# Vulnerabilities published in 2026


- [CVE-2026-94054](https://insights.sbomify.com/CVE-2026-94054/): Memory corruption in Exim (high 7.0)
- [CVE-2026-94053](https://insights.sbomify.com/CVE-2026-94053/): Apache MINA SSHD: LDAP injection in sshd-ldap (critical 9.1)
- [CVE-2026-94052](https://insights.sbomify.com/CVE-2026-94052/): Apache MINA SSHD: LDAP password authentication ineffective (critical 9.1)
- [CVE-2026-94051](https://insights.sbomify.com/CVE-2026-94051/): 0717376 cowork_bench pdf-tools-mcp server.py ControlFlowNode server-side request forgery (medium 5.3)
- [CVE-2026-94050](https://insights.sbomify.com/CVE-2026-94050/): D-Link DIR-X1860Z ubus JSON-RPC interface routerd.get_rand_key information disclosure (medium 5.3)
- [CVE-2026-9405](https://insights.sbomify.com/CVE-2026-9405/): Totolink A8000RU Web Management cstecgi.cgi setGameSpeedCfg os command injection (critical 9.3)
- [CVE-2026-94049](https://insights.sbomify.com/CVE-2026-94049/): 06ketan slideshot renderer.ts render_slides path traversal (medium 5.3)
- [CVE-2026-94048](https://insights.sbomify.com/CVE-2026-94048/): CodeAstro QR Code Attendance Management System UserController.php save privileges management (medium 5.1)
- [CVE-2026-94047](https://insights.sbomify.com/CVE-2026-94047/): samanhappy MCPHub Template Import Endpoint templateService.ts importTemplate privileges management (medium 5.3)
- [CVE-2026-94046](https://insights.sbomify.com/CVE-2026-94046/): 0215AndrewFeng ACE-MCP MCP Tool getFileSnippet.ts get_file_snippet path traversal (medium 5.3)
- [CVE-2026-94045](https://insights.sbomify.com/CVE-2026-94045/): newbee-ltd newbee-mall Goods Save Endpoint UploadController.java cross site scripting (medium 5.1)
- [CVE-2026-94044](https://insights.sbomify.com/CVE-2026-94044/): 03-lovepreetSingh MCP route.ts create_file path traversal (medium 6.9)
- [CVE-2026-94043](https://insights.sbomify.com/CVE-2026-94043/): Free5GC Gmm handler.go race condition (medium 6.9)
- [CVE-2026-94042](https://insights.sbomify.com/CVE-2026-94042/): AdithyaYelloju Restaurant Management System add_table.php mysqli_query sql injection (medium 5.3)
- [CVE-2026-94041](https://insights.sbomify.com/CVE-2026-94041/): AdithyaYelloju Restaurant-Management-System add_menu.php sql injection (medium 5.3)
- [CVE-2026-94040](https://insights.sbomify.com/CVE-2026-94040/): vas3k TaxHacker actions.ts testLLMProviderAction server-side request forgery (medium 6.9)
- [CVE-2026-9404](https://insights.sbomify.com/CVE-2026-9404/): Totolink A8000RU Web Management cstecgi.cgi setDdnsCfg os command injection (critical 9.3)
- [CVE-2026-94039](https://insights.sbomify.com/CVE-2026-94039/): vas3k TaxHacker Invoice PDF Renderer actions.ts generateInvoicePDF server-side request forgery (medium 6.9)
- [CVE-2026-94038](https://insights.sbomify.com/CVE-2026-94038/): NonceGeek dim-sum-app Deno Backend main.tsx textSearchV2Handler server-side request forgery (medium 6.9)
- [CVE-2026-94037](https://insights.sbomify.com/CVE-2026-94037/): 00Kisumi00 mcp-file-analyzer analyze_csv_data MCP tool main.py ControlFlowNode path traversal (medium 5.3)
- [CVE-2026-94036](https://insights.sbomify.com/CVE-2026-94036/): D-Link DIR-X1860/DIR-X1860Z routerd ubus access control (high 8.7)
- [CVE-2026-94035](https://insights.sbomify.com/CVE-2026-94035/): SourceCodester Drug Recommendation System index.php cross site scripting (medium 5.3)
- [CVE-2026-94034](https://insights.sbomify.com/CVE-2026-94034/): SourceCodester Drug Recommendation System Password Change change_password cross site scripting (medium 5.1)
- [CVE-2026-94033](https://insights.sbomify.com/CVE-2026-94033/): SourceCodester Drug Recommendation System User Management add_user cross site scripting (medium 5.1)
- [CVE-2026-94032](https://insights.sbomify.com/CVE-2026-94032/): itsourcecode Leave Management System index.php sql injection (medium 5.3)
- [CVE-2026-94031](https://insights.sbomify.com/CVE-2026-94031/): 0-Gaurav-0 nexus-mcp nexus_reauth MCP tool browser.ts child_process.exec command injection (medium 5.3)
- [CVE-2026-94030](https://insights.sbomify.com/CVE-2026-94030/): SerenityOS LibGfx BMPLoader.cpp decode_bmp_pixel_data integer overflow (low 2.3)
- [CVE-2026-9403](https://insights.sbomify.com/CVE-2026-9403/): Edimax BR-6675nD POST Request formWlSiteSurvey buffer overflow (high 8.7)
- [CVE-2026-94029](https://insights.sbomify.com/CVE-2026-94029/): Apache MINA SSHD: Memory exhaustion in SFTP v6 check-file-name/check-file-handle extension (medium 6.5)
- [CVE-2026-94028](https://insights.sbomify.com/CVE-2026-94028/): Server-side request forgery in Mealie (medium 5.3)
- [CVE-2026-94024](https://insights.sbomify.com/CVE-2026-94024/): Module Manager object lookup validates one byte of a module's search name (medium 6.9)
- [CVE-2026-94023](https://insights.sbomify.com/CVE-2026-94023/): Module delete dispatchers do not enforce kernel-object ownership before irreversible deletion (medium 6.9)
- [CVE-2026-9402](https://insights.sbomify.com/CVE-2026-9402/): Edimax BR-6675nD POST Request formWlanMP command injection (medium 5.3)
- [CVE-2026-94018](https://insights.sbomify.com/CVE-2026-94018/): NetX Duo Web HTTP server releases an uninitialized packet pointer on the PUT Content-Length underflow path (high 8.8)
- [CVE-2026-94016](https://insights.sbomify.com/CVE-2026-94016/): SourceCodester Drug Recommendation System add_symptom cross site scripting (medium 4.8)
- [CVE-2026-94015](https://insights.sbomify.com/CVE-2026-94015/): SourceCodester Drug Recommendation System edit_user.php sql injection (medium 6.9)
- [CVE-2026-9401](https://insights.sbomify.com/CVE-2026-9401/): Edimax BR-6675nD POST Request formWanTcpipSetup buffer overflow (high 8.7)
- [CVE-2026-94004](https://insights.sbomify.com/CVE-2026-94004/): DedeCMS mytag_js.php code injection (medium 6.9)
- [CVE-2026-94003](https://insights.sbomify.com/CVE-2026-94003/): Comfast CF-N1-S Web Management mbox-config get_css_path_from_uri stack-based overflow (critical 10.0)
- [CVE-2026-94002](https://insights.sbomify.com/CVE-2026-94002/): Apache MINA SSHD: Memory exhaustion in SFTP client via unsolicited SFTP replies (high 7.5)
- [CVE-2026-94001](https://insights.sbomify.com/CVE-2026-94001/): Keycloak-services: keycloak-services: admin credential delete bypasses denied reset-password permission (medium 6.5)
- [CVE-2026-94000](https://insights.sbomify.com/CVE-2026-94000/): Privilege escalation in Red Hat Build of Keycloak (medium 6.6)
- [CVE-2026-9400](https://insights.sbomify.com/CVE-2026-9400/): Edimax BR-6675nD POST Request formUSBStorage command injection (medium 5.3)
- [CVE-2026-93999](https://insights.sbomify.com/CVE-2026-93999/): Keycloak-services: keycloak-services: token refresh continues issuing tokens for disabled audience clients (medium 4.2)
- [CVE-2026-93997](https://insights.sbomify.com/CVE-2026-93997/): SourceCodester Drug Recommendation System edit_symptom.php sql injection (medium 6.9)
- [CVE-2026-93996](https://insights.sbomify.com/CVE-2026-93996/): Apache MINA SSHD: Memory exhaustion DoS via unbounded SCP command line read (medium 6.5)
- [CVE-2026-93995](https://insights.sbomify.com/CVE-2026-93995/): Apache MINA SSHD: Remote execution of JGit "archive -o=file.zip" can write file on the server (medium 6.5)
- [CVE-2026-93994](https://insights.sbomify.com/CVE-2026-93994/): Apache MINA SSHD: Repeated-publickey policy bypass on server (high 8.1)
- [CVE-2026-93993](https://insights.sbomify.com/CVE-2026-93993/): Mistral Vibe before 2.25.5 Remote Code Execution via git post-checkout (high 8.6)
- [CVE-2026-93992](https://insights.sbomify.com/CVE-2026-93992/): Gopeed through 2.0.0-beta.3 Arbitrary File Write via Path Traversal (high 7.0)
- [CVE-2026-93991](https://insights.sbomify.com/CVE-2026-93991/): Argo Workflows 4.1.0 through 4.1.3 Cross-Namespace Disclosure via Negated Selector (high 8.3)
- [CVE-2026-93990](https://insights.sbomify.com/CVE-2026-93990/): Expat before 2.8.5 Malformed UTF-16 Acceptance via Unchecked Surrogate (high 8.7)
- [CVE-2026-9399](https://insights.sbomify.com/CVE-2026-9399/): Edimax BR-6675nD POST Request formsetPPPoE buffer overflow (high 8.7)
- [CVE-2026-93989](https://insights.sbomify.com/CVE-2026-93989/): vLLM through 0.29.0 Cross-Request Logits Corruption via bad_words (low 2.3)
- [CVE-2026-93988](https://insights.sbomify.com/CVE-2026-93988/): QloApps through 1.7.0 Arbitrary File Read via getEmailHTML (high 7.1)
- [CVE-2026-93987](https://insights.sbomify.com/CVE-2026-93987/): rclone serve docker Path Traversal via Volume Name (medium 4.6)
- [CVE-2026-93986](https://insights.sbomify.com/CVE-2026-93986/): rclone before 1.75.1 Path Traversal via Directory Listing Names (low 2.3)
- [CVE-2026-93985](https://insights.sbomify.com/CVE-2026-93985/): OpenPanel js-runtime through 2.3.0 JavaScript Template Sandbox Escape RCE (critical 9.4)
- [CVE-2026-93984](https://insights.sbomify.com/CVE-2026-93984/): OpenPanel API through 2.3.0 Authentication Bypass via Unverified Client Secret (medium 6.9)
- [CVE-2026-93983](https://insights.sbomify.com/CVE-2026-93983/): OpenPanel through 2.3.0 SQL Injection via ClickHouse Property Key Filter (medium 5.3)
- [CVE-2026-93982](https://insights.sbomify.com/CVE-2026-93982/): OpenPanel through 2.3.0 MCP Authentication Token in Query Parameter Logged Plaintext (medium 4.8)
- [CVE-2026-93981](https://insights.sbomify.com/CVE-2026-93981/): hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Strings (low 2.3)
- [CVE-2026-93980](https://insights.sbomify.com/CVE-2026-93980/): code-projects Internship Management System Admin Login Form login.php sql injection (medium 6.9)
- [CVE-2026-9398](https://insights.sbomify.com/CVE-2026-9398/): Besen BS20 EV Charging Station BLE/WiFi authentication replay (low 2.3)
- [CVE-2026-93979](https://insights.sbomify.com/CVE-2026-93979/): code-projects Internship Management System login.php sql injection (medium 6.9)
- [CVE-2026-93978](https://insights.sbomify.com/CVE-2026-93978/): code-projects Internship Management System login.php sql injection (medium 6.9)
- [CVE-2026-93977](https://insights.sbomify.com/CVE-2026-93977/): code-projects Assessment Management add-single-mark.php cross site scripting (medium 5.1)
- [CVE-2026-93976](https://insights.sbomify.com/CVE-2026-93976/): code-projects Assessment Management add-user.php cross site scripting (medium 4.8)
- [CVE-2026-93975](https://insights.sbomify.com/CVE-2026-93975/): code-projects Assessment Management User Editing edit-user.php cross site scripting (medium 4.8)
- [CVE-2026-93974](https://insights.sbomify.com/CVE-2026-93974/): SourceCodester Online Reviewer Management System btn_functions.php remove sql injection (medium 6.9)
- [CVE-2026-93973](https://insights.sbomify.com/CVE-2026-93973/): SourceCodester Online Reviewer Management System btn_functions.php remove sql injection (medium 6.9)
- [CVE-2026-93972](https://insights.sbomify.com/CVE-2026-93972/): SourceCodester Online Reviewer Management System btn_functions.php sql injection (medium 6.9)
- [CVE-2026-93971](https://insights.sbomify.com/CVE-2026-93971/): aiyiyi121 SxDevOps settings.py information disclosure (medium 6.9)
- [CVE-2026-93970](https://insights.sbomify.com/CVE-2026-93970/): aiyiyi121 SxDevOps Settings settings.py hard-coded credentials (medium 6.9)
- [CVE-2026-9397](https://insights.sbomify.com/CVE-2026-9397/): Besen BS20 EV Charging Station OTA Update Installation improper authorization (critical 9.2)
- [CVE-2026-93969](https://insights.sbomify.com/CVE-2026-93969/): aiyiyi121 SxDevOps services.py ensure_default_superuser hard-coded credentials (medium 6.9)
- [CVE-2026-93968](https://insights.sbomify.com/CVE-2026-93968/): aiyiyi121 SxDevOps UserSerializer serializers.py update privileges management (medium 5.1)
- [CVE-2026-93967](https://insights.sbomify.com/CVE-2026-93967/): aiyiyi121 SxDevOps Command services.py generate_host_task command injection (medium 5.1)
- [CVE-2026-93966](https://insights.sbomify.com/CVE-2026-93966/): aiyiyi121 SxDevOps TASK_RUN_COMMAND host_tasks.py paramiko.SSHClient.exec_command command injection (medium 5.1)
- [CVE-2026-93965](https://insights.sbomify.com/CVE-2026-93965/): aiyiyi121 SxDevOps MCP STDIO Server Management services.py subprocess.Popen command injection (medium 5.1)
- [CVE-2026-93964](https://insights.sbomify.com/CVE-2026-93964/): NginxProxyManager nginx-proxy-manager Validate Route certificate.js internalCertificate.validate missing authentication (medium 6.9)
- [CVE-2026-93963](https://insights.sbomify.com/CVE-2026-93963/): itsourcecode Leave Management System controller.php sql injection (medium 5.3)
- [CVE-2026-93962](https://insights.sbomify.com/CVE-2026-93962/): Kamailio CDP Diameter Receiver receiver.c shm_malloc heap-based overflow (medium 6.9)
- [CVE-2026-93961](https://insights.sbomify.com/CVE-2026-93961/): Dromara UJCMS UserController UserController.java usernameExist improper authorization (medium 6.9)
- [CVE-2026-93960](https://insights.sbomify.com/CVE-2026-93960/): Pixelfed OAuth Scope ApiV1Controller.php instancePeers missing authentication (medium 5.3)
- [CVE-2026-9396](https://insights.sbomify.com/CVE-2026-9396/): Besen BS20 EV Charging Station Firmware Version Check ui layer (medium 6.3)
- [CVE-2026-93959](https://insights.sbomify.com/CVE-2026-93959/): SourceCodester Online Reviewer Management System btn_functions.php sql injection (medium 6.9)
- [CVE-2026-93958](https://insights.sbomify.com/CVE-2026-93958/): D-Link R95 DHMAPI ssi system os command injection (critical 9.4)
- [CVE-2026-93957](https://insights.sbomify.com/CVE-2026-93957/): olivier-ls PHP-FTS Filter Matching SearchEngine.php matchesSingleFilter comparison (medium 5.3)
- [CVE-2026-93956](https://insights.sbomify.com/CVE-2026-93956/): olivier-ls PHP-FTS Search SearchEngine.php buildHighlights cross site scripting (medium 5.1)
- [CVE-2026-93955](https://insights.sbomify.com/CVE-2026-93955/): grimmory-tools grimmory Download Endpoint KoboController.java streamFileToResponse authorization (medium 5.3)
- [CVE-2026-93954](https://insights.sbomify.com/CVE-2026-93954/): Missing authorization in grimmory (medium 5.3)
- [CVE-2026-93953](https://insights.sbomify.com/CVE-2026-93953/): Backuply <= 1.5.8 - Authenticated (Subscriber+) Second-Order SQL Injection via Restore to Privilege Escalation (high 8.0)
- [CVE-2026-93952](https://insights.sbomify.com/CVE-2026-93952/): Arista VeloCloud Orchestrator Improper Input Validation (critical 9.5, exploited in the wild)
- [CVE-2026-93951](https://insights.sbomify.com/CVE-2026-93951/): WordPress Zeinet theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-93950](https://insights.sbomify.com/CVE-2026-93950/): WordPress Motors theme <= 1.4.108 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-9395](https://insights.sbomify.com/CVE-2026-9395/): Besen BS20 EV Charging Station BLE/UDP insufficiently protected credentials (medium 5.1)
- [CVE-2026-93949](https://insights.sbomify.com/CVE-2026-93949/): WordPress Grocery Shopping Store theme <= 1.3.3 - Broken Authentication vulnerability (high 7.1)
- [CVE-2026-93947](https://insights.sbomify.com/CVE-2026-93947/): WordPress Traveler theme <= 3.2.9 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-93945](https://insights.sbomify.com/CVE-2026-93945/): WordPress Balance theme <= 1.12.0 - PHP Object Injection vulnerability (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/236/