# Vulnerabilities published in 2026


- [CVE-2026-35038](https://insights.sbomify.com/CVE-2026-35038/): signalk-server: Arbitrary Prototype Read via `from` Field Bypass (low 2.1)
- [CVE-2026-35037](https://insights.sbomify.com/CVE-2026-35037/): Ech0 affected by unauthenticated SSRF in GetWebsiteTitle allows access to internal services and cloud metadata (high 7.2)
- [CVE-2026-35036](https://insights.sbomify.com/CVE-2026-35036/): Ech0 Affected by Unauthenticated Server-Side Request Forgery in Website Preview Feature (high 7.5)
- [CVE-2026-35035](https://insights.sbomify.com/CVE-2026-35035/): CI4MS: Company Information Public-Facing Page Full Platform Compromise & Full Account Takeover for All Roles & Privilege-Escalation via System Settings Company Information Stored DOM XSS (high 7.2)
- [CVE-2026-35034](https://insights.sbomify.com/CVE-2026-35034/): Jellyfin: Potential Application DoS from excessively large SyncPlay group names (medium 6.5)
- [CVE-2026-35033](https://insights.sbomify.com/CVE-2026-35033/): Jellyfin: Potential SSRF + Arbitrary file read via stream argument injection (critical 9.3)
- [CVE-2026-35032](https://insights.sbomify.com/CVE-2026-35032/): Jellyfin: Potential SSRF + Arbitrary file read via LiveTV M3U tuner (high 8.6)
- [CVE-2026-35031](https://insights.sbomify.com/CVE-2026-35031/): Jellyfin: Potential RCE via subtitle upload path traversal + .strm chain (critical 10.0)
- [CVE-2026-35030](https://insights.sbomify.com/CVE-2026-35030/): LiteLLM has an authentication bypass via OIDC userinfo cache key collision (critical 9.4)
- [CVE-2026-3503](https://insights.sbomify.com/CVE-2026-3503/): Fault injection attack with ML-DSA and ML-KEM on ARM (medium 4.3)
- [CVE-2026-35029](https://insights.sbomify.com/CVE-2026-35029/): LiteLLM affected by privilege escalation via unrestricted proxy configuration endpoint (high 8.7)
- [CVE-2026-35025](https://insights.sbomify.com/CVE-2026-35025/): ProFTPD ACL Bypass via /proc/self/root Path Prefix in RNFR (high 8.6)
- [CVE-2026-35023](https://insights.sbomify.com/CVE-2026-35023/): Wimi Teamwork On-Premises < 8.2.0 IDOR via preview.php (medium 5.3)
- [CVE-2026-3502](https://insights.sbomify.com/CVE-2026-3502/): TrueConf Client Download of Code Without Integrity Check (high 7.8, exploited in the wild)
- [CVE-2026-35019](https://insights.sbomify.com/CVE-2026-35019/): NetComm NF20MESH < R6B032 Hardcoded AES Key Authentication Bypass (critical 9.2)
- [CVE-2026-35018](https://insights.sbomify.com/CVE-2026-35018/): NetComm NF20MESH < R6B032 Authenticated RCE via OS Command Injection (high 8.7)
- [CVE-2026-35016](https://insights.sbomify.com/CVE-2026-35016/): Open ISES Tickets < 3.44.2 Reflected XSS via search.php frm_query Parameter (medium 5.1)
- [CVE-2026-35015](https://insights.sbomify.com/CVE-2026-35015/): Open ISES Tickets < 3.44.2 Reflected XSS via do_unit_mail.php the_ticket Parameter (medium 5.1)
- [CVE-2026-35014](https://insights.sbomify.com/CVE-2026-35014/): Open ISES Tickets < 3.44.2 Reflected XSS via routes_nm.php ticket_id Parameter (medium 5.1)
- [CVE-2026-35013](https://insights.sbomify.com/CVE-2026-35013/): Open ISES Tickets < 3.44.2 Reflected XSS via street_view.php thelat and thelng Parameters (medium 5.1)
- [CVE-2026-35012](https://insights.sbomify.com/CVE-2026-35012/): Open ISES Tickets < 3.44.2 Reflected XSS via add_facnote.php ticket_id Parameter (medium 5.1)
- [CVE-2026-35011](https://insights.sbomify.com/CVE-2026-35011/): Open ISES Tickets < 3.44.2 Reflected XSS via opena.php frm_call Parameter (medium 5.1)
- [CVE-2026-35010](https://insights.sbomify.com/CVE-2026-35010/): Open ISES Tickets < 3.44.2 Reflected XSS via patient_JF.php ticket_id Parameter (medium 5.1)
- [CVE-2026-35009](https://insights.sbomify.com/CVE-2026-35009/): Open ISES Tickets < 3.44.2 Reflected XSS via add_note.php ticket_id Parameter (medium 5.1)
- [CVE-2026-35008](https://insights.sbomify.com/CVE-2026-35008/): Open ISES Tickets < 3.44.2 Reflected XSS via single.php ticket_id Parameter (medium 5.1)
- [CVE-2026-35007](https://insights.sbomify.com/CVE-2026-35007/): Open ISES Tickets < 3.44.2 Reflected XSS via single_unit.php id Parameter (medium 5.1)
- [CVE-2026-35002](https://insights.sbomify.com/CVE-2026-35002/): Agno < 2.3.24 field_type Eval Injection Arbitrary Code Execution (critical 9.3)
- [CVE-2026-35001](https://insights.sbomify.com/CVE-2026-35001/): OpenS100 S-102 Parser Integer Overflow Heap Buffer Overflow (high 7.1)
- [CVE-2026-35000](https://insights.sbomify.com/CVE-2026-35000/): ChangeDetection.io < 0.54.7 SafeXPath3Parser Bypass Arbitrary File Read (high 7.1)
- [CVE-2026-34999](https://insights.sbomify.com/CVE-2026-34999/): OpenViking 0.2.5 < 0.2.14 Bot Proxy Endpoints Allow Unauthenticated Access (medium 6.9)
- [CVE-2026-34993](https://insights.sbomify.com/CVE-2026-34993/): AIOHTTP Vulnerable to Deserialization of Untrusted Data (medium 6.4)
- [CVE-2026-34992](https://insights.sbomify.com/CVE-2026-34992/): Missing Encryption of Sensitive Data in antrea.io/antrea (high 7.1)
- [CVE-2026-34990](https://insights.sbomify.com/CVE-2026-34990/): OpenPrinting CUPS: Local print admin token disclosure using temporary printers (medium 5.0)
- [CVE-2026-3499](https://insights.sbomify.com/CVE-2026-3499/): Cross-site request forgery in Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce (high 8.8)
- [CVE-2026-34989](https://insights.sbomify.com/CVE-2026-34989/): CI4MS: Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS (critical 9.4)
- [CVE-2026-34988](https://insights.sbomify.com/CVE-2026-34988/): Wasmtime leaks data between pooling allocator instances (low 2.3)
- [CVE-2026-34987](https://insights.sbomify.com/CVE-2026-34987/): Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access (critical 9.0)
- [CVE-2026-34986](https://insights.sbomify.com/CVE-2026-34986/): Go JOSE affect by a panic in JWE decryption (high 7.5)
- [CVE-2026-34985](https://insights.sbomify.com/CVE-2026-34985/): LORIS has incorrect access checks in media module (medium 6.3)
- [CVE-2026-34984](https://insights.sbomify.com/CVE-2026-34984/): External Secrets Operator has DNS exfiltration via getHostByName in its v2 template engine (high 7.1)
- [CVE-2026-34983](https://insights.sbomify.com/CVE-2026-34983/): Wasmtime has a use-after-free bug after cloning `wasmtime::Linker` (low 1.0)
- [CVE-2026-34982](https://insights.sbomify.com/CVE-2026-34982/): Vim modeline bypass via various options affects Vim < 9.2.0276 (high 8.2)
- [CVE-2026-34981](https://insights.sbomify.com/CVE-2026-34981/): whisperX REST API: SSRF in download_from_url() — URL validation happens after HTTP request, extension bypass via .mp3 (medium 5.8)
- [CVE-2026-34980](https://insights.sbomify.com/CVE-2026-34980/): OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network (medium 6.1)
- [CVE-2026-3498](https://insights.sbomify.com/CVE-2026-3498/): BlockArt Blocks <= 2.2.15 - Authenticated (Author+) Stored Cross-Site Scripting via 'clientId' Block Attribute (medium 6.4)
- [CVE-2026-34979](https://insights.sbomify.com/CVE-2026-34979/): OpenPrinting CUPS: Heap overflow in `get_options()` (medium 5.3)
- [CVE-2026-34978](https://insights.sbomify.com/CVE-2026-34978/): Path traversal in cups (medium 6.5)
- [CVE-2026-34977](https://insights.sbomify.com/CVE-2026-34977/): Aperi'Solve Affected by Unauthenticated RCE via JPSeek Analyzer Command (critical 9.3)
- [CVE-2026-34976](https://insights.sbomify.com/CVE-2026-34976/): Dgraph Affected by Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization (critical 10.0)
- [CVE-2026-34975](https://insights.sbomify.com/CVE-2026-34975/): Other in plunk (high 8.5)
- [CVE-2026-34974](https://insights.sbomify.com/CVE-2026-34974/): phpMyFAQ: SVG Sanitizer Bypass via HTML Entity Encoding leads to Stored XSS and Privilege Escalation (medium 5.4)
- [CVE-2026-34973](https://insights.sbomify.com/CVE-2026-34973/): phpMyFAQ has a LIKE Wildcard Injection in Search.php — Unescaped % and _ Metacharacters Enable Broad Content Disclosure (medium 6.9)
- [CVE-2026-34972](https://insights.sbomify.com/CVE-2026-34972/): OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision (medium 5.0)
- [CVE-2026-34971](https://insights.sbomify.com/CVE-2026-34971/): Wasmtime miscompiled guest heap access enables sandbox escape on aarch64 Cranelift (critical 9.0)
- [CVE-2026-34970](https://insights.sbomify.com/CVE-2026-34970/): MantisBT Bugnote Revision Page Leaks Private Issue Metadata After Issue Access Is Revoked (medium 5.3)
- [CVE-2026-3497](https://insights.sbomify.com/CVE-2026-3497/): Memory corruption in openssh (low 2.7)
- [CVE-2026-34969](https://insights.sbomify.com/CVE-2026-34969/): Nhost Leaks the Refresh Token via URL Query Parameter in OAuth Provider Callback (low 2.3)
- [CVE-2026-34968](https://insights.sbomify.com/CVE-2026-34968/): Adminer before 5.4.3 Arbitrary File Deletion via SQLite Drop (high 7.2)
- [CVE-2026-34967](https://insights.sbomify.com/CVE-2026-34967/): Adminer sql-log Plugin 5.3.0 through 5.4.2 Arbitrary File Write (medium 5.3)
- [CVE-2026-34966](https://insights.sbomify.com/CVE-2026-34966/): Gitea prior to 1.27.0 SSRF via Migration URI Fetch Bypass (high 8.3)
- [CVE-2026-34965](https://insights.sbomify.com/CVE-2026-34965/): Cockpit CMS Authenticated Remote Code Execution via Collections (high 8.7)
- [CVE-2026-34964](https://insights.sbomify.com/CVE-2026-34964/): Adminer before 5.5.0 SSRF via PDO DSN Injection (medium 6.9)
- [CVE-2026-34963](https://insights.sbomify.com/CVE-2026-34963/): barebox EFI PE Loader Memory Safety Vulnerabilities (high 8.6)
- [CVE-2026-34962](https://insights.sbomify.com/CVE-2026-34962/): barebox ext4 Directory Parsing Infinite Loop Denial of Service (medium 6.9)
- [CVE-2026-34961](https://insights.sbomify.com/CVE-2026-34961/): barebox ext4 Extent Parsing Out-of-Bounds Read (medium 6.9)
- [CVE-2026-34960](https://insights.sbomify.com/CVE-2026-34960/): barebox Out-of-Bounds Read in DHCP Option Parsing (high 7.1)
- [CVE-2026-3496](https://insights.sbomify.com/CVE-2026-3496/): JetBooking <= 4.0.3 - Unauthenticated SQL Injection via 'check_in_date' Parameter (high 7.5)
- [CVE-2026-34959](https://insights.sbomify.com/CVE-2026-34959/): Adminer before 5.5.0 Open Redirect via X-Forwarded-Prefix (medium 5.3)
- [CVE-2026-34956](https://insights.sbomify.com/CVE-2026-34956/): Openvswitch: open vswitch: denial of service via malformed ftp epasv command (medium 5.9)
- [CVE-2026-34955](https://insights.sbomify.com/CVE-2026-34955/): PraisonAI: Sandbox Escape via shell=True and Bypassable Blocklist in SubprocessSandbox (high 8.8)
- [CVE-2026-34954](https://insights.sbomify.com/CVE-2026-34954/): PraisonAI: SSRF in FileTools.download_file() via Unvalidated URL (high 8.6)
- [CVE-2026-34953](https://insights.sbomify.com/CVE-2026-34953/): PraisonAI: Authentication Bypass in OAuthManager.validate_token() (critical 9.1)
- [CVE-2026-34952](https://insights.sbomify.com/CVE-2026-34952/): PraisonAI: Missing Authentication in WebSocket Gateway (critical 9.1)
- [CVE-2026-34951](https://insights.sbomify.com/CVE-2026-34951/): Reflected XSS in footer.php in Workbench Allows Attackers to Hijack Authenticated Sessions (medium 5.1)
- [CVE-2026-34950](https://insights.sbomify.com/CVE-2026-34950/): fast-jwt has an incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key (critical 9.1)
- [CVE-2026-3495](https://insights.sbomify.com/CVE-2026-3495/): Unescaped variables during error page composition (low 3.8)
- [CVE-2026-34949](https://insights.sbomify.com/CVE-2026-34949/): Combodo iTop: Unauthenticated user can delete .readonly file (medium 6.5)
- [CVE-2026-34948](https://insights.sbomify.com/CVE-2026-34948/): Combodo iTop: Access control bypass via OQL joins (high 7.7)
- [CVE-2026-34947](https://insights.sbomify.com/CVE-2026-34947/): Discourse: Staged user custom fields are exposed on public invite pages (low 2.7)
- [CVE-2026-34946](https://insights.sbomify.com/CVE-2026-34946/): Wasmtime's host panics when Winch compiler executes `table.fill` (medium 5.9)
- [CVE-2026-34945](https://insights.sbomify.com/CVE-2026-34945/): Wasmtime leaks host data with 64-bit tables and Winch (low 2.3)
- [CVE-2026-34944](https://insights.sbomify.com/CVE-2026-34944/): Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on x86-64 (medium 4.1)
- [CVE-2026-34943](https://insights.sbomify.com/CVE-2026-34943/): Wasmtime panics when lifting `flags` component value (medium 5.6)
- [CVE-2026-34942](https://insights.sbomify.com/CVE-2026-34942/): Wasmtime panics when transcoding misaligned utf-16 strings (medium 5.9)
- [CVE-2026-34941](https://insights.sbomify.com/CVE-2026-34941/): Wasmtime has a Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding (medium 6.9)
- [CVE-2026-34940](https://insights.sbomify.com/CVE-2026-34940/): KubeAI: OS Command Injection via Model URL in Ollama Engine startup probe allows arbitrary command execution in model pods (high 8.7)
- [CVE-2026-3494](https://insights.sbomify.com/CVE-2026-3494/): MariaDB Server Audit Plugin Comment Handling Bypass (medium 5.3)
- [CVE-2026-34939](https://insights.sbomify.com/CVE-2026-34939/): PraisonAI: ReDoS via Unvalidated User-Controlled Regex in MCPToolIndex.search_tools() (medium 6.5)
- [CVE-2026-34938](https://insights.sbomify.com/CVE-2026-34938/): PraisonAI: Python Sandbox Escape via str Subclass startswith() Override in execute_code (critical 10.0)
- [CVE-2026-34937](https://insights.sbomify.com/CVE-2026-34937/): PraisonAI: Shell Injection in run_python() via Unescaped $() Substitution (high 7.8)
- [CVE-2026-34936](https://insights.sbomify.com/CVE-2026-34936/): PraisonAI: SSRF via Unvalidated api_base in passthrough() Fallback (high 7.7)
- [CVE-2026-34935](https://insights.sbomify.com/CVE-2026-34935/): PraisonAI: OS Command Injection in MCPHandler.parse_mcp_command() (critical 9.8)
- [CVE-2026-34934](https://insights.sbomify.com/CVE-2026-34934/): PraisonAI: Second-Order SQL Injection in `get_all_user_threads` (critical 9.8)
- [CVE-2026-34933](https://insights.sbomify.com/CVE-2026-34933/): Avahi: Reachable assertion in `transport_flags_from_domain()` via conflicting publish flags crashes avahi-daemon (medium 5.5)
- [CVE-2026-34932](https://insights.sbomify.com/CVE-2026-34932/): hoppscotch: Stored XSS via mock server responses on backend origin (high 8.5)
- [CVE-2026-34931](https://insights.sbomify.com/CVE-2026-34931/): hoppscotch: Improper loopback redirect_uri validation in device-login flow (high 8.5)
- [CVE-2026-34930](https://insights.sbomify.com/CVE-2026-34930/): Privilege escalation in TrendAI Apex One (high 7.8)
- [CVE-2026-34929](https://insights.sbomify.com/CVE-2026-34929/): Privilege escalation in TrendAI Apex One (high 7.8)
- [CVE-2026-34928](https://insights.sbomify.com/CVE-2026-34928/): Privilege escalation in TrendAI Apex One (high 7.8)
- [CVE-2026-34927](https://insights.sbomify.com/CVE-2026-34927/): Privilege escalation in TrendAI Apex One (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/694/