# Vulnerabilities published in 2026


- [CVE-2026-32772](https://insights.sbomify.com/CVE-2026-32772/): Information disclosure in inetutils (low 3.4)
- [CVE-2026-32771](https://insights.sbomify.com/CVE-2026-32771/): Monitoring is vulnerable to Archive Slip due to missing checks in sanitization (high 8.8)
- [CVE-2026-32770](https://insights.sbomify.com/CVE-2026-32770/): Parse Server: LiveQuery subscription with invalid regular expression crashes server (medium 5.9)
- [CVE-2026-3277](https://insights.sbomify.com/CVE-2026-3277/): Information disclosure in PowerShell Universal (medium 5.5)
- [CVE-2026-32769](https://insights.sbomify.com/CVE-2026-32769/): Fullchain's Invalid NetworkPolicy enables a malicious actor to pivot into another namespace (high 7.1)
- [CVE-2026-32768](https://insights.sbomify.com/CVE-2026-32768/): Chall-Manager's invalid NetworkPolicy enables a malicious actor to pivot into another namespace (high 7.9)
- [CVE-2026-32767](https://insights.sbomify.com/CVE-2026-32767/): SiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search API (critical 9.8)
- [CVE-2026-32766](https://insights.sbomify.com/CVE-2026-32766/): astral-tokio-tar insufficiently validates PAX extensions during extraction (low 1.7)
- [CVE-2026-32763](https://insights.sbomify.com/CVE-2026-32763/): SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using `Kysely<any>`. (high 8.2)
- [CVE-2026-32762](https://insights.sbomify.com/CVE-2026-32762/): Rack: Forwarded Header semicolon injection enables Host and Scheme spoofing (medium 4.8)
- [CVE-2026-32761](https://insights.sbomify.com/CVE-2026-32761/): File Browser has an Authorization Policy Bypass in its Public Share Download Flow (medium 6.5)
- [CVE-2026-32760](https://insights.sbomify.com/CVE-2026-32760/): File Browser Self Registration Grants Any User Admin Access When Default Permissions Include Admin (critical 10.0)
- [CVE-2026-3276](https://insights.sbomify.com/CVE-2026-3276/): Potential DoS via quadratic complexity in unicodedata.normalize() (medium 6.3)
- [CVE-2026-32759](https://insights.sbomify.com/CVE-2026-32759/): File Browser TUS Negative Upload-Length Fires Post-Upload Hooks Prematurely (medium 5.3)
- [CVE-2026-32758](https://insights.sbomify.com/CVE-2026-32758/): File Browser has an Access Rule Bypass via Path Traversal in Copy/Rename Destination Parameter (medium 6.5)
- [CVE-2026-32757](https://insights.sbomify.com/CVE-2026-32757/): Admidio: HTMLPurifier Bypass in eCard Message Allows HTML Email Injection (medium 5.4)
- [CVE-2026-32756](https://insights.sbomify.com/CVE-2026-32756/): Admidio: Unrestricted File Upload via CSRF Token Validation Bypass in Documents & Files Module (high 8.8)
- [CVE-2026-32755](https://insights.sbomify.com/CVE-2026-32755/): Admidio is Missing CSRF Protection on Role Membership Date Changes (medium 5.7)
- [CVE-2026-32754](https://insights.sbomify.com/CVE-2026-32754/): FreeScout: Stored XSS via Unescaped Email Template Rendering ({!! $thread->body !!}) (critical 9.3)
- [CVE-2026-32753](https://insights.sbomify.com/CVE-2026-32753/): FreeScout: Stored XSS through SVG file upload with filter bypass (high 8.5)
- [CVE-2026-32752](https://insights.sbomify.com/CVE-2026-32752/): FreeScout: Broken Access Control in ThreadPolicy — Any User Can Read/Edit All Customer Messages (not scored)
- [CVE-2026-32751](https://insights.sbomify.com/CVE-2026-32751/): SiYuan Vulnerable to Remote Code Execution via Stored XSS in Notebook Name - Mobile Interface (medium 5.1)
- [CVE-2026-32750](https://insights.sbomify.com/CVE-2026-32750/): SiYuan importStdMd: unvalidated localPath imports arbitrary host directories as persistent notes (medium 6.8)
- [CVE-2026-3275](https://insights.sbomify.com/CVE-2026-3275/): Tenda F453 httpd addressNat fromAddressNat buffer overflow (high 8.7)
- [CVE-2026-32749](https://insights.sbomify.com/CVE-2026-32749/): SiYuan importSY/importZipMd: Path Traversal via multipart filename enables arbitrary file write (high 7.6)
- [CVE-2026-32748](https://insights.sbomify.com/CVE-2026-32748/): Squid has Denial of Service in ICP Response handling (high 8.7)
- [CVE-2026-32747](https://insights.sbomify.com/CVE-2026-32747/): SiYuan: Incomplete sensitive path blocklist in globalCopyFiles allows reading /proc and Docker secrets (medium 6.8)
- [CVE-2026-32746](https://insights.sbomify.com/CVE-2026-32746/): Memory corruption in inetutils (critical 9.8)
- [CVE-2026-32745](https://insights.sbomify.com/CVE-2026-32745/): Misconfiguration in Datalore (medium 6.3)
- [CVE-2026-32743](https://insights.sbomify.com/CVE-2026-32743/): PX4 Autopilot: Stack-based Buffer Overflow via Oversized Path Input in MAVLink Log Request Handling (medium 6.5)
- [CVE-2026-32742](https://insights.sbomify.com/CVE-2026-32742/): Parse Server session creation endpoint allows overwriting server-generated session fields (medium 4.3)
- [CVE-2026-32741](https://insights.sbomify.com/CVE-2026-32741/): libheif has a heap buffer overflow in decode_mask_image() (high 7.1)
- [CVE-2026-32740](https://insights.sbomify.com/CVE-2026-32740/): libheif: Heap-Buffer-Overflow Write in Grid Tile Chroma Compositing (high 8.8)
- [CVE-2026-3274](https://insights.sbomify.com/CVE-2026-3274/): Tenda F453 httpd L7Prot frmL7ProtForm buffer overflow (high 8.7)
- [CVE-2026-32739](https://insights.sbomify.com/CVE-2026-32739/): libheif is Vulnerable to Infinite Loop DoS via stts Sample Duration Lookup (medium 6.5)
- [CVE-2026-32738](https://insights.sbomify.com/CVE-2026-32738/): libheif has a Heap OOB Read/SEGV Crash via Zero samples_per_chunk (medium 6.5)
- [CVE-2026-32737](https://insights.sbomify.com/CVE-2026-32737/): Romeo's invalid NetworkPolicy enables a malicious actor to pivot into another namespace (high 7.9)
- [CVE-2026-32736](https://insights.sbomify.com/CVE-2026-32736/): Hytale Modding Wiki has Insecure Direct Object Reference / GDPR PII Exposure (medium 4.3)
- [CVE-2026-32735](https://insights.sbomify.com/CVE-2026-32735/): Unpacking Arbitrary Mustache Template Files via `maven-dependency-plugin` (low 2.3)
- [CVE-2026-32734](https://insights.sbomify.com/CVE-2026-32734/): baserCMS: Multiple vulnerabilities in baserCMS (high 7.1)
- [CVE-2026-32733](https://insights.sbomify.com/CVE-2026-32733/): Halloy has a file transfer path traveral vulnerability (high 8.7)
- [CVE-2026-32732](https://insights.sbomify.com/CVE-2026-32732/): XSS in @leanprover/unicode-input-component (not scored)
- [CVE-2026-32731](https://insights.sbomify.com/CVE-2026-32731/): ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction (critical 10.0)
- [CVE-2026-32730](https://insights.sbomify.com/CVE-2026-32730/): ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware (high 8.1)
- [CVE-2026-3273](https://insights.sbomify.com/CVE-2026-3273/): Tenda F453 httpd AdvSetWrlsafeset formWrlsafeset buffer overflow (high 8.7)
- [CVE-2026-32729](https://insights.sbomify.com/CVE-2026-32729/): Runtipi has a TOTP two-factor authentication bypass via unrestricted brute-force on `/api/auth/verify-totp` (high 8.1)
- [CVE-2026-32728](https://insights.sbomify.com/CVE-2026-32728/): Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries (high 8.3)
- [CVE-2026-32727](https://insights.sbomify.com/CVE-2026-32727/): SciTokens: Authorization Bypass via Path Traversal in Scope Validation (high 8.1)
- [CVE-2026-32726](https://insights.sbomify.com/CVE-2026-32726/): SciTokens C++: Sibling-Path Authorization Bypass (high 8.1)
- [CVE-2026-32725](https://insights.sbomify.com/CVE-2026-32725/): SciTokens C++: Relative Path Traversal Vulnerability (high 8.3)
- [CVE-2026-32724](https://insights.sbomify.com/CVE-2026-32724/): PX4 autopilot has a heap Use-After-Free in MavlinkShell::available() via SERIAL_CONTROL Race Condition (medium 5.3)
- [CVE-2026-32723](https://insights.sbomify.com/CVE-2026-32723/): SandboxJS timers have an execution-quota bypass (cross-sandbox currentTicks race) (medium 4.8)
- [CVE-2026-32722](https://insights.sbomify.com/CVE-2026-32722/): Memray-generated HTML reports vulnerable to Stored XSS via unescaped command-line metadata (low 3.6)
- [CVE-2026-32721](https://insights.sbomify.com/CVE-2026-32721/): LuCI luci-mod-network: Possible XSS attack in WiFi scan on Joining Wireless Client modal (high 8.6)
- [CVE-2026-32720](https://insights.sbomify.com/CVE-2026-32720/): Improper Access Control in github.com/ctfer-io/monitoring (high 7.1)
- [CVE-2026-3272](https://insights.sbomify.com/CVE-2026-3272/): Tenda F453 httpd DhcpListClient fromDhcpListClient buffer overflow (high 8.7)
- [CVE-2026-32719](https://insights.sbomify.com/CVE-2026-32719/): AnythingLLM has a Zip Slip Path Traversal and Code Execution via Community Hub Plugin Import (medium 4.2)
- [CVE-2026-32718](https://insights.sbomify.com/CVE-2026-32718/): Coolify read-scoped API tokens can perform state-changing validation operations (medium 6.5)
- [CVE-2026-32717](https://insights.sbomify.com/CVE-2026-32717/): AnythingLLM access control bypass: suspended users can continue using Browser Extension API keys (low 2.7)
- [CVE-2026-32716](https://insights.sbomify.com/CVE-2026-32716/): SciTokens: Authorization Bypass via Incorrect Scope Path Prefix Checking (high 8.1)
- [CVE-2026-32715](https://insights.sbomify.com/CVE-2026-32715/): AnythingLLM Manager Privilege Bypass Allows Access to Admin-Only System Preferences (low 3.8)
- [CVE-2026-32714](https://insights.sbomify.com/CVE-2026-32714/): SciTokens vulnerable to SQL Injection in KeyCache (critical 9.8)
- [CVE-2026-32713](https://insights.sbomify.com/CVE-2026-32713/): PX4 Autopilot MAVLink FTP Session Validation Logic Error Allows Operations on Invalid File Descriptors (medium 4.3)
- [CVE-2026-32712](https://insights.sbomify.com/CVE-2026-32712/): Open Source Point of Sale has Stored XSS in Customer Name (Sales) (medium 5.4)
- [CVE-2026-32711](https://insights.sbomify.com/CVE-2026-32711/): pydicom: Path traversal in FileSet/DICOMDIR ReferencedFileID allows file access outside the File-set root (high 7.8)
- [CVE-2026-32710](https://insights.sbomify.com/CVE-2026-32710/): Heap-based Buffer Overflow in MariaDB (high 8.6)
- [CVE-2026-3271](https://insights.sbomify.com/CVE-2026-3271/): Tenda F453 httpd P2pListFilterof fromP2pListFilter buffer overflow (high 8.7)
- [CVE-2026-32709](https://insights.sbomify.com/CVE-2026-32709/): PX4 Autopilot MAVLink FTP Unauthenticated Path Traversal (Arbitrary File Read/Write/Delete) (medium 5.4)
- [CVE-2026-32708](https://insights.sbomify.com/CVE-2026-32708/): Zenoh uORB Subscriber Allows Arbitrary Stack Allocation (PX4/PX4-Autopilot) (high 7.8)
- [CVE-2026-32707](https://insights.sbomify.com/CVE-2026-32707/): PX4 autopilot has a stack buffer overflow in tattu_can due to unbounded memcpy in frame assembly loop (medium 5.2)
- [CVE-2026-32706](https://insights.sbomify.com/CVE-2026-32706/): PX4 autopilot has a global buffer overflow in crsf_rc via oversized variable-length known packet (high 7.1)
- [CVE-2026-32705](https://insights.sbomify.com/CVE-2026-32705/): PX4 autopilot BST Device Name Length Can Overflow Driver Buffer (medium 6.8)
- [CVE-2026-32704](https://insights.sbomify.com/CVE-2026-32704/): SiYuan renderSprig: missing admin check allows any user to read full workspace DB (medium 6.5)
- [CVE-2026-32703](https://insights.sbomify.com/CVE-2026-32703/): OpenProject's repository files are served with the MIME type allowing them to be used to bypass Content Security Policy (critical 9.1)
- [CVE-2026-32702](https://insights.sbomify.com/CVE-2026-32702/): Cleanuparr has Username Enumeration via Timing Attack (medium 6.9)
- [CVE-2026-32701](https://insights.sbomify.com/CVE-2026-32701/): Qwik has array method pollution in FormData processing, allowing type confusion and DoS (high 7.5)
- [CVE-2026-32700](https://insights.sbomify.com/CVE-2026-32700/): Devise has a confirmable "change email" race condition that permits user to confirm email they have no access to (medium 6.0)
- [CVE-2026-3270](https://insights.sbomify.com/CVE-2026-3270/): psi-probe PSI Probe Whois Whois.java lookup server-side request forgery (medium 5.3)
- [CVE-2026-32699](https://insights.sbomify.com/CVE-2026-32699/): FacturaScripts unauthorized modification of immutable nick field via EditUser controller (medium 5.3)
- [CVE-2026-32698](https://insights.sbomify.com/CVE-2026-32698/): OpenProject has a SQL Injection via Custom Field Name that can be chained to Remote Code Execution (critical 9.1)
- [CVE-2026-32697](https://insights.sbomify.com/CVE-2026-32697/): Missing authorization in SuiteCRM-Core (medium 6.5)
- [CVE-2026-32696](https://insights.sbomify.com/CVE-2026-32696/): Null dereference in nanomq (low 3.1)
- [CVE-2026-32695](https://insights.sbomify.com/CVE-2026-32695/): Traefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass (medium 6.3)
- [CVE-2026-32694](https://insights.sbomify.com/CVE-2026-32694/): Insecure Direct Object Reference attack via predictable secret ID in Juju (medium 6.6)
- [CVE-2026-32693](https://insights.sbomify.com/CVE-2026-32693/): Unauthorized access to Kubernetes secrets in Juju (high 8.8)
- [CVE-2026-32692](https://insights.sbomify.com/CVE-2026-32692/): Unauthorized update of out-of-scope Vault secrets (high 7.6)
- [CVE-2026-32691](https://insights.sbomify.com/CVE-2026-32691/): Timing ownership claim attack on new external back-end secrets (medium 5.3)
- [CVE-2026-32690](https://insights.sbomify.com/CVE-2026-32690/): Apache Airflow: 3.x - Nested Variable Secret Values Bypass Redaction via max_depth=1 (low 3.7)
- [CVE-2026-3269](https://insights.sbomify.com/CVE-2026-3269/): psi-probe PSI Probe Session ExpireSessionsController.java handleRequestInternal denial of service (medium 5.3)
- [CVE-2026-32689](https://insights.sbomify.com/CVE-2026-32689/): Long-poll NDJSON body splitting causes unbounded memory allocation in Phoenix (high 8.7)
- [CVE-2026-32688](https://insights.sbomify.com/CVE-2026-32688/): Atom table exhaustion via HTTP/2 :scheme pseudo-header in plug_cowboy (high 8.7)
- [CVE-2026-32687](https://insights.sbomify.com/CVE-2026-32687/): SQL injection via channel name in Postgrex.Notifications.listen/3 and unlisten/3 (high 7.5)
- [CVE-2026-32686](https://insights.sbomify.com/CVE-2026-32686/): Unbounded exponent in decimal enables unauthenticated DoS (medium 6.9)
- [CVE-2026-32685](https://insights.sbomify.com/CVE-2026-32685/): Path Traversal in gleam docs build via documentation.pages Allows Arbitrary File Read and Write (medium 4.6)
- [CVE-2026-32684](https://insights.sbomify.com/CVE-2026-32684/): Misconfiguration in Hik-Connect APP (low 2.9)
- [CVE-2026-32683](https://insights.sbomify.com/CVE-2026-32683/): Information disclosure in EZVIZ APP (medium 5.3)
- [CVE-2026-32682](https://insights.sbomify.com/CVE-2026-32682/): NGINX Gateway Fabric vulnerability (high 7.1)
- [CVE-2026-32680](https://insights.sbomify.com/CVE-2026-32680/): Misconfiguration in RATOC RAID Monitoring Manager for Windows (high 8.5)
- [CVE-2026-3268](https://insights.sbomify.com/CVE-2026-3268/): psi-probe PSI Probe Session Attribute RemoveSessAttributeController.java access control (medium 5.3)
- [CVE-2026-32679](https://insights.sbomify.com/CVE-2026-32679/): Other in CanonNWCamPlugin.exe (high 8.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/716/