# Vulnerabilities published in 2026


- [CVE-2026-86272](https://insights.sbomify.com/CVE-2026-86272/): Beijing Meite Software Technology U+Smart Enjoyment WebSite UploadFormImg.ashx unrestricted upload (medium 6.9)
- [CVE-2026-86271](https://insights.sbomify.com/CVE-2026-86271/): FluentCMS PermissionManager.cs GetAccessible authorization (medium 5.1)
- [CVE-2026-86270](https://insights.sbomify.com/CVE-2026-86270/): itsourcecode Sales and Inventory System settings_edit.php sql injection (medium 5.3)
- [CVE-2026-8627](https://insights.sbomify.com/CVE-2026-8627/): Correct Prices <= 1.0 - Reflected Cross-Site Scripting via PHP_SELF Parameter (medium 6.1)
- [CVE-2026-86269](https://insights.sbomify.com/CVE-2026-86269/): itsourcecode Sales and Inventory System emp_edit1.php sql injection (medium 5.3)
- [CVE-2026-86268](https://insights.sbomify.com/CVE-2026-86268/): itsourcecode School Management System User_Login.php sql injection (medium 6.9)
- [CVE-2026-86267](https://insights.sbomify.com/CVE-2026-86267/): itsourcecode Information System Society Membership System check_student.php sql injection (medium 5.3)
- [CVE-2026-86265](https://insights.sbomify.com/CVE-2026-86265/): itsourcecode Sales and Inventory System us_transac.php sql injection (medium 5.3)
- [CVE-2026-86264](https://insights.sbomify.com/CVE-2026-86264/): sfturing ssm_pro Order Endpoint OrderController.java cross site scripting (medium 5.3)
- [CVE-2026-86263](https://insights.sbomify.com/CVE-2026-86263/): sfturing hosp_order Order Cancellation OrderController.java orderRecordsService.cancelOrder authorization (medium 6.9)
- [CVE-2026-86262](https://insights.sbomify.com/CVE-2026-86262/): sfturing hosp_order Order OrderController.java updateOrderdiseaseInfo authorization (medium 6.9)
- [CVE-2026-86261](https://insights.sbomify.com/CVE-2026-86261/): sfturing hosp_order Order Controller OrderController.java authorization (medium 6.9)
- [CVE-2026-86260](https://insights.sbomify.com/CVE-2026-86260/): sfturing hosp_order Password Recovery CommonUserController.java modifyPassWord unverified password change (medium 6.9)
- [CVE-2026-8626](https://insights.sbomify.com/CVE-2026-8626/): SponsorMe <= 0.5.2 - Reflected Cross-Site Scripting via PHP_SELF Parameter (medium 6.1)
- [CVE-2026-86259](https://insights.sbomify.com/CVE-2026-86259/): OpenMAIC before 1.0.1 SSRF via Environment-Gated URL Validation (critical 9.0)
- [CVE-2026-86258](https://insights.sbomify.com/CVE-2026-86258/): nbviewer through 1.0.1 Path Traversal via LocalFileHandler (high 8.2)
- [CVE-2026-86257](https://insights.sbomify.com/CVE-2026-86257/): wger before 2.6 CSV Formula Injection via member export (medium 4.8)
- [CVE-2026-86256](https://insights.sbomify.com/CVE-2026-86256/): wger before 2.6 Open Redirect via trainer-login next parameter (medium 5.1)
- [CVE-2026-86255](https://insights.sbomify.com/CVE-2026-86255/): wger before 2.5 Uncontrolled Resource Consumption via date_sequence (high 7.1)
- [CVE-2026-86254](https://insights.sbomify.com/CVE-2026-86254/): wger Incomplete Authorization Fix Cross-Tenant Account Deletion (medium 6.1)
- [CVE-2026-86253](https://insights.sbomify.com/CVE-2026-86253/): h3 before 1.15.6 Path Traversal via Percent-Encoded Dot Segments (high 8.2)
- [CVE-2026-86252](https://insights.sbomify.com/CVE-2026-86252/): h3 before 1.15.9 SSE Event Injection via Carriage Return (medium 6.9)
- [CVE-2026-86251](https://insights.sbomify.com/CVE-2026-86251/): h3 before 1.15.9 Path Traversal via Double Decoding (high 8.2)
- [CVE-2026-86250](https://insights.sbomify.com/CVE-2026-86250/): h3 before 2.0.1-rc.18 Denial of Service via Unbounded Chunked Cookie (high 8.7)
- [CVE-2026-8625](https://insights.sbomify.com/CVE-2026-8625/): Dear Flipbook <= 2.4.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via '.df-element' Element Inner HTML (medium 6.4)
- [CVE-2026-86249](https://insights.sbomify.com/CVE-2026-86249/): Apache bRPC: Authentication bypass when a server sets ServerOptions.internal_port and ServerOptions.auth (not scored)
- [CVE-2026-86248](https://insights.sbomify.com/CVE-2026-86248/): Auth bypass in Apache Tomcat (critical 9.8)
- [CVE-2026-86247](https://insights.sbomify.com/CVE-2026-86247/): Apache Tomcat Native: Client certificate requirements can be down-graded (high 7.4)
- [CVE-2026-86246](https://insights.sbomify.com/CVE-2026-86246/): Apache Tomcat Native: Insecure OpenSSL options enabled (critical 9.1)
- [CVE-2026-86245](https://insights.sbomify.com/CVE-2026-86245/): itsourcecode Sales and Inventory System sup_transac.php sql injection (medium 5.3)
- [CVE-2026-86244](https://insights.sbomify.com/CVE-2026-86244/): FastAdmin User Controller User.php login cross site scripting (medium 5.3)
- [CVE-2026-86243](https://insights.sbomify.com/CVE-2026-86243/): Apache Tomcat Native: DoS via TLS handshake (high 7.5)
- [CVE-2026-86242](https://insights.sbomify.com/CVE-2026-86242/): Unauthenticated RCE via Custom Plugin HTTP Path on Dynamically Linked Builds (high 8.1)
- [CVE-2026-86241](https://insights.sbomify.com/CVE-2026-86241/): liufee FeehiCMS Cookie Validation main-local.php hard-coded key (medium 5.3)
- [CVE-2026-86240](https://insights.sbomify.com/CVE-2026-86240/): liufee FeehiCMS UEditor Uploader.php catchImage server-side request forgery (medium 5.1)
- [CVE-2026-8624](https://insights.sbomify.com/CVE-2026-8624/): LJ comments import: reloaded <= 0.97.1 - Reflected Cross-Site Scripting via PHP_SELF Parameter (medium 6.1)
- [CVE-2026-86239](https://insights.sbomify.com/CVE-2026-86239/): liufee FeehiCMS UEditor Widget UeditorAction.php init unrestricted upload (medium 6.9)
- [CVE-2026-86238](https://insights.sbomify.com/CVE-2026-86238/): projectworlds Online Examination System Feedback Form feedback.php cross site scripting (medium 5.3)
- [CVE-2026-86237](https://insights.sbomify.com/CVE-2026-86237/): openagents-org openagents http.py test_default_model server-side request forgery (medium 6.9)
- [CVE-2026-86236](https://insights.sbomify.com/CVE-2026-86236/): itsourcecode Sales and Inventory System pro_transac.php add sql injection (medium 5.3)
- [CVE-2026-86235](https://insights.sbomify.com/CVE-2026-86235/): itsourcecode Sales and Inventory System pos_transac.php add sql injection (medium 5.3)
- [CVE-2026-86234](https://insights.sbomify.com/CVE-2026-86234/): itsourcecode Sales and Inventory System cust_transac.php add sql injection (medium 5.3)
- [CVE-2026-86233](https://insights.sbomify.com/CVE-2026-86233/): itsourcecode Sales and Inventory System us_del.php sql injection (medium 5.3)
- [CVE-2026-86232](https://insights.sbomify.com/CVE-2026-86232/): itsourcecode Sales and Inventory System sup_del.php sql injection (medium 5.3)
- [CVE-2026-86231](https://insights.sbomify.com/CVE-2026-86231/): mwiede jsch KnownHosts.java getRevokedKeys improper check for certificate revocation (medium 6.3)
- [CVE-2026-8623](https://insights.sbomify.com/CVE-2026-8623/): Dear Flipbook <= 2.4.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via '.dvcss' Element Class Attribute (medium 6.4)
- [CVE-2026-86228](https://insights.sbomify.com/CVE-2026-86228/): JeecgBoot AiragModelController.java exportXls access control (medium 5.3)
- [CVE-2026-86227](https://insights.sbomify.com/CVE-2026-86227/): valkey-io valkey kvstore.c kvstoreGetHashtable out-of-bounds (low 2.3)
- [CVE-2026-86226](https://insights.sbomify.com/CVE-2026-86226/): Projectwolds Online Attendance System profile.php cross site scripting (medium 5.1)
- [CVE-2026-86225](https://insights.sbomify.com/CVE-2026-86225/): SourceCodester Class and Exam Timetabling System modal_add_room.php mysqli_query sql injection (medium 6.9)
- [CVE-2026-86224](https://insights.sbomify.com/CVE-2026-86224/): SourceCodester Class and Exam Timetabling System modal_add_product.php mysqli_query sql injection (medium 6.9)
- [CVE-2026-86223](https://insights.sbomify.com/CVE-2026-86223/): SourceCodester Class and Exam Timetabling System modal_add_coursea.php mysqli_query sql injection (medium 6.9)
- [CVE-2026-86222](https://insights.sbomify.com/CVE-2026-86222/): SourceCodester Class and Exam Timetabling System modal_add_course2.php mysqli_query sql injection (medium 6.9)
- [CVE-2026-86221](https://insights.sbomify.com/CVE-2026-86221/): SourceCodester Class and Exam Timetabling System modal_add_course1.php mysqli_query sql injection (medium 6.9)
- [CVE-2026-86220](https://insights.sbomify.com/CVE-2026-86220/): SourceCodester Class and Exam Timetabling System modal_add_course.php mysqli_query sql injection (medium 6.9)
- [CVE-2026-8622](https://insights.sbomify.com/CVE-2026-8622/): Image Sizes on Demand <= 1.3 - Reflected Cross-Site Scripting via PHP_SELF Server Variable (medium 6.1)
- [CVE-2026-86219](https://insights.sbomify.com/CVE-2026-86219/): Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step. (critical 9.8)
- [CVE-2026-86218](https://insights.sbomify.com/CVE-2026-86218/): N-able N-central Static Code Injection (critical 10.0, exploited in the wild)
- [CVE-2026-86217](https://insights.sbomify.com/CVE-2026-86217/): code-projects Hotel and Tourism Reservation in PHP Database Backup hotel_db%20(1).sql information disclosure (medium 6.9)
- [CVE-2026-86216](https://insights.sbomify.com/CVE-2026-86216/): code-projects Hotel and Tourism Reservation in PHP details.php cross site scripting (medium 5.3)
- [CVE-2026-86215](https://insights.sbomify.com/CVE-2026-86215/): Mstfakts College-Management-System Logout server.php session expiration (medium 5.3)
- [CVE-2026-86214](https://insights.sbomify.com/CVE-2026-86214/): Mstfakts College-Management-System login.php improper authentication (medium 6.9)
- [CVE-2026-86213](https://insights.sbomify.com/CVE-2026-86213/): Mstfakts College-Management-System Search university.php mysqli_query sql injection (medium 6.9)
- [CVE-2026-86212](https://insights.sbomify.com/CVE-2026-86212/): Open5GS AMF/MME improper authorization (medium 5.3)
- [CVE-2026-86211](https://insights.sbomify.com/CVE-2026-86211/): rabindralamsal inventory-management-system Login index.php sql injection (medium 6.9)
- [CVE-2026-86210](https://insights.sbomify.com/CVE-2026-86210/): SourceCodester Class and Exam Timetabling System delete_user_account.php sql injection (medium 6.9)
- [CVE-2026-8621](https://insights.sbomify.com/CVE-2026-8621/): Crabbox < v0.12.0 Authentication Bypass via Header Spoofing (high 8.7)
- [CVE-2026-86209](https://insights.sbomify.com/CVE-2026-86209/): SourceCodester Class and Exam Timetabling System delete_user.php sql injection (medium 6.9)
- [CVE-2026-86208](https://insights.sbomify.com/CVE-2026-86208/): SourceCodester Class and Exam Timetabling System delete_teacher.php sql injection (medium 6.9)
- [CVE-2026-86207](https://insights.sbomify.com/CVE-2026-86207/): Authentication bypass leads to unauthorised access to N-central (high 7.7)
- [CVE-2026-86206](https://insights.sbomify.com/CVE-2026-86206/): Access control filter bypass allows unauthorised access to APIs (medium 6.9)
- [CVE-2026-86205](https://insights.sbomify.com/CVE-2026-86205/): h3 before 2.0.1-rc.18 Open Redirect via redirectBack() (medium 5.3)
- [CVE-2026-86204](https://insights.sbomify.com/CVE-2026-86204/): PocketMine-MP before 5.39.2 Denial of Service via ModalFormResponsePacket (high 7.1)
- [CVE-2026-86203](https://insights.sbomify.com/CVE-2026-86203/): PocketMine-MP before 5.39.2 Item Duplication via Despawn State (medium 6.3)
- [CVE-2026-86202](https://insights.sbomify.com/CVE-2026-86202/): PocketMine-MP before 5.39.2 Network Amplification via ActorEventPacket (medium 5.3)
- [CVE-2026-86201](https://insights.sbomify.com/CVE-2026-86201/): PocketMine-MP before 5.41.1 LogDoS via LoginPacket clientData (high 8.7)
- [CVE-2026-86200](https://insights.sbomify.com/CVE-2026-86200/): PocketMine-MP before 5.42.1 LogDoS via LoginPacket clientData JWT (medium 6.9)
- [CVE-2026-8620](https://insights.sbomify.com/CVE-2026-8620/): Other in Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty (high 7.5)
- [CVE-2026-86199](https://insights.sbomify.com/CVE-2026-86199/): PocketMine-MP before 5.43.1 Denial of Service via unauthenticated login (high 8.7)
- [CVE-2026-86198](https://insights.sbomify.com/CVE-2026-86198/): PocketMine-MP before 5.44.2 Denial of Service via ResourcePackClientResponsePacket (low 2.3)
- [CVE-2026-86197](https://insights.sbomify.com/CVE-2026-86197/): Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox (medium 5.1)
- [CVE-2026-86196](https://insights.sbomify.com/CVE-2026-86196/): Grav API Plugin before 1.0.20 Authentication Bypass via Host Header (high 8.7)
- [CVE-2026-86195](https://insights.sbomify.com/CVE-2026-86195/): grav-plugin-api 1.0.0 through 1.0.19 Privilege Escalation via Dot-Keyed Super Flag (high 8.7)
- [CVE-2026-86194](https://insights.sbomify.com/CVE-2026-86194/): Grav Form Plugin before 9.1.22 Cross-Page Form Execution (medium 6.9)
- [CVE-2026-86193](https://insights.sbomify.com/CVE-2026-86193/): Grav API Plugin Authentication Bypass via Group-Inherited Super (high 8.7)
- [CVE-2026-86192](https://insights.sbomify.com/CVE-2026-86192/): SiYuan before v3.8.2 Information Disclosure via Attribute-View (high 7.1)
- [CVE-2026-86191](https://insights.sbomify.com/CVE-2026-86191/): SiYuan before v3.8.2 Private Attribute View Key Enumeration (medium 5.3)
- [CVE-2026-86190](https://insights.sbomify.com/CVE-2026-86190/): WWBN AVideo Broken Access Control via videoViewsInfo hash Parameter (critical 9.3)
- [CVE-2026-8619](https://insights.sbomify.com/CVE-2026-8619/): Null dereference in Archer MR600 v2 (high 7.1)
- [CVE-2026-86189](https://insights.sbomify.com/CVE-2026-86189/): WWBN AVideo Unauthenticated Path Traversal via notify.ffmpeg.json.php (critical 9.3)
- [CVE-2026-86188](https://insights.sbomify.com/CVE-2026-86188/): AVideo YPTSocket Plugin Unauthenticated Cross-Site Scripting (medium 6.9)
- [CVE-2026-86187](https://insights.sbomify.com/CVE-2026-86187/): WWBN AVideo Weak PRNG Password Generation via External Login (high 7.4)
- [CVE-2026-86186](https://insights.sbomify.com/CVE-2026-86186/): AVideo API Rate Limit Bypass via Bot User-Agent Header (medium 6.3)
- [CVE-2026-86185](https://insights.sbomify.com/CVE-2026-86185/): Bilibili Desktop through 1.18.0 Remote Code Execution via TLS Verification Bypass (high 8.6)
- [CVE-2026-86184](https://insights.sbomify.com/CVE-2026-86184/): Lara Dashboard before 1.3.0 Missing Authentication in screenshot-login Route (critical 9.3)
- [CVE-2026-86183](https://insights.sbomify.com/CVE-2026-86183/): diem-project diem dmWidget BasedmWidgetActions.class.php authorization (medium 6.9)
- [CVE-2026-86182](https://insights.sbomify.com/CVE-2026-86182/): diem-project diem dmConsole actions.class.php executeCommand cross-site request forgery (medium 5.3)
- [CVE-2026-86181](https://insights.sbomify.com/CVE-2026-86181/): code-projects Task Management System User Profile Update UpdateUserProfile.php cross site scripting (medium 5.1)
- [CVE-2026-86180](https://insights.sbomify.com/CVE-2026-86180/): code-projects Task Management System In PHP Login index.php sql injection (medium 6.9)
- [CVE-2026-8618](https://insights.sbomify.com/CVE-2026-8618/): Pre-Authentication Stack-based Buffer Overflow Remote Code Execution in TDDPv2 Subtype 0x91 on Deco M9 Plus (high 7.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/300/