# Vulnerabilities published in 2026


- [CVE-2026-29184](https://insights.sbomify.com/CVE-2026-29184/): @backstage/plugin-scaffolder-backend: Potential Session Token Exfiltration via Log Redaction Bypass (low 2.0)
- [CVE-2026-29183](https://insights.sbomify.com/CVE-2026-29183/): SiYuan: Unauthenticated Reflected XSS via SVG Injection in /api/icon/getDynamicIcon Endpoint (critical 9.3)
- [CVE-2026-29182](https://insights.sbomify.com/CVE-2026-29182/): Parse Server: Cloud Hooks and Cloud Jobs bypass `readOnlyMasterKey` write restriction (high 8.6)
- [CVE-2026-29181](https://insights.sbomify.com/CVE-2026-29181/): OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification) (high 7.5)
- [CVE-2026-29180](https://insights.sbomify.com/CVE-2026-29180/): Fleet's team maintainer can transfer hosts from any team via missing source team authorization (medium 4.9)
- [CVE-2026-2918](https://insights.sbomify.com/CVE-2026-2918/): Missing authorization in Happy Addons for Elementor (medium 6.4)
- [CVE-2026-29179](https://insights.sbomify.com/CVE-2026-29179/): October: Editor Sub-Permission Bypass for Asset and Blueprint File Operations (low 3.3)
- [CVE-2026-29178](https://insights.sbomify.com/CVE-2026-29178/): Lemmy: Unauthenticated SSRF via file_type query parameter injection in image endpoint (high 7.7)
- [CVE-2026-29177](https://insights.sbomify.com/CVE-2026-29177/): Craft Commerce has Stored XSS in Craft Commerce Order Details Slideout (low 1.9)
- [CVE-2026-29176](https://insights.sbomify.com/CVE-2026-29176/): Craft Commerce has Stored XSS in Inventory Location Name (medium 4.8)
- [CVE-2026-29175](https://insights.sbomify.com/CVE-2026-29175/): Multiple Stored XSS in Commerce Inventory Page Leading to Session Hijacking (high 8.6)
- [CVE-2026-29174](https://insights.sbomify.com/CVE-2026-29174/): Craft Commerce has a SQL Injection in Commerce Inventory Table Sorting (high 8.7)
- [CVE-2026-29173](https://insights.sbomify.com/CVE-2026-29173/): Craft Commerce has Stored XSS while updating Order Status from Orders Table (low 1.9)
- [CVE-2026-29172](https://insights.sbomify.com/CVE-2026-29172/): Craft Commerce has a SQL Injection in Commerce Purchasables Table Sorting (high 8.7)
- [CVE-2026-29170](https://insights.sbomify.com/CVE-2026-29170/): Apache HTTP Server: mod_proxy_ftp XSS (medium 6.1)
- [CVE-2026-2917](https://insights.sbomify.com/CVE-2026-2917/): Missing authorization in Happy Addons for Elementor (medium 5.4)
- [CVE-2026-29169](https://insights.sbomify.com/CVE-2026-29169/): Apache HTTP Server: mod_dav_lock indirect lock crash (high 7.5)
- [CVE-2026-29168](https://insights.sbomify.com/CVE-2026-29168/): Apache HTTP Server: mod_md unrestricted OCSP response (high 7.3)
- [CVE-2026-29167](https://insights.sbomify.com/CVE-2026-29167/): Apache HTTP Server: mod_ldap per-dir use-after-free (critical 9.8)
- [CVE-2026-2916](https://insights.sbomify.com/CVE-2026-2916/): Information disclosure in Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress (medium 4.3)
- [CVE-2026-2915](https://insights.sbomify.com/CVE-2026-2915/): HP System Event Utility – Denial of Service (medium 5.2)
- [CVE-2026-29146](https://insights.sbomify.com/CVE-2026-29146/): Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default (high 7.5)
- [CVE-2026-29145](https://insights.sbomify.com/CVE-2026-29145/): Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled (critical 9.1)
- [CVE-2026-29144](https://insights.sbomify.com/CVE-2026-29144/): Unicode Subject Tags (high 7.8)
- [CVE-2026-29143](https://insights.sbomify.com/CVE-2026-29143/): S/MIME Decryption Impersonation (high 7.8)
- [CVE-2026-29142](https://insights.sbomify.com/CVE-2026-29142/): Plaintext secure-mail.html (medium 6.3)
- [CVE-2026-29141](https://insights.sbomify.com/CVE-2026-29141/): Bounded Subject Tag Sanitization (high 7.7)
- [CVE-2026-29140](https://insights.sbomify.com/CVE-2026-29140/): S/MIME Signature Additional Certificate (high 7.7)
- [CVE-2026-2914](https://insights.sbomify.com/CVE-2026-2914/): Privilege escalation in Endpoint Privilege Manager Agent (high 8.5)
- [CVE-2026-29139](https://insights.sbomify.com/CVE-2026-29139/): GINA State Confusion Account Takeover (high 7.8)
- [CVE-2026-29138](https://insights.sbomify.com/CVE-2026-29138/): PGP Decryption Sender LDAP Injection (medium 6.3)
- [CVE-2026-29137](https://insights.sbomify.com/CVE-2026-29137/): Long Subject Untagging (medium 5.3)
- [CVE-2026-29136](https://insights.sbomify.com/CVE-2026-29136/): CA Notification HTML Injection (medium 5.3)
- [CVE-2026-29135](https://insights.sbomify.com/CVE-2026-29135/): Webmail Password Tag Sanitization Bypass (medium 5.3)
- [CVE-2026-29134](https://insights.sbomify.com/CVE-2026-29134/): GINA Domain Switch (medium 5.3)
- [CVE-2026-29133](https://insights.sbomify.com/CVE-2026-29133/): UID Regex Bypass (medium 5.3)
- [CVE-2026-29132](https://insights.sbomify.com/CVE-2026-29132/): ESWmail-Verify Bypass (medium 6.3)
- [CVE-2026-29131](https://insights.sbomify.com/CVE-2026-29131/): PGP Decryption Recipient LDAP Injection (medium 4.9)
- [CVE-2026-2913](https://insights.sbomify.com/CVE-2026-2913/): libvips source.c vips_source_read_to_memory heap-based overflow (low 2.0)
- [CVE-2026-29129](https://insights.sbomify.com/CVE-2026-29129/): Apache Tomcat: TLS cipher order is not preserved (high 7.5)
- [CVE-2026-29128](https://insights.sbomify.com/CVE-2026-29128/): IDC SFX2100 Satellite Receiver bgpd/ospfd/ripd/zebra Config Credential Disclosure via World-Readable Files (high 8.6)
- [CVE-2026-29127](https://insights.sbomify.com/CVE-2026-29127/): Incorrect Permission Assignment(777) on `monitor` Users Home Directory Containing SUID Root Binaries in IDC SFX2100 (critical 9.2)
- [CVE-2026-29126](https://insights.sbomify.com/CVE-2026-29126/): World-Writable, Root Owned/Run `/etc/udhcpc/default.script` in IDC SFX2100 Satellite Receiver Leads To Potential LPE (high 8.5)
- [CVE-2026-29125](https://insights.sbomify.com/CVE-2026-29125/): Misconfiguration in SFX2100 Satellite Receiver (high 7.1)
- [CVE-2026-29124](https://insights.sbomify.com/CVE-2026-29124/): Multiple SUID Root Binaries in `monitor` User Home Directory Leading to Potential Local Privilege Escalation (high 8.6)
- [CVE-2026-29123](https://insights.sbomify.com/CVE-2026-29123/): Multiple SUID Root Binaries in `xd` User Home Directory Leading to Potential Local Privilege Escalation (high 8.6)
- [CVE-2026-29122](https://insights.sbomify.com/CVE-2026-29122/): `/bin/date` Binary given SETUID Permissions on IDC SFX2100 Leading to Potential LPE (high 8.3)
- [CVE-2026-29121](https://insights.sbomify.com/CVE-2026-29121/): `/sbin/ip` Binary given SETUID Permissions on IDC SFX2100 Leading to Potential LPE (high 8.3)
- [CVE-2026-29120](https://insights.sbomify.com/CVE-2026-29120/): Insecure, Hardcoded Root Password Stored in Anaconda Configuration File On IDC SFX2100 Satellite Receiver (critical 9.2)
- [CVE-2026-2912](https://insights.sbomify.com/CVE-2026-2912/): code-projects Online Reviewer System studentresult-view.php sql injection (medium 6.9)
- [CVE-2026-29119](https://insights.sbomify.com/CVE-2026-29119/): Hardcoded and Insecure Credentials for "Admin" Account providing Telnet Access on IDC SFX2100 Satellite Receiver (high 8.8)
- [CVE-2026-29116](https://insights.sbomify.com/CVE-2026-29116/): Denial of service in IPC/SD/NVR/XVR/EVS/VTO/VTH/ASI/TPC (high 8.7)
- [CVE-2026-29115](https://insights.sbomify.com/CVE-2026-29115/): Denial of service in IPC/SD (medium 6.9)
- [CVE-2026-29114](https://insights.sbomify.com/CVE-2026-29114/): Information disclosure in IPC (low 2.3)
- [CVE-2026-29113](https://insights.sbomify.com/CVE-2026-29113/): Craft has a potential information disclosure vulnerability in preview tokens (low 2.3)
- [CVE-2026-29112](https://insights.sbomify.com/CVE-2026-29112/): @dicebear/converter vulnerable to ncontrolled memory allocation via crafted SVG dimensions (high 7.5)
- [CVE-2026-29111](https://insights.sbomify.com/CVE-2026-29111/): systemd: Local unprivileged user can trigger an assert (medium 5.5)
- [CVE-2026-29110](https://insights.sbomify.com/CVE-2026-29110/): Cryptomator: Leaking of cleartext paths into log file in non-debug mode (low 2.2)
- [CVE-2026-2911](https://insights.sbomify.com/CVE-2026-2911/): Tenda FH451 GstDhcpSetSer buffer overflow (high 8.7)
- [CVE-2026-29109](https://insights.sbomify.com/CVE-2026-29109/): SuiteCRM Authenticated Remote Code Execution via Unsafe Deserialization in SavedSearch Filter Processing (high 8.6)
- [CVE-2026-29108](https://insights.sbomify.com/CVE-2026-29108/): Authenticated SuiteCRM Users Can Retrieve The Password Hash of Any User (medium 6.5)
- [CVE-2026-29107](https://insights.sbomify.com/CVE-2026-29107/): SuiteCRM vulnerable to authenticated SSRF via PDF export (medium 5.0)
- [CVE-2026-29106](https://insights.sbomify.com/CVE-2026-29106/): SuiteCRM has blind XSS in return_id parameter (medium 5.9)
- [CVE-2026-29105](https://insights.sbomify.com/CVE-2026-29105/): SuiteCRM has Unauthenticated Open Redirect in Leads WebToLead Capture (medium 5.4)
- [CVE-2026-29104](https://insights.sbomify.com/CVE-2026-29104/): SuiteCRM Vulnerable to Authenticated Arbitrary File Upload via Configurator addfontresult View in SuiteCRM (low 2.7)
- [CVE-2026-29103](https://insights.sbomify.com/CVE-2026-29103/): SuiteCRM Vulnerable to Remote Code Execution via Module Loader Package Scanner Bypass (critical 9.1)
- [CVE-2026-29102](https://insights.sbomify.com/CVE-2026-29102/): SuiteCRM has Authenticated RCE in Modules (high 7.2)
- [CVE-2026-29101](https://insights.sbomify.com/CVE-2026-29101/): SuiteCRM Vulnerable to Directory Traversal to DoS in Modules (medium 4.9)
- [CVE-2026-29100](https://insights.sbomify.com/CVE-2026-29100/): SuiteCRM has Reflected HTML Injection in Login Page via default_user_name Parameter (high 7.1)
- [CVE-2026-2910](https://insights.sbomify.com/CVE-2026-2910/): Tenda HG9 formPing6 stack-based overflow (high 8.7)
- [CVE-2026-29099](https://insights.sbomify.com/CVE-2026-29099/): SuiteCRM has Authenticated Blind SQL Injection in OutboundEmail Legacy Functionality. (high 8.8)
- [CVE-2026-29098](https://insights.sbomify.com/CVE-2026-29098/): SuiteCRM has Relative Path Traversal via ModuleBuilder Modules ExportCustom Action (medium 4.9)
- [CVE-2026-29097](https://insights.sbomify.com/CVE-2026-29097/): SuiteCRM Server-Side Request Forgery and Denial of Service via RSS Feed Dashlet (high 7.1)
- [CVE-2026-29096](https://insights.sbomify.com/CVE-2026-29096/): SuiteCRM vulnerable to Authenticated SQL Injection via unsanitized field_function in Report Fields (high 8.1)
- [CVE-2026-29093](https://insights.sbomify.com/CVE-2026-29093/): WWBN AVideo: Unauthenticated PHP session store exposed to host network via published memcached port (high 8.1)
- [CVE-2026-29092](https://insights.sbomify.com/CVE-2026-29092/): Kiteworks Email Protection Gateway has an Insufficient Session Expiration (medium 4.9)
- [CVE-2026-29091](https://insights.sbomify.com/CVE-2026-29091/): Locutus: Remote Code Execution (RCE) in locutus call_user_func_array due to Code Injection (high 8.1)
- [CVE-2026-29090](https://insights.sbomify.com/CVE-2026-29090/): Rucio SQL injection in postgres_meta DID search path compromises PostgreSQL metadata database (critical 9.0)
- [CVE-2026-2909](https://insights.sbomify.com/CVE-2026-2909/): Tenda HG9 Diagnostic Ping Endpoint formPing stack-based overflow (high 8.7)
- [CVE-2026-29089](https://insights.sbomify.com/CVE-2026-29089/): TimescaleDB uses untrusted search path during extension upgrade (high 8.8)
- [CVE-2026-29087](https://insights.sbomify.com/CVE-2026-29087/): @hono/node-server: Authorization bypass for protected static paths via encoded slashes in Serve Static Middleware (high 7.5)
- [CVE-2026-29086](https://insights.sbomify.com/CVE-2026-29086/): Hono: Cookie Attribute Injection via Unsanitized domain and path in setCookie() (medium 5.4)
- [CVE-2026-29085](https://insights.sbomify.com/CVE-2026-29085/): Hono: SSE Control Field Injection via CR/LF in writeSSE() (medium 6.5)
- [CVE-2026-29084](https://insights.sbomify.com/CVE-2026-29084/): Gokapi: CSRF in Login Endpoint (medium 4.6)
- [CVE-2026-29082](https://insights.sbomify.com/CVE-2026-29082/): Kestra: Stored Cross-Site Scripting in Markdown File Preview (high 7.3)
- [CVE-2026-29081](https://insights.sbomify.com/CVE-2026-29081/): Frappe: Possibility of SQL Injection due to improper fieldname sanitization (medium 6.5)
- [CVE-2026-29080](https://insights.sbomify.com/CVE-2026-29080/): Rucio SQL Injection in FilterEngine Oracle JSON Path via DID Search API (critical 9.4)
- [CVE-2026-2908](https://insights.sbomify.com/CVE-2026-2908/): Tenda HG9 Loopback Detection Configuration Endpoint formLoopBack stack-based overflow (high 8.7)
- [CVE-2026-29079](https://insights.sbomify.com/CVE-2026-29079/): Type Confusion in Lexbor Fragment Parser (high 8.2)
- [CVE-2026-29078](https://insights.sbomify.com/CVE-2026-29078/): Integer Underflow in Lexbor ISO‑2022‑JP Encoder (high 8.2)
- [CVE-2026-29077](https://insights.sbomify.com/CVE-2026-29077/): Frappe: Broken Access Control in DocShare (high 7.1)
- [CVE-2026-29076](https://insights.sbomify.com/CVE-2026-29076/): cpp-httplib: Stack Overflow Denial of Service (DoS) via std::regex in multipart filename parsing (medium 5.9)
- [CVE-2026-29075](https://insights.sbomify.com/CVE-2026-29075/): Mesa: Checking out of untrusted code in `benchmarks.yml` workflow may lead to code execution in privileged runner (high 8.3)
- [CVE-2026-29074](https://insights.sbomify.com/CVE-2026-29074/): SVGO: DoS through entity expansion in DOCTYPE (Billion Laughs) (high 7.5)
- [CVE-2026-29073](https://insights.sbomify.com/CVE-2026-29073/): SiYuan: Direct SQL Query API accessible to Reader-level users enables unauthorized database access (medium 5.7)
- [CVE-2026-29072](https://insights.sbomify.com/CVE-2026-29072/): Discourse missing permission check for policy creation in discourse-policy (high 8.2)
- [CVE-2026-29071](https://insights.sbomify.com/CVE-2026-29071/): Open WebUI's Insecure Direct Object Reference (IDOR) allows access to other users' memories (low 3.1)
- [CVE-2026-29070](https://insights.sbomify.com/CVE-2026-29070/): Open WebUI has unauthorized deletion of knowledge files (medium 5.4)
- [CVE-2026-2907](https://insights.sbomify.com/CVE-2026-2907/): Tenda HG9 GPON Configuration Endpoint formgponConf stack-based overflow (high 8.7)
- [CVE-2026-29069](https://insights.sbomify.com/CVE-2026-29069/): Craft has an unauthenticated activation email trigger with potential user enumeration (medium 6.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/739/