# Vulnerabilities published in 2026


- [CVE-2026-76872](https://insights.sbomify.com/CVE-2026-76872/): Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via DHCP/ACL Management Pages (medium 5.1)
- [CVE-2026-76871](https://insights.sbomify.com/CVE-2026-76871/): Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via VPN Read Handlers (high 7.1)
- [CVE-2026-76870](https://insights.sbomify.com/CVE-2026-76870/): Netcore NR255-V 1.5.130703 Out-of-Bounds Read in mtd_write Firmware Upload Validation (high 7.1)
- [CVE-2026-7687](https://insights.sbomify.com/CVE-2026-7687/): langflow-ai langflow Full Builtins code_parser.py CodeParser.parse_callable_details command injection (medium 5.3)
- [CVE-2026-76869](https://insights.sbomify.com/CVE-2026-76869/): Netcore NR255-V 1.5.130703 Stack-Based Buffer Overflow in reboot_timer_set.cgi (high 8.6)
- [CVE-2026-76868](https://insights.sbomify.com/CVE-2026-76868/): Netcore NR255-V 1.5.130703 NULL Pointer Dereference in route_policy_add.cgi via Missing exit_port (medium 6.9)
- [CVE-2026-76867](https://insights.sbomify.com/CVE-2026-76867/): Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting in Route/NAT Configuration CGI Handlers (medium 5.1)
- [CVE-2026-76866](https://insights.sbomify.com/CVE-2026-76866/): Netcore NR255-V 1.5.130703 OS Command Argument Injection via Unquoted DDNS Parameters (high 8.6)
- [CVE-2026-76865](https://insights.sbomify.com/CVE-2026-76865/): Netcore NR255-V 1.5.130703 NULL Pointer Dereference via Unchecked atoi() in QoS Setter Handlers (medium 6.9)
- [CVE-2026-76864](https://insights.sbomify.com/CVE-2026-76864/): Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via Unescaped QoS Rule Names (medium 4.8)
- [CVE-2026-76863](https://insights.sbomify.com/CVE-2026-76863/): Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via QoS Bandwidth Plan Routes (medium 5.3)
- [CVE-2026-76862](https://insights.sbomify.com/CVE-2026-76862/): Netcore NR255-V 1.5.130703 OS Command Argument Injection in Nettools tcpdump Launch Paths (high 8.7)
- [CVE-2026-76861](https://insights.sbomify.com/CVE-2026-76861/): Netcore NR255-V 1.5.130703 Stack-Based Buffer Overflow in ntools_tcpdump_start_set.cgi (high 8.7)
- [CVE-2026-76860](https://insights.sbomify.com/CVE-2026-76860/): Netcore NR255-V 1.5.130703 Stack-Based Buffer Overflow in wake_up_set.cgi via MAC and ID Tokenization (high 8.7)
- [CVE-2026-7686](https://insights.sbomify.com/CVE-2026-7686/): eyeo Adblock Plus Legacy Premium Activation premium.preload.js postMessage access control (medium 6.9)
- [CVE-2026-76859](https://insights.sbomify.com/CVE-2026-76859/): Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via user_pass_show.cgi (high 7.1)
- [CVE-2026-76858](https://insights.sbomify.com/CVE-2026-76858/): Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via DDNS eval() in ddns_wan_list_show.cgi (medium 4.8)
- [CVE-2026-76857](https://insights.sbomify.com/CVE-2026-76857/): Netcore NR255-V 1.5.130703 Plaintext DDNS Credential Disclosure via ddns_wan_list_show.cgi (high 7.1)
- [CVE-2026-76856](https://insights.sbomify.com/CVE-2026-76856/): Netcore NR255-V 1.5.130703 Cross-Site Request Forgery in WAN/LAN Configuration Endpoints (high 7.0)
- [CVE-2026-76855](https://insights.sbomify.com/CVE-2026-76855/): Netcore NR255-V 1.5.130703 Cross-User Session Disclosure via Audit Endpoints (high 7.1)
- [CVE-2026-76854](https://insights.sbomify.com/CVE-2026-76854/): Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via l7_web_auth_user_show.cgi (high 7.1)
- [CVE-2026-76853](https://insights.sbomify.com/CVE-2026-76853/): Netcore NR268 1.7.121109 Security Check Bypass in parame_put_file.cgi (high 7.2)
- [CVE-2026-76852](https://insights.sbomify.com/CVE-2026-76852/): Netcore NR268 1.7.121109 Forgeable Firmware Authenticity Check in mtd_write (high 8.7)
- [CVE-2026-76851](https://insights.sbomify.com/CVE-2026-76851/): Server-side request forgery in Enterprise Server (high 7.7)
- [CVE-2026-76850](https://insights.sbomify.com/CVE-2026-76850/): LMDeploy Remote Code Execution via Unsafe Pickle Deserialization in the Disaggregated Serving Peer Connector (critical 9.3)
- [CVE-2026-7685](https://insights.sbomify.com/CVE-2026-7685/): Edimax BR-6208AC setWAN buffer overflow (high 8.7)
- [CVE-2026-76847](https://insights.sbomify.com/CVE-2026-76847/): act 0.2.81 through 0.2.89 Missing Authorization in the Artifacts V4 Backend (high 8.7)
- [CVE-2026-76846](https://insights.sbomify.com/CVE-2026-76846/): Grav before 2.0.16 Information Disclosure via Twig Sandbox (high 8.7)
- [CVE-2026-76845](https://insights.sbomify.com/CVE-2026-76845/): adm-zip 0.5.9 through 0.6.0 Arbitrary File Overwrite via Symlink Following on Extraction (medium 6.8)
- [CVE-2026-76844](https://insights.sbomify.com/CVE-2026-76844/): zlib 1.2.11 through 1.3.2 Heap Buffer Overflow via Stale gzwrite Pointer After Failed Write (high 8.3)
- [CVE-2026-76843](https://insights.sbomify.com/CVE-2026-76843/): Flair 0.15.0 and 0.15.1 Deserialization of Untrusted Data via ClusteringModel.load (high 8.4)
- [CVE-2026-76842](https://insights.sbomify.com/CVE-2026-76842/): Mercado Pago Node.js SDK through 3.4.0 Path Injection via Unencoded Identifiers in Payment Clients (high 8.8)
- [CVE-2026-76841](https://insights.sbomify.com/CVE-2026-76841/): Xinference through 2.11.0 Remote Code Execution via Hardcoded trust_remote_code in Model Loaders (high 8.7)
- [CVE-2026-76840](https://insights.sbomify.com/CVE-2026-76840/): RustDesk through 1.4.9 Heap Buffer Overflow via Unvalidated CLIPRDR FileContentsResponse Length (high 8.5)
- [CVE-2026-7684](https://insights.sbomify.com/CVE-2026-7684/): Edimax BR-6428nC setWAN buffer overflow (high 8.7)
- [CVE-2026-76839](https://insights.sbomify.com/CVE-2026-76839/): Grav before 2.0.16 Information Disclosure via offsetGet (high 8.7)
- [CVE-2026-76838](https://insights.sbomify.com/CVE-2026-76838/): Hi.Events before 1.11.1-beta Server-Side Request Forgery via Unvalidated Webhook Redirects (high 8.4)
- [CVE-2026-76837](https://insights.sbomify.com/CVE-2026-76837/): Baserow before 2.3.0 Stored Cross-Site Scripting via Rich Text Mention Display Name (medium 5.3)
- [CVE-2026-76836](https://insights.sbomify.com/CVE-2026-76836/): AzuraCast through 0.23.8 Liquidsoap Configuration Write via Profile Edit Serialization Group Bypass (high 8.7)
- [CVE-2026-76835](https://insights.sbomify.com/CVE-2026-76835/): OAuth2 Proxy 7.15.2 through 7.15.4 Authentication Bypass via X-Forwarded-Uri Under the Default Trusted Proxy Set (critical 9.3)
- [CVE-2026-76834](https://insights.sbomify.com/CVE-2026-76834/): b2evolution CMS 6.7.8 through 7.2.5 Object Injection via Negative Integer Array Key (critical 9.2)
- [CVE-2026-76833](https://insights.sbomify.com/CVE-2026-76833/): @cgauge/yaml npm Package Arbitrary Code Execution via eval() YAML Tag (high 8.4)
- [CVE-2026-76832](https://insights.sbomify.com/CVE-2026-76832/): Agno PythonTools Path Traversal via joinpath file_name argument (high 8.5)
- [CVE-2026-7683](https://insights.sbomify.com/CVE-2026-7683/): Edimax BR-6428nC Web setWAN command injection (medium 5.3)
- [CVE-2026-76827](https://insights.sbomify.com/CVE-2026-76827/): Search-indexer: search-indexer: update/delete operations not scoped to caller's cluster (cross-tenant data tampering) (medium 6.8)
- [CVE-2026-76825](https://insights.sbomify.com/CVE-2026-76825/): RestrictedPython: Sandbox escape via string.Formatter field resolution (high 8.4)
- [CVE-2026-76821](https://insights.sbomify.com/CVE-2026-76821/): OpenCTI: User-Controlled ReDoS in JSON Ingestion Mapper (high 7.1)
- [CVE-2026-76820](https://insights.sbomify.com/CVE-2026-76820/): OpenCTI: Synchronizer SSRF: stream fetch has no URL validation (high 7.7)
- [CVE-2026-7682](https://insights.sbomify.com/CVE-2026-7682/): Edimax BR-6208AC L2TP Mode setWAN command injection (medium 5.3)
- [CVE-2026-76816](https://insights.sbomify.com/CVE-2026-76816/): Netty: MQTT Topic Name and Client ID Validation Bypass (low 3.5)
- [CVE-2026-7681](https://insights.sbomify.com/CVE-2026-7681/): jsbroks COCO Annotator Dataset API datasets.py authorization (medium 6.9)
- [CVE-2026-76805](https://insights.sbomify.com/CVE-2026-76805/): Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode (medium 5.3)
- [CVE-2026-76804](https://insights.sbomify.com/CVE-2026-76804/): Nuclei: Local File Read via Workflow File-Protocol Gate Bypass (medium 5.5)
- [CVE-2026-76803](https://insights.sbomify.com/CVE-2026-76803/): Nuclei: Local File Read via MySQL Client Sandbox Bypass (medium 5.3)
- [CVE-2026-76802](https://insights.sbomify.com/CVE-2026-76802/): Nuclei: Arbitrary Command Execution via DAST Code Signature Bypass (medium 4.7)
- [CVE-2026-76801](https://insights.sbomify.com/CVE-2026-76801/): FireBox <= 3.1.10 - Authenticated (Author+) Remote Code Execution to Privilege Escalation (high 8.8)
- [CVE-2026-76800](https://insights.sbomify.com/CVE-2026-76800/): DeDeCMS select_media_post.php unrestricted upload (medium 5.3)
- [CVE-2026-7680](https://insights.sbomify.com/CVE-2026-7680/): jsbroks COCO Annotator Data Endpoint datasets.py path traversal (medium 5.3)
- [CVE-2026-76799](https://insights.sbomify.com/CVE-2026-76799/): code-projects Login Registration System SQL Database Backup login_registration_system.sql file access (medium 6.9)
- [CVE-2026-76798](https://insights.sbomify.com/CVE-2026-76798/): MongoSQL Transition Readiness Tool Improper Output Encoding in Generated HTML Reports (medium 6.9)
- [CVE-2026-76797](https://insights.sbomify.com/CVE-2026-76797/): MongoSQL Transition Readiness Tool Improper Neutralization of Formula Elements in Generated Reports (medium 5.8)
- [CVE-2026-76796](https://insights.sbomify.com/CVE-2026-76796/): Newell Brands DYMO Connect Desktop improper file path validation (medium 5.1)
- [CVE-2026-76795](https://insights.sbomify.com/CVE-2026-76795/): AeternaLabsHQ PullMD REST API Endpoint api server-side request forgery (medium 6.9)
- [CVE-2026-76794](https://insights.sbomify.com/CVE-2026-76794/): MongoDB BI Connector Transition Readiness Report Improper HTML Encoding When Processing Database Metadata (medium 4.8)
- [CVE-2026-76793](https://insights.sbomify.com/CVE-2026-76793/): Firebase Authentication < 1.7.1 - Unauthenticated Account Takeover via Firebase Email Claim (high 8.1)
- [CVE-2026-76790](https://insights.sbomify.com/CVE-2026-76790/): Estatik < 4.3.5 - Reflected XSS via get_listings hash Parameter (high 7.1)
- [CVE-2026-7679](https://insights.sbomify.com/CVE-2026-7679/): YunaiV yudao-cloud OAuth2TokenServiceImpl.java getAccessToken improper authentication (medium 6.9)
- [CVE-2026-76789](https://insights.sbomify.com/CVE-2026-76789/): Slider Hero < 9.1.3 - Unauthenticated Stored XSS via Slider Type Change and Add-Slider Handlers (high 8.8)
- [CVE-2026-76788](https://insights.sbomify.com/CVE-2026-76788/): Stack out-of-bounds write in the OSDP Control Panel reply parser (high 8.8)
- [CVE-2026-76787](https://insights.sbomify.com/CVE-2026-76787/): NULL pointer dereference in the UpdateHub FOTA client when probe metadata omits sha256sum (medium 5.9)
- [CVE-2026-76785](https://insights.sbomify.com/CVE-2026-76785/): amirsanni Mini-Inventory-and-Sales-Management-System Transaction.php getAll sql injection (medium 5.3)
- [CVE-2026-76784](https://insights.sbomify.com/CVE-2026-76784/): Weak cryptography in EP10 (high 8.7)
- [CVE-2026-76783](https://insights.sbomify.com/CVE-2026-76783/): DeDeCMS advancedsearch.php sql injection (medium 6.9)
- [CVE-2026-76782](https://insights.sbomify.com/CVE-2026-76782/): Screenshot - Critical - Unsupported - SA-CONTRIB-2026-102 (high 7.3)
- [CVE-2026-76781](https://insights.sbomify.com/CVE-2026-76781/): Libxml2: libxml2: null pointer dereference parsing nextcatalog without catalog attribute (medium 5.5)
- [CVE-2026-76780](https://insights.sbomify.com/CVE-2026-76780/): BeyondSEO <= 1.3.6 - Missing Authorization to Authenticated (Contributor+) Limited Privilege Escalation (medium 6.3)
- [CVE-2026-7678](https://insights.sbomify.com/CVE-2026-7678/): YunaiV yudao-cloud GoViewDataServiceImpl.java getDataBySQL sql injection (medium 5.3)
- [CVE-2026-76779](https://insights.sbomify.com/CVE-2026-76779/): Auth bypass in Secure Connect Gateway (SCG) Policy Manager (high 7.4)
- [CVE-2026-7677](https://insights.sbomify.com/CVE-2026-7677/): kerwincui FastBee System Notice SysNoticeController.java add cross site scripting (medium 5.1)
- [CVE-2026-76769](https://insights.sbomify.com/CVE-2026-76769/): Missing authorization in Secure Connect Gateway (SCG) Policy Manager (medium 4.3)
- [CVE-2026-76764](https://insights.sbomify.com/CVE-2026-76764/): code-projects Employee Management System Admin Login Endpoint aprocess.php sql injection (medium 6.9)
- [CVE-2026-76763](https://insights.sbomify.com/CVE-2026-76763/): Io.smallrye/smallrye-graphql: smallrye graphql: unauthenticated denial of service via large exponent float literals (high 7.5)
- [CVE-2026-76762](https://insights.sbomify.com/CVE-2026-76762/): code-projects Assessment Management welcome.php sql injection (medium 6.9)
- [CVE-2026-76761](https://insights.sbomify.com/CVE-2026-76761/): chenhg5 cc-connect Management API engine.go shellExecCommand os command injection (medium 6.9)
- [CVE-2026-76760](https://insights.sbomify.com/CVE-2026-76760/): chenhg5 cc-connect webhook.go authenticate code injection (medium 6.9)
- [CVE-2026-7676](https://insights.sbomify.com/CVE-2026-7676/): kerwincui FastBee Tool Download Endpoint ToolController.java ToolController.download path traversal (medium 5.3)
- [CVE-2026-76759](https://insights.sbomify.com/CVE-2026-76759/): Screenshot - Critical - Unsupported - SA-CONTRIB-2026-102 (high 7.3)
- [CVE-2026-76758](https://insights.sbomify.com/CVE-2026-76758/): Link content parser - Critical - Unsupported - SA-CONTRIB-2026-101 (medium 5.9)
- [CVE-2026-76757](https://insights.sbomify.com/CVE-2026-76757/): Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100 (medium 5.9)
- [CVE-2026-76756](https://insights.sbomify.com/CVE-2026-76756/): Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100 (medium 5.9)
- [CVE-2026-76755](https://insights.sbomify.com/CVE-2026-76755/): Gammu SMS Daemon - Critical - Unsupported - SA-CONTRIB-2026-100 (medium 5.9)
- [CVE-2026-76754](https://insights.sbomify.com/CVE-2026-76754/): Unauthenticated SQL Injection Vulnerability leads to Remote Code Execution in ClearPass Policy Manager (critical 9.8)
- [CVE-2026-76753](https://insights.sbomify.com/CVE-2026-76753/): Unauthenticated Format String Vulnerability in HPE Networking ClearPass Policy Manager (critical 9.8)
- [CVE-2026-76752](https://insights.sbomify.com/CVE-2026-76752/): Auth bypass in ClearPass Policy Manager (CPPM) (critical 9.8)
- [CVE-2026-76751](https://insights.sbomify.com/CVE-2026-76751/): Security feature bypass in ClearPass Policy Manager (CPPM) (critical 9.8)
- [CVE-2026-76750](https://insights.sbomify.com/CVE-2026-76750/): Deserialization in ClearPass Policy Manager (CPPM) (critical 9.8)
- [CVE-2026-7675](https://insights.sbomify.com/CVE-2026-7675/): Shenzhen Libituo Technology LBT-T300-HW1 apply.cgi start_lan buffer overflow (high 8.7)
- [CVE-2026-76749](https://insights.sbomify.com/CVE-2026-76749/): Unauthenticated Sensitive Information Disclosure in AOS-S (medium 6.5)
- [CVE-2026-76748](https://insights.sbomify.com/CVE-2026-76748/): Authenticated Privilege Escalation Vulnerability in the API of AOS-S (high 8.8)
- [CVE-2026-76747](https://insights.sbomify.com/CVE-2026-76747/): Unauthenticated Buffer Overflow Vulnerabilities lead to Information Disclosure in AOS-S (critical 9.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/374/