeScout's signature only mailbox permission allows unauthorized mailbox chat setting changes (high 7.1)
- [CVE-2026-41190](https://insights.sbomify.com/CVE-2026-41190/): FreeScout has assigned-only visibility bypass via save_draft that allows hidden conversation draft injection (high 7.1)
- [CVE-2026-4119](https://insights.sbomify.com/CVE-2026-4119/): Missing authorization in Create DB Tables (critical 9.1)
- [CVE-2026-41189](https://insights.sbomify.com/CVE-2026-41189/): FreeScout has assigned-only visibility bypass that allows editing hidden customer-authored threads (high 7.1)
- [CVE-2026-41187](https://insights.sbomify.com/CVE-2026-41187/): Calico Tier Authorization Bypass via DeleteCollection (medium 6.2)
- [CVE-2026-41186](https://insights.sbomify.com/CVE-2026-41186/): Unauthenticated Go pprof exposure in Calico debug server (medium 6.0)
- [CVE-2026-41185](https://insights.sbomify.com/CVE-2026-41185/): ServiceAccount token disclosure via Azure IPAM CNI plugin logs (medium 6.0)
- [CVE-2026-41184](https://insights.sbomify.com/CVE-2026-41184/): ServiceAccount token disclosure via install-cni container logs (medium 6.0)
- [CVE-2026-41183](https://insights.sbomify.com/CVE-2026-41183/): FreeScout allows non-folder conversation queries to disclose assigned-only hidden conversations (medium 4.3)
- [CVE-2026-41182](https://insights.sbomify.com/CVE-2026-41182/): LangSmith SDK: Streaming token events bypass output redaction (medium 5.3)
- [CVE-2026-41181](https://insights.sbomify.com/CVE-2026-41181/): Traefik: Errors middleware forwards Authorization and Cookie headers to separate error page service (medium 6.9)
- [CVE-2026-41180](https://insights.sbomify.com/CVE-2026-41180/): PsiTransfer: Upload PATCH path traversal can create `config.<NODE_ENV>.js` and lead to code execution on restart (high 7.5)
- [CVE-2026-4118](https://insights.sbomify.com/CVE-2026-4118/): Call To Action Plugin <= 3.1.3 - Cross-Site Request Forgery via Settings Update (medium 4.3)
- [CVE-2026-41179](https://insights.sbomify.com/CVE-2026-41179/): RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution (critical 9.2)
- [CVE-2026-41178](https://insights.sbomify.com/CVE-2026-41178/): OpenTelemetry-Go's baggage parsing no longer caps raw header length (medium 5.3)
- [CVE-2026-41177](https://insights.sbomify.com/CVE-2026-41177/): Squidex has Blind SSRF via file:// Protocol in Restore API leading to Local File Interaction (medium 5.5)
- [CVE-2026-41176](https://insights.sbomify.com/CVE-2026-41176/): Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution (critical 9.2)
- [CVE-2026-41175](https://insights.sbomify.com/CVE-2026-41175/): Statamic: Unsafe method invocation via query value resolution allows data destruction (high 8.1)
- [CVE-2026-41174](https://insights.sbomify.com/CVE-2026-41174/): Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding (medium 4.8)
- [CVE-2026-41173](https://insights.sbomify.com/CVE-2026-41173/): Unbounded HTTP response body read in OpenTelemetry.Sampler.AWS (medium 5.9)
- [CVE-2026-41172](https://insights.sbomify.com/CVE-2026-41172/): Squidex vulnerable to Server-Side Request Forgery (SSRF) via URL-based asset upload (/api/apps/{app}/assets) (high 7.3)
- [CVE-2026-41171](https://insights.sbomify.com/CVE-2026-41171/): SSRF via Jint Scripting Engine HTTP Functions Due to Missing SSRF Protection on "Jint" HttpClient (high 7.3)
- [CVE-2026-41170](https://insights.sbomify.com/CVE-2026-41170/): Squidex has SSRF via Backup Restore Endpoint — Admin-Controlled URL Download Allows Internal and External Requests (high 7.2)
- [CVE-2026-4117](https://insights.sbomify.com/CVE-2026-4117/): CalJ <= 1.5 - Authenticated (Subscriber+) Arbitrary Settings Modification via 'save-obtained-key' Action (medium 5.3)
- [CVE-2026-41168](https://insights.sbomify.com/CVE-2026-41168/): pypdf has possible long runtimes for wrong size values in cross-reference and object streams (medium 6.9)
- [CVE-2026-41167](https://insights.sbomify.com/CVE-2026-41167/): Jellystat has SQL Injection that leads to to Remote Code Execution (critical 9.1)
- [CVE-2026-41166](https://insights.sbomify.com/CVE-2026-41166/): OpenRemote has Improper Access Control via updateUserRealmRoles function (high 7.0)
- [CVE-2026-41164](https://insights.sbomify.com/CVE-2026-41164/): nuts-node: JWT type confusion in v1 access token introspection allows VP replay as access token (medium 4.4)
- [CVE-2026-41163](https://insights.sbomify.com/CVE-2026-41163/): bubblewrap vulnerable to privilege escalation in setuid mode via ptrace (high 8.7)
- [CVE-2026-41161](https://insights.sbomify.com/CVE-2026-41161/): Username Enumeration via Timing Attack (medium 6.9)
- [CVE-2026-41160](https://insights.sbomify.com/CVE-2026-41160/): EspoCRM: Broken Access Control / IDOR in Note Pinning API allows unauthorized modification of notes (medium 4.3)
- [CVE-2026-4116](https://insights.sbomify.com/CVE-2026-4116/): Auth bypass in SMA1000 (high 7.2)
- [CVE-2026-41159](https://insights.sbomify.com/CVE-2026-41159/): Mermaid: Improper sanitization of configuration leads to CSS injection (medium 5.3)
- [CVE-2026-41158](https://insights.sbomify.com/CVE-2026-41158/): GPU DDK - Backed sparse PMRs are not handled by deferred free mechanism after shrink (high 7.8)
- [CVE-2026-41157](https://insights.sbomify.com/CVE-2026-41157/): GPU DDK - OOB Write in CalculateNPOTTwiddleSparsePageMap3D (critical 9.8)
- [CVE-2026-41156](https://insights.sbomify.com/CVE-2026-41156/): GPU DDK - kernel<->fw CCB contains SYNC_PRIMITIVE_BLOCK firmware address without holding reference (high 7.7)
- [CVE-2026-41155](https://insights.sbomify.com/CVE-2026-41155/): GPU DDK - SharedSecMem mapped into all GPU virtual address spaces (medium 5.5)
- [CVE-2026-41154](https://insights.sbomify.com/CVE-2026-41154/): GPU DDK - Incorrect Index Calculation in CMA Cleanup Path of AllocOSPages_Sparse (high 7.8)
- [CVE-2026-41153](https://insights.sbomify.com/CVE-2026-41153/): Command injection in Junie (medium 5.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/661/