# Vulnerabilities published in 2026


- [CVE-2026-72608](https://insights.sbomify.com/CVE-2026-72608/): Koha Community Koha - Stored SQL Injection via Patron Card Layout image_name (medium 6.5)
- [CVE-2026-72607](https://insights.sbomify.com/CVE-2026-72607/): Koha Community Koha - Stored SQL Injection via agefield in Automatic Item Modifications by Age (high 7.1)
- [CVE-2026-72606](https://insights.sbomify.com/CVE-2026-72606/): Pinry Pinry - Server-Side Request Forgery (high 7.5)
- [CVE-2026-72605](https://insights.sbomify.com/CVE-2026-72605/): Swing Music Swing Music - Missing Authentication (high 7.5)
- [CVE-2026-72604](https://insights.sbomify.com/CVE-2026-72604/): Intelliants Subrion CMS - Path Traversal (medium 6.5)
- [CVE-2026-72603](https://insights.sbomify.com/CVE-2026-72603/): wg-easy wg-easy - OS Command Injection (critical 9.9)
- [CVE-2026-72602](https://insights.sbomify.com/CVE-2026-72602/): AsyncFuncAI deepwiki-open - Path Traversal (high 7.5)
- [CVE-2026-72601](https://insights.sbomify.com/CVE-2026-72601/): CSZ CMS CSZ CMS - Broken Access Control (high 7.5)
- [CVE-2026-72600](https://insights.sbomify.com/CVE-2026-72600/): Idurar IDURAR ERP CRM - Broken Access Control (high 7.5)
- [CVE-2026-7260](https://insights.sbomify.com/CVE-2026-7260/): Stack overflow in phar with circular symlinks (medium 5.4)
- [CVE-2026-72599](https://insights.sbomify.com/CVE-2026-72599/): e107 e107 - SQL Injection (critical 9.8)
- [CVE-2026-72598](https://insights.sbomify.com/CVE-2026-72598/): Apioo Fusio - Server-Side Request Forgery (medium 6.5)
- [CVE-2026-72597](https://insights.sbomify.com/CVE-2026-72597/): Friendica Friendica - Server-Side Request Forgery (medium 6.5)
- [CVE-2026-72596](https://insights.sbomify.com/CVE-2026-72596/): Ghost Foundation Ghost - Broken Access Control (high 8.1)
- [CVE-2026-72595](https://insights.sbomify.com/CVE-2026-72595/): BadChoice Handesk - Broken Access Control (high 8.1)
- [CVE-2026-72594](https://insights.sbomify.com/CVE-2026-72594/): lobehub lobe-chat - Stored Cross-Site Scripting via Unrestricted SVG Avatar Upload (high 7.6)
- [CVE-2026-72593](https://insights.sbomify.com/CVE-2026-72593/): dulldusk phpfm - Missing Authentication by Default Allows Full Filesystem Access (critical 9.8)
- [CVE-2026-72592](https://insights.sbomify.com/CVE-2026-72592/): dulldusk phpfm - Unauthenticated Remote Code Execution via Unrestricted PHP File Upload (critical 9.8)
- [CVE-2026-72591](https://insights.sbomify.com/CVE-2026-72591/): Koito - Authenticated Server-Side Request Forgery via Album Image URL Parameter (high 7.7)
- [CVE-2026-72590](https://insights.sbomify.com/CVE-2026-72590/): alseambusher crontab-ui - Unauthenticated RCE via Newline Injection in env_vars Parameter (critical 9.8)
- [CVE-2026-7259](https://insights.sbomify.com/CVE-2026-7259/): Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init() (low 2.1)
- [CVE-2026-72589](https://insights.sbomify.com/CVE-2026-72589/): alseambusher crontab-ui - Unauthenticated RCE via Shell Injection in Imported Database hook Field (critical 9.8)
- [CVE-2026-72588](https://insights.sbomify.com/CVE-2026-72588/): bluewave-labs Checkmate - User Enumeration via Differential HTTP Response in Password Recovery (medium 5.3)
- [CVE-2026-72587](https://insights.sbomify.com/CVE-2026-72587/): Instatic - Cache Poisoning via Unauthenticated Server Island Endpoint (medium 6.1)
- [CVE-2026-72586](https://insights.sbomify.com/CVE-2026-72586/): frangoteam FUXA - Missing Authentication on DAQ_QUERY Socket.IO Event Handler (high 7.5)
- [CVE-2026-72584](https://insights.sbomify.com/CVE-2026-72584/): fastschema - TOCTOU Race Condition Bypasses OTP Attempt Limit in Account Recovery (high 7.4)
- [CVE-2026-72583](https://insights.sbomify.com/CVE-2026-72583/): fastschema - Stored Cross-Site Scripting via MIME Type Bypass in File Upload (medium 5.4)
- [CVE-2026-72582](https://insights.sbomify.com/CVE-2026-72582/): fastschema - Unauthenticated NULL Pointer Dereference DoS in Account Recovery Endpoint (high 7.5)
- [CVE-2026-72581](https://insights.sbomify.com/CVE-2026-72581/): duhow xiaoai-patch - Server-Side Request Forgery in /auth Endpoint (high 8.6)
- [CVE-2026-72580](https://insights.sbomify.com/CVE-2026-72580/): duhow xiaoai-patch - OS Command Injection in /mute and /unmute Endpoints (critical 9.8)
- [CVE-2026-7258](https://insights.sbomify.com/CVE-2026-7258/): Out-of-bounds read in urldecode() on NetBSD (medium 6.3)
- [CVE-2026-72579](https://insights.sbomify.com/CVE-2026-72579/): NASA HyperCP - OS Command Injection via Malicious HTTP Response from Data Server (high 7.5)
- [CVE-2026-72578](https://insights.sbomify.com/CVE-2026-72578/): FreePBX Framework - Missing CSRF Protection in Admin Panel Ajax Dispatcher (high 8.8)
- [CVE-2026-72577](https://insights.sbomify.com/CVE-2026-72577/): NASA fprime-gds - Missing Authentication and Path Traversal Enable Unauthenticated RCE and Spacecraft Command Injection (critical 9.8)
- [CVE-2026-72576](https://insights.sbomify.com/CVE-2026-72576/): Bludit - Stored Cross-Site Scripting via Malicious SVG Logo Upload (medium 5.4)
- [CVE-2026-72575](https://insights.sbomify.com/CVE-2026-72575/): daptin - Authentication Bypass via Null Owner Permission Check on usergroup Objects (critical 9.1)
- [CVE-2026-72574](https://insights.sbomify.com/CVE-2026-72574/): picocms Pico - Host Header Injection Enables Script Source Hijacking (medium 6.1)
- [CVE-2026-72573](https://insights.sbomify.com/CVE-2026-72573/): 4xmen pm2panel - Authenticated OS Command Injection via id Query Parameter (high 8.8)
- [CVE-2026-72572](https://insights.sbomify.com/CVE-2026-72572/): o1lab xmysql - Unauthenticated Path Traversal via name Query Parameter (high 7.5)
- [CVE-2026-72571](https://insights.sbomify.com/CVE-2026-72571/): mustafaakin cast-localvideo - Unauthenticated Path Traversal via dir Parameter (high 7.5)
- [CVE-2026-72570](https://insights.sbomify.com/CVE-2026-72570/): cube-root directory-serve - Stored Cross-Site Scripting via Malicious Filename (medium 5.4)
- [CVE-2026-7257](https://insights.sbomify.com/CVE-2026-7257/): Information disclosure in WRE6505 v2 firmware (medium 4.4)
- [CVE-2026-72569](https://insights.sbomify.com/CVE-2026-72569/): cube-root directory-serve - Unauthenticated Path Traversal Arbitrary File Deletion (critical 9.1)
- [CVE-2026-72567](https://insights.sbomify.com/CVE-2026-72567/): deepwiki-open - Unauthenticated Path Traversal Leading to Arbitrary File Write and Delete (critical 9.8)
- [CVE-2026-72566](https://insights.sbomify.com/CVE-2026-72566/): automatisch - Server-Side Request Forgery via HTTP Request Custom Action (high 7.7)
- [CVE-2026-72565](https://insights.sbomify.com/CVE-2026-72565/): Tencent APIJSON - Unauthenticated SQL Injection via @having Operator Map-Form Bypass (critical 9.8)
- [CVE-2026-72564](https://insights.sbomify.com/CVE-2026-72564/): fosrl Pangolin - Access Token Scope Bypass Allows Cross-Resource Authentication (critical 9.6)
- [CVE-2026-72563](https://insights.sbomify.com/CVE-2026-72563/): BadChoice Handesk - Broken Access Control (high 8.1)
- [CVE-2026-72562](https://insights.sbomify.com/CVE-2026-72562/): Pimcore pimcore admin-ui-classic-bundle - SQL Injection (high 8.8)
- [CVE-2026-72561](https://insights.sbomify.com/CVE-2026-72561/): Peppermint Lab Peppermint - Broken Access Control (high 8.8)
- [CVE-2026-72560](https://insights.sbomify.com/CVE-2026-72560/): HumanSignal Label Studio - Server-Side Request Forgery (medium 6.5)
- [CVE-2026-7256](https://insights.sbomify.com/CVE-2026-7256/): Command injection in WRE6505 v2 firmware (high 8.8)
- [CVE-2026-72559](https://insights.sbomify.com/CVE-2026-72559/): Daniel Brendel HortusFox - Cross-Site Scripting (medium 5.4)
- [CVE-2026-72558](https://insights.sbomify.com/CVE-2026-72558/): CiviCRM CiviCRM - SQL Injection (high 8.8)
- [CVE-2026-72557](https://insights.sbomify.com/CVE-2026-72557/): Cockpit CMS Cockpit CMS - Unrestricted File Upload (high 8.8)
- [CVE-2026-72556](https://insights.sbomify.com/CVE-2026-72556/): ZoneMinder ZoneMinder - Remote Code Execution (high 8.8)
- [CVE-2026-72555](https://insights.sbomify.com/CVE-2026-72555/): Peppermint Lab Peppermint - Broken Access Control (high 8.1)
- [CVE-2026-72554](https://insights.sbomify.com/CVE-2026-72554/): Ladybird Web Solution Faveo Helpdesk - Broken Access Control (medium 6.5)
- [CVE-2026-72553](https://insights.sbomify.com/CVE-2026-72553/): ElkArte Forum ElkArte - Cross-Site Scripting (medium 5.4)
- [CVE-2026-72552](https://insights.sbomify.com/CVE-2026-72552/): Dub Dub - Server-Side Request Forgery (high 7.5)
- [CVE-2026-72551](https://insights.sbomify.com/CVE-2026-72551/): Apioo Fusio - Remote Code Execution (high 8.8)
- [CVE-2026-72550](https://insights.sbomify.com/CVE-2026-72550/): Friendica Friendica - SQL Injection (critical 9.8)
- [CVE-2026-7255](https://insights.sbomify.com/CVE-2026-7255/): Auth bypass in WRE6505 v2 firmware (medium 6.5)
- [CVE-2026-72549](https://insights.sbomify.com/CVE-2026-72549/): OpenSignLabs OpenSign - Information Disclosure (medium 5.3)
- [CVE-2026-72548](https://insights.sbomify.com/CVE-2026-72548/): OpenSignLabs OpenSign - Information Disclosure (high 7.5)
- [CVE-2026-72547](https://insights.sbomify.com/CVE-2026-72547/): Attendize Attendize - Insecure Direct Object Reference (high 7.1)
- [CVE-2026-72546](https://insights.sbomify.com/CVE-2026-72546/): Attendize Attendize - Insecure Direct Object Reference (high 7.1)
- [CVE-2026-72545](https://insights.sbomify.com/CVE-2026-72545/): OpenSignLabs OpenSign - Insecure Direct Object Reference (high 7.5)
- [CVE-2026-72544](https://insights.sbomify.com/CVE-2026-72544/): OpenSignLabs OpenSign - Insufficient Verification of Data Authenticity (high 7.5)
- [CVE-2026-72543](https://insights.sbomify.com/CVE-2026-72543/): OpenSignLabs OpenSign - Insecure Direct Object Reference (high 7.5)
- [CVE-2026-72542](https://insights.sbomify.com/CVE-2026-72542/): Windmill Labs Windmill - Missing Authorization (medium 5.4)
- [CVE-2026-72541](https://insights.sbomify.com/CVE-2026-72541/): Windmill Labs Windmill - Missing Authorization (medium 6.5)
- [CVE-2026-7254](https://insights.sbomify.com/CVE-2026-7254/): Open BMC Denial of Service (medium 5.3)
- [CVE-2026-72539](https://insights.sbomify.com/CVE-2026-72539/): Windmill Labs Windmill - Information Disclosure (medium 6.5)
- [CVE-2026-72538](https://insights.sbomify.com/CVE-2026-72538/): PrefectHQ Prefect - Argument Injection (high 8.8)
- [CVE-2026-72537](https://insights.sbomify.com/CVE-2026-72537/): Authentik Security authentik - Privilege Escalation (high 8.8)
- [CVE-2026-72536](https://insights.sbomify.com/CVE-2026-72536/): Chaskiq Chaskiq - Missing Authentication (high 8.2)
- [CVE-2026-72535](https://insights.sbomify.com/CVE-2026-72535/): Chaskiq Chaskiq - Missing Authentication (high 8.2)
- [CVE-2026-72534](https://insights.sbomify.com/CVE-2026-72534/): Authentik Security authentik - Privilege Escalation (high 8.8)
- [CVE-2026-72533](https://insights.sbomify.com/CVE-2026-72533/): Portainer Portainer CE - Authentication Bypass (high 8.8)
- [CVE-2026-72532](https://insights.sbomify.com/CVE-2026-72532/): Joomla! Core - [20260805] - Improper ACL checks for category webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 (medium 5.1)
- [CVE-2026-72531](https://insights.sbomify.com/CVE-2026-72531/): Missing authorization in Joomla! CMS (medium 5.1)
- [CVE-2026-72530](https://insights.sbomify.com/CVE-2026-72530/): TrueConf Server Code Injection (critical 9.5, exploited in the wild)
- [CVE-2026-7253](https://insights.sbomify.com/CVE-2026-7253/): IBM Sterling File Gateway SQL Injection (medium 6.0)
- [CVE-2026-72529](https://insights.sbomify.com/CVE-2026-72529/): TrueConf Server Missing Authentication for Critical Function (critical 9.3, exploited in the wild)
- [CVE-2026-72528](https://insights.sbomify.com/CVE-2026-72528/): Open redirect in "Creema - Handmade Marketplace App" for iOS (medium 5.1)
- [CVE-2026-72526](https://insights.sbomify.com/CVE-2026-72526/): Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2.11 (critical 9.9)
- [CVE-2026-72524](https://insights.sbomify.com/CVE-2026-72524/): Apache Doris: Authorization bypass allowing a low-privilege user to read/write/drop arbitrary tables (high 8.8)
- [CVE-2026-72522](https://insights.sbomify.com/CVE-2026-72522/): Memory corruption in libexpat (medium 6.2)
- [CVE-2026-7252](https://insights.sbomify.com/CVE-2026-7252/): WP-Optimize <= 4.5.2 - Authenticated (Author+) Arbitrary File Deletion via 'original-file' Post Meta (high 8.1)
- [CVE-2026-72510](https://insights.sbomify.com/CVE-2026-72510/): Toptech TMS7 and TopHAT SQL Injection (high 8.5)
- [CVE-2026-7251](https://insights.sbomify.com/CVE-2026-7251/): Eppendorf BioFlo 320 Use of hard-coded password (critical 9.3)
- [CVE-2026-72508](https://insights.sbomify.com/CVE-2026-72508/): Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2.11 (critical 9.9)
- [CVE-2026-72507](https://insights.sbomify.com/CVE-2026-72507/): Toptech TMS7 and TopHAT SQL Injection (high 8.5)
- [CVE-2026-72506](https://insights.sbomify.com/CVE-2026-72506/): Other in "VoiceTra(Voice Translator)" for Android (medium 5.1)
- [CVE-2026-72502](https://insights.sbomify.com/CVE-2026-72502/): tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) (high 7.5)
- [CVE-2026-72501](https://insights.sbomify.com/CVE-2026-72501/): RDMA/bnxt_re: Initialize dpi variable to zero (not scored)
- [CVE-2026-72500](https://insights.sbomify.com/CVE-2026-72500/): RDMA/bnxt_re: Free SRQ toggle page after firmware teardown (high 8.8)
- [CVE-2026-7250](https://insights.sbomify.com/CVE-2026-7250/): Allocation of Resources Without Limits or Throttling in GitLab (high 7.5)
- [CVE-2026-72499](https://insights.sbomify.com/CVE-2026-72499/): RDMA/bnxt_re: Free CQ toggle page after firmware teardown (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/409/