# Vulnerabilities published in 2026


- [CVE-2026-71932](https://insights.sbomify.com/CVE-2026-71932/): DrayTek VigorSwitch Multiple Models Path Traversal via getSyslogFile (medium 6.9)
- [CVE-2026-71931](https://insights.sbomify.com/CVE-2026-71931/): DrayTek VigorSwitch Multiple Models OS Command Injection via tftp_upgrade (high 8.6)
- [CVE-2026-71930](https://insights.sbomify.com/CVE-2026-71930/): DrayTek VigorSwitch Multiple Models OS Command Injection via setTime (high 8.6)
- [CVE-2026-7193](https://insights.sbomify.com/CVE-2026-7193/): Multiple vulnerabilities in the T-CPE301K 4G Mini WiFi Router from Shenzhen Dbit Network Equipment (high 8.6)
- [CVE-2026-71929](https://insights.sbomify.com/CVE-2026-71929/): DrayTek VigorSwitch Multiple Models OS Command Injection via setDevProto (high 8.6)
- [CVE-2026-71928](https://insights.sbomify.com/CVE-2026-71928/): DrayTek VigorSwitch Multiple Models OS Command Injection via fdftDevice (high 8.6)
- [CVE-2026-71927](https://insights.sbomify.com/CVE-2026-71927/): DrayTek VigorSwitch Multiple Models OS Command Injection via rebDevice (high 8.6)
- [CVE-2026-71926](https://insights.sbomify.com/CVE-2026-71926/): DrayTek VigorSwitch Multiple Models OS Command Injection via setDevice (high 8.6)
- [CVE-2026-71925](https://insights.sbomify.com/CVE-2026-71925/): DrayTek VigorSwitch Multiple Models OS Command Injection via getDetail (high 8.6)
- [CVE-2026-71924](https://insights.sbomify.com/CVE-2026-71924/): DrayTek VigorSwitch Multiple Models OS Command Injection via getVid (high 8.6)
- [CVE-2026-71923](https://insights.sbomify.com/CVE-2026-71923/): DrayTek VigorSwitch Multiple Models OS Command Injection via auth_set (high 8.6)
- [CVE-2026-71922](https://insights.sbomify.com/CVE-2026-71922/): DrayTek VigorSwitch Multiple Models Pre-Authentication NULL Pointer Dereference via setget.cgi (high 8.7)
- [CVE-2026-71921](https://insights.sbomify.com/CVE-2026-71921/): DrayTek VigorSwitch Multiple Models Pre-Authentication OS Command Injection via setget.cgi (critical 9.3)
- [CVE-2026-71920](https://insights.sbomify.com/CVE-2026-71920/): DrayTek VigorSwitch Multiple Models NULL Pointer Dereference via formlogout (medium 6.9)
- [CVE-2026-7192](https://insights.sbomify.com/CVE-2026-7192/): Multiple vulnerabilities in the T-CPE301K 4G Mini WiFi Router from Shenzhen Dbit Network Equipment (critical 9.3)
- [CVE-2026-71919](https://insights.sbomify.com/CVE-2026-71919/): DrayTek VigorSwitch Multiple Models OS Command Injection via sysreboot (high 8.6)
- [CVE-2026-71918](https://insights.sbomify.com/CVE-2026-71918/): DrayTek VigorSwitch Multiple Models OS Command Injection via webBackupAction (high 8.6)
- [CVE-2026-71917](https://insights.sbomify.com/CVE-2026-71917/): DrayTek VigorSwitch Multiple Models OS Command Injection via pingtrace (high 8.6)
- [CVE-2026-71916](https://insights.sbomify.com/CVE-2026-71916/): DrayTek VigorSwitch Multiple Models OS Command Injection via commandTable (high 8.6)
- [CVE-2026-71915](https://insights.sbomify.com/CVE-2026-71915/): DrayTek VigorSwitch Multiple Models OS Command Injection via jsonstatus (high 8.6)
- [CVE-2026-71914](https://insights.sbomify.com/CVE-2026-71914/): DrayTek VigorAP Multiple Models Pre-Authentication OS Command Injection via dray_apm (critical 9.3)
- [CVE-2026-71913](https://insights.sbomify.com/CVE-2026-71913/): DrayTek VigorAP Multiple Models OS Command Injection via upload_settings.cgi (high 8.6)
- [CVE-2026-71912](https://insights.sbomify.com/CVE-2026-71912/): DrayTek VigorAP Multiple Models Buffer Overflow via apautotest (high 8.6)
- [CVE-2026-71911](https://insights.sbomify.com/CVE-2026-71911/): DrayTek VigorAP Multiple Models Buffer Overflow via setLan (high 8.6)
- [CVE-2026-71910](https://insights.sbomify.com/CVE-2026-71910/): DrayTek VigorAP Multiple Models OS Command Injection via apautotest (high 8.6)
- [CVE-2026-7191](https://insights.sbomify.com/CVE-2026-7191/): Arbitrary Code Execution via Sandbox Bypass in the open source solution QnABot on AWS (high 8.6)
- [CVE-2026-71909](https://insights.sbomify.com/CVE-2026-71909/): DrayTek VigorAP Multiple Models OS Command Injection via InquierTime (high 8.6)
- [CVE-2026-71908](https://insights.sbomify.com/CVE-2026-71908/): DrayTek VigorAP Multiple Models OS Command Injection via mesh_start_speed_test (high 8.6)
- [CVE-2026-71907](https://insights.sbomify.com/CVE-2026-71907/): DrayTek VigorAP Multiple Models OS Command Injection via setcamset (high 8.6)
- [CVE-2026-71906](https://insights.sbomify.com/CVE-2026-71906/): DrayTek VigorAP Multiple Models OS Command Injection via setLan (high 8.6)
- [CVE-2026-71905](https://insights.sbomify.com/CVE-2026-71905/): DrayTek VigorAP Multiple Models OS Command Injection via ExportSettings (high 8.6)
- [CVE-2026-71904](https://insights.sbomify.com/CVE-2026-71904/): DrayTek VigorAP Multiple Models OS Command Injection via tr069TestInform (high 8.6)
- [CVE-2026-7190](https://insights.sbomify.com/CVE-2026-7190/): Reflected Cross-Site Scripting in ICT Innovations’ PHP-CGI/PHP-FPM configuration (medium 5.1)
- [CVE-2026-71899](https://insights.sbomify.com/CVE-2026-71899/): Apache DolphinScheduler: Missing Authorization in query-dynamic-sub-workflows API Leads to Information Disclosure (medium 6.5)
- [CVE-2026-71898](https://insights.sbomify.com/CVE-2026-71898/): Missing authorization in Apache DolphinScheduler (medium 4.3)
- [CVE-2026-71897](https://insights.sbomify.com/CVE-2026-71897/): Apache DolphinScheduler: Allows unauthorized workflow operations through batch-copy and batch-move endpoints (medium 4.3)
- [CVE-2026-71896](https://insights.sbomify.com/CVE-2026-71896/): Apache DolphinScheduler: Missing Authorization Checks Allow Unauthorized Disclosure of User Account Information (medium 6.5)
- [CVE-2026-71895](https://insights.sbomify.com/CVE-2026-71895/): Apache DolphinScheduler: Missing Authorization Checks Allow Non-Admin Users to Retrieve Kubernetes Credentials (high 7.1)
- [CVE-2026-71892](https://insights.sbomify.com/CVE-2026-71892/): CMS key-transport recipient key-size validation never runs for RFC 9709 HKDF-derived keys (medium 6.9)
- [CVE-2026-71891](https://insights.sbomify.com/CVE-2026-71891/): BLS12-381 key validation accepts a public key built on a foreign curve (high 7.1)
- [CVE-2026-71890](https://insights.sbomify.com/CVE-2026-71890/): MLS external commit can remove an arbitrary group member (high 8.7)
- [CVE-2026-7189](https://insights.sbomify.com/CVE-2026-7189/): Sensitive Data Exposure in Proliz's OBS (high 7.5)
- [CVE-2026-71889](https://insights.sbomify.com/CVE-2026-71889/): PKIXCertPathReviewer does not apply X.509 name constraints to the target certificate (high 8.7)
- [CVE-2026-71888](https://insights.sbomify.com/CVE-2026-71888/): CMS AuthenticatedData exposes attacker-inserted authAttrs when digestAlgorithm is absent (high 8.7)
- [CVE-2026-71887](https://insights.sbomify.com/CVE-2026-71887/): OpenPGP data signature accepted from a signing subkey without cross-certification (high 8.2)
- [CVE-2026-71886](https://insights.sbomify.com/CVE-2026-71886/): OpenPGP certification accepted from a subkey without certification authority (high 8.2)
- [CVE-2026-71885](https://insights.sbomify.com/CVE-2026-71885/): MLS X.509 credential not bound to the LeafNode signature key (critical 9.2)
- [CVE-2026-71884](https://insights.sbomify.com/CVE-2026-71884/): Packet CTR reports a full success length after the counter is exhausted (high 8.2)
- [CVE-2026-71883](https://insights.sbomify.com/CVE-2026-71883/): Native AES packet cipher returns the raw AES key on an alias (high 8.2)
- [CVE-2026-71880](https://insights.sbomify.com/CVE-2026-71880/): Server-side template injection in Integrated Publishing Toolkit (high 7.6)
- [CVE-2026-7188](https://insights.sbomify.com/CVE-2026-7188/): SQLi in Armiya Information Technologies' Access Control System (critical 9.8)
- [CVE-2026-71879](https://insights.sbomify.com/CVE-2026-71879/): Authentication bypass in Integrated Publishing Toolkit (critical 9.1)
- [CVE-2026-71878](https://insights.sbomify.com/CVE-2026-71878/): Authentication bypass in Integrated Publishing Toolkit (critical 9.2)
- [CVE-2026-71871](https://insights.sbomify.com/CVE-2026-71871/): Orval: Import-time RCE via header-parameter default -> zod module-level template literal (critical 9.3)
- [CVE-2026-71870](https://insights.sbomify.com/CVE-2026-71870/): pypdf: Possible large memory usage for large /ToUnicode streams (medium 4.8)
- [CVE-2026-7187](https://insights.sbomify.com/CVE-2026-7187/): Improper Authentication in Universal Sotware's UKBS (high 8.8)
- [CVE-2026-71869](https://insights.sbomify.com/CVE-2026-71869/): Orval: Import-time RCE via array-items default -> zod module-level template literal (critical 9.3)
- [CVE-2026-71868](https://insights.sbomify.com/CVE-2026-71868/): Orval: Import-time RCE via enum-typed default -> zod module-level template literal (critical 9.3)
- [CVE-2026-71867](https://insights.sbomify.com/CVE-2026-71867/): Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator (critical 9.3)
- [CVE-2026-71866](https://insights.sbomify.com/CVE-2026-71866/): Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client (critical 9.3)
- [CVE-2026-71865](https://insights.sbomify.com/CVE-2026-71865/): Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli (critical 9.3)
- [CVE-2026-71864](https://insights.sbomify.com/CVE-2026-71864/): Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client (critical 9.3)
- [CVE-2026-71862](https://insights.sbomify.com/CVE-2026-71862/): Checkmate: Sensitive Bearer Token Exposure via Public Status Pages When showURL Setting is Enabled (high 7.5)
- [CVE-2026-7186](https://insights.sbomify.com/CVE-2026-7186/): Fix stored XSS in URL dashboard widget via dangerous URI schemes (high 8.5)
- [CVE-2026-71858](https://insights.sbomify.com/CVE-2026-71858/): Notepad++: shortcuts.xml Macro HMAC Bypass Enables Conditional Elevated Command Execution (medium 5.4)
- [CVE-2026-71855](https://insights.sbomify.com/CVE-2026-71855/): Suricata flow: IPv4/IPv6 hash collision can reuse wrong flow state (medium 5.9)
- [CVE-2026-71854](https://insights.sbomify.com/CVE-2026-71854/): OpenAEV has unauthenticated access and missing object-level authorization on player lessons API (high 8.2)
- [CVE-2026-71852](https://insights.sbomify.com/CVE-2026-71852/): pypdf: Possible long runtimes/large memory usage for large CID font width ranges (medium 4.8)
- [CVE-2026-71851](https://insights.sbomify.com/CVE-2026-71851/): crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain (critical 9.0)
- [CVE-2026-71850](https://insights.sbomify.com/CVE-2026-71850/): Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure (medium 4.8)
- [CVE-2026-7185](https://insights.sbomify.com/CVE-2026-7185/): Unauthorized access to files in T-Systems products (medium 6.0)
- [CVE-2026-71849](https://insights.sbomify.com/CVE-2026-71849/): Hono: Proxy Helper does not remove response headers listed in the `Connection` header (low 3.7)
- [CVE-2026-71848](https://insights.sbomify.com/CVE-2026-71848/): Hono: Algorithmic Complexity DoS in Language Middleware (medium 5.3)
- [CVE-2026-71847](https://insights.sbomify.com/CVE-2026-71847/): Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams (high 8.7)
- [CVE-2026-71846](https://insights.sbomify.com/CVE-2026-71846/): Insights-client: insights-client: clusterrole grants cluster-wide secrets get/list/watch beyond least privilege (medium 6.5)
- [CVE-2026-71845](https://insights.sbomify.com/CVE-2026-71845/): Insights-client: insights-client: ccx_token bearer credential logged in clear text at startup via setdefault() (medium 6.3)
- [CVE-2026-7184](https://insights.sbomify.com/CVE-2026-7184/): Mattermost Remote Cluster PATCH API Leaks Authentication Tokens (medium 6.5)
- [CVE-2026-71832](https://insights.sbomify.com/CVE-2026-71832/): Aria2 version 1.37.0 and below is affected by a Divide By Zero issue in src/bittorrent_helper.cc, which allows a remote malicious user to ca (medium 6.2)
- [CVE-2026-7183](https://insights.sbomify.com/CVE-2026-7183/): aligungr UERANSIM Radio Link Simulation Layer rls_pdu.cpp DecodeRlsMessage uncaught exception (medium 6.9)
- [CVE-2026-7182](https://insights.sbomify.com/CVE-2026-7182/): Path Traversal in Diagram (critical 9.2)
- [CVE-2026-71809](https://insights.sbomify.com/CVE-2026-71809/): Authentication Bypass via Hardcoded Master Verification Code vulnerability in Siam Ordering (siam-server) 1.0.0 allows remote unauthenticate (high 8.1)
- [CVE-2026-71808](https://insights.sbomify.com/CVE-2026-71808/): A SQL Injection vulnerability in Siam Ordering (siam-server) 1.0.0 allows remote authenticated attackers to execute arbitrary SQL commands v (high 8.8)
- [CVE-2026-71807](https://insights.sbomify.com/CVE-2026-71807/): In RuoYi-Cloud-Plus <= 2.6.2 in the ruoyi-workflow module, multiple core task APIs in FlwTaskController lack permission annotations, and the (medium 4.3)
- [CVE-2026-71805](https://insights.sbomify.com/CVE-2026-71805/): An arbitrary file upload and path traversal vulnerability exists in LZ-litchi 1.0.0. (critical 9.8)
- [CVE-2026-71803](https://insights.sbomify.com/CVE-2026-71803/): money-pos 1.0 contains a stored Cross-Site Scripting (XSS) vulnerability. (medium 5.4)
- [CVE-2026-71802](https://insights.sbomify.com/CVE-2026-71802/): A stored Cross-Site Scripting (XSS) vulnerability exists in the announcement preview component of REBUILD 4.4.3. (medium 5.4)
- [CVE-2026-71801](https://insights.sbomify.com/CVE-2026-71801/): An issue was discovered in s-pms SPMS-Server through v1.0. (critical 9.8)
- [CVE-2026-7179](https://insights.sbomify.com/CVE-2026-7179/): OSPG binwalk WinCE Extraction Plugin winceextract.py read_null_terminated_string path traversal (medium 4.8)
- [CVE-2026-7178](https://insights.sbomify.com/CVE-2026-7178/): ChatGPTNextWeb NextChat Artifacts Endpoint route.ts storeUrl server-side request forgery (medium 6.9)
- [CVE-2026-7177](https://insights.sbomify.com/CVE-2026-7177/): ChatGPTNextWeb NextChat route.ts proxyHandler server-side request forgery (medium 6.9)
- [CVE-2026-7176](https://insights.sbomify.com/CVE-2026-7176/): Multiple vulnerabilities in Entradium by Crocantickets (medium 4.8)
- [CVE-2026-7175](https://insights.sbomify.com/CVE-2026-7175/): Multiple vulnerabilities in Entradium by Crocantickets (medium 4.8)
- [CVE-2026-7174](https://insights.sbomify.com/CVE-2026-7174/): Multiple vulnerabilities in Entradium by Crocantickets (medium 4.8)
- [CVE-2026-7173](https://insights.sbomify.com/CVE-2026-7173/): Multiple vulnerabilities in Entradium by Crocantickets (medium 4.8)
- [CVE-2026-7172](https://insights.sbomify.com/CVE-2026-7172/): Stored Cross-Site Scripting (XSS) in TPVEnlanube (medium 4.8)
- [CVE-2026-7171](https://insights.sbomify.com/CVE-2026-7171/): Stored Cross-Site Scripting (XSS) in TPVEnlanube (medium 4.8)
- [CVE-2026-7170](https://insights.sbomify.com/CVE-2026-7170/): Stored Cross-Site Scripting (XSS) in TPVEnlanube (medium 4.8)
- [CVE-2026-71694](https://insights.sbomify.com/CVE-2026-71694/): An issue in Berkeley Out-of-Order Machine (BOOM) / BoomTile RTL benchmark v1.2 2d08d0d8b4563212175212f9db0e69f6e68c9619 allows a remote atta (high 8.8)
- [CVE-2026-7169](https://insights.sbomify.com/CVE-2026-7169/): Uncontrolled Search Path Element in Evope Collector (high 7.5)
- [CVE-2026-7168](https://insights.sbomify.com/CVE-2026-7168/): cross-proxy Digest auth state leak (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/416/