# Vulnerabilities published in 2026


- [CVE-2026-3634](https://insights.sbomify.com/CVE-2026-3634/): Libsoup: libsoup: http header injection and response splitting via crlf injection in content-type header (low 3.9)
- [CVE-2026-3633](https://insights.sbomify.com/CVE-2026-3633/): Libsoup: libsoup: header and http request injection via crlf injection (low 3.9)
- [CVE-2026-36324](https://insights.sbomify.com/CVE-2026-36324/): SourceCodester Doctor Appointment System 1.0 is vulnerable to Cross Site Scripting (XSS) due to improper handling of user supplied input in (medium 6.1)
- [CVE-2026-3632](https://insights.sbomify.com/CVE-2026-3632/): Libsoup: libsoup: http smuggling and server-side request forgery via malformed hostnames (low 3.9)
- [CVE-2026-3631](https://insights.sbomify.com/CVE-2026-3631/): Buffer Over-read DoS Vulnerability in COMMGR2 (high 7.5)
- [CVE-2026-3630](https://insights.sbomify.com/CVE-2026-3630/): Stack-based Buffer Overflow Vulnerability in COMMGR2 (critical 9.8)
- [CVE-2026-3629](https://insights.sbomify.com/CVE-2026-3629/): Privilege escalation in Import and export users and customers (high 8.1)
- [CVE-2026-3628](https://insights.sbomify.com/CVE-2026-3628/): IBM Concert Software Information Disclosure (medium 5.3)
- [CVE-2026-3627](https://insights.sbomify.com/CVE-2026-3627/): Multiple Vulnerabilities in IBM Concert Software (critical 9.1)
- [CVE-2026-3626](https://insights.sbomify.com/CVE-2026-3626/): Multiple Vulnerabilities in IBM Concert Software (medium 5.3)
- [CVE-2026-36239](https://insights.sbomify.com/CVE-2026-36239/): PbootCMS v.3.2.11 contains a code injection vulnerability in its site configuration functionality (medium 4.3)
- [CVE-2026-36236](https://insights.sbomify.com/CVE-2026-36236/): SQL injection in janobe:engineers online portal (critical 9.8)
- [CVE-2026-36235](https://insights.sbomify.com/CVE-2026-36235/): SQL injection in itsourcecode:online student enrollment system (critical 9.8)
- [CVE-2026-36234](https://insights.sbomify.com/CVE-2026-36234/): SQL injection in itsourcecode:online student enrollment system (critical 9.8)
- [CVE-2026-36233](https://insights.sbomify.com/CVE-2026-36233/): SQL injection in itsourcecode:online student enrollment system (critical 9.8)
- [CVE-2026-36232](https://insights.sbomify.com/CVE-2026-36232/): SQL injection in itsourcecode:online student enrollment system (critical 9.8)
- [CVE-2026-3623](https://insights.sbomify.com/CVE-2026-3623/): Vulnerabilities exists in IBM Netezza Performance Server Replication Services (high 7.8)
- [CVE-2026-36228](https://insights.sbomify.com/CVE-2026-36228/): Buffer Overflow vulnerability in Easy Chat Server 3.1 allows a remote attacker to obtain sensitive information and execute arbitrary code vi (high 7.3)
- [CVE-2026-36227](https://insights.sbomify.com/CVE-2026-36227/): Directory Traversal vulnerability in Easy Chat Server 3.1 allows a remote attacker to obtain sensitive information and execute arbitrary cod (medium 6.5)
- [CVE-2026-36226](https://insights.sbomify.com/CVE-2026-36226/): Cross Site Scripting vulnerability in Advantech WebAccess/SCADA 8.0-2015.08.16 allows a remote attacker to obtain sensitive information via (medium 6.1)
- [CVE-2026-3622](https://insights.sbomify.com/CVE-2026-3622/): Denial-of-Service Vulnerability in UPnP Component of TP Link's TL-WR841N (high 7.1)
- [CVE-2026-36214](https://insights.sbomify.com/CVE-2026-36214/): Cross-site scripting in osTicket (medium 6.4)
- [CVE-2026-36213](https://insights.sbomify.com/CVE-2026-36213/): An issue in Microvirt MEmu Android Emulator 9.2.7.0 allows a local attacker to escalate privileges via the MemuService.exe component. (high 7.8)
- [CVE-2026-3621](https://insights.sbomify.com/CVE-2026-3621/): IBM WebSphere Application Server Liberty is affected by identity spoofing (high 7.5)
- [CVE-2026-3620](https://insights.sbomify.com/CVE-2026-3620/): Word Replacer <= 0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Replacement' Parameter (medium 4.4)
- [CVE-2026-3619](https://insights.sbomify.com/CVE-2026-3619/): Sheets2Table <= 0.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titles' Shortcode Attribute (medium 6.4)
- [CVE-2026-36189](https://insights.sbomify.com/CVE-2026-36189/): Buffer Overflow vulnerability in Uncrustify Project Affected v.Uncrustify_d-0.82.0-132-bcc41cbdc and Fixed in commit 68e67b9a1435a1bb173b106 (medium 6.2)
- [CVE-2026-36182](https://insights.sbomify.com/CVE-2026-36182/): GNCC GP5 v7.1.76 was discovered to utilize a weak hashing algorithm to protect the root password, possibly allowing attackers to obtain root (critical 9.8)
- [CVE-2026-36180](https://insights.sbomify.com/CVE-2026-36180/): A lack of runtime integrity in GNCC GP5 v7.1.76 allows physically-proximate attackers to bypass file system read-only protections and modify (medium 4.6)
- [CVE-2026-3618](https://insights.sbomify.com/CVE-2026-3618/): Cross-site scripting in Columns by BestWebSoft – Additional Columns Plugin for Posts Pages and Widgets (medium 6.4)
- [CVE-2026-36178](https://insights.sbomify.com/CVE-2026-36178/): The factory reset functionality in GNCC GP5 v7.1.76 fails to clear sensitive cryptographic material in the JFFS2 configuration partition, po (medium 4.6)
- [CVE-2026-36176](https://insights.sbomify.com/CVE-2026-36176/): GNCC GP5 v7.1.76 was discovered to store pre-signed Backblaze B2 upload URLs (PUT requests) in plaintext to the serial console. (high 7.1)
- [CVE-2026-36175](https://insights.sbomify.com/CVE-2026-36175/): An issue in the U-Boot component of GNCC GP5 v7.1.76 allows physically-proximate attackers to bypass authentication and gain root access via (medium 6.8)
- [CVE-2026-36174](https://insights.sbomify.com/CVE-2026-36174/): GNCC GP5 v7.1.76 was discovered to store sensitive wireless network information in plaintext during routine operations to the serial console. (medium 4.6)
- [CVE-2026-3617](https://insights.sbomify.com/CVE-2026-3617/): Cross-site scripting in Paypal Shortcodes (medium 6.4)
- [CVE-2026-36163](https://insights.sbomify.com/CVE-2026-36163/): An HTML injection vulnerability in the file view endpoint of LiquidFiles v4.2.7 allows authenticated attackers to execute arbitrary JavaScri (medium 5.4)
- [CVE-2026-36162](https://insights.sbomify.com/CVE-2026-36162/): An authenticated stored cross-site scripting (XSS) vulnerability in the Upload File Shares API of LiquidFiles v4.2.7 allows attackers to exe (medium 5.4)
- [CVE-2026-3616](https://insights.sbomify.com/CVE-2026-3616/): DefaultFuction Jeson Customer Relationship Management System edit.php sql injection (medium 5.3)
- [CVE-2026-3614](https://insights.sbomify.com/CVE-2026-3614/): AcyMailing 9.11.0 - 10.8.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation (high 8.8)
- [CVE-2026-3613](https://insights.sbomify.com/CVE-2026-3613/): Wavlink WL-NU516U1 login.cgi sub_401A0C stack-based overflow (high 8.6)
- [CVE-2026-3612](https://insights.sbomify.com/CVE-2026-3612/): Wavlink WL-NU516U1 OTA Online Upgrade adm.cgi sub_405AF4 command injection (high 8.6)
- [CVE-2026-3611](https://insights.sbomify.com/CVE-2026-3611/): Honeywell IQ4x BMS Controller Missing authentication for critical function (critical 10.0)
- [CVE-2026-36102](https://insights.sbomify.com/CVE-2026-36102/): An issue in the inviteController.js component in Bluewave Labs Checkmate <=3.3.0 allows remote authenticated administrators to escalate priv (high 7.2)
- [CVE-2026-3610](https://insights.sbomify.com/CVE-2026-3610/): HSC Cybersecurity Mailinspector URL mliUserValidation.php cross site scripting (medium 5.3)
- [CVE-2026-3609](https://insights.sbomify.com/CVE-2026-3609/): XIGNCODE3 xhunter1.sys kernel driver contains a Privilege Escalation Vulnerability (medium 5.3)
- [CVE-2026-3608](https://insights.sbomify.com/CVE-2026-3608/): Stack overflow in Kea daemons (high 7.5)
- [CVE-2026-3607](https://insights.sbomify.com/CVE-2026-3607/): Access Control Check Implemented After Asset is Accessed in GitLab (medium 4.3)
- [CVE-2026-3606](https://insights.sbomify.com/CVE-2026-3606/): Ettercap etterfilter ef_output.c add_data_segment out-of-bounds (medium 4.8)
- [CVE-2026-3605](https://insights.sbomify.com/CVE-2026-3605/): Vault KVv2 Metadata and Secret Deletion Policy Bypass Denial-of-Service (high 8.1)
- [CVE-2026-36045](https://insights.sbomify.com/CVE-2026-36045/): picoclaw is vulnerable to OS command injection via the ExecTool component (high 7.3)
- [CVE-2026-36044](https://insights.sbomify.com/CVE-2026-36044/): @pensar/apex <= 0.0.58 is vulnerable to OS command injection via the smart_enumerate tool. (high 8.8)
- [CVE-2026-3604](https://insights.sbomify.com/CVE-2026-3604/): Cross-site scripting in WP SEO Structured Data Schema (medium 4.9)
- [CVE-2026-36035](https://insights.sbomify.com/CVE-2026-36035/): Incorrect access control in the /api/License/deactivateOffline endpoint of CAXPerts UniversalPlantViewer WebServices Server v2.7.6 allows au (medium 6.5)
- [CVE-2026-3603](https://insights.sbomify.com/CVE-2026-3603/): IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to XML external entity injection (XXE) attack (high 7.1)
- [CVE-2026-36028](https://insights.sbomify.com/CVE-2026-36028/): A protection mechanism failure in the Code 27 Companion Hub allows an attacker with physical access to completely bypass kiosk restrictions (medium 6.8)
- [CVE-2026-36027](https://insights.sbomify.com/CVE-2026-36027/): An issue in Code27 Companion Hub SQ3A.220705.003.A1 allows a physically proximate attacker to execute arbitrary code via the USB debugging ( (medium 6.8)
- [CVE-2026-3602](https://insights.sbomify.com/CVE-2026-3602/): IBM App Connect Enterprise and IBM Integration Bus for z/OS toolkit is vulnerable to an sql injection (medium 4.7)
- [CVE-2026-3601](https://insights.sbomify.com/CVE-2026-3601/): Missing authorization in User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder (medium 4.3)
- [CVE-2026-3600](https://insights.sbomify.com/CVE-2026-3600/): Cross-site scripting in Investi (medium 6.4)
- [CVE-2026-3599](https://insights.sbomify.com/CVE-2026-3599/): Riaxe Product Customizer <= 2.1.2 - Unauthenticated SQL Injection via 'options' Parameter Keys in product_data (high 7.5)
- [CVE-2026-3598](https://insights.sbomify.com/CVE-2026-3598/): RustDesk Server Generates Config Strings Using Reversible Encoding (Base64 + Reverse) Instead of Encryption (high 8.7)
- [CVE-2026-3596](https://insights.sbomify.com/CVE-2026-3596/): Missing authorization in Riaxe Product Customizer (critical 9.8)
- [CVE-2026-3595](https://insights.sbomify.com/CVE-2026-3595/): Riaxe Product Customizer <= 2.1.2 - Unauthenticated Arbitrary User Deletion via 'user_id' Parameter (medium 5.3)
- [CVE-2026-3594](https://insights.sbomify.com/CVE-2026-3594/): Riaxe Product Customizer <= 2.4 - Unauthenticated Sensitive Information Disclosure via '/orders' REST API Endpoint (medium 5.3)
- [CVE-2026-3593](https://insights.sbomify.com/CVE-2026-3593/): Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementation (high 7.4)
- [CVE-2026-3592](https://insights.sbomify.com/CVE-2026-3592/): Amplification vulnerabilities via self-pointed glue records (medium 5.3)
- [CVE-2026-3591](https://insights.sbomify.com/CVE-2026-3591/): A stack use-after-return flaw in SIG(0) handling code may enable ACL bypass (medium 5.4)
- [CVE-2026-35906](https://insights.sbomify.com/CVE-2026-35906/): An undocumented debug CGI endpoint in T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03 allows unauthenticated attackers to execute a (critical 9.6)
- [CVE-2026-35905](https://insights.sbomify.com/CVE-2026-35905/): T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03, and T7281 v1.0.03 were discovered to contain a hardcoded password for root access (critical 9.8)
- [CVE-2026-35904](https://insights.sbomify.com/CVE-2026-35904/): Incorrect access control in the web management interface of T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03, and T7281 v1.0.03 allo (critical 9.8)
- [CVE-2026-35903](https://insights.sbomify.com/CVE-2026-35903/): Auth bypass in mercurycom:mipc252w firmware (critical 9.8)
- [CVE-2026-35902](https://insights.sbomify.com/CVE-2026-35902/): Denial of service in mercurycom:mipc252w firmware (medium 6.2)
- [CVE-2026-35901](https://insights.sbomify.com/CVE-2026-35901/): Denial of service in mercurycom:mipc252w firmware (medium 4.4)
- [CVE-2026-3590](https://insights.sbomify.com/CVE-2026-3590/): Race Condition in Guest Magic Link Authentication Allows Token Reuse (medium 6.5)
- [CVE-2026-3589](https://insights.sbomify.com/CVE-2026-3589/): WooCommerce < 10.5.3 - Arbitrary Admin User Creation via CSRF (high 7.5)
- [CVE-2026-3588](https://insights.sbomify.com/CVE-2026-3588/): Server-Side Request Forgery (SSRF) in ikea dirigera (high 7.5)
- [CVE-2026-3587](https://insights.sbomify.com/CVE-2026-3587/): Hidden CLI Function Allows Root Access (critical 10.0)
- [CVE-2026-35869](https://insights.sbomify.com/CVE-2026-35869/): A Command Injection vulnerability exists in the bs_SetLimitCli_info function within the libshare.so library of LB-link Router AC450M V4.0.0. (critical 9.8)
- [CVE-2026-35868](https://insights.sbomify.com/CVE-2026-35868/): A Command Injection vulnerability exists in the bs_SetLimitCli_info function within the libshare.so library of LB-link Router AC2100_AZ3 V1.0.4. (critical 9.8)
- [CVE-2026-35867](https://insights.sbomify.com/CVE-2026-35867/): Command injection in AC1900 firmware (low 3.1)
- [CVE-2026-3585](https://insights.sbomify.com/CVE-2026-3585/): The Events Calendar <= 6.15.17 - Authenticated (Author+) Arbitrary File Read via ajax_create_import (high 7.5)
- [CVE-2026-35847](https://insights.sbomify.com/CVE-2026-35847/): An issue in dnsmgr v.2.15 and before allows a local attacker to execute arbitrary code via the ping function of the CheckUils.php file (critical 9.8)
- [CVE-2026-3584](https://insights.sbomify.com/CVE-2026-3584/): Kali Forms <= 2.4.9 - Unauthenticated Remote Code Execution via form_process (critical 9.8)
- [CVE-2026-3583](https://insights.sbomify.com/CVE-2026-3583/): Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows] (low 3.1)
- [CVE-2026-3582](https://insights.sbomify.com/CVE-2026-3582/): Incorrect Authorization in GitHub Enterprise Server allows access to issue and commit search results without repo scope (medium 5.3)
- [CVE-2026-3581](https://insights.sbomify.com/CVE-2026-3581/): Basic Google Maps Placemarks <= 1.10.7 - Missing Authorization to Unauthenticated Default Map Coordinate Update (medium 5.3)
- [CVE-2026-3580](https://insights.sbomify.com/CVE-2026-3580/): Compiler-induced timing leak in sp_256_get_entry_256_9 on RISC-V (low 2.1)
- [CVE-2026-3579](https://insights.sbomify.com/CVE-2026-3579/): Non-constant time multiplication subroutine __muldi3 on RISC-V RV32I (low 2.1)
- [CVE-2026-3577](https://insights.sbomify.com/CVE-2026-3577/): Keep Backup Daily <= 2.1.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Backup Title (medium 4.4)
- [CVE-2026-3576](https://insights.sbomify.com/CVE-2026-3576/): Planyo online reservation system <= 3.0 - Unauthenticated Server-Side Request Forgery via 'ulap_url' Parameter (high 7.2)
- [CVE-2026-3574](https://insights.sbomify.com/CVE-2026-3574/): Cross-site scripting in Experto Dashboard for WooCommerce (medium 4.4)
- [CVE-2026-3573](https://insights.sbomify.com/CVE-2026-3573/): AI (Artificial Intelligence) - Moderately critical - Information Disclosure - SA-CONTRIB-2026-028 (high 7.5)
- [CVE-2026-3572](https://insights.sbomify.com/CVE-2026-3572/): iTracker360 <= 2.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'itracker_license' Settings Field (medium 6.1)
- [CVE-2026-35718](https://insights.sbomify.com/CVE-2026-35718/): Path traversal in vivotek:fd8136 firmware (medium 6.5)
- [CVE-2026-35717](https://insights.sbomify.com/CVE-2026-35717/): Memory corruption in vivotek:fd8136 firmware (medium 6.3)
- [CVE-2026-35716](https://insights.sbomify.com/CVE-2026-35716/): Memory corruption in vivotek:fd8136 firmware (medium 6.3)
- [CVE-2026-3571](https://insights.sbomify.com/CVE-2026-3571/): Missing authorization in Pie Register – User Registration, Profiles & Content Restriction (medium 6.5)
- [CVE-2026-3570](https://insights.sbomify.com/CVE-2026-3570/): Smarter Analytics <= 2.0 - Missing Authorization to Unauthenticated Plugin Settings Reset via 'reset' Parameter (medium 5.3)
- [CVE-2026-3569](https://insights.sbomify.com/CVE-2026-3569/): Missing authorization in Liaison Site Prober (medium 5.3)
- [CVE-2026-35682](https://insights.sbomify.com/CVE-2026-35682/): Anviz CX2 Lite Command Injection (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/687/