# Vulnerabilities published in 2026


- [CVE-2026-30914](https://insights.sbomify.com/CVE-2026-30914/): SFTPGo has a Path Traversal and Permission Bypass via Path Normalization Discrepancy (medium 5.3)
- [CVE-2026-30913](https://insights.sbomify.com/CVE-2026-30913/): flarum/nickname: Display name injection in notification emails (autolink & markdown) (medium 4.6)
- [CVE-2026-30912](https://insights.sbomify.com/CVE-2026-30912/): Apache Airflow: Exposing stack trace in case of constraint error (high 7.5)
- [CVE-2026-30911](https://insights.sbomify.com/CVE-2026-30911/): Apache Airflow: Execution API HITL Endpoints Missing Per-Task Authorization (high 8.1)
- [CVE-2026-30910](https://insights.sbomify.com/CVE-2026-30910/): Crypt::Sodium::XS versions through 0.001000 for Perl has potential integer overflows (high 7.5)
- [CVE-2026-3091](https://insights.sbomify.com/CVE-2026-3091/): Other in Synology Presto Client (medium 6.7)
- [CVE-2026-30909](https://insights.sbomify.com/CVE-2026-30909/): Crypt::NaCl::Sodium versions through 2.002 for Perl has potential integer overflows (critical 9.8)
- [CVE-2026-30906](https://insights.sbomify.com/CVE-2026-30906/): Privilege escalation in Zoom Rooms (high 7.8)
- [CVE-2026-30905](https://insights.sbomify.com/CVE-2026-30905/): Privilege escalation in Zoom Workplace VDI Plugin (high 7.8)
- [CVE-2026-30904](https://insights.sbomify.com/CVE-2026-30904/): Security feature bypass in Zoom Workplace (low 1.8)
- [CVE-2026-30903](https://insights.sbomify.com/CVE-2026-30903/): Path traversal in Zoom Workplace (critical 9.6)
- [CVE-2026-30902](https://insights.sbomify.com/CVE-2026-30902/): Zoom Clients for Windows - Improper Privilege Management (high 7.8)
- [CVE-2026-30901](https://insights.sbomify.com/CVE-2026-30901/): Zoom Rooms for Windows - Improper Input Validation (high 7.0)
- [CVE-2026-30900](https://insights.sbomify.com/CVE-2026-30900/): Zoom Workplace Clients for Windows - Improper Check (high 7.8)
- [CVE-2026-3090](https://insights.sbomify.com/CVE-2026-3090/): Post SMTP <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'event_type' (high 7.2)
- [CVE-2026-30898](https://insights.sbomify.com/CVE-2026-30898/): Apache Airflow: Bad example of BashOperator shell injection via dag_run.conf (high 8.8)
- [CVE-2026-30897](https://insights.sbomify.com/CVE-2026-30897/): Memory corruption in FortiWeb (medium 5.9)
- [CVE-2026-30896](https://insights.sbomify.com/CVE-2026-30896/): Other in Qsee Client (high 8.4)
- [CVE-2026-30895](https://insights.sbomify.com/CVE-2026-30895/): Joomla! Core - [20260504] - XSS in readmore links (medium 6.9)
- [CVE-2026-30894](https://insights.sbomify.com/CVE-2026-30894/): Joomla! Core - [20260503] - XSS in com_contenthistory (medium 6.9)
- [CVE-2026-30893](https://insights.sbomify.com/CVE-2026-30893/): Path traversal in wazuh (critical 9.0)
- [CVE-2026-30892](https://insights.sbomify.com/CVE-2026-30892/): Crun incorrectly parses `crun exec` option `-u`, leading to privilege escalation (not scored)
- [CVE-2026-30891](https://insights.sbomify.com/CVE-2026-30891/): Discourse hasUnauthorized Exposure of Private User Action Types (medium 5.3)
- [CVE-2026-30890](https://insights.sbomify.com/CVE-2026-30890/): Combodo iTop: Reflected XSS in synchro/synchro_import.php (high 8.0)
- [CVE-2026-3089](https://insights.sbomify.com/CVE-2026-3089/): Actual Sync Server 26.2.1 - Authenticated Path Traversal (medium 5.3)
- [CVE-2026-30889](https://insights.sbomify.com/CVE-2026-30889/): Discourse has Unauthorized Post Data Exposure in discourse-user-notes (medium 5.3)
- [CVE-2026-30888](https://insights.sbomify.com/CVE-2026-30888/): Discourse has moderator privilege escalation via arbitrary post_id in suspend/silence endpoint (low 2.2)
- [CVE-2026-30887](https://insights.sbomify.com/CVE-2026-30887/): OneUptime Affected by Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE (critical 10.0)
- [CVE-2026-30886](https://insights.sbomify.com/CVE-2026-30886/): New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check (medium 6.5)
- [CVE-2026-30885](https://insights.sbomify.com/CVE-2026-30885/): WWBN AVideo - Unauthenticated IDOR - Playlist Information Disclosure (medium 5.5)
- [CVE-2026-30884](https://insights.sbomify.com/CVE-2026-30884/): mdjnelson/moodle-mod_customcert Vulnerable to Authorization Bypass Through User-Controlled Key (critical 9.6)
- [CVE-2026-30883](https://insights.sbomify.com/CVE-2026-30883/): ImageMagick has a Heap Overflow when writing extremely large image profile in the PNG encoder (medium 5.7)
- [CVE-2026-30882](https://insights.sbomify.com/CVE-2026-30882/): Chamilo LMS: Reflected XSS in the session category listing page (medium 6.1)
- [CVE-2026-30881](https://insights.sbomify.com/CVE-2026-30881/): Chamilo LMS: SQL Injection in the statistics AJAX endpoint (high 8.8)
- [CVE-2026-30880](https://insights.sbomify.com/CVE-2026-30880/): baserCMS: OS command injection vulnerability in installer (critical 9.2)
- [CVE-2026-3088](https://insights.sbomify.com/CVE-2026-3088/): Unauthenticated users can disrupt router operation (medium 4.9)
- [CVE-2026-30879](https://insights.sbomify.com/CVE-2026-30879/): baserCMS: Cross-site scripting vulnerability in blog post (medium 6.9)
- [CVE-2026-30878](https://insights.sbomify.com/CVE-2026-30878/): baserCMS: Mail Form Acceptance Bypass via Public API (medium 5.3)
- [CVE-2026-30877](https://insights.sbomify.com/CVE-2026-30877/): baserCMS: OS Command Injection in the baserCMS Update Functionality (critical 9.1)
- [CVE-2026-30876](https://insights.sbomify.com/CVE-2026-30876/): Chamilo LMS: User enumeration vulnerability via response (medium 6.3)
- [CVE-2026-30875](https://insights.sbomify.com/CVE-2026-30875/): Chamilo LMS: Authenticated RCE via H5P Import (high 8.8)
- [CVE-2026-30874](https://insights.sbomify.com/CVE-2026-30874/): OpenWrt procd PATH Environment Variable Filter Bypass via Incorrect String Comparison Leads to Privilege Escalation (low 1.8)
- [CVE-2026-30873](https://insights.sbomify.com/CVE-2026-30873/): OpenWrt Project jsonpath: Memory leak when processing strings, labels, and regexp tokens (low 2.4)
- [CVE-2026-30872](https://insights.sbomify.com/CVE-2026-30872/): OpenWrt Project has a Stack-based Buffer Overflow vulnerability via IPv6 reverse DNS lookup (critical 9.5)
- [CVE-2026-30871](https://insights.sbomify.com/CVE-2026-30871/): OpenWrt Project has Stack-based Buffer Overflow in DNS PTR Query (critical 9.5)
- [CVE-2026-30870](https://insights.sbomify.com/CVE-2026-30870/): Some sync filters in PowerSync Service ignored using `config.edition: 3` (medium 6.5)
- [CVE-2026-3087](https://insights.sbomify.com/CVE-2026-3087/): shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs (medium 6.0)
- [CVE-2026-30869](https://insights.sbomify.com/CVE-2026-30869/): SiYuan has a Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage (critical 9.3)
- [CVE-2026-30868](https://insights.sbomify.com/CVE-2026-30868/): Cross-Site Request Forgery (CSRF) in opnsense/core (medium 6.3)
- [CVE-2026-30867](https://insights.sbomify.com/CVE-2026-30867/): CocoaMQTT: Denial of Service via Reachable Assertion in `PUBLISH` Packet Parsing (medium 5.7)
- [CVE-2026-30866](https://insights.sbomify.com/CVE-2026-30866/): Combodo iTop: Insecured access to uploaded images via sniffed url (high 7.5)
- [CVE-2026-30865](https://insights.sbomify.com/CVE-2026-30865/): Combodo iTop: Reflected XSS in dashboard save (high 7.1)
- [CVE-2026-30864](https://insights.sbomify.com/CVE-2026-30864/): Combodo iTop: Reflected XSS in dashboard revert (high 8.9)
- [CVE-2026-30863](https://insights.sbomify.com/CVE-2026-30863/): Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters (critical 9.3)
- [CVE-2026-30862](https://insights.sbomify.com/CVE-2026-30862/): Critical Stored XSS & Privilege Escalation in Appsmith (critical 9.1)
- [CVE-2026-30861](https://insights.sbomify.com/CVE-2026-30861/): WeKnora: Remote Code Execution (RCE) via Command Injection in MCP Stdio Configuration Validation (critical 10.0)
- [CVE-2026-30860](https://insights.sbomify.com/CVE-2026-30860/): WeKnora: Remote Code Execution via SQL Injection Bypass in AI Database Query Tool (critical 10.0)
- [CVE-2026-3086](https://insights.sbomify.com/CVE-2026-3086/): GStreamer H.266 Codec Parser Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-30859](https://insights.sbomify.com/CVE-2026-30859/): WeKnora: Broken Access Control - Cross-Tenant Data Exposure (medium 5.3)
- [CVE-2026-30858](https://insights.sbomify.com/CVE-2026-30858/): WeKnora: DNS Rebinding Vulnerability in web_fetch Tool Allows SSRF to Internal Resources (medium 6.5)
- [CVE-2026-30857](https://insights.sbomify.com/CVE-2026-30857/): WeKnora: Unauthorized Cross‑Tenant Knowledge Base Cloning (medium 5.3)
- [CVE-2026-30856](https://insights.sbomify.com/CVE-2026-30856/): WeKnora: Tool Execution Hijacking via Ambigous Naming Convention In MCP client and Indirect Prompt Injection (medium 5.9)
- [CVE-2026-30855](https://insights.sbomify.com/CVE-2026-30855/): WeKnora: Broken Access Control in Tenant Management (high 8.8)
- [CVE-2026-30854](https://insights.sbomify.com/CVE-2026-30854/): Parse Server: GraphQL `__type` introspection bypass via inline fragments when public introspection is disabled (medium 6.9)
- [CVE-2026-30853](https://insights.sbomify.com/CVE-2026-30853/): calibre has a Path Traversal Leading to Arbitrary File Write (medium 5.0)
- [CVE-2026-30852](https://insights.sbomify.com/CVE-2026-30852/): Caddy: vars_regexp double-expands user input, leaking env vars and files (medium 5.5)
- [CVE-2026-30851](https://insights.sbomify.com/CVE-2026-30851/): Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation (high 8.1)
- [CVE-2026-30850](https://insights.sbomify.com/CVE-2026-30850/): Parse Server: File metadata endpoint bypasses `beforeFind` / `afterFind` trigger authorization (medium 6.3)
- [CVE-2026-3085](https://insights.sbomify.com/CVE-2026-3085/): GStreamer rtpqdm2depay Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-30849](https://insights.sbomify.com/CVE-2026-30849/): MantisBT SOAP API has an authentication bypass vulnerability on MySQL (critical 9.3)
- [CVE-2026-30848](https://insights.sbomify.com/CVE-2026-30848/): Parse Server: `PagesRouter` path traversal allows reading files outside configured pages directory (medium 6.3)
- [CVE-2026-30847](https://insights.sbomify.com/CVE-2026-30847/): Wekan Credential Leak via notificationUsers Publication Exposes Password Hashes and Session Tokens (critical 9.3)
- [CVE-2026-30846](https://insights.sbomify.com/CVE-2026-30846/): Wekan Exposes All Global Webhook Integrations through globalwebhooks Publication (high 8.7)
- [CVE-2026-30845](https://insights.sbomify.com/CVE-2026-30845/): Wekan Exposes Sensitive Data through Lack of Field Filtering During Board Publication (medium 6.9)
- [CVE-2026-30844](https://insights.sbomify.com/CVE-2026-30844/): Wekan Vulnerable to SSRF through Lack of Validation or Filtering in Attachment URL Loading (critical 9.3)
- [CVE-2026-30843](https://insights.sbomify.com/CVE-2026-30843/): Wekan has Cross-Board IDOR in Custom Fields Update Endpoints (critical 9.3)
- [CVE-2026-30842](https://insights.sbomify.com/CVE-2026-30842/): Wallos: Authenticated Missing Authorization Allows Deletion of Other Users’ Uploaded Avatars (medium 4.3)
- [CVE-2026-30841](https://insights.sbomify.com/CVE-2026-30841/): Wallos: Reflected XSS via unescaped token and email parameters in passwordreset.php (medium 6.9)
- [CVE-2026-30840](https://insights.sbomify.com/CVE-2026-30840/): Wallos: Server-Side Request Forgery (SSRF) in Notification Testers (high 8.8)
- [CVE-2026-3084](https://insights.sbomify.com/CVE-2026-3084/): GStreamer H.266 Codec Parser Integer Underflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-30839](https://insights.sbomify.com/CVE-2026-30839/): Wallos: SSRF via webhook test endpoint (medium 5.3)
- [CVE-2026-30838](https://insights.sbomify.com/CVE-2026-30838/): league/commonmark: DisallowedRawHtml extension bypass via whitespace in HTML tag names (medium 5.1)
- [CVE-2026-30837](https://insights.sbomify.com/CVE-2026-30837/): Elysia has a string URL format redos (high 7.5)
- [CVE-2026-30836](https://insights.sbomify.com/CVE-2026-30836/): Step CA: Unauthenticated Certificate Issuance via SCEP UpdateReq (MessageType=18) (critical 10.0)
- [CVE-2026-30835](https://insights.sbomify.com/CVE-2026-30835/): Parse Server: Malformed `$regex` query leaks database error details in API response (medium 6.9)
- [CVE-2026-30834](https://insights.sbomify.com/CVE-2026-30834/): PinchTab: SSRF with Full Response Exfiltration via Download Handler (high 7.5)
- [CVE-2026-30833](https://insights.sbomify.com/CVE-2026-30833/): Rocket.Chat: NoSQL injection in the EE ddp-streamer-service (medium 6.9)
- [CVE-2026-30832](https://insights.sbomify.com/CVE-2026-30832/): Soft Serve: SSRF via unvalidated LFS endpoint in repo import (critical 9.1)
- [CVE-2026-30831](https://insights.sbomify.com/CVE-2026-30831/): Rocket.Chat: 2FA bypass and login of deactivated users via EE ddp-streamer (high 8.0)
- [CVE-2026-30830](https://insights.sbomify.com/CVE-2026-30830/): Defuddle: XSS via unescaped string interpolation in _findContentBySchemaText image tag (low 2.1)
- [CVE-2026-3083](https://insights.sbomify.com/CVE-2026-3083/): GStreamer rtpqdm2depay Out-Of-Bounds Write Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-30829](https://insights.sbomify.com/CVE-2026-30829/): Checkmate: Unauthenticated Access to Unpublished Status Page (medium 5.3)
- [CVE-2026-30828](https://insights.sbomify.com/CVE-2026-30828/): Wallos: SSRF via url parameter leading to File Traversal (high 8.7)
- [CVE-2026-30827](https://insights.sbomify.com/CVE-2026-30827/): express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting on servers with dual-stack network (high 7.5)
- [CVE-2026-30826](https://insights.sbomify.com/CVE-2026-30826/): Combodo iTop: Reflected XSS in run_query.php (high 8.0)
- [CVE-2026-30825](https://insights.sbomify.com/CVE-2026-30825/): hoppscotch: IDOR - Any authenticated user can revoke any other user's Personal Access Token (not scored)
- [CVE-2026-30824](https://insights.sbomify.com/CVE-2026-30824/): Flowise: Missing Authentication on NVIDIA NIM Endpoints (high 7.7)
- [CVE-2026-30823](https://insights.sbomify.com/CVE-2026-30823/): Flowise: IDOR leading to Account Takeover and Enterprise Feature Bypass via SSO Configuration (high 8.8)
- [CVE-2026-30822](https://insights.sbomify.com/CVE-2026-30822/): Flowise: Mass Assignment in `/api/v1/leads` Endpoint (high 7.7)
- [CVE-2026-30821](https://insights.sbomify.com/CVE-2026-30821/): Flowise: Arbitrary File Upload via MIME Spoofing (high 8.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/733/