# Vulnerabilities published in 2026


- [CVE-2026-7125](https://insights.sbomify.com/CVE-2026-7125/): Totolink A8000RU CGI cstecgi.cgi setWiFiEasyCfg os command injection (critical 9.3)
- [CVE-2026-71249](https://insights.sbomify.com/CVE-2026-71249/): 299Ko - Unauthenticated Reflected XSS in Public Contact Form (medium 6.1)
- [CVE-2026-71248](https://insights.sbomify.com/CVE-2026-71248/): Inventory-Management-System-PHP - Unauthenticated SQL Injection in Login and Product Deletion (critical 9.8)
- [CVE-2026-71247](https://insights.sbomify.com/CVE-2026-71247/): Documenso - Assistant Recipient Can Forge Another Signer's Signature in Sequential-Signing Documents (medium 6.5)
- [CVE-2026-71246](https://insights.sbomify.com/CVE-2026-71246/): Pixelfed - Authenticated SSRF via Remote URL Search (medium 4.3)
- [CVE-2026-71244](https://insights.sbomify.com/CVE-2026-71244/): Paperless-ngx - Mail Account Test Connection Leaks Stored IMAP/OAuth Credentials to Attacker-Controlled Host (medium 6.5)
- [CVE-2026-71243](https://insights.sbomify.com/CVE-2026-71243/): backmeup (npm) - OS Command Injection via Backup Option Values (high 8.8)
- [CVE-2026-71242](https://insights.sbomify.com/CVE-2026-71242/): Crater - Cross-Company IDOR on Notes via Missing Company-Ownership Check in NotePolicy (high 8.2)
- [CVE-2026-71241](https://insights.sbomify.com/CVE-2026-71241/): Book-Management-System - Unauthenticated Disclosure of Student PII and Borrowing History (high 7.5)
- [CVE-2026-71240](https://insights.sbomify.com/CVE-2026-71240/): DjangoCRM - Unauthenticated Open Redirect via toggle_default_sorting next_url Parameter (medium 4.3)
- [CVE-2026-7124](https://insights.sbomify.com/CVE-2026-7124/): Totolink A8000RU CGI cstecgi.cgi setIpv6LanCfg os command injection (critical 9.3)
- [CVE-2026-71239](https://insights.sbomify.com/CVE-2026-71239/): DjangoCRM - Server-Side Template Injection in Mass Mail Message Rendering (high 8.1)
- [CVE-2026-71238](https://insights.sbomify.com/CVE-2026-71238/): DjangoCRM - Hardcoded Django SECRET_KEY Enables Session and CSRF Token Forgery (critical 9.1)
- [CVE-2026-71237](https://insights.sbomify.com/CVE-2026-71237/): Miantang IoT-PHP - Unauthenticated SQL Injection in /userlogin (critical 9.8)
- [CVE-2026-71236](https://insights.sbomify.com/CVE-2026-71236/): Grocy - Stored XSS via HTMLPurifier Output Double-Decode (high 8.7)
- [CVE-2026-71235](https://insights.sbomify.com/CVE-2026-71235/): Magistrala IoT Platform - Unrestricted Go/Lua Script Execution in Rules Engine (high 8.8)
- [CVE-2026-71234](https://insights.sbomify.com/CVE-2026-71234/): Documize Community - Attachment Download Authorization Bypass via Non-Validated secure Token (high 7.5)
- [CVE-2026-71233](https://insights.sbomify.com/CVE-2026-71233/): InvoiceNinja - Stored XSS via Invoice/Quote Terms Field (high 8.7)
- [CVE-2026-71232](https://insights.sbomify.com/CVE-2026-71232/): MacCMS10 - Incomplete Function Blacklist in Template Editor Enables Authenticated RCE (high 7.2)
- [CVE-2026-71231](https://insights.sbomify.com/CVE-2026-71231/): IOTSmartHome - Unauthenticated SQL Injection via lastLogin Cookie (critical 9.8)
- [CVE-2026-7123](https://insights.sbomify.com/CVE-2026-7123/): Totolink A8000RU CGI cstecgi.cgi setIptvCfg os command injection (critical 9.3)
- [CVE-2026-71227](https://insights.sbomify.com/CVE-2026-71227/): Denial of service in Red Hat Enterprise Linux 10 (medium 5.1)
- [CVE-2026-71226](https://insights.sbomify.com/CVE-2026-71226/): Libkcapi: memory corruption via uncanceled aio requests on error in libkcapi's one-shot aio path (high 7.3)
- [CVE-2026-71225](https://insights.sbomify.com/CVE-2026-71225/): Libkcapi: iv reuse in libkcapi one-shot symmetric cipher chunking causes cipher state reset across chunk boundaries (medium 6.5)
- [CVE-2026-71224](https://insights.sbomify.com/CVE-2026-71224/): Gfs2-utils: gfs2-utils: stack overflow via alloca(i_height) in metadata walk (medium 4.7)
- [CVE-2026-71222](https://insights.sbomify.com/CVE-2026-71222/): Gfs2-utils: gfs2-utils: heap out-of-bounds read via unchecked ea_num_ptrs in extended attribute processing (medium 5.3)
- [CVE-2026-71221](https://insights.sbomify.com/CVE-2026-71221/): Gfs2-utils: gfs2-utils: stack out-of-bounds write via unchecked height in savemeta (high 7.0)
- [CVE-2026-71220](https://insights.sbomify.com/CVE-2026-71220/): Gfs2-utils: gfs2-utils: stack out-of-bounds write via unchecked di_height in gfs2_edit (high 7.0)
- [CVE-2026-7122](https://insights.sbomify.com/CVE-2026-7122/): Totolink A8000RU CGI cstecgi.cgi setUPnPCfg os command injection (critical 9.3)
- [CVE-2026-71219](https://insights.sbomify.com/CVE-2026-71219/): Gfs2-utils: gfs2-utils: stack overflow via alloca(1<<di_depth) in hash table traversal (medium 4.7)
- [CVE-2026-71218](https://insights.sbomify.com/CVE-2026-71218/): Iperf3: unbounded peer-controlled allocation in iperf3 json_read() allows unauthenticated remote memory exhaustion (medium 5.3)
- [CVE-2026-71217](https://insights.sbomify.com/CVE-2026-71217/): Denial of service in Red Hat Enterprise Linux 10 (high 7.5)
- [CVE-2026-71216](https://insights.sbomify.com/CVE-2026-71216/): Apache SkyWalking: PagerDuty alarm hook transmits the integration routing key over cleartext HTTP (medium 5.3)
- [CVE-2026-71215](https://insights.sbomify.com/CVE-2026-71215/): art-template - Path Traversal in Sub-Template Resolution via include()/extend() (high 7.5)
- [CVE-2026-71214](https://insights.sbomify.com/CVE-2026-71214/): NASA-AMMOS plandev - Client-Supplied session_variables Bypass Hasura-Origin Authorization in sequencing-server (critical 9.8)
- [CVE-2026-71213](https://insights.sbomify.com/CVE-2026-71213/): typemill - No Rate Limiting on Login Endpoint Enables Unlimited Password Brute-Force (critical 9.1)
- [CVE-2026-71212](https://insights.sbomify.com/CVE-2026-71212/): xidown - Argument Injection via Unterminated yt-dlp Command Line Construction (medium 4.4)
- [CVE-2026-71211](https://insights.sbomify.com/CVE-2026-71211/): mlflow - Unvalidated Gateway Secret api_base Enables SSRF via Gateway Proxy Endpoint (high 7.1)
- [CVE-2026-71210](https://insights.sbomify.com/CVE-2026-71210/): mealie - DNS-Rebinding TOCTOU in SSRF Guard Allows Internal Network and Cloud Metadata Access (medium 5.3)
- [CVE-2026-7121](https://insights.sbomify.com/CVE-2026-7121/): Totolink A8000RU CGI cstecgi.cgi setWizardCfg os command injection (critical 9.3)
- [CVE-2026-71209](https://insights.sbomify.com/CVE-2026-71209/): Path traversal in audiobookshelf (high 7.5)
- [CVE-2026-71208](https://insights.sbomify.com/CVE-2026-71208/): KubeSphere - SSRF via Unvalidated Cluster CRD Connection Endpoint in Cluster Reconciliation (medium 6.5)
- [CVE-2026-71207](https://insights.sbomify.com/CVE-2026-71207/): SQL injection in Stock-Inventory-Management-System (critical 9.8)
- [CVE-2026-71206](https://insights.sbomify.com/CVE-2026-71206/): shiori - JWT CheckToken Never Re-Validates Account State, Allowing Stale-Privilege Access After Deletion or Demotion (high 8.2)
- [CVE-2026-71205](https://insights.sbomify.com/CVE-2026-71205/): changedetection.io - No Rate Limiting on /login Enables Unlimited Password Brute-Force (medium 6.5)
- [CVE-2026-71204](https://insights.sbomify.com/CVE-2026-71204/): changedetection.io - Omitted Checkbox in /settings Save Silently Disables API Key Enforcement (medium 6.3)
- [CVE-2026-71203](https://insights.sbomify.com/CVE-2026-71203/): changedetection.io - Missing Authentication on /api/v1/full-spec Discloses Full OpenAPI Schema (medium 5.3)
- [CVE-2026-71202](https://insights.sbomify.com/CVE-2026-71202/): raster - Integer Underflow in crop() Offset Handling Causes Capacity-Overflow Panic (high 7.5)
- [CVE-2026-71201](https://insights.sbomify.com/CVE-2026-71201/): Missing authorization in Ironic (medium 5.0)
- [CVE-2026-7120](https://insights.sbomify.com/CVE-2026-7120/): @fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths (medium 5.3)
- [CVE-2026-71198](https://insights.sbomify.com/CVE-2026-71198/): Server-side request forgery in Glance (high 7.0)
- [CVE-2026-71195](https://insights.sbomify.com/CVE-2026-71195/): Missing authorization in Manila (critical 9.9)
- [CVE-2026-71194](https://insights.sbomify.com/CVE-2026-71194/): Denial of service in Designate (medium 6.8)
- [CVE-2026-71193](https://insights.sbomify.com/CVE-2026-71193/): Missing authorization in Designate (critical 9.6)
- [CVE-2026-71192](https://insights.sbomify.com/CVE-2026-71192/): Missing authorization in Swift (medium 6.0)
- [CVE-2026-71191](https://insights.sbomify.com/CVE-2026-71191/): Missing authorization in Swift (medium 6.0)
- [CVE-2026-71190](https://insights.sbomify.com/CVE-2026-71190/): Denial of service in Swift (high 8.7)
- [CVE-2026-7119](https://insights.sbomify.com/CVE-2026-7119/): Tenda HG3 formCountrystr os command injection (high 8.7)
- [CVE-2026-71189](https://insights.sbomify.com/CVE-2026-71189/): Toptech TMS7 and TopHAT Cross-site Scripting (medium 4.8)
- [CVE-2026-71187](https://insights.sbomify.com/CVE-2026-71187/): Ebyte NA111-M Use of Client-Side Authentication (critical 9.3)
- [CVE-2026-71184](https://insights.sbomify.com/CVE-2026-71184/): Gitea fork workflow approval bypass through review events (high 8.8)
- [CVE-2026-71183](https://insights.sbomify.com/CVE-2026-71183/): Apache DolphinScheduler: Missing Authorization Checks Allow Disclosure of Data Source Information and Passwords (high 7.1)
- [CVE-2026-71182](https://insights.sbomify.com/CVE-2026-71182/): Path traversal in Update Package Framework (low 3.0)
- [CVE-2026-71181](https://insights.sbomify.com/CVE-2026-71181/): Path traversal in Update Package Framework (low 3.0)
- [CVE-2026-71180](https://insights.sbomify.com/CVE-2026-71180/): Privilege escalation in Update Package Framework (high 8.2)
- [CVE-2026-7118](https://insights.sbomify.com/CVE-2026-7118/): code-projects Employee Management System cancel.php sql injection (medium 5.3)
- [CVE-2026-71179](https://insights.sbomify.com/CVE-2026-71179/): Command injection in Update Package Framework (high 7.3)
- [CVE-2026-71178](https://insights.sbomify.com/CVE-2026-71178/): Auth bypass in Secure Connect Gateway (SCG) Policy Manager (low 3.7)
- [CVE-2026-71177](https://insights.sbomify.com/CVE-2026-71177/): Other in Secure Connect Gateway (SCG) Policy Manager (medium 5.4)
- [CVE-2026-71176](https://insights.sbomify.com/CVE-2026-71176/): SQL injection in OpenManage Enterprise (high 8.8)
- [CVE-2026-71172](https://insights.sbomify.com/CVE-2026-71172/): Server-side request forgery in Cloud Disaster Recovery (medium 4.3)
- [CVE-2026-71171](https://insights.sbomify.com/CVE-2026-71171/): Command injection in Cloud Disaster Recovery (high 7.2)
- [CVE-2026-71170](https://insights.sbomify.com/CVE-2026-71170/): Privilege escalation in Application Store (high 7.8)
- [CVE-2026-7117](https://insights.sbomify.com/CVE-2026-7117/): code-projects Employee Management System approve.php sql injection (medium 5.3)
- [CVE-2026-71169](https://insights.sbomify.com/CVE-2026-71169/): Misconfiguration in Application Store (high 7.0)
- [CVE-2026-71168](https://insights.sbomify.com/CVE-2026-71168/): Path traversal in System Update (high 7.3)
- [CVE-2026-71167](https://insights.sbomify.com/CVE-2026-71167/): Missing authorization in Helidon (critical 9.4)
- [CVE-2026-71166](https://insights.sbomify.com/CVE-2026-71166/): Missing authorization in Helidon (critical 9.4)
- [CVE-2026-71165](https://insights.sbomify.com/CVE-2026-71165/): Missing authorization in Helidon (medium 5.4)
- [CVE-2026-71164](https://insights.sbomify.com/CVE-2026-71164/): Missing authorization in Helidon (critical 9.8)
- [CVE-2026-71163](https://insights.sbomify.com/CVE-2026-71163/): Missing authorization in Oracle Access Manager (critical 9.9)
- [CVE-2026-71162](https://insights.sbomify.com/CVE-2026-71162/): Missing authorization in Helidon (medium 6.5)
- [CVE-2026-71161](https://insights.sbomify.com/CVE-2026-71161/): Denial of service in Helidon (medium 5.3)
- [CVE-2026-71160](https://insights.sbomify.com/CVE-2026-71160/): Missing authorization in Helidon (high 7.5)
- [CVE-2026-7116](https://insights.sbomify.com/CVE-2026-7116/): code-projects Employee Management System mark.php cross site scripting (medium 5.3)
- [CVE-2026-71159](https://insights.sbomify.com/CVE-2026-71159/): Missing authorization in Helidon (high 8.2)
- [CVE-2026-71158](https://insights.sbomify.com/CVE-2026-71158/): Missing authorization in Helidon (high 7.5)
- [CVE-2026-71157](https://insights.sbomify.com/CVE-2026-71157/): Missing authorization in Helidon (medium 5.3)
- [CVE-2026-71156](https://insights.sbomify.com/CVE-2026-71156/): Missing authorization in Helidon (medium 5.3)
- [CVE-2026-71155](https://insights.sbomify.com/CVE-2026-71155/): Missing authorization in Helidon (high 8.5)
- [CVE-2026-71154](https://insights.sbomify.com/CVE-2026-71154/): Missing authorization in Helidon (medium 6.1)
- [CVE-2026-71153](https://insights.sbomify.com/CVE-2026-71153/): Denial of service in Helidon (high 7.5)
- [CVE-2026-71152](https://insights.sbomify.com/CVE-2026-71152/): Missing authorization in Helidon (critical 9.8)
- [CVE-2026-71151](https://insights.sbomify.com/CVE-2026-71151/): Missing authorization in Oracle VM VirtualBox (medium 5.6)
- [CVE-2026-71150](https://insights.sbomify.com/CVE-2026-71150/): Privilege escalation in Oracle Hyperion Financial Management (high 8.8)
- [CVE-2026-7115](https://insights.sbomify.com/CVE-2026-7115/): code-projects Employee Management System delete.php sql injection (medium 5.3)
- [CVE-2026-71149](https://insights.sbomify.com/CVE-2026-71149/): Missing authorization in Oracle Hyperion Financial Management (medium 4.2)
- [CVE-2026-71148](https://insights.sbomify.com/CVE-2026-71148/): Missing authorization in Oracle Hyperion Financial Management (medium 5.3)
- [CVE-2026-71147](https://insights.sbomify.com/CVE-2026-71147/): Missing authorization in Oracle Hyperion Financial Management (medium 4.2)
- [CVE-2026-71146](https://insights.sbomify.com/CVE-2026-71146/): Other in Oracle Hyperion Financial Management (low 1.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/420/