# Vulnerabilities published in 2026


- [CVE-2026-25556](https://insights.sbomify.com/CVE-2026-25556/): MuPDF 1.23.0 through 1.27.0 Barcode Decoding Double Free (medium 5.9)
- [CVE-2026-25555](https://insights.sbomify.com/CVE-2026-25555/): OpenBullet2 0.3.2 Authentication Bypass via X-Api-Key Header (critical 9.3)
- [CVE-2026-25554](https://insights.sbomify.com/CVE-2026-25554/): OpenSIPS 3.1 <= 3.6.4 auth_jwt SQL Injection Enables JWT Authentication Bypass (high 8.3)
- [CVE-2026-25552](https://insights.sbomify.com/CVE-2026-25552/): Ghost CLI < 1.30.1 IP Spoofing via X-Forwarded-For Header (medium 6.3)
- [CVE-2026-25551](https://insights.sbomify.com/CVE-2026-25551/): Seagull Software BarTender Deserialization Privilege Escalation via .NET Remoting Service (high 8.5)
- [CVE-2026-25550](https://insights.sbomify.com/CVE-2026-25550/): Seagull Software BarTender Unauthenticated RCE via .NET Remoting Service (critical 9.3)
- [CVE-2026-2555](https://insights.sbomify.com/CVE-2026-2555/): JeecgBoot Retrieval-Augmented Generation AiragKnowledgeController.java importDocumentFromZip deserialization (low 2.3)
- [CVE-2026-25548](https://insights.sbomify.com/CVE-2026-25548/): InvoicePlane Vulnerable to Remote Code Execution via Local File Inclusion and Log Poisoning (critical 9.1)
- [CVE-2026-25547](https://insights.sbomify.com/CVE-2026-25547/): Uncontrolled Resource Consumption in @isaacs/brace-expansion (critical 9.2)
- [CVE-2026-25546](https://insights.sbomify.com/CVE-2026-25546/): Godot MCP is vulnerable to Command Injection via unsanitized projectPath (high 7.8)
- [CVE-2026-25545](https://insights.sbomify.com/CVE-2026-25545/): Astro has Full-Read SSRF in error rendering via Host: header injection (medium 6.9)
- [CVE-2026-25544](https://insights.sbomify.com/CVE-2026-25544/): Payload has an SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters (critical 9.8)
- [CVE-2026-25543](https://insights.sbomify.com/CVE-2026-25543/): HtmlSanitizer has a bypass via template tag (medium 6.3)
- [CVE-2026-25542](https://insights.sbomify.com/CVE-2026-25542/): Tekton Pipelines: VerificationPolicy regex pattern bypass via substring matching (medium 6.5)
- [CVE-2026-25541](https://insights.sbomify.com/CVE-2026-25541/): Bytes is vulnerable to integer overflow in BytesMut::reserve (medium 5.5)
- [CVE-2026-25540](https://insights.sbomify.com/CVE-2026-25540/): Information disclosure in mastodon (medium 6.5)
- [CVE-2026-2554](https://insights.sbomify.com/CVE-2026-2554/): Missing authorization in WCFM – Frontend Manager for WooCommerce (high 8.1)
- [CVE-2026-25539](https://insights.sbomify.com/CVE-2026-25539/): SiYuan has Arbitrary File Write via /api/file/copyFile leading to RCE (critical 9.1)
- [CVE-2026-25538](https://insights.sbomify.com/CVE-2026-25538/): Devtron Attributes API Unauthorized Access Leading to API Token Signing Key Leakage (high 8.7)
- [CVE-2026-25537](https://insights.sbomify.com/CVE-2026-25537/): jsonwebtoken has Type Confusion that leads to potential authorization bypass (medium 5.5)
- [CVE-2026-25536](https://insights.sbomify.com/CVE-2026-25536/): @modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse (high 7.1)
- [CVE-2026-25535](https://insights.sbomify.com/CVE-2026-25535/): jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions (high 8.7)
- [CVE-2026-25534](https://insights.sbomify.com/CVE-2026-25534/): Spinnaker clouddriver and orca URL validation bypass via underscores in hostnames (critical 9.1)
- [CVE-2026-25533](https://insights.sbomify.com/CVE-2026-25533/): Enclave has a sandbox escape via infinite recursion and error objects (medium 6.4)
- [CVE-2026-25532](https://insights.sbomify.com/CVE-2026-25532/): ESF-IDF is Vulnerable to WPS Enrollee Fragment Integer Underflow (medium 6.3)
- [CVE-2026-25531](https://insights.sbomify.com/CVE-2026-25531/): Kanboard TaskCreationController::duplicateProjects() endpoint does not validate user permissions for target projects (medium 4.3)
- [CVE-2026-25530](https://insights.sbomify.com/CVE-2026-25530/): Kanboard is missing authorization check in getSwimlane API allows cross-project data access (medium 4.3)
- [CVE-2026-2553](https://insights.sbomify.com/CVE-2026-2553/): tushar-2223 Hotel-Management-System HTTP POST Request home.php sql injection (medium 5.3)
- [CVE-2026-25529](https://insights.sbomify.com/CVE-2026-25529/): Postal has HTML injection / XSS in message view (high 8.1)
- [CVE-2026-25528](https://insights.sbomify.com/CVE-2026-25528/): LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection (medium 5.8)
- [CVE-2026-25527](https://insights.sbomify.com/CVE-2026-25527/): changedetection.io vulnerable to unauthenticated static path traversal (medium 5.3)
- [CVE-2026-25526](https://insights.sbomify.com/CVE-2026-25526/): JinJava Bypass through ForTag leads to Arbitrary Java Execution (critical 9.8)
- [CVE-2026-25525](https://insights.sbomify.com/CVE-2026-25525/): OpenMage LTS has Path Traversal Filter Bypass in Dataflow Module (medium 4.9)
- [CVE-2026-25524](https://insights.sbomify.com/CVE-2026-25524/): OpenMage LTS's Phar Deserialization leads to Remote Code Execution (high 8.1)
- [CVE-2026-25523](https://insights.sbomify.com/CVE-2026-25523/): Magento's X-Original-Url header can expose admin url (medium 5.3)
- [CVE-2026-25522](https://insights.sbomify.com/CVE-2026-25522/): Craft Commerce has Stored XSS in Shipping Zone (Name & Description) Fields Leading to Potential Privilege Escalation (medium 6.1)
- [CVE-2026-25521](https://insights.sbomify.com/CVE-2026-25521/): Locutus is vulnerable to Prototype Pollution (critical 9.4)
- [CVE-2026-25520](https://insights.sbomify.com/CVE-2026-25520/): SandboxJS has a Sandbox Escape (critical 10.0)
- [CVE-2026-2552](https://insights.sbomify.com/CVE-2026-2552/): ZenTao Editor control.php delete path traversal (medium 5.1)
- [CVE-2026-25519](https://insights.sbomify.com/CVE-2026-25519/): OpenSlides has incorrect access control vulnerability in authentication service (high 8.1)
- [CVE-2026-25518](https://insights.sbomify.com/CVE-2026-25518/): cert-manager-controller DoS via Specially Crafted DNS Response (medium 5.9)
- [CVE-2026-25517](https://insights.sbomify.com/CVE-2026-25517/): Wagtail has improper permission handling on admin preview endpoints (medium 5.1)
- [CVE-2026-25516](https://insights.sbomify.com/CVE-2026-25516/): NiceGUI's XSS vulnerability in ui.markdown() allows arbitrary JavaScript execution through unsanitized HTML content (medium 6.1)
- [CVE-2026-25514](https://insights.sbomify.com/CVE-2026-25514/): FacturaScripts has SQL Injection vulnerability in Autocomplete Actions (high 8.7)
- [CVE-2026-25513](https://insights.sbomify.com/CVE-2026-25513/): FacturaScripts has SQL Injection vulnerability in API ORDER BY Clause (high 8.3)
- [CVE-2026-25512](https://insights.sbomify.com/CVE-2026-25512/): Group-Office is vulnerable to RCE due to Command Injection via TNEF Attachment Handler (critical 9.4)
- [CVE-2026-25511](https://insights.sbomify.com/CVE-2026-25511/): Group-Office is vulnerable to SSRF and File Read in WOPI service discovery (high 8.2)
- [CVE-2026-25510](https://insights.sbomify.com/CVE-2026-25510/): CI4MS Vulnerable to Remote Code Execution (RCE) via Arbitrary File Creation and Save in File Editor (critical 10.0)
- [CVE-2026-2551](https://insights.sbomify.com/CVE-2026-2551/): ZenTao Backup control.php delete path traversal (medium 5.3)
- [CVE-2026-25509](https://insights.sbomify.com/CVE-2026-25509/): CI4MS Vulnerable to User Email Enumeration via Password Reset Flow (medium 5.3)
- [CVE-2026-25508](https://insights.sbomify.com/CVE-2026-25508/): ESF-IDF Has Memory Safety Vulnerabilities in BLE Provisioning (medium 6.3)
- [CVE-2026-25507](https://insights.sbomify.com/CVE-2026-25507/): ESF-IDF Has Use-after-free Vulnerability in BLE Provisioning (medium 6.3)
- [CVE-2026-25506](https://insights.sbomify.com/CVE-2026-25506/): MUNGE has a buffer overflow in message unpacking allows key leakage and credential forgery (high 7.7)
- [CVE-2026-25505](https://insights.sbomify.com/CVE-2026-25505/): Bambuddy Uses Hardcoded Secret Key + Many API Endpoints do not Require Authentication (critical 9.8)
- [CVE-2026-25503](https://insights.sbomify.com/CVE-2026-25503/): iccDEV Has Type Confusion in CIccTagEmbeddedHeightImage::Validate() (high 7.1)
- [CVE-2026-25502](https://insights.sbomify.com/CVE-2026-25502/): iccDEV is vulnerable to stack-buffer-overflow in icFixXml() (high 7.8)
- [CVE-2026-25501](https://insights.sbomify.com/CVE-2026-25501/): Null dereference in smf (medium 6.6)
- [CVE-2026-25500](https://insights.sbomify.com/CVE-2026-25500/): Rack's Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href (medium 5.4)
- [CVE-2026-2550](https://insights.sbomify.com/CVE-2026-2550/): EFM iptime A6004MX timepro.cgi commit_vpncli_file_upload unrestricted upload (critical 9.3)
- [CVE-2026-25499](https://insights.sbomify.com/CVE-2026-25499/): terraform-provider-proxmox has insecure sudo recommendation in the documentation (high 8.7)
- [CVE-2026-25498](https://insights.sbomify.com/CVE-2026-25498/): Craft has a potential authenticated Remote Code Execution via malicious attached Behavior (high 8.6)
- [CVE-2026-25497](https://insights.sbomify.com/CVE-2026-25497/): Craft has a GraphQL Asset Mutation Privilege Escalation (high 8.6)
- [CVE-2026-25496](https://insights.sbomify.com/CVE-2026-25496/): Craft has a stored XSS in Number Prefix & Suffix Fields (medium 4.8)
- [CVE-2026-25495](https://insights.sbomify.com/CVE-2026-25495/): Craft has a SQL Injection in Element Indexes via criteria[orderBy] (high 8.7)
- [CVE-2026-25494](https://insights.sbomify.com/CVE-2026-25494/): Craft has a SSRF in GraphQL Asset Mutation via Alternative IP Notation (medium 6.9)
- [CVE-2026-25493](https://insights.sbomify.com/CVE-2026-25493/): Craft has a SSRF in GraphQL Asset Mutation via HTTP Redirect (medium 6.9)
- [CVE-2026-25492](https://insights.sbomify.com/CVE-2026-25492/): Craft has a save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying host (medium 5.3)
- [CVE-2026-25491](https://insights.sbomify.com/CVE-2026-25491/): Craft has a Stored XSS in Entry Types Name (low 1.9)
- [CVE-2026-25490](https://insights.sbomify.com/CVE-2026-25490/): Craft Commerce has Stored XSS in Inventory Location Address Leading to Potential Privilege Escalation (medium 6.1)
- [CVE-2026-2549](https://insights.sbomify.com/CVE-2026-2549/): zhanghuanhao LibrarySystem 图书馆管理系统 BookController.java access control (medium 6.9)
- [CVE-2026-25489](https://insights.sbomify.com/CVE-2026-25489/): Craft Commerce has Stored XSS in Tax Zones (Name & Description) Leading to Potential Privilege Escalation (medium 6.1)
- [CVE-2026-25488](https://insights.sbomify.com/CVE-2026-25488/): Craft Commerce has Stored XSS in Tax Categories (Name & Description) Fields Leading to Potential Privilege Escalation (medium 6.1)
- [CVE-2026-25487](https://insights.sbomify.com/CVE-2026-25487/): Craft CMS has Stored XSS in Tax Rates Name Leading to Potential Privilege Escalation (medium 6.1)
- [CVE-2026-25486](https://insights.sbomify.com/CVE-2026-25486/): Craft Commerce has Stored XSS in Shipping Methods Name Field Leading to Potential Privilege Escalation (medium 6.1)
- [CVE-2026-25485](https://insights.sbomify.com/CVE-2026-25485/): Craft Commerce has Stored XSS in Shipping Categories (Name & Description) Fields Leading to Potential Privilege Escalation (medium 6.2)
- [CVE-2026-25484](https://insights.sbomify.com/CVE-2026-25484/): Craft Commerce has Stored XSS in Product Type Name (medium 4.8)
- [CVE-2026-25483](https://insights.sbomify.com/CVE-2026-25483/): Craft Commerce has Stored XSS via Order Status Message with potential database exfiltration (medium 6.2)
- [CVE-2026-25482](https://insights.sbomify.com/CVE-2026-25482/): Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget) (medium 6.2)
- [CVE-2026-25481](https://insights.sbomify.com/CVE-2026-25481/): Langroid has WAF Bypass Leading to RCE in TableChatAgent (critical 9.4)
- [CVE-2026-25480](https://insights.sbomify.com/CVE-2026-25480/): FileStore key canonicalization collisions allow response cache mixup/poisoning (ASCII ord + Unicode NFKD) (medium 6.5)
- [CVE-2026-2548](https://insights.sbomify.com/CVE-2026-2548/): WAYOS FBM-220G rc sub_40F820 command injection (medium 5.3)
- [CVE-2026-25479](https://insights.sbomify.com/CVE-2026-25479/): Litestar has an AllowedHosts validation bypass due to unescaped regex metacharacters in configured host patterns (medium 6.5)
- [CVE-2026-25478](https://insights.sbomify.com/CVE-2026-25478/): Litestar has a CORS origin allowlist bypass due to unescaped regex metacharacters in allowed origins (high 7.4)
- [CVE-2026-25477](https://insights.sbomify.com/CVE-2026-25477/): AFFiNE: Open Redirect via Regex Bypass in redirect-proxy (medium 6.9)
- [CVE-2026-25476](https://insights.sbomify.com/CVE-2026-25476/): OpenEMR has Session Timeout Bypass via skip_timeout_reset (high 7.5)
- [CVE-2026-25475](https://insights.sbomify.com/CVE-2026-25475/): OpenClaw Vulnerable to Local File Inclusion via MEDIA: Path Extraction (medium 6.5)
- [CVE-2026-25474](https://insights.sbomify.com/CVE-2026-25474/): OpenClaw has a Telegram webhook request forgery (missing `channels.telegram.webhookSecret`) → auth bypass (high 7.5)
- [CVE-2026-25473](https://insights.sbomify.com/CVE-2026-25473/): WordPress WZone plugin <= 14.0.31 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-25472](https://insights.sbomify.com/CVE-2026-25472/): WordPress Fusion Builder plugin <= 3.14.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-25471](https://insights.sbomify.com/CVE-2026-25471/): WordPress Admin Safety Guard plugin <= 1.2.6 - Broken Authentication vulnerability (high 8.1)
- [CVE-2026-25470](https://insights.sbomify.com/CVE-2026-25470/): Code injection in ACPT (Pro) - Custom Post Types Plugin for WordPress (critical 10.0)
- [CVE-2026-2547](https://insights.sbomify.com/CVE-2026-2547/): LigeroSmart index.pl AgentDashboard cross site scripting (medium 5.1)
- [CVE-2026-25469](https://insights.sbomify.com/CVE-2026-25469/): WordPress ViaBill – WooCommerce plugin <= 1.1.53 - Settings Change vulnerability (medium 6.5)
- [CVE-2026-25468](https://insights.sbomify.com/CVE-2026-25468/): WordPress Happy Addons for Elementor plugin <= 3.20.8 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-25467](https://insights.sbomify.com/CVE-2026-25467/): WordPress User Registration plugin <= 5.3.0 - Content Injection vulnerability (medium 5.3)
- [CVE-2026-25466](https://insights.sbomify.com/CVE-2026-25466/): WordPress WP Go Maps plugin <= 10.1.04 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-25465](https://insights.sbomify.com/CVE-2026-25465/): WordPress CP Multi View Event Calendar plugin <= 1.4.36 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-25464](https://insights.sbomify.com/CVE-2026-25464/): WordPress Jannah theme <= 7.6.4 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-25463](https://insights.sbomify.com/CVE-2026-25463/): WordPress Wpresidence Core plugin <= 5.4.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-25462](https://insights.sbomify.com/CVE-2026-25462/): WordPress avalex plugin <= 3.1.3 - Broken Access Control vulnerability (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/769/