# Vulnerabilities published in 2026


- [CVE-2026-33302](https://insights.sbomify.com/CVE-2026-33302/): OpenEMR: zhAclCheck Ignores Explicit ACL Denies (high 7.3)
- [CVE-2026-33301](https://insights.sbomify.com/CVE-2026-33301/): OpenEMR has arbitrary image file read via PDF generator (high 7.1)
- [CVE-2026-33300](https://insights.sbomify.com/CVE-2026-33300/): Discourse: Hidden group names and access metadata are exposed to moderators through the `category-chatables` endpoint (medium 5.3)
- [CVE-2026-3330](https://insights.sbomify.com/CVE-2026-3330/): Form Maker by 10Web <= 1.15.40 - Authenticated (Administrator+) SQL Injection via 'ip_search' Parameter (medium 4.9)
- [CVE-2026-33299](https://insights.sbomify.com/CVE-2026-33299/): OpenEMR has Stored XSS in patient encounter Eye Exam form answers (high 8.5)
- [CVE-2026-33298](https://insights.sbomify.com/CVE-2026-33298/): llama.cpp has a Heap Buffer Overflow via Integer Overflow in GGUF Tensor Parsing (high 7.8)
- [CVE-2026-33297](https://insights.sbomify.com/CVE-2026-33297/): AVideo has an IDOR - Any Admin Can Set Another User's Channel Password via setPassword.json.php (medium 5.1)
- [CVE-2026-33296](https://insights.sbomify.com/CVE-2026-33296/): AVideo has an Open Redirect via Unvalidated redirectUri in userLogin.php (low 2.1)
- [CVE-2026-33295](https://insights.sbomify.com/CVE-2026-33295/): AVideo Vulnerable to Stored XSS via Unescaped Video Title in CDN downloadButtons.php (high 8.2)
- [CVE-2026-33294](https://insights.sbomify.com/CVE-2026-33294/): AVideo has SSRF in BulkEmbed Thumbnail Fetch that Allows Reading Internal Network Resources (medium 5.0)
- [CVE-2026-33293](https://insights.sbomify.com/CVE-2026-33293/): AVideo Affected by Arbitrary File Deletion via Path Traversal in CloneSite deleteDump Parameter (high 8.1)
- [CVE-2026-33292](https://insights.sbomify.com/CVE-2026-33292/): AVideo has Authorization Bypass via Path Traversal in HLS Endpoint Allows Streaming Private/Paid Videos (high 7.5)
- [CVE-2026-33291](https://insights.sbomify.com/CVE-2026-33291/): Discourse user can create Zendesk tickets even when it does not have access to topic (medium 5.1)
- [CVE-2026-33290](https://insights.sbomify.com/CVE-2026-33290/): Missing authorization in wp-graphql (medium 4.3)
- [CVE-2026-3329](https://insights.sbomify.com/CVE-2026-3329/): Nexus Repository Manager - Improper Restriction of Excessive Authentication Attempts (high 8.7)
- [CVE-2026-33289](https://insights.sbomify.com/CVE-2026-33289/): SuiterCRM has LDAP Filter Injection in Authentication Module (high 8.8)
- [CVE-2026-33288](https://insights.sbomify.com/CVE-2026-33288/): SuiteCRM has Authenticated SQL Injection in Authentication Module (high 8.8)
- [CVE-2026-33287](https://insights.sbomify.com/CVE-2026-33287/): LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern (high 7.5)
- [CVE-2026-33286](https://insights.sbomify.com/CVE-2026-33286/): Graphiti Affected by Arbitrary Method Execution via Unvalidated Relationship Names (critical 9.1)
- [CVE-2026-33285](https://insights.sbomify.com/CVE-2026-33285/): LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash (high 7.5)
- [CVE-2026-33284](https://insights.sbomify.com/CVE-2026-33284/): GlobalLeaks has insufficient URL validation in user support API (low 1.2)
- [CVE-2026-33283](https://insights.sbomify.com/CVE-2026-33283/): Ella Core panics on malformed ULNASTransport Message without a Request Type (medium 6.5)
- [CVE-2026-33282](https://insights.sbomify.com/CVE-2026-33282/): Ella Core panics on malformed NGAP Location Report (high 7.5)
- [CVE-2026-33281](https://insights.sbomify.com/CVE-2026-33281/): Ella Core panics on invalid PDU Session IDs in NGAP messages (medium 6.5)
- [CVE-2026-33280](https://insights.sbomify.com/CVE-2026-33280/): Command injection in BUFFALO Wi-Fi router products (high 8.6)
- [CVE-2026-3328](https://insights.sbomify.com/CVE-2026-3328/): Deserialization in Frontend Admin by DynamiApps (high 7.2)
- [CVE-2026-33278](https://insights.sbomify.com/CVE-2026-33278/): Possible arbitrary code execution during DNSSEC validation (critical 9.1)
- [CVE-2026-33277](https://insights.sbomify.com/CVE-2026-33277/): Command injection in LogonTracer (high 8.7)
- [CVE-2026-33276](https://insights.sbomify.com/CVE-2026-33276/): XSS in Unified Search via Unescaped Host/Service Names (high 8.6)
- [CVE-2026-33273](https://insights.sbomify.com/CVE-2026-33273/): File upload in MATCHA INVOICE (medium 5.1)
- [CVE-2026-33272](https://insights.sbomify.com/CVE-2026-33272/): Red Lion Controls N-Tron 700 Series Authentication Bypass Using an Alternate Path or Channel (medium 6.8)
- [CVE-2026-33271](https://insights.sbomify.com/CVE-2026-33271/): Privilege escalation in Acronis True Image (medium 6.7)
- [CVE-2026-3327](https://insights.sbomify.com/CVE-2026-3327/): Authenticated DatoCMS Web Previews Plugin Iframe Injection (medium 4.8)
- [CVE-2026-33268](https://insights.sbomify.com/CVE-2026-33268/): Nanoleaf Lines unauthenticated firmware file store (medium 6.9)
- [CVE-2026-33267](https://insights.sbomify.com/CVE-2026-33267/): Apache Traffic Server: Untrusted @ headers can spoof ATS internal metadata (high 7.7)
- [CVE-2026-33266](https://insights.sbomify.com/CVE-2026-33266/): Apache OpenMeetings: Hardcoded Remember-Me Cookie Encryption Key and Salt (high 7.5)
- [CVE-2026-33265](https://insights.sbomify.com/CVE-2026-33265/): Information disclosure in LibreChat (medium 6.3)
- [CVE-2026-33264](https://insights.sbomify.com/CVE-2026-33264/): Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize() (critical 9.8)
- [CVE-2026-33263](https://insights.sbomify.com/CVE-2026-33263/): Denial of service in OX Dovecot CE (medium 4.3)
- [CVE-2026-33262](https://insights.sbomify.com/CVE-2026-33262/): Insufficient validation of cookie reply (medium 5.9)
- [CVE-2026-33261](https://insights.sbomify.com/CVE-2026-33261/): Null pointer accces in aggressive NSEC(3) cache (medium 5.9)
- [CVE-2026-33260](https://insights.sbomify.com/CVE-2026-33260/): Insufficient input validation of internal webserver (medium 5.3)
- [CVE-2026-3326](https://insights.sbomify.com/CVE-2026-3326/): XStore < 9.7.3 - Unauthenticated SQLi (high 8.6)
- [CVE-2026-33259](https://insights.sbomify.com/CVE-2026-33259/): Concurrent modification of RPZ data can lead to denial of servce (medium 5.0)
- [CVE-2026-33258](https://insights.sbomify.com/CVE-2026-33258/): Crafted zones can cause increased resource usage (medium 5.3)
- [CVE-2026-33257](https://insights.sbomify.com/CVE-2026-33257/): Insufficient input validation of internal webserver (medium 5.3)
- [CVE-2026-33256](https://insights.sbomify.com/CVE-2026-33256/): Unbounded memory allocation by internal web server (medium 5.3)
- [CVE-2026-33254](https://insights.sbomify.com/CVE-2026-33254/): Resource exhaustion via DoQ/DoH3 connections (medium 5.3)
- [CVE-2026-33253](https://insights.sbomify.com/CVE-2026-33253/): Privilege escalation in SANUPS SOFTWARE (high 8.4)
- [CVE-2026-33252](https://insights.sbomify.com/CVE-2026-33252/): MCP Go SDK Allows Cross-Site Tool Execution for HTTP Servers without Authorizatrion (high 7.1)
- [CVE-2026-33251](https://insights.sbomify.com/CVE-2026-33251/): Discourse has a Hidden Solved topics permission bypass (medium 5.4)
- [CVE-2026-33250](https://insights.sbomify.com/CVE-2026-33250/): Crash when receiving specially-crafted packets (high 7.5)
- [CVE-2026-3325](https://insights.sbomify.com/CVE-2026-3325/): SQL injection in MegaCMS by CRM Sistemas de Fidelización (critical 10.0)
- [CVE-2026-33249](https://insights.sbomify.com/CVE-2026-33249/): NATS: Message tracing can be redirected to arbitrary subject (medium 4.3)
- [CVE-2026-33248](https://insights.sbomify.com/CVE-2026-33248/): NATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching (medium 4.2)
- [CVE-2026-33247](https://insights.sbomify.com/CVE-2026-33247/): NATS credentials are exposed in monitoring port via command-line argv (high 7.4)
- [CVE-2026-33246](https://insights.sbomify.com/CVE-2026-33246/): NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers (medium 6.4)
- [CVE-2026-33245](https://insights.sbomify.com/CVE-2026-33245/): React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets (high 8.0)
- [CVE-2026-33244](https://insights.sbomify.com/CVE-2026-33244/): React Router has stored XSS via unescaped Location header in prerendered redirect HTML (medium 5.4)
- [CVE-2026-33243](https://insights.sbomify.com/CVE-2026-33243/): barebox: FIT Signature Verification Bypass Vulnerability (high 8.3)
- [CVE-2026-33242](https://insights.sbomify.com/CVE-2026-33242/): Salvo has a Path Traversal in salvo-proxy::encode_url_path allows API Gateway Bypass (high 7.5)
- [CVE-2026-33241](https://insights.sbomify.com/CVE-2026-33241/): Salvo Affected by Denial of Service via Unbounded Memory Allocation in Form Data Parsing (high 8.7)
- [CVE-2026-33240](https://insights.sbomify.com/CVE-2026-33240/): Combodo iTop: Reflected XSS in foreign key search criteria (high 8.8)
- [CVE-2026-3324](https://insights.sbomify.com/CVE-2026-3324/): Authentication Bypass (high 8.2)
- [CVE-2026-33238](https://insights.sbomify.com/CVE-2026-33238/): AVideo has a Path Traversal in listFiles.json.php that Enables Server Filesystem Enumeration (medium 4.3)
- [CVE-2026-33237](https://insights.sbomify.com/CVE-2026-33237/): AVideo has SSRF in Scheduler Plugin via callbackURL Missing `isSSRFSafeURL()` Validation (medium 5.5)
- [CVE-2026-33236](https://insights.sbomify.com/CVE-2026-33236/): NLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File Overwrite (high 8.1)
- [CVE-2026-33235](https://insights.sbomify.com/CVE-2026-33235/): AutoGPT: Denial of Service (DoS) via Resource Exhaustion in text templating features (high 7.7)
- [CVE-2026-33234](https://insights.sbomify.com/CVE-2026-33234/): AutoGPT: SendEmailBlock's IP blocklist bypass allows SSRF via user-controlled SMTP server (medium 5.0)
- [CVE-2026-33233](https://insights.sbomify.com/CVE-2026-33233/): AutoGPT Platform: Remote Code Execution via Unsafe Pickle Deserialization of Redis Cache Entries (high 7.6)
- [CVE-2026-33232](https://insights.sbomify.com/CVE-2026-33232/): AutoGPT: Unauthenticated DoS via Disk Space Exhaustion (high 7.5)
- [CVE-2026-33231](https://insights.sbomify.com/CVE-2026-33231/): NLTK has unauthenticated remote shutdown in nltk.app.wordnet_app (high 7.5)
- [CVE-2026-33230](https://insights.sbomify.com/CVE-2026-33230/): nltk Vulnerable to Cross-site Scripting (medium 6.1)
- [CVE-2026-3323](https://insights.sbomify.com/CVE-2026-3323/): VEGA: Privilege escalation through unsecured configuration interface in VEGAPULS devices (high 7.5)
- [CVE-2026-33229](https://insights.sbomify.com/CVE-2026-33229/): XWiki Platform affected by remote code execution with script right through unprotected Velocity scripting API (high 8.6)
- [CVE-2026-33228](https://insights.sbomify.com/CVE-2026-33228/): flatted: Prototype Pollution via parse() (high 8.9)
- [CVE-2026-33227](https://insights.sbomify.com/CVE-2026-33227/): Apache ActiveMQ: Improper validation and restriction of a classpath path name (medium 4.3)
- [CVE-2026-33226](https://insights.sbomify.com/CVE-2026-33226/): Budibase Unrestricted Server-Side Request Forgery (SSRF) via REST Datasource Query Preview (high 8.7)
- [CVE-2026-33223](https://insights.sbomify.com/CVE-2026-33223/): NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing (medium 6.4)
- [CVE-2026-33222](https://insights.sbomify.com/CVE-2026-33222/): NATS JetStream has an authorization bypass through its Management API (medium 4.9)
- [CVE-2026-33221](https://insights.sbomify.com/CVE-2026-33221/): Nhost Storage Affected by MIME Type Spoofing via Trusted Client Content-Type Header in Storage Upload (low 2.1)
- [CVE-2026-33220](https://insights.sbomify.com/CVE-2026-33220/): Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository (medium 6.8)
- [CVE-2026-3322](https://insights.sbomify.com/CVE-2026-3322/): Privilege escalation via request replaying in Lobster_pro (medium 5.6)
- [CVE-2026-33219](https://insights.sbomify.com/CVE-2026-33219/): NATS is vulnerable to pre-auth DoS through WebSockets client service (medium 5.3)
- [CVE-2026-33218](https://insights.sbomify.com/CVE-2026-33218/): NATS has pre-auth server panic via leafnode handling (high 7.5)
- [CVE-2026-33217](https://insights.sbomify.com/CVE-2026-33217/): NATS allows MQTT clients to bypass ACL checks (high 7.1)
- [CVE-2026-33216](https://insights.sbomify.com/CVE-2026-33216/): NATS has MQTT plaintext password disclosure (high 8.6)
- [CVE-2026-33215](https://insights.sbomify.com/CVE-2026-33215/): NATS is vulnerable to MQTT hijacking via Client ID (medium 6.5)
- [CVE-2026-33214](https://insights.sbomify.com/CVE-2026-33214/): Weblate has improper access control for the translation memory API (medium 4.3)
- [CVE-2026-33213](https://insights.sbomify.com/CVE-2026-33213/): Redash: Open redirect vulnerability in post-login redirect handling (medium 6.1)
- [CVE-2026-33212](https://insights.sbomify.com/CVE-2026-33212/): Weblate: Improper access control for pending tasks in API (low 3.1)
- [CVE-2026-33211](https://insights.sbomify.com/CVE-2026-33211/): Tekton Pipelines git resolver has path traversal that allows reading arbitrary files from the resolver pod (critical 9.6)
- [CVE-2026-33210](https://insights.sbomify.com/CVE-2026-33210/): Ruby JSON has a format string injection vulnerability (high 8.3)
- [CVE-2026-3321](https://insights.sbomify.com/CVE-2026-3321/): Authorization Bypass in ON24 Q&A chat (high 8.7)
- [CVE-2026-33209](https://insights.sbomify.com/CVE-2026-33209/): Avo has a XSS vulnerability on `return_to` param (medium 5.3)
- [CVE-2026-33208](https://insights.sbomify.com/CVE-2026-33208/): Roxy-WI Vulnerable to Authenticated Remote Code Execution via OS Command Injection in find-in-config Endpoint (high 7.4)
- [CVE-2026-33207](https://insights.sbomify.com/CVE-2026-33207/): DataEase SQL Injection Vulnerability (high 8.6)
- [CVE-2026-33206](https://insights.sbomify.com/CVE-2026-33206/): calibre has a path traversal vulnerability (high 8.2)
- [CVE-2026-33205](https://insights.sbomify.com/CVE-2026-33205/): calibre has Server-Side Request Forgery in ebook viewer backend (medium 4.8)
- [CVE-2026-33204](https://insights.sbomify.com/CVE-2026-33204/): SimpleJWT has an Unauthenticated Denial of Service via JWE header tampering (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/711/