# Vulnerabilities published in 2026


- [CVE-2026-5201](https://insights.sbomify.com/CVE-2026-5201/): Gdk-pixbuf: gdk-pixbuf: denial of service via heap-based buffer overflow when processing a specially crafted jpeg image (high 7.5)
- [CVE-2026-52001](https://insights.sbomify.com/CVE-2026-52001/): An issue in geelen mcp-remote 0.1.18 through 0.1.38 allows a remote attacker to obtain sensitive information via the SSE transport eventSour (high 7.5)
- [CVE-2026-5200](https://insights.sbomify.com/CVE-2026-5200/): Missing authorization in AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress (high 8.8)
- [CVE-2026-51997](https://insights.sbomify.com/CVE-2026-51997/): An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the open() functions (high 8.8)
- [CVE-2026-51996](https://insights.sbomify.com/CVE-2026-51996/): An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the src/lib/utils.ts and the getS (critical 9.8)
- [CVE-2026-51995](https://insights.sbomify.com/CVE-2026-51995/): An issue in geelen mcp-remote 0.1.32 through 0.1.38 allows a remote attacker to obtain sensitive information via the src/lib/authorization-s (high 7.5)
- [CVE-2026-51994](https://insights.sbomify.com/CVE-2026-51994/): mcp-remote versions 0.1.32 through 0.1.38 are vulnerable to Server-Side Request Forgery (SSRF) via the resource_metadata URL extracted from (critical 9.1)
- [CVE-2026-51990](https://insights.sbomify.com/CVE-2026-51990/): An issue in Sogou Sogou Input Method < 16.3.0.3498 (fixed in 16.3.0.3498) allows a remote attacker to execute arbitrary code via the biz_hel (critical 9.8)
- [CVE-2026-5199](https://insights.sbomify.com/CVE-2026-5199/): Cross Namespace Access via Batch Operation (low 2.3)
- [CVE-2026-5198](https://insights.sbomify.com/CVE-2026-5198/): code-projects Student Membership System Admin Login index.php sql injection (medium 6.9)
- [CVE-2026-51977](https://insights.sbomify.com/CVE-2026-51977/): An issue in Trueview T18061 WiFi 3MP Robot Pan-Tilt Security Camera Version 1.0 allows a physically proximate attacker to escalate privilege (critical 9.1)
- [CVE-2026-51974](https://insights.sbomify.com/CVE-2026-51974/): An eval() injection vulnerability in the get_list function in modules/meta_parser.py in lllyasviel Fooocus 2.1.854 through 2.5.5 allows remo (high 8.8)
- [CVE-2026-5197](https://insights.sbomify.com/CVE-2026-5197/): code-projects Student Membership System delete_user.php sql injection (medium 5.3)
- [CVE-2026-5196](https://insights.sbomify.com/CVE-2026-5196/): code-projects Student Membership System delete_member.php sql injection (medium 5.3)
- [CVE-2026-51956](https://insights.sbomify.com/CVE-2026-51956/): A Broken Object Level Authorization vulnerability exists in Grashjs Atlas CMMS prior to v1.6.0. (high 8.1)
- [CVE-2026-51954](https://insights.sbomify.com/CVE-2026-51954/): An issue in Webasyst Framework 4.0.3 and before allows a remote attacker to execute arbitrary code via a crafted OAuth authorization URL wit (not scored)
- [CVE-2026-51953](https://insights.sbomify.com/CVE-2026-51953/): An issue in FeehiCMS v.2.1.1 allows an attacker to escalate privileges via the Session management module, authentication logic, logout handl (high 7.4)
- [CVE-2026-5195](https://insights.sbomify.com/CVE-2026-5195/): code-projects Student Membership System User Registration sql injection (medium 6.9)
- [CVE-2026-51947](https://insights.sbomify.com/CVE-2026-51947/): An issue in Pivotal CRM 6.6.4.08 and systems using patch-ghi-15381-cwe-502-20251225.zip (fixed in Pivotal CRM 6.6.5.10 and Patch_CWE502_2026 (critical 9.8)
- [CVE-2026-51946](https://insights.sbomify.com/CVE-2026-51946/): SQL Injection vulnerability in GoAdminGroup GoAdmin (last release v1.2.26) allows a remote attacker to execute arbitrary code and obtain sen (medium 6.5)
- [CVE-2026-5194](https://insights.sbomify.com/CVE-2026-5194/): wolfSSL ECDSA Certificate Verification (critical 9.3)
- [CVE-2026-51937](https://insights.sbomify.com/CVE-2026-51937/): An issue in Oneblog V2.3.9 allows a remote attacker to obtain sensitive information via the RestApiController.java, JsApiTicketComponent.jav (high 7.5)
- [CVE-2026-51936](https://insights.sbomify.com/CVE-2026-51936/): SQL injection in SQLCipher (low 2.1)
- [CVE-2026-51934](https://insights.sbomify.com/CVE-2026-51934/): Buffer Overflow vulnerability in Shenzhen Jixiang Tengda Technology Co., Ltd. (critical 9.8)
- [CVE-2026-5193](https://insights.sbomify.com/CVE-2026-5193/): Privilege escalation in Essential Addons for Elementor – Popular Elementor Templates & Widgets (medium 6.5)
- [CVE-2026-51926](https://insights.sbomify.com/CVE-2026-51926/): An issue in docuForm GmbH FSM Client v.11.11c allows a remote attacker to obtain sensitive information via the login.php component. (high 7.5)
- [CVE-2026-51925](https://insights.sbomify.com/CVE-2026-51925/): A Local File Inclusion (LFI) vulnerability exists in docuForm GmbH Client v.11.11c that allows a remote attacker to execute arbitrary code v (high 8.1)
- [CVE-2026-51924](https://insights.sbomify.com/CVE-2026-51924/): An issue in docuForm GmbH Client v.11.11c allows a remote attacker to execute arbitrary code via the file upload and report.php component (high 8.1)
- [CVE-2026-51923](https://insights.sbomify.com/CVE-2026-51923/): An Insecure Direct Object Reference (IDOR) vulnerability exists in docuForm GmbH Client v.11.11c allowing a remote attacker to execute arbit (high 8.1)
- [CVE-2026-51922](https://insights.sbomify.com/CVE-2026-51922/): agentscope v1.0.20 contains code injection in execute_shell_command (src/agentscope/tool/_coding/_shell.py). (critical 9.8)
- [CVE-2026-5192](https://insights.sbomify.com/CVE-2026-5192/): Path traversal in Forminator Forms – Contact Form, Payment Form & Custom Form Builder (high 7.5)
- [CVE-2026-51918](https://insights.sbomify.com/CVE-2026-51918/): FinRobot 1.0.0 contains code injection in CodingUtils.create_file_with_code (). (critical 9.8)
- [CVE-2026-51917](https://insights.sbomify.com/CVE-2026-51917/): FinRobot v1.0.0 is vulnerable to Code Injection in CodingUtils.modify_code. (high 7.3)
- [CVE-2026-51916](https://insights.sbomify.com/CVE-2026-51916/): TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability in delete_user_knowledge in superagi/controllers/knowledges.py. (high 7.5)
- [CVE-2026-51915](https://insights.sbomify.com/CVE-2026-51915/): TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the tool controller. (critical 9.8)
- [CVE-2026-51914](https://insights.sbomify.com/CVE-2026-51914/): TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the agent template controller. (high 8.8)
- [CVE-2026-51912](https://insights.sbomify.com/CVE-2026-51912/): OpenBMB XAgent v1.0.0 contains directory traversal vulnerability in main-upload_file-the-preserved-live-upload-file-witness-directly-reaches (not scored)
- [CVE-2026-51911](https://insights.sbomify.com/CVE-2026-51911/): vanna v2.0.2 contains a code injection vulnerability in VannaBase.get_plotly_figure (src/vanna/legacy/base/base.py). (critical 9.8)
- [CVE-2026-5191](https://insights.sbomify.com/CVE-2026-5191/): Cross-site scripting in Tiled Gallery Carousel Without JetPack (medium 5.4)
- [CVE-2026-51907](https://insights.sbomify.com/CVE-2026-51907/): In TaskingAI v0.3.0 in the QR Code Generator plugin save_base64_image function, a path traversal vulnerability allows attackers to write ima (high 8.1)
- [CVE-2026-51906](https://insights.sbomify.com/CVE-2026-51906/): In TaskingAI v0.3.0 in the DALL-E 3 image generation tool save_url_image function, a path traversal vulnerability allows attackers to write (critical 9.1)
- [CVE-2026-51905](https://insights.sbomify.com/CVE-2026-51905/): TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in get_agent_execution_configuration in superagi/controllers/a (not scored)
- [CVE-2026-51904](https://insights.sbomify.com/CVE-2026-51904/): SuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent execution controller. (critical 9.8)
- [CVE-2026-51903](https://insights.sbomify.com/CVE-2026-51903/): SuperAGI v0.0.14 contains an improper access control vulnerability in get_agent_by_latest_execution in superagi/controllers/agent_execution.py. (not scored)
- [CVE-2026-51902](https://insights.sbomify.com/CVE-2026-51902/): SuperAGI up to v0.0.14 contains an improper access control vulnerability. (not scored)
- [CVE-2026-51901](https://insights.sbomify.com/CVE-2026-51901/): SuperAGI up to 0.0.14 is vulnerable to Incorrect Access Control. (high 8.1)
- [CVE-2026-5190](https://insights.sbomify.com/CVE-2026-5190/): AWS C Event Stream Streaming Decoder Stack Buffer Overflow (high 7.7)
- [CVE-2026-51899](https://insights.sbomify.com/CVE-2026-51899/): In SuperAGI v0.0.14 and prior, controller endpoints (/api/agents/create, /api/agents/schedule, /api/agents/delete, /api/agents/edit_schedule (medium 4.3)
- [CVE-2026-51898](https://insights.sbomify.com/CVE-2026-51898/): sinaptik-ai pandas-ai 3.0.0 is vulnerable to Code Injection in CodeExecutor.execute. (critical 9.8)
- [CVE-2026-51897](https://insights.sbomify.com/CVE-2026-51897/): RAGFlow 0.24.0 contains improper access control in get_dataset (api/apps/evaluation_app). (critical 9.8)
- [CVE-2026-51896](https://insights.sbomify.com/CVE-2026-51896/): infiniflow ragflow 0.25.3 contains improper access control in resume (api/apps/connector_app.py). (medium 6.5)
- [CVE-2026-51895](https://insights.sbomify.com/CVE-2026-51895/): Ragflow 0.24.0 and prior contains improper access control in update_metadata_setting (api/apps/kb_app.py). (medium 6.5)
- [CVE-2026-51894](https://insights.sbomify.com/CVE-2026-51894/): infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via run_mindmap. (medium 6.5)
- [CVE-2026-51893](https://insights.sbomify.com/CVE-2026-51893/): infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via trace_mindmap. (critical 9.8)
- [CVE-2026-51892](https://insights.sbomify.com/CVE-2026-51892/): infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via /v1/document/get/<doc_id>. (medium 6.5)
- [CVE-2026-5189](https://insights.sbomify.com/CVE-2026-5189/): Nexus Repository 3 - Hardcoded Credential in Internal Database Component (critical 9.2)
- [CVE-2026-51888](https://insights.sbomify.com/CVE-2026-51888/): langflow-ai langflow v1.8.4 is affected by: Directory Traversal. (high 7.5)
- [CVE-2026-51886](https://insights.sbomify.com/CVE-2026-51886/): Langflow: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description (critical 9.8)
- [CVE-2026-51884](https://insights.sbomify.com/CVE-2026-51884/): The /knowledge_base/upload_temp_docs temporary document upload endpoint in Langchain Chatchat 0.3.1 is vulnerable to path traversal. (critical 9.8)
- [CVE-2026-51883](https://insights.sbomify.com/CVE-2026-51883/): The knowledge base creation and document upload interfaces in Langchain-Chatchat 0.3.0;0.3.1 is vulnerable to path traversal. (critical 9.1)
- [CVE-2026-51882](https://insights.sbomify.com/CVE-2026-51882/): The OpenAI-compatible file upload endpoint `/v1/files` in Langchain-Chatchat 0.3.0 is vulnerable to path traversal. (critical 9.1)
- [CVE-2026-51881](https://insights.sbomify.com/CVE-2026-51881/): deeptutor 1.4.0 contains code injection in ExecTool.execute. (critical 9.8)
- [CVE-2026-51880](https://insights.sbomify.com/CVE-2026-51880/): deeptutor 1.4.0 contains a path traversal issue in EditFileTool.execute. (critical 9.8)
- [CVE-2026-5188](https://insights.sbomify.com/CVE-2026-5188/): Integer underflow in X.509 SAN parsing in wolfSSL (low 2.3)
- [CVE-2026-51879](https://insights.sbomify.com/CVE-2026-51879/): deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TutorBotManager.write_bot_file. (critical 9.1)
- [CVE-2026-51878](https://insights.sbomify.com/CVE-2026-51878/): deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TurnRuntimeManager.regenerate_last_turn. (medium 4.3)
- [CVE-2026-51876](https://insights.sbomify.com/CVE-2026-51876/): DeepTutor 1.4.0 contains an authorization bypass vulnerability in the book confirmation flow. (critical 9.1)
- [CVE-2026-51875](https://insights.sbomify.com/CVE-2026-51875/): In Devika v1.0, the Feature Agent save_code_to_project function contains a path traversal vulnerability that allows attackers to write files (critical 9.1)
- [CVE-2026-51874](https://insights.sbomify.com/CVE-2026-51874/): In Devika v1.0, the Patcher Agent save_code_to_project function contains a path traversal vulnerability that allows attackers to write files (high 7.5)
- [CVE-2026-51873](https://insights.sbomify.com/CVE-2026-51873/): Devika v1.0 is vulnerable to Directory Traversal in the Coder.save_code_to_project function, which allows attackers to write files outside t (high 8.8)
- [CVE-2026-51872](https://insights.sbomify.com/CVE-2026-51872/): Devika v1.0 is vulnerable to Code Injection via the Runner.run_code function in src/agents/runner/runner.py. (critical 9.8)
- [CVE-2026-51871](https://insights.sbomify.com/CVE-2026-51871/): Devika v1.0 is vulnerable to Code Injection in the Runner.execute function in src/agents/runner/runner.py which allows an attacker to achiev (critical 9.8)
- [CVE-2026-51870](https://insights.sbomify.com/CVE-2026-51870/): DeepTutor v1.4.0 is vulnerable to command execution in /tutorbot/agent/tools/shell.py:ExecTool.execute. (critical 9.8)
- [CVE-2026-5187](https://insights.sbomify.com/CVE-2026-5187/): Heap Out-of-Bounds Write in DecodeObjectId() in wolfSSL (low 2.3)
- [CVE-2026-51869](https://insights.sbomify.com/CVE-2026-51869/): DB-GPT v0.8.0 sandbox API silently falls back to LocalRuntime and executes code on host. (critical 9.8)
- [CVE-2026-51867](https://insights.sbomify.com/CVE-2026-51867/): agentgpt v.1.0.0 is vulnerable to Incorrect Access Control in next/src/server/api/routers/agentRouter.ts. (critical 9.8)
- [CVE-2026-51866](https://insights.sbomify.com/CVE-2026-51866/): In DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/upload route can later be executed through the real /api/v1/chat/react-agent flow. (critical 9.8)
- [CVE-2026-51864](https://insights.sbomify.com/CVE-2026-51864/): DB-GPT v0.7.5 and v0.8.0 contains directory traversal in python_file_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/python_upload_api.py:42). (critical 9.1)
- [CVE-2026-51863](https://insights.sbomify.com/CVE-2026-51863/): DB-GPT v0.7.5 and 0.8.0 contains directory traversal in use_example_file (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/examples_api.py:129). (not scored)
- [CVE-2026-51862](https://insights.sbomify.com/CVE-2026-51862/): DB-GPT 0.8.0 contains directory traversal in skill_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_data_api.py:40). (critical 9.1)
- [CVE-2026-51861](https://insights.sbomify.com/CVE-2026-51861/): bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection in src/backend/bisheng/api/v1/validate.py. (critical 9.8)
- [CVE-2026-51860](https://insights.sbomify.com/CVE-2026-51860/): bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Directory Traversal in src/backend/bisheng/linsight/domain/task_exec.py. (high 7.5)
- [CVE-2026-5186](https://insights.sbomify.com/CVE-2026-5186/): Nothings stb Multi-frame GIF File stb_image.h stbi__load_gif_main double free (medium 4.8)
- [CVE-2026-51859](https://insights.sbomify.com/CVE-2026-51859/): bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to directory traversal in save_download_file (src/backend/bisheng/core/cache/utils.py:290). (critical 9.1)
- [CVE-2026-51858](https://insights.sbomify.com/CVE-2026-51858/): In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, TerminalToolkit.shell_exec allows prompt-driven shell command execution without an approval boundary. (critical 9.8)
- [CVE-2026-51857](https://insights.sbomify.com/CVE-2026-51857/): In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, CodeExecutionToolkit can run model-produced Python code through SubprocessInterpreter w (critical 9.8)
- [CVE-2026-51856](https://insights.sbomify.com/CVE-2026-51856/): In agentscope 1.0.18, 1.0.19, and 1.0.19 when the RealtimeAgent session exposes execute_python_code as an available tool, a remote WebSocket (critical 9.8)
- [CVE-2026-51853](https://insights.sbomify.com/CVE-2026-51853/): agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.__init__. (high 7.5)
- [CVE-2026-51852](https://insights.sbomify.com/CVE-2026-51852/): agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.save_file_b64. (high 7.5)
- [CVE-2026-51851](https://insights.sbomify.com/CVE-2026-51851/): modelscope agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.save_text_file. (not scored)
- [CVE-2026-5185](https://insights.sbomify.com/CVE-2026-5185/): Nothings stb_image Multi-frame GIF File stb_image.h stbi__gif_load_next heap-based overflow (medium 4.8)
- [CVE-2026-51846](https://insights.sbomify.com/CVE-2026-51846/): Memory corruption in tenda:ac7 firmware (critical 9.8)
- [CVE-2026-51845](https://insights.sbomify.com/CVE-2026-51845/): Memory corruption in tenda:ac7 firmware (critical 9.8)
- [CVE-2026-51844](https://insights.sbomify.com/CVE-2026-51844/): Memory corruption in tenda:ac7 firmware (critical 9.8)
- [CVE-2026-51843](https://insights.sbomify.com/CVE-2026-51843/): Memory corruption in tenda:ac7 firmware (critical 9.8)
- [CVE-2026-5184](https://insights.sbomify.com/CVE-2026-5184/): TRENDnet TEW-713RE setSysAdm command injection (medium 5.3)
- [CVE-2026-51833](https://insights.sbomify.com/CVE-2026-51833/): Xenforo 2.3.8 is vulnerable to SSRF. (high 7.5)
- [CVE-2026-51832](https://insights.sbomify.com/CVE-2026-51832/): An issue in IDrive IDrive Backup for Windows Version 7.0.1.1 and below affected, remediated in Version 7.0.1.2 allows a local attacker to ex (not scored)
- [CVE-2026-51831](https://insights.sbomify.com/CVE-2026-51831/): An issue in IDrive IDrive Backup for Windows Version 7.0.1.1 and below affected, remediated in Version 7.0.1.2 allows a local attacker to ex (not scored)
- [CVE-2026-5183](https://insights.sbomify.com/CVE-2026-5183/): TRENDnet TEW-713RE addRouting sub_421494 command injection (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/570/