# Vulnerabilities published in 2026


- [CVE-2026-92993](https://insights.sbomify.com/CVE-2026-92993/): Dromara mayfly-go Machine Script Feature machine_script.go RunMachineScript os command injection (medium 5.3)
- [CVE-2026-92992](https://insights.sbomify.com/CVE-2026-92992/): Dromara mayfly-go AI Assistant ai.go authorization (medium 5.3)
- [CVE-2026-92991](https://insights.sbomify.com/CVE-2026-92991/): Biggopti Library (Various Versions) - Cross-Site Scripting via display_id from Sigmative API (medium 5.4)
- [CVE-2026-92990](https://insights.sbomify.com/CVE-2026-92990/): SendPress <= 1.26.1.20 - Unauthenticated Newsletter Sending Log Disclosure via Hardcoded Token (medium 5.3)
- [CVE-2026-9299](https://insights.sbomify.com/CVE-2026-9299/): omec-project amf handler.go PDUSessionResourceModifyIndication memory corruption (medium 5.3)
- [CVE-2026-92989](https://insights.sbomify.com/CVE-2026-92989/): SendPress Newsletters <= 1.26.1.20 - Subscriber+ Mailing List Sync and Newsletter Queueing (medium 4.3)
- [CVE-2026-92987](https://insights.sbomify.com/CVE-2026-92987/): roxmltree through 0.21.1 Denial of Service via Quadratic Parsing (high 8.7)
- [CVE-2026-92986](https://insights.sbomify.com/CVE-2026-92986/): SiYuan before 3.8.4 Cross-Site Scripting via Document Title (high 8.6)
- [CVE-2026-92985](https://insights.sbomify.com/CVE-2026-92985/): SiYuan before 3.8.4 Cross-Site Scripting via Bookmark Labels (high 8.6)
- [CVE-2026-92984](https://insights.sbomify.com/CVE-2026-92984/): HUBzero CMS through 2.2.32 Session Fixation via Query-String Session Identifier (high 8.5)
- [CVE-2026-92983](https://insights.sbomify.com/CVE-2026-92983/): InternLM LMDeploy through 0.17.0 Memory Exhaustion via Session ID Mismatch (high 8.7)
- [CVE-2026-92982](https://insights.sbomify.com/CVE-2026-92982/): Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injection (high 8.5)
- [CVE-2026-92980](https://insights.sbomify.com/CVE-2026-92980/): HortusFox-Web < 6.1 Remote Code Execution via Import/Export (high 8.6)
- [CVE-2026-9298](https://insights.sbomify.com/CVE-2026-9298/): omec-project amf PathSwitchRequest memory corruption (medium 5.3)
- [CVE-2026-92978](https://insights.sbomify.com/CVE-2026-92978/): User Registration & Membership <= 5.2.8 - Cross-Site Request Forgery to trigger_bulk_action() (medium 4.3)
- [CVE-2026-92977](https://insights.sbomify.com/CVE-2026-92977/): Real Cookie Banner: GDPR & ePrivacy Cookie Consent <= 5.3.5 - Unauthenticated Stored Cross-Site Scripting via Comment (high 7.2)
- [CVE-2026-92976](https://insights.sbomify.com/CVE-2026-92976/): Stored Cross-Site Scripting (XSS) in T-Systems’ TAO 2.0 (medium 5.1)
- [CVE-2026-92975](https://insights.sbomify.com/CVE-2026-92975/): Groundhogg <= 4.8.3 - Unauthenticated Privilege Escalation to Support User Identity Confusion (high 8.1)
- [CVE-2026-92974](https://insights.sbomify.com/CVE-2026-92974/): Photo Gallery by 10Web <= 1.8.46 - Reflected Cross-Site Scripting via 'thumb_url' Parameter (medium 6.1)
- [CVE-2026-92973](https://insights.sbomify.com/CVE-2026-92973/): ansi2html 1.7.0a0 through 1.9.3 Cross-Site Scripting via OSC 8 (medium 5.3)
- [CVE-2026-92972](https://insights.sbomify.com/CVE-2026-92972/): SGLang through 0.5.19 Unauthenticated Route Poisoning via PUT endpoint (high 8.8)
- [CVE-2026-92971](https://insights.sbomify.com/CVE-2026-92971/): InternLM LMDeploy through 0.17.0 Assertion Denial of Service (high 8.7)
- [CVE-2026-92970](https://insights.sbomify.com/CVE-2026-92970/): HUBzero CMS through 2.2.32 Path Traversal via File Upload (high 8.7)
- [CVE-2026-9297](https://insights.sbomify.com/CVE-2026-9297/): Edimax BR-6428NS POST Request formWlbasic command injection (medium 5.3)
- [CVE-2026-92969](https://insights.sbomify.com/CVE-2026-92969/): Code injection in HUSKY – Products Filter for WooCommerce Professional (high 8.1)
- [CVE-2026-92967](https://insights.sbomify.com/CVE-2026-92967/): Pochipp <= 1.20.2 - Reflected Cross-Site Scripting via 'keyword' Parameter (medium 6.1)
- [CVE-2026-92966](https://insights.sbomify.com/CVE-2026-92966/): Appointment Booking Plugin <= 5.7.0 - Unauthenticated Arbitrary Shortcode Execution via First/Last Name Field (critical 9.1)
- [CVE-2026-92965](https://insights.sbomify.com/CVE-2026-92965/): TikTok 1.2.0 - 1.4.1 - Unauthenticated OAuth Code Redemption (low 3.7)
- [CVE-2026-92963](https://insights.sbomify.com/CVE-2026-92963/): vm2 before 3.11.2 Information Disclosure via Internal State (medium 6.9)
- [CVE-2026-92962](https://insights.sbomify.com/CVE-2026-92962/): vm2 before 3.11.4 Defense Invariant Violation via setup-sandbox.js (low 2.1)
- [CVE-2026-92961](https://insights.sbomify.com/CVE-2026-92961/): vm2 before 3.11.6 Memory Exhaustion DoS via bufferAllocLimit Bypass (high 8.7)
- [CVE-2026-92960](https://insights.sbomify.com/CVE-2026-92960/): vm2 before 3.11.6 Process-wide State Exposure via os and dns (critical 10.0)
- [CVE-2026-9296](https://insights.sbomify.com/CVE-2026-9296/): Edimax BR-6428NS POST Request formWlanM system command injection (medium 5.3)
- [CVE-2026-92959](https://insights.sbomify.com/CVE-2026-92959/): vm2 before 3.11.8 allowAsync Bypass via Promise Thenable (high 7.1)
- [CVE-2026-92958](https://insights.sbomify.com/CVE-2026-92958/): vm2 before 3.11.7 Denylist Bypass via fs/promises (high 8.4)
- [CVE-2026-92957](https://insights.sbomify.com/CVE-2026-92957/): vm2 before 3.11.7 NodeVM Builtin Deny-List Bypass via node: Prefix (critical 9.4)
- [CVE-2026-92956](https://insights.sbomify.com/CVE-2026-92956/): vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming (critical 10.0)
- [CVE-2026-92955](https://insights.sbomify.com/CVE-2026-92955/): vm2 before 3.11.8 Sandbox Escape via NodeVM (critical 10.0)
- [CVE-2026-92954](https://insights.sbomify.com/CVE-2026-92954/): vm2 3.10.0 through 3.11.7 Denial of Service via Host Promise (critical 9.2)
- [CVE-2026-92953](https://insights.sbomify.com/CVE-2026-92953/): vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray (critical 9.3)
- [CVE-2026-92952](https://insights.sbomify.com/CVE-2026-92952/): vm2 3.11.4 through 3.11.6 Sandbox Symbol Filtering Bypass (high 8.9)
- [CVE-2026-92951](https://insights.sbomify.com/CVE-2026-92951/): vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver (critical 9.4)
- [CVE-2026-92950](https://insights.sbomify.com/CVE-2026-92950/): vm2 before 3.11.7 Sandbox Escape via CLI require (critical 9.3)
- [CVE-2026-9295](https://insights.sbomify.com/CVE-2026-9295/): Edimax BR-6428NS POST Request formWirelessTbl buffer overflow (high 8.7)
- [CVE-2026-92949](https://insights.sbomify.com/CVE-2026-92949/): vm2 3.9.6 before 3.11.7 Sandbox Bypass via Accessor Descriptor (medium 6.3)
- [CVE-2026-92948](https://insights.sbomify.com/CVE-2026-92948/): vm2 3.9.6 through 3.11.5 Sandbox Escape via node:test (critical 9.4)
- [CVE-2026-92947](https://insights.sbomify.com/CVE-2026-92947/): vm2 before 3.11.7 Memory Disclosure via Buffer Pool (critical 10.0)
- [CVE-2026-92946](https://insights.sbomify.com/CVE-2026-92946/): vm2 before 3.11.7 Remote Code Execution via require.external (critical 10.0)
- [CVE-2026-92945](https://insights.sbomify.com/CVE-2026-92945/): vm2 before 3.11.7 Module Allowlist Bypass via Prefix Matching (low 2.3)
- [CVE-2026-92944](https://insights.sbomify.com/CVE-2026-92944/): vm2 3.10.2 through 3.11.6 Sandbox Escape via Promise Protector (critical 9.3)
- [CVE-2026-92943](https://insights.sbomify.com/CVE-2026-92943/): Improper validation of certificate with host mismatch in AWS IoT Device SDK for Python (critical 9.2)
- [CVE-2026-92942](https://insights.sbomify.com/CVE-2026-92942/): vm2 before 3.11.7 Timeout Bypass via FinalizationRegistry (high 8.7)
- [CVE-2026-92941](https://insights.sbomify.com/CVE-2026-92941/): vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulation (critical 10.0)
- [CVE-2026-92940](https://insights.sbomify.com/CVE-2026-92940/): vm2 3.11.3 through 3.11.6 HTTPS Credential Exposure via globalAgent (critical 10.0)
- [CVE-2026-9294](https://insights.sbomify.com/CVE-2026-9294/): Edimax BR-6428NS POST Request formWanTcpipSetup buffer overflow (high 8.7)
- [CVE-2026-92939](https://insights.sbomify.com/CVE-2026-92939/): vm2 3.11.3 through 3.11.6 Native Code Execution via crypto.setEngine (critical 9.4)
- [CVE-2026-92938](https://insights.sbomify.com/CVE-2026-92938/): vm2 3.11.3 through 3.11.6 Remote Code Execution via node:sqlite (critical 9.4)
- [CVE-2026-92937](https://insights.sbomify.com/CVE-2026-92937/): vm2 3.11.6 Remote Code Execution via Promise call/apply (critical 10.0)
- [CVE-2026-92936](https://insights.sbomify.com/CVE-2026-92936/): vm2 3.11.0 before 3.11.7 Information Disclosure via Error Stack (medium 6.9)
- [CVE-2026-92935](https://insights.sbomify.com/CVE-2026-92935/): vm2 NodeVM Remote Code Execution via Array-Shaped Require (critical 9.5)
- [CVE-2026-92934](https://insights.sbomify.com/CVE-2026-92934/): vm2 before 3.11.8 Sandbox Escape RCE via AggregateError (critical 9.5)
- [CVE-2026-92933](https://insights.sbomify.com/CVE-2026-92933/): vm2 before 3.11.8 Information Disclosure via util.getCallSites (medium 6.9)
- [CVE-2026-92932](https://insights.sbomify.com/CVE-2026-92932/): MISP sachertortephp Xml::build() Operator Precedence Bypass Allows Unintended HTTPS SSRF When readFile Is Disabled (medium 5.1)
- [CVE-2026-92931](https://insights.sbomify.com/CVE-2026-92931/): CWE-918: Server-Side Request Forgery in the Progress Sitefinity Next.js Renderer SDK (high 8.8)
- [CVE-2026-92930](https://insights.sbomify.com/CVE-2026-92930/): Weak cryptography in Apex Network Video Recorder (NVR) (medium 6.2)
- [CVE-2026-92929](https://insights.sbomify.com/CVE-2026-92929/): Auth bypass in Apex Network Video Recorder (NVR) (medium 5.3)
- [CVE-2026-92928](https://insights.sbomify.com/CVE-2026-92928/): Hardcoded credentials in Apex Network Video Recorder (NVR) (medium 6.5)
- [CVE-2026-92927](https://insights.sbomify.com/CVE-2026-92927/): SourceCodester Drug Recommendation System drug_recommendor.sql information disclosure (medium 6.9)
- [CVE-2026-92926](https://insights.sbomify.com/CVE-2026-92926/): code-projects Matrimonial System partner_preference.php writepartnerprefs sql injection (medium 6.9)
- [CVE-2026-92925](https://insights.sbomify.com/CVE-2026-92925/): Redis: redis: out-of-bounds read via crafted cluster bus packets (high 7.1)
- [CVE-2026-92924](https://insights.sbomify.com/CVE-2026-92924/): Unlimited Elements For Elementor < 2.0.21 - Subscriber+ Arbitrary Shortcode Execution via get_addon_output_data (medium 5.4)
- [CVE-2026-92923](https://insights.sbomify.com/CVE-2026-92923/): Unlimited Elements For Elementor 1.5.142 - 2.0.20 - Subscriber+ SQLi via get_addon_output_data (medium 6.3)
- [CVE-2026-92922](https://insights.sbomify.com/CVE-2026-92922/): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (high 8.1)
- [CVE-2026-92921](https://insights.sbomify.com/CVE-2026-92921/): admin3 through 3.0.0 Weak Password Hashing via Single-Round MD5 (medium 6.9)
- [CVE-2026-92920](https://insights.sbomify.com/CVE-2026-92920/): admin3 through 3.0.0 Session Not Invalidated When a User Account Is Disabled (medium 5.3)
- [CVE-2026-9292](https://insights.sbomify.com/CVE-2026-9292/): Rockwell Automation FactoryTalk® DataMosaix™ Private Cloud - Stored Cross-Site Scripting (high 8.4)
- [CVE-2026-92919](https://insights.sbomify.com/CVE-2026-92919/): admin3 through 3.0.0 Arbitrary File Write via Path Traversal in Storage Upload Filename (high 7.2)
- [CVE-2026-92918](https://insights.sbomify.com/CVE-2026-92918/): admin3 through 3.0.0 Session Token Disclosure via Audit Log (high 8.7)
- [CVE-2026-92917](https://insights.sbomify.com/CVE-2026-92917/): Grav 2.0.0-rc.1 through 2.0.21 Configuration Disclosure via print_r (high 8.7)
- [CVE-2026-92916](https://insights.sbomify.com/CVE-2026-92916/): Grav through 2.0.21 Unauthenticated Information Disclosure via Clockwork (high 8.7)
- [CVE-2026-92915](https://insights.sbomify.com/CVE-2026-92915/): WWBN AVideo userVerifyEmail.php Unauthenticated Access Control (medium 6.9)
- [CVE-2026-92914](https://insights.sbomify.com/CVE-2026-92914/): AVideo LoginControl PGP Second Factor Authentication Bypass (high 8.6)
- [CVE-2026-92913](https://insights.sbomify.com/CVE-2026-92913/): AVideo Weak PRNG Activation Code Authentication Bypass (critical 9.1)
- [CVE-2026-92912](https://insights.sbomify.com/CVE-2026-92912/): AVideo Cryptographically Weak PRNG via uniqid Stream Key (high 8.3)
- [CVE-2026-92911](https://insights.sbomify.com/CVE-2026-92911/): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (high 8.7)
- [CVE-2026-92910](https://insights.sbomify.com/CVE-2026-92910/): Adobe Commerce | Incorrect Authorization (CWE-863) (high 7.2)
- [CVE-2026-9291](https://insights.sbomify.com/CVE-2026-9291/): Insecure Deserialization in Amazon Braket SDK Job Results Processing (high 7.5)
- [CVE-2026-92909](https://insights.sbomify.com/CVE-2026-92909/): Adobe Commerce | Incorrect Authorization (CWE-863) (critical 9.8)
- [CVE-2026-92908](https://insights.sbomify.com/CVE-2026-92908/): Adobe Commerce | Incorrect Authorization (CWE-863) (high 8.3)
- [CVE-2026-92905](https://insights.sbomify.com/CVE-2026-92905/): Denial of Service Vulnerability (medium 5.3)
- [CVE-2026-92904](https://insights.sbomify.com/CVE-2026-92904/): Rubygem-foreman_remote_execution: job output readable without object-level view_job_invocations check (medium 4.3)
- [CVE-2026-92903](https://insights.sbomify.com/CVE-2026-92903/): SQL injection in Snowflake CLI (high 8.2)
- [CVE-2026-9290](https://insights.sbomify.com/CVE-2026-9290/): WP User Manager <= 2.9.17 - Unauthenticated Path Traversal to Local File Inclusion via 'tab' Query Parameter (high 7.5)
- [CVE-2026-92899](https://insights.sbomify.com/CVE-2026-92899/): Apache WSS4J: UsernameToken replay protection bypassed by re-encoding the Nonce (medium 4.8)
- [CVE-2026-92894](https://insights.sbomify.com/CVE-2026-92894/): Rubygem-foreman_ansible: unscoped lookupvalue deletion allows cross-model override value destruction (medium 4.3)
- [CVE-2026-92893](https://insights.sbomify.com/CVE-2026-92893/): Rubygem-foreman_ansible: ansible inventory api ignores view_hosts permission filters, exposes hidden parameters (medium 4.3)
- [CVE-2026-92892](https://insights.sbomify.com/CVE-2026-92892/): Potential command execution on the host running JFrog CLI. (critical 9.0)
- [CVE-2026-9289](https://insights.sbomify.com/CVE-2026-9289/): WordLift <= 3.54.10 - Unauthenticated Sensitive Information Exposure in JSON-LD REST API Endpoints (medium 5.3)
- [CVE-2026-92885](https://insights.sbomify.com/CVE-2026-92885/): Qode Membership <= 2.0.6.2 - Authentication Bypass via Social Login (critical 9.8)
- [CVE-2026-92883](https://insights.sbomify.com/CVE-2026-92883/): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (high 8.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/245/