# Vulnerabilities published in 2026


- [CVE-2026-88621](https://insights.sbomify.com/CVE-2026-88621/): OneNav v1.2.4 contains an authenticated arbitrary file deletion vulnerability in the Api::upload() method in class/Api.php. (low 2.7)
- [CVE-2026-88620](https://insights.sbomify.com/CVE-2026-88620/): SmartAdmin API Java17 SpringBoot3 version 3.30.0 contains an improper authorization vulnerability in the /employee/queryAll endpoint. (medium 4.3)
- [CVE-2026-8862](https://insights.sbomify.com/CVE-2026-8862/): Vulnerabilities exists in IBM Netezza Software (high 7.5)
- [CVE-2026-88619](https://insights.sbomify.com/CVE-2026-88619/): 1024-lab SmartAdmin v3.30.0 contains a missing authorization vulnerability in the scheduled-job management module. (high 8.1)
- [CVE-2026-88618](https://insights.sbomify.com/CVE-2026-88618/): 1024-lab SmartAdmin v3.30.0 contains a stored cross-site scripting vulnerability in its file upload functionality. (medium 6.5)
- [CVE-2026-88617](https://insights.sbomify.com/CVE-2026-88617/): SmartAdmin v3.30.0 contains an authorization flaw in the configuration query endpoint. (critical 9.8)
- [CVE-2026-88616](https://insights.sbomify.com/CVE-2026-88616/): An issue in RuoYi-Vue-Plus 6.0.0 allows a remote attacker to execute arbitrary code via the FlwTaskController.java component, and the FlwTas (high 8.8)
- [CVE-2026-8861](https://insights.sbomify.com/CVE-2026-8861/): Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access (medium 5.3)
- [CVE-2026-88593](https://insights.sbomify.com/CVE-2026-88593/): kkFileView 5.0.0 through 5.0.2 allows reflected XSS via the /onlinePreview endpoint. (medium 6.1)
- [CVE-2026-88592](https://insights.sbomify.com/CVE-2026-88592/): kkFileView >= 4.2.0 is vulnerable to Server-Side Request Forgery (SSRF). (critical 9.1)
- [CVE-2026-8859](https://insights.sbomify.com/CVE-2026-8859/): Path Traversal in APIRequest Component via Content-Disposition Header (critical 9.9)
- [CVE-2026-8858](https://insights.sbomify.com/CVE-2026-8858/): WebSphere Application Server Remote Code Execution (high 7.5)
- [CVE-2026-8857](https://insights.sbomify.com/CVE-2026-8857/): Full RCE using EasyTimeline Extension (not scored)
- [CVE-2026-8856](https://insights.sbomify.com/CVE-2026-8856/): IBM HTTP Server is affected by multiple vulnerabilities (high 7.7)
- [CVE-2026-8855](https://insights.sbomify.com/CVE-2026-8855/): IBM HTTP Server is affected by multiple vulnerabilities (high 8.1)
- [CVE-2026-8854](https://insights.sbomify.com/CVE-2026-8854/): IBM HTTP Server is affected by multiple vulnerabilities (high 7.5)
- [CVE-2026-8853](https://insights.sbomify.com/CVE-2026-8853/): MW WP Form <= 5.1.3 - Authenticated (Editor+) Stored Cross-Site Scripting via 'memo' Parameter (medium 4.4)
- [CVE-2026-8852](https://insights.sbomify.com/CVE-2026-8852/): IBM HTTP Server is affected by multiple vulnerabilities (medium 6.2)
- [CVE-2026-88514](https://insights.sbomify.com/CVE-2026-88514/): An issue in iTerm2 macOS before 3.6.12 allows a local attacker to obtain sensitive information. (medium 5.5)
- [CVE-2026-8851](https://insights.sbomify.com/CVE-2026-8851/): SOGo < 5.12.8 SQL Injection via addUserInAcls endpoint (high 8.6)
- [CVE-2026-8850](https://insights.sbomify.com/CVE-2026-8850/): IBM HTTP Server is affected by multiple vulnerabilities (high 7.5)
- [CVE-2026-8849](https://insights.sbomify.com/CVE-2026-8849/): Use After Free vulnerability in RTI Connext Professional (Security Plugins) allows File Manipulation. (high 7.7)
- [CVE-2026-8848](https://insights.sbomify.com/CVE-2026-8848/): Missing authorization in Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder (high 7.2)
- [CVE-2026-8847](https://insights.sbomify.com/CVE-2026-8847/): Dideo <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-88467](https://insights.sbomify.com/CVE-2026-88467/): CRMEB Knowledge-Paid System crmeb_zzff_class 1.4.4 has a backend verification function that returns the wrong type of value, causing errors (medium 6.2)
- [CVE-2026-8846](https://insights.sbomify.com/CVE-2026-8846/): Tuxquote <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-8845](https://insights.sbomify.com/CVE-2026-8845/): Islamic Database <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-8844](https://insights.sbomify.com/CVE-2026-8844/): Responsive Check <= 0.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-8843](https://insights.sbomify.com/CVE-2026-8843/): Calling createIndex with certain index types can crash mongod (high 7.1)
- [CVE-2026-88424](https://insights.sbomify.com/CVE-2026-88424/): FineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the field/order parameter at ButtonService.GetListByFilter(). (critical 9.8)
- [CVE-2026-88421](https://insights.sbomify.com/CVE-2026-88421/): Incorrect access control in the BlogPage.get_entries() component of APSL puput v1.2.1 through v2.2.0 allows unauthenticated attackers to vie (high 7.5)
- [CVE-2026-88420](https://insights.sbomify.com/CVE-2026-88420/): A reflected cross-site scripting (XSS) vulnerability in the EntryAbstract.save() component of APSL puput v1.2.1 through v2.2.0 allows authen (medium 5.4)
- [CVE-2026-8842](https://insights.sbomify.com/CVE-2026-8842/): Google+ Link Name <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-88419](https://insights.sbomify.com/CVE-2026-88419/): An unrestricted upload of files with a dangerous type in the thumbnail-upload endpoint (/index.php?m=member&f=article&v=thumbUpload) of Wuzh (high 8.8)
- [CVE-2026-88418](https://insights.sbomify.com/CVE-2026-88418/): CMSimple 5.24 ships with CSRF protection disabled by default, which turns csrfProtection() into a no-op on every state-changing admin reques (high 8.8)
- [CVE-2026-88416](https://insights.sbomify.com/CVE-2026-88416/): MCMS 6.1.1 through 6.2.1 has a SQL injection vulnerability in the custom model/form import feature. (critical 9.8)
- [CVE-2026-88415](https://insights.sbomify.com/CVE-2026-88415/): MCMS 6.1.1 through 6.2.1 is vulnerable to stored Cross-Site Scripting (XSS). (high 8.7)
- [CVE-2026-88414](https://insights.sbomify.com/CVE-2026-88414/): MCMS 6.1.1 through 6.2.1 contains a SQL injection vulnerability in the PageAction.verify endpoint (GET /ms/mdiy/page/verify.do). (critical 9.8)
- [CVE-2026-88412](https://insights.sbomify.com/CVE-2026-88412/): An integer overflow in the _BulkInsert_ReadProperty component (/bulk_insert.c) of FalkorDB (Redis module) v4.20.1 allows attackers to cause (medium 5.3)
- [CVE-2026-88411](https://insights.sbomify.com/CVE-2026-88411/): Improper error handling in the GRAPH.EFFECT component (/effects/effects_apply.c) of FalkorDB (Redis module) v4.20.1 leads to a Denial of Ser (high 7.5)
- [CVE-2026-88410](https://insights.sbomify.com/CVE-2026-88410/): The graph.UDF in FalkorDB (Redis module) v4.20.1 to v4.20.4 is not registered as a write command, leading to unexpected behavior within the application. (high 7.1)
- [CVE-2026-8841](https://insights.sbomify.com/CVE-2026-8841/): Cross-site scripting in Extra Settings for RocketChat (medium 6.4)
- [CVE-2026-88409](https://insights.sbomify.com/CVE-2026-88409/): FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a buffer overflow in the _Decode_GrB_Matrix function (/v19/decode_matrix.c). (high 8.8)
- [CVE-2026-88408](https://insights.sbomify.com/CVE-2026-88408/): FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a stack overflow in the _GetGroup() function (/ops/op_aggregate.c). (medium 6.5)
- [CVE-2026-88407](https://insights.sbomify.com/CVE-2026-88407/): An out-of-bounds read in the node_token_count/relation_token_count component of FalkorDB (Redis module) v4.20.1 to v4.20.4 allows attackers (high 7.5)
- [CVE-2026-88406](https://insights.sbomify.com/CVE-2026-88406/): FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a stack overflow in the _ValidateUnion_Clauses function (/ast/ast_validations.c). (high 7.5)
- [CVE-2026-88405](https://insights.sbomify.com/CVE-2026-88405/): A remote code execution (RCE) vulnerability in the RemoteRegisterFunctionService function (/remote/remote-register-function.service.ts) of U (critical 9.8)
- [CVE-2026-88404](https://insights.sbomify.com/CVE-2026-88404/): A remote code execution (RCE) vulnerability in the UniscriptExecutionService.execute() function (/services/script-execution.service.ts) of U (critical 9.8)
- [CVE-2026-88403](https://insights.sbomify.com/CVE-2026-88403/): A Server-Side Request Forgery (SSRF) in the serverRequest function of nocobase v2.1.21 allows authenticated attackers to scan internal resou (medium 6.5)
- [CVE-2026-88402](https://insights.sbomify.com/CVE-2026-88402/): A SQL injection vulnerability in the checkSQL function of nocobase v2.1.21 allows attackers to access sesntive database information via inje (critical 9.8)
- [CVE-2026-8840](https://insights.sbomify.com/CVE-2026-8840/): Missing authorization in Booking calendar, Appointment Booking System (medium 5.3)
- [CVE-2026-88397](https://insights.sbomify.com/CVE-2026-88397/): ApiAdmin v.5.0 and before is vulnerable to SQL Injection in the user-list endpoint GET /admin/User/getUsers via the gid parameter. (medium 6.5)
- [CVE-2026-88396](https://insights.sbomify.com/CVE-2026-88396/): ApiAdmin v5.0 and before is vulnerable to Directory Traversal. (high 7.2)
- [CVE-2026-88395](https://insights.sbomify.com/CVE-2026-88395/): GouGuOA v6.0.5 and before is vulnerable to SQL Injection in /home/message/rubbish via the keywords parameter. (critical 9.8)
- [CVE-2026-88394](https://insights.sbomify.com/CVE-2026-88394/): WookTeam v1.6.6 and before is vulnerable to a Directory Traversal. (high 7.5)
- [CVE-2026-88393](https://insights.sbomify.com/CVE-2026-88393/): WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export. (critical 9.8)
- [CVE-2026-88392](https://insights.sbomify.com/CVE-2026-88392/): Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local(). (high 7.5)
- [CVE-2026-88391](https://insights.sbomify.com/CVE-2026-88391/): Northstar (dromara/northstar, quantitative trading platform) <= 9.1.1 enables the H2 Console but its auth interceptor only covers /northstar (critical 9.8)
- [CVE-2026-88390](https://insights.sbomify.com/CVE-2026-88390/): An out-of-bounds write vulnerability in jslGetTokenValueAsString() in Espruino 2v29 (commit bffc6d0) allows crafted JavaScript input contain (high 7.7)
- [CVE-2026-8839](https://insights.sbomify.com/CVE-2026-8839/): MapPress Maps for WordPress <= 2.96.6 - Unauthenticated Insecure Direct Object Reference via REST API Endpoints (medium 5.3)
- [CVE-2026-88389](https://insights.sbomify.com/CVE-2026-88389/): Espruino 2v29 (commit bffc6d0) contains a NULL pointer dereference vulnerability in jslGetRawString() in src/jslex.c. (medium 6.2)
- [CVE-2026-88388](https://insights.sbomify.com/CVE-2026-88388/): Espruino 2v29 (commit bffc6d0) contains a stack-based buffer overflow vulnerability in the JavaScript error stack-trace handling path on 64-bit builds. (high 7.5)
- [CVE-2026-88387](https://insights.sbomify.com/CVE-2026-88387/): LibRaw 0.22.0 contains an incorrect numeric conversion vulnerability in LibRaw::parse_tiff_ifd() when processing TIFF tag 0x00fe (NewSubfileType). (medium 5.5)
- [CVE-2026-88386](https://insights.sbomify.com/CVE-2026-88386/): libsndfile 1.2.2 contains a misaligned memory access issue in psf_binheader_readf() while parsing WAV fmt chunks. (medium 5.5)
- [CVE-2026-88385](https://insights.sbomify.com/CVE-2026-88385/): Mini-XML 4.0.5 contains a memory leak vulnerability in mxml_load_data() during malformed XML parsing. (medium 6.5)
- [CVE-2026-88384](https://insights.sbomify.com/CVE-2026-88384/): OpenEXR 3.4.14 contains a NULL Pointer Dereference in the C++ attribute parsing path. (medium 5.5)
- [CVE-2026-88383](https://insights.sbomify.com/CVE-2026-88383/): libical 4.0.6 contains an incompatible function pointer in icalparameter_string_to_kind(). (medium 6.2)
- [CVE-2026-88382](https://insights.sbomify.com/CVE-2026-88382/): hiredis commit 29ea279 (post-v1.5.0) contains an uncontrolled memory allocation vulnerability in its RESP aggregate parser. (high 7.5)
- [CVE-2026-8838](https://insights.sbomify.com/CVE-2026-8838/): Remote Code Execution via eval() Injection in amazon-redshift-python-driver (critical 9.3)
- [CVE-2026-88378](https://insights.sbomify.com/CVE-2026-88378/): QuickJS commit 04be24600 contains a heap out-of-bounds write condition in JS_ReadFunctionTag(). (critical 9.8)
- [CVE-2026-88377](https://insights.sbomify.com/CVE-2026-88377/): Bento4 1.6.0.0 contains an integer underflow vulnerability in the avcC and hvcC configuration atom parsers. (medium 6.2)
- [CVE-2026-88376](https://insights.sbomify.com/CVE-2026-88376/): Bento4 1.6.0.0 contains an integer underflow vulnerability in AP4_AvccAtom::Create() and AP4_HvccAtom::Create(). (high 7.5)
- [CVE-2026-88373](https://insights.sbomify.com/CVE-2026-88373/): libde265 commit 4d45a6b contains a NULL pointer dereference vulnerability in the NAL parsing path. (high 7.5)
- [CVE-2026-88372](https://insights.sbomify.com/CVE-2026-88372/): libsndfile 1.2.2 contains an integer overflow vulnerability in mat4_read_header() when parsing crafted MAT4 (MATLAB v4) files. (high 7.5)
- [CVE-2026-88371](https://insights.sbomify.com/CVE-2026-88371/): ZBar commit 2ea2ca58 contains an undefined-behavior vulnerability in the Code 128 decode6() function. (medium 5.5)
- [CVE-2026-88370](https://insights.sbomify.com/CVE-2026-88370/): libconfini 1.16.4 contains a heap out-of-bounds write condition involving the bundled load_ini_buffer.h utility and strip_ini_cache(). (medium 5.3)
- [CVE-2026-8837](https://insights.sbomify.com/CVE-2026-8837/): Cross-site scripting in WP Iframe Geo Style for Amazon affiliates (medium 6.4)
- [CVE-2026-88369](https://insights.sbomify.com/CVE-2026-88369/): zserge jsmn commit 25647e6 is vulnerable to Buffer Overflow in example/jsondump.c dump(). (high 7.3)
- [CVE-2026-88368](https://insights.sbomify.com/CVE-2026-88368/): NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in the rasterizer's nsvg__addActive() function. (high 7.5)
- [CVE-2026-88367](https://insights.sbomify.com/CVE-2026-88367/): NanoSVG 239e102ec contains an incorrect numeric conversion vulnerability in nsvg__curveDivs() during SVG stroke rasterization. (medium 6.5)
- [CVE-2026-88366](https://insights.sbomify.com/CVE-2026-88366/): NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in nsvg__pathArcTo() when parsing SVG arc commands. (high 7.5)
- [CVE-2026-88365](https://insights.sbomify.com/CVE-2026-88365/): minimp3 commit ea99364f contains an integer overflow vulnerability in mp3dec_skip_id3v1() when parsing the APEv2 tag-size field. (critical 9.8)
- [CVE-2026-88362](https://insights.sbomify.com/CVE-2026-88362/): MuJS e892c9fdb contains an incorrect numeric conversion vulnerability in jsR_isindex() in jsrun.c. (high 7.5)
- [CVE-2026-88361](https://insights.sbomify.com/CVE-2026-88361/): SumatraPDF 3.6.1 contains an integer overflow vulnerability in EngineMupdf::BuildPageLabelRec() when parsing PDF PageLabels /Nums entries. (high 7.5)
- [CVE-2026-88360](https://insights.sbomify.com/CVE-2026-88360/): libvips 8.19.0 contains a memory access vulnerability when processing little-endian PFM images. (high 7.5)
- [CVE-2026-8836](https://insights.sbomify.com/CVE-2026-8836/): lwIP snmpv3 USM snmp_msg.c snmp_parse_inbound_frame stack-based overflow (critical 9.3)
- [CVE-2026-88359](https://insights.sbomify.com/CVE-2026-88359/): libfyaml 0.9.6 contains a stack exhaustion vulnerability in fy_atom_iter_format(). (medium 6.5)
- [CVE-2026-88358](https://insights.sbomify.com/CVE-2026-88358/): simdjson 4.6.1 contains a one-byte out-of-bounds read vulnerability in dom::parser::parse_unpadded(). (medium 6.5)
- [CVE-2026-88357](https://insights.sbomify.com/CVE-2026-88357/): nDPI 5.1.0 contains a memory access issue in the DNS dissector and serializer deserialization code. (high 7.5)
- [CVE-2026-88355](https://insights.sbomify.com/CVE-2026-88355/): An incorrect buffer size calculation vulnerability exists in tinyexpr commit 4a7456e in new_expr(). (high 7.5)
- [CVE-2026-88351](https://insights.sbomify.com/CVE-2026-88351/): An integer overflow vulnerability exists in the MPack Node API in MPack 1.1.1 on 32-bit platforms. (critical 9.8)
- [CVE-2026-88350](https://insights.sbomify.com/CVE-2026-88350/): An integer overflow vulnerability exists in MPack 1.1.1 in mpack_node_cstr_alloc() and mpack_node_utf8_cstr_alloc(). (medium 6.2)
- [CVE-2026-8835](https://insights.sbomify.com/CVE-2026-8835/): IBM HTTP Server is affected by multiple vulnerabilities (high 7.3)
- [CVE-2026-88345](https://insights.sbomify.com/CVE-2026-88345/): An out-of-bounds read vulnerability exists in the schema lexer of flatcc 4c3b999e. (high 7.5)
- [CVE-2026-88344](https://insights.sbomify.com/CVE-2026-88344/): An out-of-bounds read vulnerability exists in the schema lexer of flatcc 4c3b999e. (high 7.5)
- [CVE-2026-88341](https://insights.sbomify.com/CVE-2026-88341/): A reachable assertion vulnerability exists in YARA 4.5.8 when loading crafted .yrc compiled rule files. (medium 5.5)
- [CVE-2026-88340](https://insights.sbomify.com/CVE-2026-88340/): An invalid pointer release vulnerability exists in YARA 4.5.8 during deserialization of compiled .yrc rule files. (high 7.6)
- [CVE-2026-8834](https://insights.sbomify.com/CVE-2026-8834/): IBM HTTP Server is affected by multiple vulnerabilities (high 8.0)
- [CVE-2026-88339](https://insights.sbomify.com/CVE-2026-88339/): A NULL pointer dereference vulnerability exists in the gf_sg_vrml_field_clone() function of GPAC 2d7da22e (26.08-DEV). (medium 5.5)
- [CVE-2026-8833](https://insights.sbomify.com/CVE-2026-8833/): XSS in urls (high 8.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/281/