# Vulnerabilities published in 2026


- [CVE-2026-35584](https://insights.sbomify.com/CVE-2026-35584/): Missing authorization in freescout (medium 6.9)
- [CVE-2026-35583](https://insights.sbomify.com/CVE-2026-35583/): Emissary has a Path Traversal via Blacklist Bypass in Configuration API (medium 5.3)
- [CVE-2026-35582](https://insights.sbomify.com/CVE-2026-35582/): Emissary has an OS Command Injection via Unvalidated IN_FILE_ENDING / OUT_FILE_ENDING in Executrix (high 8.8)
- [CVE-2026-35581](https://insights.sbomify.com/CVE-2026-35581/): Emissary has a Command Injection via PLACE_NAME Configuration in Executrix (high 7.2)
- [CVE-2026-35580](https://insights.sbomify.com/CVE-2026-35580/): Emissary has GitHub Actions Shell Injection via Workflow Inputs (critical 9.1)
- [CVE-2026-3558](https://insights.sbomify.com/CVE-2026-3558/): Philips Hue Bridge HomeKit Accessory Protocol Transient Pairing Mode Authentication Bypass Vulnerability (high 8.1)
- [CVE-2026-35579](https://insights.sbomify.com/CVE-2026-35579/): CoreDNS TSIG authentication bypass on gRPC, QUIC, DoH, and DoH3 transports (high 8.2)
- [CVE-2026-35577](https://insights.sbomify.com/CVE-2026-35577/): Missing Host Header Validation in Apollo MCP Server for Localhost Deployments (medium 6.8)
- [CVE-2026-35576](https://insights.sbomify.com/CVE-2026-35576/): ChurchCRM has Stored Cross-Site Scripting (XSS) in Person Properties via PrintView.php (high 8.7)
- [CVE-2026-35575](https://insights.sbomify.com/CVE-2026-35575/): ChurchCRM has Stored XSS in Group Name (high 8.0)
- [CVE-2026-35574](https://insights.sbomify.com/CVE-2026-35574/): ChurchCRM has a Stored XSS in Person Profile - Add a Note (high 7.3)
- [CVE-2026-35573](https://insights.sbomify.com/CVE-2026-35573/): ChurchCRM has a Path traversal leads to RCE (critical 9.1)
- [CVE-2026-35572](https://insights.sbomify.com/CVE-2026-35572/): SSRF via Referer header in ChurchCRM allows server-side HTTP/HTTPS requests to arbitrary hosts (high 7.0)
- [CVE-2026-35571](https://insights.sbomify.com/CVE-2026-35571/): Emissary has Stored XSS via Navigation Template Link Injection (medium 4.8)
- [CVE-2026-35570](https://insights.sbomify.com/CVE-2026-35570/): OpenClaude has Sandbox Bypass via Early-Exit Logic Flaw that Allows Path Traversal (high 8.4)
- [CVE-2026-3557](https://insights.sbomify.com/CVE-2026-3557/): Memory corruption in Hue Bridge (high 8.0)
- [CVE-2026-35569](https://insights.sbomify.com/CVE-2026-35569/): ApostropheCMS: Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS (high 8.7)
- [CVE-2026-35568](https://insights.sbomify.com/CVE-2026-35568/): MCP Java-SDK has a DNS Rebinding Vulnerability (high 7.6)
- [CVE-2026-35565](https://insights.sbomify.com/CVE-2026-35565/): Apache Storm UI: Stored Cross-Site Scripting (XSS) via Unsanitized Topology Metadata in Storm UI (medium 5.4)
- [CVE-2026-35563](https://insights.sbomify.com/CVE-2026-35563/): Apache Directory LDAP API lacks server certificate verification for LDAP hostnames (high 8.8)
- [CVE-2026-35562](https://insights.sbomify.com/CVE-2026-35562/): Allocation of resources without limits in parsing components in Amazon Athena ODBC driver (high 8.7)
- [CVE-2026-35561](https://insights.sbomify.com/CVE-2026-35561/): Insufficient authentication security controls in browser-based authentication components in Amazon Athena ODBC driver (critical 9.1)
- [CVE-2026-35560](https://insights.sbomify.com/CVE-2026-35560/): Improper certificate validation in identity provider connection components in Amazon Athena ODBC driver (critical 9.1)
- [CVE-2026-3556](https://insights.sbomify.com/CVE-2026-3556/): Philips Hue Bridge HomeKit Pair-Setup Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-35559](https://insights.sbomify.com/CVE-2026-35559/): Out-of-bounds write in query processing components in Amazon Athena ODBC driver (high 7.1)
- [CVE-2026-35558](https://insights.sbomify.com/CVE-2026-35558/): Improper neutralization of special elements in authentication components in Amazon Athena ODBC driver (high 7.3)
- [CVE-2026-35556](https://insights.sbomify.com/CVE-2026-35556/): Plaintext storage of a password in OpenPLC_V3 (critical 9.2)
- [CVE-2026-35555](https://insights.sbomify.com/CVE-2026-35555/): Subnet Solutions PowerSYSTEM Center Incorrect Authorization (high 7.0)
- [CVE-2026-35554](https://insights.sbomify.com/CVE-2026-35554/): Apache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race Condition (high 8.7)
- [CVE-2026-35553](https://insights.sbomify.com/CVE-2026-35553/): Memory corruption in DRFEC.SYS (high 8.4)
- [CVE-2026-35552](https://insights.sbomify.com/CVE-2026-35552/): In CAXperts UPVWebServices 2.4.2212.603 through 2.7.6 and UDiTH Portal 2026.0.0 through 2026.2.0, an authenticated remote user can invoke an (high 8.1)
- [CVE-2026-3555](https://insights.sbomify.com/CVE-2026-3555/): Philips Hue Bridge Zigbee Stack Custom Command Handler Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 8.0)
- [CVE-2026-35549](https://insights.sbomify.com/CVE-2026-35549/): Denial of service in MariaDB (medium 6.5)
- [CVE-2026-35548](https://insights.sbomify.com/CVE-2026-35548/): Server-side request forgery in guardsix:logpoint (high 8.5)
- [CVE-2026-35547](https://insights.sbomify.com/CVE-2026-35547/): Heap overflow in libnv (high 8.1)
- [CVE-2026-35546](https://insights.sbomify.com/CVE-2026-35546/): Anviz Products Missing Authentication for Critical Function (critical 9.8)
- [CVE-2026-35545](https://insights.sbomify.com/CVE-2026-35545/): Roundcube Webmail: Remote image blocking feature can be bypassed via SVG content in an e-mail message (medium 5.3)
- [CVE-2026-35544](https://insights.sbomify.com/CVE-2026-35544/): Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages (medium 5.3)
- [CVE-2026-35543](https://insights.sbomify.com/CVE-2026-35543/): Roundcube Webmail: Bypass of remote image blocking via SVG content (with animate attributes) in an e-mail message (medium 5.3)
- [CVE-2026-35542](https://insights.sbomify.com/CVE-2026-35542/): Roundcube: Bypass of remote image blocking via crafted BODY background attribute (medium 5.3)
- [CVE-2026-35541](https://insights.sbomify.com/CVE-2026-35541/): Roundcube Webmail: Incorrect password comparison in the password plugin (medium 4.2)
- [CVE-2026-35540](https://insights.sbomify.com/CVE-2026-35540/): Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages (medium 5.4)
- [CVE-2026-3554](https://insights.sbomify.com/CVE-2026-3554/): Cross-site scripting in Sherk Custom Post Type Displays (medium 6.4)
- [CVE-2026-35539](https://insights.sbomify.com/CVE-2026-35539/): Roundcube Webmail: Insufficient HTML attachment sanitization in preview mode (medium 6.1)
- [CVE-2026-35538](https://insights.sbomify.com/CVE-2026-35538/): Roundcube Webmail: Unsanitized IMAP SEARCH command arguments (low 3.1)
- [CVE-2026-35537](https://insights.sbomify.com/CVE-2026-35537/): Roundcube Webmail: Unsafe deserialization in the redis/memcache session handler (low 3.7)
- [CVE-2026-35536](https://insights.sbomify.com/CVE-2026-35536/): Tornado has incomplete validation of cookie attributes (high 7.2)
- [CVE-2026-35535](https://insights.sbomify.com/CVE-2026-35535/): Privilege escalation in Sudo (high 7.4)
- [CVE-2026-35534](https://insights.sbomify.com/CVE-2026-35534/): ChurchCRM has Stored XSS in PersonView.php via Facebook Field Attribute Injection (high 7.6)
- [CVE-2026-35533](https://insights.sbomify.com/CVE-2026-35533/): mise has a local settings bypass config trust checks (high 7.8)
- [CVE-2026-3553](https://insights.sbomify.com/CVE-2026-3553/): Incorrect Authorization in GitLab (low 3.1)
- [CVE-2026-35527](https://insights.sbomify.com/CVE-2026-35527/): Incus blind SSRF via image import preflight HEAD request (medium 5.3)
- [CVE-2026-35526](https://insights.sbomify.com/CVE-2026-35526/): Strawberry GraphQL affected by a Denial of Service via unbounded WebSocket subscriptions (high 7.5)
- [CVE-2026-35525](https://insights.sbomify.com/CVE-2026-35525/): LiquidJS has a root restriction bypass for partial and layout loading through symlinked templates (high 8.2)
- [CVE-2026-35523](https://insights.sbomify.com/CVE-2026-35523/): Authentication bypass in strawberry-graphql via legacy graphql-ws WebSocket subprotocol (high 7.5)
- [CVE-2026-35521](https://insights.sbomify.com/CVE-2026-35521/): Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.hosts Newline Injection (high 8.8)
- [CVE-2026-35520](https://insights.sbomify.com/CVE-2026-35520/): Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.leaseTime Newline Injection (high 8.8)
- [CVE-2026-3552](https://insights.sbomify.com/CVE-2026-3552/): Missing authorization in SurfLink – Link Manager & Backup Restore (medium 4.3)
- [CVE-2026-35519](https://insights.sbomify.com/CVE-2026-35519/): Pi-hole FTL affected by Remote Code Execution (RCE) via dns.hostRecord Newline Injection (high 8.8)
- [CVE-2026-35518](https://insights.sbomify.com/CVE-2026-35518/): Pi-hole FTL affected by Remote Code Execution (RCE) via dns.cnameRecords Newline Injection (high 8.8)
- [CVE-2026-35517](https://insights.sbomify.com/CVE-2026-35517/): Pi-hole FTL affected by Remote Code Execution (RCE) via dns.upstreams Newline Injection (high 8.8)
- [CVE-2026-35516](https://insights.sbomify.com/CVE-2026-35516/): LinkAce has SSRF via CheckLinksCommand - Link URL Update Bypasses laravel-html-meta Protection (medium 5.0)
- [CVE-2026-35515](https://insights.sbomify.com/CVE-2026-35515/): @nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection') (medium 6.3)
- [CVE-2026-35514](https://insights.sbomify.com/CVE-2026-35514/): Unauthenticated Account Registration via /user/invited Bypasses All Signup Restrictions in Chartbrew (medium 6.5)
- [CVE-2026-35512](https://insights.sbomify.com/CVE-2026-35512/): xrdp: Heap buffer overflow in EGFX channel (high 8.7)
- [CVE-2026-3551](https://insights.sbomify.com/CVE-2026-3551/): Cross-site scripting in Custom New User Notification (medium 4.4)
- [CVE-2026-35508](https://insights.sbomify.com/CVE-2026-35508/): Cross-site scripting in Shynet (medium 5.4)
- [CVE-2026-35507](https://insights.sbomify.com/CVE-2026-35507/): Other in Shynet (medium 6.4)
- [CVE-2026-35506](https://insights.sbomify.com/CVE-2026-35506/): Command injection in WRC-BE65QSD-B (high 8.6)
- [CVE-2026-35505](https://insights.sbomify.com/CVE-2026-35505/): OFFIS DCMTK Toolkit Missing Release of Memory after Effective Lifetime (high 8.7)
- [CVE-2026-35504](https://insights.sbomify.com/CVE-2026-35504/): Subnet Solutions PowerSYSTEM Center CRLF injection (medium 5.1)
- [CVE-2026-35503](https://insights.sbomify.com/CVE-2026-35503/): SenseLive X3050 Use of Hard-coded Credentials (critical 9.3)
- [CVE-2026-35502](https://insights.sbomify.com/CVE-2026-35502/): Deserialization in Intel(R) Extension for PyTorch (medium 4.6)
- [CVE-2026-35501](https://insights.sbomify.com/CVE-2026-35501/): Bypass of a configured island trust anchor underneath an insecure parent from an atacker-controlled NSEC record. (low 3.7)
- [CVE-2026-3550](https://insights.sbomify.com/CVE-2026-3550/): RockPress <= 1.0.17 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via AJAX Actions (medium 5.3)
- [CVE-2026-35499](https://insights.sbomify.com/CVE-2026-35499/): Command injection in Totolink (critical 9.1)
- [CVE-2026-35496](https://insights.sbomify.com/CVE-2026-35496/): Path traversal in CubeCart (medium 5.1)
- [CVE-2026-35492](https://insights.sbomify.com/CVE-2026-35492/): Kedro-Datasets has a path traversal vulnerability in PartitionedDataset allows arbitrary file write (medium 6.5)
- [CVE-2026-35491](https://insights.sbomify.com/CVE-2026-35491/): Pi-hole FTL: CLI API sessions can import Teleporter archives and modify configuration (medium 6.1)
- [CVE-2026-35490](https://insights.sbomify.com/CVE-2026-35490/): changedetection.io has an Authentication Bypass via Decorator Ordering (critical 9.8)
- [CVE-2026-3549](https://insights.sbomify.com/CVE-2026-3549/): ECH parsing heap buffer overflow (high 8.3)
- [CVE-2026-35489](https://insights.sbomify.com/CVE-2026-35489/): Tandoor Recipes — `amount`/`unit` bypass serializer in `food/{id}/shopping/` (high 7.3)
- [CVE-2026-35488](https://insights.sbomify.com/CVE-2026-35488/): Tandoor Recipes — CustomIsShared permits DELETE/PUT on RecipeBook by shared (read-only) users (high 8.1)
- [CVE-2026-35487](https://insights.sbomify.com/CVE-2026-35487/): text-generation-webui has a Path Traversal in load_prompt() — .txt file read without authentication (medium 5.3)
- [CVE-2026-35486](https://insights.sbomify.com/CVE-2026-35486/): text-generation-webui has a SSRF in superbooga/superboogav2 extensions — no URL validation (high 7.5)
- [CVE-2026-35485](https://insights.sbomify.com/CVE-2026-35485/): text-generation-webui has a Path Traversal in load_grammar() — arbitrary file read without authentication (high 7.5)
- [CVE-2026-35484](https://insights.sbomify.com/CVE-2026-35484/): text-generation-webui has a Path Traversal in load_preset() — .yaml file read without authentication (medium 5.3)
- [CVE-2026-35483](https://insights.sbomify.com/CVE-2026-35483/): text-generation-webui has a Path Traversal in load_template() — .jinja/.yaml/.yml file read without authentication (medium 5.3)
- [CVE-2026-35482](https://insights.sbomify.com/CVE-2026-35482/): alf.io has an Authenticated RCE via Extension Script Sandbox Escape (high 8.0)
- [CVE-2026-35480](https://insights.sbomify.com/CVE-2026-35480/): go-ipld-prime's DAG-CBOR decoder unbounded memory allocation from CBOR headers (medium 6.2)
- [CVE-2026-3548](https://insights.sbomify.com/CVE-2026-3548/): Buffer overflow in CRL number parsing in wolfSSL (high 7.2)
- [CVE-2026-35479](https://insights.sbomify.com/CVE-2026-35479/): InvenTree Plugin Installation - Insufficient Permissions (medium 6.6)
- [CVE-2026-35478](https://insights.sbomify.com/CVE-2026-35478/): InvenTree has Arbitrary API Token Creation (high 8.3)
- [CVE-2026-35477](https://insights.sbomify.com/CVE-2026-35477/): InvenTree has SSTI in PART_NAME_FORMAT bypasses CVE-2026-27629 fix via {% if part.pk %} sandbox escape (medium 5.5)
- [CVE-2026-35476](https://insights.sbomify.com/CVE-2026-35476/): InvenTree Affected by Privilege Escalation via API (high 7.2)
- [CVE-2026-35475](https://insights.sbomify.com/CVE-2026-35475/): WeGIA - Open Redirect - backup redirection — Unvalidated $_GET['redirect'] (medium 5.1)
- [CVE-2026-35474](https://insights.sbomify.com/CVE-2026-35474/): WeGIA - Open Redirect - atualizacao redirection - Unvalidated $_GET['redirect'] (medium 5.1)
- [CVE-2026-35473](https://insights.sbomify.com/CVE-2026-35473/): WeGIA - Open Redirect - IentradaControle - listarId() - Unvalidated $_GET['nextPage'] (medium 5.1)
- [CVE-2026-35472](https://insights.sbomify.com/CVE-2026-35472/): WeGIA - Open Redirect - EstoqueControle - listarTodos() - Unvalidated $_GET['nextPage'] (medium 5.1)
- [CVE-2026-35471](https://insights.sbomify.com/CVE-2026-35471/): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/689/