# Vulnerabilities published in 2026


- [CVE-2026-40288](https://insights.sbomify.com/CVE-2026-40288/): PraisonAI: Critical RCE via `type: job` workflow YAML (critical 9.8)
- [CVE-2026-40287](https://insights.sbomify.com/CVE-2026-40287/): PraisonAI has RCE via Automatic tools.py Import (high 8.4)
- [CVE-2026-40286](https://insights.sbomify.com/CVE-2026-40286/): WeGIA has Cross-Site Scripting in Controle de Contribuição (high 7.5)
- [CVE-2026-40285](https://insights.sbomify.com/CVE-2026-40285/): WeGIA has SQL Injection via Session Variable Override in DespachoControle.php (high 8.8)
- [CVE-2026-40284](https://insights.sbomify.com/CVE-2026-40284/): WeGIA has stored XSS in listar_despachos.php (medium 6.8)
- [CVE-2026-40283](https://insights.sbomify.com/CVE-2026-40283/): WeGIA has stored XSS in profile_paciente.php (medium 6.8)
- [CVE-2026-40282](https://insights.sbomify.com/CVE-2026-40282/): WeGIA has stored XSS in intercorrencia_visualizar.php (medium 6.4)
- [CVE-2026-40281](https://insights.sbomify.com/CVE-2026-40281/): Gotenberg vulnerable to argument injection via newlines in ExifTool metadata values (critical 10.0)
- [CVE-2026-40280](https://insights.sbomify.com/CVE-2026-40280/): Gotenberg SSRF via case-insensitive URL scheme bypass in webhook and downloadFrom deny-lists (high 7.8)
- [CVE-2026-40279](https://insights.sbomify.com/CVE-2026-40279/): BACnet Stack: Undefined-behavior signed left shift in `decode_signed32()` (low 3.7)
- [CVE-2026-40272](https://insights.sbomify.com/CVE-2026-40272/): Vulnerability in the QNX libtraceparser Impacts QNX Software Development Platform (high 7.0)
- [CVE-2026-4027](https://insights.sbomify.com/CVE-2026-4027/): FlexNet Manager Suite Attachment File Disclosure (high 7.1)
- [CVE-2026-40265](https://insights.sbomify.com/CVE-2026-40265/): Note Mark has Broken Access Control on Asset Download (medium 5.9)
- [CVE-2026-40264](https://insights.sbomify.com/CVE-2026-40264/): OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation (low 2.0)
- [CVE-2026-40263](https://insights.sbomify.com/CVE-2026-40263/): Note Mark: Username Enumeration via Login Endpoint Timing Side-Channel (low 3.7)
- [CVE-2026-40262](https://insights.sbomify.com/CVE-2026-40262/): Note Mark has Stored XSS via Unrestricted Asset Upload (high 8.7)
- [CVE-2026-40261](https://insights.sbomify.com/CVE-2026-40261/): Composer has Command Injection via Malicious Perforce Reference (high 8.8)
- [CVE-2026-40260](https://insights.sbomify.com/CVE-2026-40260/): pypdf: Manipulated XMP metadata entity declarations can exhaust RAM (medium 6.9)
- [CVE-2026-4026](https://insights.sbomify.com/CVE-2026-4026/): FlexNet Manager Suite Privilege Escalation Vulnerability (high 8.7)
- [CVE-2026-40259](https://insights.sbomify.com/CVE-2026-40259/): SiYuan: Publish Reader Can Arbitrarily Delete Attribute View Files via removeUnusedAttributeView API (high 8.1)
- [CVE-2026-40258](https://insights.sbomify.com/CVE-2026-40258/): Gramps Web API has Zip Slip Path Traversal in Media Archive Import (critical 9.1)
- [CVE-2026-40257](https://insights.sbomify.com/CVE-2026-40257/): OP-TEE has SHA-3 accelerated finalize heap overflow (medium 5.5)
- [CVE-2026-40256](https://insights.sbomify.com/CVE-2026-40256/): Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision (medium 5.0)
- [CVE-2026-40255](https://insights.sbomify.com/CVE-2026-40255/): @adonisjs/http-server has an Open Redirect vulnerability (medium 6.1)
- [CVE-2026-40254](https://insights.sbomify.com/CVE-2026-40254/): FreeRDP: contains_dotdot() off-by-one allows drive channel path traversal via terminal .. (medium 4.2)
- [CVE-2026-40253](https://insights.sbomify.com/CVE-2026-40253/): openCryptoki: Memory safety vulnerabilities in BER/DER decoders in asn1.c (medium 6.8)
- [CVE-2026-40252](https://insights.sbomify.com/CVE-2026-40252/): Broken Access Control (IDOR) Leading to Cross-Tenant Application Access in FastGPT (medium 5.3)
- [CVE-2026-40251](https://insights.sbomify.com/CVE-2026-40251/): Incus out-of-bounds panic in snapshot metadata handling allows denial of service (high 7.1)
- [CVE-2026-40250](https://insights.sbomify.com/CVE-2026-40250/): OpenEXR has integer overflow in DWA decoder outBufferEnd pointer arithmetic (missed variant of CVE-2026-34589) (high 8.4)
- [CVE-2026-4025](https://insights.sbomify.com/CVE-2026-4025/): PrivateContent Free <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' Shortcode Attribute (medium 6.4)
- [CVE-2026-40249](https://insights.sbomify.com/CVE-2026-40249/): free5gc UDR fail-open request handling in PolicyDataSubsToNotifySubsIdPut may allow unintended subscription updates after input errors (medium 6.9)
- [CVE-2026-40248](https://insights.sbomify.com/CVE-2026-40248/): free5gc UDR improper path validation allows unauthenticated creation and modification of Traffic Influence Subscriptions (high 8.7)
- [CVE-2026-40247](https://insights.sbomify.com/CVE-2026-40247/): free5gc UDR improper path validation allows unauthenticated access to Traffic Influence Subscriptions (high 8.7)
- [CVE-2026-40246](https://insights.sbomify.com/CVE-2026-40246/): free5gc UDR improper path validation allows unauthenticated deletion of Traffic Influence Subscriptions (high 8.7)
- [CVE-2026-40245](https://insights.sbomify.com/CVE-2026-40245/): Free5GC: UDR nudr-dr influenceData/subs-to-notify leaks SUPI in error response body without authentication (high 7.5)
- [CVE-2026-40244](https://insights.sbomify.com/CVE-2026-40244/): OpenEXR has integer overflow in DWA setupChannelData planarUncRle pointer arithmetic (missed variant of CVE-2026-34589) (high 8.4)
- [CVE-2026-40243](https://insights.sbomify.com/CVE-2026-40243/): Incus OVN TLS verification accepts peer-supplied roots and permits endpoint impersonation (low 2.3)
- [CVE-2026-40242](https://insights.sbomify.com/CVE-2026-40242/): Arcane Unauthenticated SSRF with Conditional Response Reflection in Template Fetch Endpoint (high 7.2)
- [CVE-2026-4024](https://insights.sbomify.com/CVE-2026-4024/): Royal Addons for Elementor <= 1.7.1056 - Missing Authorization to Unauthenticated Form Action Meta Modification (medium 5.3)
- [CVE-2026-40230](https://insights.sbomify.com/CVE-2026-40230/): Helpy 2.8.0 - Stored XSS in knowledgebase Doc body rendering (medium 4.8)
- [CVE-2026-40229](https://insights.sbomify.com/CVE-2026-40229/): Helpy 2.8.0 - Stored XSS in post author display via PostsHelper (medium 5.1)
- [CVE-2026-40228](https://insights.sbomify.com/CVE-2026-40228/): Other in systemd (low 2.9)
- [CVE-2026-40227](https://insights.sbomify.com/CVE-2026-40227/): Denial of service in systemd (medium 6.2)
- [CVE-2026-40226](https://insights.sbomify.com/CVE-2026-40226/): Security feature bypass in systemd (medium 6.4)
- [CVE-2026-40225](https://insights.sbomify.com/CVE-2026-40225/): Privilege escalation in systemd (medium 6.4)
- [CVE-2026-40224](https://insights.sbomify.com/CVE-2026-40224/): Privilege escalation in systemd (medium 6.7)
- [CVE-2026-40223](https://insights.sbomify.com/CVE-2026-40223/): Denial of service in systemd (medium 4.7)
- [CVE-2026-4022](https://insights.sbomify.com/CVE-2026-4022/): Show Posts list <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2026-40217](https://insights.sbomify.com/CVE-2026-40217/): LiteLLM has a sandbox escape in custom-code guardrail (high 8.8)
- [CVE-2026-40215](https://insights.sbomify.com/CVE-2026-40215/): Use after free in OpenVPN (medium 6.1)
- [CVE-2026-40214](https://insights.sbomify.com/CVE-2026-40214/): OpenStack Cyborg's Accelerator Request (ARQ) API does not enforce project ownership at any layer (medium 6.3)
- [CVE-2026-40213](https://insights.sbomify.com/CVE-2026-40213/): OpenStack Cyborg uses rule:allow (check_str='@') as the default policy for multiple API endpoints (high 7.4)
- [CVE-2026-40212](https://insights.sbomify.com/CVE-2026-40212/): Cross-site scripting in Skyline (medium 5.4)
- [CVE-2026-40211](https://insights.sbomify.com/CVE-2026-40211/): Denial of service via crafted DoH3 queries (medium 5.3)
- [CVE-2026-40210](https://insights.sbomify.com/CVE-2026-40210/): Out-of-bounds read in SetMacAddrAction (medium 4.8)
- [CVE-2026-4021](https://insights.sbomify.com/CVE-2026-4021/): Auth bypass in Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe (high 8.1)
- [CVE-2026-40209](https://insights.sbomify.com/CVE-2026-40209/): Denial of service via IXFR queries (medium 5.3)
- [CVE-2026-40208](https://insights.sbomify.com/CVE-2026-40208/): Denial of service via DoH3 queries (low 3.7)
- [CVE-2026-40205](https://insights.sbomify.com/CVE-2026-40205/): Auth bypass in OX Dovecot CE (medium 5.9)
- [CVE-2026-40204](https://insights.sbomify.com/CVE-2026-40204/): Other in OX Dovecot CE (low 3.1)
- [CVE-2026-40203](https://insights.sbomify.com/CVE-2026-40203/): Information disclosure in OX Dovecot CE (low 3.7)
- [CVE-2026-40201](https://insights.sbomify.com/CVE-2026-40201/): @diplodoc/search-extension allows stored XSS via Markdown file title (medium 5.4)
- [CVE-2026-40200](https://insights.sbomify.com/CVE-2026-40200/): Memory corruption in musl (high 8.1)
- [CVE-2026-4020](https://insights.sbomify.com/CVE-2026-4020/): Gravity SMTP <= 2.1.4 - Unauthenticated Sensitive Information Exposure via REST API (high 7.5)
- [CVE-2026-40199](https://insights.sbomify.com/CVE-2026-40199/): Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv4 mapped IPv6 addresses, which may allow IP ACL bypass (medium 6.5)
- [CVE-2026-40198](https://insights.sbomify.com/CVE-2026-40198/): Net::CIDR::Lite versions before 0.23 for Perl does not validate IPv6 group count, which may allow IP ACL bypass (high 7.5)
- [CVE-2026-40197](https://insights.sbomify.com/CVE-2026-40197/): Incus nil-pointer dereference in custom volume import allows denial of service (high 7.1)
- [CVE-2026-40196](https://insights.sbomify.com/CVE-2026-40196/): HomeBox has Unauthorized API Access via Retained defaultGroup ID After Group Access Revocation (high 8.1)
- [CVE-2026-40195](https://insights.sbomify.com/CVE-2026-40195/): Incus nil-pointer dereference in storage bucket import allows denial of service (high 7.1)
- [CVE-2026-40194](https://insights.sbomify.com/CVE-2026-40194/): phpseclib has a variable-time HMAC comparison in SSH2::get_binary_packet() using != instead of hash_equals() (low 3.7)
- [CVE-2026-40193](https://insights.sbomify.com/CVE-2026-40193/): Maddy Mail Server: LDAP Filter Injection via Unsanitized Username (high 8.2)
- [CVE-2026-40192](https://insights.sbomify.com/CVE-2026-40192/): Pillow is vulnerable to a FITS GZIP decompression bomb (high 8.7)
- [CVE-2026-40191](https://insights.sbomify.com/CVE-2026-40191/): ClearanceKit has a policy bypass via dual-path Endpoint Security events checking only source path (medium 6.8)
- [CVE-2026-40190](https://insights.sbomify.com/CVE-2026-40190/): LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set()` (medium 5.6)
- [CVE-2026-4019](https://insights.sbomify.com/CVE-2026-4019/): Missing authorization in Complianz – GDPR/CCPA Cookie Consent (medium 5.3)
- [CVE-2026-40189](https://insights.sbomify.com/CVE-2026-40189/): goshs has a file-based ACL authorization bypass in goshs state-changing routes (critical 9.3)
- [CVE-2026-40188](https://insights.sbomify.com/CVE-2026-40188/): goshs is Missing Write Protection for Parametric Data Values (high 7.7)
- [CVE-2026-40187](https://insights.sbomify.com/CVE-2026-40187/): Authenticated RCE via Malicious eTemplate Upload in EGroupware (high 8.6)
- [CVE-2026-40186](https://insights.sbomify.com/CVE-2026-40186/): ApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements (medium 6.1)
- [CVE-2026-40185](https://insights.sbomify.com/CVE-2026-40185/): Missing Authorization on Immich Trip Photo Routes in TREK (high 7.1)
- [CVE-2026-40184](https://insights.sbomify.com/CVE-2026-40184/): Unauthenticated Access to Uploaded Files in TREK (low 3.7)
- [CVE-2026-40183](https://insights.sbomify.com/CVE-2026-40183/): ImageMagick: Heap buffer overflow when encoding JXL image with a 16-bit float (medium 5.5)
- [CVE-2026-40182](https://insights.sbomify.com/CVE-2026-40182/): OpenTelemetry dotnet: OTLP exporter reads unbounded HTTP response bodies (medium 5.3)
- [CVE-2026-40181](https://insights.sbomify.com/CVE-2026-40181/): React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation (medium 6.6)
- [CVE-2026-40180](https://insights.sbomify.com/CVE-2026-40180/): Zip Slip Path Traversal in quarkus-openapi-generator ApicurioCodegenWrapper class (high 7.7)
- [CVE-2026-4018](https://insights.sbomify.com/CVE-2026-4018/): Race condition in QNX OS for Medical (medium 6.4)
- [CVE-2026-40179](https://insights.sbomify.com/CVE-2026-40179/): Prometheus: Stored XSS via metric names and label values in web UI tooltips and metrics explorer (medium 5.3)
- [CVE-2026-40178](https://insights.sbomify.com/CVE-2026-40178/): ajenti.plugin.core has a race conditions in 2FA (medium 6.9)
- [CVE-2026-40177](https://insights.sbomify.com/CVE-2026-40177/): Password bypass when 2FA is activated (critical 9.3)
- [CVE-2026-40176](https://insights.sbomify.com/CVE-2026-40176/): Composer is vulnerable to Command Injection via Malicious Perforce Repository (high 7.8)
- [CVE-2026-40175](https://insights.sbomify.com/CVE-2026-40175/): Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain (medium 4.8)
- [CVE-2026-40174](https://insights.sbomify.com/CVE-2026-40174/): Masa CMS CSRF in user address management allows unauthorized address changes (high 7.1)
- [CVE-2026-40173](https://insights.sbomify.com/CVE-2026-40173/): Dgraph: Unauthenticated pprof endpoint leaks admin auth token (critical 9.4)
- [CVE-2026-40172](https://insights.sbomify.com/CVE-2026-40172/): authentik: Privilege Escalation via User PATCH: Superuser Group Assignment Bypasses enable_group_superuser (high 8.1)
- [CVE-2026-40171](https://insights.sbomify.com/CVE-2026-40171/): Jupyter Notebook and JupyterLab token theft via stored XSS in help command linker (high 8.4)
- [CVE-2026-40170](https://insights.sbomify.com/CVE-2026-40170/): ngtcp2 has a qlog transport parameter serialization stack buffer overflow (high 7.5)
- [CVE-2026-4017](https://insights.sbomify.com/CVE-2026-4017/): Memory corruption in QNX OS for Medical (high 7.4)
- [CVE-2026-40169](https://insights.sbomify.com/CVE-2026-40169/): ImageMagick: Heap buffer overflow (WRITE) in the YAML and JSON encoders (medium 6.2)
- [CVE-2026-40168](https://insights.sbomify.com/CVE-2026-40168/): Postiz has Server-Side Request Forgery via Redirect Bypass in /api/public/stream (high 8.2)
- [CVE-2026-40166](https://insights.sbomify.com/CVE-2026-40166/): authentik: Non-admin user can retrieve confidential OAuth client_secret via /api/v3/oauth2/access_tokens/ (high 7.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/670/