# Vulnerabilities published in 2026


- [CVE-2026-90697](https://insights.sbomify.com/CVE-2026-90697/): SourceCodester Inventory Management System invoice.php authorization (medium 5.3)
- [CVE-2026-90696](https://insights.sbomify.com/CVE-2026-90696/): SourceCodester Inventory Management System Product Management products_handler.php cross site scripting (medium 5.1)
- [CVE-2026-90695](https://insights.sbomify.com/CVE-2026-90695/): SourceCodester Inventory Management System Vendor Management vendors_handler.php cross site scripting (medium 5.1)
- [CVE-2026-90694](https://insights.sbomify.com/CVE-2026-90694/): SourceCodester Inventory Management System Customer Management customers_handler.php cross site scripting (medium 5.1)
- [CVE-2026-90693](https://insights.sbomify.com/CVE-2026-90693/): D-Link DIR-878 WAN Settings SetWan3Settings stack-based overflow (critical 9.4)
- [CVE-2026-90692](https://insights.sbomify.com/CVE-2026-90692/): D-Link DIR-878 Dynamic DNS IPv6 Settings SetDynamicDNSIPv6Settings stack-based overflow (critical 9.4)
- [CVE-2026-90691](https://insights.sbomify.com/CVE-2026-90691/): 0x4m4 HexStrike AI API Files Endpoint hexstrike_server.py FileOperationsManager path traversal (medium 6.9)
- [CVE-2026-90690](https://insights.sbomify.com/CVE-2026-90690/): 0x4m4 HexStrike AI API Tools Endpoint hexstrike_server.py subprocess.Popen os command injection (medium 6.9)
- [CVE-2026-90689](https://insights.sbomify.com/CVE-2026-90689/): Tenda W20E formDelWebAuthWhiteUser stack-based overflow (high 8.7)
- [CVE-2026-90688](https://insights.sbomify.com/CVE-2026-90688/): Tenda W20E HTTP formIPMacBindAdd stack-based overflow (high 7.1)
- [CVE-2026-90687](https://insights.sbomify.com/CVE-2026-90687/): GPAC MP4Box base_scenegraph.c gf_node_changed_internal use after free (medium 5.3)
- [CVE-2026-90686](https://insights.sbomify.com/CVE-2026-90686/): GPAC MP4Box loader_bt.c gf_bt_report memory corruption (medium 6.9)
- [CVE-2026-90685](https://insights.sbomify.com/CVE-2026-90685/): GPAC MP4Box lsr_dec.c lsr_exec_command_list assertion (low 2.4)
- [CVE-2026-90684](https://insights.sbomify.com/CVE-2026-90684/): GPAC MP4Box base_scenegraph.c gf_node_get_field_count assertion (low 2.4)
- [CVE-2026-90683](https://insights.sbomify.com/CVE-2026-90683/): GPAC MP4Box base_scenegraph.c gf_node_unregister assertion (medium 4.8)
- [CVE-2026-90682](https://insights.sbomify.com/CVE-2026-90682/): Matthias-Wandel jhead WebP EXIF gpsinfo.c ProcessGpsInfo heap-based overflow (medium 4.8)
- [CVE-2026-90681](https://insights.sbomify.com/CVE-2026-90681/): Matthias-Wandel jhead EXIF Parsing exif.c Get16u out-of-bounds (medium 4.8)
- [CVE-2026-90680](https://insights.sbomify.com/CVE-2026-90680/): D-Link DIR-823G HNAP1 SetStaticRouteSettings strcpy stack-based overflow (critical 9.4)
- [CVE-2026-90679](https://insights.sbomify.com/CVE-2026-90679/): Security feature bypass in Forgejo (medium 4.3)
- [CVE-2026-90678](https://insights.sbomify.com/CVE-2026-90678/): Other in HAProxy (high 7.5)
- [CVE-2026-9067](https://insights.sbomify.com/CVE-2026-9067/): Schema & Structured Data for WP & AMP < 1.60 - Unauthenticated Arbitrary Media Upload (critical 9.1)
- [CVE-2026-90668](https://insights.sbomify.com/CVE-2026-90668/): Denial of service in UnrealIRCd (high 8.7)
- [CVE-2026-9066](https://insights.sbomify.com/CVE-2026-9066/): WP Compress < 7.10.04 - Reflected XSS via test_zone (medium 6.1)
- [CVE-2026-90651](https://insights.sbomify.com/CVE-2026-90651/): Security feature bypass in Socket Firewall (high 8.1)
- [CVE-2026-90650](https://insights.sbomify.com/CVE-2026-90650/): MotoPress Hotel Booking <= 6.2.4 - Unauthenticated Stored Cross-Site Scripting via Stripe Webhook Event Object 'id' (high 7.2)
- [CVE-2026-9065](https://insights.sbomify.com/CVE-2026-9065/): Surecart - SQL Injection (critical 9.3)
- [CVE-2026-90648](https://insights.sbomify.com/CVE-2026-90648/): Memory corruption in wabt (high 7.1)
- [CVE-2026-90647](https://insights.sbomify.com/CVE-2026-90647/): Security feature bypass in ASE2000 V2 Communication Test Set (critical 9.1)
- [CVE-2026-9064](https://insights.sbomify.com/CVE-2026-9064/): Denial of service in Red Hat Directory Server 11.5 E4S for RHEL 8 (high 7.5)
- [CVE-2026-90623](https://insights.sbomify.com/CVE-2026-90623/): andreashappe cochise SSH Host Key ssh_connection.py asyncssh.connect certificate validation (medium 6.3)
- [CVE-2026-90622](https://insights.sbomify.com/CVE-2026-90622/): GNU libredwg Layer Encoding dwg.spec DWG_TABLE null pointer dereference (medium 4.8)
- [CVE-2026-90621](https://insights.sbomify.com/CVE-2026-90621/): ipa-lab HackingBuddyGPT ssh_run_command.py ssh_run_command os command injection (medium 5.3)
- [CVE-2026-90620](https://insights.sbomify.com/CVE-2026-90620/): 0x4m4 HexStrike AI API Command Endpoint hexstrike_server.py missing authentication (medium 6.9)
- [CVE-2026-9062](https://insights.sbomify.com/CVE-2026-9062/): Agile Store Locator < 1.6.9 - Admin+ Arbitrary File Read via Path Traversal (low 3.4)
- [CVE-2026-90619](https://insights.sbomify.com/CVE-2026-90619/): 0x4m4 HexStrike AI Execute Endpoint hexstrike_server.py os command injection (medium 6.9)
- [CVE-2026-90618](https://insights.sbomify.com/CVE-2026-90618/): GH05TCREW PentestAgent LocalRuntime runtime.py LocalRuntime.execute_command os command injection (medium 6.9)
- [CVE-2026-90617](https://insights.sbomify.com/CVE-2026-90617/): GH05TCREW PentestAgent MCP HTTP Server main.py run_task os command injection (medium 6.9)
- [CVE-2026-90616](https://insights.sbomify.com/CVE-2026-90616/): Path traversal in Flatpak (high 7.4)
- [CVE-2026-90615](https://insights.sbomify.com/CVE-2026-90615/): SourceCodester Class and Exam Timetabling System subject1.php cross site scripting (medium 5.3)
- [CVE-2026-90614](https://insights.sbomify.com/CVE-2026-90614/): FedML-AI FedML MQTT+S3 Communication Backend remote_storage.py S3Storage.read_model deserialization (medium 5.3)
- [CVE-2026-90613](https://insights.sbomify.com/CVE-2026-90613/): GPAC MP4Box stbl_read.c stbl_GetSampleInfos assertion (medium 4.8)
- [CVE-2026-90612](https://insights.sbomify.com/CVE-2026-90612/): GPAC MP4Box scene_dump.c gf_sm_dump_command_list assertion (medium 4.8)
- [CVE-2026-90611](https://insights.sbomify.com/CVE-2026-90611/): GPAC MP4Box loader_xmt.c xmt_parse_element assertion (medium 4.8)
- [CVE-2026-90610](https://insights.sbomify.com/CVE-2026-90610/): GPAC MP4Box svg_attributes.c gf_svg_attributes_copy buffer over-read (medium 4.8)
- [CVE-2026-9061](https://insights.sbomify.com/CVE-2026-9061/): Agile Store Locator < 1.6.9 - Admin+ Stored XSS via logo_name (low 3.5)
- [CVE-2026-90609](https://insights.sbomify.com/CVE-2026-90609/): GPAC MP4Box vrml_tools.c null pointer dereference (medium 4.8)
- [CVE-2026-90608](https://insights.sbomify.com/CVE-2026-90608/): Totolink A3002MU boa formPortFw buffer overflow (critical 9.4)
- [CVE-2026-90607](https://insights.sbomify.com/CVE-2026-90607/): Totolink A3002MU boa formNewSchedule buffer overflow (critical 9.4)
- [CVE-2026-90606](https://insights.sbomify.com/CVE-2026-90606/): Totolink A3002MU boa formIpv6Setup buffer overflow (critical 9.4)
- [CVE-2026-90605](https://insights.sbomify.com/CVE-2026-90605/): Totolink A3002MU boa formFilter buffer overflow (critical 9.4)
- [CVE-2026-90604](https://insights.sbomify.com/CVE-2026-90604/): Totolink A3002MU Anchor Tag cross site scripting (medium 5.1)
- [CVE-2026-90603](https://insights.sbomify.com/CVE-2026-90603/): Anil-matcha Open-Generative-AI S3 Upload upload-binary unrestricted upload (medium 6.9)
- [CVE-2026-90602](https://insights.sbomify.com/CVE-2026-90602/): Anil-matcha Open-Generative-AI Studio Components ImageStudio.js renderHistory cross site scripting (medium 5.1)
- [CVE-2026-90601](https://insights.sbomify.com/CVE-2026-90601/): getzep graphiti REST API main.py improper authentication (medium 6.9)
- [CVE-2026-90600](https://insights.sbomify.com/CVE-2026-90600/): itsourcecode Sales and Inventory System inv_edit1.php sql injection (medium 5.3)
- [CVE-2026-9060](https://insights.sbomify.com/CVE-2026-9060/): Agile Store Locator < 1.6.6 - Admin+ Stored XSS via map_style (low 3.5)
- [CVE-2026-90599](https://insights.sbomify.com/CVE-2026-90599/): Rizwan17 inventory-management-system process.php cross-site request forgery (medium 5.3)
- [CVE-2026-90598](https://insights.sbomify.com/CVE-2026-90598/): jaygajera17 E-commerce-project-springBoot UserController.java UserController.updateUser authorization (medium 5.3)
- [CVE-2026-90597](https://insights.sbomify.com/CVE-2026-90597/): itsourcecode Sales and Inventory System sup_edit1.php sql injection (medium 5.3)
- [CVE-2026-90596](https://insights.sbomify.com/CVE-2026-90596/): embedded-graphics image_raw.rs new/bytes_per_row integer overflow (medium 6.9)
- [CVE-2026-90595](https://insights.sbomify.com/CVE-2026-90595/): wxiaoqi Spring-Cloud-Platform OnlineController.java OnlineController.getOnlineInfo authorization (medium 5.3)
- [CVE-2026-90594](https://insights.sbomify.com/CVE-2026-90594/): Missing authorization in Spring-Cloud-Platform (medium 5.3)
- [CVE-2026-90593](https://insights.sbomify.com/CVE-2026-90593/): embedded-graphics image_raw.rs draw_sub_image integer overflow (medium 6.9)
- [CVE-2026-9059](https://insights.sbomify.com/CVE-2026-9059/): NextGEN Gallery - SQL Injection (critical 9.3)
- [CVE-2026-90584](https://insights.sbomify.com/CVE-2026-90584/): TooTallNate Java-WebSocket Fragmentation Draft_6455.java processFrameContinuousAndNonFin allocation of resources (medium 6.9)
- [CVE-2026-90583](https://insights.sbomify.com/CVE-2026-90583/): kagisearch smallweb Query String Rendering sw.py index cross site scripting (medium 5.3)
- [CVE-2026-90582](https://insights.sbomify.com/CVE-2026-90582/): evanchiu serverless-todo API Todo Endpoint index.js saveTodos resource consumption (medium 6.9)
- [CVE-2026-90581](https://insights.sbomify.com/CVE-2026-90581/): cym1102 nginxWebUI autoUpdate MainController.autoUpdate code injection (medium 5.3)
- [CVE-2026-90580](https://insights.sbomify.com/CVE-2026-90580/): FlowiseAI Flowise Evaluations Endpoint index.ts axios.post server-side request forgery (medium 5.3)
- [CVE-2026-9058](https://insights.sbomify.com/CVE-2026-9058/): Improper Certificate Verification in Szafir SDK (critical 9.3)
- [CVE-2026-90579](https://insights.sbomify.com/CVE-2026-90579/): cheshire-cat-ai Cheshire Cat AI custom_auth_handler.py _authorize_http_key missing authentication (medium 6.9)
- [CVE-2026-90578](https://insights.sbomify.com/CVE-2026-90578/): GPAC MP4Box list.c gf_list_count use after free (medium 4.8)
- [CVE-2026-90577](https://insights.sbomify.com/CVE-2026-90577/): GPAC MP4Box base_scenegraph.c gf_node_get_field heap-based overflow (medium 4.8)
- [CVE-2026-90576](https://insights.sbomify.com/CVE-2026-90576/): GPAC MP4Box base_scenegraph.c gf_node_list_add_child null pointer dereference (medium 4.8)
- [CVE-2026-90575](https://insights.sbomify.com/CVE-2026-90575/): PHPGurukul Small CRM Login Success login.php unserialize deserialization (medium 6.3)
- [CVE-2026-90574](https://insights.sbomify.com/CVE-2026-90574/): itsourcecode Sales and Inventory System emp_transac.php add sql injection (medium 5.3)
- [CVE-2026-90573](https://insights.sbomify.com/CVE-2026-90573/): GPAC MP4Box vrml_tools.c gf_sg_mfurl_del null pointer dereference (medium 4.8)
- [CVE-2026-90572](https://insights.sbomify.com/CVE-2026-90572/): davenardella snap7 s7_micro_client.cpp opUpload memory corruption (medium 5.1)
- [CVE-2026-90571](https://insights.sbomify.com/CVE-2026-90571/): Exrick xmall Order Printing order-print.jsp cross site scripting (medium 5.3)
- [CVE-2026-90570](https://insights.sbomify.com/CVE-2026-90570/): linlinjava litemall Product Detail index.vue AdminGoodsService.validate cross site scripting (medium 4.8)
- [CVE-2026-9057](https://insights.sbomify.com/CVE-2026-9057/): Security fix for Qlik Talend Administration Center URL access control vulnerability (high 8.2)
- [CVE-2026-90569](https://insights.sbomify.com/CVE-2026-90569/): linlinjava litemall Admin Topic index.vue AdminTopicController.validate cross site scripting (medium 4.8)
- [CVE-2026-90568](https://insights.sbomify.com/CVE-2026-90568/): moxi624 Mogu Blog v2 blogSort Endpoint info.ftl BlogSortServiceImpl.addBlogSort cross site scripting (medium 5.1)
- [CVE-2026-90567](https://insights.sbomify.com/CVE-2026-90567/): quequnlong shiyi-blog Search index.vue highlightKeyword cross site scripting (medium 5.1)
- [CVE-2026-90566](https://insights.sbomify.com/CVE-2026-90566/): Rizwan17 inventory-management-system Registration register.php createUserAccount improper authorization (medium 6.9)
- [CVE-2026-90565](https://insights.sbomify.com/CVE-2026-90565/): Rizwan17 inventory-management-system dashboard.php access control (medium 6.9)
- [CVE-2026-90564](https://insights.sbomify.com/CVE-2026-90564/): quequnlong shiyi-blog chat sendMsg Endpoint index.vue SysChatMsgMapper.getChatMsgList cross site scripting (medium 5.1)
- [CVE-2026-90563](https://insights.sbomify.com/CVE-2026-90563/): maliangnansheng bbs-springboot ArticleController.java utils.toToc cross site scripting (medium 5.1)
- [CVE-2026-90562](https://insights.sbomify.com/CVE-2026-90562/): LangBot before 4.10.11 Authentication Bypass via Weak Recovery Key (critical 9.2)
- [CVE-2026-90561](https://insights.sbomify.com/CVE-2026-90561/): Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS via WYSIWYG (critical 9.3)
- [CVE-2026-90560](https://insights.sbomify.com/CVE-2026-90560/): zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictDecompress (high 8.8)
- [CVE-2026-9056](https://insights.sbomify.com/CVE-2026-9056/): Security fix for Qlik Talend Administration Center cross-site scripting vulnerability (medium 5.4)
- [CVE-2026-90559](https://insights.sbomify.com/CVE-2026-90559/): snappy-java through 1.1.10.8 Out-of-Bounds Write via uncompress (high 8.7)
- [CVE-2026-90558](https://insights.sbomify.com/CVE-2026-90558/): sngrep through 1.8.4 Stack Buffer Overflow via SIP Headers (critical 9.3)
- [CVE-2026-90557](https://insights.sbomify.com/CVE-2026-90557/): Freeciv 3.1.0 through 3.2.5 Out-of-Bounds Read via Savegame (medium 6.9)
- [CVE-2026-90556](https://insights.sbomify.com/CVE-2026-90556/): Freeciv before 3.2.6 Heap Buffer Overflow via worklist_load (high 8.5)
- [CVE-2026-90555](https://insights.sbomify.com/CVE-2026-90555/): vLLM before 0.28.0 Denial of Service via Audio Header (high 7.1)
- [CVE-2026-90554](https://insights.sbomify.com/CVE-2026-90554/): vLLM before 0.28.0 Denial of Service via audio extraction (medium 6.9)
- [CVE-2026-90553](https://insights.sbomify.com/CVE-2026-90553/): vLLM before 0.28.0 Remote Code Execution via LlavaOnevision2 processor (high 8.5)
- [CVE-2026-90552](https://insights.sbomify.com/CVE-2026-90552/): WWBN AVideo Missing Authorization via Playlists_schedules list.json.php (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/263/