# Vulnerabilities published in 2026


- [CVE-2026-31901](https://insights.sbomify.com/CVE-2026-31901/): Parse Server has user enumeration via email verification endpoint (medium 6.3)
- [CVE-2026-31900](https://insights.sbomify.com/CVE-2026-31900/): Black's vulnerable version parsing leads to RCE in GitHub Action (high 8.7)
- [CVE-2026-3190](https://insights.sbomify.com/CVE-2026-3190/): Keycloak: keycloak: information disclosure via improper role enforcement in uma 2.0 protection api (medium 4.3)
- [CVE-2026-31899](https://insights.sbomify.com/CVE-2026-31899/): CairoSVG vulnerable to Exponential DoS via recursive <use> element amplification (high 7.5)
- [CVE-2026-31898](https://insights.sbomify.com/CVE-2026-31898/): jsPDF has a PDF Object Injection via FreeText color (high 8.1)
- [CVE-2026-31897](https://insights.sbomify.com/CVE-2026-31897/): FreeRDP has an out-of-bounds read in `freerdp_bitmap_decompress_planar` (not scored)
- [CVE-2026-31896](https://insights.sbomify.com/CVE-2026-31896/): WeGIA has a Time-Based Blind SQL Injection in remover_produto_ocultar.php (critical 9.8)
- [CVE-2026-31895](https://insights.sbomify.com/CVE-2026-31895/): WeGIA has a SQL Injection via Direct Query Interpolation in restaurar_produto.php (high 8.8)
- [CVE-2026-31894](https://insights.sbomify.com/CVE-2026-31894/): WeGIA affected by arbitrary file read via symlink in backup restore (medium 6.9)
- [CVE-2026-31893](https://insights.sbomify.com/CVE-2026-31893/): Tunnelblick arbitrary file read via symlink following in tunnelblickd (medium 6.8)
- [CVE-2026-31892](https://insights.sbomify.com/CVE-2026-31892/): WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode (high 8.9)
- [CVE-2026-31891](https://insights.sbomify.com/CVE-2026-31891/): Cockpit CMS has SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw() (high 7.7)
- [CVE-2026-31890](https://insights.sbomify.com/CVE-2026-31890/): Inspektor Gadget: Tracing Denial of Service via Event Flooding (medium 4.8)
- [CVE-2026-3189](https://insights.sbomify.com/CVE-2026-3189/): feiyuchuixue sz-boot-parent download server-side request forgery (low 2.3)
- [CVE-2026-31889](https://insights.sbomify.com/CVE-2026-31889/): Shopware has a potential take over of app credentials (high 8.9)
- [CVE-2026-31888](https://insights.sbomify.com/CVE-2026-31888/): Shopware has user enumeration via distinct error codes on Store API login endpoint (medium 5.3)
- [CVE-2026-31887](https://insights.sbomify.com/CVE-2026-31887/): Shopware unauthenticated data extraction possible through store-api.order endpoint (high 8.9)
- [CVE-2026-31886](https://insights.sbomify.com/CVE-2026-31886/): Dagu has a Path Traversal via `dagRunId` in Inline DAG Execution (critical 9.1)
- [CVE-2026-31885](https://insights.sbomify.com/CVE-2026-31885/): FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks (medium 6.5)
- [CVE-2026-31884](https://insights.sbomify.com/CVE-2026-31884/): FreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0 (medium 6.5)
- [CVE-2026-31883](https://insights.sbomify.com/CVE-2026-31883/): FreeRDP has a `size_t` underflow in ADPCM decoder leads to heap-buffer-overflow write (medium 6.5)
- [CVE-2026-31882](https://insights.sbomify.com/CVE-2026-31882/): Dagu SSE Authentication Bypass in Basic Auth Mode (high 7.5)
- [CVE-2026-31881](https://insights.sbomify.com/CVE-2026-31881/): Runtipi unauthenticated /api/auth/reset-password allows operator account takeover during active reset window (high 7.7)
- [CVE-2026-31880](https://insights.sbomify.com/CVE-2026-31880/): Combodo iTop: Reflected XSS in universal search (high 8.0)
- [CVE-2026-3188](https://insights.sbomify.com/CVE-2026-3188/): feiyuchuixue sz-boot-parent API templates path traversal (medium 5.3)
- [CVE-2026-31879](https://insights.sbomify.com/CVE-2026-31879/): Frappe Workspace modification and stored XSS due to improper resource ownership checks (medium 5.1)
- [CVE-2026-31878](https://insights.sbomify.com/CVE-2026-31878/): Frappe: Possible SSRF by any authenticated user (medium 5.0)
- [CVE-2026-31877](https://insights.sbomify.com/CVE-2026-31877/): Frappe SQL Injection due to improper field sanitization (critical 9.3)
- [CVE-2026-31876](https://insights.sbomify.com/CVE-2026-31876/): Notesnook has Stored XSS via unsanitized Twitter/X embed URL in editor (`tweetToEmbed`) (medium 5.4)
- [CVE-2026-31875](https://insights.sbomify.com/CVE-2026-31875/): Parse Server MFA recovery codes not consumed after use (high 8.2)
- [CVE-2026-31874](https://insights.sbomify.com/CVE-2026-31874/): Taskosaur Improper Role Assignment via Parameter Manipulation in User Registration (critical 9.8)
- [CVE-2026-31873](https://insights.sbomify.com/CVE-2026-31873/): Unhead has a Bypass of URI Scheme Sanitization in makeTagSafe via Case-Sensitivity (not scored)
- [CVE-2026-31872](https://insights.sbomify.com/CVE-2026-31872/): Parse Server has a protected fields bypass via dot-notation in query and sort (high 8.7)
- [CVE-2026-31871](https://insights.sbomify.com/CVE-2026-31871/): Parse Server has a SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL (critical 9.3)
- [CVE-2026-31870](https://insights.sbomify.com/CVE-2026-31870/): cpp-httplib Affected by Remote Process Crash via Malformed Content-Length Response Header (high 7.5)
- [CVE-2026-3187](https://insights.sbomify.com/CVE-2026-3187/): feiyuchuixue sz-boot-parent API Endpoint upload unrestricted upload (medium 5.3)
- [CVE-2026-31869](https://insights.sbomify.com/CVE-2026-31869/): Discourse: Composer mentions endpoint leaks hidden group membership through PM `allowed_names` check (medium 5.3)
- [CVE-2026-31868](https://insights.sbomify.com/CVE-2026-31868/): Parse Server has Stored XSS via file upload of HTML-renderable file types (medium 6.3)
- [CVE-2026-31867](https://insights.sbomify.com/CVE-2026-31867/): Craft Commerce has a Potential IDOR in Commerce carts (medium 6.3)
- [CVE-2026-31866](https://insights.sbomify.com/CVE-2026-31866/): Allocation of Resources Without Limits or Throttling in flagd (high 7.5)
- [CVE-2026-31865](https://insights.sbomify.com/CVE-2026-31865/): Elysia Cookie Value Prototype Pollution (medium 6.5)
- [CVE-2026-31864](https://insights.sbomify.com/CVE-2026-31864/): JumpServer has a Server-Side Template Injection Leading to RCE via YAML Rendering (medium 6.8)
- [CVE-2026-31863](https://insights.sbomify.com/CVE-2026-31863/): Improper Restriction of Excessive Authentication Attempts in github.com/anyproto/anytype-heart (low 3.6)
- [CVE-2026-31862](https://insights.sbomify.com/CVE-2026-31862/): Cloud CLI has Command Injection via Multiple Parameters (critical 9.1)
- [CVE-2026-31861](https://insights.sbomify.com/CVE-2026-31861/): Shell Command Injection in Git Routes [CloudCLI UI] (high 8.7)
- [CVE-2026-31860](https://insights.sbomify.com/CVE-2026-31860/): Unhead has a XSS bypass in `useHeadSafe` via attribute name injection and case-sensitive protocol check (medium 5.3)
- [CVE-2026-3186](https://insights.sbomify.com/CVE-2026-3186/): feiyuchuixue sz-boot-parent Password Reset password default password (medium 5.3)
- [CVE-2026-31859](https://insights.sbomify.com/CVE-2026-31859/): Craft has Reflective XSS via incomplete return URL sanitization (medium 6.9)
- [CVE-2026-31858](https://insights.sbomify.com/CVE-2026-31858/): CraftCMS's `ElementSearchController` Affected by Blind SQL Injection (high 8.7)
- [CVE-2026-31857](https://insights.sbomify.com/CVE-2026-31857/): CraftCMS has an RCE vulnerability via relational conditionals in the control panel (high 8.1)
- [CVE-2026-31856](https://insights.sbomify.com/CVE-2026-31856/): Parse Server has a SQL injection via `Increment` operation on nested object field in PostgreSQL (critical 9.3)
- [CVE-2026-31854](https://insights.sbomify.com/CVE-2026-31854/): Cursor Affected by Arbitrary Code Execution via Prompt Injection and Whitelist Bypass (high 8.7)
- [CVE-2026-31853](https://insights.sbomify.com/CVE-2026-31853/): ImageMagick has a heap buffer over-write on 32-bit systems in SFW decoder (medium 5.7)
- [CVE-2026-31852](https://insights.sbomify.com/CVE-2026-31852/): Jellyfin Possible Organization/Secret Compromise from dangerous CI implementation (critical 10.0)
- [CVE-2026-31851](https://insights.sbomify.com/CVE-2026-31851/): Nexxt Nebula 300+ - Lack of Rate Limiting Enables Brute-Force Attacks (high 7.7)
- [CVE-2026-31850](https://insights.sbomify.com/CVE-2026-31850/): Plaintext Storage of Credentials in Configuration Backup in Nexxt Nebula 300+ (medium 6.8)
- [CVE-2026-3185](https://insights.sbomify.com/CVE-2026-3185/): feiyuchuixue sz-boot-parent API Endpoint sys-message authorization (medium 6.9)
- [CVE-2026-31849](https://insights.sbomify.com/CVE-2026-31849/): Missing CSRF Protection on Administrative Endpoints in Nexxt Nebula 300+ (high 7.2)
- [CVE-2026-31848](https://insights.sbomify.com/CVE-2026-31848/): Reversible ecos_pw Cookie Allows Authentication Bypass in Nexxt Nebula 300+ (high 8.7)
- [CVE-2026-31847](https://insights.sbomify.com/CVE-2026-31847/): Hidden Functionality Enables Remote Telnet Activation via /goform/setSysTools in Nexxt Nebula 300+ (high 8.5)
- [CVE-2026-31846](https://insights.sbomify.com/CVE-2026-31846/): Unauthenticated Credential Disclosure via /goform/ate in Nexxt Nebula 300+ (high 7.1)
- [CVE-2026-31845](https://insights.sbomify.com/CVE-2026-31845/): Rukovoditel CRM Reflected XSS via zd_echo Parameter in Zadarma Telephony API Endpoint (critical 9.3)
- [CVE-2026-31844](https://insights.sbomify.com/CVE-2026-31844/): Authenticated SQL Injection in Koha displayby parameter of suggestion.pl (high 8.7)
- [CVE-2026-31843](https://insights.sbomify.com/CVE-2026-31843/): goodoneuz/pay-uz Unauthenticated PHP File Overwrite via /payment/api/editable/update Leading to Remote Code Execution (critical 10.0)
- [CVE-2026-31842](https://insights.sbomify.com/CVE-2026-31842/): Tinyproxy HTTP request parsing desynchronization via case-sensitive Transfer-Encoding handling (high 8.7)
- [CVE-2026-31841](https://insights.sbomify.com/CVE-2026-31841/): Raw exposure of database statements in Hyperterse MCP search tool (medium 6.5)
- [CVE-2026-31840](https://insights.sbomify.com/CVE-2026-31840/): Parse Server has a SQL injection via dot-notation field name in PostgreSQL (critical 9.3)
- [CVE-2026-3184](https://insights.sbomify.com/CVE-2026-3184/): Util-linux: util-linux: access control bypass due to improper hostname canonicalization (low 3.7)
- [CVE-2026-31839](https://insights.sbomify.com/CVE-2026-31839/): Striae has a hash validation utility vulnerability (high 8.2)
- [CVE-2026-31838](https://insights.sbomify.com/CVE-2026-31838/): Auth bypass in istio (medium 6.9)
- [CVE-2026-31837](https://insights.sbomify.com/CVE-2026-31837/): Istio JWKS resolver to prevent private key material from being exposed when JWKS fetch fails. (high 8.7)
- [CVE-2026-31836](https://insights.sbomify.com/CVE-2026-31836/): Mass Assignment Privilege Escalation in Checkmate (high 8.1)
- [CVE-2026-31835](https://insights.sbomify.com/CVE-2026-31835/): Vaultwarden WebAuthn credential metadata tampered before signature verification (medium 5.3)
- [CVE-2026-31834](https://insights.sbomify.com/CVE-2026-31834/): Umbraco Affected by Vertical Privilege Escalation via Missing Authorization Checks (high 7.2)
- [CVE-2026-31833](https://insights.sbomify.com/CVE-2026-31833/): Umbraco has Stored XSS in UFM Rendering Pipeline via Permissive DOMPurify Attribute Filtering (medium 6.7)
- [CVE-2026-31832](https://insights.sbomify.com/CVE-2026-31832/): Umbraco Backoffice API Allows Unauthorized Modification of Domain Data (medium 5.4)
- [CVE-2026-31831](https://insights.sbomify.com/CVE-2026-31831/): Tautulli: Unauthenticated Path Traversal in `/newsletter/image/images` endpoint (high 8.7)
- [CVE-2026-31830](https://insights.sbomify.com/CVE-2026-31830/): sigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto subject digest (high 7.5)
- [CVE-2026-3183](https://insights.sbomify.com/CVE-2026-3183/): Multi Factor Auth Bypass (high 7.1)
- [CVE-2026-31829](https://insights.sbomify.com/CVE-2026-31829/): Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access (high 7.1)
- [CVE-2026-31828](https://insights.sbomify.com/CVE-2026-31828/): Parse Server has an LDAP injection via unsanitized user input in DN and group filter construction (medium 6.0)
- [CVE-2026-31827](https://insights.sbomify.com/CVE-2026-31827/): Alienbin: TTL Index Race Condition allows unauthorized deletion of other users data (high 7.1)
- [CVE-2026-31826](https://insights.sbomify.com/CVE-2026-31826/): pypdf: manipulated stream length values can exhaust RAM (medium 6.8)
- [CVE-2026-31825](https://insights.sbomify.com/CVE-2026-31825/): Sylius has a DQL Injection via API Order Filters (medium 5.3)
- [CVE-2026-31824](https://insights.sbomify.com/CVE-2026-31824/): Sylius has a Promotion Usage Limit Bypass via Race Condition (high 8.2)
- [CVE-2026-31823](https://insights.sbomify.com/CVE-2026-31823/): Sylius has Authenticated Stored XSS (medium 4.8)
- [CVE-2026-31822](https://insights.sbomify.com/CVE-2026-31822/): Sylius has a XSS vulnerability in checkout login form (medium 5.3)
- [CVE-2026-31821](https://insights.sbomify.com/CVE-2026-31821/): Sylius is Missing Authorization in API v2 Add Item Endpoint (medium 6.9)
- [CVE-2026-31820](https://insights.sbomify.com/CVE-2026-31820/): Sylius affected by IDOR in Cart and Checkout LiveComponents (high 7.1)
- [CVE-2026-3182](https://insights.sbomify.com/CVE-2026-3182/): Sensitive Data Exposure (medium 4.3)
- [CVE-2026-31819](https://insights.sbomify.com/CVE-2026-31819/): Sylius has an Open Redirect via Referer Header (medium 6.9)
- [CVE-2026-31818](https://insights.sbomify.com/CVE-2026-31818/): Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist (critical 9.6)
- [CVE-2026-31817](https://insights.sbomify.com/CVE-2026-31817/): OliveTin's unsafe parsing of UniqueTrackingId can be used to write files (high 8.5)
- [CVE-2026-31816](https://insights.sbomify.com/CVE-2026-31816/): Budibase Universal Auth Bypass via Webhook Query Param Injection (critical 9.1)
- [CVE-2026-31815](https://insights.sbomify.com/CVE-2026-31815/): django-unicorn affected by component state manipulation via unvalidated attribute access (medium 5.3)
- [CVE-2026-31814](https://insights.sbomify.com/CVE-2026-31814/): Yamux remote Panic via malformed WindowUpdate credit (high 8.7)
- [CVE-2026-31813](https://insights.sbomify.com/CVE-2026-31813/): Supabase Auth has insecure Apple and Azure authentication with ID tokens (medium 4.8)
- [CVE-2026-31812](https://insights.sbomify.com/CVE-2026-31812/): Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing (high 8.7)
- [CVE-2026-31809](https://insights.sbomify.com/CVE-2026-31809/): SiYuan has a SVG Sanitizer Bypass via Whitespace in `javascript:` URI — Unauthenticated XSS (medium 6.4)
- [CVE-2026-31808](https://insights.sbomify.com/CVE-2026-31808/): file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/725/