# Vulnerabilities published in 2026


- [CVE-2026-39943](https://insights.sbomify.com/CVE-2026-39943/): Directus exposes sensitive fields in revision history (medium 6.5)
- [CVE-2026-39942](https://insights.sbomify.com/CVE-2026-39942/): Directus has a Path Traversal and Broken Access Control in File Management API (high 8.5)
- [CVE-2026-39941](https://insights.sbomify.com/CVE-2026-39941/): ChurchCRM has an XSS vulnerability (medium 5.3)
- [CVE-2026-39940](https://insights.sbomify.com/CVE-2026-39940/): ChurchCRM has an Open Redirect via the ‘linkBack’ URL Parameter in DonatedItemEditor.php (medium 5.3)
- [CVE-2026-3994](https://insights.sbomify.com/CVE-2026-3994/): rui314 mold Object File input-files.cc initialize_sections heap-based overflow (medium 4.8)
- [CVE-2026-39938](https://insights.sbomify.com/CVE-2026-39938/): Cacti: Unauthenticated RCE on Graph Image (critical 9.8)
- [CVE-2026-39937](https://insights.sbomify.com/CVE-2026-39937/): Global vanishing does not completely remove user email (high 8.8)
- [CVE-2026-39936](https://insights.sbomify.com/CVE-2026-39936/): Stored XSS in Score due to usage of non-reserved data attributes (medium 6.9)
- [CVE-2026-39935](https://insights.sbomify.com/CVE-2026-39935/): XSS-via-i18n in localised wiki names (medium 6.9)
- [CVE-2026-39934](https://insights.sbomify.com/CVE-2026-39934/): Growth Experiments ReassignMenteesJob runs as an infinite loop (medium 6.9)
- [CVE-2026-39933](https://insights.sbomify.com/CVE-2026-39933/): Multiple XSS vulnerabilities in GlobalWatchlist (medium 6.9)
- [CVE-2026-39932](https://insights.sbomify.com/CVE-2026-39932/): OpenEMR 8.2.0 Remote Code Execution via CategoryTree eval() Injection (critical 9.4)
- [CVE-2026-39931](https://insights.sbomify.com/CVE-2026-39931/): OpenEMR Authenticated SQL Injection via backup.php Import Feature (high 8.6)
- [CVE-2026-3993](https://insights.sbomify.com/CVE-2026-3993/): itsourcecode Payroll Management System manage_employee_deductions.php cross site scripting (medium 5.3)
- [CVE-2026-39929](https://insights.sbomify.com/CVE-2026-39929/): Lakeside SysTrack Agent LsiAgent.exe Out-of-Bounds Read via UDP (high 8.7)
- [CVE-2026-39924](https://insights.sbomify.com/CVE-2026-39924/): Flarum < 1.8.16 Session Persistence via Improper Access Token Revocation (high 7.6)
- [CVE-2026-39923](https://insights.sbomify.com/CVE-2026-39923/): Flarum < 1.8.16 Password Reset Token Expiry Bypass via POST /reset (critical 9.2)
- [CVE-2026-39922](https://insights.sbomify.com/CVE-2026-39922/): GeoNode SSRF via Service Registration (medium 5.3)
- [CVE-2026-39921](https://insights.sbomify.com/CVE-2026-39921/): GeoNode < 4.4.5, 5.0.2 SSRF via Document Upload (medium 5.3)
- [CVE-2026-39920](https://insights.sbomify.com/CVE-2026-39920/): BridgeHead FileStore < 24A Apache Axis2 Default Credentials RCE (critical 9.3)
- [CVE-2026-3992](https://insights.sbomify.com/CVE-2026-3992/): CodeGenieApp serverless-express Users Endpoint dynamodb.ts injection (medium 5.3)
- [CVE-2026-39919](https://insights.sbomify.com/CVE-2026-39919/): Ghostscript < 10.08.0 Heap Buffer Overflow via JPEG 2000 Output Adapter (critical 9.3)
- [CVE-2026-39918](https://insights.sbomify.com/CVE-2026-39918/): Vvveb < 1.0.8.1 Code Injection via Installation Endpoint (critical 9.2)
- [CVE-2026-39915](https://insights.sbomify.com/CVE-2026-39915/): TIM Flow < 26.0.6 CRLF Injection via rt Parameter (high 8.5)
- [CVE-2026-39914](https://insights.sbomify.com/CVE-2026-39914/): TIM Flow < 26.0.6 Unauthorized SQL Query Execution via Dashboard Export Endpoint (high 7.1)
- [CVE-2026-39912](https://insights.sbomify.com/CVE-2026-39912/): v2board / Xboard Authentication Token Exposure via loginWithMailLink (critical 9.1)
- [CVE-2026-39911](https://insights.sbomify.com/CVE-2026-39911/): Hashgraph Guardian 3.5.1 Unsandboxed JavaScript Execution RCE (high 8.7)
- [CVE-2026-39910](https://insights.sbomify.com/CVE-2026-39910/): STACKIT IaaS API Privilege Escalation via Service Account Attachment (high 8.7)
- [CVE-2026-3991](https://insights.sbomify.com/CVE-2026-3991/): Elevation of Privileges in Symantec Data Loss Prevention Windows Endpoint (high 7.8)
- [CVE-2026-39908](https://insights.sbomify.com/CVE-2026-39908/): OpenBullet2 0.3.2 NTLMv2 Hash Disclosure via UNC Path Proxy Source (high 7.1)
- [CVE-2026-39907](https://insights.sbomify.com/CVE-2026-39907/): Unisys WebPerfect Image Suite 3.0 NTLMv2 Hash Leakage via WCF SOAP (high 7.0)
- [CVE-2026-39906](https://insights.sbomify.com/CVE-2026-39906/): Unisys WebPerfect Image Suite 3.0 NTLMv2 Hash Leakage via .NET Remoting (high 7.0)
- [CVE-2026-39904](https://insights.sbomify.com/CVE-2026-39904/): Gophish 0.12.1 Denial of Service via Office Document Upload (high 7.1)
- [CVE-2026-39903](https://insights.sbomify.com/CVE-2026-39903/): Simple Machines Forum Authorization Bypass via AttachmentApprove.php (high 7.1)
- [CVE-2026-39902](https://insights.sbomify.com/CVE-2026-39902/): Cacti: Authenticated RCE on Data Input (high 7.2)
- [CVE-2026-39901](https://insights.sbomify.com/CVE-2026-39901/): monetr: Protected Transactions Deletable via PUT (medium 5.7)
- [CVE-2026-39900](https://insights.sbomify.com/CVE-2026-39900/): Cacti: Reflected XSS via tab parameter in auth_profile.php JavaScript context (medium 5.3)
- [CVE-2026-3990](https://insights.sbomify.com/CVE-2026-3990/): CesiumGS CesiumJS standalone.html cross site scripting (medium 5.3)
- [CVE-2026-39899](https://insights.sbomify.com/CVE-2026-39899/): Cacti: Path Traversal via filename parameter in package_import.php (medium 6.9)
- [CVE-2026-39897](https://insights.sbomify.com/CVE-2026-39897/): Cacti has a Reflected XSS Vulnerability via html_auth_footer (medium 5.3)
- [CVE-2026-39894](https://insights.sbomify.com/CVE-2026-39894/): Cacti: RRDtool metric shift via LC_NUMERIC locale comma decimal formatting (low 2.9)
- [CVE-2026-39893](https://insights.sbomify.com/CVE-2026-39893/): Cacti: Pre-authentication SQL injection via rfilter RLIKE clause in graph_view.php (critical 9.8)
- [CVE-2026-39892](https://insights.sbomify.com/CVE-2026-39892/): cryptography has a buffer overflow if non-contiguous buffers were passed to APIs (medium 6.9)
- [CVE-2026-39891](https://insights.sbomify.com/CVE-2026-39891/): PraisonAI has a Template Injection in Agent Tool Definitions (high 8.8)
- [CVE-2026-39890](https://insights.sbomify.com/CVE-2026-39890/): PraisonAI Affected by Remote Code Execution via YAML Deserialization in Agent Definition Loading (critical 9.8)
- [CVE-2026-3989](https://insights.sbomify.com/CVE-2026-3989/): CVE-2026-3989 (high 7.8)
- [CVE-2026-39889](https://insights.sbomify.com/CVE-2026-39889/): PraisonAI has Unauthenticated SSE Event Stream Exposes All Agent Activity in A2U Server (high 7.5)
- [CVE-2026-39888](https://insights.sbomify.com/CVE-2026-39888/): PraisonAIAgents has a sandbox escape via exception frame traversal in `execute_code` (subprocess mode) (critical 10.0)
- [CVE-2026-39886](https://insights.sbomify.com/CVE-2026-39886/): OpenEXR has HTJ2K Signed Integer Overflow in ht_undo_impl() (medium 5.3)
- [CVE-2026-39885](https://insights.sbomify.com/CVE-2026-39885/): FrontMCP Affected by SSRF via $ref Dereferencing in Untrusted OpenAPI Specifications (high 7.5)
- [CVE-2026-39884](https://insights.sbomify.com/CVE-2026-39884/): MCP Server Kubernetes has Argument Injection in its port_forward tool via space-splitting (high 8.3)
- [CVE-2026-39883](https://insights.sbomify.com/CVE-2026-39883/): opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking (high 7.3)
- [CVE-2026-39882](https://insights.sbomify.com/CVE-2026-39882/): OpenTelemetry-Go OTLP HTTP exporters read unbounded HTTP response bodies (medium 5.3)
- [CVE-2026-39881](https://insights.sbomify.com/CVE-2026-39881/): Vim Ex command injection in Vims NetBeans integration (medium 5.0)
- [CVE-2026-39880](https://insights.sbomify.com/CVE-2026-39880/): Remnawave Backend has a race condition in HWID device limit allows bypassing max devices (medium 5.0)
- [CVE-2026-3988](https://insights.sbomify.com/CVE-2026-3988/): Inefficient Algorithmic Complexity in GitLab (high 7.5)
- [CVE-2026-39879](https://insights.sbomify.com/CVE-2026-39879/): SQL injection in syslog-ng SQL destionation driver (high 7.1)
- [CVE-2026-39878](https://insights.sbomify.com/CVE-2026-39878/): Chamilo stored XSS via user registration leads to admin account takeover (critical 9.3)
- [CVE-2026-39877](https://insights.sbomify.com/CVE-2026-39877/): Memory corruption in iOS and iPadOS (high 7.8)
- [CVE-2026-39875](https://insights.sbomify.com/CVE-2026-39875/): Privilege escalation in macOS (high 7.8)
- [CVE-2026-39874](https://insights.sbomify.com/CVE-2026-39874/): Privilege escalation in macOS (high 7.8)
- [CVE-2026-39873](https://insights.sbomify.com/CVE-2026-39873/): Memory corruption in macOS (critical 9.8)
- [CVE-2026-39872](https://insights.sbomify.com/CVE-2026-39872/): Use after free in Safari (medium 6.5)
- [CVE-2026-39871](https://insights.sbomify.com/CVE-2026-39871/): Information disclosure in macOS (high 7.5)
- [CVE-2026-39870](https://insights.sbomify.com/CVE-2026-39870/): Memory corruption in macOS (high 7.5)
- [CVE-2026-3987](https://insights.sbomify.com/CVE-2026-3987/): WatchGuard Firebox Arbitrary File Write vis Path Traversal in Fireware Web UI (high 8.6)
- [CVE-2026-39869](https://insights.sbomify.com/CVE-2026-39869/): Memory corruption in iOS and iPadOS (medium 4.3)
- [CVE-2026-39868](https://insights.sbomify.com/CVE-2026-39868/): Memory corruption in iOS and iPadOS (critical 9.1)
- [CVE-2026-39866](https://insights.sbomify.com/CVE-2026-39866/): Lawnchair vulnerable to Command Injection via unquoted workflow dispatch input in release_update.yml (high 7.4)
- [CVE-2026-39865](https://insights.sbomify.com/CVE-2026-39865/): Axios HTTP/2 Session Cleanup State Corruption Vulnerability (medium 5.9)
- [CVE-2026-39864](https://insights.sbomify.com/CVE-2026-39864/): Kamailio Auth: Processing Vulnerability For Additional Authenticated User Identity Checks (medium 4.4)
- [CVE-2026-39863](https://insights.sbomify.com/CVE-2026-39863/): Kamailio Core: TCP Data Processing Vulnerability (high 7.5)
- [CVE-2026-39862](https://insights.sbomify.com/CVE-2026-39862/): Tophat has a Command Injection Vulnerability When Accessing a Maliciously Crafted Tophat Link (medium 6.3)
- [CVE-2026-39861](https://insights.sbomify.com/CVE-2026-39861/): Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside Workspace (high 7.7)
- [CVE-2026-39860](https://insights.sbomify.com/CVE-2026-39860/): Nix sandbox escape: file write via symlink at FOD `.tmp` copy destination (critical 9.0)
- [CVE-2026-3986](https://insights.sbomify.com/CVE-2026-3986/): Calculated Fields Form <= 5.4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Form Settings (medium 6.4)
- [CVE-2026-39859](https://insights.sbomify.com/CVE-2026-39859/): LiquidJS has a renderFile() / parseFile() bypass configured root and allow arbitrary file read (medium 6.3)
- [CVE-2026-39858](https://insights.sbomify.com/CVE-2026-39858/): Traefik: Forwarded alias spoofing top pre-auth decision bypass (high 7.8)
- [CVE-2026-39857](https://insights.sbomify.com/CVE-2026-39857/): Information Disclosure via `choices`/`counts` Query Parameters Bypassing publicApiProjection Field Restrictions (medium 5.3)
- [CVE-2026-39856](https://insights.sbomify.com/CVE-2026-39856/): osslsigncode has an Out-of-Bounds Read via Unvalidated Section Bounds in PE Page Hash Calculation (medium 5.5)
- [CVE-2026-39855](https://insights.sbomify.com/CVE-2026-39855/): osslsigncode has an Integer Underflow in PE Page Hash Calculation Can Cause Out-of-Bounds Read (medium 5.5)
- [CVE-2026-39853](https://insights.sbomify.com/CVE-2026-39853/): osslsigncode has a Stack Buffer Overflow via Unbounded Digest Copy During Signature Verification (high 7.8)
- [CVE-2026-39852](https://insights.sbomify.com/CVE-2026-39852/): Quarkus authorization bypass via semicolon path normalization inconsistency (high 8.8)
- [CVE-2026-39851](https://insights.sbomify.com/CVE-2026-39851/): Saleor has a user enumeration vulnerability due to different error messages (medium 5.3)
- [CVE-2026-39850](https://insights.sbomify.com/CVE-2026-39850/): Yii 2: Local file inclusion via view parameter name collision (high 7.4)
- [CVE-2026-3985](https://insights.sbomify.com/CVE-2026-3985/): SQL injection in Creative Mail – Easier WordPress & WooCommerce Email Marketing (high 7.5)
- [CVE-2026-39849](https://insights.sbomify.com/CVE-2026-39849/): Pi-hole FTL remote code execution via newline injection in dns.interface configuration (high 8.7)
- [CVE-2026-39848](https://insights.sbomify.com/CVE-2026-39848/): Dockyard's Unauthenticated Cron Endpoint in Dockyard Enables Container Enumeration and Database Manipulation (medium 6.5)
- [CVE-2026-39847](https://insights.sbomify.com/CVE-2026-39847/): Emmett has a path traversal in internal assets handler (critical 9.1)
- [CVE-2026-39846](https://insights.sbomify.com/CVE-2026-39846/): SiYuan affected by Remote Code Execution in the Electron desktop client via stored XSS in synced table captions (critical 9.1)
- [CVE-2026-39845](https://insights.sbomify.com/CVE-2026-39845/): Weblate: SSRF via the webhook add-on using unprotected fetch_url() (medium 4.1)
- [CVE-2026-39844](https://insights.sbomify.com/CVE-2026-39844/): NiceGUI has a Path Traversal in NiceGUI Upload Filename on Windows via Backslash Bypass of PurePosixPath Sanitization (medium 5.9)
- [CVE-2026-39843](https://insights.sbomify.com/CVE-2026-39843/): Plane has a Server-Side Request Forgery (SSRF) in Favicon Fetching (high 7.7)
- [CVE-2026-39842](https://insights.sbomify.com/CVE-2026-39842/): OpenRemote is Vulnerable to Expression Injection (critical 10.0)
- [CVE-2026-39841](https://insights.sbomify.com/CVE-2026-39841/): Stored XSS through list fields on Cargo's page values and Special:CargoTables (medium 6.3)
- [CVE-2026-39840](https://insights.sbomify.com/CVE-2026-39840/): CSS injection in multiple Cargo display formats (medium 5.1)
- [CVE-2026-3984](https://insights.sbomify.com/CVE-2026-3984/): Campcodes Division Regional Athletic Meet Game Result Matrix System save_up_athlete.php cross site scripting (medium 5.1)
- [CVE-2026-39839](https://insights.sbomify.com/CVE-2026-39839/): Stored XSS through URLs in Cargo's map format (medium 6.3)
- [CVE-2026-39838](https://insights.sbomify.com/CVE-2026-39838/): ProofreadPage improperly sanitizes multiline styles using Sanitizer::checkCSS (medium 6.9)
- [CVE-2026-39837](https://insights.sbomify.com/CVE-2026-39837/): Stored XSS through the dynamic table format in Cargo (medium 6.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/673/