# Vulnerabilities published in 2026


- [CVE-2026-52491](https://insights.sbomify.com/CVE-2026-52491/): An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the libtiff/tools/thumbnail.c: (high 8.4)
- [CVE-2026-52490](https://insights.sbomify.com/CVE-2026-52490/): An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the process_command_opts() fun (critical 9.8)
- [CVE-2026-5249](https://insights.sbomify.com/CVE-2026-5249/): gougucms Record Endpoint record.html cross site scripting (medium 5.1)
- [CVE-2026-52489](https://insights.sbomify.com/CVE-2026-52489/): Buffer Overflow vulnerability in gpac 31becc9e08b88e525a4a62013a4000de1c0f8fd9 allows an attacker to execute arbitrary code via the svgNameT (high 7.8)
- [CVE-2026-52486](https://insights.sbomify.com/CVE-2026-52486/): An issue in OpenDDS 3.33.x allows a local attacker to cause a denial of service via the verify function in the SIgnedDocument module (medium 6.6)
- [CVE-2026-52484](https://insights.sbomify.com/CVE-2026-52484/): An issue in MitraStar GPT-2742GX4X5v6-SV GL_g2.5_100XNT0b23_3 allows an authenticated attacker to execute arbitrary code via the /cgi-bin/de (high 8.8)
- [CVE-2026-52483](https://insights.sbomify.com/CVE-2026-52483/): The ping diagnostics and other similar functions of the MitraStar GPT-2741GNAC-N2-SV router with firmware BR_g8.10_1.11(WVK.0)b46 allow auth (high 8.8)
- [CVE-2026-52482](https://insights.sbomify.com/CVE-2026-52482/): An issue in SJRC F11 SJ-GPS-PRO firmware build 2019-09-17 allows a remote attacker to obtain sensitive information via the inetd service spa (high 7.5)
- [CVE-2026-52481](https://insights.sbomify.com/CVE-2026-52481/): An issue in SJRC F11 SJ-GPS-PRO firmware build 2019-09-17 allows a remote attacker to obtain sensitive information via the tcp_actions() fun (high 7.5)
- [CVE-2026-52480](https://insights.sbomify.com/CVE-2026-52480/): An issue in SJRC F11 SJ-GPS-PRO firmware build 2019-09-17 allows a remote attacker to obtain sensitive information via the inetd service (medium 6.5)
- [CVE-2026-5248](https://insights.sbomify.com/CVE-2026-5248/): gougucms User Registration Login.php reg_submit dynamically-determined object attributes (medium 5.3)
- [CVE-2026-52476](https://insights.sbomify.com/CVE-2026-52476/): SQL Injection vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the getPageData method in the D (high 7.5)
- [CVE-2026-52475](https://insights.sbomify.com/CVE-2026-52475/): Cross Site Scripting vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the UploadController.jav (medium 6.1)
- [CVE-2026-52474](https://insights.sbomify.com/CVE-2026-52474/): An issue in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the JobUtil.java file. (high 7.5)
- [CVE-2026-52473](https://insights.sbomify.com/CVE-2026-52473/): An issue in Wgcloud 3.6.4 allows a remote attacker to escalate privileges via the content parameter is directly concatenated to the ProcessBuilder. (medium 4.3)
- [CVE-2026-52472](https://insights.sbomify.com/CVE-2026-52472/): SQL injection vulnerability in Wgcloud 3.6.4 allows a remote attacker to escalate privileges via the PortInfoMapper.xml file (critical 9.8)
- [CVE-2026-52470](https://insights.sbomify.com/CVE-2026-52470/): SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the RecordStateMapper.xml file (critical 9.8)
- [CVE-2026-5247](https://insights.sbomify.com/CVE-2026-5247/): Cross-site scripting in Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories (medium 5.5)
- [CVE-2026-52469](https://insights.sbomify.com/CVE-2026-52469/): SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the DeviceInfoMapper.xml file (critical 9.8)
- [CVE-2026-52466](https://insights.sbomify.com/CVE-2026-52466/): Open Library Foundation VuFind v11.0.3 and v4.1 is vulnerable to toInorrect Access Control. (critical 9.8)
- [CVE-2026-5246](https://insights.sbomify.com/CVE-2026-5246/): Cesanta Mongoose P-384 Public Key mongoose.c mg_tls_verify_cert_signature authorization (medium 6.3)
- [CVE-2026-5245](https://insights.sbomify.com/CVE-2026-5245/): Cesanta Mongoose mDNS Record mongoose.c handle_mdns_record stack-based overflow (medium 6.3)
- [CVE-2026-5244](https://insights.sbomify.com/CVE-2026-5244/): Cesanta Mongoose TLS 1.3 mongoose.c mg_tls_recv_cert heap-based overflow (medium 6.9)
- [CVE-2026-52439](https://insights.sbomify.com/CVE-2026-52439/): An issue in xiandafu beetl 3.20.2 allows a remote attacker to execute arbitrary code via the type.new function and the property reflection m (critical 9.8)
- [CVE-2026-5243](https://insights.sbomify.com/CVE-2026-5243/): Cross-site scripting in The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce (medium 6.4)
- [CVE-2026-5242](https://insights.sbomify.com/CVE-2026-5242/): Code Injection in Mia Technologies' Pizzy Library (high 8.8)
- [CVE-2026-5241](https://insights.sbomify.com/CVE-2026-5241/): Policy Bypass in LightGlue Nested Config Resolution in huggingface/transformers (high 8.0)
- [CVE-2026-5240](https://insights.sbomify.com/CVE-2026-5240/): code-projects BloodBank Managing System admin_state.php cross site scripting (medium 5.3)
- [CVE-2026-52394](https://insights.sbomify.com/CVE-2026-52394/): DeepSeek V4 is vulnerable to Incorrect Access Control via a crafted input. (critical 9.1)
- [CVE-2026-5238](https://insights.sbomify.com/CVE-2026-5238/): itsourcecode Payroll Management System Parameter view_employee.php sql injection (medium 6.9)
- [CVE-2026-52371](https://insights.sbomify.com/CVE-2026-52371/): A Server-Side Request Forgery (SSRF) in the xxl-job-admin/jobinfo/trigger component of xxl-job v3.4.0 allows authenticated attackers to scan (medium 6.5)
- [CVE-2026-52370](https://insights.sbomify.com/CVE-2026-52370/): A reflected cross-site scripting (XSS) vulnerability in the Forum posting function of O2OA v10 allows attackers to execute arbitrary Javascr (medium 6.1)
- [CVE-2026-5237](https://insights.sbomify.com/CVE-2026-5237/): itsourcecode Payroll Management System Parameter manage_user.php sql injection (medium 6.9)
- [CVE-2026-5236](https://insights.sbomify.com/CVE-2026-5236/): Axiomatic Bento4 DSI v1 Ap4Dac4Atom.cpp SkipBits heap-based overflow (medium 4.8)
- [CVE-2026-52356](https://insights.sbomify.com/CVE-2026-52356/): An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1_FW101WWb04 allows attackers to execut (high 8.8)
- [CVE-2026-5235](https://insights.sbomify.com/CVE-2026-5235/): Axiomatic Bento4 MP4 File Ap4Dac4Atom.cpp ReadCache heap-based overflow (medium 4.8)
- [CVE-2026-52349](https://insights.sbomify.com/CVE-2026-52349/): Directory Traversal vulnerability in Menyoo 2.0 Versions before commit 729aa48: fixed in commit 729aa48 allows a local attacker to execute a (high 7.8)
- [CVE-2026-52348](https://insights.sbomify.com/CVE-2026-52348/): cool-admin-java 8.0.0 has a SQL injection vulnerability in the order() method of CrudOption.java. (critical 9.8)
- [CVE-2026-5234](https://insights.sbomify.com/CVE-2026-5234/): Missing authorization in LatePoint – Calendar Booking Plugin for Appointments and Events (medium 5.3)
- [CVE-2026-5233](https://insights.sbomify.com/CVE-2026-5233/): Missing Rate Limiting in Mia Technologies' Pizzy Library (high 7.1)
- [CVE-2026-5231](https://insights.sbomify.com/CVE-2026-5231/): WP Statistics <= 14.16.4 - Unauthenticated Stored Cross-Site Scripting via 'utm_source' Parameter (high 7.2)
- [CVE-2026-52307](https://insights.sbomify.com/CVE-2026-52307/): An authenticated stored cross-site scripting (XSS) vulnerability in the Column Management component of ClassCMS 1CMS v5.6 allows attackers t (medium 5.4)
- [CVE-2026-5230](https://insights.sbomify.com/CVE-2026-5230/): Improper Access Control in Mia Technologies' Pizzy Library (high 7.1)
- [CVE-2026-52297](https://insights.sbomify.com/CVE-2026-52297/): Memory corruption in FFmpeg (low 2.9)
- [CVE-2026-52296](https://insights.sbomify.com/CVE-2026-52296/): Memory corruption in FFmpeg (low 2.9)
- [CVE-2026-52295](https://insights.sbomify.com/CVE-2026-52295/): Memory corruption in FFmpeg (low 2.9)
- [CVE-2026-5229](https://insights.sbomify.com/CVE-2026-5229/): Auth bypass in Receive Notifications After Form Submitting – Form Notify for Any Forms (critical 9.8)
- [CVE-2026-5228](https://insights.sbomify.com/CVE-2026-5228/): Improper Access Control in Kurt Software Studio's WriteUp Mobile App (high 8.8)
- [CVE-2026-5226](https://insights.sbomify.com/CVE-2026-5226/): Optimole <= 4.2.3 - Reflected Cross-Site Scripting via Page Profiler URL (medium 6.1)
- [CVE-2026-5224](https://insights.sbomify.com/CVE-2026-5224/): Sensitive Data Exposure in Kriptek Crypto's Cryptosim (medium 5.7)
- [CVE-2026-52232](https://insights.sbomify.com/CVE-2026-52232/): A reflected cross-site scripting (XSS) vulnerability in the /logo.asp component of FS Inc S3150-8T2F Switch 2.2.0D Build 118101 allows attac (medium 6.1)
- [CVE-2026-5223](https://insights.sbomify.com/CVE-2026-5223/): Crates in third party registries can override the cached source of other crates (medium 6.5)
- [CVE-2026-5222](https://insights.sbomify.com/CVE-2026-5222/): Cargo can be coerced to share credentials between registries (low 2.3)
- [CVE-2026-52203](https://insights.sbomify.com/CVE-2026-52203/): An issue in MCMS v.6.1.1 allows a remote attacker to obtain sensitive information via the source parameter. (high 7.5)
- [CVE-2026-52200](https://insights.sbomify.com/CVE-2026-52200/): An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the /ajax web management API (critical 9.8)
- [CVE-2026-5220](https://insights.sbomify.com/CVE-2026-5220/): Stored XSS in DivvyDrive Information Technologies' DivvyDrive (medium 6.4)
- [CVE-2026-52199](https://insights.sbomify.com/CVE-2026-52199/): An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the sbin/adbd component (critical 9.1)
- [CVE-2026-52198](https://insights.sbomify.com/CVE-2026-52198/): Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohea (high 7.5)
- [CVE-2026-52197](https://insights.sbomify.com/CVE-2026-52197/): An issue in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_44af70 componen (high 7.5)
- [CVE-2026-52196](https://insights.sbomify.com/CVE-2026-52196/): Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohea (high 7.5)
- [CVE-2026-52195](https://insights.sbomify.com/CVE-2026-52195/): Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohea (high 7.5)
- [CVE-2026-52193](https://insights.sbomify.com/CVE-2026-52193/): Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohea (high 7.5)
- [CVE-2026-52192](https://insights.sbomify.com/CVE-2026-52192/): An issue in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_445C5C componen (high 7.5)
- [CVE-2026-52191](https://insights.sbomify.com/CVE-2026-52191/): Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohea (high 7.5)
- [CVE-2026-52190](https://insights.sbomify.com/CVE-2026-52190/): Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohea (high 7.5)
- [CVE-2026-5219](https://insights.sbomify.com/CVE-2026-5219/): CSRF in Softtr's E-Commerce Pack (high 8.3)
- [CVE-2026-52189](https://insights.sbomify.com/CVE-2026-52189/): Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohea (high 7.5)
- [CVE-2026-52188](https://insights.sbomify.com/CVE-2026-52188/): Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohea (medium 6.5)
- [CVE-2026-52187](https://insights.sbomify.com/CVE-2026-52187/): Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohea (high 7.5)
- [CVE-2026-52186](https://insights.sbomify.com/CVE-2026-52186/): SQL Injection vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to execute arbitrary code via the gohead/sub (critical 9.8)
- [CVE-2026-5218](https://insights.sbomify.com/CVE-2026-5218/): HTML Injection in Softtr's E-Commerce Pack (medium 4.3)
- [CVE-2026-5217](https://insights.sbomify.com/CVE-2026-5217/): Optimole <= 4.2.2 - Unauthenticated Stored Cross-Site Scripting via Srcset Descriptor Parameter (high 7.2)
- [CVE-2026-52167](https://insights.sbomify.com/CVE-2026-52167/): A stack overflow in the gensub_ParsePsb() function of AOC LC32D1320 v2.05 allows attackers to cause a Denial of Service (DoS) via supplying (medium 6.2)
- [CVE-2026-5215](https://insights.sbomify.com/CVE-2026-5215/): D-Link DNS-1550-04 network_mgr.cgi cgi_get_ipv6 access control (medium 5.3)
- [CVE-2026-5214](https://insights.sbomify.com/CVE-2026-5214/): D-Link DNS-1550-04 account_mgr.cgi cgi_addgroup_get_group_quota_minsize stack-based overflow (high 8.7)
- [CVE-2026-52134](https://insights.sbomify.com/CVE-2026-52134/): An issue in the parseGoosePayload() function (/goose/goose_receiver.c) of libiec61850 v1.6 allows attackers to bypass authentication via a captured GOOSE frame. (critical 9.8)
- [CVE-2026-52132](https://insights.sbomify.com/CVE-2026-52132/): Denial of service in ggml:llama.cpp (high 7.5)
- [CVE-2026-52131](https://insights.sbomify.com/CVE-2026-52131/): Denial of service in ggml:llama.cpp (high 7.5)
- [CVE-2026-52130](https://insights.sbomify.com/CVE-2026-52130/): Denial of service in ggml:llama.cpp (high 7.5)
- [CVE-2026-5213](https://insights.sbomify.com/CVE-2026-5213/): D-Link DNS-1550-04 account_mgr.cgi cgi_adduser_to_session stack-based overflow (high 8.7)
- [CVE-2026-5212](https://insights.sbomify.com/CVE-2026-5212/): D-Link DNS-1550-04 webdav_mgr.cgi Webdav_Upload_File stack-based overflow (high 8.7)
- [CVE-2026-52111](https://insights.sbomify.com/CVE-2026-52111/): An issue in fast-note-sync-service <=2.13.7 allows a remote attacker to escalate privileges via the admin configuration endpoint exposes aut (critical 9.8)
- [CVE-2026-5211](https://insights.sbomify.com/CVE-2026-5211/): D-Link DNS-1550-04 app_mgr.cgi UPnP_AV_Server_Path_Del stack-based overflow (high 8.7)
- [CVE-2026-52103](https://insights.sbomify.com/CVE-2026-52103/): A zero-click remote code execution (RCE) vulnerability in the /Terminal/Notification.hs component of SimpleX Chat before v6.5 allows attacke (critical 9.8)
- [CVE-2026-52102](https://insights.sbomify.com/CVE-2026-52102/): An OS command injection vulnerability in the openmediavault-md plugin of OpenMediaVault v8.0.4-1 allows attackers to execute arbitrary comma (critical 9.8)
- [CVE-2026-52101](https://insights.sbomify.com/CVE-2026-52101/): An issue in andreimarcu linux-server v.1.0 through v.2.3.8 allows a remote attacker to obtain sensitive information via the function uploadR (critical 9.1)
- [CVE-2026-52100](https://insights.sbomify.com/CVE-2026-52100/): Cross Site Request Forgery vulnerability in andreimarcu linux-server v.1.0 through v.2.3.8 allows a remote attacker to execute arbitrary cod (high 7.5)
- [CVE-2026-5210](https://insights.sbomify.com/CVE-2026-5210/): SourceCodester Leave Application System file inclusion (medium 6.9)
- [CVE-2026-52098](https://insights.sbomify.com/CVE-2026-52098/): Code injection in flowiseai:flowise (critical 9.8)
- [CVE-2026-52097](https://insights.sbomify.com/CVE-2026-52097/): An issue in AppFlowy 0.11.8 allows a remote attacker to execute arbitrary code via the afLaunchUri, _afLaunchLocalUri (url_launcher.dart), O (medium 6.8)
- [CVE-2026-5209](https://insights.sbomify.com/CVE-2026-5209/): SourceCodester Leave Application System User Management cross site scripting (medium 4.8)
- [CVE-2026-5208](https://insights.sbomify.com/CVE-2026-5208/): Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in coolercontrold (high 8.2)
- [CVE-2026-5207](https://insights.sbomify.com/CVE-2026-5207/): LifterLMS <= 9.2.1 - Authenticated (Custom+) SQL Injection via 'order' Parameter (medium 6.5)
- [CVE-2026-5206](https://insights.sbomify.com/CVE-2026-5206/): code-projects Simple Gym Management System Payment sql injection (medium 5.3)
- [CVE-2026-5205](https://insights.sbomify.com/CVE-2026-5205/): chatwoot Webhook API trigger.rb Trigger server-side request forgery (medium 5.3)
- [CVE-2026-5204](https://insights.sbomify.com/CVE-2026-5204/): Tenda CH22 Parameter webtypelibrary formWebTypeLibrary stack-based overflow (high 8.7)
- [CVE-2026-5203](https://insights.sbomify.com/CVE-2026-5203/): CMS Made Simple UserGuide Module XML Import class.UserGuideImporterExporter.php _copyFilesToFolder path traversal (medium 5.1)
- [CVE-2026-52023](https://insights.sbomify.com/CVE-2026-52023/): Denial of service in kamailio:kamailio (high 7.5)
- [CVE-2026-52022](https://insights.sbomify.com/CVE-2026-52022/): Denial of service in kamailio:kamailio (high 7.5)
- [CVE-2026-52021](https://insights.sbomify.com/CVE-2026-52021/): An issue in code100xDevs 100xdevs CMS v.1.0 (2026-04-30) allows a remote attacker to obtain sensitive information via the src/middleware.ts, (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/569/