# Vulnerabilities published in 2026


- [CVE-2026-36943](https://insights.sbomify.com/CVE-2026-36943/): Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerable to SQL injection in the file /rsms/admin/repairs/manage_repair.php. (low 2.7)
- [CVE-2026-36942](https://insights.sbomify.com/CVE-2026-36942/): Sourcecodester Online Resort Management System v1.0 is vulnerable to SQL injection in the file /orms/admin/activities/manage_activity.php. (low 2.7)
- [CVE-2026-36941](https://insights.sbomify.com/CVE-2026-36941/): Sourcecodester Online Resort Management System v1.0 is vulnerable to SQL Injection in the file /orms/admin/rooms/manage_room.php. (low 2.7)
- [CVE-2026-3694](https://insights.sbomify.com/CVE-2026-3694/): Bold Page Builder <= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_button Shortcode (medium 6.4)
- [CVE-2026-36938](https://insights.sbomify.com/CVE-2026-36938/): Sourcecodester Online Resort Management System v1.0 is vulnerable to SQL injection in /orms/admin/rooms/view_room.php. (low 2.7)
- [CVE-2026-36937](https://insights.sbomify.com/CVE-2026-36937/): Sourcecodester Online Resort Management System v1.0 is vulnerable to SQL injection in /orms/admin/reservations/view_details.php. (low 2.7)
- [CVE-2026-36933](https://insights.sbomify.com/CVE-2026-36933/): An issue in Boyleep K11, y108 firmware v.2.3.0.11291 allows a physically proximate attacker to execute arbitrary code via the factory test feature. (medium 6.8)
- [CVE-2026-3693](https://insights.sbomify.com/CVE-2026-3693/): Shy2593666979 AgentChat User Endpoint user.py update_user_info resource injection (medium 6.9)
- [CVE-2026-36923](https://insights.sbomify.com/CVE-2026-36923/): SQL injection in oretnom23:cab management system (low 2.7)
- [CVE-2026-36922](https://insights.sbomify.com/CVE-2026-36922/): SQL injection in oretnom23:cab management system (low 2.7)
- [CVE-2026-36920](https://insights.sbomify.com/CVE-2026-36920/): SQL injection in janobe:online reviewer system (low 2.7)
- [CVE-2026-3692](https://insights.sbomify.com/CVE-2026-3692/): Unintended command execution during report generation in Progress Flowmon (high 8.7)
- [CVE-2026-36919](https://insights.sbomify.com/CVE-2026-36919/): SQL injection in janobe:online reviewer system (low 2.7)
- [CVE-2026-36912](https://insights.sbomify.com/CVE-2026-36912/): A NULL pointer dereference in the AP4_AtomSampleTable::GetSample() function of Aleksoid1978 MPC-BE before commit 4341cb3 allows attackers to (high 7.5)
- [CVE-2026-36911](https://insights.sbomify.com/CVE-2026-36911/): A division-by-zero vulnerability in the CStreamSwitcherOutputPin::DecideBufferSize function of Aleksoid1978 MPC-BE before commit 4341cb3 all (medium 5.5)
- [CVE-2026-36910](https://insights.sbomify.com/CVE-2026-36910/): An access violation in the BaseSplitterFile::Read function of Aleksoid1978 MPC-BE before commit 4341cb3 allows attackers to cause a Denial o (medium 5.5)
- [CVE-2026-3691](https://insights.sbomify.com/CVE-2026-3691/): OpenClaw Client PKCE Verifier Information Disclosure Vulnerability (medium 5.3)
- [CVE-2026-36909](https://insights.sbomify.com/CVE-2026-36909/): A NULL pointer dereference in the AP4_TkhdAtom::GetTrackId() function of Aleksoid1978 MPC-BE before commit 4341cb3 allows attackers to cause (medium 6.2)
- [CVE-2026-36908](https://insights.sbomify.com/CVE-2026-36908/): A stack overflow in the AP4_Array<AP4_TrunAtom::Entry>::EnsureCapacity component of axiomatic-systems Bento4 before v1.8.9allows attackers t (medium 5.5)
- [CVE-2026-36907](https://insights.sbomify.com/CVE-2026-36907/): A stack overflow in the AP4_StsdAtom::AP4_StsdAtom component of axiomatic-systems Bento4 before v1.8.9allows attackers to cause a Denial of (medium 5.5)
- [CVE-2026-36906](https://insights.sbomify.com/CVE-2026-36906/): Cross Site Scripting vulnerability in iotgateway v.3.0.1 allows a remote attacker to execute arbitrary code via the Log Record Function (medium 6.1)
- [CVE-2026-3690](https://insights.sbomify.com/CVE-2026-3690/): OpenClaw Canvas Authentication Bypass Vulnerability (high 7.4)
- [CVE-2026-3689](https://insights.sbomify.com/CVE-2026-3689/): OpenClaw Canvas Path Traversal Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-3688](https://insights.sbomify.com/CVE-2026-3688/): Privilege escalation in WCFM Membership – WooCommerce Memberships for Multivendor Marketplace (high 8.1)
- [CVE-2026-36874](https://insights.sbomify.com/CVE-2026-36874/): SQL injection in razormist:basic library system (low 2.7)
- [CVE-2026-36873](https://insights.sbomify.com/CVE-2026-36873/): SQL injection in razormist:basic library system (low 2.7)
- [CVE-2026-36872](https://insights.sbomify.com/CVE-2026-36872/): SQL injection in razormist:basic library system (low 2.7)
- [CVE-2026-3686](https://insights.sbomify.com/CVE-2026-3686/): Vulnerabilities exists in IBM Cloud Pak for Data System (medium 6.2)
- [CVE-2026-36851](https://insights.sbomify.com/CVE-2026-36851/): Path traversal vulnerability in UnPoller 2.33.0 password field allows arbitrary file read and network exfiltration. (high 7.5)
- [CVE-2026-36848](https://insights.sbomify.com/CVE-2026-36848/): Path traversal in gigamon:gigavue-os (high 7.5)
- [CVE-2026-36841](https://insights.sbomify.com/CVE-2026-36841/): TOTOLINK N200RE V5 was discovered to contain a command injection vulnerability via the macstr and bandstr parameters in the formMapDelDevice function. (critical 9.8)
- [CVE-2026-36837](https://insights.sbomify.com/CVE-2026-36837/): TOTOLINK A3002RU V3 <= V3.0.0-B20220304.1804 was discovered to contain a stack-based buffer overflow via the hostname parameter in the formMapDelDevice function. (high 7.5)
- [CVE-2026-3683](https://insights.sbomify.com/CVE-2026-3683/): bufanyun HotGo Endpoint upload.go ImageTransferStorage server-side request forgery (medium 5.3)
- [CVE-2026-36829](https://insights.sbomify.com/CVE-2026-36829/): An authentication bypass vulnerability exists in the embedded HTTP server of Panabit PAP-XM320 up to and including v7.7. (critical 9.8)
- [CVE-2026-36828](https://insights.sbomify.com/CVE-2026-36828/): A command injection vulnerability exists in the /cgi-bin/tools/ajax_cmd endpoint of Panabit PAP-XM320 up to and including v7.7. (high 8.8)
- [CVE-2026-36827](https://insights.sbomify.com/CVE-2026-36827/): A command injection vulnerability exists in Panabit PAP-XM320 up to and including V7.7. (medium 5.4)
- [CVE-2026-36823](https://insights.sbomify.com/CVE-2026-36823/): Shenzhen Tenda Technology Co., Ltd Tenda W20E v15.11.0.6 was discovered to contain a buffer overflow in the webAuthUserInfo parameter of the (high 7.5)
- [CVE-2026-36822](https://insights.sbomify.com/CVE-2026-36822/): Shenzhen Tenda Technology Co., Ltd Tenda W20E v15.11.0.6 was discovered to contain a buffer overflow in the macAddr parameter of the formDelStaState function. (high 7.5)
- [CVE-2026-36821](https://insights.sbomify.com/CVE-2026-36821/): Shenzhen Tenda Technology Co., Ltd Tenda W20E v15.11.0.6 was discovered to contain a buffer overflow in the picCropName parameter of the for (high 7.5)
- [CVE-2026-36820](https://insights.sbomify.com/CVE-2026-36820/): Shenzhen Tenda Technology Co., Ltd Tenda W20E v15.11.0.6 was discovered to contain a buffer overflow in the webAuthWhiteUserInfo parameter o (high 7.5)
- [CVE-2026-3682](https://insights.sbomify.com/CVE-2026-3682/): welovemedia FFmate ffmpeg.go Execute argument injection (medium 5.3)
- [CVE-2026-36819](https://insights.sbomify.com/CVE-2026-36819/): Shenzhen Tenda Technology Co., Ltd Tenda W20E v15.11.0.6 was discovered to contain a buffer overflow in the bindMACAddr parameter of the fro (high 7.5)
- [CVE-2026-36818](https://insights.sbomify.com/CVE-2026-36818/): Shenzhen Tenda Technology Co., Ltd Tenda W20E v15.11.0.6 was discovered to contain a buffer overflow in the wewifiWhiteUserInfo parameter of (high 7.5)
- [CVE-2026-36817](https://insights.sbomify.com/CVE-2026-36817/): Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the webAuthWhiteUserInfo parameter (high 7.5)
- [CVE-2026-36816](https://insights.sbomify.com/CVE-2026-36816/): Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the wewifiWhiteUserInfo parameter o (high 7.5)
- [CVE-2026-36815](https://insights.sbomify.com/CVE-2026-36815/): Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the hostname parameter of the formS (high 7.5)
- [CVE-2026-36813](https://insights.sbomify.com/CVE-2026-36813/): Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the picCropName parameter of the fo (high 7.5)
- [CVE-2026-36811](https://insights.sbomify.com/CVE-2026-36811/): Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the picName parameter of the formDelwebAuthPic function. (high 7.5)
- [CVE-2026-36810](https://insights.sbomify.com/CVE-2026-36810/): Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the gotoUrl parameter of the formPortalAuth function. (high 7.5)
- [CVE-2026-3681](https://insights.sbomify.com/CVE-2026-3681/): welovemedia FFmate webhook.go fireWebhook server-side request forgery (medium 5.3)
- [CVE-2026-36809](https://insights.sbomify.com/CVE-2026-36809/): Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the webAuthWhiteID parameter of the (high 7.5)
- [CVE-2026-36808](https://insights.sbomify.com/CVE-2026-36808/): Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the webAuthUserInfo parameter of th (high 7.5)
- [CVE-2026-36807](https://insights.sbomify.com/CVE-2026-36807/): Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the webAuthUserPwd parameter of the (high 7.5)
- [CVE-2026-36806](https://insights.sbomify.com/CVE-2026-36806/): Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the webAuthUserPwd parameter of the (high 7.5)
- [CVE-2026-36805](https://insights.sbomify.com/CVE-2026-36805/): Shenzhen Tenda Technology Co., Ltd Tenda G0 v15.11.0.5 was discovered to contain multiple buffer overflows in the Saveqqlist function via th (high 7.5)
- [CVE-2026-36803](https://insights.sbomify.com/CVE-2026-36803/): Shenzhen Tenda Technology Co., Ltd Tenda PW201A v1.0.5 was discovered to contain a buffer overflow in the page parameter of the qossetting function. (high 7.5)
- [CVE-2026-36802](https://insights.sbomify.com/CVE-2026-36802/): Shenzhen Tenda Technology Co., Ltd Tenda PW201A v1.0.5 was discovered to contain a buffer overflow in the page parameter of the SafeMacFilter function. (high 7.5)
- [CVE-2026-36801](https://insights.sbomify.com/CVE-2026-36801/): Shenzhen Tenda Technology Co., Ltd Tenda G0 v15.11.0.5 was discovered to contain a buffer overflow in the IPMacBindRule parameter of the for (high 7.5)
- [CVE-2026-36800](https://insights.sbomify.com/CVE-2026-36800/): Shenzhen Tenda Technology Co., Ltd Tenda G0 v15.11.0.5 was discovered to contain a buffer overflow in the IPMacBindIndex parameter of the fo (high 7.5)
- [CVE-2026-3680](https://insights.sbomify.com/CVE-2026-3680/): RyuzakiShinji biome-mcp-server biome-mcp-server.ts command injection (medium 5.3)
- [CVE-2026-36799](https://insights.sbomify.com/CVE-2026-36799/): Shenzhen Tenda Technology Co., Ltd Tenda G0 v15.11.0.5 was discovered to contain a buffer overflow in the portalAuth parameter of the formPortalAuth function. (high 7.5)
- [CVE-2026-36798](https://insights.sbomify.com/CVE-2026-36798/): Shenzhen Tenda Technology Co., Ltd Tenda G0 v15.11.0.5 was discovered to contain multiple stack overflows in the formSetDebugCfgr function v (medium 6.5)
- [CVE-2026-36797](https://insights.sbomify.com/CVE-2026-36797/): Shenzhen Tenda Technology Co., Ltd Tenda G0 v15.11.0.5 was discovered to contain a stack overflow in the IPMacBindRuleIp parameter of the fo (high 7.5)
- [CVE-2026-36796](https://insights.sbomify.com/CVE-2026-36796/): Shenzhen Tenda Technology Co., Ltd Tenda G0 v15.11.0.5 was discovered to contain a stack overflow in the picCropName parameter of the formCr (high 7.5)
- [CVE-2026-36794](https://insights.sbomify.com/CVE-2026-36794/): Shenzhen Tenda Technology Co., Ltd Tenda W3 Wireless Router v1.0.0.3(2204) was discovered to contain multiple stack overflows in the R7WebsS (high 7.5)
- [CVE-2026-36793](https://insights.sbomify.com/CVE-2026-36793/): Shenzhen Tenda Technology Co., Ltd Tenda W3 Wireless Router v1.0.0.3(2204) was discovered to contain multiple stack overflows in the formwrl (high 7.5)
- [CVE-2026-36792](https://insights.sbomify.com/CVE-2026-36792/): Shenzhen Tenda Technology Co., Ltd Tenda W3 Wireless Router v1.0.0.3(2204) was discovered to contain a stack overflow in the wl_radio parame (high 7.5)
- [CVE-2026-36791](https://insights.sbomify.com/CVE-2026-36791/): Shenzhen Tenda Technology Co., Ltd Tenda O3v3 v1.0.0.5 was discovered to contain a stack overflow in the save_list_data parameter of the formSetCfm function. (high 7.5)
- [CVE-2026-3679](https://insights.sbomify.com/CVE-2026-3679/): Tenda FH451 QuickIndex formQuickIndex stack-based overflow (high 8.7)
- [CVE-2026-36789](https://insights.sbomify.com/CVE-2026-36789/): Shenzhen Tenda Technology Co., Ltd Tenda AC1206 v15.03.06.23 was discovered to contain multiple stack overflows in the fromGstDhcpSetSer fun (high 7.5)
- [CVE-2026-36786](https://insights.sbomify.com/CVE-2026-36786/): Shenzhen Tenda Technology Co., Ltd Tenda FH451 V1.0.0.9 was discovered to contain a stack overflow in the list1 parameter of the fromDhcpListClient function. (high 7.5)
- [CVE-2026-36785](https://insights.sbomify.com/CVE-2026-36785/): Shenzhen Tenda Technology Co., Ltd Tenda FH451 V1.0.0.9 was discovered to contain a stack overflow in the page parameter of the fromDhcpListClient function. (high 7.5)
- [CVE-2026-36784](https://insights.sbomify.com/CVE-2026-36784/): Shenzhen Tenda Technology Co., Ltd Tenda O3 Wireless Router v1.0.0.5(4180) was discovered to contain a stack overflow in the ip parameter of (high 7.5)
- [CVE-2026-36783](https://insights.sbomify.com/CVE-2026-36783/): Shenzhen Tenda Technology Co., Ltd Tenda O3 Wireless Router v1.0.0.5(4180) was discovered to contain a stack overflow in the domain paramete (high 7.5)
- [CVE-2026-3678](https://insights.sbomify.com/CVE-2026-3678/): Tenda FH451 AdvSetWan sub_3C434 stack-based overflow (high 8.7)
- [CVE-2026-36779](https://insights.sbomify.com/CVE-2026-36779/): Shenzhen Tenda Technology Co., Ltd Tenda O3 Wireless Router v1.0.0.5(4180) was discovered to contain multiple stack overflows in the fromVir (high 7.5)
- [CVE-2026-36778](https://insights.sbomify.com/CVE-2026-36778/): Shenzhen Tenda Technology Co., Ltd Tenda O3 Wireless Router v1.0.0.5(4180) was discovered to contain a stack overflow in the username parame (medium 4.9)
- [CVE-2026-36777](https://insights.sbomify.com/CVE-2026-36777/): Shenzhen Tenda Technology Co., Ltd Tenda W3 Wireless Router v1.0.0.3(2204) was discovered to contain a stack overflow in the param_1 paramet (medium 6.5)
- [CVE-2026-36773](https://insights.sbomify.com/CVE-2026-36773/): Shenzhen Tenda Technology Co., Ltd Tenda W3 Wireless Router v1.0.0.3(2204) was discovered to contain a stack overflow in the Go parameter of (medium 6.5)
- [CVE-2026-36772](https://insights.sbomify.com/CVE-2026-36772/): Shenzhen Tenda Technology Co., Ltd Tenda W3 Wireless Router v1.0.0.3(2204) was discovered to contain a stack overflow in the wl_radio parame (medium 6.5)
- [CVE-2026-36771](https://insights.sbomify.com/CVE-2026-36771/): Shenzhen Tenda Technology Co., Ltd Tenda W3 Wireless Router v1.0.0.3(2204) was discovered to contain a stack overflow in the wl_radio parame (high 7.5)
- [CVE-2026-36770](https://insights.sbomify.com/CVE-2026-36770/): Shenzhen Tenda Technology Co., Ltd Tenda US_W3V1.0BR v1.0.0.3 was discovered to contain a stack overflow in the Go parameter of the ask_to_reboot function. (high 7.5)
- [CVE-2026-3677](https://insights.sbomify.com/CVE-2026-3677/): Tenda FH451 setcfm fromSetCfm stack-based overflow (high 8.7)
- [CVE-2026-36767](https://insights.sbomify.com/CVE-2026-36767/): Shopizer has a path traversal issue (critical 10.0)
- [CVE-2026-36766](https://insights.sbomify.com/CVE-2026-36766/): Shopizer is vulnerable to Cross-site Scripting (medium 5.4)
- [CVE-2026-36765](https://insights.sbomify.com/CVE-2026-36765/): An XML external entity (XXE) vulnerability in the /designer/loadReport endpoint of SpringBlade v4.8.0 allows authenticated attackers to exec (high 8.8)
- [CVE-2026-36764](https://insights.sbomify.com/CVE-2026-36764/): A Server-Side Request Forgery (SSRF) in the /ureport/datasource/testConnection endpoint of SpringBlade v4.8.0 allows authenticated attackers (medium 5.0)
- [CVE-2026-36763](https://insights.sbomify.com/CVE-2026-36763/): A stored cross-site scripting (XSS) vulnerability in the /api/blade-desk/notice/submit endpoint of SpringBlade v4.8.0 allows attackers to ex (medium 6.1)
- [CVE-2026-36762](https://insights.sbomify.com/CVE-2026-36762/): An issue in the fileEntityId parameter in the /a/file/upload endpoint of JeeSite v5.15.1 allows authenticated attackers with file upload per (high 8.8)
- [CVE-2026-36761](https://insights.sbomify.com/CVE-2026-36761/): A stored cross-site scripting (XSS) vulnerability in the /msg/msgInner/save endpoint of JeeSite v5.15.1 allows attackers to execute arbitrar (medium 6.1)
- [CVE-2026-36760](https://insights.sbomify.com/CVE-2026-36760/): An issue in the fileMd5 parameter in the /a/file/upload endpoint of JeeSite v5.15.1 allows authenticated attackers with file upload permissi (critical 9.6)
- [CVE-2026-3676](https://insights.sbomify.com/CVE-2026-3676/): There are multiple vulnerabilities in IBM DB2 bundled with IBM Application Performance Management products. (medium 6.5)
- [CVE-2026-36759](https://insights.sbomify.com/CVE-2026-36759/): A Server-Side Request Forgery (SSRF) in the /themes/{name}/upgrade-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan (medium 6.5)
- [CVE-2026-36758](https://insights.sbomify.com/CVE-2026-36758/): A Server-Side Request Forgery (SSRF) in the /themes/-/install-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan inte (medium 4.3)
- [CVE-2026-36757](https://insights.sbomify.com/CVE-2026-36757/): A Server-Side Request Forgery (SSRF) in the /plugins/{name}/upgrade-from-uri endpoint of halo v2.22.14 allows authenticated attackers to sca (medium 4.3)
- [CVE-2026-36756](https://insights.sbomify.com/CVE-2026-36756/): A Server-Side Request Forgery (SSRF) in the /plugins/-/install-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan int (medium 5.4)
- [CVE-2026-3675](https://insights.sbomify.com/CVE-2026-3675/): Freedom Factory dGEN1 org.ethosmobile.ethoslauncher FakeAppReceiver improper authorization (medium 4.8)
- [CVE-2026-36748](https://insights.sbomify.com/CVE-2026-36748/): RockRMS v16.13 and before v.17.7.0 is vulnerable to Cross Site Scripting (XSS) via Social Media links in user profile. (critical 9.0)
- [CVE-2026-36742](https://insights.sbomify.com/CVE-2026-36742/): Hiseeu C90 v5.7.15 is vulnerable to Insecure Permissions. (medium 6.8)
- [CVE-2026-36741](https://insights.sbomify.com/CVE-2026-36741/): Command injection in u-speed:t18-21k firmware (high 7.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/685/