# Vulnerabilities published in 2026


- [CVE-2026-3769](https://insights.sbomify.com/CVE-2026-3769/): Tenda F453 WrlclientSet stack-based overflow (high 8.7)
- [CVE-2026-3768](https://insights.sbomify.com/CVE-2026-3768/): Tenda F453 WrlExtraSet formWrlExtraSet stack-based overflow (high 8.7)
- [CVE-2026-3767](https://insights.sbomify.com/CVE-2026-3767/): itsourcecode sanitize or validate this input teacher-attendance.php sql injection (medium 5.3)
- [CVE-2026-3766](https://insights.sbomify.com/CVE-2026-3766/): SourceCodester Web-based Pharmacy Product Management System edit-profile.php cross site scripting (medium 5.1)
- [CVE-2026-3765](https://insights.sbomify.com/CVE-2026-3765/): itsourcecode University Management System att_single_view.php sql injection (medium 6.9)
- [CVE-2026-3764](https://insights.sbomify.com/CVE-2026-3764/): SourceCodester Client Database Management System superadmin_user_update.php improper authorization (medium 6.9)
- [CVE-2026-37637](https://insights.sbomify.com/CVE-2026-37637/): An issue in Alexantr filemanager v.1.0 allows a remote attacker to execute arbitrary code via the filemanager.php component (critical 9.1)
- [CVE-2026-37630](https://insights.sbomify.com/CVE-2026-37630/): An issue in QuickJS-NG v.0.12.1 allows an attacker to execute arbitrary code via the js_mapped_arguments_mark function (high 7.3)
- [CVE-2026-3763](https://insights.sbomify.com/CVE-2026-3763/): code-projects Simple Flight Ticket Booking System showhistory.php cross site scripting (medium 5.3)
- [CVE-2026-3762](https://insights.sbomify.com/CVE-2026-3762/): SourceCodester Client Database Management System Endpoint superadmin_delete_manager.php improper authorization (medium 6.9)
- [CVE-2026-3761](https://insights.sbomify.com/CVE-2026-3761/): SourceCodester Client Database Management System Endpoint superadmin_user_delete.php improper authorization (medium 5.3)
- [CVE-2026-37604](https://insights.sbomify.com/CVE-2026-37604/): pH7Software pH7Builder (pH7 Social Dating CMS) through 18.2.0 resolves the client IP address in _protected/framework/Ip/Ip.class.php from th (medium 6.5)
- [CVE-2026-37603](https://insights.sbomify.com/CVE-2026-37603/): Improper Restriction of Excessive Authentication Attempts in the administration login of pH7Software pH7Builder (pH7 Social Dating CMS) through 19.2.0. (medium 6.5)
- [CVE-2026-37602](https://insights.sbomify.com/CVE-2026-37602/): SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to SQL Injection in the file /scheduler/admin/user/manage_user.php. (low 2.7)
- [CVE-2026-37601](https://insights.sbomify.com/CVE-2026-37601/): SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to SQL Injection in the file /scheduler/admin/appointments/manage_appointment.php. (low 2.7)
- [CVE-2026-37600](https://insights.sbomify.com/CVE-2026-37600/): SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to SQL Injection in the file /scheduler/admin/appointments/view_details.php. (low 2.7)
- [CVE-2026-3760](https://insights.sbomify.com/CVE-2026-3760/): itsourcecode University Management System view_result.php sql injection (medium 6.9)
- [CVE-2026-37598](https://insights.sbomify.com/CVE-2026-37598/): SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to arbitrary code execution (RCE) via /scheduler/classes/SystemSettin (low 2.7)
- [CVE-2026-37597](https://insights.sbomify.com/CVE-2026-37597/): SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL Injection in the file /wfh_attendance/admin/attendance_list.php. (low 2.7)
- [CVE-2026-37596](https://insights.sbomify.com/CVE-2026-37596/): SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL Injection in the file /wfh_attendance/admin/manage_department.php. (low 2.7)
- [CVE-2026-37595](https://insights.sbomify.com/CVE-2026-37595/): SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL Injection in the file /wfh_attendance/admin/manage_employee.php. (low 2.7)
- [CVE-2026-37594](https://insights.sbomify.com/CVE-2026-37594/): SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL Injection in the file /wfh_attendance/admin/view_employee.php. (low 2.7)
- [CVE-2026-37593](https://insights.sbomify.com/CVE-2026-37593/): SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL Injection in the file /wfh_attendance/admin/view_att.php. (low 2.7)
- [CVE-2026-37592](https://insights.sbomify.com/CVE-2026-37592/): Sourcecodester Storage Unit Rental Management System v1.0 is vulnerable to SQL in the file /storage/admin/maintenance/manage_pricing.php. (low 2.7)
- [CVE-2026-37591](https://insights.sbomify.com/CVE-2026-37591/): Sourcecodester Storage Unit Rental Management System v1.0 is vulnerable to SQL injection in the file /storage/admin/tenants/view_details.php. (low 2.7)
- [CVE-2026-37590](https://insights.sbomify.com/CVE-2026-37590/): SourceCodester Storage Unit Rental Management System v1.0 is vulnerable to SQL Injection in the file /storage/admin/rents/manage_rent.php. (low 2.7)
- [CVE-2026-3759](https://insights.sbomify.com/CVE-2026-3759/): projectworlds Online Art Gallery Shop adminHome.php sql injection (medium 6.9)
- [CVE-2026-37589](https://insights.sbomify.com/CVE-2026-37589/): SourceCodester Storage Unit Rental Management System v1.0 is vulnerable to SQL Injection in the file /storage/admin/maintenance/manage_storage_unit.php. (low 2.7)
- [CVE-2026-3758](https://insights.sbomify.com/CVE-2026-3758/): projectworlds Online Art Gallery Shop adminHome.php sql injection (medium 6.9)
- [CVE-2026-37579](https://insights.sbomify.com/CVE-2026-37579/): An issue in SMSGate sms-core<=2.1.13.6 allows a remote attacker to execute arbitrary code via the Cmpp7FDeliverRequestMessageCodec.java comp (high 7.3)
- [CVE-2026-3757](https://insights.sbomify.com/CVE-2026-3757/): projectworlds Online Art Gallery Shop pass sql injection (medium 6.9)
- [CVE-2026-3756](https://insights.sbomify.com/CVE-2026-3756/): SourceCodester Sales and Inventory System check_item_details.php sql injection (medium 5.3)
- [CVE-2026-37555](https://insights.sbomify.com/CVE-2026-37555/): Integer overflow in libsndfile project:libsndfile (high 7.5)
- [CVE-2026-37554](https://insights.sbomify.com/CVE-2026-37554/): An issue was discovered in Vanetza V2X v26.02 allowing remote unauthorized attackers to cause a denial of service. (high 7.5)
- [CVE-2026-37552](https://insights.sbomify.com/CVE-2026-37552/): Deserialization in openmix:mix php (high 8.4)
- [CVE-2026-3755](https://insights.sbomify.com/CVE-2026-3755/): SourceCodester Sales and Inventory System POST check_customer_details.php sql injection (medium 5.3)
- [CVE-2026-37541](https://insights.sbomify.com/CVE-2026-37541/): Memory corruption in openvehicles:open vehicle monitoring system firmware (critical 10.0)
- [CVE-2026-37540](https://insights.sbomify.com/CVE-2026-37540/): Integer overflow in linaro:openamp (high 8.4)
- [CVE-2026-3754](https://insights.sbomify.com/CVE-2026-3754/): SourceCodester Sales and Inventory System add_stock.php sql injection (medium 5.3)
- [CVE-2026-37539](https://insights.sbomify.com/CVE-2026-37539/): Buffer overflow vulnerability in cannelloni v2.0.0 in CAN frame parsing in parser.cpp in function parseCANFrame, and decoder.cpp in function (critical 9.8)
- [CVE-2026-37538](https://insights.sbomify.com/CVE-2026-37538/): Buffer overflow vulnerability in socketcand 0.4.2 in file socketcand.c in function main allows attackers to cause a denial of service or oth (high 7.5)
- [CVE-2026-37537](https://insights.sbomify.com/CVE-2026-37537/): collin80/Open-SAE-J1939 thru commit 744024d4306bc387857dfce439558336806acb06 (2023-03-08) contains an integer underflow leading to out-of-bo (high 8.1)
- [CVE-2026-37536](https://insights.sbomify.com/CVE-2026-37536/): miaofng/uds-c commit e506334e270d77b20c0bc259ac6c7d8c9b702b7a (2016-10-05) contains a stack buffer overflow in send_diagnostic_request. (high 8.8)
- [CVE-2026-37535](https://insights.sbomify.com/CVE-2026-37535/): openxc/isotp-c thru commit 5a5d19245f65189202719321facd49ce6f5d46ac (2021-08-09) contains an out-of-bounds read in the ISO-TP Single Frame r (high 7.1)
- [CVE-2026-37534](https://insights.sbomify.com/CVE-2026-37534/): Integer underflow vulnerability in Open-SAE-J1939 thru commit b6caf884df46435e539b1ecbf92b6c29b345bdfe (2025-11-30) in SAE_J1939_Read_Transp (critical 9.8)
- [CVE-2026-37532](https://insights.sbomify.com/CVE-2026-37532/): Memory corruption in linuxfoundation:automotive grade linux (high 7.1)
- [CVE-2026-37531](https://insights.sbomify.com/CVE-2026-37531/): Path traversal in linuxfoundation:automotive grade linux (critical 9.8)
- [CVE-2026-37530](https://insights.sbomify.com/CVE-2026-37530/): Memory corruption in linuxfoundation:automotive grade linux (high 7.5)
- [CVE-2026-3753](https://insights.sbomify.com/CVE-2026-3753/): SourceCodester Sales and Inventory System add_sales_print.php sql injection (medium 5.3)
- [CVE-2026-37526](https://insights.sbomify.com/CVE-2026-37526/): Missing authorization in linuxfoundation:automotive grade linux (high 7.8)
- [CVE-2026-37525](https://insights.sbomify.com/CVE-2026-37525/): Privilege escalation in linuxfoundation:automotive grade linux (high 7.8)
- [CVE-2026-3752](https://insights.sbomify.com/CVE-2026-3752/): SourceCodester Employee Task Management System GET Parameter daily-task-report.php sql injection (medium 5.1)
- [CVE-2026-3751](https://insights.sbomify.com/CVE-2026-3751/): SourceCodester Employee Task Management System GET Parameter daily-attendance-report.php sql injection (medium 5.1)
- [CVE-2026-37505](https://insights.sbomify.com/CVE-2026-37505/): SQL injection in v2board:v2board (medium 4.9)
- [CVE-2026-37504](https://insights.sbomify.com/CVE-2026-37504/): Information disclosure in v2board:v2board (medium 5.3)
- [CVE-2026-37503](https://insights.sbomify.com/CVE-2026-37503/): Cross-site scripting in v2board:v2board (medium 6.9)
- [CVE-2026-3750](https://insights.sbomify.com/CVE-2026-3750/): ContiNew Admin Storage Management S3ClientFactory.java URI.create server-side request forgery (medium 5.1)
- [CVE-2026-3749](https://insights.sbomify.com/CVE-2026-3749/): Bytedesk SVG File UploadRestService.java handleFileUpload unrestricted upload (medium 5.3)
- [CVE-2026-3748](https://insights.sbomify.com/CVE-2026-3748/): Bytedesk SVG File UploadRestController.java uploadFile unrestricted upload (medium 5.3)
- [CVE-2026-37470](https://insights.sbomify.com/CVE-2026-37470/): An issue in ClipBucket v5 v.5.5.2 allows an attacker to execute arbitrary code via the Authentication interface, login page endpoint and HTT (high 7.3)
- [CVE-2026-3747](https://insights.sbomify.com/CVE-2026-3747/): itsourcecode University Management System add_result.php sql injection (medium 6.9)
- [CVE-2026-37462](https://insights.sbomify.com/CVE-2026-37462/): GoBGP: Integer underflow in the BGPUpdate.DecodeFromBytes function (high 7.5)
- [CVE-2026-37461](https://insights.sbomify.com/CVE-2026-37461/): GoBGP has an out-of-bounds read in the ParseIP6Extended function (high 7.5)
- [CVE-2026-37460](https://insights.sbomify.com/CVE-2026-37460/): Missing input validation in the rfapiRibBi2Ri() function (rfapi_rib.c) of FRRouting (FRR) stable/10.0 to stable/10.6 allows attackers to cau (high 7.5)
- [CVE-2026-3746](https://insights.sbomify.com/CVE-2026-3746/): SourceCodester Simple Responsive Tourism Website Login Login.php sql injection (medium 6.9)
- [CVE-2026-37459](https://insights.sbomify.com/CVE-2026-37459/): An integer underflow in FRRouting (FRR) stable/10.0 to stable/10.6 allows attackers to cause a Denial of Service (DoS) via supplying a craft (high 7.5)
- [CVE-2026-37458](https://insights.sbomify.com/CVE-2026-37458/): Denial of service in frrouting:frrouting (medium 6.5)
- [CVE-2026-37457](https://insights.sbomify.com/CVE-2026-37457/): Memory corruption in frrouting:frrouting (high 7.5)
- [CVE-2026-37454](https://insights.sbomify.com/CVE-2026-37454/): Weak cryptography in msi:center (high 7.5)
- [CVE-2026-37453](https://insights.sbomify.com/CVE-2026-37453/): Information disclosure in msi:center (high 7.5)
- [CVE-2026-37452](https://insights.sbomify.com/CVE-2026-37452/): Insecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 allows a remote attacker to obtain sensitive information via (high 7.5)
- [CVE-2026-3745](https://insights.sbomify.com/CVE-2026-3745/): code-projects Student Web Portal profile.php sql injection (medium 5.3)
- [CVE-2026-3744](https://insights.sbomify.com/CVE-2026-3744/): code-projects Student Web Portal signup.php valreg_passwdation sql injection (medium 6.9)
- [CVE-2026-37431](https://insights.sbomify.com/CVE-2026-37431/): Beauty Parlour Management System v1.1 was discovered to contain a SQL injection vulnerability via the aptnumber parameter in the /appointmen (critical 9.8)
- [CVE-2026-37430](https://insights.sbomify.com/CVE-2026-37430/): An arbitrary file upload vulnerability in the ShopOrderImportController.java component of qihang-wms commit 75c15a allows attackers to execu (high 7.3)
- [CVE-2026-3743](https://insights.sbomify.com/CVE-2026-3743/): YiFang CMS D_singlePageGroup.php update cross site scripting (medium 5.1)
- [CVE-2026-37429](https://insights.sbomify.com/CVE-2026-37429/): qihang-wms commit 75c15a was discovered to contain a SQL injection vulnerability via the datascope parameter in the SysUserMapper.xml file. (medium 6.5)
- [CVE-2026-37428](https://insights.sbomify.com/CVE-2026-37428/): qihang-wms commit 75c15a was discovered to contain a SQL injection vulnerability via the datascope parameter in the SysDeptMapper.xml file. (medium 6.5)
- [CVE-2026-3742](https://insights.sbomify.com/CVE-2026-3742/): YiFang CMS D_singlePage.php update cross site scripting (medium 5.1)
- [CVE-2026-3741](https://insights.sbomify.com/CVE-2026-3741/): YiFang CMS D_friendLink.php update cross site scripting (medium 5.1)
- [CVE-2026-3740](https://insights.sbomify.com/CVE-2026-3740/): itsourcecode University Management System admin_search_student.php sql injection (medium 6.9)
- [CVE-2026-3739](https://insights.sbomify.com/CVE-2026-3739/): suitenumerique messages ThreadAccess serializers.py ThreadAccessSerializer improper authentication (medium 5.3)
- [CVE-2026-3738](https://insights.sbomify.com/CVE-2026-3738/): SourceCodester Pet Grooming Management Software Financial Report improper authorization (medium 5.3)
- [CVE-2026-3737](https://insights.sbomify.com/CVE-2026-3737/): SourceCodester Pet Grooming Management Software User Creation add_user.php improper authorization (medium 5.3)
- [CVE-2026-3736](https://insights.sbomify.com/CVE-2026-3736/): code-projects Simple Flight Ticket Booking System SearchResultRoundtrip.php sql injection (medium 6.9)
- [CVE-2026-3735](https://insights.sbomify.com/CVE-2026-3735/): code-projects Simple Flight Ticket Booking System SearchResultOneway.php sql injection (medium 6.9)
- [CVE-2026-37347](https://insights.sbomify.com/CVE-2026-37347/): SourceCodester Payroll Management and Information System v1.0 is vulnerable to SQL Injection in the file /payroll/view_employee.php. (critical 9.1)
- [CVE-2026-37346](https://insights.sbomify.com/CVE-2026-37346/): SourceCodester Payroll Management and Information System v1.0 is vulnerable to SQL Injection in the file /payroll/view_account.php?emp_id=. (medium 4.7)
- [CVE-2026-37345](https://insights.sbomify.com/CVE-2026-37345/): SourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the file /parking/manage_park.php. (critical 9.8)
- [CVE-2026-37344](https://insights.sbomify.com/CVE-2026-37344/): SourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the file /parking/manage_location.php. (high 7.2)
- [CVE-2026-37343](https://insights.sbomify.com/CVE-2026-37343/): SourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the file /parking/manage_user.php. (high 7.2)
- [CVE-2026-37342](https://insights.sbomify.com/CVE-2026-37342/): SourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the file /parking/view_parked_details.php. (high 7.2)
- [CVE-2026-37341](https://insights.sbomify.com/CVE-2026-37341/): SourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the file /parking/manage_category.php. (high 7.2)
- [CVE-2026-37340](https://insights.sbomify.com/CVE-2026-37340/): SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/edit_music.php. (critical 9.8)
- [CVE-2026-3734](https://insights.sbomify.com/CVE-2026-3734/): SourceCodester Client Database Management System Endpoint fetch_manager_details.php improper authorization (medium 6.9)
- [CVE-2026-37339](https://insights.sbomify.com/CVE-2026-37339/): SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/view_genre.php. (critical 9.8)
- [CVE-2026-37338](https://insights.sbomify.com/CVE-2026-37338/): SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/view_user.php. (critical 9.4)
- [CVE-2026-37337](https://insights.sbomify.com/CVE-2026-37337/): SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/view_playlist.php. (high 7.3)
- [CVE-2026-37336](https://insights.sbomify.com/CVE-2026-37336/): SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/view_music.php. (high 7.3)
- [CVE-2026-3733](https://insights.sbomify.com/CVE-2026-3733/): xuxueli xxl-job JobInfoController.java server-side request forgery (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/683/