# Vulnerabilities published in 2026


- [CVE-2026-26007](https://insights.sbomify.com/CVE-2026-26007/): cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves (high 8.2)
- [CVE-2026-26006](https://insights.sbomify.com/CVE-2026-26006/): Redos (Regular Expression Denial of Service) at Code Extraction Block in significant-gravitas/autogpt (medium 6.5)
- [CVE-2026-26005](https://insights.sbomify.com/CVE-2026-26005/): ClipBucket v5 enables internal network scans via an SSRF vulnerability (medium 5.0)
- [CVE-2026-26004](https://insights.sbomify.com/CVE-2026-26004/): Sentry allows unauthorized access to event data across organizational boundaries (medium 5.7)
- [CVE-2026-26003](https://insights.sbomify.com/CVE-2026-26003/): FastGPT Plugin forwarding request is not authenticated, posing a serious risk of attack (medium 6.9)
- [CVE-2026-26002](https://insights.sbomify.com/CVE-2026-26002/): OnDemand susceptible to malicious input when navigating to a directory. (medium 6.3)
- [CVE-2026-26001](https://insights.sbomify.com/CVE-2026-26001/): GLPI Inventory Plugin has SQL Injection on dropdown_calendar Report (high 7.1)
- [CVE-2026-26000](https://insights.sbomify.com/CVE-2026-26000/): XWiki Platform affected by click-jacking through CSS injection in comments (medium 5.3)
- [CVE-2026-2600](https://insights.sbomify.com/CVE-2026-2600/): Cross-site scripting in ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor (medium 6.4)
- [CVE-2026-25999](https://insights.sbomify.com/CVE-2026-25999/): Klaw has an improper authorisation check on /resetMemoryCache (high 7.1)
- [CVE-2026-25998](https://insights.sbomify.com/CVE-2026-25998/): strongMan vulnerable to private credential recovery due to key and counter reuse (high 8.7)
- [CVE-2026-25997](https://insights.sbomify.com/CVE-2026-25997/): FreeRDP has heap-use-after-free in xf_clipboard_format_equal (medium 5.5)
- [CVE-2026-25996](https://insights.sbomify.com/CVE-2026-25996/): Inspektor Gadget uses unsanitized ANSI Escape Sequences In `columns` Output Mode (medium 6.9)
- [CVE-2026-25994](https://insights.sbomify.com/CVE-2026-25994/): PJSIP has a heap buffer overflow in ICE with long username (high 8.1)
- [CVE-2026-25993](https://insights.sbomify.com/CVE-2026-25993/): EverShop has a Second-Order SQL Injection in URL Rewrite Processing Derived from Category URL Keys (critical 9.3)
- [CVE-2026-25992](https://insights.sbomify.com/CVE-2026-25992/): SiYuan has a File Read Interface Case Bypass Vulnerability (high 7.5)
- [CVE-2026-25991](https://insights.sbomify.com/CVE-2026-25991/): Tandoor Recipes affected by Blind SSRF with Internal Network Access via Recipe Import (high 7.7)
- [CVE-2026-25990](https://insights.sbomify.com/CVE-2026-25990/): Pillow has an out-of-bounds write when loading PSD images (high 8.6)
- [CVE-2026-2599](https://insights.sbomify.com/CVE-2026-2599/): Deserialization in Database for Contact Form 7, WPforms, Elementor forms (critical 9.8)
- [CVE-2026-25989](https://insights.sbomify.com/CVE-2026-25989/): ImageMagick: Integer overflow or wraparound and incorrect conversion between numeric types in the internal SVG decoder (high 7.5)
- [CVE-2026-25988](https://insights.sbomify.com/CVE-2026-25988/): ImageMagick's MSL image stack index not refreshed, leading to leaked images. (medium 5.3)
- [CVE-2026-25987](https://insights.sbomify.com/CVE-2026-25987/): ImageMagick has heap buffer over-read in MAP image decoder (medium 5.3)
- [CVE-2026-25986](https://insights.sbomify.com/CVE-2026-25986/): ImageMagick has a heap buffer overflow in YUV 4:2:2 decoder (medium 5.3)
- [CVE-2026-25985](https://insights.sbomify.com/CVE-2026-25985/): Memory allocation with excessive without limits in the internal SVG decoder (high 7.5)
- [CVE-2026-25983](https://insights.sbomify.com/CVE-2026-25983/): ImageMagick has Use After Free in MSLStartElement in "coders/msl.c" (medium 5.3)
- [CVE-2026-25982](https://insights.sbomify.com/CVE-2026-25982/): ImageMagick Has Heap Out-of-Bounds Read in DCM Decoder (ReadDCMImage) (medium 6.5)
- [CVE-2026-25972](https://insights.sbomify.com/CVE-2026-25972/): Cross-site scripting in FortiSIEM (medium 4.1)
- [CVE-2026-25971](https://insights.sbomify.com/CVE-2026-25971/): ImageMagick's MSL: Stack overflow in ProcessMSLScript (medium 6.2)
- [CVE-2026-25970](https://insights.sbomify.com/CVE-2026-25970/): ImageMagick SIXEL Decoder Has Signed Integer Overflow, Leading to Memory Corruption (medium 5.3)
- [CVE-2026-2597](https://insights.sbomify.com/CVE-2026-2597/): Memory corruption in Crypt::SysRandom::XS (high 7.5)
- [CVE-2026-25969](https://insights.sbomify.com/CVE-2026-25969/): ImageMagick has Memory Leak in coders/ashlar.c (medium 5.3)
- [CVE-2026-25968](https://insights.sbomify.com/CVE-2026-25968/): ImageMagick has MSL attribute stack buffer overflow that leads to out of bounds write. (high 7.4)
- [CVE-2026-25967](https://insights.sbomify.com/CVE-2026-25967/): ImageMagick has stack buffer overflow in FTXT reader via oversized integer field (high 7.4)
- [CVE-2026-25966](https://insights.sbomify.com/CVE-2026-25966/): ImageMagick's Security Policy Bypass through config/policy-secure.xml via "fd handler" leads to stdin/stdout access (medium 5.9)
- [CVE-2026-25965](https://insights.sbomify.com/CVE-2026-25965/): ImageMagick's policy bypass through path traversal allows reading restricted content despite secured policy (high 8.6)
- [CVE-2026-25964](https://insights.sbomify.com/CVE-2026-25964/): Tandoor Recipes Affected by Authenticated Local File Disclosure (LFD) via Recipe Import leads to Arbitrary File Read (medium 4.9)
- [CVE-2026-25963](https://insights.sbomify.com/CVE-2026-25963/): Fleet: Authorization Bypass in certificate template batch deletion for team administrators (low 1.2)
- [CVE-2026-25962](https://insights.sbomify.com/CVE-2026-25962/): MarkUs: Zip bomb in config upload enables DoS (medium 6.5)
- [CVE-2026-25961](https://insights.sbomify.com/CVE-2026-25961/): SumatraPDF Update MITM -> Arbitrary Code Execution (high 7.5)
- [CVE-2026-25960](https://insights.sbomify.com/CVE-2026-25960/): SSRF Protection Bypass in vLLM (high 7.1)
- [CVE-2026-25959](https://insights.sbomify.com/CVE-2026-25959/): FreeRDP has heap-use-after-free in xf_cliprdr_provide_data_ (medium 5.5)
- [CVE-2026-25958](https://insights.sbomify.com/CVE-2026-25958/): Cube privilege escalation via a specially crafted request (high 7.7)
- [CVE-2026-25957](https://insights.sbomify.com/CVE-2026-25957/): Cube Denial of Service (DoS) - An authenticated attacker can crash the server by sending a specially crafted request (medium 6.5)
- [CVE-2026-25956](https://insights.sbomify.com/CVE-2026-25956/): Frappe Affected by XSS and Open Redirect in Sign Up (medium 6.1)
- [CVE-2026-25955](https://insights.sbomify.com/CVE-2026-25955/): FreeRDP has heap-use-after-free in xf_AppUpdateWindowFromSurface (stale XImage) (medium 5.5)
- [CVE-2026-25954](https://insights.sbomify.com/CVE-2026-25954/): FreeRDP has heap-use-after-free in xf_rail_server_local_move_size (medium 5.5)
- [CVE-2026-25953](https://insights.sbomify.com/CVE-2026-25953/): FreeRDP has heap-use-after-free in xf_AppUpdateWindowFromSurface (freed appWindow) (medium 5.5)
- [CVE-2026-25952](https://insights.sbomify.com/CVE-2026-25952/): FreeRDP has heap-use-after-free in xf_SetWindowMinMaxInfo (medium 5.5)
- [CVE-2026-25951](https://insights.sbomify.com/CVE-2026-25951/): FUXA has a Path Traversal Sanitization Bypass (high 8.6)
- [CVE-2026-2595](https://insights.sbomify.com/CVE-2026-2595/): Cross-site scripting in Quads Ads Manager for Google AdSense (medium 5.4)
- [CVE-2026-25949](https://insights.sbomify.com/CVE-2026-25949/): Traefik: TCP readTimeout bypass via STARTTLS on Postgres (high 7.5)
- [CVE-2026-25947](https://insights.sbomify.com/CVE-2026-25947/): Worklenz Boolean-Based Blind SQL Injection via Improper ORDER BY Clause Input Validation (high 8.8)
- [CVE-2026-25946](https://insights.sbomify.com/CVE-2026-25946/): Gitea OpenID discovery server-side request forgery (medium 5.3)
- [CVE-2026-25945](https://insights.sbomify.com/CVE-2026-25945/): EV2GO ev2go.io Improper Restriction of Excessive Authentication Attempts (high 8.7)
- [CVE-2026-25942](https://insights.sbomify.com/CVE-2026-25942/): FreeRDP has global-buffer-overflow in xf_rail_server_execute_result (medium 5.5)
- [CVE-2026-25941](https://insights.sbomify.com/CVE-2026-25941/): FreeRDP: vuln_1_15_1 RDPGFX WIRE_TO_SURFACE_2 Out-of-Bounds Read (medium 4.3)
- [CVE-2026-25940](https://insights.sbomify.com/CVE-2026-25940/): jsPDF has a PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and "AS" property) (high 8.1)
- [CVE-2026-2594](https://insights.sbomify.com/CVE-2026-2594/): Smart Custom Fields <= 5.0.7 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Title (medium 6.4)
- [CVE-2026-25939](https://insights.sbomify.com/CVE-2026-25939/): FUXA Unauthenticated Remote Arbitrary Scheduler Write (critical 9.3)
- [CVE-2026-25938](https://insights.sbomify.com/CVE-2026-25938/): FUXA Unauthenticated Remote Code Execution in Node-RED Integration (critical 9.5)
- [CVE-2026-25937](https://insights.sbomify.com/CVE-2026-25937/): GLPI has a MFA bypass (medium 6.5)
- [CVE-2026-25936](https://insights.sbomify.com/CVE-2026-25936/): GLPI Vulnerable to Authenticated SQL Injection (medium 6.5)
- [CVE-2026-25935](https://insights.sbomify.com/CVE-2026-25935/): Vikunja Affected by XSS Via Task Preview (high 8.6)
- [CVE-2026-25934](https://insights.sbomify.com/CVE-2026-25934/): go-git improperly verifies data integrity values for .idx and .pack files (medium 4.3)
- [CVE-2026-25933](https://insights.sbomify.com/CVE-2026-25933/): Arduino App Lab has Improper Data Validation in Internal Terminal Interface (medium 6.9)
- [CVE-2026-25932](https://insights.sbomify.com/CVE-2026-25932/): GLPI has Stored XSS in Supplier 'Website' field (high 7.2)
- [CVE-2026-25931](https://insights.sbomify.com/CVE-2026-25931/): vscode-spell-checker has a workspace-trust bypass Code Execution (high 7.8)
- [CVE-2026-25930](https://insights.sbomify.com/CVE-2026-25930/): OpenEMR's Printable LBF Endpoint Leaks Arbitrary Patient Forms (medium 6.5)
- [CVE-2026-2593](https://insights.sbomify.com/CVE-2026-2593/): Greenshift – animation and page builder blocks <= 12.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2026-25929](https://insights.sbomify.com/CVE-2026-25929/): OpenEMR Patient Picture Context Allows Arbitrary Patient Photo Retrieval (medium 6.5)
- [CVE-2026-25928](https://insights.sbomify.com/CVE-2026-25928/): OpenEMR Vulnerable to Path Traversal When Zipping DICOM Folders (medium 6.5)
- [CVE-2026-25927](https://insights.sbomify.com/CVE-2026-25927/): OpenEMR Missing Authorization Checks in DICOM Viewer State API (high 7.1)
- [CVE-2026-25926](https://insights.sbomify.com/CVE-2026-25926/): Notepad++ has an Untrusted Search Path (high 7.3)
- [CVE-2026-25925](https://insights.sbomify.com/CVE-2026-25925/): PowerDocu Affected by Remote Code Execution via Insecure Deserialization (high 7.8)
- [CVE-2026-25924](https://insights.sbomify.com/CVE-2026-25924/): Kanboard is Missing Access Control on Plugin Installation leading to Administrative RCE (high 8.5)
- [CVE-2026-25923](https://insights.sbomify.com/CVE-2026-25923/): Phar Deserialization leading to Arbitrary File Deletion in my little forum (high 8.7)
- [CVE-2026-25922](https://insights.sbomify.com/CVE-2026-25922/): authentik has a Signature Verification Bypass via SAML Assertion Wrapping (high 8.8)
- [CVE-2026-25921](https://insights.sbomify.com/CVE-2026-25921/): Gogs: Cross-repository LFS object overwrite via missing content hash verification (critical 9.3)
- [CVE-2026-25920](https://insights.sbomify.com/CVE-2026-25920/): SumatraPDF has a heap out-of-bounds read in MOBI HuffDic decompressor (medium 5.5)
- [CVE-2026-2592](https://insights.sbomify.com/CVE-2026-2592/): Zarinpal Gateway for WooCommerce <= 5.0.16 - Improper Access Control to Payment Status Update (high 7.7)
- [CVE-2026-25918](https://insights.sbomify.com/CVE-2026-25918/): unity-cli Exposes Plaintext Credentials in Debug Logs (sign-package command) (medium 5.9)
- [CVE-2026-25917](https://insights.sbomify.com/CVE-2026-25917/): Apache Airflow: API extra-links triggers XCom deserialization/class instantiation (Airflow 3.1.5) (high 7.2)
- [CVE-2026-25916](https://insights.sbomify.com/CVE-2026-25916/): Security feature bypass in Webmail (medium 4.3)
- [CVE-2026-25908](https://insights.sbomify.com/CVE-2026-25908/): Privilege escalation in Alienware Command Center (AWCC) (medium 6.7)
- [CVE-2026-25907](https://insights.sbomify.com/CVE-2026-25907/): Denial of service in PowerScale OneFS (medium 5.3)
- [CVE-2026-25906](https://insights.sbomify.com/CVE-2026-25906/): Privilege escalation in Optimizer (high 7.3)
- [CVE-2026-25905](https://insights.sbomify.com/CVE-2026-25905/): Lack of isolation in mcp-run-python leads to MCP server takeover (medium 5.8)
- [CVE-2026-25904](https://insights.sbomify.com/CVE-2026-25904/): Overly permissive Deno configuration in mcp-run-python leads to SSRF (medium 5.8)
- [CVE-2026-25903](https://insights.sbomify.com/CVE-2026-25903/): Apache NiFi: Missing Authorization of Restricted Permissions for Component Updates (high 8.7)
- [CVE-2026-25901](https://insights.sbomify.com/CVE-2026-25901/): Joomla! Core - [20260502] - XSS in com_associations (medium 6.9)
- [CVE-2026-25900](https://insights.sbomify.com/CVE-2026-25900/): Joomla! Core - [20260501] - XSS in feed modules (medium 6.9)
- [CVE-2026-2590](https://insights.sbomify.com/CVE-2026-2590/): Security feature bypass in Remote Desktop Manager (critical 9.8)
- [CVE-2026-25899](https://insights.sbomify.com/CVE-2026-25899/): Fiber is Vulnerable to Denial of Service via Flash Cookie Unbounded Allocation (high 7.5)
- [CVE-2026-25898](https://insights.sbomify.com/CVE-2026-25898/): Imagemagick Has Global Buffer Overflow (OOB Read) via Negative Pixel Index in UIL and XPM Writer (medium 6.5)
- [CVE-2026-25897](https://insights.sbomify.com/CVE-2026-25897/): ImageMagick has heap overflow in sun decoder on 32-bit systems that can result in out of bounds write (medium 6.5)
- [CVE-2026-25896](https://insights.sbomify.com/CVE-2026-25896/): fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names (critical 9.3)
- [CVE-2026-25895](https://insights.sbomify.com/CVE-2026-25895/): FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API (critical 9.5)
- [CVE-2026-25894](https://insights.sbomify.com/CVE-2026-25894/): FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration (critical 9.5)
- [CVE-2026-25893](https://insights.sbomify.com/CVE-2026-25893/): FUXA Unauthenticated Remote Code Execution via Admin JWT Minting (critical 10.0)
- [CVE-2026-25892](https://insights.sbomify.com/CVE-2026-25892/): Adminer has an Unauthenticated Persistent DoS via Array Injection in ?script=version Endpoint (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/765/