# Vulnerabilities published in 2026


- [CVE-2026-10740](https://insights.sbomify.com/CVE-2026-10740/): Excessive memory allocation in s2n-quic (medium 6.9)
- [CVE-2026-1074](https://insights.sbomify.com/CVE-2026-1074/): WP App Bar <= 1.5 - Unauthenticated Stored Cross-Site Scripting via 'app-bar-features' Parameter (high 7.2)
- [CVE-2026-107399](https://insights.sbomify.com/CVE-2026-107399/): Mechanize sends credential headers to another origin after a meta refresh (medium 6.8)
- [CVE-2026-107397](https://insights.sbomify.com/CVE-2026-107397/): Indico: Cross-Site-Scripting in minutes editor (medium 4.4)
- [CVE-2026-107396](https://insights.sbomify.com/CVE-2026-107396/): Indico: Cross-Site-Scripting in link fields (medium 5.4)
- [CVE-2026-107395](https://insights.sbomify.com/CVE-2026-107395/): Indico: Missing access check in legacy session export API (medium 4.3)
- [CVE-2026-107394](https://insights.sbomify.com/CVE-2026-107394/): Indico: Incomplete Server-Side Request Forgery (SSRF) check (medium 6.8)
- [CVE-2026-107393](https://insights.sbomify.com/CVE-2026-107393/): FreeScout: Stored HTML Injection in Administrator Alert Emails via Spoofed CF-Connecting-IP Header (medium 6.1)
- [CVE-2026-107392](https://insights.sbomify.com/CVE-2026-107392/): music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of CVE-2026-32256) (medium 6.2)
- [CVE-2026-107391](https://insights.sbomify.com/CVE-2026-107391/): music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master (medium 6.2)
- [CVE-2026-107390](https://insights.sbomify.com/CVE-2026-107390/): music-metadata: MP4 parser allows memory exhaustion via oversized extended atom length (medium 6.2)
- [CVE-2026-10739](https://insights.sbomify.com/CVE-2026-10739/): Cato Networks SDP Client for Windows is vulnerable to Local Privilege Escalation (high 8.5)
- [CVE-2026-107389](https://insights.sbomify.com/CVE-2026-107389/): music-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abort (medium 6.2)
- [CVE-2026-107388](https://insights.sbomify.com/CVE-2026-107388/): music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS (medium 6.2)
- [CVE-2026-107387](https://insights.sbomify.com/CVE-2026-107387/): music-metadata: Uncontrolled memory allocation in APEv2 parser (medium 6.2)
- [CVE-2026-107386](https://insights.sbomify.com/CVE-2026-107386/): amqp091-go: Pre-negotiation frame limit is not enforced to 4KB (medium 6.3)
- [CVE-2026-107385](https://insights.sbomify.com/CVE-2026-107385/): MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES (high 7.4)
- [CVE-2026-107384](https://insights.sbomify.com/CVE-2026-107384/): MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries) (high 8.1)
- [CVE-2026-107383](https://insights.sbomify.com/CVE-2026-107383/): MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters (high 7.5)
- [CVE-2026-107382](https://insights.sbomify.com/CVE-2026-107382/): MariaDB Connector/Node.js: Uncaught exception crashes the client during ed25519 authentication with zero-configuration TLS (medium 5.9)
- [CVE-2026-107381](https://insights.sbomify.com/CVE-2026-107381/): svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences (medium 6.5)
- [CVE-2026-107380](https://insights.sbomify.com/CVE-2026-107380/): enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision (medium 5.4)
- [CVE-2026-10738](https://insights.sbomify.com/CVE-2026-10738/): Cross-site scripting in jQuery Hover Footnotes (medium 6.4)
- [CVE-2026-107379](https://insights.sbomify.com/CVE-2026-107379/): enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash (medium 6.5)
- [CVE-2026-107378](https://insights.sbomify.com/CVE-2026-107378/): CairoSVG: Quadratic-time DoS parsing a crafted SVG <path> (high 8.7)
- [CVE-2026-107377](https://insights.sbomify.com/CVE-2026-107377/): datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory (high 7.5)
- [CVE-2026-107376](https://insights.sbomify.com/CVE-2026-107376/): webonyx graphql-php: Unbounded recursion in parser causes stack overflow on crafted nested input (high 8.2)
- [CVE-2026-107375](https://insights.sbomify.com/CVE-2026-107375/): JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort (high 8.8)
- [CVE-2026-107373](https://insights.sbomify.com/CVE-2026-107373/): ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument. (critical 9.1)
- [CVE-2026-107371](https://insights.sbomify.com/CVE-2026-107371/): Missing Verification of auth_time Claim in auth0.js (medium 5.4)
- [CVE-2026-107370](https://insights.sbomify.com/CVE-2026-107370/): Improper Request Handling for Active Directory Logins in auth0-lock (medium 5.3)
- [CVE-2026-10737](https://insights.sbomify.com/CVE-2026-10737/): Missing authorization in SP Project & Document Manager (high 7.5)
- [CVE-2026-107369](https://insights.sbomify.com/CVE-2026-107369/): Improper Validation of Post-Login Redirect URL in nextjs-auth0 (medium 6.1)
- [CVE-2026-107366](https://insights.sbomify.com/CVE-2026-107366/): Langflow OSS Authorization Bypass Through User-Controlled Key (high 8.3)
- [CVE-2026-107363](https://insights.sbomify.com/CVE-2026-107363/): Missing authorization in Zaqar (medium 6.1)
- [CVE-2026-107362](https://insights.sbomify.com/CVE-2026-107362/): Server-Side Request Forgery in Malcolm (high 7.1)
- [CVE-2026-107361](https://insights.sbomify.com/CVE-2026-107361/): Authentication Bypass Using an Alternate Path or Channel in Malcolm (medium 4.2)
- [CVE-2026-10736](https://insights.sbomify.com/CVE-2026-10736/): Tutor LMS <= 3.9.11 - Authenticated (Administrator+) SQL Injection via 'data' Parameter (medium 4.9)
- [CVE-2026-107353](https://insights.sbomify.com/CVE-2026-107353/): traverse: set() can write to built-in prototypes via an untrusted path (medium 6.9)
- [CVE-2026-107352](https://insights.sbomify.com/CVE-2026-107352/): Missing authorization checks in Amazon Athena engine version 3 request handling (medium 6.3)
- [CVE-2026-107350](https://insights.sbomify.com/CVE-2026-107350/): Authentication bypass via second StartupMessage during SCRAM authentication in PgBouncer (high 8.8)
- [CVE-2026-10735](https://insights.sbomify.com/CVE-2026-10735/): ShapedPlugin Multiple Pro Plugins - Backdoor via Compromised Vendor Update Server (high 7.5)
- [CVE-2026-107349](https://insights.sbomify.com/CVE-2026-107349/): Infinite loop on empty option name in startup options parameter in PgBouncer (high 7.5)
- [CVE-2026-107348](https://insights.sbomify.com/CVE-2026-107348/): Integer overflow causes an infinite loop in message buffer growth in PgBouncer (medium 5.9)
- [CVE-2026-107347](https://insights.sbomify.com/CVE-2026-107347/): Nomad dispatch payload writes can escape the allocation directory through symlinks (high 8.4)
- [CVE-2026-10734](https://insights.sbomify.com/CVE-2026-10734/): Infility Global <= 2.15.21 - Unauthenticated Stored Cross-Site Scripting via /cf7_record Log Endpoint (high 7.2)
- [CVE-2026-107337](https://insights.sbomify.com/CVE-2026-107337/): Cross-Site Request Forgery in Malcolm (high 7.1)
- [CVE-2026-107336](https://insights.sbomify.com/CVE-2026-107336/): Authentication Bypass by Spoofing in Malcolm (medium 6.5)
- [CVE-2026-107335](https://insights.sbomify.com/CVE-2026-107335/): Improper Handling of Highly Compressed Data in Malcolm (medium 6.5)
- [CVE-2026-107334](https://insights.sbomify.com/CVE-2026-107334/): Incorrect Authorization in Malcolm (medium 5.4)
- [CVE-2026-107333](https://insights.sbomify.com/CVE-2026-107333/): Incorrect Authorization in Malcolm (high 8.1)
- [CVE-2026-107332](https://insights.sbomify.com/CVE-2026-107332/): Insecure Default File Permissions on Cached Credentials in AWS Toolkit for Visual Studio Code (medium 6.8)
- [CVE-2026-10733](https://insights.sbomify.com/CVE-2026-10733/): Improper Restriction of Rendered UI Layers or Frames in GitLab (medium 4.3)
- [CVE-2026-107329](https://insights.sbomify.com/CVE-2026-107329/): Langflow OSS is affected by multiple vulnerabilities (critical 9.9)
- [CVE-2026-107328](https://insights.sbomify.com/CVE-2026-107328/): Langflow OSS is affected by multiple vulnerabilities (critical 9.9)
- [CVE-2026-107327](https://insights.sbomify.com/CVE-2026-107327/): Langflow OSS is affected by multiple vulnerabilities (critical 9.9)
- [CVE-2026-107326](https://insights.sbomify.com/CVE-2026-107326/): Langflow OSS is affected by multiple vulnerabilities (high 8.8)
- [CVE-2026-107325](https://insights.sbomify.com/CVE-2026-107325/): Application denial of service via missing BSON array length validation in MongoDB Go Driver (high 8.2)
- [CVE-2026-107324](https://insights.sbomify.com/CVE-2026-107324/): Application denial of service via integer overflow in BSON value-length validation in MongoDB Go Driver (high 8.2)
- [CVE-2026-107323](https://insights.sbomify.com/CVE-2026-107323/): Gallery PhotoBlocks 1.3.5 - Contributor+ Stored XSS (medium 6.8)
- [CVE-2026-107322](https://insights.sbomify.com/CVE-2026-107322/): OS command injection in Amazon Agent Plugins for AWS databases-on-aws (high 8.5)
- [CVE-2026-107321](https://insights.sbomify.com/CVE-2026-107321/): W3 Total Cache < 2.10.6 - Author+ Path Traversal via CDN Media Library Import (medium 5.4)
- [CVE-2026-107320](https://insights.sbomify.com/CVE-2026-107320/): GamiPress 7.9.5 - 8.0.5 - Unauthenticated Private Activity Log Disclosure (medium 5.3)
- [CVE-2026-10732](https://insights.sbomify.com/CVE-2026-10732/): decompress: Arbitrary File Write via Archive Extraction (Zip Slip) (medium 6.1)
- [CVE-2026-107319](https://insights.sbomify.com/CVE-2026-107319/): GamiPress < 8.0.6 - Subscriber+ Activity Log Disclosure (medium 4.3)
- [CVE-2026-107318](https://insights.sbomify.com/CVE-2026-107318/): @fastify/reply-from vulnerable to improper certificate validation in built-in HTTPS transports (high 7.4)
- [CVE-2026-107315](https://insights.sbomify.com/CVE-2026-107315/): pgjdbc pads a value shorter than its declared length with bytes of earlier statements (rather than zeros) (medium 5.3)
- [CVE-2026-107314](https://insights.sbomify.com/CVE-2026-107314/): pgjdbc does not enforce requireAuth when the value excludes every authentication method (medium 5.9)
- [CVE-2026-107313](https://insights.sbomify.com/CVE-2026-107313/): pgjdbc stores bytes of earlier messages in place of a large value on GSS-encrypted connections (medium 4.2)
- [CVE-2026-10731](https://insights.sbomify.com/CVE-2026-10731/): SQL injection in Nemon products (critical 9.3)
- [CVE-2026-107305](https://insights.sbomify.com/CVE-2026-107305/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2026-107303](https://insights.sbomify.com/CVE-2026-107303/): JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin Blob (high 7.6)
- [CVE-2026-107302](https://insights.sbomify.com/CVE-2026-107302/): msgpack5: Truncated map32 headers throw an unexpected error (high 7.5)
- [CVE-2026-107301](https://insights.sbomify.com/CVE-2026-107301/): msgpack5: Partial options disable prototype protection (medium 6.5)
- [CVE-2026-107300](https://insights.sbomify.com/CVE-2026-107300/): msgpack5: Many buffered values can exhaust the streaming decoder stack (high 7.5)
- [CVE-2026-1073](https://insights.sbomify.com/CVE-2026-1073/): Purchase Button For Affiliate Link <= 1.0.2 - Cross-Site Request Forgery to Settings Update (medium 4.3)
- [CVE-2026-107299](https://insights.sbomify.com/CVE-2026-107299/): msgpack5: Reserved byte can cause unbounded stream buffering (medium 5.9)
- [CVE-2026-107298](https://insights.sbomify.com/CVE-2026-107298/): msgpack5: Deeply nested input can exhaust the decoder stack (medium 5.3)
- [CVE-2026-107297](https://insights.sbomify.com/CVE-2026-107297/): msgpack5: Quadratic parsing in the streaming decoder (medium 5.9)
- [CVE-2026-107296](https://insights.sbomify.com/CVE-2026-107296/): msgpack5: Decoding negative int64 values mutates the input buffer (low 3.7)
- [CVE-2026-107295](https://insights.sbomify.com/CVE-2026-107295/): Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint (high 7.6)
- [CVE-2026-107294](https://insights.sbomify.com/CVE-2026-107294/): Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl (medium 6.5)
- [CVE-2026-107293](https://insights.sbomify.com/CVE-2026-107293/): Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False` (low 2.3)
- [CVE-2026-107292](https://insights.sbomify.com/CVE-2026-107292/): Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header (medium 6.4)
- [CVE-2026-107291](https://insights.sbomify.com/CVE-2026-107291/): Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False` (low 2.3)
- [CVE-2026-107290](https://insights.sbomify.com/CVE-2026-107290/): Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch` (medium 6.5)
- [CVE-2026-10729](https://insights.sbomify.com/CVE-2026-10729/): HTML injection in the notification email for "Slow Redirect" and "Cloned Website" Canarytokens (low 1.2)
- [CVE-2026-107289](https://insights.sbomify.com/CVE-2026-107289/): Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers (medium 6.8)
- [CVE-2026-107288](https://insights.sbomify.com/CVE-2026-107288/): Pydantic AI: web_fetch_tool blocked_domains bypass via a hostname the resolver normalizes differently (low 3.7)
- [CVE-2026-107287](https://insights.sbomify.com/CVE-2026-107287/): Pydantic AI: Excessive resource use when local web fetching converts nested HTML (medium 6.5)
- [CVE-2026-107286](https://insights.sbomify.com/CVE-2026-107286/): Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early (high 7.5)
- [CVE-2026-107285](https://insights.sbomify.com/CVE-2026-107285/): AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel (medium 5.9)
- [CVE-2026-107284](https://insights.sbomify.com/CVE-2026-107284/): AsyncHttpClient: WebSocket handshake continues after a failed Sec-WebSocket-Accept check (low 3.7)
- [CVE-2026-107283](https://insights.sbomify.com/CVE-2026-107283/): AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source (low 3.7)
- [CVE-2026-107282](https://insights.sbomify.com/CVE-2026-107282/): AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host (critical 9.4)
- [CVE-2026-107281](https://insights.sbomify.com/CVE-2026-107281/): Auth bypass in async-http-client (high 7.6)
- [CVE-2026-107280](https://insights.sbomify.com/CVE-2026-107280/): AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk (medium 6.9)
- [CVE-2026-107279](https://insights.sbomify.com/CVE-2026-107279/): AsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-int (high 8.8)
- [CVE-2026-107278](https://insights.sbomify.com/CVE-2026-107278/): MISP Object Sync Drops Objects and Attributes When Description Is Empty (medium 5.3)
- [CVE-2026-107276](https://insights.sbomify.com/CVE-2026-107276/): MISP Email OTP Race Condition Allows One-Time Password to Be Consumed by Multiple Concurrent Requests (medium 6.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/957/