# Vulnerabilities published in 2026


- [CVE-2026-90822](https://insights.sbomify.com/CVE-2026-90822/): Command injection in IPVPN (critical 9.8)
- [CVE-2026-90821](https://insights.sbomify.com/CVE-2026-90821/): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller (medium 5.4)
- [CVE-2026-90820](https://insights.sbomify.com/CVE-2026-90820/): Missing authorization in a2a-java (medium 5.3)
- [CVE-2026-9082](https://insights.sbomify.com/CVE-2026-9082/): Drupal Core SQL Injection (critical 9.8, exploited in the wild)
- [CVE-2026-90819](https://insights.sbomify.com/CVE-2026-90819/): Other in a2a-java (medium 6.9)
- [CVE-2026-90818](https://insights.sbomify.com/CVE-2026-90818/): Server-side request forgery in LobsterAI (medium 5.3)
- [CVE-2026-90817](https://insights.sbomify.com/CVE-2026-90817/): Code injection in REDCap (critical 9.8)
- [CVE-2026-90816](https://insights.sbomify.com/CVE-2026-90816/): FFmpeg Duration hlsproto.c parse_playlist denial of service (medium 5.3)
- [CVE-2026-90815](https://insights.sbomify.com/CVE-2026-90815/): FFmpeg Convolution Filter vf_convolution.c setup_3x3 out-of-bounds (medium 5.3)
- [CVE-2026-90814](https://insights.sbomify.com/CVE-2026-90814/): cosmicstack-labs mercury-agent GitHub API github.ts githubRequest server-side request forgery (medium 5.3)
- [CVE-2026-90813](https://insights.sbomify.com/CVE-2026-90813/): cosmicstack-labs mercury-agent Shell Command Execution permissions.ts checkShellCommand validate before canonicalize (medium 5.3)
- [CVE-2026-90812](https://insights.sbomify.com/CVE-2026-90812/): cosmicstack-labs mercury-agent Shell Command Permission permissions.ts checkShellCommand privileges assignment (medium 5.3)
- [CVE-2026-90811](https://insights.sbomify.com/CVE-2026-90811/): Information disclosure in mercury-agent (medium 4.8)
- [CVE-2026-90810](https://insights.sbomify.com/CVE-2026-90810/): Missing authorization in mercury-agent (medium 5.3)
- [CVE-2026-9081](https://insights.sbomify.com/CVE-2026-9081/): Langflow OSS is affected by server-side request forgery in provider validation and API request functionality (high 7.1)
- [CVE-2026-90809](https://insights.sbomify.com/CVE-2026-90809/): HKUDS nanobot ExecTool shell.py ExecTool._spawn argument injection (medium 6.9)
- [CVE-2026-90808](https://insights.sbomify.com/CVE-2026-90808/): HKUDS nanobot ExecTool shell.py ExecTool._spawn incomplete blacklist (medium 5.3)
- [CVE-2026-90807](https://insights.sbomify.com/CVE-2026-90807/): nanocoai NanoClaw Attachment agent-route.ts forwardAttachedFiles link following (medium 5.3)
- [CVE-2026-90806](https://insights.sbomify.com/CVE-2026-90806/): DjangoCRM django-crm Bulk Case Update bulk_views.py BulkUpdateCasesView authorization (medium 5.3)
- [CVE-2026-90805](https://insights.sbomify.com/CVE-2026-90805/): subhajitkhan online-clinic-management-system doctorlogin.php sql injection (medium 6.9)
- [CVE-2026-90804](https://insights.sbomify.com/CVE-2026-90804/): GNU Binutils Eh Frame Section elf-eh-frame.c _bfd_elf_write_section_eh_frame buffer overflow (low 2.4)
- [CVE-2026-90803](https://insights.sbomify.com/CVE-2026-90803/): GNU Binutils ld elf64-x86-64.c elf_x86_64_relocate_section buffer overflow (medium 4.8)
- [CVE-2026-90802](https://insights.sbomify.com/CVE-2026-90802/): GNU Binutils ld libbfd.c bfd_putl64 null pointer dereference (medium 4.8)
- [CVE-2026-90801](https://insights.sbomify.com/CVE-2026-90801/): GNU Binutils ld cache.c cache_bwrite buffer overflow (medium 4.8)
- [CVE-2026-90800](https://insights.sbomify.com/CVE-2026-90800/): Apache CouchDB: Auth bypass in prefixed _users and _replicator databases (high 8.1)
- [CVE-2026-9080](https://insights.sbomify.com/CVE-2026-9080/): UAF after pause in socket callback (high 7.3)
- [CVE-2026-90799](https://insights.sbomify.com/CVE-2026-90799/): Deserialization in Apache CouchDB (low 1.3)
- [CVE-2026-90798](https://insights.sbomify.com/CVE-2026-90798/): Apache CouchDB: Replicator follows redirects indefinitely (low 0.6)
- [CVE-2026-90797](https://insights.sbomify.com/CVE-2026-90797/): Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session (high 7.7)
- [CVE-2026-90796](https://insights.sbomify.com/CVE-2026-90796/): itsourcecode Leave Management System index.php sql injection (medium 5.3)
- [CVE-2026-90795](https://insights.sbomify.com/CVE-2026-90795/): itsourcecode Loan Management System navbar.php cross site scripting (medium 5.3)
- [CVE-2026-90794](https://insights.sbomify.com/CVE-2026-90794/): GPAC MP4Box vrml_tools.c gf_sg_script_load use after free (medium 5.3)
- [CVE-2026-90793](https://insights.sbomify.com/CVE-2026-90793/): GPAC MP4Box base_scenegraph.c gf_node_get_name use after free (medium 5.3)
- [CVE-2026-90792](https://insights.sbomify.com/CVE-2026-90792/): GPAC MP4Box base_scenegraph.c gf_node_list_get_child null pointer dereference (medium 5.3)
- [CVE-2026-90791](https://insights.sbomify.com/CVE-2026-90791/): GPAC MP4Box base_scenegraph.c gf_node_unregister use after free (medium 5.3)
- [CVE-2026-90790](https://insights.sbomify.com/CVE-2026-90790/): Server-side request forgery in a2a-python (medium 5.3)
- [CVE-2026-9079](https://insights.sbomify.com/CVE-2026-9079/): stale proxy password leak (critical 9.8)
- [CVE-2026-90789](https://insights.sbomify.com/CVE-2026-90789/): itsourcecode Leave Management System login.php sql injection (medium 6.9)
- [CVE-2026-90788](https://insights.sbomify.com/CVE-2026-90788/): magicblack MacCMS10 Template .%40template%40default%40html%40label.html os command injection (medium 5.1)
- [CVE-2026-90787](https://insights.sbomify.com/CVE-2026-90787/): Soarkey StudentManagement Registration Workflow register.html RegisterServlet.doPost privileges management (medium 6.9)
- [CVE-2026-90786](https://insights.sbomify.com/CVE-2026-90786/): Dvidelabs flatcc Duplicate Symbol semantics.c align_order_members assertion (medium 6.9)
- [CVE-2026-90785](https://insights.sbomify.com/CVE-2026-90785/): Dvidelabs flatcc Struct Analysis semantics.c analyze_struct assertion (medium 6.9)
- [CVE-2026-90784](https://insights.sbomify.com/CVE-2026-90784/): Dvidelabs flatcc semantics.c fb_clear_parser memory leak (medium 6.9)
- [CVE-2026-90783](https://insights.sbomify.com/CVE-2026-90783/): MKVToolNix through 101.0 Heap Buffer Overflow via avilib ODML Superindex Integer Wraparound (high 8.5)
- [CVE-2026-90782](https://insights.sbomify.com/CVE-2026-90782/): S2OPC through 1.7.3 NULL Pointer Dereference in alloc_notification_message_items() (medium 6.0)
- [CVE-2026-90781](https://insights.sbomify.com/CVE-2026-90781/): alsa-lib through 1.2.16.1 Off-by-One Stack Buffer Overflow in __snd_ctl_ascii_elem_id_parse() (medium 4.8)
- [CVE-2026-90780](https://insights.sbomify.com/CVE-2026-90780/): SIPp through 3.7.7 Buffer Overflow via Oversized SIP Header Content (high 8.7)
- [CVE-2026-9078](https://insights.sbomify.com/CVE-2026-9078/): Firefox iOS RTL Domain Rendering Issue in Link Preview (medium 5.4)
- [CVE-2026-90779](https://insights.sbomify.com/CVE-2026-90779/): SIPp through 3.7.7 Stack Buffer Overflow via createAuthHeader Algorithm Parameter (high 8.7)
- [CVE-2026-90778](https://insights.sbomify.com/CVE-2026-90778/): SIPp through 3.7.7 Buffer Overflow via SIP To Header Tag (high 8.7)
- [CVE-2026-90777](https://insights.sbomify.com/CVE-2026-90777/): ESPnet before 202609 Remote Code Execution via Unsafe Deserialization (high 8.7)
- [CVE-2026-90776](https://insights.sbomify.com/CVE-2026-90776/): Nodemailer 9.1.0 through 10.0.4 Denial of Service via Quadratic Address Parsing (high 8.7)
- [CVE-2026-90775](https://insights.sbomify.com/CVE-2026-90775/): PostGIS address_standardizer through 3.7.0 Out-of-Bounds Read via Unvalidated Rule Weight (high 7.1)
- [CVE-2026-90774](https://insights.sbomify.com/CVE-2026-90774/): rustypaste before 0.18.1 Path Traversal via filename header (high 8.7)
- [CVE-2026-90773](https://insights.sbomify.com/CVE-2026-90773/): procs through 0.14.12 Terminal Escape Sequence Injection via Command (low 2.4)
- [CVE-2026-90772](https://insights.sbomify.com/CVE-2026-90772/): Amundsen Frontend through 4.3.0 Stored XSS via Description (high 8.3)
- [CVE-2026-90771](https://insights.sbomify.com/CVE-2026-90771/): joi before 17.13.8 and 18.2.9 Prototype Pollution via messages (medium 6.3)
- [CVE-2026-90770](https://insights.sbomify.com/CVE-2026-90770/): Spug through 3.4.0 Remote Code Execution via ping_check (high 8.7)
- [CVE-2026-9077](https://insights.sbomify.com/CVE-2026-9077/): Reliance on Untrusted Inputs in a Security Decision vulnerabilities in Model Context Protocol features (high 8.5)
- [CVE-2026-90769](https://insights.sbomify.com/CVE-2026-90769/): Open Notebook before 1.11.0 Server-Side Request Forgery via link-source (high 8.3)
- [CVE-2026-90768](https://insights.sbomify.com/CVE-2026-90768/): CAPEv2 through commit 471ee4b REST API Task Endpoints Missing Ownership Check (high 8.6)
- [CVE-2026-90767](https://insights.sbomify.com/CVE-2026-90767/): Froxlor before 2.3.12 SSH Key Injection via authorized_keys (high 7.1)
- [CVE-2026-9076](https://insights.sbomify.com/CVE-2026-9076/): Out-of-Bounds Read in CMS Password-Based Decryption (high 7.5)
- [CVE-2026-9074](https://insights.sbomify.com/CVE-2026-9074/): IBM API Connect SQL Injection (critical 9.1)
- [CVE-2026-90732](https://insights.sbomify.com/CVE-2026-90732/): Memory corruption in PowerProtect Data Domain (medium 4.9)
- [CVE-2026-90731](https://insights.sbomify.com/CVE-2026-90731/): Memory corruption in PowerProtect Data Domain (medium 4.9)
- [CVE-2026-90730](https://insights.sbomify.com/CVE-2026-90730/): Missing authorization in PowerProtect Data Domain (medium 6.5)
- [CVE-2026-9073](https://insights.sbomify.com/CVE-2026-9073/): Foreman-mcp-server: mcp server: insecure sensitive http header sanitization (medium 6.2)
- [CVE-2026-90729](https://insights.sbomify.com/CVE-2026-90729/): Privilege escalation in PowerProtect Data Domain (medium 6.7)
- [CVE-2026-90728](https://insights.sbomify.com/CVE-2026-90728/): Privilege escalation in PowerProtect Data Domain (medium 6.3)
- [CVE-2026-90727](https://insights.sbomify.com/CVE-2026-90727/): Path traversal in PowerProtect Data Domain (low 3.8)
- [CVE-2026-90726](https://insights.sbomify.com/CVE-2026-90726/): Path traversal in PowerProtect Data Domain (medium 6.0)
- [CVE-2026-90725](https://insights.sbomify.com/CVE-2026-90725/): Memory corruption in PowerProtect Data Domain (medium 4.9)
- [CVE-2026-90724](https://insights.sbomify.com/CVE-2026-90724/): SQL injection in PowerProtect Data Domain Management Center (low 2.7)
- [CVE-2026-90723](https://insights.sbomify.com/CVE-2026-90723/): SQL injection in PowerProtect Data Domain Management Center (low 2.7)
- [CVE-2026-90721](https://insights.sbomify.com/CVE-2026-90721/): Path traversal in PowerProtect Data Domain (low 3.4)
- [CVE-2026-90720](https://insights.sbomify.com/CVE-2026-90720/): Security feature bypass in PowerProtect Data Domain (medium 6.7)
- [CVE-2026-9072](https://insights.sbomify.com/CVE-2026-9072/): WebSphere Application Server Remote Code Execution (high 8.1)
- [CVE-2026-90719](https://insights.sbomify.com/CVE-2026-90719/): SQL injection in PowerProtect Data Domain Management Center (low 2.7)
- [CVE-2026-90717](https://insights.sbomify.com/CVE-2026-90717/): Auth bypass in PowerProtect Data Domain Management Center (critical 9.1)
- [CVE-2026-90716](https://insights.sbomify.com/CVE-2026-90716/): marcobambini Gravity Number gravity_parser.c parse_number_expression out-of-bounds (medium 5.1)
- [CVE-2026-90715](https://insights.sbomify.com/CVE-2026-90715/): marcobambini Gravity udp json-parser gravity_json.c integer overflow (medium 6.9)
- [CVE-2026-90714](https://insights.sbomify.com/CVE-2026-90714/): marcobambini Gravity JSON parser gravity_json.c memory corruption (medium 5.3)
- [CVE-2026-90713](https://insights.sbomify.com/CVE-2026-90713/): vllm-project vLLM tiktoken vocab File mod.rs new denial of service (medium 4.8)
- [CVE-2026-90712](https://insights.sbomify.com/CVE-2026-90712/): Gitlawb openclaude xAI OAuth Callback xaiOAuthCallback.ts waitForCallback denial of service (medium 5.3)
- [CVE-2026-90711](https://insights.sbomify.com/CVE-2026-90711/): proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet (critical 9.1)
- [CVE-2026-90710](https://insights.sbomify.com/CVE-2026-90710/): taisan tarzan-cms Theme Download Function ThemeService.java openConnection server-side request forgery (medium 6.9)
- [CVE-2026-9071](https://insights.sbomify.com/CVE-2026-9071/): Denial of service in WebSphere Application Server (high 7.5)
- [CVE-2026-90709](https://insights.sbomify.com/CVE-2026-90709/): Yot CMS Admin Console admin.php eval code injection (medium 5.1)
- [CVE-2026-90708](https://insights.sbomify.com/CVE-2026-90708/): Yot CMS Cookie global.php login sql injection (medium 6.9)
- [CVE-2026-90707](https://insights.sbomify.com/CVE-2026-90707/): Open5GS Old AMF Discovery Fallback nnrf-handler.c amf_nnrf_try_old_amf_discovery_fallback use after free (medium 6.9)
- [CVE-2026-90706](https://insights.sbomify.com/CVE-2026-90706/): D-Link DWR-M921 formWsc os command injection (medium 5.1)
- [CVE-2026-90705](https://insights.sbomify.com/CVE-2026-90705/): D-Link DWR-M921 Boa Dispatch Table formsysCmd os command injection (medium 5.1)
- [CVE-2026-90704](https://insights.sbomify.com/CVE-2026-90704/): D-Link DWR-M921 formDiskPartition system command injection (medium 5.1)
- [CVE-2026-90703](https://insights.sbomify.com/CVE-2026-90703/): D-Link DWR-M921 formDiskCreateShare system os command injection (critical 9.4)
- [CVE-2026-90702](https://insights.sbomify.com/CVE-2026-90702/): D-Link DWR-M921 formDiskFormat system os command injection (critical 9.4)
- [CVE-2026-90701](https://insights.sbomify.com/CVE-2026-90701/): subhajitkhan online-clinic-management-system listdoctor.php sql injection (medium 6.9)
- [CVE-2026-90700](https://insights.sbomify.com/CVE-2026-90700/): itsourcecode Sales and Inventory System pro_edit1.php sql injection (medium 5.3)
- [CVE-2026-90699](https://insights.sbomify.com/CVE-2026-90699/): D-Link DWR-M920 formPinManageSetup sub_41E60C os command injection (critical 9.4)
- [CVE-2026-90698](https://insights.sbomify.com/CVE-2026-90698/): memcached mcmc Tokenizer proto_text.c try_read_command_asciiauth out-of-bounds (medium 6.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/262/