# Vulnerabilities published in 2026


- [CVE-2026-26704](https://insights.sbomify.com/CVE-2026-26704/): SQL injection in oretnom23:pharmacy point of sale system (critical 9.8)
- [CVE-2026-26703](https://insights.sbomify.com/CVE-2026-26703/): SQL injection in jon-remus-sevellejo:personnel property equipment system (critical 9.8)
- [CVE-2026-26702](https://insights.sbomify.com/CVE-2026-26702/): SQL injection in jon-remus-sevellejo:personnel property equipment system (critical 9.8)
- [CVE-2026-26701](https://insights.sbomify.com/CVE-2026-26701/): SQL injection in jon-remus-sevellejo:personnel property equipment system (critical 9.8)
- [CVE-2026-26700](https://insights.sbomify.com/CVE-2026-26700/): SQL injection in jon-remus-sevellejo:personnel property equipment system (critical 9.8)
- [CVE-2026-2670](https://insights.sbomify.com/CVE-2026-2670/): Advantech WISE-6610-NB Background Management openvpn_apply os command injection (high 8.6)
- [CVE-2026-26699](https://insights.sbomify.com/CVE-2026-26699/): Code injection in jon-remus-sevellejo:personnel property equipment system (high 7.2)
- [CVE-2026-26698](https://insights.sbomify.com/CVE-2026-26698/): SQL injection in carmelo:simple student alumni system (medium 4.9)
- [CVE-2026-26697](https://insights.sbomify.com/CVE-2026-26697/): SQL injection in carmelo:simple student alumni system (medium 4.9)
- [CVE-2026-26696](https://insights.sbomify.com/CVE-2026-26696/): SQL injection in carmelo:simple student alumni system (critical 9.8)
- [CVE-2026-26695](https://insights.sbomify.com/CVE-2026-26695/): SQL injection in carmelo:simple student alumni system (critical 9.8)
- [CVE-2026-26694](https://insights.sbomify.com/CVE-2026-26694/): SQL injection in carmelo:simple student alumni system (critical 9.8)
- [CVE-2026-2669](https://insights.sbomify.com/CVE-2026-2669/): Rongzhitong Visual Integrated Command and Dispatch Platform User delete access control (medium 6.9)
- [CVE-2026-26682](https://insights.sbomify.com/CVE-2026-26682/): Code injection in xjd2020:fastcms (high 7.8)
- [CVE-2026-2668](https://insights.sbomify.com/CVE-2026-2668/): Rongzhitong Visual Integrated Command and Dispatch Platform User add access control (medium 6.9)
- [CVE-2026-26673](https://insights.sbomify.com/CVE-2026-26673/): Denial of service in dji:mavic mini firmware (high 7.5)
- [CVE-2026-2667](https://insights.sbomify.com/CVE-2026-2667/): Rongzhitong Visual Integrated Command and Dispatch Platform api access control (medium 6.9)
- [CVE-2026-2666](https://insights.sbomify.com/CVE-2026-2666/): mingSoft MCMS Template Archive uploadTemplate.do unrestricted upload (medium 5.1)
- [CVE-2026-2665](https://insights.sbomify.com/CVE-2026-2665/): huanzi-qch base-admin JSP Parser SysFileController.java upload unrestricted upload (medium 5.3)
- [CVE-2026-2664](https://insights.sbomify.com/CVE-2026-2664/): Out of bounds read vulnerability in grpcfuse kernel module (medium 6.8)
- [CVE-2026-2663](https://insights.sbomify.com/CVE-2026-2663/): Alixhan xh-admin-backend Database Query query sql injection (medium 5.3)
- [CVE-2026-2662](https://insights.sbomify.com/CVE-2026-2662/): FascinatedBox lily lily_emitter.c count_transforms out-of-bounds (medium 4.8)
- [CVE-2026-2661](https://insights.sbomify.com/CVE-2026-2661/): Squirrel sqobject.h operator heap-based overflow (medium 4.8)
- [CVE-2026-2660](https://insights.sbomify.com/CVE-2026-2660/): FascinatedBox lily lily_symtab.c shorthash_for_name use after free (medium 4.8)
- [CVE-2026-2659](https://insights.sbomify.com/CVE-2026-2659/): Squirrel sqfuncstate.cpp PopTarget out-of-bounds (medium 4.8)
- [CVE-2026-2658](https://insights.sbomify.com/CVE-2026-2658/): newbee-ltd newbee-mall Multiple Endpoints cross-site request forgery (medium 5.3)
- [CVE-2026-2657](https://insights.sbomify.com/CVE-2026-2657/): wren-lang wren Error Message wren_compiler.c printError stack-based overflow (medium 4.8)
- [CVE-2026-2656](https://insights.sbomify.com/CVE-2026-2656/): ChaiScript type_info.hpp bare_equal use after free (low 2.0)
- [CVE-2026-2655](https://insights.sbomify.com/CVE-2026-2655/): ChaiScript chaiscript_defines.hpp operator use after free (low 2.0)
- [CVE-2026-2654](https://insights.sbomify.com/CVE-2026-2654/): huggingface smolagents LocalPythonExecutor requests.post server-side request forgery (medium 5.3)
- [CVE-2026-2653](https://insights.sbomify.com/CVE-2026-2653/): admesh normals.c stl_check_normal_vector heap-based overflow (medium 4.8)
- [CVE-2026-2652](https://insights.sbomify.com/CVE-2026-2652/): Authentication Bypass in mlflow/mlflow (high 8.6)
- [CVE-2026-26514](https://insights.sbomify.com/CVE-2026-26514/): Command injection in xddxdd:bird-lg-go (high 7.5)
- [CVE-2026-2651](https://insights.sbomify.com/CVE-2026-2651/): Missing Authorization Validation in mlflow/mlflow (critical 9.0)
- [CVE-2026-2650](https://insights.sbomify.com/CVE-2026-2650/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-2649](https://insights.sbomify.com/CVE-2026-2649/): Integer overflow in Chrome (high 8.8)
- [CVE-2026-26483](https://insights.sbomify.com/CVE-2026-26483/): Mettle SendPortal 3.0.1 and earlier contains a stored cross-site scripting (XSS) vulnerability in the template management functionality. (medium 6.1)
- [CVE-2026-2648](https://insights.sbomify.com/CVE-2026-2648/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-26478](https://insights.sbomify.com/CVE-2026-26478/): Command injection in mobvoi:tichome mini firmware (critical 9.8)
- [CVE-2026-26477](https://insights.sbomify.com/CVE-2026-26477/): Denial of service in DokuWiki (medium 4.3)
- [CVE-2026-26464](https://insights.sbomify.com/CVE-2026-26464/): Cross-site scripting in kashipara:society management system portal (medium 6.1)
- [CVE-2026-26462](https://insights.sbomify.com/CVE-2026-26462/): Offline Hospital Management System 5.3.0 allows remote code execution due to an improper Electron renderer configuration. (high 7.3)
- [CVE-2026-26461](https://insights.sbomify.com/CVE-2026-26461/): A Command Injection vulnerability in the web management interface in Aver PTC320UV2 0.1.0000.65 allows an unauthenticated attacker to execut (medium 6.5)
- [CVE-2026-26460](https://insights.sbomify.com/CVE-2026-26460/): A HTML Injection vulnerability exists in the Dashboard module of Vtiger CRM 8.4.0. (medium 6.1)
- [CVE-2026-2646](https://insights.sbomify.com/CVE-2026-2646/): Heap buffer overflow in session parsing with wolfSSL_d2i_SSL_SESSION() function (medium 5.0)
- [CVE-2026-26459](https://insights.sbomify.com/CVE-2026-26459/): ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 contains a vulnerability in the option parsing logic that causes a segmentation fault when pr (high 7.5)
- [CVE-2026-26457](https://insights.sbomify.com/CVE-2026-26457/): ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 contains a null pointer dereference vulnerability in the coap_dump_msg() function when proces (high 7.5)
- [CVE-2026-26456](https://insights.sbomify.com/CVE-2026-26456/): A null pointer dereference vulnerability exists in the server-side session management logic of ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5. (high 7.5)
- [CVE-2026-26453](https://insights.sbomify.com/CVE-2026-26453/): ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 contains a null pointer dereference vulnerability in the coap_server_handle_session() functio (high 7.5)
- [CVE-2026-26452](https://insights.sbomify.com/CVE-2026-26452/): ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 lcontains a vulnerability in the option parsing logic that causes a segmentation fault when p (high 7.5)
- [CVE-2026-2645](https://insights.sbomify.com/CVE-2026-2645/): Acceptance of CertificateVerify Message before ClientKeyExchange in TLS 1.2 (medium 5.5)
- [CVE-2026-26449](https://insights.sbomify.com/CVE-2026-26449/): In Stomper 5e2741e when a client sends a SEND frame missing the destination header field, the server triggers a null pointer dereference (or (high 7.5)
- [CVE-2026-26448](https://insights.sbomify.com/CVE-2026-26448/): Stomper 5e2741e is vulnerable to Use-After-Free. (critical 9.8)
- [CVE-2026-26447](https://insights.sbomify.com/CVE-2026-26447/): Stomper 5e2741e is vulnerable to Use-After-Free. (high 7.5)
- [CVE-2026-26446](https://insights.sbomify.com/CVE-2026-26446/): Stomper 5e2741e is vulnerable to Denial of Service. (high 7.5)
- [CVE-2026-26445](https://insights.sbomify.com/CVE-2026-26445/): stomper 5e2741e is vulnerable to Denial of Service. (high 7.5)
- [CVE-2026-2644](https://insights.sbomify.com/CVE-2026-2644/): niklasso minisat DIMACS File SolverTypes.h value out-of-bounds (medium 4.8)
- [CVE-2026-26422](https://insights.sbomify.com/CVE-2026-26422/): Misconfiguration in clash-verge-service-ipc (high 8.4)
- [CVE-2026-2642](https://insights.sbomify.com/CVE-2026-2642/): ggreer the_silver_searcher search.c search_stream null pointer dereference (medium 4.8)
- [CVE-2026-26418](https://insights.sbomify.com/CVE-2026-26418/): Missing authorization in tcs:cognix platform (high 7.5)
- [CVE-2026-26417](https://insights.sbomify.com/CVE-2026-26417/): Missing authorization in tcs:cognix platform (high 8.1)
- [CVE-2026-26416](https://insights.sbomify.com/CVE-2026-26416/): Privilege escalation in tcs:cognix platform (high 8.8)
- [CVE-2026-2641](https://insights.sbomify.com/CVE-2026-2641/): universal-ctags V Language v.c parseExprList recursion (medium 4.8)
- [CVE-2026-2640](https://insights.sbomify.com/CVE-2026-2640/): Privilege escalation in PC Manager (medium 6.8)
- [CVE-2026-26399](https://insights.sbomify.com/CVE-2026-26399/): A stack-use-after-return issue exists in the Arduino_Core_STM32 library prior to version 1.7.0. (medium 5.3)
- [CVE-2026-26396](https://insights.sbomify.com/CVE-2026-26396/): OpenBMB XAgent v1.0.0 and before is vulnerable to path traversal in the file() function in XAgent/XAgentServer/application/routers/workspace.py. (high 7.5)
- [CVE-2026-2638](https://insights.sbomify.com/CVE-2026-2638/): X-VPN macOS website versions - Local Privilege Escalation (high 7.3)
- [CVE-2026-26379](https://insights.sbomify.com/CVE-2026-26379/): Server-side request forgery in koha:koha (medium 6.5)
- [CVE-2026-26378](https://insights.sbomify.com/CVE-2026-26378/): Cross-site scripting in koha:koha (medium 5.4)
- [CVE-2026-26377](https://insights.sbomify.com/CVE-2026-26377/): Cross-site scripting in koha:koha (medium 5.4)
- [CVE-2026-26370](https://insights.sbomify.com/CVE-2026-26370/): Cross-site scripting in Survey Maker (medium 5.1)
- [CVE-2026-2637](https://insights.sbomify.com/CVE-2026-2637/): Privilege escalation in iBoysoft NTFS (high 8.5)
- [CVE-2026-26369](https://insights.sbomify.com/CVE-2026-26369/): JUNG eNet SMART HOME server 2.2.1/2.3.1 Privilege Escalation via setUserGroup (high 8.7)
- [CVE-2026-26368](https://insights.sbomify.com/CVE-2026-26368/): JUNG eNet SMART HOME server 2.2.1/2.3.1 Account Takeover via resetUserPassword (high 8.7)
- [CVE-2026-26367](https://insights.sbomify.com/CVE-2026-26367/): JUNG eNet SMART HOME server 2.2.1/2.3.1 Arbitrary User Deletion via deleteUserAccount (high 7.1)
- [CVE-2026-26366](https://insights.sbomify.com/CVE-2026-26366/): JUNG eNet SMART HOME server 2.2.1/2.3.1 Use of Default Credentials (critical 9.3)
- [CVE-2026-26365](https://insights.sbomify.com/CVE-2026-26365/): Other in Ghost (medium 4.0)
- [CVE-2026-26362](https://insights.sbomify.com/CVE-2026-26362/): Path traversal in PowerMax (high 8.1)
- [CVE-2026-26361](https://insights.sbomify.com/CVE-2026-26361/): Path traversal in PowerMax (medium 6.5)
- [CVE-2026-26360](https://insights.sbomify.com/CVE-2026-26360/): Path traversal in PowerMax (high 8.1)
- [CVE-2026-2636](https://insights.sbomify.com/CVE-2026-2636/): Denial of Service in Microsoft OS (medium 5.5)
- [CVE-2026-26359](https://insights.sbomify.com/CVE-2026-26359/): Path traversal in PowerMax (high 8.8)
- [CVE-2026-26358](https://insights.sbomify.com/CVE-2026-26358/): Missing authorization in PowerMax (high 8.8)
- [CVE-2026-26357](https://insights.sbomify.com/CVE-2026-26357/): Cross-site scripting in Unisphere for PowerMax 9.2.4.18 (medium 5.4)
- [CVE-2026-26355](https://insights.sbomify.com/CVE-2026-26355/): Command injection in PowerProtect Data Domain (medium 6.5)
- [CVE-2026-26354](https://insights.sbomify.com/CVE-2026-26354/): Memory corruption in PowerProtect Data Domain (high 8.1)
- [CVE-2026-26352](https://insights.sbomify.com/CVE-2026-26352/): Smoothwall Express < 3.1 Update 13 Stored XSS in vpnmain.cgi via VPN_IP Parameter (medium 5.1)
- [CVE-2026-26351](https://insights.sbomify.com/CVE-2026-26351/): GetSimpleCMS-CE < 3.3.22 Stored XSS via components.php (medium 4.8)
- [CVE-2026-2635](https://insights.sbomify.com/CVE-2026-2635/): MLflow Use of Default Password Authentication Bypass Vulnerability (critical 9.8)
- [CVE-2026-26345](https://insights.sbomify.com/CVE-2026-26345/): SPIP < 4.4.8 Cross-Site Scripting in Public Area (high 8.6)
- [CVE-2026-26342](https://insights.sbomify.com/CVE-2026-26342/): Tattile Smart+ / Vega / Basic <= 1.181.5 Insufficient Session Token Expiration (high 8.7)
- [CVE-2026-26341](https://insights.sbomify.com/CVE-2026-26341/): Tattile Smart+ / Vega / Basic <= 1.181.5 Default Credentials (critical 9.3)
- [CVE-2026-26340](https://insights.sbomify.com/CVE-2026-26340/): Tattile Smart+ / Vega / Basic <= 1.181.5 Unauthenticated RTSP Stream Disclosure (high 8.7)
- [CVE-2026-2634](https://insights.sbomify.com/CVE-2026-2634/): Spoofed web content presented under trusted domains using scripted navigation on Firefox iOS (critical 9.8)
- [CVE-2026-26339](https://insights.sbomify.com/CVE-2026-26339/): Hyland Alfresco Transformation Service Argument Injection RCE (critical 9.3)
- [CVE-2026-26338](https://insights.sbomify.com/CVE-2026-26338/): Hyland Alfresco Transformation Service SSRF (medium 6.9)
- [CVE-2026-26337](https://insights.sbomify.com/CVE-2026-26337/): Hyland Alfresco Transformation Service Absolute Path Traversal Arbitrary File Read and SSRF (high 8.8)
- [CVE-2026-26336](https://insights.sbomify.com/CVE-2026-26336/): Hyland Alfresco Improper Authorization Arbitrary File Read (high 8.7)
- [CVE-2026-26335](https://insights.sbomify.com/CVE-2026-26335/): Calero VeraSMART < 2022 R1 Static IIS Machine Keys Enable ViewState RCE (critical 9.3)
- [CVE-2026-26334](https://insights.sbomify.com/CVE-2026-26334/): Calero VeraSMART < 2026 R1 Hardcoded Static AES Keys Allow Decryption of Service Credentials (high 8.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/761/