# Vulnerabilities published in 2026


- [CVE-2026-27892](https://insights.sbomify.com/CVE-2026-27892/): FacturaScripts: Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/Download (medium 6.5)
- [CVE-2026-27891](https://insights.sbomify.com/CVE-2026-27891/): Remote Code Execution (RCE) via Zip Slip in Plugin Upload Mechanism (high 7.2)
- [CVE-2026-27890](https://insights.sbomify.com/CVE-2026-27890/): Firebird has Pre-Auth DOS when Processing Out of Order CNCT_specific_data Segments (high 8.2)
- [CVE-2026-2789](https://insights.sbomify.com/CVE-2026-2789/): Use-after-free in the Graphics: ImageLib component (high 8.8)
- [CVE-2026-27889](https://insights.sbomify.com/CVE-2026-27889/): NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead (high 7.5)
- [CVE-2026-27888](https://insights.sbomify.com/CVE-2026-27888/): pypdf: Manipulated FlateDecode XFA streams can exhaust RAM (medium 6.6)
- [CVE-2026-27887](https://insights.sbomify.com/CVE-2026-27887/): Spin has memory leaks in various WIT interfaces (medium 6.9)
- [CVE-2026-27886](https://insights.sbomify.com/CVE-2026-27886/): Strapi may leak sensitive data via relational filtering due to lack of query sanitization (critical 9.2)
- [CVE-2026-27885](https://insights.sbomify.com/CVE-2026-27885/): Piwigo: SQL Injection in Activity.getList (high 7.2)
- [CVE-2026-27884](https://insights.sbomify.com/CVE-2026-27884/): NetExec vulnerable to arbitrary file write via path traversal in spider_plus module (medium 5.3)
- [CVE-2026-27883](https://insights.sbomify.com/CVE-2026-27883/): Coolify: IDOR in Deployment API - Cross-Team Deployment Information Disclosure (medium 5.0)
- [CVE-2026-27882](https://insights.sbomify.com/CVE-2026-27882/): Coolify: Timing Attack in GitLab Webhook Token Validation (medium 4.8)
- [CVE-2026-27881](https://insights.sbomify.com/CVE-2026-27881/): Coolify: Cross-team deployment information disclosure via GET /api/v1/deployments/{uuid} (IDOR) (medium 5.0)
- [CVE-2026-27880](https://insights.sbomify.com/CVE-2026-27880/): OpenFeature evaluation API reads input data with no bounds (high 7.5)
- [CVE-2026-2788](https://insights.sbomify.com/CVE-2026-2788/): Incorrect boundary conditions in the Audio/Video: GMP component (critical 9.8)
- [CVE-2026-27879](https://insights.sbomify.com/CVE-2026-27879/): Query resampling can cause unbounded memory allocations (medium 6.5)
- [CVE-2026-27878](https://insights.sbomify.com/CVE-2026-27878/): Tempo TraceQL query with exemplar hint could result in unbounded memory usage (medium 6.5)
- [CVE-2026-27877](https://insights.sbomify.com/CVE-2026-27877/): Public dashboards discloses all direct mode datasources (medium 6.5)
- [CVE-2026-27876](https://insights.sbomify.com/CVE-2026-27876/): RCE on Grafana via sqlExpressions (critical 9.1)
- [CVE-2026-27875](https://insights.sbomify.com/CVE-2026-27875/): Simplex Incident Manager Clear Test (medium 6.9)
- [CVE-2026-27874](https://insights.sbomify.com/CVE-2026-27874/): Hardcoded credentials in EasyIO FS32 (medium 5.0)
- [CVE-2026-27873](https://insights.sbomify.com/CVE-2026-27873/): Hardcoded credentials in EasyIO FG (medium 5.6)
- [CVE-2026-27872](https://insights.sbomify.com/CVE-2026-27872/): EasyIO FG (medium 5.6)
- [CVE-2026-27871](https://insights.sbomify.com/CVE-2026-27871/): TL280 (low 2.9)
- [CVE-2026-27870](https://insights.sbomify.com/CVE-2026-27870/): CROSS-SITE SCRIPTING (XSS) VIA MALICIOUS FILE UPLOAD ON REGESTA SMART HD-PLC OF TELDAT (medium 4.8)
- [CVE-2026-2787](https://insights.sbomify.com/CVE-2026-2787/): Use-after-free in the DOM: Window and Location component (high 8.8)
- [CVE-2026-27869](https://insights.sbomify.com/CVE-2026-27869/): WEB SERVICE (HTTP) DENIAL OF SERVICE VIA SLOW HEADERS ON REGESTA SMART HD-PLC OF TELDAT (medium 6.9)
- [CVE-2026-27868](https://insights.sbomify.com/CVE-2026-27868/): PUBLICATION OF SENSITIVE INFORMATION ON REGESTA SMART HD-PLC OF TELDAT (medium 6.9)
- [CVE-2026-27867](https://insights.sbomify.com/CVE-2026-27867/): CROSS-SITE SCRIPTING (XSS) VIA THE CMDCOOKIE PARAMETER REGESTA SMART HD-PLC OF TELDAT (medium 4.8)
- [CVE-2026-27860](https://insights.sbomify.com/CVE-2026-27860/): Other in OX Dovecot Pro (low 3.7)
- [CVE-2026-2786](https://insights.sbomify.com/CVE-2026-2786/): Use-after-free in the JavaScript Engine component (high 8.8)
- [CVE-2026-27859](https://insights.sbomify.com/CVE-2026-27859/): Denial of service in OX Dovecot Pro (medium 5.3)
- [CVE-2026-27858](https://insights.sbomify.com/CVE-2026-27858/): Denial of service in OX Dovecot Pro (high 7.5)
- [CVE-2026-27857](https://insights.sbomify.com/CVE-2026-27857/): Denial of service in OX Dovecot Pro (medium 4.3)
- [CVE-2026-27856](https://insights.sbomify.com/CVE-2026-27856/): Weak cryptography in OX Dovecot Pro (high 7.4)
- [CVE-2026-27855](https://insights.sbomify.com/CVE-2026-27855/): Auth bypass in OX Dovecot Pro (medium 6.8)
- [CVE-2026-27854](https://insights.sbomify.com/CVE-2026-27854/): Use after free when parsing EDNS options in Lua (medium 4.8)
- [CVE-2026-27853](https://insights.sbomify.com/CVE-2026-27853/): Out-of-bounds write when rewriting large DNS packets (medium 5.9)
- [CVE-2026-27852](https://insights.sbomify.com/CVE-2026-27852/): Denial of service in OX Dovecot CE (high 7.5)
- [CVE-2026-27851](https://insights.sbomify.com/CVE-2026-27851/): SQL injection in OX Dovecot Pro (high 7.4)
- [CVE-2026-27850](https://insights.sbomify.com/CVE-2026-27850/): Improper verification in Linksys MR9600, Linksys MX4200 (high 7.5)
- [CVE-2026-2785](https://insights.sbomify.com/CVE-2026-2785/): Invalid pointer in the JavaScript Engine component (high 8.8)
- [CVE-2026-27849](https://insights.sbomify.com/CVE-2026-27849/): Missing neutralization in Linksys MR9600, Linksys MX4200 (critical 9.8)
- [CVE-2026-27848](https://insights.sbomify.com/CVE-2026-27848/): Missing neutralization in Linksys MR9600, Linksys MX4200 (critical 9.8)
- [CVE-2026-27847](https://insights.sbomify.com/CVE-2026-27847/): Missing authentication in Linksys MR9600, Linksys MX4200 (critical 9.8)
- [CVE-2026-27846](https://insights.sbomify.com/CVE-2026-27846/): Missing authentication in Linksys MR9600, Linksys MX4200 (medium 6.2)
- [CVE-2026-27844](https://insights.sbomify.com/CVE-2026-27844/): Denial of service in Controller 7000 and 6000 (low 2.7)
- [CVE-2026-27843](https://insights.sbomify.com/CVE-2026-27843/): SenseLive X3050 Missing authentication for critical function (critical 9.2)
- [CVE-2026-27842](https://insights.sbomify.com/CVE-2026-27842/): Auth bypass in MR-GM5A-L1 (critical 9.3)
- [CVE-2026-27841](https://insights.sbomify.com/CVE-2026-27841/): SenseLive X3050 Cross-Site request forgery (high 8.4)
- [CVE-2026-27840](https://insights.sbomify.com/CVE-2026-27840/): ZITADEL's truncated opaque tokens are still valid (medium 4.3)
- [CVE-2026-2784](https://insights.sbomify.com/CVE-2026-2784/): Mitigation bypass in the DOM: Security component (critical 9.8)
- [CVE-2026-27839](https://insights.sbomify.com/CVE-2026-27839/): wger: IDOR in nutritional_values endpoints exposes private dietary data via direct ORM lookup (medium 4.3)
- [CVE-2026-27838](https://insights.sbomify.com/CVE-2026-27838/): wger: IDOR via user-unscoped cache keys on routine API actions exposes workout data (low 3.1)
- [CVE-2026-27837](https://insights.sbomify.com/CVE-2026-27837/): Dottie vulnerable to prototype pollution bypass via non-first path segments in set() and transform() (medium 6.3)
- [CVE-2026-27836](https://insights.sbomify.com/CVE-2026-27836/): phpMyFAQ Allows Unauthenticated Account Creation via WebAuthn Prepare Endpoint (high 7.5)
- [CVE-2026-27835](https://insights.sbomify.com/CVE-2026-27835/): wger: IDOR in RepetitionsConfig and MaxRepetitionsConfig API leak other users' workout data (medium 4.3)
- [CVE-2026-27834](https://insights.sbomify.com/CVE-2026-27834/): Piwigo: SQL Injection in pwg.users.getList API Method via filter Parameter (high 7.2)
- [CVE-2026-27833](https://insights.sbomify.com/CVE-2026-27833/): Piwigo: Unauthenticated Information Disclosure via pwg.history.search API (high 7.5)
- [CVE-2026-27832](https://insights.sbomify.com/CVE-2026-27832/): Group-Office Has Authenticated SQL Injection in advancedQueryData.comparator (high 7.1)
- [CVE-2026-27831](https://insights.sbomify.com/CVE-2026-27831/): rldns Vulnerable to Heap-based Out-of-Bounds Read (high 7.5)
- [CVE-2026-27830](https://insights.sbomify.com/CVE-2026-27830/): c3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString property (high 8.9)
- [CVE-2026-2783](https://insights.sbomify.com/CVE-2026-2783/): Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component (medium 6.5)
- [CVE-2026-27829](https://insights.sbomify.com/CVE-2026-27829/): Astro is vulnerable to SSRF due to missing allowlist enforcement in remote image inferSize (medium 6.5)
- [CVE-2026-27828](https://insights.sbomify.com/CVE-2026-27828/): EVerest: ISO15118 session_setup use-after-free can crash EVSE process (medium 5.5)
- [CVE-2026-27826](https://insights.sbomify.com/CVE-2026-27826/): MCP Atlassian has SSRF via unvalidated X-Atlassian-Jira-Url / X-Atlassian-Confluence-Url headers (high 8.2)
- [CVE-2026-27825](https://insights.sbomify.com/CVE-2026-27825/): MCP Atlassian has an arbitrary file write leading to arbitrary code execution via unconstrained download_path in confluence_download_attachment (critical 9.1)
- [CVE-2026-27824](https://insights.sbomify.com/CVE-2026-27824/): calibre has IP Ban Bypass via X-Forwarded-For Header Spoofing (medium 5.3)
- [CVE-2026-27823](https://insights.sbomify.com/CVE-2026-27823/): Remote Code Execution Vulnerability in EGroupware (high 8.7)
- [CVE-2026-27822](https://insights.sbomify.com/CVE-2026-27822/): Rust has Critical Stored XSS in Preview Modal, leading to Administrative Account Takeover (critical 9.1)
- [CVE-2026-27821](https://insights.sbomify.com/CVE-2026-27821/): GPAC NHML Demuxer (dmx_nhml.c) Vulnerable to Stack Buffer Overflow (high 7.7)
- [CVE-2026-27820](https://insights.sbomify.com/CVE-2026-27820/): zlib: Buffer Overflow in Zlib::GzipReader ungetc via large input leads to memory corruption (low 1.7)
- [CVE-2026-2782](https://insights.sbomify.com/CVE-2026-2782/): Privilege escalation in the Netmonitor component (high 8.8)
- [CVE-2026-27819](https://insights.sbomify.com/CVE-2026-27819/): Vikunja has Path Traversal in CLI Restore (high 7.2)
- [CVE-2026-27818](https://insights.sbomify.com/CVE-2026-27818/): TerriaJS-Server has a domain validation bypass vulnerability in its proxy allowlist (high 8.7)
- [CVE-2026-27816](https://insights.sbomify.com/CVE-2026-27816/): EVerest's ISO15118 update_energy_transfer_modes overflow can corrupt EVSE state (medium 5.5)
- [CVE-2026-27815](https://insights.sbomify.com/CVE-2026-27815/): EVerest: ISO15118 session_setup payment options overflow can corrupt EVSE state (medium 5.5)
- [CVE-2026-27814](https://insights.sbomify.com/CVE-2026-27814/): EVerest EvseManager phase-switch path has unsynchronized shared-state access race condition (medium 4.2)
- [CVE-2026-27813](https://insights.sbomify.com/CVE-2026-27813/): EVerest has use-after-free in auth timeout timer via race condition (medium 5.3)
- [CVE-2026-27812](https://insights.sbomify.com/CVE-2026-27812/): Sub2API Vulnerable to Password Reset Poisoning via Host Header Trust Issue, Leading to Account Takeover (high 8.0)
- [CVE-2026-27811](https://insights.sbomify.com/CVE-2026-27811/): Roxy-WI has a Command Injection via diff parameter in config comparison allows authenticated RCE (high 8.8)
- [CVE-2026-27810](https://insights.sbomify.com/CVE-2026-27810/): calibre Vulnerable to HTTP Response Header Injection (medium 6.4)
- [CVE-2026-2781](https://insights.sbomify.com/CVE-2026-2781/): Integer overflow in the Libraries component in NSS (high 8.8)
- [CVE-2026-27809](https://insights.sbomify.com/CVE-2026-27809/): psd-tools: Compression module has unguarded zlib decompression, missing dimension validation, and hardening gaps (medium 6.8)
- [CVE-2026-27808](https://insights.sbomify.com/CVE-2026-27808/): Mailpit is Vulnerable to Server-Side Request Forgery (SSRF) via Link Check API (medium 5.8)
- [CVE-2026-27807](https://insights.sbomify.com/CVE-2026-27807/): MarkUs: YAML alias (‘billion laughs’) DoS in config upload (medium 4.9)
- [CVE-2026-27806](https://insights.sbomify.com/CVE-2026-27806/): Fleet Affected by Local Privilege Escalation via Tcl Command Injection in Orbit (high 7.8)
- [CVE-2026-27804](https://insights.sbomify.com/CVE-2026-27804/): Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter (critical 9.3)
- [CVE-2026-27803](https://insights.sbomify.com/CVE-2026-27803/): Vaultwarden: Collection Management Operations Allowed Without `manage` Verification for Manager Role (high 8.3)
- [CVE-2026-27802](https://insights.sbomify.com/CVE-2026-27802/): Vaultwarden: Privilege Escalation via Bulk Permission Update to Unauthorized Collections by Manager (high 8.3)
- [CVE-2026-27801](https://insights.sbomify.com/CVE-2026-27801/): Vaultwarden: 2FA Bypass on Protected Actions due to Faulty Rate Limit Enforcement (medium 6.0)
- [CVE-2026-27800](https://insights.sbomify.com/CVE-2026-27800/): Zed has Zip Slip Path Traversal in Extension Archive Extraction (high 7.4)
- [CVE-2026-2780](https://insights.sbomify.com/CVE-2026-2780/): Privilege escalation in the Netmonitor component (high 8.8)
- [CVE-2026-27799](https://insights.sbomify.com/CVE-2026-27799/): ImageMagick has a heap Buffer Over-read in its DJVU image format handler (medium 4.0)
- [CVE-2026-27798](https://insights.sbomify.com/CVE-2026-27798/): ImageMagick: Heap Buffer Over-read in WaveletDenoise when processing small images (medium 4.0)
- [CVE-2026-27797](https://insights.sbomify.com/CVE-2026-27797/): Homarr: Unauthenticated SSRF in rssFeed.ts (medium 5.3)
- [CVE-2026-27796](https://insights.sbomify.com/CVE-2026-27796/): Homarr: Unauthenticated Information Disclosure (Integration Metadata Leak) (medium 5.3)
- [CVE-2026-27795](https://insights.sbomify.com/CVE-2026-27795/): LangChain Community: redirect chaining can lead to SSRF bypass via RecursiveUrlLoader (medium 4.1)
- [CVE-2026-27794](https://insights.sbomify.com/CVE-2026-27794/): LangGraph: BaseCache Deserialization of Untrusted Data may lead to Remote Code Execution (medium 6.6)
- [CVE-2026-27793](https://insights.sbomify.com/CVE-2026-27793/): Seerr has Broken Object-Level Authorization in User Profile Endpoint that Exposes Third-Party Notification Credentials (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/751/