# Vulnerabilities published in 2026


- [CVE-2026-89246](https://insights.sbomify.com/CVE-2026-89246/): WWBN AVideo CSV Formula Injection via myComments.download.php (medium 5.1)
- [CVE-2026-89245](https://insights.sbomify.com/CVE-2026-89245/): WWBN AVideo Cross-Site Request Forgery via playlistRemove.php (high 7.1)
- [CVE-2026-89244](https://insights.sbomify.com/CVE-2026-89244/): WWBN AVideo Reflected XSS via Gallery Category getBackURL (medium 5.3)
- [CVE-2026-89243](https://insights.sbomify.com/CVE-2026-89243/): WWBN AVideo Stored XSS via UserGroups setGroup_name (critical 9.2)
- [CVE-2026-89242](https://insights.sbomify.com/CVE-2026-89242/): WWBN AVideo Unauthenticated SSRF via login.json.php (medium 6.9)
- [CVE-2026-89241](https://insights.sbomify.com/CVE-2026-89241/): WWBN AVideo Reflected XSS via confirmLivePassword.php (medium 5.3)
- [CVE-2026-89240](https://insights.sbomify.com/CVE-2026-89240/): WWBN AVideo Reflected XSS via confirmLivePassword.php (medium 5.3)
- [CVE-2026-8924](https://insights.sbomify.com/CVE-2026-8924/): trailing dot domain super cookie (critical 9.1)
- [CVE-2026-89239](https://insights.sbomify.com/CVE-2026-89239/): WWBN AVideo Reflected XSS via Referer Header Comment Breakout (medium 5.3)
- [CVE-2026-89238](https://insights.sbomify.com/CVE-2026-89238/): Apache WSS4J: WSS4J EncryptedHeader child confusion causing wrong protected-header selection (critical 9.1)
- [CVE-2026-89237](https://insights.sbomify.com/CVE-2026-89237/): Bluff Post <= 1.1.1 - Unauthenticated SQLi via 'table_name' and 'column_name' Parameters (medium 6.8)
- [CVE-2026-89236](https://insights.sbomify.com/CVE-2026-89236/): SaveTo Wishlist Lite < 1.1.5 - Unauthenticated SQLi via 'sort_column' and 'sort_order' Parameters (high 8.6)
- [CVE-2026-89235](https://insights.sbomify.com/CVE-2026-89235/): Testimonials by BestWebSoft 1.0.5 - 1.0.8 - Unauthenticated SQLi via 'offset' Parameter (medium 6.8)
- [CVE-2026-89234](https://insights.sbomify.com/CVE-2026-89234/): WP-Partner <= 1.2.1 - Unauthenticated SQLi via 'id' Parameter (high 8.6)
- [CVE-2026-89232](https://insights.sbomify.com/CVE-2026-89232/): RecordBrowser <= 1.1.7 - Unauthenticated SQLi via 'recordid' Parameter (high 8.6)
- [CVE-2026-8922](https://insights.sbomify.com/CVE-2026-8922/): Org.keycloak/keycloak-services: keycloak: org.keycloak.protocol.oidc: security flaw in org.keycloak/keycloak-services (medium 5.4)
- [CVE-2026-89216](https://insights.sbomify.com/CVE-2026-89216/): vTables < 0.3 - Unauthenticated SQL Injection via orderby Parameter (high 8.6)
- [CVE-2026-89214](https://insights.sbomify.com/CVE-2026-89214/): WpCues Basic Quiz <= 1.6.5 - Unauthenticated SQLi via Quiz Result Submission (high 8.6)
- [CVE-2026-89213](https://insights.sbomify.com/CVE-2026-89213/): Llavero.io <= 0.1.4 - Unauthenticated Blind SQLi via 'cill_login' Parameter (high 8.6)
- [CVE-2026-89212](https://insights.sbomify.com/CVE-2026-89212/): XML External Entity in Akana API Platform (critical 9.2)
- [CVE-2026-8921](https://insights.sbomify.com/CVE-2026-8921/): Privilege escalation in ASUS Business Manager (high 8.5)
- [CVE-2026-89209](https://insights.sbomify.com/CVE-2026-89209/): Auth bypass in Mendix SAML (Mendix 10 compatible) (high 7.6)
- [CVE-2026-89208](https://insights.sbomify.com/CVE-2026-89208/): Memory corruption in Capital Embedded AR Classic 431-422 (medium 6.9)
- [CVE-2026-89207](https://insights.sbomify.com/CVE-2026-89207/): Denial of service in WTV676-HB6035 Web Interface (medium 6.9)
- [CVE-2026-89206](https://insights.sbomify.com/CVE-2026-89206/): Missing authorization in RUGGEDCOM CROSSBOW (medium 5.3)
- [CVE-2026-89205](https://insights.sbomify.com/CVE-2026-89205/): Missing authorization in RUGGEDCOM CROSSBOW (medium 5.3)
- [CVE-2026-89204](https://insights.sbomify.com/CVE-2026-89204/): Missing authorization in RUGGEDCOM CROSSBOW (medium 5.3)
- [CVE-2026-89203](https://insights.sbomify.com/CVE-2026-89203/): Missing authorization in RUGGEDCOM CROSSBOW (medium 5.3)
- [CVE-2026-89202](https://insights.sbomify.com/CVE-2026-89202/): Missing authorization in RUGGEDCOM CROSSBOW (high 7.1)
- [CVE-2026-89201](https://insights.sbomify.com/CVE-2026-89201/): SQL injection in RUGGEDCOM CROSSBOW (high 7.7)
- [CVE-2026-89200](https://insights.sbomify.com/CVE-2026-89200/): SQL injection in RUGGEDCOM CROSSBOW (high 8.4)
- [CVE-2026-8920](https://insights.sbomify.com/CVE-2026-8920/): Path traversal in Aura Wallpaper Service (high 8.5)
- [CVE-2026-89199](https://insights.sbomify.com/CVE-2026-89199/): Missing authorization in RUGGEDCOM CROSSBOW (high 8.7)
- [CVE-2026-89198](https://insights.sbomify.com/CVE-2026-89198/): SQL injection in RUGGEDCOM CROSSBOW (high 8.7)
- [CVE-2026-89197](https://insights.sbomify.com/CVE-2026-89197/): SQL injection in RUGGEDCOM CROSSBOW (high 8.7)
- [CVE-2026-89196](https://insights.sbomify.com/CVE-2026-89196/): SQL injection in RUGGEDCOM CROSSBOW (high 8.7)
- [CVE-2026-89195](https://insights.sbomify.com/CVE-2026-89195/): Site Setup Wizard <= 1.5.8 - Unauthenticated SQLi via ssw_check_admin_email_exists (high 8.6)
- [CVE-2026-89193](https://insights.sbomify.com/CVE-2026-89193/): Robin Image Optimizer 2.0.0 - 2.0.7 - Unauthenticated Stored XSS via WebP URL Delivery HTML Parser (high 7.5)
- [CVE-2026-89191](https://insights.sbomify.com/CVE-2026-89191/): Stored Cross-Site Scripting in SQLView KRIS (medium 6.8)
- [CVE-2026-89190](https://insights.sbomify.com/CVE-2026-89190/): Robin Image Optimizer < 2.0.8 - Subscriber+ Plugin Settings Disclosure via fy_ajax (medium 4.3)
- [CVE-2026-8919](https://insights.sbomify.com/CVE-2026-8919/): Misconfiguration in GameSDK (high 7.2)
- [CVE-2026-89186](https://insights.sbomify.com/CVE-2026-89186/): Information disclosure in mpp (medium 6.3)
- [CVE-2026-89182](https://insights.sbomify.com/CVE-2026-89182/): Gitea push-to-create bypass of FORCE_PRIVATE policy (medium 5.4)
- [CVE-2026-89180](https://insights.sbomify.com/CVE-2026-89180/): Thinking Software Technology｜EFence - SQL Injection (high 8.7)
- [CVE-2026-8918](https://insights.sbomify.com/CVE-2026-8918/): Security feature bypass in Armoury Crate (high 7.1)
- [CVE-2026-89179](https://insights.sbomify.com/CVE-2026-89179/): Howyar｜WeenyGenius - Missing Support for Integrity Check (medium 5.3)
- [CVE-2026-89178](https://insights.sbomify.com/CVE-2026-89178/): Howyar｜WeenyGenius - Origin Validation Error (high 8.7)
- [CVE-2026-89177](https://insights.sbomify.com/CVE-2026-89177/): Howyar｜WeenyGenius - Use of Insecure Protocol (high 8.7)
- [CVE-2026-89176](https://insights.sbomify.com/CVE-2026-89176/): Howyar｜WeenyGenius - Missing Authentication (high 8.7)
- [CVE-2026-89175](https://insights.sbomify.com/CVE-2026-89175/): Kingdom Communication Associated｜Smart Video Intercom System - Client-Side Authentication (medium 6.9)
- [CVE-2026-89174](https://insights.sbomify.com/CVE-2026-89174/): Kingdom Communication Associated｜Smart Video Intercom System - Missing Burte-force Protection (high 8.7)
- [CVE-2026-89173](https://insights.sbomify.com/CVE-2026-89173/): Kingdom Communication Associated｜Smart Video Intercom System - Sensitive Data Exposure (medium 6.9)
- [CVE-2026-89172](https://insights.sbomify.com/CVE-2026-89172/): Side-channel attack of AN1044/AN953/SW300052 cryptographic algorithms (medium 5.6)
- [CVE-2026-8917](https://insights.sbomify.com/CVE-2026-8917/): Memory corruption in AI Suite3 (high 8.4)
- [CVE-2026-89169](https://insights.sbomify.com/CVE-2026-89169/): Security feature bypass in live-boot (medium 4.1)
- [CVE-2026-89162](https://insights.sbomify.com/CVE-2026-89162/): Information disclosure in PCRE2 (low 2.9)
- [CVE-2026-89161](https://insights.sbomify.com/CVE-2026-89161/): Memory corruption in PCRE2 (high 7.4)
- [CVE-2026-89160](https://insights.sbomify.com/CVE-2026-89160/): Memory corruption in PCRE2 (low 3.7)
- [CVE-2026-8916](https://insights.sbomify.com/CVE-2026-8916/): Memory corruption in rlottie (medium 6.1)
- [CVE-2026-89158](https://insights.sbomify.com/CVE-2026-89158/): Integer overflow in PCRE2 (medium 6.5)
- [CVE-2026-89157](https://insights.sbomify.com/CVE-2026-89157/): Memory corruption in PCRE2 (medium 5.7)
- [CVE-2026-89156](https://insights.sbomify.com/CVE-2026-89156/): Memory corruption in PCRE2 (low 2.9)
- [CVE-2026-89151](https://insights.sbomify.com/CVE-2026-89151/): Missing authorization in Forgejo (low 3.5)
- [CVE-2026-8915](https://insights.sbomify.com/CVE-2026-8915/): Memory corruption in Escargot (high 8.8)
- [CVE-2026-89148](https://insights.sbomify.com/CVE-2026-89148/): AVideo Open Redirect via playlistSort.php Referer Header (medium 5.1)
- [CVE-2026-89147](https://insights.sbomify.com/CVE-2026-89147/): Net-SNMP through 5.9.5.2 Denial of Service via Blocking Unauthenticated SMUX Read (high 8.7)
- [CVE-2026-89146](https://insights.sbomify.com/CVE-2026-89146/): libp2p-rendezvous through 0.17.1 Denial of Service via Unbounded Registration TTL in Discovery Responses (high 8.7)
- [CVE-2026-89145](https://insights.sbomify.com/CVE-2026-89145/): Flextype CMS 0.9.9 through 1.0.0-alpha.3 Stored XSS via Plugin Directory (low 2.4)
- [CVE-2026-89141](https://insights.sbomify.com/CVE-2026-89141/): Missing authorization in AI Engine – The Chatbot, AI Framework & MCP for WordPress (medium 6.5)
- [CVE-2026-89140](https://insights.sbomify.com/CVE-2026-89140/): Missing authorization in Temporal Server (medium 6.0)
- [CVE-2026-8914](https://insights.sbomify.com/CVE-2026-8914/): Command injection in Profile change function (high 8.4)
- [CVE-2026-89139](https://insights.sbomify.com/CVE-2026-89139/): Temporal Server worker deployment compute provider executes a caller-supplied command on the Worker Service host (high 8.7)
- [CVE-2026-89138](https://insights.sbomify.com/CVE-2026-89138/): Missing authorization in Filter Gallery (medium 4.3)
- [CVE-2026-89136](https://insights.sbomify.com/CVE-2026-89136/): Client accepts unsolicited RawPublicKey server certificate type (high 8.3)
- [CVE-2026-89135](https://insights.sbomify.com/CVE-2026-89135/): Failed X509_verify_cert leaves unverified CA in shared CertManager (medium 6.3)
- [CVE-2026-89134](https://insights.sbomify.com/CVE-2026-89134/): Subject CN name-constraint check bypassed when non-DNS SAN present (medium 6.3)
- [CVE-2026-89133](https://insights.sbomify.com/CVE-2026-89133/): NameConstraints not enforced across unconstrained intermediate CA (medium 6.3)
- [CVE-2026-8913](https://insights.sbomify.com/CVE-2026-8913/): Command Injection in TP-Link's Archer MR600 WireGuard Client Configuration (high 8.5)
- [CVE-2026-89124](https://insights.sbomify.com/CVE-2026-89124/): Missing authorization in SAP HANA (Display Product Catalog Based on Customs Declaration) (medium 4.3)
- [CVE-2026-89122](https://insights.sbomify.com/CVE-2026-89122/): Open Redirect Vulnerability in SAP NetWeaver Enterprise Portal (medium 6.1)
- [CVE-2026-89121](https://insights.sbomify.com/CVE-2026-89121/): Missing Authorization Check in SAP S/4HANA (Linear Asset Management RAP Business Object) (medium 4.7)
- [CVE-2026-89120](https://insights.sbomify.com/CVE-2026-89120/): Missing authorization check in SAP ABAP Platform (high 7.1)
- [CVE-2026-8912](https://insights.sbomify.com/CVE-2026-8912/): Contest Gallery <= 28.1.6 - Unauthenticated SQL Injection (high 7.5)
- [CVE-2026-89118](https://insights.sbomify.com/CVE-2026-89118/): Information Disclosure vulnerability in SAP NetWeaver Enterprise Portal (medium 5.3)
- [CVE-2026-89117](https://insights.sbomify.com/CVE-2026-89117/): Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal (medium 6.1)
- [CVE-2026-89116](https://insights.sbomify.com/CVE-2026-89116/): OS Command Injection in Yeoman-UI / Application Wizard Extension for VS Code (medium 5.9)
- [CVE-2026-89113](https://insights.sbomify.com/CVE-2026-89113/): SQL Injection vulnerability in SAP Commerce Cloud (OOTB Code) (high 8.8)
- [CVE-2026-89112](https://insights.sbomify.com/CVE-2026-89112/): Broken Access Control in CLA-Assistant � CLA Signature PII Disclosure (medium 6.5)
- [CVE-2026-89111](https://insights.sbomify.com/CVE-2026-89111/): OAuth2 SSRF vulnerability in SAP Cloud SDK for Python (critical 10.0)
- [CVE-2026-89110](https://insights.sbomify.com/CVE-2026-89110/): Broken Access Control in SAP NetWeaver Visual Composer (critical 9.9)
- [CVE-2026-8911](https://insights.sbomify.com/CVE-2026-8911/): WP AutoBuzz <= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'googleAccount' Parameter (medium 6.1)
- [CVE-2026-89108](https://insights.sbomify.com/CVE-2026-89108/): Missing Authorization check in SAP Manufacturing Integration and Intelligence (Configuration Service) (critical 9.1)
- [CVE-2026-89107](https://insights.sbomify.com/CVE-2026-89107/): Code Injection vulnerability in SAP S/4HANA (Manage Substitution/Validation Rules) (critical 9.9)
- [CVE-2026-89106](https://insights.sbomify.com/CVE-2026-89106/): Cross Site Scripting (XSS) vulnerability in SAPUI5 (medium 4.4)
- [CVE-2026-89105](https://insights.sbomify.com/CVE-2026-89105/): Improper Authentication in HybridTokenAuthenticator of SAP/cloud-security-services-integration-library (medium 4.2)
- [CVE-2026-89102](https://insights.sbomify.com/CVE-2026-89102/): OCSP stapling v2 multi accepts non-CA chain certificates as issuers (high 8.3)
- [CVE-2026-89100](https://insights.sbomify.com/CVE-2026-89100/): Cross-site scripting in Payment Plugins for Stripe WooCommerce (medium 6.1)
- [CVE-2026-8910](https://insights.sbomify.com/CVE-2026-8910/): WP Emoticon Rating <= 1.0.1 - Cross-Site Request Forgery to Reflected Cross-Site Scripting via 'emo_settings' Parameter (medium 6.1)
- [CVE-2026-89099](https://insights.sbomify.com/CVE-2026-89099/): Race Condition in MongoDB Server Document Value Layer Leads to Memory Corruption (high 7.7)
- [CVE-2026-89098](https://insights.sbomify.com/CVE-2026-89098/): Nfs-utils: nfs-utils: denial of service via assertion failure in fsidd (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/277/