# Vulnerabilities published in 2026


- [CVE-2026-2230](https://insights.sbomify.com/CVE-2026-2230/): Missing authorization in Booking Calendar (medium 4.3)
- [CVE-2026-2229](https://insights.sbomify.com/CVE-2026-2229/): undici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation (high 7.5)
- [CVE-2026-22285](https://insights.sbomify.com/CVE-2026-22285/): Information disclosure in Device Management Agent (DDMA) (medium 4.4)
- [CVE-2026-22284](https://insights.sbomify.com/CVE-2026-22284/): Command injection in SmartFabric OS10 Software (medium 6.6)
- [CVE-2026-22283](https://insights.sbomify.com/CVE-2026-22283/): Information disclosure in PowerFlex (high 7.5)
- [CVE-2026-22281](https://insights.sbomify.com/CVE-2026-22281/): Race condition in PowerScale OneFS (low 3.5)
- [CVE-2026-22280](https://insights.sbomify.com/CVE-2026-22280/): Misconfiguration in PowerScale OneFS (medium 5.0)
- [CVE-2026-22279](https://insights.sbomify.com/CVE-2026-22279/): Other in PowerScale OneFS (medium 4.3)
- [CVE-2026-22278](https://insights.sbomify.com/CVE-2026-22278/): Auth bypass in PowerScale OneFS (high 8.1)
- [CVE-2026-22277](https://insights.sbomify.com/CVE-2026-22277/): Command injection in UnityVSA (high 7.8)
- [CVE-2026-22276](https://insights.sbomify.com/CVE-2026-22276/): Information disclosure in ObjectScale (medium 5.5)
- [CVE-2026-22275](https://insights.sbomify.com/CVE-2026-22275/): Information disclosure in ObjectScale (medium 4.4)
- [CVE-2026-22274](https://insights.sbomify.com/CVE-2026-22274/): Information disclosure in ObjectScale (medium 6.5)
- [CVE-2026-22273](https://insights.sbomify.com/CVE-2026-22273/): Hardcoded credentials in ObjectScale (high 8.8)
- [CVE-2026-22271](https://insights.sbomify.com/CVE-2026-22271/): Information disclosure in ObjectScale (high 7.5)
- [CVE-2026-22270](https://insights.sbomify.com/CVE-2026-22270/): Privilege escalation in PowerScale OneFS, (medium 6.7)
- [CVE-2026-2227](https://insights.sbomify.com/CVE-2026-2227/): D-Link DCS-931L setSystemAdmin doSystem command injection (medium 5.1)
- [CVE-2026-22269](https://insights.sbomify.com/CVE-2026-22269/): Security feature bypass in PowerProtect Data Manager (medium 4.7)
- [CVE-2026-22268](https://insights.sbomify.com/CVE-2026-22268/): Privilege escalation in PowerProtect Data Manager (medium 6.3)
- [CVE-2026-22267](https://insights.sbomify.com/CVE-2026-22267/): Privilege escalation in PowerProtect Data Manager (high 8.1)
- [CVE-2026-22266](https://insights.sbomify.com/CVE-2026-22266/): Security feature bypass in PowerProtect Data Manager (medium 4.7)
- [CVE-2026-22265](https://insights.sbomify.com/CVE-2026-22265/): Roxy-WI has a Command Injection via grep parameter in logs.py allows authenticated RCE (high 7.5)
- [CVE-2026-22264](https://insights.sbomify.com/CVE-2026-22264/): Suricata detect/alert: heap-use-after-free on alert queue expansion (high 7.4)
- [CVE-2026-22263](https://insights.sbomify.com/CVE-2026-22263/): Suricata http1: quadratic complexity in headers parsing over multiple packets (medium 5.3)
- [CVE-2026-22262](https://insights.sbomify.com/CVE-2026-22262/): Suricata datasets: stack overflow when saving a set (medium 5.9)
- [CVE-2026-22261](https://insights.sbomify.com/CVE-2026-22261/): Suricata eve/alert: http1 xff handling can lead to denial of service (low 3.7)
- [CVE-2026-22260](https://insights.sbomify.com/CVE-2026-22260/): Suricata http1: infinite recursion in decompression (high 7.5)
- [CVE-2026-2226](https://insights.sbomify.com/CVE-2026-2226/): DouPHP ZIP File file.php unrestricted upload (medium 5.1)
- [CVE-2026-22259](https://insights.sbomify.com/CVE-2026-22259/): Suricata dnp3: unbounded transaction growth (high 7.5)
- [CVE-2026-22258](https://insights.sbomify.com/CVE-2026-22258/): Suricata DCERPC: unbounded fragment buffering leads to memory exhaustion (high 7.5)
- [CVE-2026-22257](https://insights.sbomify.com/CVE-2026-22257/): Salvo is vulnerable to stored XSS in the list_html function by uploading files with malicious names (high 8.8)
- [CVE-2026-22256](https://insights.sbomify.com/CVE-2026-22256/): Salvo is vulnerable to reflected XSS in the list_html function (high 8.8)
- [CVE-2026-22255](https://insights.sbomify.com/CVE-2026-22255/): iccDEV has heap-buffer-overflow in CIccCLUT::Init() at IccProfLib/IccTagLut.cpp (high 8.8)
- [CVE-2026-22254](https://insights.sbomify.com/CVE-2026-22254/): Winter Affected by Stored Cross-Site Scripting (XSS) in Asset Manager (not scored)
- [CVE-2026-22253](https://insights.sbomify.com/CVE-2026-22253/): Soft Serve is missing an authorization check in LFS lock deletion (medium 5.4)
- [CVE-2026-22252](https://insights.sbomify.com/CVE-2026-22252/): LibreChat MCP Stdio Remote Command Execution (critical 9.1)
- [CVE-2026-22251](https://insights.sbomify.com/CVE-2026-22251/): wlc may leak API keys due to an insecure API key configuration (medium 5.3)
- [CVE-2026-22250](https://insights.sbomify.com/CVE-2026-22250/): wlc can skip SSL verification (low 2.5)
- [CVE-2026-2225](https://insights.sbomify.com/CVE-2026-2225/): itsourcecode News Portal Project Administrator Login index.php sql injection (medium 6.9)
- [CVE-2026-22249](https://insights.sbomify.com/CVE-2026-22249/): Docmost affected by an Arbitrary File Write via Zip Import Feature (ZipSlip) (high 7.1)
- [CVE-2026-22248](https://insights.sbomify.com/CVE-2026-22248/): GLPI affected by Remote Code Execution via malicious upload (high 8.1)
- [CVE-2026-22247](https://insights.sbomify.com/CVE-2026-22247/): GLPI is Vulnerable to SSRF via Webhooks (medium 4.1)
- [CVE-2026-22246](https://insights.sbomify.com/CVE-2026-22246/): Local Mastodon users can enumerate and access severed relationships of every other local user (medium 6.5)
- [CVE-2026-22245](https://insights.sbomify.com/CVE-2026-22245/): Mastodon has SSRF Protection bypass (high 7.1)
- [CVE-2026-22244](https://insights.sbomify.com/CVE-2026-22244/): OpenMetadata Server-Side Template Injection (SSTI) in FreeMarker email templates that leads to RCE (high 8.5)
- [CVE-2026-22243](https://insights.sbomify.com/CVE-2026-22243/): EGroupware has SQL Injection in Nextmatch Filter Processing (high 8.7)
- [CVE-2026-22242](https://insights.sbomify.com/CVE-2026-22242/): CoreShop Vulnerable to SQL Injection via Admin Reports (medium 4.9)
- [CVE-2026-22241](https://insights.sbomify.com/CVE-2026-22241/): Open eClass has Unrestricted File Upload that Leads to Remote Code Execution (RCE) (high 7.3)
- [CVE-2026-22240](https://insights.sbomify.com/CVE-2026-22240/): Plaintext Passwords Vulnerability in BLUVOYIX (critical 10.0)
- [CVE-2026-2224](https://insights.sbomify.com/CVE-2026-2224/): code-projects Online Reviewer System btn_functions.php cross site scripting (medium 5.1)
- [CVE-2026-22239](https://insights.sbomify.com/CVE-2026-22239/): Email Sending Vulnerability in BLUVOYIX (critical 10.0)
- [CVE-2026-22238](https://insights.sbomify.com/CVE-2026-22238/): Administrator Account Creation Vulnerability in BLUVOYIX (critical 10.0)
- [CVE-2026-22237](https://insights.sbomify.com/CVE-2026-22237/): Exposed Internal API Documentation Vulnerability in BLUVOYIX (critical 10.0)
- [CVE-2026-22236](https://insights.sbomify.com/CVE-2026-22236/): Improper Authentication Vulnerability in BLUVOYIX (critical 10.0)
- [CVE-2026-22235](https://insights.sbomify.com/CVE-2026-22235/): OPEXUS eComplaint IDOR (high 8.7)
- [CVE-2026-22234](https://insights.sbomify.com/CVE-2026-22234/): OPEXUS eCasePortal unauthenticated IDOR (critical 9.3)
- [CVE-2026-22233](https://insights.sbomify.com/CVE-2026-22233/): OPEXUS eCASE Audit Project Cost stored XSS (medium 4.8)
- [CVE-2026-22232](https://insights.sbomify.com/CVE-2026-22232/): OPEXUS eCASE Audit Project Setup stored XSS (medium 4.8)
- [CVE-2026-22231](https://insights.sbomify.com/CVE-2026-22231/): OPEXUS eCASE Audit Document Check Out stored XSS (medium 4.8)
- [CVE-2026-22230](https://insights.sbomify.com/CVE-2026-22230/): OPEXUS eCASE Audit incorrect access control (high 7.2)
- [CVE-2026-2223](https://insights.sbomify.com/CVE-2026-2223/): code-projects Online Reviewer System index.php sql injection (medium 6.9)
- [CVE-2026-22229](https://insights.sbomify.com/CVE-2026-22229/): Command Injection Vulnerability on TP-Link Archer BE230 v1.2 and Deco BE25 v1.0 (high 8.6)
- [CVE-2026-22228](https://insights.sbomify.com/CVE-2026-22228/): Improper Input Validation Leading to DoS on TP-Link Archer BE230 (medium 6.8)
- [CVE-2026-22227](https://insights.sbomify.com/CVE-2026-22227/): Command Injection Vulnerability on TP-Link Archer BE230 v1.2 (high 8.5)
- [CVE-2026-22226](https://insights.sbomify.com/CVE-2026-22226/): Command Injection Vulnerability on TP-Link Archer BE230 and AX73 (high 8.5)
- [CVE-2026-22225](https://insights.sbomify.com/CVE-2026-22225/): Command Injection Vulnerability on TP-Link Archer BE230 v1.2 and AXE75 v1.0 (high 8.5)
- [CVE-2026-22224](https://insights.sbomify.com/CVE-2026-22224/): Command Injection Vulnerability on TP-Link Archer BE230 v1.2 (high 8.5)
- [CVE-2026-22223](https://insights.sbomify.com/CVE-2026-22223/): Command Injection Vulnerability on TP-Link Archer BE230 v1.2 and BE3600 v1 (high 8.5)
- [CVE-2026-22222](https://insights.sbomify.com/CVE-2026-22222/): Command Injection Vulnerability on TP-Link Archer BE230 v1.2 and AXE75 v2 (high 8.5)
- [CVE-2026-22221](https://insights.sbomify.com/CVE-2026-22221/): Command Injection Vulnerability on TP-Link Archer BE230 v1.2 and BE3600 v1 (high 8.5)
- [CVE-2026-22220](https://insights.sbomify.com/CVE-2026-22220/): Improper Input Validation Leading to DoS on TP-Link Archer BE230 (medium 6.8)
- [CVE-2026-2222](https://insights.sbomify.com/CVE-2026-2222/): code-projects Online Reviewer System btn_functions.php cross site scripting (medium 4.8)
- [CVE-2026-22219](https://insights.sbomify.com/CVE-2026-22219/): Chainlit < 2.9.4 SQLAlchemy Data Layer SSRF via /project/element (high 8.3)
- [CVE-2026-22218](https://insights.sbomify.com/CVE-2026-22218/): Chainlit < 2.9.4 Arbitrary File Read via /project/element (high 7.1)
- [CVE-2026-22217](https://insights.sbomify.com/CVE-2026-22217/): OpenClaw 2026.2.22 < 2026.2.23 - Arbitrary Binary Execution via $SHELL Environment Variable Trusted Prefix Fallback (medium 5.8)
- [CVE-2026-22216](https://insights.sbomify.com/CVE-2026-22216/): wpDiscuz before 7.6.47 - No Rate Limiting on Subscription Endpoints with LIKE Wildcard Bypass (medium 6.9)
- [CVE-2026-22215](https://insights.sbomify.com/CVE-2026-22215/): wpDiscuz before 7.6.47 - Missing CSRF Protection on wpdGetFollowsPage (medium 5.3)
- [CVE-2026-22214](https://insights.sbomify.com/CVE-2026-22214/): RIOT OS <= 2026.01-devel-317 Stack-Based Buffer Overflow in ethos Serial Frame Parser (medium 6.8)
- [CVE-2026-22213](https://insights.sbomify.com/CVE-2026-22213/): RIOT OS <= 2026.01-devel-317 Stack-Based Buffer Overflow in tapslip6 Utility (low 2.4)
- [CVE-2026-22212](https://insights.sbomify.com/CVE-2026-22212/): TinyOS <= 2.1.2 Stack-Based Buffer Overflow in mcp2200gpio (medium 4.8)
- [CVE-2026-22211](https://insights.sbomify.com/CVE-2026-22211/): TinyOS <= 2.1.2 Global Buffer Overflow in printfUART (medium 5.1)
- [CVE-2026-22210](https://insights.sbomify.com/CVE-2026-22210/): wpDiscuz before 7.6.47 - Cross-Site Scripting via Unescaped Attachment URLs (low 2.1)
- [CVE-2026-2221](https://insights.sbomify.com/CVE-2026-2221/): code-projects Online Reviewer System Login index.php sql injection (medium 6.9)
- [CVE-2026-22209](https://insights.sbomify.com/CVE-2026-22209/): wpDiscuz before 7.6.47 - Cross-Site Scripting via Unescaped Custom CSS in Style Tag (medium 5.1)
- [CVE-2026-22208](https://insights.sbomify.com/CVE-2026-22208/): OpenS100 Portrayal Engine Unrestricted Lua Standard Library Access (critical 9.4)
- [CVE-2026-22207](https://insights.sbomify.com/CVE-2026-22207/): OpenViking Missing root_api_key Allows Anonymous ROOT Access (critical 9.3)
- [CVE-2026-22206](https://insights.sbomify.com/CVE-2026-22206/): SPIP < 4.4.10 SQL Injection RCE via Union & PHP Tags (high 8.7)
- [CVE-2026-22205](https://insights.sbomify.com/CVE-2026-22205/): SPIP < 4.4.10 Authentication Bypass via PHP Type Juggling (high 8.7)
- [CVE-2026-22204](https://insights.sbomify.com/CVE-2026-22204/): wpDiscuz before 7.6.47 - Unsanitized Cookie Email Used as wp_mail() Recipient (medium 6.3)
- [CVE-2026-22203](https://insights.sbomify.com/CVE-2026-22203/): wpDiscuz before 7.6.47 - Options Export Leaks OAuth Secrets in Plaintext (medium 6.9)
- [CVE-2026-22202](https://insights.sbomify.com/CVE-2026-22202/): wpDiscuz before 7.6.47 - Destructive GET Action Deletes All Comments by Email (medium 6.1)
- [CVE-2026-22201](https://insights.sbomify.com/CVE-2026-22201/): wpDiscuz before 7.6.47 - IP Address Spoofing in getIP() (medium 6.9)
- [CVE-2026-22200](https://insights.sbomify.com/CVE-2026-22200/): osTicket (1.18.x < 1.18.3, 1.17.x < 1.17.7) PDF Export Arbitrary File Read (high 8.7)
- [CVE-2026-2220](https://insights.sbomify.com/CVE-2026-2220/): code-projects Online Reviewer System btn_functions.php sql injection (medium 6.9)
- [CVE-2026-22199](https://insights.sbomify.com/CVE-2026-22199/): Voltronic Power SNMP Web Pro 1.1 Path Traversal via upload.cgi (high 8.7)
- [CVE-2026-22198](https://insights.sbomify.com/CVE-2026-22198/): GestSup < 3.2.60 Stored XSS in API Error Logs (medium 5.1)
- [CVE-2026-22197](https://insights.sbomify.com/CVE-2026-22197/): GestSup < 3.2.60 Multiple SQL Injections in Asset List (high 7.5)
- [CVE-2026-22196](https://insights.sbomify.com/CVE-2026-22196/): GestSup < 3.2.60 SQL Injection in Ticket Creation (high 7.7)
- [CVE-2026-22195](https://insights.sbomify.com/CVE-2026-22195/): GestSup < 3.2.60 SQL Injection in Search Bar (high 7.7)
- [CVE-2026-22194](https://insights.sbomify.com/CVE-2026-22194/): GestSup <= 3.2.60 CSRF Allows Privileged Actions (high 8.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/800/