# Vulnerabilities published in 2026


- [CVE-2026-29649](https://insights.sbomify.com/CVE-2026-29649/): Security feature bypass in xiangshan:nemu (critical 9.8)
- [CVE-2026-29648](https://insights.sbomify.com/CVE-2026-29648/): In OpenXiangShan NEMU, when Smstateen is enabled, clearing mstateen0.ENVCFG does not correctly restrict access to henvcfg and senvcfg. (high 8.8)
- [CVE-2026-29647](https://insights.sbomify.com/CVE-2026-29647/): In OpenXiangShan NEMU, insufficient Smstateen permission enforcement allows lower-privileged code to access IMSIC state via stopei/vstopei C (medium 6.5)
- [CVE-2026-29646](https://insights.sbomify.com/CVE-2026-29646/): In OpenXiangShan NEMU prior to 55295c4, when running with RVH (Hypervisor extension) enabled, a VS-mode guest write to the supervisor interr (critical 9.8)
- [CVE-2026-29645](https://insights.sbomify.com/CVE-2026-29645/): Other in xiangshan:nemu (high 7.5)
- [CVE-2026-29644](https://insights.sbomify.com/CVE-2026-29644/): XiangShan (open-source high-performance RISC-V processor) commit edb1dfaf7d290ae99724594507dc46c2c2125384 (2024-11-28) has improper gating o (medium 5.3)
- [CVE-2026-29643](https://insights.sbomify.com/CVE-2026-29643/): XiangShan (Open-source high-performance RISC-V processor) commit edb1dfaf7d290ae99724594507dc46c2c2125384 (2024-11-28) contains an improper (high 7.1)
- [CVE-2026-29642](https://insights.sbomify.com/CVE-2026-29642/): A local attacker who can execute privileged CSR operations (or can induce firmware to do so) performs carefully crafted reads/writes to menv (high 7.8)
- [CVE-2026-2964](https://insights.sbomify.com/CVE-2026-2964/): higuma web-audio-recorder-js Dynamic Config Handling WebAudioRecorder.js extend prototype pollution (low 2.3)
- [CVE-2026-2963](https://insights.sbomify.com/CVE-2026-2963/): Jinher OA C6 OfficeSupplyTypeRight.aspx sql injection (medium 5.3)
- [CVE-2026-29628](https://insights.sbomify.com/CVE-2026-29628/): A stack overflow in the experimental/tinyobj_loader_opt.h file of tinyobjloader commit d56555b allows attackers to cause a Denial of Service (medium 6.2)
- [CVE-2026-2962](https://insights.sbomify.com/CVE-2026-2962/): D-Link DWR-M960 Scheduled Reboot Configuration Endpoint formDateReboot sub_460F30 stack-based overflow (high 8.7)
- [CVE-2026-29613](https://insights.sbomify.com/CVE-2026-29613/): OpenClaw < 2026.2.12 - Webhook Authentication Bypass via Loopback remoteAddress Trust (high 8.2)
- [CVE-2026-29612](https://insights.sbomify.com/CVE-2026-29612/): OpenClaw < 2026.2.14 - Denial of Service via Large Base64 Media File Decoding (medium 6.8)
- [CVE-2026-29611](https://insights.sbomify.com/CVE-2026-29611/): OpenClaw < 2026.2.14 - Local File Inclusion via mediaPath Parameter in BlueBubbles Media Handling (high 8.2)
- [CVE-2026-29610](https://insights.sbomify.com/CVE-2026-29610/): OpenClaw < 2026.2.14 - Command Hijacking via Unsafe PATH Handling (high 7.7)
- [CVE-2026-2961](https://insights.sbomify.com/CVE-2026-2961/): D-Link DWR-M960 VPN Configuration Endpoint formVpnConfigSetup sub_4196C4 stack-based overflow (high 8.7)
- [CVE-2026-29609](https://insights.sbomify.com/CVE-2026-29609/): OpenClaw < 2026.2.14 - Denial of Service via Unbounded URL-backed Media Fetch (high 8.7)
- [CVE-2026-29608](https://insights.sbomify.com/CVE-2026-29608/): OpenClaw 2026.3.1 < 2026.3.2 - Approval Integrity Bypass via system.run argv Rewriting (medium 5.4)
- [CVE-2026-29607](https://insights.sbomify.com/CVE-2026-29607/): OpenClaw < 2026.2.22 - Authorization Bypass via allow-always Wrapper Persistence (high 7.1)
- [CVE-2026-29606](https://insights.sbomify.com/CVE-2026-29606/): OpenClaw < 2026.2.14 - Webhook Signature Verification Bypass via ngrok Loopback Compatibility (medium 6.3)
- [CVE-2026-2960](https://insights.sbomify.com/CVE-2026-2960/): D-Link DWR-M960 formDhcpv6s sub_468D64 stack-based overflow (high 8.7)
- [CVE-2026-29598](https://insights.sbomify.com/CVE-2026-29598/): Multiple stored cross-site scripting (XSS) vulnerabilities in the submit_add_user.asp endpoint of DDSN Interactive Acora CMS v10.7.1 allow a (medium 5.4)
- [CVE-2026-29597](https://insights.sbomify.com/CVE-2026-29597/): DDSN Interactive cm3 Acora CMS version 10.7.1 contains an improper access control vulnerability. (medium 6.5)
- [CVE-2026-2959](https://insights.sbomify.com/CVE-2026-2959/): D-Link DWR-M960 formNewSchedule sub_44E0F8 stack-based overflow (high 8.7)
- [CVE-2026-2958](https://insights.sbomify.com/CVE-2026-2958/): D-Link DWR-M960 formWsc sub_457C5C stack-based overflow (high 8.7)
- [CVE-2026-2957](https://insights.sbomify.com/CVE-2026-2957/): qinming99 dst-admin File BackupController.java deleteBackup denial of service (medium 5.3)
- [CVE-2026-2956](https://insights.sbomify.com/CVE-2026-2956/): qinming99 dst-admin restore revertBackup command injection (medium 5.3)
- [CVE-2026-2955](https://insights.sbomify.com/CVE-2026-2955/): Cross-site scripting in AI Chatbot & Workflow Automation by AIWU (medium 6.4)
- [CVE-2026-2954](https://insights.sbomify.com/CVE-2026-2954/): Dromara UJCMS ImportDataController import-channel importChanel injection (medium 5.3)
- [CVE-2026-2953](https://insights.sbomify.com/CVE-2026-2953/): Dromara UJCMS Template WebFileTemplateController.delete deleteDirectory path traversal (medium 5.3)
- [CVE-2026-29522](https://insights.sbomify.com/CVE-2026-29522/): ZwickRoell Test Data Management < 3.0.8 Path Traversal LFI (high 8.7)
- [CVE-2026-29521](https://insights.sbomify.com/CVE-2026-29521/): Hereta ETH-IMC408M CSRF via Configuration Setup (medium 5.1)
- [CVE-2026-29520](https://insights.sbomify.com/CVE-2026-29520/): Hereta ETH-IMC408M Reflected XSS via ping_ipaddr Parameter (medium 5.1)
- [CVE-2026-2952](https://insights.sbomify.com/CVE-2026-2952/): Vaelsys HTTP POST Request tree_server.php os command injection (medium 6.9)
- [CVE-2026-29519](https://insights.sbomify.com/CVE-2026-29519/): Lucee CFML Server Reflected XSS via URL Path Parsing (medium 6.2)
- [CVE-2026-29518](https://insights.sbomify.com/CVE-2026-29518/): Rsync < 3.4.3 TOCTOU Race Condition Allows Symlink-Based Arbitrary File Write (high 7.3)
- [CVE-2026-29516](https://insights.sbomify.com/CVE-2026-29516/): Buffalo TeraStation TS5400R Excessive File Permissions Information Disclosure (medium 6.9)
- [CVE-2026-29515](https://insights.sbomify.com/CVE-2026-29515/): MiCode FileExplorer SwiFTP Server Authentication Bypass (critical 9.3)
- [CVE-2026-29514](https://insights.sbomify.com/CVE-2026-29514/): NetBox 4.3.5 - 4.5.4 RCE via RenderTemplateMixin (high 8.7)
- [CVE-2026-29513](https://insights.sbomify.com/CVE-2026-29513/): Hereta ETH-IMC408M Stored XSS via Device Location (medium 5.1)
- [CVE-2026-29510](https://insights.sbomify.com/CVE-2026-29510/): Hereta ETH-IMC408M Stored XSS via Device Name (medium 5.1)
- [CVE-2026-2951](https://insights.sbomify.com/CVE-2026-2951/): Cross-site scripting in Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor (medium 5.4)
- [CVE-2026-29509](https://insights.sbomify.com/CVE-2026-29509/): Patool < 4.0.5 Path Traversal via safe_extract() Function (medium 5.3)
- [CVE-2026-2950](https://insights.sbomify.com/CVE-2026-2950/): lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` (medium 6.5)
- [CVE-2026-2949](https://insights.sbomify.com/CVE-2026-2949/): Cross-site scripting in Xpro Addons — 140+ Widgets for Elementor (medium 6.4)
- [CVE-2026-2948](https://insights.sbomify.com/CVE-2026-2948/): Server-side request forgery in Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem (medium 6.4)
- [CVE-2026-2947](https://insights.sbomify.com/CVE-2026-2947/): rymcu forest User Profile UserInfoController.java updateUserInfo cross site scripting (medium 5.1)
- [CVE-2026-2946](https://insights.sbomify.com/CVE-2026-2946/): rymcu forest Article Content/Comments/Portfolio XssUtils.java XssUtils.replaceHtmlCode cross site scripting (medium 5.1)
- [CVE-2026-2945](https://insights.sbomify.com/CVE-2026-2945/): JeecgBoot uploadImgByHttp server-side request forgery (medium 5.3)
- [CVE-2026-2944](https://insights.sbomify.com/CVE-2026-2944/): Tosei Online Store Management System ネット店舗管理システム HTTP POST Request monitor.php system os command injection (medium 6.9)
- [CVE-2026-2943](https://insights.sbomify.com/CVE-2026-2943/): SapneshNaik Student Management System index.php cross site scripting (medium 5.3)
- [CVE-2026-2942](https://insights.sbomify.com/CVE-2026-2942/): ProSolution WP Client <= 1.9.9 - Unauthenticated Arbitrary File Upload via proSol_fileUploadProcess (critical 9.8)
- [CVE-2026-2941](https://insights.sbomify.com/CVE-2026-2941/): Missing authorization in Linksy Search and Replace (high 8.8)
- [CVE-2026-2940](https://insights.sbomify.com/CVE-2026-2940/): Zaher1307 tiny_web_server URL tiny.c out-of-bounds write (medium 6.9)
- [CVE-2026-2939](https://insights.sbomify.com/CVE-2026-2939/): itsourcecode Student Management System Add Student add_student cross site scripting (medium 4.8)
- [CVE-2026-2938](https://insights.sbomify.com/CVE-2026-2938/): SourceCodester Student Result Management System update_smtp.php access control (medium 6.9)
- [CVE-2026-2936](https://insights.sbomify.com/CVE-2026-2936/): Visitor Traffic Real Time Statistics <= 8.4 - Unauthenticated Stored Cross-Site Scripting (high 7.2)
- [CVE-2026-2935](https://insights.sbomify.com/CVE-2026-2935/): UTT HiPER 810G ConfigExceptMSN strcpy buffer overflow (high 8.6)
- [CVE-2026-2934](https://insights.sbomify.com/CVE-2026-2934/): YiFang CMS Extended Management D_friendLinkGroup.php update cross site scripting (medium 4.8)
- [CVE-2026-2933](https://insights.sbomify.com/CVE-2026-2933/): YiFang CMS Extended Management D_adManage.php update cross site scripting (medium 4.8)
- [CVE-2026-2932](https://insights.sbomify.com/CVE-2026-2932/): YiFang CMS Extended Management D_adPosition.php update cross site scripting (medium 4.8)
- [CVE-2026-2931](https://insights.sbomify.com/CVE-2026-2931/): Amelia Booking <= 9.1.2 - Authenticated (Customer+) Insecure Direct Object Reference to Arbitrary User Password Change (high 8.8)
- [CVE-2026-2930](https://insights.sbomify.com/CVE-2026-2930/): Tenda A18 Httpd Service UploadCfg webCgiGetUploadFile stack-based overflow (medium 5.3)
- [CVE-2026-2929](https://insights.sbomify.com/CVE-2026-2929/): D-Link DWR-M960 Wireless Access Control Endpoint formWlAc sub_453140 stack-based overflow (high 8.7)
- [CVE-2026-2928](https://insights.sbomify.com/CVE-2026-2928/): D-Link DWR-M960 WLAN Encryption Configuration Endpoint formWlEncrypt sub_452CCC stack-based overflow (high 8.7)
- [CVE-2026-2927](https://insights.sbomify.com/CVE-2026-2927/): D-Link DWR-M960 Operation Mode Configuration Endpoint formOpMode sub_462590 stack-based overflow (high 8.7)
- [CVE-2026-2926](https://insights.sbomify.com/CVE-2026-2926/): D-Link DWR-M960 LTE Configuration Endpoint formLteSetup sub_4237AC stack-based overflow (high 8.7)
- [CVE-2026-2925](https://insights.sbomify.com/CVE-2026-2925/): D-Link DWR-M960 Bridge VLAN Configuration Endpoint formBridgeVlan sub_42B5A0 stack-based overflow (high 8.7)
- [CVE-2026-2924](https://insights.sbomify.com/CVE-2026-2924/): Cross-site scripting in Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem (medium 6.4)
- [CVE-2026-2923](https://insights.sbomify.com/CVE-2026-2923/): GStreamer DVB Subtitles Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-29226](https://insights.sbomify.com/CVE-2026-29226/): Apache OFBiz: Low-Privilege SSRF in Content Component (high 7.3)
- [CVE-2026-29220](https://insights.sbomify.com/CVE-2026-29220/): Apache OFBiz: Low-Privilege LFI in Content Component (medium 6.5)
- [CVE-2026-2922](https://insights.sbomify.com/CVE-2026-2922/): GStreamer RealMedia Demuxer Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-2921](https://insights.sbomify.com/CVE-2026-2921/): GStreamer RIFF Palette Integer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-29207](https://insights.sbomify.com/CVE-2026-29207/): Apache OFBiz: Low-Privilege SSTI Leading to RCE in the Content Component (medium 6.5)
- [CVE-2026-29206](https://insights.sbomify.com/CVE-2026-29206/): SQL injection in WP Squared (high 8.1)
- [CVE-2026-29205](https://insights.sbomify.com/CVE-2026-29205/): Path traversal in WP Squared (high 8.6)
- [CVE-2026-29204](https://insights.sbomify.com/CVE-2026-29204/): Missing authorization in WHMCS (critical 9.1)
- [CVE-2026-29203](https://insights.sbomify.com/CVE-2026-29203/): Privilege escalation in WP Squared (medium 5.3)
- [CVE-2026-29202](https://insights.sbomify.com/CVE-2026-29202/): Code injection in WP Squared (medium 5.3)
- [CVE-2026-29201](https://insights.sbomify.com/CVE-2026-29201/): Path traversal in WP Squared (high 8.6)
- [CVE-2026-29200](https://insights.sbomify.com/CVE-2026-29200/): Missing authorization in Comet Backup (critical 9.9)
- [CVE-2026-2920](https://insights.sbomify.com/CVE-2026-2920/): GStreamer ASF Demuxer Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-29199](https://insights.sbomify.com/CVE-2026-29199/): phpBB has Password Reset Link Poisoning via Host Header injection (high 8.1)
- [CVE-2026-29198](https://insights.sbomify.com/CVE-2026-29198/): SQL injection in Rocket.Chat (critical 9.8)
- [CVE-2026-29197](https://insights.sbomify.com/CVE-2026-29197/): Missing authorization in Rocket.Chat (medium 4.3)
- [CVE-2026-29196](https://insights.sbomify.com/CVE-2026-29196/): Netmaker: Service User with Network Access Can Access config files with WireGuard Private Keys (high 8.7)
- [CVE-2026-29195](https://insights.sbomify.com/CVE-2026-29195/): Netmaker: Privilege Escalation from Admin to Super-Admin via User Update (medium 6.9)
- [CVE-2026-29194](https://insights.sbomify.com/CVE-2026-29194/): Netmaker: Insufficient Authorization in Host Token Verification (high 8.6)
- [CVE-2026-29193](https://insights.sbomify.com/CVE-2026-29193/): ZITADEL: Bypassing Zitadel Login Behavior and Security Policy in Login V2 (high 8.2)
- [CVE-2026-29192](https://insights.sbomify.com/CVE-2026-29192/): ZITADEL: Stored XSS via Default URI Redirect Leads to Account Takeover (high 7.7)
- [CVE-2026-29191](https://insights.sbomify.com/CVE-2026-29191/): ZITADEL: 1-Click Account Takeover via XSS in /saml-post Endpoint (critical 9.3)
- [CVE-2026-29190](https://insights.sbomify.com/CVE-2026-29190/): Karapace: Path Traversal in Backup Reader (medium 4.1)
- [CVE-2026-2919](https://insights.sbomify.com/CVE-2026-2919/): Attacker-controlled content shown under spoofed domains in Focus for iOS via stalled navigation and iframe redirect (medium 4.3)
- [CVE-2026-29189](https://insights.sbomify.com/CVE-2026-29189/): SuiteCRM has a REST API V8 IDOR: Missing ACL Checks on User Preferences and Relationship Endpoints (high 8.1)
- [CVE-2026-29188](https://insights.sbomify.com/CVE-2026-29188/): File Browser: TUS Delete Endpoint Bypasses Delete Permission Check (critical 9.1)
- [CVE-2026-29187](https://insights.sbomify.com/CVE-2026-29187/): OpenEMR Vulnerable to Authenticated Blind Boolean-Based SQL Injection in new_search_popup.php (high 8.1)
- [CVE-2026-29186](https://insights.sbomify.com/CVE-2026-29186/): @backstage/plugin-techdocs-node: TechDocs Mkdocs Configuration Key Enables Arbitrary Code Execution (high 7.7)
- [CVE-2026-29185](https://insights.sbomify.com/CVE-2026-29185/): @backstage/integration: Potential reading of SCM URLs using built in token (low 2.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/738/