# Vulnerabilities published in 2026


- [CVE-2026-30820](https://insights.sbomify.com/CVE-2026-30820/): Flowise Authorization Bypass via Spoofed x-request-from Header (high 8.7)
- [CVE-2026-3082](https://insights.sbomify.com/CVE-2026-3082/): GStreamer JPEG Parser Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-30819](https://insights.sbomify.com/CVE-2026-30819/): Combodo iTop: Reflected XSS in /pages/ajax.render.php dashboard_id parameter (high 7.3)
- [CVE-2026-30818](https://insights.sbomify.com/CVE-2026-30818/): OS Command Injection Vulnerability in dnsmasq Module in TP-Link AX53 (high 8.5)
- [CVE-2026-30817](https://insights.sbomify.com/CVE-2026-30817/): Arbitrary File Reading Vulnerability in dnsmasq Module in TP-Link AX53 (medium 6.8)
- [CVE-2026-30816](https://insights.sbomify.com/CVE-2026-30816/): Arbitrary File Reading Vulnerability in OpenVPN Module in TP-Link AX53 (medium 6.8)
- [CVE-2026-30815](https://insights.sbomify.com/CVE-2026-30815/): OS Command Injection Vulnerability in OpenVPN Module in TP-Link AX53 (high 8.5)
- [CVE-2026-30814](https://insights.sbomify.com/CVE-2026-30814/): Buffer Overflow Vulnerability in TP-Link AX53 (high 7.3)
- [CVE-2026-30813](https://insights.sbomify.com/CVE-2026-30813/): SQL Injection in Module Search leads to Database Compromise (high 8.7)
- [CVE-2026-30812](https://insights.sbomify.com/CVE-2026-30812/): Stored Cross-Site Scripting in Event Comments via Filter Bypass (low 2.1)
- [CVE-2026-30811](https://insights.sbomify.com/CVE-2026-30811/): Missing Authorization in Configuration Ajax Endpoint leads to Information Disclosure (high 8.4)
- [CVE-2026-30810](https://insights.sbomify.com/CVE-2026-30810/): Server-Side Request Forgery in API Checker leads to Privilege Escalation (high 7.1)
- [CVE-2026-3081](https://insights.sbomify.com/CVE-2026-3081/): GStreamer H.266 Codec Parser Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-30809](https://insights.sbomify.com/CVE-2026-30809/): OS Command Injection in WebServerModuleDebug via Blacklist Bypass leads to Remote Code Execution (high 8.7)
- [CVE-2026-30808](https://insights.sbomify.com/CVE-2026-30808/): Session Fixation in Authentication leads to Session Hijacking (high 7.6)
- [CVE-2026-30807](https://insights.sbomify.com/CVE-2026-30807/): Cross-Site Request Forgery on Extension Pages (high 7.1)
- [CVE-2026-30806](https://insights.sbomify.com/CVE-2026-30806/): OS Command Injection in Network Report leads to Remote Code Execution (high 8.7)
- [CVE-2026-30805](https://insights.sbomify.com/CVE-2026-30805/): Insecure Default Initialization in API Authentication leads to Authentication Bypass (critical 9.1)
- [CVE-2026-30804](https://insights.sbomify.com/CVE-2026-30804/): Unrestricted File Upload in Extension Uploader leads to Remote Code Execution (high 8.6)
- [CVE-2026-30803](https://insights.sbomify.com/CVE-2026-30803/): Integer Underflow (Wrap or Wraparound) vulnerability in RTI Connext Micro (Core Libraries) allows Overread Buffers. (high 8.8)
- [CVE-2026-30802](https://insights.sbomify.com/CVE-2026-30802/): Out-of-bounds Read vulnerability in RTI Connext Micro (Core Libraries) allows Overread Buffers. (high 8.8)
- [CVE-2026-30799](https://insights.sbomify.com/CVE-2026-30799/): Auth bypass in Connext Professional (medium 6.1)
- [CVE-2026-30798](https://insights.sbomify.com/CVE-2026-30798/): RustDesk Client Accepts Unauthenticated stop-service Command via Strategy Payload (high 8.2)
- [CVE-2026-30797](https://insights.sbomify.com/CVE-2026-30797/): RustDesk rustdesk://config/ URI Silently Re-homes Client to Attacker-Controlled Server (critical 9.3)
- [CVE-2026-30796](https://insights.sbomify.com/CVE-2026-30796/): RustDesk Client Transmits Preset Address Book Password Verbatim in Heartbeat Sync (medium 6.9)
- [CVE-2026-30795](https://insights.sbomify.com/CVE-2026-30795/): RustDesk HTTP Client Silently Accepts Invalid TLS Certificates After Handshake Failure (high 8.7)
- [CVE-2026-30793](https://insights.sbomify.com/CVE-2026-30793/): RustDesk Flutter URI Handler Sets Permanent Password Without Privilege Check or User Confirmation (critical 9.3)
- [CVE-2026-30792](https://insights.sbomify.com/CVE-2026-30792/): RustDesk Client Blindly Merges Unauthenticated Strategy Payloads, Bypassing Local Security Settings (high 8.3)
- [CVE-2026-30791](https://insights.sbomify.com/CVE-2026-30791/): RustDesk Client Accepts Pseudo-Encrypted Config Strings Without Cryptographic Validation (high 8.7)
- [CVE-2026-3079](https://insights.sbomify.com/CVE-2026-3079/): LearnDash LMS <= 5.0.3 - Authenticated (Contributor+) SQL Injection via 'filters[orderby_order]' Parameter (medium 6.5)
- [CVE-2026-30789](https://insights.sbomify.com/CVE-2026-30789/): RustDesk Auth Proof Uses Server-Controlled Salt/Challenge and Fast Double-SHA256, Enabling Offline Brute-Force (medium 5.7)
- [CVE-2026-30785](https://insights.sbomify.com/CVE-2026-30785/): RustDesk Encrypts Local Passwords with World-Readable Machine ID and Fixed Zero Nonce (XSalsa20-Poly1305) (high 8.2)
- [CVE-2026-30783](https://insights.sbomify.com/CVE-2026-30783/): RustDesk Client Can Orphan API Channel to Ignore All Admin Commands and ACL Policies (medium 4.8)
- [CVE-2026-30778](https://insights.sbomify.com/CVE-2026-30778/): SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information (high 7.5)
- [CVE-2026-30777](https://insights.sbomify.com/CVE-2026-30777/): Auth bypass in EC-CUBE 4.1 series (medium 6.9)
- [CVE-2026-30769](https://insights.sbomify.com/CVE-2026-30769/): Privilege escalation in entechtaiwan:tvicport (high 7.8)
- [CVE-2026-30761](https://insights.sbomify.com/CVE-2026-30761/): An arbitrary file upload vulnerability in the pages/admin.uploadmapimg.php component of SourceBans Material Admin v1.1.6 allows attackers to (high 7.3)
- [CVE-2026-30760](https://insights.sbomify.com/CVE-2026-30760/): An issue in SourceBans Material Admin before v.1.1.6 (3ecd95e) allows attackers to manipulate arbitrary user data in the web app via a crafted XAJAX call. (high 7.3)
- [CVE-2026-30754](https://insights.sbomify.com/CVE-2026-30754/): Memory corruption in ffmpeg:ffmpeg (high 8.8)
- [CVE-2026-3075](https://insights.sbomify.com/CVE-2026-3075/): WordPress Simple Ajax Chat plugin <= 20251121 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-30741](https://insights.sbomify.com/CVE-2026-30741/): Code injection in openclaw:openclaw (critical 9.8)
- [CVE-2026-3074](https://insights.sbomify.com/CVE-2026-3074/): Authorization Bypass Through User-Controlled Key in GitLab (medium 4.3)
- [CVE-2026-3073](https://insights.sbomify.com/CVE-2026-3073/): Authorization Bypass Through User-Controlled Key in GitLab (medium 4.3)
- [CVE-2026-3072](https://insights.sbomify.com/CVE-2026-3072/): Missing authorization in Media Library Assistant (medium 4.3)
- [CVE-2026-30711](https://insights.sbomify.com/CVE-2026-30711/): Devome GRR v4.5.0 was discovered to contain multiple authenticated SQL injection vulnerabilities in the include/session.inc.php file via the (high 8.8)
- [CVE-2026-3071](https://insights.sbomify.com/CVE-2026-3071/): Deserialization in Flair (high 8.4)
- [CVE-2026-30707](https://insights.sbomify.com/CVE-2026-30707/): An issue was discovered in SpeedExam Online Examination System (SaaS) after v.FEV2026. (high 8.1)
- [CVE-2026-30704](https://insights.sbomify.com/CVE-2026-30704/): The WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02) exposes an unprotected UART interface through accessible hardware pads on the PCB (critical 9.1)
- [CVE-2026-30703](https://insights.sbomify.com/CVE-2026-30703/): A command injection vulnerability exists in the web management interface of the WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02). (critical 9.8)
- [CVE-2026-30702](https://insights.sbomify.com/CVE-2026-30702/): The WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02) implements a broken authentication mechanism in its web management interface. (critical 9.8)
- [CVE-2026-30701](https://insights.sbomify.com/CVE-2026-30701/): The web interface of the WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02) contains hardcoded credential disclosure mechanisms (in the (critical 9.1)
- [CVE-2026-3070](https://insights.sbomify.com/CVE-2026-3070/): SourceCodester Modern Image Gallery App upload.php cross site scripting (medium 5.3)
- [CVE-2026-30695](https://insights.sbomify.com/CVE-2026-30695/): A Cross-Site Scripting (XSS) vulnerability exists in the web-based configuration interface of Zucchetti Axess access control devices, includ (medium 6.1)
- [CVE-2026-30694](https://insights.sbomify.com/CVE-2026-30694/): Code injection in dedecms:dedecms (critical 9.8)
- [CVE-2026-30691](https://insights.sbomify.com/CVE-2026-30691/): @cyntler/react-doc-viewer's TXTRenderer fails to sanitize file content and explicitly casts raw data as a ReactNode (medium 6.1)
- [CVE-2026-3069](https://insights.sbomify.com/CVE-2026-3069/): itsourcecode Document Management System edtlbls.php sql injection (medium 6.9)
- [CVE-2026-30689](https://insights.sbomify.com/CVE-2026-30689/): Missing authorization in Blog.Core (medium 4.3)
- [CVE-2026-3068](https://insights.sbomify.com/CVE-2026-3068/): itsourcecode Document Management System deluser.php sql injection (medium 6.9)
- [CVE-2026-3067](https://insights.sbomify.com/CVE-2026-3067/): HummerRisk Archive Extraction CommandUtils.java extractZip path traversal (medium 5.3)
- [CVE-2026-30662](https://insights.sbomify.com/CVE-2026-30662/): ConcreteCMS is vulnerable to Denial of Service During Bulk Downloads (medium 6.5)
- [CVE-2026-30661](https://insights.sbomify.com/CVE-2026-30661/): Cross-site scripting in idreamsoft:icms (medium 6.1)
- [CVE-2026-3066](https://insights.sbomify.com/CVE-2026-3066/): HummerRisk Cloud Compliance Scanning PlatformUtils.java fixedCommand command injection (medium 5.3)
- [CVE-2026-30656](https://insights.sbomify.com/CVE-2026-30656/): A NULL pointer dereference vulnerability exists in fio (Flexible I/O Tester) v3.41 when parsing job files containing the fdp_pli option. (high 7.5)
- [CVE-2026-30655](https://insights.sbomify.com/CVE-2026-30655/): SQL injection in esiclivre:esiclivre (medium 6.5)
- [CVE-2026-30653](https://insights.sbomify.com/CVE-2026-30653/): Denial of service in free5gc:free5gc (high 7.5)
- [CVE-2026-30652](https://insights.sbomify.com/CVE-2026-30652/): Memory corruption in vivotek:fd8136 firmware (high 8.8)
- [CVE-2026-30650](https://insights.sbomify.com/CVE-2026-30650/): Memory corruption in vivotek:fd8136 firmware (high 8.8)
- [CVE-2026-3065](https://insights.sbomify.com/CVE-2026-3065/): HummerRisk Cloud Task Dry-run CloudTaskService.java CommandUtils.commonExecCmdWithResult command injection (medium 5.3)
- [CVE-2026-30649](https://insights.sbomify.com/CVE-2026-30649/): Memory corruption in vivotek:fd8136 firmware (high 7.3)
- [CVE-2026-30643](https://insights.sbomify.com/CVE-2026-30643/): Code injection in dedecms:dedecms (critical 9.8)
- [CVE-2026-3064](https://insights.sbomify.com/CVE-2026-3064/): HummerRisk Cloud Task Scheduler ResourceCreateService.java command injection (medium 5.3)
- [CVE-2026-30637](https://insights.sbomify.com/CVE-2026-30637/): Server-side request forgery in otcms:otcms (high 7.5)
- [CVE-2026-30635](https://insights.sbomify.com/CVE-2026-30635/): automagik-genie has a command injection vulnerability (high 8.1)
- [CVE-2026-30633](https://insights.sbomify.com/CVE-2026-30633/): Directory traversal vulnerability in knowns-dev/knowns 0.11.4 via crafted path value to the get_doc and update_doc tools. (high 7.5)
- [CVE-2026-30632](https://insights.sbomify.com/CVE-2026-30632/): Directory traversal vulnerability in knowns-dev/knowns 0.11.4 via crafted folder name value to the create_doc tool. (high 7.5)
- [CVE-2026-30631](https://insights.sbomify.com/CVE-2026-30631/): An issue was discovered in bytebot-ai in commit 3d37894ce07ef8d8b40adc7fd309ad96c2a71313 (2025-09-11) allowing attackers to execute arbitrar (critical 9.8)
- [CVE-2026-3063](https://insights.sbomify.com/CVE-2026-3063/): Cross-site scripting in Chrome (high 8.8)
- [CVE-2026-30625](https://insights.sbomify.com/CVE-2026-30625/): Upsonic: remote code execution vulnerability in its MCP server/task creation functionality (critical 9.8)
- [CVE-2026-30624](https://insights.sbomify.com/CVE-2026-30624/): Command injection in agent-zero:agent-zero (high 8.6)
- [CVE-2026-30623](https://insights.sbomify.com/CVE-2026-30623/): LiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation functionality. (critical 9.8)
- [CVE-2026-3062](https://insights.sbomify.com/CVE-2026-3062/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-30618](https://insights.sbomify.com/CVE-2026-30618/): xszyou Fay 4.3.1 contains a remote code execution vulnerability in its MCP STDIO server management and command execution handling. (critical 9.8)
- [CVE-2026-30617](https://insights.sbomify.com/CVE-2026-30617/): LangChain-ChatChat 0.3.1 contains a remote code execution vulnerability in its MCP STDIO server configuration and execution handling. (high 8.6)
- [CVE-2026-30616](https://insights.sbomify.com/CVE-2026-30616/): Jaaz 1.0.30 contains a remote code execution vulnerability in its MCP STDIO command execution handling. (high 7.3)
- [CVE-2026-30615](https://insights.sbomify.com/CVE-2026-30615/): A prompt injection vulnerability in Windsurf 1.9544.26 allows remote attackers to execute arbitrary commands on a victim system. (high 8.0)
- [CVE-2026-30613](https://insights.sbomify.com/CVE-2026-30613/): An information disclosure vulnerability exists in AZIOT 1 Node Smart Switch (16amp)- WiFi/Bluetooth Enabled Software Version: 1.1.9 due to i (medium 4.6)
- [CVE-2026-30612](https://insights.sbomify.com/CVE-2026-30612/): An issue in Time4 Popcorn for Windows <= 6.2.1.18 and Time4Popcorn for MacOS <= 6.2.1.17 and Time4Popcorn for Android <= 3.5.0.173 allows a (critical 9.8)
- [CVE-2026-3061](https://insights.sbomify.com/CVE-2026-3061/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-30603](https://insights.sbomify.com/CVE-2026-30603/): An issue in the firmware update mechanism of Qianniao QN-L23PA0904 v20250721.1640 allows attackers to gain root access, install backdoors, a (medium 6.8)
- [CVE-2026-3060](https://insights.sbomify.com/CVE-2026-3060/): CVE-2026-3060 (critical 9.8)
- [CVE-2026-3059](https://insights.sbomify.com/CVE-2026-3059/): CVE-2026-3059 (critical 9.8)
- [CVE-2026-30587](https://insights.sbomify.com/CVE-2026-30587/): Seafile Server has multiple stored XSS vulnerabilities (medium 5.4)
- [CVE-2026-30586](https://insights.sbomify.com/CVE-2026-30586/): Cross Site Scripting vulnerability in usememos Memos v.0.26.0 allows a remote attacker to obtain sensitive information via the SANITIZE_SCHE (medium 6.1)
- [CVE-2026-30580](https://insights.sbomify.com/CVE-2026-30580/): Path traversal in leefish:file thingie (medium 4.3)
- [CVE-2026-3058](https://insights.sbomify.com/CVE-2026-3058/): Missing authorization in Seraphinite Accelerator (medium 4.3)
- [CVE-2026-30579](https://insights.sbomify.com/CVE-2026-30579/): Cross-site scripting in leefish:file thingie (medium 6.5)
- [CVE-2026-30578](https://insights.sbomify.com/CVE-2026-30578/): Cross-site scripting in leefish:file thingie (medium 6.5)
- [CVE-2026-30576](https://insights.sbomify.com/CVE-2026-30576/): Business logic in senior-walter:web-based pharmacy product management system (high 7.5)
- [CVE-2026-30575](https://insights.sbomify.com/CVE-2026-30575/): Business logic in senior-walter:web-based pharmacy product management system (high 7.5)
- [CVE-2026-30574](https://insights.sbomify.com/CVE-2026-30574/): Business logic in senior-walter:web-based pharmacy product management system (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/734/