# Vulnerabilities published in 2026


- [CVE-2026-33690](https://insights.sbomify.com/CVE-2026-33690/): AVideo vulnerable to IP Address Spoofing via Untrusted HTTP Headers in getRealIpAddr() (medium 5.3)
- [CVE-2026-3369](https://insights.sbomify.com/CVE-2026-3369/): Cross-site scripting in Better Find and Replace – AI-Powered Suggestions (medium 5.4)
- [CVE-2026-33689](https://insights.sbomify.com/CVE-2026-33689/): xrdp: Pre-authentication out-of-bounds reads in channel parsers (high 8.7)
- [CVE-2026-33688](https://insights.sbomify.com/CVE-2026-33688/): AVideo has Pre-Captcha User Enumeration and Account Status Disclosure in Password Recovery Endpoint (medium 5.3)
- [CVE-2026-33687](https://insights.sbomify.com/CVE-2026-33687/): Sharp has Unrestricted File Upload via Client-Controlled Validation Rules (high 8.8)
- [CVE-2026-33686](https://insights.sbomify.com/CVE-2026-33686/): Sharp is Vulnerable to Path Traversal via Unsanitized Extension in FileUtil (high 8.8)
- [CVE-2026-33685](https://insights.sbomify.com/CVE-2026-33685/): AVideo Allows Unauthenticated Access to AD_Server reports.json.php that Exposes Ad Campaign Analytics and User Data (medium 5.3)
- [CVE-2026-33684](https://insights.sbomify.com/CVE-2026-33684/): AVideo's Privilege Escalation via Unguarded Permission Parameters in signUp API Allows Self-Granting Upload/Stream/Meet Permissions (medium 5.3)
- [CVE-2026-33683](https://insights.sbomify.com/CVE-2026-33683/): AVideo vulnerable to Stored XSS via html_entity_decode() Reversing xss_esc() Sanitization in Channel About Field (medium 5.4)
- [CVE-2026-33682](https://insights.sbomify.com/CVE-2026-33682/): Streamlit on Windows has Unauthenticated SSRF Vulnerability (NTLM Credential Exposure) (medium 4.7)
- [CVE-2026-33681](https://insights.sbomify.com/CVE-2026-33681/): AVideo has Path Traversal in pluginRunDatabaseScript.json.php Enables Arbitrary SQL File Execution via Unsanitized Plugin Name (high 7.2)
- [CVE-2026-33680](https://insights.sbomify.com/CVE-2026-33680/): Vikunja Vulnerable to Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation (high 7.5)
- [CVE-2026-3368](https://insights.sbomify.com/CVE-2026-3368/): Injection Guard <= 1.2.9 - Unauthenticated Stored Cross-Site Scripting via Query Parameter Name (high 7.2)
- [CVE-2026-33679](https://insights.sbomify.com/CVE-2026-33679/): Vikunja has SSRF via OpenID Connect Avatar Download that Bypasses Webhook SSRF Protections (medium 6.4)
- [CVE-2026-33678](https://insights.sbomify.com/CVE-2026-33678/): Vikunja has IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion (high 8.1)
- [CVE-2026-33677](https://insights.sbomify.com/CVE-2026-33677/): Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API (medium 6.5)
- [CVE-2026-33676](https://insights.sbomify.com/CVE-2026-33676/): Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read (medium 6.5)
- [CVE-2026-33675](https://insights.sbomify.com/CVE-2026-33675/): Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources (medium 6.4)
- [CVE-2026-33674](https://insights.sbomify.com/CVE-2026-33674/): PrestaShop: Improper Use of Validation Framework (low 2.0)
- [CVE-2026-33673](https://insights.sbomify.com/CVE-2026-33673/): PrestaShop has multiple stored XSS vulnerabilities via unprotected Template variables (high 7.7)
- [CVE-2026-33672](https://insights.sbomify.com/CVE-2026-33672/): Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching (medium 5.3)
- [CVE-2026-33671](https://insights.sbomify.com/CVE-2026-33671/): Picomatch has a ReDoS vulnerability via extglob quantifiers (high 7.5)
- [CVE-2026-33670](https://insights.sbomify.com/CVE-2026-33670/): SiYuan has directory traversal within its publishing service (critical 9.8)
- [CVE-2026-3367](https://insights.sbomify.com/CVE-2026-3367/): Cross-site scripting in Lockme calendars integration (medium 4.4)
- [CVE-2026-33669](https://insights.sbomify.com/CVE-2026-33669/): SiYuan has Arbitrary Document Reading within the Publishing Service (critical 9.8)
- [CVE-2026-33668](https://insights.sbomify.com/CVE-2026-33668/): Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect (high 7.1)
- [CVE-2026-33667](https://insights.sbomify.com/CVE-2026-33667/): OpenProject: 2FA OTP Verification Missing Rate Limiting (high 7.4)
- [CVE-2026-33666](https://insights.sbomify.com/CVE-2026-33666/): Zserio: Integer Overflow in BitStreamReader on 32-bit platforms (high 7.5)
- [CVE-2026-33665](https://insights.sbomify.com/CVE-2026-33665/): n8n: LDAP Email-Based Account Linking Allows Privilege Escalation and Account Takeover (high 8.8)
- [CVE-2026-33664](https://insights.sbomify.com/CVE-2026-33664/): Kestra Vulnerable to Stored Cross-Site Scripting via Flow YAML Fields (high 7.3)
- [CVE-2026-33663](https://insights.sbomify.com/CVE-2026-33663/): n8n Vulnerable to Credential Theft via Name-Based Resolution and Permission Checker Bypass in Community Edition (high 8.5)
- [CVE-2026-33662](https://insights.sbomify.com/CVE-2026-33662/): OP-TEE: RSASSA EMSA- PKCS1-v1_5 underflow in emsa_pkcs1_v1_5_encode() (high 7.5)
- [CVE-2026-33661](https://insights.sbomify.com/CVE-2026-33661/): WeChat Pay callback signature verification bypassed when Host header is localhost (high 8.6)
- [CVE-2026-33660](https://insights.sbomify.com/CVE-2026-33660/): n8n Has Multiple Remote Code Execution Vulnerabilities in Merge Node AlaSQL SQL Mode (critical 9.4)
- [CVE-2026-3366](https://insights.sbomify.com/CVE-2026-3366/): InfoSphere Optim Test Data Fabrication is affected by Arbitrary File Read (high 7.5)
- [CVE-2026-33659](https://insights.sbomify.com/CVE-2026-33659/): EspoCRM: SSRF via DNS Rebinding in Attachment fromImageUrl Endpoint Allows Internal Network Access (low 3.5)
- [CVE-2026-33658](https://insights.sbomify.com/CVE-2026-33658/): Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests (low 2.3)
- [CVE-2026-33657](https://insights.sbomify.com/CVE-2026-33657/): EspoCRM: Stored HTML injection in email notifications about stream notes via unescaped post field (medium 4.6)
- [CVE-2026-33656](https://insights.sbomify.com/CVE-2026-33656/): Path traversal in espocrm (critical 9.1)
- [CVE-2026-33655](https://insights.sbomify.com/CVE-2026-33655/): New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs (high 7.7)
- [CVE-2026-33654](https://insights.sbomify.com/CVE-2026-33654/): Zero-Click Indirect Prompt Injection and Authentication Bypass via Email Polling (high 8.9)
- [CVE-2026-33653](https://insights.sbomify.com/CVE-2026-33653/): Uploady Vulnerable to Stored Cross-Site Scripting (XSS) (medium 4.6)
- [CVE-2026-33651](https://insights.sbomify.com/CVE-2026-33651/): AVideo has a Blind SQL Injection in Live Schedule Reminder via Unsanitized live_schedule_id in Scheduler_commands::getAllActiveOrToRepeat() (high 8.1)
- [CVE-2026-33650](https://insights.sbomify.com/CVE-2026-33650/): AVideo's Video Moderator Privilege Escalation via Ownership Transfer Enables Arbitrary Video Deletion (high 7.6)
- [CVE-2026-33649](https://insights.sbomify.com/CVE-2026-33649/): AVideo's GET-Based CSRF in setPermission.json.php Enables Privilege Escalation via Arbitrary Permission Modification (high 8.1)
- [CVE-2026-33648](https://insights.sbomify.com/CVE-2026-33648/): AVideo Vulnerable to OS Command Injection via Unsanitized `users_id` and `liveTransmitionHistory_id` in Restreamer Log File Path (high 8.8)
- [CVE-2026-33647](https://insights.sbomify.com/CVE-2026-33647/): AVideo Vulnerable to Remote Code Execution via MIME/Extension Mismatch in ImageGallery File Upload (high 8.8)
- [CVE-2026-33646](https://insights.sbomify.com/CVE-2026-33646/): mise: Arbitrary Code Execution via Tera Templates in .tool-versions Files (Trust Bypass) (critical 9.6)
- [CVE-2026-33645](https://insights.sbomify.com/CVE-2026-33645/): Fireshare has Path Traversal Arbitrary File Write in `/api/uploadChunked` (high 7.1)
- [CVE-2026-33644](https://insights.sbomify.com/CVE-2026-33644/): Server-side request forgery in Lychee (low 2.3)
- [CVE-2026-33643](https://insights.sbomify.com/CVE-2026-33643/): SQL injection in schemahero:schemahero (high 7.4)
- [CVE-2026-33642](https://insights.sbomify.com/CVE-2026-33642/): Kitty has a Heap Buffer Over-Read/Write via Integer Overflow in compose_rectangles Bounds Check (critical 9.9)
- [CVE-2026-33641](https://insights.sbomify.com/CVE-2026-33641/): Glances Vulnerable to Command Injection via Dynamic Configuration Values (high 7.8)
- [CVE-2026-33640](https://insights.sbomify.com/CVE-2026-33640/): Outline has a rate limit bypass that allows brute force of email login OTP (critical 9.1)
- [CVE-2026-33639](https://insights.sbomify.com/CVE-2026-33639/): InvoicePlane permits DDL injection through tax_rate_decimal_places (high 7.2)
- [CVE-2026-33638](https://insights.sbomify.com/CVE-2026-33638/): Ech0 authenticated user-list exposed data via public `/api/allusers` endpoint (medium 5.3)
- [CVE-2026-33637](https://insights.sbomify.com/CVE-2026-33637/): Faraday: Protocol-relative URI objects still bypass host scoping (possible incomplete fix for GHSA-33mh-2634-fwr2) (not scored)
- [CVE-2026-33636](https://insights.sbomify.com/CVE-2026-33636/): LIBPNG has ARM NEON Palette Expansion Out-of-Bounds Read on AArch64 (high 7.6)
- [CVE-2026-33635](https://insights.sbomify.com/CVE-2026-33635/): iCalendar has ICS injection via unsanitized URI property values (medium 4.3)
- [CVE-2026-33634](https://insights.sbomify.com/CVE-2026-33634/): Aquasecurity Trivy Embedded Malicious Code (critical 9.4, exploited in the wild)
- [CVE-2026-33633](https://insights.sbomify.com/CVE-2026-33633/): Kitty has a Heap Buffer Overflow in its Graphics Protocol Handler (high 7.5)
- [CVE-2026-33632](https://insights.sbomify.com/CVE-2026-33632/): ClearanceKit: opfilter policy bypass via exchangedata and clone operations (high 8.4)
- [CVE-2026-33631](https://insights.sbomify.com/CVE-2026-33631/): ClearanceKit: opfilter policy bypass via non-open file operations (high 8.7)
- [CVE-2026-33630](https://insights.sbomify.com/CVE-2026-33630/): Use after free in c-ares (high 7.5)
- [CVE-2026-33628](https://insights.sbomify.com/CVE-2026-33628/): Invoice Ninja Denylist Bypass may Lead to Stored XSS via Invoice Line Items (medium 5.4)
- [CVE-2026-33627](https://insights.sbomify.com/CVE-2026-33627/): Parse Server: Auth data exposed via /users/me endpoint (high 7.1)
- [CVE-2026-33626](https://insights.sbomify.com/CVE-2026-33626/): LMDeploy Vulnerable to Server-Side Request Forgery (SSRF) via Vision-Language Image Loading (high 7.5)
- [CVE-2026-33625](https://insights.sbomify.com/CVE-2026-33625/): LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading (high 8.8)
- [CVE-2026-33624](https://insights.sbomify.com/CVE-2026-33624/): Parse Server: MFA recovery code single-use bypass via concurrent requests (low 2.1)
- [CVE-2026-33623](https://insights.sbomify.com/CVE-2026-33623/): PinchTab: OS Command Injection via Profile Name in Windows Cleanup Routine Enables Arbitrary Command Execution (medium 6.7)
- [CVE-2026-33622](https://insights.sbomify.com/CVE-2026-33622/): A PinchTab Security Policy Bypass in /wait Allows Arbitrary JavaScript Execution (medium 6.1)
- [CVE-2026-33621](https://insights.sbomify.com/CVE-2026-33621/): PinchTab: Unapplied Rate Limiting Middleware Allows Unbounded Brute-Force of API Token (medium 4.8)
- [CVE-2026-33620](https://insights.sbomify.com/CVE-2026-33620/): PinchTab: API Bearer Token Exposed in URL Query Parameter via Server Logs and Intermediary Systems (medium 4.3)
- [CVE-2026-3362](https://insights.sbomify.com/CVE-2026-3362/): Short Comment Filter <= 2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Minimum Count' Setting (medium 4.4)
- [CVE-2026-33619](https://insights.sbomify.com/CVE-2026-33619/): PinchTab has Unauthenticated Blind SSRF in Task Scheduler via Unvalidated callbackUrl (medium 4.1)
- [CVE-2026-33618](https://insights.sbomify.com/CVE-2026-33618/): Chamilo LMS Affected by Remote Code Execution via eval() in Platform Settings (high 8.8)
- [CVE-2026-33617](https://insights.sbomify.com/CVE-2026-33617/): MB connect line mbCONNECT24 vulnerable to an unauthenticated information disclosure in the data24 Endpoint (medium 5.3)
- [CVE-2026-33616](https://insights.sbomify.com/CVE-2026-33616/): MB connect line mbCONNECT24 vulnerable to an unauthenticated SQL injection in the mb24api Endpoint (high 7.5)
- [CVE-2026-33615](https://insights.sbomify.com/CVE-2026-33615/): MB connect line mbCONNECT24 vulnerable to an unauthenticated SQL injection in the setinfo Endpoint (critical 9.1)
- [CVE-2026-33614](https://insights.sbomify.com/CVE-2026-33614/): MB connect line mbCONNECT24 vulnerable to an unauthenticated SQL injection in the getinfo endpoint (high 7.5)
- [CVE-2026-33613](https://insights.sbomify.com/CVE-2026-33613/): MB connect line mbCONNECT24 vulnerable to RCE in generateSrpArray (high 7.2)
- [CVE-2026-33612](https://insights.sbomify.com/CVE-2026-33612/): ZoneToCache can poison the cache (high 7.5)
- [CVE-2026-33611](https://insights.sbomify.com/CVE-2026-33611/): Insufficient validation of HTTPS and SVCB records (medium 6.5)
- [CVE-2026-33610](https://insights.sbomify.com/CVE-2026-33610/): Possible file descriptor exhaustion in forward-dnsupdate (medium 5.9)
- [CVE-2026-3361](https://insights.sbomify.com/CVE-2026-3361/): WP Store Locator <= 2.2.261 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpsl_address' Post Meta (medium 6.4)
- [CVE-2026-33609](https://insights.sbomify.com/CVE-2026-33609/): LDAP DN injection (medium 5.3)
- [CVE-2026-33608](https://insights.sbomify.com/CVE-2026-33608/): Incomplete domain name sanitization during (high 7.4)
- [CVE-2026-33607](https://insights.sbomify.com/CVE-2026-33607/): Denial of service in OX Dovecot CE (medium 4.3)
- [CVE-2026-33606](https://insights.sbomify.com/CVE-2026-33606/): Other in OX Dovecot CE (medium 4.8)
- [CVE-2026-33605](https://insights.sbomify.com/CVE-2026-33605/): Denial of service in OX Dovecot CE (high 7.5)
- [CVE-2026-33604](https://insights.sbomify.com/CVE-2026-33604/): Security feature bypass in OX Dovecot CE (medium 5.9)
- [CVE-2026-33603](https://insights.sbomify.com/CVE-2026-33603/): Security feature bypass in OX Dovecot Pro (medium 6.8)
- [CVE-2026-33602](https://insights.sbomify.com/CVE-2026-33602/): Off-by-one access when processing crafted UDP responses (medium 6.5)
- [CVE-2026-33601](https://insights.sbomify.com/CVE-2026-33601/): Insufficient validation of zonemd record (medium 4.4)
- [CVE-2026-33600](https://insights.sbomify.com/CVE-2026-33600/): Null pointer dereference in RPZ transfer (medium 4.4)
- [CVE-2026-3360](https://insights.sbomify.com/CVE-2026-3360/): Missing authorization in Tutor LMS – eLearning and online course solution (high 7.5)
- [CVE-2026-33599](https://insights.sbomify.com/CVE-2026-33599/): Out-of-bounds read in service discovery (low 3.1)
- [CVE-2026-33598](https://insights.sbomify.com/CVE-2026-33598/): Out-of-bounds read in cache inspection via Lua (medium 4.8)
- [CVE-2026-33597](https://insights.sbomify.com/CVE-2026-33597/): PRSD detection denial of service (low 3.7)
- [CVE-2026-33596](https://insights.sbomify.com/CVE-2026-33596/): TCP backend stream ID overflow (low 3.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/707/