# Vulnerabilities published in 2026


- [CVE-2026-0641](https://insights.sbomify.com/CVE-2026-0641/): TOTOLINK WA300 cstecgi.cgi sub_401510 command injection (medium 5.3)
- [CVE-2026-0640](https://insights.sbomify.com/CVE-2026-0640/): Tenda AC23 PowerSaveSet sscanf buffer overflow (high 8.7)
- [CVE-2026-0639](https://insights.sbomify.com/CVE-2026-0639/): liteos_a has a missing release of memory vulnerability (low 3.3)
- [CVE-2026-0637](https://insights.sbomify.com/CVE-2026-0637/): Sensitive Information Disclosure via Event Publisher Logging in Multiple WSO2 Products (medium 4.4)
- [CVE-2026-0636](https://insights.sbomify.com/CVE-2026-0636/): LDAP Injection Vulnerability in LDAPStoreHelper.java (medium 5.5)
- [CVE-2026-0635](https://insights.sbomify.com/CVE-2026-0635/): Missing authorization in Responsive Accordion Slider (medium 4.3)
- [CVE-2026-0634](https://insights.sbomify.com/CVE-2026-0634/): Code Execution in AssistFeedbackService on TECNO Pova7 Pro 5G (high 7.8)
- [CVE-2026-0633](https://insights.sbomify.com/CVE-2026-0633/): Auth bypass in MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor (low 3.7)
- [CVE-2026-0632](https://insights.sbomify.com/CVE-2026-0632/): Fluent Forms Pro Add On Pack <= 6.1.12 - Authenticated (Subscriber+) Server-Side Request Forgery via 'saveDataSource' (medium 5.4)
- [CVE-2026-0631](https://insights.sbomify.com/CVE-2026-0631/): Authenticated Command Injection Vulnerability in Surfshark VPN Login in multiple Archer products (high 8.5)
- [CVE-2026-0630](https://insights.sbomify.com/CVE-2026-0630/): Command Injection Vulnerability on TP-Link Archer BE230 v1.2 and AXE75 v1.0 (high 8.5)
- [CVE-2026-0629](https://insights.sbomify.com/CVE-2026-0629/): Authentication Bypass in Password Recovery Feature via Local Web App on Multiple VIGI Cameras (high 8.7)
- [CVE-2026-0628](https://insights.sbomify.com/CVE-2026-0628/): Missing authorization in Chrome (high 8.8)
- [CVE-2026-0627](https://insights.sbomify.com/CVE-2026-0627/): AMP for WP <= 1.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2026-0626](https://insights.sbomify.com/CVE-2026-0626/): WPFunnels <= 3.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpf_optin_form' Shortcode (medium 6.4)
- [CVE-2026-0625](https://insights.sbomify.com/CVE-2026-0625/): D-Link DSL/DIR/DNS Authentication Bypass via DNS Configuration Endpoint (critical 9.3)
- [CVE-2026-0622](https://insights.sbomify.com/CVE-2026-0622/): Open 5GS WebUI uses a hard-coded JWT signing key (medium 6.5)
- [CVE-2026-0621](https://insights.sbomify.com/CVE-2026-0621/): MCP TypeScript SDK UriTemplate Exploded Array Pattern ReDoS (high 8.7)
- [CVE-2026-0620](https://insights.sbomify.com/CVE-2026-0620/): L2TP over IPSec Encryption Failure on ArcherAXE75 (medium 6.0)
- [CVE-2026-0619](https://insights.sbomify.com/CVE-2026-0619/): Integer Wraparound DoS in Silicon Labs Matter Implementation (medium 6.0)
- [CVE-2026-0618](https://insights.sbomify.com/CVE-2026-0618/): Cross-site scripting in PowerShell Universal (medium 6.1)
- [CVE-2026-0617](https://insights.sbomify.com/CVE-2026-0617/): LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Unauthenticated Stored Cross-Site Scripting (high 7.2)
- [CVE-2026-0616](https://insights.sbomify.com/CVE-2026-0616/): CVE-2026-0616 (high 7.5)
- [CVE-2026-0615](https://insights.sbomify.com/CVE-2026-0615/): CVE-2026-0615 (high 7.3)
- [CVE-2026-0613](https://insights.sbomify.com/CVE-2026-0613/): CVE-2026-0613 (high 7.5)
- [CVE-2026-0612](https://insights.sbomify.com/CVE-2026-0612/): CVE-2026-0612 (high 7.5)
- [CVE-2026-0611](https://insights.sbomify.com/CVE-2026-0611/): Spacelabs Healthcare Sentinel 10.5.x < 11.6.0 Unauthenticated RCE via .NET Remoting (critical 9.2)
- [CVE-2026-0610](https://insights.sbomify.com/CVE-2026-0610/): SQL injection in Server (critical 9.8)
- [CVE-2026-0609](https://insights.sbomify.com/CVE-2026-0609/): Logo Slider <= 4.9.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'logo-slider' Shortcode (medium 6.4)
- [CVE-2026-0608](https://insights.sbomify.com/CVE-2026-0608/): Head Meta Data <= 20251118 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta (medium 6.4)
- [CVE-2026-0607](https://insights.sbomify.com/CVE-2026-0607/): code-projects Online Music Site AdminViewSongs.php sql injection (medium 6.9)
- [CVE-2026-0606](https://insights.sbomify.com/CVE-2026-0606/): code-projects Online Music Site Albums.php sql injection (medium 6.9)
- [CVE-2026-0605](https://insights.sbomify.com/CVE-2026-0605/): code-projects Online Music Site login.php sql injection (medium 6.9)
- [CVE-2026-0604](https://insights.sbomify.com/CVE-2026-0604/): FastDup <= 2.7 - Authenticated (Contributor+) Path Traversal via 'dir_path' REST Parameter (medium 6.5)
- [CVE-2026-0603](https://insights.sbomify.com/CVE-2026-0603/): Org.hibernate/hibernate-core: hibernate: information disclosure and data deletion via second-order sql injection (high 8.3)
- [CVE-2026-0602](https://insights.sbomify.com/CVE-2026-0602/): Authentication Bypass Using an Alternate Path or Channel in GitLab (medium 4.3)
- [CVE-2026-0601](https://insights.sbomify.com/CVE-2026-0601/): Nexus Repository 3 - Cross-Site Scripting (medium 5.1)
- [CVE-2026-0600](https://insights.sbomify.com/CVE-2026-0600/): Nexus Repository 3 - Server-Side Request Forgery in Proxy Repository Configuration (medium 6.2)
- [CVE-2026-0599](https://insights.sbomify.com/CVE-2026-0599/): Unbounded External Image Fetch in Validation Leads to Resource-Exhaustion DoS in huggingface/text-generation-inference (high 7.5)
- [CVE-2026-0598](https://insights.sbomify.com/CVE-2026-0598/): Missing authorization in Red Hat Ansible Automation Platform 2 (medium 4.2)
- [CVE-2026-0597](https://insights.sbomify.com/CVE-2026-0597/): Campcodes Supplier Management System edit_profile.php sql injection (medium 5.3)
- [CVE-2026-0596](https://insights.sbomify.com/CVE-2026-0596/): Command Injection in mlflow/mlflow (critical 9.6)
- [CVE-2026-0595](https://insights.sbomify.com/CVE-2026-0595/): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (high 7.3)
- [CVE-2026-0594](https://insights.sbomify.com/CVE-2026-0594/): List Site Contributors <= 1.1.8 - Reflected Cross-Site Scripting via alpha (medium 6.1)
- [CVE-2026-0593](https://insights.sbomify.com/CVE-2026-0593/): Missing authorization in WP Go Maps (formerly WP Google Maps) (medium 5.3)
- [CVE-2026-0592](https://insights.sbomify.com/CVE-2026-0592/): code-projects Online Product Reservation System User Registration register_code.php sql injection (medium 6.9)
- [CVE-2026-0591](https://insights.sbomify.com/CVE-2026-0591/): code-projects Online Product Reservation System Cart Update update.php sql injection (medium 5.3)
- [CVE-2026-0590](https://insights.sbomify.com/CVE-2026-0590/): code-projects Online Product Reservation System POST Parameter delete.php sql injection (medium 5.3)
- [CVE-2026-0589](https://insights.sbomify.com/CVE-2026-0589/): code-projects Online Product Reservation System Administration Backend improper authentication (medium 6.9)
- [CVE-2026-0588](https://insights.sbomify.com/CVE-2026-0588/): Xinhu Rainrock RockOA API rockfun.php cross site scripting (medium 5.1)
- [CVE-2026-0587](https://insights.sbomify.com/CVE-2026-0587/): Xinhu Rainrock RockOA Cover Image rock_page_gong.php cross site scripting (medium 5.1)
- [CVE-2026-0586](https://insights.sbomify.com/CVE-2026-0586/): code-projects Online Product Reservation System prod.php cross site scripting (medium 5.3)
- [CVE-2026-0585](https://insights.sbomify.com/CVE-2026-0585/): code-projects Online Product Reservation System GET Parameter order_view.php sql injection (medium 6.9)
- [CVE-2026-0584](https://insights.sbomify.com/CVE-2026-0584/): code-projects Online Product Reservation System left_cart.php sql injection (medium 5.3)
- [CVE-2026-0583](https://insights.sbomify.com/CVE-2026-0583/): code-projects Online Product Reservation System User Login login.php sql injection (medium 6.9)
- [CVE-2026-0582](https://insights.sbomify.com/CVE-2026-0582/): itsourcecode Society Management System edit_activity_query.php sql injection (medium 5.3)
- [CVE-2026-0581](https://insights.sbomify.com/CVE-2026-0581/): Tenda AC1206 httpd BehaviorManager formBehaviorManager command injection (medium 5.3)
- [CVE-2026-0580](https://insights.sbomify.com/CVE-2026-0580/): SourceCodester API Key Manager App Import Key cross site scripting (medium 5.1)
- [CVE-2026-0579](https://insights.sbomify.com/CVE-2026-0579/): code-projects Online Product Reservation System POST Parameter edit.php sql injection (medium 6.9)
- [CVE-2026-0578](https://insights.sbomify.com/CVE-2026-0578/): code-projects Online Product Reservation System delete.php sql injection (medium 6.9)
- [CVE-2026-0577](https://insights.sbomify.com/CVE-2026-0577/): code-projects Online Product Reservation System prod.php unrestricted upload (medium 5.3)
- [CVE-2026-0576](https://insights.sbomify.com/CVE-2026-0576/): code-projects Online Product Reservation System Parameter prod.php sql injection (medium 6.9)
- [CVE-2026-0575](https://insights.sbomify.com/CVE-2026-0575/): code-projects Online Product Reservation System Administrator Login adminlogin.php sql injection (medium 6.9)
- [CVE-2026-0574](https://insights.sbomify.com/CVE-2026-0574/): yeqifu warehouse Request UserController.java saveUserRole improper authorization (medium 5.3)
- [CVE-2026-0573](https://insights.sbomify.com/CVE-2026-0573/): Open redirect in Enterprise Server (high 7.6)
- [CVE-2026-0572](https://insights.sbomify.com/CVE-2026-0572/): Missing authorization in WebPurify Profanity Filter (medium 6.5)
- [CVE-2026-0571](https://insights.sbomify.com/CVE-2026-0571/): yeqifu warehouse AppFileUtils.java createResponseEntity path traversal (medium 5.3)
- [CVE-2026-0570](https://insights.sbomify.com/CVE-2026-0570/): code-projects Online Music Site Feedback.php sql injection (medium 6.9)
- [CVE-2026-0569](https://insights.sbomify.com/CVE-2026-0569/): code-projects Online Music Site AlbumByCategory.php sql injection (medium 6.9)
- [CVE-2026-0568](https://insights.sbomify.com/CVE-2026-0568/): code-projects Online Music Site ViewSongs.php sql injection (medium 6.9)
- [CVE-2026-0567](https://insights.sbomify.com/CVE-2026-0567/): code-projects Content Management System pages.php sql injection (medium 6.9)
- [CVE-2026-0566](https://insights.sbomify.com/CVE-2026-0566/): code-projects Content Management System edit_posts.php unrestricted upload (medium 5.1)
- [CVE-2026-0565](https://insights.sbomify.com/CVE-2026-0565/): code-projects Content Management System delete.php sql injection (medium 6.9)
- [CVE-2026-0563](https://insights.sbomify.com/CVE-2026-0563/): Cross-site scripting in WP Google Street View (with 360° virtual tour) & Google maps + Local SEO (medium 6.4)
- [CVE-2026-0562](https://insights.sbomify.com/CVE-2026-0562/): Insecure Direct Object Reference (IDOR) in parisneo/lollms (high 8.3)
- [CVE-2026-0561](https://insights.sbomify.com/CVE-2026-0561/): Shield Security <= 21.0.8 - Unauthenticated Reflected Cross-Site Scripting via 'message' Parameter (medium 6.1)
- [CVE-2026-0560](https://insights.sbomify.com/CVE-2026-0560/): Server-Side Request Forgery (SSRF) in parisneo/lollms (high 7.5)
- [CVE-2026-0559](https://insights.sbomify.com/CVE-2026-0559/): Cross-site scripting in MasterStudy LMS WordPress Plugin – for Online Courses and Education (medium 6.4)
- [CVE-2026-0558](https://insights.sbomify.com/CVE-2026-0558/): Unauthenticated File Upload in parisneo/lollms (high 7.5)
- [CVE-2026-0557](https://insights.sbomify.com/CVE-2026-0557/): WP Data Access <= 5.5.63 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpda_app' Shortcode (medium 6.4)
- [CVE-2026-0556](https://insights.sbomify.com/CVE-2026-0556/): XO Event Calendar <= 3.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'xo_event_field' shortcode (medium 6.4)
- [CVE-2026-0555](https://insights.sbomify.com/CVE-2026-0555/): Cross-site scripting in Premmerce (medium 6.4)
- [CVE-2026-0554](https://insights.sbomify.com/CVE-2026-0554/): NotificationX <= 3.1.11 - Missing Authorization to Authenticated (Contributor+) Analytics Reset (medium 4.3)
- [CVE-2026-0552](https://insights.sbomify.com/CVE-2026-0552/): Cross-site scripting in Simple Shopping Cart (medium 6.4)
- [CVE-2026-0551](https://insights.sbomify.com/CVE-2026-0551/): PPWP – Password Protect Pages <= 1.9.18 - Authenticated (Contributor+) PHP Object Injection via post_protection_roles (high 8.8)
- [CVE-2026-0550](https://insights.sbomify.com/CVE-2026-0550/): myCred <= 2.9.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mycred_load_coupon' Shortcode (medium 6.4)
- [CVE-2026-0549](https://insights.sbomify.com/CVE-2026-0549/): Groups <= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'groups_group_info' Shortcode (medium 6.4)
- [CVE-2026-0548](https://insights.sbomify.com/CVE-2026-0548/): Missing authorization in Tutor LMS – eLearning and online course solution (medium 5.4)
- [CVE-2026-0547](https://insights.sbomify.com/CVE-2026-0547/): PHPGurukul Online Course Registration Student Registration edit-student-profile.php unrestricted upload (medium 5.3)
- [CVE-2026-0546](https://insights.sbomify.com/CVE-2026-0546/): code-projects Content Management System search.php sql injection (medium 6.9)
- [CVE-2026-0545](https://insights.sbomify.com/CVE-2026-0545/): Missing Authentication for Critical Function in mlflow/mlflow (critical 9.1)
- [CVE-2026-0544](https://insights.sbomify.com/CVE-2026-0544/): itsourcecode School Management System index.php sql injection (medium 6.9)
- [CVE-2026-0543](https://insights.sbomify.com/CVE-2026-0543/): Improper Input Validation in Kibana Email Connector Leading to Excessive Allocation (medium 6.5)
- [CVE-2026-0542](https://insights.sbomify.com/CVE-2026-0542/): Remote Code Execution in ServiceNow AI Platform (critical 9.2)
- [CVE-2026-0541](https://insights.sbomify.com/CVE-2026-0541/): Privilege escalation in AXIS OS (medium 6.7)
- [CVE-2026-0540](https://insights.sbomify.com/CVE-2026-0540/): DOMPurify XSS via Missing Rawtext Elements in SAFE_FOR_XML (medium 5.3)
- [CVE-2026-0539](https://insights.sbomify.com/CVE-2026-0539/): Local Privilege Escalation in pcvisit service client (high 8.5)
- [CVE-2026-0538](https://insights.sbomify.com/CVE-2026-0538/): GIF File Parsing Out-of-Bounds Write (high 8.4)
- [CVE-2026-0537](https://insights.sbomify.com/CVE-2026-0537/): RGB File Parsing Memory Corruption (high 8.4)
- [CVE-2026-0536](https://insights.sbomify.com/CVE-2026-0536/): GIF File Parsing Stack Based Buffer Overflow (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/1009/