# Vulnerabilities published in 2026


- [CVE-2026-33788](https://insights.sbomify.com/CVE-2026-33788/): Junos OS Evolved: Local, authenticated attacker can gain privileged access to FPCs (high 8.5)
- [CVE-2026-33787](https://insights.sbomify.com/CVE-2026-33787/): Junos OS: SRX1500, SRX4100, SRX4200, SRX4600: When a specific show command is executed chassisd crashes (medium 6.8)
- [CVE-2026-33786](https://insights.sbomify.com/CVE-2026-33786/): Junos OS: SRX1600, SRX2300, SRX4300: When a specific show command is executed chassisd crashes (medium 6.8)
- [CVE-2026-33785](https://insights.sbomify.com/CVE-2026-33785/): Junos OS: MX Series: Missing Authorization for specific 'request' CLI commands in a JDM/CSDS scenario (medium 6.3)
- [CVE-2026-33784](https://insights.sbomify.com/CVE-2026-33784/): Hardcoded credentials in JSI LWC (critical 9.3)
- [CVE-2026-33783](https://insights.sbomify.com/CVE-2026-33783/): Denial of service in Junos OS Evolved (high 7.1)
- [CVE-2026-33782](https://insights.sbomify.com/CVE-2026-33782/): Junos OS: MX Series: In specific DHCPv6 scenarios jdhcpd memory increases continuously with subscriber logouts (high 8.7)
- [CVE-2026-33781](https://insights.sbomify.com/CVE-2026-33781/): Denial of service in Junos OS (high 7.1)
- [CVE-2026-33780](https://insights.sbomify.com/CVE-2026-33780/): Junos OS and Junos OS Evolved: In an EVPN-MPLS scenario churn of ESI routes causes a memory leak in l2ald (high 7.1)
- [CVE-2026-3378](https://insights.sbomify.com/CVE-2026-3378/): Tenda F453 qossetting fromqossetting buffer overflow (high 8.7)
- [CVE-2026-33779](https://insights.sbomify.com/CVE-2026-33779/): Junos OS: SRX Series: Insufficient certificate verification for device to SD cloud communication (high 8.3)
- [CVE-2026-33778](https://insights.sbomify.com/CVE-2026-33778/): Junos OS: SRX Series, MX Series: When a specifically malformed first ISAKMP packet is received kmd/iked crashes (high 8.7)
- [CVE-2026-33776](https://insights.sbomify.com/CVE-2026-33776/): Junos OS and Junos OS Evolved: Specific low privileged CLI command exposes sensitive information (medium 6.8)
- [CVE-2026-33775](https://insights.sbomify.com/CVE-2026-33775/): Junos OS: MX Series: Mismatch between configured and received packet types causes memory leak in bbe-smgd (high 7.1)
- [CVE-2026-33774](https://insights.sbomify.com/CVE-2026-33774/): Junos OS: MX Series: Firewall filters on lo0.<non-0> in the default routing instance are not in effect (medium 6.9)
- [CVE-2026-33773](https://insights.sbomify.com/CVE-2026-33773/): Security feature bypass in Junos OS (medium 6.9)
- [CVE-2026-33771](https://insights.sbomify.com/CVE-2026-33771/): CTP OS: Configuring password requirements does not work which permits the use of weak passwords (critical 9.1)
- [CVE-2026-33770](https://insights.sbomify.com/CVE-2026-33770/): AVideo has SQL Injection in category.php fixCleanTitle() via Unparameterized clean_title and id Variables (high 7.1)
- [CVE-2026-3377](https://insights.sbomify.com/CVE-2026-3377/): Tenda F453 SafeUrlFilter fromSafeUrlFilter buffer overflow (high 8.7)
- [CVE-2026-33769](https://insights.sbomify.com/CVE-2026-33769/): Astro: Remote allowlist bypass via unanchored matchPathname wildcard (low 2.9)
- [CVE-2026-33768](https://insights.sbomify.com/CVE-2026-33768/): Astro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path` (medium 6.5)
- [CVE-2026-33767](https://insights.sbomify.com/CVE-2026-33767/): AVideo has SQL Injection via Partial Prepared Statement — videos_id Concatenated Directly into Query (high 7.1)
- [CVE-2026-33766](https://insights.sbomify.com/CVE-2026-33766/): AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints (medium 5.3)
- [CVE-2026-33765](https://insights.sbomify.com/CVE-2026-33765/): Pi-hole Web Interface has a Command Injection Vulnerability (high 8.9)
- [CVE-2026-33764](https://insights.sbomify.com/CVE-2026-33764/): AVideo: IDOR in AI Plugin Allows Stealing Other Users' AI-Generated Metadata and Transcriptions (medium 4.3)
- [CVE-2026-33763](https://insights.sbomify.com/CVE-2026-33763/): AVideo has an Unauthenticated Video Password Brute-Force Vulnerability via Unrate-Limited Boolean Oracle (medium 5.3)
- [CVE-2026-33762](https://insights.sbomify.com/CVE-2026-33762/): go-git: Missing validation decoding Index v4 files leads to panic (low 2.8)
- [CVE-2026-33761](https://insights.sbomify.com/CVE-2026-33761/): AVideo: Unauthenticated Access to Scheduler Plugin Endpoints Leaks Scheduled Tasks, Email Content, and User Mappings (medium 5.3)
- [CVE-2026-33760](https://insights.sbomify.com/CVE-2026-33760/): Langflow: IDOR/BOLA in Monitor API — Missing Ownership Enforcement on 7 Endpoints (high 8.8)
- [CVE-2026-3376](https://insights.sbomify.com/CVE-2026-3376/): Tenda F453 SafeMacFilter fromSafeMacFilter buffer overflow (high 8.7)
- [CVE-2026-33759](https://insights.sbomify.com/CVE-2026-33759/): AVideo: Unauthenticated IDOR in playlistsVideos.json.php Exposes Private Playlist Contents (medium 5.3)
- [CVE-2026-33758](https://insights.sbomify.com/CVE-2026-33758/): OpenBao has Reflected XSS in its OIDC authentication error message (critical 9.4)
- [CVE-2026-33757](https://insights.sbomify.com/CVE-2026-33757/): OpenBao lacks user confirmation for OIDC direct callback mode (critical 9.6)
- [CVE-2026-33756](https://insights.sbomify.com/CVE-2026-33756/): Saleor Affected by Denial of Service via Unbounded GraphQL Query Batching (high 7.5)
- [CVE-2026-33755](https://insights.sbomify.com/CVE-2026-33755/): Authenticated SQL Injection in Contact/query addressBookIds filter (high 8.8)
- [CVE-2026-33754](https://insights.sbomify.com/CVE-2026-33754/): Wazuh: Unauthenticated cluster packet length leads to uncontrolled memory allocation (remote DoS) (medium 6.5)
- [CVE-2026-33753](https://insights.sbomify.com/CVE-2026-33753/): Improper Certificate Validation in rfc3161-client (medium 6.2)
- [CVE-2026-33752](https://insights.sbomify.com/CVE-2026-33752/): Redirect-based SSRF leading to internal network access in curl_cffi (with TLS impersonation bypass) (high 8.6)
- [CVE-2026-33751](https://insights.sbomify.com/CVE-2026-33751/): n8n Vulnerable to LDAP Filter Injection in LDAP Node (medium 6.3)
- [CVE-2026-33750](https://insights.sbomify.com/CVE-2026-33750/): brace-expansion: Zero-step sequence causes process hang and memory exhaustion (medium 6.5)
- [CVE-2026-3375](https://insights.sbomify.com/CVE-2026-3375/): LiteSpeed Cache <= 7.7 - Unauthenticated Stored Cross-Site Scripting via QUIC.cloud CCSS/UCSS REST API Endpoints (high 7.2)
- [CVE-2026-33749](https://insights.sbomify.com/CVE-2026-33749/): n8n Vulnerable to XSS via Binary Data Inline HTML Rendering (medium 6.3)
- [CVE-2026-33748](https://insights.sbomify.com/CVE-2026-33748/): BuildKit Git URL subdir component can cause access to restricted files (high 8.2)
- [CVE-2026-33747](https://insights.sbomify.com/CVE-2026-33747/): BuildKit vulnerable to malicious frontend causing file escape outside of storage root (high 8.4)
- [CVE-2026-33746](https://insights.sbomify.com/CVE-2026-33746/): Convoy: JWT Signature Verification Bypass Allows Authentication as Arbitrary Users (critical 9.8)
- [CVE-2026-33745](https://insights.sbomify.com/CVE-2026-33745/): cpp-httplib Client Leaks Authentication Credentials to Untrusted Hosts on Cross-Origin HTTP Redirect (high 7.4)
- [CVE-2026-33744](https://insights.sbomify.com/CVE-2026-33744/): BentoML has Dockerfile Command Injection via system_packages in bentofile.yaml (high 7.8)
- [CVE-2026-33743](https://insights.sbomify.com/CVE-2026-33743/): Incus vulnerable to denial of source through crafted bucket backup file (medium 6.5)
- [CVE-2026-33742](https://insights.sbomify.com/CVE-2026-33742/): Invoice Ninja has Stored XSS via Markdown HTML Injection in Product Notes (medium 5.4)
- [CVE-2026-33741](https://insights.sbomify.com/CVE-2026-33741/): EspoCRM: Stored XSS via SVG attachment loading same-origin JavaScript (medium 6.8)
- [CVE-2026-33740](https://insights.sbomify.com/CVE-2026-33740/): EspoCRM: Email importEml can import and delete another user's attachment by raw fileId (medium 5.4)
- [CVE-2026-33739](https://insights.sbomify.com/CVE-2026-33739/): FOG has Stored XSS in Multiple Management Pages (medium 5.7)
- [CVE-2026-33738](https://insights.sbomify.com/CVE-2026-33738/): Lychee Vulnerable to Stored XSS via Photo Description in RSS/Atom/JSON Feed (No Sanitization on Public Endpoint) (medium 4.8)
- [CVE-2026-33737](https://insights.sbomify.com/CVE-2026-33737/): Chamilo LMS has an XML External Entity (XXE) Injection (medium 5.3)
- [CVE-2026-33736](https://insights.sbomify.com/CVE-2026-33736/): Chamilo LMS has an Insecure Direct Object Reference (IDOR) - User Data Exposure (medium 6.5)
- [CVE-2026-33735](https://insights.sbomify.com/CVE-2026-33735/): MyTube has an Improper Access Control that Allows Complete Application Takeover (high 7.4)
- [CVE-2026-33734](https://insights.sbomify.com/CVE-2026-33734/): FOSSBilling has improper SQL neutralization in `Massmailer` recipient filters (medium 6.9)
- [CVE-2026-33733](https://insights.sbomify.com/CVE-2026-33733/): EspoCRM has Admin TemplateManager path traversal that allows arbitrary file read write and delete (high 7.2)
- [CVE-2026-33732](https://insights.sbomify.com/CVE-2026-33732/): srvx is vulnerable to middleware bypass via absolute URI in request line (medium 4.8)
- [CVE-2026-33731](https://insights.sbomify.com/CVE-2026-33731/): AVideo has an Authorize.Net Webhook Signature Bypass that Enables Wallet Balance Inflation via Forged Payment Data (medium 6.5)
- [CVE-2026-33730](https://insights.sbomify.com/CVE-2026-33730/): Open Source Point of Sale has an IDOR in Password Change (Home) (medium 6.5)
- [CVE-2026-33729](https://insights.sbomify.com/CVE-2026-33729/): OpenFGA has an Authorization Bypass through cached keys (medium 5.8)
- [CVE-2026-33728](https://insights.sbomify.com/CVE-2026-33728/): dd-trace-java: Unsafe deserialization in RMI instrumentation may lead to remote code execution (critical 9.3)
- [CVE-2026-33727](https://insights.sbomify.com/CVE-2026-33727/): Pi-hole has a Local Privilege Escalation (post-compromise, pihole -> root). (medium 6.4)
- [CVE-2026-33726](https://insights.sbomify.com/CVE-2026-33726/): Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic (medium 5.4)
- [CVE-2026-33725](https://insights.sbomify.com/CVE-2026-33725/): Metabase vulnerable to RCE and Arbitrary File Read via H2 JDBC INIT Injection in EE Serialization Import (high 7.2)
- [CVE-2026-33724](https://insights.sbomify.com/CVE-2026-33724/): n8n's Source Control SSH Configuration Uses StrictHostKeyChecking=no (medium 6.3)
- [CVE-2026-33723](https://insights.sbomify.com/CVE-2026-33723/): AVideo Vulnerable to SQL Injection in Subscribe Endpoint via Unsanitized user_id Parameter in subscribe.php (high 7.1)
- [CVE-2026-33722](https://insights.sbomify.com/CVE-2026-33722/): n8n Has External Secrets Authorization Bypass in Credential Saving (high 7.3)
- [CVE-2026-33721](https://insights.sbomify.com/CVE-2026-33721/): MapServer has heap buffer overflow in SLD `Categorize` Threshold parsing (medium 5.3)
- [CVE-2026-33720](https://insights.sbomify.com/CVE-2026-33720/): n8n Has Authorization Bypass in OAuth Callback via N8N_SKIP_AUTH_ON_OAUTH_CALLBACK (medium 6.3)
- [CVE-2026-33719](https://insights.sbomify.com/CVE-2026-33719/): AVideo: Unauthenticated CDN Configuration Takeover via Empty Default Key Bypass and Mass-Assignment (high 8.6)
- [CVE-2026-33718](https://insights.sbomify.com/CVE-2026-33718/): OpenHands is Vulnerable to Command Injection through its Git Diff Handler (high 7.6)
- [CVE-2026-33717](https://insights.sbomify.com/CVE-2026-33717/): AVideo: Remote Code Execution via PHP Temp File in Encoder downloadURL (high 8.8)
- [CVE-2026-33716](https://insights.sbomify.com/CVE-2026-33716/): AVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.php (critical 9.4)
- [CVE-2026-33715](https://insights.sbomify.com/CVE-2026-33715/): Chamilo LMS has Unauthenticated SSRF and Open Email Relay via install.ajax.php test_mailer action (high 7.2)
- [CVE-2026-33714](https://insights.sbomify.com/CVE-2026-33714/): Chamilo LMS has Authenticated SQL Injection in statistics.ajax.php users_active action (2.0 RC2) (high 7.1)
- [CVE-2026-33713](https://insights.sbomify.com/CVE-2026-33713/): n8n Vulnerable to SQL Injection in Data Table Node via orderByColumn Expression (high 8.7)
- [CVE-2026-33712](https://insights.sbomify.com/CVE-2026-33712/): TypeBot: Unauthenticated SSRF via isolated-vm fetch in preview chat endpoint bypasses SSRF controls (critical 10.0)
- [CVE-2026-33711](https://insights.sbomify.com/CVE-2026-33711/): Incus vulnerable to local privilege escalation through VM screenshot path (medium 4.7)
- [CVE-2026-33710](https://insights.sbomify.com/CVE-2026-33710/): Chamilo LMS has Weak REST API Key Generation (Predictable) (high 7.5)
- [CVE-2026-3371](https://insights.sbomify.com/CVE-2026-3371/): Missing authorization in Tutor LMS – eLearning and online course solution (medium 4.3)
- [CVE-2026-33709](https://insights.sbomify.com/CVE-2026-33709/): JupyterHub has an Open Redirect Vulnerability (medium 5.1)
- [CVE-2026-33708](https://insights.sbomify.com/CVE-2026-33708/): Chamilo LMS has REST API PII Exposure via get_user_info_from_username (medium 6.5)
- [CVE-2026-33707](https://insights.sbomify.com/CVE-2026-33707/): Weak Password Recovery Mechanism for Forgotten Password in chamilo/chamilo-lms (critical 9.4)
- [CVE-2026-33706](https://insights.sbomify.com/CVE-2026-33706/): Chamilo LMS has a REST API Self-Privilege Escalation (Student → Teacher) (high 7.1)
- [CVE-2026-33705](https://insights.sbomify.com/CVE-2026-33705/): Chamilo LMS has unauthenticated access to Twig template source files exposes application logic (medium 5.3)
- [CVE-2026-33704](https://insights.sbomify.com/CVE-2026-33704/): Chamilo LMS Affected by Authenticated Arbitrary File Write via BigUpload endpoint (high 7.1)
- [CVE-2026-33703](https://insights.sbomify.com/CVE-2026-33703/): Chamilo LMS Critical IDOR: Any Authenticated User Can Extract All Users’ Personal Data and API Tokens (high 7.1)
- [CVE-2026-33702](https://insights.sbomify.com/CVE-2026-33702/): Chamilo LMS has an Insecure Direct Object Reference (IDOR) (high 7.1)
- [CVE-2026-33701](https://insights.sbomify.com/CVE-2026-33701/): OpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code Execution (critical 9.3)
- [CVE-2026-33700](https://insights.sbomify.com/CVE-2026-33700/): Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion (medium 6.9)
- [CVE-2026-33699](https://insights.sbomify.com/CVE-2026-33699/): pypdf: Possible infinite loop during recovery attempts in DictionaryObject.read_from_stream (medium 4.6)
- [CVE-2026-33698](https://insights.sbomify.com/CVE-2026-33698/): Chamilo LMS affected by unauthenticated RCE in main/install folder (critical 9.3)
- [CVE-2026-33697](https://insights.sbomify.com/CVE-2026-33697/): CoCoS attested TLS is vulnerable to relay attacks via extracted ephemeral TLS keys (high 7.5)
- [CVE-2026-33696](https://insights.sbomify.com/CVE-2026-33696/): n8n Vulnerable to Prototype Pollution in XML & GSuiteAdmin node parameters lead to RCE (critical 9.4)
- [CVE-2026-33694](https://insights.sbomify.com/CVE-2026-33694/): Junction File Manipulation (high 7.4)
- [CVE-2026-33693](https://insights.sbomify.com/CVE-2026-33693/): Lemmy's Activitypub-Federation has SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4_is_invalid() (medium 6.5)
- [CVE-2026-33692](https://insights.sbomify.com/CVE-2026-33692/): AVideo Has Unauthenticated .env File Exposure via Official Docker Compose Configuration (high 7.5)
- [CVE-2026-33691](https://insights.sbomify.com/CVE-2026-33691/): OWASP CRS: Whitespace padding in filenames bypasses file upload extension checks (medium 6.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/706/