# Vulnerabilities published in 2026


- [CVE-2026-25155](https://insights.sbomify.com/CVE-2026-25155/): Qwik City CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form-data) (medium 5.9)
- [CVE-2026-25154](https://insights.sbomify.com/CVE-2026-25154/): LocalSend has Stored XSS in Web Share Interface via Filename (medium 6.1)
- [CVE-2026-25153](https://insights.sbomify.com/CVE-2026-25153/): @backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooks (high 7.7)
- [CVE-2026-25152](https://insights.sbomify.com/CVE-2026-25152/): @backstage/plugin-techdocs-node vulnerable to possible Path Traversal in TechDocs Local Generator (medium 5.3)
- [CVE-2026-25151](https://insights.sbomify.com/CVE-2026-25151/): Qwik City has a CSRF Protection Bypass via Content-Type Header Validation (medium 5.9)
- [CVE-2026-25150](https://insights.sbomify.com/CVE-2026-25150/): Prototype Pollution via FormData Processing in Qwik City (critical 9.3)
- [CVE-2026-2515](https://insights.sbomify.com/CVE-2026-2515/): Hostinger Reach <= 1.3.8 - Missing Authorization to Authenticated (Subscriber+) Integration API Key Update (medium 5.3)
- [CVE-2026-25149](https://insights.sbomify.com/CVE-2026-25149/): Qwik City Open Redirect via fixTrailingSlash (low 2.7)
- [CVE-2026-25148](https://insights.sbomify.com/CVE-2026-25148/): Qwik SSR XSS via Unsafe Virtual Node Serialization (medium 5.3)
- [CVE-2026-25147](https://insights.sbomify.com/CVE-2026-25147/): OpenEMR's Portal Payment Endpoint Trusts User-Controlled pid (high 7.1)
- [CVE-2026-25146](https://insights.sbomify.com/CVE-2026-25146/): OpenEMR's payments gateway_api_key secret rendered into client JS code (critical 9.6)
- [CVE-2026-25145](https://insights.sbomify.com/CVE-2026-25145/): melange has a path traversal in license-path which allows reading files outside workspace (medium 5.5)
- [CVE-2026-25144](https://insights.sbomify.com/CVE-2026-25144/): Talishar has a Stored XSS which can lead to data exfiltration & user impersonation (medium 5.3)
- [CVE-2026-25143](https://insights.sbomify.com/CVE-2026-25143/): melange affected by potential host command execution via license-check YAML mode patch pipeline (high 7.8)
- [CVE-2026-25142](https://insights.sbomify.com/CVE-2026-25142/): SandboxJS Prototype Pollution -> Sandbox Escape -> RCE (critical 10.0)
- [CVE-2026-25141](https://insights.sbomify.com/CVE-2026-25141/): Orval has a code injection via unsanitized x-enum-descriptions uing JS comments (critical 9.3)
- [CVE-2026-25140](https://insights.sbomify.com/CVE-2026-25140/): apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams (high 7.5)
- [CVE-2026-2514](https://insights.sbomify.com/CVE-2026-2514/): Possibility of unintended actions when viewing maliciously crafted network data in Progress Flowmon ADS web application (high 8.6)
- [CVE-2026-25139](https://insights.sbomify.com/CVE-2026-25139/): RIOT Vulnerable to Multiple Out-of-Bounds Read When Processing Received 6LoWPAN SFR Fragments (high 8.7)
- [CVE-2026-25138](https://insights.sbomify.com/CVE-2026-25138/): Rucio WebUI has Username Enumeration via Login Error Message (medium 5.3)
- [CVE-2026-25137](https://insights.sbomify.com/CVE-2026-25137/): NixOs Odoo database and filestore publicly accessible with default odoo configuration (critical 9.1)
- [CVE-2026-25136](https://insights.sbomify.com/CVE-2026-25136/): Rucio WebUI has a Reflected Cross-site Scripting Vulnerability (high 8.1)
- [CVE-2026-25135](https://insights.sbomify.com/CVE-2026-25135/): OpenEMR's location resource for Group.$export operation returns entire patient/user population contact information (medium 4.5)
- [CVE-2026-25134](https://insights.sbomify.com/CVE-2026-25134/): Group-Office Argument Injection in MaintenanceController::actionZipLanguage (critical 9.4)
- [CVE-2026-25133](https://insights.sbomify.com/CVE-2026-25133/): October CMS has Stored XSS via SVG Filter Bypass (medium 4.8)
- [CVE-2026-25131](https://insights.sbomify.com/CVE-2026-25131/): OpenEMR has Broken Access Control in Procedures Configuration (high 8.8)
- [CVE-2026-25130](https://insights.sbomify.com/CVE-2026-25130/): Cybersecurity AI vulnerable to command Injection through argument injection in find_file Agent tool (critical 9.7)
- [CVE-2026-2513](https://insights.sbomify.com/CVE-2026-2513/): Cross-site scripting in Flowmon ADS (high 8.6)
- [CVE-2026-25129](https://insights.sbomify.com/CVE-2026-25129/): PsySH has Local Privilege Escalation via CWD .psysh.php auto-load (medium 6.7)
- [CVE-2026-25128](https://insights.sbomify.com/CVE-2026-25128/): fast-xml-parser has RangeError DoS Numeric Entities Bug (high 7.5)
- [CVE-2026-25127](https://insights.sbomify.com/CVE-2026-25127/): OpenEMR has Broken Access Control on Care Coordination Module (high 7.0)
- [CVE-2026-25126](https://insights.sbomify.com/CVE-2026-25126/): PolarLearn's unvalidated vote direction allows vote count manipulation (high 7.1)
- [CVE-2026-25125](https://insights.sbomify.com/CVE-2026-25125/): October CMS: Environment Variable Exfiltration via INI Parser Interpolation (medium 4.9)
- [CVE-2026-25124](https://insights.sbomify.com/CVE-2026-25124/): OpenEMR has Broken Access Control in Report/Clients/Message List CSV Export (medium 6.5)
- [CVE-2026-25123](https://insights.sbomify.com/CVE-2026-25123/): Homarr affected by Unauthenticated SSRF / Port-Scan Primitive via widget.app.ping (medium 5.3)
- [CVE-2026-25122](https://insights.sbomify.com/CVE-2026-25122/): apko is vulnerable to unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams (medium 5.5)
- [CVE-2026-25121](https://insights.sbomify.com/CVE-2026-25121/): apko is vulnerable to path traversal in apko dirFS which allows filesystem writes outside base (high 7.5)
- [CVE-2026-25120](https://insights.sbomify.com/CVE-2026-25120/): Gogs Allows Cross-Repository Comment Deletion via DeleteComment (medium 5.1)
- [CVE-2026-2512](https://insights.sbomify.com/CVE-2026-2512/): Code Embed <= 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Fields (medium 6.4)
- [CVE-2026-25119](https://insights.sbomify.com/CVE-2026-25119/): Gogs: Authentication Bypass via Unvalidated Reverse Proxy Headers (high 7.7)
- [CVE-2026-25118](https://insights.sbomify.com/CVE-2026-25118/): Information disclosure in immich (medium 6.3)
- [CVE-2026-25117](https://insights.sbomify.com/CVE-2026-25117/): pwn.college DOJO vulnerable to sandbox escape leading to arbitrary javascript execution (high 8.3)
- [CVE-2026-25116](https://insights.sbomify.com/CVE-2026-25116/): Runtipi vulnerable to unauthenticated docker-compose.yml Overwrite via Path Traversal (high 7.6)
- [CVE-2026-25115](https://insights.sbomify.com/CVE-2026-25115/): n8n is vulnerable to Python sandbox escape (critical 9.4)
- [CVE-2026-25114](https://insights.sbomify.com/CVE-2026-25114/): CloudCharge cloudcharge.se Improper Restriction of Excessive Authentication Attempts (high 8.7)
- [CVE-2026-25113](https://insights.sbomify.com/CVE-2026-25113/): SWITCH EV swtchenergy.com Improper Restriction of Excessive Authentication Attempts (high 8.7)
- [CVE-2026-25112](https://insights.sbomify.com/CVE-2026-25112/): Privilege escalation in Genetec Airport Operational Manager (high 7.8)
- [CVE-2026-25111](https://insights.sbomify.com/CVE-2026-25111/): Copeland XWEB and XWEB Pro OS Command Injection (high 8.0)
- [CVE-2026-25110](https://insights.sbomify.com/CVE-2026-25110/): Sensors_medical_sensor has a NULL pointer dereference vulnerability (low 3.3)
- [CVE-2026-2511](https://insights.sbomify.com/CVE-2026-2511/): SQL injection in JS Help Desk – AI-Powered Support & Ticketing System (high 7.5)
- [CVE-2026-25109](https://insights.sbomify.com/CVE-2026-25109/): Copeland XWEB and XWEB Pro OS Command Injection (high 8.0)
- [CVE-2026-25108](https://insights.sbomify.com/CVE-2026-25108/): Soliton Systems K.K FileZen OS Command Injection (high 8.7, exploited in the wild)
- [CVE-2026-25107](https://insights.sbomify.com/CVE-2026-25107/): Hardcoded credentials in WRC-X1800GS-B (medium 6.9)
- [CVE-2026-25105](https://insights.sbomify.com/CVE-2026-25105/): Copeland XWEB and XWEB Pro OS Command Injection (high 8.0)
- [CVE-2026-25104](https://insights.sbomify.com/CVE-2026-25104/): Memory corruption in MediaInfoLib (high 7.8)
- [CVE-2026-25101](https://insights.sbomify.com/CVE-2026-25101/): Session Fixation in Bludit (medium 4.8)
- [CVE-2026-25100](https://insights.sbomify.com/CVE-2026-25100/): Stored XSS via SVG File Upload in Bludit (medium 4.8)
- [CVE-2026-25099](https://insights.sbomify.com/CVE-2026-25099/): Remote Code Execution via Unrestricted File Upload in Bludit (high 8.7)
- [CVE-2026-2509](https://insights.sbomify.com/CVE-2026-2509/): Cross-site scripting in Page Builder: Pagelayer – Drag and Drop website builder (medium 6.4)
- [CVE-2026-25089](https://insights.sbomify.com/CVE-2026-25089/): Fortinet FortiSandbox OS Command Injection (critical 9.1, exploited in the wild)
- [CVE-2026-25088](https://insights.sbomify.com/CVE-2026-25088/): SQL injection in FortiNDR (medium 5.1)
- [CVE-2026-25087](https://insights.sbomify.com/CVE-2026-25087/): Apache Arrow: Potential use-after-free when reading IPC file with pre-buffering (high 7.0)
- [CVE-2026-25086](https://insights.sbomify.com/CVE-2026-25086/): Automated Logic WebCTRL Premium Server Multiple Binds to the Same Port (high 7.7)
- [CVE-2026-25085](https://insights.sbomify.com/CVE-2026-25085/): Copeland XWEB and XWEB Pro Unexpected Status Code or Return Value (high 8.6)
- [CVE-2026-25084](https://insights.sbomify.com/CVE-2026-25084/): ZLAN Information Technology ZLAN5143D Missing Authentication for Critical Function (critical 9.3)
- [CVE-2026-25083](https://insights.sbomify.com/CVE-2026-25083/): Missing authorization in GROWI (high 8.7)
- [CVE-2026-2508](https://insights.sbomify.com/CVE-2026-2508/): Gravity Forms Booking <= 2.7.1 - Authenticated (Subscriber+) Time-Based SQL Injection via 'staff_id' (medium 6.5)
- [CVE-2026-25077](https://insights.sbomify.com/CVE-2026-25077/): Apache CloudStack: Unauthenticated Command Injection in Direct Download Templates (high 8.8)
- [CVE-2026-25076](https://insights.sbomify.com/CVE-2026-25076/): Anchore Enterprise GraphQL Reports API SQL injection (high 8.5)
- [CVE-2026-25075](https://insights.sbomify.com/CVE-2026-25075/): strongSwan 4.5.0 < 6.0.5 EAP-TTLS AVP Parsing Integer Underflow (high 8.7)
- [CVE-2026-25073](https://insights.sbomify.com/CVE-2026-25073/): XikeStor SKS8310-8X Stored XSS via System Name (medium 5.1)
- [CVE-2026-25072](https://insights.sbomify.com/CVE-2026-25072/): XikeStor SKS8310-8X Predictable Session Identifiers (high 8.6)
- [CVE-2026-25071](https://insights.sbomify.com/CVE-2026-25071/): XikeStor SKS8310-8X switch_config.src Missing Authentication (high 8.7)
- [CVE-2026-25070](https://insights.sbomify.com/CVE-2026-25070/): XikeStor SKS8310-8X PingTestSet Command Injection (critical 9.3)
- [CVE-2026-2507](https://insights.sbomify.com/CVE-2026-2507/): BIG-IP TMM Vulnerability (high 8.7)
- [CVE-2026-25069](https://insights.sbomify.com/CVE-2026-25069/): SunFounder Pironman Dashboard <= 1.3.13 Path Traversal Arbitrary File Read/Deletion (critical 9.3)
- [CVE-2026-25068](https://insights.sbomify.com/CVE-2026-25068/): alsa-lib 1.2.15.2 Topology Decoder Heap-based Buffer Overflow (medium 4.6)
- [CVE-2026-25067](https://insights.sbomify.com/CVE-2026-25067/): SmarterTools SmarterMail < Build 9518 Unauthenticated background-of-the-day Path Coercion (medium 6.9)
- [CVE-2026-25063](https://insights.sbomify.com/CVE-2026-25063/): gradle-completion has a Bash command injection issue (high 8.3)
- [CVE-2026-25062](https://insights.sbomify.com/CVE-2026-25062/): Outline Affected an Arbitrary File Read via Path Traversal in JSON Import (medium 5.5)
- [CVE-2026-25061](https://insights.sbomify.com/CVE-2026-25061/): tcpflow has TIM Element OOB Write in wifipcap (medium 5.5)
- [CVE-2026-25060](https://insights.sbomify.com/CVE-2026-25060/): OpenList Insecure TLS Default Configuration (high 8.1)
- [CVE-2026-2506](https://insights.sbomify.com/CVE-2026-2506/): EM Cost Calculator <= 2.3.1 - Unauthenticated Stored Cross-Site Scripting via 'customer_name' (medium 6.1)
- [CVE-2026-25059](https://insights.sbomify.com/CVE-2026-25059/): OpenList affected by Path Traversal in file copy and remove handlers (high 8.8)
- [CVE-2026-25058](https://insights.sbomify.com/CVE-2026-25058/): Vexa's unauthenticated internal transcript endpoint exposed by default (high 7.5)
- [CVE-2026-25057](https://insights.sbomify.com/CVE-2026-25057/): Zip Slip in MarkUs config upload allowing RCE (critical 9.1)
- [CVE-2026-25056](https://insights.sbomify.com/CVE-2026-25056/): n8n Arbitrary File Write leading to RCE in n8n Merge Node (critical 9.4)
- [CVE-2026-25055](https://insights.sbomify.com/CVE-2026-25055/): n8n Arbitrary File Write on Remote Systems via SSH Node (high 7.1)
- [CVE-2026-25054](https://insights.sbomify.com/CVE-2026-25054/): n8n is Vulnerable to Stored Cross-Site Scripting via Markdown Rendering in Workflow UI (high 8.5)
- [CVE-2026-25053](https://insights.sbomify.com/CVE-2026-25053/): n8n is Vulnerable to OS Command Injection in Git Node (critical 9.4)
- [CVE-2026-25052](https://insights.sbomify.com/CVE-2026-25052/): n8n Improper File Access Controls Allow Arbitrary File Read by Authenticated Users (critical 9.4)
- [CVE-2026-25051](https://insights.sbomify.com/CVE-2026-25051/): n8n Improper CSP Enforcement in Webhook Responses May Allow Stored XSS (high 8.5)
- [CVE-2026-25050](https://insights.sbomify.com/CVE-2026-25050/): Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategy (low 2.7)
- [CVE-2026-2505](https://insights.sbomify.com/CVE-2026-2505/): Categories Images <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'z_taxonomy_image' Shortcode (medium 5.4)
- [CVE-2026-25049](https://insights.sbomify.com/CVE-2026-25049/): n8n Has an Expression Escape Vulnerability Leading to RCE (critical 9.4)
- [CVE-2026-25048](https://insights.sbomify.com/CVE-2026-25048/): xgrammar: Multi-layer nesting causes DoS (high 8.7)
- [CVE-2026-25047](https://insights.sbomify.com/CVE-2026-25047/): deepHas vulnerable to Prototype Pollution via constructor.prototype (critical 9.4)
- [CVE-2026-25046](https://insights.sbomify.com/CVE-2026-25046/): [Kimi VS Code] Command Injection in publish scripts vsix-publish.js and ovsx-publish.js (low 2.9)
- [CVE-2026-25045](https://insights.sbomify.com/CVE-2026-25045/): Budibase Critical Privilege Escalation & IDOR via Missing RBAC on User Role Management (Creator-Role) (high 8.7)
- [CVE-2026-25044](https://insights.sbomify.com/CVE-2026-25044/): Budibase: Command Injection in Bash Automation Step (high 8.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/773/