# Vulnerabilities published in 2026


- [CVE-2026-71676](https://insights.sbomify.com/CVE-2026-71676/): Buffer Overflow vulnerability in Open5GS v.2.7.0 allows a remote attacker to cause a denial of service via the NAS 5GS decoder chain, trigge (high 7.5)
- [CVE-2026-71675](https://insights.sbomify.com/CVE-2026-71675/): An issue in Open5GS v.2.7.0 allows a remote attacker to cause a denial of service via the ngap_send_to_nas() function in src/amf/ngap-path.c (high 7.5)
- [CVE-2026-7167](https://insights.sbomify.com/CVE-2026-7167/): Multiple vulnerabilities in the Assassin game by Gaudire (medium 6.9)
- [CVE-2026-7166](https://insights.sbomify.com/CVE-2026-7166/): Multiple vulnerabilities in the Assassin game by Gaudire (critical 9.2)
- [CVE-2026-7165](https://insights.sbomify.com/CVE-2026-7165/): Multiple vulnerabilities in the Assassin game by Gaudire (critical 9.4)
- [CVE-2026-71647](https://insights.sbomify.com/CVE-2026-71647/): An issue in EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows an attacker to cause a denial of servic (high 7.5)
- [CVE-2026-71646](https://insights.sbomify.com/CVE-2026-71646/): An issue in Robotics-STAR-Lab (SYSU STAR Group) RACER Tested affected version: commit abcdef1234567890 allows an attacker to cause a denial (high 7.5)
- [CVE-2026-71645](https://insights.sbomify.com/CVE-2026-71645/): An issue in Robotics-STAR-Lab (SYSU STAR Group) RACER Tested affected version: commit abcdef1234567890 allows an attacker to cause a denial (high 7.5)
- [CVE-2026-71644](https://insights.sbomify.com/CVE-2026-71644/): An issue in Robotics-STAR-Lab (SYSU STAR Group) RACER Tested affected version: commit abcdef1234567890 allows an attacker to cause unsafe tr (critical 9.8)
- [CVE-2026-71643](https://insights.sbomify.com/CVE-2026-71643/): An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows an attacker to cause a den (high 7.5)
- [CVE-2026-71642](https://insights.sbomify.com/CVE-2026-71642/): An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows an attacker to cause a den (medium 4.0)
- [CVE-2026-71641](https://insights.sbomify.com/CVE-2026-71641/): An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows an attacker to cause a den (high 7.5)
- [CVE-2026-71640](https://insights.sbomify.com/CVE-2026-71640/): An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows unsafe vehicle motion via (critical 9.1)
- [CVE-2026-7164](https://insights.sbomify.com/CVE-2026-7164/): pf can overflow the stack parsing crafted SCTP packets (high 7.5)
- [CVE-2026-7163](https://insights.sbomify.com/CVE-2026-7163/): Missing authorization in multicluster engine for Kubernetes 2.1 (medium 6.1)
- [CVE-2026-71626](https://insights.sbomify.com/CVE-2026-71626/): An issue in Invoice Ninja v5.13.24 allows a remote attacker to obtain sensitive information via the StoreWebhookRequest.php, UpdateWebhookRe (high 7.5)
- [CVE-2026-71625](https://insights.sbomify.com/CVE-2026-71625/): An issue in slimkit plus ThinkSNS+ v.2.4 allows a remote attacker to escalate privileges via the ResetPasswordController.php component (critical 9.8)
- [CVE-2026-71624](https://insights.sbomify.com/CVE-2026-71624/): An issue in esoTalk v.1.0.0g4 allows a remote attacker to execute arbitrary code via the core/models/ETMemberModel.class.php, core/controlle (critical 9.8)
- [CVE-2026-71622](https://insights.sbomify.com/CVE-2026-71622/): SQL injection vulnerability in Zhao-github APiAdmin v.5.0.1 allows a remote attacker to obtain sensitive information via the User.php compon (high 7.4)
- [CVE-2026-71620](https://insights.sbomify.com/CVE-2026-71620/): File Upload vulnerability in Zhao-github ApiAdmin v.5.0.1 allows a remote attacker to execute arbitrary code via a crafted .php file (high 8.1)
- [CVE-2026-7162](https://insights.sbomify.com/CVE-2026-7162/): Integer overflow in WinFsp (high 7.8)
- [CVE-2026-71616](https://insights.sbomify.com/CVE-2026-71616/): An issue in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to cause a denial of service via the function gf_route_media_complete_object(). (medium 6.2)
- [CVE-2026-71614](https://insights.sbomify.com/CVE-2026-71614/): An issue in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary code via the src/media_tools/dvb_mpe.c, de (high 8.4)
- [CVE-2026-71613](https://insights.sbomify.com/CVE-2026-71613/): Buffer Overflow vulnerability in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary code via the j2kdec_process() function. (high 7.8)
- [CVE-2026-71612](https://insights.sbomify.com/CVE-2026-71612/): Buffer Overflow vulnerability in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary code via the nhntdmx_process() function. (high 8.4)
- [CVE-2026-7161](https://insights.sbomify.com/CVE-2026-7161/): GeoVision GV-IP Device Utility Device Authentication insufficient encryption vulnerability (critical 9.3)
- [CVE-2026-7160](https://insights.sbomify.com/CVE-2026-7160/): Tenda HG3 formTracert command injection (high 8.7)
- [CVE-2026-7159](https://insights.sbomify.com/CVE-2026-7159/): douinc mkdocs-mcp-plugin server.py list_documents path traversal (medium 6.9)
- [CVE-2026-7158](https://insights.sbomify.com/CVE-2026-7158/): dmitryglhf mcp-url-downloader server.py _validate_url_safe server-side request forgery (medium 6.9)
- [CVE-2026-71577](https://insights.sbomify.com/CVE-2026-71577/): Information disclosure in Multicluster Global Hub 1.4.9 (medium 6.3)
- [CVE-2026-71576](https://insights.sbomify.com/CVE-2026-71576/): Security feature bypass in Multicluster Global Hub 1.4.9 (high 8.5)
- [CVE-2026-71575](https://insights.sbomify.com/CVE-2026-71575/): Apache CXF: Inoperative max_age authentication-freshness check in OidcClientCodeRequestFilter (critical 9.1)
- [CVE-2026-71574](https://insights.sbomify.com/CVE-2026-71574/): Missing authorization in Joomla! CMS (high 8.5)
- [CVE-2026-71573](https://insights.sbomify.com/CVE-2026-71573/): Joomla! Core - [20260802] - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 (medium 6.9)
- [CVE-2026-71572](https://insights.sbomify.com/CVE-2026-71572/): Joomla! Core - [20260801] - Response header injection in download views in Joomla 3.0.0-5.4.7, 6.0.0-6.1.2 (medium 4.8)
- [CVE-2026-71571](https://insights.sbomify.com/CVE-2026-71571/): Joomla Extension - icagenda.com - Authenticated SQL injection via unescaped numeric filter in iCagenda < 2.0.0-4.0.11 (high 8.6)
- [CVE-2026-71570](https://insights.sbomify.com/CVE-2026-71570/): Joomla Extension - icagenda.com - ACL bypass allowing arbitrary user enumeration < 2.0.0-4.0.11 (medium 5.1)
- [CVE-2026-7157](https://insights.sbomify.com/CVE-2026-7157/): disler aider-mcp-server aider_ai_code server.py command injection (medium 6.9)
- [CVE-2026-71569](https://insights.sbomify.com/CVE-2026-71569/): Apache Camel: Camel-A2A Push Notification Webhook Guard Accepts IPv6 Unique Local Addresses Reached Through a Host Name (medium 4.8)
- [CVE-2026-71568](https://insights.sbomify.com/CVE-2026-71568/): BMCtest exposes Ironic without authentication and TLS during the test (medium 5.3)
- [CVE-2026-71567](https://insights.sbomify.com/CVE-2026-71567/): User-controlled variables inserted unescaped into shell scripts and Kubernetes manifests (high 7.7)
- [CVE-2026-71566](https://insights.sbomify.com/CVE-2026-71566/): KubeVirt backend is not authenticated (critical 9.3)
- [CVE-2026-71565](https://insights.sbomify.com/CVE-2026-71565/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-71564](https://insights.sbomify.com/CVE-2026-71564/): Substance3D - Designer | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-71563](https://insights.sbomify.com/CVE-2026-71563/): Apache Answer: MCP Answer Retrieval Exposes Content from Non-Public Questions (medium 4.3)
- [CVE-2026-71562](https://insights.sbomify.com/CVE-2026-71562/): httpc does not bound server-supplied numeric header values before integer conversion (medium 6.3)
- [CVE-2026-71560](https://insights.sbomify.com/CVE-2026-71560/): Apache Fory: Out-of-bounds heap read in C++ struct deserializer tagged-int fast-path (critical 9.1)
- [CVE-2026-7156](https://insights.sbomify.com/CVE-2026-7156/): Totolink A8000RU CGI cstecgi.cgi CsteSystem os command injection (critical 9.3)
- [CVE-2026-71559](https://insights.sbomify.com/CVE-2026-71559/): Apache Fory: Uncaught panic (remote DoS) in Go meta-string decoder from untrusted metadata (high 7.5)
- [CVE-2026-71558](https://insights.sbomify.com/CVE-2026-71558/): Apache Fory: Heap type confusion in C++ polymorphic smart-pointer deserialization (critical 9.8)
- [CVE-2026-71557](https://insights.sbomify.com/CVE-2026-71557/): go-git: Malicious reference names may modify files outside the reference storage (medium 6.3)
- [CVE-2026-71556](https://insights.sbomify.com/CVE-2026-71556/): go-git: Worktree operations may follow symlinks (high 7.1)
- [CVE-2026-71555](https://insights.sbomify.com/CVE-2026-71555/): PILOS: Reverse tabnabbing in room description (medium 4.1)
- [CVE-2026-71554](https://insights.sbomify.com/CVE-2026-71554/): h2: Duplicate Host header could facilitate request smuggling (medium 5.3)
- [CVE-2026-71553](https://insights.sbomify.com/CVE-2026-71553/): ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS (high 7.1)
- [CVE-2026-71551](https://insights.sbomify.com/CVE-2026-71551/): Super Productivity: Arbitrary OS Command Execution via IPC EXEC Handler with Persistent Whitelist (high 7.8)
- [CVE-2026-7155](https://insights.sbomify.com/CVE-2026-7155/): Totolink A8000RU CGI cstecgi.cgi setLoginPasswordCfg os command injection (critical 9.3)
- [CVE-2026-71543](https://insights.sbomify.com/CVE-2026-71543/): OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters (high 7.5)
- [CVE-2026-71542](https://insights.sbomify.com/CVE-2026-71542/): GetSimple CMS: Stored Cross-Site Scripting (XSS) via the "title" parameter in admin/components.php (high 8.7)
- [CVE-2026-71540](https://insights.sbomify.com/CVE-2026-71540/): Wazuh Manager cluster header parsing allows pre-authentication memory exhaustion (high 7.5)
- [CVE-2026-7154](https://insights.sbomify.com/CVE-2026-7154/): Totolink A8000RU CGI cstecgi.cgi setAdvancedInfoShow os command injection (critical 9.3)
- [CVE-2026-71539](https://insights.sbomify.com/CVE-2026-71539/): n8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution (high 8.9)
- [CVE-2026-71538](https://insights.sbomify.com/CVE-2026-71538/): @cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument on Windows (high 8.5)
- [CVE-2026-71537](https://insights.sbomify.com/CVE-2026-71537/): Paymenter: Credit-refund double-spend race condition in service downgrade (doUpgrade) (medium 6.5)
- [CVE-2026-7153](https://insights.sbomify.com/CVE-2026-7153/): Totolink A8000RU CGI cstecgi.cgi setMiniuiHomeInfoShow os command injection (critical 9.3)
- [CVE-2026-7152](https://insights.sbomify.com/CVE-2026-7152/): Totolink A8000RU CGI cstecgi.cgi setTelnetCfg os command injection (critical 9.3)
- [CVE-2026-71518](https://insights.sbomify.com/CVE-2026-71518/): Typemill < 2.26.0 Authorization Bypass via Media File Download Route (high 8.7)
- [CVE-2026-71514](https://insights.sbomify.com/CVE-2026-71514/): NLTK 3.9.4 through 3.10.2 Path Traversal via CrubadanCorpusReader pathsec Bypass (low 2.0)
- [CVE-2026-71513](https://insights.sbomify.com/CVE-2026-71513/): NLTK 3.10.0 through 3.10.2 Remote Code Execution via AllowlistUnpickler Dotted-Name Bypass (high 8.7)
- [CVE-2026-71511](https://insights.sbomify.com/CVE-2026-71511/): Dolibarr < 24.0.0 Members REST API Sensitive Data Exposure via Member Endpoints (high 7.1)
- [CVE-2026-71510](https://insights.sbomify.com/CVE-2026-71510/): Dolibarr < 24.0.0 Users REST API SQL Injection via filter parameter (high 7.1)
- [CVE-2026-7151](https://insights.sbomify.com/CVE-2026-7151/): Tenda HG3 formIPv6Routing formUploadConfig stack-based overflow (high 8.7)
- [CVE-2026-71509](https://insights.sbomify.com/CVE-2026-71509/): Dolibarr < 24.0.0 Expense Report REST API Improper Authorization via Update Endpoint (high 7.1)
- [CVE-2026-71508](https://insights.sbomify.com/CVE-2026-71508/): Dolibarr < 24.0.0 REST API Improper Authorization via User Update Endpoint (high 7.1)
- [CVE-2026-71507](https://insights.sbomify.com/CVE-2026-71507/): Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Bank Account Routes (high 7.1)
- [CVE-2026-71506](https://insights.sbomify.com/CVE-2026-71506/): Dolibarr < 24.0.0 Payments REST API Improper Authorization via Delete Endpoint (high 7.2)
- [CVE-2026-71505](https://insights.sbomify.com/CVE-2026-71505/): Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Third-Party Write Route (high 7.1)
- [CVE-2026-71504](https://insights.sbomify.com/CVE-2026-71504/): Dolibarr < 24.0.0 Members REST API Improper Authorization via Password Reset (high 8.6)
- [CVE-2026-71503](https://insights.sbomify.com/CVE-2026-71503/): Dolibarr < 24.0.0 Reflected XSS via Extra Fields Administration Template (medium 5.1)
- [CVE-2026-71502](https://insights.sbomify.com/CVE-2026-71502/): Unauthenticated Stored Vue Template Injection Leads to Cross-Site Scripting in CTI-Transmute (medium 5.1)
- [CVE-2026-7150](https://insights.sbomify.com/CVE-2026-7150/): dh1011 auto-favicon MCP Tool server.py generate_favicon_from_url server-side request forgery (medium 5.3)
- [CVE-2026-71498](https://insights.sbomify.com/CVE-2026-71498/): node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript (medium 5.1)
- [CVE-2026-71497](https://insights.sbomify.com/CVE-2026-71497/): jsoup: Cleaner may expose markup with custom raw-text elements (medium 4.7)
- [CVE-2026-71494](https://insights.sbomify.com/CVE-2026-71494/): Infracost: Terraform Cloud and registry token disclosure via unvalidated hostname (medium 5.9)
- [CVE-2026-71493](https://insights.sbomify.com/CVE-2026-71493/): Infracost: Arbitrary file read via config-template readFile symlink traversal (medium 5.9)
- [CVE-2026-71492](https://insights.sbomify.com/CVE-2026-71492/): Banks: Path traversal in `DirectoryPromptRegistry.set()` allows arbitrary file write outside the registry root (medium 6.0)
- [CVE-2026-71491](https://insights.sbomify.com/CVE-2026-71491/): sqlparse: Quadratic O(n²) DoS in group_comments (high 8.7)
- [CVE-2026-71490](https://insights.sbomify.com/CVE-2026-71490/): OPNsense: Direct comma-separated user privileges bypass OPNsense MVC read-only write protection (high 7.1)
- [CVE-2026-7149](https://insights.sbomify.com/CVE-2026-7149/): dexhunter kaggle-mcp server.py prepare_kaggle_dataset path traversal (medium 6.9)
- [CVE-2026-71488](https://insights.sbomify.com/CVE-2026-71488/): league/commonmark: Quadratic-time denial of service when parsing crafted Markdown (high 7.5)
- [CVE-2026-71486](https://insights.sbomify.com/CVE-2026-71486/): vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds (medium 4.3)
- [CVE-2026-71485](https://insights.sbomify.com/CVE-2026-71485/): Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends (critical 9.1)
- [CVE-2026-71483](https://insights.sbomify.com/CVE-2026-71483/): Horilla: Reflected Cross-Site Scripting (XSS) in Employee Filter View (high 8.5)
- [CVE-2026-7148](https://insights.sbomify.com/CVE-2026-7148/): CodeAstro Online Classroom addnewfaculty sql injection (medium 5.3)
- [CVE-2026-71479](https://insights.sbomify.com/CVE-2026-71479/): New API: Integer overflow in quota billing yields negative charges (self-crediting) (critical 9.1)
- [CVE-2026-71478](https://insights.sbomify.com/CVE-2026-71478/): league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes (medium 6.1)
- [CVE-2026-71477](https://insights.sbomify.com/CVE-2026-71477/): mise: Incorrect file ownership, when installed by the root user using `install.sh` (medium 6.7)
- [CVE-2026-71476](https://insights.sbomify.com/CVE-2026-71476/): Nx: Zip-Slip in the self-hosted remote cache (high 8.7)
- [CVE-2026-71475](https://insights.sbomify.com/CVE-2026-71475/): Insights-client-rhel9: insights-client: spoke-controlled clusterid injected unencoded into insights api url path (medium 6.8)
- [CVE-2026-71474](https://insights.sbomify.com/CVE-2026-71474/): Insights-client-rhel9: insights-client: pull-secret bearer token written to logs on non-200 ccx response (high 7.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/417/