# Vulnerabilities published in 2026


- [CVE-2026-40050](https://insights.sbomify.com/CVE-2026-40050/): CrowdStrike LogScale Unauthenticated Path Traversal (critical 9.8)
- [CVE-2026-4005](https://insights.sbomify.com/CVE-2026-4005/): Cross-site scripting in Coachific Shortcode (medium 6.4)
- [CVE-2026-40048](https://insights.sbomify.com/CVE-2026-40048/): Apache Camel PQC: Unsafe Deserialization from FileBasedKeyLifecycleManager (high 7.8)
- [CVE-2026-40047](https://insights.sbomify.com/CVE-2026-40047/): Apache Camel-Docling: Insufficient validation of custom CLI arguments enables argument injection and path traversal in DoclingProducer (critical 9.1)
- [CVE-2026-40046](https://insights.sbomify.com/CVE-2026-40046/): Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT vulnerable to Integer Overflow or Wraparound (high 7.5)
- [CVE-2026-40045](https://insights.sbomify.com/CVE-2026-40045/): OpenClaw < 2026.4.2 - Cleartext Credential Transmission via Unencrypted WebSocket Gateway Endpoints (medium 5.9)
- [CVE-2026-40044](https://insights.sbomify.com/CVE-2026-40044/): Pachno 1.0.6 FileCache Deserialization Remote Code Execution (critical 9.3)
- [CVE-2026-40043](https://insights.sbomify.com/CVE-2026-40043/): Pachno 1.0.6 Authentication Bypass via runSwitchUser() (high 7.1)
- [CVE-2026-40042](https://insights.sbomify.com/CVE-2026-40042/): Pachno 1.0.6 Wiki TextParser XML External Entity Injection (critical 9.3)
- [CVE-2026-40041](https://insights.sbomify.com/CVE-2026-40041/): Pachno 1.0.6 Cross-Site Request Forgery via State-Changing Endpoints (medium 5.3)
- [CVE-2026-40040](https://insights.sbomify.com/CVE-2026-40040/): Pachno 1.0.6 Unrestricted File Upload Remote Code Execution (high 8.7)
- [CVE-2026-4004](https://insights.sbomify.com/CVE-2026-4004/): Task Manager <= 3.0.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'task_id' Parameter (medium 6.5)
- [CVE-2026-40039](https://insights.sbomify.com/CVE-2026-40039/): Pachno 1.0.6 Open Redirection via return_to Parameter (high 7.1)
- [CVE-2026-40038](https://insights.sbomify.com/CVE-2026-40038/): Pachno 1.0.6 Stored Cross-Site Scripting via Multiple Parameters (medium 5.1)
- [CVE-2026-40037](https://insights.sbomify.com/CVE-2026-40037/): OpenClaw < 2026.4.8 - Unsafe Request Body Replay via fetchWithSsrFGuard Cross-Origin Redirects (high 7.1)
- [CVE-2026-40036](https://insights.sbomify.com/CVE-2026-40036/): Unfurl < 2026.04 - Denial of Service via Unbounded zlib Decompression (high 8.7)
- [CVE-2026-40035](https://insights.sbomify.com/CVE-2026-40035/): Unfurl - Werkzeug Debugger Exposure via String Config Parsing (critical 9.3)
- [CVE-2026-40034](https://insights.sbomify.com/CVE-2026-40034/): gitoxide - Command Injection via Partial .gitmodules Override in gix-submodule (high 7.3)
- [CVE-2026-40033](https://insights.sbomify.com/CVE-2026-40033/): FreeRDP - Heap-buffer-overflow in gdi_CacheToSurface via rectangle validation bypass (high 8.6)
- [CVE-2026-40032](https://insights.sbomify.com/CVE-2026-40032/): UAC < 3.3.0-rc1 Command Injection via Placeholder Substitution (high 8.5)
- [CVE-2026-40031](https://insights.sbomify.com/CVE-2026-40031/): MemProcFS < 5.17 DLL/Shared Library Hijacking (high 8.5)
- [CVE-2026-40030](https://insights.sbomify.com/CVE-2026-40030/): parseusbs < 1.9 Command Injection via Volume Path Argument (high 8.4)
- [CVE-2026-4003](https://insights.sbomify.com/CVE-2026-4003/): Missing authorization in Users manager – PN (critical 9.8)
- [CVE-2026-40029](https://insights.sbomify.com/CVE-2026-40029/): parseusbs < 1.9 Command Injection via Crafted LNK Filename (high 8.5)
- [CVE-2026-40028](https://insights.sbomify.com/CVE-2026-40028/): Hayabusa < 3.8.0 XSS via JSON Log Import (medium 5.1)
- [CVE-2026-40027](https://insights.sbomify.com/CVE-2026-40027/): ALEAPP NQ Vault Artifact Parser Path Traversal (high 8.4)
- [CVE-2026-40026](https://insights.sbomify.com/CVE-2026-40026/): Sleuth Kit ISO9660 SUSP Extension Reference Out-of-Bounds Read (medium 4.8)
- [CVE-2026-40025](https://insights.sbomify.com/CVE-2026-40025/): Sleuth Kit APFS Keybag Parser Out-of-Bounds Read (medium 4.8)
- [CVE-2026-40024](https://insights.sbomify.com/CVE-2026-40024/): Sleuth Kit tsk_recover Path Traversal (high 8.4)
- [CVE-2026-40023](https://insights.sbomify.com/CVE-2026-40023/): Other in Apache Log4cxx (medium 6.3)
- [CVE-2026-40022](https://insights.sbomify.com/CVE-2026-40022/): Apache Camel Platform HTTP Main: Authentication Bypass on Non-Root Context Paths in camel main runtime (high 8.2)
- [CVE-2026-40021](https://insights.sbomify.com/CVE-2026-40021/): Apache Log4net: Silent log event loss in XmlLayout and XmlLayoutSchemaLog4J due to unescaped XML 1.0 forbidden characters (medium 6.3)
- [CVE-2026-40020](https://insights.sbomify.com/CVE-2026-40020/): Missing authorization in OX Dovecot Pro (low 3.1)
- [CVE-2026-4002](https://insights.sbomify.com/CVE-2026-4002/): Petje.af <= 2.1.8 - Cross-Site Request Forgery to Account Deletion via 'petjeaf_disconnect' AJAX Action (medium 4.3)
- [CVE-2026-40019](https://insights.sbomify.com/CVE-2026-40019/): Denial of service in OX Dovecot CE (medium 5.9)
- [CVE-2026-40018](https://insights.sbomify.com/CVE-2026-40018/): SQL injection in OX Dovecot CE (high 7.4)
- [CVE-2026-40017](https://insights.sbomify.com/CVE-2026-40017/): Denial of service in OX Dovecot CE (medium 6.5)
- [CVE-2026-40016](https://insights.sbomify.com/CVE-2026-40016/): Denial of service in OX Dovecot Pro (medium 5.3)
- [CVE-2026-40015](https://insights.sbomify.com/CVE-2026-40015/): Memory corruption in OX Dovecot CE (medium 4.3)
- [CVE-2026-40014](https://insights.sbomify.com/CVE-2026-40014/): Denial of service in OX Dovecot CE (medium 6.5)
- [CVE-2026-40013](https://insights.sbomify.com/CVE-2026-40013/): Memory corruption in OX Dovecot CE (medium 4.3)
- [CVE-2026-40012](https://insights.sbomify.com/CVE-2026-40012/): Information about ECS zero scoped answers might leak to clients that use a specific ECS (medium 5.3)
- [CVE-2026-40011](https://insights.sbomify.com/CVE-2026-40011/): Prometheus denial of service via crafted DNS queries (low 3.7)
- [CVE-2026-40010](https://insights.sbomify.com/CVE-2026-40010/): Apache Wicket: possible session fixation using AuthenticatedWebSession (critical 9.1)
- [CVE-2026-4001](https://insights.sbomify.com/CVE-2026-4001/): Woocommerce Custom Product Addons Pro <= 5.4.1 - Unauthenticated Remote Code Execution via Custom Pricing Formula (critical 9.8)
- [CVE-2026-40009](https://insights.sbomify.com/CVE-2026-40009/): Apache IoTDB: Authenticated users can escalate to full tree-path access by renaming themselves to __internal_auditor (medium 6.5)
- [CVE-2026-40008](https://insights.sbomify.com/CVE-2026-40008/): Apache IoTDB: Arbitrary Class Instantiation via Pipe Transfer RPC (critical 9.8)
- [CVE-2026-40007](https://insights.sbomify.com/CVE-2026-40007/): Denial of service in Apache IoTDB (high 7.5)
- [CVE-2026-40006](https://insights.sbomify.com/CVE-2026-40006/): Apache IoTDB: Unauthenticated heap-exhaustion DoS via unbounded allocation in IoTDB AirGap pipe receiver (high 7.5)
- [CVE-2026-40005](https://insights.sbomify.com/CVE-2026-40005/): Apache IoTDB: Path Traversal in Pipe File Transfer Receiver (critical 9.1)
- [CVE-2026-40004](https://insights.sbomify.com/CVE-2026-40004/): openssl.cnf Privilege Escalation Vulnerability in ZTE Cloud PC Client uSmartview (medium 5.5)
- [CVE-2026-40003](https://insights.sbomify.com/CVE-2026-40003/): USB-based arbitrary memory write vulnerability in ZTE ZX297520V3 soc BootROM (medium 5.1)
- [CVE-2026-40002](https://insights.sbomify.com/CVE-2026-40002/): Missing authorization in Red Magic 11 Pro (NX809J) (medium 5.0)
- [CVE-2026-40001](https://insights.sbomify.com/CVE-2026-40001/): Local privilege escalation vulnerability in ZTE PROCESS Guard service of the cloud computer client (medium 5.2)
- [CVE-2026-40000](https://insights.sbomify.com/CVE-2026-40000/): Path Traversal Vulnerability in ZTE Blade A75 5G (low 1.8)
- [CVE-2026-39999](https://insights.sbomify.com/CVE-2026-39999/): Apache APISIX: JWT Algorithm Confusion allows authentication bypass (high 7.0)
- [CVE-2026-39998](https://insights.sbomify.com/CVE-2026-39998/): Apache APISIX: Identity Injection via forward-auth Plugin Missing Header Cleanup (medium 5.8)
- [CVE-2026-39997](https://insights.sbomify.com/CVE-2026-39997/): Unauthenticated Remote Input Injection in QNAP HD Station's remotepad (high 8.9)
- [CVE-2026-39993](https://insights.sbomify.com/CVE-2026-39993/): Path Traversal to Root RCE in QNAP Download Station via Addon/Search addon Parameter (high 8.7)
- [CVE-2026-39991](https://insights.sbomify.com/CVE-2026-39991/): Stored Cross-Site Scripting (XSS) in Note Station file upload functionality (medium 4.8)
- [CVE-2026-3999](https://insights.sbomify.com/CVE-2026-3999/): Broken access control vulnerability affecting ID Server (high 8.8)
- [CVE-2026-39989](https://insights.sbomify.com/CVE-2026-39989/): SSRF in QNAP Download Station (medium 5.3)
- [CVE-2026-39987](https://insights.sbomify.com/CVE-2026-39987/): Marimo Remote Code Execution (critical 9.3, exploited in the wild)
- [CVE-2026-39985](https://insights.sbomify.com/CVE-2026-39985/): LORIS has an open redirect field on login (medium 4.3)
- [CVE-2026-39984](https://insights.sbomify.com/CVE-2026-39984/): Sigstore Timestamp Authority has Improper Certificate Validation in verifier (medium 5.5)
- [CVE-2026-39983](https://insights.sbomify.com/CVE-2026-39983/): FTP Command Injection via CRLF in basic-ftp (high 8.6)
- [CVE-2026-39981](https://insights.sbomify.com/CVE-2026-39981/): AGiXT has a Path Traversal in safe_join() (high 8.8)
- [CVE-2026-39980](https://insights.sbomify.com/CVE-2026-39980/): OpenCTI affected by RCE via notifier template (critical 9.1)
- [CVE-2026-3998](https://insights.sbomify.com/CVE-2026-3998/): WM JqMath <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute (medium 6.4)
- [CVE-2026-39979](https://insights.sbomify.com/CVE-2026-39979/): jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers (medium 6.9)
- [CVE-2026-39977](https://insights.sbomify.com/CVE-2026-39977/): flatpak-builder has a path traversal leading to arbitrary file read on host when installing licence files (high 7.1)
- [CVE-2026-39976](https://insights.sbomify.com/CVE-2026-39976/): Laravel Passport's TokenGuard Authenticates Unrelated User for Client Credentials Tokens (high 7.1)
- [CVE-2026-39975](https://insights.sbomify.com/CVE-2026-39975/): Combodo iTop: Remote code execution using external auth variable value (critical 9.4)
- [CVE-2026-39974](https://insights.sbomify.com/CVE-2026-39974/): n8n-MCP has an Authenticated SSRF via instance-URL header in multi-tenant HTTP mode (high 8.5)
- [CVE-2026-39973](https://insights.sbomify.com/CVE-2026-39973/): Apktool: Path Traversal to Arbitrary File Write (high 7.1)
- [CVE-2026-39972](https://insights.sbomify.com/CVE-2026-39972/): Mercure has a Topic Selector Cache Key Collision (high 7.1)
- [CVE-2026-39971](https://insights.sbomify.com/CVE-2026-39971/): Serendipity: Host Header Injection leads to SMTP header injection via unvalidated HTTP_HOST (high 7.2)
- [CVE-2026-39970](https://insights.sbomify.com/CVE-2026-39970/): TypeBot: Stored Cross-Site Scripting (XSS) via SVG File Upload On Profile Picture Form (high 8.5)
- [CVE-2026-3997](https://insights.sbomify.com/CVE-2026-3997/): Text Toggle <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute (medium 6.4)
- [CVE-2026-39969](https://insights.sbomify.com/CVE-2026-39969/): TypeBot: WhatsApp Webhook Endpoint Missing Signature Verification (medium 6.5)
- [CVE-2026-39968](https://insights.sbomify.com/CVE-2026-39968/): TypeBot: Cross-Workspace Credential Theft via Bot-Engine Preview Endpoint (high 7.1)
- [CVE-2026-39967](https://insights.sbomify.com/CVE-2026-39967/): TypeBot: Cross-Typebot Result Data Access via Missing typebotId Filter (low 3.1)
- [CVE-2026-39966](https://insights.sbomify.com/CVE-2026-39966/): Missing authorization in typebot.io (medium 6.5)
- [CVE-2026-39965](https://insights.sbomify.com/CVE-2026-39965/): TypeBot: SSRF via Open Redirect Bypass in HTTP Request and Code Blocks (high 7.7)
- [CVE-2026-39964](https://insights.sbomify.com/CVE-2026-39964/): TypeBot: Stored XSS via javascript: URI in text bubble links — bot author executes JS on visitors' browsers (medium 5.4)
- [CVE-2026-39963](https://insights.sbomify.com/CVE-2026-39963/): Serendipity: Host Header Injection enables authentication cookie scoping to an attacker-controlled domain (medium 6.9)
- [CVE-2026-39962](https://insights.sbomify.com/CVE-2026-39962/): LDAP injection in MISP ApacheAuthenticate when using a user-controlled Apache environment variable (high 8.8)
- [CVE-2026-39961](https://insights.sbomify.com/CVE-2026-39961/): Aiven Operator has cross-namespace secret exfiltration via ClickhouseUser connInfoSecretSource (medium 6.8)
- [CVE-2026-39960](https://insights.sbomify.com/CVE-2026-39960/): MantisBT is Vulnerable to Stored XSS through Custom Field Textarea Values (medium 5.4)
- [CVE-2026-3996](https://insights.sbomify.com/CVE-2026-3996/): WP Games Embed <= 0.1beta - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-39959](https://insights.sbomify.com/CVE-2026-39959/): Tmds.DBus: malicious D-Bus peers can spoof signals, exhaust file descriptor resources, and cause denial of service (high 7.1)
- [CVE-2026-39958](https://insights.sbomify.com/CVE-2026-39958/): oma-topic: name Field in Topic Manifests (topic.json) May Allow CRLF Injection (medium 5.2)
- [CVE-2026-39957](https://insights.sbomify.com/CVE-2026-39957/): Missing authorization in Lychee (low 2.3)
- [CVE-2026-39956](https://insights.sbomify.com/CVE-2026-39956/): jq: Missing runtime type checks for _strindices lead to crash and limited memory disclosure (medium 6.1)
- [CVE-2026-39955](https://insights.sbomify.com/CVE-2026-39955/): Cacti has Pre-Authentication SQL Injection via unanchored FILTER_VALIDATE_REGEXP in graph_view.php (critical 9.8)
- [CVE-2026-39951](https://insights.sbomify.com/CVE-2026-39951/): Cacti: Stored SQL Injection via graph_name_regexp in Reports feature (high 7.6)
- [CVE-2026-3995](https://insights.sbomify.com/CVE-2026-3995/): OPEN-BRAIN <= 0.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'API Key' Setting (medium 4.4)
- [CVE-2026-39948](https://insights.sbomify.com/CVE-2026-39948/): Cacti has SQL Injection via rfilter parameter in RLIKE clauses (critical 9.3)
- [CVE-2026-39946](https://insights.sbomify.com/CVE-2026-39946/): OpenBao allows SQL Injection in PostgreSQL database secrets engine (medium 4.6)
- [CVE-2026-39944](https://insights.sbomify.com/CVE-2026-39944/): Ceph: CephX AES Authentication error (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/672/