# Vulnerabilities published in 2026


- [CVE-2026-3410](https://insights.sbomify.com/CVE-2026-3410/): itsourcecode Society Management System check_studid.php sql injection (medium 6.9)
- [CVE-2026-34099](https://insights.sbomify.com/CVE-2026-34099/): Guardian Language-System Unauthenticated SQL Injection via id Parameter in job_info.php (critical 9.3)
- [CVE-2026-34098](https://insights.sbomify.com/CVE-2026-34098/): Guardian Language-System XSS via id Parameter in media.php (medium 4.8)
- [CVE-2026-34097](https://insights.sbomify.com/CVE-2026-34097/): Guardian Language-System XSS via id Parameter in text_file.php (medium 4.8)
- [CVE-2026-34096](https://insights.sbomify.com/CVE-2026-34096/): Guardian Language-System XSS via name Parameter in designer.php (medium 4.8)
- [CVE-2026-34095](https://insights.sbomify.com/CVE-2026-34095/): action=raw with Special:Mypage subpage title responds with "Content-Type: text/html" on ctype=text/javascript request (not scored)
- [CVE-2026-34094](https://insights.sbomify.com/CVE-2026-34094/): Other in MediaWiki (low 2.0)
- [CVE-2026-34093](https://insights.sbomify.com/CVE-2026-34093/): Special:UserRights allows viewing user rights from private wiki (low 1.1)
- [CVE-2026-34092](https://insights.sbomify.com/CVE-2026-34092/): Block UI elements in 'tools'-sidebar shows presence of an autoblocked IP (low 2.1)
- [CVE-2026-34091](https://insights.sbomify.com/CVE-2026-34091/): User localization leaked by AbuseFilter + EventStream (medium 5.5)
- [CVE-2026-34090](https://insights.sbomify.com/CVE-2026-34090/): Suggested investigations: Handle suppressed usernames (medium 4.8)
- [CVE-2026-3409](https://insights.sbomify.com/CVE-2026-3409/): eosphoros-ai db-gpt Flow Import Endpoint import importlib.machinery.SourceFileLoader.exec_module code injection (medium 6.9)
- [CVE-2026-34089](https://insights.sbomify.com/CVE-2026-34089/): Memory leak in Scribunto causes runJobs.php to run out of memory (low 2.3)
- [CVE-2026-34088](https://insights.sbomify.com/CVE-2026-34088/): RecentChanges entries expose suppressed content via generated log page html (low 1.3)
- [CVE-2026-34087](https://insights.sbomify.com/CVE-2026-34087/): Users API leaks whether privileged users have their user groups disabled for lack of 2FA (medium 5.1)
- [CVE-2026-34086](https://insights.sbomify.com/CVE-2026-34086/): AbuseFilter misuses ::userCanBitfield, exposing access-controlled information (low 2.1)
- [CVE-2026-34085](https://insights.sbomify.com/CVE-2026-34085/): Memory corruption in fontconfig (medium 5.9)
- [CVE-2026-34084](https://insights.sbomify.com/CVE-2026-34084/): PhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFactory::load (critical 9.2)
- [CVE-2026-34083](https://insights.sbomify.com/CVE-2026-34083/): signalk-server: OAuth Authorization Code Theft via Unvalidated Host Header in OIDC Flow (medium 6.1)
- [CVE-2026-34082](https://insights.sbomify.com/CVE-2026-34082/): Dify has IDOR in deleting someone else's chat conversation (medium 5.3)
- [CVE-2026-34080](https://insights.sbomify.com/CVE-2026-34080/): xdg-dbus-proxy has an eavesdrop filter bypass allowing message interception (medium 6.8)
- [CVE-2026-3408](https://insights.sbomify.com/CVE-2026-3408/): Open Babel CDXML File atom.cpp GetExplicitValence null pointer dereference (medium 5.3)
- [CVE-2026-34079](https://insights.sbomify.com/CVE-2026-34079/): Flatpak affected by arbitrary file deletion on the host filesystem (high 8.7)
- [CVE-2026-34078](https://insights.sbomify.com/CVE-2026-34078/): Flatpak has a complete sandbox escape leading to host file access and code execution in the host context (critical 9.3)
- [CVE-2026-34077](https://insights.sbomify.com/CVE-2026-34077/): React Router vulnerable to Denial of Service via reflected user input in single-fetch (high 7.5)
- [CVE-2026-34076](https://insights.sbomify.com/CVE-2026-34076/): Clerk JavaScript: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host (high 7.4)
- [CVE-2026-34073](https://insights.sbomify.com/CVE-2026-34073/): cryptography has incomplete DNS name constraint enforcement on peer names (low 1.7)
- [CVE-2026-34072](https://insights.sbomify.com/CVE-2026-34072/): cronmaster: Middleware authentication bypass enabling unauthorized page access and server-action execution (high 8.3)
- [CVE-2026-34071](https://insights.sbomify.com/CVE-2026-34071/): Stirling-PDF has Stored Cross Site Scripting (XSS) via EML-to-HTML Export (medium 5.4)
- [CVE-2026-34070](https://insights.sbomify.com/CVE-2026-34070/): LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions (high 7.5)
- [CVE-2026-3407](https://insights.sbomify.com/CVE-2026-3407/): YosysHQ yosys BLIF File rtlil.h set heap-based overflow (medium 4.8)
- [CVE-2026-34069](https://insights.sbomify.com/CVE-2026-34069/): nimiq-consensus panics via RequestMacroChain micro-block locator (medium 5.3)
- [CVE-2026-34068](https://insights.sbomify.com/CVE-2026-34068/): nimiq-transaction: UpdateValidator transactions allows voting key change without proof-of-knowledge (medium 6.8)
- [CVE-2026-34067](https://insights.sbomify.com/CVE-2026-34067/): nimiq-transaction vulnerable to panic via `HistoryTreeProof` length mismatch (low 3.1)
- [CVE-2026-34066](https://insights.sbomify.com/CVE-2026-34066/): nimiq-blockchain: Peer-triggerable panic during history sync (medium 5.3)
- [CVE-2026-34065](https://insights.sbomify.com/CVE-2026-34065/): nimiq-primitives: Node crash due to missing interlink validation in election macro block proposals (high 7.5)
- [CVE-2026-34064](https://insights.sbomify.com/CVE-2026-34064/): nimiq-account: Vesting insufficient funds error can panic (medium 5.3)
- [CVE-2026-34063](https://insights.sbomify.com/CVE-2026-34063/): network-libp2p: Peer can crash the node by opening discovery protocol substream twice (high 7.5)
- [CVE-2026-34062](https://insights.sbomify.com/CVE-2026-34062/): Nimiq has Allocation of Resources Without Limits or Throttling in its libp2p request/response (medium 5.3)
- [CVE-2026-34061](https://insights.sbomify.com/CVE-2026-34061/): nimiq/core-rs-albatross: Macro block proposal interlink bug (medium 4.9)
- [CVE-2026-34060](https://insights.sbomify.com/CVE-2026-34060/): Ruby LSP has arbitrary code execution through branch setting (high 7.1)
- [CVE-2026-3406](https://insights.sbomify.com/CVE-2026-3406/): projectworlds Online Art Gallery Shop Registration registration.php sql injection (medium 6.9)
- [CVE-2026-34059](https://insights.sbomify.com/CVE-2026-34059/): Apache HTTP Server: mod_proxy_ajp: Heap Over-Read and memory disclosure in ajp_parse_data() (high 7.5)
- [CVE-2026-34058](https://insights.sbomify.com/CVE-2026-34058/): Coolify: OS Command Injection via Unmanaged Container Operations - Remote Code Execution (high 8.8)
- [CVE-2026-34057](https://insights.sbomify.com/CVE-2026-34057/): Coolify: Authenticated Remote Code Execution via Command Injection in Database Import Container Name (high 8.8)
- [CVE-2026-34056](https://insights.sbomify.com/CVE-2026-34056/): OpenEMR has a Privilege Escalation that Allows a Low-Level User to View Admin-Only Data (high 7.7)
- [CVE-2026-34055](https://insights.sbomify.com/CVE-2026-34055/): OpenEMR has IDOR in Patient Notes Web UI allows unauthorized note access/modification (high 8.1)
- [CVE-2026-34054](https://insights.sbomify.com/CVE-2026-34054/): openssl on Windows built with openssldir set from the build machine (Uncontrolled Search Path Element) (high 7.8)
- [CVE-2026-34053](https://insights.sbomify.com/CVE-2026-34053/): OpenEMR Missing Authorization in Procedure Order AJAX Deletion Handler (high 7.1)
- [CVE-2026-34052](https://insights.sbomify.com/CVE-2026-34052/): LTI JupyterHub Authenticator: Unbounded Memory Growth via Nonce Storage (Denial of Service) (medium 5.9)
- [CVE-2026-34051](https://insights.sbomify.com/CVE-2026-34051/): OpenEMR has Improper ACL On Import/Export Popup (medium 5.4)
- [CVE-2026-34050](https://insights.sbomify.com/CVE-2026-34050/): Coolify Settings/Updates Livewire component missing instance administrator authorization (medium 6.5)
- [CVE-2026-3405](https://insights.sbomify.com/CVE-2026-3405/): thinkgem JeeSite Connection path traversal (low 2.3)
- [CVE-2026-34049](https://insights.sbomify.com/CVE-2026-34049/): Coolify: Command Injection via unsanitized MongoDB collection names in database backup (low 3.3)
- [CVE-2026-34048](https://insights.sbomify.com/CVE-2026-34048/): Missing authorization in coolify (critical 9.9)
- [CVE-2026-34047](https://insights.sbomify.com/CVE-2026-34047/): Coolify: WebSocket Endpoint Access Control Flaw Leading to Remote Code Execution (critical 9.9)
- [CVE-2026-34046](https://insights.sbomify.com/CVE-2026-34046/): Langflow: Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership Check (high 8.7)
- [CVE-2026-34045](https://insights.sbomify.com/CVE-2026-34045/): Podman Desktop WebView Server Exposed (high 8.2)
- [CVE-2026-34044](https://insights.sbomify.com/CVE-2026-34044/): Coolify: Cross-team IDOR in logs component (resource lookup not team-scoped) (high 7.7)
- [CVE-2026-34043](https://insights.sbomify.com/CVE-2026-34043/): Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects (medium 5.9)
- [CVE-2026-34042](https://insights.sbomify.com/CVE-2026-34042/): act: actions/cache server allows malicious cache injection (high 8.2)
- [CVE-2026-34041](https://insights.sbomify.com/CVE-2026-34041/): act: Unrestricted set-env and add-path command processing enables environment injection (high 7.7)
- [CVE-2026-34040](https://insights.sbomify.com/CVE-2026-34040/): Moby: AuthZ plugin bypass with oversized request body (high 8.8)
- [CVE-2026-3404](https://insights.sbomify.com/CVE-2026-3404/): thinkgem JeeSite Endpoint CasOutHandler.java xml external entity reference (low 2.3)
- [CVE-2026-34038](https://insights.sbomify.com/CVE-2026-34038/): Coolify authenticated remote command injection leading to RCE and secret exfiltration (critical 9.9)
- [CVE-2026-34037](https://insights.sbomify.com/CVE-2026-34037/): Cross-Tenant Resource Cloning via Broken Object-Level Authorization in cloneTo() (critical 9.9)
- [CVE-2026-34036](https://insights.sbomify.com/CVE-2026-34036/): Dolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.php (medium 6.5)
- [CVE-2026-34035](https://insights.sbomify.com/CVE-2026-34035/): Coolify: Host RCE via Log Drain secret/env command injection (high 8.8)
- [CVE-2026-34034](https://insights.sbomify.com/CVE-2026-34034/): Coolify: Host RCE via Sentinel token injection (high 8.8)
- [CVE-2026-34033](https://insights.sbomify.com/CVE-2026-34033/): Apache Answer: HTML Content Injection in Email (medium 5.4)
- [CVE-2026-34032](https://insights.sbomify.com/CVE-2026-34032/): Apache HTTP Server: mod_proxy_ajp: Heap Buffer Over-Read Due to Missing Null-Termination Check (ajp_msg_get_string) (medium 5.3)
- [CVE-2026-34031](https://insights.sbomify.com/CVE-2026-34031/): Apache Answer: The custom avatar was not properly validated (medium 6.5)
- [CVE-2026-34030](https://insights.sbomify.com/CVE-2026-34030/): Improper branch-code validation in Wertheim SafeController Software allows file path manipulation (medium 6.9)
- [CVE-2026-3403](https://insights.sbomify.com/CVE-2026-3403/): PHPGurukul Student Record Management System edit-subject.php cross site scripting (medium 4.8)
- [CVE-2026-34029](https://insights.sbomify.com/CVE-2026-34029/): Hard-coded cryptographic key in Wertheim SafeController Software allows decryption of sensitive configuration data (medium 6.8)
- [CVE-2026-34028](https://insights.sbomify.com/CVE-2026-34028/): Unauthenticated direct access to web data in Wertheim SafeController Software exposes files (medium 6.9)
- [CVE-2026-34027](https://insights.sbomify.com/CVE-2026-34027/): Upload restriction bypass in Wertheim SafeController Software allows authenticated users to upload arbitrary files (medium 5.3)
- [CVE-2026-34026](https://insights.sbomify.com/CVE-2026-34026/): Path traversal in Wertheim SafeController Software allows authenticated users to download arbitrary files (high 7.1)
- [CVE-2026-34025](https://insights.sbomify.com/CVE-2026-34025/): IP restriction bypass in Wertheim SafeController Software allows logins from unauthorized network locations (medium 5.3)
- [CVE-2026-34024](https://insights.sbomify.com/CVE-2026-34024/): Missing authorization in Wertheim SafeController Software for VAULT ROOMS (Safe Deposit Locker System) (high 8.6)
- [CVE-2026-34023](https://insights.sbomify.com/CVE-2026-34023/): Broken WebSocket authorization in Wertheim SafeController Software allows cross-branch access to restricted functions (high 7.1)
- [CVE-2026-34022](https://insights.sbomify.com/CVE-2026-34022/): Weak custom cryptography and hard-coded keys in Wertheim SafeController 65000 allow traffic decryption (high 7.1)
- [CVE-2026-34021](https://insights.sbomify.com/CVE-2026-34021/): Lack of cryptographic protection in Wertheim SafeController 5400 enables RS-485 message sniffing and replay (high 8.6)
- [CVE-2026-34020](https://insights.sbomify.com/CVE-2026-34020/): Apache OpenMeetings: Login Credentials Passed via GET Query Parameters (high 7.5)
- [CVE-2026-3402](https://insights.sbomify.com/CVE-2026-3402/): PHPGurukul Student Record Management System edit-course.php cross site scripting (medium 4.8)
- [CVE-2026-34019](https://insights.sbomify.com/CVE-2026-34019/): BIG-IP BFD vulnerability (medium 6.3)
- [CVE-2026-34018](https://insights.sbomify.com/CVE-2026-34018/): SQL injection in CubeCart (medium 5.1)
- [CVE-2026-34015](https://insights.sbomify.com/CVE-2026-34015/): Remote Code Execution in upload.php of Video Station (high 8.7)
- [CVE-2026-34014](https://insights.sbomify.com/CVE-2026-34014/): ds-move-files.sh is writable and executed as root (high 8.4)
- [CVE-2026-3401](https://insights.sbomify.com/CVE-2026-3401/): SourceCodester Web-based Pharmacy Product Management System session expiration (low 2.3)
- [CVE-2026-34009](https://insights.sbomify.com/CVE-2026-34009/): **Container Escape** Host user home directory mounted with write access into application container (high 8.4)
- [CVE-2026-34008](https://insights.sbomify.com/CVE-2026-34008/): **Privilege Escalation** World-writable crontab path monitored and executed by root-owned process (high 8.5)
- [CVE-2026-34007](https://insights.sbomify.com/CVE-2026-34007/): Command injection in Notes Station 3 (medium 6.9)
- [CVE-2026-34006](https://insights.sbomify.com/CVE-2026-34006/): Pre-Authentication Multiple Critical Vulnerabilities in QNAP sMedioDTCPServer (critical 9.3)
- [CVE-2026-34005](https://insights.sbomify.com/CVE-2026-34005/): Command injection in DVR/NVR devices (high 8.8)
- [CVE-2026-34003](https://insights.sbomify.com/CVE-2026-34003/): Xorg: xwayland: x.org x server: information exposure and denial of service via out-of-bounds memory access (high 7.8)
- [CVE-2026-34002](https://insights.sbomify.com/CVE-2026-34002/): Memory corruption in Red Hat Enterprise Linux 10 (medium 6.1)
- [CVE-2026-34001](https://insights.sbomify.com/CVE-2026-34001/): Xorg: xwayland: x.org x server: use-after-free vulnerability leads to server crash and potential memory corruption (high 7.8)
- [CVE-2026-34000](https://insights.sbomify.com/CVE-2026-34000/): Memory corruption in Red Hat Enterprise Linux 10 (medium 6.1)
- [CVE-2026-3400](https://insights.sbomify.com/CVE-2026-3400/): Tenda AC15 TextEditingConversion stack-based overflow (high 8.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/703/