# Vulnerabilities published in 2026


- [CVE-2026-25891](https://insights.sbomify.com/CVE-2026-25891/): Fiber has an Arbitrary File Read in Static Middleware on Windows (high 7.7)
- [CVE-2026-25890](https://insights.sbomify.com/CVE-2026-25890/): File Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URL (high 8.1)
- [CVE-2026-2589](https://insights.sbomify.com/CVE-2026-2589/): Information disclosure in Greenshift – animation and page builder blocks (medium 5.3)
- [CVE-2026-25889](https://insights.sbomify.com/CVE-2026-25889/): File Browser has an Authentication Bypass in User Password Update (medium 5.4)
- [CVE-2026-25888](https://insights.sbomify.com/CVE-2026-25888/): Chartbrew: Remote Code Execution (RCE) via Vulnerable API (high 8.8)
- [CVE-2026-25887](https://insights.sbomify.com/CVE-2026-25887/): Chartbrew: Remote Code Execution (RCE) via MongoDB Dataset Query (high 7.2)
- [CVE-2026-25885](https://insights.sbomify.com/CVE-2026-25885/): PolarLearn allows Unauthenticated WebSocket access allows subscribing to and posting in arbitrary group chats (critical 10.0)
- [CVE-2026-25884](https://insights.sbomify.com/CVE-2026-25884/): Exiv2: Out-of-bounds read in CrwMap::decode0x0805 (low 2.7)
- [CVE-2026-25883](https://insights.sbomify.com/CVE-2026-25883/): Vexa Webhook Feature has a SSRF Vulnerability (medium 5.8)
- [CVE-2026-25882](https://insights.sbomify.com/CVE-2026-25882/): Fiber has a Denial of Service Vulnerability via Route Parameter Overflow (medium 5.5)
- [CVE-2026-25881](https://insights.sbomify.com/CVE-2026-25881/): @nyariv/sandboxjs has host prototype pollution from sandbox via array intermediary (sandbox escape) (critical 9.1)
- [CVE-2026-25880](https://insights.sbomify.com/CVE-2026-25880/): Untrusted Search Path in SumatraPDF Reader (explorer.exe on Windows) (high 7.8)
- [CVE-2026-2588](https://insights.sbomify.com/CVE-2026-2588/): Crypt::NaCl::Sodium versions through 2.001 for Perl has an integer overflow flaw on 32-bit systems (critical 9.1)
- [CVE-2026-25879](https://insights.sbomify.com/CVE-2026-25879/): Langroid has Prompt to SQL Injection, Leading to RCE (critical 9.8)
- [CVE-2026-25878](https://insights.sbomify.com/CVE-2026-25878/): FroshAdminer Adminer UI is accessible without admin session (medium 6.9)
- [CVE-2026-25877](https://insights.sbomify.com/CVE-2026-25877/): Chartbrew: Insecure Direct Object Reference (IDOR) in Chart Operations (medium 6.5)
- [CVE-2026-25876](https://insights.sbomify.com/CVE-2026-25876/): PlaciPy is Missing Authorization on Assessment Results Endpoint (medium 5.3)
- [CVE-2026-25875](https://insights.sbomify.com/CVE-2026-25875/): PlaciPy Admin Privilege Escalation via Trusted JWT Claims (critical 9.3)
- [CVE-2026-25874](https://insights.sbomify.com/CVE-2026-25874/): LeRobot Unsafe Deserialization Remote Code Execution via gRPC (critical 9.3)
- [CVE-2026-25873](https://insights.sbomify.com/CVE-2026-25873/): OmniGen2-RL Reward Server Unsafe Deserialization RCE (critical 9.3)
- [CVE-2026-25872](https://insights.sbomify.com/CVE-2026-25872/): JUNG Smart Panel 5.1 KNX Unauthenticated Path Traversal (medium 6.9)
- [CVE-2026-25870](https://insights.sbomify.com/CVE-2026-25870/): DoraCMS <= 3.1 UEditor Remote Image Fetch SSRF (medium 6.9)
- [CVE-2026-2587](https://insights.sbomify.com/CVE-2026-2587/): GlassFish's gadget handler is vulnerable to RCE (critical 9.6)
- [CVE-2026-25869](https://insights.sbomify.com/CVE-2026-25869/): MiniGal Nano <= 0.3.5 Path Traversal via dir Parameter (medium 6.9)
- [CVE-2026-25868](https://insights.sbomify.com/CVE-2026-25868/): MiniGal Nano <= 0.3.5 Reflected XSS via dir Parameter (medium 5.1)
- [CVE-2026-25866](https://insights.sbomify.com/CVE-2026-25866/): MobaXterm < 26.1 Notepad++ Unquoted Service Path (high 8.5)
- [CVE-2026-25865](https://insights.sbomify.com/CVE-2026-25865/): Punto Switcher 4.5.0.583 Unquoted Search Path via WinExec (high 8.5)
- [CVE-2026-25863](https://insights.sbomify.com/CVE-2026-25863/): Conditional Fields for Contact Form 7 < 2.7.3 DoS via Uncontrolled Resource Consumption (high 8.7)
- [CVE-2026-25861](https://insights.sbomify.com/CVE-2026-25861/): QloApps 1.7.0 Weak Password Hashing via MD5 in Tools.php (high 8.2)
- [CVE-2026-25860](https://insights.sbomify.com/CVE-2026-25860/): OpenClinic GA 5.351.19 Reflected XSS via DICOM Image Upload Handler (medium 5.3)
- [CVE-2026-2586](https://insights.sbomify.com/CVE-2026-2586/): GlassFish's Administration Console is Vulnerable to RCE (critical 9.1)
- [CVE-2026-25859](https://insights.sbomify.com/CVE-2026-25859/): WeKan < 8.20 Migration Functionality Insufficient Permission Checks (high 7.1)
- [CVE-2026-25858](https://insights.sbomify.com/CVE-2026-25858/): macrozheng mall <= 1.0.3 Unauthenticated Password Reset via OTP Disclosure (critical 9.3)
- [CVE-2026-25857](https://insights.sbomify.com/CVE-2026-25857/): Tenda G300-F Command Injection via formSetWanDiag (high 8.6)
- [CVE-2026-25856](https://insights.sbomify.com/CVE-2026-25856/): OpenBullet2 0.3.2 Authenticated RCE via Job Configuration Interface (high 8.7)
- [CVE-2026-25855](https://insights.sbomify.com/CVE-2026-25855/): OpenBullet2 0.3.2 Authenticated RCE via FileProxySource Script Upload (high 8.7)
- [CVE-2026-25854](https://insights.sbomify.com/CVE-2026-25854/): Apache Tomcat: Occasionally open redirect (medium 6.1)
- [CVE-2026-25852](https://insights.sbomify.com/CVE-2026-25852/): Privilege escalation in Acronis DeviceLock DLP (medium 6.7)
- [CVE-2026-25851](https://insights.sbomify.com/CVE-2026-25851/): Chargemap chargemap.com Missing Authentication for Critical Function (critical 9.3)
- [CVE-2026-25850](https://insights.sbomify.com/CVE-2026-25850/): filemanagement_storage_service has an improper preservation of permissions vulnerability (medium 5.5)
- [CVE-2026-2585](https://insights.sbomify.com/CVE-2026-2585/): Cross-site scripting in Brizy – Page Builder (medium 6.4)
- [CVE-2026-25848](https://insights.sbomify.com/CVE-2026-25848/): Auth bypass in Hub (critical 9.1)
- [CVE-2026-25847](https://insights.sbomify.com/CVE-2026-25847/): Cross-site scripting in PyCharm (high 8.2)
- [CVE-2026-25846](https://insights.sbomify.com/CVE-2026-25846/): Information disclosure in YouTrack (medium 6.5)
- [CVE-2026-2584](https://insights.sbomify.com/CVE-2026-2584/): SQL Injection in Ciser System SL firmware (critical 9.3)
- [CVE-2026-25836](https://insights.sbomify.com/CVE-2026-25836/): Command injection in FortiSandbox Cloud (medium 6.7)
- [CVE-2026-25835](https://insights.sbomify.com/CVE-2026-25835/): Weak cryptography in arm:mbed tls (high 7.7)
- [CVE-2026-25834](https://insights.sbomify.com/CVE-2026-25834/): Weak cryptography in trustedfirmware:mbed tls (medium 6.5)
- [CVE-2026-25833](https://insights.sbomify.com/CVE-2026-25833/): Memory corruption in trustedfirmware:mbed tls (high 7.5)
- [CVE-2026-25832](https://insights.sbomify.com/CVE-2026-25832/): Security feature bypass in Mbed TLS (low 3.7)
- [CVE-2026-2583](https://insights.sbomify.com/CVE-2026-2583/): Blocksy <= 2.1.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via `blocksy_meta` Fields (medium 6.4)
- [CVE-2026-25828](https://insights.sbomify.com/CVE-2026-25828/): grub-btrfs through 2026-01-31 (on Arch Linux and derivative distributions) allows initramfs OS command injection because it does not sanitiz (medium 5.4)
- [CVE-2026-25827](https://insights.sbomify.com/CVE-2026-25827/): An issue was discovered in Keyfactor SignServer before 7.6.0. (low 2.3)
- [CVE-2026-25826](https://insights.sbomify.com/CVE-2026-25826/): An issue was discovered in Keyfactor SignServer before 7.6.0. (medium 4.9)
- [CVE-2026-25825](https://insights.sbomify.com/CVE-2026-25825/): An issue was discovered in Keyfactor SignServer before 7.6.0. (low 2.7)
- [CVE-2026-25823](https://insights.sbomify.com/CVE-2026-25823/): HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 ha (critical 9.8)
- [CVE-2026-2582](https://insights.sbomify.com/CVE-2026-2582/): Germanized for WooCommerce <= 3.20.5 - Unauthenticated Arbitrary Shortcode Execution (medium 6.5)
- [CVE-2026-25819](https://insights.sbomify.com/CVE-2026-25819/): HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 al (high 7.5)
- [CVE-2026-25818](https://insights.sbomify.com/CVE-2026-25818/): HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 ha (critical 9.1)
- [CVE-2026-25817](https://insights.sbomify.com/CVE-2026-25817/): HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 ha (high 8.8)
- [CVE-2026-25815](https://insights.sbomify.com/CVE-2026-25815/): Weak cryptography in FortiOS (low 3.2)
- [CVE-2026-25814](https://insights.sbomify.com/CVE-2026-25814/): NoSQL Injection Risk via Unsanitized Query Parameters (critical 9.3)
- [CVE-2026-25813](https://insights.sbomify.com/CVE-2026-25813/): PlaciPy Exposes Sensitive Data via Application Logs (high 8.7)
- [CVE-2026-25812](https://insights.sbomify.com/CVE-2026-25812/): PlaciPy is Missing CSRF Protection on State-Changing Endpoints (critical 9.3)
- [CVE-2026-25811](https://insights.sbomify.com/CVE-2026-25811/): PlaciPy Email Domain Trust Enables Cross-Tenant Data Access (Multi-Tenant Isolation Failure) (medium 5.3)
- [CVE-2026-25810](https://insights.sbomify.com/CVE-2026-25810/): PlaciPy is Missing Object-Level Authorization in student.submission.routes.ts (medium 5.3)
- [CVE-2026-2581](https://insights.sbomify.com/CVE-2026-2581/): Undici has Unbounded Memory Consumption in its DeduplicationHandler via Response Buffering that leads to DoS (medium 5.9)
- [CVE-2026-25809](https://insights.sbomify.com/CVE-2026-25809/): PlaciPy Code Execution Allowed Without Assessment Active State Validation (medium 5.3)
- [CVE-2026-25808](https://insights.sbomify.com/CVE-2026-25808/): Hollo DMs get leaked and can be seen on Webfinger Browser (high 7.5)
- [CVE-2026-25807](https://insights.sbomify.com/CVE-2026-25807/): Unauthenticated Remote Code Execution via P2P Sharing in ZAI-Shell (high 8.8)
- [CVE-2026-25806](https://insights.sbomify.com/CVE-2026-25806/): PlaciPy has Missing Authorization Checks on Student Management Endpoints (IDOR) (medium 5.3)
- [CVE-2026-25805](https://insights.sbomify.com/CVE-2026-25805/): Zed does not show Parameter Values for MCP Tool Calls. Users cannot detect tool poisoning. (medium 6.4)
- [CVE-2026-25804](https://insights.sbomify.com/CVE-2026-25804/): Antrea has invalid enforcement order for network policy rules caused by integer overflow (high 8.0)
- [CVE-2026-25803](https://insights.sbomify.com/CVE-2026-25803/): 3DP-MANAGER Uses Hard-coded Credentials (critical 9.8)
- [CVE-2026-25802](https://insights.sbomify.com/CVE-2026-25802/): New API has Potential XSS in its MarkdownRenderer component (high 7.6)
- [CVE-2026-25800](https://insights.sbomify.com/CVE-2026-25800/): quinn-proto has remote memory exhaustion from unbounded out-of-order stream reassembly (high 7.5)
- [CVE-2026-2580](https://insights.sbomify.com/CVE-2026-2580/): SQL injection in WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters (high 7.5)
- [CVE-2026-25799](https://insights.sbomify.com/CVE-2026-25799/): ImageMagick has Division-by-Zero in YUV sampling factor validation, which leads to crash (medium 5.3)
- [CVE-2026-25798](https://insights.sbomify.com/CVE-2026-25798/): ImageMagick has NULL Pointer Dereference in ClonePixelCacheRepository via crafted image (medium 5.3)
- [CVE-2026-25797](https://insights.sbomify.com/CVE-2026-25797/): ImageMagick vulnerable to Code injection via PostScript header in ps coders (medium 5.7)
- [CVE-2026-25796](https://insights.sbomify.com/CVE-2026-25796/): ImageMagick has memory leak of watermark Image object in ReadSTEGANOImage on multiple error/early-return paths (medium 5.3)
- [CVE-2026-25795](https://insights.sbomify.com/CVE-2026-25795/): ImageMagick has NULL pointer dereference in ReadSFWImage after DestroyImageInfo (sfw.c) (medium 5.3)
- [CVE-2026-25794](https://insights.sbomify.com/CVE-2026-25794/): ImageMagick has heap-buffer-overflow via signed integer overflow in WriteUHDRImage when writing UHDR images with large dimensions (high 8.2)
- [CVE-2026-25793](https://insights.sbomify.com/CVE-2026-25793/): Nebula Has Possible Blocklist Bypass via ECDSA Signature Malleability (high 7.6)
- [CVE-2026-25792](https://insights.sbomify.com/CVE-2026-25792/): Greenshot Vulnerable to OS Command Injection via ExternalCommand Plugin (medium 6.5)
- [CVE-2026-25791](https://insights.sbomify.com/CVE-2026-25791/): Sliver has a DNS C2 OTP Bypass Allows Unauthenticated Session Flooding and Denial of Service (high 7.5)
- [CVE-2026-25790](https://insights.sbomify.com/CVE-2026-25790/): Wazuh has Stack-Based Buffer Overflow in Security Configuration Assessment JSON Parser (medium 4.9)
- [CVE-2026-2579](https://insights.sbomify.com/CVE-2026-2579/): SQL injection in WowStore – Store Builder & Product Blocks for WooCommerce (high 7.5)
- [CVE-2026-25789](https://insights.sbomify.com/CVE-2026-25789/): Cross-site scripting in SIMATIC Drive Controller CPU 1504D TF (high 7.2)
- [CVE-2026-25787](https://insights.sbomify.com/CVE-2026-25787/): Cross-site scripting in SIMATIC Drive Controller CPU 1504D TF (critical 9.3)
- [CVE-2026-25786](https://insights.sbomify.com/CVE-2026-25786/): Cross-site scripting in SIMATIC Drive Controller CPU 1504D TF (critical 9.3)
- [CVE-2026-25785](https://insights.sbomify.com/CVE-2026-25785/): Path traversal in Lanscope Endpoint Manager (On-Premises) Sub-Manager Server (critical 9.3)
- [CVE-2026-25784](https://insights.sbomify.com/CVE-2026-25784/): Misconfiguration in BlueSpice (critical 9.3)
- [CVE-2026-25783](https://insights.sbomify.com/CVE-2026-25783/): Denial of service via malformed User-Agent header in getBrowserVersion (medium 4.3)
- [CVE-2026-25782](https://insights.sbomify.com/CVE-2026-25782/): Gitea tracked-time deletion can target entries from another issue (medium 5.3)
- [CVE-2026-25781](https://insights.sbomify.com/CVE-2026-25781/): kernel_liteos_a has an out-of-bounds write vulnerability (high 8.4)
- [CVE-2026-25780](https://insights.sbomify.com/CVE-2026-25780/): Memory Exhaustion via Malformed DOC File Upload (medium 4.3)
- [CVE-2026-2578](https://insights.sbomify.com/CVE-2026-2578/): Information Disclosure via WebSocket Event When Deleting Unrevealed Burn on Read Posts (medium 4.3)
- [CVE-2026-25779](https://insights.sbomify.com/CVE-2026-25779/): Gitea redirect handling permits open redirects through backslash paths (medium 6.1)
- [CVE-2026-25778](https://insights.sbomify.com/CVE-2026-25778/): SWITCH EV swtchenergy.com Insufficient Session Expiration (medium 6.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/766/