# Vulnerabilities published in 2026


- [CVE-2026-33096](https://insights.sbomify.com/CVE-2026-33096/): HTTP.sys Denial of Service Vulnerability (high 7.5)
- [CVE-2026-33095](https://insights.sbomify.com/CVE-2026-33095/): Microsoft Word Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-33093](https://insights.sbomify.com/CVE-2026-33093/): Anviz Products Missing Authorization (medium 5.3)
- [CVE-2026-33092](https://insights.sbomify.com/CVE-2026-33092/): Privilege escalation in Acronis True Image (high 7.8)
- [CVE-2026-3309](https://insights.sbomify.com/CVE-2026-3309/): Code injection in Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress (medium 6.5)
- [CVE-2026-33088](https://insights.sbomify.com/CVE-2026-33088/): SQL injection in Movable Type (medium 6.9)
- [CVE-2026-33084](https://insights.sbomify.com/CVE-2026-33084/): DataEase has SQL Injection through its getFieldEnumObj Endpoint (high 8.7)
- [CVE-2026-33083](https://insights.sbomify.com/CVE-2026-33083/): DataEase has SQL Injection in Order By Clause (high 8.7)
- [CVE-2026-33082](https://insights.sbomify.com/CVE-2026-33082/): DataEase: SQL Injection in v2 Dataset Export (high 8.7)
- [CVE-2026-33081](https://insights.sbomify.com/CVE-2026-33081/): PinchTab has Blind SSRF via browser-side redirect bypass in /download URL validation (medium 5.8)
- [CVE-2026-33080](https://insights.sbomify.com/CVE-2026-33080/): Filament: Unvalidated Range and Values summarizer values can be used for XSS (high 7.3)
- [CVE-2026-3308](https://insights.sbomify.com/CVE-2026-3308/): CVE-2026-3308 (high 7.8)
- [CVE-2026-33079](https://insights.sbomify.com/CVE-2026-33079/): Mistune ReDoS in LINK_TITLE_RE allows denial of service with crafted Markdown titles (high 8.7)
- [CVE-2026-33078](https://insights.sbomify.com/CVE-2026-33078/): Roxy-WI has SQL Injection in haproxy_section_save Endpoint via Unsanitized server_ip Parameter (high 8.9)
- [CVE-2026-33077](https://insights.sbomify.com/CVE-2026-33077/): Roxy-WI has an arbitrary file read vulnerability (high 7.7)
- [CVE-2026-33076](https://insights.sbomify.com/CVE-2026-33076/): Roxy-WI vulnerable to path traversal and arbitrary file writing (high 8.9)
- [CVE-2026-33075](https://insights.sbomify.com/CVE-2026-33075/): FastGPT has Arbitrary Code Execution in GitHub Actions via pull_request_target in fastgpt-preview-image.yml (critical 9.4)
- [CVE-2026-33074](https://insights.sbomify.com/CVE-2026-33074/): Discourse: Vulnerability in discourse-subscriptions plugin allowing users to self-grant to higher tier subscriptions (medium 6.3)
- [CVE-2026-33073](https://insights.sbomify.com/CVE-2026-33073/): discourse-subscriptions plugin leaking stripe API key in multisite environment (low 2.0)
- [CVE-2026-33072](https://insights.sbomify.com/CVE-2026-33072/): FileRise: Default Encryption Key Enables Token Forgery and Config Decryption (high 8.2)
- [CVE-2026-33071](https://insights.sbomify.com/CVE-2026-33071/): FileRise: WebDAV upload path bypasses filename validation enforced by regular uploads (medium 4.3)
- [CVE-2026-33070](https://insights.sbomify.com/CVE-2026-33070/): FileRise has Unauthenticated Share Link Deletion (low 3.7)
- [CVE-2026-3307](https://insights.sbomify.com/CVE-2026-3307/): Missing authorization in Enterprise Server (medium 5.3)
- [CVE-2026-33069](https://insights.sbomify.com/CVE-2026-33069/): PJSIP has an Out-of-bounds Read in SIP multipart parsing (medium 6.9)
- [CVE-2026-33068](https://insights.sbomify.com/CVE-2026-33068/): Claude Code has a Workspace Trust Dialog Bypass via Repo-Controlled Settings File (high 7.7)
- [CVE-2026-33067](https://insights.sbomify.com/CVE-2026-33067/): SiYuan has Stored XSS to RCE via Unsanitized Bazaar Package Metadata (medium 5.3)
- [CVE-2026-33066](https://insights.sbomify.com/CVE-2026-33066/): SiYuan has Stored XSS to RCE via Unsanitized Bazaar README Rendering (medium 5.3)
- [CVE-2026-33065](https://insights.sbomify.com/CVE-2026-33065/): free5GC UDM incorrectly returns 500 for empty supi path parameter in DELETE sdm-subscriptions request (medium 6.9)
- [CVE-2026-33064](https://insights.sbomify.com/CVE-2026-33064/): free5GC UDM DataChangeNotification Procedure Panic Due to Nil Pointer Dereference (high 8.7)
- [CVE-2026-33063](https://insights.sbomify.com/CVE-2026-33063/): free5GC AUSF UE Authentication Panic on Nil SuciSupiMap Interface Conversion (high 8.7)
- [CVE-2026-33062](https://insights.sbomify.com/CVE-2026-33062/): free5GC NRF Discovery EncodeGroupId Function Panics on Malformed group-id-list Parameter (high 8.7)
- [CVE-2026-33061](https://insights.sbomify.com/CVE-2026-33061/): Jexactyl has Stored DOM Cross-Site Scripting (XSS) via unescaped JSON in Blade template (medium 5.8)
- [CVE-2026-33060](https://insights.sbomify.com/CVE-2026-33060/): CKAN MCP Server: SSRF via base_url allows access to internal networks (medium 5.3)
- [CVE-2026-3306](https://insights.sbomify.com/CVE-2026-3306/): Missing authorization in Enterprise Server (medium 5.3)
- [CVE-2026-33058](https://insights.sbomify.com/CVE-2026-33058/): Kanboard has Authenticated SQL Injection in Project Permissions Handler (high 8.4)
- [CVE-2026-33057](https://insights.sbomify.com/CVE-2026-33057/): Mesop Affected by Unauthenticated Remote Code Execution via Test Suite Route /exec-py (critical 9.8)
- [CVE-2026-33056](https://insights.sbomify.com/CVE-2026-33056/): tar-rs: unpack_in can chmod arbitrary directories by following symlinks (medium 5.1)
- [CVE-2026-33055](https://insights.sbomify.com/CVE-2026-33055/): tar-rs incorrectly ignores PAX size headers if header size is nonzero (medium 5.1)
- [CVE-2026-33054](https://insights.sbomify.com/CVE-2026-33054/): Mesop has a Path Traversal utilizing `FileStateSessionBackend` leads to Application Denial of Service and File Write/Deletion (critical 10.0)
- [CVE-2026-33053](https://insights.sbomify.com/CVE-2026-33053/): Langflow has Missing Ownership Verification in API Key Deletion (IDOR) (medium 6.1)
- [CVE-2026-33052](https://insights.sbomify.com/CVE-2026-33052/): MantisBT: Authorization Bypass in Global Profile Creation (medium 5.3)
- [CVE-2026-33051](https://insights.sbomify.com/CVE-2026-33051/): Craft CMS Vulnerable to Stored XSS in Revision Context Menu (medium 5.3)
- [CVE-2026-33047](https://insights.sbomify.com/CVE-2026-33047/): Combodo iTop: Object can be locked by a user without write permissions (medium 4.3)
- [CVE-2026-33046](https://insights.sbomify.com/CVE-2026-33046/): Indico discloses local files resulting in Remote Code Execution through LaTeX injection (high 7.7)
- [CVE-2026-33045](https://insights.sbomify.com/CVE-2026-33045/): Home Assistant has stored XSS in history-graphs (high 7.3)
- [CVE-2026-33044](https://insights.sbomify.com/CVE-2026-33044/): Home Assistant has stored XSS in Map-card through malicious device name (high 7.3)
- [CVE-2026-33043](https://insights.sbomify.com/CVE-2026-33043/): AVideo affected by Session Hijacking via Unauthenticated Session ID Disclosure with Permissive CORS (high 8.1)
- [CVE-2026-33042](https://insights.sbomify.com/CVE-2026-33042/): Parse Server affected by empty authData bypassing credential requirement on signup (medium 6.9)
- [CVE-2026-33041](https://insights.sbomify.com/CVE-2026-33041/): AVideo has an Unauthenticated Password Hash Oracle via encryptPass.json.php (medium 5.3)
- [CVE-2026-33040](https://insights.sbomify.com/CVE-2026-33040/): libp2p-rust: Gossipsub PRUNE.backoff Duration Overflow (high 8.7)
- [CVE-2026-3304](https://insights.sbomify.com/CVE-2026-3304/): Multer vulnerable to Denial of Service via incomplete cleanup (high 8.7)
- [CVE-2026-33039](https://insights.sbomify.com/CVE-2026-33039/): AVideo vulnerable to unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxy (high 8.6)
- [CVE-2026-33038](https://insights.sbomify.com/CVE-2026-33038/): AVideo affected by unauthenticated application takeover via exposed web installer on uninitialized deployments (high 8.1)
- [CVE-2026-33037](https://insights.sbomify.com/CVE-2026-33037/): WWBN AVideo has predictable default admin credentials in official Docker deployment path (high 8.1)
- [CVE-2026-33036](https://insights.sbomify.com/CVE-2026-33036/): fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278) (high 7.5)
- [CVE-2026-33035](https://insights.sbomify.com/CVE-2026-33035/): Unauthenticated Reflected XSS via innerHTML in AVideo (medium 5.3)
- [CVE-2026-33034](https://insights.sbomify.com/CVE-2026-33034/): Potential denial-of-service vulnerability in ASGI requests via memory upload limit bypass (high 7.5)
- [CVE-2026-33033](https://insights.sbomify.com/CVE-2026-33033/): Potential denial-of-service vulnerability in MultiPartParser via base64-encoded file upload (medium 6.5)
- [CVE-2026-33032](https://insights.sbomify.com/CVE-2026-33032/): Nginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx Takeover (critical 9.8)
- [CVE-2026-33031](https://insights.sbomify.com/CVE-2026-33031/): Nginx-UI: Disabled users retain full API access through previously issued bearer tokens (high 8.6)
- [CVE-2026-33030](https://insights.sbomify.com/CVE-2026-33030/): Nginx UI: Unencrypted Storage of DNS API Tokens and ACME Private Keys (high 8.8)
- [CVE-2026-3303](https://insights.sbomify.com/CVE-2026-3303/): IBM Concert Software Permissive Cross-domain Security Policy (low 3.7)
- [CVE-2026-33029](https://insights.sbomify.com/CVE-2026-33029/): Nginx UI: DoS via Negative Integer Input in Logrotate Interval (medium 6.9)
- [CVE-2026-33028](https://insights.sbomify.com/CVE-2026-33028/): Nginx UI: Race Condition Leads to Persistent Data Corruption and Service Collapse (high 7.1)
- [CVE-2026-33027](https://insights.sbomify.com/CVE-2026-33027/): Nginx UI: Improper Path Validation Allows Recursive Deletion of the Nginx Configuration Directory (medium 6.9)
- [CVE-2026-33026](https://insights.sbomify.com/CVE-2026-33026/): nginx-ui Backup Restore Allows Tampering with Encrypted Backups (critical 9.4)
- [CVE-2026-33025](https://insights.sbomify.com/CVE-2026-33025/): AVideo-Encoder is Vulnerable to Authenticated SQL Injection via ORDER BY Clause (high 8.6)
- [CVE-2026-33024](https://insights.sbomify.com/CVE-2026-33024/): AVideo-Encoder has Unauthenticated Blind Server-Side Request Forgery via Public Thumbnail Generator (critical 9.3)
- [CVE-2026-33023](https://insights.sbomify.com/CVE-2026-33023/): libsixel: Use-after-free in load_with_gdkpixbuf() (high 7.8)
- [CVE-2026-33022](https://insights.sbomify.com/CVE-2026-33022/): Tekton Pipelines: Controller can panic when setting long resolver names in TaskRun/PipelineRun (medium 6.5)
- [CVE-2026-33021](https://insights.sbomify.com/CVE-2026-33021/): libsixel: Use-after-free in sixel_encoder_encode_bytes() (high 7.3)
- [CVE-2026-33020](https://insights.sbomify.com/CVE-2026-33020/): libsixel: Integer Overflow in write_png_to_file() leads to Heap-based Buffer Overflow (high 7.1)
- [CVE-2026-3302](https://insights.sbomify.com/CVE-2026-3302/): SourceCodester Doctor Appointment System Sign Up register.php cross site scripting (medium 5.3)
- [CVE-2026-33019](https://insights.sbomify.com/CVE-2026-33019/): libsixel: Integer overflow leads to Out-of-bounds Read in img2sixel (high 7.1)
- [CVE-2026-33018](https://insights.sbomify.com/CVE-2026-33018/): libsixel: Use-After-Free in load_gif() (high 7.0)
- [CVE-2026-33017](https://insights.sbomify.com/CVE-2026-33017/): Langflow Code Injection (critical 9.3, exploited in the wild)
- [CVE-2026-33015](https://insights.sbomify.com/CVE-2026-33015/): EVerest has RemoteStop Bypass via BCB Toggle Session Restart (medium 5.2)
- [CVE-2026-33014](https://insights.sbomify.com/CVE-2026-33014/): EVerest has Delayed Authorization Response Bypasses Termination After RemoteStop (medium 5.2)
- [CVE-2026-33013](https://insights.sbomify.com/CVE-2026-33013/): Micronaut vulnerable to DoS via crafted form-urlencoded body binding with descending array indices (high 8.2)
- [CVE-2026-33012](https://insights.sbomify.com/CVE-2026-33012/): Micronaut Framework vulnerable to a Denial of Service in HTML error response caching (high 7.5)
- [CVE-2026-33011](https://insights.sbomify.com/CVE-2026-33011/): Nest Fastify HEAD Request Middleware Bypass (high 8.7)
- [CVE-2026-33010](https://insights.sbomify.com/CVE-2026-33010/): mcp-memory-service's Wildcard CORS with Credentials Enables Cross-Origin Memory Theft (high 8.1)
- [CVE-2026-3301](https://insights.sbomify.com/CVE-2026-3301/): Totolink N300RH Web Management cstecgi.cgi setWebWlanIdx os command injection (critical 9.3)
- [CVE-2026-33009](https://insights.sbomify.com/CVE-2026-33009/): EVerest: MQTT Switch-Phases Command Data Race Causing Charger State Corruptio (high 8.2)
- [CVE-2026-33007](https://insights.sbomify.com/CVE-2026-33007/): Apache HTTP Server: mod_authn_socache crash (medium 5.3)
- [CVE-2026-33006](https://insights.sbomify.com/CVE-2026-33006/): Apache HTTP Server: mod_auth_digest timing attack (medium 4.8)
- [CVE-2026-33005](https://insights.sbomify.com/CVE-2026-33005/): Apache OpenMeetings: Insufficient checks in FileWebService (medium 4.3)
- [CVE-2026-33004](https://insights.sbomify.com/CVE-2026-33004/): Jenkins LoadNinja Plugin does not mask LoadNinja API keys displayed on the job configuration form (medium 4.3)
- [CVE-2026-33003](https://insights.sbomify.com/CVE-2026-33003/): Jenkins LoadNinja Plugin stores LoadNinja API keys unencrypted in job config.xml files (medium 4.3)
- [CVE-2026-33002](https://insights.sbomify.com/CVE-2026-33002/): Jenkins has a DNS rebinding vulnerability in WebSocket CLI origin validation (high 7.5)
- [CVE-2026-33001](https://insights.sbomify.com/CVE-2026-33001/): Jenkins has a link following vulnerability allows arbitrary file creation (high 8.8)
- [CVE-2026-33000](https://insights.sbomify.com/CVE-2026-33000/): Command injection in UniFi OS Server (critical 9.1)
- [CVE-2026-3300](https://insights.sbomify.com/CVE-2026-3300/): Everest Forms Pro <= 1.9.12 - Unauthenticated Remote Code Execution via Calculation Field (critical 9.8)
- [CVE-2026-32999](https://insights.sbomify.com/CVE-2026-32999/): Code injection in Comet Backup (critical 9.1)
- [CVE-2026-32998](https://insights.sbomify.com/CVE-2026-32998/): Code injection in Service Provider Console (critical 9.4)
- [CVE-2026-32997](https://insights.sbomify.com/CVE-2026-32997/): Path traversal in Backup and Replication (high 8.6)
- [CVE-2026-32996](https://insights.sbomify.com/CVE-2026-32996/): Privilege escalation in Backup and Replication (high 7.3)
- [CVE-2026-32995](https://insights.sbomify.com/CVE-2026-32995/): Missing authorization in Rocket.Chat (high 7.5)
- [CVE-2026-32994](https://insights.sbomify.com/CVE-2026-32994/): Missing authorization in Rocket.Chat (medium 5.3)
- [CVE-2026-32993](https://insights.sbomify.com/CVE-2026-32993/): Other in WP Squared (high 8.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/713/