# Vulnerabilities published in 2026


- [CVE-2026-82751](https://insights.sbomify.com/CVE-2026-82751/): Unbounded key authorization in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors access-key provisioning (high 8.3)
- [CVE-2026-82750](https://insights.sbomify.com/CVE-2026-82750/): Business logic in mpp (high 8.3)
- [CVE-2026-8275](https://insights.sbomify.com/CVE-2026-8275/): bettercap zerogod IPP Service zerogod_ipp_primitives.go ippReadChunkedBody integer coercion (medium 6.3)
- [CVE-2026-82749](https://insights.sbomify.com/CVE-2026-82749/): Missing authorization in ash (medium 5.9)
- [CVE-2026-82748](https://insights.sbomify.com/CVE-2026-82748/): Ash.Actions.Aggregate authorizes an aggregate under one action but computes it under another (low 2.1)
- [CVE-2026-82747](https://insights.sbomify.com/CVE-2026-82747/): Ash.Policy.Authorizer returns records denied by a runtime read policy to any actor (medium 5.9)
- [CVE-2026-82746](https://insights.sbomify.com/CVE-2026-82746/): Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records (medium 5.9)
- [CVE-2026-82745](https://insights.sbomify.com/CVE-2026-82745/): ETS and Mnesia data layers overwrite an existing record on create instead of enforcing primary-key uniqueness (medium 5.9)
- [CVE-2026-82744](https://insights.sbomify.com/CVE-2026-82744/): Ash.Reactor change step fails open, skipping a change when its where guard raises (low 2.1)
- [CVE-2026-82743](https://insights.sbomify.com/CVE-2026-82743/): Ash.Actions.Read.AsyncLimiter busy-spins a scheduler while awaiting slow async reads (low 2.1)
- [CVE-2026-82742](https://insights.sbomify.com/CVE-2026-82742/): Ash.Filter.Runtime materializes a combinatorial cross-product over to-many relationships, exhausting memory (medium 5.9)
- [CVE-2026-82741](https://insights.sbomify.com/CVE-2026-82741/): Ash.Type.Union with :map_with_tag does not force the tag on dump, enabling tag confusion (low 2.1)
- [CVE-2026-82740](https://insights.sbomify.com/CVE-2026-82740/): Ash.Type ignores outer array constraints on nested {:array, {:array, type}} inputs (low 2.1)
- [CVE-2026-8274](https://insights.sbomify.com/CVE-2026-8274/): npitre cramfs-tools Directory cramfsck.c do_directory path traversal (medium 4.8)
- [CVE-2026-82739](https://insights.sbomify.com/CVE-2026-82739/): Ash.Resource.Validation.Confirm leaks a confirmed field's stored value in the atomic mismatch error (low 2.1)
- [CVE-2026-82738](https://insights.sbomify.com/CVE-2026-82738/): Ash.Type.UUIDv7 accepts non-v7 UUIDs that then fail to load, causing persistent denial of service (medium 5.9)
- [CVE-2026-82737](https://insights.sbomify.com/CVE-2026-82737/): Ash.Vector wraps the 16-bit dimension header for vectors over 65,535 elements, corrupting data and crashing reads (medium 5.9)
- [CVE-2026-82736](https://insights.sbomify.com/CVE-2026-82736/): Ash.Type.CiString validates length and match constraints before case folding, allowing constraint bypass (low 2.1)
- [CVE-2026-82735](https://insights.sbomify.com/CVE-2026-82735/): Match regex runs on over-length input in Ash.Type.String, enabling regex denial of service (medium 5.9)
- [CVE-2026-82734](https://insights.sbomify.com/CVE-2026-82734/): Non-finite Infinity/NaN decimal values bypass bounds constraints in Ash.Type.Decimal (low 2.1)
- [CVE-2026-82733](https://insights.sbomify.com/CVE-2026-82733/): Route handler return value echoed into AshTypescript error response (medium 6.3)
- [CVE-2026-82732](https://insights.sbomify.com/CVE-2026-82732/): Declared argument constraints not enforced on AshTypescript typed controller routes (medium 6.3)
- [CVE-2026-82731](https://insights.sbomify.com/CVE-2026-82731/): Unescaped path parameters in AshTypescript generated TypeScript client allow request redirection (low 2.3)
- [CVE-2026-82730](https://insights.sbomify.com/CVE-2026-82730/): Authorization-redacted field values disclosed through AshTypescript result normalization (high 8.2)
- [CVE-2026-8273](https://insights.sbomify.com/CVE-2026-8273/): D-Link DNS-320 system_mgr.cgi cgi_merge_user os command injection (medium 5.1)
- [CVE-2026-82729](https://insights.sbomify.com/CVE-2026-82729/): Quadratic chunk-size parsing in Mint.HTTP1.Parse allows CPU-exhaustion DoS (medium 6.3)
- [CVE-2026-82728](https://insights.sbomify.com/CVE-2026-82728/): Unbounded HTTP/1 status-line and chunk-extension buffering in Mint causes memory-exhaustion DoS (high 8.2)
- [CVE-2026-82727](https://insights.sbomify.com/CVE-2026-82727/): AshPhoenix Form.Auto leaks submitted params in an unknown _union_type error message (low 2.3)
- [CVE-2026-82726](https://insights.sbomify.com/CVE-2026-82726/): AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant (medium 6.3)
- [CVE-2026-82725](https://insights.sbomify.com/CVE-2026-82725/): AshPhoenix FilterForm allows filtering across non-public relationships, disclosing private related data (low 2.3)
- [CVE-2026-82724](https://insights.sbomify.com/CVE-2026-82724/): Broken access control in AshPhoenix SubdomainHook via a nil tenant in handle_subdomain (high 7.6)
- [CVE-2026-82723](https://insights.sbomify.com/CVE-2026-82723/): Actor record with password digest stored in AshAuthentication audit log entries (low 1.8)
- [CVE-2026-82722](https://insights.sbomify.com/CVE-2026-82722/): AshAdmin LiveView events intern atoms from client input, exhausting the atom table (node DoS) (high 8.3)
- [CVE-2026-82720](https://insights.sbomify.com/CVE-2026-82720/): Use-after-free in DoH stream cleanup code path (medium 5.9)
- [CVE-2026-8272](https://insights.sbomify.com/CVE-2026-8272/): D-Link DNS-320 webfile_mgr.cgi chown os command injection (medium 5.1)
- [CVE-2026-82717](https://insights.sbomify.com/CVE-2026-82717/): CNAME synthesis could lead to heap corruption (high 8.4)
- [CVE-2026-82716](https://insights.sbomify.com/CVE-2026-82716/): Botslab G980H Dashcams Insertion of Sensitive Information into Log File (medium 5.1)
- [CVE-2026-82715](https://insights.sbomify.com/CVE-2026-82715/): Other in Hitachi Disk Array Driver for AIX (high 7.9)
- [CVE-2026-82712](https://insights.sbomify.com/CVE-2026-82712/): Tycon Systems TPDIN-Monitor-WEB3 Cross-Site Request Forgery (high 8.6)
- [CVE-2026-82710](https://insights.sbomify.com/CVE-2026-82710/): Terminal escape sequence injection in mix usage_rules.search_docs via package documentation metadata (low 2.3)
- [CVE-2026-8271](https://insights.sbomify.com/CVE-2026-8271/): D-Link DNS-320 network_mgr.cgi cgi_upnp_edit os command injection (medium 5.1)
- [CVE-2026-82708](https://insights.sbomify.com/CVE-2026-82708/): Botslab G980H Dashcams Improper Limitation of a Pathname to a Restricted Directory (high 7.1)
- [CVE-2026-82703](https://insights.sbomify.com/CVE-2026-82703/): Edimax BR-6214K asp_setPing Endpoint ping.asp system os command injection (medium 5.1)
- [CVE-2026-82702](https://insights.sbomify.com/CVE-2026-82702/): Edimax BR-6214K asp_WlanMP Endpoint wlanMP.asp system os command injection (medium 5.1)
- [CVE-2026-82701](https://insights.sbomify.com/CVE-2026-82701/): code-projects Online Shopping System Search Functionality action.php sql injection (medium 6.9)
- [CVE-2026-82700](https://insights.sbomify.com/CVE-2026-82700/): code-projects Online Shopping System Newsletter Subscription offersmail.php cross site scripting (medium 5.3)
- [CVE-2026-8270](https://insights.sbomify.com/CVE-2026-8270/): Open5GS SMF ogs_nas_parse_qos_rules denial of service (medium 5.3)
- [CVE-2026-82699](https://insights.sbomify.com/CVE-2026-82699/): sambitraj Student Management System Password aca.sql cleartext storage (medium 5.1)
- [CVE-2026-82698](https://insights.sbomify.com/CVE-2026-82698/): sambitraj Student-Management-System aca.sql default password (medium 6.9)
- [CVE-2026-82697](https://insights.sbomify.com/CVE-2026-82697/): sambitraj Student-Management-System session_start cookie httponly flag (medium 6.3)
- [CVE-2026-82696](https://insights.sbomify.com/CVE-2026-82696/): itsourcecode Sales and Inventory System inv_searchfrm.php sql injection (medium 5.3)
- [CVE-2026-82695](https://insights.sbomify.com/CVE-2026-82695/): Tenda AC18 Telnet telnet missing authentication (critical 10.0)
- [CVE-2026-82694](https://insights.sbomify.com/CVE-2026-82694/): Tenda AC1206 Web UI ate R7WebsSecurityHandler missing authentication (critical 10.0)
- [CVE-2026-82693](https://insights.sbomify.com/CVE-2026-82693/): Tenda AC1206 Web UI telnet TendaTelnet missing authentication (critical 10.0)
- [CVE-2026-82692](https://insights.sbomify.com/CVE-2026-82692/): D-Link DNS-340L/DNS-345 iscsi_mgr.cgi os command injection (critical 9.4)
- [CVE-2026-82691](https://insights.sbomify.com/CVE-2026-82691/): D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 CGI usb_device.cgi os command injection (critical 9.4)
- [CVE-2026-82690](https://insights.sbomify.com/CVE-2026-82690/): D-Link DNS-327L/DNS-340L ve_mgr.cgi os command injection (critical 9.4)
- [CVE-2026-8269](https://insights.sbomify.com/CVE-2026-8269/): Open5GS SMF smf_nsmf_handle_create_sm_context denial of service (medium 5.3)
- [CVE-2026-82689](https://insights.sbomify.com/CVE-2026-82689/): D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 ISO Image isomount_mgr.cgi os command injection (critical 9.4)
- [CVE-2026-82688](https://insights.sbomify.com/CVE-2026-82688/): D-Link DNS-340L/DNS-345 Virtual Volume virtual_vol.cgi os command injection (critical 9.4)
- [CVE-2026-82685](https://insights.sbomify.com/CVE-2026-82685/): Confirmation token accepted on any record in AshAuthentication (high 7.6)
- [CVE-2026-82684](https://insights.sbomify.com/CVE-2026-82684/): Tycon Systems TPDIN-Monitor-WEB3 Missing Authorization (high 8.6)
- [CVE-2026-82681](https://insights.sbomify.com/CVE-2026-82681/): Query-parameter injection in AshAdmin row-action links via unencoded string primary keys (low 2.0)
- [CVE-2026-82680](https://insights.sbomify.com/CVE-2026-82680/): D-Link DSM-G600 Multipart load_file.cgi out-of-bounds write (high 8.7)
- [CVE-2026-8268](https://insights.sbomify.com/CVE-2026-8268/): Open5GS SMF OpenAPI_list_create denial of service (medium 5.3)
- [CVE-2026-82679](https://insights.sbomify.com/CVE-2026-82679/): diem-project diem Widget Editor dmWidgetContentBaseMediaForm.php unrestricted upload (medium 5.3)
- [CVE-2026-82678](https://insights.sbomify.com/CVE-2026-82678/): diem-project diem Administrative Console actions.class.php executeCommand os command injection (medium 5.1)
- [CVE-2026-82677](https://insights.sbomify.com/CVE-2026-82677/): valkey-io valkey Module Timer module.c moduleTimerHandler double free (medium 4.8)
- [CVE-2026-82673](https://insights.sbomify.com/CVE-2026-82673/): Path traversal in AshAdmin file uploads via unsanitized client filename (high 8.3)
- [CVE-2026-82672](https://insights.sbomify.com/CVE-2026-82672/): Other in mint (medium 6.3)
- [CVE-2026-82671](https://insights.sbomify.com/CVE-2026-82671/): IObit Unlocker IRP_MJ_DEVICE_CONTROL IObitUnlocker.sys ZwTerminateProcess privileges management (medium 4.6)
- [CVE-2026-82670](https://insights.sbomify.com/CVE-2026-82670/): IObit Uninstaller IOCTL IUForceDelete.sys IRP_MJ_DEVICE_CONTROL privileges management (medium 4.8)
- [CVE-2026-8267](https://insights.sbomify.com/CVE-2026-8267/): Open5GS SMF smf_nsmf_handle_created_data_in_vsmf denial of service (medium 5.3)
- [CVE-2026-82669](https://insights.sbomify.com/CVE-2026-82669/): klaussilveira GitList XML Parsing CommandLine.php SimpleXMLElement denial of service (medium 6.9)
- [CVE-2026-82668](https://insights.sbomify.com/CVE-2026-82668/): klaussilveira GitList Git Command Line CommandLine.php getDefaultBranch os command injection (medium 6.9)
- [CVE-2026-82667](https://insights.sbomify.com/CVE-2026-82667/): Server-side request forgery in GEOFlow (medium 5.1)
- [CVE-2026-82666](https://insights.sbomify.com/CVE-2026-82666/): yaojingang GEOFlow Superadmin Theme Editor SiteThemeEditorController.php preview code injection (medium 5.1)
- [CVE-2026-82665](https://insights.sbomify.com/CVE-2026-82665/): yaojingang GEOFlow Image Library Cleanup ImageLibraryController.php unlink path traversal (medium 5.1)
- [CVE-2026-82664](https://insights.sbomify.com/CVE-2026-82664/): yaojingang GEOFlow JSON-LD Theme HomeController.php cross site scripting (medium 5.3)
- [CVE-2026-82662](https://insights.sbomify.com/CVE-2026-82662/): Nodemailer before 8.0.8 TLS Certificate Validation Bypass (high 8.3)
- [CVE-2026-82661](https://insights.sbomify.com/CVE-2026-82661/): Nodemailer CRLF Injection via List-* Header Comments (medium 5.3)
- [CVE-2026-82660](https://insights.sbomify.com/CVE-2026-82660/): Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess (medium 5.3)
- [CVE-2026-8266](https://insights.sbomify.com/CVE-2026-8266/): Open5GS SMF gsm-build.c gsm_build_pdu_session_establishment_accept denial of service (medium 5.3)
- [CVE-2026-82659](https://insights.sbomify.com/CVE-2026-82659/): nodemailer before 9.0.1 File Read and SSRF via raw option (high 7.1)
- [CVE-2026-82658](https://insights.sbomify.com/CVE-2026-82658/): Admidio before 5.0.12 Broken Access Control via profile_function.php (medium 5.3)
- [CVE-2026-82657](https://insights.sbomify.com/CVE-2026-82657/): Admidio before 5.0.12 Authentication Bypass via RSS feeds (high 8.7)
- [CVE-2026-82656](https://insights.sbomify.com/CVE-2026-82656/): Admidio before 5.0.12 Path Traversal via Photo ZIP Download (low 2.1)
- [CVE-2026-82655](https://insights.sbomify.com/CVE-2026-82655/): Admidio before 5.0.12 SQL Injection via relation_type_list (high 8.7)
- [CVE-2026-82654](https://insights.sbomify.com/CVE-2026-82654/): SiYuan before v3.8.1 Stored XSS via block name (critical 9.3)
- [CVE-2026-82653](https://insights.sbomify.com/CVE-2026-82653/): SiYuan before v3.8.1 Stored XSS via confirmDialog (critical 9.3)
- [CVE-2026-82652](https://insights.sbomify.com/CVE-2026-82652/): SiYuan before v3.8.1 Information Disclosure via Publish Access (medium 6.9)
- [CVE-2026-82651](https://insights.sbomify.com/CVE-2026-82651/): SiYuan before v3.8.1 Missing Authorization via /history and /repo/diff (medium 6.9)
- [CVE-2026-82650](https://insights.sbomify.com/CVE-2026-82650/): SiYuan before v3.8.1 Path Traversal via /api/template/render (medium 5.9)
- [CVE-2026-8265](https://insights.sbomify.com/CVE-2026-8265/): Tenda AC6 httpd getLogFile get_log_file os command injection (medium 5.1)
- [CVE-2026-82649](https://insights.sbomify.com/CVE-2026-82649/): SiYuan before 3.8.1 Local Privilege Escalation via Uncontrolled Search Path (high 7.0)
- [CVE-2026-82648](https://insights.sbomify.com/CVE-2026-82648/): WWBN AVideo SSRF Filter Bypass via NAT64 Hex Address (high 7.1)
- [CVE-2026-82647](https://insights.sbomify.com/CVE-2026-82647/): WWBN AVideo Cross-Site Request Forgery via sendEmail.json.php (medium 5.3)
- [CVE-2026-82646](https://insights.sbomify.com/CVE-2026-82646/): WWBN AVideo Unauthenticated Reflected XSS via url2Embed.json.php (medium 5.3)
- [CVE-2026-82645](https://insights.sbomify.com/CVE-2026-82645/): AVideo Unauthenticated Stream Credential Disclosure via Forgeable Token (critical 9.2)
- [CVE-2026-82644](https://insights.sbomify.com/CVE-2026-82644/): WWBN AVideo Brute-force Rate Limiting Bypass via Missing User-Agent (high 8.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/331/