# Vulnerabilities published in 2026


- [CVE-2026-40947](https://insights.sbomify.com/CVE-2026-40947/): Other in libfido2 (low 2.9)
- [CVE-2026-40946](https://insights.sbomify.com/CVE-2026-40946/): Oxia: OIDC token audience validation bypass via SkipClientIDCheck (critical 9.2)
- [CVE-2026-40945](https://insights.sbomify.com/CVE-2026-40945/): Oxia: Bearer token exposed in debug log messages on authentication failure (high 8.7)
- [CVE-2026-40944](https://insights.sbomify.com/CVE-2026-40944/): Oxia: TLS CA certificate chain validation fails with multi-certificate PEM bundles (medium 6.9)
- [CVE-2026-40943](https://insights.sbomify.com/CVE-2026-40943/): Oxia: Server crash via race condition in session heartbeat handling (high 8.7)
- [CVE-2026-40942](https://insights.sbomify.com/CVE-2026-40942/): DSF: Inverted Time Comparison in OIDC JWKS and Token Cache (medium 6.3)
- [CVE-2026-40941](https://insights.sbomify.com/CVE-2026-40941/): Cacti: Package Import Signature Validation Bypass Allows Self-Signed Packages (high 7.1)
- [CVE-2026-4094](https://insights.sbomify.com/CVE-2026-4094/): Missing authorization in FOX – Currency Switcher Professional for WooCommerce (high 8.1)
- [CVE-2026-40939](https://insights.sbomify.com/CVE-2026-40939/): DSF: Missing Session Timeout for OIDC Sessions (medium 6.8)
- [CVE-2026-40938](https://insights.sbomify.com/CVE-2026-40938/): Tekton Pipelines: Git Resolver Unsanitized Revision Parameter Enables git Argument Injection Leading to RCE (high 7.5)
- [CVE-2026-40937](https://insights.sbomify.com/CVE-2026-40937/): RustFS: Missing admin authorization on notification target endpoints allows unauthenticated configuration of event webhooks (high 8.3)
- [CVE-2026-40935](https://insights.sbomify.com/CVE-2026-40935/): WWBN/AVideo has CAPTCHA Bypass via Attacker-Controlled Length Parameter and Missing Token Invalidation on Failure (medium 5.3)
- [CVE-2026-40934](https://insights.sbomify.com/CVE-2026-40934/): jupyter-server authentication cookies remain valid after password reset due to static cookie secret (high 7.6)
- [CVE-2026-40933](https://insights.sbomify.com/CVE-2026-40933/): Flowise: Authenticated RCE Via MCP Adapters (critical 10.0)
- [CVE-2026-40931](https://insights.sbomify.com/CVE-2026-40931/): Complete Bypass of CVE-2026-24884 Patch via Git-Delivered Symlink Poisoning in compressing (high 8.4)
- [CVE-2026-40930](https://insights.sbomify.com/CVE-2026-40930/): LIBPNG: Chunk smuggling in push-mode APNG parser via unconsumed chunk body (medium 5.4)
- [CVE-2026-4093](https://insights.sbomify.com/CVE-2026-4093/): Stored XSS in Drupal 7 Term Reference Tree module (token display templates and term labels) (medium 5.1)
- [CVE-2026-40929](https://insights.sbomify.com/CVE-2026-40929/): WWBN AVideo is missing CSRF protection in objects/commentDelete.json.php enables mass comment deletion against moderators and content creators (medium 5.4)
- [CVE-2026-40928](https://insights.sbomify.com/CVE-2026-40928/): WWBN AVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Creation, Vote Manipulation, and Category Asset Deletion (medium 5.4)
- [CVE-2026-40927](https://insights.sbomify.com/CVE-2026-40927/): Docmost: XSS in Comments with JavaScript URI (medium 5.4)
- [CVE-2026-40926](https://insights.sbomify.com/CVE-2026-40926/): WWBN AVideo Vulnerable to CSRF in Admin JSON Endpoints (Category CRUD, Plugin Update Script) (high 7.1)
- [CVE-2026-40925](https://insights.sbomify.com/CVE-2026-40925/): WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP Credentials (high 8.3)
- [CVE-2026-40924](https://insights.sbomify.com/CVE-2026-40924/): Tekton Pipelines: HTTP Resolver Unbounded Response Body Read Enables Denial of Service via Memory Exhaustion (medium 6.5)
- [CVE-2026-40923](https://insights.sbomify.com/CVE-2026-40923/): Tekton Pipelines: VolumeMount path restriction bypass via missing filepath.Clean in /tekton/ check (medium 5.4)
- [CVE-2026-40922](https://insights.sbomify.com/CVE-2026-40922/): SiYuan has incomplete fix for CVE-2026-33066: XSS (medium 5.3)
- [CVE-2026-40920](https://insights.sbomify.com/CVE-2026-40920/): Apache Ranger: Privilege Escalation via URL Parameter (critical 9.8)
- [CVE-2026-4092](https://insights.sbomify.com/CVE-2026-4092/): Arbitrary File Write via Path Traversal in Google clasp leading to RCE (high 8.7)
- [CVE-2026-40919](https://insights.sbomify.com/CVE-2026-40919/): Gimp: gimp: denial of service via specially crafted seattle filmworks file (medium 6.1)
- [CVE-2026-40918](https://insights.sbomify.com/CVE-2026-40918/): Gimp: gimp: denial of service via crafted pvr image file (medium 5.5)
- [CVE-2026-40917](https://insights.sbomify.com/CVE-2026-40917/): Gimp: gimp: application crashes or information disclosure via crafted icns image files (medium 5.0)
- [CVE-2026-40916](https://insights.sbomify.com/CVE-2026-40916/): Gimp: gimp: denial of service due to stack buffer overflow in tim image loader (medium 5.0)
- [CVE-2026-40915](https://insights.sbomify.com/CVE-2026-40915/): Gimp: gimp: heap buffer overflow due to integer overflow in fits image loader (medium 5.5)
- [CVE-2026-40914](https://insights.sbomify.com/CVE-2026-40914/): Apache Artemis has an Incorrect Authorization issue (medium 4.3)
- [CVE-2026-40912](https://insights.sbomify.com/CVE-2026-40912/): Traefik: StripPrefixRegex auth bypass via Path/RawPath desync (high 7.8)
- [CVE-2026-40911](https://insights.sbomify.com/CVE-2026-40911/): WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks (critical 10.0)
- [CVE-2026-40910](https://insights.sbomify.com/CVE-2026-40910/): frp: Authentication bypass in frp HTTP vhost routing when routeByHTTPUser is used for access control (medium 6.5)
- [CVE-2026-4091](https://insights.sbomify.com/CVE-2026-4091/): OPEN-BRAIN <= 0.5.0 - Cross-Site Request Forgery (medium 6.1)
- [CVE-2026-40909](https://insights.sbomify.com/CVE-2026-40909/): WWBN AVideo has a Path Traversal in Locale Save Endpoint Enables Arbitrary PHP File Write to Any Web-Accessible Directory (RCE) (high 8.7)
- [CVE-2026-40908](https://insights.sbomify.com/CVE-2026-40908/): WWBN AVideo has an Unauthenticated Information Disclosure via git.json.php Exposes Developer Emails and Deployed Version (medium 5.3)
- [CVE-2026-40907](https://insights.sbomify.com/CVE-2026-40907/): WWBN AVideo has IDOR in Live Restreams list.json.php that Exposes Other Users' Stream Keys and OAuth Tokens (medium 6.5)
- [CVE-2026-40906](https://insights.sbomify.com/CVE-2026-40906/): Electric: SQL Injection via ORDER BY Parameter in Shape API (critical 10.0)
- [CVE-2026-40905](https://insights.sbomify.com/CVE-2026-40905/): LinkAce: Password Reset Poisoning via X-Forwarded-Host Header Injection Leading to Account Takeover (high 8.1)
- [CVE-2026-40904](https://insights.sbomify.com/CVE-2026-40904/): Chartbrew: Incorrect Access Control in dataset and dataRequest routes via team-scoped permission checks (high 8.1)
- [CVE-2026-40903](https://insights.sbomify.com/CVE-2026-40903/): Goshs - ArtiPACKED Vulnerability – GitHub Actions Credential Persistence (critical 9.1)
- [CVE-2026-40902](https://insights.sbomify.com/CVE-2026-40902/): PhpSpreadsheet: CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions (high 7.5)
- [CVE-2026-40901](https://insights.sbomify.com/CVE-2026-40901/): DataEase: Quartz Deserialization → Remote Code Execution (high 7.5)
- [CVE-2026-40900](https://insights.sbomify.com/CVE-2026-40900/): DataEase has SQL Injection via Stacked Queries (high 8.7)
- [CVE-2026-4090](https://insights.sbomify.com/CVE-2026-4090/): Inquiry cart <= 3.4.2 - Cross-Site Request Forgery via Settings Form (medium 6.1)
- [CVE-2026-40899](https://insights.sbomify.com/CVE-2026-40899/): DataEase has an Arbitrary File Read Vulnerability (high 8.3)
- [CVE-2026-40898](https://insights.sbomify.com/CVE-2026-40898/): quic-go: HTTP/3 QPACK Trailer Expansion Memory Exhaustion (medium 5.3)
- [CVE-2026-40897](https://insights.sbomify.com/CVE-2026-40897/): Math.js: Unsafe object property setter in mathjs (high 8.8)
- [CVE-2026-40896](https://insights.sbomify.com/CVE-2026-40896/): OpenProject has Cross-Project Meeting Agenda Item Injection via Unscoped Section Lookup (medium 6.5)
- [CVE-2026-40895](https://insights.sbomify.com/CVE-2026-40895/): follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets (medium 6.9)
- [CVE-2026-40894](https://insights.sbomify.com/CVE-2026-40894/): OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers (medium 5.3)
- [CVE-2026-40893](https://insights.sbomify.com/CVE-2026-40893/): Gotenberg: ExifTool Dangerous Tag Blocklist Bypass via Group-Prefixed Tag Names Allows Arbitrary File Rename and Move (high 8.2)
- [CVE-2026-40892](https://insights.sbomify.com/CVE-2026-40892/): PJSIP: Stack buffer overflow in pjsip_auth_create_digest2() (high 8.1)
- [CVE-2026-40891](https://insights.sbomify.com/CVE-2026-40891/): OpenTelemetry dotnet: Unbounded `grpc-status-details-bin` parsing in OTLP/gRPC retry handling (medium 5.3)
- [CVE-2026-40890](https://insights.sbomify.com/CVE-2026-40890/): github.com/gomarkdown/markdown: Out-of-bounds Read in SmartypantsRenderer (high 7.5)
- [CVE-2026-4089](https://insights.sbomify.com/CVE-2026-4089/): Twittee Text Tweet <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute (medium 6.4)
- [CVE-2026-40889](https://insights.sbomify.com/CVE-2026-40889/): Frappe HR has Improper Access Control on Files (medium 6.5)
- [CVE-2026-40888](https://insights.sbomify.com/CVE-2026-40888/): Frappe HR vulnerable to Improper Access Control (medium 6.5)
- [CVE-2026-40887](https://insights.sbomify.com/CVE-2026-40887/): @vendure/core has a SQL Injection vulnerability (critical 9.1)
- [CVE-2026-40886](https://insights.sbomify.com/CVE-2026-40886/): Argo Workflows: Unchecked annotation parsing in pod informer crashes Argo Workflows controller (high 7.7)
- [CVE-2026-40885](https://insights.sbomify.com/CVE-2026-40885/): goshs: Public collaborator feed leaks .goshs ACL credentials and enables unauthorized access (high 7.7)
- [CVE-2026-40884](https://insights.sbomify.com/CVE-2026-40884/): goshs: Empty-username SFTP password authentication bypass in goshs (critical 9.8)
- [CVE-2026-40883](https://insights.sbomify.com/CVE-2026-40883/): goshs: CSRF in state-changing GET routes enables authenticated file deletion and directory creation (medium 6.1)
- [CVE-2026-40882](https://insights.sbomify.com/CVE-2026-40882/): OpenRemote has XXE in Velbus Asset Import (high 7.6)
- [CVE-2026-40881](https://insights.sbomify.com/CVE-2026-40881/): Zebra: addr/addrv2 Deserialization Resource Exhaustion (medium 6.3)
- [CVE-2026-40880](https://insights.sbomify.com/CVE-2026-40880/): Zebra: Cached Mempool Verification Bypasses Consensus Rules for Ahead-of-Tip Blocks (high 7.2)
- [CVE-2026-4088](https://insights.sbomify.com/CVE-2026-4088/): Switch CTA Box <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2026-40879](https://insights.sbomify.com/CVE-2026-40879/): Nest: DoS via Recursive handleData in JsonSocket (TCP Transport) (high 7.5)
- [CVE-2026-40878](https://insights.sbomify.com/CVE-2026-40878/): mailcow-dockerized Login Page has Reflected Parameter Injection / Wrong-Context XSS Escaping (low 2.1)
- [CVE-2026-40877](https://insights.sbomify.com/CVE-2026-40877/): Combodo iTop: PHP Object Injection Leading to Remote Code Execution on user preferences (high 8.7)
- [CVE-2026-40876](https://insights.sbomify.com/CVE-2026-40876/): SFTP root escape via prefix-based path validation in goshs (high 8.7)
- [CVE-2026-40875](https://insights.sbomify.com/CVE-2026-40875/): mailcow: dockerized vulnerable to stored XSS in user login history real_rip (high 7.0)
- [CVE-2026-40874](https://insights.sbomify.com/CVE-2026-40874/): mailcow: dockerized missing authorization on Forwarding Hosts delete action (medium 6.0)
- [CVE-2026-40873](https://insights.sbomify.com/CVE-2026-40873/): mailcow: dockerized vulnerable to stored XSS in Quarantine attachment filenames (high 8.9)
- [CVE-2026-40872](https://insights.sbomify.com/CVE-2026-40872/): mailcow: dockerized vulnerable to stored XSS in autodiscover logs email address field (critical 9.3)
- [CVE-2026-40871](https://insights.sbomify.com/CVE-2026-40871/): mailcow: dockerized vulnerable to Second Order SQL Injection in quarantine category via API (high 7.2)
- [CVE-2026-40870](https://insights.sbomify.com/CVE-2026-40870/): Decidim's comments API allows access to all commentable resources (high 7.5)
- [CVE-2026-4087](https://insights.sbomify.com/CVE-2026-4087/): Pre* Party Resource Hints <= 1.8.20 - Authenticated (Subscriber+) SQL Injection via 'hint_ids' Parameter (medium 6.5)
- [CVE-2026-40869](https://insights.sbomify.com/CVE-2026-40869/): Decidim amendments can be accepted or rejected by anyone (high 7.5)
- [CVE-2026-40868](https://insights.sbomify.com/CVE-2026-40868/): kyverno apicall servicecall implicit bearer token injection leaks kyverno serviceaccount token (high 8.1)
- [CVE-2026-40867](https://insights.sbomify.com/CVE-2026-40867/): Horilla: Unauthorized Helpdesk Attachment Access via Attachment ID Manipulation (high 7.1)
- [CVE-2026-40866](https://insights.sbomify.com/CVE-2026-40866/): Horilla: Unauthorized Document Overwrite via File Upload Endpoint (high 8.6)
- [CVE-2026-40865](https://insights.sbomify.com/CVE-2026-40865/): Horilla: Insecure Direct Object Reference at `/employee/view-file/<int:id> (high 7.1)
- [CVE-2026-40864](https://insights.sbomify.com/CVE-2026-40864/): JupyterHub: Cross-origin form POSTs bypass XSRF (medium 5.4)
- [CVE-2026-40863](https://insights.sbomify.com/CVE-2026-40863/): PhpSpreadsheet: CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader (high 7.5)
- [CVE-2026-40861](https://insights.sbomify.com/CVE-2026-40861/): Apache Airflow: Arbitrary File Read via Log Symlink following in FileTaskHandler (medium 6.5)
- [CVE-2026-40860](https://insights.sbomify.com/CVE-2026-40860/): Apache Camel: Unsafe Deserialization of JMS ObjectMessage in camel-jms, camel-sjms, camel-sjms2 and camel-amqp (critical 9.8)
- [CVE-2026-4086](https://insights.sbomify.com/CVE-2026-4086/): WP Random Button <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cat' Shortcode Attribute (medium 6.4)
- [CVE-2026-40859](https://insights.sbomify.com/CVE-2026-40859/): Apache Camel-Vertx-Http and Camel-Netty-Http: Unsafe Java deserialization of HTTP response bodies via a raw ObjectInputStream when transferException is enabled (high 8.1)
- [CVE-2026-40858](https://insights.sbomify.com/CVE-2026-40858/): Apache Camel: Camel-Infinispan: Unsafe Deserialization in Remote Aggregation Repository (high 8.8)
- [CVE-2026-40857](https://insights.sbomify.com/CVE-2026-40857/): CSRF token bypass in T-Mobile 5G Box IDU routers (high 8.4)
- [CVE-2026-40856](https://insights.sbomify.com/CVE-2026-40856/): Config disclosure in T-Mobile 5G Box IDU routers (high 7.1)
- [CVE-2026-40855](https://insights.sbomify.com/CVE-2026-40855/): Command Injection in T-Mobile 5G Box IDU router via ping functionality (critical 9.3)
- [CVE-2026-40854](https://insights.sbomify.com/CVE-2026-40854/): Session auth bypass via cookie value in T-Mobile 5G Box IDU routers (high 8.7)
- [CVE-2026-40852](https://insights.sbomify.com/CVE-2026-40852/): Command injection via malicious configuration (high 7.2)
- [CVE-2026-40851](https://insights.sbomify.com/CVE-2026-40851/): Command injection via USB (high 8.4)
- [CVE-2026-40850](https://insights.sbomify.com/CVE-2026-40850/): Unauthenticated SQLi in getAccountData function (high 8.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/664/