# Vulnerabilities published in 2026


- [CVE-2026-94653](https://insights.sbomify.com/CVE-2026-94653/): Apache Thrift: PHP framed/memory/HTTP transports re-slice the buffer on every read (quadratic) (high 8.2)
- [CVE-2026-94652](https://insights.sbomify.com/CVE-2026-94652/): Apache Thrift: C++ `TEvhttpServer` leaks its `RequestContext` when the processor throws before calling back (medium 6.3)
- [CVE-2026-94651](https://insights.sbomify.com/CVE-2026-94651/): Apache Thrift: Java `TSaslNonblockingServer` `Computation.run` orphans a connection on a pre-auth parse error (high 8.2)
- [CVE-2026-94650](https://insights.sbomify.com/CVE-2026-94650/): Apache Thrift: c_glib generated struct readers have no recursion-depth guard (native stack exhaustion) (high 8.2)
- [CVE-2026-9465](https://insights.sbomify.com/CVE-2026-9465/): Tiandy Easy7 Integrated Management Platform GetDBDataEx.jsp sql injection (medium 6.9)
- [CVE-2026-94648](https://insights.sbomify.com/CVE-2026-94648/): Apache Thrift: dart `TJsonProtocol`/`TJSONProtocol` has no string size bound (high 8.2)
- [CVE-2026-94646](https://insights.sbomify.com/CVE-2026-94646/): Apache Thrift: Node.js `server.js` ends the process on any per-connection error (+ two triggers) (high 8.7)
- [CVE-2026-94645](https://insights.sbomify.com/CVE-2026-94645/): Apache Thrift: Node.js `TJSONProtocol` uses a peer-declared container size as an unbounded loop bound (high 8.2)
- [CVE-2026-94644](https://insights.sbomify.com/CVE-2026-94644/): Apache Thrift: PHP `TJSONProtocol` string/number readers have no size bound (high 8.2)
- [CVE-2026-94642](https://insights.sbomify.com/CVE-2026-94642/): Apache Thrift: PHP `TSimpleServer` exits the whole process on any non-transport exception (high 8.7)
- [CVE-2026-94641](https://insights.sbomify.com/CVE-2026-94641/): WordPress UsersWP plugin <= 1.2.73 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-94640](https://insights.sbomify.com/CVE-2026-94640/): Rpcbind: unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service (high 7.5)
- [CVE-2026-9464](https://insights.sbomify.com/CVE-2026-9464/): YunaiV yudao-cloud Admin API Endpoint create IotDataSinkHttpConfig server-side request forgery (medium 5.1)
- [CVE-2026-94639](https://insights.sbomify.com/CVE-2026-94639/): Denial of service in Apache Thrift (high 8.2)
- [CVE-2026-94638](https://insights.sbomify.com/CVE-2026-94638/): Apache Thrift: PHP `thrift_protocol` C extension ignores the configured `maxStringSize` (medium 6.3)
- [CVE-2026-94637](https://insights.sbomify.com/CVE-2026-94637/): Apache Thrift: Go `THeaderTransport` does not bound the inflated size of a ZLIB frame (high 8.2)
- [CVE-2026-94636](https://insights.sbomify.com/CVE-2026-94636/): Apache Thrift: Python `TZlibTransport` stops enforcing its decompressed-size limit once the limit is exactly used up (high 8.2)
- [CVE-2026-94635](https://insights.sbomify.com/CVE-2026-94635/): Apache Thrift: Lua `TBinaryProtocol:readMessageBegin` bypasses `checkStringSize` on the pre-versioned name (high 8.7)
- [CVE-2026-94634](https://insights.sbomify.com/CVE-2026-94634/): Apache Thrift: Python `TJSONProtocol` has a string length limit that is off by default (high 8.2)
- [CVE-2026-94633](https://insights.sbomify.com/CVE-2026-94633/): Apache Thrift: Dart `TBinaryProtocol.readMessageBegin` allocates from the pre-versioned name length (high 8.7)
- [CVE-2026-94632](https://insights.sbomify.com/CVE-2026-94632/): WordPress BlockStrap Page Builder - Bootstrap Blocks plugin <= 0.1.58 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-9463](https://insights.sbomify.com/CVE-2026-9463/): Edimax EW-7438RPn formLicence stack-based overflow (high 8.7)
- [CVE-2026-94627](https://insights.sbomify.com/CVE-2026-94627/): vLLM through 0.29.0 GPU KV Cache Leak via Mooncake Transfer ID Collision (high 8.7)
- [CVE-2026-94626](https://insights.sbomify.com/CVE-2026-94626/): vLLM through 0.29.0 Memory Exhaustion via Unvalidated NIXL tp_size (high 8.7)
- [CVE-2026-94625](https://insights.sbomify.com/CVE-2026-94625/): vLLM through 0.29.0 Resource Exhaustion via Ownerless Mooncake Transfer Placeholders (medium 6.9)
- [CVE-2026-94624](https://insights.sbomify.com/CVE-2026-94624/): vLLM through 0.29.0 Denial of Service via Unbounded P2P KV Offloading Sessions (high 8.7)
- [CVE-2026-94623](https://insights.sbomify.com/CVE-2026-94623/): vLLM through 0.29.0 Denial of Service via NIXL Multi-Prompt Assertion Failure (high 8.7)
- [CVE-2026-94622](https://insights.sbomify.com/CVE-2026-94622/): vLLM through 0.29.0 Denial of Service via Incomplete NIXL KV Transfer Metadata (high 8.7)
- [CVE-2026-94621](https://insights.sbomify.com/CVE-2026-94621/): AliasVault: Server-Side Request Forgery via DNS rebinding in Favicon Extraction (medium 6.3)
- [CVE-2026-94620](https://insights.sbomify.com/CVE-2026-94620/): Path traversal in classroom50 (critical 9.4)
- [CVE-2026-9462](https://insights.sbomify.com/CVE-2026-9462/): Edimax EW-7438RPn formWpsProxyEnable stack-based overflow (high 8.7)
- [CVE-2026-94613](https://insights.sbomify.com/CVE-2026-94613/): authentik: Denial of Service via Document Type Declarations in SAML Messages (high 7.5)
- [CVE-2026-94612](https://insights.sbomify.com/CVE-2026-94612/): authentik: Authentication bypass via assertion confusion in SAML sources (high 7.4)
- [CVE-2026-94611](https://insights.sbomify.com/CVE-2026-94611/): authentik: Stored credentials are readable with view permission alone (high 8.1)
- [CVE-2026-9461](https://insights.sbomify.com/CVE-2026-9461/): Edimax EW-7438RPn formRadius stack-based overflow (high 8.7)
- [CVE-2026-94609](https://insights.sbomify.com/CVE-2026-94609/): authentik: Privilege Escalation to Superuser via Group Hierarchy (high 8.8)
- [CVE-2026-94606](https://insights.sbomify.com/CVE-2026-94606/): authentik: MFA Bypass via State Confusion / Parameter Injection in AuthenticatorEmailStage (high 8.9)
- [CVE-2026-94603](https://insights.sbomify.com/CVE-2026-94603/): Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation (critical 10.0)
- [CVE-2026-9460](https://insights.sbomify.com/CVE-2026-9460/): Edimax EW-7438RPn formAccept stack-based overflow (high 8.7)
- [CVE-2026-94594](https://insights.sbomify.com/CVE-2026-94594/): Armatura LLC Armatura One Insertion of Sensitive Information into Log File (medium 5.1)
- [CVE-2026-94593](https://insights.sbomify.com/CVE-2026-94593/): Armatura LLC Armatura One Insertion of Sensitive Information into Log File (high 8.5)
- [CVE-2026-94592](https://insights.sbomify.com/CVE-2026-94592/): Armatura LLC Armatura One Use of Hard-coded Credentials (high 8.6)
- [CVE-2026-94591](https://insights.sbomify.com/CVE-2026-94591/): Armatura LLC Armatura One Use of Hard-coded Cryptographic Key (high 8.6)
- [CVE-2026-94590](https://insights.sbomify.com/CVE-2026-94590/): WordPress Sell Downloads plugin <= 1.2.3 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-9459](https://insights.sbomify.com/CVE-2026-9459/): Edimax EW-7438RPn formConnectionSetting stack-based overflow (high 8.7)
- [CVE-2026-94589](https://insights.sbomify.com/CVE-2026-94589/): File upload in Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) (critical 9.8)
- [CVE-2026-94588](https://insights.sbomify.com/CVE-2026-94588/): Command injection in pmg-api (medium 4.4)
- [CVE-2026-94587](https://insights.sbomify.com/CVE-2026-94587/): Memory corruption in Fabric OS (medium 6.9)
- [CVE-2026-94586](https://insights.sbomify.com/CVE-2026-94586/): Command injection in Fabric OS (high 8.5)
- [CVE-2026-94585](https://insights.sbomify.com/CVE-2026-94585/): Auth bypass in Fabric OS (high 7.7)
- [CVE-2026-94584](https://insights.sbomify.com/CVE-2026-94584/): Race condition in Fabric OS (low 2.1)
- [CVE-2026-94583](https://insights.sbomify.com/CVE-2026-94583/): Race condition in Fabric OS (low 2.1)
- [CVE-2026-94582](https://insights.sbomify.com/CVE-2026-94582/): Memory corruption in Fabric OS (medium 6.8)
- [CVE-2026-94581](https://insights.sbomify.com/CVE-2026-94581/): Command injection in Fabric OS (high 8.5)
- [CVE-2026-94580](https://insights.sbomify.com/CVE-2026-94580/): Path traversal in Fabric OS (medium 5.7)
- [CVE-2026-9458](https://insights.sbomify.com/CVE-2026-9458/): Totolink A8000RU Web Management cstecgi.cgi setWanCfg os command injection (critical 9.3)
- [CVE-2026-94579](https://insights.sbomify.com/CVE-2026-94579/): Command injection in Fabric OS (medium 5.4)
- [CVE-2026-94578](https://insights.sbomify.com/CVE-2026-94578/): Privilege escalation in Fabric OS (high 7.5)
- [CVE-2026-94577](https://insights.sbomify.com/CVE-2026-94577/): Privilege escalation in Fabric OS (high 7.3)
- [CVE-2026-94576](https://insights.sbomify.com/CVE-2026-94576/): Privilege escalation in Fabric OS (medium 5.9)
- [CVE-2026-94575](https://insights.sbomify.com/CVE-2026-94575/): Privilege escalation in Fabric OS (medium 6.9)
- [CVE-2026-94574](https://insights.sbomify.com/CVE-2026-94574/): CVE-2026-94574 (high 7.8)
- [CVE-2026-94573](https://insights.sbomify.com/CVE-2026-94573/): Repeater Fields for Elementor Forms <= 2.2.7 - Unauthenticated Stored Cross-Site Scripting via Repeater Field Value (high 7.2)
- [CVE-2026-94572](https://insights.sbomify.com/CVE-2026-94572/): Code injection in Octavia (critical 9.4)
- [CVE-2026-94571](https://insights.sbomify.com/CVE-2026-94571/): Code injection in Octavia (critical 9.4)
- [CVE-2026-94570](https://insights.sbomify.com/CVE-2026-94570/): CVE-2026-94570 (medium 5.9)
- [CVE-2026-9457](https://insights.sbomify.com/CVE-2026-9457/): Totolink A8000RU Web Management cstecgi.cgi UploadFirmwareFile os command injection (critical 9.3)
- [CVE-2026-94568](https://insights.sbomify.com/CVE-2026-94568/): WordPress Pay with Vipps for WooCommerce plugin <= 6.2.0 - PHP Object Injection vulnerability (high 7.2)
- [CVE-2026-9456](https://insights.sbomify.com/CVE-2026-9456/): Totolink A8000RU Web Management cstecgi.cgi setOpenVpnCfg os command injection (critical 9.3)
- [CVE-2026-9455](https://insights.sbomify.com/CVE-2026-9455/): Totolink A8000RU Web Management cstecgi.cgi UploadOpenVpnCert os command injection (critical 9.3)
- [CVE-2026-94545](https://insights.sbomify.com/CVE-2026-94545/): Satori-generated SVG has improper escaping (medium 5.3)
- [CVE-2026-94544](https://insights.sbomify.com/CVE-2026-94544/): Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages (medium 6.3)
- [CVE-2026-94543](https://insights.sbomify.com/CVE-2026-94543/): Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applications (medium 6.3)
- [CVE-2026-94541](https://insights.sbomify.com/CVE-2026-94541/): WPMobile.App <= 11.82 - Unauthenticated Admin Account Takeover via 'wpapp_category[]' Parameter (critical 9.8)
- [CVE-2026-94540](https://insights.sbomify.com/CVE-2026-94540/): DesktopSMS 1.11.0 Unauthorized Access via Local Service (high 7.4)
- [CVE-2026-9454](https://insights.sbomify.com/CVE-2026-9454/): Totolink A8000RU Web Management cstecgi.cgi setOpenVpnCertGenerationCfg os command injection (critical 9.3)
- [CVE-2026-94539](https://insights.sbomify.com/CVE-2026-94539/): SupportCandy <= 3.5.3 - Authenticated (Custom+) SQL Injection via 'sort_by' Parameter (medium 6.5)
- [CVE-2026-94538](https://insights.sbomify.com/CVE-2026-94538/): Missing authorization in WP File Download (high 8.1)
- [CVE-2026-94536](https://insights.sbomify.com/CVE-2026-94536/): lamp-cloud through 5.10.0 Unauthorized Information Disclosure via /anyone/visible/resource (medium 5.3)
- [CVE-2026-94535](https://insights.sbomify.com/CVE-2026-94535/): lamp-cloud through 5.10.0 Unauthorized Notification Deletion (high 7.1)
- [CVE-2026-94534](https://insights.sbomify.com/CVE-2026-94534/): lamp-cloud through 5.10.0 Unauthorized Profile Modification via PUT endpoints (high 7.1)
- [CVE-2026-94533](https://insights.sbomify.com/CVE-2026-94533/): lamp-cloud through 5.10.0 Unauthorized File Download via /anyone/file (high 7.1)
- [CVE-2026-94532](https://insights.sbomify.com/CVE-2026-94532/): lamp-cloud through 5.10.0 Unauthorized User Profile Access via getUserInfoById (high 7.1)
- [CVE-2026-9453](https://insights.sbomify.com/CVE-2026-9453/): FoundDream miniclawd SkillsLoader skills-loader.ts which command injection (medium 6.9)
- [CVE-2026-94520](https://insights.sbomify.com/CVE-2026-94520/): Microsoft SQL Server Denial of Service Vulnerability (medium 4.9)
- [CVE-2026-9452](https://insights.sbomify.com/CVE-2026-9452/): FoundDream miniclawd exec.ts ExecTool.execute os command injection (medium 6.9)
- [CVE-2026-94512](https://insights.sbomify.com/CVE-2026-94512/): SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-94510](https://insights.sbomify.com/CVE-2026-94510/): Microsoft Bookings Elevation of Privilege Vulnerability (critical 9.9)
- [CVE-2026-9451](https://insights.sbomify.com/CVE-2026-9451/): code-projects Employee Management System applyleaveprocess.php sql injection (medium 5.3)
- [CVE-2026-94506](https://insights.sbomify.com/CVE-2026-94506/): Microsoft Office Access Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-94505](https://insights.sbomify.com/CVE-2026-94505/): Missing authorization in Nelio Content – Editorial Calendar & Social Media Auto-Posting (high 8.1)
- [CVE-2026-94504](https://insights.sbomify.com/CVE-2026-94504/): Ninja Forms – The Contact Form Builder That Grows With You <= 3.15.3 - Stored Cross-Site Scripting (high 7.2)
- [CVE-2026-94503](https://insights.sbomify.com/CVE-2026-94503/): WordPress Zombify plugin <= 1.7.7 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2026-94502](https://insights.sbomify.com/CVE-2026-94502/): Out-of-bounds write in Zigbee Publish Price Matrix handling (high 7.5)
- [CVE-2026-94501](https://insights.sbomify.com/CVE-2026-94501/): jshERP through 3.6 Privilege Escalation via userBusiness CRUD (high 8.7)
- [CVE-2026-94500](https://insights.sbomify.com/CVE-2026-94500/): WordPress ElementsKit Elementor addons Lite plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-9450](https://insights.sbomify.com/CVE-2026-9450/): code-projects Employee Management System psubmit.php sql injection (medium 5.3)
- [CVE-2026-94499](https://insights.sbomify.com/CVE-2026-94499/): WordPress FormGent plugin <= 1.12.2 - Broken Access Control vulnerability (high 7.1)
- [CVE-2026-94498](https://insights.sbomify.com/CVE-2026-94498/): WordPress AppMySite plugin <= 3.15.4 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-94497](https://insights.sbomify.com/CVE-2026-94497/): jshERP through 3.6 Unauthorized Access via by-id Endpoints (high 8.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/232/