# Vulnerabilities published in 2026


- [CVE-2026-31049](https://insights.sbomify.com/CVE-2026-31049/): An issue in Hostbill v.2025-11-24 and 2025-12-01 allows a remote attacker to execute arbitrary code and escalate privileges via the CSV regi (critical 9.8)
- [CVE-2026-31048](https://insights.sbomify.com/CVE-2026-31048/): An issue in the <code>pickle</code> protocol of Pyro v3.x allows attackers to execute arbitrary code via supplying a crafted pickled string message. (critical 9.8)
- [CVE-2026-31040](https://insights.sbomify.com/CVE-2026-31040/): stata-mcp has insufficient validation of user-supplied Stata do-file content that can lead to command execution (critical 9.8)
- [CVE-2026-3104](https://insights.sbomify.com/CVE-2026-3104/): Memory leak in code preparing DNSSEC proofs of non-existence (high 7.5)
- [CVE-2026-3103](https://insights.sbomify.com/CVE-2026-3103/): Deletion of passwords via RestApi (medium 5.3)
- [CVE-2026-31027](https://insights.sbomify.com/CVE-2026-31027/): Memory corruption in totolink:a3600r firmware (critical 9.8)
- [CVE-2026-31020](https://insights.sbomify.com/CVE-2026-31020/): In DocsGPT 0.15.0 and below, the application provides a custom prompt feature that allows users to define prompt content used during chatbot interactions. (critical 9.8)
- [CVE-2026-3102](https://insights.sbomify.com/CVE-2026-3102/): exiftool PNG File MacOS.pm SetMacOSTags os command injection (medium 5.3)
- [CVE-2026-31019](https://insights.sbomify.com/CVE-2026-31019/): Dolibarr user with permission to edit PHP content can bypass filtering to restrict dangerous PHP functions (high 8.8)
- [CVE-2026-31018](https://insights.sbomify.com/CVE-2026-31018/): Dolibarr Allows Code Injection through its Website Module (high 8.8)
- [CVE-2026-31017](https://insights.sbomify.com/CVE-2026-31017/): Server-side request forgery in frappe:erpnext (critical 9.1)
- [CVE-2026-31016](https://insights.sbomify.com/CVE-2026-31016/): Cross Site Request Forgery vulnerability in Squidex.io Squidex CMS v.7.21.0 and before allows a remote attacker to escalate privileges via t (medium 6.5)
- [CVE-2026-31014](https://insights.sbomify.com/CVE-2026-31014/): Cross-site request forgery in dovestones:ad self update (medium 6.3)
- [CVE-2026-31013](https://insights.sbomify.com/CVE-2026-31013/): Cross-site scripting in dovestones:ad phonebook (medium 6.1)
- [CVE-2026-3101](https://insights.sbomify.com/CVE-2026-3101/): Intelbras TIP 635G Ping os command injection (medium 5.3)
- [CVE-2026-3100](https://insights.sbomify.com/CVE-2026-3100/): An improper certificate validation vulnerability was found in the FTP Backup on the ADM. (high 8.3)
- [CVE-2026-30999](https://insights.sbomify.com/CVE-2026-30999/): Memory corruption in ffmpeg:ffmpeg (high 7.5)
- [CVE-2026-30998](https://insights.sbomify.com/CVE-2026-30998/): Denial of service in ffmpeg:ffmpeg (high 7.5)
- [CVE-2026-30997](https://insights.sbomify.com/CVE-2026-30997/): Memory corruption in ffmpeg:ffmpeg (high 7.5)
- [CVE-2026-30996](https://insights.sbomify.com/CVE-2026-30996/): An issue in the file handling logic of the component download.php of SAC-NFe v2.0.02 allows attackers to execute a directory traversal and r (high 7.5)
- [CVE-2026-30995](https://insights.sbomify.com/CVE-2026-30995/): Slah CMS v1.5.0 and below was discovered to contain a SQL injection vulnerability via the id parameter in the vereador_ver.php endpoint. (high 8.6)
- [CVE-2026-30994](https://insights.sbomify.com/CVE-2026-30994/): Incorrect access control in the config.php component of Slah v1.5.0 and below allows unauthenticated attackers to access sensitive informati (high 7.5)
- [CVE-2026-30993](https://insights.sbomify.com/CVE-2026-30993/): Slah CMS v1.5.0 and below was discovered to contain a remote code execution (RCE) vulnerability in the session() function at config.php. (critical 9.8)
- [CVE-2026-3099](https://insights.sbomify.com/CVE-2026-3099/): Libsoup: libsoup: authentication bypass via digest authentication replay attack (medium 5.8)
- [CVE-2026-30987](https://insights.sbomify.com/CVE-2026-30987/): iccDEV has a stack buffer overflow in CIccTagNum<(icTagTypeSignature)>::GetValues() (high 7.8)
- [CVE-2026-30986](https://insights.sbomify.com/CVE-2026-30986/): iccDEV has a heap-based buffer overflow write in CIccCLUT::Interp3d() (medium 5.5)
- [CVE-2026-30985](https://insights.sbomify.com/CVE-2026-30985/): iccDEV has a heap-based buffer overflow write in CIccMatrixMath::SetRange() (high 7.8)
- [CVE-2026-30984](https://insights.sbomify.com/CVE-2026-30984/): iccDEV has a heap out-of-bounds read in CIccCalculatorFunc::ApplySequence() (medium 6.1)
- [CVE-2026-30983](https://insights.sbomify.com/CVE-2026-30983/): iccDEV has a stack buffer overflow in icFixXml() (high 7.8)
- [CVE-2026-30982](https://insights.sbomify.com/CVE-2026-30982/): iccDEV has a heap out-of-bounds read in CIccPcsXform::pushXYZConvert() (medium 6.1)
- [CVE-2026-30981](https://insights.sbomify.com/CVE-2026-30981/): iccDEV has a heap-buffer-overflow read in CIccXmlArrayType<> (medium 6.1)
- [CVE-2026-30980](https://insights.sbomify.com/CVE-2026-30980/): iccDEV has a stack overflow in CIccBasicStructFactory::CreateStruct() (medium 5.5)
- [CVE-2026-3098](https://insights.sbomify.com/CVE-2026-3098/): Smart Slider 3 <= 3.5.1.33 - Authenticated (Subscriber+) Arbitrary File Read via actionExportAll (medium 6.5)
- [CVE-2026-30979](https://insights.sbomify.com/CVE-2026-30979/): iccDEV has a heap-based buffer overflow in CIccCalculatorFunc::InitSelectOp() (high 7.8)
- [CVE-2026-30978](https://insights.sbomify.com/CVE-2026-30978/): Heap-use-after-free in CIccCmm::AddXform() (high 7.8)
- [CVE-2026-30977](https://insights.sbomify.com/CVE-2026-30977/): RenderBlocking has Stored XSS in renderblocking-css with Inline Assets mode (low 2.0)
- [CVE-2026-30976](https://insights.sbomify.com/CVE-2026-30976/): Sonarr Path Traversal vulnerability (high 8.6)
- [CVE-2026-30975](https://insights.sbomify.com/CVE-2026-30975/): Sonarr Authentication Bypass vulnerability (high 8.1)
- [CVE-2026-30974](https://insights.sbomify.com/CVE-2026-30974/): Copyparty volflag `nohtml` did not block javascript in svg files (medium 4.6)
- [CVE-2026-30973](https://insights.sbomify.com/CVE-2026-30973/): Zip Slip arbitrary file write in @appium/support ZIP extraction (medium 6.5)
- [CVE-2026-30972](https://insights.sbomify.com/CVE-2026-30972/): Parse Server has a rate limit bypass via batch request endpoint (medium 6.9)
- [CVE-2026-30971](https://insights.sbomify.com/CVE-2026-30971/): ZoneMinder: Authenticated RCE via command injection in monitor Device Path (high 8.8)
- [CVE-2026-30970](https://insights.sbomify.com/CVE-2026-30970/): Session authentication bypass in Coral Server session creation endpoint (high 8.8)
- [CVE-2026-30969](https://insights.sbomify.com/CVE-2026-30969/): Coral Server has insufficient agent authentication in session communication channels (high 7.6)
- [CVE-2026-30968](https://insights.sbomify.com/CVE-2026-30968/): Coral Server has insufficient validation of agent identity for SSE connections (high 8.6)
- [CVE-2026-30967](https://insights.sbomify.com/CVE-2026-30967/): Parse Server OAuth2 authentication adapter account takeover via identity spoofing (high 7.6)
- [CVE-2026-30966](https://insights.sbomify.com/CVE-2026-30966/): Parse Server role escalation and CLP bypass via direct `_Join` table write (critical 10.0)
- [CVE-2026-30965](https://insights.sbomify.com/CVE-2026-30965/): Parse Server session token exfiltration via `redirectClassNameForKey` query parameter (critical 9.9)
- [CVE-2026-30964](https://insights.sbomify.com/CVE-2026-30964/): Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validation (medium 5.4)
- [CVE-2026-30963](https://insights.sbomify.com/CVE-2026-30963/): Capsule Namespace Hijacking via subresource (low 3.9)
- [CVE-2026-30962](https://insights.sbomify.com/CVE-2026-30962/): Parse Server has a protected fields bypass via logical query operators (high 7.1)
- [CVE-2026-30961](https://insights.sbomify.com/CVE-2026-30961/): Gokapi's File Request MaxSize Limit Bypassed via Multi-Chunk Upload (medium 4.3)
- [CVE-2026-30960](https://insights.sbomify.com/CVE-2026-30960/): RSSN has Arbitrary Code Execution via Unvalidated JIT Instruction Generation in C-FFI Interface (critical 9.4)
- [CVE-2026-3096](https://insights.sbomify.com/CVE-2026-3096/): Reverse Tabnabbing via New Tab Navigation in Multiple WSO2 Products Allows Phishing and Credential Theft (medium 4.7)
- [CVE-2026-30959](https://insights.sbomify.com/CVE-2026-30959/): OneUptime has WhatsApp Resend Verification Authorization Bypass (medium 5.3)
- [CVE-2026-30958](https://insights.sbomify.com/CVE-2026-30958/): OneUptime: Path Traversal — Arbitrary File Read (No Auth) (high 7.2)
- [CVE-2026-30957](https://insights.sbomify.com/CVE-2026-30957/): OneUptime Synthetic Monitor RCE via exposed Playwright browser object (critical 10.0)
- [CVE-2026-30956](https://insights.sbomify.com/CVE-2026-30956/): OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header (critical 10.0)
- [CVE-2026-30955](https://insights.sbomify.com/CVE-2026-30955/): Gokapi vulnerable to DoS in E2E Metadata Parser (medium 6.5)
- [CVE-2026-30954](https://insights.sbomify.com/CVE-2026-30954/): LinkAce has a Cross-User Tag/List Attachment IDOR in processTaxonomy() (medium 5.3)
- [CVE-2026-30953](https://insights.sbomify.com/CVE-2026-30953/): LinkAce affected by SSRF via link creation: NoPrivateIpRule not applied to LinkStoreRequest (high 7.7)
- [CVE-2026-30952](https://insights.sbomify.com/CVE-2026-30952/): liquidjs has a path traversal fallback vulnerability (high 8.7)
- [CVE-2026-30951](https://insights.sbomify.com/CVE-2026-30951/): Sequelize v6 Vulnerable to SQL Injection via JSON Column Cast Type (high 7.5)
- [CVE-2026-30950](https://insights.sbomify.com/CVE-2026-30950/): AutoGPT has Authenticated Session Hijacking via IDOR (high 7.1)
- [CVE-2026-30949](https://insights.sbomify.com/CVE-2026-30949/): Parse Server is missing audience validation in Keycloak authentication adapter (high 7.6)
- [CVE-2026-30948](https://insights.sbomify.com/CVE-2026-30948/): Parse Server has stored cross-site scripting (XSS) via SVG file upload (high 8.3)
- [CVE-2026-30947](https://insights.sbomify.com/CVE-2026-30947/): Parse Server ha a bypass of class-level permissions in LiveQuery (high 8.7)
- [CVE-2026-30946](https://insights.sbomify.com/CVE-2026-30946/): Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API (high 8.7)
- [CVE-2026-30945](https://insights.sbomify.com/CVE-2026-30945/): StudioCMS: IDOR — Arbitrary API Token Revocation Leading to Denial of Service (high 7.1)
- [CVE-2026-30944](https://insights.sbomify.com/CVE-2026-30944/): StudioCMS Affected by Privilege Escalation via Insecure API Token Generation (high 8.8)
- [CVE-2026-30943](https://insights.sbomify.com/CVE-2026-30943/): Gokapi has Privilege Escalation in File Replace (medium 4.1)
- [CVE-2026-30942](https://insights.sbomify.com/CVE-2026-30942/): Flare has a Path Traversal in /api/avatars/[filename] (high 8.3)
- [CVE-2026-30941](https://insights.sbomify.com/CVE-2026-30941/): Parse Server has a NoSQL injection via token type in password reset and email verification endpoints (high 8.7)
- [CVE-2026-30940](https://insights.sbomify.com/CVE-2026-30940/): baserCMS: Path Traversal in Theme File API Leads to Arbitrary File Write and RCE (high 7.2)
- [CVE-2026-3094](https://insights.sbomify.com/CVE-2026-3094/): File Parsing Out-Of-Bounds Write in CNCSoft-G2 (high 7.8)
- [CVE-2026-30939](https://insights.sbomify.com/CVE-2026-30939/): Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution (high 8.8)
- [CVE-2026-30938](https://insights.sbomify.com/CVE-2026-30938/): Parse Server has denylist `requestKeywordDenylist` keyword scan bypass through nested object placement (medium 6.9)
- [CVE-2026-30937](https://insights.sbomify.com/CVE-2026-30937/): ImageMagick has a heap buffer overflow in WriteXWDImage due to CARD32 arithmetic overflow in bytes_per_line calculation (medium 6.8)
- [CVE-2026-30936](https://insights.sbomify.com/CVE-2026-30936/): ImageMagick has a heap Buffer Overflow in WaveletDenoiseImage (medium 5.5)
- [CVE-2026-30935](https://insights.sbomify.com/CVE-2026-30935/): ImageMagick has a heap Buffer Over-Read in BilateralBlurImage (medium 4.4)
- [CVE-2026-30934](https://insights.sbomify.com/CVE-2026-30934/): FileBrowser Quantum: Stored XSS in public share page via unsanitized share metadata (text/template misuse) (high 8.9)
- [CVE-2026-30933](https://insights.sbomify.com/CVE-2026-30933/): FileBrowser Quantum: Password-Protected Share Bypass via /public/api/share/info (high 7.5)
- [CVE-2026-30932](https://insights.sbomify.com/CVE-2026-30932/): Froxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones API (high 8.6)
- [CVE-2026-30931](https://insights.sbomify.com/CVE-2026-30931/): ImageMagick has a heap-based buffer overflow in UHDR encoder (medium 6.8)
- [CVE-2026-30930](https://insights.sbomify.com/CVE-2026-30930/): Glances has SQL Injection via Process Names in TimescaleDB Export (high 7.3)
- [CVE-2026-3093](https://insights.sbomify.com/CVE-2026-3093/): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (medium 4.7)
- [CVE-2026-30929](https://insights.sbomify.com/CVE-2026-30929/): ImageMagick has a stack buffer overflow in MagnifyImage (high 7.7)
- [CVE-2026-30928](https://insights.sbomify.com/CVE-2026-30928/): Glances Exposes Unauthenticated Configuration Secrets (high 8.7)
- [CVE-2026-30927](https://insights.sbomify.com/CVE-2026-30927/): Admidio: Event participation IDOR - non-leaders can register other users for events via user_uuid parameter (medium 5.3)
- [CVE-2026-30926](https://insights.sbomify.com/CVE-2026-30926/): SiYuan Note publish service authorization bypass allows low-privilege users to modify notebook content (high 7.1)
- [CVE-2026-30925](https://insights.sbomify.com/CVE-2026-30925/): Parse Server affected by Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuery (high 8.2)
- [CVE-2026-30924](https://insights.sbomify.com/CVE-2026-30924/): qui CORS Misconfiguration: Arbitrary Origins Trusted (critical 9.0)
- [CVE-2026-30923](https://insights.sbomify.com/CVE-2026-30923/): libModSecurity3 denial of service via segfault when using t:hexDecode on single-character query strings (high 8.2)
- [CVE-2026-30922](https://insights.sbomify.com/CVE-2026-30922/): pyasn1 Vulnerable to Denial of Service via Unbounded Recursion (high 7.5)
- [CVE-2026-30921](https://insights.sbomify.com/CVE-2026-30921/): OneUptime Synthetic Monitor RCE via exposed Playwright browser object (critical 10.0)
- [CVE-2026-30920](https://insights.sbomify.com/CVE-2026-30920/): OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding (high 8.6)
- [CVE-2026-30919](https://insights.sbomify.com/CVE-2026-30919/): facileManager Affected by Stored Cross-Site Scripting (XSS) (high 7.6)
- [CVE-2026-30918](https://insights.sbomify.com/CVE-2026-30918/): facileManager Affected by Reflected Cross-Site Scripting (XSS) (high 7.6)
- [CVE-2026-30917](https://insights.sbomify.com/CVE-2026-30917/): Stored XSS on Bucket namespace pages (high 8.8)
- [CVE-2026-30915](https://insights.sbomify.com/CVE-2026-30915/): SFTPGo improperly sanitizes placeholders in group home directories/key prefixes (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/732/