# Vulnerabilities published in 2026


- [CVE-2026-3004](https://insights.sbomify.com/CVE-2026-3004/): Snow Monkey Blocks <= 24.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-slick' Attribute (medium 6.4)
- [CVE-2026-3003](https://insights.sbomify.com/CVE-2026-3003/): Vagaro Booking Widget <= 0.3 - Unauthenticated Stored Cross-Site Scripting via 'vagaro_code' (high 7.2)
- [CVE-2026-3002](https://insights.sbomify.com/CVE-2026-3002/): Gutenverse <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Blocks (medium 6.4)
- [CVE-2026-3001](https://insights.sbomify.com/CVE-2026-3001/): Gutenverse <= 3.4.6 - Reflected Cross-Site Scripting via 's' Parameter (medium 6.1)
- [CVE-2026-30007](https://insights.sbomify.com/CVE-2026-30007/): Use after free in xnview:nconvert (medium 6.2)
- [CVE-2026-30006](https://insights.sbomify.com/CVE-2026-30006/): Memory corruption in xnview:nconvert (medium 6.2)
- [CVE-2026-3000](https://insights.sbomify.com/CVE-2026-3000/): Changing｜IDExpert Windows Logon Agent - Remote Code Execution (critical 9.3)
- [CVE-2026-2999](https://insights.sbomify.com/CVE-2026-2999/): Changing｜IDExpert Windows Logon Agent - Remote Code Execution (critical 9.3)
- [CVE-2026-29988](https://insights.sbomify.com/CVE-2026-29988/): Information disclosure in AM102/102L V2 (high 8.3)
- [CVE-2026-2998](https://insights.sbomify.com/CVE-2026-2998/): eAI Technologies｜ERP - DLL Hijacking (high 8.5)
- [CVE-2026-29976](https://insights.sbomify.com/CVE-2026-29976/): Memory corruption in zerbea:hcxtools (medium 6.2)
- [CVE-2026-29975](https://insights.sbomify.com/CVE-2026-29975/): lwjson 1.8.1 contains an improper input validation vulnerability in the streaming JSON parser (lwjson_stream.c). (high 7.5)
- [CVE-2026-29974](https://insights.sbomify.com/CVE-2026-29974/): An issue was discovered in kosma minmea 0.3.0. (high 7.5)
- [CVE-2026-29972](https://insights.sbomify.com/CVE-2026-29972/): nanoMODBUS through v1.22.0 has a stack-based buffer overflow in recv_read_registers_res() in nanomodbus.c. (high 8.2)
- [CVE-2026-29971](https://insights.sbomify.com/CVE-2026-29971/): A reflected cross-site scripting (XSS) vulnerability exists in WebFileSys version before 2.32.0 and fixed in v.2.32.0. (medium 6.1)
- [CVE-2026-2997](https://insights.sbomify.com/CVE-2026-2997/): WisdomGarden｜Tronclass - Insecure Direct Object Reference (medium 6.5)
- [CVE-2026-29969](https://insights.sbomify.com/CVE-2026-29969/): Cross-site scripting in workflowfirst:staffwiki (medium 6.1)
- [CVE-2026-29965](https://insights.sbomify.com/CVE-2026-29965/): Cross-site scripting in hsclabs:mailinspector (medium 6.1)
- [CVE-2026-29964](https://insights.sbomify.com/CVE-2026-29964/): Cross-site scripting in hsclabs:mailinspector (medium 6.1)
- [CVE-2026-29963](https://insights.sbomify.com/CVE-2026-29963/): Path traversal in hsclabs:mailinspector (high 7.5)
- [CVE-2026-29962](https://insights.sbomify.com/CVE-2026-29962/): Path traversal in hsclabs:mailinspector (high 7.5)
- [CVE-2026-2996](https://insights.sbomify.com/CVE-2026-2996/): Business logic in Advanced Product Fields (Product Addons) for WooCommerce (high 7.5)
- [CVE-2026-29955](https://insights.sbomify.com/CVE-2026-29955/): Command injection in cloudark:kubeplus (high 8.8)
- [CVE-2026-29954](https://insights.sbomify.com/CVE-2026-29954/): Server-side request forgery in cloudark:kubeplus (high 7.6)
- [CVE-2026-29953](https://insights.sbomify.com/CVE-2026-29953/): SQL injection in schemahero:schemahero (high 7.4)
- [CVE-2026-2995](https://insights.sbomify.com/CVE-2026-2995/): Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLab (high 7.7)
- [CVE-2026-2994](https://insights.sbomify.com/CVE-2026-2994/): Concrete CMS below 9.4.8 is vulnerable to CSRF by a Rogue Admin using the Anti-Spam Allowlist Group (low 2.3)
- [CVE-2026-29934](https://insights.sbomify.com/CVE-2026-29934/): Cross-site scripting in lightcms project:lightcms (medium 6.1)
- [CVE-2026-29933](https://insights.sbomify.com/CVE-2026-29933/): Cross-site scripting in yzmcms:yzmcms (medium 6.1)
- [CVE-2026-2993](https://insights.sbomify.com/CVE-2026-2993/): AI Chatbot & Workflow Automation by AIWU <= 1.4.17 - Unauthenticated SQL Injection in getListForTbl() (high 7.5)
- [CVE-2026-29925](https://insights.sbomify.com/CVE-2026-29925/): Server-side request forgery in invoiceninja:invoice ninja (high 7.7)
- [CVE-2026-29924](https://insights.sbomify.com/CVE-2026-29924/): XML external entity in getgrav:grav (high 7.6)
- [CVE-2026-29923](https://insights.sbomify.com/CVE-2026-29923/): The pstrip64.sys driver in EnTech Taiwan PowerStrip <=3.90.736 allows local users to escalate privileges to SYSTEM via a crafted IOCTL reque (high 7.8)
- [CVE-2026-2992](https://insights.sbomify.com/CVE-2026-2992/): KiviCare <= 4.1.2 - Missing Authorization to Unauthenticated Privilege Escalation via Setup Wizard (high 8.2)
- [CVE-2026-2991](https://insights.sbomify.com/CVE-2026-2991/): Auth bypass in KiviCare – Clinic & Patient Management System (EHR) (high 7.3)
- [CVE-2026-29909](https://insights.sbomify.com/CVE-2026-29909/): Missing authorization in mrcms:mrcms (medium 5.3)
- [CVE-2026-29905](https://insights.sbomify.com/CVE-2026-29905/): Denial of service in getkirby:kirby (medium 6.5)
- [CVE-2026-2988](https://insights.sbomify.com/CVE-2026-2988/): Cross-site scripting in PowerPress Podcasting plugin by Blubrry (medium 6.4)
- [CVE-2026-29872](https://insights.sbomify.com/CVE-2026-29872/): Information disclosure in theunwindai:awesome llm apps (high 8.2)
- [CVE-2026-29871](https://insights.sbomify.com/CVE-2026-29871/): Path traversal in theunwindai:awesome llm apps (high 7.5)
- [CVE-2026-29870](https://insights.sbomify.com/CVE-2026-29870/): A directory traversal vulnerability in the agentic-context-engine project versions up to 0.7.1 allows arbitrary file writes via the checkpoi (high 7.6)
- [CVE-2026-2987](https://insights.sbomify.com/CVE-2026-2987/): Simple Ajax Chat <= 20260217 - Unauthenticated Stored Cross-Site Scripting via 'c' (medium 6.1)
- [CVE-2026-29861](https://insights.sbomify.com/CVE-2026-29861/): PHP-MYSQL-User-Login-System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at login.php. (critical 9.8)
- [CVE-2026-2986](https://insights.sbomify.com/CVE-2026-2986/): Contextual Related Posts <= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'other_attributes' (medium 6.4)
- [CVE-2026-29859](https://insights.sbomify.com/CVE-2026-29859/): File upload in aapanel:aapanel (critical 9.8)
- [CVE-2026-29858](https://insights.sbomify.com/CVE-2026-29858/): Path traversal in aapanel:aapanel (high 7.5)
- [CVE-2026-29856](https://insights.sbomify.com/CVE-2026-29856/): Denial of service in aapanel:aapanel (high 7.5)
- [CVE-2026-2985](https://insights.sbomify.com/CVE-2026-2985/): Tiandy Video Surveillance System 视频监控平台 CLSBODownLoad.java downloadImage server-side request forgery (medium 5.3)
- [CVE-2026-29840](https://insights.sbomify.com/CVE-2026-29840/): Cross-site scripting in jizhicms:jizhicms (medium 5.4)
- [CVE-2026-2984](https://insights.sbomify.com/CVE-2026-2984/): SourceCodester Student Result Management System drop_user.php denial of service (medium 6.9)
- [CVE-2026-29839](https://insights.sbomify.com/CVE-2026-29839/): Cross-site request forgery in dedecms:dedecms (high 8.8)
- [CVE-2026-2983](https://insights.sbomify.com/CVE-2026-2983/): SourceCodester Student Result Management System Bulk Import import_users.php access control (medium 6.9)
- [CVE-2026-29828](https://insights.sbomify.com/CVE-2026-29828/): Cross-site scripting in dootask:dootask (medium 6.1)
- [CVE-2026-29812](https://insights.sbomify.com/CVE-2026-29812/): Other in CyberPanel (medium 4.3)
- [CVE-2026-29811](https://insights.sbomify.com/CVE-2026-29811/): Other in CyberPanel (high 7.7)
- [CVE-2026-29810](https://insights.sbomify.com/CVE-2026-29810/): Business logic in CyberPanel (medium 4.3)
- [CVE-2026-2981](https://insights.sbomify.com/CVE-2026-2981/): UTT HiPER 810G formTaskEdit_ap strcpy buffer overflow (high 8.7)
- [CVE-2026-2980](https://insights.sbomify.com/CVE-2026-2980/): UTT HiPER 810G setSysAdm strcpy buffer overflow (high 8.6)
- [CVE-2026-29797](https://insights.sbomify.com/CVE-2026-29797/): Red Lion Controls N-Tron 700 Series Download of Code Without Integrity Check (high 8.4)
- [CVE-2026-29796](https://insights.sbomify.com/CVE-2026-29796/): IGL-Technologies eParking.fi Missing Authentication for Critical Function (critical 9.3)
- [CVE-2026-29795](https://insights.sbomify.com/CVE-2026-29795/): stellar-xdr: `StringM::from_str` bypasses max length validation (medium 4.0)
- [CVE-2026-29794](https://insights.sbomify.com/CVE-2026-29794/): Vikunja has Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers (medium 5.3)
- [CVE-2026-29793](https://insights.sbomify.com/CVE-2026-29793/): NoSQL Injection via WebSocket id Parameter in MongoDB Adapter (critical 9.3)
- [CVE-2026-29792](https://insights.sbomify.com/CVE-2026-29792/): Feathersjs has an OAuth Callback Account Takeover (critical 9.3)
- [CVE-2026-29791](https://insights.sbomify.com/CVE-2026-29791/): Agentgateway: Missing parameter sanitization in MCP to OpenAPI conversion (medium 4.9)
- [CVE-2026-29790](https://insights.sbomify.com/CVE-2026-29790/): dbt-common: commonprefix() doesn't protect against path traversal (low 2.0)
- [CVE-2026-2979](https://insights.sbomify.com/CVE-2026-2979/): FastApiAdmin Scheduled Task API controller.py user_avatar_upload_controller unrestricted upload (medium 5.3)
- [CVE-2026-29789](https://insights.sbomify.com/CVE-2026-29789/): Vito: Cross-project privilege escalation in workflow site-creation actions allows unauthorized server modification (critical 10.0)
- [CVE-2026-29788](https://insights.sbomify.com/CVE-2026-29788/): TSPortal: Anyone can forge self-deletion requests of any user (high 8.4)
- [CVE-2026-29787](https://insights.sbomify.com/CVE-2026-29787/): mcp-memory-service: System Information Disclosure via Health Endpoint (medium 5.3)
- [CVE-2026-29786](https://insights.sbomify.com/CVE-2026-29786/): node-tar: Hardlink Path Traversal via Drive-Relative Linkpath (high 8.2)
- [CVE-2026-29785](https://insights.sbomify.com/CVE-2026-29785/): NATS Server panic via malicious compression on leafnode port (high 7.5)
- [CVE-2026-29784](https://insights.sbomify.com/CVE-2026-29784/): Ghost: Incomplete CSRF protections around OTC use (high 7.5)
- [CVE-2026-29783](https://insights.sbomify.com/CVE-2026-29783/): GitHub Copilot CLI allows for dangerous shell expansion patterns that enable arbitrary command execution (high 7.5)
- [CVE-2026-29782](https://insights.sbomify.com/CVE-2026-29782/): OpenSTAManager: Remote Code Execution via Insecure Deserialization in OAuth2 (high 7.2)
- [CVE-2026-29781](https://insights.sbomify.com/CVE-2026-29781/): Sliver: Authenticated Nil-Pointer Dereference in Handlers (low 2.1)
- [CVE-2026-29780](https://insights.sbomify.com/CVE-2026-29780/): eml_parser: Path Traversal in Official Example Script Leading to Arbitrary File Write (medium 5.5)
- [CVE-2026-2978](https://insights.sbomify.com/CVE-2026-2978/): FastApiAdmin Scheduled Task API controller.py upload_file_controller unrestricted upload (medium 5.3)
- [CVE-2026-29779](https://insights.sbomify.com/CVE-2026-29779/): UptimeFlare: Montior config / Credentials in `workerConfig` exposed in client-side JavaScript bundle (high 7.5)
- [CVE-2026-29778](https://insights.sbomify.com/CVE-2026-29778/): pyLoad: Arbitrary File Write via Path Traversal in edit_package() (high 7.1)
- [CVE-2026-29777](https://insights.sbomify.com/CVE-2026-29777/): Traefik has a kubernetes gateway rule injection via unescaped backticks in HTTPRoute match values (medium 6.1)
- [CVE-2026-29776](https://insights.sbomify.com/CVE-2026-29776/): FreeRDP has an Integer Underflow in update_read_cache_bitmap_order Function of FreeRDP's Core Library (low 3.1)
- [CVE-2026-29775](https://insights.sbomify.com/CVE-2026-29775/): FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId (medium 5.3)
- [CVE-2026-29774](https://insights.sbomify.com/CVE-2026-29774/): FreeRDP has a heap-buffer-overflow in avc420_yuv_to_rgb via OOB regionRects (medium 5.3)
- [CVE-2026-29773](https://insights.sbomify.com/CVE-2026-29773/): kubewarden-controller cross-namespace data exfiltration via deprecated host callback binding (medium 4.3)
- [CVE-2026-29772](https://insights.sbomify.com/CVE-2026-29772/): Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands (medium 5.9)
- [CVE-2026-29771](https://insights.sbomify.com/CVE-2026-29771/): Netmaker: Denial of Service via Server Shutdown Endpoint (high 8.7)
- [CVE-2026-2977](https://insights.sbomify.com/CVE-2026-2977/): FastApiAdmin Scheduled Task API controller.py upload_controller unrestricted upload (medium 5.3)
- [CVE-2026-2976](https://insights.sbomify.com/CVE-2026-2976/): FastApiAdmin Download Endpoint controller.py download_controller information disclosure (medium 5.3)
- [CVE-2026-2975](https://insights.sbomify.com/CVE-2026-2975/): FastApiAdmin Custom Documentation Endpoint init_app.py reset_api_docs information disclosure (medium 6.9)
- [CVE-2026-2974](https://insights.sbomify.com/CVE-2026-2974/): AliasVault App Backup aliasvault.xml backup (low 2.0)
- [CVE-2026-2973](https://insights.sbomify.com/CVE-2026-2973/): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (medium 5.4)
- [CVE-2026-2972](https://insights.sbomify.com/CVE-2026-2972/): a466350665 Smart-SSO Role Edit UserController.java save cross site scripting (medium 4.8)
- [CVE-2026-2971](https://insights.sbomify.com/CVE-2026-2971/): a466350665 Smart-SSO Login login.html cross site scripting (medium 5.3)
- [CVE-2026-2970](https://insights.sbomify.com/CVE-2026-2970/): datapizza-labs datapizza-ai cache.py RedisCache deserialization (low 2.1)
- [CVE-2026-2969](https://insights.sbomify.com/CVE-2026-2969/): datapizza-labs datapizza-ai Jinja2 Template prompt.py ChatPromptTemplate special elements used in a template engine (medium 5.1)
- [CVE-2026-2968](https://insights.sbomify.com/CVE-2026-2968/): Cesanta Mongoose Poly1305 Authentication Tag tls_chacha20.c mg_chacha20_poly1305_decrypt signature verification (medium 6.3)
- [CVE-2026-2967](https://insights.sbomify.com/CVE-2026-2967/): Cesanta Mongoose TCP Sequence Number net_builtin.c getpeer verification of source (medium 6.3)
- [CVE-2026-2966](https://insights.sbomify.com/CVE-2026-2966/): Cesanta Mongoose DNS Transaction ID dns.c mg_sendnsreq random values (medium 6.3)
- [CVE-2026-2965](https://insights.sbomify.com/CVE-2026-2965/): 07FLYCMS/07FLY-CMS/07FlyCRM System Extension edit.html cross site scripting (medium 4.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/737/