# Vulnerabilities published in 2026


- [CVE-2026-3732](https://insights.sbomify.com/CVE-2026-3732/): Tenda F453 exeCommand strcpy stack-based overflow (high 8.7)
- [CVE-2026-3731](https://insights.sbomify.com/CVE-2026-3731/): libssh SFTP Extension Name sftp.c sftp_extensions_get_data out-of-bounds (medium 6.9)
- [CVE-2026-3730](https://insights.sbomify.com/CVE-2026-3730/): itsourcecode Free Hotel Reservation System index.php sql injection (medium 6.9)
- [CVE-2026-3729](https://insights.sbomify.com/CVE-2026-3729/): Tenda F453 PPTPDClient fromPptpUserAdd stack-based overflow (high 8.7)
- [CVE-2026-37281](https://insights.sbomify.com/CVE-2026-37281/): An OS command injection vulnerability in the /stream-to-vlc Express route in hitarth-gg Zenshin before 2.7.0 allows remote attackers to exec (critical 9.8)
- [CVE-2026-3728](https://insights.sbomify.com/CVE-2026-3728/): Tenda F453 setcfm fromSetCfm stack-based overflow (high 8.7)
- [CVE-2026-37271](https://insights.sbomify.com/CVE-2026-37271/): Fire-Boltt Smartwatch FB BGS001 Firmware: MOY-JS14-2.0.4 is vulnerable to Improper Authentication, The device accepts GATT Write Request com (critical 9.8)
- [CVE-2026-37270](https://insights.sbomify.com/CVE-2026-37270/): Trueview Security camera T18161- AF v4.9.60.0 contains an authentication bypass vulnerability caused by improper password validation and the (critical 9.8)
- [CVE-2026-3727](https://insights.sbomify.com/CVE-2026-3727/): Tenda F453 QuickIndex sub_3C6C0 stack-based overflow (high 8.7)
- [CVE-2026-37266](https://insights.sbomify.com/CVE-2026-37266/): An issue in Responsive File Manager Responsive FileManager Version 9.14.0 allows a remote attacker to execute arbitrary code via the force_d (high 8.0)
- [CVE-2026-3726](https://insights.sbomify.com/CVE-2026-3726/): Tenda F453 webExcptypemanFilter fromwebExcptypemanFilter stack-based overflow (high 8.7)
- [CVE-2026-3725](https://insights.sbomify.com/CVE-2026-3725/): Code injection in SmartAdmin (medium 5.3)
- [CVE-2026-3724](https://insights.sbomify.com/CVE-2026-3724/): SourceCodester Patients Waiting Area Queue Management System checkin.php improper authorization (medium 5.3)
- [CVE-2026-37237](https://insights.sbomify.com/CVE-2026-37237/): Denial of service in vllm:vllm (high 7.5)
- [CVE-2026-37236](https://insights.sbomify.com/CVE-2026-37236/): grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. (critical 9.8)
- [CVE-2026-37235](https://insights.sbomify.com/CVE-2026-37235/): Auth bypass in mosaic5g:flexric (high 7.5)
- [CVE-2026-37234](https://insights.sbomify.com/CVE-2026-37234/): Denial of service in mosaic5g:flexric (high 8.2)
- [CVE-2026-37233](https://insights.sbomify.com/CVE-2026-37233/): Missing authorization in mosaic5g:flexric (high 7.5)
- [CVE-2026-37232](https://insights.sbomify.com/CVE-2026-37232/): Denial of service in openairinterface:openairinterface5g (high 8.6)
- [CVE-2026-37231](https://insights.sbomify.com/CVE-2026-37231/): Integer overflow in mosaic5g:flexric (high 7.5)
- [CVE-2026-37230](https://insights.sbomify.com/CVE-2026-37230/): Null dereference in mosaic5g:flexric (high 7.5)
- [CVE-2026-3723](https://insights.sbomify.com/CVE-2026-3723/): code-projects Simple Flight Ticket Booking System Admindelete.php sql injection (medium 6.9)
- [CVE-2026-37229](https://insights.sbomify.com/CVE-2026-37229/): Denial of service in mosaic5g:flexric (high 7.5)
- [CVE-2026-37228](https://insights.sbomify.com/CVE-2026-37228/): Denial of service in mosaic5g:flexric (high 7.5)
- [CVE-2026-37227](https://insights.sbomify.com/CVE-2026-37227/): FlexRIC v2.0.0 contains reachable assert(0) calls in stub message handlers for whitelisted but unimplemented E2AP message types in the near-RT RIC. (high 7.5)
- [CVE-2026-37226](https://insights.sbomify.com/CVE-2026-37226/): Null dereference in mosaic5g:flexric (high 7.5)
- [CVE-2026-37225](https://insights.sbomify.com/CVE-2026-37225/): FlexRIC v2.0.0 crashes when the iApp receives an E42_RIC_SUBSCRIPTION_REQUEST with an empty ricEventTriggerDefinition field. (high 7.5)
- [CVE-2026-37224](https://insights.sbomify.com/CVE-2026-37224/): FlexRIC v2.0.0 crashes when receiving a duplicate E2_SETUP_REQUEST from the same or spoofed E2 Node. (high 7.5)
- [CVE-2026-37223](https://insights.sbomify.com/CVE-2026-37223/): FlexRIC v2.0.0 contains a reachable assertion in the iApp message dispatcher. (high 7.5)
- [CVE-2026-37222](https://insights.sbomify.com/CVE-2026-37222/): FlexRIC v2.0.0 uses hardcoded assertions to validate Information Element (IE) counts in decoded E2AP messages. (high 7.5)
- [CVE-2026-37221](https://insights.sbomify.com/CVE-2026-37221/): FlexRIC v2.0.0 crashes when receiving a RIC_SUBSCRIPTION_RESPONSE with an unknown ric_id that has no corresponding pending event. (high 7.5)
- [CVE-2026-37220](https://insights.sbomify.com/CVE-2026-37220/): FlexRIC v2.0.0 crashes when an SCTP association is closed before an E2_SETUP_REQUEST is sent. (high 7.5)
- [CVE-2026-3722](https://insights.sbomify.com/CVE-2026-3722/): Cross-site scripting in Auto Image Attributes From Filename With Bulk Updater (Add Alt Text, Image Title For Image SEO) (medium 6.4)
- [CVE-2026-37216](https://insights.sbomify.com/CVE-2026-37216/): Ruoyi 4.8.2 is vulnerable to Cross Site Scripting (XSS) at the interface /system/notice/add. (medium 6.1)
- [CVE-2026-3721](https://insights.sbomify.com/CVE-2026-3721/): 1024-lab/lab1024 SmartAdmin Help Documentation HelpDocAddForm.java cross site scripting (medium 5.1)
- [CVE-2026-3720](https://insights.sbomify.com/CVE-2026-3720/): 1024-lab/lab1024 SmartAdmin Notice notice-form-drawer.vue cross site scripting (medium 5.1)
- [CVE-2026-37198](https://insights.sbomify.com/CVE-2026-37198/): An integer overflow in the SMF component of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted GTP packet. (high 7.5)
- [CVE-2026-3719](https://insights.sbomify.com/CVE-2026-3719/): Tsinghua Unigroup Electronic Archives System downLoad path traversal (medium 6.9)
- [CVE-2026-3718](https://insights.sbomify.com/CVE-2026-3718/): ManageWP Worker <= 4.9.31 - Unauthenticated Stored Cross-Site Scripting via 'MWP-Key-Name' Header (high 7.2)
- [CVE-2026-37171](https://insights.sbomify.com/CVE-2026-37171/): A lack of tenant separation in SuperTokens Inc. (medium 5.9)
- [CVE-2026-3717](https://insights.sbomify.com/CVE-2026-3717/): CV Builder – Professional Resume Builder SaaS <= 1.3.1 - Missing Authorization to Unauthenticated PNG File Upload (medium 5.3)
- [CVE-2026-3716](https://insights.sbomify.com/CVE-2026-3716/): Wavlink WL-WN579X3-C adm.cgi sub_401AD4 cross site scripting (medium 4.8)
- [CVE-2026-37152](https://insights.sbomify.com/CVE-2026-37152/): TOTOLINK X5000R V9.1.0cu.2415_B20250515 was discovered to contain a hardcoded password for root access. (critical 9.8)
- [CVE-2026-3715](https://insights.sbomify.com/CVE-2026-3715/): Wavlink WL-WN579X3-C firewall.cgi sub_40139C stack-based overflow (high 8.7)
- [CVE-2026-37149](https://insights.sbomify.com/CVE-2026-37149/): GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0 was discovered to contain a SQL injection vulnerability in the scost par (high 7.7)
- [CVE-2026-3714](https://insights.sbomify.com/CVE-2026-3714/): OpenCart Incomplete Fix CVE-2024-36694 template.php save special elements used in a template engine (medium 5.1)
- [CVE-2026-3713](https://insights.sbomify.com/CVE-2026-3713/): pnggroup libpng pnm2png pnm2png.c do_pnm2png heap-based overflow (medium 4.8)
- [CVE-2026-3712](https://insights.sbomify.com/CVE-2026-3712/): PhastPress <= 3.10 - Unauthenticated Server-Side Request Forgery via 'src' Parameter (high 7.3)
- [CVE-2026-3711](https://insights.sbomify.com/CVE-2026-3711/): code-projects Simple Flight Ticket Booking System Adminupdate.php sql injection (medium 5.1)
- [CVE-2026-37107](https://insights.sbomify.com/CVE-2026-37107/): An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the get_feed function in the admin.php component (critical 9.8)
- [CVE-2026-37106](https://insights.sbomify.com/CVE-2026-37106/): An issue in DokuWiki 2025-05-14b "Librarian" 56.2 allows a remote attacker to create an account via the register function in inc/auth.php. (critical 9.8)
- [CVE-2026-37100](https://insights.sbomify.com/CVE-2026-37100/): An issue in the Bluetooth Low Energy (BLE) control interface of the Yamaha SR-B30A sound bar firmware 2.40 (Mobile App: Sound Bar Remote / v (medium 6.5)
- [CVE-2026-3710](https://insights.sbomify.com/CVE-2026-3710/): code-projects Simple Flight Ticket Booking System Adminadd.php sql injection (medium 5.1)
- [CVE-2026-3709](https://insights.sbomify.com/CVE-2026-3709/): code-projects Simple Flight Ticket Booking System register.php sql injection (medium 6.9)
- [CVE-2026-3708](https://insights.sbomify.com/CVE-2026-3708/): code-projects Simple Flight Ticket Booking System login.php sql injection (medium 6.9)
- [CVE-2026-37073](https://insights.sbomify.com/CVE-2026-37073/): Incorrect access control in /vfm-admin/ajax/sendfiles.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to send emai (medium 5.3)
- [CVE-2026-37072](https://insights.sbomify.com/CVE-2026-37072/): Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-updates.php. (critical 9.8)
- [CVE-2026-37071](https://insights.sbomify.com/CVE-2026-37071/): Arbitrary File Rename Leading to Privilege Escalation in Actions::renameFile() function in Veno File Manager Project 4.4.9 allows an authent (critical 9.8)
- [CVE-2026-37070](https://insights.sbomify.com/CVE-2026-37070/): Incorrect access control in /vfm-admin/ajax/streamvid.php in Veno File Manager Project in 4.4.9 allows an authenticated attacker to read any (medium 6.5)
- [CVE-2026-3707](https://insights.sbomify.com/CVE-2026-3707/): MrNanko webp4j gif_decoder.c DecodeGifFromMemory integer overflow (medium 4.8)
- [CVE-2026-37069](https://insights.sbomify.com/CVE-2026-37069/): Absolute Path Disclosure in /vfm-admin/assets/zipstream/grandt/relativepath/RelativePath.Example1.php in Veno File Manager Project 4.4.9 all (medium 5.3)
- [CVE-2026-37068](https://insights.sbomify.com/CVE-2026-37068/): Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated u (high 8.1)
- [CVE-2026-37067](https://insights.sbomify.com/CVE-2026-37067/): Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker t (medium 5.3)
- [CVE-2026-37066](https://insights.sbomify.com/CVE-2026-37066/): Path traversal leading to Arbitrary File Read in /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php in Veno File Manager Project 4.4.9 a (medium 6.5)
- [CVE-2026-37065](https://insights.sbomify.com/CVE-2026-37065/): Veno File Manager Project 4.4.9 is vulnerable to Arbitrary File Deletion in /vfm-admin/index.php?section=translations&action=update&remove=. (critical 9.1)
- [CVE-2026-37064](https://insights.sbomify.com/CVE-2026-37064/): User enumeration in /vfm-admin/ajax/usr-check.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to enumerate the app (medium 5.3)
- [CVE-2026-3706](https://insights.sbomify.com/CVE-2026-3706/): mkj Dropbear S Range Check curve25519.c unpackneg signature verification (medium 6.3)
- [CVE-2026-3705](https://insights.sbomify.com/CVE-2026-3705/): code-projects Simple Flight Ticket Booking System Adminsearch.php sql injection (medium 6.9)
- [CVE-2026-3704](https://insights.sbomify.com/CVE-2026-3704/): Wavlink NU516U1 Incomplete Fix CVE-2025-10959 firewall.cgi sub_405B2C command injection (medium 5.1)
- [CVE-2026-3703](https://insights.sbomify.com/CVE-2026-3703/): Wavlink NU516U1 login.cgi sub_401A10 out-of-bounds write (critical 9.3)
- [CVE-2026-3702](https://insights.sbomify.com/CVE-2026-3702/): SourceCodester Loan Management System index.php cross site scripting (medium 5.3)
- [CVE-2026-37012](https://insights.sbomify.com/CVE-2026-37012/): A vulnerability in pentestgpt/core/langfuse.py in PentestGPT 1.0.0 allows remote attackers to disclose sensitive user telemetry data via har (high 7.5)
- [CVE-2026-3701](https://insights.sbomify.com/CVE-2026-3701/): H3C Magic B1 aspForm Edit_BasicSSID_5G buffer overflow (high 8.7)
- [CVE-2026-37009](https://insights.sbomify.com/CVE-2026-37009/): A SQL injection vulnerability in NL2SQLTool in crewai-tools v1.10.2rc1 allows a remote attacker to execute arbitrary SQL commands via an uns (medium 6.5)
- [CVE-2026-37008](https://insights.sbomify.com/CVE-2026-37008/): Security feature bypass in CrewAI (high 8.1)
- [CVE-2026-37007](https://insights.sbomify.com/CVE-2026-37007/): A vulnerability in FileWriterTool in crewai-tools <= 1.10.2rc1 allows a remote attacker to achieve code execution via malicious path travers (critical 9.8)
- [CVE-2026-37006](https://insights.sbomify.com/CVE-2026-37006/): A vulnerability in the WebSocket endpoint of gpt-researcher v0.14.7 and before allows an unauthenticated remote attacker to achieve code exe (critical 9.8)
- [CVE-2026-37004](https://insights.sbomify.com/CVE-2026-37004/): LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint (critical 9.8)
- [CVE-2026-37003](https://insights.sbomify.com/CVE-2026-37003/): Agno up to and including 2.5.8 is vulnerable to Remote Code Execution (RCE) via prompt injection. (critical 9.8)
- [CVE-2026-3700](https://insights.sbomify.com/CVE-2026-3700/): UTT HiPER 810G formConfigDnsFilterGlobal strcpy buffer overflow (high 8.7)
- [CVE-2026-3699](https://insights.sbomify.com/CVE-2026-3699/): UTT HiPER 810G formRemoteControl strcpy buffer overflow (high 8.7)
- [CVE-2026-36989](https://insights.sbomify.com/CVE-2026-36989/): SQL injection in LuxCal Web Calendar (medium 5.8)
- [CVE-2026-36983](https://insights.sbomify.com/CVE-2026-36983/): Command injection in dlink:dcs-932l firmware (high 7.3)
- [CVE-2026-3698](https://insights.sbomify.com/CVE-2026-3698/): UTT HiPER 810G NTP strcpy buffer overflow (high 8.7)
- [CVE-2026-3697](https://insights.sbomify.com/CVE-2026-3697/): Planet ICG-2510 Language Package Configuration httpd sub_40C8E4 stack-based overflow (medium 5.3)
- [CVE-2026-36962](https://insights.sbomify.com/CVE-2026-36962/): SQL Injection in MuuCMF T6 v1.9.4.20260115 allows an unauthenticated attacker to compromise the entire database, achieve unauthorized admini (high 7.3)
- [CVE-2026-36960](https://insights.sbomify.com/CVE-2026-36960/): A Cross-Site Request Forgery (CSRF) vulnerability exists in the web management interface of the U-SPEED N300 Rounter V1.0.0. (high 8.8)
- [CVE-2026-3696](https://insights.sbomify.com/CVE-2026-3696/): Totolink N300RH CGI cstecgi.cgi setWiFiWpsConfig os command injection (medium 6.9)
- [CVE-2026-36959](https://insights.sbomify.com/CVE-2026-36959/): Auth bypass in u-speed:n300 firmware (high 7.5)
- [CVE-2026-36958](https://insights.sbomify.com/CVE-2026-36958/): Denial of service in u-speed:n300 firmware (high 7.5)
- [CVE-2026-36957](https://insights.sbomify.com/CVE-2026-36957/): Denial of service in dbitnet:dbit n300 t1 pro firmware (high 7.5)
- [CVE-2026-36956](https://insights.sbomify.com/CVE-2026-36956/): Cross-site request forgery in dbitnet:dbit n300 t1 pro firmware (high 8.8)
- [CVE-2026-36952](https://insights.sbomify.com/CVE-2026-36952/): Sourcecodester Online Thesis Archiving System v1.0 is vulnerable to SQL injection in the file /otas/admin/curriculum/manage_curriculum.php. (low 2.7)
- [CVE-2026-36950](https://insights.sbomify.com/CVE-2026-36950/): Sourcecodester Online Thesis Archiving System v1.0 is vulnerable to SQL injection in /otas/projects_per_department.php. (low 2.7)
- [CVE-2026-3695](https://insights.sbomify.com/CVE-2026-3695/): SourceCodester Modern Image Gallery App delete.php path traversal (medium 6.9)
- [CVE-2026-36948](https://insights.sbomify.com/CVE-2026-36948/): Sourcecodester Online Thesis Archiving System v1.0 is vulnerale to SQL injection in the file /otas/view_archive.php. (high 7.3)
- [CVE-2026-36947](https://insights.sbomify.com/CVE-2026-36947/): SQL injection in oretnom23:computer and mobile repair shop management system (low 2.7)
- [CVE-2026-36946](https://insights.sbomify.com/CVE-2026-36946/): SQL injection in oretnom23:computer and mobile repair shop management system (low 2.7)
- [CVE-2026-36945](https://insights.sbomify.com/CVE-2026-36945/): Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerable to SQL injection in the file /rsms/admin/clients/manage_ (low 2.7)
- [CVE-2026-36944](https://insights.sbomify.com/CVE-2026-36944/): Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerale to SQL injection in the file/rsms/admin/repairs/view_details.php. (low 2.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/684/