# Vulnerabilities published in 2026


- [CVE-2026-33404](https://insights.sbomify.com/CVE-2026-33404/): Pi-hole has a Stored XSS / HTML injection in the Network page/Dashboard (low 3.4)
- [CVE-2026-33403](https://insights.sbomify.com/CVE-2026-33403/): Pi-hole has a Reflected XSS / HTML injection in taillog.js (medium 6.1)
- [CVE-2026-33402](https://insights.sbomify.com/CVE-2026-33402/): SAK-52311: Sakai site-manage group titles can contain XSS content (low 1.3)
- [CVE-2026-33401](https://insights.sbomify.com/CVE-2026-33401/): Wallos: Incomplete fix for CVE-2026-30840 - SSRF in AI and notification endpoints bypass ssrf_helper.php (high 7.1)
- [CVE-2026-33400](https://insights.sbomify.com/CVE-2026-33400/): Wallos: Stored cross-site scripting (XSS) vulnerability in the payment method rename endpoint (medium 5.4)
- [CVE-2026-3340](https://insights.sbomify.com/CVE-2026-3340/): Server-Side Request Forgery (SSRF) in Langflow URL Component (medium 6.5)
- [CVE-2026-33399](https://insights.sbomify.com/CVE-2026-33399/): Wallos: SSRF Bypass - Incomplete Fix for CVE-2026-30839/30840 (high 7.7)
- [CVE-2026-33398](https://insights.sbomify.com/CVE-2026-33398/): Authenticated users can read hidden forum posts through `/forum/get_quotes` (high 7.1)
- [CVE-2026-33397](https://insights.sbomify.com/CVE-2026-33397/): Angular SSR Vulnerable to Protocol-Relative URL Injection via Single Backslash Bypass (medium 6.9)
- [CVE-2026-33396](https://insights.sbomify.com/CVE-2026-33396/): Command injection in oneuptime (critical 10.0)
- [CVE-2026-33395](https://insights.sbomify.com/CVE-2026-33395/): Discourse has stored click‑based XSS via Graphviz SVG javascript: links (medium 4.4)
- [CVE-2026-33394](https://insights.sbomify.com/CVE-2026-33394/): Discourse leaks PM post edits to moderators (low 2.7)
- [CVE-2026-33393](https://insights.sbomify.com/CVE-2026-33393/): Discourse fixes loose hostname matching in spam host allowlist (medium 4.3)
- [CVE-2026-33392](https://insights.sbomify.com/CVE-2026-33392/): Code injection in YouTrack (high 7.2)
- [CVE-2026-33391](https://insights.sbomify.com/CVE-2026-33391/): Incorrect authorization in Smart Polling configuration in Guardian/CMC before 26.3.0 (medium 5.3)
- [CVE-2026-33390](https://insights.sbomify.com/CVE-2026-33390/): Incorrect privilege assignment for Arc sensors in Guardian/CMC before 26.2.0 (high 7.2)
- [CVE-2026-3339](https://insights.sbomify.com/CVE-2026-3339/): Keep Backup Daily <= 2.1.1 - Authenticated (Admin+) Limited Path Traversal via 'kbd_path' Parameter (low 2.7)
- [CVE-2026-33389](https://insights.sbomify.com/CVE-2026-33389/): Security feature bypass in Arc (medium 5.3)
- [CVE-2026-33388](https://insights.sbomify.com/CVE-2026-33388/): Incorrect authorization in Credentials Manager in Guardian/CMC before 26.3.0 (medium 6.4)
- [CVE-2026-33387](https://insights.sbomify.com/CVE-2026-33387/): Insufficient sanitization of Dashboards in Guardian/CMC before 26.3.0 (medium 5.1)
- [CVE-2026-33386](https://insights.sbomify.com/CVE-2026-33386/): XSS in QuickCMS (low 2.3)
- [CVE-2026-33385](https://insights.sbomify.com/CVE-2026-33385/): Blind SQL Injection in Quick.CMS (medium 5.1)
- [CVE-2026-33384](https://insights.sbomify.com/CVE-2026-33384/): Session Fixation in QuickCMS (medium 4.8)
- [CVE-2026-33382](https://insights.sbomify.com/CVE-2026-33382/): Denial of service via unbounded request body size (high 7.5)
- [CVE-2026-33381](https://insights.sbomify.com/CVE-2026-33381/): Users can generate Service Account tokens after permissions removal (medium 5.9)
- [CVE-2026-33380](https://insights.sbomify.com/CVE-2026-33380/): SQL Expressions Read File From Disk (medium 6.3)
- [CVE-2026-3338](https://insights.sbomify.com/CVE-2026-3338/): PKCS7_verify Signature Validation Bypass in AWS-LC (high 8.7)
- [CVE-2026-33378](https://insights.sbomify.com/CVE-2026-33378/): Grafana Data Source Plugin: DoS (OOM) via Negative Interval Injection in $__timeGroup Macro (medium 6.5)
- [CVE-2026-33377](https://insights.sbomify.com/CVE-2026-33377/): Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin (high 7.1)
- [CVE-2026-33376](https://insights.sbomify.com/CVE-2026-33376/): Auth Proxy IPv6 whitelist bypass (high 7.4)
- [CVE-2026-33375](https://insights.sbomify.com/CVE-2026-33375/): Grafana MSSQL Data Source Plugin: Restriction Bypass Leading to OOM DoS (medium 6.5)
- [CVE-2026-33374](https://insights.sbomify.com/CVE-2026-33374/): Unbounded memory allocation in the Prometheus rule conversion API (medium 6.5)
- [CVE-2026-33373](https://insights.sbomify.com/CVE-2026-33373/): Cross-site request forgery in synacor:zimbra collaboration suite (high 8.8)
- [CVE-2026-33372](https://insights.sbomify.com/CVE-2026-33372/): Cross-site request forgery in synacor:zimbra collaboration suite (medium 5.4)
- [CVE-2026-33371](https://insights.sbomify.com/CVE-2026-33371/): XML external entity in synacor:zimbra collaboration suite (medium 4.3)
- [CVE-2026-33370](https://insights.sbomify.com/CVE-2026-33370/): Cross-site scripting in synacor:zimbra collaboration suite (medium 6.1)
- [CVE-2026-3337](https://insights.sbomify.com/CVE-2026-3337/): Timing Side-Channel in AES-CCM Tag Verification in AWS-LC (high 8.2)
- [CVE-2026-33369](https://insights.sbomify.com/CVE-2026-33369/): Other in synacor:zimbra collaboration suite (medium 4.3)
- [CVE-2026-33368](https://insights.sbomify.com/CVE-2026-33368/): Cross-site scripting in synacor:zimbra collaboration suite (medium 6.1)
- [CVE-2026-33367](https://insights.sbomify.com/CVE-2026-33367/): Red Lion Controls N-Tron 700 Series Missing Authentication for Critical Function (critical 9.3)
- [CVE-2026-33366](https://insights.sbomify.com/CVE-2026-33366/): Missing authorization in BUFFALO Wi-Fi router products (medium 6.9)
- [CVE-2026-33362](https://insights.sbomify.com/CVE-2026-33362/): Meari SDK hardcoded cryptographic keys (high 8.6)
- [CVE-2026-33361](https://insights.sbomify.com/CVE-2026-33361/): Meari weak XOR obfuscation (high 7.5)
- [CVE-2026-3336](https://insights.sbomify.com/CVE-2026-3336/): PKCS7_verify Certificate Chain Validation Bypass in AWS-LC (high 8.7)
- [CVE-2026-33359](https://insights.sbomify.com/CVE-2026-33359/): Meari unauthenticated alert image access in cloud object storage (high 7.5)
- [CVE-2026-33357](https://insights.sbomify.com/CVE-2026-33357/): Meari OpenAPI device status IDOR (high 7.5)
- [CVE-2026-33356](https://insights.sbomify.com/CVE-2026-33356/): Meari MQTT broker missing per-device subscribe ACL (high 7.7)
- [CVE-2026-33355](https://insights.sbomify.com/CVE-2026-33355/): Discourse filters whisper posts from private-posts feed (medium 6.5)
- [CVE-2026-33354](https://insights.sbomify.com/CVE-2026-33354/): AVideo has an authenticated arbitrary local file read via `chunkFile` path injection in `aVideoEncoder.json.php` (high 7.6)
- [CVE-2026-33353](https://insights.sbomify.com/CVE-2026-33353/): Soft Serve: Authenticated repo import can clone server-local private repositories (high 7.1)
- [CVE-2026-33352](https://insights.sbomify.com/CVE-2026-33352/): AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass) (critical 9.8)
- [CVE-2026-33351](https://insights.sbomify.com/CVE-2026-33351/): AVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification Bypass (critical 9.1)
- [CVE-2026-33350](https://insights.sbomify.com/CVE-2026-33350/): LORIS has a SQL injection in MRI feedback popup (high 7.5)
- [CVE-2026-3335](https://insights.sbomify.com/CVE-2026-3335/): Canto <= 3.1.1 - Missing Authorization to Unauthenticated File Upload (medium 5.3)
- [CVE-2026-33349](https://insights.sbomify.com/CVE-2026-33349/): fast-xml-parser: Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation (medium 5.9)
- [CVE-2026-33348](https://insights.sbomify.com/CVE-2026-33348/): OpenEMR has Stored XSS in patient encounter Eye Exam form $CHRONIC2 and $CHRONIC3 (high 8.7)
- [CVE-2026-33347](https://insights.sbomify.com/CVE-2026-33347/): league/commonmark has an embed extension allowed_domains bypass (medium 6.3)
- [CVE-2026-33346](https://insights.sbomify.com/CVE-2026-33346/): OpenEMR has stored XSS in portal_payment.php via Unescaped table_args (high 8.7)
- [CVE-2026-33345](https://insights.sbomify.com/CVE-2026-33345/): solidtime vulnerable to IDOR in private projects (medium 6.5)
- [CVE-2026-33344](https://insights.sbomify.com/CVE-2026-33344/): Dagu has an incomplete fix for CVE-2026-27598: path traversal via %2F-encoded slashes in locateDAG (high 8.1)
- [CVE-2026-33343](https://insights.sbomify.com/CVE-2026-33343/): etcd: Nested etcd transactions bypass RBAC authorization checks (not scored)
- [CVE-2026-33340](https://insights.sbomify.com/CVE-2026-33340/): LoLLMs WEBUI has unauthenticated Server-Side Request Forgery (SSRF) in /api/proxy endpoint (critical 9.1)
- [CVE-2026-3334](https://insights.sbomify.com/CVE-2026-3334/): CMS Commander <= 2.288 - Authenticated (Custom+) SQL Injection via 'or_blogname' Parameter (high 8.8)
- [CVE-2026-33337](https://insights.sbomify.com/CVE-2026-33337/): Firebird has a buffer overflow when parsing corrupted slice packets (high 7.5)
- [CVE-2026-33336](https://insights.sbomify.com/CVE-2026-33336/): Vikunja Desktop vulnerable to Remote Code Execution via same-window navigation (medium 6.5)
- [CVE-2026-33335](https://insights.sbomify.com/CVE-2026-33335/): Vikunja Desktop allows arbitrary local application invocation via unvalidated shell.openExternal (medium 6.4)
- [CVE-2026-33334](https://insights.sbomify.com/CVE-2026-33334/): Vikunja Desktop: Any frontend XSS escalates to Remote Code Execution due to nodeIntegration (medium 6.5)
- [CVE-2026-33333](https://insights.sbomify.com/CVE-2026-33333/): Combodo iTop: Information disclosure in ajax.render.php (low 3.5)
- [CVE-2026-33332](https://insights.sbomify.com/CVE-2026-33332/): NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion (medium 6.9)
- [CVE-2026-33331](https://insights.sbomify.com/CVE-2026-33331/): oRPC: Stored XSS in OpenAPI Reference Plugin via unescaped JSON.stringify (high 8.2)
- [CVE-2026-33330](https://insights.sbomify.com/CVE-2026-33330/): FileRise ONLYOFFICE integration allows read-only users to overwrite files via forged save callback (high 7.1)
- [CVE-2026-3333](https://insights.sbomify.com/CVE-2026-3333/): MinhNhut Link Gateway <= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-33329](https://insights.sbomify.com/CVE-2026-33329/): Path traversal in FileRise (high 8.1)
- [CVE-2026-33328](https://insights.sbomify.com/CVE-2026-33328/): Possible integer overflow on 32-bit systems when reading GIF images (medium 6.8)
- [CVE-2026-33327](https://insights.sbomify.com/CVE-2026-33327/): Possible integer overflow leading to potential heap-based buffer overflow (high 7.0)
- [CVE-2026-33326](https://insights.sbomify.com/CVE-2026-33326/): @keystone-6/core: `isFilterable` bypass via `cursor` parameter in findMany (medium 4.3)
- [CVE-2026-33324](https://insights.sbomify.com/CVE-2026-33324/): SQLBot prompt injection allows arbitrary SQL execution and remote code execution (critical 9.4)
- [CVE-2026-33323](https://insights.sbomify.com/CVE-2026-33323/): Parse Server: Email verification resend page leaks user existence (medium 6.3)
- [CVE-2026-33322](https://insights.sbomify.com/CVE-2026-33322/): MinIO: JWT Algorithm Confusion in OIDC Authentication (critical 9.2)
- [CVE-2026-33321](https://insights.sbomify.com/CVE-2026-33321/): OpenEMR has Out-of-Band Server-Side Request Forgery (OOB SSRF) (high 7.2)
- [CVE-2026-33320](https://insights.sbomify.com/CVE-2026-33320/): Dasel has unbounded YAML alias expansion in dasel leads to CPU/memory denial of service (medium 6.2)
- [CVE-2026-3332](https://insights.sbomify.com/CVE-2026-3332/): Xhanch - My Advanced Settings <= 1.1.2 - Cross-Site Request Forgery to Settings Update (medium 4.3)
- [CVE-2026-33319](https://insights.sbomify.com/CVE-2026-33319/): AVideo Vulnerable to OS Command Injection via Unescaped URL in LinkedIn Video Upload Shell Command (medium 5.9)
- [CVE-2026-33318](https://insights.sbomify.com/CVE-2026-33318/): Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers (high 8.8)
- [CVE-2026-33317](https://insights.sbomify.com/CVE-2026-33317/): OP-TEE: PKCS#11 TA out-of-bounds read and memory disclosure (high 8.7)
- [CVE-2026-33316](https://insights.sbomify.com/CVE-2026-33316/): Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement (high 8.1)
- [CVE-2026-33315](https://insights.sbomify.com/CVE-2026-33315/): Vikunja has a 2FA Bypass via Caldav Basic Auth (medium 6.9)
- [CVE-2026-33314](https://insights.sbomify.com/CVE-2026-33314/): pyload-ng: Improper Authentication and Origin Validation Error (medium 6.5)
- [CVE-2026-33313](https://insights.sbomify.com/CVE-2026-33313/): Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments (medium 5.3)
- [CVE-2026-33312](https://insights.sbomify.com/CVE-2026-33312/): Read-only Vikunja users can delete project background images via broken object-level authorization (medium 5.3)
- [CVE-2026-33311](https://insights.sbomify.com/CVE-2026-33311/): @dicebear/core and @dicebear/initials Vulnerable to SVG Injection via Unsanitized Options (medium 4.7)
- [CVE-2026-33310](https://insights.sbomify.com/CVE-2026-33310/): Intake has a Command Injection via shell() Expansion in Parameter Defaults (high 8.8)
- [CVE-2026-3331](https://insights.sbomify.com/CVE-2026-3331/): Lobot Slider Administrator <= 0.6.0 - Cross-Site Request Forgery to Settings Update (medium 4.3)
- [CVE-2026-33309](https://insights.sbomify.com/CVE-2026-33309/): Langflow has an Arbitrary File Write (RCE) via v2 API (critical 10.0)
- [CVE-2026-33308](https://insights.sbomify.com/CVE-2026-33308/): mod_gnutls missing key purpose check in client certificate verification (medium 6.8)
- [CVE-2026-33307](https://insights.sbomify.com/CVE-2026-33307/): mod_gnutils has stack-based buffer overflow caused by a long client certificate chain (high 7.5)
- [CVE-2026-33306](https://insights.sbomify.com/CVE-2026-33306/): bcrypt-ruby has an Integer Overflow that Causes Zero Key-Strengthening Iterations at Cost=31 on JRuby (medium 4.5)
- [CVE-2026-33305](https://insights.sbomify.com/CVE-2026-33305/): OpenEMR has Authorization Bypass in FaxSMS AppDispatch Constructor (medium 5.4)
- [CVE-2026-33304](https://insights.sbomify.com/CVE-2026-33304/): OpenEMR has Authorization Bypass in Dated Reminders Log (medium 6.5)
- [CVE-2026-33303](https://insights.sbomify.com/CVE-2026-33303/): OpenEMR Vulnerable to Stored XSS via Unescaped portal_login_username in Credential Print View (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/710/