# Vulnerabilities published in 2026


- [CVE-2026-33496](https://insights.sbomify.com/CVE-2026-33496/): Ory Oathkeeper has an authentication bypass by cache key confusion (high 8.1)
- [CVE-2026-33495](https://insights.sbomify.com/CVE-2026-33495/): Ory Oathkeeper has an authentication bypass by usage of untrusted header (medium 6.5)
- [CVE-2026-33494](https://insights.sbomify.com/CVE-2026-33494/): Ory Oathkeeper has a path traversal authorization bypass (critical 10.0)
- [CVE-2026-33493](https://insights.sbomify.com/CVE-2026-33493/): AVideo has a Path Traversal in import.json.php Allows Private Video Theft and Arbitrary File Read/Deletion via fileURI Parameter (high 7.1)
- [CVE-2026-33492](https://insights.sbomify.com/CVE-2026-33492/): AVideo has Session Fixation via GET PHPSESSID Parameter With Disabled Login Session Regeneration (high 7.3)
- [CVE-2026-33491](https://insights.sbomify.com/CVE-2026-33491/): Zen-C has Stack-Based Buffer Overflow in Identifier Mangling (high 7.8)
- [CVE-2026-33490](https://insights.sbomify.com/CVE-2026-33490/): h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes (low 3.7)
- [CVE-2026-3349](https://insights.sbomify.com/CVE-2026-3349/): MinhNhut Link Gateway <= 3.6.1 - Reflected Cross-Site Scripting via 'url' Parameter (medium 6.1)
- [CVE-2026-33489](https://insights.sbomify.com/CVE-2026-33489/): CoreDNS transfer plugin subzone ACL bypass via lexicographic zone comparison (high 8.2)
- [CVE-2026-33488](https://insights.sbomify.com/CVE-2026-33488/): AVideo has a PGP 2FA Bypass via Cryptographically Broken 512-bit RSA Key Generation in LoginControl Plugin (high 7.4)
- [CVE-2026-33487](https://insights.sbomify.com/CVE-2026-33487/): goxmldsig has validateSignature Loop Variable Capture Signature Bypass (high 7.5)
- [CVE-2026-33486](https://insights.sbomify.com/CVE-2026-33486/): Roadiz has Server-Side Request Forgery (SSRF) in roadiz/documents (medium 6.8)
- [CVE-2026-33485](https://insights.sbomify.com/CVE-2026-33485/): AVideo has an Unauthenticated Blind SQL Injection in RTMP on_publish Callback via Stream Name Parameter (high 7.5)
- [CVE-2026-33484](https://insights.sbomify.com/CVE-2026-33484/): Langflow has Unauthenticated IDOR on Image Downloads (high 7.5)
- [CVE-2026-33483](https://insights.sbomify.com/CVE-2026-33483/): AVideo Affected by Unauthenticated Disk Space Exhaustion via Unlimited Temp File Creation in aVideoEncoderChunk.json.php (high 7.5)
- [CVE-2026-33482](https://insights.sbomify.com/CVE-2026-33482/): AVideo has an OS Command Injection via $() Shell Substitution Bypass in sanitizeFFmpegCommand() (high 8.1)
- [CVE-2026-33481](https://insights.sbomify.com/CVE-2026-33481/): Syft improper temporary file cleanup (medium 5.3)
- [CVE-2026-33480](https://insights.sbomify.com/CVE-2026-33480/): AVideo has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in Unauthenticated LiveLinks Proxy (high 8.6)
- [CVE-2026-3348](https://insights.sbomify.com/CVE-2026-3348/): MinhNhut Link Gateway <= 3.6.1 - Authenticated (Admin+) Stored Cross-Site Scripting via Plugin Settings (medium 4.4)
- [CVE-2026-33479](https://insights.sbomify.com/CVE-2026-33479/): AVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against Admin (high 8.8)
- [CVE-2026-33478](https://insights.sbomify.com/CVE-2026-33478/): AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection (critical 10.0)
- [CVE-2026-33477](https://insights.sbomify.com/CVE-2026-33477/): FileRise has incorrect authorization in /api/file/snippet.php allows read_own users to read other users’ file content (medium 4.3)
- [CVE-2026-33476](https://insights.sbomify.com/CVE-2026-33476/): SiYuan has an Unauthenticated Arbitrary File Read via Path Traversal (high 7.5)
- [CVE-2026-33475](https://insights.sbomify.com/CVE-2026-33475/): Langflow GitHub Actions Shell Injection (critical 9.1)
- [CVE-2026-33474](https://insights.sbomify.com/CVE-2026-33474/): Vikunja Affected by DoS via Image Preview Generation (medium 6.5)
- [CVE-2026-33473](https://insights.sbomify.com/CVE-2026-33473/): Vikunja has TOTP Reuse During Validity Window (medium 5.7)
- [CVE-2026-33472](https://insights.sbomify.com/CVE-2026-33472/): Cryptomator Hub OAuth token exchange HTTP downgrade via getAuthority() scheme confusion (CVE-2026-32303 bypass) (medium 4.8)
- [CVE-2026-33471](https://insights.sbomify.com/CVE-2026-33471/): nimiq-block has skip block quorum bypass via out-of-range BitSet indices & u16 truncation (critical 9.6)
- [CVE-2026-33470](https://insights.sbomify.com/CVE-2026-33470/): Missing authorization in frigate (medium 6.5)
- [CVE-2026-3347](https://insights.sbomify.com/CVE-2026-3347/): Multi Functional Flexi Lightbox <= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting via 'message' Parameter (medium 5.5)
- [CVE-2026-33469](https://insights.sbomify.com/CVE-2026-33469/): Authenticated Frigate users can read the full unredacted configuration via `/api/config/raw (medium 6.5)
- [CVE-2026-33468](https://insights.sbomify.com/CVE-2026-33468/): Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)` usage or similar methods that append string literal values into the compiled SQL strings (high 8.1)
- [CVE-2026-33467](https://insights.sbomify.com/CVE-2026-33467/): Improper Verification of Cryptographic Signature in Elastic Package Registry Leading to Package Integrity Bypass (medium 5.9)
- [CVE-2026-33466](https://insights.sbomify.com/CVE-2026-33466/): Improper Limitation of a Pathname to a Restricted Directory in Logstash Leading to Arbitrary File Write (high 8.1)
- [CVE-2026-33465](https://insights.sbomify.com/CVE-2026-33465/): Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service (medium 6.5)
- [CVE-2026-33464](https://insights.sbomify.com/CVE-2026-33464/): Uncontrolled Resource Consumption in Kibana Leading to Denial of Service (medium 6.5)
- [CVE-2026-33463](https://insights.sbomify.com/CVE-2026-33463/): Operation on a Resource after Expiration or Termination in Kibana Leading to Unauthorized File Access (medium 5.3)
- [CVE-2026-33462](https://insights.sbomify.com/CVE-2026-33462/): Path Traversal in Kibana Leading to Unauthorized Deletion of User Accounts (medium 4.6)
- [CVE-2026-33461](https://insights.sbomify.com/CVE-2026-33461/): Incorrect Authorization in Kibana Fleet Leading to Information Disclosure (high 7.7)
- [CVE-2026-33460](https://insights.sbomify.com/CVE-2026-33460/): Incorrect Authorization in Kibana Fleet Leading to Information Disclosure (medium 4.3)
- [CVE-2026-3346](https://insights.sbomify.com/CVE-2026-3346/): Stored Cross-Site Scripting (XSS) in Langflow Markdown Rendering via rehypeRaw (medium 6.4)
- [CVE-2026-33459](https://insights.sbomify.com/CVE-2026-33459/): Uncontrolled Resource Consumption in Kibana Leading to Denial of Service (medium 6.5)
- [CVE-2026-33458](https://insights.sbomify.com/CVE-2026-33458/): Server-Side Request Forgery (SSRF) in Kibana One Workflow Leading to Information Disclosure (medium 6.8)
- [CVE-2026-33457](https://insights.sbomify.com/CVE-2026-33457/): Potential livestatus injection in prediction graph page (medium 5.3)
- [CVE-2026-33456](https://insights.sbomify.com/CVE-2026-33456/): Potential livestatus injection in notification test (medium 5.1)
- [CVE-2026-33455](https://insights.sbomify.com/CVE-2026-33455/): Livestatus injection in monitoring quicksearch (medium 5.3)
- [CVE-2026-33454](https://insights.sbomify.com/CVE-2026-33454/): Apache Camel's Camel-Mail component is vulnerable to Camel message header injection (critical 9.4)
- [CVE-2026-33453](https://insights.sbomify.com/CVE-2026-33453/): Apache camel-coap allows header injection that can lead to remote code execution (critical 10.0)
- [CVE-2026-33452](https://insights.sbomify.com/CVE-2026-33452/): Buffer overflow in Windows clients prior to 14.50 (medium 5.9)
- [CVE-2026-33451](https://insights.sbomify.com/CVE-2026-33451/): Arbitrary read/write vulnerability in Windows clients prior to 14.50 (high 8.5)
- [CVE-2026-33450](https://insights.sbomify.com/CVE-2026-33450/): Out of bounds read in Secure Access MacOS clients prior to 14.50 (low 2.3)
- [CVE-2026-3345](https://insights.sbomify.com/CVE-2026-3345/): Path Traversal and Arbitrary File Write Vulnerability in IBM Langflow Desktop API v2 File Upload Endpoint (medium 6.5)
- [CVE-2026-33449](https://insights.sbomify.com/CVE-2026-33449/): Message handler buffer overflow in clients prior to 14.50 (low 2.3)
- [CVE-2026-33448](https://insights.sbomify.com/CVE-2026-33448/): Format string vulnerability in MacOS clients prior to 14.50 (medium 4.8)
- [CVE-2026-33447](https://insights.sbomify.com/CVE-2026-33447/): Memory corruption in Secure Access (low 2.3)
- [CVE-2026-33446](https://insights.sbomify.com/CVE-2026-33446/): Buffer overflow in client authentication prior to version 14.50 (low 2.3)
- [CVE-2026-33445](https://insights.sbomify.com/CVE-2026-33445/): Memory management vulnerability in Secure Access servers (high 8.7)
- [CVE-2026-33444](https://insights.sbomify.com/CVE-2026-33444/): Memory management vulnerability in Secure Access servers (medium 6.9)
- [CVE-2026-33443](https://insights.sbomify.com/CVE-2026-33443/): Memory management error in Secure Access servers prior to 14.55 (high 7.1)
- [CVE-2026-33442](https://insights.sbomify.com/CVE-2026-33442/): Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of JSON path keys. (high 8.1)
- [CVE-2026-33440](https://insights.sbomify.com/CVE-2026-33440/): Weblate: Authenticated SSRF via redirect bypass of ALLOWED_ASSET_DOMAINS in screenshot URL uploads (medium 5.0)
- [CVE-2026-3344](https://insights.sbomify.com/CVE-2026-3344/): WatchGuard Firebox System Integrity Check Bypass (medium 6.9)
- [CVE-2026-33439](https://insights.sbomify.com/CVE-2026-33439/): Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM (critical 9.3)
- [CVE-2026-33438](https://insights.sbomify.com/CVE-2026-33438/): Stirling-PDF vulnerable to DoS via add-watermark (medium 6.5)
- [CVE-2026-33437](https://insights.sbomify.com/CVE-2026-33437/): Stirling PDF: Stored XSS in Info Summary (high 8.1)
- [CVE-2026-33436](https://insights.sbomify.com/CVE-2026-33436/): Stirling-PDF: Reflected XSS through crafted filename in file upload functionality (low 3.1)
- [CVE-2026-33435](https://insights.sbomify.com/CVE-2026-33435/): Weblate: Remote code execution during backup restoration (high 8.1)
- [CVE-2026-33434](https://insights.sbomify.com/CVE-2026-33434/): Wazuh: Rate Limit Bypass via /events Endpoint (medium 4.3)
- [CVE-2026-33433](https://insights.sbomify.com/CVE-2026-33433/): Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField (medium 5.1)
- [CVE-2026-33432](https://insights.sbomify.com/CVE-2026-33432/): Roxy-WI has Pre-Authentication LDAP Injection that Leads to Authentication Bypass (high 7.7)
- [CVE-2026-33431](https://insights.sbomify.com/CVE-2026-33431/): Roxy-WI Vulnerable to Authenticated Arbitrary File Read via Path Traversal in Config Version Viewer (medium 5.7)
- [CVE-2026-33430](https://insights.sbomify.com/CVE-2026-33430/): Briefcase: Windows MSI Installer Privilege Escalation via Insecure Directory Permissions (high 7.3)
- [CVE-2026-3343](https://insights.sbomify.com/CVE-2026-3343/): WatchGuard Firebox Reflected Cross-Site-Scripting (XSS) Vulnerability in Fireware Web UI (medium 5.1)
- [CVE-2026-33429](https://insights.sbomify.com/CVE-2026-33429/): Parse Server: Protected field change detection oracle via LiveQuery watch parameter (medium 6.3)
- [CVE-2026-33428](https://insights.sbomify.com/CVE-2026-33428/): Discourse Allows Unauthorized Access to Deleted Posts Index via Group Membership (medium 4.9)
- [CVE-2026-33427](https://insights.sbomify.com/CVE-2026-33427/): Discourse Authorization Page Displays Unvalidated Redirect Domain (low 2.7)
- [CVE-2026-33426](https://insights.sbomify.com/CVE-2026-33426/): Discourse users can edit or synonymize hidden tags they can't see (low 3.5)
- [CVE-2026-33425](https://insights.sbomify.com/CVE-2026-33425/): Discourse has inferable private group membership or existence via exclude_groups parameter (medium 6.9)
- [CVE-2026-33424](https://insights.sbomify.com/CVE-2026-33424/): PM access granted through invites after access revocation (medium 5.9)
- [CVE-2026-33423](https://insights.sbomify.com/CVE-2026-33423/): Discourse staff can modify any user's group notification level (low 1.3)
- [CVE-2026-33422](https://insights.sbomify.com/CVE-2026-33422/): Discourse exposes ip_address of flagged user (low 3.5)
- [CVE-2026-33421](https://insights.sbomify.com/CVE-2026-33421/): Parse Server: LiveQuery bypasses CLP pointer permission enforcement (high 7.1)
- [CVE-2026-33420](https://insights.sbomify.com/CVE-2026-33420/): Vaultwarden missing authorization check allows Manager-role users to enumerate all collections (medium 5.3)
- [CVE-2026-3342](https://insights.sbomify.com/CVE-2026-3342/): WatchGuard Firebox Out of Bounds Write Vulnerability (high 8.6)
- [CVE-2026-33419](https://insights.sbomify.com/CVE-2026-33419/): MinIO: LDAP login brute-force via user enumeration and missing rate limit (critical 9.1)
- [CVE-2026-33418](https://insights.sbomify.com/CVE-2026-33418/): @dicebear/converter ensureSize() Vulnerable to SVG Dimension Capping Bypass via XML Comment Injection (high 7.5)
- [CVE-2026-33417](https://insights.sbomify.com/CVE-2026-33417/): Wallos: Password Reset Tokens Never Expire (medium 6.5)
- [CVE-2026-33416](https://insights.sbomify.com/CVE-2026-33416/): LIBPNG has use-after-free via pointer aliasing in `png_set_tRNS` and `png_set_PLTE` (high 7.5)
- [CVE-2026-33415](https://insights.sbomify.com/CVE-2026-33415/): Discourse: Improper Access Control in discourse-ai Allows Unauthorized Category Content Exposure (medium 5.1)
- [CVE-2026-33414](https://insights.sbomify.com/CVE-2026-33414/): PowerShell Command Injection in Podman HyperV Machine (medium 4.0)
- [CVE-2026-33413](https://insights.sbomify.com/CVE-2026-33413/): etcd: Authorization bypasses in multiple APIs (high 8.8)
- [CVE-2026-33412](https://insights.sbomify.com/CVE-2026-33412/): Vim affected by Command injection via newline in glob() (medium 5.6)
- [CVE-2026-33411](https://insights.sbomify.com/CVE-2026-33411/): Discourse's solved topic stream has potential stored XSS in topic title (medium 5.4)
- [CVE-2026-33410](https://insights.sbomify.com/CVE-2026-33410/): Discourse hardens chat DM channel creation and expansion (medium 5.4)
- [CVE-2026-3341](https://insights.sbomify.com/CVE-2026-3341/): IBM Langflow Desktop 1.0.0 - 1.9.2 DNS Rebinding Bypasses SSRF Protection Allowing Access to Internal Services (medium 5.4)
- [CVE-2026-33409](https://insights.sbomify.com/CVE-2026-33409/): Parse Server: Auth provider validation bypass on login via partial authData (high 7.0)
- [CVE-2026-33408](https://insights.sbomify.com/CVE-2026-33408/): Discourse has Improper Authorization in "Post Edits" Report For Moderators (low 2.2)
- [CVE-2026-33407](https://insights.sbomify.com/CVE-2026-33407/): Wallos: SSRF via HTTP Proxy Environment Variable (high 8.3)
- [CVE-2026-33406](https://insights.sbomify.com/CVE-2026-33406/): Pi-hole has a Stored HTML attribute injection (medium 5.4)
- [CVE-2026-33405](https://insights.sbomify.com/CVE-2026-33405/): Pi-hole has a Stored HTML Injection in queries.js (low 3.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/709/