# Vulnerabilities published in 2026


- [CVE-2026-75353](https://insights.sbomify.com/CVE-2026-75353/): OpENer v2.3/ commit 76b95cf, contains an out-of-bounds read in the server-side EtherNet/IP ForwardOpen connection-path parser. (high 7.5)
- [CVE-2026-75352](https://insights.sbomify.com/CVE-2026-75352/): OpENer v2.3/commit 76b95cf, contains an integer underflow in the server-side EtherNet/IP ForwardOpen connection-path parser. (high 7.5)
- [CVE-2026-75351](https://insights.sbomify.com/CVE-2026-75351/): OpENer v2.3/commit 76b95cf, contains an out-of-bounds read in the server-side EtherNet/IP ForwardOpen connection-path parser. (high 7.5)
- [CVE-2026-75350](https://insights.sbomify.com/CVE-2026-75350/): EIPStackGroup OpENer v2.3 / master commit 76b95cf contains a buffer overflow in the GetAttributeList() implementation for the EtherNet/IP Ge (high 7.5)
- [CVE-2026-7535](https://insights.sbomify.com/CVE-2026-7535/): Open5GS transfer-update denial of service (medium 5.3)
- [CVE-2026-75349](https://insights.sbomify.com/CVE-2026-75349/): EIPStackGroup OpENer v2.3.0/master up to commit 76b95cf contains an out-of-bounds read vulnerability in Connection Manager request parsing. (high 7.5)
- [CVE-2026-75348](https://insights.sbomify.com/CVE-2026-75348/): An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master up to commit 76b95cf in the EtherNet/IP TCP SendRRData Co (high 7.5)
- [CVE-2026-75347](https://insights.sbomify.com/CVE-2026-75347/): EIPStackGroup OpENer v2.3 and master up to commit 76b95cf contain an expired pointer dereference vulnerability in the EtherNet/IP Common Pac (high 7.5)
- [CVE-2026-75346](https://insights.sbomify.com/CVE-2026-75346/): An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master through commit 76b95cf in the server-side CIP SetAttributeList service. (high 7.5)
- [CVE-2026-75345](https://insights.sbomify.com/CVE-2026-75345/): OpENer v2.3.0 / commit 76b95cf contains an out-of-bounds read in the unconnected explicit messaging path. (high 7.5)
- [CVE-2026-75340](https://insights.sbomify.com/CVE-2026-75340/): The device metadata import interface /device/instance/{productId}/property-metadata/import of jetlinks community 2.11 is vulnerable to Serve (critical 9.1)
- [CVE-2026-7534](https://insights.sbomify.com/CVE-2026-7534/): SUMO Reward Points for WooCommerce <= 32.7.0 - Unauthenticated Stored Cross-Site Scripting via 'reason' Parameter (high 7.2)
- [CVE-2026-75339](https://insights.sbomify.com/CVE-2026-75339/): The storage endpoint /storage/upload of cjbi admin3 v3.0.0 are missing permission checks. (high 8.8)
- [CVE-2026-75338](https://insights.sbomify.com/CVE-2026-75338/): disconf (Distributed Configuration Management Platform) 2.6.36 is vulnerable to Incorrect Access Control. (critical 9.8)
- [CVE-2026-75337](https://insights.sbomify.com/CVE-2026-75337/): The static resource interface /api/static/{deployKey}/ of Yu AI Code Mother v4.3 is vulnerable to path traversal. (critical 9.8)
- [CVE-2026-75336](https://insights.sbomify.com/CVE-2026-75336/): Funiture 1.0.0 is vulnerable to SQL Injection in the backend tool interfaces /sys/tool/select.json and /sys/tool/update.json. (critical 9.8)
- [CVE-2026-75334](https://insights.sbomify.com/CVE-2026-75334/): The report module in the backend of smart-web2 v1.3.1 is vulnerable to arbitrary SQL execution. (critical 9.8)
- [CVE-2026-75333](https://insights.sbomify.com/CVE-2026-75333/): yx-image-recognition v1.0 is vulnerable to Path Traversal. (high 7.5)
- [CVE-2026-75332](https://insights.sbomify.com/CVE-2026-75332/): Zyplayer-Doc <=1.0.0 is vulnerable to Server-Side Request Forgery (SSRF) via WikiPageWebService.download(). (critical 9.1)
- [CVE-2026-75331](https://insights.sbomify.com/CVE-2026-75331/): tamguo 1.5.3 is vulnerable to Unrestricted File Upload Leading to Stored XSS. (medium 4.6)
- [CVE-2026-75330](https://insights.sbomify.com/CVE-2026-75330/): The front-end interface /superdiamond/preview/{projectCode}/{module}/{type} of super-diamond-server <= 1.3.3 is vulnerable to SQL injection. (critical 9.8)
- [CVE-2026-7533](https://insights.sbomify.com/CVE-2026-7533/): Easy Digital Downloads <= 3.6.7 - Cross-Site Request Forgery to Payment Account Hijacking via 'square_tokens' Parameter (medium 4.3)
- [CVE-2026-75329](https://insights.sbomify.com/CVE-2026-75329/): The Netty configuration distribution service (port 8283) of super-diamond-server <= 1.3.3 has no authentication mechanism. (critical 9.8)
- [CVE-2026-75328](https://insights.sbomify.com/CVE-2026-75328/): In DocSys-master V2.02.85, the downloadDocEx interface in src/com/DocSystem/controller/DocController.java has an arbitrary file read vulnera (high 7.5)
- [CVE-2026-75327](https://insights.sbomify.com/CVE-2026-75327/): In DocSys-master V2.02.85, the uploadMarkdownPic interface in src/com/DocSystem/controller/DocController.java has an arbitrary file upload v (critical 9.8)
- [CVE-2026-75325](https://insights.sbomify.com/CVE-2026-75325/): DWSurvey v6.14.0 is is vulnerable to authentication bypass via the '/api/dwsurvey/none/' and '/api/dwsurvey/up/**' parameters. (critical 9.8)
- [CVE-2026-7532](https://insights.sbomify.com/CVE-2026-7532/): iPAddress name constraints not enforced when WOLFSSL_IP_ALT_NAME is undefined (medium 5.7)
- [CVE-2026-7531](https://insights.sbomify.com/CVE-2026-7531/): Use-after-free in PQC hybrid key-share handling (low 2.3)
- [CVE-2026-75308](https://insights.sbomify.com/CVE-2026-75308/): yshopmall <=3.3 is vulnerable to Cross Site Scripting (XSS). (medium 6.1)
- [CVE-2026-75307](https://insights.sbomify.com/CVE-2026-75307/): zhitan-ems 1.0.0 is vulnerable to Cross Site Scripting (XSS) via SVG file upload through the /equipmentFile/upload endpoint. (medium 6.1)
- [CVE-2026-7529](https://insights.sbomify.com/CVE-2026-7529/): wiseCampaign <= 1.1.16 - Missing Authorization to Unauthenticated Plugin Configuration Modification via REST API (high 7.5)
- [CVE-2026-7528](https://insights.sbomify.com/CVE-2026-7528/): Unauthenticated File Upload Vulnerability Allows Disk Space Exhaustion and Path Disclosure in Langflow OSS (high 7.1)
- [CVE-2026-7527](https://insights.sbomify.com/CVE-2026-7527/): WP Ghost (Hide My WP Ghost) <= 7.0.02 - Unauthenticated Open Redirect via 'redirect_to' Parameter (medium 4.7)
- [CVE-2026-7526](https://insights.sbomify.com/CVE-2026-7526/): PDF Embedder <= 4.9.3 - Authenticated (Contributor+) Information Exposure via Block Editor Page (medium 4.3)
- [CVE-2026-7525](https://insights.sbomify.com/CVE-2026-7525/): Missing authorization in My Calendar – Accessible Event Manager (medium 4.3)
- [CVE-2026-7524](https://insights.sbomify.com/CVE-2026-7524/): Path traversal in Langflow OSS (critical 9.8)
- [CVE-2026-7523](https://insights.sbomify.com/CVE-2026-7523/): Missing authorization in Alba Board (medium 4.3)
- [CVE-2026-7522](https://insights.sbomify.com/CVE-2026-7522/): Advanced Database Cleaner – Premium <= 4.1.0 - Authenticated (Subscriber+) Local File Inclusion via 'template' (high 8.8)
- [CVE-2026-7521](https://insights.sbomify.com/CVE-2026-7521/): SAML certificate deletion allows path traversal to delete arbitrary files outside the config directory (medium 5.5)
- [CVE-2026-7520](https://insights.sbomify.com/CVE-2026-7520/): Missing authorization in Mailmunch Forms for Mailchimp (high 8.1)
- [CVE-2026-7519](https://insights.sbomify.com/CVE-2026-7519/): Fujian Apex LiveBOS Endpoint UploadImage.do path traversal (medium 6.9)
- [CVE-2026-7518](https://insights.sbomify.com/CVE-2026-7518/): Open5GS AMF SBI Endpoint sdmsubscription-notify amf_namf_callback_handle_sdm_data_change_notify denial of service (medium 5.3)
- [CVE-2026-75171](https://insights.sbomify.com/CVE-2026-75171/): An issue in HubCore v.14.1.1 allows a remote attacker to escalate privileges via the HUBCOREID session cookie handling component. (critical 9.8)
- [CVE-2026-75170](https://insights.sbomify.com/CVE-2026-75170/): Cross-site scripting (XSS) vulnerability in the /loginController/doLogin endpoint of the HubCore platform (version 14.1.1) allows a remote u (medium 6.1)
- [CVE-2026-7517](https://insights.sbomify.com/CVE-2026-7517/): Cross-site scripting in Custom Payment Gateways for WooCommerce (high 7.2)
- [CVE-2026-75169](https://insights.sbomify.com/CVE-2026-75169/): An arbitrary file upload vulnerability in /cgi-bin/ugwupload.cgi of MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authenti (high 8.8)
- [CVE-2026-75168](https://insights.sbomify.com/CVE-2026-75168/): An issue in the ugw-editfile method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authenticated (medium 6.3)
- [CVE-2026-75167](https://insights.sbomify.com/CVE-2026-75167/): A broken access control vulnerability in the ugw-usr-edit method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_05 a (medium 4.3)
- [CVE-2026-75166](https://insights.sbomify.com/CVE-2026-75166/): Insecure Permission vulnerability in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows the low-privileged service user to execute /usr/ (high 8.8)
- [CVE-2026-75165](https://insights.sbomify.com/CVE-2026-75165/): An issue in /cgi-bin/wwwugw.cgi of MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authenticated user with the low-privilege (medium 6.5)
- [CVE-2026-75164](https://insights.sbomify.com/CVE-2026-75164/): An arbitrary file read vulnerability in /cgi-bin/ugwdownload.cgi of MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authenti (medium 6.5)
- [CVE-2026-75163](https://insights.sbomify.com/CVE-2026-75163/): An information disclosure vulnerability in the ugw-deviceinfo method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_ (medium 6.5)
- [CVE-2026-75162](https://insights.sbomify.com/CVE-2026-75162/): An information disclosure vulnerability in the opcua-configuration method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V (medium 6.5)
- [CVE-2026-75161](https://insights.sbomify.com/CVE-2026-75161/): An issue in the ugw-restart method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authenticated u (high 8.8)
- [CVE-2026-75160](https://insights.sbomify.com/CVE-2026-75160/): An issue in X-Serie Gateway Firmware V6_00_05 allows a remote attacker to escalate privileges via the endpoints /cgi-bin/wwwugw.cgi and /cgi-bin/ugwdownload.cgi. (critical 9.1)
- [CVE-2026-7516](https://insights.sbomify.com/CVE-2026-7516/): Other in Application (medium 5.1)
- [CVE-2026-75159](https://insights.sbomify.com/CVE-2026-75159/): MongoDB BI Connector Improper Memory Handling During Failed Kerberos Authentication May Cause Process Termination (high 8.2)
- [CVE-2026-75158](https://insights.sbomify.com/CVE-2026-75158/): Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter (medium 4.3)
- [CVE-2026-75157](https://insights.sbomify.com/CVE-2026-75157/): Missing authorization in Apache Airflow (high 7.5)
- [CVE-2026-75156](https://insights.sbomify.com/CVE-2026-75156/): Auth bypass in Apache Airflow FAB provider (critical 9.1)
- [CVE-2026-75151](https://insights.sbomify.com/CVE-2026-75151/): SourceCodester Onlne Examination & Learning Management System cross-site request forgery (medium 5.3)
- [CVE-2026-7515](https://insights.sbomify.com/CVE-2026-7515/): BetterDocs Pro <= 3.8.0 - Unauthenticated Local File Inclusion via doc_style (critical 9.8)
- [CVE-2026-75149](https://insights.sbomify.com/CVE-2026-75149/): marimo < 0.23.15 Code Injection via MCP Server Configuration (high 8.7)
- [CVE-2026-75148](https://insights.sbomify.com/CVE-2026-75148/): cgltf 1.15 Integer Overflow via cgltf_validate() Accessor Bounds Check (medium 6.9)
- [CVE-2026-75147](https://insights.sbomify.com/CVE-2026-75147/): FFmpeg Out-of-Bounds Read in AV1 RTP Packetizer via rtpenc_av1.c (medium 6.9)
- [CVE-2026-75146](https://insights.sbomify.com/CVE-2026-75146/): FFmpeg Out-of-Bounds Read in DASH Demuxer via dashdec.c (high 7.2)
- [CVE-2026-75145](https://insights.sbomify.com/CVE-2026-75145/): FFmpeg Integer Narrowing Conversion OOB Memory Access in AV1 RTP Packetizer (medium 5.8)
- [CVE-2026-75144](https://insights.sbomify.com/CVE-2026-75144/): FFmpeg Heap Buffer Overflow in VC-2/Dirac RTP Packetizer (high 8.5)
- [CVE-2026-75143](https://insights.sbomify.com/CVE-2026-75143/): FFmpeg Heap Buffer Overflow via RIST Protocol Reader (critical 9.3)
- [CVE-2026-75142](https://insights.sbomify.com/CVE-2026-75142/): FFmpeg Stack Buffer Overflow in MPEG-PS Muxer via mpegenc.c (high 8.5)
- [CVE-2026-75141](https://insights.sbomify.com/CVE-2026-75141/): FFmpeg Heap Buffer Overflow in hvcC Box Writer via HEVC Muxing (high 8.5)
- [CVE-2026-75140](https://insights.sbomify.com/CVE-2026-75140/): jsoup Uncontrolled Resource Consumption in XmlTreeBuilder (high 8.7)
- [CVE-2026-7514](https://insights.sbomify.com/CVE-2026-7514/): Missing Authorization in GitLab (medium 4.3)
- [CVE-2026-75137](https://insights.sbomify.com/CVE-2026-75137/): UpSignOn < 7.19.0 Sensitive Data Exposure in Process Memory after Lock (medium 6.9)
- [CVE-2026-75136](https://insights.sbomify.com/CVE-2026-75136/): UpSignOn < 7.19.0 Biometric Key Exposure via Windows PasswordVault (medium 6.9)
- [CVE-2026-75135](https://insights.sbomify.com/CVE-2026-75135/): UpSignOn < 7.19.0 Sensitive Key Retention in Memory (medium 6.9)
- [CVE-2026-75134](https://insights.sbomify.com/CVE-2026-75134/): SEOWriting WordPress Plugin 1.12.5 Stored XSS via iframe onload (medium 5.1)
- [CVE-2026-75133](https://insights.sbomify.com/CVE-2026-75133/): Keep Backup Daily WordPress Plugin < 2.1.4 Sensitive Information Exposure via kbd_cron_process (high 8.7)
- [CVE-2026-75132](https://insights.sbomify.com/CVE-2026-75132/): WAPT Server SQL Injection via /api/v3/hosts Endpoint (high 7.1)
- [CVE-2026-75131](https://insights.sbomify.com/CVE-2026-75131/): NetworkManager-l2tp Privilege Escalation via pppd Username Injection (high 8.5)
- [CVE-2026-75130](https://insights.sbomify.com/CVE-2026-75130/): Context7 2.1.2 Prompt Injection via Custom AI Instructions (medium 6.4)
- [CVE-2026-7513](https://insights.sbomify.com/CVE-2026-7513/): UTT HiPER 1200GW formRemoteControl strcpy buffer overflow (high 8.7)
- [CVE-2026-75128](https://insights.sbomify.com/CVE-2026-75128/): Langchain-Chatchat through 0.3.1.3 Unauthenticated RCE via /tools/call Endpoint (critical 9.3)
- [CVE-2026-75126](https://insights.sbomify.com/CVE-2026-75126/): PLANET GS-4210-16P2S V3 Stack Buffer Overflow via dispatcher.cgi Standard Handlers (medium 6.9)
- [CVE-2026-75125](https://insights.sbomify.com/CVE-2026-75125/): PLANET GS-4210-16P2S V3 Null Pointer Dereference DoS via dispatcher.cgi web_poe_alive_rmtip_post (medium 6.9)
- [CVE-2026-75124](https://insights.sbomify.com/CVE-2026-75124/): PLANET GS-4210-16P2S V3 Memory Corruption via dispatcher.cgi _readHttpParam (high 8.7)
- [CVE-2026-75123](https://insights.sbomify.com/CVE-2026-75123/): PLANET GS-4210-16P2S V3 Command Injection via dispatcher.cgi web_smtp_test_post (high 8.6)
- [CVE-2026-75122](https://insights.sbomify.com/CVE-2026-75122/): PLANET GS-4210-16P2S V3 Command Injection via httpuploadcert.cgi (high 8.6)
- [CVE-2026-75121](https://insights.sbomify.com/CVE-2026-75121/): PLANET GS-4210-16P2S V3 Command Injection via dispatcher.cgi web_vlan_membership_edit_dialog_post (high 8.6)
- [CVE-2026-75120](https://insights.sbomify.com/CVE-2026-75120/): Remote Code Execution (RCE) vulnerability identified in the OpenText™ EnCase SAFE Agents (critical 9.3)
- [CVE-2026-7512](https://insights.sbomify.com/CVE-2026-7512/): UTT HiPER 1200GW formUser strcpy buffer overflow (high 8.7)
- [CVE-2026-75118](https://insights.sbomify.com/CVE-2026-75118/): http_gdpr_decrypt Pre-Authentication Stack-Based Buffer Overflow (high 8.7)
- [CVE-2026-75115](https://insights.sbomify.com/CVE-2026-75115/): Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.0-5.0.40 (high 7.0)
- [CVE-2026-75114](https://insights.sbomify.com/CVE-2026-75114/): Joomla Extension - yootheme.com - Open redirect in CommentController::twitterAuthenticate() in Zoo < 4.1.64 (medium 5.1)
- [CVE-2026-75112](https://insights.sbomify.com/CVE-2026-75112/): OTTO® Fleet Manager – Weak Password Hashing Configuration (medium 6.9)
- [CVE-2026-75111](https://insights.sbomify.com/CVE-2026-75111/): Evidently UI Path Traversal via Dataset Materialization Filename (high 8.7)
- [CVE-2026-75110](https://insights.sbomify.com/CVE-2026-75110/): MemOS Authentication Bypass via Unset INTERNAL_SERVICE_SECRET (critical 9.3)
- [CVE-2026-7511](https://insights.sbomify.com/CVE-2026-7511/): PKCS7_verify signer confusion allows forged signatures to be accepted (medium 5.9)
- [CVE-2026-75109](https://insights.sbomify.com/CVE-2026-75109/): Determined Missing Authorization Check on Generic Task Endpoints (high 7.1)
- [CVE-2026-75108](https://insights.sbomify.com/CVE-2026-75108/): Next Terminal Missing Per-Asset Authorization on Portal Endpoints (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/386/