# Vulnerabilities published in 2026


- [CVE-2026-21822](https://insights.sbomify.com/CVE-2026-21822/): A path traversal vulnerability has been identified in HCL AppScan 360° (CVE-2026-21822). (medium 6.3)
- [CVE-2026-21821](https://insights.sbomify.com/CVE-2026-21821/): HCL BigFix SCM Reporting is affected by vulnerabilities in jQuery (high 8.3)
- [CVE-2026-2182](https://insights.sbomify.com/CVE-2026-2182/): UTT 进取 521G setSysAdm doSystem command injection (high 8.6)
- [CVE-2026-21812](https://insights.sbomify.com/CVE-2026-21812/): Multiple security vulnerabilities affect HCL AppScan Azure Boards Plugin (CVE-2026-12143 and CVE-2026-13149) (low 2.2)
- [CVE-2026-21811](https://insights.sbomify.com/CVE-2026-21811/): Multiple security vulnerabilities affect HCL AppScan Azure Boards Plugin (CVE-2026-12143 and CVE-2026-13149) (low 3.8)
- [CVE-2026-21810](https://insights.sbomify.com/CVE-2026-21810/): Supply chain in BigFix Quantum Risk Analyzer (medium 4.4)
- [CVE-2026-2181](https://insights.sbomify.com/CVE-2026-2181/): Tenda RX3 openSchedWifi stack-based overflow (high 8.7)
- [CVE-2026-21809](https://insights.sbomify.com/CVE-2026-21809/): HCL BigFix Quantum Risk Analyzer is affected by generating error messages with sensitive information (low 3.9)
- [CVE-2026-21808](https://insights.sbomify.com/CVE-2026-21808/): HCL BigFix Quantum Risk Analyzer is affected by logging sensitive information (medium 4.1)
- [CVE-2026-21807](https://insights.sbomify.com/CVE-2026-21807/): HCL BigFix Quantum Risk Analyzer is affected by a stack-based buffer overflow (low 3.9)
- [CVE-2026-21806](https://insights.sbomify.com/CVE-2026-21806/): HCL BigFix Service Management was affected with Admin Session Concurrency vulnerability (CVE-2026-21806) (low 3.1)
- [CVE-2026-2180](https://insights.sbomify.com/CVE-2026-2180/): Tenda RX3 fast_setting_wifi_set stack-based overflow (high 8.7)
- [CVE-2026-21791](https://insights.sbomify.com/CVE-2026-21791/): HCL Sametime for Android is affected by sensitive information disclosure (low 3.3)
- [CVE-2026-21790](https://insights.sbomify.com/CVE-2026-21790/): HCL Traveler is susceptible to a weak default HTTP header validation vulnerability (medium 6.3)
- [CVE-2026-2179](https://insights.sbomify.com/CVE-2026-2179/): PHPGurukul Hospital Management System manage-users.php sql injection (medium 5.1)
- [CVE-2026-21789](https://insights.sbomify.com/CVE-2026-21789/): HCL Connections is vulnerable to broken access control (medium 4.6)
- [CVE-2026-21788](https://insights.sbomify.com/CVE-2026-21788/): HCL Connections is vulnerable to cross-site scripting (XSS) (medium 5.4)
- [CVE-2026-21786](https://insights.sbomify.com/CVE-2026-21786/): HCL Sametime for iOS is affected by sensitive information disclosure (low 3.3)
- [CVE-2026-21785](https://insights.sbomify.com/CVE-2026-21785/): HCL BigFix Remote Control Server WebUI is affected by a misconfigured Content Security Policy (medium 4.0)
- [CVE-2026-21784](https://insights.sbomify.com/CVE-2026-21784/): HCL IntelliOps Event Management is affected by multiple security vulnerabilities. (medium 4.8)
- [CVE-2026-21783](https://insights.sbomify.com/CVE-2026-21783/): HCL Traveler is affected by sensitive information disclosure (medium 4.3)
- [CVE-2026-2178](https://insights.sbomify.com/CVE-2026-2178/): r-huijts xcode-mcp-server run_lldb index.ts registerXcodeTools command injection (medium 5.3)
- [CVE-2026-21770](https://insights.sbomify.com/CVE-2026-21770/): HCL Traveler for Microsoft Outlook (HTMO) is susceptible to DLL hijacking (medium 6.5)
- [CVE-2026-2177](https://insights.sbomify.com/CVE-2026-2177/): SourceCodester Prison Management System Login session fixiation (medium 6.9)
- [CVE-2026-21768](https://insights.sbomify.com/CVE-2026-21768/): HCL Verse for Android is susceptible to an injection vulnerability (medium 6.3)
- [CVE-2026-21767](https://insights.sbomify.com/CVE-2026-21767/): HCL BigFix Platform is affected by insufficient authentication (medium 4.0)
- [CVE-2026-21766](https://insights.sbomify.com/CVE-2026-21766/): HCL Digital Experience and Digital Experience Compose insufficiently protects credentials (medium 5.4)
- [CVE-2026-21765](https://insights.sbomify.com/CVE-2026-21765/): HCL BigFix Platform is affected by insecure permissions on private cryptographic keys (high 8.8)
- [CVE-2026-21764](https://insights.sbomify.com/CVE-2026-21764/): Insufficient Input Validation in DevOps Loop (low 3.1)
- [CVE-2026-21762](https://insights.sbomify.com/CVE-2026-21762/): Missing HTTP Security Headers in DevOps Loop (low 3.7)
- [CVE-2026-21761](https://insights.sbomify.com/CVE-2026-21761/): CORS Misconfiguration in DevOps Loop (medium 4.2)
- [CVE-2026-21760](https://insights.sbomify.com/CVE-2026-21760/): Unauthorized Access to Admin Functionality via Forced Browsing (medium 4.6)
- [CVE-2026-2176](https://insights.sbomify.com/CVE-2026-2176/): code-projects Contact Management System index.py sql injection (medium 5.3)
- [CVE-2026-21759](https://insights.sbomify.com/CVE-2026-21759/): HCL Hive is affected by an information exposure vulnerability (medium 4.3)
- [CVE-2026-21758](https://insights.sbomify.com/CVE-2026-21758/): HCL Hive is affected by multiple security vulnerabilities. (low 3.7)
- [CVE-2026-21756](https://insights.sbomify.com/CVE-2026-21756/): HCL Hive is affected by a broken access control vulnerability (high 7.2)
- [CVE-2026-21755](https://insights.sbomify.com/CVE-2026-21755/): HCL Hive is affected by a missing rate limit (medium 5.3)
- [CVE-2026-21754](https://insights.sbomify.com/CVE-2026-21754/): HCL Hive is affected by multiple security vulnerabilities. (medium 5.4)
- [CVE-2026-21753](https://insights.sbomify.com/CVE-2026-21753/): HCL Hive is affected by multiple security vulnerabilities. (medium 4.2)
- [CVE-2026-21752](https://insights.sbomify.com/CVE-2026-21752/): HCL Hive is affected by a use of vulnerable third-party components (high 7.5)
- [CVE-2026-21751](https://insights.sbomify.com/CVE-2026-21751/): HCL Hive is affected by use of a cryptographic primitive with a risky implementation (high 7.4)
- [CVE-2026-2175](https://insights.sbomify.com/CVE-2026-2175/): D-Link DIR-823X set_upnp sub_420618 os command injection (high 8.6)
- [CVE-2026-21743](https://insights.sbomify.com/CVE-2026-21743/): Missing authorization in FortiAuthenticator (medium 6.8)
- [CVE-2026-21742](https://insights.sbomify.com/CVE-2026-21742/): Information disclosure in FortiSOAR PaaS (medium 5.4)
- [CVE-2026-21741](https://insights.sbomify.com/CVE-2026-21741/): Open redirect in FortiNAC-F (low 2.2)
- [CVE-2026-2174](https://insights.sbomify.com/CVE-2026-2174/): code-projects Contact Management System CRUD Endpoint improper authentication (medium 6.9)
- [CVE-2026-21736](https://insights.sbomify.com/CVE-2026-21736/): GPU DDK - Insufficient permission check in PhysmemWrapExtMem() when write attribute support enabled (medium 4.4)
- [CVE-2026-21734](https://insights.sbomify.com/CVE-2026-21734/): GPU DDK - libusc OOB write at TreeRemove during WebGPU shader compilation (high 7.7)
- [CVE-2026-21733](https://insights.sbomify.com/CVE-2026-21733/): Security feature bypass in Graphics DDK (high 7.3)
- [CVE-2026-21732](https://insights.sbomify.com/CVE-2026-21732/): GPU DDK - libusc OOB write at ConvertSwitchToArrayLookupBP during WebGPU shader compilation (critical 9.6)
- [CVE-2026-21730](https://insights.sbomify.com/CVE-2026-21730/): Stored XSS in Verba (medium 5.3)
- [CVE-2026-2173](https://insights.sbomify.com/CVE-2026-2173/): code-projects Online Examination System login.php sql injection (medium 6.9)
- [CVE-2026-21729](https://insights.sbomify.com/CVE-2026-21729/): Loki detected_fields query limits results in unbounded memory allocation (high 7.5)
- [CVE-2026-21728](https://insights.sbomify.com/CVE-2026-21728/): Tempo query limit results in unbounded memory allocation (high 7.5)
- [CVE-2026-21727](https://insights.sbomify.com/CVE-2026-21727/): Grafana Correlations: Cross-Tenant Data Disclosure and Permanent Deletion via Legacy org_id=0 Record (low 3.3)
- [CVE-2026-21726](https://insights.sbomify.com/CVE-2026-21726/): Loki Path Traversal - CVE-2021-36156 Bypass (medium 5.3)
- [CVE-2026-21725](https://insights.sbomify.com/CVE-2026-21725/): Authorization Bypass via TOCTOU in Grafana Datasource Deletion by Name (low 2.6)
- [CVE-2026-21724](https://insights.sbomify.com/CVE-2026-21724/): Missing Protected-field Authorization in Provisioning Contact Points API (medium 5.4)
- [CVE-2026-21723](https://insights.sbomify.com/CVE-2026-21723/): CVE-2026-21723 Record (medium 5.3)
- [CVE-2026-21722](https://insights.sbomify.com/CVE-2026-21722/): Public Dashboards time range restriction on annotations can be bypassed (medium 5.3)
- [CVE-2026-21721](https://insights.sbomify.com/CVE-2026-21721/): Dashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege Escalation (high 8.1)
- [CVE-2026-21720](https://insights.sbomify.com/CVE-2026-21720/): Unauthenticated DoS: avatar cache leaks goroutines when /avatar/:hash requests time out (high 7.5)
- [CVE-2026-2172](https://insights.sbomify.com/CVE-2026-2172/): code-projects Online Application System for Admission Login Endpoint index.php sql injection (medium 6.9)
- [CVE-2026-21719](https://insights.sbomify.com/CVE-2026-21719/): Command injection in CubeCart (high 8.6)
- [CVE-2026-21718](https://insights.sbomify.com/CVE-2026-21718/): Copeland XWEB and XWEB Pro Use of a Broken or Risky Cryptographic Algorithm (critical 10.0)
- [CVE-2026-21717](https://insights.sbomify.com/CVE-2026-21717/): Denial of service in node (medium 5.9)
- [CVE-2026-21716](https://insights.sbomify.com/CVE-2026-21716/): Missing authorization in node (low 3.3)
- [CVE-2026-21715](https://insights.sbomify.com/CVE-2026-21715/): Security feature bypass in node (low 3.3)
- [CVE-2026-21714](https://insights.sbomify.com/CVE-2026-21714/): Denial of service in node (medium 5.3)
- [CVE-2026-21713](https://insights.sbomify.com/CVE-2026-21713/): Weak cryptography in node (medium 5.9)
- [CVE-2026-21712](https://insights.sbomify.com/CVE-2026-21712/): Denial of service in node (medium 5.7)
- [CVE-2026-21711](https://insights.sbomify.com/CVE-2026-21711/): Security feature bypass in node (medium 5.3)
- [CVE-2026-21710](https://insights.sbomify.com/CVE-2026-21710/): Denial of service in node (high 7.5)
- [CVE-2026-2171](https://insights.sbomify.com/CVE-2026-2171/): code-projects Online Student Management System Login accounts.php sql injection (medium 6.9)
- [CVE-2026-21709](https://insights.sbomify.com/CVE-2026-21709/): Security feature bypass in Backup and Replication (medium 6.7)
- [CVE-2026-21708](https://insights.sbomify.com/CVE-2026-21708/): SQL injection in Backup and Replication (critical 9.9)
- [CVE-2026-21697](https://insights.sbomify.com/CVE-2026-21697/): axios4go's Race Condition in Shared HTTP Client Allows Proxy Configuration Leak (high 8.2)
- [CVE-2026-21696](https://insights.sbomify.com/CVE-2026-21696/): Endless reprocessing/reupload of activity log data due to SQLite max parameters limit not being considered (high 8.3)
- [CVE-2026-21695](https://insights.sbomify.com/CVE-2026-21695/): Titra API Contains Mass Assignment Vulnerability (medium 4.3)
- [CVE-2026-21694](https://insights.sbomify.com/CVE-2026-21694/): Titra APIs have Improper Access Control (medium 6.8)
- [CVE-2026-21693](https://insights.sbomify.com/CVE-2026-21693/): iccDEV has Type Confusion in CIccSegmentedCurveXml::ToXml() at IccXML/IccLibXML/IccMpeXml.cpp (high 8.8)
- [CVE-2026-21692](https://insights.sbomify.com/CVE-2026-21692/): iccDEV has Type Confusion in ToXmlCurve() at IccXML/IccLibXML/IccMpeXml.cpp (high 8.8)
- [CVE-2026-21691](https://insights.sbomify.com/CVE-2026-21691/): iccDEV has Type Confusion in CIccTag:IsTypeCompressed() (medium 5.4)
- [CVE-2026-21690](https://insights.sbomify.com/CVE-2026-21690/): iccDEV has Type Confusion in CIccTagXmlTagData::ToXml() (medium 6.3)
- [CVE-2026-2169](https://insights.sbomify.com/CVE-2026-2169/): D-Link DWR-M921 formLtefotaUpgradeFibocom command injection (medium 5.3)
- [CVE-2026-21689](https://insights.sbomify.com/CVE-2026-21689/): iccDEV has Type Confusion in CIccProfileXml::ParseBasic() at IccXML/IccLibXML/IccProfileXml.cpp (medium 6.5)
- [CVE-2026-21688](https://insights.sbomify.com/CVE-2026-21688/): iccDEV has Type Confusion in SIccCalcOp::ArgsPushed() at IccProfLib/IccMpeCalc.cpp (high 8.8)
- [CVE-2026-21687](https://insights.sbomify.com/CVE-2026-21687/): iccDEV has Undefined Behavior in CIccTagCurve::CIccTagCurve() (high 7.1)
- [CVE-2026-21686](https://insights.sbomify.com/CVE-2026-21686/): iccDEV has Undefined Behavior in CIccTagLutAtoB::Validate() (high 7.1)
- [CVE-2026-21685](https://insights.sbomify.com/CVE-2026-21685/): iccDEV has Undefined Behavior in CIccTagLut16::Read() (high 7.1)
- [CVE-2026-21684](https://insights.sbomify.com/CVE-2026-21684/): iccDEV has Undefined Behavior in CIccTagSpectralViewingConditions() (high 7.1)
- [CVE-2026-21683](https://insights.sbomify.com/CVE-2026-21683/): iccDEV has Type Confusion in icStatusCMM::CIccEvalCompare::EvaluateProfile() (high 8.8)
- [CVE-2026-21682](https://insights.sbomify.com/CVE-2026-21682/): iccDEV has heap-buffer-overflow in CIccXmlArrayType::ParseText() (high 8.8)
- [CVE-2026-21681](https://insights.sbomify.com/CVE-2026-21681/): iccDEV has Undefined Behavior runtime error: nan is outside the range .. IccProfLib/IccTagBasic.cpp (high 7.1)
- [CVE-2026-21680](https://insights.sbomify.com/CVE-2026-21680/): iccDEV has Null Pointer Dereference in CIccProfile::CheckTagTypes() (medium 6.5)
- [CVE-2026-2168](https://insights.sbomify.com/CVE-2026-2168/): D-Link DWR-M921 formLtefotaUpgradeQuectel sub_419920 command injection (medium 5.3)
- [CVE-2026-21679](https://insights.sbomify.com/CVE-2026-21679/): iccDEV has heap-buffer-overflow vulnerability in CIccLocalizedUnicode::GetText() (high 8.8)
- [CVE-2026-21678](https://insights.sbomify.com/CVE-2026-21678/): iccDEV has heap-buffer-overflow vulnerability on IccTagXml() (high 7.8)
- [CVE-2026-21677](https://insights.sbomify.com/CVE-2026-21677/): iccDEV has Undefined Behavior in CIccCLUT::Init() (high 8.8)
- [CVE-2026-21676](https://insights.sbomify.com/CVE-2026-21676/): iccDEV has a Heap-based Buffer Overflow in its CIccMBB::Validate() function (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/804/