# Vulnerabilities published in 2026


- [CVE-2026-5156](https://insights.sbomify.com/CVE-2026-5156/): Tenda CH22 Parameter QuickIndex formQuickIndex stack-based overflow (high 8.7)
- [CVE-2026-5155](https://insights.sbomify.com/CVE-2026-5155/): Tenda CH22 Parameter AdvSetWan fromAdvSetWan stack-based overflow (high 8.7)
- [CVE-2026-51541](https://insights.sbomify.com/CVE-2026-51541/): Memory corruption in opener project:opener (critical 9.1)
- [CVE-2026-51540](https://insights.sbomify.com/CVE-2026-51540/): Integer overflow in opener project:opener (critical 9.8)
- [CVE-2026-5154](https://insights.sbomify.com/CVE-2026-5154/): Tenda CH22 Parameter setcfm fromSetCfm stack-based overflow (high 8.7)
- [CVE-2026-51539](https://insights.sbomify.com/CVE-2026-51539/): A Denial of Service (DoS) vulnerability exists in the receive loop of libmodbus 3.1.12 when running on Windows. (high 7.5)
- [CVE-2026-51538](https://insights.sbomify.com/CVE-2026-51538/): Auth bypass in opener project:opener (critical 9.1)
- [CVE-2026-51537](https://insights.sbomify.com/CVE-2026-51537/): Memory corruption in opener project:opener (critical 9.1)
- [CVE-2026-51536](https://insights.sbomify.com/CVE-2026-51536/): Integer overflow in opener project:opener (critical 9.1)
- [CVE-2026-51535](https://insights.sbomify.com/CVE-2026-51535/): In OpENer 2.3.0 (commit 76b95cf), a resource exhaustion (Denial of Service) vulnerability exists in its network processing loop. (high 7.5)
- [CVE-2026-5153](https://insights.sbomify.com/CVE-2026-5153/): Tenda CH22 WriteFacMac FormWriteFacMac command injection (medium 5.3)
- [CVE-2026-5152](https://insights.sbomify.com/CVE-2026-5152/): Tenda CH22 createFileName formCreateFileName stack-based overflow (high 8.7)
- [CVE-2026-5150](https://insights.sbomify.com/CVE-2026-5150/): code-projects Accounting System Parameter viewin_costumer.php sql injection (medium 6.9)
- [CVE-2026-5149](https://insights.sbomify.com/CVE-2026-5149/): Missing authorization in RTMKit (medium 6.5)
- [CVE-2026-5148](https://insights.sbomify.com/CVE-2026-5148/): YunaiV yudao-cloud page sql injection (medium 5.1)
- [CVE-2026-5147](https://insights.sbomify.com/CVE-2026-5147/): YunaiV yudao-cloud get-by-website sql injection (medium 6.9)
- [CVE-2026-5146](https://insights.sbomify.com/CVE-2026-5146/): Missing authorization in Server (medium 4.3)
- [CVE-2026-5144](https://insights.sbomify.com/CVE-2026-5144/): BuddyPress Groupblog <= 1.9.3 - Authenticated (Subscriber+) Privilege Escalation to Administrator via Group Blog IDOR (high 8.8)
- [CVE-2026-5142](https://insights.sbomify.com/CVE-2026-5142/): Foreman: foreman: cross-tenant private ssh key disclosure via taxonomy scoping bypass (medium 6.5)
- [CVE-2026-5141](https://insights.sbomify.com/CVE-2026-5141/): Improper Access Control in TUBITAK BILGEM's Pardus Software Center (high 8.8)
- [CVE-2026-51401](https://insights.sbomify.com/CVE-2026-51401/): Code injection in vim:vim (high 7.7)
- [CVE-2026-51400](https://insights.sbomify.com/CVE-2026-51400/): Other in vim:vim (high 8.4)
- [CVE-2026-5140](https://insights.sbomify.com/CVE-2026-5140/): Authorization Bypass in TUBITAK BILGEM's Pardus Update (high 8.8)
- [CVE-2026-5139](https://insights.sbomify.com/CVE-2026-5139/): GitLab Plugin Allows Non-Admin Users to Modify Default Instance Configuration (medium 5.4)
- [CVE-2026-51385](https://insights.sbomify.com/CVE-2026-51385/): An issue in safishamsi Open-Source GRAPHIFY v.0.3.2 through v0.4.29 allows a remote attacker to execute arbitrary code via the validate_url, (medium 6.9)
- [CVE-2026-51380](https://insights.sbomify.com/CVE-2026-51380/): Buffer Overflow vulnerability in Tenda AC10 v3 (firmware V03.03.16.09) allows attackers to cause a permanent Denial of Service (DoS) or pote (critical 9.8)
- [CVE-2026-5138](https://insights.sbomify.com/CVE-2026-5138/): Foreman: foreman: information disclosure via improper validation of nested request parameters (medium 4.3)
- [CVE-2026-51376](https://insights.sbomify.com/CVE-2026-51376/): An issue in BitChat for iOS v1.15.0 allows a remote attacker to cause a denial of service via an unauthenticated MESSAGE packet into the mes (medium 6.5)
- [CVE-2026-5137](https://insights.sbomify.com/CVE-2026-5137/): RTMKit <= 2.0.7 - Authenticated (Contributor+) Limited Local File Inclusion via 'template' Parameter (medium 4.3)
- [CVE-2026-51368](https://insights.sbomify.com/CVE-2026-51368/): An issue in Beijing Tongtech Co., Ltd tongweb v.7.0.24 in the Spring HttpInovkerServiceExporter component allows a remote attacker to execut (critical 9.8)
- [CVE-2026-51367](https://insights.sbomify.com/CVE-2026-51367/): An issue in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker to obtain sensitive information via the api_vedo/chat endpoin (high 7.5)
- [CVE-2026-51366](https://insights.sbomify.com/CVE-2026-51366/): SQL Injection vulnerability in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker to execute arbitrary code via the api_vedo (critical 9.9)
- [CVE-2026-5136](https://insights.sbomify.com/CVE-2026-5136/): Foreman: foreman: privilege escalation to administrator-level access via usergroup role assignment manipulation (high 8.8)
- [CVE-2026-5135](https://insights.sbomify.com/CVE-2026-5135/): Foreman: foreman: unauthorized modification of host configurations via broken access control (medium 6.5)
- [CVE-2026-51346](https://insights.sbomify.com/CVE-2026-51346/): SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote attacker to execute arbitrary code and obta (critical 9.1)
- [CVE-2026-5134](https://insights.sbomify.com/CVE-2026-5134/): SQLi in Loca Software's CMS (critical 9.8)
- [CVE-2026-5132](https://insights.sbomify.com/CVE-2026-5132/): Unbounded zlib decompression in Calls SDP WebSocket messages (medium 6.5)
- [CVE-2026-5131](https://insights.sbomify.com/CVE-2026-5131/): Server-Side Request Forgery in GREENmod (medium 6.9)
- [CVE-2026-5130](https://insights.sbomify.com/CVE-2026-5130/): Debugger & Troubleshooter <= 1.3.2 - Unauthenticated Privilege Escalation to Administrator via Cookie Manipulation (high 8.8)
- [CVE-2026-5127](https://insights.sbomify.com/CVE-2026-5127/): Deserialization in User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration (high 8.8)
- [CVE-2026-5126](https://insights.sbomify.com/CVE-2026-5126/): SourceCodester RSS Feed Parser file_get_contents server-side request forgery (medium 5.3)
- [CVE-2026-5125](https://insights.sbomify.com/CVE-2026-5125/): raine consult-llm-mcp server.ts child_process.execSync os command injection (medium 4.8)
- [CVE-2026-5124](https://insights.sbomify.com/CVE-2026-5124/): osrg GoBGP BGP Header bgp.go BGPHeader.DecodeFromBytes access control (medium 6.3)
- [CVE-2026-5123](https://insights.sbomify.com/CVE-2026-5123/): osrg GoBGP bgp.go DecodeFromBytes off-by-one (medium 6.3)
- [CVE-2026-51221](https://insights.sbomify.com/CVE-2026-51221/): A buffer overflow in the Get_Attribute_List function of EIPStackGroup OpENer commit 76b95c allows attackers to cause a Denial of Service (Do (high 7.5)
- [CVE-2026-5122](https://insights.sbomify.com/CVE-2026-5122/): osrg GoBGP BGP OPEN Message bgp.go DecodeFromBytes access control (medium 6.3)
- [CVE-2026-51219](https://insights.sbomify.com/CVE-2026-51219/): A heap buffer overflow in the HighPriorityASDUQueue_hasUnconfirmedIMessages function of lib60870 v2.3.3 to v2.3.6 allows attackers to cause (high 7.5)
- [CVE-2026-51218](https://insights.sbomify.com/CVE-2026-51218/): A heap buffer overflow in the TS7Worker::PerformFunctionWrite() function (/core/s7_server.cpp) of snap7 v1.4.3 allows attackers to cause a D (high 7.5)
- [CVE-2026-5121](https://insights.sbomify.com/CVE-2026-5121/): Libarchive: libarchive: arbitrary code execution via integer overflow in iso9660 image processing (high 7.5)
- [CVE-2026-5120](https://insights.sbomify.com/CVE-2026-5120/): Race Condition vulnerability affecting BIOVIA Workbook from Release 2021 through Release 2026 (high 8.1)
- [CVE-2026-51190](https://insights.sbomify.com/CVE-2026-51190/): The "s init" command in Serverless-Devs @serverless-devs/s <= 3.1.11 passes unsanitized user input to child_process.spawn() with shell: true. (critical 9.8)
- [CVE-2026-5119](https://insights.sbomify.com/CVE-2026-5119/): Libsoup: libsoup: information disclosure via cleartext transmission of cookies during https tunnel establishment (medium 5.9)
- [CVE-2026-5118](https://insights.sbomify.com/CVE-2026-5118/): Divi Form Builder <= 5.1.2 - Unauthenticated Privilege Escalation via 'role' (critical 9.8)
- [CVE-2026-5116](https://insights.sbomify.com/CVE-2026-5116/): Contact Form 7 – Dynamic Text Extension <= 5.0.5 - Authenticated (Editor+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2026-51153](https://insights.sbomify.com/CVE-2026-51153/): Stored Cross-Site Scripting (XSS) in TaskRunHandler.post() in web/handlers/task.py in QD 20220208 through 20250803. (medium 5.4)
- [CVE-2026-51152](https://insights.sbomify.com/CVE-2026-51152/): Server-side request forgery (SSRF) in the /har/test endpoint in QD 20220208 through 20250803. (critical 9.1)
- [CVE-2026-5115](https://insights.sbomify.com/CVE-2026-5115/): Session hijacking in PaperCut NG/MF embedded application for Konica Minolta devices (low 3.6)
- [CVE-2026-51144](https://insights.sbomify.com/CVE-2026-51144/): Cross Site Scripting vulnerability in Soliton Systems MailZen Management Protal v.2.62, v.2.63 allows a remote attacker to execute arbitrary (medium 6.1)
- [CVE-2026-5114](https://insights.sbomify.com/CVE-2026-5114/): SpeedyCache <= 1.3.8 - Authenticated (Administrator+) Arbitrary File Read (medium 4.9)
- [CVE-2026-51134](https://insights.sbomify.com/CVE-2026-51134/): The C-MOR Video Surveillance web interface (up to version 6.0104) is vulnerable to Path Traversal via the 'cam' parameter in show-movies.pml. (high 7.5)
- [CVE-2026-51133](https://insights.sbomify.com/CVE-2026-51133/): Cross Site Scripting vulnerability in za-internet GmbH C-MOR Video Surveillance <= V6.0104 allows a remote attacker to execute arbitrary cod (medium 6.1)
- [CVE-2026-5113](https://insights.sbomify.com/CVE-2026-5113/): Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Consent Field Hidden Input (high 7.2)
- [CVE-2026-5112](https://insights.sbomify.com/CVE-2026-5112/): Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Calculation Product Field in Repeater (high 7.2)
- [CVE-2026-51119](https://insights.sbomify.com/CVE-2026-51119/): An issue in Invixium IXM WEB v.2.3.85.25 allows an attacker to escalate privileges via the /SystemUsers/CreateAppUser components (critical 9.1)
- [CVE-2026-5111](https://insights.sbomify.com/CVE-2026-5111/): Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Hidden Product Field in Repeater (high 7.2)
- [CVE-2026-51106](https://insights.sbomify.com/CVE-2026-51106/): An issue in TokTok qTox v1.18.4 allows a local attacker to cause a denial of service via the src/persistence/serialize.cpp component (critical 9.3)
- [CVE-2026-51105](https://insights.sbomify.com/CVE-2026-51105/): Buffer Overflow vulnerability in aMULE-Project aMule v.2.3.3 allows a remote attacker to cause a denial of service via the OP_SERVERMESSAGE Handler. (high 7.5)
- [CVE-2026-5110](https://insights.sbomify.com/CVE-2026-5110/): Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Single Product Field Inside Repeater (high 7.2)
- [CVE-2026-5109](https://insights.sbomify.com/CVE-2026-5109/): Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Product Option (high 7.2)
- [CVE-2026-51083](https://insights.sbomify.com/CVE-2026-51083/): Incorrect access control in Proxmox Virtual Environment (PVE) 9.x qemu-server before 9.1.8 and 8.x before 8.4.8 allows users within limited (medium 6.5)
- [CVE-2026-51082](https://insights.sbomify.com/CVE-2026-51082/): A race condition between the vncproxy and vncwebsocket API calls in Proxmox Virtual Environment (PVE) 9.x pve-manager before 9.1.9 and 8.x b (high 7.2)
- [CVE-2026-51081](https://insights.sbomify.com/CVE-2026-51081/): A cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment (PVE) 9.x 5.1.8 and Proxmox Virtual Environment (PVE) 8.x 4.3.16 a (medium 6.1)
- [CVE-2026-51080](https://insights.sbomify.com/CVE-2026-51080/): XML external entity in proxmox:libpve-storage-perl (critical 9.8)
- [CVE-2026-5108](https://insights.sbomify.com/CVE-2026-5108/): Cross-site scripting in Super Progressive Web Apps (medium 4.4)
- [CVE-2026-51078](https://insights.sbomify.com/CVE-2026-51078/): An issue in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the str parameter of the file_manage_control.php (high 7.5)
- [CVE-2026-51077](https://insights.sbomify.com/CVE-2026-51077/): SQL injection vulnerability in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the sqlquery parameter of the (high 7.5)
- [CVE-2026-5107](https://insights.sbomify.com/CVE-2026-5107/): FRRouting FRR EVPN Type-2 Route bgp_evpn.c process_type2_route access control (low 2.3)
- [CVE-2026-5106](https://insights.sbomify.com/CVE-2026-5106/): code-projects Exam Form Submission update_fst.php cross site scripting (medium 4.8)
- [CVE-2026-5105](https://insights.sbomify.com/CVE-2026-5105/): Totolink A3300R Parameter cstecgi.cgi setVpnPassCfg command injection (medium 5.3)
- [CVE-2026-5104](https://insights.sbomify.com/CVE-2026-5104/): Totolink A3300R cstecgi.cgi setStaticRoute command injection (medium 5.3)
- [CVE-2026-51031](https://insights.sbomify.com/CVE-2026-51031/): FlareSolverr before version 3.4.7 contains a server-side request forgery (SSRF) vulnerability in the /v1 API endpoint. (high 7.5)
- [CVE-2026-5103](https://insights.sbomify.com/CVE-2026-5103/): Totolink A3300R cstecgi.cgi setUPnPCfg command injection (medium 5.3)
- [CVE-2026-51027](https://insights.sbomify.com/CVE-2026-51027/): An issue in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via the ft2.php component. (critical 9.9)
- [CVE-2026-51026](https://insights.sbomify.com/CVE-2026-51026/): Directory Traversal vulnerability in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via a crafted request. (medium 6.5)
- [CVE-2026-51025](https://insights.sbomify.com/CVE-2026-51025/): Cross Site Scripting vulnerability in fuint Member Marketing System <=v1.0 allows a remote attacker to execute arbitrary code via the Client (medium 6.1)
- [CVE-2026-5102](https://insights.sbomify.com/CVE-2026-5102/): Totolink A3300R Parameter cstecgi.cgi setSmartQosCfg command injection (medium 5.3)
- [CVE-2026-5101](https://insights.sbomify.com/CVE-2026-5101/): Totolink A3300R Parameter cstecgi.cgi setLanCfg command injection (medium 5.3)
- [CVE-2026-5100](https://insights.sbomify.com/CVE-2026-5100/): AWP Classifieds <= 4.4.5 - Unauthenticated SQL Injection via 'regions' (high 7.5)
- [CVE-2026-50986](https://insights.sbomify.com/CVE-2026-50986/): PrestaShop module, totadministrativemandate <1.8.1 is vulnerable to Cross Site Request Forgery (CSRF). (high 8.8)
- [CVE-2026-50980](https://insights.sbomify.com/CVE-2026-50980/): Cross-Site Scripting (XSS) vulnerability in the DNS lookup/management component of oPanel before v1.20.25 allows remote attackers to execute (medium 6.1)
- [CVE-2026-50979](https://insights.sbomify.com/CVE-2026-50979/): A command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier allows authenticated atta (high 8.1)
- [CVE-2026-5097](https://insights.sbomify.com/CVE-2026-5097/): wpForo Forum <= 2.4.17 - Unauthenticated SQL Injection via 'referer' Parameter (high 7.5)
- [CVE-2026-5096](https://insights.sbomify.com/CVE-2026-5096/): Everest Forms <= 3.4.4 - Unauthenticated Server-Side Request Forgery via Upload Field 'Previous Value' (medium 5.3)
- [CVE-2026-5093](https://insights.sbomify.com/CVE-2026-5093/): Greenshift <= 12.8.9 - Authenticated (Contributor+) Theme Settings Modification via 'gspb_update_global_wp_settings' (medium 4.3)
- [CVE-2026-5092](https://insights.sbomify.com/CVE-2026-5092/): Greenshift <= 12.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data URI (medium 6.4)
- [CVE-2026-5091](https://insights.sbomify.com/CVE-2026-5091/): Catalyst::Plugin::Authentication versions through 0.10024 for Perl is susceptible to timing attacks (medium 5.1)
- [CVE-2026-5090](https://insights.sbomify.com/CVE-2026-5090/): Template::Plugin::HTML versions before 3.103 for Perl allows HTML and JavaScript to be injected (medium 6.1)
- [CVE-2026-50894](https://insights.sbomify.com/CVE-2026-50894/): easyadmin v2.0.2.2 is vulnerable to Unrestricted Upload of File with Dangerous Type in the background management interface which allows auth (critical 9.8)
- [CVE-2026-50892](https://insights.sbomify.com/CVE-2026-50892/): Incorrect access control in the "Let's Encrypt" certificate download endpoint of Nginx Proxy Manager v2.14.0 allows authenticated attackers (medium 6.5)
- [CVE-2026-50891](https://insights.sbomify.com/CVE-2026-50891/): Filestash allows attackers to escalate privileges via sending a crafted request (high 8.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/573/