# Vulnerabilities published in 2026


- [CVE-2026-31249](https://insights.sbomify.com/CVE-2026-31249/): CosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnerability (CWE-502) in (high 7.3)
- [CVE-2026-31248](https://insights.sbomify.com/CVE-2026-31248/): Docling's METS GBS backend is vulnerable to XML Entity Expansion (XXE) attacks (high 7.5)
- [CVE-2026-31247](https://insights.sbomify.com/CVE-2026-31247/): Docling's JATS XML backend is vulnerable to XML Entity Expansion (XXE) attacks (high 7.5)
- [CVE-2026-31246](https://insights.sbomify.com/CVE-2026-31246/): GPT-Pilot contains a command injection vulnerability in the Executor.run() method (medium 6.5)
- [CVE-2026-31245](https://insights.sbomify.com/CVE-2026-31245/): mem0 server lacks authentication and authorization controls for its memory creation API endpoint (medium 5.3)
- [CVE-2026-31244](https://insights.sbomify.com/CVE-2026-31244/): Missing authorization in mem0:mem0 (medium 6.5)
- [CVE-2026-31243](https://insights.sbomify.com/CVE-2026-31243/): Missing authorization in mem0:mem0 (medium 6.5)
- [CVE-2026-31242](https://insights.sbomify.com/CVE-2026-31242/): Missing authorization in mem0:mem0 (critical 9.1)
- [CVE-2026-31241](https://insights.sbomify.com/CVE-2026-31241/): mem0 server lacks authentication and authorization controls for its memory deletion API endpoint (medium 6.5)
- [CVE-2026-31240](https://insights.sbomify.com/CVE-2026-31240/): mem0 server lacks authentication and authorization controls for its memory management API endpoints (high 7.5)
- [CVE-2026-3124](https://insights.sbomify.com/CVE-2026-3124/): Business logic in Download Monitor (high 7.5)
- [CVE-2026-31239](https://insights.sbomify.com/CVE-2026-31239/): mamba language model framework vulnerable to insecure deserialization when loading pre-trained models from HuggingFace Hub (critical 9.8)
- [CVE-2026-31238](https://insights.sbomify.com/CVE-2026-31238/): Ludwig framework is vulnerable to insecure deserialization in its model serving component (critical 9.8)
- [CVE-2026-31237](https://insights.sbomify.com/CVE-2026-31237/): Ludwig framework is vulnerable to insecure deserialization through its predict() method. (critical 9.8)
- [CVE-2026-31236](https://insights.sbomify.com/CVE-2026-31236/): llm CLI tool contains a code injection vulnerability via `--functions` command-line argument (critical 9.8)
- [CVE-2026-31235](https://insights.sbomify.com/CVE-2026-31235/): imgaug contains an insecure deserialization vulnerability in BackgroundAugmenter class within multicore.py module (critical 9.8)
- [CVE-2026-31234](https://insights.sbomify.com/CVE-2026-31234/): Horovod contains an insecure deserialization vulnerability in its KVStore HTTP server component (critical 9.8)
- [CVE-2026-31233](https://insights.sbomify.com/CVE-2026-31233/): Guardrails AI contains a code injection vulnerability in its Hub package installation mechanism (critical 9.8)
- [CVE-2026-31232](https://insights.sbomify.com/CVE-2026-31232/): The CosyVoice project thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnerability ( (high 8.8)
- [CVE-2026-31231](https://insights.sbomify.com/CVE-2026-31231/): Cognee thru v0.4.0 contains a critical remote code execution vulnerability in its notebook cell execution API endpoint. (critical 9.8)
- [CVE-2026-31230](https://insights.sbomify.com/CVE-2026-31230/): The Adversarial Robustness Toolbox (ART) thru 1.20.1 contains a command-line argument injection vulnerability in its Kubeflow component (rob (critical 9.8)
- [CVE-2026-31229](https://insights.sbomify.com/CVE-2026-31229/): The Adversarial Robustness Toolbox (ART) thru 1.20.1 contains an insecure deserialization vulnerability (CWE-502) in its Kubeflow component' (critical 9.8)
- [CVE-2026-31228](https://insights.sbomify.com/CVE-2026-31228/): The Adversarial Robustness Toolbox (ART) thru 1.20.1 contains a remote code execution vulnerability in its Kubeflow component. (critical 9.8)
- [CVE-2026-31226](https://insights.sbomify.com/CVE-2026-31226/): The TinyZero project thru commit 6652a63c57fa7e5ccde3fc9c598c7176ff15b839 (2025-58-24) contains a critical command injection vulnerability ( (critical 9.8)
- [CVE-2026-31225](https://insights.sbomify.com/CVE-2026-31225/): Superduper: Remote code execution via unsafe eval in superduper query parsing (high 8.8)
- [CVE-2026-31224](https://insights.sbomify.com/CVE-2026-31224/): Snorkel MultitaskClassifier.load uses an unsafe torch.load (high 8.8)
- [CVE-2026-31223](https://insights.sbomify.com/CVE-2026-31223/): Snorkel BaseLabeler.load uses an unsafe pickle.load (high 8.8)
- [CVE-2026-31222](https://insights.sbomify.com/CVE-2026-31222/): Snorkel Trainer.load uses an unsafe torch.load (high 8.8)
- [CVE-2026-31221](https://insights.sbomify.com/CVE-2026-31221/): PyTorch Lightning load_from_checkpoint has an insecure checkpoint deserialization (high 8.8)
- [CVE-2026-31220](https://insights.sbomify.com/CVE-2026-31220/): PySyft server-side arbitrary Python execution after code approval (critical 9.8)
- [CVE-2026-31219](https://insights.sbomify.com/CVE-2026-31219/): The _load_model() function in the neural_magic_training.py script of the optimate project in commit a6d302f912b481c94370811af6b11402f51d377f (high 8.8)
- [CVE-2026-31218](https://insights.sbomify.com/CVE-2026-31218/): The _load_model() function in the neural_magic_training.py script of the optimate project in commit a6d302f912b481c94370811af6b11402f51d377f (high 8.8)
- [CVE-2026-31217](https://insights.sbomify.com/CVE-2026-31217/): Code injection in nebuly:optimate (critical 9.8)
- [CVE-2026-31216](https://insights.sbomify.com/CVE-2026-31216/): Missing authorization in nexent:nexent (critical 9.1)
- [CVE-2026-31215](https://insights.sbomify.com/CVE-2026-31215/): Missing authorization in nexent:nexent (critical 9.1)
- [CVE-2026-31214](https://insights.sbomify.com/CVE-2026-31214/): The torch-checkpoint-shrink.py script in the ml-engineering project in commit 0099885db36a8f06556efe1faf552518852cb1e0 (2025-20-27) contains (critical 9.8)
- [CVE-2026-3121](https://insights.sbomify.com/CVE-2026-3121/): Keycloak: org.keycloak/keycloak-services: keycloak: privilege escalation via manage-clients permission (medium 6.5)
- [CVE-2026-31205](https://insights.sbomify.com/CVE-2026-31205/): Cross Site Scripting vulnerability in Pluck CMS before v.4.7.21dev allows a remote attacker to escalate privileges via the editpage.php and (medium 5.7)
- [CVE-2026-3120](https://insights.sbomify.com/CVE-2026-3120/): RCE in Profelis Informatics' SambaBox (high 7.2)
- [CVE-2026-31196](https://insights.sbomify.com/CVE-2026-31196/): OS command injection vulnerability in the traceroute diagnostic handler in /bin/httpd_clientside in ALTICE LABS / SFR France GR140DG Fibre R (high 8.8)
- [CVE-2026-31195](https://insights.sbomify.com/CVE-2026-31195/): OS command injection vulnerability in the ping diagnostic handler in /bin/httpd_clientside in ALTICE LABS / SFR France GR140DG Fibre Router (high 8.8)
- [CVE-2026-31192](https://insights.sbomify.com/CVE-2026-31192/): Missing authorization in raindrop:raindrop (medium 6.5)
- [CVE-2026-3119](https://insights.sbomify.com/CVE-2026-3119/): Authenticated query containing a TKEY record may cause named to terminate unexpectedly (medium 6.5)
- [CVE-2026-31181](https://insights.sbomify.com/CVE-2026-31181/): Command injection in totolink:a3300r firmware (critical 9.8)
- [CVE-2026-3118](https://insights.sbomify.com/CVE-2026-3118/): Rhdh: graphql injection leading to platform-wide denial of service (dos) in rh developer hub orchestrator plugin (medium 6.5)
- [CVE-2026-31179](https://insights.sbomify.com/CVE-2026-31179/): Command injection in totolink:a3300r firmware (medium 6.5)
- [CVE-2026-31178](https://insights.sbomify.com/CVE-2026-31178/): Command injection in totolink:a3300r firmware (critical 9.8)
- [CVE-2026-31177](https://insights.sbomify.com/CVE-2026-31177/): Command injection in totolink:a3300r firmware (critical 9.8)
- [CVE-2026-31176](https://insights.sbomify.com/CVE-2026-31176/): Command injection in totolink:a3300r firmware (medium 6.5)
- [CVE-2026-31175](https://insights.sbomify.com/CVE-2026-31175/): Command injection in totolink:a3300r firmware (critical 9.8)
- [CVE-2026-31174](https://insights.sbomify.com/CVE-2026-31174/): Command injection in totolink:a3300r firmware (medium 6.5)
- [CVE-2026-31173](https://insights.sbomify.com/CVE-2026-31173/): Command injection in totolink:a3300r firmware (medium 6.5)
- [CVE-2026-31172](https://insights.sbomify.com/CVE-2026-31172/): Command injection in totolink:a3300r firmware (medium 6.5)
- [CVE-2026-31171](https://insights.sbomify.com/CVE-2026-31171/): Command injection in totolink:a3300r firmware (medium 6.5)
- [CVE-2026-31170](https://insights.sbomify.com/CVE-2026-31170/): Command injection in totolink:a3300r firmware (critical 9.8)
- [CVE-2026-3117](https://insights.sbomify.com/CVE-2026-3117/): Instance and webhook GitLab plugin commands were able to be run by non-admin users (medium 6.5)
- [CVE-2026-31169](https://insights.sbomify.com/CVE-2026-31169/): Command injection in totolink:a3300r firmware (medium 6.5)
- [CVE-2026-31168](https://insights.sbomify.com/CVE-2026-31168/): Command injection in totolink:a3300r firmware (medium 6.5)
- [CVE-2026-31167](https://insights.sbomify.com/CVE-2026-31167/): Command injection in totolink:a3300r firmware (medium 6.5)
- [CVE-2026-31166](https://insights.sbomify.com/CVE-2026-31166/): Command injection in totolink:a3300r firmware (medium 6.5)
- [CVE-2026-31165](https://insights.sbomify.com/CVE-2026-31165/): Command injection in totolink:a3300r firmware (medium 6.5)
- [CVE-2026-31164](https://insights.sbomify.com/CVE-2026-31164/): Command injection in totolink:a3300r firmware (medium 6.5)
- [CVE-2026-31163](https://insights.sbomify.com/CVE-2026-31163/): Command injection in totolink:a3300r firmware (medium 6.5)
- [CVE-2026-31162](https://insights.sbomify.com/CVE-2026-31162/): Command injection in totolink:a3300r firmware (medium 6.5)
- [CVE-2026-31160](https://insights.sbomify.com/CVE-2026-31160/): Command injection in totolink:a3300r firmware (medium 6.5)
- [CVE-2026-3116](https://insights.sbomify.com/CVE-2026-3116/): Improper Input Validation in Zoom Plugin Webhook Handler (medium 4.9)
- [CVE-2026-31159](https://insights.sbomify.com/CVE-2026-31159/): Command injection in totolink:a3300r firmware (medium 6.5)
- [CVE-2026-31158](https://insights.sbomify.com/CVE-2026-31158/): SQL Injection vulnerability in CRM SOFTTRADE Infotech (aka softtradeindia) 1.0 allows a remote attacker to execute arbitrary code via the Lo (critical 9.8)
- [CVE-2026-31156](https://insights.sbomify.com/CVE-2026-31156/): Path traversal in openplcproject:openplc v3 firmware (medium 6.5)
- [CVE-2026-31153](https://insights.sbomify.com/CVE-2026-31153/): A stored cross-site scripting (XSS) vulnerability in Bynder before 12 January 2026 allows attackers to execute arbitrary web scripts or HTML (medium 5.4)
- [CVE-2026-31151](https://insights.sbomify.com/CVE-2026-31151/): Auth bypass in kaleris:yard management solutions (critical 9.8)
- [CVE-2026-31150](https://insights.sbomify.com/CVE-2026-31150/): Missing authorization in kaleris:yard management solutions (medium 4.3)
- [CVE-2026-3115](https://insights.sbomify.com/CVE-2026-3115/): Guest users can view group member IDs without respecting view restrictions (medium 4.3)
- [CVE-2026-3114](https://insights.sbomify.com/CVE-2026-3114/): Zip Bomb Denial of Service via Unrestricted Archive Decompression (medium 6.5)
- [CVE-2026-3113](https://insights.sbomify.com/CVE-2026-3113/): mmctl export download command doesn’t restrict permissions to created file to file owner (medium 5.0)
- [CVE-2026-3112](https://insights.sbomify.com/CVE-2026-3112/): Arbitrary File Read via Advanced Logging Support Packet (medium 6.8)
- [CVE-2026-3111](https://insights.sbomify.com/CVE-2026-3111/): Multiple vulnerabilities on the Educativa Campus (medium 6.9)
- [CVE-2026-3110](https://insights.sbomify.com/CVE-2026-3110/): Multiple vulnerabilities on the Educativa Campus (high 8.7)
- [CVE-2026-3109](https://insights.sbomify.com/CVE-2026-3109/): Missing timestamp validation in Zoom webhook handler (low 2.2)
- [CVE-2026-3108](https://insights.sbomify.com/CVE-2026-3108/): Terminal Escape Injection in mmctl Report Posts Command (high 8.0)
- [CVE-2026-31072](https://insights.sbomify.com/CVE-2026-31072/): APScheduler's JSONSerializer and CBORSerializer are vulnerable to Remote Code Execution (RCE) via Insecure Deserialization (critical 9.8)
- [CVE-2026-31071](https://insights.sbomify.com/CVE-2026-31071/): API endpoints in LalanaChami Pharmacy Management System (commit 5c3d028) lack authentication middleware. (critical 9.1)
- [CVE-2026-31070](https://insights.sbomify.com/CVE-2026-31070/): The LalanaChami Pharmacy Management System (commit 5c3d028) allows unauthenticated remote attackers to escalate privileges by self-assigning (critical 9.8)
- [CVE-2026-3107](https://insights.sbomify.com/CVE-2026-3107/): Multiple vulnerabilities in Teampass (critical 9.3)
- [CVE-2026-31069](https://insights.sbomify.com/CVE-2026-31069/): BillaBear is Vulnerable to SQL Injection in the EventRepository (high 8.8)
- [CVE-2026-31067](https://insights.sbomify.com/CVE-2026-31067/): Command injection in utt:520w firmware (medium 6.8)
- [CVE-2026-31066](https://insights.sbomify.com/CVE-2026-31066/): Memory corruption in utt:810g firmware (medium 4.5)
- [CVE-2026-31065](https://insights.sbomify.com/CVE-2026-31065/): Memory corruption in utt:520w firmware (medium 4.5)
- [CVE-2026-31063](https://insights.sbomify.com/CVE-2026-31063/): Memory corruption in utt:1200gw firmware (medium 4.5)
- [CVE-2026-31062](https://insights.sbomify.com/CVE-2026-31062/): Memory corruption in utt:520w firmware (medium 4.5)
- [CVE-2026-31061](https://insights.sbomify.com/CVE-2026-31061/): Memory corruption in utt:810g firmware (medium 4.5)
- [CVE-2026-31060](https://insights.sbomify.com/CVE-2026-31060/): Memory corruption in utt:810g firmware (medium 4.5)
- [CVE-2026-3106](https://insights.sbomify.com/CVE-2026-3106/): Multiple vulnerabilities in Teampass (critical 9.3)
- [CVE-2026-31059](https://insights.sbomify.com/CVE-2026-31059/): Command injection in utt:520w firmware (critical 9.8)
- [CVE-2026-31058](https://insights.sbomify.com/CVE-2026-31058/): Memory corruption in utt:1200gw firmware (medium 4.5)
- [CVE-2026-31053](https://insights.sbomify.com/CVE-2026-31053/): Memory corruption in rizin:rizin (medium 6.2)
- [CVE-2026-31052](https://insights.sbomify.com/CVE-2026-31052/): An issue in Hostbill v.2025-11-24 and 2025-12-01 allows a remote attacker to cause a denial of service via the Checkout Authentication Flow (medium 5.3)
- [CVE-2026-31051](https://insights.sbomify.com/CVE-2026-31051/): An issue in Hostbill v.2025-11-24 and 2025-12-01 allows a remote attacker to cause a denial of service via the Client Balance component (low 3.8)
- [CVE-2026-31050](https://insights.sbomify.com/CVE-2026-31050/): Cross Site Scripting vulnerability in Hostbill v.2025-11-24 and 2025-12-01 allows a remote attacker to execute arbitrary code (medium 4.9)
- [CVE-2026-3105](https://insights.sbomify.com/CVE-2026-3105/): SQL Injection in Contact Activity API Sorting (high 7.6)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/731/