# Vulnerabilities published in 2026


- [CVE-2026-19977](https://insights.sbomify.com/CVE-2026-19977/): EFM ipTIME A3004T Session Validation httpcon_check_session_url improper authentication (critical 10.0)
- [CVE-2026-19976](https://insights.sbomify.com/CVE-2026-19976/): COMFAST CF-N1-S mbox-config sub_44A968 command injection (medium 5.1)
- [CVE-2026-19975](https://insights.sbomify.com/CVE-2026-19975/): Azuriom CMS Money Transfer ProfileController.php transferMoney toctou (low 2.3)
- [CVE-2026-19974](https://insights.sbomify.com/CVE-2026-19974/): treefrogframework treefrog-framework Session Cookie tsessioncookiestore.cpp strncmp improper authentication (medium 6.3)
- [CVE-2026-19973](https://insights.sbomify.com/CVE-2026-19973/): itsourcecode Hospital Management System viewpaymentreport.php sql injection (medium 5.3)
- [CVE-2026-19972](https://insights.sbomify.com/CVE-2026-19972/): itsourcecode Hospital Management System viewpatient.php sql injection (medium 5.3)
- [CVE-2026-19971](https://insights.sbomify.com/CVE-2026-19971/): LB-Link WR1210M Backup Endpoint backup.cgi main missing authentication (medium 5.3)
- [CVE-2026-19970](https://insights.sbomify.com/CVE-2026-19970/): Open Asset Import Library Assimp Node MDLLoader.cpp AddBonesToNodeGraph_3DGS_MDL7 heap-based overflow (medium 5.3)
- [CVE-2026-1997](https://insights.sbomify.com/CVE-2026-1997/): Certain HP OfficeJet Pro Printers - Information Disclosure (medium 6.9)
- [CVE-2026-19969](https://insights.sbomify.com/CVE-2026-19969/): Memory corruption in Assimp (medium 5.3)
- [CVE-2026-19968](https://insights.sbomify.com/CVE-2026-19968/): Open Asset Import Library Assimp 3DGS MDL7 Model LWOLoader.h ReadFaces_3DGS_MDL7 heap-based overflow (medium 5.3)
- [CVE-2026-19967](https://insights.sbomify.com/CVE-2026-19967/): Open Asset Import Library Assimp File Compression.cpp decompressBlock heap-based overflow (medium 5.3)
- [CVE-2026-19966](https://insights.sbomify.com/CVE-2026-19966/): CodeCanyon TimeCamp Integration for CRM Contact Information Update save_contact authorization (medium 5.3)
- [CVE-2026-19965](https://insights.sbomify.com/CVE-2026-19965/): automad Password Reset Endpoint UserController.php requestPasswordResetToken response discrepancy (medium 6.3)
- [CVE-2026-19964](https://insights.sbomify.com/CVE-2026-19964/): Jij-Inc Jij-MCP-Server jm_check python_repr.py PythonREPL.run code injection (medium 5.1)
- [CVE-2026-19963](https://insights.sbomify.com/CVE-2026-19963/): Edimax EW-7478APC stainfo command injection (medium 5.3)
- [CVE-2026-19962](https://insights.sbomify.com/CVE-2026-19962/): Edimax EW-7478APC setWAN command injection (medium 5.3)
- [CVE-2026-19961](https://insights.sbomify.com/CVE-2026-19961/): Edimax EW-7478APC formWlSiteSurvey buffer overflow (critical 9.4)
- [CVE-2026-19960](https://insights.sbomify.com/CVE-2026-19960/): Edimax EW-7478APC formWlbasic command injection (medium 5.3)
- [CVE-2026-1996](https://insights.sbomify.com/CVE-2026-1996/): Certain HP OfficeJet Pro Printers – Denial of Service (medium 6.9)
- [CVE-2026-19959](https://insights.sbomify.com/CVE-2026-19959/): Edimax EW-7478APC formWanTcpipSetup stack-based overflow (critical 9.4)
- [CVE-2026-19958](https://insights.sbomify.com/CVE-2026-19958/): iatsiuk pptr-mcp execute Tool vm-executor.ts executeCode code injection (medium 5.3)
- [CVE-2026-19957](https://insights.sbomify.com/CVE-2026-19957/): graphlit graphlit-mcp-server ssrf-test Endpoint tools.ts fetch server-side request forgery (medium 5.3)
- [CVE-2026-19956](https://insights.sbomify.com/CVE-2026-19956/): gomarble-ai facebook-ads-mcp-server server.py fetch_pagination_url server-side request forgery (medium 5.3)
- [CVE-2026-19955](https://insights.sbomify.com/CVE-2026-19955/): TrailDB TOC Validation tdb.c tdb_open out-of-bounds (medium 5.1)
- [CVE-2026-19954](https://insights.sbomify.com/CVE-2026-19954/): Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names. (medium 5.4)
- [CVE-2026-19953](https://insights.sbomify.com/CVE-2026-19953/): URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep. (medium 6.5)
- [CVE-2026-19952](https://insights.sbomify.com/CVE-2026-19952/): Path traversal in Frontend Admin by DynamiApps (high 7.5)
- [CVE-2026-1995](https://insights.sbomify.com/CVE-2026-1995/): IDrive Cloud Backup Client for Windows contains a privilege escalation vulnerability (high 7.8)
- [CVE-2026-19949](https://insights.sbomify.com/CVE-2026-19949/): SQL injection in All-in-One WP Migration and Backup (high 8.8)
- [CVE-2026-19948](https://insights.sbomify.com/CVE-2026-19948/): Missing authorization in Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates (medium 5.3)
- [CVE-2026-19947](https://insights.sbomify.com/CVE-2026-19947/): Missing authorization in zephyr (medium 5.3)
- [CVE-2026-19946](https://insights.sbomify.com/CVE-2026-19946/): Missing authorization in Awesome Support – WordPress HelpDesk & Support Plugin (medium 4.3)
- [CVE-2026-19945](https://insights.sbomify.com/CVE-2026-19945/): WP Crowdfunding <= 2.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'first_name' Parameter (medium 6.4)
- [CVE-2026-19944](https://insights.sbomify.com/CVE-2026-19944/): WP Crowdfunding <= 2.2.1 - Authenticated (Shop Manager+) SQL Injection via 'wpneo_reward' Post Meta (medium 4.9)
- [CVE-2026-19943](https://insights.sbomify.com/CVE-2026-19943/): Gutenverse <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleTag' Block Attribute (medium 6.4)
- [CVE-2026-19942](https://insights.sbomify.com/CVE-2026-19942/): Atarim <= 5.1.1 - Authenticated (Author+) Arbitrary File Deletion via '_wp_attached_file' Meta (high 8.1)
- [CVE-2026-19941](https://insights.sbomify.com/CVE-2026-19941/): checkwildcard() accepts an out-of-zone NSEC as a wildcard-nonexistence proof (medium 5.9)
- [CVE-2026-19940](https://insights.sbomify.com/CVE-2026-19940/): Use after free in zephyr (medium 6.5)
- [CVE-2026-1994](https://insights.sbomify.com/CVE-2026-1994/): s2Member <= 260127 - Unauthenticated Privilege Escalation via Account Takeover (critical 9.8)
- [CVE-2026-19939](https://insights.sbomify.com/CVE-2026-19939/): Bluetooth Classic AVDTP: stale timeout work on signalling-channel disconnect leads to kernel timeout-list corruption (medium 6.3)
- [CVE-2026-19938](https://insights.sbomify.com/CVE-2026-19938/): Use-after-free of an ATT PDU buffer when signing an outgoing Bluetooth ATT Signed Write Command fails (medium 5.9)
- [CVE-2026-19937](https://insights.sbomify.com/CVE-2026-19937/): Bluetooth Mesh Access layer permanently leaks delayable-message contexts, disabling all model responses (medium 5.7)
- [CVE-2026-19936](https://insights.sbomify.com/CVE-2026-19936/): Bluetooth Mesh delayable message queue: unsynchronized list access leads to NULL pointer dereference (medium 4.8)
- [CVE-2026-19935](https://insights.sbomify.com/CVE-2026-19935/): Use after free in zephyr (high 7.5)
- [CVE-2026-19934](https://insights.sbomify.com/CVE-2026-19934/): itsourcecode Hospital Management System vieworder.php sql injection (medium 5.3)
- [CVE-2026-19933](https://insights.sbomify.com/CVE-2026-19933/): DefaultFuction Customer-Relationship-Management-In-C-Project Customer Search gets stack-based overflow (medium 5.3)
- [CVE-2026-19932](https://insights.sbomify.com/CVE-2026-19932/): DefaultFuction Notice-System-Managent NoticeController execute GroovyShell.evaluate code injection (medium 5.3)
- [CVE-2026-19931](https://insights.sbomify.com/CVE-2026-19931/): Negotiate ambient user conn reuse (critical 9.8)
- [CVE-2026-19930](https://insights.sbomify.com/CVE-2026-19930/): Dolibarr User Cloning card.php ldap injection (medium 5.3)
- [CVE-2026-1993](https://insights.sbomify.com/CVE-2026-1993/): Privilege escalation in ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin) (high 8.8)
- [CVE-2026-19929](https://insights.sbomify.com/CVE-2026-19929/): OpenBoxes Template Processing DocumentController.groovy buildZebraTemplate special elements in template engine (medium 5.3)
- [CVE-2026-19928](https://insights.sbomify.com/CVE-2026-19928/): OpenBoxes Role Interceptor RoleInterceptor.groovy needManager privileges management (medium 5.3)
- [CVE-2026-19927](https://insights.sbomify.com/CVE-2026-19927/): OpenBoxes Product Upload Endpoint ProductController.groovy upload server-side request forgery (medium 5.3)
- [CVE-2026-19926](https://insights.sbomify.com/CVE-2026-19926/): Evergreen open-ils.fielder OpenSRF Service osrf-gateway-v1 sql injection (medium 6.9)
- [CVE-2026-19925](https://insights.sbomify.com/CVE-2026-19925/): SourceCodester Stock Management System Master.php delete_supplier sql injection (medium 5.1)
- [CVE-2026-19924](https://insights.sbomify.com/CVE-2026-19924/): Tenda AC10 httpd R7WebsSecurityHandler improper authentication (critical 9.3)
- [CVE-2026-19923](https://insights.sbomify.com/CVE-2026-19923/): code-projects Online Shopping System checkout_process.php sql injection (medium 5.3)
- [CVE-2026-19922](https://insights.sbomify.com/CVE-2026-19922/): code-projects Online Shopping System checkout.php cross site scripting (medium 5.1)
- [CVE-2026-19921](https://insights.sbomify.com/CVE-2026-19921/): code-projects Online Shopping System homeaction.php sql injection (medium 5.3)
- [CVE-2026-19920](https://insights.sbomify.com/CVE-2026-19920/): code-projects Online Shopping System action.php sql injection (medium 5.3)
- [CVE-2026-1992](https://insights.sbomify.com/CVE-2026-1992/): ExactMetrics 8.6.0 - 9.0.2 - Authenticated (Custom) Insecure Direct Object Reference to Arbitrary Plugin Installation (high 8.8)
- [CVE-2026-19919](https://insights.sbomify.com/CVE-2026-19919/): code-projects Online Shopping System Login login.php sql injection (medium 6.9)
- [CVE-2026-19918](https://insights.sbomify.com/CVE-2026-19918/): SpaceX Starlink Router Gen 3 gRPC Management get_status access control (medium 5.3)
- [CVE-2026-19917](https://insights.sbomify.com/CVE-2026-19917/): code-projects Online Food Order System delete_food_items1.php sql injection (medium 5.3)
- [CVE-2026-19916](https://insights.sbomify.com/CVE-2026-19916/): code-projects Online Food Order System edit_food_items.php cross site scripting (medium 5.1)
- [CVE-2026-19915](https://insights.sbomify.com/CVE-2026-19915/): HP Support Assistant - Local Escalation of Privilege (high 7.3)
- [CVE-2026-19914](https://insights.sbomify.com/CVE-2026-19914/): Welcart e-Commerce <= 2.12.1 - Unauthenticated Stored Cross-Site Scripting via 'custom_order' Parameter (high 7.2)
- [CVE-2026-19913](https://insights.sbomify.com/CVE-2026-19913/): CVE-2026-19913 (high 7.5)
- [CVE-2026-19912](https://insights.sbomify.com/CVE-2026-19912/): CVE-2026-19912 (critical 9.8)
- [CVE-2026-19910](https://insights.sbomify.com/CVE-2026-19910/): PAX Technology Q80 Application Installer Signature Verification Bypass Remote Code Execution Vulnerability (high 7.5)
- [CVE-2026-1991](https://insights.sbomify.com/CVE-2026-1991/): libuvc UVC Descriptor device.c uvc_scan_streaming null pointer dereference (medium 4.8)
- [CVE-2026-19909](https://insights.sbomify.com/CVE-2026-19909/): PAX Technology Q80 AIP File Parsing Link Following Remote Code Execution Vulnerability (high 7.5)
- [CVE-2026-19908](https://insights.sbomify.com/CVE-2026-19908/): PAX Technology Q80 XCB Daemon Missing Authentication Vulnerability (high 7.1)
- [CVE-2026-19906](https://insights.sbomify.com/CVE-2026-19906/): pkp pkp-lib API Key Generation APIProfileForm.php setData entropy (medium 6.3)
- [CVE-2026-19905](https://insights.sbomify.com/CVE-2026-19905/): Jinher OA attendance_out_approve.aspx sql injection (medium 6.9)
- [CVE-2026-19904](https://insights.sbomify.com/CVE-2026-19904/): SourceCodester Online Book Store System System Settings index.php site_settings cross site scripting (medium 4.8)
- [CVE-2026-19903](https://insights.sbomify.com/CVE-2026-19903/): SourceCodester Online Clothing Store SQL Database Backup shopping.sql file access (medium 6.9)
- [CVE-2026-19902](https://insights.sbomify.com/CVE-2026-19902/): Ad Inserter <= 2.8.18 - Reflected Cross-Site Scripting via {search-query} Dynamic Tag (Referer Header) (medium 6.1)
- [CVE-2026-19901](https://insights.sbomify.com/CVE-2026-19901/): LB-LINK X-PRO easycwmp hard-coded credentials (critical 9.2)
- [CVE-2026-19900](https://insights.sbomify.com/CVE-2026-19900/): LB-LINK X-PRO shadow hard-coded credentials (critical 9.2)
- [CVE-2026-1990](https://insights.sbomify.com/CVE-2026-1990/): oatpp Type.hpp ObjectWrapper null pointer dereference (medium 4.8)
- [CVE-2026-19899](https://insights.sbomify.com/CVE-2026-19899/): SourceCodester Class and Exam Timetabling System edit_teacher.php sql injection (medium 6.9)
- [CVE-2026-19898](https://insights.sbomify.com/CVE-2026-19898/): VictoriaMetrics VMAuth Authentication Endpoint main.go requestHandler excessive authentication (medium 6.3)
- [CVE-2026-19897](https://insights.sbomify.com/CVE-2026-19897/): mangroup dtale Login Endpoint auth.py login excessive authentication (medium 6.3)
- [CVE-2026-19896](https://insights.sbomify.com/CVE-2026-19896/): mangroup dtale Flask Session Cookie app.py build_secret_key random values (medium 6.3)
- [CVE-2026-19895](https://insights.sbomify.com/CVE-2026-19895/): opensourcepos Open Source Point of Sale Login Endpoint Filters.php index excessive authentication (medium 6.3)
- [CVE-2026-19894](https://insights.sbomify.com/CVE-2026-19894/): itsourcecode Hospital Management System viewmedicine.php sql injection (medium 5.3)
- [CVE-2026-19893](https://insights.sbomify.com/CVE-2026-19893/): D-Link DIR-842 vsftpd vsftpd.conf default permission (low 2.3)
- [CVE-2026-19892](https://insights.sbomify.com/CVE-2026-19892/): InfusedWoo Pro <= 5.1.18 - Authenticated (Subscriber+) Privilege Escalation via Password Reset Link Disclosure (high 8.8)
- [CVE-2026-19891](https://insights.sbomify.com/CVE-2026-19891/): TRENDnet TEW-WLC100 IKE Phase 1 Aggressive Mode racoon.conf missing encryption (medium 6.3)
- [CVE-2026-1989](https://insights.sbomify.com/CVE-2026-1989/): IDOR in PAVO Inc.'s PAVO Pay (high 7.5)
- [CVE-2026-19889](https://insights.sbomify.com/CVE-2026-19889/): Server-Side Request Forgery (SSRF) in GitLab AI Gateway (high 8.2)
- [CVE-2026-19888](https://insights.sbomify.com/CVE-2026-19888/): NULL pointer dereference in SCRAM client-final-message parsing in PgBouncer (high 7.5)
- [CVE-2026-19887](https://insights.sbomify.com/CVE-2026-19887/): Deserialization in Welcart e-Commerce (high 8.8)
- [CVE-2026-19886](https://insights.sbomify.com/CVE-2026-19886/): OriginLab Origin Viewer OGM File Parsing Memory Corruption Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-19885](https://insights.sbomify.com/CVE-2026-19885/): OriginLab Origin Viewer OGWU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-19884](https://insights.sbomify.com/CVE-2026-19884/): Code injection in Eclipse Theia (high 8.4)
- [CVE-2026-19883](https://insights.sbomify.com/CVE-2026-19883/): Privilege escalation in WPeMatico RSS Feed Fetcher (high 8.8)
- [CVE-2026-19880](https://insights.sbomify.com/CVE-2026-19880/): Incomplete protection against CVE-2025-11226 (medium 6.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/820/