# Vulnerabilities published in 2026


- [CVE-2026-32891](https://insights.sbomify.com/CVE-2026-32891/): Anchorr Privilege Escalation: Jellyseerr User → Anchorr Admin via Stored XSS (critical 9.1)
- [CVE-2026-32890](https://insights.sbomify.com/CVE-2026-32890/): Cross-site scripting in Anchorr (critical 9.7)
- [CVE-2026-3289](https://insights.sbomify.com/CVE-2026-3289/): Sanluan PublicCMS Template Cache Generation TemplateCacheComponent.java saveMetadata path traversal (medium 5.3)
- [CVE-2026-32889](https://insights.sbomify.com/CVE-2026-32889/): tinytag: Denial of Service via non-terminating SYLT frame parsing loop (medium 6.5)
- [CVE-2026-32888](https://insights.sbomify.com/CVE-2026-32888/): Open Source Point of Sale is Vulnerable to SQL Injection Through its Item Search Functionality (high 8.8)
- [CVE-2026-32887](https://insights.sbomify.com/CVE-2026-32887/): Effect Bug: `AsyncLocalStorage` context lost/contaminated inside Effect fibers under concurrent load with RPC (high 7.4)
- [CVE-2026-32886](https://insights.sbomify.com/CVE-2026-32886/): Parse Server's Cloud function dispatch crashes server via prototype chain traversal (high 8.2)
- [CVE-2026-32885](https://insights.sbomify.com/CVE-2026-32885/): DDEV has ZipSlip path traversal in tar and zip archive extraction (medium 6.5)
- [CVE-2026-32884](https://insights.sbomify.com/CVE-2026-32884/): Botan: Case-Insensitive CN Values Bypass DNS excludedSubtrees Name Constraints (RFC 5280 Violation) (medium 5.9)
- [CVE-2026-32883](https://insights.sbomify.com/CVE-2026-32883/): Botan: Missing OCSP Response Signature Verification Allows MitM Certificate Revocation Bypass (medium 5.9)
- [CVE-2026-32882](https://insights.sbomify.com/CVE-2026-32882/): libheif: Heap Buffer OOB Read in overlay compositing due to wrong alpha stride (high 7.1)
- [CVE-2026-32881](https://insights.sbomify.com/CVE-2026-32881/): ewe has an Overly Permissive List of Allowed Inputs (medium 5.3)
- [CVE-2026-32880](https://insights.sbomify.com/CVE-2026-32880/): ChurchCRM is vulnerable to Stored XSS through JSON handling in SystemSettings.php (medium 6.4)
- [CVE-2026-3288](https://insights.sbomify.com/CVE-2026-3288/): ingress-nginx rewrite-target nginx configuration injection (high 8.8)
- [CVE-2026-32879](https://insights.sbomify.com/CVE-2026-32879/): New API has passkey-based secure step-up verification bypass for root-only channel secret disclosure (medium 4.9)
- [CVE-2026-32878](https://insights.sbomify.com/CVE-2026-32878/): Parse Server vulnerable to schema poisoning via prototype pollution in deep copy (medium 5.3)
- [CVE-2026-32877](https://insights.sbomify.com/CVE-2026-32877/): Botan: Heap Buffer Over-read in SM2 Decryption via Undersized C3 Hash Field (high 8.2)
- [CVE-2026-32875](https://insights.sbomify.com/CVE-2026-32875/): UltraJSON has an integer overflow handling large indent leads to buffer overflow or infinite loop (high 7.5)
- [CVE-2026-32874](https://insights.sbomify.com/CVE-2026-32874/): UltraJSON has a Memory Leak parsing large integers allows DoS (high 7.5)
- [CVE-2026-32873](https://insights.sbomify.com/CVE-2026-32873/): ewe: Loop with Unreachable Exit Condition ('Infinite Loop') (high 7.5)
- [CVE-2026-32871](https://insights.sbomify.com/CVE-2026-32871/): FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability (critical 10.0)
- [CVE-2026-32870](https://insights.sbomify.com/CVE-2026-32870/): Kirby has XML injection in its XML creator toolkit (medium 6.9)
- [CVE-2026-3287](https://insights.sbomify.com/CVE-2026-3287/): youlaitech youlai-mall App-side Product Pagination Endpoint SpuController.java listPagedSpuForApp sql injection (medium 5.3)
- [CVE-2026-32869](https://insights.sbomify.com/CVE-2026-32869/): OPEXUS eComplaint and eCASE XSS via Name of Organization field (medium 5.1)
- [CVE-2026-32868](https://insights.sbomify.com/CVE-2026-32868/): OPEXUS eComplaint and eCASE XSS via my information (medium 5.1)
- [CVE-2026-32867](https://insights.sbomify.com/CVE-2026-32867/): OPEXUS eComplaint unauthenticated file upload (medium 5.3)
- [CVE-2026-32866](https://insights.sbomify.com/CVE-2026-32866/): OPEXUS eComplaint and eCase stored XSS via profile first and last name (medium 5.1)
- [CVE-2026-32865](https://insights.sbomify.com/CVE-2026-32865/): OPEXUS eComplaint and eCase insecure password reset (critical 9.2)
- [CVE-2026-32864](https://insights.sbomify.com/CVE-2026-32864/): Out-of-Bounds Read in mgcore_SH_25_3!aligned_free() (high 8.5)
- [CVE-2026-32863](https://insights.sbomify.com/CVE-2026-32863/): Out-of-Bounds Read in sentry_transaction_context_set_operation() (high 8.5)
- [CVE-2026-32862](https://insights.sbomify.com/CVE-2026-32862/): Out-of-Bounds Write in ResFileFactory::InitResourceMgr() (high 8.5)
- [CVE-2026-32861](https://insights.sbomify.com/CVE-2026-32861/): Out-of-Bounds Write Vulnerability in NI LabVIEW when loading lvclass file (high 8.5)
- [CVE-2026-32860](https://insights.sbomify.com/CVE-2026-32860/): Out-of-Bounds Write Vulnerability in NI LabVIEW when loading lvlib file (high 8.5)
- [CVE-2026-3286](https://insights.sbomify.com/CVE-2026-3286/): itwanger paicoding Image Save Endpoint ImageRestController.java save server-side request forgery (medium 5.3)
- [CVE-2026-32859](https://insights.sbomify.com/CVE-2026-32859/): ByteDance DeerFlow Stored XSS via Inline Artifact Rendering (medium 5.1)
- [CVE-2026-32857](https://insights.sbomify.com/CVE-2026-32857/): Firecrawl Playwright Service SSRF Protection Bypass via Missing Post-Redirect Validation (high 7.8)
- [CVE-2026-32856](https://insights.sbomify.com/CVE-2026-32856/): Ellucian Banner Self-Service Reflected XSS via dateConverter (medium 5.1)
- [CVE-2026-32854](https://insights.sbomify.com/CVE-2026-32854/): LibVNCServer httpd proxy NULL Pointer Dereference (medium 6.3)
- [CVE-2026-32853](https://insights.sbomify.com/CVE-2026-32853/): LibVNCServer UltraZip Encoding Heap Out-of-bounds Read (medium 6.9)
- [CVE-2026-32852](https://insights.sbomify.com/CVE-2026-32852/): MailEnable < 10.55 Reflected XSS via FreeBusy.aspx StartDate Parameter (medium 5.1)
- [CVE-2026-32851](https://insights.sbomify.com/CVE-2026-32851/): MailEnable < 10.55 Reflected XSS via FreeBusy.aspx StartDate Parameter (medium 5.1)
- [CVE-2026-32850](https://insights.sbomify.com/CVE-2026-32850/): MailEnable < 10.55 Reflected XSS via ManageShares.aspx SelectedIndex Parameter (medium 5.1)
- [CVE-2026-3285](https://insights.sbomify.com/CVE-2026-3285/): berry-lang berry be_lexer.c scan_string out-of-bounds (medium 4.8)
- [CVE-2026-32849](https://insights.sbomify.com/CVE-2026-32849/): NetBSD Signed Integer Overflow in cryptodev_op via cryptodev.c (medium 5.7)
- [CVE-2026-32848](https://insights.sbomify.com/CVE-2026-32848/): NetBSD cryptodev Race Condition Double-Free via cryptodev_op() (medium 5.7)
- [CVE-2026-32847](https://insights.sbomify.com/CVE-2026-32847/): DeepCode 1.2.0 Path Traversal via SPA Catch-All Route in main.py (high 8.7)
- [CVE-2026-32846](https://insights.sbomify.com/CVE-2026-32846/): OpenClaw < 2026.3.28 Media Parsing Path Traversal to Arbitrary File Read (high 8.7)
- [CVE-2026-32845](https://insights.sbomify.com/CVE-2026-32845/): jkuhlmann / cgltf <= 1.15 Sparse Accessor Validation Integer Overflow (medium 6.9)
- [CVE-2026-32844](https://insights.sbomify.com/CVE-2026-32844/): XinLiangCoder / php_api_doc Reflected XSS via list_method.php (medium 5.1)
- [CVE-2026-32843](https://insights.sbomify.com/CVE-2026-32843/): Linkit ONE Location Aware Sensor System (LASS) Reflected XSS via PM25.php (medium 5.1)
- [CVE-2026-32842](https://insights.sbomify.com/CVE-2026-32842/): Edimax GS-5008PL <= 1.00.54 Admin Credentials Stored in Cleartext (high 7.1)
- [CVE-2026-32841](https://insights.sbomify.com/CVE-2026-32841/): Edimax GS-5008PL <= 1.00.54 Global Authentication State Across All Clients (critical 9.2)
- [CVE-2026-32840](https://insights.sbomify.com/CVE-2026-32840/): Edimax GS-5008PL <= 1.00.54 Stored XSS via Device Name (medium 5.1)
- [CVE-2026-3284](https://insights.sbomify.com/CVE-2026-3284/): libvips extract.c vips_extract_area_build integer overflow (medium 4.8)
- [CVE-2026-32839](https://insights.sbomify.com/CVE-2026-32839/): Edimax GS-5008PL <= 1.00.54 CSRF via Management CGI Endpoints (medium 5.1)
- [CVE-2026-32838](https://insights.sbomify.com/CVE-2026-32838/): Edimax GS-5008PL <= 1.00.54 Transmits Credentials Over Cleartext HTTP (high 8.7)
- [CVE-2026-32837](https://insights.sbomify.com/CVE-2026-32837/): mackron / miniaudio Out-of-Bounds Read in BEXT Coding History Parsing (medium 5.1)
- [CVE-2026-32836](https://insights.sbomify.com/CVE-2026-32836/): mackron / dr_libs dr_flac.h Excessive Memory Allocation in PICTURE Metadata Parsing (medium 6.9)
- [CVE-2026-32834](https://insights.sbomify.com/CVE-2026-32834/): Easy PayPal Events & Tickets < 1.4 Authentication Bypass via QR Code Scanning (high 8.7)
- [CVE-2026-32833](https://insights.sbomify.com/CVE-2026-32833/): Cudy LT300 3.0 OS Command Injection via NTP Configuration (high 8.7)
- [CVE-2026-3283](https://insights.sbomify.com/CVE-2026-3283/): libvips extract.c vips_extract_band_build out-of-bounds (medium 4.8)
- [CVE-2026-32829](https://insights.sbomify.com/CVE-2026-32829/): lz4_flex: Decompression can leak information from uninitialized memory or reused output buffer (high 8.2)
- [CVE-2026-32828](https://insights.sbomify.com/CVE-2026-32828/): Kargo: SSRF in Promotion http/http-download Steps Enables Internal Network Access and Data Exfiltration (medium 5.1)
- [CVE-2026-32825](https://insights.sbomify.com/CVE-2026-32825/): dataCycle No Brute-Force Protection On Web And API Login Endpoints (high 7.3)
- [CVE-2026-32824](https://insights.sbomify.com/CVE-2026-32824/): dataCycle User API Password Reset And Confirmation Flows Trust Attacker- Controlled Redirect Targets (high 7.3)
- [CVE-2026-32823](https://insights.sbomify.com/CVE-2026-32823/): dataCycle State-Changing GET Endpoints Enable CSRF (medium 4.3)
- [CVE-2026-32822](https://insights.sbomify.com/CVE-2026-32822/): dataCycle Unauthenticated Reflected DOM XSS Via flash[...] On Public Pages (medium 6.1)
- [CVE-2026-32821](https://insights.sbomify.com/CVE-2026-32821/): API Collection Impersonation Via user_email And Missing Object- Level Authorization (high 8.1)
- [CVE-2026-32820](https://insights.sbomify.com/CVE-2026-32820/): dataCycle Public Markdown Path Traversal Via /docs/*path (high 7.5)
- [CVE-2026-3282](https://insights.sbomify.com/CVE-2026-3282/): libvips unpremultiply.c vips_unpremultiply_build out-of-bounds (medium 4.8)
- [CVE-2026-32819](https://insights.sbomify.com/CVE-2026-32819/): dataCycle User Directory Enumeration Via /users/search (medium 4.3)
- [CVE-2026-32818](https://insights.sbomify.com/CVE-2026-32818/): Admidio is Missing Authorization on Forum Topic and Post Deletion (medium 6.5)
- [CVE-2026-32817](https://insights.sbomify.com/CVE-2026-32817/): Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion (critical 9.1)
- [CVE-2026-32816](https://insights.sbomify.com/CVE-2026-32816/): Admidio has Missing CSRF Validation on Role Delete, Activate, and Deactivate Actions (medium 5.7)
- [CVE-2026-32815](https://insights.sbomify.com/CVE-2026-32815/): SiYuan: Cross-Origin WebSocket Hijacking via Authentication Bypass — Unauthenticated Information Disclosure (medium 5.3)
- [CVE-2026-32814](https://insights.sbomify.com/CVE-2026-32814/): libheif: Uninitialized Heap Memory Information Leak via Failed Grid Tiles (medium 6.5)
- [CVE-2026-32813](https://insights.sbomify.com/CVE-2026-32813/): Admidio: Second-Order SQL Injection via List Configuration (lsc_special_field, lsc_sort, lsc_filter) (high 8.0)
- [CVE-2026-32812](https://insights.sbomify.com/CVE-2026-32812/): Admidio Vulnerable to SSRF and Local File Read via Unrestricted URL Fetch in SSO Metadata Endpoint (medium 6.8)
- [CVE-2026-32811](https://insights.sbomify.com/CVE-2026-32811/): Heimdall: Path received via Envoy gRPC corrupted when containing query string (high 8.2)
- [CVE-2026-32810](https://insights.sbomify.com/CVE-2026-32810/): Halloy has insecure file permissions on credential files (medium 4.8)
- [CVE-2026-3281](https://insights.sbomify.com/CVE-2026-3281/): libvips bandrank.c vips_bandrank_build heap-based overflow (medium 4.8)
- [CVE-2026-32808](https://insights.sbomify.com/CVE-2026-32808/): pyLoad: Arbitrary File Deletion via Path Traversal during Encrypted 7z Password Verification (high 8.1)
- [CVE-2026-32807](https://insights.sbomify.com/CVE-2026-32807/): dataCycle Public DataLink Text File Download Ignores Validity And Authorization (high 7.5)
- [CVE-2026-32806](https://insights.sbomify.com/CVE-2026-32806/): dataCycle Authorization Bypass Via /remote_render (high 7.5)
- [CVE-2026-32805](https://insights.sbomify.com/CVE-2026-32805/): Romeo is vulnerable to Archive Slip due to missing checks in sanitization (high 8.3)
- [CVE-2026-32804](https://insights.sbomify.com/CVE-2026-32804/): Auth bypass in PowerFlex (high 8.1)
- [CVE-2026-32803](https://insights.sbomify.com/CVE-2026-32803/): Other in PowerScale OneFS (low 3.3)
- [CVE-2026-32802](https://insights.sbomify.com/CVE-2026-32802/): Privilege escalation in PowerPath (medium 5.3)
- [CVE-2026-32794](https://insights.sbomify.com/CVE-2026-32794/): Apache Airflow Provider for Databricks: TLS Certificate Verification Disabled in Databricks Provider K8s Token Exchange (medium 4.8)
- [CVE-2026-32792](https://insights.sbomify.com/CVE-2026-32792/): Packet of death with DNSCrypt (medium 4.6)
- [CVE-2026-32791](https://insights.sbomify.com/CVE-2026-32791/): Privilege escalation in Intel(R) Performance Counter Monitor (Intel(R) PCM) (medium 5.4)
- [CVE-2026-3279](https://insights.sbomify.com/CVE-2026-3279/): Enable jQuery Migrate Helper <= 1.4.1 - Missing Authorization to Authenticated (Subscriber+) jQuery Version Downgrade (medium 6.5)
- [CVE-2026-32788](https://insights.sbomify.com/CVE-2026-32788/): Privilege escalation in Approximate Bayesian Inference Framework (medium 5.4)
- [CVE-2026-3278](https://insights.sbomify.com/CVE-2026-3278/): XSS Vulnerability discovered in OpenText™ ZENworks Service Desk. (high 7.4)
- [CVE-2026-32778](https://insights.sbomify.com/CVE-2026-32778/): Null dereference in libexpat (low 2.9)
- [CVE-2026-32777](https://insights.sbomify.com/CVE-2026-32777/): Denial of service in libexpat (medium 4.0)
- [CVE-2026-32776](https://insights.sbomify.com/CVE-2026-32776/): Null dereference in libexpat (medium 4.0)
- [CVE-2026-32775](https://insights.sbomify.com/CVE-2026-32775/): Integer overflow in libexif (high 7.4)
- [CVE-2026-32774](https://insights.sbomify.com/CVE-2026-32774/): Vulnogram - Stored Cross-Site Scripting via Comment Hypertext (medium 5.3)
- [CVE-2026-32773](https://insights.sbomify.com/CVE-2026-32773/): Apache Spark: XSS Vulnerability in Spark Web 3.5.4 (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/715/