# Vulnerabilities published in 2026


- [CVE-2026-90551](https://insights.sbomify.com/CVE-2026-90551/): WWBN AVideo Missing Authorization via video_from_program API (medium 6.9)
- [CVE-2026-90550](https://insights.sbomify.com/CVE-2026-90550/): WWBN AVideo Missing Authorization via mediaSession.json.php (medium 6.9)
- [CVE-2026-9055](https://insights.sbomify.com/CVE-2026-9055/): Privilege escalation in Booking for Appointments and Events Calendar – Amelia (critical 9.8)
- [CVE-2026-90549](https://insights.sbomify.com/CVE-2026-90549/): WWBN AVideo Missing Authorization via videosAndroid.json.php Endpoint (medium 6.9)
- [CVE-2026-90548](https://insights.sbomify.com/CVE-2026-90548/): WWBN AVideo Missing Authorization in ImageGallery list.json.php (medium 6.9)
- [CVE-2026-90547](https://insights.sbomify.com/CVE-2026-90547/): WWBN AVideo Missing Authorization via getBookmarks.json.php (medium 6.9)
- [CVE-2026-90546](https://insights.sbomify.com/CVE-2026-90546/): WWBN AVideo Missing Authorization via like.json.php (medium 5.3)
- [CVE-2026-90545](https://insights.sbomify.com/CVE-2026-90545/): WWBN AVideo Missing Authorization via commentAddNew.json.php (medium 5.3)
- [CVE-2026-90544](https://insights.sbomify.com/CVE-2026-90544/): WWBN AVideo Missing Authorization via videoAddViewCount.json.php (medium 5.3)
- [CVE-2026-90543](https://insights.sbomify.com/CVE-2026-90543/): WWBN AVideo Missing Authentication via socketMessageLiveOwner.json.php (medium 6.9)
- [CVE-2026-90542](https://insights.sbomify.com/CVE-2026-90542/): WWBN AVideo Missing Authorization via remindMe.json.php (medium 5.3)
- [CVE-2026-90541](https://insights.sbomify.com/CVE-2026-90541/): WWBN AVideo Unauthenticated Information Disclosure via menus.json.php (medium 6.9)
- [CVE-2026-90540](https://insights.sbomify.com/CVE-2026-90540/): WWBN AVideo Missing Authorization via playListAddVideo.json.php (medium 5.3)
- [CVE-2026-9054](https://insights.sbomify.com/CVE-2026-9054/): Invalid IP packets cause a kernel panic (critical 9.2)
- [CVE-2026-90539](https://insights.sbomify.com/CVE-2026-90539/): WWBN AVideo Missing Authentication via menuItems.json.php (medium 6.9)
- [CVE-2026-90538](https://insights.sbomify.com/CVE-2026-90538/): WWBN AVideo Missing Authorization via playlistsFromUser.json.php (medium 6.9)
- [CVE-2026-90537](https://insights.sbomify.com/CVE-2026-90537/): WWBN AVideo Scheduler sendEmail Missing Authorization via Token (high 8.8)
- [CVE-2026-90536](https://insights.sbomify.com/CVE-2026-90536/): WWBN AVideo Missing Authorization via adsInfo API Endpoint (medium 6.9)
- [CVE-2026-90535](https://insights.sbomify.com/CVE-2026-90535/): Flowise before 3.1.4 Denial of Service via text-to-speech/abort (medium 6.3)
- [CVE-2026-90534](https://insights.sbomify.com/CVE-2026-90534/): Flowise before 3.1.4 Cross-Workspace Credential IDOR via node-load-method (medium 6.1)
- [CVE-2026-90533](https://insights.sbomify.com/CVE-2026-90533/): Flowise before 3.1.4 Broken Access Control via organizationuser (medium 6.0)
- [CVE-2026-90532](https://insights.sbomify.com/CVE-2026-90532/): Adobe Experience Manager | Incorrect Authorization (CWE-863) (critical 10.0)
- [CVE-2026-90531](https://insights.sbomify.com/CVE-2026-90531/): Adobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) (critical 9.6)
- [CVE-2026-90530](https://insights.sbomify.com/CVE-2026-90530/): ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) (critical 9.3)
- [CVE-2026-9053](https://insights.sbomify.com/CVE-2026-9053/): File upload in 9front (medium 6.9)
- [CVE-2026-90529](https://insights.sbomify.com/CVE-2026-90529/): DataEase Symbolic Map symbolic-map.ts buildTooltip cross site scripting (medium 5.1)
- [CVE-2026-90528](https://insights.sbomify.com/CVE-2026-90528/): TDuckApp tduck-platform Form Write View index.vue cross site scripting (medium 5.1)
- [CVE-2026-90527](https://insights.sbomify.com/CVE-2026-90527/): quequnlong shiyi-blog Add Message API index.vue cross site scripting (medium 5.3)
- [CVE-2026-90526](https://insights.sbomify.com/CVE-2026-90526/): SourceCodester School Registration and Fee System save_class.php sql injection (medium 6.9)
- [CVE-2026-90525](https://insights.sbomify.com/CVE-2026-90525/): itsourcecode Sales and Inventory System cust_pos_trans.php sql injection (medium 5.3)
- [CVE-2026-90524](https://insights.sbomify.com/CVE-2026-90524/): jaychouchannel Tourism-Management-System Update Endpoint missing authentication (medium 6.9)
- [CVE-2026-90523](https://insights.sbomify.com/CVE-2026-90523/): jaychouchannel Tourism-Management-System User Register Endpoint UsersController.java privileges management (medium 6.9)
- [CVE-2026-90522](https://insights.sbomify.com/CVE-2026-90522/): jaychouchannel Tourism-Management-System Password Recovery UsersController.java resetPass password recovery (medium 6.9)
- [CVE-2026-90521](https://insights.sbomify.com/CVE-2026-90521/): jaychouchannel Tourism-Management-System CRUD MenpiaodingdanController.java authorization (medium 5.3)
- [CVE-2026-90520](https://insights.sbomify.com/CVE-2026-90520/): jaychouchannel Tourism-Management-System Authorization Interceptor AuthorizationInterceptor.java improper authorization (medium 5.3)
- [CVE-2026-90519](https://insights.sbomify.com/CVE-2026-90519/): PHPGurukul Bank Locker Management System add-locker-form.php unrestricted upload (medium 5.3)
- [CVE-2026-90518](https://insights.sbomify.com/CVE-2026-90518/): PHPGurukul Bank Locker Management System sidebar.php access control (medium 5.3)
- [CVE-2026-90517](https://insights.sbomify.com/CVE-2026-90517/): PHPGurukul Bank Locker Management System view-assign-locker.php authorization (medium 6.9)
- [CVE-2026-90516](https://insights.sbomify.com/CVE-2026-90516/): SourceCodester School Registration and Fee System pay_report.php sql injection (medium 6.9)
- [CVE-2026-90515](https://insights.sbomify.com/CVE-2026-90515/): SourceCodester School Registration and Fee System delete_stud.php sql injection (medium 6.9)
- [CVE-2026-90514](https://insights.sbomify.com/CVE-2026-90514/): SourceCodester School Registration and Fee System save_stud.php sql injection (medium 6.9)
- [CVE-2026-90513](https://insights.sbomify.com/CVE-2026-90513/): simalexan api-lambda-send-email-ses API Gateway Endpoint template.yml SES.sendEmail missing authentication (medium 6.9)
- [CVE-2026-90511](https://insights.sbomify.com/CVE-2026-90511/): GongShengyue OnlineBooks listSplit BooksServlet.java sql injection (medium 5.3)
- [CVE-2026-90510](https://insights.sbomify.com/CVE-2026-90510/): dromara orion-visor HostKeyServiceImpl.java HostKeyServiceImpl.encryptKey hard-coded key (medium 6.9)
- [CVE-2026-9051](https://insights.sbomify.com/CVE-2026-9051/): Authentication Bypass Vulnerability in NI SystemLink Enterprise (critical 9.3)
- [CVE-2026-90509](https://insights.sbomify.com/CVE-2026-90509/): dromara orion-visor ExposeApiAspect.java ExposeApiAspect.beforeExposeApi hard-coded credentials (medium 6.9)
- [CVE-2026-90508](https://insights.sbomify.com/CVE-2026-90508/): Chengdu Qilu Technology Ludashi Message Dispatch ProtectFilter64.sys MessageNotifyCallback authorization (medium 4.6)
- [CVE-2026-90507](https://insights.sbomify.com/CVE-2026-90507/): vvbbnn00 WARP-Clash-API Subscription subscription.py get_surge_subscription access control (medium 5.3)
- [CVE-2026-90506](https://insights.sbomify.com/CVE-2026-90506/): vvbbnn00 WARP-Clash-API Save Account Job race condition (low 2.3)
- [CVE-2026-90505](https://insights.sbomify.com/CVE-2026-90505/): vvbbnn00 WARP-Clash-API doUpdateLicenseKey race condition (low 2.3)
- [CVE-2026-90504](https://insights.sbomify.com/CVE-2026-90504/): vvbbnn00 WARP-Clash-API authorized missing authentication (medium 6.9)
- [CVE-2026-90503](https://insights.sbomify.com/CVE-2026-90503/): Chengdu Qilu Technology Ludashi ComputerZ_x64.sys sub_11008 information disclosure (medium 4.6)
- [CVE-2026-90502](https://insights.sbomify.com/CVE-2026-90502/): stilleshan ServerStatus Stats Generation main.cpp cross site scripting (medium 5.1)
- [CVE-2026-90501](https://insights.sbomify.com/CVE-2026-90501/): lenve vhr HrMapper.xml HrInfoController.updateHr privileges management (medium 5.3)
- [CVE-2026-90500](https://insights.sbomify.com/CVE-2026-90500/): lenve vhr Avatar Upload userface FastDFSUtils.upload unrestricted upload (medium 5.3)
- [CVE-2026-9050](https://insights.sbomify.com/CVE-2026-9050/): Missing authorization in Slider Revolution (medium 4.3)
- [CVE-2026-90499](https://insights.sbomify.com/CVE-2026-90499/): lenve vhr Password Update pass HrInfoController.updatePass improper authorization (medium 5.3)
- [CVE-2026-90498](https://insights.sbomify.com/CVE-2026-90498/): lenve vhr vhr.sql default credentials (medium 6.9)
- [CVE-2026-90497](https://insights.sbomify.com/CVE-2026-90497/): Fengoffice Feng Office Task Title Output add_task.php getTitle cross site scripting (medium 5.1)
- [CVE-2026-90496](https://insights.sbomify.com/CVE-2026-90496/): Fengoffice Feng Office Reorder Handlers MoreController.class.php update_dimension_order sql injection (medium 5.1)
- [CVE-2026-90495](https://insights.sbomify.com/CVE-2026-90495/): Fengoffice Feng Office Legacy API CompanyWebsite.class.php instance->findAll sql injection (medium 6.9)
- [CVE-2026-90494](https://insights.sbomify.com/CVE-2026-90494/): restify node-restify static.js serveStatic path traversal (medium 6.9)
- [CVE-2026-90493](https://insights.sbomify.com/CVE-2026-90493/): Tonec Internet Download Manager Kernel Driver idmwfp.sys access control (critical 9.3)
- [CVE-2026-90492](https://insights.sbomify.com/CVE-2026-90492/): webgjc web_robot web.py controller_recover os command injection (medium 5.3)
- [CVE-2026-90491](https://insights.sbomify.com/CVE-2026-90491/): sanjevirau gsubs Electron index.js showQuerySuccessPage code injection (medium 5.3)
- [CVE-2026-90490](https://insights.sbomify.com/CVE-2026-90490/): lenve vhr MailReceiver deserialization (medium 5.3)
- [CVE-2026-90489](https://insights.sbomify.com/CVE-2026-90489/): Xuxueli xxl-job insert cross site scripting (medium 5.1)
- [CVE-2026-90488](https://insights.sbomify.com/CVE-2026-90488/): Xuxueli xxl-job GlueFactory.java GroovyClassLoader.parseClass code injection (medium 5.3)
- [CVE-2026-90487](https://insights.sbomify.com/CVE-2026-90487/): Xuxueli xxl-job JobGroupController.java privileges management (medium 5.3)
- [CVE-2026-90486](https://insights.sbomify.com/CVE-2026-90486/): openstatusHQ openstatus resolve-custom-domain-rewrite.ts server-side request forgery (medium 5.3)
- [CVE-2026-90485](https://insights.sbomify.com/CVE-2026-90485/): IOBit Uninstaller IOCTL Dispatch IURegistryFilter.sys sub_11838 null pointer dereference (medium 6.8)
- [CVE-2026-90484](https://insights.sbomify.com/CVE-2026-90484/): Apache bRPC: Null pointer dereference in MySQL reply parser leading to client crash (medium 6.5)
- [CVE-2026-90481](https://insights.sbomify.com/CVE-2026-90481/): Auth bypass in Burp Suite DAST (critical 9.2)
- [CVE-2026-9048](https://insights.sbomify.com/CVE-2026-9048/): Missing authorization in Slider Revolution (medium 4.3)
- [CVE-2026-90474](https://insights.sbomify.com/CVE-2026-90474/): MCPHub before 1.0.32 OAuth 2.0 Authentication Bypass (high 7.6)
- [CVE-2026-90473](https://insights.sbomify.com/CVE-2026-90473/): msgpack-java through 0.9.12 Integer Overflow via MAP32 (medium 6.9)
- [CVE-2026-90472](https://insights.sbomify.com/CVE-2026-90472/): msgpack-java through 0.9.12 Stack Overflow via Nested Arrays (medium 6.9)
- [CVE-2026-9047](https://insights.sbomify.com/CVE-2026-9047/): Auth bypass in Server (high 7.6)
- [CVE-2026-90467](https://insights.sbomify.com/CVE-2026-90467/): aiosmtplib before 5.1.3 ESMTP Parameter Injection via unvalidated addresses (medium 6.3)
- [CVE-2026-90466](https://insights.sbomify.com/CVE-2026-90466/): Apache Impala: Path traversal executes JARs outside trusted paths (medium 6.5)
- [CVE-2026-90465](https://insights.sbomify.com/CVE-2026-90465/): Fireware OS Missing Authentication in FireCluster Sync Allows Privilege Escalation (high 8.7)
- [CVE-2026-90464](https://insights.sbomify.com/CVE-2026-90464/): Fireware OS Missing Command Validation allows Authenticated Arbitrary File Modification as Root (high 7.2)
- [CVE-2026-90463](https://insights.sbomify.com/CVE-2026-90463/): Memory corruption in Red Hat Enterprise Linux 10 (medium 4.0)
- [CVE-2026-90462](https://insights.sbomify.com/CVE-2026-90462/): Sssd: sssd: fail-open in ldap ppolicy access check allows continued authorization (medium 5.4)
- [CVE-2026-90461](https://insights.sbomify.com/CVE-2026-90461/): Information disclosure in Ironic (medium 6.3)
- [CVE-2026-90460](https://insights.sbomify.com/CVE-2026-90460/): Missing authorization in Keystone (high 7.6)
- [CVE-2026-9046](https://insights.sbomify.com/CVE-2026-9046/): Misconfiguration in App Store (high 7.3)
- [CVE-2026-90458](https://insights.sbomify.com/CVE-2026-90458/): Missing authorization in Ironic (medium 5.4)
- [CVE-2026-90457](https://insights.sbomify.com/CVE-2026-90457/): Weak cryptography in Malcolm (medium 6.9)
- [CVE-2026-90456](https://insights.sbomify.com/CVE-2026-90456/): Use of default credentials in Malcolm (critical 9.2)
- [CVE-2026-90455](https://insights.sbomify.com/CVE-2026-90455/): Dependency on vulnerable third-party component in Malcolm (medium 6.3)
- [CVE-2026-90454](https://insights.sbomify.com/CVE-2026-90454/): Missing authorization in Malcolm (medium 5.3)
- [CVE-2026-90453](https://insights.sbomify.com/CVE-2026-90453/): Open Redirect in Malcolm (medium 5.1)
- [CVE-2026-90452](https://insights.sbomify.com/CVE-2026-90452/): Improper certificate validation in Malcolm (medium 6.0)
- [CVE-2026-90451](https://insights.sbomify.com/CVE-2026-90451/): Use of Default Credentials in Malcolm (high 8.2)
- [CVE-2026-90450](https://insights.sbomify.com/CVE-2026-90450/): Incorrect Authorization in Malcolm (medium 5.3)
- [CVE-2026-9045](https://insights.sbomify.com/CVE-2026-9045/): Privilege escalation in Accessories and Display Manager for Enterprise (high 8.5)
- [CVE-2026-90449](https://insights.sbomify.com/CVE-2026-90449/): Missing Authentication for Critical Function in Malcolm (medium 6.9)
- [CVE-2026-90448](https://insights.sbomify.com/CVE-2026-90448/): Missing Authorization in Malcolm (high 7.1)
- [CVE-2026-90447](https://insights.sbomify.com/CVE-2026-90447/): Authentication Bypass by Spoofing in Malcolm (high 7.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/264/