# Vulnerabilities published in 2026


- [CVE-2026-9605](https://insights.sbomify.com/CVE-2026-9605/): GNU libredwg Dwgbmp Utility bits.c bit_read_RC heap-based overflow (medium 6.9)
- [CVE-2026-96044](https://insights.sbomify.com/CVE-2026-96044/): Microsoft Office SharePoint Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-9604](https://insights.sbomify.com/CVE-2026-9604/): JeecgBoot AiragModelController access control (medium 5.3)
- [CVE-2026-96039](https://insights.sbomify.com/CVE-2026-96039/): BA Book Everything <= 1.8.27 - Unauthenticated Stored Cross-Site Scripting via first_name Parameter (high 7.2)
- [CVE-2026-9603](https://insights.sbomify.com/CVE-2026-9603/): SourceCodester eDoc Doctor Appointment System delete-session.php authorization (medium 6.9)
- [CVE-2026-9602](https://insights.sbomify.com/CVE-2026-9602/): Mattermost Desktop App crashes when malformed arguments are provided to some exposed IPC methods (medium 5.7)
- [CVE-2026-96012](https://insights.sbomify.com/CVE-2026-96012/): IBM Db2 Mirror for i Privilege Escalation (critical 9.9)
- [CVE-2026-9599](https://insights.sbomify.com/CVE-2026-9599/): Tectite Forms <= 1.3 - Cross-Site Request Forgery to Settings Update (medium 4.3)
- [CVE-2026-95985](https://insights.sbomify.com/CVE-2026-95985/): Kiro IDE Allows Agentic Writes to Global Configurations While Working in Untrusted Workspaces (high 8.6)
- [CVE-2026-9597](https://insights.sbomify.com/CVE-2026-9597/): Deactivated guest accounts can authenticate via magic-link token in Mattermost REST API login endpoint (medium 5.4)
- [CVE-2026-95958](https://insights.sbomify.com/CVE-2026-95958/): JusticeRage Manalyze PE Parser pe.cpp _parse_relocations integer underflow (medium 4.8)
- [CVE-2026-95957](https://insights.sbomify.com/CVE-2026-95957/): Cross-site scripting in Smart Attendance System with QR Code Scanner (medium 5.3)
- [CVE-2026-9595](https://insights.sbomify.com/CVE-2026-9595/): webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies (medium 5.3)
- [CVE-2026-95943](https://insights.sbomify.com/CVE-2026-95943/): Connected Devices Platform Service (Cdpsvc) Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-9594](https://insights.sbomify.com/CVE-2026-9594/): WP Maps <= 4.9.4 - Authenticated (Admin+) Stored Cross-Site Scripting via 'location_messages' Parameter (medium 4.4)
- [CVE-2026-95930](https://insights.sbomify.com/CVE-2026-95930/): iFlytek astron-agent debugToolV2 API endpoint UrlCheckTool.checkUrl server-side request forgery (medium 5.3)
- [CVE-2026-9593](https://insights.sbomify.com/CVE-2026-9593/): iDTM FDI Unauthorized Debug Interface Enablement (high 8.4)
- [CVE-2026-95929](https://insights.sbomify.com/CVE-2026-95929/): iFlytek astron-agent getBotList API endpoint ChatBotMarketMapper.xml sql injection (medium 5.3)
- [CVE-2026-95928](https://insights.sbomify.com/CVE-2026-95928/): recommenders-team recommenders Dict Loading mind_iterator.py pickle.load deserialization (medium 5.1)
- [CVE-2026-95927](https://insights.sbomify.com/CVE-2026-95927/): SourceCodester Online Reviewer Management System exam-delete.php sql injection (medium 6.9)
- [CVE-2026-95926](https://insights.sbomify.com/CVE-2026-95926/): SourceCodester Online Reviewer Management System btn_functions.php update sql injection (medium 6.9)
- [CVE-2026-95925](https://insights.sbomify.com/CVE-2026-95925/): SourceCodester Online Reviewer Management System btn_functions.php update sql injection (medium 6.9)
- [CVE-2026-95924](https://insights.sbomify.com/CVE-2026-95924/): SourceCodester Online Reviewer Management System btn_functions.php add sql injection (medium 6.9)
- [CVE-2026-9592](https://insights.sbomify.com/CVE-2026-9592/): Sensitive Information Disclosure in HTTP header (high 7.5)
- [CVE-2026-9591](https://insights.sbomify.com/CVE-2026-9591/): Cross-Site Request Forgery (CSRF) in SimplCommerce News Module (medium 6.9)
- [CVE-2026-95904](https://insights.sbomify.com/CVE-2026-95904/): Windows Event Logging Service Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-9590](https://insights.sbomify.com/CVE-2026-9590/): Missing authorization in Server (medium 5.3)
- [CVE-2026-95897](https://insights.sbomify.com/CVE-2026-95897/): Dask Loader core.py from_npy_stack deserialization (medium 5.1)
- [CVE-2026-9589](https://insights.sbomify.com/CVE-2026-9589/): Unblu Spark Authorization Bypass in Configuration Cascade Operations (critical 9.3)
- [CVE-2026-9588](https://insights.sbomify.com/CVE-2026-9588/): Authenticated Stored Cross-Site Scripting (XSS) in Switchvox SMB Web Portal (high 7.0)
- [CVE-2026-9587](https://insights.sbomify.com/CVE-2026-9587/): Authenticated Local File Inclusion (LFI) in Switchvox SMB Web Portal (high 7.1)
- [CVE-2026-95868](https://insights.sbomify.com/CVE-2026-95868/): AdithyaYelloju Restaurant-Management-System Search Form display_menu.php mysqli_query sql injection (medium 5.3)
- [CVE-2026-95866](https://insights.sbomify.com/CVE-2026-95866/): User Profile Builder <= 4.0.2 - Unauthenticated Stored Cross-Site Scripting via Avatar Field (high 7.2)
- [CVE-2026-95865](https://insights.sbomify.com/CVE-2026-95865/): Beaver Builder Page Builder <= 2.11.0.5 - Authenticated (Contributor+) SQL Injection via 'fields[][value]' Parameter (medium 6.5)
- [CVE-2026-95864](https://insights.sbomify.com/CVE-2026-95864/): Themify Builder <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via 'css[fonts]' Parameter (high 7.2)
- [CVE-2026-95862](https://insights.sbomify.com/CVE-2026-95862/): Memory corruption in Cloud Gateways (high 7.5)
- [CVE-2026-95861](https://insights.sbomify.com/CVE-2026-95861/): Denial of service in Cloud Gateways (high 7.5)
- [CVE-2026-9586](https://insights.sbomify.com/CVE-2026-9586/): Sangoma Switchvox SQL Injection (critical 9.3, exploited in the wild)
- [CVE-2026-95859](https://insights.sbomify.com/CVE-2026-95859/): libp2p-rust: Gossipsub GRAFT topics unbounded growth (high 8.7)
- [CVE-2026-9585](https://insights.sbomify.com/CVE-2026-9585/): Unauthenticated Reflected Cross-Site Scripting (XSS) in Switchvox SMB Web Portal (high 8.6)
- [CVE-2026-95848](https://insights.sbomify.com/CVE-2026-95848/): Moquette fails open when configured authentication or authorization classes cannot load (critical 9.3)
- [CVE-2026-95847](https://insights.sbomify.com/CVE-2026-95847/): Moquette client IDs can cause cross-session H2 durable-queue corruption (high 8.8)
- [CVE-2026-95846](https://insights.sbomify.com/CVE-2026-95846/): Moquette publishes Last-Will messages without enforcing write authorization (high 8.7)
- [CVE-2026-95845](https://insights.sbomify.com/CVE-2026-95845/): Moquette unbounded per-session message queues allow memory exhaustion (high 8.7)
- [CVE-2026-95844](https://insights.sbomify.com/CVE-2026-95844/): Moquette deeply nested MQTT topics can cause stack exhaustion (high 8.7)
- [CVE-2026-95843](https://insights.sbomify.com/CVE-2026-95843/): Moquette malformed shared subscriptions can crash command processing (high 8.7)
- [CVE-2026-95842](https://insights.sbomify.com/CVE-2026-95842/): Moquette uncaught MQTT command exceptions can terminate shared session event loops (high 8.7)
- [CVE-2026-9584](https://insights.sbomify.com/CVE-2026-9584/): code-projects Project Management System Login chk.php sql injection (medium 6.9)
- [CVE-2026-95838](https://insights.sbomify.com/CVE-2026-95838/): containerd: Unpack DoS via repeated opaque whiteouts (medium 4.6)
- [CVE-2026-95837](https://insights.sbomify.com/CVE-2026-95837/): containerd CRI plugin: Checkpoint restore bypasses destination security context (high 7.8)
- [CVE-2026-95835](https://insights.sbomify.com/CVE-2026-95835/): Missing ownership check on the shared memory object named by the kitty askpass escape code (medium 5.6)
- [CVE-2026-95834](https://insights.sbomify.com/CVE-2026-95834/): Use after free in the kitty drag and drop protocol when a drag source item is aborted mid-transfer (medium 4.6)
- [CVE-2026-95833](https://insights.sbomify.com/CVE-2026-95833/): itsourcecode Leave Management System index.php sql injection (medium 5.3)
- [CVE-2026-95832](https://insights.sbomify.com/CVE-2026-95832/): Reflected unknown field names in the kitty colour control escape code allow command execution in the user's shell (critical 9.3)
- [CVE-2026-95831](https://insights.sbomify.com/CVE-2026-95831/): Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL. (high 7.8)
- [CVE-2026-95830](https://insights.sbomify.com/CVE-2026-95830/): theRealSain Pixtream post_upload.php unrestricted upload (medium 5.3)
- [CVE-2026-9583](https://insights.sbomify.com/CVE-2026-9583/): SourceCodester CET Automated Grading System with AI Predictive Analytics SQL index.php information exposure (medium 5.3)
- [CVE-2026-95829](https://insights.sbomify.com/CVE-2026-95829/): SQL injection in tduck-platform (medium 5.3)
- [CVE-2026-95828](https://insights.sbomify.com/CVE-2026-95828/): Mstfakts College-Management-System Authentication server.php session_start session fixiation (medium 5.3)
- [CVE-2026-95820](https://insights.sbomify.com/CVE-2026-95820/): anirbandutta9 College-Notes-Gallery userprofile.php admin1 unrestricted upload (medium 5.3)
- [CVE-2026-9582](https://insights.sbomify.com/CVE-2026-9582/): SourceCodester CET Automated Grading System with AI Predictive Analytics cross-site request forgery (medium 5.3)
- [CVE-2026-95819](https://insights.sbomify.com/CVE-2026-95819/): anirbandutta9 College-Notes-Gallery login.php sql injection (medium 6.9)
- [CVE-2026-95818](https://insights.sbomify.com/CVE-2026-95818/): AT_SECURE program buffer overflow via $ORIGIN processing (low 3.6)
- [CVE-2026-95817](https://insights.sbomify.com/CVE-2026-95817/): DoFollow Case by Case <= 3.6.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content (high 7.2)
- [CVE-2026-95816](https://insights.sbomify.com/CVE-2026-95816/): Smart Forms <= 2.6.104 - Unauthenticated Stored Cross-Site Scripting via 'formString' Parameter (high 7.2)
- [CVE-2026-95815](https://insights.sbomify.com/CVE-2026-95815/): OpenClaw iOS before 2026.8.11 Credential Exposure via Deep-Link URL Logging (high 7.2)
- [CVE-2026-95814](https://insights.sbomify.com/CVE-2026-95814/): Vaultwarden through 1.37.3 Authorization Bypass via Missing Status Check (high 8.6)
- [CVE-2026-95813](https://insights.sbomify.com/CVE-2026-95813/): e621ng before 26.09.16 Open Redirect via URL Parameters (medium 5.3)
- [CVE-2026-95812](https://insights.sbomify.com/CVE-2026-95812/): ClipBucket v5 before 5.5.3-#182 Reflected XSS via Query Parameters (medium 5.3)
- [CVE-2026-95811](https://insights.sbomify.com/CVE-2026-95811/): Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent (medium 6.5)
- [CVE-2026-9581](https://insights.sbomify.com/CVE-2026-9581/): JeecgBoot add access control (medium 5.3)
- [CVE-2026-95809](https://insights.sbomify.com/CVE-2026-95809/): Opti-Behavior <= 1.9.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'country_name' Location Parameter (high 7.2)
- [CVE-2026-95808](https://insights.sbomify.com/CVE-2026-95808/): Form Maker by 10Web <= 1.15.48 - Unauthenticated SQL Injection via 'inputs' Parameter (high 7.5)
- [CVE-2026-95807](https://insights.sbomify.com/CVE-2026-95807/): FV Player 8 <= 8.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute (medium 6.4)
- [CVE-2026-95806](https://insights.sbomify.com/CVE-2026-95806/): MISP: PHP phar stream wrapper enables deserialization and code execution via caller-influenced filesystem paths (high 7.7)
- [CVE-2026-95805](https://insights.sbomify.com/CVE-2026-95805/): MISP ACLComponent: Typo in previewEventAttributes ACL key bypasses intended access restriction (medium 5.3)
- [CVE-2026-9580](https://insights.sbomify.com/CVE-2026-9580/): JeecgBoot selectDepart LoginController.selectDepart access control (medium 6.9)
- [CVE-2026-9579](https://insights.sbomify.com/CVE-2026-9579/): JeecgBoot SysUser userEdit user.getUsername access control (medium 5.3)
- [CVE-2026-9577](https://insights.sbomify.com/CVE-2026-9577/): Post Status Notifier Lite < 1.13.0 - Reflected XSS via mod Parameter (medium 4.8)
- [CVE-2026-9576](https://insights.sbomify.com/CVE-2026-9576/): Fluent Booking < 2.1.2 - Calendar Manager+ Sensitive Information Disclosure via Attendee Export (medium 4.9)
- [CVE-2026-95754](https://insights.sbomify.com/CVE-2026-95754/): MISP: Disabled-user check ineffective in pre-authentication TOTP login branch (medium 6.9)
- [CVE-2026-9575](https://insights.sbomify.com/CVE-2026-9575/): itsourcecode Student Transcript Processing System index.php sql injection (medium 6.9)
- [CVE-2026-9574](https://insights.sbomify.com/CVE-2026-9574/): itsourcecode Student Transcript Processing System trans.php sql injection (medium 6.9)
- [CVE-2026-9573](https://insights.sbomify.com/CVE-2026-9573/): itsourcecode Student Transcript Processing System index.php sql injection (medium 6.9)
- [CVE-2026-95721](https://insights.sbomify.com/CVE-2026-95721/): Authenticated Local Memory Corruption Vulnerability in AOS-8 Web-Based Management Interface (low 3.3)
- [CVE-2026-95720](https://insights.sbomify.com/CVE-2026-95720/): Authenticated Local Buffer Overflow Vulnerability leads to Denial-of-Service in AOS-8 (medium 4.4)
- [CVE-2026-9572](https://insights.sbomify.com/CVE-2026-9572/): GPAC MP4Box media.c Media_GetSample memory leak (medium 4.8)
- [CVE-2026-95719](https://insights.sbomify.com/CVE-2026-95719/): Authenticated Arbitrary File Deletion Vulnerability leads to Denial-of-Service in AOS-10 (medium 4.9)
- [CVE-2026-95718](https://insights.sbomify.com/CVE-2026-95718/): Authentication Bypass Vulnerability in the PAPI Protocol of AOS-8 (medium 5.3)
- [CVE-2026-95717](https://insights.sbomify.com/CVE-2026-95717/): Authenticated Stored Cross-Site Scripting (XSS) Vulnerability in AOS Web-Based Management Interface (medium 5.5)
- [CVE-2026-95716](https://insights.sbomify.com/CVE-2026-95716/): Authentication Bypass in the PAPI Protocol of AOS-10 allows Unauthorized Configuration Changes (medium 6.5)
- [CVE-2026-95715](https://insights.sbomify.com/CVE-2026-95715/): Unauthenticated Local Command Injection Vulnerability in AOS-10 Command Line Interface (medium 6.8)
- [CVE-2026-95714](https://insights.sbomify.com/CVE-2026-95714/): Authenticated Adjacent Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-10 (medium 6.8)
- [CVE-2026-95713](https://insights.sbomify.com/CVE-2026-95713/): Unauthenticated Buffer Overflow Vulnerability leads to Denial-of-Service in AOS-8 Command Line Interface (high 7.0)
- [CVE-2026-95712](https://insights.sbomify.com/CVE-2026-95712/): Unauthenticated Adjacent Sensitive Information Disclosure and Denial-of-Service in AOS-8 via the PAPI Protocol (high 7.1)
- [CVE-2026-95711](https://insights.sbomify.com/CVE-2026-95711/): Authentication Bypass Leading to Remote Code Execution in AOS-10 Web-Based Management Interface (high 7.1)
- [CVE-2026-95710](https://insights.sbomify.com/CVE-2026-95710/): Unauthenticated Adjacent Buffer Overflow Vulnerability leads to Denial-of-Service in AOS-10 or AOS-8 (high 7.1)
- [CVE-2026-9571](https://insights.sbomify.com/CVE-2026-9571/): Deactivated user accounts can continue to obtain valid OAuth access tokens via refresh token grant in Mattermost (medium 5.9)
- [CVE-2026-95709](https://insights.sbomify.com/CVE-2026-95709/): Authenticated Command Injection Vulnerabilities in AOS-10 (high 7.2)
- [CVE-2026-95708](https://insights.sbomify.com/CVE-2026-95708/): Authenticated File Write leads to Command Injection Vulnerabilities in AOS-10 (high 7.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/227/