# Vulnerabilities published in 2026


- [CVE-2026-90931](https://insights.sbomify.com/CVE-2026-90931/): LaraDashboard 0.9.0 through 1.2.2 Stored XSS via SVG Upload (medium 5.1)
- [CVE-2026-90930](https://insights.sbomify.com/CVE-2026-90930/): File Browser through 2.63.23 Path Traversal via Symlink Alias (high 7.6)
- [CVE-2026-9093](https://insights.sbomify.com/CVE-2026-9093/): CVE-2026-9093 (critical 9.8)
- [CVE-2026-90929](https://insights.sbomify.com/CVE-2026-90929/): File Browser 2.5.0 Directory Deletion via Upload Failure Cleanup (high 7.2)
- [CVE-2026-90928](https://insights.sbomify.com/CVE-2026-90928/): File Browser through 2.63.23 Memory Exhaustion via subtitle endpoint (high 7.1)
- [CVE-2026-90927](https://insights.sbomify.com/CVE-2026-90927/): filebrowser through 2.63.23 Denial of Service via unbounded WebSocket message (high 7.1)
- [CVE-2026-90926](https://insights.sbomify.com/CVE-2026-90926/): Code Injection in Innotim Software's Logsign SIEM (high 8.8)
- [CVE-2026-90925](https://insights.sbomify.com/CVE-2026-90925/): Path Traversal in Innotim Software's Logsign SIEM (high 7.1)
- [CVE-2026-90924](https://insights.sbomify.com/CVE-2026-90924/): Default Admin Credentials in Innotim Software's Logsign SIEM (critical 9.8)
- [CVE-2026-90923](https://insights.sbomify.com/CVE-2026-90923/): Autopay < 5.0.1 - Unauthenticated Cross-Customer Order Payment Parameter Disclosure and Deletion (medium 6.5)
- [CVE-2026-90922](https://insights.sbomify.com/CVE-2026-90922/): Business logic in Paid Membership Subscriptions (medium 5.3)
- [CVE-2026-90921](https://insights.sbomify.com/CVE-2026-90921/): Maximo AI Service Denial of Service (high 7.5)
- [CVE-2026-90920](https://insights.sbomify.com/CVE-2026-90920/): Maximo AI Service Code Injection (critical 9.8)
- [CVE-2026-9092](https://insights.sbomify.com/CVE-2026-9092/): CVE-2026-9092 (critical 9.1)
- [CVE-2026-90919](https://insights.sbomify.com/CVE-2026-90919/): LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Config Server Pickle Deserialization (critical 9.3)
- [CVE-2026-90918](https://insights.sbomify.com/CVE-2026-90918/): Joomla! Core - [20260908] - Core - XSS in HTML Mail Templates in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 (medium 6.9)
- [CVE-2026-90917](https://insights.sbomify.com/CVE-2026-90917/): Joomla! Core - [20260907] - Core - Improper ACL checks in outputs for tagged items in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 (medium 6.9)
- [CVE-2026-90916](https://insights.sbomify.com/CVE-2026-90916/): Missing authorization in Joomla! CMS (medium 5.1)
- [CVE-2026-90915](https://insights.sbomify.com/CVE-2026-90915/): Path traversal in Joomla! CMS (high 7.0)
- [CVE-2026-90914](https://insights.sbomify.com/CVE-2026-90914/): Joomla! Core - [20260904] - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 (medium 5.9)
- [CVE-2026-90913](https://insights.sbomify.com/CVE-2026-90913/): Missing authorization in Joomla! CMS (high 7.0)
- [CVE-2026-90912](https://insights.sbomify.com/CVE-2026-90912/): Maximo AI Service Denial of Service (high 7.5)
- [CVE-2026-90911](https://insights.sbomify.com/CVE-2026-90911/): Maximo AI Service Denial of Service (high 7.5)
- [CVE-2026-90910](https://insights.sbomify.com/CVE-2026-90910/): Apache Answer: Reaction API authorization bypass for restricted content (critical 9.8)
- [CVE-2026-9091](https://insights.sbomify.com/CVE-2026-9091/): CVE-2026-9091 (medium 5.3)
- [CVE-2026-90907](https://insights.sbomify.com/CVE-2026-90907/): Missing authorization in Joomla! CMS (medium 6.9)
- [CVE-2026-90906](https://insights.sbomify.com/CVE-2026-90906/): Joomla! Core - [20260901] - XSS in HTMLHelper::link method in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 (medium 5.9)
- [CVE-2026-90905](https://insights.sbomify.com/CVE-2026-90905/): Cross-site request forgery in Easy Store extension for Joomla (high 7.2)
- [CVE-2026-90904](https://insights.sbomify.com/CVE-2026-90904/): Missing authorization in Easy Store extension for Joomla (high 8.6)
- [CVE-2026-90903](https://insights.sbomify.com/CVE-2026-90903/): Cross-site request forgery in Easy Store extension for Joomla (high 7.2)
- [CVE-2026-90902](https://insights.sbomify.com/CVE-2026-90902/): SQL injection in Easy Store extension for Joomla (high 8.6)
- [CVE-2026-90901](https://insights.sbomify.com/CVE-2026-90901/): SQL injection in Easy Store extension for Joomla (high 8.6)
- [CVE-2026-90900](https://insights.sbomify.com/CVE-2026-90900/): Cross-site request forgery in Easy Store extension for Joomla (medium 5.3)
- [CVE-2026-9090](https://insights.sbomify.com/CVE-2026-9090/): CVE-2026-9090 (critical 9.1)
- [CVE-2026-90899](https://insights.sbomify.com/CVE-2026-90899/): Missing authorization in Easy Store extension for Joomla (high 8.2)
- [CVE-2026-90898](https://insights.sbomify.com/CVE-2026-90898/): Bifrost unauthenticated remote code execution via MCP stdio client registration (critical 9.8)
- [CVE-2026-90896](https://insights.sbomify.com/CVE-2026-90896/): Missing authentication in Ecommerce Template checkout session endpoint allows unauthenticated disclosure of buyer PII (high 8.2)
- [CVE-2026-90895](https://insights.sbomify.com/CVE-2026-90895/): MISP Interactive CLI Shell: Authorization Bypass, Credential Exposure, and Terminal Injection (high 8.4)
- [CVE-2026-90894](https://insights.sbomify.com/CVE-2026-90894/): Parallels Desktop local privilege escalation via appliance extract argument injection (high 7.8)
- [CVE-2026-90893](https://insights.sbomify.com/CVE-2026-90893/): MISP UserSettingsController CSRF Protection Bypass on setTheme, setHomePage, and eventIndexColumnToggle Endpoints (medium 5.1)
- [CVE-2026-90891](https://insights.sbomify.com/CVE-2026-90891/): ASRock｜ASRock Polychrome SYNC/RGB software utility - Improper Access Control (medium 6.8)
- [CVE-2026-90890](https://insights.sbomify.com/CVE-2026-90890/): ASRock｜ASRock Polychrome SYNC/RGB software utility - Untrusted Pointer Dereference (medium 6.8)
- [CVE-2026-9089](https://insights.sbomify.com/CVE-2026-9089/): Security feature bypass in Automate (high 8.8)
- [CVE-2026-90887](https://insights.sbomify.com/CVE-2026-90887/): WordPress WP Inventory Manager plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-90885](https://insights.sbomify.com/CVE-2026-90885/): XML external entity in Apache Camel (high 7.5)
- [CVE-2026-90884](https://insights.sbomify.com/CVE-2026-90884/): Cross-site scripting in WP Recipe Maker (medium 5.4)
- [CVE-2026-90882](https://insights.sbomify.com/CVE-2026-90882/): Reflected arbitrary origins with credentials, allowing cross-origin reads of authenticated user data (high 8.7)
- [CVE-2026-90881](https://insights.sbomify.com/CVE-2026-90881/): D-Link DIR-882 CGI Binary dllog.cgi main information disclosure (medium 6.9)
- [CVE-2026-90880](https://insights.sbomify.com/CVE-2026-90880/): D-Link DSL-3782 Diagnostics Diagnostics.asp system command injection (medium 5.3)
- [CVE-2026-9088](https://insights.sbomify.com/CVE-2026-9088/): Keycloak: keycloak: information disclosure due to user profile permission bypass (low 2.7)
- [CVE-2026-90879](https://insights.sbomify.com/CVE-2026-90879/): zyx0814 FilePress Publish search.php sql injection (medium 6.9)
- [CVE-2026-90878](https://insights.sbomify.com/CVE-2026-90878/): vllm-project vLLM Jinja Template Rendering completions resource consumption (medium 5.3)
- [CVE-2026-90877](https://insights.sbomify.com/CVE-2026-90877/): SourceCodester Online Faculty Clearance System update_requirement_status.php sql injection (medium 6.9)
- [CVE-2026-90876](https://insights.sbomify.com/CVE-2026-90876/): SourceCodester Online Faculty Clearance System delete_requirement.php sql injection (medium 6.9)
- [CVE-2026-90872](https://insights.sbomify.com/CVE-2026-90872/): Server-Side Script Injection in Manager Web UI in Progress WS_FTP Server (medium 6.6)
- [CVE-2026-90871](https://insights.sbomify.com/CVE-2026-90871/): Path Traversal Leading to File Deletion in Ad Hoc Transfer and Web Transfer in Progress WS_FTP Server (medium 5.3)
- [CVE-2026-90870](https://insights.sbomify.com/CVE-2026-90870/): Unauthenticated Ad Hoc Transfer Resource Exhaustion in Progress WS_FTP Server (medium 5.3)
- [CVE-2026-9087](https://insights.sbomify.com/CVE-2026-9087/): Keycloak: cross-session email verification proof not bound to upstream identity in first-broker-login (medium 6.4)
- [CVE-2026-90869](https://insights.sbomify.com/CVE-2026-90869/): Pre-Authentication SSH Denial of Service via Malformed Public-Key Signature in Progress WS_FTP Server (high 7.5)
- [CVE-2026-90868](https://insights.sbomify.com/CVE-2026-90868/): OS Command Injection in Progress WS_FTP Server (critical 9.9)
- [CVE-2026-90867](https://insights.sbomify.com/CVE-2026-90867/): Improper Access Control of Web Admin Console in Progress WS_FTP Server (high 8.1)
- [CVE-2026-90866](https://insights.sbomify.com/CVE-2026-90866/): Virtual Folder Path Confinement Bypass in Progress WS_FTP Server (critical 9.1)
- [CVE-2026-90865](https://insights.sbomify.com/CVE-2026-90865/): Command Injection via FTP Notification Variables in Progress WS_FTP Server (critical 9.0)
- [CVE-2026-90864](https://insights.sbomify.com/CVE-2026-90864/): Host Administrator Path Containment Bypass in Progress WS_FTP Server (critical 9.1)
- [CVE-2026-90863](https://insights.sbomify.com/CVE-2026-90863/): Privilege Escalation via Missing Authorization in WS_FTP Manager (critical 9.1)
- [CVE-2026-90862](https://insights.sbomify.com/CVE-2026-90862/): Web Transfer Module Multi-Factor Authentication Bypass in Progress WS_FTP Server (medium 4.3)
- [CVE-2026-90861](https://insights.sbomify.com/CVE-2026-90861/): Password Disclosure via Activity Logs Enabling Administrator Privilege Escalation in WS_FTP Server (medium 6.6)
- [CVE-2026-90860](https://insights.sbomify.com/CVE-2026-90860/): Information disclosure in Canva (high 7.1)
- [CVE-2026-9086](https://insights.sbomify.com/CVE-2026-9086/): Keycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypass (high 7.3)
- [CVE-2026-90858](https://insights.sbomify.com/CVE-2026-90858/): subhajitkhan online-clinic-management-system adminappview.php session_start authorization (medium 6.9)
- [CVE-2026-90857](https://insights.sbomify.com/CVE-2026-90857/): SourceCodester College Notes Gallery Management System Profile Upload userprofile.php unrestricted upload (medium 5.3)
- [CVE-2026-90856](https://insights.sbomify.com/CVE-2026-90856/): SourceCodester College Notes Gallery Management System Registration Flow signup.php privileges management (medium 6.9)
- [CVE-2026-90855](https://insights.sbomify.com/CVE-2026-90855/): SourceCodester/katojkalemba Online Food Ordering System order.php sql injection (medium 6.9)
- [CVE-2026-90854](https://insights.sbomify.com/CVE-2026-90854/): SourceCodester/katojkalemba Online Food Ordering System category-foods.php sql injection (medium 6.9)
- [CVE-2026-90852](https://insights.sbomify.com/CVE-2026-90852/): luben zstd-jni Dictionary Sharing ZstdCompressCtx.java ZstdCompressCtx.loadDict use after free (medium 6.9)
- [CVE-2026-90851](https://insights.sbomify.com/CVE-2026-90851/): PHPGurukul Hostel Management System checklogin.php access control (medium 5.3)
- [CVE-2026-90850](https://insights.sbomify.com/CVE-2026-90850/): PHPGurukul Hostel Management System manage-students.php cross site scripting (medium 4.8)
- [CVE-2026-9085](https://insights.sbomify.com/CVE-2026-9085/): DNS Hijacking in TUBITAK BILGEM's Pardus-Parental-Control (high 8.8)
- [CVE-2026-90849](https://insights.sbomify.com/CVE-2026-90849/): SourceCodester College Notes Gallery Management System login.php sql injection (medium 6.9)
- [CVE-2026-90848](https://insights.sbomify.com/CVE-2026-90848/): Governikus AusweisApp StartPAOSResponse cross site scripting (medium 5.3)
- [CVE-2026-90847](https://insights.sbomify.com/CVE-2026-90847/): EFM ipTIME C200E System Setup iux_set.cgi os command injection (critical 9.4)
- [CVE-2026-90846](https://insights.sbomify.com/CVE-2026-90846/): PHPGurukul Daily Expense Tracker System forgot-password.php sql injection (medium 6.9)
- [CVE-2026-90845](https://insights.sbomify.com/CVE-2026-90845/): PHPGurukul Daily Expense Tracker System sidebar.php cross site scripting (medium 5.1)
- [CVE-2026-90844](https://insights.sbomify.com/CVE-2026-90844/): PHPGurukul Daily Expense Tracker System Login index.php sql injection (medium 6.9)
- [CVE-2026-90843](https://insights.sbomify.com/CVE-2026-90843/): SabyasachiRana WebMap New Nmap Scan functions_nmap.py nmap_newscan os command injection (medium 6.9)
- [CVE-2026-90842](https://insights.sbomify.com/CVE-2026-90842/): PHPGurukul Blood Donor Management System Login_Model.php cleartext storage in file (medium 6.3)
- [CVE-2026-90841](https://insights.sbomify.com/CVE-2026-90841/): PHPGurukul Blood Donor Management System Report Endpoint Report.php sql injection (medium 6.9)
- [CVE-2026-90840](https://insights.sbomify.com/CVE-2026-90840/): PHPGurukul Blood Donor Management System Admin Controllers Dashboard.php __construct improper authentication (medium 6.9)
- [CVE-2026-9084](https://insights.sbomify.com/CVE-2026-9084/): MISP OIDC authentication bypass via automatic email-based account linking under insecure IdP configurations (medium 6.0)
- [CVE-2026-90835](https://insights.sbomify.com/CVE-2026-90835/): michaelliao itranswarp Page Content Rendering Markdown.java Markdown.toHtml cross site scripting (medium 5.1)
- [CVE-2026-90831](https://insights.sbomify.com/CVE-2026-90831/): GNU Binutils ELF String Table elf-strtab.c _bfd_elf_strtab_delref memory corruption (medium 4.8)
- [CVE-2026-90830](https://insights.sbomify.com/CVE-2026-90830/): GNU Binutils Section Merge merge.c _bfd_write_merged_section null pointer dereference (medium 4.8)
- [CVE-2026-9083](https://insights.sbomify.com/CVE-2026-9083/): Keycloak: keycloak: information disclosure through arbitrary filesystem path probing (medium 4.9)
- [CVE-2026-90829](https://insights.sbomify.com/CVE-2026-90829/): GNU Binutils SHT_GROUP Section elf.c bfd_elf_set_group_contents null pointer dereference (medium 4.8)
- [CVE-2026-90828](https://insights.sbomify.com/CVE-2026-90828/): GNU Binutils ELF Orphan Section ldelf.c elf_orphan_compatible null pointer dereference (medium 4.8)
- [CVE-2026-90827](https://insights.sbomify.com/CVE-2026-90827/): GPAC MP4Box base_scenegraph.c gf_node_deactivate_ex use after free (medium 4.8)
- [CVE-2026-90826](https://insights.sbomify.com/CVE-2026-90826/): GPAC MP4Box base_scenegraph.c gf_node_del out-of-bounds (low 2.4)
- [CVE-2026-90825](https://insights.sbomify.com/CVE-2026-90825/): GPAC MP4Box base_scenegraph.c gf_node_unregister use after free (medium 4.8)
- [CVE-2026-90824](https://insights.sbomify.com/CVE-2026-90824/): GPAC MP4Box dom_events.c gf_sg_dom_event_bubble stack-based overflow (medium 4.8)
- [CVE-2026-90823](https://insights.sbomify.com/CVE-2026-90823/): Memory corruption in IPVPN (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/261/