# Vulnerabilities published in 2026


- [CVE-2026-24848](https://insights.sbomify.com/CVE-2026-24848/): OpenEMR Arbitrary File Write leading to Remote Code Execution (high 8.7)
- [CVE-2026-24847](https://insights.sbomify.com/CVE-2026-24847/): OpenEMR has Open Redirect in Eye Exam Form (medium 6.1)
- [CVE-2026-24846](https://insights.sbomify.com/CVE-2026-24846/): malcontent's archive extraction could write outside extraction directory (medium 5.5)
- [CVE-2026-24845](https://insights.sbomify.com/CVE-2026-24845/): malcontent's OCI image scanning could expose registry credentials (medium 6.5)
- [CVE-2026-24844](https://insights.sbomify.com/CVE-2026-24844/): melange pipeline working-directory could allow command injection (high 7.8)
- [CVE-2026-24843](https://insights.sbomify.com/CVE-2026-24843/): melange QEMU runner could write files outside workspace directory (high 8.2)
- [CVE-2026-24842](https://insights.sbomify.com/CVE-2026-24842/): node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal (high 8.2)
- [CVE-2026-24841](https://insights.sbomify.com/CVE-2026-24841/): Command injection in dokploy (critical 9.9)
- [CVE-2026-24840](https://insights.sbomify.com/CVE-2026-24840/): Dokploy uses hardcoded credentials in installation script, which could result in database access (high 8.0)
- [CVE-2026-2484](https://insights.sbomify.com/CVE-2026-2484/): IBM InfoSphere Information Server Information Disclosure (medium 4.3)
- [CVE-2026-24839](https://insights.sbomify.com/CVE-2026-24839/): Dokploy has a clickjacking vulnerability - Missing X-Frame-Options and CSP frame-ancestors headers (medium 4.7)
- [CVE-2026-24838](https://insights.sbomify.com/CVE-2026-24838/): DotNetNuke.Core Vulnerable to Stored XSS via Module Title (critical 9.1)
- [CVE-2026-24837](https://insights.sbomify.com/CVE-2026-24837/): DotNetNuke.Core Vulnerable to Stored XSS in Module Deletion Confirmation Modal (high 7.7)
- [CVE-2026-24836](https://insights.sbomify.com/CVE-2026-24836/): DotNetNuke.Core Vulnerable to Stored XSS in Scheduler LogNotes (high 7.7)
- [CVE-2026-24835](https://insights.sbomify.com/CVE-2026-24835/): Podman Desktop Extension System Vulnerable to Authentication Bypass (high 8.8)
- [CVE-2026-24834](https://insights.sbomify.com/CVE-2026-24834/): Kata Container to Guest micro VM privilege escalation (critical 9.4)
- [CVE-2026-24833](https://insights.sbomify.com/CVE-2026-24833/): DotNetNuke.Core Vulnerable to Stored XSS in Module Description (high 7.7)
- [CVE-2026-24832](https://insights.sbomify.com/CVE-2026-24832/): Out-of-bounds write in ixray-1.6-stcop (critical 9.8)
- [CVE-2026-24831](https://insights.sbomify.com/CVE-2026-24831/): Infinite loop (DoS) in ixray-1.6-stcop (high 7.5)
- [CVE-2026-24830](https://insights.sbomify.com/CVE-2026-24830/): Integer Overflow or Wraparound in IronOS (critical 9.8)
- [CVE-2026-2483](https://insights.sbomify.com/CVE-2026-2483/): IBM InfoSphere Information Server Cross-Site Scripting (medium 5.4)
- [CVE-2026-24829](https://insights.sbomify.com/CVE-2026-24829/): Out-of-bounds write in is-Engine (medium 6.5)
- [CVE-2026-24828](https://insights.sbomify.com/CVE-2026-24828/): Memory leak in is-Engine (high 7.5)
- [CVE-2026-24827](https://insights.sbomify.com/CVE-2026-24827/): Out-of-bounds write in Commander-Genius (high 7.5)
- [CVE-2026-24826](https://insights.sbomify.com/CVE-2026-24826/): Out-of-bounds write in turso3d (critical 10.0)
- [CVE-2026-24825](https://insights.sbomify.com/CVE-2026-24825/): Denial of service in ydb (medium 6.9)
- [CVE-2026-24824](https://insights.sbomify.com/CVE-2026-24824/): A XSS in yacy/yacy_search_server (medium 6.9)
- [CVE-2026-24823](https://insights.sbomify.com/CVE-2026-24823/): A heap-based buffer over-read or buffer overflow vulnerability in FASTSHIFT/X-TRACK (critical 10.0)
- [CVE-2026-24822](https://insights.sbomify.com/CVE-2026-24822/): a heap-based buffer overflow vulnerability in ttttupup/wxhelper via src/mongoose. (critical 10.0)
- [CVE-2026-24821](https://insights.sbomify.com/CVE-2026-24821/): A heap-based buffer over-read that might affect a system that compiles untrusted Lua code in turanszkij/WickedEngine. (critical 9.3)
- [CVE-2026-24820](https://insights.sbomify.com/CVE-2026-24820/): A stack overflow vulnerability in turanszkij/WickedEngine (medium 5.1)
- [CVE-2026-2482](https://insights.sbomify.com/CVE-2026-2482/): IBM WebSphere Application Server Liberty is affected by a cross-site request forgery (low 3.1)
- [CVE-2026-24819](https://insights.sbomify.com/CVE-2026-24819/): An out-of-memory (OOM) issue in foxinmy/weixin4j (medium 6.3)
- [CVE-2026-24818](https://insights.sbomify.com/CVE-2026-24818/): A heap-based buffer over-read that might affect a system that compiles untrusted Lua code in praydog/UEVR (medium 6.9)
- [CVE-2026-24817](https://insights.sbomify.com/CVE-2026-24817/): A potential heap-buffer overflow in praydog/UEVR (high 8.7)
- [CVE-2026-24816](https://insights.sbomify.com/CVE-2026-24816/): Cookie Security Vulnerabilities in datavane/tis (critical 10.0)
- [CVE-2026-24815](https://insights.sbomify.com/CVE-2026-24815/): A XStream Security Vulnerability in XML Deserialization in datavane/tis (critical 10.0)
- [CVE-2026-24814](https://insights.sbomify.com/CVE-2026-24814/): A integer overflow in swoole/swoole-src (critical 10.0)
- [CVE-2026-24813](https://insights.sbomify.com/CVE-2026-24813/): A null pointer dereference in abcz316/SKRoot-linuxKernelRoot (high 8.7)
- [CVE-2026-24812](https://insights.sbomify.com/CVE-2026-24812/): An improper pointer arithmetic in root-project/root at builtins/zlib/inftrees.c (critical 9.3)
- [CVE-2026-24811](https://insights.sbomify.com/CVE-2026-24811/): An improper pointer arithmetic in root-project/root at builtins/zlib/inffast.c (critical 9.3)
- [CVE-2026-24810](https://insights.sbomify.com/CVE-2026-24810/): A buffer overflow in rethinkdb/rethinkdb (critical 10.0)
- [CVE-2026-2481](https://insights.sbomify.com/CVE-2026-2481/): Cross-site scripting in Beaver Builder Page Builder – Drag and Drop Website Builder (medium 6.4)
- [CVE-2026-24809](https://insights.sbomify.com/CVE-2026-24809/): Save stack space while handling errors in praydog/REFramework (medium 6.9)
- [CVE-2026-24808](https://insights.sbomify.com/CVE-2026-24808/): A possible integer overflow vulnerability in RawTherapee/RawTherapee (high 8.3)
- [CVE-2026-24807](https://insights.sbomify.com/CVE-2026-24807/): Buffer Overflow Vulnerability in liuyueyi/quick-media (medium 5.3)
- [CVE-2026-24806](https://insights.sbomify.com/CVE-2026-24806/): Buffer Write Security Vulnerability in liuyueyi/quick-media (medium 5.3)
- [CVE-2026-24805](https://insights.sbomify.com/CVE-2026-24805/): Mishandles certain out-of-memory conditions in visualfc/liteide via liteidex/src/3rdparty/libvterm/src module (medium 6.7)
- [CVE-2026-24804](https://insights.sbomify.com/CVE-2026-24804/): A infinite loop vulnerability in coolsnowwolf/lede (critical 9.2)
- [CVE-2026-24803](https://insights.sbomify.com/CVE-2026-24803/): A possible infinite loop vulnerability in coolsnowwolf/lede (critical 9.2)
- [CVE-2026-24802](https://insights.sbomify.com/CVE-2026-24802/): Buffer Overflow Vulnerability in briandilley/jsonrpc4j (medium 5.3)
- [CVE-2026-24801](https://insights.sbomify.com/CVE-2026-24801/): A Potential SPA-vulnerability in Ralim/IronOS (medium 6.9)
- [CVE-2026-24800](https://insights.sbomify.com/CVE-2026-24800/): A heap-based buffer over-read or buffer overflow in tildearrow/furnace (critical 10.0)
- [CVE-2026-2480](https://insights.sbomify.com/CVE-2026-2480/): Cross-site scripting in WP Shortcodes Plugin — Shortcodes Ultimate (medium 6.4)
- [CVE-2026-24799](https://insights.sbomify.com/CVE-2026-24799/): A heap-based buffer over-read or buffer overflow in davisking/dlib (medium 5.2)
- [CVE-2026-24798](https://insights.sbomify.com/CVE-2026-24798/): An Uninitialized stack variable vulnerability in GaijinEntertainment/DagorEngine (critical 9.3)
- [CVE-2026-24797](https://insights.sbomify.com/CVE-2026-24797/): An out of bounds write due to a missing bounds check in neka-nat/cupoch (medium 6.9)
- [CVE-2026-24796](https://insights.sbomify.com/CVE-2026-24796/): A Out-of-bounds Read vulnerability in CloverHackyColor/CloverBootloader (medium 6.9)
- [CVE-2026-24795](https://insights.sbomify.com/CVE-2026-24795/): An Out-of-bounds Write in CloverHackyColor/CloverBootloader (medium 5.1)
- [CVE-2026-24794](https://insights.sbomify.com/CVE-2026-24794/): Chunk Unloading Security Vulnerability in CardboardPowered/cardboard (critical 9.2)
- [CVE-2026-24793](https://insights.sbomify.com/CVE-2026-24793/): A heap-based buffer over-read or buffer overflow vulnerability in azerothcore/azerothcore-wotlk (critical 10.0)
- [CVE-2026-24792](https://insights.sbomify.com/CVE-2026-24792/): web_webview has a Race Condition vulnerability (high 8.1)
- [CVE-2026-24791](https://insights.sbomify.com/CVE-2026-24791/): Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes (high 8.1)
- [CVE-2026-24790](https://insights.sbomify.com/CVE-2026-24790/): Welker OdorEyes EcoSystem Pulse Bypass System with XL4 Controller Missing Authentication for Critical Function (high 8.2)
- [CVE-2026-2479](https://insights.sbomify.com/CVE-2026-2479/): Server-side request forgery in Responsive Lightbox & Gallery (medium 5.0)
- [CVE-2026-24789](https://insights.sbomify.com/CVE-2026-24789/): ZLAN Information Technology ZLAN5143D Missing Authentication for Critical Function (critical 9.3)
- [CVE-2026-24788](https://insights.sbomify.com/CVE-2026-24788/): RaspAP raspap-webgui contains an OS Command Injection vulnerability (high 8.7)
- [CVE-2026-24785](https://insights.sbomify.com/CVE-2026-24785/): Clatter has a PSK Validity Rule Violation issue (high 8.0)
- [CVE-2026-24784](https://insights.sbomify.com/CVE-2026-24784/): DotNetNuke.Core has a potential XSS vulnerability in modules' header and footer (medium 6.8)
- [CVE-2026-24783](https://insights.sbomify.com/CVE-2026-24783/): soroban-fixed-point-math has Incorrect Rounding and Overflow Handling in Signed Fixed-Point Math with Negatives (high 7.5)
- [CVE-2026-24782](https://insights.sbomify.com/CVE-2026-24782/): Kiteworks Secure Data Forms has a SQL Injection vulnerability (high 7.6)
- [CVE-2026-24781](https://insights.sbomify.com/CVE-2026-24781/): vm2: Sandbox Breakout Through Inspect (critical 9.8)
- [CVE-2026-24780](https://insights.sbomify.com/CVE-2026-24780/): AutoGPT is Vulnerable to RCE via Disabled Block Execution (high 8.6)
- [CVE-2026-24779](https://insights.sbomify.com/CVE-2026-24779/): vLLM vulnerable to Server-Side Request Forgery (SSRF) in `MediaConnector` (high 7.1)
- [CVE-2026-24778](https://insights.sbomify.com/CVE-2026-24778/): Ghost vulnerable to XSS via malicious Portal preview links (high 8.8)
- [CVE-2026-24777](https://insights.sbomify.com/CVE-2026-24777/): OpenProject has Improper Access Control on User Management allows user managers to lock admin accounts (medium 6.7)
- [CVE-2026-24776](https://insights.sbomify.com/CVE-2026-24776/): OpenProject has an IDOR on MeetingAgendaItems allows cross-project meeting agenda item transfer (medium 4.3)
- [CVE-2026-24775](https://insights.sbomify.com/CVE-2026-24775/): Server-side request forgery in openproject (medium 6.3)
- [CVE-2026-24774](https://insights.sbomify.com/CVE-2026-24774/): Open eClass Business Logic Flaw Allows Students to Mark Attendance in Expired Activities (medium 4.3)
- [CVE-2026-24773](https://insights.sbomify.com/CVE-2026-24773/): Open eClass Unauthenticated IDOR Allows Access to Arbitrary User Files (high 7.5)
- [CVE-2026-24772](https://insights.sbomify.com/CVE-2026-24772/): OpenProject has SSRF and CSWSH in Hocuspocus Synchronization Server (high 8.9)
- [CVE-2026-24771](https://insights.sbomify.com/CVE-2026-24771/): Hono has a Cross-site Scripting vulnerability (medium 4.7)
- [CVE-2026-24770](https://insights.sbomify.com/CVE-2026-24770/): RAGFlow Affected by Zip Slip Remote Code Execution (RCE) in MinerUParser (critical 9.8)
- [CVE-2026-24769](https://insights.sbomify.com/CVE-2026-24769/): NocoDB Vulnerable to Stored Cross-Site Scripting via SVG upload (high 8.5)
- [CVE-2026-24768](https://insights.sbomify.com/CVE-2026-24768/): NocoDB has Unvalidated Redirect in Login Flow via continueAfterSignIn Parameter (medium 5.7)
- [CVE-2026-24767](https://insights.sbomify.com/CVE-2026-24767/): NocoDB has Blind SSRF via Unvalidated HEAD Request in uploadViaURL Functionality (medium 4.9)
- [CVE-2026-24766](https://insights.sbomify.com/CVE-2026-24766/): NocoDB Vulnerable to Prototype Pollution in Connection Test Endpoint, Leading to DoS (medium 4.9)
- [CVE-2026-24765](https://insights.sbomify.com/CVE-2026-24765/): PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling (high 7.8)
- [CVE-2026-24764](https://insights.sbomify.com/CVE-2026-24764/): OpenClaw has Remote Code Execution via System Prompt Injection in Slack Channel Descriptions (low 3.7)
- [CVE-2026-24763](https://insights.sbomify.com/CVE-2026-24763/): Authenticated Command Injection in OpenClaw Docker Execution via PATH Environment Variable (high 8.8)
- [CVE-2026-24762](https://insights.sbomify.com/CVE-2026-24762/): RustFS Logs Sensitive Credentials in Plaintext (medium 6.9)
- [CVE-2026-24761](https://insights.sbomify.com/CVE-2026-24761/): Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key (low 3.7)
- [CVE-2026-2476](https://insights.sbomify.com/CVE-2026-2476/): MS Teams plugin sensitive config values not properly masked in support packets (high 7.6)
- [CVE-2026-24756](https://insights.sbomify.com/CVE-2026-24756/): Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key (medium 4.3)
- [CVE-2026-24755](https://insights.sbomify.com/CVE-2026-24755/): Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key (medium 5.4)
- [CVE-2026-24754](https://insights.sbomify.com/CVE-2026-24754/): Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting (medium 5.4)
- [CVE-2026-24753](https://insights.sbomify.com/CVE-2026-24753/): Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key (medium 6.5)
- [CVE-2026-24752](https://insights.sbomify.com/CVE-2026-24752/): Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting (high 8.2)
- [CVE-2026-24751](https://insights.sbomify.com/CVE-2026-24751/): Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting (high 8.2)
- [CVE-2026-24750](https://insights.sbomify.com/CVE-2026-24750/): Kiteworks Secure Data Forms vulnerable to Cross-site Scripting (high 7.6)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/776/