# Vulnerabilities published in 2026


- [CVE-2026-34816](https://insights.sbomify.com/CVE-2026-34816/): Endian Firewall /manage/smtpscan/domainrouting/ domain Stored Cross-Site Scripting (medium 5.1)
- [CVE-2026-34815](https://insights.sbomify.com/CVE-2026-34815/): Endian Firewall /cgi-bin/smtpdomains.cgi DOMAIN Stored Cross-Site Scripting (medium 5.1)
- [CVE-2026-34814](https://insights.sbomify.com/CVE-2026-34814/): Endian Firewall /cgi-bin/proxygroup.cgi group Stored Cross-Site Scripting (medium 5.1)
- [CVE-2026-34813](https://insights.sbomify.com/CVE-2026-34813/): Endian Firewall /cgi-bin/proxyuser.cgi user Stored Cross-Site Scripting (medium 5.1)
- [CVE-2026-34812](https://insights.sbomify.com/CVE-2026-34812/): Endian Firewall /cgi-bin/proxypolicy.cgi mimetypes Stored Cross-Site Scripting (medium 5.1)
- [CVE-2026-34811](https://insights.sbomify.com/CVE-2026-34811/): Endian Firewall /cgi-bin/xtaccess.cgi remark Stored Cross-Site Scripting (medium 5.1)
- [CVE-2026-34810](https://insights.sbomify.com/CVE-2026-34810/): Endian Firewall /cgi-bin/vpnfw.cgi remark Stored Cross-Site Scripting (medium 5.1)
- [CVE-2026-3481](https://insights.sbomify.com/CVE-2026-3481/): WP Blockade <= 0.9.14 - Reflected Cross-Site Scripting via 'shortcode' Parameter (medium 6.1)
- [CVE-2026-34809](https://insights.sbomify.com/CVE-2026-34809/): Endian Firewall /cgi-bin/zonefw.cgi remark Stored Cross-Site Scripting (medium 5.1)
- [CVE-2026-34808](https://insights.sbomify.com/CVE-2026-34808/): Endian Firewall /cgi-bin/outgoingfw.cgi remark Stored Cross-Site Scripting (medium 5.1)
- [CVE-2026-34807](https://insights.sbomify.com/CVE-2026-34807/): Endian Firewall /cgi-bin/incoming.cgi remark Stored Cross-Site Scripting (medium 5.1)
- [CVE-2026-34806](https://insights.sbomify.com/CVE-2026-34806/): Endian Firewall /cgi-bin/snat.cgi remark Stored Cross-Site Scripting (medium 5.1)
- [CVE-2026-34805](https://insights.sbomify.com/CVE-2026-34805/): Endian Firewall /cgi-bin/dnat.cgi remark Stored Cross-Site Scripting (medium 5.1)
- [CVE-2026-34804](https://insights.sbomify.com/CVE-2026-34804/): Endian Firewall /manage/qos/rules/ dscp Stored Cross-Site Scripting (medium 5.1)
- [CVE-2026-34803](https://insights.sbomify.com/CVE-2026-34803/): Endian Firewall /manage/qos/classes/ name Stored Cross-Site Scripting (medium 5.1)
- [CVE-2026-34802](https://insights.sbomify.com/CVE-2026-34802/): Endian Firewall /cgi-bin/salearn.cgi remark user ham spam Stored Cross-Site Scripting (medium 5.1)
- [CVE-2026-34801](https://insights.sbomify.com/CVE-2026-34801/): Endian Firewall /manage/dhcp/fixed_leases/ remark Stored Cross-Site Scripting (medium 5.1)
- [CVE-2026-34800](https://insights.sbomify.com/CVE-2026-34800/): Endian Firewall /cgi-bin/uplinkeditor.cgi NAME Stored Cross-Site Scripting (medium 5.1)
- [CVE-2026-3480](https://insights.sbomify.com/CVE-2026-3480/): Missing authorization in WP Blockade – Visual Page Builder (medium 6.5)
- [CVE-2026-34799](https://insights.sbomify.com/CVE-2026-34799/): Endian Firewall /manage/dnsmasq/hosts/ remark Stored Cross-Site Scripting (medium 5.1)
- [CVE-2026-34798](https://insights.sbomify.com/CVE-2026-34798/): Endian Firewall /cgi-bin/routing.cgi remark Stored Cross-Site Scripting (medium 5.1)
- [CVE-2026-34797](https://insights.sbomify.com/CVE-2026-34797/): Endian Firewall /cgi-bin/logs_smtp.cgi DATE Perl Command Injection (high 8.7)
- [CVE-2026-34796](https://insights.sbomify.com/CVE-2026-34796/): Endian Firewall /cgi-bin/logs_openvpn.cgi DATE Perl Command Injection (high 8.7)
- [CVE-2026-34795](https://insights.sbomify.com/CVE-2026-34795/): Endian Firewall /cgi-bin/logs_log.cgi DATE Perl Command Injection (high 8.7)
- [CVE-2026-34794](https://insights.sbomify.com/CVE-2026-34794/): Endian Firewall /cgi-bin/logs_ids.cgi DATE Perl Command Injection (high 8.7)
- [CVE-2026-34793](https://insights.sbomify.com/CVE-2026-34793/): Endian Firewall /cgi-bin/logs_firewall.cgi DATE Perl Command Injection (high 8.7)
- [CVE-2026-34792](https://insights.sbomify.com/CVE-2026-34792/): Endian Firewall /cgi-bin/logs_clamav.cgi DATE Perl Command Injection (high 8.7)
- [CVE-2026-34791](https://insights.sbomify.com/CVE-2026-34791/): Endian Firewall /cgi-bin/logs_proxy.cgi DATE Perl Command Injection (high 8.7)
- [CVE-2026-34790](https://insights.sbomify.com/CVE-2026-34790/): Endian Firewall /cgi-bin/backup.cgi remove ARCHIVE Directory Traversal (high 7.1)
- [CVE-2026-3479](https://insights.sbomify.com/CVE-2026-3479/): pkgutil.get_data() does not enforce documented restrictions (not scored)
- [CVE-2026-34789](https://insights.sbomify.com/CVE-2026-34789/): FreeCAD: Arbitrary code execution via unsandboxed PyImport_ImportModule in PropertyPythonObject::Restore (high 7.0)
- [CVE-2026-34788](https://insights.sbomify.com/CVE-2026-34788/): Emlog: SQL Injection in tag_model::updateTagName() via unsanitized parameters (medium 6.5)
- [CVE-2026-34787](https://insights.sbomify.com/CVE-2026-34787/): Emlog: Local File Inclusion in plugin.php via unsanitized plugin parameter (medium 6.5)
- [CVE-2026-34786](https://insights.sbomify.com/CVE-2026-34786/): Rack: Rack::Static header_rules bypass via URL-encoded paths (medium 5.3)
- [CVE-2026-34785](https://insights.sbomify.com/CVE-2026-34785/): Rack: Local file inclusion in `Rack::Static` via URL Prefix Matching (high 7.5)
- [CVE-2026-34784](https://insights.sbomify.com/CVE-2026-34784/): Parse Server: Streaming file download bypasses afterFind file trigger authorization (high 8.2)
- [CVE-2026-34783](https://insights.sbomify.com/CVE-2026-34783/): Ferret has a Path Traversal in IO::FS::WRITE allows arbitrary file write when scraping malicious websites (high 8.1)
- [CVE-2026-34782](https://insights.sbomify.com/CVE-2026-34782/): Zammad has improper access control in AI assistance controller for text tools (medium 5.3)
- [CVE-2026-34781](https://insights.sbomify.com/CVE-2026-34781/): Electron crashes in clipboard.readImage() on malformed clipboard image data (low 2.8)
- [CVE-2026-34780](https://insights.sbomify.com/CVE-2026-34780/): Electron: Context Isolation bypass via contextBridge VideoFrame transfer (high 8.4)
- [CVE-2026-3478](https://insights.sbomify.com/CVE-2026-3478/): Content Syndication Toolkit <= 1.3 - Unauthenticated Server-Side Request Forgery via 'url' Parameter (high 7.2)
- [CVE-2026-34779](https://insights.sbomify.com/CVE-2026-34779/): Electron: AppleScript injection in app.moveToApplicationsFolder on macOS (medium 6.5)
- [CVE-2026-34778](https://insights.sbomify.com/CVE-2026-34778/): Electron: Service worker can spoof executeJavaScript IPC replies (medium 5.9)
- [CVE-2026-34777](https://insights.sbomify.com/CVE-2026-34777/): Electron: Incorrect origin passed to permission request handler for iframe requests (medium 5.4)
- [CVE-2026-34776](https://insights.sbomify.com/CVE-2026-34776/): Electron: Out-of-bounds read in second-instance IPC on macOS and Linux (medium 5.3)
- [CVE-2026-34775](https://insights.sbomify.com/CVE-2026-34775/): Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes (medium 6.8)
- [CVE-2026-34774](https://insights.sbomify.com/CVE-2026-34774/): Electron: Use-after-free in offscreen child window paint callback (high 8.1)
- [CVE-2026-34773](https://insights.sbomify.com/CVE-2026-34773/): Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows (medium 4.7)
- [CVE-2026-34772](https://insights.sbomify.com/CVE-2026-34772/): Electron: Use-after-free in download save dialog callback (medium 5.8)
- [CVE-2026-34771](https://insights.sbomify.com/CVE-2026-34771/): Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks (high 7.5)
- [CVE-2026-34770](https://insights.sbomify.com/CVE-2026-34770/): Electron: Use-after-free in PowerMonitor on Windows and macOS (high 7.0)
- [CVE-2026-3477](https://insights.sbomify.com/CVE-2026-3477/): PZ Frontend Manager <= 1.0.6 - Missing Authorization to Arbitrary User Deletion via 'dataType' Parameter (medium 5.3)
- [CVE-2026-34769](https://insights.sbomify.com/CVE-2026-34769/): Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference (high 7.8)
- [CVE-2026-34768](https://insights.sbomify.com/CVE-2026-34768/): Electron: Unquoted executable path in app.setLoginItemSettings on Windows (low 3.9)
- [CVE-2026-34767](https://insights.sbomify.com/CVE-2026-34767/): Electron: HTTP Response Header Injection in custom protocol handlers and webRequest (medium 5.9)
- [CVE-2026-34766](https://insights.sbomify.com/CVE-2026-34766/): Electron: USB device selection not validated against filtered device list (low 3.3)
- [CVE-2026-34765](https://insights.sbomify.com/CVE-2026-34765/): Electron named window.open targets not scoped to the opener's browsing context (medium 6.0)
- [CVE-2026-34764](https://insights.sbomify.com/CVE-2026-34764/): Electron has a use-after-free in offscreen shared texture release() callback (low 2.3)
- [CVE-2026-34763](https://insights.sbomify.com/CVE-2026-34763/): Rack: Rack::Directory info disclosure and DoS via unescaped regex interpolation (medium 5.3)
- [CVE-2026-34762](https://insights.sbomify.com/CVE-2026-34762/): Ella Core Has Audit Log Falsification via Path/Body IMSI Mismatch in UpdateSubscriber (low 2.7)
- [CVE-2026-34761](https://insights.sbomify.com/CVE-2026-34761/): Ella Core Panics Upon NGAP handover failure (medium 5.8)
- [CVE-2026-34760](https://insights.sbomify.com/CVE-2026-34760/): vLLM: Downmix Implementation Differences as Attack Vectors Against Audio AI Models (medium 5.9)
- [CVE-2026-3476](https://insights.sbomify.com/CVE-2026-3476/): Code Injection vulnerability affecting SOLIDWORKS Desktop from Release 2025 through Release 2026 (high 7.8)
- [CVE-2026-34759](https://insights.sbomify.com/CVE-2026-34759/): Missing authorization in oneuptime (critical 9.2)
- [CVE-2026-34758](https://insights.sbomify.com/CVE-2026-34758/): OneUptime: Missing Authentication on Notification Endpoints (critical 9.1)
- [CVE-2026-34757](https://insights.sbomify.com/CVE-2026-34757/): Use after free in libpng (medium 5.1)
- [CVE-2026-34756](https://insights.sbomify.com/CVE-2026-34756/): vLLM Affected by Unauthenticated OOM Denial of Service via Unbounded `n` Parameter in OpenAI API Server (medium 6.5)
- [CVE-2026-34755](https://insights.sbomify.com/CVE-2026-34755/): vLLM Affected by Denial of Service via Unbounded Frame Count in video/jpeg Base64 Processing (medium 6.5)
- [CVE-2026-34754](https://insights.sbomify.com/CVE-2026-34754/): MantisBT allows unauthorized users to upload attachments to restricted issues via REST API (medium 4.3)
- [CVE-2026-34753](https://insights.sbomify.com/CVE-2026-34753/): vLLM affected by Server-Side Request Forgery (SSRF) in `download_bytes_from_url ` (medium 5.4)
- [CVE-2026-34752](https://insights.sbomify.com/CVE-2026-34752/): Haraka affected by DoS via `__proto__` email header (high 8.7)
- [CVE-2026-34751](https://insights.sbomify.com/CVE-2026-34751/): Payload has Unvalidated Input in Password Recovery Endpoints (critical 9.1)
- [CVE-2026-34750](https://insights.sbomify.com/CVE-2026-34750/): Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints (medium 6.5)
- [CVE-2026-3475](https://insights.sbomify.com/CVE-2026-3475/): Instant Popup Builder <= 1.1.7 - Unauthenticated Arbitrary Shortcode Execution via 'token' Parameter (medium 5.3)
- [CVE-2026-34749](https://insights.sbomify.com/CVE-2026-34749/): Payload has a CSRF Protection Bypass in Authentication Flow (medium 5.4)
- [CVE-2026-34748](https://insights.sbomify.com/CVE-2026-34748/): @payloadcms/next has Stored XSS in Admin Panel (high 8.7)
- [CVE-2026-34747](https://insights.sbomify.com/CVE-2026-34747/): Payload has an SQL Injection via Query Handling (high 8.5)
- [CVE-2026-34746](https://insights.sbomify.com/CVE-2026-34746/): Payload has Authenticated SSRF via Upload Functionality (high 7.7)
- [CVE-2026-34745](https://insights.sbomify.com/CVE-2026-34745/): Unauthenticated Path Traversal Arbitrary File Write in /api/uploadChunked/public (critical 9.1)
- [CVE-2026-34744](https://insights.sbomify.com/CVE-2026-34744/): MantisBT authorization bypass allows continued access to self-uploaded attachments on private issues (medium 5.3)
- [CVE-2026-34743](https://insights.sbomify.com/CVE-2026-34743/): XZ Utils: Buffer overflow in lzma_index_append() (low 1.7)
- [CVE-2026-34742](https://insights.sbomify.com/CVE-2026-34742/): Model Context Protocol Go SDK: DNS Rebinding Protection Disabled by Default for Servers Running on Localhost (high 7.6)
- [CVE-2026-34741](https://insights.sbomify.com/CVE-2026-34741/): Combodo iTop: Authentication bypass in exec.php allows PHP file execution (high 8.6)
- [CVE-2026-34740](https://insights.sbomify.com/CVE-2026-34740/): AVideo: Stored SSRF via Video EPG Link Missing isSSRFSafeURL() Validation (medium 6.5)
- [CVE-2026-3474](https://insights.sbomify.com/CVE-2026-3474/): EmailKit <= 1.6.3 - Authenticated (Administrator+) Path Traversal via 'emailkit-editor-template' REST API Parameter (medium 4.9)
- [CVE-2026-34739](https://insights.sbomify.com/CVE-2026-34739/): AVideo: Reflected XSS via Unescaped ip Parameter in User_Location testIP.php (medium 6.1)
- [CVE-2026-34738](https://insights.sbomify.com/CVE-2026-34738/): AVideo: Video Publishing Workflow Bypass via Unauthorized overrideStatus Request Parameter (medium 4.3)
- [CVE-2026-34737](https://insights.sbomify.com/CVE-2026-34737/): AVideo: Arbitrary Stripe Subscription Cancellation via Debug Endpoint and retrieveSubscriptions() Bug (medium 6.5)
- [CVE-2026-34736](https://insights.sbomify.com/CVE-2026-34736/): Open edX Platform: Account Activation Bypass via activation_key Exposure in REST API (medium 5.3)
- [CVE-2026-34735](https://insights.sbomify.com/CVE-2026-34735/): Hytale Modding Vulnerable to Remote Code Execution via File Upload Bypass in `FileController` (high 8.7)
- [CVE-2026-34734](https://insights.sbomify.com/CVE-2026-34734/): HDF5: H5T__conv_struct Use After Free (high 7.8)
- [CVE-2026-34733](https://insights.sbomify.com/CVE-2026-34733/): AVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI Guard (medium 6.5)
- [CVE-2026-34732](https://insights.sbomify.com/CVE-2026-34732/): AVideo: Missing Authentication in CreatePlugin list.json.php Template Affects 21 Endpoints (medium 5.3)
- [CVE-2026-34731](https://insights.sbomify.com/CVE-2026-34731/): AVideo: Unauthenticated Live Stream Termination via RTMP Callback on_publish_done.php (high 7.5)
- [CVE-2026-34730](https://insights.sbomify.com/CVE-2026-34730/): Copier `_external_data` allows path traversal and absolute-path local file read without unsafe mode (medium 5.5)
- [CVE-2026-3473](https://insights.sbomify.com/CVE-2026-3473/): Improper file ownership validation in the Boards API allows unauthorised file access (medium 5.9)
- [CVE-2026-34729](https://insights.sbomify.com/CVE-2026-34729/): phpMyFAQ: Stored XSS via Regex Bypass in Filter::removeAttributes() (medium 6.1)
- [CVE-2026-34728](https://insights.sbomify.com/CVE-2026-34728/): phpMyFAQ: Path Traversal - Arbitrary File Deletion in MediaBrowserController (high 8.7)
- [CVE-2026-34727](https://insights.sbomify.com/CVE-2026-34727/): Vikunja ahs a TOTP Two-Factor Authentication Bypass via OIDC Login Path (high 7.4)
- [CVE-2026-34726](https://insights.sbomify.com/CVE-2026-34726/): Copier `_subdirectory` allows template root escape via parent-directory traversal (medium 4.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/696/