# Vulnerabilities published in 2026


- [CVE-2026-82643](https://insights.sbomify.com/CVE-2026-82643/): WWBN AVideo Unauthenticated Rate Limit Bypass via preauthorize.json.php (medium 6.9)
- [CVE-2026-82642](https://insights.sbomify.com/CVE-2026-82642/): Readest: unsanitized iframe srcdoc attribute in the EPUB sanitizer can lead to arbitrary code execution (high 8.8)
- [CVE-2026-82641](https://insights.sbomify.com/CVE-2026-82641/): Keploy 3.1.0-3.6.25 Unauthenticated TLS Key Exposure (high 8.8)
- [CVE-2026-82640](https://insights.sbomify.com/CVE-2026-82640/): browser-use web-ui 2.0.0 through 3.0.0 Cleartext API Key Storage (medium 6.8)
- [CVE-2026-8264](https://insights.sbomify.com/CVE-2026-8264/): Tenda AC6 httpd WifiApScan formWifiApScan os command injection (medium 5.3)
- [CVE-2026-82639](https://insights.sbomify.com/CVE-2026-82639/): NextChat 2.15.8 through 2.16.1 OpenAI API Key Disclosure (high 8.7)
- [CVE-2026-82638](https://insights.sbomify.com/CVE-2026-82638/): jina-ai reader Server-Side Request Forgery via disabled private-address guard (high 8.7)
- [CVE-2026-82637](https://insights.sbomify.com/CVE-2026-82637/): browser-use web-ui 2.0.0 through 3.0.0 Arbitrary Directory Creation (medium 6.9)
- [CVE-2026-82636](https://insights.sbomify.com/CVE-2026-82636/): Command injection in Qubes OS (high 7.9)
- [CVE-2026-82635](https://insights.sbomify.com/CVE-2026-82635/): Pake arbitrary file write via unsanitized download_file filename (high 8.8)
- [CVE-2026-82634](https://insights.sbomify.com/CVE-2026-82634/): Frappe Framework Development Branch Incorrect Authorization via Jinja Template Preview Endpoint (high 7.1)
- [CVE-2026-82633](https://insights.sbomify.com/CVE-2026-82633/): Dolibarr 10.0.0 before 24.0.0 Missing Authorization on REST Users Groups Endpoint (medium 5.3)
- [CVE-2026-82632](https://insights.sbomify.com/CVE-2026-82632/): Incorrect Authorization in GitLab (low 3.1)
- [CVE-2026-82631](https://insights.sbomify.com/CVE-2026-82631/): valkey-io valkey Blocked-on-keys blocked.c handleClientsBlockedOnKey use after free (low 2.1)
- [CVE-2026-82630](https://insights.sbomify.com/CVE-2026-82630/): PowerJob Transport Endpoint TestController.java MuConnectionManager.getOrCreateConnection server-side request forgery (medium 6.9)
- [CVE-2026-8263](https://insights.sbomify.com/CVE-2026-8263/): Tenda AC6 httpd WifiExtraSet fromSetWirelessRepeat os command injection (medium 5.1)
- [CVE-2026-82629](https://insights.sbomify.com/CVE-2026-82629/): jeecgboot jeewx-boot doUpload Endpoint MyJwWebJwid3Controller.java MyJwWebJwid3Controller.doUpload unrestricted upload (medium 5.1)
- [CVE-2026-82628](https://insights.sbomify.com/CVE-2026-82628/): Colorful iGameCenter IOCTL Dispatch WinRing0x64.sys sub_11504 privileges management (critical 9.3)
- [CVE-2026-82627](https://insights.sbomify.com/CVE-2026-82627/): Deserialization in Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included (high 7.5)
- [CVE-2026-82625](https://insights.sbomify.com/CVE-2026-82625/): code-projects Simple Inventory System User Registration register.php cross site scripting (medium 5.3)
- [CVE-2026-82624](https://insights.sbomify.com/CVE-2026-82624/): code-projects Simple Inventory System Database Backup File inventorymanagement.sql information disclosure (medium 6.9)
- [CVE-2026-82623](https://insights.sbomify.com/CVE-2026-82623/): open62541 History Backend ua_history_data_backend_memory.c UA_DataValue_backend_copyRange use after free (medium 6.9)
- [CVE-2026-82622](https://insights.sbomify.com/CVE-2026-82622/): code-projects Employee Leave Managing System Employee Profile Update editaction.php cross site scripting (medium 5.1)
- [CVE-2026-82621](https://insights.sbomify.com/CVE-2026-82621/): Soarkey StudentManagement/学生信息管理系统 Administrative Servlet AdminDao.java AdminDao.doGet authorization (medium 6.9)
- [CVE-2026-82620](https://insights.sbomify.com/CVE-2026-82620/): Soarkey StudentManagement/学生信息管理系统 CourseDao.java CourseDao.course_ranking sql injection (medium 5.3)
- [CVE-2026-8262](https://insights.sbomify.com/CVE-2026-8262/): Devs Palace ERP Online chart-save cross site scripting (medium 4.8)
- [CVE-2026-82619](https://insights.sbomify.com/CVE-2026-82619/): Systerel S2OPC subscription_mgr.c use after free (medium 5.3)
- [CVE-2026-82618](https://insights.sbomify.com/CVE-2026-82618/): Systerel S2OPC String Array Range Writing sopc_builtintypes.c set_range_matrix_on_string_array out-of-bounds (medium 5.3)
- [CVE-2026-82617](https://insights.sbomify.com/CVE-2026-82617/): Apache OpenNLP, Apache OpenNLP: ReDoS / stack exhaustion in RegexNameFinderFactory built-in EMAIL and URL patterns (critical 10.0)
- [CVE-2026-82616](https://insights.sbomify.com/CVE-2026-82616/): TOTOLINK NR1800X cstecgi.cgi setUploadSetting stack-based overflow (critical 9.4)
- [CVE-2026-82615](https://insights.sbomify.com/CVE-2026-82615/): itsourcecode Online Medicine Delivery System Password Recovery passwordrecover.php find_phone sql injection (medium 6.9)
- [CVE-2026-82614](https://insights.sbomify.com/CVE-2026-82614/): itsourcecode Online Medicine Delivery System Product Category Filter index.php loadResultList sql injection (medium 6.9)
- [CVE-2026-82613](https://insights.sbomify.com/CVE-2026-82613/): itsourcecode Online Medicine Delivery System Product Search index.php loadResultList sql injection (medium 6.9)
- [CVE-2026-82612](https://insights.sbomify.com/CVE-2026-82612/): itsourcecode Online Medicine Delivery System Product Detail index.php loadResultList sql injection (medium 6.9)
- [CVE-2026-82611](https://insights.sbomify.com/CVE-2026-82611/): itsourcecode Online Medicine Delivery System Customer Login login.php cusAuthentication sql injection (medium 6.9)
- [CVE-2026-82610](https://insights.sbomify.com/CVE-2026-82610/): itsourcecode Online Medicine Delivery System Login login.php employeeAuthentication sql injection (medium 6.9)
- [CVE-2026-8261](https://insights.sbomify.com/CVE-2026-8261/): Squirrel sqobject.cpp Load heap-based overflow (medium 5.1)
- [CVE-2026-82609](https://insights.sbomify.com/CVE-2026-82609/): itsourcecode Sales and Inventory System inv_edit.php sql injection (medium 5.3)
- [CVE-2026-82608](https://insights.sbomify.com/CVE-2026-82608/): Kamailio AVP cxdx_avp.c get_4bytes out-of-bounds (medium 5.3)
- [CVE-2026-82607](https://insights.sbomify.com/CVE-2026-82607/): Cozmoslabs Profile Builder Plugin Avatar Simple Upload AJAX admin-ajax.php wppb_ajax_simple_avatar unrestricted upload (medium 6.9)
- [CVE-2026-82605](https://insights.sbomify.com/CVE-2026-82605/): BareBones BBEdit Lasso Language Tokenizer infinite loop (medium 5.3)
- [CVE-2026-82604](https://insights.sbomify.com/CVE-2026-82604/): BareBones BBEdit Java Language recursion (medium 5.3)
- [CVE-2026-82603](https://insights.sbomify.com/CVE-2026-82603/): SeaCMS Comment Cache member.php del_pl path traversal (medium 5.3)
- [CVE-2026-82602](https://insights.sbomify.com/CVE-2026-82602/): SeaCMS ass.php authorization (medium 6.9)
- [CVE-2026-82601](https://insights.sbomify.com/CVE-2026-82601/): SeaCMS err.php cross site scripting (medium 5.3)
- [CVE-2026-82600](https://insights.sbomify.com/CVE-2026-82600/): SeaCMS zyapi.php sql injection (medium 6.9)
- [CVE-2026-8260](https://insights.sbomify.com/CVE-2026-8260/): D-Link DCS-935L HNAP Service hnap_service SetDeviceSettings buffer overflow (high 8.7)
- [CVE-2026-82599](https://insights.sbomify.com/CVE-2026-82599/): SeaCMS Avatar Upload member.php unlink path traversal (medium 5.3)
- [CVE-2026-82598](https://insights.sbomify.com/CVE-2026-82598/): SeaCMS Template search.php parseIf code injection (medium 6.9)
- [CVE-2026-82597](https://insights.sbomify.com/CVE-2026-82597/): TOTOLINK NR1800X cstecgi.cgi setUssd command injection (medium 5.3)
- [CVE-2026-82596](https://insights.sbomify.com/CVE-2026-82596/): LatencyUtils PauseDetector LatencyStats.java LatencyStats.recordDetectedPause memory corruption (medium 4.8)
- [CVE-2026-82595](https://insights.sbomify.com/CVE-2026-82595/): D-Link DIR-825M System Command Execution formSysCmd sub_456CF4 command injection (medium 5.3)
- [CVE-2026-82594](https://insights.sbomify.com/CVE-2026-82594/): LogNet grpc-spring-boot-starter Annotation Processing improper authorization (low 2.3)
- [CVE-2026-82593](https://insights.sbomify.com/CVE-2026-82593/): D-Link DIR-825M LTE Module Firmware Upgrade formLtefotaUpgradeFibocom sub_41802C stack-based overflow (critical 9.4)
- [CVE-2026-82592](https://insights.sbomify.com/CVE-2026-82592/): D-Link DIR-825M Disk Formatting Handler Endpoint formDiskFormat sub_46725C stack-based overflow (critical 9.4)
- [CVE-2026-82591](https://insights.sbomify.com/CVE-2026-82591/): Open Asset Import Library Assimp MD5Loader.cpp MakeDataUnique heap-based overflow (medium 4.8)
- [CVE-2026-82590](https://insights.sbomify.com/CVE-2026-82590/): Open5GS SMF nudm-handler.c smf_nudm_sdm_handle_get assertion (medium 5.3)
- [CVE-2026-8259](https://insights.sbomify.com/CVE-2026-8259/): Tenda AC6 httpd telnet os command injection (medium 5.1)
- [CVE-2026-82589](https://insights.sbomify.com/CVE-2026-82589/): Open5GS N1-N2 Message namf-handler.c amf_namf_comm_handle_n1_n2_message_transfer denial of service (medium 5.3)
- [CVE-2026-82588](https://insights.sbomify.com/CVE-2026-82588/): Open5GS Transfer Endpoint namf-handler.c null pointer dereference (medium 5.3)
- [CVE-2026-82587](https://insights.sbomify.com/CVE-2026-82587/): Open5GS AMF namf-handler.c amf_namf_comm_decode_ue_mm_context_list memory corruption (medium 5.3)
- [CVE-2026-82586](https://insights.sbomify.com/CVE-2026-82586/): AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributes (high 8.2)
- [CVE-2026-82585](https://insights.sbomify.com/CVE-2026-82585/): Botslab G980H Dashcams Cleartext Transmission of Sensitive Information (high 7.1)
- [CVE-2026-82584](https://insights.sbomify.com/CVE-2026-82584/): Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata (low 2.3)
- [CVE-2026-82583](https://insights.sbomify.com/CVE-2026-82583/): NextGen Healthcare Mirth Connect SQL Injection (high 7.2)
- [CVE-2026-82582](https://insights.sbomify.com/CVE-2026-82582/): Missing authorization in SHIRASAGI (medium 5.3)
- [CVE-2026-82580](https://insights.sbomify.com/CVE-2026-82580/): AshAi echoes raw tool exception messages into the conversation, disclosing internal details (medium 5.3)
- [CVE-2026-8258](https://insights.sbomify.com/CVE-2026-8258/): Squirrel sqstdstring.cpp validate_format stack-based overflow (medium 4.8)
- [CVE-2026-82579](https://insights.sbomify.com/CVE-2026-82579/): AshAi tool loop never terminates when all tool calls are filtered out, enabling denial of service (medium 6.0)
- [CVE-2026-82578](https://insights.sbomify.com/CVE-2026-82578/): NextGen Healthcare Mirth Connect Improper Restriction of XML External Entity Reference (high 8.7)
- [CVE-2026-8257](https://insights.sbomify.com/CVE-2026-8257/): WebAssembly Binaryen BrOn wasm-ir-builder.cpp makeBrOn assertion (medium 4.8)
- [CVE-2026-82567](https://insights.sbomify.com/CVE-2026-82567/): mySCADA myPRO Manager Missing Authorization (medium 5.3)
- [CVE-2026-82566](https://insights.sbomify.com/CVE-2026-82566/): Botslab G980H Dashcams Insufficient session expiration (high 8.7)
- [CVE-2026-82564](https://insights.sbomify.com/CVE-2026-82564/): Identity tool filter in AshAi accepts operator maps, allowing update or destroy of unidentified records (high 7.1)
- [CVE-2026-82563](https://insights.sbomify.com/CVE-2026-82563/): Softish C6 Ear Camera and EarVision Android Application Authentication bypass by spoofing (high 8.4)
- [CVE-2026-82562](https://insights.sbomify.com/CVE-2026-82562/): qs array-limit bypass via bracket-key comma parsing (medium 6.3)
- [CVE-2026-82561](https://insights.sbomify.com/CVE-2026-82561/): Apache NiFi: Missing Authorization for Components Referenced in Flow Update Methods (medium 5.9)
- [CVE-2026-82560](https://insights.sbomify.com/CVE-2026-82560/): Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width. (high 7.5)
- [CVE-2026-8256](https://insights.sbomify.com/CVE-2026-8256/): Devs Palace ERP Online mr-save cross site scripting (medium 4.8)
- [CVE-2026-82556](https://insights.sbomify.com/CVE-2026-82556/): Forgejo Repository Migration is_migrate_allowed.go net.LookupIP server-side request forgery (medium 5.3)
- [CVE-2026-82555](https://insights.sbomify.com/CVE-2026-82555/): TOTOLINK N600R Authentication cstecgi.cgi loginAuth random values (medium 6.3)
- [CVE-2026-82554](https://insights.sbomify.com/CVE-2026-82554/): SourceCodester Queue Management System add_customer.php cross site scripting (medium 5.3)
- [CVE-2026-82553](https://insights.sbomify.com/CVE-2026-82553/): sambitraj Student Management System Student Dashboard student_dashboard.php mysqli_query improper authorization (medium 5.3)
- [CVE-2026-82552](https://insights.sbomify.com/CVE-2026-82552/): Linux Foundation Magma gNB Termination ngap_amf.c denial of service (medium 5.3)
- [CVE-2026-82551](https://insights.sbomify.com/CVE-2026-82551/): Linux Foundation Magma NGSetup ngap_amf_handlers.c state issue (medium 6.9)
- [CVE-2026-82550](https://insights.sbomify.com/CVE-2026-82550/): Linux Foundation Magma NGSetupRequest input validation (medium 6.9)
- [CVE-2026-8255](https://insights.sbomify.com/CVE-2026-8255/): Devs Palace ERP Online add_new_customer cross site scripting (medium 4.8)
- [CVE-2026-82549](https://insights.sbomify.com/CVE-2026-82549/): Linux Foundation Magma SecurityModeComplete integrity check (medium 6.9)
- [CVE-2026-82548](https://insights.sbomify.com/CVE-2026-82548/): Linux Foundation Magma InitialUEMessage information disclosure (medium 6.9)
- [CVE-2026-82547](https://insights.sbomify.com/CVE-2026-82547/): Linux Foundation Magma Registration Complete Message amf_fsm.cpp improper authentication (medium 6.9)
- [CVE-2026-82546](https://insights.sbomify.com/CVE-2026-82546/): Apache Roller: Stored cross-site scripting through incoming Trackback links (medium 6.1)
- [CVE-2026-82545](https://insights.sbomify.com/CVE-2026-82545/): itsourcecode Sales and Inventory System sup_searchfrm.php sql injection (medium 5.3)
- [CVE-2026-82544](https://insights.sbomify.com/CVE-2026-82544/): wger-project wger Password Reset gym.py reset_user_password cross-site request forgery (medium 5.3)
- [CVE-2026-82543](https://insights.sbomify.com/CVE-2026-82543/): vastsa FileCodeBox Pickup Limit views.py update_file_usage race condition (medium 6.9)
- [CVE-2026-82542](https://insights.sbomify.com/CVE-2026-82542/): Tenda HG10 Boa Web Server formIPv6Routing buffer overflow (critical 10.0)
- [CVE-2026-82541](https://insights.sbomify.com/CVE-2026-82541/): itsourcecode Sales and Inventory System sup_edit.php sql injection (medium 5.3)
- [CVE-2026-82540](https://insights.sbomify.com/CVE-2026-82540/): itsourcecode Sales and Inventory System cust_searchfrm.php sql injection (medium 5.3)
- [CVE-2026-8254](https://insights.sbomify.com/CVE-2026-8254/): Devs Palace ERP Online sales_save cross site scripting (medium 4.8)
- [CVE-2026-82539](https://insights.sbomify.com/CVE-2026-82539/): TOTOLINK A720R MAC Filtering cstecgi.cgi setMacFilterRules memory corruption (critical 9.4)
- [CVE-2026-82538](https://insights.sbomify.com/CVE-2026-82538/): ILIAS Arbitrary SQL Injection via Repository Trash Table Sort Parameter (high 8.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/332/