# Vulnerabilities published in 2026


- [CVE-2026-34219](https://insights.sbomify.com/CVE-2026-34219/): libp2p-gossipsub: Gossipsub PRUNE Backoff Heartbeat Instant Overflow (high 8.2)
- [CVE-2026-34218](https://insights.sbomify.com/CVE-2026-34218/): ClearanceKit: Managed and user-defined policy rules not enforced between opfilter start and first policy modification (medium 6.3)
- [CVE-2026-34217](https://insights.sbomify.com/CVE-2026-34217/): SandboxJS has a Sandbox Escape via Prop Object Leak in New Handler (medium 6.9)
- [CVE-2026-34216](https://insights.sbomify.com/CVE-2026-34216/): CtrlPanel: Authenticated Remote Code Execution via Dynamic Class Instantiation in SettingsController.php (medium 6.6)
- [CVE-2026-34215](https://insights.sbomify.com/CVE-2026-34215/): Parse Server: Auth data exposed via verify password endpoint (high 8.2)
- [CVE-2026-34214](https://insights.sbomify.com/CVE-2026-34214/): Trino: Iceberg REST catalog static and vended credentials are accessible via query JSON (high 7.7)
- [CVE-2026-34213](https://insights.sbomify.com/CVE-2026-34213/): Docmost has cross-page attachment overwrite via flawed attachmentId overwrite validation (medium 5.4)
- [CVE-2026-34212](https://insights.sbomify.com/CVE-2026-34212/): Docmost page content has stored XSS via unsanitized attachment URLs (medium 5.4)
- [CVE-2026-34211](https://insights.sbomify.com/CVE-2026-34211/): SandboxJS: Stack overflow DoS via deeply nested expressions in recursive descent parser (medium 6.9)
- [CVE-2026-34210](https://insights.sbomify.com/CVE-2026-34210/): mppx has Stripe charge credential replay via missing idempotency check (medium 6.0)
- [CVE-2026-34209](https://insights.sbomify.com/CVE-2026-34209/): mppx: Tempo has a session close voucher bypass vulnerability due to settled amount equality (high 7.5)
- [CVE-2026-34208](https://insights.sbomify.com/CVE-2026-34208/): SandboxJS: Sandbox integrity escape (critical 10.0)
- [CVE-2026-34207](https://insights.sbomify.com/CVE-2026-34207/): TypeBot: SSRF Protection Bypass via DNS-Resolved Hostnames in Webhook / HTTP Request Validation (high 7.6)
- [CVE-2026-34206](https://insights.sbomify.com/CVE-2026-34206/): Captcha Protect: Reflected XSS in challenge page via unsanitized destination rendered with text/template (medium 6.1)
- [CVE-2026-34205](https://insights.sbomify.com/CVE-2026-34205/): Home Assistant: Unauthenticated App (Add-on) Endpoints Exposed to Local Network via Host Network Mode (critical 9.7)
- [CVE-2026-34204](https://insights.sbomify.com/CVE-2026-34204/): MinIO is Vulnerable to SSE Metadata Injection via Replication Headers (high 7.1)
- [CVE-2026-34203](https://insights.sbomify.com/CVE-2026-34203/): Nautobot: Management of users via REST API does not apply configured password validators (low 2.7)
- [CVE-2026-34202](https://insights.sbomify.com/CVE-2026-34202/): Zebra node crash — V5 transaction hash panic (P2P reachable) (critical 9.2)
- [CVE-2026-34200](https://insights.sbomify.com/CVE-2026-34200/): Nhost CLI MCP Server: Missing Inbound Authentication on Explicitly Bound Network Port (high 7.7)
- [CVE-2026-34198](https://insights.sbomify.com/CVE-2026-34198/): Coolify: Password reset link poisoning via X-Forwarded-Host header spoofing (medium 5.3)
- [CVE-2026-34197](https://insights.sbomify.com/CVE-2026-34197/): Apache ActiveMQ Improper Input Validation (high 8.8, exploited in the wild)
- [CVE-2026-34196](https://insights.sbomify.com/CVE-2026-34196/): GPU DDK - UAF read and/or write of arbitrary physical memory due to integer truncation in PMRDevPhysAddrOSMem (high 7.8)
- [CVE-2026-34195](https://insights.sbomify.com/CVE-2026-34195/): Memory corruption in Graphics DDK (high 8.8)
- [CVE-2026-34194](https://insights.sbomify.com/CVE-2026-34194/): Use after free in Graphics DDK (high 7.1)
- [CVE-2026-34193](https://insights.sbomify.com/CVE-2026-34193/): GPU DDK - Arbitrary write via UFO updates due insufficient pointer validation in rgxfw_to_ptr() (medium 4.3)
- [CVE-2026-34192](https://insights.sbomify.com/CVE-2026-34192/): GPU DDK - _MMU_AllocLevel error recovery paths leave dangling page table entries (high 7.7)
- [CVE-2026-34191](https://insights.sbomify.com/CVE-2026-34191/): Apache Portable Runtime Utility: SQL Injection in apr_dbd_oracle (critical 9.1)
- [CVE-2026-34190](https://insights.sbomify.com/CVE-2026-34190/): CSRF in Alert Command Deletion (medium 5.9)
- [CVE-2026-3419](https://insights.sbomify.com/CVE-2026-3419/): Fastify's Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass Validation (medium 5.3)
- [CVE-2026-34189](https://insights.sbomify.com/CVE-2026-34189/): CSRF in Event Response Deletion (medium 5.9)
- [CVE-2026-34188](https://insights.sbomify.com/CVE-2026-34188/): OS Command Injection in Event Response Execution (high 7.5)
- [CVE-2026-34187](https://insights.sbomify.com/CVE-2026-34187/): SQL Injection in Graph Container Parameter (high 7.6)
- [CVE-2026-34186](https://insights.sbomify.com/CVE-2026-34186/): SQL Injection in Custom Fields leads to Database Compromise (high 8.7)
- [CVE-2026-34185](https://insights.sbomify.com/CVE-2026-34185/): SQL Injection in AlanWeb SCADA (high 8.7)
- [CVE-2026-34184](https://insights.sbomify.com/CVE-2026-34184/): Missing Authorization inAlanWeb SCADA (high 8.8)
- [CVE-2026-34183](https://insights.sbomify.com/CVE-2026-34183/): Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (high 7.5)
- [CVE-2026-34182](https://insights.sbomify.com/CVE-2026-34182/): CMS AuthEnvelopedData Processing May Accept Forged Messages (critical 9.1)
- [CVE-2026-34181](https://insights.sbomify.com/CVE-2026-34181/): PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys (high 7.4)
- [CVE-2026-34180](https://insights.sbomify.com/CVE-2026-34180/): Heap Buffer Over-read in ASN.1 Content Parsing (high 7.5)
- [CVE-2026-3418](https://insights.sbomify.com/CVE-2026-3418/): Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution (critical 9.1)
- [CVE-2026-34179](https://insights.sbomify.com/CVE-2026-34179/): Update of type field in restricted TLS certificate allows privilege escalation to cluster admin (critical 9.1)
- [CVE-2026-34178](https://insights.sbomify.com/CVE-2026-34178/): Importing a crafted backup leads to project restriction bypass (critical 9.1)
- [CVE-2026-34177](https://insights.sbomify.com/CVE-2026-34177/): VM lowlevel restriction bypass via raw.apparmor and raw.qemu.conf (critical 9.1)
- [CVE-2026-34176](https://insights.sbomify.com/CVE-2026-34176/): Knowledge Appliance mode iControl REST vulnerability (high 8.5)
- [CVE-2026-34175](https://insights.sbomify.com/CVE-2026-34175/): Privilege escalation in Hardware-Aware-Automated-MachineLearning NA (medium 5.4)
- [CVE-2026-34172](https://insights.sbomify.com/CVE-2026-34172/): Giskard Agents have Server-side template injection via ChatWorkflow.chat() using non-sandboxed Jinja2 Environment (high 7.7)
- [CVE-2026-34171](https://insights.sbomify.com/CVE-2026-34171/): Coolify: Account takeover via CSRF-able GET endpoint that resets password to attacker-known value (high 8.0)
- [CVE-2026-34170](https://insights.sbomify.com/CVE-2026-34170/): Coolify: Server-Side Request Forgery via attacker-controlled GitHub App API URL (medium 4.3)
- [CVE-2026-34168](https://insights.sbomify.com/CVE-2026-34168/): Coolify: Command injection via unsanitized persistent storage name in docker volume commands (high 8.8)
- [CVE-2026-34167](https://insights.sbomify.com/CVE-2026-34167/): Coolify: Cross-tenant activity log disclosure via unlocked Livewire property in ActivityMonitor (medium 5.0)
- [CVE-2026-34166](https://insights.sbomify.com/CVE-2026-34166/): LiquidJS has a Memory Limit Bypass via Quadratic Amplification in `replace` Filter (low 3.7)
- [CVE-2026-34165](https://insights.sbomify.com/CVE-2026-34165/): go-git: Maliciously crafted idx file can cause asymmetric memory consumption (medium 5.0)
- [CVE-2026-34164](https://insights.sbomify.com/CVE-2026-34164/): Valtimo: Sensitive data exposure through inbox message logging in InboxHandlingService (medium 4.9)
- [CVE-2026-34163](https://insights.sbomify.com/CVE-2026-34163/): Server-Side Request Forgery via MCP Tools Endpoint in FastGPT (high 7.7)
- [CVE-2026-34162](https://insights.sbomify.com/CVE-2026-34162/): FastGPT: Unauthenticated SSRF via httpTools Endpoint Leads to Internal API Key Theft (critical 10.0)
- [CVE-2026-34161](https://insights.sbomify.com/CVE-2026-34161/): Chamilo LMS: Stored XSS via Malicious File Upload in Social Post Attachments Leads to Arbitrary JavaScript Execution (medium 5.1)
- [CVE-2026-34160](https://insights.sbomify.com/CVE-2026-34160/): Server-side request forgery in chamilo-lms (high 8.6)
- [CVE-2026-3416](https://insights.sbomify.com/CVE-2026-3416/): Weak cryptography in WSO2 API Control Plane (medium 5.9)
- [CVE-2026-34159](https://insights.sbomify.com/CVE-2026-34159/): llama.cpp: Unauthenticated RCE via GRAPH_COMPUTE buffer=0 bypass in llama.cpp RPC backend (critical 9.8)
- [CVE-2026-34158](https://insights.sbomify.com/CVE-2026-34158/): Coolify: Command injection via single-quote breakout in Docker Compose custom commands (high 8.8)
- [CVE-2026-34156](https://insights.sbomify.com/CVE-2026-34156/): NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node (critical 10.0)
- [CVE-2026-34155](https://insights.sbomify.com/CVE-2026-34155/): RAUC: Improper Signing of Plain Bundles Exceeding 2 GiB (high 7.2)
- [CVE-2026-34154](https://insights.sbomify.com/CVE-2026-34154/): Discourse has a subscription access bypass in its discourse-subscriptions plugin (low 2.1)
- [CVE-2026-34153](https://insights.sbomify.com/CVE-2026-34153/): Coolify LocalFileVolume fs_path command injection enables RCE (high 8.8)
- [CVE-2026-34152](https://insights.sbomify.com/CVE-2026-34152/): Coolify: Command Injection via Newline in Pre/Post Deployment Commands (Heredoc Transport) (high 8.8)
- [CVE-2026-34151](https://insights.sbomify.com/CVE-2026-34151/): XWiki Platform: Resource path traversal via /skin/ action endpoint in Jetty 12+ (high 8.2)
- [CVE-2026-34150](https://insights.sbomify.com/CVE-2026-34150/): Wazuh: Heap buffer overflow in wazuh-analysisd via rootcheck event parsing (high 7.5)
- [CVE-2026-3415](https://insights.sbomify.com/CVE-2026-3415/): XML external entity in WSO2 API Control Plane (high 8.7)
- [CVE-2026-34149](https://insights.sbomify.com/CVE-2026-34149/): Coolify: Authenticated Host-Level RCE via Unescaped Database Credentials in Backup Jobs (low 3.3)
- [CVE-2026-34148](https://insights.sbomify.com/CVE-2026-34148/): Fedify affected by resource exhaustion caused by unbounded redirect following during remote key/document resolution (high 7.5)
- [CVE-2026-3413](https://insights.sbomify.com/CVE-2026-3413/): itsourcecode University Management System admin_single_student.php sql injection (medium 6.9)
- [CVE-2026-34127](https://insights.sbomify.com/CVE-2026-34127/): Stored Cross-Site Scripting (XSS) via Configuration File Import on TP-Link's TL-SG108PE (medium 5.3)
- [CVE-2026-34126](https://insights.sbomify.com/CVE-2026-34126/): Bluetooth Communication Uses Unencrypted Transmission During Initial Setup on TP-Link's Tapo L535E, P300 and D100C (high 7.3)
- [CVE-2026-34124](https://insights.sbomify.com/CVE-2026-34124/): Denial of Service via Path Expansion Overflow in HTTP Service in TP-Link Tapo C520WS (high 7.1)
- [CVE-2026-34123](https://insights.sbomify.com/CVE-2026-34123/): Whitelist Validation Bypass in TP-Link Tapo C520WS (high 7.0)
- [CVE-2026-34122](https://insights.sbomify.com/CVE-2026-34122/): Stack-based Buffer Overflow Leading to Denial of Service in TP-Link Tapo C520WS (high 7.1)
- [CVE-2026-34121](https://insights.sbomify.com/CVE-2026-34121/): Authentication Bypass in DS Configuration Service via HTTP Request Parsing Differential of TP-Link Tapo C520WS (high 8.7)
- [CVE-2026-34120](https://insights.sbomify.com/CVE-2026-34120/): Heap-based Buffer Overflow Vulnerability Leading to Denial-of-Service in TP-Link Tapo C520WS (high 7.1)
- [CVE-2026-3412](https://insights.sbomify.com/CVE-2026-3412/): itsourcecode University Management System att_single_view.php cross site scripting (medium 5.3)
- [CVE-2026-34119](https://insights.sbomify.com/CVE-2026-34119/): Heap-based Buffer Overflow Vulnerability Leading to Denial-of-Service in TP-Link Tapo C520WS (high 7.1)
- [CVE-2026-34118](https://insights.sbomify.com/CVE-2026-34118/): Heap-based Buffer Overflow Vulnerability Leading to Denial-of-Service in TP-Link Tapo C100, C101, C210 & C520WS (high 7.1)
- [CVE-2026-34117](https://insights.sbomify.com/CVE-2026-34117/): Guardian Language-System Unauthenticated OS Command Injection via id Parameter in text_to_subtitles.php (critical 9.3)
- [CVE-2026-34116](https://insights.sbomify.com/CVE-2026-34116/): Guardian Language-System Unauthenticated OS Command Injection via id Parameter in transcribe.php (critical 9.3)
- [CVE-2026-34115](https://insights.sbomify.com/CVE-2026-34115/): Guardian Language-System Unauthenticated OS Command Injection via id Parameter in transcribe_amazon.php (critical 9.3)
- [CVE-2026-34114](https://insights.sbomify.com/CVE-2026-34114/): Guardian Language-System Unauthenticated OS Command Injection via id Parameter in translate_text.php (critical 9.3)
- [CVE-2026-34113](https://insights.sbomify.com/CVE-2026-34113/): Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speech_text.php (critical 9.3)
- [CVE-2026-34112](https://insights.sbomify.com/CVE-2026-34112/): Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speechmac.php (critical 9.3)
- [CVE-2026-34111](https://insights.sbomify.com/CVE-2026-34111/): Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speechmac_text.php (critical 9.3)
- [CVE-2026-34110](https://insights.sbomify.com/CVE-2026-34110/): Guardian Language-System Unauthenticated OS Command Injection via id Parameter in complex_start.php (critical 9.3)
- [CVE-2026-3411](https://insights.sbomify.com/CVE-2026-3411/): itsourcecode University Management System admin_single_student_update.php sql injection (medium 6.9)
- [CVE-2026-34109](https://insights.sbomify.com/CVE-2026-34109/): Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speech.php (critical 9.3)
- [CVE-2026-34108](https://insights.sbomify.com/CVE-2026-34108/): Guardian Language-System Unauthenticated OS Command Injection via id Parameter in text.php (critical 9.3)
- [CVE-2026-34107](https://insights.sbomify.com/CVE-2026-34107/): Guardian Language-System Unauthenticated OS Command Injection via id Parameter in translate.php (critical 9.3)
- [CVE-2026-34106](https://insights.sbomify.com/CVE-2026-34106/): Guardian Language-System Unauthenticated OS Command Injection via id Parameter in subtitles.php (critical 9.3)
- [CVE-2026-34105](https://insights.sbomify.com/CVE-2026-34105/): Guardian Language-System SQL Injection via id Parameter in translate_text.php (high 8.7)
- [CVE-2026-34104](https://insights.sbomify.com/CVE-2026-34104/): Guardian Language-System SQL Injection via name Parameter in designer.php (high 8.7)
- [CVE-2026-34103](https://insights.sbomify.com/CVE-2026-34103/): Guardian Language-System SQL Injection via id Parameter in subtitles.php (high 8.7)
- [CVE-2026-34102](https://insights.sbomify.com/CVE-2026-34102/): Guardian Language-System SQL Injection via id Parameter in job_info_get.php (high 8.7)
- [CVE-2026-34101](https://insights.sbomify.com/CVE-2026-34101/): Guardian Language-System SQL Injection via id Parameter in text_file.php (high 8.7)
- [CVE-2026-34100](https://insights.sbomify.com/CVE-2026-34100/): Guardian Language-System SQL Injection via id Parameter in media.php (high 8.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/702/