# Vulnerabilities published in 2026


- [CVE-2026-86401](https://insights.sbomify.com/CVE-2026-86401/): SQL injection in PowerProtect Data Domain Management Center (low 2.7)
- [CVE-2026-86400](https://insights.sbomify.com/CVE-2026-86400/): Auth bypass in PowerProtect Data Domain (critical 9.8)
- [CVE-2026-86399](https://insights.sbomify.com/CVE-2026-86399/): Command injection in PowerProtect Data Domain (high 7.2)
- [CVE-2026-86398](https://insights.sbomify.com/CVE-2026-86398/): Path traversal in PowerProtect Data Domain (high 8.8)
- [CVE-2026-86397](https://insights.sbomify.com/CVE-2026-86397/): Missing authorization in PowerProtect Data Domain (critical 9.8)
- [CVE-2026-86396](https://insights.sbomify.com/CVE-2026-86396/): Command injection in PowerProtect Data Domain (high 8.8)
- [CVE-2026-86395](https://insights.sbomify.com/CVE-2026-86395/): Command injection in PowerProtect Data Domain Virtual Edition (high 7.2)
- [CVE-2026-86394](https://insights.sbomify.com/CVE-2026-86394/): Command injection in PowerProtect Data Domain (high 7.2)
- [CVE-2026-86393](https://insights.sbomify.com/CVE-2026-86393/): Privilege escalation in PowerProtect Data Domain (high 7.2)
- [CVE-2026-86392](https://insights.sbomify.com/CVE-2026-86392/): Memory corruption in PowerProtect Data Domain (medium 4.9)
- [CVE-2026-86391](https://insights.sbomify.com/CVE-2026-86391/): Auth bypass in PowerProtect Data Domain Management Center (medium 6.4)
- [CVE-2026-86390](https://insights.sbomify.com/CVE-2026-86390/): Missing authorization in PowerProtect Data Domain (medium 6.5)
- [CVE-2026-86389](https://insights.sbomify.com/CVE-2026-86389/): Integer overflow in PowerProtect Data Domain (high 7.2)
- [CVE-2026-86388](https://insights.sbomify.com/CVE-2026-86388/): Path traversal in PowerProtect Data Domain (medium 5.3)
- [CVE-2026-86386](https://insights.sbomify.com/CVE-2026-86386/): SQL injection in PowerProtect Data Domain Management Center (medium 4.3)
- [CVE-2026-86385](https://insights.sbomify.com/CVE-2026-86385/): Privilege escalation in PowerProtect Data Domain (high 8.8)
- [CVE-2026-86384](https://insights.sbomify.com/CVE-2026-86384/): Hardcoded credentials in PowerProtect Data Domain (critical 9.8)
- [CVE-2026-86383](https://insights.sbomify.com/CVE-2026-86383/): Path traversal in PowerProtect Data Domain (medium 6.8)
- [CVE-2026-86380](https://insights.sbomify.com/CVE-2026-86380/): Integer overflow in PowerProtect Data Domain (high 7.2)
- [CVE-2026-86379](https://insights.sbomify.com/CVE-2026-86379/): Command injection in PowerProtect Data Domain Management Center (high 7.2)
- [CVE-2026-86378](https://insights.sbomify.com/CVE-2026-86378/): Memory corruption in PowerProtect Data Domain (high 8.8)
- [CVE-2026-86377](https://insights.sbomify.com/CVE-2026-86377/): Memory corruption in PowerProtect Data Domain (high 7.6)
- [CVE-2026-86375](https://insights.sbomify.com/CVE-2026-86375/): Information disclosure in Application Installer, (medium 6.2)
- [CVE-2026-8637](https://insights.sbomify.com/CVE-2026-8637/): Privilege escalation in LanSchool Classic (high 8.5)
- [CVE-2026-86362](https://insights.sbomify.com/CVE-2026-86362/): Privilege escalation in System Update (high 8.2)
- [CVE-2026-86361](https://insights.sbomify.com/CVE-2026-86361/): Privilege escalation in System Update (high 8.2)
- [CVE-2026-86360](https://insights.sbomify.com/CVE-2026-86360/): Path traversal in System Update (critical 9.6)
- [CVE-2026-8636](https://insights.sbomify.com/CVE-2026-8636/): Multiple Vulnerabilities in IBM Datacap (medium 5.5)
- [CVE-2026-86359](https://insights.sbomify.com/CVE-2026-86359/): Misconfiguration in Repository Manager (high 8.5)
- [CVE-2026-86358](https://insights.sbomify.com/CVE-2026-86358/): Memory corruption in Update Package Framework (medium 6.5)
- [CVE-2026-86351](https://insights.sbomify.com/CVE-2026-86351/): MISP User Homepage Validation Allows Authenticated Open Redirect via Protocol-Relative URL (medium 5.1)
- [CVE-2026-86350](https://insights.sbomify.com/CVE-2026-86350/): Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-up (critical 9.1)
- [CVE-2026-8635](https://insights.sbomify.com/CVE-2026-8635/): Arbitrary Code Execution in Python Interpreter Component (critical 9.9)
- [CVE-2026-86349](https://insights.sbomify.com/CVE-2026-86349/): Mattermost Server Algorithmic DoS via Unbounded Markdown Block Nesting (medium 4.3)
- [CVE-2026-86348](https://insights.sbomify.com/CVE-2026-86348/): MS Calendar plugin: unrecovered handler panics from malformed post-action requests could crash the plugin process (medium 4.3)
- [CVE-2026-86347](https://insights.sbomify.com/CVE-2026-86347/): MISP Missing Authorization on Template File Upload Allows Authenticated Disk Exhaustion (high 7.1)
- [CVE-2026-86345](https://insights.sbomify.com/CVE-2026-86345/): Security feature bypass in Red Hat Directory Server 11 (critical 9.0)
- [CVE-2026-86344](https://insights.sbomify.com/CVE-2026-86344/): Denial of service in Red Hat Directory Server 11 (high 7.5)
- [CVE-2026-86342](https://insights.sbomify.com/CVE-2026-86342/): MISP Freetext Feed Preview Improper Authorization Exposes Restricted Event and Feed Information (medium 5.3)
- [CVE-2026-86341](https://insights.sbomify.com/CVE-2026-86341/): Access Control Check Implemented After Asset is Accessed in GitLab (medium 4.4)
- [CVE-2026-8634](https://insights.sbomify.com/CVE-2026-8634/): Crabbox < v0.12.0 Environment Variable Information Disclosure (critical 9.3)
- [CVE-2026-86338](https://insights.sbomify.com/CVE-2026-86338/): Ash field policies do not filter-nil forbidden calculations and aggregates, enabling an information-disclosure oracle (medium 6.0)
- [CVE-2026-86335](https://insights.sbomify.com/CVE-2026-86335/): LXD Cross-Project Private Image Theft via Unsanitized GetImageFromAnyProject Local Reuse (medium 6.3)
- [CVE-2026-86334](https://insights.sbomify.com/CVE-2026-86334/): CLI Path Traversal via Content-Disposition in LXD Image Export/Copy (medium 4.2)
- [CVE-2026-86332](https://insights.sbomify.com/CVE-2026-86332/): Odh-dashboard: odh-dashboard: nim credential secret readable by any authenticated user (medium 6.5)
- [CVE-2026-86330](https://insights.sbomify.com/CVE-2026-86330/): Noobaa-core: noobaa-core: os command injection in cluster_internal_api.set_hostname_internal (high 7.2)
- [CVE-2026-8633](https://insights.sbomify.com/CVE-2026-8633/): Code injection in Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty (critical 9.8)
- [CVE-2026-86326](https://insights.sbomify.com/CVE-2026-86326/): Security feature bypass in MGate MB3170 Series (high 8.6)
- [CVE-2026-86325](https://insights.sbomify.com/CVE-2026-86325/): Memory corruption in MGate MB3170 Series (critical 9.4)
- [CVE-2026-86321](https://insights.sbomify.com/CVE-2026-86321/): java-json-tools jackson-coreutils URL Validation JsonLoader.java JsonLoader.fromURL server-side request forgery (medium 6.9)
- [CVE-2026-86320](https://insights.sbomify.com/CVE-2026-86320/): Flatpak-builder: host code execution via `git am` hook execution in patch source extraction (`use-git-am`) (high 7.8)
- [CVE-2026-8632](https://insights.sbomify.com/CVE-2026-8632/): HP Linux Imaging and Printing Software – Potential Escalation of Privilege and Arbitrary Code Execution (high 8.5)
- [CVE-2026-86319](https://insights.sbomify.com/CVE-2026-86319/): java-json-tools json-patch Patch Operation JsonPatch.java JsonPatch.apply resource consumption (medium 6.9)
- [CVE-2026-86318](https://insights.sbomify.com/CVE-2026-86318/): java-json-tools json-patch JsonMergePatchDeserializer.java JsonMergePatch.fromJson stack-based overflow (medium 6.9)
- [CVE-2026-86317](https://insights.sbomify.com/CVE-2026-86317/): ggml-org llama.cpp RPC Server ggml-rpc.cpp deserialize_tensor assertion (medium 6.9)
- [CVE-2026-86315](https://insights.sbomify.com/CVE-2026-86315/): Integer overflow in Escargot (medium 6.2)
- [CVE-2026-86314](https://insights.sbomify.com/CVE-2026-86314/): Integer overflow in Walrus (medium 6.2)
- [CVE-2026-86313](https://insights.sbomify.com/CVE-2026-86313/): Memory corruption in Walrus (high 7.8)
- [CVE-2026-86311](https://insights.sbomify.com/CVE-2026-86311/): Cross-site scripting in Photo Gallery by 10Web – Mobile-Friendly Image Gallery (medium 6.4)
- [CVE-2026-86310](https://insights.sbomify.com/CVE-2026-86310/): itsourcecode Sales and Inventory System cust_edit1.php sql injection (medium 5.3)
- [CVE-2026-8631](https://insights.sbomify.com/CVE-2026-8631/): HP Linux Imaging and Printing Software – Potential Escalation of Privilege and Arbitrary Code Execution (critical 9.3)
- [CVE-2026-86309](https://insights.sbomify.com/CVE-2026-86309/): itsourcecode Sales and Inventory System pro_searchfrm.php sql injection (medium 5.3)
- [CVE-2026-86308](https://insights.sbomify.com/CVE-2026-86308/): light0011 cms Debug Mode config.php information disclosure (medium 6.9)
- [CVE-2026-86307](https://insights.sbomify.com/CVE-2026-86307/): light0011 cms cross-site request forgery (medium 5.3)
- [CVE-2026-86306](https://insights.sbomify.com/CVE-2026-86306/): light0011 cms Cookie Helper UserModel.class.php improper authentication (medium 6.9)
- [CVE-2026-86305](https://insights.sbomify.com/CVE-2026-86305/): light0011 cms Upload.class.php upload unrestricted upload (medium 6.9)
- [CVE-2026-86304](https://insights.sbomify.com/CVE-2026-86304/): MojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parse_assertion builds Net::SAML2::Binding::PO (critical 9.8)
- [CVE-2026-86303](https://insights.sbomify.com/CVE-2026-86303/): 92181 markdown md.c lds out-of-bounds (medium 6.9)
- [CVE-2026-86302](https://insights.sbomify.com/CVE-2026-86302/): code-projects Hospital Information System SQL Database Backup File his.sql information disclosure (medium 6.9)
- [CVE-2026-86301](https://insights.sbomify.com/CVE-2026-86301/): code-projects Hospital Information System Patient Management editPatient.php cross site scripting (medium 5.1)
- [CVE-2026-86300](https://insights.sbomify.com/CVE-2026-86300/): Tenda AC9 Web Management R7WebsSecurityHandler improper authentication (medium 6.9)
- [CVE-2026-8630](https://insights.sbomify.com/CVE-2026-8630/): justhtml before 1.12.0 Mutation XSS via Raw Text Elements (medium 5.1)
- [CVE-2026-86299](https://insights.sbomify.com/CVE-2026-86299/): Linksys RE7000 PingTest json.cgi platform_event_pingTest os command injection (critical 9.4)
- [CVE-2026-86298](https://insights.sbomify.com/CVE-2026-86298/): SourceCodester Class and Exam Timetabling System delete_subject.php sql injection (medium 6.9)
- [CVE-2026-86297](https://insights.sbomify.com/CVE-2026-86297/): D-Link DIR-605 L2TP Control Message tunnel.c tunnel_set_params off-by-one (critical 9.2)
- [CVE-2026-86296](https://insights.sbomify.com/CVE-2026-86296/): D-Link DIR-822A udhcpcd serverpacket.c strcpy stack-based overflow (critical 10.0)
- [CVE-2026-86295](https://insights.sbomify.com/CVE-2026-86295/): D-Link DIR-895L udhcpcd serverpacket.c sendACK command injection (medium 6.9)
- [CVE-2026-86294](https://insights.sbomify.com/CVE-2026-86294/): SourceCodester Simple Traffic Offense System Settings Update Endpoint save-settings.php cross site scripting (medium 5.3)
- [CVE-2026-86293](https://insights.sbomify.com/CVE-2026-86293/): SourceCodester Simple Traffic Offense System Deletion Endpoint delete-user.php missing authentication (medium 6.9)
- [CVE-2026-86292](https://insights.sbomify.com/CVE-2026-86292/): SourceCodester Simple Traffic Offense System User Creation saveuser.php missing authentication (medium 6.9)
- [CVE-2026-86291](https://insights.sbomify.com/CVE-2026-86291/): itsourcecode Sales and Inventory System us_edit1.php sql injection (medium 5.3)
- [CVE-2026-86290](https://insights.sbomify.com/CVE-2026-86290/): SourceCodester Online Voting System ajax.php save_category sql injection (medium 6.9)
- [CVE-2026-8629](https://insights.sbomify.com/CVE-2026-8629/): Crabbox < v0.12.0 Privilege Escalation via Agent Ticket Endpoints (high 8.6)
- [CVE-2026-86289](https://insights.sbomify.com/CVE-2026-86289/): Ollama GGUF Decoder gguf.go readGGUFV1String integer overflow (medium 5.3)
- [CVE-2026-86288](https://insights.sbomify.com/CVE-2026-86288/): ModelCloud GPTQModel Triton dequantization kernel tritonv2.py out-of-bounds (medium 5.3)
- [CVE-2026-86287](https://insights.sbomify.com/CVE-2026-86287/): Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths (high 7.5)
- [CVE-2026-86285](https://insights.sbomify.com/CVE-2026-86285/): BookStack Attachment Edit Endpoint AttachmentController.php getUpdateForm access control (medium 5.3)
- [CVE-2026-86284](https://insights.sbomify.com/CVE-2026-86284/): jaychouchannel Tourism-Management-System CommonController.java getOption information disclosure (medium 6.9)
- [CVE-2026-86283](https://insights.sbomify.com/CVE-2026-86283/): MISP UiBeta Collection View Bypasses Event ACL, Exposing Unauthorized Event Data (high 7.1)
- [CVE-2026-86282](https://insights.sbomify.com/CVE-2026-86282/): jaychouchannel Tourism-Management-System CommonDao CommonController.java sql injection (medium 6.9)
- [CVE-2026-86281](https://insights.sbomify.com/CVE-2026-86281/): SourceCodester Syllabus-Aligned Learning Management & Examination System cross-site request forgery (medium 5.3)
- [CVE-2026-86280](https://insights.sbomify.com/CVE-2026-86280/): SourceCodester Syllabus-Aligned Learning Management & Examination System cict_portal.sql cleartext storage (medium 6.9)
- [CVE-2026-8628](https://insights.sbomify.com/CVE-2026-8628/): EntreDroppers <= 1.1.2 - Reflected Cross-Site Scripting via PHP_SELF Parameter (medium 6.1)
- [CVE-2026-86279](https://insights.sbomify.com/CVE-2026-86279/): SourceCodester Syllabus-Aligned Learning Management & Examination System Login auth_process.php session fixiation (medium 5.3)
- [CVE-2026-86278](https://insights.sbomify.com/CVE-2026-86278/): SourceCodester Syllabus-Aligned Learning Management & Examination System manage_subjects.php cross site scripting (medium 5.3)
- [CVE-2026-86277](https://insights.sbomify.com/CVE-2026-86277/): SourceCodester Syllabus-Aligned Learning Management & Examination System delete_exam.php authorization (medium 6.9)
- [CVE-2026-86276](https://insights.sbomify.com/CVE-2026-86276/): SourceCodester Syllabus-Aligned Learning Management & Examination System db.php hard-coded credentials (medium 6.9)
- [CVE-2026-86275](https://insights.sbomify.com/CVE-2026-86275/): SourceCodester Syllabus-Aligned Learning Management & Examination System auth.php register privileges management (medium 6.9)
- [CVE-2026-86274](https://insights.sbomify.com/CVE-2026-86274/): projeto-siga Authentication Flow ExAutenticacaoController.java ExAutenticacaoController.autenticar authorization (medium 6.9)
- [CVE-2026-86273](https://insights.sbomify.com/CVE-2026-86273/): projeto-siga HTML-to-PDF Endpoint ExUtilController.java DownloadExterno.getUrl server-side request forgery (medium 6.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/299/