# Vulnerabilities published in 2026


- [CVE-2026-29068](https://insights.sbomify.com/CVE-2026-29068/): PJSIP: Stack buffer overflow in Opus codec parser (high 8.7)
- [CVE-2026-29067](https://insights.sbomify.com/CVE-2026-29067/): ZITADEL: Account Takeover Due to Improper Instance Validation in V2 Login (high 8.1)
- [CVE-2026-29066](https://insights.sbomify.com/CVE-2026-29066/): Arbitrary File Read via Disabled Vite Filesystem Restriction in TinaCMS CLI (medium 6.2)
- [CVE-2026-29065](https://insights.sbomify.com/CVE-2026-29065/): changedetection.io: Zip Slip vulnerability in the backup restore functionality (high 8.8)
- [CVE-2026-29064](https://insights.sbomify.com/CVE-2026-29064/): Zarf: Symlink targets in archives are not validated against destination directory (high 8.2)
- [CVE-2026-29063](https://insights.sbomify.com/CVE-2026-29063/): Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable (high 8.7)
- [CVE-2026-29062](https://insights.sbomify.com/CVE-2026-29062/): jackson-core: Nesting Depth Constraint Bypass in `UTF8DataInputJsonParser` potentially allowing Resource Exhaustion (high 8.7)
- [CVE-2026-29061](https://insights.sbomify.com/CVE-2026-29061/): Gokapi: Privilege escalation via incomplete API-key permission revocation on user rank demotion (medium 5.4)
- [CVE-2026-29060](https://insights.sbomify.com/CVE-2026-29060/): Gokapi: Privilege escalation with auth token (medium 5.0)
- [CVE-2026-2906](https://insights.sbomify.com/CVE-2026-2906/): Tenda HG9 Samba Configuration Endpoint formSamba stack-based overflow (high 8.7)
- [CVE-2026-29059](https://insights.sbomify.com/CVE-2026-29059/): Windmill: SUPERADMIN_SECRET (rarely used) can be accessed publicly (medium 6.9)
- [CVE-2026-29058](https://insights.sbomify.com/CVE-2026-29058/): AVideo: Unauthenticated OS Command Injection via base64Url in objects/getImage.php (critical 9.8)
- [CVE-2026-29057](https://insights.sbomify.com/CVE-2026-29057/): Next.js: HTTP request smuggling in rewrites (medium 6.3)
- [CVE-2026-29056](https://insights.sbomify.com/CVE-2026-29056/): Kanboard's privilege escalation via mass assignment in user invite registration allows any invited user to become admin (high 7.0)
- [CVE-2026-29055](https://insights.sbomify.com/CVE-2026-29055/): Tandoor Recipes: WebP and GIF Image Uploads Bypass EXIF/Metadata Stripping, Leaking GPS Coordinates and PII (medium 5.3)
- [CVE-2026-29054](https://insights.sbomify.com/CVE-2026-29054/): Traefik: lowercase `Connection` tokens can delete traefik-managed forwarded identity headers (for example, `X-Real-Ip`) (high 7.5)
- [CVE-2026-29053](https://insights.sbomify.com/CVE-2026-29053/): Ghost Vulnerable to Remote Code Execution via Malicious Themes (high 7.7)
- [CVE-2026-29052](https://insights.sbomify.com/CVE-2026-29052/): HumHub Calendar Module: Stored XSS in Event Types (medium 6.9)
- [CVE-2026-29051](https://insights.sbomify.com/CVE-2026-29051/): melange has Path Traversal via .PKGINFO in --persist-lint-results (medium 4.4)
- [CVE-2026-29050](https://insights.sbomify.com/CVE-2026-29050/): melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses (medium 6.1)
- [CVE-2026-2905](https://insights.sbomify.com/CVE-2026-2905/): Tenda HG9 Wireless Configuration Endpoint formWlanSetup stack-based overflow (high 8.7)
- [CVE-2026-29049](https://insights.sbomify.com/CVE-2026-29049/): melange: unbounded HTTP download in `melange update-cache` can exhaust disk in CI (medium 4.3)
- [CVE-2026-29048](https://insights.sbomify.com/CVE-2026-29048/): HumHub: XSS in Button component (medium 6.9)
- [CVE-2026-29047](https://insights.sbomify.com/CVE-2026-29047/): GLPI has an Authenticated SQL Injection via log exports (high 7.2)
- [CVE-2026-29046](https://insights.sbomify.com/CVE-2026-29046/): TinyWeb: HTTP Header Control Character Injection into CGI Environment (critical 9.2)
- [CVE-2026-29045](https://insights.sbomify.com/CVE-2026-29045/): Hono: Arbitrary file access via serveStatic vulnerability (high 7.5)
- [CVE-2026-29044](https://insights.sbomify.com/CVE-2026-29044/): EVerest: Charging Continues When WithdrawAuthorization Is Processed Before TransactionStarted (medium 5.0)
- [CVE-2026-29043](https://insights.sbomify.com/CVE-2026-29043/): HDF5 H5T__ref_mem_setnull Heap Buffer Overflow (medium 5.5)
- [CVE-2026-29042](https://insights.sbomify.com/CVE-2026-29042/): Nuclio Shell Runtime Command Injection Leading to Privilege Escalation (high 8.9)
- [CVE-2026-29041](https://insights.sbomify.com/CVE-2026-29041/): Chamilo: Authenticated Remote Code Execution via Unrestricted File Upload (high 8.8)
- [CVE-2026-2904](https://insights.sbomify.com/CVE-2026-2904/): UTT HiPER 810G ConfigExceptAli strcpy buffer overflow (high 8.7)
- [CVE-2026-29039](https://insights.sbomify.com/CVE-2026-29039/): changedetection.io: XPath - Arbitrary File Read via unparsed-text() (high 8.8)
- [CVE-2026-29038](https://insights.sbomify.com/CVE-2026-29038/): changedetection.io: Reflected XSS in RSS Tag Error Response (medium 6.1)
- [CVE-2026-29036](https://insights.sbomify.com/CVE-2026-29036/): cJSON 1.7.19 Wrong-Key Modification via JSON Pointer Escape Decoding (high 8.7)
- [CVE-2026-29035](https://insights.sbomify.com/CVE-2026-29035/): CivetWeb Heap/Stack Buffer Overflow via WebSocket permessage-deflate Decompression (high 8.3)
- [CVE-2026-2903](https://insights.sbomify.com/CVE-2026-2903/): skvadrik re2c ast.cc check_and_merge_special_rules null pointer dereference (medium 4.8)
- [CVE-2026-29023](https://insights.sbomify.com/CVE-2026-29023/): Keygraph Shannon Hard-coded Router API Key (medium 6.9)
- [CVE-2026-29022](https://insights.sbomify.com/CVE-2026-29022/): mackron / dr_libs dr_wav.h Heap Buffer Overflow via WAV File (medium 6.8)
- [CVE-2026-2902](https://insights.sbomify.com/CVE-2026-2902/): WP Meteor Website Speed Optimization Addon <= 3.4.16 - Unauthenticated Stored Cross-Site Scripting via Comment (medium 6.1)
- [CVE-2026-29014](https://insights.sbomify.com/CVE-2026-29014/): MetInfo CMS Unauthenticated PHP Code Injection RCE (critical 9.3)
- [CVE-2026-29013](https://insights.sbomify.com/CVE-2026-29013/): libcoap Out-of-Bounds Read in OSCORE CBOR Unwrap Handling (high 8.8)
- [CVE-2026-29009](https://insights.sbomify.com/CVE-2026-29009/): U-Boot < 2026.07-rc2 Buffer Overflow in nfs_readlink_reply() via NFS READLINK (high 8.8)
- [CVE-2026-29008](https://insights.sbomify.com/CVE-2026-29008/): U-Boot 2026.04-rc3 Integer Underflow DoS via tcp_rx_state_machine() (high 8.7)
- [CVE-2026-29007](https://insights.sbomify.com/CVE-2026-29007/): U-Boot 2026.04-rc3 Out-of-Bounds Read in tcp_rx_state_machine via tcp.c (medium 6.9)
- [CVE-2026-29004](https://insights.sbomify.com/CVE-2026-29004/): BusyBox DHCPv6 Client Heap Buffer Overflow via DNS_SERVERS (high 7.2)
- [CVE-2026-29002](https://insights.sbomify.com/CVE-2026-29002/): CouchCMS Privilege Escalation via f_k_levels_list Parameter (high 8.6)
- [CVE-2026-29001](https://insights.sbomify.com/CVE-2026-29001/): TastyIgniter 4.4.5 PHP Object Injection via Settings Deserialization (high 8.6)
- [CVE-2026-29000](https://insights.sbomify.com/CVE-2026-29000/): pac4j-jwt JwtAuthenticator Authentication Bypass (critical 9.3)
- [CVE-2026-2900](https://insights.sbomify.com/CVE-2026-2900/): Missing Authorization in GitLab (low 2.7)
- [CVE-2026-28996](https://insights.sbomify.com/CVE-2026-28996/): Race condition in iOS and iPadOS (medium 5.5)
- [CVE-2026-28995](https://insights.sbomify.com/CVE-2026-28995/): Privilege escalation in iOS and iPadOS (high 8.8)
- [CVE-2026-28994](https://insights.sbomify.com/CVE-2026-28994/): Use after free in iOS and iPadOS (medium 5.3)
- [CVE-2026-28993](https://insights.sbomify.com/CVE-2026-28993/): Security feature bypass in iOS and iPadOS (medium 5.5)
- [CVE-2026-28992](https://insights.sbomify.com/CVE-2026-28992/): Race condition in iOS and iPadOS (medium 4.7)
- [CVE-2026-28991](https://insights.sbomify.com/CVE-2026-28991/): Memory corruption in iOS and iPadOS (high 7.5)
- [CVE-2026-28990](https://insights.sbomify.com/CVE-2026-28990/): Memory corruption in iOS and iPadOS (high 7.5)
- [CVE-2026-2899](https://insights.sbomify.com/CVE-2026-2899/): Fluent Forms Pro Add On Pack <= 6.1.17 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion (medium 6.5)
- [CVE-2026-28988](https://insights.sbomify.com/CVE-2026-28988/): Security feature bypass in iOS and iPadOS (medium 5.5)
- [CVE-2026-28987](https://insights.sbomify.com/CVE-2026-28987/): Information disclosure in iOS and iPadOS (high 7.5)
- [CVE-2026-28986](https://insights.sbomify.com/CVE-2026-28986/): Race condition in iOS and iPadOS (high 7.5)
- [CVE-2026-28985](https://insights.sbomify.com/CVE-2026-28985/): Null dereference in iOS and iPadOS (medium 6.2)
- [CVE-2026-28984](https://insights.sbomify.com/CVE-2026-28984/): Use after free in Safari (medium 4.3)
- [CVE-2026-28983](https://insights.sbomify.com/CVE-2026-28983/): Memory corruption in iOS and iPadOS (high 7.5)
- [CVE-2026-28982](https://insights.sbomify.com/CVE-2026-28982/): Race condition in macOS (critical 9.8)
- [CVE-2026-28981](https://insights.sbomify.com/CVE-2026-28981/): Memory corruption in macOS (high 7.8)
- [CVE-2026-2898](https://insights.sbomify.com/CVE-2026-2898/): funadmin Backend Endpoint AuthCloudService.php getMember deserialization (medium 5.1)
- [CVE-2026-28979](https://insights.sbomify.com/CVE-2026-28979/): Memory corruption in Safari (medium 6.5)
- [CVE-2026-28978](https://insights.sbomify.com/CVE-2026-28978/): Security feature bypass in macOS (high 8.8)
- [CVE-2026-28977](https://insights.sbomify.com/CVE-2026-28977/): Memory corruption in iOS and iPadOS (medium 6.2)
- [CVE-2026-28976](https://insights.sbomify.com/CVE-2026-28976/): Privilege escalation in macOS (high 7.5)
- [CVE-2026-28974](https://insights.sbomify.com/CVE-2026-28974/): Missing authorization in iOS and iPadOS (high 7.5)
- [CVE-2026-28973](https://insights.sbomify.com/CVE-2026-28973/): Integer overflow in iOS and iPadOS (high 8.6)
- [CVE-2026-28972](https://insights.sbomify.com/CVE-2026-28972/): Memory corruption in iOS and iPadOS (medium 6.5)
- [CVE-2026-28971](https://insights.sbomify.com/CVE-2026-28971/): Security feature bypass in Safari (medium 4.3)
- [CVE-2026-2897](https://insights.sbomify.com/CVE-2026-2897/): funadmin Backend index.html cross site scripting (medium 4.8)
- [CVE-2026-28969](https://insights.sbomify.com/CVE-2026-28969/): Use after free in iOS and iPadOS (high 7.5)
- [CVE-2026-28968](https://insights.sbomify.com/CVE-2026-28968/): Memory corruption in iOS and iPadOS (medium 5.5)
- [CVE-2026-28967](https://insights.sbomify.com/CVE-2026-28967/): Denial of service in iOS and iPadOS (medium 4.9)
- [CVE-2026-28966](https://insights.sbomify.com/CVE-2026-28966/): Memory corruption in iOS and iPadOS (medium 4.3)
- [CVE-2026-28965](https://insights.sbomify.com/CVE-2026-28965/): Security feature bypass in iOS and iPadOS (high 7.5)
- [CVE-2026-28964](https://insights.sbomify.com/CVE-2026-28964/): Other in iOS and iPadOS (high 7.5)
- [CVE-2026-28963](https://insights.sbomify.com/CVE-2026-28963/): Information disclosure in iOS and iPadOS (medium 4.6)
- [CVE-2026-28962](https://insights.sbomify.com/CVE-2026-28962/): Information disclosure in Safari (high 7.5)
- [CVE-2026-28961](https://insights.sbomify.com/CVE-2026-28961/): Information disclosure in macOS (medium 4.6)
- [CVE-2026-28960](https://insights.sbomify.com/CVE-2026-28960/): Denial of service in iOS and iPadOS (high 7.5)
- [CVE-2026-2896](https://insights.sbomify.com/CVE-2026-2896/): funadmin Configuration Ajax.php setConfig improper authorization (medium 6.9)
- [CVE-2026-28959](https://insights.sbomify.com/CVE-2026-28959/): Memory corruption in iOS and iPadOS (high 7.5)
- [CVE-2026-28958](https://insights.sbomify.com/CVE-2026-28958/): Information disclosure in Safari (medium 5.5)
- [CVE-2026-28957](https://insights.sbomify.com/CVE-2026-28957/): Missing authorization in iOS and iPadOS (low 3.3)
- [CVE-2026-28956](https://insights.sbomify.com/CVE-2026-28956/): Memory corruption in iOS and iPadOS (medium 6.5)
- [CVE-2026-28955](https://insights.sbomify.com/CVE-2026-28955/): Memory corruption in Safari (high 8.8)
- [CVE-2026-28954](https://insights.sbomify.com/CVE-2026-28954/): Security feature bypass in iOS and iPadOS (high 7.5)
- [CVE-2026-28953](https://insights.sbomify.com/CVE-2026-28953/): Memory corruption in Safari (high 7.5)
- [CVE-2026-28952](https://insights.sbomify.com/CVE-2026-28952/): Integer overflow in iOS and iPadOS (high 7.5)
- [CVE-2026-28951](https://insights.sbomify.com/CVE-2026-28951/): Privilege escalation in iOS and iPadOS (high 7.8)
- [CVE-2026-28950](https://insights.sbomify.com/CVE-2026-28950/): Information disclosure in iOS and iPadOS (medium 6.2)
- [CVE-2026-2895](https://insights.sbomify.com/CVE-2026-2895/): funadmin Member.php repass password recovery (medium 6.3)
- [CVE-2026-28947](https://insights.sbomify.com/CVE-2026-28947/): Use after free in Safari (high 8.8)
- [CVE-2026-28946](https://insights.sbomify.com/CVE-2026-28946/): Use after free in Safari (medium 6.5)
- [CVE-2026-28945](https://insights.sbomify.com/CVE-2026-28945/): Security feature bypass in macOS (high 7.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/740/