# Vulnerabilities published in 2026 - [CVE-2026-30573](https://insights.sbomify.com/CVE-2026-30573/): Business logic in senior-walter:web-based pharmacy product management system (high 7.5) - [CVE-2026-30571](https://insights.sbomify.com/CVE-2026-30571/): Cross-site scripting in ahsanriaz26gmailcom:inventory system (medium 6.1) - [CVE-2026-30570](https://insights.sbomify.com/CVE-2026-30570/): Cross-site scripting in ahsanriaz26gmailcom:inventory system (medium 6.1) - [CVE-2026-3057](https://insights.sbomify.com/CVE-2026-3057/): a54552239 pearProjectApi Backend Task.php dateTotalForProject sql injection (medium 5.3) - [CVE-2026-30569](https://insights.sbomify.com/CVE-2026-30569/): Cross-site scripting in ahsanriaz26gmailcom:inventory system (medium 6.1) - [CVE-2026-30568](https://insights.sbomify.com/CVE-2026-30568/): Cross-site scripting in ahsanriaz26gmailcom:inventory system (medium 4.8) - [CVE-2026-30567](https://insights.sbomify.com/CVE-2026-30567/): Cross-site scripting in ahsanriaz26gmailcom:inventory system (medium 6.1) - [CVE-2026-30566](https://insights.sbomify.com/CVE-2026-30566/): Cross-site scripting in ahsanriaz26gmailcom:sales and inventory system (medium 6.1) - [CVE-2026-30565](https://insights.sbomify.com/CVE-2026-30565/): Cross-site scripting in ahsanriaz26gmailcom:sales and inventory system (medium 6.1) - [CVE-2026-30564](https://insights.sbomify.com/CVE-2026-30564/): Cross-site scripting in ahsanriaz26gmailcom:sales and inventory system (medium 6.1) - [CVE-2026-30563](https://insights.sbomify.com/CVE-2026-30563/): Cross-site scripting in ahsanriaz26gmailcom:sales and inventory system (medium 6.1) - [CVE-2026-30562](https://insights.sbomify.com/CVE-2026-30562/): Cross-site scripting in ahsanriaz26gmailcom:sales and inventory system (critical 9.3) - [CVE-2026-30561](https://insights.sbomify.com/CVE-2026-30561/): Cross-site scripting in ahsanriaz26gmailcom:sales and inventory system (medium 6.1) - [CVE-2026-30560](https://insights.sbomify.com/CVE-2026-30560/): Cross-site scripting in ahsanriaz26gmailcom:sales and inventory system (medium 6.1) - [CVE-2026-3056](https://insights.sbomify.com/CVE-2026-3056/): Seraphinite Accelerator <= 2.28.14 - Missing Authorization to Authenticated (Subscriber+) Log Clearing (medium 4.3) - [CVE-2026-30559](https://insights.sbomify.com/CVE-2026-30559/): Cross-site scripting in ahsanriaz26gmailcom:sales and inventory system (medium 6.1) - [CVE-2026-30558](https://insights.sbomify.com/CVE-2026-30558/): Cross-site scripting in ahsanriaz26gmailcom:sales and inventory system (medium 6.1) - [CVE-2026-30557](https://insights.sbomify.com/CVE-2026-30557/): Cross-site scripting in ahsanriaz26gmailcom:sales and inventory system (medium 6.1) - [CVE-2026-30556](https://insights.sbomify.com/CVE-2026-30556/): Cross-site scripting in ahsanriaz26gmailcom:sales and inventory system (medium 6.1) - [CVE-2026-3055](https://insights.sbomify.com/CVE-2026-3055/): Citrix NetScaler Out-of-Bounds Read (critical 9.3, exploited in the wild) - [CVE-2026-3054](https://insights.sbomify.com/CVE-2026-3054/): Alinto SOGo cross site scripting (medium 5.3) - [CVE-2026-30534](https://insights.sbomify.com/CVE-2026-30534/): SQL injection in oretnom23:online food ordering system (high 8.3) - [CVE-2026-30533](https://insights.sbomify.com/CVE-2026-30533/): SQL injection in oretnom23:online food ordering system (critical 9.8) - [CVE-2026-30532](https://insights.sbomify.com/CVE-2026-30532/): SQL injection in oretnom23:online food ordering system (critical 9.8) - [CVE-2026-30531](https://insights.sbomify.com/CVE-2026-30531/): SQL injection in oretnom23:online food ordering system (high 8.8) - [CVE-2026-30530](https://insights.sbomify.com/CVE-2026-30530/): SQL injection in oretnom23:online food ordering system (critical 9.8) - [CVE-2026-3053](https://insights.sbomify.com/CVE-2026-3053/): DataLinkDC dinky OpenAPI Endpoint AppConfig.java addInterceptors missing authentication (medium 6.9) - [CVE-2026-30529](https://insights.sbomify.com/CVE-2026-30529/): SQL injection in oretnom23:online food ordering system (high 8.8) - [CVE-2026-30527](https://insights.sbomify.com/CVE-2026-30527/): Cross-site scripting in oretnom23:online food ordering system (medium 4.8) - [CVE-2026-30526](https://insights.sbomify.com/CVE-2026-30526/): Cross-site scripting in pushpam02:zoo management system (medium 6.1) - [CVE-2026-30523](https://insights.sbomify.com/CVE-2026-30523/): Business logic in oretnom23:loan management system (medium 6.5) - [CVE-2026-30522](https://insights.sbomify.com/CVE-2026-30522/): Business logic in oretnom23:loan management system (medium 6.5) - [CVE-2026-30521](https://insights.sbomify.com/CVE-2026-30521/): Business logic in oretnom23:loan management system (medium 6.5) - [CVE-2026-30520](https://insights.sbomify.com/CVE-2026-30520/): SQL injection in oretnom23:loan management system (medium 5.4) - [CVE-2026-3052](https://insights.sbomify.com/CVE-2026-3052/): DataLinkDC dinky Flink Proxy Controller FlinkProxyController.java proxyUba server-side request forgery (medium 5.3) - [CVE-2026-30512](https://insights.sbomify.com/CVE-2026-30512/): A local privilege escalation vulnerability exists in the Restricted Access (Kiosk) Mode implementation of Scheidt & Bachmann entervo HMI prior to V2 R5 P0 M5. (high 7.8) - [CVE-2026-3051](https://insights.sbomify.com/CVE-2026-3051/): DataLinkDC dinky Project Name GitRepository.java getProjectDir path traversal (medium 5.3) - [CVE-2026-3050](https://insights.sbomify.com/CVE-2026-3050/): horilla-opensource horilla Leads global.js cross site scripting (medium 5.1) - [CVE-2026-30498](https://insights.sbomify.com/CVE-2026-30498/): A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the delete.php endpoint of Jason2605 AdminPanel 4.0. (medium 6.3) - [CVE-2026-30496](https://insights.sbomify.com/CVE-2026-30496/): The Optoma CinemaX P2 projector (firmware TVOS-04.24.010.04.01, Android 8.0.0) exposes an HTTP API on TCP port 2345 that allows full unauthe (critical 9.8) - [CVE-2026-30495](https://insights.sbomify.com/CVE-2026-30495/): The Optoma CinemaX P2 projector (firmware TVOS-04.24.010.04.01, Android 8.0.0) exposes Android Debug Bridge (ADB) on TCP port 5555 over the (high 8.8) - [CVE-2026-3049](https://insights.sbomify.com/CVE-2026-3049/): horilla-opensource horilla Query Parameter global_search.py get redirect (medium 5.3) - [CVE-2026-30480](https://insights.sbomify.com/CVE-2026-30480/): A Local File Inclusion (LFI) vulnerability in the NFSen module (nfsen.inc.php) of LibreNMS 22.11.0-23-gd091788f2 allows authenticated attack (medium 6.5) - [CVE-2026-3048](https://insights.sbomify.com/CVE-2026-3048/): Nexus Repository 3 - Improper LDAP Referral Handling (medium 5.1) - [CVE-2026-30479](https://insights.sbomify.com/CVE-2026-30479/): A Dynamic-link Library Injection vulnerability in OSGeo Project MapServer before v8.0 allows attackers to execute arbitrary code via a crafted executable. (critical 9.1) - [CVE-2026-30478](https://insights.sbomify.com/CVE-2026-30478/): A Dynamic-link Library Injection vulnerability in GatewayGeo MapServer for Windows version 5 allows attackers to escalate privileges via a crafted executable. (high 8.8) - [CVE-2026-3047](https://insights.sbomify.com/CVE-2026-3047/): Keycloak SAML Broken has Authentication Bypass by Primary Weakness (high 8.8) - [CVE-2026-30463](https://insights.sbomify.com/CVE-2026-30463/): SQL injection in thedaylightstudio:fuel cms (high 7.7) - [CVE-2026-30462](https://insights.sbomify.com/CVE-2026-30462/): A path traversal vulnerability in the Blocks module of Daylight Studio FuelCMS v1.5.2 allows attackers to execute a directory traversal. (medium 4.3) - [CVE-2026-30461](https://insights.sbomify.com/CVE-2026-30461/): Command injection in thedaylightstudio:fuel cms (high 8.3) - [CVE-2026-30460](https://insights.sbomify.com/CVE-2026-30460/): Code injection in thedaylightstudio:fuel cms (high 8.8) - [CVE-2026-3046](https://insights.sbomify.com/CVE-2026-3046/): itsourcecode E-Logbook with Health Monitoring System for COVID-19 check_profile_old.php sql injection (medium 6.9) - [CVE-2026-30459](https://insights.sbomify.com/CVE-2026-30459/): Business logic in thedaylightstudio:fuel cms (high 7.1) - [CVE-2026-30458](https://insights.sbomify.com/CVE-2026-30458/): Business logic in thedaylightstudio:fuel cms (critical 9.1) - [CVE-2026-30457](https://insights.sbomify.com/CVE-2026-30457/): Code injection in thedaylightstudio:dwoo (critical 9.8) - [CVE-2026-30452](https://insights.sbomify.com/CVE-2026-30452/): Missing authorization in textpattern:textpattern (medium 6.5) - [CVE-2026-3045](https://insights.sbomify.com/CVE-2026-3045/): Missing authorization in Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin (high 7.5) - [CVE-2026-3044](https://insights.sbomify.com/CVE-2026-3044/): Tenda AC8 Httpd Service UploadCfg webCgiGetUploadFile stack-based overflow (high 8.7) - [CVE-2026-3043](https://insights.sbomify.com/CVE-2026-3043/): itsourcecode Event Management System navbar.php cross site scripting (medium 5.3) - [CVE-2026-3042](https://insights.sbomify.com/CVE-2026-3042/): itsourcecode Event Management System index.php sql injection (medium 6.9) - [CVE-2026-3041](https://insights.sbomify.com/CVE-2026-3041/): xingfuggz BaykeShop Article Sidebar custom.html cross site scripting (medium 4.8) - [CVE-2026-30405](https://insights.sbomify.com/CVE-2026-30405/): GoBGP vulnerable to a denial of service via the NEXT_HOP path attribute (high 7.5) - [CVE-2026-30404](https://insights.sbomify.com/CVE-2026-30404/): Server-side request forgery in wgstart:wgcloud (high 7.5) - [CVE-2026-30403](https://insights.sbomify.com/CVE-2026-30403/): Path traversal in wgstart:wgcloud (high 7.5) - [CVE-2026-30402](https://insights.sbomify.com/CVE-2026-30402/): Code injection in wgstart:wgcloud (critical 9.8) - [CVE-2026-3040](https://insights.sbomify.com/CVE-2026-3040/): DrayTek Vigor 300B Web Management uploadlangs cgiGetFile os command injection (medium 5.1) - [CVE-2026-3039](https://insights.sbomify.com/CVE-2026-3039/): BIND 9 server memory exhaustion during GSS-API TKEY negotiation (high 7.5) - [CVE-2026-3038](https://insights.sbomify.com/CVE-2026-3038/): Local DoS and possible privilege escalation via routing sockets (high 7.5) - [CVE-2026-3037](https://insights.sbomify.com/CVE-2026-3037/): Copeland XWEB and XWEB Pro OS Command Injection (high 8.0) - [CVE-2026-30368](https://insights.sbomify.com/CVE-2026-30368/): Auth bypass in Lightspeed Classroom (medium 5.4) - [CVE-2026-30364](https://insights.sbomify.com/CVE-2026-30364/): CentSDR commit e40795 was discovered to contain a stack overflow in the "Thread1" function. (high 7.5) - [CVE-2026-30363](https://insights.sbomify.com/CVE-2026-30363/): flipperzero-firmware commit ad2a80 was discovered to contain a stack overflow in the "Main" function. (high 8.4) - [CVE-2026-30352](https://insights.sbomify.com/CVE-2026-30352/): A remote code execution (RCE) vulnerability in the /devserver/start endpoint of leonvanzyl autocoder commit 79d02a allows attackers to execu (critical 9.8) - [CVE-2026-30351](https://insights.sbomify.com/CVE-2026-30351/): A path traversal vulnerability in the UI/static component of leonvanzyl autocoder commit 79d02a allows attackers to read arbitrary files via (high 7.5) - [CVE-2026-30350](https://insights.sbomify.com/CVE-2026-30350/): An issue in the /store/items/search endpoint of Agent Protocol server commit e9a89f allows attackers to cause a Denial of Service (DoS) via (high 7.5) - [CVE-2026-3035](https://insights.sbomify.com/CVE-2026-3035/): Authentication Bypass Using an Alternate Path or Channel in GitLab (medium 5.5) - [CVE-2026-30346](https://insights.sbomify.com/CVE-2026-30346/): An open redirect in the /api/google/authorize endpoint of hunvreus DevPush v0.3.2 allows attackers to redirect users to malicious sites via (medium 4.3) - [CVE-2026-30345](https://insights.sbomify.com/CVE-2026-30345/): A zip slip vulnerability in the Admin import functionality of CTFd v3.8.1-18-gdb5a18c4 allows attackers to write arbitrary files outside the (high 7.5) - [CVE-2026-3034](https://insights.sbomify.com/CVE-2026-3034/): Cross-site scripting in OoohBoi Steroids for Elementor (medium 6.4) - [CVE-2026-30332](https://insights.sbomify.com/CVE-2026-30332/): A Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability in Balena Etcher for Windows prior to v2.1.4 allows attackers to escala (high 7.5) - [CVE-2026-30314](https://insights.sbomify.com/CVE-2026-30314/): Command injection in ridvay:auto-approval module (critical 9.8) - [CVE-2026-30313](https://insights.sbomify.com/CVE-2026-30313/): Command injection in cline:cline (critical 9.8) - [CVE-2026-30312](https://insights.sbomify.com/CVE-2026-30312/): DSAI-Cline's command auto-approval module contains a critical OS command injection vulnerability that renders its whitelist security mechani (critical 9.8) - [CVE-2026-30311](https://insights.sbomify.com/CVE-2026-30311/): Command injection in ridvay:auto-approval module (critical 9.8) - [CVE-2026-30310](https://insights.sbomify.com/CVE-2026-30310/): In its design for automatic terminal command execution, Sixth offers two options: Execute safe commands and Execute all commands. (critical 9.8) - [CVE-2026-3031](https://insights.sbomify.com/CVE-2026-3031/): Image::EPEG versions through 0.15 for Perl embeds an unsupported version of the Epeg library (critical 9.8) - [CVE-2026-30309](https://insights.sbomify.com/CVE-2026-30309/): Command injection in tokfinity:infcode (high 7.8) - [CVE-2026-30308](https://insights.sbomify.com/CVE-2026-30308/): Code injection in presidio:hai build (critical 9.8) - [CVE-2026-30307](https://insights.sbomify.com/CVE-2026-30307/): Command injection in roocode:roo code (critical 9.8) - [CVE-2026-30306](https://insights.sbomify.com/CVE-2026-30306/): Code injection in rahmanazhar:sakadev (critical 9.8) - [CVE-2026-30305](https://insights.sbomify.com/CVE-2026-30305/): Command injection in orangecat:syntx (critical 9.8) - [CVE-2026-30304](https://insights.sbomify.com/CVE-2026-30304/): Security feature bypass in tianguaduizhang:ai code (critical 9.6) - [CVE-2026-30303](https://insights.sbomify.com/CVE-2026-30303/): Command injection in matterai:axon code (critical 9.8) - [CVE-2026-30302](https://insights.sbomify.com/CVE-2026-30302/): Command injection in coderider-kilo:coderider (critical 10.0) - [CVE-2026-30292](https://insights.sbomify.com/CVE-2026-30292/): An arbitrary file overwrite vulnerability in Docudepot PDF Reader: PDF Viewer APP v1.0.34 allows attackers to overwrite critical internal fi (high 8.4) - [CVE-2026-30291](https://insights.sbomify.com/CVE-2026-30291/): An arbitrary file overwrite vulnerability in Ora Tools PDF Reader ' Reader & Editor APPv4.3.5 allows attackers to overwrite critical interna (high 8.4) - [CVE-2026-30290](https://insights.sbomify.com/CVE-2026-30290/): Path traversal in intouchapp:intouch contacts \& caller id (high 8.4) - [CVE-2026-3029](https://insights.sbomify.com/CVE-2026-3029/): CVE-2026-3029 (high 7.5) - [CVE-2026-30289](https://insights.sbomify.com/CVE-2026-30289/): Path traversal in tinybeans:private family album (high 8.4) - [CVE-2026-30287](https://insights.sbomify.com/CVE-2026-30287/): Path traversal in deepthought.industries:ace scanner (high 8.4) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/735/