# Vulnerabilities published in 2026


- [CVE-2026-3674](https://insights.sbomify.com/CVE-2026-3674/): Freedom Factory dGEN1 org.ethosmobile.ethoslauncher FakeAppProvider improper authorization (medium 4.8)
- [CVE-2026-36738](https://insights.sbomify.com/CVE-2026-36738/): Auth bypass in u-speed:t18-21k firmware (medium 6.8)
- [CVE-2026-36734](https://insights.sbomify.com/CVE-2026-36734/): EDIMAX BR-6428nS V3 1.15 is vulnerable to Command Injection. (high 8.8)
- [CVE-2026-3673](https://insights.sbomify.com/CVE-2026-3673/): Frappe Framework 16.10.0 - Stored DOM XSS in Tag Pill Renderer (medium 4.6)
- [CVE-2026-36728](https://insights.sbomify.com/CVE-2026-36728/): A markdown based cross-site scripting (XSS) vulnerability in the AI assistant chat function of FastapiAdmin v2.2.0 allows attackers to execu (medium 5.4)
- [CVE-2026-36727](https://insights.sbomify.com/CVE-2026-36727/): An insecure authentication vulnerability in the /api/social-sign-in endpoint of bookcars v8.3 allows attackers to bypass authentication via a forged JWT token. (critical 9.1)
- [CVE-2026-36726](https://insights.sbomify.com/CVE-2026-36726/): An arbitrary file deletion vulnerability in the /api/delete-temp-license/{file} endpoint of bookcars v8.3 allows unauthenticated attackers t (medium 5.3)
- [CVE-2026-36725](https://insights.sbomify.com/CVE-2026-36725/): A markdown based cross-site scripting (XSS) vulnerability in the /system/notice/create endpoint of FastapiAdmin v2.2.0 allows attackers to e (medium 6.1)
- [CVE-2026-36724](https://insights.sbomify.com/CVE-2026-36724/): An uncaught exception in the /application/job/update/{id} endpoint of FastapiAdmin v2.2.0 allows authenticated attackers with the module_tas (medium 6.5)
- [CVE-2026-36723](https://insights.sbomify.com/CVE-2026-36723/): An unrestricted file rename vulnerability in the /api/create-user component of bookcars v8.3 allows authenticated attackers to leverage dire (high 8.8)
- [CVE-2026-36722](https://insights.sbomify.com/CVE-2026-36722/): An authenticated arbitrary file upload vulnerability in the /api/create-car-image component of bookcars v8.3 allows attackers to execute arb (medium 5.4)
- [CVE-2026-36721](https://insights.sbomify.com/CVE-2026-36721/): A lack of cryptographic signature verification in the validateAccessToken function of bookcars v8.3 allows attackers to bypass authenticatio (critical 9.8)
- [CVE-2026-36720](https://insights.sbomify.com/CVE-2026-36720/): Insecure permissions in bookcars v8.3 allows authenticated attackers to escalate privileges from user to admin via modifying their user type. (high 8.1)
- [CVE-2026-3672](https://insights.sbomify.com/CVE-2026-3672/): JeecgBoot getDictItems isExistSqlInjectKeyword sql injection (medium 5.3)
- [CVE-2026-36719](https://insights.sbomify.com/CVE-2026-36719/): An information disclosure vulnerability in the /api/v1/user/info endpoint of AgentChat v2.3.0 allows unauthenticated attackers to obtain sen (high 7.5)
- [CVE-2026-3671](https://insights.sbomify.com/CVE-2026-3671/): Freedom Factory dGEN1 org.ethereumphone.walletmanager.testing123 TokenBalanceContentProvider improper authorization (medium 4.8)
- [CVE-2026-3670](https://insights.sbomify.com/CVE-2026-3670/): Freedom Factory dGEN1 com.dgen.alarm improper authorization (medium 4.8)
- [CVE-2026-36698](https://insights.sbomify.com/CVE-2026-36698/): Xovis AG APS-R-POE, APS-R-POE-PP, APS-R, APS-R-POE-USB, and APS-B 2.10.1.1 and earlier contains an OS command injection vulnerability in /sbin/ImportParamSet.sh. (not scored)
- [CVE-2026-3669](https://insights.sbomify.com/CVE-2026-3669/): Freedom Factory dGEN1 com.dgen.alarm AlarmService improper authorization (medium 4.8)
- [CVE-2026-3668](https://insights.sbomify.com/CVE-2026-3668/): Freedom Factory dGEN1 org.ethosmobile.webpwaemul AndroidEthereum access control (low 2.3)
- [CVE-2026-36670](https://insights.sbomify.com/CVE-2026-36670/): A Time-Based Blind SQL Injection vulnerability in the alias_management module of OpenSIPS Control Panel (opensips-cp) prior to version 9.3.3 (high 8.8)
- [CVE-2026-3667](https://insights.sbomify.com/CVE-2026-3667/): Freedom Factory dGEN1 org.ethosmobile.ethoslauncher FakeAppService improper authorization (medium 4.8)
- [CVE-2026-36669](https://insights.sbomify.com/CVE-2026-36669/): An unauthenticated arbitrary file upload vulnerability in ck_upload_handler.php in Feng Office 3.11.13.11 allows remote attackers to upload (critical 9.8)
- [CVE-2026-3666](https://insights.sbomify.com/CVE-2026-3666/): wpForo Forum <= 2.4.16 - Authenticated (Subscriber+) Arbitrary File Deletion via Post Body (high 8.8)
- [CVE-2026-3665](https://insights.sbomify.com/CVE-2026-3665/): xlnt-community xlnt XLSX File xlsx_consumer.cpp read_office_document null pointer dereference (medium 4.8)
- [CVE-2026-3664](https://insights.sbomify.com/CVE-2026-3664/): xlnt-community xlnt Encrypted XLSX File compound_document.cpp read_directory out-of-bounds (medium 4.8)
- [CVE-2026-3663](https://insights.sbomify.com/CVE-2026-3663/): xlnt-community xlnt XLSX File compound_document.cpp xsgetn out-of-bounds (medium 4.8)
- [CVE-2026-3662](https://insights.sbomify.com/CVE-2026-3662/): Wavlink WL-NU516U1 adm.cgi usb_p910 command injection (medium 5.1)
- [CVE-2026-36618](https://insights.sbomify.com/CVE-2026-36618/): Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 responds to version.bind CHAOS TXT queries, disclosing the DNS resolver software ve (medium 4.3)
- [CVE-2026-36616](https://insights.sbomify.com/CVE-2026-36616/): Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 contains hardcoded WiFi driver credentials including a RADIUS shared secret, WPS te (medium 5.9)
- [CVE-2026-36615](https://insights.sbomify.com/CVE-2026-36615/): Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 exposes an undocumented /agileconfigreset endpoint that returns internal buffer con (medium 4.3)
- [CVE-2026-36613](https://insights.sbomify.com/CVE-2026-36613/): Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 returns 128 bytes of uninitialized internal buffer contents when receiving HTTP POS (medium 4.3)
- [CVE-2026-36612](https://insights.sbomify.com/CVE-2026-36612/): Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 enables WPS 2.0 by default with a weak lockout policy (60-second lockout after 10 attempts). (medium 6.4)
- [CVE-2026-36611](https://insights.sbomify.com/CVE-2026-36611/): Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 returns 128 bytes of uninitialized buffer when receiving POST requests without SOAP (high 7.3)
- [CVE-2026-36610](https://insights.sbomify.com/CVE-2026-36610/): Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 transmits DDNS credentials over plaintext HTTP with only Base64 encoding. (medium 5.9)
- [CVE-2026-3661](https://insights.sbomify.com/CVE-2026-3661/): Wavlink WL-NU516U1 adm.cgi ota_new_upgrade command injection (medium 5.1)
- [CVE-2026-36609](https://insights.sbomify.com/CVE-2026-36609/): Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 uses a static authentication nonce that does not change between requests from the same source IP. (high 7.3)
- [CVE-2026-36608](https://insights.sbomify.com/CVE-2026-36608/): Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows UPnP AddPortMapping to forward external ports to the router's own adm (high 8.8)
- [CVE-2026-36607](https://insights.sbomify.com/CVE-2026-36607/): Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows unauthenticated brute-force attacks via the TDDP password change endp (high 8.8)
- [CVE-2026-36606](https://insights.sbomify.com/CVE-2026-36606/): Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 encrypts configuration backups with a hardcoded DES key using single DES in ECB mode. (high 7.1)
- [CVE-2026-36605](https://insights.sbomify.com/CVE-2026-36605/): Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 is vulnerable to a HTTP denial of service via a low number of crafted incomp (medium 6.5)
- [CVE-2026-36604](https://insights.sbomify.com/CVE-2026-36604/): Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 does not validate the HTTP Host header, enabling DNS rebinding attacks. (medium 6.5)
- [CVE-2026-36603](https://insights.sbomify.com/CVE-2026-36603/): Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 exposes 15 of 18 UPnP IGD actions without authentication on port 1900, inclu (high 8.1)
- [CVE-2026-36602](https://insights.sbomify.com/CVE-2026-36602/): Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 discloses kernel memory layout via the UPnP GetStatusInfo action. (medium 4.3)
- [CVE-2026-3660](https://insights.sbomify.com/CVE-2026-3660/): IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to Authentication Bypass (critical 9.8)
- [CVE-2026-36590](https://insights.sbomify.com/CVE-2026-36590/): Denial of service in emqx:nanomq (high 7.5)
- [CVE-2026-3659](https://insights.sbomify.com/CVE-2026-3659/): WP Circliful <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute (medium 6.4)
- [CVE-2026-3658](https://insights.sbomify.com/CVE-2026-3658/): Appointment Booking Calendar <= 1.6.10.0 - Unauthenticated SQL Injection via 'fields' Parameter (high 7.5)
- [CVE-2026-36576](https://insights.sbomify.com/CVE-2026-36576/): An OS command injection vulnerability in the app.py component of openlabs docker-wkhtmltopdf-aas up to commit 9f50579 allows attackers to ex (critical 9.8)
- [CVE-2026-36574](https://insights.sbomify.com/CVE-2026-36574/): A DLL hijacking vulnerability in Wassimulator (GitHub) CactusViewer v2.3.0 allows attackers to escalate privileges and execute arbitrary code via a crafted DLL. (high 7.8)
- [CVE-2026-3657](https://insights.sbomify.com/CVE-2026-3657/): My Sticky Bar <= 2.8.6 - Unauthenticated SQL Injection via 'stickymenu_contact_lead_form' Action (high 7.5)
- [CVE-2026-3655](https://insights.sbomify.com/CVE-2026-3655/): Auth bypass in OTP Login With Phone Number, OTP Verification (critical 9.8)
- [CVE-2026-36540](https://insights.sbomify.com/CVE-2026-36540/): Netis AC1200 Router NC21 V4.0.1.4296 is vulnerable to unauthenticated command injection via the /cgi-bin/skk_set.cgi endpoint. (high 7.3)
- [CVE-2026-36539](https://insights.sbomify.com/CVE-2026-36539/): Netis AC1200 Router NC21 V4.0.1.4296 exposes a CGI endpoint /cgi-bin/skk_get.cgi that returns the entire router configuration as a JSON resp (high 7.3)
- [CVE-2026-36538](https://insights.sbomify.com/CVE-2026-36538/): Netis AC1200 Router NC21 V4.0.1.4296 contains a hard-coded root credential stored in /etc/shadow.sample. (high 7.3)
- [CVE-2026-36537](https://insights.sbomify.com/CVE-2026-36537/): ThingsBoard v4.3.0.1 is vulnerable to an authentication bypass during the OAuth authorization code exchange. (critical 9.8)
- [CVE-2026-36521](https://insights.sbomify.com/CVE-2026-36521/): PublicCMS V5.202506.d has a Cross Site Scripting (XSS) vulnerability in the site configuration management module. (medium 6.1)
- [CVE-2026-3652](https://insights.sbomify.com/CVE-2026-3652/): ARForms <= 7.1.3 - Unauthenticated Stored Cross-Site Scripting via 'value' Parameter (high 7.2)
- [CVE-2026-3651](https://insights.sbomify.com/CVE-2026-3651/): Missing authorization in Build App Online (medium 5.3)
- [CVE-2026-36501](https://insights.sbomify.com/CVE-2026-36501/): An issue in the Externalizable.readExternal() component of Controller v12.0.5 allows attackers to cause a Denial of Service (DoS) via a crafted input. (high 7.5)
- [CVE-2026-36500](https://insights.sbomify.com/CVE-2026-36500/): An issue in the cluster-admin:backup-datastore component of Controller v12.0.5 allows attackers to execute a directory traversal via a crafted request. (critical 9.1)
- [CVE-2026-3650](https://insights.sbomify.com/CVE-2026-3650/): Grassroots DICOM Missing release of memory after effective lifetime (high 8.7)
- [CVE-2026-36499](https://insights.sbomify.com/CVE-2026-36499/): A missing upper-bound check in the udpif_set_threads() function of Open vSwitch v3.6.90 allows an attacker with OVSDB write access to reques (medium 6.5)
- [CVE-2026-3649](https://insights.sbomify.com/CVE-2026-3649/): Missing authorization in Katalogportal-pdf-sync Widget (medium 5.3)
- [CVE-2026-36478](https://insights.sbomify.com/CVE-2026-36478/): An issue in Technitium DNS Server v.14.3 and before allows a remote attacker to cause a denial of service via the DnsServerApp.exe, DnsServe (high 7.5)
- [CVE-2026-36472](https://insights.sbomify.com/CVE-2026-36472/): CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS). (medium 5.2)
- [CVE-2026-36471](https://insights.sbomify.com/CVE-2026-36471/): Deserialization of Untrusted Data of the __post_data parameter in cn_parse_url() in CuteNews v.2.1.2 allows a remote attacker to inject arbi (medium 5.8)
- [CVE-2026-36470](https://insights.sbomify.com/CVE-2026-36470/): CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS) in index.php. (medium 5.8)
- [CVE-2026-36469](https://insights.sbomify.com/CVE-2026-36469/): CuteNews v.2.1.2 is vulnerable to Server-Side Request Forgery (SSRF) in core/modules/media.php -- upload_from_inet (Media Manager's "Upload (critical 9.1)
- [CVE-2026-36468](https://insights.sbomify.com/CVE-2026-36468/): Cross-site Scripting (XSS) in index.php in CuteNews v.2.1.2 allows remote unauthenticated attackers to supply an arbitrarily named URL param (medium 6.1)
- [CVE-2026-36467](https://insights.sbomify.com/CVE-2026-36467/): Unrestricted Upload of File with Dangerous Type in core/modules/media.php in CuteNews v.2.1.2 allows remote authenticated users with access (high 7.2)
- [CVE-2026-36460](https://insights.sbomify.com/CVE-2026-36460/): Dovestones Softwares ADPhonebook before v4.0.1.1 is vulnerable to a Cross Site Scripting vulnerability. (medium 4.8)
- [CVE-2026-3646](https://insights.sbomify.com/CVE-2026-3646/): LTL Freight Quotes – R+L Carriers Edition <= 3.3.13 - Missing Authorization to Unauthenticated Settings Update (medium 5.3)
- [CVE-2026-36458](https://insights.sbomify.com/CVE-2026-36458/): ChestnutCMS v1.5.10 has a SQL injection vulnerability. (critical 9.8)
- [CVE-2026-36453](https://insights.sbomify.com/CVE-2026-36453/): Missing authorization in Rhymix (high 7.4)
- [CVE-2026-3645](https://insights.sbomify.com/CVE-2026-3645/): Missing authorization in Punnel – Landing Page Builder (medium 5.3)
- [CVE-2026-3644](https://insights.sbomify.com/CVE-2026-3644/): Incomplete control character validation in http.cookies (medium 6.0)
- [CVE-2026-36438](https://insights.sbomify.com/CVE-2026-36438/): An issue in Intelbras VIP-1230-D-G4 Version V2.800.00IB00C.0.T allows a remote attacker to obtain sensitive information via password reset f (medium 5.3)
- [CVE-2026-36436](https://insights.sbomify.com/CVE-2026-36436/): An issue in Trisolutions BRPerfX version 1.4.4.0 exposes LDAP credentials in plaintext within the administrative configuration interface. (high 7.5)
- [CVE-2026-36433](https://insights.sbomify.com/CVE-2026-36433/): An issue in Actions Semiconductor Co. (critical 9.8)
- [CVE-2026-3643](https://insights.sbomify.com/CVE-2026-3643/): Missing authorization in Accessibly – WordPress Website Accessibility (high 7.2)
- [CVE-2026-36425](https://insights.sbomify.com/CVE-2026-36425/): An issue in OPSWAT AppRemover Driver (ardrv.sys) v2017.10.02.1551 and earlier in IOCTL handler 0x2420031. (medium 6.5)
- [CVE-2026-3642](https://insights.sbomify.com/CVE-2026-3642/): e-shot <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Form Settings Modification via AJAX (medium 5.3)
- [CVE-2026-36418](https://insights.sbomify.com/CVE-2026-36418/): JimuReport versions 2.3.4 and below are vulnerable to remote code execution due to improper handling of Aviator expressions. (critical 9.1)
- [CVE-2026-3641](https://insights.sbomify.com/CVE-2026-3641/): Appmax <= 1.0.3 - Missing Authorization to Order Status Manipulation and Arbitrary Order Creation via Webhook Endpoint (medium 5.3)
- [CVE-2026-3640](https://insights.sbomify.com/CVE-2026-3640/): STRABL <= 4.5 - Unauthenticated Arbitrary Webhook Creation via REST API Endpoint (medium 5.3)
- [CVE-2026-36392](https://insights.sbomify.com/CVE-2026-36392/): FairSketch Rise CRM Version 3.9.6 is vulnerable to Cross Site Scripting (XSS). (medium 5.4)
- [CVE-2026-3639](https://insights.sbomify.com/CVE-2026-3639/): Cross-site scripting in PPWP – Password Protect Pages (medium 6.4)
- [CVE-2026-36388](https://insights.sbomify.com/CVE-2026-36388/): A Cross-Site Scripting (XSS) vulnerability was found in PHPGurukal Hospital Management System v4.0 in the /hospital/hms/edit-profile.php page. (medium 5.4)
- [CVE-2026-36387](https://insights.sbomify.com/CVE-2026-36387/): A Remote Code Execution vulnerability was found in CODEASTRO Membership Management System v1.0 in /add_members.php. (medium 6.5)
- [CVE-2026-3638](https://insights.sbomify.com/CVE-2026-3638/): Missing authorization in Server (medium 5.9)
- [CVE-2026-3637](https://insights.sbomify.com/CVE-2026-3637/): Mattermost fails to enforce create_post permission when editing posts (medium 4.3)
- [CVE-2026-36365](https://insights.sbomify.com/CVE-2026-36365/): An issue in Lymphatus caesium-image-compressor All versions up to and including commit 02da2c6 allows a local attacker to execute arbitrary (high 7.8)
- [CVE-2026-3636](https://insights.sbomify.com/CVE-2026-3636/): Sanitize team member data returned by API (medium 4.3)
- [CVE-2026-36358](https://insights.sbomify.com/CVE-2026-36358/): Cross Site Scripting vulnerability in Juzaweb CMS v.5.0.0 allows a remote attacker via execute arbitrary code via a crafted script to the Ad (medium 5.4)
- [CVE-2026-36356](https://insights.sbomify.com/CVE-2026-36356/): The GoAhead web server on MeiG Smart FORGE_SLT711 devices (firmware MDM9607.LE.1.0-00110-STD.PROD-1) allows unauthenticated OS command injec (critical 9.1)
- [CVE-2026-36355](https://insights.sbomify.com/CVE-2026-36355/): The rtl8192cd Wi-Fi kernel driver in the Realtek rtl819x Jungle SDK (all known versions through v3.4.14B) does not perform any access contro (high 7.7)
- [CVE-2026-3635](https://insights.sbomify.com/CVE-2026-3635/): fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections (medium 6.1)
- [CVE-2026-36341](https://insights.sbomify.com/CVE-2026-36341/): Webkul Krayin CRM is Vulnerable to Cross-Site Scripting in the /admin/activities/create endpoint (medium 5.4)
- [CVE-2026-36340](https://insights.sbomify.com/CVE-2026-36340/): Krayin CRM allows a remote attacker to execute arbitrary code via compose email function (high 8.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/686/