# Vulnerabilities published in 2026


- [CVE-2026-33203](https://insights.sbomify.com/CVE-2026-33203/): SiYuan has an Unauthenticated WebSocket DoS via Auth Keepalive Bypass (high 7.5)
- [CVE-2026-33202](https://insights.sbomify.com/CVE-2026-33202/): Rails Active Storage has possible glob injection in its DiskService (medium 6.6)
- [CVE-2026-33201](https://insights.sbomify.com/CVE-2026-33201/): Misconfiguration in Digital Photo Frame GH-WDF10A (high 7.0)
- [CVE-2026-3320](https://insights.sbomify.com/CVE-2026-3320/): Multiple vulnerabilities in Cradle e-commerce (medium 5.1)
- [CVE-2026-33197](https://insights.sbomify.com/CVE-2026-33197/): BDS Module Bypass Secure Boot Advisory (high 8.7)
- [CVE-2026-33195](https://insights.sbomify.com/CVE-2026-33195/): Rails Active Storage has possible Path Traversal in DiskService (high 8.0)
- [CVE-2026-33194](https://insights.sbomify.com/CVE-2026-33194/): SiYuan has an Incomplete Fix for IsSensitivePath Denylist Allows File Read from /opt, /usr, /home (medium 6.8)
- [CVE-2026-33193](https://insights.sbomify.com/CVE-2026-33193/): Docmost vulnerable to stored XSS via MIME type spoofing (medium 4.6)
- [CVE-2026-33192](https://insights.sbomify.com/CVE-2026-33192/): free5GC UDM incorrectly returns 500 for empty supi path parameter in PATCH sdm-subscriptions reques (high 8.7)
- [CVE-2026-33191](https://insights.sbomify.com/CVE-2026-33191/): free5GC UDM vulnerable to null byte injection in URL path parameters causing 500 Internal Server Error (high 8.7)
- [CVE-2026-33190](https://insights.sbomify.com/CVE-2026-33190/): CoreDNS TSIG authentication bypass on encrypted DNS transports (high 8.7)
- [CVE-2026-3319](https://insights.sbomify.com/CVE-2026-3319/): Multiple vulnerabilities in Cradle e-commerce (medium 5.1)
- [CVE-2026-33186](https://insights.sbomify.com/CVE-2026-33186/): gRPC-Go has an authorization bypass via missing leading slash in :path (critical 9.1)
- [CVE-2026-33185](https://insights.sbomify.com/CVE-2026-33185/): Discourse: Group SMTP test endpoint susceptible to SSRF (medium 5.3)
- [CVE-2026-33184](https://insights.sbomify.com/CVE-2026-33184/): nimiq/core-rs-albatross: Discovery handshake limit could underflow and later provoke a deterministic overflow panic (high 7.5)
- [CVE-2026-33183](https://insights.sbomify.com/CVE-2026-33183/): Saloon has a Fixture Name Path Traversal Vulnerability (high 8.0)
- [CVE-2026-33182](https://insights.sbomify.com/CVE-2026-33182/): Saloon is vulnerable to SSRF and credential leakage via absolute URL in endpoint overriding base URL (medium 6.6)
- [CVE-2026-33180](https://insights.sbomify.com/CVE-2026-33180/): HAPI FHIR HTTP authentication leak in redirects (high 7.5)
- [CVE-2026-3318](https://insights.sbomify.com/CVE-2026-3318/): Multiple vulnerabilities in Cradle e-commerce (medium 5.3)
- [CVE-2026-33179](https://insights.sbomify.com/CVE-2026-33179/): libfuse: NULL Pointer Dereference and Memory Leak in io_uring Queue Initialization (medium 5.5)
- [CVE-2026-33177](https://insights.sbomify.com/CVE-2026-33177/): Statamic is missing authorization check on taxonomy term creation via fieldtype (medium 4.3)
- [CVE-2026-33176](https://insights.sbomify.com/CVE-2026-33176/): Rails Active Support has a possible DoS vulnerability in its number helpers (medium 6.6)
- [CVE-2026-33175](https://insights.sbomify.com/CVE-2026-33175/): OAuthenticator: Authentication Bypass in Auth0OAuthenticator via Unverified Email Claims (high 8.8)
- [CVE-2026-33174](https://insights.sbomify.com/CVE-2026-33174/): Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests (medium 6.6)
- [CVE-2026-33173](https://insights.sbomify.com/CVE-2026-33173/): Rails Active Storage has possible content type bypass via metadata in direct uploads (medium 5.3)
- [CVE-2026-33172](https://insights.sbomify.com/CVE-2026-33172/): Statamic has Stored XSS via SVG Sanitization Bypass (high 8.7)
- [CVE-2026-33171](https://insights.sbomify.com/CVE-2026-33171/): Statamic has a path traversal in file dictionary fieldtype (medium 4.3)
- [CVE-2026-33170](https://insights.sbomify.com/CVE-2026-33170/): Rails Active Support has a possible XSS vulnerability in SafeBuffer#% (medium 5.3)
- [CVE-2026-3317](https://insights.sbomify.com/CVE-2026-3317/): Reflected Cross-Site Scripting in Navigate CMS application (medium 5.1)
- [CVE-2026-33169](https://insights.sbomify.com/CVE-2026-33169/): Rails Active Support has a possible ReDoS vulnerability in number_to_delimited (medium 6.9)
- [CVE-2026-33168](https://insights.sbomify.com/CVE-2026-33168/): Rails has a possible XSS vulnerability in its Action View tag helpers (low 2.3)
- [CVE-2026-33167](https://insights.sbomify.com/CVE-2026-33167/): Rails has a possible XSS vulnerability in its Action Pack debug exceptions (low 1.3)
- [CVE-2026-33166](https://insights.sbomify.com/CVE-2026-33166/): Allure Report has an Arbitrary File Read via Path Traversal in Attachment Processing (Allure 1, Allure 2, and XCTest Readers) (high 8.6)
- [CVE-2026-33165](https://insights.sbomify.com/CVE-2026-33165/): heap out-of-bounds write in libde265 1.0.16 (medium 5.5)
- [CVE-2026-33164](https://insights.sbomify.com/CVE-2026-33164/): NULL Pointer Dereference in libde265 (high 8.7)
- [CVE-2026-33163](https://insights.sbomify.com/CVE-2026-33163/): Parse Server leaks protected fields via LiveQuery afterEvent trigger (high 8.2)
- [CVE-2026-33162](https://insights.sbomify.com/CVE-2026-33162/): Craft CMS has an authorization bypass which allows any control panel user to move entries without permissions (medium 4.9)
- [CVE-2026-33161](https://insights.sbomify.com/CVE-2026-33161/): Craft CMS: Anonymous "assets/image-editor" calls returns private asset editor metadata to unauthorized users (low 1.3)
- [CVE-2026-33160](https://insights.sbomify.com/CVE-2026-33160/): Craft CMS: Anonymous "generate transform" calls for assets can expose private assets via transform URL (low 2.7)
- [CVE-2026-33159](https://insights.sbomify.com/CVE-2026-33159/): Craft CMS: Unauthenticated Users Can Perform Restricted Project Config Sync Operations (medium 6.9)
- [CVE-2026-33158](https://insights.sbomify.com/CVE-2026-33158/): Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR) (medium 4.9)
- [CVE-2026-33157](https://insights.sbomify.com/CVE-2026-33157/): Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior (high 8.6)
- [CVE-2026-33156](https://insights.sbomify.com/CVE-2026-33156/): DLL Sideloading in ScreenToGif (high 7.8)
- [CVE-2026-33155](https://insights.sbomify.com/CVE-2026-33155/): DeepDiff has Memory Exhaustion DoS through SAFE_TO_IMPORT (high 8.7)
- [CVE-2026-33154](https://insights.sbomify.com/CVE-2026-33154/): dynaconf Affected by Remote Code Execution (RCE) via Insecure Template Evaluation in @jinja Resolver (high 7.5)
- [CVE-2026-33153](https://insights.sbomify.com/CVE-2026-33153/): Information disclosure in recipes (high 7.7)
- [CVE-2026-33152](https://insights.sbomify.com/CVE-2026-33152/): Tandoor Recipes Vulnerable to Unrestricted Brute-Force via BasicAuthentication (critical 9.1)
- [CVE-2026-33151](https://insights.sbomify.com/CVE-2026-33151/): socket.io allows an unbounded number of binary attachments (high 8.7)
- [CVE-2026-33150](https://insights.sbomify.com/CVE-2026-33150/): Use After Free in libfuse (high 7.8)
- [CVE-2026-3315](https://insights.sbomify.com/CVE-2026-3315/): Local Privilege Escalation Due to Writable Executable in Privileged Visionline Service Path (medium 5.8)
- [CVE-2026-33149](https://insights.sbomify.com/CVE-2026-33149/): Tandoor Recipes Vulnerable to Host Header Injection (high 8.1)
- [CVE-2026-33148](https://insights.sbomify.com/CVE-2026-33148/): URL Parameter Injection in FDC Food Search API Causes Server Crash and Exposes Internal API Key (medium 6.5)
- [CVE-2026-33147](https://insights.sbomify.com/CVE-2026-33147/): GMT: Stack-based Buffer Overflow in gmt_remote_dataset_id (high 7.3)
- [CVE-2026-33146](https://insights.sbomify.com/CVE-2026-33146/): Docmost's Public Share Search Exposes Metadata of Restricted Children (medium 4.3)
- [CVE-2026-33145](https://insights.sbomify.com/CVE-2026-33145/): xrdp: Authenticated RCE via unsanitized AlternateShell execution in xrdp-sesman (medium 6.3)
- [CVE-2026-33144](https://insights.sbomify.com/CVE-2026-33144/): GPAC MP4Box Heap Buffer Overflow Write in gf_xml_parse_bit_sequence_bs (NHML BS Parsing) (medium 5.8)
- [CVE-2026-33143](https://insights.sbomify.com/CVE-2026-33143/): OneUptime: WhatsApp Webhook Missing Signature Verification (high 8.7)
- [CVE-2026-33142](https://insights.sbomify.com/CVE-2026-33142/): OneUptime: ClickHouse SQL Injection via unvalidated column identifiers in sort, select, and groupBy parameters (high 8.1)
- [CVE-2026-33141](https://insights.sbomify.com/CVE-2026-33141/): Chamilo LMS has an IDOR in REST API Stats Endpoint Exposes Any User's Learning Data (medium 6.5)
- [CVE-2026-33140](https://insights.sbomify.com/CVE-2026-33140/): PySpector: Stored XSS in PySpector HTML Report Generation leads to Javascript Code Execution (medium 5.3)
- [CVE-2026-3314](https://insights.sbomify.com/CVE-2026-3314/): Information disclosure in Hitachi Infrastructure Analytics Advisor (medium 4.6)
- [CVE-2026-33139](https://insights.sbomify.com/CVE-2026-33139/): PySpector: Plugin Sandbox Bypass leads to Arbitrary Code Execution (high 8.3)
- [CVE-2026-33137](https://insights.sbomify.com/CVE-2026-33137/): XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName} (critical 9.3)
- [CVE-2026-33136](https://insights.sbomify.com/CVE-2026-33136/): WeGIA has Reflected Cross-Site Scripting (XSS) in `listar_memorandos_ativos.php` via `sccd` parameter (critical 9.3)
- [CVE-2026-33135](https://insights.sbomify.com/CVE-2026-33135/): WeGIA has Reflected Cross-Site Scripting (XSS) in `novo_memorandoo.php` via `sccs` parameter (critical 9.3)
- [CVE-2026-33134](https://insights.sbomify.com/CVE-2026-33134/): WeGIA has Authenticated Time-Based Blind SQL Injection in `restaurar_produto.php` via `id_produto` parameter (critical 9.3)
- [CVE-2026-33133](https://insights.sbomify.com/CVE-2026-33133/): WeGIA has an arbitrary SQL execution vulnerability via crafted backup archive (high 8.6)
- [CVE-2026-33132](https://insights.sbomify.com/CVE-2026-33132/): ZITADEL is missing enforcement of organization scopes (medium 5.3)
- [CVE-2026-33131](https://insights.sbomify.com/CVE-2026-33131/): h3 has a middleware bypass with one gadget (high 7.4)
- [CVE-2026-33130](https://insights.sbomify.com/CVE-2026-33130/): Uptime Kuma: SSTI in Notification Templates Allows Arbitrary File Read (Incomplete Fix for GHSA-vffh-c9pq-4crh) (medium 6.5)
- [CVE-2026-33129](https://insights.sbomify.com/CVE-2026-33129/): h3 has an observable timing discrepancy in basic auth utils (medium 5.9)
- [CVE-2026-33128](https://insights.sbomify.com/CVE-2026-33128/): h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields (high 7.5)
- [CVE-2026-33126](https://insights.sbomify.com/CVE-2026-33126/): Frigate has SSRF vulnerability in /ffprobe endpoint (medium 5.0)
- [CVE-2026-33125](https://insights.sbomify.com/CVE-2026-33125/): Frigate Broken Access Control: Users assigned the viewer role can delete admin and other low-privileged accounts (high 7.1)
- [CVE-2026-33124](https://insights.sbomify.com/CVE-2026-33124/): Frigate has insecure password change functionality (high 8.6)
- [CVE-2026-33123](https://insights.sbomify.com/CVE-2026-33123/): pypdf has inefficient decoding of array-based streams (medium 5.1)
- [CVE-2026-33122](https://insights.sbomify.com/CVE-2026-33122/): DataEase has SQL Injection via Datasource Management (high 8.6)
- [CVE-2026-33121](https://insights.sbomify.com/CVE-2026-33121/): DataEase has SQL Injection via Datasource Save Flow (high 8.7)
- [CVE-2026-33120](https://insights.sbomify.com/CVE-2026-33120/): Microsoft SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-33119](https://insights.sbomify.com/CVE-2026-33119/): Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability (medium 5.4)
- [CVE-2026-33118](https://insights.sbomify.com/CVE-2026-33118/): Microsoft Edge (Chromium-based) Spoofing Vulnerability (medium 4.3)
- [CVE-2026-33117](https://insights.sbomify.com/CVE-2026-33117/): Azure SDK for Java Security Feature Bypass Vulnerability (critical 9.1)
- [CVE-2026-33116](https://insights.sbomify.com/CVE-2026-33116/): .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability (high 7.5)
- [CVE-2026-33115](https://insights.sbomify.com/CVE-2026-33115/): Microsoft Word Remote Code Execution Vulnerability (high 8.4)
- [CVE-2026-33114](https://insights.sbomify.com/CVE-2026-33114/): Microsoft Word Remote Code Execution Vulnerability (high 8.4)
- [CVE-2026-33113](https://insights.sbomify.com/CVE-2026-33113/): Microsoft SharePoint Server Spoofing Vulnerability (medium 5.4)
- [CVE-2026-33112](https://insights.sbomify.com/CVE-2026-33112/): Microsoft SharePoint Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-33111](https://insights.sbomify.com/CVE-2026-33111/): Copilot Chat (Microsoft Edge) Information Disclosure Vulnerability (high 7.5)
- [CVE-2026-33110](https://insights.sbomify.com/CVE-2026-33110/): Microsoft SharePoint Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-3311](https://insights.sbomify.com/CVE-2026-3311/): Cross-site scripting in The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce (medium 6.4)
- [CVE-2026-33109](https://insights.sbomify.com/CVE-2026-33109/): Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability (critical 9.9)
- [CVE-2026-33107](https://insights.sbomify.com/CVE-2026-33107/): Azure Databricks Elevation of Privilege Vulnerability (critical 10.0)
- [CVE-2026-33105](https://insights.sbomify.com/CVE-2026-33105/): Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability (critical 10.0)
- [CVE-2026-33104](https://insights.sbomify.com/CVE-2026-33104/): Win32k Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-33103](https://insights.sbomify.com/CVE-2026-33103/): Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-33102](https://insights.sbomify.com/CVE-2026-33102/): Microsoft 365 Copilot Elevation of Privilege Vulnerability (critical 9.3)
- [CVE-2026-33101](https://insights.sbomify.com/CVE-2026-33101/): Windows Print Spooler Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-33100](https://insights.sbomify.com/CVE-2026-33100/): Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-33099](https://insights.sbomify.com/CVE-2026-33099/): Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-33098](https://insights.sbomify.com/CVE-2026-33098/): Windows Container Isolation FS Filter Driver Elevation of Privilege Vulnerability (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/712/