# Vulnerabilities published in 2026


- [CVE-2026-9230](https://insights.sbomify.com/CVE-2026-9230/): Missing authorization in Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker (medium 4.3)
- [CVE-2026-92299](https://insights.sbomify.com/CVE-2026-92299/): @jitsi/electron-sdk before 10.0.5 Unauthorized Screen Capture (high 7.1)
- [CVE-2026-92298](https://insights.sbomify.com/CVE-2026-92298/): EspoCRM through 10.0.8 Weak Token Generation via rand() (medium 6.3)
- [CVE-2026-92289](https://insights.sbomify.com/CVE-2026-92289/): Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKCE or secret" mode be (critical 9.1)
- [CVE-2026-92288](https://insights.sbomify.com/CVE-2026-92288/): Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspectio (critical 9.1)
- [CVE-2026-92287](https://insights.sbomify.com/CVE-2026-92287/): Server-side request forgery in Apache Arrow C++ (high 8.1)
- [CVE-2026-92284](https://insights.sbomify.com/CVE-2026-92284/): Caddy: Unbounded body buffer via {http.request.body} placeholder — memory exhaustion DoS (medium 6.9)
- [CVE-2026-9228](https://insights.sbomify.com/CVE-2026-9228/): Missing authorization in Timetable and Event Schedule by MotoPress (medium 4.3)
- [CVE-2026-9227](https://insights.sbomify.com/CVE-2026-9227/): GutenBee <= 2.20.1 - Authenticated (Author+) Arbitrary File Upload via wp_check_filetype_and_ext Filter (high 8.8)
- [CVE-2026-92263](https://insights.sbomify.com/CVE-2026-92263/): Command injection in SparkyFitness (high 7.2)
- [CVE-2026-92262](https://insights.sbomify.com/CVE-2026-92262/): MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass. (critical 9.9)
- [CVE-2026-9226](https://insights.sbomify.com/CVE-2026-9226/): Auth bypass in Server (medium 6.8)
- [CVE-2026-92259](https://insights.sbomify.com/CVE-2026-92259/): Integer overflow in Escargot (medium 5.5)
- [CVE-2026-92257](https://insights.sbomify.com/CVE-2026-92257/): Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting in L7 Content Management via eval() Sinks (medium 5.1)
- [CVE-2026-92256](https://insights.sbomify.com/CVE-2026-92256/): Netcore NR255-V 1.5.130703 IPsec PSK and RSA Key Disclosure via l2tpd_config_show.cgi Read Handlers (high 7.1)
- [CVE-2026-92255](https://insights.sbomify.com/CVE-2026-92255/): Netcore NR255-V 1.5.130703 Out-of-Bounds Read in filter_arp_put_file.cgi via String API Misuse (medium 5.3)
- [CVE-2026-92254](https://insights.sbomify.com/CVE-2026-92254/): WatchDog Antivirus kernel driver arbitrary file deletion via unauthenticated IOCTL (medium 6.9)
- [CVE-2026-92253](https://insights.sbomify.com/CVE-2026-92253/): Arbitrary File Write via Directory Junction in WatchDog Anti-Virus Quarantine Restoration (medium 5.2)
- [CVE-2026-92252](https://insights.sbomify.com/CVE-2026-92252/): Incorrect Default Permissions in WatchDog Anti-Virus Installation Directory (medium 5.9)
- [CVE-2026-9225](https://insights.sbomify.com/CVE-2026-9225/): Langflow is vulnerable to unauthorized file system access due to path traversal and missing storage path validation (medium 6.5)
- [CVE-2026-92249](https://insights.sbomify.com/CVE-2026-92249/): Qi Addons For Elementor <= 1.11 - Reflected DOM-Based Cross-Site Scripting via 's' Parameter (medium 6.1)
- [CVE-2026-92248](https://insights.sbomify.com/CVE-2026-92248/): Gimp: integer overflow when generating a thumbnail preview for a psd file (high 7.8)
- [CVE-2026-92247](https://insights.sbomify.com/CVE-2026-92247/): synaptikcms synaptik-cms Admin File Manager file-manager.php rename unrestricted upload (medium 5.1)
- [CVE-2026-92245](https://insights.sbomify.com/CVE-2026-92245/): Missing authorization in Simply Schedule Appointments (high 7.5)
- [CVE-2026-92244](https://insights.sbomify.com/CVE-2026-92244/): Cross-site scripting in PDF Invoices & Packing Slips for WooCommerce (high 7.2)
- [CVE-2026-92243](https://insights.sbomify.com/CVE-2026-92243/): Ivory Search <= 5.5.18 - Reflected DOM-Based Cross-Site Scripting via 's' Parameter (medium 6.1)
- [CVE-2026-92240](https://insights.sbomify.com/CVE-2026-92240/): Out-of-bounds read in IMAP response parser (critical 9.1)
- [CVE-2026-9224](https://insights.sbomify.com/CVE-2026-9224/): Missing authorization in Server (medium 4.3)
- [CVE-2026-92239](https://insights.sbomify.com/CVE-2026-92239/): Buffer overrun in IMAP (high 8.1)
- [CVE-2026-92238](https://insights.sbomify.com/CVE-2026-92238/): Ambiguous parsing of mail headers (critical 9.8)
- [CVE-2026-92237](https://insights.sbomify.com/CVE-2026-92237/): Information disclosure in PowerShell Universal (medium 6.5)
- [CVE-2026-92235](https://insights.sbomify.com/CVE-2026-92235/): Code injection in WP Ultimate Review (high 8.1)
- [CVE-2026-92234](https://insights.sbomify.com/CVE-2026-92234/): QloApps through 1.7.0 Reflected XSS via Hotel Feature Validation Errors (medium 5.1)
- [CVE-2026-92232](https://insights.sbomify.com/CVE-2026-92232/): Cross-site scripting in Joomla! CMS (high 7.1)
- [CVE-2026-92231](https://insights.sbomify.com/CVE-2026-92231/): Cross-site scripting in Joomla! CMS (high 7.1)
- [CVE-2026-92230](https://insights.sbomify.com/CVE-2026-92230/): Apache Karaf: Improper release of ClassLoader references via static ThreadLocal caching (high 7.5)
- [CVE-2026-9223](https://insights.sbomify.com/CVE-2026-9223/): Missing authorization in Server (medium 4.3)
- [CVE-2026-92229](https://insights.sbomify.com/CVE-2026-92229/): Forminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter (critical 9.1)
- [CVE-2026-92228](https://insights.sbomify.com/CVE-2026-92228/): Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log read (medium 6.5)
- [CVE-2026-92227](https://insights.sbomify.com/CVE-2026-92227/): Auth bypass in Joomla! CMS (high 8.2)
- [CVE-2026-92226](https://insights.sbomify.com/CVE-2026-92226/): Missing authorization in Joomla! CMS (high 7.0)
- [CVE-2026-92225](https://insights.sbomify.com/CVE-2026-92225/): Joomla! Core - [20260912] - Core - XSS in module list in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 (medium 5.9)
- [CVE-2026-92224](https://insights.sbomify.com/CVE-2026-92224/): Joomla! Core - [20260911] - Core - XSS in link toolbar layout in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 (medium 5.9)
- [CVE-2026-92223](https://insights.sbomify.com/CVE-2026-92223/): Joomla! Core - [20260910] - Core - Improper ACL checks for workflow stage changes in Joomla 5.0.0-5.4.8, 6.0.0-6.1.3 (medium 5.1)
- [CVE-2026-92222](https://insights.sbomify.com/CVE-2026-92222/): Joomla! Core - [20260909] - Core - SSRF vectors in various core extensions in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 (high 8.9)
- [CVE-2026-92221](https://insights.sbomify.com/CVE-2026-92221/): gedelumbung HospitalManagement app_global_admin_model.php generate_index_pasien sql injection (medium 5.1)
- [CVE-2026-92220](https://insights.sbomify.com/CVE-2026-92220/): vllm-project vLLM MoRIIO Acknowledgement moriio_connector.py MoRIIOWrapper._handle_release_message resource consumption (medium 6.9)
- [CVE-2026-9222](https://insights.sbomify.com/CVE-2026-9222/): Setracker2 Children's Smartwatch Ecosystem Use of password hash instead of password for authentication (critical 9.2)
- [CVE-2026-92217](https://insights.sbomify.com/CVE-2026-92217/): a2ui-project a2ui Message Parsing message-processor.ts processMessages dynamically-determined object attributes (medium 5.3)
- [CVE-2026-92216](https://insights.sbomify.com/CVE-2026-92216/): a2ui-project a2ui Binder generic-binder.ts openUrl redirect (medium 5.3)
- [CVE-2026-92215](https://insights.sbomify.com/CVE-2026-92215/): a2ui-project a2ui FileResolver file_resolver.py httpx.get server-side request forgery (medium 6.9)
- [CVE-2026-92214](https://insights.sbomify.com/CVE-2026-92214/): a2ui-project a2ui a2a-chat-canvas sanitizer-markdown-renderer-service.ts cross site scripting (medium 5.1)
- [CVE-2026-92213](https://insights.sbomify.com/CVE-2026-92213/): a2ui-project a2ui Angular Renderer server-to-client.ts z.any injection (medium 5.1)
- [CVE-2026-92212](https://insights.sbomify.com/CVE-2026-92212/): Cross-site scripting in JetFormBuilder — Dynamic Blocks Form Builder (medium 6.1)
- [CVE-2026-92210](https://insights.sbomify.com/CVE-2026-92210/): NoMachine nxhtd Server-Side Request Forgery Information Disclosure Vulnerability (high 7.2)
- [CVE-2026-9221](https://insights.sbomify.com/CVE-2026-9221/): Setracker2 Children's Smartwatch Ecosystem Use of a Broken or Risky Cryptographic Algorithm (high 8.7)
- [CVE-2026-92209](https://insights.sbomify.com/CVE-2026-92209/): NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2026-92208](https://insights.sbomify.com/CVE-2026-92208/): NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-92207](https://insights.sbomify.com/CVE-2026-92207/): MindsDB OpenBBtable Code Injection Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-92206](https://insights.sbomify.com/CVE-2026-92206/): CrewAI crewAI Framework Agent Loading Unsafe Reflection Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-92205](https://insights.sbomify.com/CVE-2026-92205/): BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability (medium 6.1)
- [CVE-2026-92204](https://insights.sbomify.com/CVE-2026-92204/): Airbyte OneDrive Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability (high 7.7)
- [CVE-2026-92203](https://insights.sbomify.com/CVE-2026-92203/): Airbyte SharePoint Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability (high 7.7)
- [CVE-2026-92202](https://insights.sbomify.com/CVE-2026-92202/): Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-9220](https://insights.sbomify.com/CVE-2026-9220/): Setracker2 Children's Smartwatch Ecosystem Use of hard-coded cryptographic key (high 8.7)
- [CVE-2026-9219](https://insights.sbomify.com/CVE-2026-9219/): Setracker2 Children's Smartwatch Ecosystem Generation of Predictable Numbers or Identifiers (high 8.3)
- [CVE-2026-92184](https://insights.sbomify.com/CVE-2026-92184/): ag-ui-protocol ag-ui Multimodal Content utils.py urllib.request.urlopen server-side request forgery (medium 5.3)
- [CVE-2026-92183](https://insights.sbomify.com/CVE-2026-92183/): GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-92180](https://insights.sbomify.com/CVE-2026-92180/): Privilege escalation in PDF Architect (high 7.8)
- [CVE-2026-9218](https://insights.sbomify.com/CVE-2026-9218/): Insufficient input validation vulnerability in Certain NETGEAR routers allows unauthorized access (medium 4.3)
- [CVE-2026-92179](https://insights.sbomify.com/CVE-2026-92179/): pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-92178](https://insights.sbomify.com/CVE-2026-92178/): pdfforge PDF Architect PDF File Parsing Memory Corruption Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-92177](https://insights.sbomify.com/CVE-2026-92177/): pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-92176](https://insights.sbomify.com/CVE-2026-92176/): pdfforge PDF Architect App Object Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-92174](https://insights.sbomify.com/CVE-2026-92174/): SiteOrigin Widgets Bundle <= 1.73.2 - Authenticated (Contributor+) Local File Inclusion via 'theme' Parameter (high 7.5)
- [CVE-2026-92173](https://insights.sbomify.com/CVE-2026-92173/): Privilege escalation in Meta Horizon OS (critical 9.1)
- [CVE-2026-92172](https://insights.sbomify.com/CVE-2026-92172/): Privilege escalation in Meta Horizon OS (high 8.8)
- [CVE-2026-92171](https://insights.sbomify.com/CVE-2026-92171/): Infinispan-operator: infinispan operator: sensitive information disclosure due pod args store (medium 6.5)
- [CVE-2026-92164](https://insights.sbomify.com/CVE-2026-92164/): Streamlink: HTTPSession follows HTTP redirects into file:// URLs, reading local files (medium 6.5)
- [CVE-2026-92162](https://insights.sbomify.com/CVE-2026-92162/): Flatpak vulnerable to path traversal via unvalidated "arch" parameter in DeployAppstream (high 7.2)
- [CVE-2026-92161](https://insights.sbomify.com/CVE-2026-92161/): FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider (critical 9.8)
- [CVE-2026-92160](https://insights.sbomify.com/CVE-2026-92160/): F´: SendPartial Integer Overflow Leading to Assertion DoS (medium 6.5)
- [CVE-2026-9216](https://insights.sbomify.com/CVE-2026-9216/): Insufficient input validation vulnerability exists in certain NETGEAR RAX Models (low 1.2)
- [CVE-2026-92159](https://insights.sbomify.com/CVE-2026-92159/): F´: TlmPacketizer copies oversized telemetry past configured channel slots and emits corrupted packetized telemetry (medium 6.5)
- [CVE-2026-92158](https://insights.sbomify.com/CVE-2026-92158/): F´: FpySequencer Integer Overflow in Stack Offset/Size Validation Leading to Out-of-Bounds Write (high 7.2)
- [CVE-2026-92157](https://insights.sbomify.com/CVE-2026-92157/): F´: FileDownlink SendPartial integer overflow lets legal startOffset/length values reach a reachable assertion (medium 6.5)
- [CVE-2026-92156](https://insights.sbomify.com/CVE-2026-92156/): F´: EventManager asserts on legal oversized LogBuffer values delivered over the standard GenericHub event bridge (medium 6.5)
- [CVE-2026-92155](https://insights.sbomify.com/CVE-2026-92155/): F´: FileUplink Unknown Packet Type Assertion DoS (high 7.5)
- [CVE-2026-92154](https://insights.sbomify.com/CVE-2026-92154/): F´: File size bounds bypass in Svc::FileUplink via unsigned integer overflow in DATA packet validation (high 8.1)
- [CVE-2026-92153](https://insights.sbomify.com/CVE-2026-92153/): F´: Arbitrary File Write in Svc::FileUplink via attacker-controlled StartPacket.destinationPath (high 7.1)
- [CVE-2026-92152](https://insights.sbomify.com/CVE-2026-92152/): F´: Unvalidated Port Index in GenericHub (critical 9.3)
- [CVE-2026-92151](https://insights.sbomify.com/CVE-2026-92151/): F´: SpacePacketDeframer Small Packet Assertion DoS (high 7.5)
- [CVE-2026-92150](https://insights.sbomify.com/CVE-2026-92150/): F´: GenericHub Malformed Buffer Assertion DoS (high 7.5)
- [CVE-2026-9215](https://insights.sbomify.com/CVE-2026-9215/): A CSRF vulnerability exists in certain NETGEAR XR series devices (low 1.8)
- [CVE-2026-92144](https://insights.sbomify.com/CVE-2026-92144/): Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter (high 7.2)
- [CVE-2026-92142](https://insights.sbomify.com/CVE-2026-92142/): Apache Karaf: Authorization bypass in JMX MBean lifecycle operations (high 8.8)
- [CVE-2026-92141](https://insights.sbomify.com/CVE-2026-92141/): Open redirect in Jenkins Keycloak Authentication Plugin (medium 4.3)
- [CVE-2026-92140](https://insights.sbomify.com/CVE-2026-92140/): Cross-site scripting in Jenkins Gitee Plugin (medium 6.8)
- [CVE-2026-9214](https://insights.sbomify.com/CVE-2026-9214/): Insufficient input validation in NETGEAR R7000 router allows administrators to tamper with the device. (medium 4.3)
- [CVE-2026-92139](https://insights.sbomify.com/CVE-2026-92139/): Server-side request forgery in Jenkins Bitbucket Push and Pull Request Plugin (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/250/