# Vulnerabilities published in 2026


- [CVE-2026-41150](https://insights.sbomify.com/CVE-2026-41150/): Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS (medium 5.3)
- [CVE-2026-4115](https://insights.sbomify.com/CVE-2026-4115/): PuTTY Ed25519 Signature ecc-ssh.c eddsa_verify signature verification (medium 6.3)
- [CVE-2026-41149](https://insights.sbomify.com/CVE-2026-41149/): Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection (medium 5.3)
- [CVE-2026-41148](https://insights.sbomify.com/CVE-2026-41148/): Mermaid: Improper sanitization of `classDefs` in diagrams leads to CSS injection (medium 5.3)
- [CVE-2026-41147](https://insights.sbomify.com/CVE-2026-41147/): NukeViet CMS: Stored Cross-Site Scripting (XSS) via insufficient server-side input sanitization in Request class (high 8.7)
- [CVE-2026-41146](https://insights.sbomify.com/CVE-2026-41146/): Uncontrolled resource consumption and loop with unreachable exit condition in facil.io and downstream iodine ruby gem (high 8.7)
- [CVE-2026-41145](https://insights.sbomify.com/CVE-2026-41145/): MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads (high 8.8)
- [CVE-2026-41144](https://insights.sbomify.com/CVE-2026-41144/): F´ (F Prime) has Integer Overflow in FileUplink (not scored)
- [CVE-2026-41143](https://insights.sbomify.com/CVE-2026-41143/): YesWiki vulnerable to authenticated SQL Injection via id_fiche in EntryManager::formatDataBeforeSave() (high 8.8)
- [CVE-2026-41142](https://insights.sbomify.com/CVE-2026-41142/): OpenEXR is Vulnerable to Integer overflow in ImageChannel::resize leads to heap OOB write via OpenEXRUtil public API (high 8.8)
- [CVE-2026-41141](https://insights.sbomify.com/CVE-2026-41141/): EspoCRM: IDOR in EmailTemplate Prepare Endpoint Leaks Entity Data via Email Address Lookup (medium 6.5)
- [CVE-2026-41140](https://insights.sbomify.com/CVE-2026-41140/): Poetry: Path traversal in tar extraction on Python 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4 (low 0.6)
- [CVE-2026-4114](https://insights.sbomify.com/CVE-2026-4114/): Auth bypass in SMA1000 (medium 6.6)
- [CVE-2026-41139](https://insights.sbomify.com/CVE-2026-41139/): Unsafe array index getter in mathjs (high 8.8)
- [CVE-2026-41138](https://insights.sbomify.com/CVE-2026-41138/): Flowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using `Pandas`. (high 8.3)
- [CVE-2026-41137](https://insights.sbomify.com/CVE-2026-41137/): Flowise: Code Injection in CSVAgent leads to Authenticated RCE (critical 9.4)
- [CVE-2026-41136](https://insights.sbomify.com/CVE-2026-41136/): free5GC AMF missing default case in Content-Type switch in HTTPUEContextTransfer (medium 5.5)
- [CVE-2026-41135](https://insights.sbomify.com/CVE-2026-41135/): free5GC PCF: Memory Leak via CORS Middleware Registration in HTTP Handler Leads to Denial of Service (high 7.5)
- [CVE-2026-41134](https://insights.sbomify.com/CVE-2026-41134/): Kiota: Code Generation Literal Injection (high 7.3)
- [CVE-2026-41133](https://insights.sbomify.com/CVE-2026-41133/): pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass) (high 8.8)
- [CVE-2026-41132](https://insights.sbomify.com/CVE-2026-41132/): CKAN: No certificate validation on STMP connection (medium 6.6)
- [CVE-2026-41131](https://insights.sbomify.com/CVE-2026-41131/): OpenFGA has Improper Policy Enforcement (medium 5.0)
- [CVE-2026-41130](https://insights.sbomify.com/CVE-2026-41130/): Craft CMS has a host header injection leading to SSRF via resource-js endpoint (medium 5.5)
- [CVE-2026-4113](https://insights.sbomify.com/CVE-2026-4113/): Information disclosure in SMA1000 (high 7.2)
- [CVE-2026-41129](https://insights.sbomify.com/CVE-2026-41129/): Craft CMS has Server-Side Request Forgery (SSRF) with Asset Uploads Mutations (medium 5.5)
- [CVE-2026-41128](https://insights.sbomify.com/CVE-2026-41128/): Craft CMS has a Missing Authorization Check on User Group Removal via save-permissions Action (medium 5.3)
- [CVE-2026-41127](https://insights.sbomify.com/CVE-2026-41127/): BigBlueButton's missing authorization allows viewer to inject/overwrite captions (medium 6.5)
- [CVE-2026-41126](https://insights.sbomify.com/CVE-2026-41126/): BigBlueButton has Open Redirect through bigbluebutton/api/join via get-parameter "logoutURL" (medium 4.3)
- [CVE-2026-41125](https://insights.sbomify.com/CVE-2026-41125/): SQL injection in blueplanet 100 NX3 M8 (medium 5.9)
- [CVE-2026-41124](https://insights.sbomify.com/CVE-2026-41124/): Path traversal in PowerProtect Data Domain (low 2.3)
- [CVE-2026-41123](https://insights.sbomify.com/CVE-2026-41123/): Missing authorization in PowerProtect Data Domain (medium 4.3)
- [CVE-2026-41122](https://insights.sbomify.com/CVE-2026-41122/): Cross-site scripting in PowerProtect Data Domain (high 7.1)
- [CVE-2026-41121](https://insights.sbomify.com/CVE-2026-41121/): Privilege escalation in Device Management Agent (high 7.3)
- [CVE-2026-41120](https://insights.sbomify.com/CVE-2026-41120/): Security feature bypass in Wyse Management Suite (critical 9.8)
- [CVE-2026-4112](https://insights.sbomify.com/CVE-2026-4112/): SQL injection in SMA1000 (high 7.2)
- [CVE-2026-41119](https://insights.sbomify.com/CVE-2026-41119/): Security feature bypass in Live Optics (medium 6.8)
- [CVE-2026-41116](https://insights.sbomify.com/CVE-2026-41116/): Path traversal in Inventory Collector Client (medium 6.3)
- [CVE-2026-41115](https://insights.sbomify.com/CVE-2026-41115/): Apache Kafka: Improper Authorization in CONSUMER_GROUP_DESCRIBE API (medium 4.3)
- [CVE-2026-41114](https://insights.sbomify.com/CVE-2026-41114/): Apache IoTDB JDBC driver: Large-scale Memory Exhaustion via BigDecimal toPlainString in JDBC Driver (not scored)
- [CVE-2026-41113](https://insights.sbomify.com/CVE-2026-41113/): Command injection in qmail (high 8.1)
- [CVE-2026-4111](https://insights.sbomify.com/CVE-2026-4111/): Libarchive: infinite loop denial of service in rar5 decompression via archive_read_data() in libarchive (high 7.5)
- [CVE-2026-41109](https://insights.sbomify.com/CVE-2026-41109/): GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability (high 8.8)
- [CVE-2026-41108](https://insights.sbomify.com/CVE-2026-41108/): Windows DNS Client Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-41107](https://insights.sbomify.com/CVE-2026-41107/): Microsoft Edge (Chromium-based) Information Disclosure Vulnerability (high 7.4)
- [CVE-2026-41106](https://insights.sbomify.com/CVE-2026-41106/): Microsoft 365 Copilot Elevation of Privilege Vulnerability (critical 9.3)
- [CVE-2026-41105](https://insights.sbomify.com/CVE-2026-41105/): Azure Monitor Action Group Notification System Elevation of Privilege Vulnerability (high 8.1)
- [CVE-2026-41104](https://insights.sbomify.com/CVE-2026-41104/): Microsoft Planetary Computer Pro Information Disclosure Vulnerability (critical 10.0)
- [CVE-2026-41103](https://insights.sbomify.com/CVE-2026-41103/): Microsoft SSO Plugin for Jira & Confluence Elevation of Privilege Vulnerability (critical 9.1)
- [CVE-2026-41102](https://insights.sbomify.com/CVE-2026-41102/): Microsoft PowerPoint for Android Spoofing Vulnerability (high 7.1)
- [CVE-2026-41101](https://insights.sbomify.com/CVE-2026-41101/): Microsoft Word for Android Spoofing Vulnerability (high 7.1)
- [CVE-2026-41100](https://insights.sbomify.com/CVE-2026-41100/): Microsoft 365 Copilot for Android Spoofing Vulnerability (medium 4.4)
- [CVE-2026-4110](https://insights.sbomify.com/CVE-2026-4110/): Ultimate WooCommerce Auction Pro <= 2.4.5 - Reflected XSS via uwa_auctions_bids_list (medium 6.1)
- [CVE-2026-41098](https://insights.sbomify.com/CVE-2026-41098/): Azure Stack Edge Spoofing Vulnerability (high 8.4)
- [CVE-2026-41097](https://insights.sbomify.com/CVE-2026-41097/): Secure Boot Security Feature Bypass Vulnerability (medium 6.7)
- [CVE-2026-41096](https://insights.sbomify.com/CVE-2026-41096/): Windows DNS Client Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-41095](https://insights.sbomify.com/CVE-2026-41095/): Data Deduplication Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-41094](https://insights.sbomify.com/CVE-2026-41094/): Microsoft Data Formulator Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-41092](https://insights.sbomify.com/CVE-2026-41092/): Microsoft Kinect Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-41091](https://insights.sbomify.com/CVE-2026-41091/): Microsoft Defender Link Following (high 7.8, exploited in the wild)
- [CVE-2026-41090](https://insights.sbomify.com/CVE-2026-41090/): Microsoft Copilot Tampering Vulnerability (critical 9.3)
- [CVE-2026-4109](https://insights.sbomify.com/CVE-2026-4109/): Missing authorization in Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) (medium 4.3)
- [CVE-2026-41089](https://insights.sbomify.com/CVE-2026-41089/): Windows Netlogon Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-41088](https://insights.sbomify.com/CVE-2026-41088/): Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-41087](https://insights.sbomify.com/CVE-2026-41087/): Windows File Explorer Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-41086](https://insights.sbomify.com/CVE-2026-41086/): Windows Admin Center in Azure Portal Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-41085](https://insights.sbomify.com/CVE-2026-41085/): Thermo Fisher Scientific Torrent Suite Dx through 5.14.2 has a privilege escalation vulnerability that may allow an authenticated user with (high 8.8)
- [CVE-2026-41084](https://insights.sbomify.com/CVE-2026-41084/): Apache Airflow: API authorization bypass: bulk TaskInstances allows cross-DAG mutation (high 7.5)
- [CVE-2026-41082](https://insights.sbomify.com/CVE-2026-41082/): Path traversal in opam (high 7.3)
- [CVE-2026-41081](https://insights.sbomify.com/CVE-2026-41081/): Apache Storm Client: Anonymous principal assigned on TLS client certificate verification failure (medium 6.5)
- [CVE-2026-41080](https://insights.sbomify.com/CVE-2026-41080/): Weak cryptography in libexpat (low 2.9)
- [CVE-2026-4108](https://insights.sbomify.com/CVE-2026-4108/): Stored XSS Vulnerability (high 7.3)
- [CVE-2026-41079](https://insights.sbomify.com/CVE-2026-41079/): OpenPrinting CUPS: Heap out-of-bounds read in SNMP supply-level polling leaks stack memory to authenticated users (medium 4.3)
- [CVE-2026-41078](https://insights.sbomify.com/CVE-2026-41078/): OpenTelemetry dotnet: Potential memory exhaustion via unbounded pooled-list sizing in Jaeger exporter conversion path (medium 5.9)
- [CVE-2026-41076](https://insights.sbomify.com/CVE-2026-41076/): RT: LDAP authentication bypass via empty password (high 8.1)
- [CVE-2026-41075](https://insights.sbomify.com/CVE-2026-41075/): RT: SQL injection via entry_aggregator parameter in JSON search (high 8.8)
- [CVE-2026-41074](https://insights.sbomify.com/CVE-2026-41074/): RT has broken CSRF protection for authenticated users (high 7.1)
- [CVE-2026-41073](https://insights.sbomify.com/CVE-2026-41073/): RT: Spreadsheet downloads vulnerable to CSV/formula injection in Microsoft Excel and similar apps (medium 4.6)
- [CVE-2026-41071](https://insights.sbomify.com/CVE-2026-41071/): libheif: Heap buffer over-read in SampleAuxInfoReader via crafted HEIF sequence file with mismatched saiz sample count (medium 5.1)
- [CVE-2026-41070](https://insights.sbomify.com/CVE-2026-41070/): openvpn-auth-oauth2 returns FUNC_SUCCESS on client-deny, allowing unauthenticated VPN access (critical 10.0)
- [CVE-2026-4107](https://insights.sbomify.com/CVE-2026-4107/): Stored XSS Vulnerability (high 7.3)
- [CVE-2026-41069](https://insights.sbomify.com/CVE-2026-41069/): libheif allows Out-of-bounds vector access leading to invalid dereference (DoS) (medium 6.5)
- [CVE-2026-41068](https://insights.sbomify.com/CVE-2026-41068/): Kyverno: Cross-Namespace Read Bypasses RBAC Isolation (CVE-2026-22039 Incomplete Fix) (high 7.7)
- [CVE-2026-41067](https://insights.sbomify.com/CVE-2026-41067/): Astro: XSS via incomplete `</script>` sanitization in `define:vars` allows case-insensitive and whitespace-based bypass (medium 6.1)
- [CVE-2026-41066](https://insights.sbomify.com/CVE-2026-41066/): lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files (high 7.5)
- [CVE-2026-41065](https://insights.sbomify.com/CVE-2026-41065/): Tautulli Vulnerable to Unauthenticated/Authenticated Remote Code Execution via Newsletter Custom Template Directory (high 8.9)
- [CVE-2026-41064](https://insights.sbomify.com/CVE-2026-41064/): AVideo has an incomplete fix for CVE-2026-33502 (Command Injection) (critical 9.3)
- [CVE-2026-41063](https://insights.sbomify.com/CVE-2026-41063/): WWBN AVideo has incomplete fix for CVE-2026-33500 (XSS) (medium 5.4)
- [CVE-2026-41062](https://insights.sbomify.com/CVE-2026-41062/): WWBN AVideo has an Incomplete fix: Directory traversal bypass via query string in ReceiveImage downloadURL parameters (medium 6.5)
- [CVE-2026-41061](https://insights.sbomify.com/CVE-2026-41061/): WWBN AVideo Vulnerable to stored XSS via Unanchored Duration Regex in Video Encoder Receiver (medium 5.4)
- [CVE-2026-41060](https://insights.sbomify.com/CVE-2026-41060/): AVideo's SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL (high 7.7)
- [CVE-2026-4106](https://insights.sbomify.com/CVE-2026-4106/): HT Mega < 3.0.7 – Unauthenticated PII Disclosure (medium 5.3)
- [CVE-2026-41059](https://insights.sbomify.com/CVE-2026-41059/): OAuth2 Proxy has an Authentication Bypass via Fragment Confusion in skip_auth_routes and skip_auth_regex (high 8.2)
- [CVE-2026-41058](https://insights.sbomify.com/CVE-2026-41058/): AVideo has an incomplete fix for CVE-2026-33293 (Path Traversal) in AVideo (high 8.1)
- [CVE-2026-41057](https://insights.sbomify.com/CVE-2026-41057/): WWBN AVideo has a CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true) Exposes Authenticated API Responses (high 7.1)
- [CVE-2026-41056](https://insights.sbomify.com/CVE-2026-41056/): WWBN AVideo has CORS Origin Reflection with Credentials on Sensitive API Endpoints Enables Cross-Origin Account Takeover (high 8.1)
- [CVE-2026-41055](https://insights.sbomify.com/CVE-2026-41055/): AVideo has an incomplete fix for CVE-2026-33039 (SSRF) (high 8.6)
- [CVE-2026-41054](https://insights.sbomify.com/CVE-2026-41054/): Missing exit out of permission check in haveged could lead to root exploit (high 7.8)
- [CVE-2026-41053](https://insights.sbomify.com/CVE-2026-41053/): Over-inclusive team membership expansion in GitHub App authentication provider for Rancher (high 8.8)
- [CVE-2026-41052](https://insights.sbomify.com/CVE-2026-41052/): Rancher Privilege Escalation from Project Owner to Host (critical 9.4)
- [CVE-2026-41051](https://insights.sbomify.com/CVE-2026-41051/): csync2 uses insecure temporary directories when compiled with C99 or later (medium 5.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/662/