# Vulnerabilities published in 2026


- [CVE-2026-25654](https://insights.sbomify.com/CVE-2026-25654/): Missing authorization in SINEC NMS (high 8.7)
- [CVE-2026-25652](https://insights.sbomify.com/CVE-2026-25652/): ColdFusion | Incorrect Authorization (CWE-863) (high 7.8)
- [CVE-2026-25651](https://insights.sbomify.com/CVE-2026-25651/): client-certificate-auth has an Open Redirect via Host Header Injection in HTTP-to-HTTPS redirect (medium 6.1)
- [CVE-2026-25650](https://insights.sbomify.com/CVE-2026-25650/): MCP Salesforce Connector has arbitrary attribute access which leads to disclosure of Salesforce auth token (medium 6.6)
- [CVE-2026-2565](https://insights.sbomify.com/CVE-2026-2565/): Wavlink WL-NU516U1 adm.cgi sub_40785C stack-based overflow (high 7.5)
- [CVE-2026-25649](https://insights.sbomify.com/CVE-2026-25649/): Traccar Vulnerable to Authorization Code Theft via Open Redirect in OIDC Provider Endpoints (high 7.3)
- [CVE-2026-25648](https://insights.sbomify.com/CVE-2026-25648/): Traccar Vulnerable to Stored Cross-Site Scripting (XSS) via Malicious SVG File Upload (high 8.7)
- [CVE-2026-25647](https://insights.sbomify.com/CVE-2026-25647/): Lute has a Stored Cross-Site Scripting (XSS) via Markdown hyperlink (medium 4.6)
- [CVE-2026-25646](https://insights.sbomify.com/CVE-2026-25646/): LIBPNG has a heap buffer overflow in png_set_quantize (high 8.3)
- [CVE-2026-25645](https://insights.sbomify.com/CVE-2026-25645/): Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function (medium 4.4)
- [CVE-2026-25644](https://insights.sbomify.com/CVE-2026-25644/): DataHub's LDAP Ingestion Source vulnerable to MITM attack through TLS downgrade (high 7.5)
- [CVE-2026-25643](https://insights.sbomify.com/CVE-2026-25643/): Frigate Affected by Authenticated Remote Command Execution (RCE) and Container Escape (critical 9.1)
- [CVE-2026-25642](https://insights.sbomify.com/CVE-2026-25642/): HedgeDoc security headers for uploaded files were not working (medium 4.3)
- [CVE-2026-25641](https://insights.sbomify.com/CVE-2026-25641/): SandboxJS has a sandbox escape via TOCTOU bug on keys in property accesses (critical 10.0)
- [CVE-2026-25640](https://insights.sbomify.com/CVE-2026-25640/): Pydantic AI affected by Stored XSS via Path Traversal in Web UI CDN URL (high 7.1)
- [CVE-2026-2564](https://insights.sbomify.com/CVE-2026-2564/): Intelbras VIP 3260 Z IA OutsideCmd password recovery (critical 9.2)
- [CVE-2026-25639](https://insights.sbomify.com/CVE-2026-25639/): Axios affected by Denial of Service via __proto__ Key in mergeConfig (high 7.5)
- [CVE-2026-25638](https://insights.sbomify.com/CVE-2026-25638/): ImageMagick has memory leak in msl encoder (medium 5.3)
- [CVE-2026-25637](https://insights.sbomify.com/CVE-2026-25637/): ImageMagick: Possible memory leak in ASHLAR encoder (medium 5.3)
- [CVE-2026-25636](https://insights.sbomify.com/CVE-2026-25636/): calibre has a Path Traversal Leading to Arbitrary File Corruption and Code Execution (high 8.2)
- [CVE-2026-25635](https://insights.sbomify.com/CVE-2026-25635/): calibre has a Path Traversal Leading to Arbitrary File Write and Potential Code Execution (high 8.6)
- [CVE-2026-25634](https://insights.sbomify.com/CVE-2026-25634/): iccDEV memcpy-param-overlap in CIccTagMultiProcessElement::Apply() (high 7.8)
- [CVE-2026-25633](https://insights.sbomify.com/CVE-2026-25633/): Statamic's missing authorization allows access to assets (medium 4.3)
- [CVE-2026-25632](https://insights.sbomify.com/CVE-2026-25632/): EPyT-Flow has unsafe JSON deserialization (__type__) (critical 10.0)
- [CVE-2026-25631](https://insights.sbomify.com/CVE-2026-25631/): Domain allowlist bypass enables credential exfiltration (medium 5.3)
- [CVE-2026-2563](https://insights.sbomify.com/CVE-2026-2563/): JingDong JD Cloud Box AX6600 jdcapp_rpc controlDevice get_status privileges management (medium 5.3)
- [CVE-2026-25628](https://insights.sbomify.com/CVE-2026-25628/): Qdrant affected by arbitrary file write via `/logger` endpoint (high 8.6)
- [CVE-2026-25627](https://insights.sbomify.com/CVE-2026-25627/): nanomq: OOB Read / Crash (DoS) via Malformed MQTT Remaining Length over WebSocket (medium 6.5)
- [CVE-2026-25624](https://insights.sbomify.com/CVE-2026-25624/): Arista Edge Threat Management NGFW UI Administrative Cross-Site Scripting (medium 5.8)
- [CVE-2026-25623](https://insights.sbomify.com/CVE-2026-25623/): Arista Edge Threat Management NGFW UI Arbitrary Command Execution (high 7.0)
- [CVE-2026-25622](https://insights.sbomify.com/CVE-2026-25622/): Arista Edge Threat Management NGFW Captive Portal Custom Handler Command Injection (high 7.0)
- [CVE-2026-25621](https://insights.sbomify.com/CVE-2026-25621/): Arista Edge Threat Management NGFW Reports Application Insecure Input Validation (high 7.0)
- [CVE-2026-25620](https://insights.sbomify.com/CVE-2026-25620/): Arista Edge Threat Management NGFW Captive Portal Encrypted Password Command Injection (high 7.0)
- [CVE-2026-2562](https://insights.sbomify.com/CVE-2026-2562/): JingDong JD Cloud Box AX6600 jdcweb_rpc jdcapi cast_streen privileges management (medium 5.3)
- [CVE-2026-25616](https://insights.sbomify.com/CVE-2026-25616/): Cross-site scripting in Blesta (medium 4.7)
- [CVE-2026-25615](https://insights.sbomify.com/CVE-2026-25615/): Deserialization in Blesta (high 7.2)
- [CVE-2026-25614](https://insights.sbomify.com/CVE-2026-25614/): Deserialization in Blesta (high 7.5)
- [CVE-2026-25613](https://insights.sbomify.com/CVE-2026-25613/): An unsafe cast in the MongoDB query planner can result in a segmentation fault. (high 7.1)
- [CVE-2026-25612](https://insights.sbomify.com/CVE-2026-25612/): Internal ResourceId collision may affect unrelated collections (high 7.1)
- [CVE-2026-25611](https://insights.sbomify.com/CVE-2026-25611/): Pre-Authentication Memory Exhaustion Denial of Service in MongoDB Server (high 8.7)
- [CVE-2026-25610](https://insights.sbomify.com/CVE-2026-25610/): Invalid $geoNear index hint may cause server crash (high 7.1)
- [CVE-2026-2561](https://insights.sbomify.com/CVE-2026-2561/): JingDong JD Cloud Box AX6600 jdcweb_rpc jdcapi web_get_ddns_uptime privileges management (medium 5.3)
- [CVE-2026-25609](https://insights.sbomify.com/CVE-2026-25609/): profile command may permit unauthorized configuration (medium 5.3)
- [CVE-2026-25608](https://insights.sbomify.com/CVE-2026-25608/): Lack of traffic encryption in STER (low 2.3)
- [CVE-2026-25607](https://insights.sbomify.com/CVE-2026-25607/): Weak password encoding in STER (medium 5.7)
- [CVE-2026-25606](https://insights.sbomify.com/CVE-2026-25606/): SQL Injection in STER (high 8.7)
- [CVE-2026-25605](https://insights.sbomify.com/CVE-2026-25605/): Path traversal in SICAM SIAPP SDK (medium 5.9)
- [CVE-2026-25604](https://insights.sbomify.com/CVE-2026-25604/): Apache Airflow AWS Auth Manager - Host Header Injection Leading to SAML Authentication Bypass (medium 5.4)
- [CVE-2026-25603](https://insights.sbomify.com/CVE-2026-25603/): Path Traversal vulnerability in Linksys MR9600, Linksys MX4200 (medium 6.6)
- [CVE-2026-25602](https://insights.sbomify.com/CVE-2026-25602/): Other in Meona Client (low 2.3)
- [CVE-2026-25601](https://insights.sbomify.com/CVE-2026-25601/): Credential Exposure vulnerability in MEPIS RM (medium 6.4)
- [CVE-2026-25600](https://insights.sbomify.com/CVE-2026-25600/): Credential Exposure Vulnerability in Trac PDBM (medium 6.4)
- [CVE-2026-2560](https://insights.sbomify.com/CVE-2026-2560/): kalcaddle kodbox Media File Preview Plugin VideoResize.class.php run os command injection (medium 5.3)
- [CVE-2026-25599](https://insights.sbomify.com/CVE-2026-25599/): Missing authentication and clear‑text data transmission affecting Orca heat pumps (medium 6.3)
- [CVE-2026-25598](https://insights.sbomify.com/CVE-2026-25598/): Bypassing Logging of Outbound Connections Using sendto, sendmsg, and sendmmsg in Harden-Runner (Community Tier) (medium 6.3)
- [CVE-2026-25597](https://insights.sbomify.com/CVE-2026-25597/): PrestaShop has a time based enumeration in FO login form (medium 5.3)
- [CVE-2026-25596](https://insights.sbomify.com/CVE-2026-25596/): InvoicePlane has Stored XSS via Product Unit Name in Invoice Item List (medium 4.8)
- [CVE-2026-25595](https://insights.sbomify.com/CVE-2026-25595/): InvoicePlane has Stored XSS via Invoice Number in Invoice View and Dashboard (medium 4.8)
- [CVE-2026-25594](https://insights.sbomify.com/CVE-2026-25594/): InvoicePlane has Stored XSS via Family Name in Product Form (medium 4.8)
- [CVE-2026-25593](https://insights.sbomify.com/CVE-2026-25593/): OpenClaw Affected by Unauthenticated Local RCE via WebSocket config.apply (high 8.4)
- [CVE-2026-25592](https://insights.sbomify.com/CVE-2026-25592/): Semantic Kernel has an Arbitrary File Write via AI Agent Function Calling in .NET SDK (critical 10.0)
- [CVE-2026-25591](https://insights.sbomify.com/CVE-2026-25591/): New API has an SQL LIKE Wildcard Injection DoS via Token Search (high 7.1)
- [CVE-2026-25590](https://insights.sbomify.com/CVE-2026-25590/): GLPI Inventory Plugin has Reflected XSS in task jobs (medium 4.5)
- [CVE-2026-2559](https://insights.sbomify.com/CVE-2026-2559/): Post SMTP <= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Office 365 OAuth Configuration Overwrite (medium 5.3)
- [CVE-2026-25589](https://insights.sbomify.com/CVE-2026-25589/): RedisBloom RESTORE invalid memory access may allow remote code execution (high 7.7)
- [CVE-2026-25588](https://insights.sbomify.com/CVE-2026-25588/): RedisTimeSeries RESTORE invalid memory access may allow remote code execution (high 7.7)
- [CVE-2026-25587](https://insights.sbomify.com/CVE-2026-25587/): SandboxJS has a Sandbox Escape (critical 10.0)
- [CVE-2026-25586](https://insights.sbomify.com/CVE-2026-25586/): SandboxJS has a Sandbox Escape via Prototype Whitelist Bypass and Host Prototype Pollution (critical 10.0)
- [CVE-2026-25585](https://insights.sbomify.com/CVE-2026-25585/): iccDEV vulnerable to OOB in CIccXform3DLut::Apply() (high 7.8)
- [CVE-2026-25584](https://insights.sbomify.com/CVE-2026-25584/): iccDEV vulnerable to Stack-based Buffer Overflow in CIccTagFloatNum::GetValues() (high 7.8)
- [CVE-2026-25583](https://insights.sbomify.com/CVE-2026-25583/): iccDEV vulnerable to Heap Buffer Overflow in CIccFileIO::Read8() (high 7.8)
- [CVE-2026-25582](https://insights.sbomify.com/CVE-2026-25582/): iccDEV vulnerable to Heap Buffer Overflow in CIccIO::WriteUInt16Float() (high 7.8)
- [CVE-2026-25581](https://insights.sbomify.com/CVE-2026-25581/): SCEditor affected by DOM XSS via emoticon URL/HTML injection (medium 5.4)
- [CVE-2026-25580](https://insights.sbomify.com/CVE-2026-25580/): Pydantic AI Affected by Server-Side Request Forgery (SSRF) in URL Download Handling (high 8.6)
- [CVE-2026-2558](https://insights.sbomify.com/CVE-2026-2558/): GeekAI net_handler.go Download server-side request forgery (medium 5.3)
- [CVE-2026-25579](https://insights.sbomify.com/CVE-2026-25579/): Navidrome affected by Denial of Service and disk exhaustion via oversized `size` parameter in `/rest/getCoverArt` and `/share/img/<token>` endpoints (critical 9.2)
- [CVE-2026-25578](https://insights.sbomify.com/CVE-2026-25578/): Navidrome is vulnerable to XSS via comment from song metadata (medium 6.1)
- [CVE-2026-25577](https://insights.sbomify.com/CVE-2026-25577/): Emmett has an Unhandled CookieError Exception Causing Denial of Service (high 7.5)
- [CVE-2026-25576](https://insights.sbomify.com/CVE-2026-25576/): ImageMagick: Out of bounds read in multiple coders read raw pixel data (medium 5.1)
- [CVE-2026-25575](https://insights.sbomify.com/CVE-2026-25575/): NavigaTUM has a Path Traversal Vulnerability in the propose_edits functionality (high 8.8)
- [CVE-2026-25574](https://insights.sbomify.com/CVE-2026-25574/): Payload Affected by Cross-Collection IDOR in payload-preferences Access Control (Multi-Auth Environments) (medium 5.4)
- [CVE-2026-25573](https://insights.sbomify.com/CVE-2026-25573/): Command injection in SICAM SIAPP SDK (high 8.6)
- [CVE-2026-25572](https://insights.sbomify.com/CVE-2026-25572/): Memory corruption in SICAM SIAPP SDK (medium 5.9)
- [CVE-2026-25571](https://insights.sbomify.com/CVE-2026-25571/): Memory corruption in SICAM SIAPP SDK (medium 5.9)
- [CVE-2026-25570](https://insights.sbomify.com/CVE-2026-25570/): Memory corruption in SICAM SIAPP SDK (high 7.5)
- [CVE-2026-2557](https://insights.sbomify.com/CVE-2026-2557/): cskefu File Upload MediaController.java upload cross site scripting (medium 5.1)
- [CVE-2026-25569](https://insights.sbomify.com/CVE-2026-25569/): Memory corruption in SICAM SIAPP SDK (high 7.5)
- [CVE-2026-25568](https://insights.sbomify.com/CVE-2026-25568/): WeKan < 8.19 allowPrivateOnly Setting Enforcement Bypass (high 7.1)
- [CVE-2026-25567](https://insights.sbomify.com/CVE-2026-25567/): WeKan < 8.19 Card Comment Author Spoofing via User-controlled authorId (medium 5.3)
- [CVE-2026-25566](https://insights.sbomify.com/CVE-2026-25566/): WeKan < 8.19 Cross-board Card Move Without Destination Authorization (high 7.1)
- [CVE-2026-25565](https://insights.sbomify.com/CVE-2026-25565/): WeKan < 8.19 Read-only Board Roles Can Update Cards (high 7.1)
- [CVE-2026-25564](https://insights.sbomify.com/CVE-2026-25564/): WeKan < 8.19 Checklist Deletion IDOR via Missing Relationship Validation (high 7.1)
- [CVE-2026-25563](https://insights.sbomify.com/CVE-2026-25563/): WeKan < 8.19 Checklist Creation Cross-Board IDOR (high 7.1)
- [CVE-2026-25562](https://insights.sbomify.com/CVE-2026-25562/): WeKan < 8.19 Attachments Publication Information Disclosure (medium 5.3)
- [CVE-2026-25561](https://insights.sbomify.com/CVE-2026-25561/): WeKan < 8.19 Attachment Upload Object Relationship Validation Bypass (high 7.1)
- [CVE-2026-25560](https://insights.sbomify.com/CVE-2026-25560/): WeKan < 8.19 LDAP Authentication Filter Injection (high 8.7)
- [CVE-2026-2556](https://insights.sbomify.com/CVE-2026-2556/): cskefu Endpoint MediaController.java server-side request forgery (medium 5.3)
- [CVE-2026-25559](https://insights.sbomify.com/CVE-2026-25559/): OpenBullet2 0.3.2 Path Traversal via Wordlist Endpoint (high 8.7)
- [CVE-2026-25558](https://insights.sbomify.com/CVE-2026-25558/): QloApps 1.7.0 Stored XSS via SVG File Upload in Admin File Manager (medium 4.8)
- [CVE-2026-25557](https://insights.sbomify.com/CVE-2026-25557/): Evoluted PHP Directory Listing Script 4.0.5 Reflected XSS via dir parameter (medium 5.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/768/