# Vulnerabilities published in 2026


- [CVE-2026-25776](https://insights.sbomify.com/CVE-2026-25776/): Code injection in Movable Type (critical 9.3)
- [CVE-2026-25775](https://insights.sbomify.com/CVE-2026-25775/): SenseLive X3050 Missing authentication for critical function (critical 9.3)
- [CVE-2026-25774](https://insights.sbomify.com/CVE-2026-25774/): EV Energy ev.energy Insufficiently Protected Credentials (medium 6.9)
- [CVE-2026-25773](https://insights.sbomify.com/CVE-2026-25773/): Focalboard doesn't sanitize category IDs before incorporating them into dynamic SQL statements (high 8.1)
- [CVE-2026-25772](https://insights.sbomify.com/CVE-2026-25772/): Wazuh Database Synchronization Vulnerable to Stack-based Buffer Overflow via snprintf Integer Underflow (medium 4.9)
- [CVE-2026-25771](https://insights.sbomify.com/CVE-2026-25771/): Wazuh Vulnerable to Denial of Service via Synchronous I/O Blocking in Asynchronous Authentication Middleware (medium 5.3)
- [CVE-2026-25770](https://insights.sbomify.com/CVE-2026-25770/): Wazuh has Privilege Escalation to Root via Cluster Protocol File Write (critical 9.1)
- [CVE-2026-2577](https://insights.sbomify.com/CVE-2026-2577/): Nanobot Unauthenticated WhatsApp Session Hijack via WebSocket Bridge (critical 10.0)
- [CVE-2026-25769](https://insights.sbomify.com/CVE-2026-25769/): Wazuh Cluster vulnerable to Remote Code Execution via Insecure Deserialization (critical 9.1)
- [CVE-2026-25768](https://insights.sbomify.com/CVE-2026-25768/): LavinMQ is missing vhost access control (high 7.1)
- [CVE-2026-25767](https://insights.sbomify.com/CVE-2026-25767/): LavinMQ has incomplete shovel configuration validation (high 8.6)
- [CVE-2026-25766](https://insights.sbomify.com/CVE-2026-25766/): Echo has a Windows path traversal via backslash in middleware.Static default filesystem (medium 5.3)
- [CVE-2026-25765](https://insights.sbomify.com/CVE-2026-25765/): Faraday affected by SSRF via protocol-relative URL host override in build_exclusive_url (medium 5.8)
- [CVE-2026-25764](https://insights.sbomify.com/CVE-2026-25764/): OpenProject vulnerable to Stored HTML injection (low 3.5)
- [CVE-2026-25763](https://insights.sbomify.com/CVE-2026-25763/): Command Injection on OpenProject repositories leads to Remote Code Execution (critical 9.4)
- [CVE-2026-25762](https://insights.sbomify.com/CVE-2026-25762/): AdonisJS vulnerable to Denial of Service (DoS) via Unrestricted Memory Buffering in PartHandler during File Type Detection (high 7.5)
- [CVE-2026-25761](https://insights.sbomify.com/CVE-2026-25761/): Command injection via crafted filenames in Super-linter Action (high 8.8)
- [CVE-2026-25760](https://insights.sbomify.com/CVE-2026-25760/): Website Path Traversal / Arbitrary File Read (Authenticated) in Sliver (medium 6.5)
- [CVE-2026-2576](https://insights.sbomify.com/CVE-2026-2576/): Business Directory Plugin <= 6.4.21 - Unauthenticated SQL Injection via payment Parameter (high 7.5)
- [CVE-2026-25759](https://insights.sbomify.com/CVE-2026-25759/): Statmatic affected by privilege escalation via stored cross-site scripting (high 8.7)
- [CVE-2026-25758](https://insights.sbomify.com/CVE-2026-25758/): Spree allows unauthenticated users can access all guest addresses (high 7.7)
- [CVE-2026-25757](https://insights.sbomify.com/CVE-2026-25757/): Unauthenticated Spree Commerce users can view completed guest orders by Order ID (high 7.7)
- [CVE-2026-25755](https://insights.sbomify.com/CVE-2026-25755/): jsPDF has PDF Object Injection via Unsanitized Input in addJS Method (high 8.1)
- [CVE-2026-25754](https://insights.sbomify.com/CVE-2026-25754/): AdonisJS multipart body parsing has Prototype Pollution issue (high 7.2)
- [CVE-2026-25753](https://insights.sbomify.com/CVE-2026-25753/): PlaciPy has a Hard-Coded Default Password for All Student Accounts (Account Takeover) (critical 9.3)
- [CVE-2026-25752](https://insights.sbomify.com/CVE-2026-25752/): FUXA Unauthenticated Remote Arbitrary Device Tag Write (critical 9.3)
- [CVE-2026-25751](https://insights.sbomify.com/CVE-2026-25751/): FUXA Unauthenticated Exposure of Plaintext Database Credentials (critical 9.1)
- [CVE-2026-25750](https://insights.sbomify.com/CVE-2026-25750/): LangSmith Studio has URL Parameter Injection Vulnerability that Enables Token Theft via Malicious baseUrl (high 8.5)
- [CVE-2026-2575](https://insights.sbomify.com/CVE-2026-2575/): Keycloak: keycloak: denial of service due to excessive samlrequest decompression (medium 5.3)
- [CVE-2026-25749](https://insights.sbomify.com/CVE-2026-25749/): Heap Overflow in Vim (medium 6.6)
- [CVE-2026-25748](https://insights.sbomify.com/CVE-2026-25748/): authentik has a forward authentication bypass with broken cookie (high 8.6)
- [CVE-2026-25747](https://insights.sbomify.com/CVE-2026-25747/): Apache Camel LevelDB: Deserialization of Untrusted Data in Camel LevelDB (high 8.8)
- [CVE-2026-25746](https://insights.sbomify.com/CVE-2026-25746/): OpenEMR has SQL Injection Vulnerability (high 8.8)
- [CVE-2026-25745](https://insights.sbomify.com/CVE-2026-25745/): OpenEMR's Message Update Ignores Patient id (medium 6.5)
- [CVE-2026-25744](https://insights.sbomify.com/CVE-2026-25744/): OpenEMR: POST /api/.../vital Accepts Attacker-Supplied id and Overwrites Arbitrary Vitals (medium 6.5)
- [CVE-2026-25743](https://insights.sbomify.com/CVE-2026-25743/): OpenEMR has Stored XSS in Questionnaire answers (high 7.2)
- [CVE-2026-25742](https://insights.sbomify.com/CVE-2026-25742/): Zulip: Anonymous File Access After Disabling Spectator Access (medium 5.3)
- [CVE-2026-25741](https://insights.sbomify.com/CVE-2026-25741/): Zulip Vulnerable to Modification of Payment Method (Stripe Default Card) by Non-Billing Users (high 7.1)
- [CVE-2026-25740](https://insights.sbomify.com/CVE-2026-25740/): Privilege escalation to the `CAP_NET_RAW` capability via the `programs.captive-browser` NixOS module (medium 5.8)
- [CVE-2026-25739](https://insights.sbomify.com/CVE-2026-25739/): Indico affected by Cross-Site-Scripting via material uploads (medium 5.4)
- [CVE-2026-25738](https://insights.sbomify.com/CVE-2026-25738/): Indico has Server-Side Request Forgery (SSRF) in multiple places (medium 6.9)
- [CVE-2026-25737](https://insights.sbomify.com/CVE-2026-25737/): Budibase Arbitrary File Upload Leading to Multiple Critical Vulnerabilities (SSRF, Stored XSS) (high 8.9)
- [CVE-2026-25736](https://insights.sbomify.com/CVE-2026-25736/): Rucio WebUI has a Stored Cross-site Scripting (XSS) Vulnerability in its Custom RSE Attribute (medium 6.1)
- [CVE-2026-25735](https://insights.sbomify.com/CVE-2026-25735/): Rucio WebUI has a Stored Cross-site Scripting (XSS) vulnerability its Identity Name (medium 6.1)
- [CVE-2026-25734](https://insights.sbomify.com/CVE-2026-25734/): Rucio WebUI has Stored Cross-site Scripting (XSS) in RSE Metadata (medium 6.1)
- [CVE-2026-25733](https://insights.sbomify.com/CVE-2026-25733/): Rucio WebUI Vulnerable to Stored Cross-site Scripting (XSS) through Custom Rule Function (high 7.3)
- [CVE-2026-25732](https://insights.sbomify.com/CVE-2026-25732/): NiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File Write (high 7.5)
- [CVE-2026-25731](https://insights.sbomify.com/CVE-2026-25731/): Calibre Affected by Arbitrary Code Execution via Server-Side Template Injection in Calibre HTML Export (high 7.8)
- [CVE-2026-2573](https://insights.sbomify.com/CVE-2026-2573/): GutenKit <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'postBodyCss' (medium 6.4)
- [CVE-2026-25729](https://insights.sbomify.com/CVE-2026-25729/): DeepAudit Affected by User Enumeration via Broken Access Control (low 2.1)
- [CVE-2026-25728](https://insights.sbomify.com/CVE-2026-25728/): ClipBucket v5 Affected by Remote Code Execution via Avatar/Background File Upload Race Condition (critical 9.3)
- [CVE-2026-25727](https://insights.sbomify.com/CVE-2026-25727/): time affected by a stack exhaustion denial of service attack (medium 6.8)
- [CVE-2026-25726](https://insights.sbomify.com/CVE-2026-25726/): Cloudreve is vulnerable to Account Takeover via Weak Cryptographic Token Generation (Insecure PRNG Seeding) (high 8.1)
- [CVE-2026-25725](https://insights.sbomify.com/CVE-2026-25725/): Claude Code Has Sandbox Escape via Persistent Configuration Injection in settings.json (high 7.7)
- [CVE-2026-25724](https://insights.sbomify.com/CVE-2026-25724/): Claude Code Has Permission Deny Bypass Through Symbolic Links (low 2.3)
- [CVE-2026-25723](https://insights.sbomify.com/CVE-2026-25723/): Claude Code Vulnerable to Command Injection via Piped sed Command Bypasses File Write Restrictions (high 7.7)
- [CVE-2026-25722](https://insights.sbomify.com/CVE-2026-25722/): Claude Code Vulnerable to Command Injection via Directory Change Bypasses Write Protection (high 7.7)
- [CVE-2026-25721](https://insights.sbomify.com/CVE-2026-25721/): Copeland XWEB and XWEB Pro OS Command Injection (high 8.0)
- [CVE-2026-25720](https://insights.sbomify.com/CVE-2026-25720/): SenseLive X3050 Insufficient session expiration (medium 6.9)
- [CVE-2026-25718](https://insights.sbomify.com/CVE-2026-25718/): Gitea template repository generation mishandles symlinked paths (critical 9.1)
- [CVE-2026-25716](https://insights.sbomify.com/CVE-2026-25716/): BlueSpiceUserManager: Missing authorization in REST endpoints for blocking and unblocking users (high 7.1)
- [CVE-2026-25715](https://insights.sbomify.com/CVE-2026-25715/): Jinan USR IOT Technology Limited (PUSR) USR-W610 Weak Password Requirements (critical 9.8)
- [CVE-2026-25714](https://insights.sbomify.com/CVE-2026-25714/): Gitea user organization API bypasses public-only token filtering (medium 4.3)
- [CVE-2026-25713](https://insights.sbomify.com/CVE-2026-25713/): Memory corruption in MediaInfoLib (high 7.8)
- [CVE-2026-25712](https://insights.sbomify.com/CVE-2026-25712/): Gitea organization permission APIs expose private visibility information (high 7.5)
- [CVE-2026-25711](https://insights.sbomify.com/CVE-2026-25711/): Chargemap chargemap.com Insufficient Session Expiration (medium 6.9)
- [CVE-2026-25710](https://insights.sbomify.com/CVE-2026-25710/): Privilege escalation in plasma-login-manager (high 7.0)
- [CVE-2026-2571](https://insights.sbomify.com/CVE-2026-2571/): Missing authorization in Download Manager (medium 4.3)
- [CVE-2026-25707](https://insights.sbomify.com/CVE-2026-25707/): Handcrafted repo metadata may cause arbitrary local files to be overwritten by libzypp (high 8.8)
- [CVE-2026-25706](https://insights.sbomify.com/CVE-2026-25706/): yast2-samba-client: OS command injection via attacker-controlled Organizational Unit (Active Directory-supplied) (high 7.5)
- [CVE-2026-25705](https://insights.sbomify.com/CVE-2026-25705/): Rancher Extensions have arbitrary file access via path traversal (high 8.4)
- [CVE-2026-25704](https://insights.sbomify.com/CVE-2026-25704/): Incomplete privilege drop for com.system76.CosmicGreeter.GetUserData (medium 5.8)
- [CVE-2026-25703](https://insights.sbomify.com/CVE-2026-25703/): Potential information leakage from manager /network/graph API in NeuVector (high 7.3)
- [CVE-2026-25702](https://insights.sbomify.com/CVE-2026-25702/): nftables disabled due to incorrect kernel backport (high 7.3)
- [CVE-2026-25701](https://insights.sbomify.com/CVE-2026-25701/): Race condition in sdbootutil (high 7.0)
- [CVE-2026-25700](https://insights.sbomify.com/CVE-2026-25700/): Apache Answer: AdminToken not invalidated after admin deactivation (high 7.2)
- [CVE-2026-25699](https://insights.sbomify.com/CVE-2026-25699/): Apache Answer: Authorization Bypass in Timeline API (medium 6.1)
- [CVE-2026-25691](https://insights.sbomify.com/CVE-2026-25691/): Path traversal in FortiSandbox (medium 6.2)
- [CVE-2026-25690](https://insights.sbomify.com/CVE-2026-25690/): Command injection in FortiDeceptor (medium 4.0)
- [CVE-2026-2569](https://insights.sbomify.com/CVE-2026-2569/): Dear Flipbook <= 2.4.20 - Authenticated (Auhtor+) Stored Cross-Site Scripting via PDF Page Labels (medium 6.4)
- [CVE-2026-25689](https://insights.sbomify.com/CVE-2026-25689/): Command injection in FortiDeceptor (medium 6.0)
- [CVE-2026-25688](https://insights.sbomify.com/CVE-2026-25688/): Apache Answer: XSS in AI Answer Rendering (medium 6.1)
- [CVE-2026-25687](https://insights.sbomify.com/CVE-2026-25687/): ZCC race condition in ZPA tunnel handler (high 8.1)
- [CVE-2026-25684](https://insights.sbomify.com/CVE-2026-25684/): File Type Control rule bypass (medium 4.4)
- [CVE-2026-25681](https://insights.sbomify.com/CVE-2026-25681/): Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html (medium 6.1)
- [CVE-2026-25680](https://insights.sbomify.com/CVE-2026-25680/): Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html (medium 6.5)
- [CVE-2026-2568](https://insights.sbomify.com/CVE-2026-2568/): Cross-site scripting in WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms (high 7.2)
- [CVE-2026-25679](https://insights.sbomify.com/CVE-2026-25679/): Incorrect parsing of IPv6 host literals in net/url (high 7.5)
- [CVE-2026-25676](https://insights.sbomify.com/CVE-2026-25676/): Other in M-Track Duo HD (high 7.1)
- [CVE-2026-25674](https://insights.sbomify.com/CVE-2026-25674/): Potential incorrect permissions on newly created file system objects (low 3.7)
- [CVE-2026-25673](https://insights.sbomify.com/CVE-2026-25673/): Potential denial-of-service vulnerability in URLField via Unicode normalization on Windows (high 7.5)
- [CVE-2026-2567](https://insights.sbomify.com/CVE-2026-2567/): Wavlink WL-NU516U1 nas.cgi sub_401218 stack-based overflow (high 8.6)
- [CVE-2026-25667](https://insights.sbomify.com/CVE-2026-25667/): Denial of service in microsoft:.net (high 7.5)
- [CVE-2026-25660](https://insights.sbomify.com/CVE-2026-25660/): Authentication bypass for certain API calls (critical 9.3)
- [CVE-2026-2566](https://insights.sbomify.com/CVE-2026-2566/): Wavlink WL-NU516U1 adm.cgi sub_406194 stack-based overflow (high 8.6)
- [CVE-2026-25659](https://insights.sbomify.com/CVE-2026-25659/): Ericsson Packet Core Gateway (PCG) - Improper handling of missing values Vulnerability (high 7.1)
- [CVE-2026-25658](https://insights.sbomify.com/CVE-2026-25658/): Ericsson Packet Core Gateway (PCG) - Improper handling of missing values Vulnerability (high 7.1)
- [CVE-2026-25657](https://insights.sbomify.com/CVE-2026-25657/): Ericsson Packet Core Gateway (PCG) - Improper Handling of Syntactically Invalid Structure Vulnerability (high 7.1)
- [CVE-2026-25656](https://insights.sbomify.com/CVE-2026-25656/): Privilege escalation in SINEC NMS (high 8.5)
- [CVE-2026-25655](https://insights.sbomify.com/CVE-2026-25655/): Privilege escalation in SINEC NMS (high 8.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/767/