# Vulnerabilities published in 2026


- [CVE-2026-60162](https://insights.sbomify.com/CVE-2026-60162/): Privilege escalation in Oracle VM VirtualBox (medium 6.1)
- [CVE-2026-60161](https://insights.sbomify.com/CVE-2026-60161/): Race condition in Oracle VM VirtualBox (medium 6.1)
- [CVE-2026-60160](https://insights.sbomify.com/CVE-2026-60160/): Information disclosure in Oracle VM VirtualBox (low 3.2)
- [CVE-2026-6016](https://insights.sbomify.com/CVE-2026-6016/): Tenda AC9 POST Request WizardHandle decodePwd stack-based overflow (high 8.7)
- [CVE-2026-60159](https://insights.sbomify.com/CVE-2026-60159/): Other in Oracle VM VirtualBox (high 7.5)
- [CVE-2026-60158](https://insights.sbomify.com/CVE-2026-60158/): Other in Oracle VM VirtualBox (medium 6.4)
- [CVE-2026-60157](https://insights.sbomify.com/CVE-2026-60157/): Missing authorization in Oracle GoldenGate (high 8.8)
- [CVE-2026-60156](https://insights.sbomify.com/CVE-2026-60156/): Information disclosure in Oracle APEX (medium 5.3)
- [CVE-2026-60155](https://insights.sbomify.com/CVE-2026-60155/): Other in Oracle VM VirtualBox (high 7.5)
- [CVE-2026-60154](https://insights.sbomify.com/CVE-2026-60154/): Missing authorization in Oracle Application Object Library (medium 5.4)
- [CVE-2026-60153](https://insights.sbomify.com/CVE-2026-60153/): Auth bypass in Oracle WebLogic Server (high 7.2)
- [CVE-2026-60152](https://insights.sbomify.com/CVE-2026-60152/): Missing authorization in PeopleSoft Enterprise PeopleTools (medium 5.4)
- [CVE-2026-60150](https://insights.sbomify.com/CVE-2026-60150/): Privilege escalation in Oracle VM VirtualBox (high 7.8)
- [CVE-2026-6015](https://insights.sbomify.com/CVE-2026-6015/): Tenda AC9 POST Request QuickIndex formQuickIndex stack-based overflow (high 8.7)
- [CVE-2026-60149](https://insights.sbomify.com/CVE-2026-60149/): Other in Oracle Workflow (medium 5.2)
- [CVE-2026-60147](https://insights.sbomify.com/CVE-2026-60147/): Other in Oracle GraalVM Enterprise Edition (medium 6.5)
- [CVE-2026-60146](https://insights.sbomify.com/CVE-2026-60146/): Missing authorization in Oracle Access Manager (medium 6.1)
- [CVE-2026-60145](https://insights.sbomify.com/CVE-2026-60145/): Denial of service in MySQL Cluster (medium 4.9)
- [CVE-2026-60144](https://insights.sbomify.com/CVE-2026-60144/): Missing authorization in Oracle Workflow (low 3.6)
- [CVE-2026-60143](https://insights.sbomify.com/CVE-2026-60143/): Missing authorization in Oracle Workflow (high 7.3)
- [CVE-2026-60140](https://insights.sbomify.com/CVE-2026-60140/): AutomationDirect Productivity Suite Out-of-bounds Read (medium 6.9)
- [CVE-2026-6014](https://insights.sbomify.com/CVE-2026-6014/): D-Link DIR-513 POST Request formAdvanceSetup buffer overflow (high 8.7)
- [CVE-2026-60137](https://insights.sbomify.com/CVE-2026-60137/): WordPress Core SQL Injection (medium 5.9, exploited in the wild)
- [CVE-2026-60135](https://insights.sbomify.com/CVE-2026-60135/): Weintek cMT3092X Incorrect User Management (high 7.1)
- [CVE-2026-60134](https://insights.sbomify.com/CVE-2026-60134/): Weintek cMT3092X Reliance on Cookies without Validation and Integrity Checking in a Security Decision (high 8.7)
- [CVE-2026-6013](https://insights.sbomify.com/CVE-2026-6013/): D-Link DIR-513 POST Request formSetRoute buffer overflow (high 8.7)
- [CVE-2026-60125](https://insights.sbomify.com/CVE-2026-60125/): importModule function in MISP ignores per-organisation import module restrictions (medium 5.3)
- [CVE-2026-60124](https://insights.sbomify.com/CVE-2026-60124/): MISP importModule missing authorization allows read-only users to modify events via misp_standard imports (medium 5.3)
- [CVE-2026-60122](https://insights.sbomify.com/CVE-2026-60122/): gpsd gpsprof Code Injection via SKY.satellites used Field (high 8.5)
- [CVE-2026-60121](https://insights.sbomify.com/CVE-2026-60121/): Vitec Flamingo 4.12.2 Unauthenticated OS Command Injection via ping.php (critical 9.3)
- [CVE-2026-60120](https://insights.sbomify.com/CVE-2026-60120/): Bagisto < 2.4.4 Stored XSS via CSTI in create.blade.php (medium 5.1)
- [CVE-2026-6012](https://insights.sbomify.com/CVE-2026-6012/): D-Link DIR-513 POST Request formSetPassword buffer overflow (high 8.7)
- [CVE-2026-60119](https://insights.sbomify.com/CVE-2026-60119/): Hi.Events < 1.11.0 XSS via Event Title JSON.stringify Injection (medium 5.1)
- [CVE-2026-60118](https://insights.sbomify.com/CVE-2026-60118/): Hi.Events < 1.11.0 Hidden Ticket Enumeration via Order Creation Endpoint (medium 6.9)
- [CVE-2026-60114](https://insights.sbomify.com/CVE-2026-60114/): Sustainable Irrigation Platform 5.2.16 Path Traversal via JSON Backup Restore (high 8.7)
- [CVE-2026-60113](https://insights.sbomify.com/CVE-2026-60113/): AIT-DSN < 2.2.2 Missing Authentication via SLE API Routes (critical 9.3)
- [CVE-2026-60112](https://insights.sbomify.com/CVE-2026-60112/): AIT-GUI < 2.5.1 Missing Authentication via Sessions.create() (critical 9.3)
- [CVE-2026-6011](https://insights.sbomify.com/CVE-2026-6011/): OpenClaw assertPublicHostname web-fetch.ts server-side request forgery (medium 6.3)
- [CVE-2026-60109](https://insights.sbomify.com/CVE-2026-60109/): Zeek < 8.0.9 Null Pointer Dereference DoS via Kerberos KRB_ERROR Parsing (high 8.7)
- [CVE-2026-60108](https://insights.sbomify.com/CVE-2026-60108/): Zeek < 8.0.9 Uncontrolled Memory Consumption DoS via FTP Analyzer (high 8.7)
- [CVE-2026-60105](https://insights.sbomify.com/CVE-2026-60105/): Monsta FTP < 2.14.5 SSRF via IPv4-Mapped IPv6 Address Bypass (high 7.7)
- [CVE-2026-60104](https://insights.sbomify.com/CVE-2026-60104/): Bitwarden Server < 2026.6.0 Authorization Bypass via Admin Auth Request (critical 9.3)
- [CVE-2026-60103](https://insights.sbomify.com/CVE-2026-60103/): Blender 3.0.0 - 5.1.2 Out-of-Bounds Read via crafted .blend SDNA block (medium 6.8)
- [CVE-2026-60102](https://insights.sbomify.com/CVE-2026-60102/): Horde VFS < 3.0.1 OS Command Injection via Horde_Vfs_Smb Driver (high 7.7)
- [CVE-2026-6010](https://insights.sbomify.com/CVE-2026-6010/): CodeAstro Online Classroom takeassessment2.php sql injection (medium 5.3)
- [CVE-2026-60095](https://insights.sbomify.com/CVE-2026-60095/): Vinchin Backup & Recovery 9.0.0.86562 Stack Buffer Overflow via ModuleHandShake (medium 6.9)
- [CVE-2026-60094](https://insights.sbomify.com/CVE-2026-60094/): Vinchin Backup & Recovery 9.0.0.86562 Heap Buffer Overflow via agentlink_server (medium 6.9)
- [CVE-2026-60093](https://insights.sbomify.com/CVE-2026-60093/): Apache Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download target from the remote path name without constraining it to the configured fileDir (medium 5.5)
- [CVE-2026-60092](https://insights.sbomify.com/CVE-2026-60092/): AVideo - Stored Cross-Site Scripting via Unescaped User-Agent in Participants Panel (medium 5.1)
- [CVE-2026-60091](https://insights.sbomify.com/CVE-2026-60091/): PraisonAI before 4.6.78 Unauthenticated SSRF via webhook_url (medium 6.9)
- [CVE-2026-60090](https://insights.sbomify.com/CVE-2026-60090/): PraisonAI before 4.6.78 SQL/CQL Injection via vector dimension (critical 9.3)
- [CVE-2026-6009](https://insights.sbomify.com/CVE-2026-6009/): Jaspersoft Library Deserialisation Vulnerability (high 8.7)
- [CVE-2026-60089](https://insights.sbomify.com/CVE-2026-60089/): PraisonAI before 1.6.78 Path Traversal via config.toml (medium 6.9)
- [CVE-2026-60088](https://insights.sbomify.com/CVE-2026-60088/): PraisonAI before 4.6.78 Path Traversal via Custom Commands (medium 6.8)
- [CVE-2026-60087](https://insights.sbomify.com/CVE-2026-60087/): PraisonAI before 1.6.78 Tool Approval Cache Bypass (medium 6.9)
- [CVE-2026-60086](https://insights.sbomify.com/CVE-2026-60086/): PraisonAI before 4.6.78 Prompt Injection Defense Bypass (medium 6.9)
- [CVE-2026-60085](https://insights.sbomify.com/CVE-2026-60085/): PraisonAI before 4.6.78 Unenforced Security Policy in Subprocess Sandbox (high 8.7)
- [CVE-2026-60084](https://insights.sbomify.com/CVE-2026-60084/): SiYuan before v3.7.4 Arbitrary File Deletion via removeTemplate (high 8.4)
- [CVE-2026-60083](https://insights.sbomify.com/CVE-2026-60083/): SiYuan before v3.8.0 Incomplete Path Blocklist via MCP file tool (medium 6.9)
- [CVE-2026-60082](https://insights.sbomify.com/CVE-2026-60082/): DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row (critical 9.1)
- [CVE-2026-60081](https://insights.sbomify.com/CVE-2026-60081/): DBI::ProfileData versions before 1.651 for Perl do not limit the path index (high 7.5)
- [CVE-2026-60080](https://insights.sbomify.com/CVE-2026-60080/): Apache Fory: Rust MetaString heap use-after-free (high 7.3)
- [CVE-2026-6008](https://insights.sbomify.com/CVE-2026-6008/): IDOR in Im Park's DijiDemi (medium 6.8)
- [CVE-2026-60075](https://insights.sbomify.com/CVE-2026-60075/): Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time. (high 7.5)
- [CVE-2026-60074](https://insights.sbomify.com/CVE-2026-60074/): Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check. (high 7.5)
- [CVE-2026-60073](https://insights.sbomify.com/CVE-2026-60073/): AutomationDirect Productivity Suite Out-of-bounds Read (medium 5.2)
- [CVE-2026-6007](https://insights.sbomify.com/CVE-2026-6007/): itsourcecode Construction Management System del.php sql injection (medium 5.3)
- [CVE-2026-60065](https://insights.sbomify.com/CVE-2026-60065/): NGINX Plus ngx_stream_mqtt_filter_module vulnerability (medium 6.3)
- [CVE-2026-60063](https://insights.sbomify.com/CVE-2026-60063/): AutomationDirect Productivity Suite Out-of-bounds Write (high 7.3)
- [CVE-2026-60062](https://insights.sbomify.com/CVE-2026-60062/): NGINX Agent Vulnerability (medium 5.3)
- [CVE-2026-60060](https://insights.sbomify.com/CVE-2026-60060/): Memory corruption in TTSSH2 (medium 5.1)
- [CVE-2026-6006](https://insights.sbomify.com/CVE-2026-6006/): code-projects Patient Record Management System edit_hpatient.php sql injection (medium 5.3)
- [CVE-2026-60053](https://insights.sbomify.com/CVE-2026-60053/): Apache Answer: Residual Administrative API Key Access After Role or Account Revocation (critical 9.1)
- [CVE-2026-6005](https://insights.sbomify.com/CVE-2026-6005/): code-projects Patient Record Management System hematology_print.php sql injection (medium 5.3)
- [CVE-2026-6004](https://insights.sbomify.com/CVE-2026-6004/): code-projects Simple IT Discussion Forum delete-category.php sql injection (medium 6.9)
- [CVE-2026-60034](https://insights.sbomify.com/CVE-2026-60034/): Joomla Extension - themexpert.com - Authenticated stored XSS in JMedia Extension < 1.6.0 (critical 9.4)
- [CVE-2026-60033](https://insights.sbomify.com/CVE-2026-60033/): Joomla Extension - themexpert.com - SSRF via remote download in JMedia Extension < 1.6.0 (medium 5.1)
- [CVE-2026-60032](https://insights.sbomify.com/CVE-2026-60032/): Joomla Extension - themexpert.com - Authenticated arbitrary file upload in JMedia < 1.6.0 (critical 9.4)
- [CVE-2026-60031](https://insights.sbomify.com/CVE-2026-60031/): Joomla Extension - themexpert.com - Information disclosure in Quix Page Builder < 6.2.1 (medium 6.9)
- [CVE-2026-60030](https://insights.sbomify.com/CVE-2026-60030/): Joomla Extension - themexpert.com - Broken Access Control for media management in Quix Page Builder < 6.2.1 (high 8.7)
- [CVE-2026-6003](https://insights.sbomify.com/CVE-2026-6003/): code-projects Simple IT Discussion Forum user.php cross site scripting (medium 4.8)
- [CVE-2026-60029](https://insights.sbomify.com/CVE-2026-60029/): Joomla Extension - themexpert.com - Authenticated stored XSS in Quix Page Builder < 6.2.1 (medium 5.1)
- [CVE-2026-60028](https://insights.sbomify.com/CVE-2026-60028/): Joomla Extension - themexpert.com - Authenticated stored XSS in Quix Page Builder < 6.2.1 (high 8.6)
- [CVE-2026-60027](https://insights.sbomify.com/CVE-2026-60027/): Joomla Extension - themexpert.com - Unauthenticated path traversal / file read in Quix Page Builder < 6.2.1 (high 8.7)
- [CVE-2026-60026](https://insights.sbomify.com/CVE-2026-60026/): Joomla Extension - themexpert.com - Authenticated PHP code execution in Quix Page Builder < 6.2.1 (high 8.9)
- [CVE-2026-60025](https://insights.sbomify.com/CVE-2026-60025/): Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0 (high 8.8)
- [CVE-2026-60024](https://insights.sbomify.com/CVE-2026-60024/): Joomla Extension - joomdonation.com - Insecure default configuration Events Booking < 5.8.0 (critical 9.8)
- [CVE-2026-60023](https://insights.sbomify.com/CVE-2026-60023/): Apache Answer: Unauthorized disclosure of deleted or pending answer content (high 7.5)
- [CVE-2026-60021](https://insights.sbomify.com/CVE-2026-60021/): Gitea GitLab migration denial of service (medium 6.5)
- [CVE-2026-6002](https://insights.sbomify.com/CVE-2026-6002/): HTML Injection in DivvyDrive Information Technologies' DivvyDrive (high 8.8)
- [CVE-2026-60018](https://insights.sbomify.com/CVE-2026-60018/): Gitea OneDev migration denial of service (medium 6.5)
- [CVE-2026-60011](https://insights.sbomify.com/CVE-2026-60011/): Missing authorization in Sharp MFPs (medium 6.9)
- [CVE-2026-60010](https://insights.sbomify.com/CVE-2026-60010/): Gitea organization team policy bypass through repository API (medium 6.5)
- [CVE-2026-6001](https://insights.sbomify.com/CVE-2026-6001/): IDOR in Abis Technology's BAPSİS (high 8.8)
- [CVE-2026-60009](https://insights.sbomify.com/CVE-2026-60009/): Cross-site request forgery in Eclipse Theia (high 8.8)
- [CVE-2026-60008](https://insights.sbomify.com/CVE-2026-60008/): Gitea Jupyter notebook UI redress through CSS class injection (low 3.5)
- [CVE-2026-60007](https://insights.sbomify.com/CVE-2026-60007/): Weak cryptography in Eclipse Milo (critical 9.1)
- [CVE-2026-60005](https://insights.sbomify.com/CVE-2026-60005/): NGINX ngx_http_slice_module vulnerability (high 8.8)
- [CVE-2026-60004](https://insights.sbomify.com/CVE-2026-60004/): Gitea Code Injection (critical 9.8, exploited in the wild)
- [CVE-2026-60002](https://insights.sbomify.com/CVE-2026-60002/): Use after free in OpenSSH (high 7.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/508/