# Vulnerabilities published in 2026


- [CVE-2026-26945](https://insights.sbomify.com/CVE-2026-26945/): Other in Integrated Dell Remote Access Controller (medium 5.3)
- [CVE-2026-26944](https://insights.sbomify.com/CVE-2026-26944/): Auth bypass in PowerProtect Data Domain (high 8.8)
- [CVE-2026-26943](https://insights.sbomify.com/CVE-2026-26943/): Command injection in PowerProtect Data Domain (high 7.2)
- [CVE-2026-26942](https://insights.sbomify.com/CVE-2026-26942/): Command injection in PowerProtect Data Domain (medium 6.7)
- [CVE-2026-26940](https://insights.sbomify.com/CVE-2026-26940/): Improper Validation of Specified Quantity in Input in Kibana Leading to Denial of Service (medium 6.5)
- [CVE-2026-2694](https://insights.sbomify.com/CVE-2026-2694/): Missing authorization in The Events Calendar (medium 5.4)
- [CVE-2026-26939](https://insights.sbomify.com/CVE-2026-26939/): Missing Authorization in Kibana Leading to Unauthorized Endpoint Response Action Configuration (medium 6.5)
- [CVE-2026-26938](https://insights.sbomify.com/CVE-2026-26938/): Code injection in Kibana (high 8.6)
- [CVE-2026-26937](https://insights.sbomify.com/CVE-2026-26937/): Uncontrolled Resource Consumption in Kibana Leading to Denial of Service (medium 6.5)
- [CVE-2026-26936](https://insights.sbomify.com/CVE-2026-26936/): Inefficient Regular Expression Complexity in Kibana Leading to Denial of Service (medium 4.9)
- [CVE-2026-26935](https://insights.sbomify.com/CVE-2026-26935/): Improper Input Validation in Kibana Leading to Denial of Service (medium 6.5)
- [CVE-2026-26934](https://insights.sbomify.com/CVE-2026-26934/): Improper Validation of Specified Quantity in Input in Kibana Leading to Denial of Service (medium 6.5)
- [CVE-2026-26933](https://insights.sbomify.com/CVE-2026-26933/): Improper Validation of Array Index in Packetbeat Leading to Denial of Service (medium 5.7)
- [CVE-2026-26932](https://insights.sbomify.com/CVE-2026-26932/): Improper Validation of Array Index in Packetbeat Leading to Denial of Service (medium 5.7)
- [CVE-2026-26931](https://insights.sbomify.com/CVE-2026-26931/): Memory Allocation with Excessive Size Value in Metricbeat Leading to Denial of Service (medium 5.7)
- [CVE-2026-26930](https://insights.sbomify.com/CVE-2026-26930/): Cross-site scripting in SmarterMail (high 7.2)
- [CVE-2026-2693](https://insights.sbomify.com/CVE-2026-2693/): CoCoTeaNet CyreneAdmin System Info Endpoint getCount improper authorization (medium 5.3)
- [CVE-2026-26929](https://insights.sbomify.com/CVE-2026-26929/): Apache Airflow: Wildcard DagVersion Listing Bypasses Per‑DAG RBAC and Leaks Metadata (medium 6.5)
- [CVE-2026-26928](https://insights.sbomify.com/CVE-2026-26928/): Lack of Dynamic Library Validation in SzafirHost (high 8.7)
- [CVE-2026-26927](https://insights.sbomify.com/CVE-2026-26927/): URL (HTTP Origin) call location spoofing in Szafir SDK Web (medium 5.1)
- [CVE-2026-2692](https://insights.sbomify.com/CVE-2026-2692/): CoCoTeaNet CyreneAdmin Image getAvatar path traversal (medium 5.3)
- [CVE-2026-2691](https://insights.sbomify.com/CVE-2026-2691/): itsourcecode Event Management System manage_register.php sql injection (medium 6.9)
- [CVE-2026-2690](https://insights.sbomify.com/CVE-2026-2690/): itsourcecode Event Management System Admin Login ajax.php sql injection (medium 6.9)
- [CVE-2026-26899](https://insights.sbomify.com/CVE-2026-26899/): An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR #15 (< 2026-01-17). (high 8.8)
- [CVE-2026-26897](https://insights.sbomify.com/CVE-2026-26897/): An issue in EcoOnline EHS (com.airsweb.v10) application for Android, version 0.2.499 allows a remote attacker to obtain sensitive informatio (critical 9.8)
- [CVE-2026-26895](https://insights.sbomify.com/CVE-2026-26895/): Information disclosure in enhancesoft:osticket (medium 5.3)
- [CVE-2026-26892](https://insights.sbomify.com/CVE-2026-26892/): SQL injection in oretnom23:simple logistic hub parcel\'s management system (low 2.7)
- [CVE-2026-26891](https://insights.sbomify.com/CVE-2026-26891/): SQL injection in oretnom23:simple logistic hub parcel\'s management system (low 2.7)
- [CVE-2026-26890](https://insights.sbomify.com/CVE-2026-26890/): SQL injection in oretnom23:pharmacy point of sale system (low 2.7)
- [CVE-2026-2689](https://insights.sbomify.com/CVE-2026-2689/): itsourcecode Event Management System manage_booking.php sql injection (medium 6.9)
- [CVE-2026-26889](https://insights.sbomify.com/CVE-2026-26889/): SQL injection in oretnom23:pharmacy point of sale system (low 2.7)
- [CVE-2026-26888](https://insights.sbomify.com/CVE-2026-26888/): SQL injection in oretnom23:pharmacy point of sale system (low 2.7)
- [CVE-2026-26887](https://insights.sbomify.com/CVE-2026-26887/): SQL injection in oretnom23:pharmacy point of sale system (low 2.7)
- [CVE-2026-26886](https://insights.sbomify.com/CVE-2026-26886/): SQL injection in oretnom23:simple online men\'s salon management system (low 2.7)
- [CVE-2026-26885](https://insights.sbomify.com/CVE-2026-26885/): SQL injection in oretnom23:simple online men\'s salon management system (low 2.7)
- [CVE-2026-26884](https://insights.sbomify.com/CVE-2026-26884/): SQL injection in oretnom23:simple online men\'s salon management system (low 2.7)
- [CVE-2026-26883](https://insights.sbomify.com/CVE-2026-26883/): SQL injection in oretnom23:simple online men\'s salon management system (low 2.7)
- [CVE-2026-2688](https://insights.sbomify.com/CVE-2026-2688/): CM HIPAA Forms < 3.2.0 - Unauthenticated Authorization Bypass (medium 6.5)
- [CVE-2026-2687](https://insights.sbomify.com/CVE-2026-2687/): Reading progressbar < 1.3.1 - Admin+ Stored XSS (medium 4.3)
- [CVE-2026-26862](https://insights.sbomify.com/CVE-2026-26862/): CleverTap Web SDK is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage (high 8.3)
- [CVE-2026-26861](https://insights.sbomify.com/CVE-2026-26861/): CleverTap Web SDK is vulnerable to DOM-based XSS via handleCustomHtmlPreviewPostMessageEvent function (high 8.3)
- [CVE-2026-2686](https://insights.sbomify.com/CVE-2026-2686/): SECCN Dingcheng G10 session_login.cgi qq os command injection (critical 9.3)
- [CVE-2026-26846](https://insights.sbomify.com/CVE-2026-26846/): Buffer Overflow vulnerability in WEINVEIW CO.,LTD EBPro v.6.10.01.510_20251022 allows a remote attacker to execute arbitrary code via the Ut (critical 9.8)
- [CVE-2026-2684](https://insights.sbomify.com/CVE-2026-2684/): Tsinghua Unigroup Electronic Archives System uploadFile.html unrestricted upload (medium 6.9)
- [CVE-2026-26833](https://insights.sbomify.com/CVE-2026-26833/): thumbler allows OS Command Injection (critical 9.8)
- [CVE-2026-26832](https://insights.sbomify.com/CVE-2026-26832/): node-tesseract-ocr is vulnerable to OS Command Injection through unsanitized recognize() function parameter (critical 9.8)
- [CVE-2026-26831](https://insights.sbomify.com/CVE-2026-26831/): textract is vulnerable to OS Command Injection (critical 9.8)
- [CVE-2026-26830](https://insights.sbomify.com/CVE-2026-26830/): pdf-image has an OS Command Injection Vulnerability through its pdfFilePath parameter (critical 9.8)
- [CVE-2026-2683](https://insights.sbomify.com/CVE-2026-2683/): Tsinghua Unigroup Electronic Archives System downLoad.html path traversal (medium 5.3)
- [CVE-2026-26829](https://insights.sbomify.com/CVE-2026-26829/): A NULL pointer dereference in the safe_atou64 function (src/misc.c) of owntone-server through commit c4d57aa allows attackers to cause a Den (high 7.5)
- [CVE-2026-26828](https://insights.sbomify.com/CVE-2026-26828/): A NULL pointer dereference in the daap_reply_playlists function (src/httpd_daap.c) of owntone-server commit 3d1652d allows attackers to caus (high 7.5)
- [CVE-2026-26825](https://insights.sbomify.com/CVE-2026-26825/): Memory corruption in libxls project:libxls (medium 5.3)
- [CVE-2026-26824](https://insights.sbomify.com/CVE-2026-26824/): Memory corruption in libxls project:libxls (medium 6.5)
- [CVE-2026-2682](https://insights.sbomify.com/CVE-2026-2682/): Tsinghua Unigroup Electronic Archives System prinReport.html sql injection (medium 5.3)
- [CVE-2026-2681](https://insights.sbomify.com/CVE-2026-2681/): A flaw was found in the blst cryptographic library. (medium 5.3)
- [CVE-2026-26801](https://insights.sbomify.com/CVE-2026-26801/): pdfmake is vulnerable to server-side request forgery (SSRF) (high 7.5)
- [CVE-2026-2680](https://insights.sbomify.com/CVE-2026-2680/): Multiple vulnerabilities in A3factura software (medium 4.8)
- [CVE-2026-26795](https://insights.sbomify.com/CVE-2026-26795/): Command injection in gl-inet:ar300m16 firmware (critical 9.8)
- [CVE-2026-26794](https://insights.sbomify.com/CVE-2026-26794/): SQL injection in gl-inet:ar300m16 firmware (high 8.8)
- [CVE-2026-26793](https://insights.sbomify.com/CVE-2026-26793/): Command injection in gl-inet:ar300m16 firmware (critical 9.8)
- [CVE-2026-26792](https://insights.sbomify.com/CVE-2026-26792/): Command injection in gl-inet:ar300m16 firmware (critical 9.8)
- [CVE-2026-26791](https://insights.sbomify.com/CVE-2026-26791/): Command injection in gl-inet:ar300m16 firmware (critical 9.8)
- [CVE-2026-2679](https://insights.sbomify.com/CVE-2026-2679/): Multiple vulnerabilities in A3factura software (medium 4.8)
- [CVE-2026-2678](https://insights.sbomify.com/CVE-2026-2678/): Multiple vulnerabilities in A3factura software (medium 4.8)
- [CVE-2026-2677](https://insights.sbomify.com/CVE-2026-2677/): Multiple vulnerabilities in A3factura software (medium 4.8)
- [CVE-2026-2676](https://insights.sbomify.com/CVE-2026-2676/): GoogTech sms-ssm API LoginInterceptor.java preHandle improper authorization (medium 5.3)
- [CVE-2026-2675](https://insights.sbomify.com/CVE-2026-2675/): Auth bypass in Connext Professional (medium 6.0)
- [CVE-2026-26747](https://insights.sbomify.com/CVE-2026-26747/): Business logic in monicahq:monica (critical 9.1)
- [CVE-2026-26746](https://insights.sbomify.com/CVE-2026-26746/): Path traversal in opensourcepos:open source point of sale (high 8.8)
- [CVE-2026-26745](https://insights.sbomify.com/CVE-2026-26745/): SQL injection in opensourcepos:open source point of sale (medium 5.3)
- [CVE-2026-26744](https://insights.sbomify.com/CVE-2026-26744/): Information disclosure in formalms:formalms (medium 5.3)
- [CVE-2026-26742](https://insights.sbomify.com/CVE-2026-26742/): Security feature bypass in dronecode:px4 drone autopilot (high 8.1)
- [CVE-2026-26741](https://insights.sbomify.com/CVE-2026-26741/): Business logic in dronecode:px4 drone autopilot (high 8.1)
- [CVE-2026-26740](https://insights.sbomify.com/CVE-2026-26740/): Memory corruption in giflib project:giflib (high 8.2)
- [CVE-2026-2674](https://insights.sbomify.com/CVE-2026-2674/): Memory corruption in Connext Professional (medium 4.8)
- [CVE-2026-26738](https://insights.sbomify.com/CVE-2026-26738/): Memory corruption in uderzo:spacesniffer (high 7.8)
- [CVE-2026-26736](https://insights.sbomify.com/CVE-2026-26736/): Memory corruption in totolink:a3002ru firmware (high 8.8)
- [CVE-2026-26732](https://insights.sbomify.com/CVE-2026-26732/): Memory corruption in totolink:a3002ru firmware (high 8.8)
- [CVE-2026-26731](https://insights.sbomify.com/CVE-2026-26731/): Memory corruption in totolink:a3002ru firmware (high 8.0)
- [CVE-2026-2673](https://insights.sbomify.com/CVE-2026-2673/): OpenSSL TLS 1.3 server may choose unexpected key agreement group (medium 6.5)
- [CVE-2026-26725](https://insights.sbomify.com/CVE-2026-26725/): Privilege escalation in edubusinesssolutions:print shop pro webdesk (critical 9.8)
- [CVE-2026-26724](https://insights.sbomify.com/CVE-2026-26724/): Cross-site scripting in keystorage:global facilities management software (high 7.6)
- [CVE-2026-26723](https://insights.sbomify.com/CVE-2026-26723/): Cross-site scripting in keystorage:global facilities management software (high 8.2)
- [CVE-2026-26722](https://insights.sbomify.com/CVE-2026-26722/): Privilege escalation in keystorage:global facilities management software (critical 9.4)
- [CVE-2026-26721](https://insights.sbomify.com/CVE-2026-26721/): Information disclosure in keystorage:global facilities management software (high 7.1)
- [CVE-2026-26720](https://insights.sbomify.com/CVE-2026-26720/): Code injection in twenty:twenty (critical 9.8)
- [CVE-2026-2672](https://insights.sbomify.com/CVE-2026-2672/): Tsinghua Unigroup Electronic Archives System downLoad download path traversal (medium 5.3)
- [CVE-2026-26719](https://insights.sbomify.com/CVE-2026-26719/): Cross Site Scripting vulnerability in xxl-job-admin v.3.0.0 allows a remote attacker to execute arbitrary code via a crafted HTTP GET reques (medium 6.1)
- [CVE-2026-26718](https://insights.sbomify.com/CVE-2026-26718/): A Cross-Site Request Forgery (CSRF) vulnerability exists in the xxl-job-admin web application v.3.0.0 that allows an attacker to perform una (critical 9.1)
- [CVE-2026-26717](https://insights.sbomify.com/CVE-2026-26717/): OpenFUN Richie Observable Timing Discrepancy in its sync_course_run_from_request function (medium 4.8)
- [CVE-2026-26713](https://insights.sbomify.com/CVE-2026-26713/): SQL injection in carmelo:simple food order system (critical 9.8)
- [CVE-2026-26712](https://insights.sbomify.com/CVE-2026-26712/): SQL injection in carmelo:simple food order system (critical 9.8)
- [CVE-2026-26711](https://insights.sbomify.com/CVE-2026-26711/): SQL injection in carmelo:simple food order system (critical 9.8)
- [CVE-2026-26710](https://insights.sbomify.com/CVE-2026-26710/): SQL injection in carmelo:simple food order system (critical 9.8)
- [CVE-2026-2671](https://insights.sbomify.com/CVE-2026-2671/): Mendi Neurofeedback Headset Bluetooth Low Energy cleartext transmission (low 2.3)
- [CVE-2026-26709](https://insights.sbomify.com/CVE-2026-26709/): SQL injection in carmelo:simple gym management system (critical 9.8)
- [CVE-2026-26708](https://insights.sbomify.com/CVE-2026-26708/): SQL injection in oretnom23:pharmacy point of sale system (critical 9.8)
- [CVE-2026-26707](https://insights.sbomify.com/CVE-2026-26707/): SQL injection in oretnom23:pharmacy point of sale system (critical 9.8)
- [CVE-2026-26706](https://insights.sbomify.com/CVE-2026-26706/): SQL injection in oretnom23:pharmacy point of sale system (critical 9.8)
- [CVE-2026-26705](https://insights.sbomify.com/CVE-2026-26705/): SQL injection in oretnom23:pharmacy point of sale system (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/760/