# Vulnerabilities published in 2026


- [CVE-2026-40608](https://insights.sbomify.com/CVE-2026-40608/): Next AI Draw.io: Unbounded HTTP Body — Denial of Service (medium 6.2)
- [CVE-2026-40607](https://insights.sbomify.com/CVE-2026-40607/): MantisBT is Vulnerable to Stored XSS Through its Saved-Filter Owner Column (high 7.5)
- [CVE-2026-40606](https://insights.sbomify.com/CVE-2026-40606/): ProxyAuth Addon LDAP Injection in mitmproxy (medium 4.8)
- [CVE-2026-40605](https://insights.sbomify.com/CVE-2026-40605/): Tautulli Vulnerable to Authenticated Path Traversal in Cache Deletion API (medium 5.7)
- [CVE-2026-40604](https://insights.sbomify.com/CVE-2026-40604/): Security feature bypass in clearancekit (high 8.2)
- [CVE-2026-40603](https://insights.sbomify.com/CVE-2026-40603/): Chartbrew: Incorrect Access Control in /api/project/dashboard/:brewName via same-team override (medium 6.5)
- [CVE-2026-40602](https://insights.sbomify.com/CVE-2026-40602/): hass-cli: Handling of user-supplied Jinja2 templates (medium 5.6)
- [CVE-2026-40601](https://insights.sbomify.com/CVE-2026-40601/): Chartbrew: Missing Authorization in /api/chart/:chart_id/query via team-level refresh toggle (high 7.5)
- [CVE-2026-40600](https://insights.sbomify.com/CVE-2026-40600/): Chartbrew: Incorrect Access Control in project share policy routes via unbound policy_id (high 8.1)
- [CVE-2026-4060](https://insights.sbomify.com/CVE-2026-4060/): Geo Mashup <= 1.13.18 - Unauthenticated Time-Based SQL Injection via 'sort' Parameter (high 7.5)
- [CVE-2026-40599](https://insights.sbomify.com/CVE-2026-40599/): ClearanceKit: Ad-hoc signed binaries can spoof Apple process identities in the global allowlist (high 8.4)
- [CVE-2026-40598](https://insights.sbomify.com/CVE-2026-40598/): MantisBT has Potential Referer-Based Reflected HTML Injection / XSS in Tag Update Page (medium 6.9)
- [CVE-2026-40597](https://insights.sbomify.com/CVE-2026-40597/): MantisBT has a Content Security Policy bypass via attachments (high 7.6)
- [CVE-2026-40596](https://insights.sbomify.com/CVE-2026-40596/): MantisBT is vulnerable to XSS and potential account takeover via user font family preference update (high 7.2)
- [CVE-2026-40595](https://insights.sbomify.com/CVE-2026-40595/): Chartbrew: Incorrect Access Control in public chart and export routes via missing onReport and SharePolicy checks (high 7.5)
- [CVE-2026-40594](https://insights.sbomify.com/CVE-2026-40594/): pyLoad: Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition) (medium 4.8)
- [CVE-2026-40593](https://insights.sbomify.com/CVE-2026-40593/): ChurchCRM: Stored XSS in UserEditor.php via Login Name Field (medium 4.8)
- [CVE-2026-40592](https://insights.sbomify.com/CVE-2026-40592/): FreeScout's cross-user undo reply allows mailbox peers to recall another agent's outbound reply (medium 5.9)
- [CVE-2026-40591](https://insights.sbomify.com/CVE-2026-40591/): FreeScout: Improper Authorization in Phone Conversation Creation Enables Cross-Mailbox Hidden Customer Modification (high 7.1)
- [CVE-2026-40590](https://insights.sbomify.com/CVE-2026-40590/): FreeScout's Customer AJAX Create Modifies Hidden Existing Customer (medium 4.3)
- [CVE-2026-4059](https://insights.sbomify.com/CVE-2026-4059/): ShopLentor <= 3.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button_text' Shortcode Attribute (medium 6.4)
- [CVE-2026-40589](https://insights.sbomify.com/CVE-2026-40589/): FreeScout has Customer Edit Cross-Mailbox Email Takeover (high 7.6)
- [CVE-2026-40588](https://insights.sbomify.com/CVE-2026-40588/): blueprintUE: Authenticated Password Change Does Not Verify Current Password (high 8.1)
- [CVE-2026-40587](https://insights.sbomify.com/CVE-2026-40587/): blueprintUE: Active Sessions Are Not Invalidated After Password Change or Reset (medium 6.5)
- [CVE-2026-40586](https://insights.sbomify.com/CVE-2026-40586/): blueprintUE: Login Endpoint Has No Rate Limiting, Lockout, or Brute-Force Protection (high 7.5)
- [CVE-2026-40585](https://insights.sbomify.com/CVE-2026-40585/): blueprintUE: Password Reset Tokens Have No Expiry Window (high 7.4)
- [CVE-2026-40584](https://insights.sbomify.com/CVE-2026-40584/): RansomLook - Improper Filtering of Private Location Entries in API Endpoints Leads to Information Exposure (medium 6.9)
- [CVE-2026-40583](https://insights.sbomify.com/CVE-2026-40583/): UltraDAG: SmartOp Vote Path Triggers Fatal Supply Invariant Halt (high 8.8)
- [CVE-2026-40582](https://insights.sbomify.com/CVE-2026-40582/): ChurchCRM: Authentication Bypass in `/api/public/user/login` Allows Bypass of 2FA and Account Lockout (critical 9.1)
- [CVE-2026-40581](https://insights.sbomify.com/CVE-2026-40581/): ChurchCRM: Cross-Site Request Forgery (CSRF) in SelectDelete.php Leading to Permanent Data Deletion (high 8.1)
- [CVE-2026-4058](https://insights.sbomify.com/CVE-2026-4058/): Missing authorization in User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration (medium 4.3)
- [CVE-2026-40576](https://insights.sbomify.com/CVE-2026-40576/): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in excel-mcp-server (critical 9.4)
- [CVE-2026-40575](https://insights.sbomify.com/CVE-2026-40575/): OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing (critical 9.1)
- [CVE-2026-40574](https://insights.sbomify.com/CVE-2026-40574/): OAuth2 Proxy has an Authorization Bypass in Email Domain Validation via Malformed Multi-@ Email Claims (medium 6.8)
- [CVE-2026-40572](https://insights.sbomify.com/CVE-2026-40572/): NovumOS has Arbitrary Memory Mapping via Syscall 15 (MemoryMapRange) (critical 9.0)
- [CVE-2026-40571](https://insights.sbomify.com/CVE-2026-40571/): NamelessMC: Reactions on private or blocking profile posts can be modified without proper authorization (medium 5.3)
- [CVE-2026-40570](https://insights.sbomify.com/CVE-2026-40570/): FreeScout's Missing Authorization in load_customer_info Allows Any Authenticated User to Access Full Customer PII (medium 5.7)
- [CVE-2026-4057](https://insights.sbomify.com/CVE-2026-4057/): Download Manager <= 3.3.51 - Missing Authorization to Authenticated (Contributor+) Media File Protection Removal (medium 4.3)
- [CVE-2026-40569](https://insights.sbomify.com/CVE-2026-40569/): FreeScout's Mass Assignment in Mailbox Connection Settings Enables Silent Email Exfiltration (critical 9.0)
- [CVE-2026-40568](https://insights.sbomify.com/CVE-2026-40568/): FreeScout Vulnerable to XSS via Mailbox Signature Due to Incomplete HTML Sanitization (high 8.5)
- [CVE-2026-40567](https://insights.sbomify.com/CVE-2026-40567/): FreeScout has HTML Injection in Outgoing Emails via Unsanitized Customer Name in Signature Variables (medium 5.8)
- [CVE-2026-40566](https://insights.sbomify.com/CVE-2026-40566/): FreeScout vulnerable to SSRF via IMAP/SMTP Connection Test Endpoints (medium 4.1)
- [CVE-2026-40565](https://insights.sbomify.com/CVE-2026-40565/): FreeScout has Stored XSS / CSS Injection via linkify() — Unescaped URL in Anchor href (medium 6.1)
- [CVE-2026-40564](https://insights.sbomify.com/CVE-2026-40564/): Apache Flink Kubernetes Operator: Server-Side Request Forgery and local file access in Kubernetes Operator (medium 6.5)
- [CVE-2026-40563](https://insights.sbomify.com/CVE-2026-40563/): Apache Atlas: Script injection allows access to unintended data (high 8.1)
- [CVE-2026-40562](https://insights.sbomify.com/CVE-2026-40562/): Gazelle versions through 0.49 for Perl allows HTTP Request Smuggling via Improper Header Precedence (high 7.5)
- [CVE-2026-40561](https://insights.sbomify.com/CVE-2026-40561/): Starlet versions through 0.31 for Perl allows HTTP Request Smuggling via Improper Header Precedence (medium 5.3)
- [CVE-2026-40560](https://insights.sbomify.com/CVE-2026-40560/): Starman versions before 0.4018 for Perl allows HTTP Request Smuggling via Improper Header Precedence (high 7.5)
- [CVE-2026-4056](https://insights.sbomify.com/CVE-2026-4056/): Missing authorization in User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder (medium 5.4)
- [CVE-2026-40557](https://insights.sbomify.com/CVE-2026-40557/): Apache Storm Prometheus Reporter vulnerable to Improper Certificate Validation via Global SSL Context Downgrade (medium 4.8)
- [CVE-2026-40553](https://insights.sbomify.com/CVE-2026-40553/): Stack-based buffer overflow in gawk (medium 5.1)
- [CVE-2026-40552](https://insights.sbomify.com/CVE-2026-40552/): Remote Code Execution in multiple BinSoft products (medium 4.7)
- [CVE-2026-40551](https://insights.sbomify.com/CVE-2026-40551/): Use of Client-Side Authentication in multiple BinSoft products (high 8.4)
- [CVE-2026-40550](https://insights.sbomify.com/CVE-2026-40550/): Privilege Escalation in multiple BinSoft products (medium 6.9)
- [CVE-2026-4055](https://insights.sbomify.com/CVE-2026-4055/): Insufficient permission validation on cross-team playbook run creation (medium 4.3)
- [CVE-2026-40549](https://insights.sbomify.com/CVE-2026-40549/): Cross-Site Request Forgery in SOPlanning (medium 5.1)
- [CVE-2026-40548](https://insights.sbomify.com/CVE-2026-40548/): Unrestricted Upload of File with Dangerous Type in SOPlanning (medium 6.4)
- [CVE-2026-40547](https://insights.sbomify.com/CVE-2026-40547/): Path Traversal in SOPlanning (medium 6.4)
- [CVE-2026-40546](https://insights.sbomify.com/CVE-2026-40546/): Multiple SQL Injections in SOPlanning (high 8.7)
- [CVE-2026-40545](https://insights.sbomify.com/CVE-2026-40545/): Reflected XSS in SOPlanning (medium 5.1)
- [CVE-2026-40544](https://insights.sbomify.com/CVE-2026-40544/): Stored XSS in SOPlanning (medium 5.1)
- [CVE-2026-40543](https://insights.sbomify.com/CVE-2026-40543/): Missing Authorization in SOPlanning (high 8.8)
- [CVE-2026-40542](https://insights.sbomify.com/CVE-2026-40542/): Apache HttpClient accepts SCRAM-SHA-256 authentication without proper mutual authentication verification (high 7.3)
- [CVE-2026-40541](https://insights.sbomify.com/CVE-2026-40541/): Cross-site scripting in Synology Chat Server (critical 9.0)
- [CVE-2026-4054](https://insights.sbomify.com/CVE-2026-4054/): Mattermost doesn't validate the response body of proxied images (medium 4.3)
- [CVE-2026-40539](https://insights.sbomify.com/CVE-2026-40539/): Security feature bypass in DiskStation Manager (DSM) (high 7.1)
- [CVE-2026-40538](https://insights.sbomify.com/CVE-2026-40538/): Auth bypass in DiskStation Manager (DSM) (low 3.7)
- [CVE-2026-40537](https://insights.sbomify.com/CVE-2026-40537/): Server-side request forgery in DiskStation Manager (DSM) (medium 4.3)
- [CVE-2026-40536](https://insights.sbomify.com/CVE-2026-40536/): Path traversal in DiskStation Manager (DSM) (medium 4.3)
- [CVE-2026-40535](https://insights.sbomify.com/CVE-2026-40535/): Path traversal in DiskStation Manager (DSM) (medium 6.5)
- [CVE-2026-40534](https://insights.sbomify.com/CVE-2026-40534/): Cross-site scripting in DiskStation Manager (DSM) (medium 5.4)
- [CVE-2026-40533](https://insights.sbomify.com/CVE-2026-40533/): Information disclosure in DiskStation Manager (DSM) (medium 5.3)
- [CVE-2026-40532](https://insights.sbomify.com/CVE-2026-40532/): Information disclosure in DiskStation Manager (DSM) (medium 6.5)
- [CVE-2026-40531](https://insights.sbomify.com/CVE-2026-40531/): Integer overflow in DiskStation Manager (DSM) (medium 4.3)
- [CVE-2026-40530](https://insights.sbomify.com/CVE-2026-40530/): Other in DiskStation Manager (DSM) (high 8.0)
- [CVE-2026-4053](https://insights.sbomify.com/CVE-2026-4053/): post edit time limit is not enforced on some post update operations (low 3.1)
- [CVE-2026-40529](https://insights.sbomify.com/CVE-2026-40529/): SQL injection in CMS ALAYA (medium 5.1)
- [CVE-2026-40528](https://insights.sbomify.com/CVE-2026-40528/): OpenSC < 0.27.0 Buffer Overrun in do_key_value() via profile.c (low 1.0)
- [CVE-2026-40527](https://insights.sbomify.com/CVE-2026-40527/): radare2 Command Injection via DWARF Parameter Names (high 8.5)
- [CVE-2026-40526](https://insights.sbomify.com/CVE-2026-40526/): Volmarg Personal Management System Path Traversal via get-file Endpoint (high 7.1)
- [CVE-2026-40525](https://insights.sbomify.com/CVE-2026-40525/): OpenViking < 0.3.9 Authentication Bypass via VikingBot OpenAPI (critical 9.1)
- [CVE-2026-40524](https://insights.sbomify.com/CVE-2026-40524/): FrontAccounting < 2.4.20 SQL Injection via get_gl_transactions() (high 7.2)
- [CVE-2026-40523](https://insights.sbomify.com/CVE-2026-40523/): FrontAccounting < 2.4.20 SQL Injection via reporting/rep710.php (high 7.2)
- [CVE-2026-40522](https://insights.sbomify.com/CVE-2026-40522/): FrontAccounting < 2.4.20 SQL Injection via rep601.php (high 7.1)
- [CVE-2026-40521](https://insights.sbomify.com/CVE-2026-40521/): FrontAccounting < 2.4.20 Path Traversal RCE via attachment upload (high 8.7)
- [CVE-2026-40520](https://insights.sbomify.com/CVE-2026-40520/): FreePBX api module Command Injection via GraphQL (high 8.6)
- [CVE-2026-40519](https://insights.sbomify.com/CVE-2026-40519/): Nginx Proxy Manager Authenticated RCE via setupCertbotPlugins() (high 7.7)
- [CVE-2026-40518](https://insights.sbomify.com/CVE-2026-40518/): ByteDance DeerFlow Path Traversal and Arbitrary File Write via Bootstrap Mode (high 7.1)
- [CVE-2026-40517](https://insights.sbomify.com/CVE-2026-40517/): radare2 < 6.1.4 Command Injection via PDB Parser Symbol Names (high 8.4)
- [CVE-2026-40516](https://insights.sbomify.com/CVE-2026-40516/): OpenHarness SSRF via web_fetch and web_search (high 7.8)
- [CVE-2026-40515](https://insights.sbomify.com/CVE-2026-40515/): OpenHarness Permission Bypass via grep and glob root argument (high 8.7)
- [CVE-2026-40514](https://insights.sbomify.com/CVE-2026-40514/): SmarterTools SmarterMail < Build 9610 Cryptographic Weakness via Weak RNG (high 8.2)
- [CVE-2026-40510](https://insights.sbomify.com/CVE-2026-40510/): OpenSC < 0.27.0-rc1 Stack Buffer Overflow via piv_process_history() in card-piv.c (low 1.0)
- [CVE-2026-4051](https://insights.sbomify.com/CVE-2026-4051/): IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to Server Post-Auth Remote Code Execution (high 7.2)
- [CVE-2026-40509](https://insights.sbomify.com/CVE-2026-40509/): OpenEMR < 8.3.0 CSRF via DICOM Viewer web_path Parameter (medium 5.3)
- [CVE-2026-40508](https://insights.sbomify.com/CVE-2026-40508/): OpenEMR < 8.3.0 Stored XSS via Patient Portal Template Import Handler (medium 5.1)
- [CVE-2026-40507](https://insights.sbomify.com/CVE-2026-40507/): OpenEMR < 8.3.0 Reflected XSS via templateHtml Parameter in Patient Portal (medium 5.1)
- [CVE-2026-40506](https://insights.sbomify.com/CVE-2026-40506/): OpenEMR Path Traversal Arbitrary Directory Deletion via standard_tables_manage.php (high 7.0)
- [CVE-2026-40505](https://insights.sbomify.com/CVE-2026-40505/): MuPDF < 1.27 mutool ANSI Injection via Metadata (medium 4.8)
- [CVE-2026-40504](https://insights.sbomify.com/CVE-2026-40504/): Creolabs Gravity < 0.9.6 Heap Buffer Overflow via gravity_vm_exec (critical 9.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/667/