# Vulnerabilities published in 2026


- [CVE-2026-94496](https://insights.sbomify.com/CVE-2026-94496/): jshERP through 3.6 Privilege Escalation via Role Management (high 8.7)
- [CVE-2026-94495](https://insights.sbomify.com/CVE-2026-94495/): jshERP through 3.6 Missing Authorization via systemConfig (high 7.1)
- [CVE-2026-94494](https://insights.sbomify.com/CVE-2026-94494/): jshERP through 3.6 Tenant Information Disclosure via GET /tenant/info (medium 5.3)
- [CVE-2026-94493](https://insights.sbomify.com/CVE-2026-94493/): Gigatech PDV5701 WebSocket Service index.html missing authentication (critical 10.0)
- [CVE-2026-94492](https://insights.sbomify.com/CVE-2026-94492/): Yonyou U8cloud OpenAPI so.saleorder.sendaudit sql injection (medium 5.3)
- [CVE-2026-94491](https://insights.sbomify.com/CVE-2026-94491/): Yonyou KSOA search_list.jsp sql injection (medium 6.9)
- [CVE-2026-9449](https://insights.sbomify.com/CVE-2026-9449/): code-projects Employee Management System changepassemp.php sql injection (medium 5.3)
- [CVE-2026-94488](https://insights.sbomify.com/CVE-2026-94488/): Cross-site scripting in Telegram Desktop (high 8.3)
- [CVE-2026-94487](https://insights.sbomify.com/CVE-2026-94487/): WordPress PublishPress Capabilities plugin <= 2.50.1 - Cross Site Request Forgery (CSRF) vulnerability (high 8.1)
- [CVE-2026-94486](https://insights.sbomify.com/CVE-2026-94486/): Next.js: Information disclosure in the Next.js development server's Model Context Protocol endpoint (low 2.3)
- [CVE-2026-94485](https://insights.sbomify.com/CVE-2026-94485/): Next.js: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass (medium 6.3)
- [CVE-2026-94484](https://insights.sbomify.com/CVE-2026-94484/): Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service (medium 6.3)
- [CVE-2026-94483](https://insights.sbomify.com/CVE-2026-94483/): Next.js: Server-Side Request Forgery in Image Optimization (high 8.3)
- [CVE-2026-94482](https://insights.sbomify.com/CVE-2026-94482/): Next.js: Denial of Service in App Router using Server Actions (high 8.2)
- [CVE-2026-9448](https://insights.sbomify.com/CVE-2026-9448/): code-projects Employee Management System applyleave.php cross site scripting (medium 5.3)
- [CVE-2026-9447](https://insights.sbomify.com/CVE-2026-9447/): SourceCodester Simple POS and Inventory System search.php sql injection (medium 6.9)
- [CVE-2026-94462](https://insights.sbomify.com/CVE-2026-94462/): Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR) (high 7.1)
- [CVE-2026-94461](https://insights.sbomify.com/CVE-2026-94461/): WordPress Ditty plugin <= 3.1.69 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-9446](https://insights.sbomify.com/CVE-2026-9446/): SourceCodester Simple POS and Inventory System edit_customer.php sql injection (medium 5.1)
- [CVE-2026-94457](https://insights.sbomify.com/CVE-2026-94457/): WordPress Captcha Code plugin <= 3.32 - Bypass Vulnerability vulnerability (medium 4.8)
- [CVE-2026-94456](https://insights.sbomify.com/CVE-2026-94456/): Weak cryptography in postiz-app (critical 9.1)
- [CVE-2026-94455](https://insights.sbomify.com/CVE-2026-94455/): Unauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API key (high 7.1)
- [CVE-2026-94453](https://insights.sbomify.com/CVE-2026-94453/): IKEv2 Use-After-Free bug when using IKE-over-TCP (high 7.5)
- [CVE-2026-94451](https://insights.sbomify.com/CVE-2026-94451/): Other in Exploit Intelligence (medium 6.5)
- [CVE-2026-94450](https://insights.sbomify.com/CVE-2026-94450/): Potential denial of service when configured to send Retry packets in s2n-quic (high 8.7)
- [CVE-2026-9445](https://insights.sbomify.com/CVE-2026-9445/): SourceCodester Simple POS and Inventory System File Extension addproduct.php unrestricted upload (medium 5.3)
- [CVE-2026-94449](https://insights.sbomify.com/CVE-2026-94449/): Denial of service in Exploit Intelligence (high 7.5)
- [CVE-2026-94448](https://insights.sbomify.com/CVE-2026-94448/): Reset context tracking on consecutive template expressions in html/template (medium 6.1)
- [CVE-2026-94447](https://insights.sbomify.com/CVE-2026-94447/): Checksum database bypass for golang.org/toolchain in cmd/go (high 7.8)
- [CVE-2026-94445](https://insights.sbomify.com/CVE-2026-94445/): Malicious user input may lead to RCE in golang.org/x/playground (high 8.8)
- [CVE-2026-94444](https://insights.sbomify.com/CVE-2026-94444/): Checksum bypass for golang.org/fips140 in cmd/go (high 7.8)
- [CVE-2026-94440](https://insights.sbomify.com/CVE-2026-94440/): Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart (high 7.5)
- [CVE-2026-9444](https://insights.sbomify.com/CVE-2026-9444/): SourceCodester Simple POS and Inventory System GET Parameter deleteproduct.php delete sql injection (medium 5.1)
- [CVE-2026-94439](https://insights.sbomify.com/CVE-2026-94439/): HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http (high 7.5)
- [CVE-2026-94432](https://insights.sbomify.com/CVE-2026-94432/): Missing authorization in Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress (medium 5.3)
- [CVE-2026-9443](https://insights.sbomify.com/CVE-2026-9443/): Edimax BR-6478AC POST Request formL2TPSetup buffer overflow (high 8.7)
- [CVE-2026-94426](https://insights.sbomify.com/CVE-2026-94426/): xuxueli xxl-job insert cross site scripting (medium 5.1)
- [CVE-2026-94425](https://insights.sbomify.com/CVE-2026-94425/): Moore Threads MTT S80 Driver Package IOCTL mtdispkm64.sys sub_140006F0C privileges management (critical 9.3)
- [CVE-2026-94424](https://insights.sbomify.com/CVE-2026-94424/): Moore Threads MTT S80 Driver Package IOCTL mtdispkm64.sys sub_140001000 heap-based overflow (critical 9.3)
- [CVE-2026-94423](https://insights.sbomify.com/CVE-2026-94423/): Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because connect never checks the host key against known_hosts. (not scored)
- [CVE-2026-94422](https://insights.sbomify.com/CVE-2026-94422/): xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escape (high 8.7)
- [CVE-2026-94421](https://insights.sbomify.com/CVE-2026-94421/): Church Admin <= 5.1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'email' Parameter (medium 6.4)
- [CVE-2026-9442](https://insights.sbomify.com/CVE-2026-9442/): Edimax BR-6478AC POST Request formiNICSiteSurvey buffer overflow (high 8.7)
- [CVE-2026-94419](https://insights.sbomify.com/CVE-2026-94419/): Client session cache reference poisoning allows resumption with wrong server (low 2.3)
- [CVE-2026-94418](https://insights.sbomify.com/CVE-2026-94418/): Signature failure masked by date error under WOLFSSL_SMALL_CERT_VERIFY (low 2.3)
- [CVE-2026-94417](https://insights.sbomify.com/CVE-2026-94417/): CRL check skipped when OCSP enabled and certificate has no OCSP URL (low 2.3)
- [CVE-2026-94416](https://insights.sbomify.com/CVE-2026-94416/): Aap-gateway: aap-gateway: authorization bypass via workload identity token forgery (medium 6.8)
- [CVE-2026-94415](https://insights.sbomify.com/CVE-2026-94415/): WordPress Betheme theme <= 28.5.8 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-94414](https://insights.sbomify.com/CVE-2026-94414/): jshERP through 3.6 Missing Authorization via updateBtnStr (medium 5.3)
- [CVE-2026-94413](https://insights.sbomify.com/CVE-2026-94413/): jshERP through 3.6 Password Hash Disclosure via /user/info (high 7.1)
- [CVE-2026-94412](https://insights.sbomify.com/CVE-2026-94412/): jshERP through 3.6 Authorization Bypass via resetPwd (high 8.7)
- [CVE-2026-94411](https://insights.sbomify.com/CVE-2026-94411/): jshERP 3.6 Privilege Escalation via updateOneValueByKeyIdAndType (high 8.7)
- [CVE-2026-94410](https://insights.sbomify.com/CVE-2026-94410/): Exposure of Role List to Low-Privileged Remote Users in Bender Custom&Partner Service (medium 5.3)
- [CVE-2026-9441](https://insights.sbomify.com/CVE-2026-9441/): Edimax BR-6478AC POST Request formiNICbasic command injection (medium 5.3)
- [CVE-2026-94408](https://insights.sbomify.com/CVE-2026-94408/): Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service (medium 4.9)
- [CVE-2026-94405](https://insights.sbomify.com/CVE-2026-94405/): WordPress Download Manager plugin <= 3.3.71 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-94404](https://insights.sbomify.com/CVE-2026-94404/): MISP CSRF vulnerability allows unauthorized attribute modification (high 7.1)
- [CVE-2026-94403](https://insights.sbomify.com/CVE-2026-94403/): ColorFul iGameCenter IOCTL ene.sys sub_140001AF0 untrusted pointer dereference (critical 9.3)
- [CVE-2026-94402](https://insights.sbomify.com/CVE-2026-94402/): IBM vulnerable to cross-site scripting (XSS) via unsanitized title truncation (medium 6.1)
- [CVE-2026-94401](https://insights.sbomify.com/CVE-2026-94401/): MISP Arbitrary Local File Read and SSRF via MISP Export Upload (high 8.3)
- [CVE-2026-94400](https://insights.sbomify.com/CVE-2026-94400/): Uncontrolled Resource Consumption in Kibana Leading to denial of service (medium 6.5)
- [CVE-2026-9440](https://insights.sbomify.com/CVE-2026-9440/): Edimax BR-6478AC POST Request formAccept command injection (medium 5.3)
- [CVE-2026-94399](https://insights.sbomify.com/CVE-2026-94399/): Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service (medium 6.5)
- [CVE-2026-94398](https://insights.sbomify.com/CVE-2026-94398/): Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service (medium 6.5)
- [CVE-2026-94397](https://insights.sbomify.com/CVE-2026-94397/): Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service (medium 6.5)
- [CVE-2026-94396](https://insights.sbomify.com/CVE-2026-94396/): Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service (medium 6.5)
- [CVE-2026-94394](https://insights.sbomify.com/CVE-2026-94394/): Missing authorization in MISP (medium 6.3)
- [CVE-2026-94393](https://insights.sbomify.com/CVE-2026-94393/): MISP Event Report Cross-Event Reparenting via Unscoped UUID Resolution in editReport (medium 6.4)
- [CVE-2026-94391](https://insights.sbomify.com/CVE-2026-94391/): WordPress Ultimate FAQ plugin <= 2.4.14 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-94390](https://insights.sbomify.com/CVE-2026-94390/): WordPress Hide Shipping Method For WooCommerce plugin <= 1.5.4 - PHP Object Injection vulnerability (high 7.2)
- [CVE-2026-9439](https://insights.sbomify.com/CVE-2026-9439/): Edimax BR-6675nD stainfo command injection (medium 5.3)
- [CVE-2026-94389](https://insights.sbomify.com/CVE-2026-94389/): WordPress AcyMailing SMTP Newsletter plugin <= 11.0.5 - Remote Code Execution (RCE) vulnerability (critical 9.0)
- [CVE-2026-94388](https://insights.sbomify.com/CVE-2026-94388/): WordPress Green Popups plugin < 7.6.3 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-94387](https://insights.sbomify.com/CVE-2026-94387/): Aureus ERP before 1.6.0 Stored XSS via Chatter Field-Change Log (medium 5.1)
- [CVE-2026-94386](https://insights.sbomify.com/CVE-2026-94386/): Apache Camel: Camel-OAuth Cross-Scope Token Reuse via an Under-Keyed JVM-Global Client Credentials Token Cache (medium 4.8)
- [CVE-2026-94384](https://insights.sbomify.com/CVE-2026-94384/): Missing Authorization in sfExecuteAWSService Lambda Dispatcher in Amazon Connect Salesforce Lambda (medium 6.4)
- [CVE-2026-94383](https://insights.sbomify.com/CVE-2026-94383/): MISP Blocklist Workflow Module: Arbitrary Script Execution via Unrestricted File Extension (high 8.6)
- [CVE-2026-94382](https://insights.sbomify.com/CVE-2026-94382/): Beszel before 0.19.0 Insecure Direct Object Reference via user-alerts (low 2.3)
- [CVE-2026-94381](https://insights.sbomify.com/CVE-2026-94381/): MISP Privilege Escalation: Read-Only API Key User Can Regain Full Role via updateLoginTime (high 8.7)
- [CVE-2026-94380](https://insights.sbomify.com/CVE-2026-94380/): Host Header Injection in HAVELSAN's Liman MYS (high 8.1)
- [CVE-2026-9438](https://insights.sbomify.com/CVE-2026-9438/): yashpokharna2555 StudentManagementSystem courseDel.php resource injection (medium 5.3)
- [CVE-2026-94379](https://insights.sbomify.com/CVE-2026-94379/): MISP: HTTP Method Bypass of Login Security Controls (Bruteforce Protection and Email OTP) (medium 6.9)
- [CVE-2026-94378](https://insights.sbomify.com/CVE-2026-94378/): SupportCandy <= 3.5.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'name' Parameter (medium 6.4)
- [CVE-2026-94377](https://insights.sbomify.com/CVE-2026-94377/): Cross-site scripting in Verified Reviews (Avis Vérifiés) (high 7.2)
- [CVE-2026-94376](https://insights.sbomify.com/CVE-2026-94376/): Better Messages <= 3.0.4 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via User Display Name (medium 6.4)
- [CVE-2026-94375](https://insights.sbomify.com/CVE-2026-94375/): Information disclosure in Order Export & Order Import for WooCommerce (medium 5.3)
- [CVE-2026-94374](https://insights.sbomify.com/CVE-2026-94374/): Missing authorization in MISP (high 8.3)
- [CVE-2026-94373](https://insights.sbomify.com/CVE-2026-94373/): MISP DOM-based Cross-Site Scripting via innerHTML in Contextual Menu (medium 6.3)
- [CVE-2026-94372](https://insights.sbomify.com/CVE-2026-94372/): Stored Cross-Site Scripting via Unescaped Galaxy Cluster Tag Names in MISP Default Theme Galaxies Index (medium 6.3)
- [CVE-2026-94370](https://insights.sbomify.com/CVE-2026-94370/): Memory corruption (double free / use-after-free) vulnerability in core string handling impacts Qt for MCUs (medium 6.5)
- [CVE-2026-9437](https://insights.sbomify.com/CVE-2026-9437/): DTStack Taier REST API Runtime.exec os command injection (medium 5.3)
- [CVE-2026-94368](https://insights.sbomify.com/CVE-2026-94368/): Noobaa-core: noobaa-core: presigned put url escalation to copyobject via unsigned x-amz-copy-source header (high 7.1)
- [CVE-2026-94367](https://insights.sbomify.com/CVE-2026-94367/): Command injection in Apex Network Video Recorder (NVR) (high 7.2)
- [CVE-2026-94360](https://insights.sbomify.com/CVE-2026-94360/): Paymentfor Gateway for WooCommerce < 1.0.6 - Unauthenticated Order Payment Forgery via Unverified Card Callbacks (medium 5.3)
- [CVE-2026-9436](https://insights.sbomify.com/CVE-2026-9436/): Totolink A8000RU Web Management cstecgi.cgi setL2tpServerCfg os command injection (critical 9.3)
- [CVE-2026-9435](https://insights.sbomify.com/CVE-2026-9435/): Totolink A8000RU Web Management cstecgi.cgi setQosCfg os command injection (critical 9.3)
- [CVE-2026-94348](https://insights.sbomify.com/CVE-2026-94348/): SQL injection in PowerScale InsightIQ (medium 6.1)
- [CVE-2026-94347](https://insights.sbomify.com/CVE-2026-94347/): Security feature bypass in PowerProtect Data Domain Virtual Edition (high 7.2)
- [CVE-2026-94346](https://insights.sbomify.com/CVE-2026-94346/): Path traversal in PowerProtect Data Domain Virtual Edition (high 7.2)
- [CVE-2026-9434](https://insights.sbomify.com/CVE-2026-9434/): Totolink A8000RU Web Management cstecgi.cgi setWiFiWpsCfg os command injection (critical 9.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/233/