# Vulnerabilities published in 2026


- [CVE-2026-86179](https://insights.sbomify.com/CVE-2026-86179/): code-projects Daily Expense Manager Database Backup exp_ak.sql information disclosure (medium 6.9)
- [CVE-2026-86178](https://insights.sbomify.com/CVE-2026-86178/): Pixelfed through 0.12.9 Unauthorized Story Access via API (medium 5.3)
- [CVE-2026-86177](https://insights.sbomify.com/CVE-2026-86177/): Pterodactyl Panel before 1.14.1 Privilege Escalation via Schedule Tasks (high 8.7)
- [CVE-2026-86176](https://insights.sbomify.com/CVE-2026-86176/): NetBox through 4.7.0 Information Disclosure via REST and GraphQL APIs (medium 5.3)
- [CVE-2026-86175](https://insights.sbomify.com/CVE-2026-86175/): NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs (high 7.1)
- [CVE-2026-86174](https://insights.sbomify.com/CVE-2026-86174/): Plane through 1.4.2 Arbitrary Comment Write via Public Deploy Board (medium 5.3)
- [CVE-2026-86173](https://insights.sbomify.com/CVE-2026-86173/): MindsDB through 26.1.0 Unauthenticated SSRF via Web Crawler (high 8.7)
- [CVE-2026-86172](https://insights.sbomify.com/CVE-2026-86172/): DefaultFuction CRM delete.php sql injection (medium 5.3)
- [CVE-2026-86171](https://insights.sbomify.com/CVE-2026-86171/): DefaultFuction CRM delete.php sql injection (medium 5.3)
- [CVE-2026-86170](https://insights.sbomify.com/CVE-2026-86170/): DefaultFuction CRM edit.php sql injection (medium 5.3)
- [CVE-2026-8617](https://insights.sbomify.com/CVE-2026-8617/): Missing authorization in SearchPlus (medium 5.3)
- [CVE-2026-86169](https://insights.sbomify.com/CVE-2026-86169/): Axolotl before 0.19.0 Remote Code Execution via Multipack Patching (high 8.7)
- [CVE-2026-86168](https://insights.sbomify.com/CVE-2026-86168/): code-projects Content Management System login.php sql injection (medium 6.9)
- [CVE-2026-86167](https://insights.sbomify.com/CVE-2026-86167/): Tenda HG10 Boa formgponConf os command injection (critical 9.4)
- [CVE-2026-86166](https://insights.sbomify.com/CVE-2026-86166/): Tenda HG10 Boa Web Server formWanRedirect buffer overflow (high 8.7)
- [CVE-2026-86165](https://insights.sbomify.com/CVE-2026-86165/): Tenda HG10 formURL buffer overflow (critical 9.3)
- [CVE-2026-86164](https://insights.sbomify.com/CVE-2026-86164/): itsourcecode Sales and Inventory System trans_view.php sql injection (medium 5.3)
- [CVE-2026-86163](https://insights.sbomify.com/CVE-2026-86163/): itsourcecode Sales and Inventory System pro_del.php sql injection (medium 5.3)
- [CVE-2026-86162](https://insights.sbomify.com/CVE-2026-86162/): SourceCodester Online Voting System ajax.php login sql injection (medium 6.9)
- [CVE-2026-86161](https://insights.sbomify.com/CVE-2026-86161/): SourceCodester Online Voting System ajax.php delete_category sql injection (medium 6.9)
- [CVE-2026-86160](https://insights.sbomify.com/CVE-2026-86160/): SourceCodester Online Voting System ajax.php delete_voting sql injection (medium 6.9)
- [CVE-2026-8616](https://insights.sbomify.com/CVE-2026-8616/): Missing authorization in Fense Proxy & VPN Blocker (medium 5.3)
- [CVE-2026-86159](https://insights.sbomify.com/CVE-2026-86159/): SourceCodester Online Voting System ajax.php save_user sql injection (medium 6.9)
- [CVE-2026-86158](https://insights.sbomify.com/CVE-2026-86158/): Missing Authentication in the local .NET backend of Progress Telerik Fiddler Everywhere (high 7.7)
- [CVE-2026-86157](https://insights.sbomify.com/CVE-2026-86157/): Exposure of Privileged IPC Functionality in Progress Telerik Fiddler Everywhere (medium 5.6)
- [CVE-2026-86153](https://insights.sbomify.com/CVE-2026-86153/): Tenda CP3 Redirect.cpp SetRedirectEnable privileges management (critical 9.4)
- [CVE-2026-86152](https://insights.sbomify.com/CVE-2026-86152/): Tenda CP3 Kylin AutoAddWifi.cpp ThreadProc os command injection (critical 10.0)
- [CVE-2026-86151](https://insights.sbomify.com/CVE-2026-86151/): Tenda CP3 Network Configuration Management system.c sub_2F77E8 os command injection (critical 9.4)
- [CVE-2026-86150](https://insights.sbomify.com/CVE-2026-86150/): Tenda CP3 hostapd hard-coded credentials (medium 5.1)
- [CVE-2026-8615](https://insights.sbomify.com/CVE-2026-8615/): Missing authorization in ilGhera Reviso Exporter for WooCommerce (medium 4.3)
- [CVE-2026-86149](https://insights.sbomify.com/CVE-2026-86149/): Tenda CP3 NetCheckPing.cpp os command injection (critical 9.4)
- [CVE-2026-86148](https://insights.sbomify.com/CVE-2026-86148/): Tenda CP3 Kylin system.c SystemAsh os command injection (critical 9.4)
- [CVE-2026-86147](https://insights.sbomify.com/CVE-2026-86147/): Apache bRPC: Arbitrary file creation/truncation via /flags and unbounded profiling duration via /pprof (not scored)
- [CVE-2026-86146](https://insights.sbomify.com/CVE-2026-86146/): Apache bRPC: HTTP Request Smuggling and Header Injection via Lenient HTTP/1.1 Header Parsing (not scored)
- [CVE-2026-86145](https://insights.sbomify.com/CVE-2026-86145/): Memory corruption in PCRE2 (high 8.2)
- [CVE-2026-86144](https://insights.sbomify.com/CVE-2026-86144/): XML external entity in libxml2 (medium 5.6)
- [CVE-2026-86143](https://insights.sbomify.com/CVE-2026-86143/): Integer overflow in libxml2 (medium 6.9)
- [CVE-2026-86142](https://insights.sbomify.com/CVE-2026-86142/): Memory corruption in libxml2 (medium 6.9)
- [CVE-2026-86141](https://insights.sbomify.com/CVE-2026-86141/): Null dereference in libxml2 (low 2.9)
- [CVE-2026-86140](https://insights.sbomify.com/CVE-2026-86140/): Memory corruption in libxml2 (high 8.0)
- [CVE-2026-8614](https://insights.sbomify.com/CVE-2026-8614/): Missing authorization in Assistio (medium 4.3)
- [CVE-2026-86139](https://insights.sbomify.com/CVE-2026-86139/): Integer overflow in libxml2 (medium 6.9)
- [CVE-2026-86138](https://insights.sbomify.com/CVE-2026-86138/): Integer overflow in libxml2 (medium 6.9)
- [CVE-2026-86137](https://insights.sbomify.com/CVE-2026-86137/): Memory corruption in libxml2 (low 2.9)
- [CVE-2026-86136](https://insights.sbomify.com/CVE-2026-86136/): Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant A (high 7.1)
- [CVE-2026-86135](https://insights.sbomify.com/CVE-2026-86135/): Dimension CSRF Vulnerability in Database Snapshot Creation Allows Denial of Service (high 7.0)
- [CVE-2026-86134](https://insights.sbomify.com/CVE-2026-86134/): Fireware OS Pre-Authentication NULL Pointer Dereference Allows Remote Denial of Service (high 8.7)
- [CVE-2026-86133](https://insights.sbomify.com/CVE-2026-86133/): Fireware OS Pre-Authentication Integer Underflow in iked Allows Remote Denial of Service (high 8.2)
- [CVE-2026-86132](https://insights.sbomify.com/CVE-2026-86132/): Fireware OS Pre-Authentication Integer Underflow in iked Allows Denial of Service (high 8.2)
- [CVE-2026-86131](https://insights.sbomify.com/CVE-2026-86131/): Fireware OS Code Injection in BOVPN Over TLS Client Allows Remote Code Execution (critical 9.2)
- [CVE-2026-8613](https://insights.sbomify.com/CVE-2026-8613/): Cross-site scripting in aThemes Addons for Elementor (medium 6.4)
- [CVE-2026-86128](https://insights.sbomify.com/CVE-2026-86128/): Fireware OS NULL Pointer Dereference in NetFlow IPv6 Traffic Processing Allows Remote Denial of Service (high 8.2)
- [CVE-2026-86124](https://insights.sbomify.com/CVE-2026-86124/): AutoAgent Unauthenticated Remote Code Execution via the Sandbox TCP Command Server (critical 9.3)
- [CVE-2026-86123](https://insights.sbomify.com/CVE-2026-86123/): SQL Chat Unauthenticated Database-Connection Proxy in the /api/connection Endpoints (critical 9.4)
- [CVE-2026-86122](https://insights.sbomify.com/CVE-2026-86122/): Rowboat through 0.9.1 Server-Side Request Forgery via Custom MCP Server (medium 5.3)
- [CVE-2026-86121](https://insights.sbomify.com/CVE-2026-86121/): Cua computer-server before 0.3.42 Unauthenticated RCE via Desktop Control (critical 9.3)
- [CVE-2026-86120](https://insights.sbomify.com/CVE-2026-86120/): APITable through 1.13.0-beta.1 Fail-Open Authorization in the Fusion API Node Permission Guard (medium 5.3)
- [CVE-2026-8612](https://insights.sbomify.com/CVE-2026-8612/): Deserialization in WWW::Mechanize::Cached (medium 5.3)
- [CVE-2026-86119](https://insights.sbomify.com/CVE-2026-86119/): Webstudio through 0.296.0 SSRF via /cgi proxy routes (critical 9.2)
- [CVE-2026-86118](https://insights.sbomify.com/CVE-2026-86118/): gonic before 0.22.0 Missing Administrator Check on the Subsonic startScan Endpoint (medium 5.3)
- [CVE-2026-86117](https://insights.sbomify.com/CVE-2026-86117/): Coolify through 4.3.17 OAuth Account Takeover via Unverified Email Matching (critical 9.2)
- [CVE-2026-86116](https://insights.sbomify.com/CVE-2026-86116/): Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API (high 7.1)
- [CVE-2026-86115](https://insights.sbomify.com/CVE-2026-86115/): Sim before 0.8.14 Confused Deputy in Tool URL Routing Mints an Internal Token for a User-Supplied /api/ Path (medium 5.3)
- [CVE-2026-86114](https://insights.sbomify.com/CVE-2026-86114/): Arcane before 2.0.0 Missing Administrator Authorization on the Compose Template Mutation Endpoints (high 7.1)
- [CVE-2026-86113](https://insights.sbomify.com/CVE-2026-86113/): Missing authorization in bookwyrm (high 7.1)
- [CVE-2026-86112](https://insights.sbomify.com/CVE-2026-86112/): BookWyrm through 0.9.1 Missing Authorization on the Favorite and Unfavorite Endpoints (medium 5.3)
- [CVE-2026-86111](https://insights.sbomify.com/CVE-2026-86111/): BookWyrm through 0.9.1 Insecure Direct Object Reference in EditStatus Exposes Followers-Only and Direct Statuses (high 7.1)
- [CVE-2026-8611](https://insights.sbomify.com/CVE-2026-8611/): Missing authorization in Klamra Paycal for Aspaclaria (medium 4.3)
- [CVE-2026-86109](https://insights.sbomify.com/CVE-2026-86109/): Security Advisory 0182 (high 7.5)
- [CVE-2026-86108](https://insights.sbomify.com/CVE-2026-86108/): Security Advisory 0181 (high 7.5)
- [CVE-2026-86107](https://insights.sbomify.com/CVE-2026-86107/): Security Advisory 0180 (high 8.2)
- [CVE-2026-86106](https://insights.sbomify.com/CVE-2026-86106/): Security Advisory 0179 (high 8.7)
- [CVE-2026-86105](https://insights.sbomify.com/CVE-2026-86105/): Fireware OS Improper Authorization in Access Portal Reverse Proxy (medium 5.3)
- [CVE-2026-86104](https://insights.sbomify.com/CVE-2026-86104/): Fireware OS Resource Exhaustion in Login Process Allows Denial of Service (high 8.7)
- [CVE-2026-86102](https://insights.sbomify.com/CVE-2026-86102/): WatchGuard AP Command Injection in Internal Management API Allows Command Execution (critical 9.3)
- [CVE-2026-86101](https://insights.sbomify.com/CVE-2026-86101/): Fireware OS Authorization Bypass in SAML Login Allows Unauthorized SSLVPN Access (high 7.2)
- [CVE-2026-86100](https://insights.sbomify.com/CVE-2026-86100/): Camaleon CMS 2.7.5 through 2.9.1 SSRF via HTTP Redirect in Upload from URL (medium 5.3)
- [CVE-2026-8610](https://insights.sbomify.com/CVE-2026-8610/): Missing authorization in TypeSquare Webfonts for ConoHa (medium 4.3)
- [CVE-2026-86099](https://insights.sbomify.com/CVE-2026-86099/): Chainlit through 2.12.0 Path Traversal via socket.io sessionId (high 8.8)
- [CVE-2026-86098](https://insights.sbomify.com/CVE-2026-86098/): ntop nDPI before 6.0 Heap Buffer Overflow via ndpi_json_string_escape (high 8.3)
- [CVE-2026-86097](https://insights.sbomify.com/CVE-2026-86097/): PX4 Autopilot through 1.17.0 Null Pointer Dereference via param select (high 7.1)
- [CVE-2026-86096](https://insights.sbomify.com/CVE-2026-86096/): PX4 Autopilot through 1.17.0 Use-After-Free via Temperature Calibration Task Startup (medium 6.0)
- [CVE-2026-86095](https://insights.sbomify.com/CVE-2026-86095/): Unidata netcdf-c through 4.10.1 Out-of-bounds Write via Oversized HDF5 Attribute Name (high 8.5)
- [CVE-2026-86093](https://insights.sbomify.com/CVE-2026-86093/): Memory corruption in Db2 (high 7.5)
- [CVE-2026-86091](https://insights.sbomify.com/CVE-2026-86091/): ntopng before 6.7.260717 Missing Authorization on the Host Pool Bulk Delete Handler (high 7.1)
- [CVE-2026-86090](https://insights.sbomify.com/CVE-2026-86090/): ntopng before 6.7.260717 Missing Authorization on the Notification Endpoint and Recipient Delete Handlers (high 7.1)
- [CVE-2026-8609](https://insights.sbomify.com/CVE-2026-8609/): Pre-authentication denial of service via the OAuth login route (medium 5.3)
- [CVE-2026-86089](https://insights.sbomify.com/CVE-2026-86089/): Apache NiFi: Missing Process Group Authorization for Connector Migration (low 2.3)
- [CVE-2026-86087](https://insights.sbomify.com/CVE-2026-86087/): IBM® Db2® could allow an authenticated user to send a specially crafted request to write arbitrary files on the system (medium 4.3)
- [CVE-2026-86085](https://insights.sbomify.com/CVE-2026-86085/): n8n: Cross-Tenant Project-Member PII Disclosure via Missing Per-Project Scope Check on Role Assignment Endpoints (medium 5.1)
- [CVE-2026-86084](https://insights.sbomify.com/CVE-2026-86084/): n8n: Disabled OIDC SSO Endpoints Remain Active and Issue Valid Sessions (medium 6.0)
- [CVE-2026-86083](https://insights.sbomify.com/CVE-2026-86083/): n8n: Expression Sandbox Escape via Shared Builtin Tampering and Code-Printer Injection Leads to Code Execution (high 7.7)
- [CVE-2026-86082](https://insights.sbomify.com/CVE-2026-86082/): n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node (high 7.1)
- [CVE-2026-86081](https://insights.sbomify.com/CVE-2026-86081/): n8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern Match via a Git Node Clone Path (high 7.1)
- [CVE-2026-86080](https://insights.sbomify.com/CVE-2026-86080/): n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Open (medium 6.3)
- [CVE-2026-8608](https://insights.sbomify.com/CVE-2026-8608/): Business logic in Event Monster – Event Manager, Ticket Booking & Registration (medium 5.3)
- [CVE-2026-86079](https://insights.sbomify.com/CVE-2026-86079/): n8n: Path Injection in Elasticsearch and ElasticSecurity Nodes via Unencoded Identifiers (medium 6.3)
- [CVE-2026-86078](https://insights.sbomify.com/CVE-2026-86078/): n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service (medium 6.0)
- [CVE-2026-86077](https://insights.sbomify.com/CVE-2026-86077/): n8n: Anonymous Approval-Gate Bypass via Reused resumeToken over the Chat WebSocket (medium 6.3)
- [CVE-2026-86076](https://insights.sbomify.com/CVE-2026-86076/): n8n: Expression Sandbox Escape in Editor-UI Enables Stored Cross-User JavaScript Execution (high 8.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/301/