# Vulnerabilities published in 2026


- [CVE-2026-93442](https://insights.sbomify.com/CVE-2026-93442/): IBM QRadar SIEM Out-of-bounds Read (high 8.2)
- [CVE-2026-93441](https://insights.sbomify.com/CVE-2026-93441/): IBM QRadar SIEM HTTP Receiver protocol is vulnerable to a denial of service (high 8.6)
- [CVE-2026-9344](https://insights.sbomify.com/CVE-2026-9344/): Edimax EW-7438RPn webs formWpsStart stack-based overflow (high 8.7)
- [CVE-2026-93436](https://insights.sbomify.com/CVE-2026-93436/): vLLM through 0.29.0 Memory Exhaustion via Rejected Requests (high 8.7)
- [CVE-2026-93435](https://insights.sbomify.com/CVE-2026-93435/): redis-parser through 3.0.0 Denial of Service via Unbounded Recursion (high 8.7)
- [CVE-2026-93434](https://insights.sbomify.com/CVE-2026-93434/): Fireware OS XPath Injection in SSH Authentication Allows Blind Extraction of Configuration Secrets (high 8.7)
- [CVE-2026-93433](https://insights.sbomify.com/CVE-2026-93433/): Libstoragemgmt: libstoragemgmt: denial of service via stack buffer overflow in scsi vpd page parsing (medium 5.5)
- [CVE-2026-93432](https://insights.sbomify.com/CVE-2026-93432/): Io.quarkus.qute:quarkus-core: cross-site scripting (xss) and json injection via qute {#eval} section in quarkus (medium 6.1)
- [CVE-2026-93430](https://insights.sbomify.com/CVE-2026-93430/): Cross-site scripting in GD Rating System (high 7.2)
- [CVE-2026-9343](https://insights.sbomify.com/CVE-2026-9343/): Edimax EW-7438RPn webs formWpsStart os command injection (medium 5.3)
- [CVE-2026-93428](https://insights.sbomify.com/CVE-2026-93428/): Missing authorization in Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin (high 7.5)
- [CVE-2026-93426](https://insights.sbomify.com/CVE-2026-93426/): SigNoz 0.87.0 before 0.142.0 - SQL Injection in v5 Query Builder Field Key Names (high 8.4)
- [CVE-2026-93425](https://insights.sbomify.com/CVE-2026-93425/): Dokploy: Authenticated OS Command Injection in patch.readRepoDirectories (repoPath) leads to RCE as root (critical 9.9)
- [CVE-2026-93421](https://insights.sbomify.com/CVE-2026-93421/): Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint (medium 5.3)
- [CVE-2026-9342](https://insights.sbomify.com/CVE-2026-9342/): SourceCodester Hospitals Patient Records Management System view_history.php sql injection (medium 5.3)
- [CVE-2026-9341](https://insights.sbomify.com/CVE-2026-9341/): Academy LMS <= 3.8.0 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'user_id' Parameter (medium 4.3)
- [CVE-2026-93405](https://insights.sbomify.com/CVE-2026-93405/): Mailspring: Stored XSS in attachment quick preview (unsanitized Markdown/DOCX/XLSX conversion) (medium 6.1)
- [CVE-2026-93399](https://insights.sbomify.com/CVE-2026-93399/): Missing authorization in Online Scheduling and Appointment Booking System – Bookly (critical 9.1)
- [CVE-2026-93395](https://insights.sbomify.com/CVE-2026-93395/): Integer Underflow → Heap Out-of-Bounds Read in `bson_new_from_buffer() (medium 6.9)
- [CVE-2026-93394](https://insights.sbomify.com/CVE-2026-93394/): libmongoc SCRAM client nonce-validation bypass (medium 6.3)
- [CVE-2026-93393](https://insights.sbomify.com/CVE-2026-93393/): Heap overflow via oversized decrypted TLS record sequence in Windows Secure Channel stream (critical 9.2)
- [CVE-2026-93388](https://insights.sbomify.com/CVE-2026-93388/): File upload in Printcart Store – Web to Print Product Designer for WooCommerce (critical 9.8)
- [CVE-2026-93387](https://insights.sbomify.com/CVE-2026-93387/): Information disclosure in Chrome (medium 4.3)
- [CVE-2026-93386](https://insights.sbomify.com/CVE-2026-93386/): Other in Chrome (medium 5.4)
- [CVE-2026-93385](https://insights.sbomify.com/CVE-2026-93385/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-93384](https://insights.sbomify.com/CVE-2026-93384/): Server-side request forgery in Chrome (low 3.7)
- [CVE-2026-93383](https://insights.sbomify.com/CVE-2026-93383/): Information disclosure in Chrome (medium 4.3)
- [CVE-2026-93382](https://insights.sbomify.com/CVE-2026-93382/): Use after free in Chrome (high 8.8)
- [CVE-2026-93381](https://insights.sbomify.com/CVE-2026-93381/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-93380](https://insights.sbomify.com/CVE-2026-93380/): Race condition in Chrome (low 3.1)
- [CVE-2026-9338](https://insights.sbomify.com/CVE-2026-9338/): IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities (medium 5.3)
- [CVE-2026-93379](https://insights.sbomify.com/CVE-2026-93379/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2026-93378](https://insights.sbomify.com/CVE-2026-93378/): Missing authorization in Chrome (low 3.1)
- [CVE-2026-93377](https://insights.sbomify.com/CVE-2026-93377/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-93376](https://insights.sbomify.com/CVE-2026-93376/): Memory corruption in Chrome (medium 6.3)
- [CVE-2026-93375](https://insights.sbomify.com/CVE-2026-93375/): Other in Chrome (high 8.1)
- [CVE-2026-93374](https://insights.sbomify.com/CVE-2026-93374/): Use after free in Chrome (critical 9.6)
- [CVE-2026-93373](https://insights.sbomify.com/CVE-2026-93373/): Use after free in Chrome (critical 9.6)
- [CVE-2026-93372](https://insights.sbomify.com/CVE-2026-93372/): Memory corruption in Chrome (critical 9.6)
- [CVE-2026-93371](https://insights.sbomify.com/CVE-2026-93371/): marcopiovanello yt-dlp-web-ui generic.go NewGenericDownload command injection (medium 6.9)
- [CVE-2026-93368](https://insights.sbomify.com/CVE-2026-93368/): Rename wp-login.php to anything you want <= 2.0.1 - Unauthenticated SQL Injection via 'log' (Username) Parameter (high 7.5)
- [CVE-2026-93367](https://insights.sbomify.com/CVE-2026-93367/): Cross-site scripting in Visitor Traffic Real Time Statistics pro (high 7.2)
- [CVE-2026-93366](https://insights.sbomify.com/CVE-2026-93366/): Bludit CMS 3.22.0 Authorization Bypass via list-images/delete-image AJAX Endpoints (medium 5.3)
- [CVE-2026-93365](https://insights.sbomify.com/CVE-2026-93365/): Bludit CMS 3.22.0 Missing Authorization via content-get-list AJAX Endpoint (high 7.1)
- [CVE-2026-93364](https://insights.sbomify.com/CVE-2026-93364/): Bludit CMS 3.22.0 Mass Assignment Privilege Escalation via Pages::edit() (medium 5.3)
- [CVE-2026-93363](https://insights.sbomify.com/CVE-2026-93363/): Payload CMS storage-vercel-blob Adapter Improper Access Control on Upload Route (medium 5.3)
- [CVE-2026-9336](https://insights.sbomify.com/CVE-2026-9336/): IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities (medium 6.5)
- [CVE-2026-93355](https://insights.sbomify.com/CVE-2026-93355/): LiteLLM Weak JWT Authentication via Email-Based User Lookup (high 7.6)
- [CVE-2026-93354](https://insights.sbomify.com/CVE-2026-93354/): Taskview Community Missing Authentication via OAuth Dynamic Client Registration (high 8.5)
- [CVE-2026-93353](https://insights.sbomify.com/CVE-2026-93353/): copyparty SFTP Volume Restriction Bypass via mkdir/rmdir/chattr Handlers (low 2.3)
- [CVE-2026-93352](https://insights.sbomify.com/CVE-2026-93352/): Laravel-Mediable 7.0.0 < 7.0.2 RCE via .pht File Upload (critical 9.3)
- [CVE-2026-9335](https://insights.sbomify.com/CVE-2026-9335/): Improper Handling of HDF5 ExternalLinks in keras-team/keras (medium 6.5)
- [CVE-2026-93349](https://insights.sbomify.com/CVE-2026-93349/): Frictionless OS Command Injection via explore Console Command (high 8.6)
- [CVE-2026-93348](https://insights.sbomify.com/CVE-2026-93348/): Unsloth Zoo Code Injection via model_type in config.json (high 8.6)
- [CVE-2026-93347](https://insights.sbomify.com/CVE-2026-93347/): Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster get_list_file (medium 6.9)
- [CVE-2026-93346](https://insights.sbomify.com/CVE-2026-93346/): Wazuh 4.0.0 before 4.14.8 API Brute-Force Protection Bypass via Race Condition (medium 6.9)
- [CVE-2026-93345](https://insights.sbomify.com/CVE-2026-93345/): MikroTik RouterOS < 7.25beta4 Improper Input Validation DoS via BGP Labelled-VPN NLRI (high 8.7)
- [CVE-2026-93344](https://insights.sbomify.com/CVE-2026-93344/): MarketKing < 2.1.72 Missing Authorization via marketking_get_page_content AJAX (high 7.1)
- [CVE-2026-93343](https://insights.sbomify.com/CVE-2026-93343/): MarketKing < 2.1.72 Missing Authorization via marketking_admin_vendors_ajax (high 7.1)
- [CVE-2026-93342](https://insights.sbomify.com/CVE-2026-93342/): MarketKing < 2.1.72 Missing Authorization via marketking_duplicate_product AJAX (medium 5.3)
- [CVE-2026-93341](https://insights.sbomify.com/CVE-2026-93341/): MarketKing < 2.1.72 Missing Authorization via marketking_send_refund AJAX (medium 5.3)
- [CVE-2026-93340](https://insights.sbomify.com/CVE-2026-93340/): Gladys Assistant < 5.1.0 Password Reset Link Poisoning via forgot_password Endpoint (high 7.4)
- [CVE-2026-9334](https://insights.sbomify.com/CVE-2026-9334/): Memory corruption in Cpanel::JSON::XS (high 7.3)
- [CVE-2026-93339](https://insights.sbomify.com/CVE-2026-93339/): Ditty < 3.1.70 Stored XSS via Layout Tag Wrapper Attribute (medium 5.1)
- [CVE-2026-93338](https://insights.sbomify.com/CVE-2026-93338/): Grandstream GWN7660ELR < 1.0.27.6 Information Disclosure via SNMP Default Community String (medium 6.9)
- [CVE-2026-93337](https://insights.sbomify.com/CVE-2026-93337/): NetworkManager-l2tp Privilege Escalation via pppd Plugin Injection (high 8.5)
- [CVE-2026-93336](https://insights.sbomify.com/CVE-2026-93336/): Missing authorization in the unit resources download route in Juju controllers (high 7.1)
- [CVE-2026-93332](https://insights.sbomify.com/CVE-2026-93332/): Missing authorization in Server (medium 5.4)
- [CVE-2026-93331](https://insights.sbomify.com/CVE-2026-93331/): GPAC RTP Depacketizer rtp_depacketizer.c gf_rtp_parse_ttxt out-of-bounds (medium 6.9)
- [CVE-2026-93330](https://insights.sbomify.com/CVE-2026-93330/): Security feature bypass in Server (medium 4.3)
- [CVE-2026-93328](https://insights.sbomify.com/CVE-2026-93328/): Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write (critical 9.3)
- [CVE-2026-93326](https://insights.sbomify.com/CVE-2026-93326/): Crafted Git build source can bypass certain policy validation (medium 6.0)
- [CVE-2026-93323](https://insights.sbomify.com/CVE-2026-93323/): Oversized Dockerfile or .dockerignore can exhaust buildkitd memory (medium 6.8)
- [CVE-2026-93322](https://insights.sbomify.com/CVE-2026-93322/): Malformed MergeOp can crash the BuildKit daemon (medium 6.9)
- [CVE-2026-93321](https://insights.sbomify.com/CVE-2026-93321/): Malformed LLB file operation can crash buildkitd (medium 6.9)
- [CVE-2026-93320](https://insights.sbomify.com/CVE-2026-93320/): BuildKit improperly handles special files in build snapshots (medium 6.0)
- [CVE-2026-93319](https://insights.sbomify.com/CVE-2026-93319/): A malicious frontend can cause a daemon panic (medium 5.7)
- [CVE-2026-93318](https://insights.sbomify.com/CVE-2026-93318/): Cache poisoning via unvalidated image layer DiffIDs (high 7.5)
- [CVE-2026-93317](https://insights.sbomify.com/CVE-2026-93317/): Container blob cache can accept unverified content (medium 5.9)
- [CVE-2026-93316](https://insights.sbomify.com/CVE-2026-93316/): Starting daemon with --cdi-disabled flag can lead to panic on specific builds (high 7.1)
- [CVE-2026-93315](https://insights.sbomify.com/CVE-2026-93315/): BuildKit proxy CA cleanup can be disrupted by build steps (medium 5.8)
- [CVE-2026-93314](https://insights.sbomify.com/CVE-2026-93314/): Freedesktop Poppler FoFiTrueType.cc mapCodeToGID integer overflow (medium 5.3)
- [CVE-2026-93313](https://insights.sbomify.com/CVE-2026-93313/): Freedesktop Poppler JBIG2Stream.cc readCodeTableSeg integer overflow (medium 5.3)
- [CVE-2026-93312](https://insights.sbomify.com/CVE-2026-93312/): Freedesktop Poppler JBIG2Stream.cc rewind null pointer dereference (medium 5.3)
- [CVE-2026-93311](https://insights.sbomify.com/CVE-2026-93311/): Freedesktop Poppler SampledFunction Function.cc integer overflow (medium 5.3)
- [CVE-2026-93310](https://insights.sbomify.com/CVE-2026-93310/): O-RAN-SC SMO OAM VES Collector allocation of resources (medium 6.9)
- [CVE-2026-9331](https://insights.sbomify.com/CVE-2026-9331/): Missing authorization in EDD Product Catalog Feed by PixelYourSite (high 7.1)
- [CVE-2026-93309](https://insights.sbomify.com/CVE-2026-93309/): O-RAN-SC SMO OAM VES Collector allocation of resources (medium 5.3)
- [CVE-2026-93308](https://insights.sbomify.com/CVE-2026-93308/): O-RAN-SC SMO OAM VES Collector allocation of resources (medium 5.3)
- [CVE-2026-93307](https://insights.sbomify.com/CVE-2026-93307/): O-RAN-SC SMO OAM VES Collector memory allocation (medium 5.3)
- [CVE-2026-93306](https://insights.sbomify.com/CVE-2026-93306/): This Power System update is being released to address (high 7.1)
- [CVE-2026-93304](https://insights.sbomify.com/CVE-2026-93304/): (D)TLS 1.2 client accepts early ChangeCipherSpec before ClientKeyExchange (medium 6.3)
- [CVE-2026-93303](https://insights.sbomify.com/CVE-2026-93303/): Cross-site scripting in HT Contact Form – Drag & Drop Form Builder for WordPress (high 7.2)
- [CVE-2026-93302](https://insights.sbomify.com/CVE-2026-93302/): Trusted peer certificate match ignores public key, allowing forged CA clones (high 8.3)
- [CVE-2026-93300](https://insights.sbomify.com/CVE-2026-93300/): EventON - Subscriber <= 1.4.5 - Unauthenticated SQL Injection via 'email' Parameter (high 7.5)
- [CVE-2026-9330](https://insights.sbomify.com/CVE-2026-9330/): IBM WebSphere Application Server is affected by remote code execution (high 8.5)
- [CVE-2026-93296](https://insights.sbomify.com/CVE-2026-93296/): MISP Overmind: Stored Cross-Site Scripting via Unescaped Object Names in Statistics Legends (high 8.5)
- [CVE-2026-93295](https://insights.sbomify.com/CVE-2026-93295/): MISP Background Job Argument Injection via Console Path Switches Enables Remote Code Execution (high 8.7)
- [CVE-2026-93294](https://insights.sbomify.com/CVE-2026-93294/): Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs (medium 6.3)
- [CVE-2026-93293](https://insights.sbomify.com/CVE-2026-93293/): Cross-site scripting in Password Protected – Protect Your Site Content With a Password (medium 6.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/241/