# Vulnerabilities published in 2026


- [CVE-2026-86689](https://insights.sbomify.com/CVE-2026-86689/): Cleartext Transmission of Sensitive Information in Bransys ELD (high 8.2)
- [CVE-2026-86688](https://insights.sbomify.com/CVE-2026-86688/): Session id is not renewed on authentication in ash_authentication, allowing session fixation (high 7.4)
- [CVE-2026-86684](https://insights.sbomify.com/CVE-2026-86684/): Gitea push mirror local path check uses the repository owner (high 7.1)
- [CVE-2026-86683](https://insights.sbomify.com/CVE-2026-86683/): Broken Authentication Vulnerability (high 8.1)
- [CVE-2026-86681](https://insights.sbomify.com/CVE-2026-86681/): Broken Access Control vulnerability (high 7.6)
- [CVE-2026-8668](https://insights.sbomify.com/CVE-2026-8668/): Hardcoded credentials in embedded content (low 2.3)
- [CVE-2026-86679](https://insights.sbomify.com/CVE-2026-86679/): Broken Access Control vulnerability (high 7.1)
- [CVE-2026-86678](https://insights.sbomify.com/CVE-2026-86678/): Broken Authentication vulnerability (high 8.8)
- [CVE-2026-86677](https://insights.sbomify.com/CVE-2026-86677/): Broken Authentication vulnerability (high 8.8)
- [CVE-2026-86675](https://insights.sbomify.com/CVE-2026-86675/): itsourcecode Sales and Inventory System us_edit.php sql injection (medium 5.3)
- [CVE-2026-86674](https://insights.sbomify.com/CVE-2026-86674/): ningzichun Student Management System login.php session_start session fixiation (medium 5.3)
- [CVE-2026-86673](https://insights.sbomify.com/CVE-2026-86673/): ningzichun Student Management System Database Connection database.php mysqli_connect hard-coded credentials (medium 6.9)
- [CVE-2026-86672](https://insights.sbomify.com/CVE-2026-86672/): ningzichun Student Management System Backup example.7z information disclosure (medium 6.9)
- [CVE-2026-86671](https://insights.sbomify.com/CVE-2026-86671/): Server-side request forgery in Eclipse Che (high 8.4)
- [CVE-2026-86670](https://insights.sbomify.com/CVE-2026-86670/): aircheng-org iWebShop-5 Authentication Storage admin.php weak password hash (medium 6.3)
- [CVE-2026-8667](https://insights.sbomify.com/CVE-2026-8667/): Incorrect Authorization in GitLab (medium 4.3)
- [CVE-2026-86669](https://insights.sbomify.com/CVE-2026-86669/): aircheng-org iWebShop-5 systemseller.php login improper authentication (medium 6.9)
- [CVE-2026-86668](https://insights.sbomify.com/CVE-2026-86668/): aircheng-org iWebShop-5 pic.php uploadFile cross site scripting (medium 5.3)
- [CVE-2026-86667](https://insights.sbomify.com/CVE-2026-86667/): aircheng-org iWebShop-5 member.php member_list sql injection (medium 5.1)
- [CVE-2026-86666](https://insights.sbomify.com/CVE-2026-86666/): aircheng-org iWebShop-5 pic.php uploadFile unrestricted upload (medium 6.9)
- [CVE-2026-86665](https://insights.sbomify.com/CVE-2026-86665/): aircheng-org iWebShop-5 update.php index authorization (medium 6.9)
- [CVE-2026-8666](https://insights.sbomify.com/CVE-2026-8666/): OS Command Injection in Rapid7 InsightConnect Traceroute Plugin (high 7.7)
- [CVE-2026-8665](https://insights.sbomify.com/CVE-2026-8665/): OS Command Injection in Rapid7 InsightConnect Translate Plugin (high 7.7)
- [CVE-2026-86644](https://insights.sbomify.com/CVE-2026-86644/): star7th showdoc API Page Save Endpoint editormd.js cross site scripting (medium 5.1)
- [CVE-2026-8664](https://insights.sbomify.com/CVE-2026-8664/): OS Command Injection in Rapid7 InsightConnect Finger Plugin (medium 6.0)
- [CVE-2026-8663](https://insights.sbomify.com/CVE-2026-8663/): OS Command Injection in Rapid7 InsightConnect RPM Plugin (medium 6.0)
- [CVE-2026-8662](https://insights.sbomify.com/CVE-2026-8662/): Path Traversal in Rapid7 InsightConnect Compression Plugin (low 3.3)
- [CVE-2026-86612](https://insights.sbomify.com/CVE-2026-86612/): Ninja Tables < 5.2.17 - Unauthenticated Arbitrary Shortcode Execution via Fluent Forms Data Source (medium 5.6)
- [CVE-2026-86611](https://insights.sbomify.com/CVE-2026-86611/): Download Manager (Free & Pro) - Privacy Settings Update via CSRF (medium 4.3)
- [CVE-2026-86610](https://insights.sbomify.com/CVE-2026-86610/): Download Manager < 3.3.71 - Author+ Stored XSS via Package Icon (medium 6.4)
- [CVE-2026-8661](https://insights.sbomify.com/CVE-2026-8661/): Server-Side Cross-Site Scripting and SSRF in Rapid7 InsightConnect Markdown to PDF Plugin (medium 4.8)
- [CVE-2026-86609](https://insights.sbomify.com/CVE-2026-86609/): Download Manager Pro < 7.5.6 - Unauthenticated Stored XSS via Email Lock Subscription (high 8.8)
- [CVE-2026-86608](https://insights.sbomify.com/CVE-2026-86608/): WP Recipe Maker 9.8.0 - 10.8.1 - Unauthenticated DoS via Unbounded User Meta Insertion (high 8.2)
- [CVE-2026-86607](https://insights.sbomify.com/CVE-2026-86607/): Internal Application Information Exposure Vulnerability in Hitachi Ops Center Administrator (medium 4.3)
- [CVE-2026-86604](https://insights.sbomify.com/CVE-2026-86604/): GTranslate < 5.0.1 - Unauthenticated Arbitrary Shortcode Execution via Email Translation (medium 4.8)
- [CVE-2026-86603](https://insights.sbomify.com/CVE-2026-86603/): WP Recipe Maker < 10.8.2 - Subscriber+ Non-Public List Title Disclosure via wprm_search_lists (medium 4.3)
- [CVE-2026-86602](https://insights.sbomify.com/CVE-2026-86602/): WP Recipe Maker 10.3.0 - 10.8.1 - Subscriber+ Draft and Private Recipe Content Disclosure via wprm_shortcode_preview (medium 4.3)
- [CVE-2026-86601](https://insights.sbomify.com/CVE-2026-86601/): WP Recipe Maker < 10.8.2 - Unauthenticated Arbitrary Shortcode Execution via Comment Content (medium 6.5)
- [CVE-2026-86600](https://insights.sbomify.com/CVE-2026-86600/): Workload identity attestation generated before login host validation in Snowflake drivers (high 8.2)
- [CVE-2026-8660](https://insights.sbomify.com/CVE-2026-8660/): OS Command Injection in Rapid7 InsightConnect Ping Plugin (high 7.7)
- [CVE-2026-86597](https://insights.sbomify.com/CVE-2026-86597/): Sensitive information written to logs by Snowflake drivers (medium 6.5)
- [CVE-2026-86595](https://insights.sbomify.com/CVE-2026-86595/): SQLi in Iron Mountain's enVision (high 8.8)
- [CVE-2026-86591](https://insights.sbomify.com/CVE-2026-86591/): Botiga Pro < 1.6.5 - Unauthenticated Arbitrary Blog Options Update via Templates Builder REST Route (critical 9.8)
- [CVE-2026-86590](https://insights.sbomify.com/CVE-2026-86590/): Server-side request forgery in Eclipse Che (medium 6.3)
- [CVE-2026-8659](https://insights.sbomify.com/CVE-2026-8659/): OS Command Injection in Rapid7 InsightConnect SQLmap Plugin (medium 6.0)
- [CVE-2026-86589](https://insights.sbomify.com/CVE-2026-86589/): Apache Answer: User Center integration does not revoke first-login sessions after central account suspension (not scored)
- [CVE-2026-86585](https://insights.sbomify.com/CVE-2026-86585/): Improper Verification of the Firmware Signature vulnerability (high 7.7)
- [CVE-2026-86583](https://insights.sbomify.com/CVE-2026-86583/): Privilege escalation in Import and export users and customers (high 8.8)
- [CVE-2026-8658](https://insights.sbomify.com/CVE-2026-8658/): OS Command Injection in Rapid7 InsightConnect Tcpdump Plugin (medium 6.0)
- [CVE-2026-86577](https://insights.sbomify.com/CVE-2026-86577/): Out-of-bounds Write Vulnerability in JP1 Products (critical 9.4)
- [CVE-2026-86576](https://insights.sbomify.com/CVE-2026-86576/): Heap-based Buffer Overflow Vulnerability in JP1 Products (critical 9.4)
- [CVE-2026-86575](https://insights.sbomify.com/CVE-2026-86575/): Stack-based Buffer Overflow Vulnerability in JP1 Products (critical 9.4)
- [CVE-2026-86574](https://insights.sbomify.com/CVE-2026-86574/): Heap-based Buffer Overflow Vulnerability in JP1/Base (critical 9.8)
- [CVE-2026-86573](https://insights.sbomify.com/CVE-2026-86573/): Memory corruption in Hitachi Disk Array Driver for AIX (medium 5.1)
- [CVE-2026-8657](https://insights.sbomify.com/CVE-2026-8657/): jsondiffpatch patch APIs are vulnerable to prototype pollution (high 8.8)
- [CVE-2026-86567](https://insights.sbomify.com/CVE-2026-86567/): Dpdk: dpdk: vduse handler fails to invalidate vring pointers when iotlb is invalidated, leading to use-after-unmap (high 8.8)
- [CVE-2026-86566](https://insights.sbomify.com/CVE-2026-86566/): Dpdk: dpdk: guest with runt rx descriptors underflows copy length in vhost enqueue (split and packed rings) (medium 6.5)
- [CVE-2026-86565](https://insights.sbomify.com/CVE-2026-86565/): Dpdk: dpdk: guest can desynchronize virtqueue size from inflight descriptor table size, causing out-of-bounds write (high 8.2)
- [CVE-2026-86564](https://insights.sbomify.com/CVE-2026-86564/): Dpdk: dpdk: missing length validation before reading command_data in virtio-net control queue handler (low 3.3)
- [CVE-2026-86563](https://insights.sbomify.com/CVE-2026-86563/): Dpdk: dpdk: double offset bug in vhost log mapping calculation (high 7.8)
- [CVE-2026-86562](https://insights.sbomify.com/CVE-2026-86562/): Dpdk: dpdk: control-queue descriptor double-fetch overflows host heap in dpdk vhost (vduse) (high 7.8)
- [CVE-2026-86561](https://insights.sbomify.com/CVE-2026-86561/): Dpdk: dpdk: missing memory size validation before mmap in vhost memory region setup (medium 6.5)
- [CVE-2026-8656](https://insights.sbomify.com/CVE-2026-8656/): Cross-site scripting in jsondiffpatch (medium 5.1)
- [CVE-2026-86556](https://insights.sbomify.com/CVE-2026-86556/): An information disclosure vulnerability in ZTE U30 Air product (medium 5.3)
- [CVE-2026-86555](https://insights.sbomify.com/CVE-2026-86555/): Hardcoded Key Vulnerability in ZTE SmartLife APP (medium 6.2)
- [CVE-2026-86554](https://insights.sbomify.com/CVE-2026-86554/): Email enumeration and account ID leakage vulnerabilities in ZTE SmartLife APP (medium 4.3)
- [CVE-2026-86553](https://insights.sbomify.com/CVE-2026-86553/): A password reset vulnerability in ZTE SmartLife APP (high 8.8)
- [CVE-2026-86552](https://insights.sbomify.com/CVE-2026-86552/): A vulnerability that skips email ownership verification for account registration in ZTE SmartLife APP (medium 5.4)
- [CVE-2026-86551](https://insights.sbomify.com/CVE-2026-86551/): Wi-Fi MAC Address Obtainment by Non-privileged Program Vulnerability in ZTE Z80Ultra (NX741J) product (low 3.3)
- [CVE-2026-86550](https://insights.sbomify.com/CVE-2026-86550/): UXSS vulnerability in ZTE browser products (medium 6.5)
- [CVE-2026-8655](https://insights.sbomify.com/CVE-2026-8655/): Multiple Memory overflow vulnerabilities leading to unpredictable or erroneous behavior and Denial of Service (high 8.8)
- [CVE-2026-86547](https://insights.sbomify.com/CVE-2026-86547/): mrubyc through 4.0.0 NULL Pointer Dereference via OP_ENTER (medium 6.9)
- [CVE-2026-86544](https://insights.sbomify.com/CVE-2026-86544/): knowns before 0.30.0 Authorization Bypass via Misclassified Code Actions (high 7.2)
- [CVE-2026-86543](https://insights.sbomify.com/CVE-2026-86543/): knowns before 0.30.0 Unauthenticated Management API Exposure (critical 9.3)
- [CVE-2026-86542](https://insights.sbomify.com/CVE-2026-86542/): knowns before 0.30.0 Path Traversal via Import Name (high 8.8)
- [CVE-2026-86541](https://insights.sbomify.com/CVE-2026-86541/): knowns before 0.30.0 Path Traversal via code.replace MCP action (high 7.2)
- [CVE-2026-86540](https://insights.sbomify.com/CVE-2026-86540/): knowns before 0.30.0 Arbitrary Code Execution via LSP Binary (high 8.5)
- [CVE-2026-8654](https://insights.sbomify.com/CVE-2026-8654/): Command injection in Cassandra Connector (high 8.7)
- [CVE-2026-86539](https://insights.sbomify.com/CVE-2026-86539/): knowns through 0.33.0 Server-Side Request Forgery via embedding-models endpoint (medium 6.9)
- [CVE-2026-86538](https://insights.sbomify.com/CVE-2026-86538/): knowns before 0.30.0 Path Traversal via templateFile parameter (high 8.7)
- [CVE-2026-86537](https://insights.sbomify.com/CVE-2026-86537/): Denial of service in Apache Thrift (high 8.7)
- [CVE-2026-86536](https://insights.sbomify.com/CVE-2026-86536/): Code injection in Apache Thrift (medium 6.3)
- [CVE-2026-86535](https://insights.sbomify.com/CVE-2026-86535/): Apache Thrift: A JSON member name can stall the Node server's event loop indefinitely (high 8.7)
- [CVE-2026-86533](https://insights.sbomify.com/CVE-2026-86533/): Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix (critical 9.1)
- [CVE-2026-86530](https://insights.sbomify.com/CVE-2026-86530/): Command injection in WEX-G300 (high 8.6)
- [CVE-2026-8653](https://insights.sbomify.com/CVE-2026-8653/): MasterStudy LMS Pro Plus <= 4.8.20 - Authenticated (Instructor+) SQL Injection via 'columns' Parameter (medium 6.5)
- [CVE-2026-86522](https://insights.sbomify.com/CVE-2026-86522/): Log injection via an unescaped password reset identity in AshAuthentication (medium 6.3)
- [CVE-2026-86520](https://insights.sbomify.com/CVE-2026-86520/): Use of Hard-coded Credentials in Bransys ELD (high 8.7)
- [CVE-2026-8652](https://insights.sbomify.com/CVE-2026-8652/): Command injection in Aterm CM51FD (high 8.5)
- [CVE-2026-86519](https://insights.sbomify.com/CVE-2026-86519/): code-projects Student Crud Operation Backup File card_activation.sql information disclosure (medium 6.9)
- [CVE-2026-86518](https://insights.sbomify.com/CVE-2026-86518/): code-projects Student Crud Operation edit.php sql injection (medium 5.3)
- [CVE-2026-86517](https://insights.sbomify.com/CVE-2026-86517/): itsourcecode Sales and Inventory System us_searchfrm.php mysqli_query sql injection (medium 5.3)
- [CVE-2026-86516](https://insights.sbomify.com/CVE-2026-86516/): Privilege escalation in mocknest-serverless (medium 5.1)
- [CVE-2026-86515](https://insights.sbomify.com/CVE-2026-86515/): vgmstream txtp txtp_parser.c add_entry resource consumption (medium 5.3)
- [CVE-2026-86514](https://insights.sbomify.com/CVE-2026-86514/): vgmstream txth-txtp txth.c sscanf stack-based overflow (medium 5.3)
- [CVE-2026-86513](https://insights.sbomify.com/CVE-2026-86513/): Denial of service in jackson-coreutils (medium 6.9)
- [CVE-2026-86512](https://insights.sbomify.com/CVE-2026-86512/): java-json-tools json-patch Copy Move Operations CopyOperation.java MoveOperation.apply access control (medium 5.3)
- [CVE-2026-86511](https://insights.sbomify.com/CVE-2026-86511/): java-json-tools jackson-coreutils JacksonUtils.java BigDecimal.toPlainString resource consumption (medium 6.9)
- [CVE-2026-86510](https://insights.sbomify.com/CVE-2026-86510/): D-Link DIR-822A L2TP Control Message tunnel_set_params out-of-bounds write (critical 9.4)
- [CVE-2026-8651](https://insights.sbomify.com/CVE-2026-8651/): IPv6 Loopback Spoof via Trusted Host Header Bypasses Origin Check in MOVEit Transfer (low 3.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/297/