# Vulnerabilities published in 2026


- [CVE-2026-3911](https://insights.sbomify.com/CVE-2026-3911/): Keycloak: Information disclosure of disabled user attributes via administrative endpoint (low 2.7)
- [CVE-2026-39109](https://insights.sbomify.com/CVE-2026-39109/): SQL Injection vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 within the username parameter (critical 9.4)
- [CVE-2026-39107](https://insights.sbomify.com/CVE-2026-39107/): A Cross Site Scripting vulnerability exists in the Kimi AI v1.0 web interface's 'Preview' feature. (medium 6.3)
- [CVE-2026-39103](https://insights.sbomify.com/CVE-2026-39103/): Memory corruption in gpac:gpac (medium 5.5)
- [CVE-2026-3910](https://insights.sbomify.com/CVE-2026-3910/): Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer (high 8.8, exploited in the wild)
- [CVE-2026-3909](https://insights.sbomify.com/CVE-2026-3909/): Google Skia Out-of-Bounds Write (high 8.8, exploited in the wild)
- [CVE-2026-39087](https://insights.sbomify.com/CVE-2026-39087/): ntfy.sh allows a remote attacker to execute arbitrary code via the parseActions function (medium 6.4)
- [CVE-2026-39079](https://insights.sbomify.com/CVE-2026-39079/): An issue in prestashop upsshipping all versions through at least 2.4.0 allows a remote attacker to obtain sensitive information via the /mod (high 7.5)
- [CVE-2026-39071](https://insights.sbomify.com/CVE-2026-39071/): WordPress plugin (Spiffy Plugin) before 5.0.9 is affected by Stored Cross-Site Scripting in Event Title field. (medium 5.4)
- [CVE-2026-39070](https://insights.sbomify.com/CVE-2026-39070/): WordPress plugin (Bit Assist) before 1.7.2 is affected by Stored Cross-Site Scripting in Call-To-Action feature. (medium 4.8)
- [CVE-2026-3907](https://insights.sbomify.com/CVE-2026-3907/): Hostel <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wphostel-book' Shortcode (medium 6.4)
- [CVE-2026-3906](https://insights.sbomify.com/CVE-2026-3906/): WordPress 6.9 - 6.9.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Note Creation via REST API (medium 4.3)
- [CVE-2026-39054](https://insights.sbomify.com/CVE-2026-39054/): Oinone Pamirs 7.0.0 contains a command injection vulnerability in CommandHelper.executeCommands. (high 7.3)
- [CVE-2026-39053](https://insights.sbomify.com/CVE-2026-39053/): Oinone Pamirs 7.0.0 contains an XML External Entity (XXE) issue in its XStream-based XML parsing logic. (medium 6.5)
- [CVE-2026-39052](https://insights.sbomify.com/CVE-2026-39052/): Oinone Pamirs 7.0.0 contains a code execution vulnerability via ScriptRunner. (medium 6.5)
- [CVE-2026-39047](https://insights.sbomify.com/CVE-2026-39047/): Buffer Overflow vulnerability in EPSON L14150 FL27PB allows a remote attacker to execute arbitrary code via the RAW Printing Service (JetDir (high 7.5)
- [CVE-2026-39042](https://insights.sbomify.com/CVE-2026-39042/): An issue in MikroTIk (SIA Mikrotikls, Latvia) RouterOS 7.21.x before v.7.21.4 and 7.22.x before v.7.22.2 allows a remote attacker to cause a (high 7.5)
- [CVE-2026-39040](https://insights.sbomify.com/CVE-2026-39040/): BharatMLStack up to and including 1.3.0 is vulnerable to Cross Site Scripting (XSS) via the component Trufflebox UI (trufflebox-ui) in ExpressionViewModal.jsx. (medium 5.4)
- [CVE-2026-3904](https://insights.sbomify.com/CVE-2026-3904/): Race condition in glibc (medium 6.2)
- [CVE-2026-39039](https://insights.sbomify.com/CVE-2026-39039/): In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authentication token, full user object, and session ID in the brow (medium 5.3)
- [CVE-2026-39038](https://insights.sbomify.com/CVE-2026-39038/): BharatMLStack up to and including v1.3.0 is vulnerable to Cross Site Scripting (XSS) in the component Trufflebox UI (trufflebox-ui) in GenericNumerixTable.jsx. (medium 6.1)
- [CVE-2026-39031](https://insights.sbomify.com/CVE-2026-39031/): Lansweeper lsrunase 2.0 and lsencrypt 2.0 use RC4 encryption with a hardcoded 142-byte static key array to encrypt credentials. (medium 5.5)
- [CVE-2026-3903](https://insights.sbomify.com/CVE-2026-3903/): Modular Connector <= 2.5.1 - Cross-Site Request Forgery via postConfirmOauth (medium 4.3)
- [CVE-2026-39020](https://insights.sbomify.com/CVE-2026-39020/): An issue in WIngs3D v.2.4.1 allows a local attacker to cause a denial of service via a crafted Wavefront OBJ file (medium 5.5)
- [CVE-2026-3902](https://insights.sbomify.com/CVE-2026-3902/): ASGI header spoofing via underscore/hyphen conflation (high 7.5)
- [CVE-2026-39007](https://insights.sbomify.com/CVE-2026-39007/): An issue in Observeinc's Observe v.2026-01-28 and before allows a remote attacker to obtain sensitive information via the CSV Log export component. (high 7.5)
- [CVE-2026-39006](https://insights.sbomify.com/CVE-2026-39006/): SNMP4J-Agent allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component (critical 9.8)
- [CVE-2026-38999](https://insights.sbomify.com/CVE-2026-38999/): A Null Pointer Dereference in the mk_sched_event_close function (mk_server/mk_scheduler.c) of Monkey through commit 4fb0c16 allows attackers (high 7.5)
- [CVE-2026-38998](https://insights.sbomify.com/CVE-2026-38998/): A use-after-free in the SocketDescriptor::tcpReadHandler1 function (liveMedia/RTPInterface.cpp) of LIVE555 Streaming Media (version 2026.02. (medium 6.5)
- [CVE-2026-38993](https://insights.sbomify.com/CVE-2026-38993/): Cockpit is vulnerable to directory traversal (medium 6.5)
- [CVE-2026-38992](https://insights.sbomify.com/CVE-2026-38992/): Cockpit is vulnerable to arbitrary code execution (critical 9.8)
- [CVE-2026-38991](https://insights.sbomify.com/CVE-2026-38991/): Cockpit Vulnerable to Unrestricted Upload of File with Dangerous Type (high 8.8)
- [CVE-2026-38979](https://insights.sbomify.com/CVE-2026-38979/): ajenti through v2.2.13 has a clickjacking weakness in the browser-facing login and administrative UI. (medium 5.4)
- [CVE-2026-38978](https://insights.sbomify.com/CVE-2026-38978/): transmission through 4.1.1 was found to have a clickjacking weakness in the browser-facing WebUI and RPC response paths. (medium 5.3)
- [CVE-2026-38976](https://insights.sbomify.com/CVE-2026-38976/): mrubyc through 3.4.1 was found to contain a NULL pointer dereference in src/vm.c in op_super() / OP_SUPER due to a missing runtime guard for top-level super. (high 7.5)
- [CVE-2026-38974](https://insights.sbomify.com/CVE-2026-38974/): Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramiko_vendor.py. (medium 5.3)
- [CVE-2026-38973](https://insights.sbomify.com/CVE-2026-38973/): mrubyc through release3.4.1 was found to contain an out-of-bounds read in builtin missing-method lookup inside mrbc_find_method(). (medium 4.4)
- [CVE-2026-38972](https://insights.sbomify.com/CVE-2026-38972/): Other in rizonesoft:notepad3 (high 7.8)
- [CVE-2026-38971](https://insights.sbomify.com/CVE-2026-38971/): Memory corruption in ardupilot:arduplane (critical 9.1)
- [CVE-2026-38970](https://insights.sbomify.com/CVE-2026-38970/): pdfcpu through v0.11.1 contains an uncontrolled-recursion denial-of-service issue in pkg/pdfcpu/model/parse.go. (high 7.5)
- [CVE-2026-3897](https://insights.sbomify.com/CVE-2026-3897/): Missing authorization in Livemesh Addons for Beaver Builder (medium 6.4)
- [CVE-2026-38968](https://insights.sbomify.com/CVE-2026-38968/): Weak cryptography in ntop:ntopng (critical 9.8)
- [CVE-2026-38967](https://insights.sbomify.com/CVE-2026-38967/): CrowCpp Crow through v1.3.1 HTTP is vulnerable to response header injection via unvalidated response header values. (critical 9.8)
- [CVE-2026-38961](https://insights.sbomify.com/CVE-2026-38961/): Cross-Site Scripting (XSS) vulnerability in the RSS Widget of Netgate pfSense Plus (versions 26.03, 25.11.1) and pfSense CE (version 2.8.1) (medium 5.4)
- [CVE-2026-3896](https://insights.sbomify.com/CVE-2026-3896/): Livemesh SiteOrigin Widgets <= 3.9.2 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2026-38950](https://insights.sbomify.com/CVE-2026-38950/): An issue in ESA AnomalyMatch before 1.3.1 allow attackers to execute arbitrary code via crafted model checkpoint files. (high 7.8)
- [CVE-2026-3895](https://insights.sbomify.com/CVE-2026-3895/): Missing authorization in WPBakery Page Builder Addons by Livemesh (medium 6.4)
- [CVE-2026-38949](https://insights.sbomify.com/CVE-2026-38949/): Cross-Site Scripting (XSS) vulnerability exists in HTMLy version 3.1.1 in the content creation functionality at the /add/content?type=image endpoint. (high 8.9)
- [CVE-2026-38948](https://insights.sbomify.com/CVE-2026-38948/): Cross-Site Scripting (XSS) vulnerability exists in FUEL CMS v1.5.2 and before within the asset upload functionality. (medium 5.4)
- [CVE-2026-38947](https://insights.sbomify.com/CVE-2026-38947/): FluentCMS 1.2.3 is vulnerable to Cross Site Scripting (XSS) in TextHTML plugin. (medium 6.1)
- [CVE-2026-38945](https://insights.sbomify.com/CVE-2026-38945/): Command injection in Raynet rvia version 12.6 Update 8 and previous versions allows adversaries to execute arbitrary code via a crafted path (high 7.8)
- [CVE-2026-38940](https://insights.sbomify.com/CVE-2026-38940/): Cross Site Scripting vulnerability in RafyMrX TOKO-ONLINE-ROTI v.1.0 allows a remote attacker to execute arbitrary code via the detail_produ (medium 6.1)
- [CVE-2026-3894](https://insights.sbomify.com/CVE-2026-3894/): Out-of-bounds Read vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers. (critical 9.2)
- [CVE-2026-38939](https://insights.sbomify.com/CVE-2026-38939/): Cross Site Scripting vulnerability in andrewtch88 mvc-ecommerce v.1.0 allows a remote attacker to execute arbitrary code and obtain sensitiv (medium 6.1)
- [CVE-2026-38936](https://insights.sbomify.com/CVE-2026-38936/): A reflected cross-site scripting (XSS) vulnerability exists in diskover-community <= 2.3.5 in public/selectindices.php via the namecontains (medium 6.1)
- [CVE-2026-38935](https://insights.sbomify.com/CVE-2026-38935/): A reflected cross-site scripting (XSS) vulnerability exists in diskover-community <= 2.3.5 in public/view.php via the doctype parameter (medium 6.1)
- [CVE-2026-38934](https://insights.sbomify.com/CVE-2026-38934/): Cross Site Request Forgery vulnerability in diskoverdata diskover-community v.2.3.5. (high 8.8)
- [CVE-2026-38931](https://insights.sbomify.com/CVE-2026-38931/): A stored cross-site scripting (XSS) vulnerability in the /admin/config-module.php component of creatorsofcode simplephp GitHub commit 5184cf (medium 5.4)
- [CVE-2026-38930](https://insights.sbomify.com/CVE-2026-38930/): OpenRapid RapidCMS v1.3.1 was discovered to contain an authentication bypass in the /template/default/menu.php component. (medium 6.5)
- [CVE-2026-3893](https://insights.sbomify.com/CVE-2026-3893/): Carlson Software VASCO-B GNSS Receiver Missing Authentication for Critical Function (critical 9.4)
- [CVE-2026-38924](https://insights.sbomify.com/CVE-2026-38924/): Misconfiguration in Serena (low 2.9)
- [CVE-2026-3892](https://insights.sbomify.com/CVE-2026-3892/): Path traversal in Motors – Car Dealership & Classified Listings Plugin (high 8.1)
- [CVE-2026-3891](https://insights.sbomify.com/CVE-2026-3891/): Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2026-38891](https://insights.sbomify.com/CVE-2026-38891/): An improper input validation in the gazebo_ros_diff_drive.cpp component of gazebo_plugins v3.9.0 allows attackers to cause a Denial of Servi (high 7.5)
- [CVE-2026-3889](https://insights.sbomify.com/CVE-2026-3889/): Spoofing issue in Thunderbird (medium 6.5)
- [CVE-2026-3888](https://insights.sbomify.com/CVE-2026-3888/): Local Privilege Escalation in snapd (high 7.8)
- [CVE-2026-3885](https://insights.sbomify.com/CVE-2026-3885/): Cross-site scripting in Shortcodes Ultimate – Content Elements (medium 6.4)
- [CVE-2026-3884](https://insights.sbomify.com/CVE-2026-3884/): Cross-site scripting in spin.js (medium 5.1)
- [CVE-2026-38835](https://insights.sbomify.com/CVE-2026-38835/): Command injection in tenda:w30e firmware (critical 9.8)
- [CVE-2026-38834](https://insights.sbomify.com/CVE-2026-38834/): Command injection in tenda:w30e firmware (high 7.3)
- [CVE-2026-38822](https://insights.sbomify.com/CVE-2026-38822/): Command injection in openNDS (high 7.6)
- [CVE-2026-38821](https://insights.sbomify.com/CVE-2026-38821/): Memory corruption in openNDS (high 7.1)
- [CVE-2026-38820](https://insights.sbomify.com/CVE-2026-38820/): Command injection in openNDS (high 8.3)
- [CVE-2026-38819](https://insights.sbomify.com/CVE-2026-38819/): Denial of service in openNDS (medium 5.3)
- [CVE-2026-38812](https://insights.sbomify.com/CVE-2026-38812/): RuoYi v4.8.2 is vulnerable to SQL Injection via the /tool/gen/createTable endpoint. (critical 9.8)
- [CVE-2026-3881](https://insights.sbomify.com/CVE-2026-3881/): Performance Monitor <= 1.0.6 - Unauthenticated Blind SSRF (medium 5.8)
- [CVE-2026-38808](https://insights.sbomify.com/CVE-2026-38808/): SQL Injection vulnerability in uzy-ssm-mall v1.1.0 allows a remote attacker to obtain sensitive information via the ProductMapper.xml and /O (medium 5.3)
- [CVE-2026-38807](https://insights.sbomify.com/CVE-2026-38807/): Insecure Permissions vulnerability in kvf-admin v1.0.0 allows a remote attacker to escalate privileges via the UserController.java component (high 8.8)
- [CVE-2026-3880](https://insights.sbomify.com/CVE-2026-3880/): Stored XSS Vulnerability (high 7.3)
- [CVE-2026-3879](https://insights.sbomify.com/CVE-2026-3879/): Stored XSS Vulnerability (high 7.3)
- [CVE-2026-3878](https://insights.sbomify.com/CVE-2026-3878/): WP Docs <= 2.2.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpdocs_options[icon_size]' (medium 6.4)
- [CVE-2026-3877](https://insights.sbomify.com/CVE-2026-3877/): Reflected Cross-Site Scripting in Dashboard Search (high 7.3)
- [CVE-2026-38766](https://insights.sbomify.com/CVE-2026-38766/): An issue in Unistal Systems Pvt. (high 7.8)
- [CVE-2026-38765](https://insights.sbomify.com/CVE-2026-38765/): An issue in Unistal Systems Pvt. (high 7.8)
- [CVE-2026-38764](https://insights.sbomify.com/CVE-2026-38764/): An issue in Unistal Systems Pvt. (high 7.8)
- [CVE-2026-38763](https://insights.sbomify.com/CVE-2026-38763/): An issue in Unistal Systems Pvt. (medium 5.5)
- [CVE-2026-3876](https://insights.sbomify.com/CVE-2026-3876/): Prismatic <= 3.7.3 - Unauthenticated Stored Cross-Site Scripting via 'prismatic_encoded' Pseudo-Shortcode (high 7.2)
- [CVE-2026-38755](https://insights.sbomify.com/CVE-2026-38755/): Memory corruption in BusyBox (low 2.9)
- [CVE-2026-38754](https://insights.sbomify.com/CVE-2026-38754/): Memory corruption in BusyBox (medium 5.1)
- [CVE-2026-38753](https://insights.sbomify.com/CVE-2026-38753/): Use after free in BusyBox (medium 4.9)
- [CVE-2026-38752](https://insights.sbomify.com/CVE-2026-38752/): Memory corruption in BusyBox (low 2.9)
- [CVE-2026-38751](https://insights.sbomify.com/CVE-2026-38751/): OpenSTAManager contains an arbitrary file upload vulnerability in its module update functionality (high 7.2)
- [CVE-2026-3875](https://insights.sbomify.com/CVE-2026-3875/): BetterDocs <= 4.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-38743](https://insights.sbomify.com/CVE-2026-38743/): Apache Airflow: Dags endpoint might provide access to otherwise inaccessible entities (medium 4.3)
- [CVE-2026-38740](https://insights.sbomify.com/CVE-2026-38740/): Foscam VD1 Video Doorbell before V5.3.13_1072 is vulnerable to Cleartext Transmission of Sensitive Information. (medium 5.3)
- [CVE-2026-3873](https://insights.sbomify.com/CVE-2026-3873/): Legacy built-in user account (high 7.2)
- [CVE-2026-38728](https://insights.sbomify.com/CVE-2026-38728/): smtp-server's command parser memory exhaustion denial-of-service (high 7.5)
- [CVE-2026-38725](https://insights.sbomify.com/CVE-2026-38725/): xipblog module v2.0.1 and before for PrestaShop allows unauthenticated remote attackers to inject arbitrary JavaScript via the name and cont (medium 5.4)
- [CVE-2026-3872](https://insights.sbomify.com/CVE-2026-3872/): Keycloak: keycloak: information disclosure due to redirect_uri validation bypass (high 7.3)
- [CVE-2026-38719](https://insights.sbomify.com/CVE-2026-38719/): OpENer v2.3-558-g1e99582 contains an out-of-bounds read vulnerability in the Common Packet Format (CPF) parser, specifically in CreateCommon (medium 6.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/680/