# Vulnerabilities published in 2026


- [CVE-2026-30286](https://insights.sbomify.com/CVE-2026-30286/): Path traversal in funambol:zefiro (critical 9.8)
- [CVE-2026-30285](https://insights.sbomify.com/CVE-2026-30285/): Path traversal in zora:zora (critical 9.8)
- [CVE-2026-30284](https://insights.sbomify.com/CVE-2026-30284/): Path traversal in uxgroupllc:voice recorder (high 8.6)
- [CVE-2026-30283](https://insights.sbomify.com/CVE-2026-30283/): Path traversal in peaksel:animal sounds and ringtones (critical 9.8)
- [CVE-2026-30282](https://insights.sbomify.com/CVE-2026-30282/): Path traversal in uxgroupllc:cast to tv (critical 9.0)
- [CVE-2026-30281](https://insights.sbomify.com/CVE-2026-30281/): Path traversal in maru:neo.maru (critical 9.8)
- [CVE-2026-30280](https://insights.sbomify.com/CVE-2026-30280/): File upload in rareprob:video player (medium 5.3)
- [CVE-2026-3028](https://insights.sbomify.com/CVE-2026-3028/): erzhongxmu JEEWMS JeecgListDemoController.java doAdd cross site scripting (medium 5.3)
- [CVE-2026-30279](https://insights.sbomify.com/CVE-2026-30279/): Path traversal in squareapps:my location (high 8.4)
- [CVE-2026-30278](https://insights.sbomify.com/CVE-2026-30278/): Path traversal in funair:fly is fun (critical 9.8)
- [CVE-2026-30277](https://insights.sbomify.com/CVE-2026-30277/): Path traversal in triumph-adler:mobile print (high 8.4)
- [CVE-2026-30276](https://insights.sbomify.com/CVE-2026-30276/): Path traversal in deftpdf:document translator (critical 9.8)
- [CVE-2026-30273](https://insights.sbomify.com/CVE-2026-30273/): SQL injection in gabrieleventuri:pandasai (high 7.3)
- [CVE-2026-3027](https://insights.sbomify.com/CVE-2026-3027/): erzhongxmu JEEWMS UEditor getContent.jsp cross site scripting (medium 5.3)
- [CVE-2026-30269](https://insights.sbomify.com/CVE-2026-30269/): Privilege escalation in doorman:doorman (critical 9.9)
- [CVE-2026-30266](https://insights.sbomify.com/CVE-2026-30266/): Misconfiguration in deepcool:deepcreative (high 7.8)
- [CVE-2026-3026](https://insights.sbomify.com/CVE-2026-3026/): erzhongxmu JEEWMS UEditor getRemoteImage.jsp server-side request forgery (medium 6.9)
- [CVE-2026-30252](https://insights.sbomify.com/CVE-2026-30252/): Cross-site scripting in interzen:zencrm (medium 6.1)
- [CVE-2026-30251](https://insights.sbomify.com/CVE-2026-30251/): Cross-site scripting in interzen:zenshare suite (medium 6.1)
- [CVE-2026-30250](https://insights.sbomify.com/CVE-2026-30250/): Cross-site scripting vulnerability in the user documentation field in Beta Systems Software AG ANOW! (medium 6.1)
- [CVE-2026-3025](https://insights.sbomify.com/CVE-2026-3025/): ShuoRen Smart Heating Integrated Management Platform ExampleNodeService.asmx unrestricted upload (medium 6.9)
- [CVE-2026-30247](https://insights.sbomify.com/CVE-2026-30247/): WeKnora: SSRF via Redirection (medium 5.9)
- [CVE-2026-30246](https://insights.sbomify.com/CVE-2026-30246/): github.com/gofiber/fiber/v3 cache middleware can mix responses across query parameters (medium 6.5)
- [CVE-2026-30244](https://insights.sbomify.com/CVE-2026-30244/): Plane: Unauthenticated Workspace Member Information Disclosure (high 7.5)
- [CVE-2026-30242](https://insights.sbomify.com/CVE-2026-30242/): Plane: SSRF via Incomplete IP Validation in Webhook URL Serializer (high 8.5)
- [CVE-2026-30241](https://insights.sbomify.com/CVE-2026-30241/): Mercurius: queryDepth limit bypassed for WebSocket subscriptions (low 2.7)
- [CVE-2026-30240](https://insights.sbomify.com/CVE-2026-30240/): Budibase PWA ZIP Upload Path Traversal Allows Reading Arbitrary Server Files Including All Environment Secrets (critical 9.6)
- [CVE-2026-3024](https://insights.sbomify.com/CVE-2026-3024/): Stored Cross-Site Scripting (XSS) vulnerability in the Wakyma application web (medium 4.8)
- [CVE-2026-30239](https://insights.sbomify.com/CVE-2026-30239/): OpenProject has a Permission Check bypass on Budget deletion allows reassignment of WorkPackages into other budgets (medium 6.5)
- [CVE-2026-30238](https://insights.sbomify.com/CVE-2026-30238/): Group-Office: Reflected XSS in JavaScript context (medium 5.1)
- [CVE-2026-30237](https://insights.sbomify.com/CVE-2026-30237/): Group-Office: Self XSS in GroupOffice Installer License Page (install/license.php) (low 2.1)
- [CVE-2026-30236](https://insights.sbomify.com/CVE-2026-30236/): OpenProject users that are not project members can be used to calculate Labor Budget, leaking their global hourly rate (medium 4.3)
- [CVE-2026-30235](https://insights.sbomify.com/CVE-2026-30235/): Business Logic Error on OpenProject through hyperlinks in markdown using DOM clobbering (medium 6.5)
- [CVE-2026-30234](https://insights.sbomify.com/CVE-2026-30234/): OpenProject BIM BCF XML Import: <Snapshot> Path Traversal Leads to Arbitrary Local File Read (AFR) (medium 6.5)
- [CVE-2026-30233](https://insights.sbomify.com/CVE-2026-30233/): OliveTin: View permission not being checked when returning dashboards (medium 6.5)
- [CVE-2026-30232](https://insights.sbomify.com/CVE-2026-30232/): Chartbrew has SSRF in API Data Connection - No IP Validation on User-Provided URLs (high 7.8)
- [CVE-2026-30231](https://insights.sbomify.com/CVE-2026-30231/): Flare: Private File IDOR via raw/direct endpoints (medium 6.0)
- [CVE-2026-30230](https://insights.sbomify.com/CVE-2026-30230/): Flare: Password‑Protected Thumbnail Bypass (high 8.2)
- [CVE-2026-3023](https://insights.sbomify.com/CVE-2026-3023/): Non-relational SQL injection vulnerability (NoSQLi) in the Wakyma application web (medium 5.3)
- [CVE-2026-30229](https://insights.sbomify.com/CVE-2026-30229/): Parse Server: Endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any user (high 8.5)
- [CVE-2026-30228](https://insights.sbomify.com/CVE-2026-30228/): Parse Server: File creation and deletion bypasses `readOnlyMasterKey` write restriction (medium 6.9)
- [CVE-2026-30227](https://insights.sbomify.com/CVE-2026-30227/): MimeKit: CRLF Injection in Quoted Local-Part Enables SMTP Command Injection and Email Forgery (medium 6.9)
- [CVE-2026-30226](https://insights.sbomify.com/CVE-2026-30226/): devalue has prototype pollution in devalue.parse and devalue.unflatten (medium 6.3)
- [CVE-2026-30225](https://insights.sbomify.com/CVE-2026-30225/): OliveTin: RestartAction always runs actions as guest (medium 5.3)
- [CVE-2026-30224](https://insights.sbomify.com/CVE-2026-30224/): OliveTin: Session Fixation - Logout Fails to Invalidate Server-Side Session (medium 5.4)
- [CVE-2026-30223](https://insights.sbomify.com/CVE-2026-30223/): OliveTin: JWT Audience Validation Bypass in Local Key and HMAC Modes (high 8.8)
- [CVE-2026-3022](https://insights.sbomify.com/CVE-2026-3022/): Non-relational SQL injection vulnerability (NoSQLi) in the Wakyma application web (high 7.1)
- [CVE-2026-3021](https://insights.sbomify.com/CVE-2026-3021/): Non-relational SQL injection vulnerability (NoSQLi) in the Wakyma application web (high 7.1)
- [CVE-2026-3020](https://insights.sbomify.com/CVE-2026-3020/): Identity based authorization bypass vulnerability (IDOR) in the Wakyma application web (high 8.6)
- [CVE-2026-3018](https://insights.sbomify.com/CVE-2026-3018/): Newsletters <= 4.13 - Unauthenticated SQL Injection via wpmlsubscriber_id Parameter (high 7.5)
- [CVE-2026-3017](https://insights.sbomify.com/CVE-2026-3017/): Deserialization in Smart Post Show – Post Grid, Post Carousel & Slider, and List Category Posts (high 7.2)
- [CVE-2026-30162](https://insights.sbomify.com/CVE-2026-30162/): Cross-site scripting in auntvt:timo (medium 6.1)
- [CVE-2026-3016](https://insights.sbomify.com/CVE-2026-3016/): UTT HiPER 810G formP2PLimitConfig strcpy buffer overflow (high 8.7)
- [CVE-2026-3015](https://insights.sbomify.com/CVE-2026-3015/): UTT HiPER 810G formPolicyRouteConf strcpy buffer overflow (high 8.7)
- [CVE-2026-30141](https://insights.sbomify.com/CVE-2026-30141/): An issue was discovered in bitbank2 AnimatedGIF v2.2.0. (critical 9.8)
- [CVE-2026-30140](https://insights.sbomify.com/CVE-2026-30140/): Missing authorization in tenda:w15e firmware (high 7.5)
- [CVE-2026-3014](https://insights.sbomify.com/CVE-2026-3014/): Remote Code Execution by administrative user on the Management Server (medium 6.4)
- [CVE-2026-30139](https://insights.sbomify.com/CVE-2026-30139/): Silverpeas Core has a reflected cross-site scripting vulnerability (medium 6.1)
- [CVE-2026-3013](https://insights.sbomify.com/CVE-2026-3013/): Path Traversal in Coppermine Photo Gallery (high 8.7)
- [CVE-2026-30121](https://insights.sbomify.com/CVE-2026-30121/): Remotion: arbitrary file write vulnerability (critical 9.1)
- [CVE-2026-30120](https://insights.sbomify.com/CVE-2026-30120/): Remotion: remote code execution (RCE) vulnerability (critical 9.8)
- [CVE-2026-3012](https://insights.sbomify.com/CVE-2026-3012/): Samba: group policy certificate enrollment uses http:// without validation (high 8.0)
- [CVE-2026-30118](https://insights.sbomify.com/CVE-2026-30118/): scalar/astro v0.1.13 was discovered to contain a Server-Side Request Forgery (SSRF) in the scalar_url query parameter of the Scalar Proxy endpoint. (critical 9.8)
- [CVE-2026-30117](https://insights.sbomify.com/CVE-2026-30117/): scalar/astro v0.1.13 was discovered to contain an arbitrary file upload vulnerability in the the scalar_url query parameter of the Scalar Proxy endpoint. (critical 9.8)
- [CVE-2026-3011](https://insights.sbomify.com/CVE-2026-3011/): Recipe Card Blocks Lite <= 3.4.13 - Authenticated (Author+) Stored Cross-Site Scripting via 'summary' and 'notes' (medium 6.4)
- [CVE-2026-3010](https://insights.sbomify.com/CVE-2026-3010/): TimePictra Stored Cross-Site Scripting (critical 9.3)
- [CVE-2026-3009](https://insights.sbomify.com/CVE-2026-3009/): Keycloak allows authentication using an Identity Provider (IdP) even after it has been disabled by an administrator (high 8.1)
- [CVE-2026-30082](https://insights.sbomify.com/CVE-2026-30082/): Multiple stored cross-site scripting (XSS) vulnerabilities in the Edit feature of the Software Package List page of IngEstate Server v11.14. (medium 6.1)
- [CVE-2026-30080](https://insights.sbomify.com/CVE-2026-30080/): Security feature bypass in openairinterface:oai-cn5g-amf (high 7.5)
- [CVE-2026-3008](https://insights.sbomify.com/CVE-2026-3008/): Vulnerability in Notepad++ (medium 6.6)
- [CVE-2026-30079](https://insights.sbomify.com/CVE-2026-30079/): Auth bypass in openairinterface:oai-cn5g-amf (critical 9.8)
- [CVE-2026-30078](https://insights.sbomify.com/CVE-2026-30078/): Denial of service in openairinterface:oai-cn5g-amf (high 7.5)
- [CVE-2026-30077](https://insights.sbomify.com/CVE-2026-30077/): Denial of service in openairinterface:openairinterface (high 7.5)
- [CVE-2026-30075](https://insights.sbomify.com/CVE-2026-30075/): Memory corruption in openairinterface:oai-cn5g-amf (high 7.5)
- [CVE-2026-30073](https://insights.sbomify.com/CVE-2026-30073/): An issue in the NssaiAvailabilitySubscriptionCreate component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted POST request. (high 7.5)
- [CVE-2026-30072](https://insights.sbomify.com/CVE-2026-30072/): A NULL pointer dereference in the CDR processing path of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via supplying crafted payload. (high 7.5)
- [CVE-2026-30071](https://insights.sbomify.com/CVE-2026-30071/): An issue in the RechargePut function of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input. (high 7.5)
- [CVE-2026-30070](https://insights.sbomify.com/CVE-2026-30070/): An issue in the HandleGetSharedData function of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input. (high 7.5)
- [CVE-2026-3007](https://insights.sbomify.com/CVE-2026-3007/): Stored Cross-Site Scripting (XSS) Vulnerability (medium 5.4)
- [CVE-2026-30069](https://insights.sbomify.com/CVE-2026-30069/): A NULL pointer dereference in the UDMC registration handler component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) (high 7.5)
- [CVE-2026-30068](https://insights.sbomify.com/CVE-2026-30068/): Improper input validation in the HandleUpdate function (/sbi/parameter_provision.go) of free5gc v4.0.1 allows attackers to cause a Denial of (high 7.5)
- [CVE-2026-30067](https://insights.sbomify.com/CVE-2026-30067/): An issue in the complexQueryFilterSubprocess function in the NRF Discovery service of free5gc v4.0.1 allows attackers to cause a Denial of S (high 7.5)
- [CVE-2026-30064](https://insights.sbomify.com/CVE-2026-30064/): Improper input validation in the buildFilter function (processor/processor.go) of free5gc v4.0.1 allows attackers to cause a Denial of Servi (high 7.5)
- [CVE-2026-30063](https://insights.sbomify.com/CVE-2026-30063/): An issue in the NF Discovery endpoint of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted snssais query. (high 7.5)
- [CVE-2026-30062](https://insights.sbomify.com/CVE-2026-30062/): An issue in the NGAP handler of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted NAS PDU. (high 7.5)
- [CVE-2026-30060](https://insights.sbomify.com/CVE-2026-30060/): An issue in free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) when parsing crafted SUCI data during UE registration. (high 7.5)
- [CVE-2026-3006](https://insights.sbomify.com/CVE-2026-3006/): Race Condition Vulnerability (high 7.0)
- [CVE-2026-30059](https://insights.sbomify.com/CVE-2026-30059/): An issue in the NAS decoder component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted Registration Request message. (high 7.5)
- [CVE-2026-30058](https://insights.sbomify.com/CVE-2026-30058/): Improper Input Validation in the HTTPModifySubscription handler of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input. (high 7.5)
- [CVE-2026-30057](https://insights.sbomify.com/CVE-2026-30057/): An issue in the CreateUEContext handler component of free5gc v4.1.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted request. (high 7.5)
- [CVE-2026-30056](https://insights.sbomify.com/CVE-2026-30056/): A NULL pointer dereference in the AMF NGAP Dispatcher component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via su (high 7.5)
- [CVE-2026-30051](https://insights.sbomify.com/CVE-2026-30051/): An issue in the CreateUEContextProcedure function (/v1/ue-contexts/{supi}) of free5gc v4.1.0 allows attackers to cause a Denial of Service ( (high 7.5)
- [CVE-2026-30050](https://insights.sbomify.com/CVE-2026-30050/): An issue in the ModifyAMFEventSubscriptionProcedure function (processor/event_exposure.go) of free5gc v4.1.0 allows attackers to cause a Den (high 7.5)
- [CVE-2026-3005](https://insights.sbomify.com/CVE-2026-3005/): List category posts <= 0.94.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'catlist' Shortcode (medium 6.4)
- [CVE-2026-30048](https://insights.sbomify.com/CVE-2026-30048/): NotChatbot WebChat has a stored cross-site scripting (XSS) vulnerability (medium 5.4)
- [CVE-2026-30047](https://insights.sbomify.com/CVE-2026-30047/): A reachable assertion vulnerability in the /nsmf-pdusession/v1/sm-contexts component of Open5GS v2.7.6 allows attackers to cause a Denial of (high 7.5)
- [CVE-2026-30046](https://insights.sbomify.com/CVE-2026-30046/): A reachable assertion vulnerability in the NUDM-UECM interface of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via sup (high 7.5)
- [CVE-2026-30045](https://insights.sbomify.com/CVE-2026-30045/): An integer overflow in the /nnrf-disc/v1/nf-instances component of open5gs v2.7.6 allows attackers to cause a Denial of Service (DoS) via su (high 7.5)
- [CVE-2026-30041](https://insights.sbomify.com/CVE-2026-30041/): An integer overflow in the PSD parser compnent of FastStone Image Viewer v8.3 allows attackers to execute arbitrary code or cause a Denial o (high 7.5)
- [CVE-2026-30040](https://insights.sbomify.com/CVE-2026-30040/): A heap overflow in the FSViewer.exe process of FastStone Image Viewer v8.3 allows attackers to cause a execute arbitrary code in the context (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/736/