# Vulnerabilities published in 2026


- [CVE-2026-95155](https://insights.sbomify.com/CVE-2026-95155/): FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allows attackers to cause a denial (high 7.5)
- [CVE-2026-95153](https://insights.sbomify.com/CVE-2026-95153/): An issue in Bludit CMS 3.22.0 allows a remote attacker to obtain sensitive information via the /admin/ajax/clippy and /admin/ajax/save-as-dr (medium 4.9)
- [CVE-2026-9515](https://insights.sbomify.com/CVE-2026-9515/): Totolink CA750-PoE Setting cstecgi.cgi setUnloadUserData os command injection (medium 5.3)
- [CVE-2026-95140](https://insights.sbomify.com/CVE-2026-95140/): kkFileView v5.0.0 through v5.0.2 contains a directory traversal vulnerability in FileController.java. (high 7.5)
- [CVE-2026-9514](https://insights.sbomify.com/CVE-2026-9514/): Totolink CA750-PoE Setting cstecgi.cgi setNetworkDiag os command injection (medium 5.3)
- [CVE-2026-9513](https://insights.sbomify.com/CVE-2026-9513/): Totolink CA750-PoE Setting cstecgi.cgi NTPSyncWithHost os command injection (medium 5.3)
- [CVE-2026-95127](https://insights.sbomify.com/CVE-2026-95127/): An issue in libass v.0.17.5 allows a remote attacker to cause a denial of service via the ass_outline_construct() in libass/ass_render.c (high 7.5)
- [CVE-2026-95125](https://insights.sbomify.com/CVE-2026-95125/): libming through 0.4.8 contains a heap buffer overflow in r_readc() in src/blocks/fromswf.c. (medium 6.5)
- [CVE-2026-95124](https://insights.sbomify.com/CVE-2026-95124/): Buffer Overflow vulnerability in madmurphy libconfini v.1.16.4 allows a remote attacker to cause a denial of service via an allocation-size (high 7.5)
- [CVE-2026-95122](https://insights.sbomify.com/CVE-2026-95122/): mp4v2 2.0.0 contains a NULL pointer dereference vulnerability in MP4File::GenerateTracks() in src/mp4file.cpp. (high 7.5)
- [CVE-2026-95121](https://insights.sbomify.com/CVE-2026-95121/): An issue in mp4v2 2.0.0 allows an attacker to execute arbitrary code via the MP4RtpAtom::ReadHntiType() in src/atom_rtp.cpp. (high 7.8)
- [CVE-2026-9512](https://insights.sbomify.com/CVE-2026-9512/): Totolink CA750-PoE Setting cstecgi.cgi setPasswordCfg os command injection (medium 5.3)
- [CVE-2026-95117](https://insights.sbomify.com/CVE-2026-95117/): Buffer Overflow vulnerability in zserge jsmn jsmn HEAD 25647e6 allows a remote attacker to cause a denial of service via the jsmn.h, jsmn_pa (not scored)
- [CVE-2026-95116](https://insights.sbomify.com/CVE-2026-95116/): An issue in libming through 0.4.8 allows a remote attacker to cause a denial of service via the readtag_file() in src/blocks/fromswf.c. (high 7.5)
- [CVE-2026-95115](https://insights.sbomify.com/CVE-2026-95115/): Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser (high 7.5)
- [CVE-2026-95114](https://insights.sbomify.com/CVE-2026-95114/): libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib/misc/lejp.c. (high 7.5)
- [CVE-2026-95112](https://insights.sbomify.com/CVE-2026-95112/): Gitea issue reference parsing CPU exhaustion (medium 6.5)
- [CVE-2026-95111](https://insights.sbomify.com/CVE-2026-95111/): Module queue front-send validates a word count as a byte count (medium 4.8)
- [CVE-2026-9511](https://insights.sbomify.com/CVE-2026-9511/): Totolink CA750-PoE Setting cstecgi.cgi setWebWlanIdx os command injection (medium 5.3)
- [CVE-2026-95109](https://insights.sbomify.com/CVE-2026-95109/): Cortex-A7 module data validation checks only the first address of a caller-supplied range (high 8.5)
- [CVE-2026-95108](https://insights.sbomify.com/CVE-2026-95108/): Deleting a user-mode module thread leaks its privileged kernel stack (medium 6.8)
- [CVE-2026-95107](https://insights.sbomify.com/CVE-2026-95107/): Module object allocation size overflow corrupts the manager object pool (high 7.0)
- [CVE-2026-95106](https://insights.sbomify.com/CVE-2026-95106/): Gitea review and execution mismatch through duplicate tree entries (critical 9.1)
- [CVE-2026-95105](https://insights.sbomify.com/CVE-2026-95105/): Cloak AES-CTR cipher lacks ciphertext authentication, allowing chosen-plaintext forgery by bit flipping (high 8.2)
- [CVE-2026-95104](https://insights.sbomify.com/CVE-2026-95104/): Memory corruption in WEX-G300 (high 8.7)
- [CVE-2026-95102](https://insights.sbomify.com/CVE-2026-95102/): Monta monta.app Missing Authentication for Critical Function (critical 9.3)
- [CVE-2026-95101](https://insights.sbomify.com/CVE-2026-95101/): NGINX ngx_http_v3_module vulnerability (medium 6.9)
- [CVE-2026-9509](https://insights.sbomify.com/CVE-2026-9509/): Uncaught exception vulnerability in Suprema's BioStar (high 8.7)
- [CVE-2026-9508](https://insights.sbomify.com/CVE-2026-9508/): Incorrect Permission Assignment for Critical Resource vulnerability in Suprema's BioStar (critical 10.0)
- [CVE-2026-9507](https://insights.sbomify.com/CVE-2026-9507/): Session fixation vulnerability in Enhancesoft's osTicket (medium 5.1)
- [CVE-2026-9506](https://insights.sbomify.com/CVE-2026-9506/): Path Traversal Vulnerability in Bagisto (high 8.7)
- [CVE-2026-9504](https://insights.sbomify.com/CVE-2026-9504/): GNU LibreDWG Dwggrep Utility dwggrep.c bit_convert_TU out-of-bounds (medium 4.8)
- [CVE-2026-9503](https://insights.sbomify.com/CVE-2026-9503/): GNU LibreDWG DWG File decode.c dwg_next_entity null pointer dereference (medium 4.8)
- [CVE-2026-9502](https://insights.sbomify.com/CVE-2026-9502/): GNU LibreDWG Dwgread Utility decode.c decompress_R2004_section heap-based overflow (medium 4.8)
- [CVE-2026-9501](https://insights.sbomify.com/CVE-2026-9501/): GNU LibreDWG Dwgread Utility decode.c decompress_R2004_section assertion (medium 4.8)
- [CVE-2026-9500](https://insights.sbomify.com/CVE-2026-9500/): GNU LibreDWG Dwgread Utility decode.c read_2004_compressed_section heap-based overflow (medium 4.8)
- [CVE-2026-9499](https://insights.sbomify.com/CVE-2026-9499/): Out-of-bounds read in QTextCodec::codecForName() in Qt (medium 6.3)
- [CVE-2026-9498](https://insights.sbomify.com/CVE-2026-9498/): Dromara lamp-cloud Message Template GroovyClassLoader.parseClass special elements used in a template engine (medium 5.3)
- [CVE-2026-9497](https://insights.sbomify.com/CVE-2026-9497/): changmingxie tcc-transaction Fastjson AutoType REST API Fastjson.parseObject deserialization (medium 5.3)
- [CVE-2026-9496](https://insights.sbomify.com/CVE-2026-9496/): pacote is vulnerable to Denial of Service (DoS) via the addGitSha function (high 8.7)
- [CVE-2026-94954](https://insights.sbomify.com/CVE-2026-94954/): A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030. (high 8.8)
- [CVE-2026-94953](https://insights.sbomify.com/CVE-2026-94953/): A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030. (high 8.8)
- [CVE-2026-94952](https://insights.sbomify.com/CVE-2026-94952/): A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030. (critical 9.8)
- [CVE-2026-9495](https://insights.sbomify.com/CVE-2026-9495/): @koa/router has an Access Control Bypass (medium 6.9)
- [CVE-2026-9494](https://insights.sbomify.com/CVE-2026-9494/): ubuntu-pro-client Information Disclosure via Cleartext Bearer Token Exposure in Process Command Line (medium 5.5)
- [CVE-2026-9493](https://insights.sbomify.com/CVE-2026-9493/): BankPro E-Service Technology｜Service Center - Insecure Direct Object Reference (high 7.1)
- [CVE-2026-9492](https://insights.sbomify.com/CVE-2026-9492/): GIGABYTE｜Gigabyte Control Center - Improper Access Control (high 8.5)
- [CVE-2026-9491](https://insights.sbomify.com/CVE-2026-9491/): Server-side request forgery in Synology Chat Server (medium 4.3)
- [CVE-2026-9490](https://insights.sbomify.com/CVE-2026-9490/): Acer Care Center creates a Named Pipe with a weak Security Descriptor (medium 6.8)
- [CVE-2026-9489](https://insights.sbomify.com/CVE-2026-9489/): NitroSense V3: Local Privilege Escalation (LPE) vulnerability (high 8.5)
- [CVE-2026-9487](https://insights.sbomify.com/CVE-2026-9487/): XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID (critical 9.1)
- [CVE-2026-9486](https://insights.sbomify.com/CVE-2026-9486/): SourceCodester Student Grades Management System cross-site request forgery (medium 5.3)
- [CVE-2026-9485](https://insights.sbomify.com/CVE-2026-9485/): SourceCodester Student Grades Management System students.php cross site scripting (medium 5.1)
- [CVE-2026-9484](https://insights.sbomify.com/CVE-2026-9484/): SourceCodester Student Grades Management System classroom.php removeStudentFromClassroom improper authorization (medium 5.3)
- [CVE-2026-9483](https://insights.sbomify.com/CVE-2026-9483/): SourceCodester Student Grades Management System grades.php improper authorization (medium 5.3)
- [CVE-2026-9482](https://insights.sbomify.com/CVE-2026-9482/): Edimax EW-7438RPn formSDHCP stack-based overflow (high 8.7)
- [CVE-2026-9481](https://insights.sbomify.com/CVE-2026-9481/): Edimax EW-7438RPn formStats stack-based overflow (high 8.7)
- [CVE-2026-9480](https://insights.sbomify.com/CVE-2026-9480/): Edimax EW-7438RPn formrefresh stack-based overflow (high 8.7)
- [CVE-2026-9479](https://insights.sbomify.com/CVE-2026-9479/): Edimax EW-7438RPn formLogout stack-based overflow (high 8.7)
- [CVE-2026-9478](https://insights.sbomify.com/CVE-2026-9478/): Totolink A8000RU Web Management cstecgi.cgi setParentalRules os command injection (critical 9.3)
- [CVE-2026-9477](https://insights.sbomify.com/CVE-2026-9477/): Totolink A8000RU Web Management cstecgi.cgi setAccessDeviceCfg os command injection (critical 9.3)
- [CVE-2026-9476](https://insights.sbomify.com/CVE-2026-9476/): Totolink A8000RU Web Management cstecgi.cgi setPasswordCfg os command injection (critical 9.3)
- [CVE-2026-9475](https://insights.sbomify.com/CVE-2026-9475/): Totolink A8000RU Web Management cstecgi.cgi setIpQosRules os command injection (critical 9.3)
- [CVE-2026-9474](https://insights.sbomify.com/CVE-2026-9474/): yashpokharna2555 StudentManagementSystem studentdel.php confirm_logged_in sql injection (medium 6.9)
- [CVE-2026-9473](https://insights.sbomify.com/CVE-2026-9473/): c-rick jimeng-mcp api.ts generateVideo path traversal (medium 5.3)
- [CVE-2026-9472](https://insights.sbomify.com/CVE-2026-9472/): dazeb markdown-downloader index.ts create_subdirectory path traversal (medium 5.3)
- [CVE-2026-9471](https://insights.sbomify.com/CVE-2026-9471/): yashpokharna2555 StudentManagementSystem student.php cross site scripting (medium 5.1)
- [CVE-2026-9470](https://insights.sbomify.com/CVE-2026-9470/): yashpokharna2555 StudentManagementSystem student_trans.php confirm_logged_in sql injection (medium 6.9)
- [CVE-2026-9469](https://insights.sbomify.com/CVE-2026-9469/): yashpokharna2555 StudentManagementSystem success.php sql injection (medium 6.9)
- [CVE-2026-94683](https://insights.sbomify.com/CVE-2026-94683/): WordPress DesignSetGo plugin <= 2.8.0 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-94682](https://insights.sbomify.com/CVE-2026-94682/): WordPress Podcast Importer SecondLine plugin <= 1.5.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-94681](https://insights.sbomify.com/CVE-2026-94681/): WordPress WP Store Locator plugin < 3.0.0 - Denial of Service Attack vulnerability (medium 5.9)
- [CVE-2026-94680](https://insights.sbomify.com/CVE-2026-94680/): WordPress The Post Grid plugin <= 7.9.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-9468](https://insights.sbomify.com/CVE-2026-9468/): dazeb cline-mcp-memory-bank index.ts handleInitializeMemoryBank path traversal (medium 5.3)
- [CVE-2026-94679](https://insights.sbomify.com/CVE-2026-94679/): WordPress Fluent Support plugin <= 2.3.2 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-94678](https://insights.sbomify.com/CVE-2026-94678/): WordPress Go Live Update Urls plugin <= 7.0.8 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-94677](https://insights.sbomify.com/CVE-2026-94677/): WordPress Kadence WooCommerce Email Designer plugin <= 1.5.19.1 - PHP Object Injection vulnerability (high 7.2)
- [CVE-2026-94676](https://insights.sbomify.com/CVE-2026-94676/): WordPress Tainacan plugin <= 1.3.0 - PHP Object Injection vulnerability (high 7.2)
- [CVE-2026-94675](https://insights.sbomify.com/CVE-2026-94675/): WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.13 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-94674](https://insights.sbomify.com/CVE-2026-94674/): WordPress Pixel Manager for WooCommerce plugin <= 1.69.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-94673](https://insights.sbomify.com/CVE-2026-94673/): WordPress Simply Schedule Appointments plugin <= 1.6.12.31 - Insecure Direct Object References (IDOR) vulnerability (medium 5.3)
- [CVE-2026-94672](https://insights.sbomify.com/CVE-2026-94672/): WordPress Safe SVG plugin <= 2.5.0 - Insecure Direct Object References (IDOR) vulnerability (medium 4.3)
- [CVE-2026-94671](https://insights.sbomify.com/CVE-2026-94671/): WordPress The Post Grid plugin <= 7.9.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-94670](https://insights.sbomify.com/CVE-2026-94670/): WordPress Everest Forms plugin <= 3.6.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-9467](https://insights.sbomify.com/CVE-2026-9467/): debugmcp mcp-debugger server.ts handleGetSourceContext path traversal (medium 5.3)
- [CVE-2026-94669](https://insights.sbomify.com/CVE-2026-94669/): WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.13 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-94668](https://insights.sbomify.com/CVE-2026-94668/): WordPress Salon booking system plugin <= 10.31.5 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-94667](https://insights.sbomify.com/CVE-2026-94667/): WordPress JetReviews plugin <= 3.1.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-94666](https://insights.sbomify.com/CVE-2026-94666/): WordPress Generate PDF using Contact Form 7 plugin <= 4.2.1 - Arbitrary File Download vulnerability (high 7.5)
- [CVE-2026-94665](https://insights.sbomify.com/CVE-2026-94665/): WordPress Classified Listing plugin <= 6.1.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-94664](https://insights.sbomify.com/CVE-2026-94664/): WordPress PDF for Contact Form 7 plugin <= 7.1.0 - Arbitrary File Download vulnerability (high 7.5)
- [CVE-2026-94663](https://insights.sbomify.com/CVE-2026-94663/): WordPress ProfileGrid plugin <= 6.0.0.2 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-94662](https://insights.sbomify.com/CVE-2026-94662/): WordPress Unlimited Elements For Elementor plugin <= 2.0.19 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-94661](https://insights.sbomify.com/CVE-2026-94661/): WordPress JetBlog plugin <= 2.4.10 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-9466](https://insights.sbomify.com/CVE-2026-9466/): Tiandy Easy7 Integrated Management Platform API Endpoint updateUserPassword password recovery (medium 6.9)
- [CVE-2026-94658](https://insights.sbomify.com/CVE-2026-94658/): Apache Thrift: Lua `TFramedTransport`/`THttpTransport` re-slice the buffer on every read (quadratic) (high 8.7)
- [CVE-2026-94657](https://insights.sbomify.com/CVE-2026-94657/): Apache Thrift: javame `TJsonProtocol`/`TJSONProtocol` has no string size bound (high 8.2)
- [CVE-2026-94656](https://insights.sbomify.com/CVE-2026-94656/): Apache Thrift: rb `TJsonProtocol`/`TJSONProtocol` has no string size bound (high 8.2)
- [CVE-2026-94655](https://insights.sbomify.com/CVE-2026-94655/): Apache Thrift: Lua `TJsonProtocol` string/number readers have no size bound and are quadratic (high 8.2)
- [CVE-2026-94654](https://insights.sbomify.com/CVE-2026-94654/): Apache Thrift: Python `TNonblockingServer` busy-loops and stops selecting all fds after an 8192-byte-boundary frame (high 8.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/231/