# Vulnerabilities published in 2026


- [CVE-2026-81197](https://insights.sbomify.com/CVE-2026-81197/): MasterStudy LMS < 3.7.46 - Unauthenticated Unpublished Course Title Disclosure via course-list REST Route (medium 5.3)
- [CVE-2026-81196](https://insights.sbomify.com/CVE-2026-81196/): MasterStudy LMS < 3.7.46 - Instructor+ Quiz Answer Disclosure via IDOR (low 2.7)
- [CVE-2026-81195](https://insights.sbomify.com/CVE-2026-81195/): MasterStudy LMS < 3.7.46 - Unauthenticated Student Enrollment Disclosure via student-courses REST Route (medium 5.3)
- [CVE-2026-81194](https://insights.sbomify.com/CVE-2026-81194/): MasterStudy LMS < 3.7.46 - Subscriber+ Cross-Instructor Order Data Disclosure via author_id Parameter (medium 4.3)
- [CVE-2026-81192](https://insights.sbomify.com/CVE-2026-81192/): OpenTelemetry.Resources.Host vulnerable to arbitrary code execution via local PATH hijacking on macOS (high 7.0)
- [CVE-2026-8119](https://insights.sbomify.com/CVE-2026-8119/): Open5GS NSSF nghttp2-server.c ogs_sbi_stream_find_by_id denial of service (medium 4.8)
- [CVE-2026-81182](https://insights.sbomify.com/CVE-2026-81182/): SysReptor: Unauthorized file disclosure by broken access control in writable shared notes (medium 4.2)
- [CVE-2026-81181](https://insights.sbomify.com/CVE-2026-81181/): SysReptor: Session Fixation in Password-Protected Shared Notes (low 3.7)
- [CVE-2026-81180](https://insights.sbomify.com/CVE-2026-81180/): SysReptor: Authenticated RCE by insecure image processing (high 8.8)
- [CVE-2026-8118](https://insights.sbomify.com/CVE-2026-8118/): Path traversal in Royal Addons for Elementor – Addons and Templates Kit for Elementor (medium 6.5)
- [CVE-2026-81179](https://insights.sbomify.com/CVE-2026-81179/): SysReptor: Host header injection might allow account takeover (high 8.1)
- [CVE-2026-81178](https://insights.sbomify.com/CVE-2026-81178/): SysReptor: Anonymous note-share link discloses project member identities and non-shared note activity (low 3.5)
- [CVE-2026-81176](https://insights.sbomify.com/CVE-2026-81176/): Svelte devalue: DoS via malformed input (medium 5.3)
- [CVE-2026-8117](https://insights.sbomify.com/CVE-2026-8117/): SourceCodester Pizzafy Ecommerce System index.php cross site scripting (medium 5.3)
- [CVE-2026-81168](https://insights.sbomify.com/CVE-2026-81168/): CAPTCHA Protected Page - Moderately critical - Cookie Forgery - SA-CONTRIB-2026-105 (low 3.7)
- [CVE-2026-81167](https://insights.sbomify.com/CVE-2026-81167/): Address Suggestion - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-103 (medium 4.8)
- [CVE-2026-81166](https://insights.sbomify.com/CVE-2026-81166/): Digital Signage Framework - Moderately critical - Access bypass - SA-CONTRIB-2026-109 (medium 5.3)
- [CVE-2026-81165](https://insights.sbomify.com/CVE-2026-81165/): Blazy - Less critical - Access bypass - SA-CONTRIB-2026-104 (medium 5.3)
- [CVE-2026-81164](https://insights.sbomify.com/CVE-2026-81164/): Entity PDF - Moderately critical - Access bypass - SA-CONTRIB-2026-114 (medium 5.4)
- [CVE-2026-81163](https://insights.sbomify.com/CVE-2026-81163/): Media Library Importer - Moderately critical - Access bypass - SA-CONTRIB-2026-129 (medium 5.4)
- [CVE-2026-81162](https://insights.sbomify.com/CVE-2026-81162/): Information disclosure in DXPR Builder: The Best Editing (AI) Experience for Drupal (medium 5.3)
- [CVE-2026-81161](https://insights.sbomify.com/CVE-2026-81161/): Content Moderation Notifications - Moderately critical - Access bypass - SA-CONTRIB-2026-107 (low 3.3)
- [CVE-2026-81160](https://insights.sbomify.com/CVE-2026-81160/): Slick Carousel - Moderately critical - Cross Site Scripting - SA-CONTRIB-2026-117 (medium 6.1)
- [CVE-2026-8116](https://insights.sbomify.com/CVE-2026-8116/): huangjunsen0406 xiaozhi-mcphub dxtController.ts path traversal (medium 5.3)
- [CVE-2026-81159](https://insights.sbomify.com/CVE-2026-81159/): Commerce CyberSource - Moderately critical - Insufficient input validation - SA-CONTRIB-2026-106 (low 3.7)
- [CVE-2026-81158](https://insights.sbomify.com/CVE-2026-81158/): Entity API - Moderately critical - Information disclosure - SA-CONTRIB-2026-113 (medium 5.3)
- [CVE-2026-81156](https://insights.sbomify.com/CVE-2026-81156/): Robo Gallery < 5.2.6 - Contributor+ Stored XSS via Gallery Settings (medium 6.8)
- [CVE-2026-81155](https://insights.sbomify.com/CVE-2026-81155/): Robo Gallery < 5.2.6 - Author+ Stored XSS via Gallery Search Label (medium 6.8)
- [CVE-2026-81154](https://insights.sbomify.com/CVE-2026-81154/): Robo Gallery < 5.2.6 - Author+ Stored XSS via Image Alt Text (medium 6.8)
- [CVE-2026-81153](https://insights.sbomify.com/CVE-2026-81153/): Robo Gallery < 5.2.6 - Author+ Stored XSS via Image Overlay Effect Meta (medium 6.8)
- [CVE-2026-8115](https://insights.sbomify.com/CVE-2026-8115/): gyoridavid short-video-maker REST API rest.ts path traversal (medium 6.9)
- [CVE-2026-8114](https://insights.sbomify.com/CVE-2026-8114/): JeecgBoot JSON Object loadTreeData sql injection (medium 5.3)
- [CVE-2026-8113](https://insights.sbomify.com/CVE-2026-8113/): 8421bit MiniClaw executeSkillScript kernel.ts isPathInside path traversal (medium 5.3)
- [CVE-2026-8112](https://insights.sbomify.com/CVE-2026-8112/): 8421bit MiniClaw kernel.ts executeCognitivePulse os command injection (medium 5.3)
- [CVE-2026-8111](https://insights.sbomify.com/CVE-2026-8111/): SQL injection in Endpoint Manager (high 8.8)
- [CVE-2026-81102](https://insights.sbomify.com/CVE-2026-81102/): Dropbox Dash MCP Server DNS Rebinding via Missing Host Header Validation (low 2.3)
- [CVE-2026-81101](https://insights.sbomify.com/CVE-2026-81101/): Airtable MCP CLI before 0.2.5 Credential Disclosure via Unvalidated Configured Endpoint (medium 6.9)
- [CVE-2026-81100](https://insights.sbomify.com/CVE-2026-81100/): Timescale tiger-gh-mcp-server DNS Rebinding via Disabled Host Header Allow-List (high 7.6)
- [CVE-2026-8110](https://insights.sbomify.com/CVE-2026-8110/): Privilege escalation in Endpoint Manager (high 7.8)
- [CVE-2026-81099](https://insights.sbomify.com/CVE-2026-81099/): Timescale tiger-slack DNS Rebinding via Disabled Host Header Allow-List (high 7.6)
- [CVE-2026-81098](https://insights.sbomify.com/CVE-2026-81098/): Telnyx MCP Server through 6.83.0 Missing Authentication on Streamable HTTP Transport (critical 9.3)
- [CVE-2026-81097](https://insights.sbomify.com/CVE-2026-81097/): rails-mcp-server 1.4.0 through 1.6.0 OS Command Execution via execute_ruby PTY Escape (high 8.6)
- [CVE-2026-81096](https://insights.sbomify.com/CVE-2026-81096/): ToolUniverse through 1.2.6 Unauthenticated Remote Code Execution via python_code_executor Sandbox Escape (critical 9.3)
- [CVE-2026-81095](https://insights.sbomify.com/CVE-2026-81095/): Timescale pg-aiguide through 0.5.0 DNS Rebinding via Disabled Host Header Allow-List (high 7.6)
- [CVE-2026-81094](https://insights.sbomify.com/CVE-2026-81094/): mcp-router CLI before 0.6.3 Binds the MCP Aggregator to All Interfaces Without Requiring Authentication (critical 9.3)
- [CVE-2026-81093](https://insights.sbomify.com/CVE-2026-81093/): Apify Actors MCP Server before 0.9.12 Server-Side Request Forgery via get-html-skeleton (high 8.7)
- [CVE-2026-81092](https://insights.sbomify.com/CVE-2026-81092/): mcp-go before 0.56.0 Missing Host Header Validation Enables DNS Rebinding (high 7.6)
- [CVE-2026-81091](https://insights.sbomify.com/CVE-2026-81091/): mcp-use Inspector Proxy Server-Side Request Forgery via Caller-Supplied Target URL (high 8.7)
- [CVE-2026-81090](https://insights.sbomify.com/CVE-2026-81090/): Gpx2Graphics <= 0.3 - Arbitrary File Upload via CSRF (high 7.2)
- [CVE-2026-8109](https://insights.sbomify.com/CVE-2026-8109/): Information disclosure in Endpoint Manager (medium 6.5)
- [CVE-2026-8108](https://insights.sbomify.com/CVE-2026-8108/): Fuji Electric Tellus Exposed Dangerous Method or Function (high 7.8)
- [CVE-2026-8106](https://insights.sbomify.com/CVE-2026-8106/): Cross-site scripting in Enterprise Server (medium 5.9)
- [CVE-2026-81052](https://insights.sbomify.com/CVE-2026-81052/): Security feature bypass in ThinOS 10 (medium 6.8)
- [CVE-2026-81051](https://insights.sbomify.com/CVE-2026-81051/): Security feature bypass in ThinOS 10 (medium 6.6)
- [CVE-2026-81049](https://insights.sbomify.com/CVE-2026-81049/): Security feature bypass in ThinOS 10 (medium 4.4)
- [CVE-2026-81048](https://insights.sbomify.com/CVE-2026-81048/): Command injection in ThinOS 10 (critical 9.6)
- [CVE-2026-81046](https://insights.sbomify.com/CVE-2026-81046/): Security feature bypass in ThinOS 10 (critical 9.4)
- [CVE-2026-81039](https://insights.sbomify.com/CVE-2026-81039/): Bluetooth Host connection reservation leak when multiple connectable advertising sets share an identity (medium 4.3)
- [CVE-2026-81038](https://insights.sbomify.com/CVE-2026-81038/): Bluetooth OTS server discloses uninitialized stack memory in failed Calculate Checksum responses (high 7.1)
- [CVE-2026-81036](https://insights.sbomify.com/CVE-2026-81036/): Stalwart Mail Server through 0.16.19 Authorization Code Disclosure via Unvalidated OAuth redirect_uri (high 8.5)
- [CVE-2026-81035](https://insights.sbomify.com/CVE-2026-81035/): Midday Missing Owner Check on Team Deletion (high 7.2)
- [CVE-2026-81034](https://insights.sbomify.com/CVE-2026-81034/): Netmaker through 1.6.0 Improper Certificate Validation in SMTP Client (high 8.3)
- [CVE-2026-81033](https://insights.sbomify.com/CVE-2026-81033/): Automatisch through 0.15.0 User Enumeration via Forgot-Password Response Discrepancy (medium 6.9)
- [CVE-2026-81032](https://insights.sbomify.com/CVE-2026-81032/): NebulaGraph through 3.8.0 Unauthenticated Read and Modification of Runtime Configuration (critical 9.3)
- [CVE-2026-81031](https://insights.sbomify.com/CVE-2026-81031/): IDURAR ERP CRM through 4.1.1 Account Takeover via Unverified Identifier on Password Update (high 8.6)
- [CVE-2026-81030](https://insights.sbomify.com/CVE-2026-81030/): Mage AI through 0.9.79 Arbitrary File Read via Unvalidated Path in browser_items Endpoint (high 7.1)
- [CVE-2026-81029](https://insights.sbomify.com/CVE-2026-81029/): OpenMetadata before 2.0.0 JWT Disclosure via Unvalidated SAML and OIDC Redirect URI (high 8.5)
- [CVE-2026-81028](https://insights.sbomify.com/CVE-2026-81028/): ZLMediaKit downloadFile Root-Directory Confinement Bypass via Prefix Collision (medium 6.9)
- [CVE-2026-81027](https://insights.sbomify.com/CVE-2026-81027/): one-api through 0.6.10 Missing Authorization on URL-Parameter Channel Pinning (high 8.4)
- [CVE-2026-81026](https://insights.sbomify.com/CVE-2026-81026/): MasterStudy LMS < 3.7.40 - Unauthenticated Payment Bypass via PayPal IPN (medium 4.8)
- [CVE-2026-81022](https://insights.sbomify.com/CVE-2026-81022/): SupportCandy 3.3.6 - 3.5.2 - Unauthenticated Ticket Content Disclosure via Auth Code Leak (medium 5.3)
- [CVE-2026-81021](https://insights.sbomify.com/CVE-2026-81021/): SupportCandy 3.2.9 - 3.5.2 - Unauthenticated Ticket Attachment Disclosure (medium 5.3)
- [CVE-2026-81020](https://insights.sbomify.com/CVE-2026-81020/): wolfEngine reuses the AES-GCM nonce on every TLS 1.2 / DTLS 1.2 record (high 7.4)
- [CVE-2026-81019](https://insights.sbomify.com/CVE-2026-81019/): wolfProvider reuses the AES-GCM nonce on every TLS 1.2 / DTLS 1.2 record (high 7.4)
- [CVE-2026-81018](https://insights.sbomify.com/CVE-2026-81018/): platform/x86: think-lmi: Free system certificate signatures (not scored)
- [CVE-2026-81017](https://insights.sbomify.com/CVE-2026-81017/): platform/chrome: sensorhub: Bound the EC-reported sensor number (high 8.4)
- [CVE-2026-81016](https://insights.sbomify.com/CVE-2026-81016/): platform/x86/amd/pmc: Propagate SMU errors and validate S2D address (high 7.7)
- [CVE-2026-81015](https://insights.sbomify.com/CVE-2026-81015/): platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails (high 7.8)
- [CVE-2026-81014](https://insights.sbomify.com/CVE-2026-81014/): platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store() (not scored)
- [CVE-2026-81013](https://insights.sbomify.com/CVE-2026-81013/): platform/x86: hp-bioscfg: fix heap OOB read on empty password write (not scored)
- [CVE-2026-81012](https://insights.sbomify.com/CVE-2026-81012/): platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buffer() (high 8.4)
- [CVE-2026-81011](https://insights.sbomify.com/CVE-2026-81011/): platform/x86: hp-bioscfg: pass validated element count to package parsers (high 7.1)
- [CVE-2026-81010](https://insights.sbomify.com/CVE-2026-81010/): io_uring/waitid: honor task_work cancellation (high 7.8)
- [CVE-2026-81009](https://insights.sbomify.com/CVE-2026-81009/): io_uring/query: cap user size passed to copy_struct_to_user (not scored)
- [CVE-2026-81008](https://insights.sbomify.com/CVE-2026-81008/): interconnect: Fix use after free in icc_get() and of_icc_get_by_index() (high 7.8)
- [CVE-2026-81007](https://insights.sbomify.com/CVE-2026-81007/): ipmi: ipmb: validate write message length (high 7.1)
- [CVE-2026-81006](https://insights.sbomify.com/CVE-2026-81006/): ipmi: Remove all sysfs files on registration failure (high 7.8)
- [CVE-2026-81005](https://insights.sbomify.com/CVE-2026-81005/): ipmi: si: Fix NULL pointer dereference after failed registration (not scored)
- [CVE-2026-81004](https://insights.sbomify.com/CVE-2026-81004/): ipmi:msghandler: Cancel work cleanly on an error (high 8.4)
- [CVE-2026-81003](https://insights.sbomify.com/CVE-2026-81003/): net/iucv: filter frames in afiucv_hs_rcv() by ingress device (high 8.1)
- [CVE-2026-81002](https://insights.sbomify.com/CVE-2026-81002/): xdp: fix zero-copy frame layout (critical 9.8)
- [CVE-2026-81001](https://insights.sbomify.com/CVE-2026-81001/): slip: fix use-after-free in sl_sync() (high 7.8)
- [CVE-2026-81000](https://insights.sbomify.com/CVE-2026-81000/): net: tun: bound receive headroom (high 7.8)
- [CVE-2026-8100](https://insights.sbomify.com/CVE-2026-8100/): Auth bypass in Chef360 (high 8.6)
- [CVE-2026-80999](https://insights.sbomify.com/CVE-2026-80999/): net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO (not scored)
- [CVE-2026-80998](https://insights.sbomify.com/CVE-2026-80998/): net: bnxt: ring the doorbell when SW USO exits early (high 7.5)
- [CVE-2026-80997](https://insights.sbomify.com/CVE-2026-80997/): net: ipa: fix stalled modem TX queue after runtime resume (high 7.5)
- [CVE-2026-80996](https://insights.sbomify.com/CVE-2026-80996/): net: l2tp: do not propagate multicast notification errors (not scored)
- [CVE-2026-80995](https://insights.sbomify.com/CVE-2026-80995/): net: mctp: hold a reference to the route device in mctp_route_lookup() (high 7.8)
- [CVE-2026-80994](https://insights.sbomify.com/CVE-2026-80994/): net: openvswitch: fix flow mask use-after-free on flow deletion (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/343/