# Vulnerabilities published in 2026


- [CVE-2026-14825](https://insights.sbomify.com/CVE-2026-14825/): Quiz And Survey Master < 11.2.4 - Contributor+ Arbitrary Quiz Text Settings Update via IDOR (low 2.7)
- [CVE-2026-14824](https://insights.sbomify.com/CVE-2026-14824/): Quiz And Survey Master < 11.2.2 - Contributor+ Stored XSS via Polar Question (medium 4.8)
- [CVE-2026-14823](https://insights.sbomify.com/CVE-2026-14823/): Event Tickets < 5.29.0.1 - Contributor+ Seating Layout and Ticket Inventory Modification via IDOR (low 2.2)
- [CVE-2026-14822](https://insights.sbomify.com/CVE-2026-14822/): Event Tickets < 5.29.0.1 - Unauthenticated PayPal Order Status Manipulation (medium 5.3)
- [CVE-2026-14821](https://insights.sbomify.com/CVE-2026-14821/): Quiz And Survey Master < 11.1.5 - Contributor+ Arbitrary Template Deletion (low 2.7)
- [CVE-2026-14820](https://insights.sbomify.com/CVE-2026-14820/): Quiz And Survey Master < 11.1.3 - Unauthenticated User Enumeration and Password Oracle via Quiz Login (medium 5.3)
- [CVE-2026-1482](https://insights.sbomify.com/CVE-2026-1482/): Out-of-band SQL injection in Quatuor Performance Evaluation (critical 9.3)
- [CVE-2026-14819](https://insights.sbomify.com/CVE-2026-14819/): Event Tickets < 5.28.4 - Editor+ Stored XSS via Ticket Move (low 3.5)
- [CVE-2026-14818](https://insights.sbomify.com/CVE-2026-14818/): Path traversal in ATP series firmware (high 7.2)
- [CVE-2026-14817](https://insights.sbomify.com/CVE-2026-14817/): Element Pack Elementor Addons < 8.7.13 - Contributor+ DOM-Based Stored XSS via uikit Data Attributes (medium 6.8)
- [CVE-2026-14816](https://insights.sbomify.com/CVE-2026-14816/): The GDPR Framework < 2.4.0 - Unauthenticated Consent Record Forgery and Do Not Sell Requests Spam (medium 6.5)
- [CVE-2026-14814](https://insights.sbomify.com/CVE-2026-14814/): Permissive Regular Expression in GitLab (high 8.2)
- [CVE-2026-14812](https://insights.sbomify.com/CVE-2026-14812/): Premium SEO - Unauthenticated Backdoor (Admin Creation / RCE / SSRF / Content Injection) (critical 10.0)
- [CVE-2026-1481](https://insights.sbomify.com/CVE-2026-1481/): Out-of-band SQL injection in Quatuor Performance Evaluation (critical 9.3)
- [CVE-2026-14809](https://insights.sbomify.com/CVE-2026-14809/): PROG MIS｜Prog Management System - SQL Injection (high 8.7)
- [CVE-2026-14808](https://insights.sbomify.com/CVE-2026-14808/): PROG MIS｜Prog Management System - Exposure of Sensitive Information (critical 9.3)
- [CVE-2026-14807](https://insights.sbomify.com/CVE-2026-14807/): PROG MIS｜ERP App - Use of Hard-coded Credentials (critical 9.3)
- [CVE-2026-14805](https://insights.sbomify.com/CVE-2026-14805/): Consulting - Business, Finance WordPress Theme <= 6.7.16 - Authenticated (Subscriber+) Privilege Escalation via AJAX (high 8.8)
- [CVE-2026-14804](https://insights.sbomify.com/CVE-2026-14804/): Hardcoded Cryptographic Key in Bilin Software's HUMANIST Digital Human Resources (critical 9.1)
- [CVE-2026-14803](https://insights.sbomify.com/CVE-2026-14803/): Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder (medium 6.5)
- [CVE-2026-14802](https://insights.sbomify.com/CVE-2026-14802/): react create-react-app react-dev-utils openBrowser.js startBrowserProcess os command injection (medium 6.9)
- [CVE-2026-14801](https://insights.sbomify.com/CVE-2026-14801/): GPAC TeXML File load_text.c txtin_probe_duration divide by zero (medium 4.8)
- [CVE-2026-14800](https://insights.sbomify.com/CVE-2026-14800/): imhamzaazam ecommerceFlask cross-site request forgery (medium 5.3)
- [CVE-2026-1480](https://insights.sbomify.com/CVE-2026-1480/): Out-of-band SQL injection in Quatuor Performance Evaluation (critical 9.3)
- [CVE-2026-14799](https://insights.sbomify.com/CVE-2026-14799/): CodeAstro Ecommerce Website my_account.php sql injection (medium 5.3)
- [CVE-2026-14798](https://insights.sbomify.com/CVE-2026-14798/): CodeAstro Apartment Visitor Management System visitor-entry.php sql injection (medium 5.3)
- [CVE-2026-14797](https://insights.sbomify.com/CVE-2026-14797/): CodeAstro Apartment Visitor Management System edit-apartment.php sql injection (medium 5.3)
- [CVE-2026-14796](https://insights.sbomify.com/CVE-2026-14796/): CodeAstro Apartment Visitor Management System report.php sql injection (medium 5.3)
- [CVE-2026-14795](https://insights.sbomify.com/CVE-2026-14795/): CodeAstro Apartment Visitor Management System action-visitor.php sql injection (medium 5.3)
- [CVE-2026-14794](https://insights.sbomify.com/CVE-2026-14794/): Craft CMS Charts Endpoint ChartsController.php actionGetNewUsersData improper authorization (medium 5.3)
- [CVE-2026-14793](https://insights.sbomify.com/CVE-2026-14793/): Craft CMS reorder-sets Endpoint GlobalsController.php actionReorderSets authorization (medium 5.3)
- [CVE-2026-14792](https://insights.sbomify.com/CVE-2026-14792/): Formbricks Survey actions.ts access control (medium 6.9)
- [CVE-2026-14791](https://insights.sbomify.com/CVE-2026-14791/): crater-invoice-inc crater Invoice Note InvoicesRequest.php getFormattedString cross site scripting (medium 5.1)
- [CVE-2026-14790](https://insights.sbomify.com/CVE-2026-14790/): GPAC Media File write_nhml.c nhmldump_send_frame null pointer dereference (medium 4.8)
- [CVE-2026-1479](https://insights.sbomify.com/CVE-2026-1479/): Out-of-band SQL injection in Quatuor Performance Evaluation (critical 9.3)
- [CVE-2026-14789](https://insights.sbomify.com/CVE-2026-14789/): radareorg radare2 Memory64ListStream mdmp.c stack-based overflow (medium 4.8)
- [CVE-2026-14788](https://insights.sbomify.com/CVE-2026-14788/): radareorg radare2 cfile.c r_core_bin_load use after free (medium 4.8)
- [CVE-2026-14787](https://insights.sbomify.com/CVE-2026-14787/): radareorg radare2 pb Print cmd_print.inc cmd_print integer overflow (medium 4.8)
- [CVE-2026-14786](https://insights.sbomify.com/CVE-2026-14786/): radareorg radare2 str.c r_str_word_get0set integer overflow (medium 4.8)
- [CVE-2026-14785](https://insights.sbomify.com/CVE-2026-14785/): Web Directory Free <= 1.7.13 - Unauthenticated SQL Injection (high 7.5)
- [CVE-2026-14784](https://insights.sbomify.com/CVE-2026-14784/): vxcontrol PentAGI Docker API client.go sandbox (medium 5.3)
- [CVE-2026-14783](https://insights.sbomify.com/CVE-2026-14783/): NousResearch hermes-agent skills_tool.py skill_view path traversal (medium 5.3)
- [CVE-2026-14782](https://insights.sbomify.com/CVE-2026-14782/): SQL injection in Booking for Appointments and Events Calendar – Amelia (medium 4.9)
- [CVE-2026-14781](https://insights.sbomify.com/CVE-2026-14781/): Keycloak-services: keycloak-services: oidc email_verified claim incorrectly applied to userinfo email (medium 4.8)
- [CVE-2026-14780](https://insights.sbomify.com/CVE-2026-14780/): PaperCut NG/MF: Remote Code Execution via Scripting Subsystem (high 7.5)
- [CVE-2026-1478](https://insights.sbomify.com/CVE-2026-1478/): Out-of-band SQL injection in Quatuor Performance Evaluation (critical 9.3)
- [CVE-2026-14778](https://insights.sbomify.com/CVE-2026-14778/): Missing authorization in Onlne Examination & Learning Management System (medium 6.9)
- [CVE-2026-14777](https://insights.sbomify.com/CVE-2026-14777/): SourceCodester Onlne Examination & Learning Management System announcements.php unrestricted upload (medium 5.3)
- [CVE-2026-14776](https://insights.sbomify.com/CVE-2026-14776/): File upload in Onlne Examination & Learning Management System (medium 5.3)
- [CVE-2026-14775](https://insights.sbomify.com/CVE-2026-14775/): SourceCodester Onlne Examination & Learning Management System process_lesson.php unrestricted upload (medium 5.3)
- [CVE-2026-14774](https://insights.sbomify.com/CVE-2026-14774/): itsourcecode Hospital Management System paymentdischarge.php sql injection (medium 5.3)
- [CVE-2026-14773](https://insights.sbomify.com/CVE-2026-14773/): itsourcecode Hospital Management System payment.php sql injection (medium 5.3)
- [CVE-2026-14772](https://insights.sbomify.com/CVE-2026-14772/): SourceCodester Class and Exam Timetabling System edit_course1.php sql injection (medium 6.9)
- [CVE-2026-14771](https://insights.sbomify.com/CVE-2026-14771/): SourceCodester Class and Exam Timetabling System edit_exam1.php sql injection (medium 6.9)
- [CVE-2026-14770](https://insights.sbomify.com/CVE-2026-14770/): SourceCodester Class and Exam Timetabling System edit_room.php sql injection (medium 6.9)
- [CVE-2026-1477](https://insights.sbomify.com/CVE-2026-1477/): Out-of-band SQL injection in Quatuor Performance Evaluation (critical 9.3)
- [CVE-2026-14769](https://insights.sbomify.com/CVE-2026-14769/): code-projects Real State Services pay.php sql injection (medium 6.9)
- [CVE-2026-14768](https://insights.sbomify.com/CVE-2026-14768/): code-projects Real State Services builderHome.php sql injection (medium 6.9)
- [CVE-2026-14767](https://insights.sbomify.com/CVE-2026-14767/): CodeAstro Ecommerce Website POST Parameter confirm.php sql injection (medium 5.3)
- [CVE-2026-14766](https://insights.sbomify.com/CVE-2026-14766/): CodeAstro Apartment Visitor Management System POST Parameter search-result.php sql injection (medium 5.3)
- [CVE-2026-14765](https://insights.sbomify.com/CVE-2026-14765/): Epic Games Unreal Engine Insecure Default URL Scheme Allowance in LaunchURL (high 7.7)
- [CVE-2026-14764](https://insights.sbomify.com/CVE-2026-14764/): code-projects Hotel and Tourism Reservation Event Management add_event.php sql injection (medium 6.9)
- [CVE-2026-14763](https://insights.sbomify.com/CVE-2026-14763/): code-projects Hotel and Tourism Reservation Tour Reservations tour_reserves.php sql injection (medium 6.9)
- [CVE-2026-14762](https://insights.sbomify.com/CVE-2026-14762/): code-projects Hotel and Tourism Reservation Room Management rooms.php sql injection (medium 6.9)
- [CVE-2026-14761](https://insights.sbomify.com/CVE-2026-14761/): radareorg radare2 str.c r_str_append integer overflow (medium 4.8)
- [CVE-2026-14760](https://insights.sbomify.com/CVE-2026-14760/): radareorg radare2 regprofile disasm.c r_core_seek_arch_bits use after free (medium 4.8)
- [CVE-2026-1476](https://insights.sbomify.com/CVE-2026-1476/): Out-of-band SQL injection in Quatuor Performance Evaluation (critical 9.3)
- [CVE-2026-14759](https://insights.sbomify.com/CVE-2026-14759/): radareorg radare2 RBinJava Line Number Table class.c r_bin_java_inner_classes_attr_calc_size heap-based overflow (medium 4.8)
- [CVE-2026-14758](https://insights.sbomify.com/CVE-2026-14758/): radareorg radare2 hexpairs cmd_anal.inc.c cmd_anal_opcode integer overflow (medium 4.8)
- [CVE-2026-14757](https://insights.sbomify.com/CVE-2026-14757/): radareorg radare2 cmd_anal.inc core_anal_bytes integer overflow (medium 4.8)
- [CVE-2026-14756](https://insights.sbomify.com/CVE-2026-14756/): code-projects Hotel and Tourism Reservation Tour Management add_tour.php sql injection (medium 6.9)
- [CVE-2026-14755](https://insights.sbomify.com/CVE-2026-14755/): code-projects Hotel and Tourism Reservation Reservations Management reservations.php sql injection (medium 6.9)
- [CVE-2026-14754](https://insights.sbomify.com/CVE-2026-14754/): code-projects Hotel and Tourism Reservation add_room.php sql injection (medium 6.9)
- [CVE-2026-14753](https://insights.sbomify.com/CVE-2026-14753/): mjperpinosa stumasy Note Handler/Assignment notes authorization (medium 6.9)
- [CVE-2026-14752](https://insights.sbomify.com/CVE-2026-14752/): mjperpinosa stumasy add_into_dictionary.php add_definition cross site scripting (medium 5.1)
- [CVE-2026-14751](https://insights.sbomify.com/CVE-2026-14751/): mjperpinosa stumasy search_scratch_data.php search_scratch_data sql injection (medium 5.3)
- [CVE-2026-14750](https://insights.sbomify.com/CVE-2026-14750/): mjperpinosa stumasy accessing_dictionary_authorization.php accessing_dictionary_authorization sql injection (medium 6.9)
- [CVE-2026-1475](https://insights.sbomify.com/CVE-2026-1475/): Out-of-band SQL injection in Quatuor Performance Evaluation (critical 9.3)
- [CVE-2026-14749](https://insights.sbomify.com/CVE-2026-14749/): mjperpinosa stumasy calculate.php eval code injection (medium 6.9)
- [CVE-2026-14748](https://insights.sbomify.com/CVE-2026-14748/): AIAnytime Awesome-MCP-Server mcp-wiki/wiki-summary server.py server-side request forgery (medium 5.3)
- [CVE-2026-14747](https://insights.sbomify.com/CVE-2026-14747/): code-projects Real State Services addprojectsale.php sql injection (medium 6.9)
- [CVE-2026-14746](https://insights.sbomify.com/CVE-2026-14746/): code-projects Real State Services addprojectrent.php sql injection (medium 6.9)
- [CVE-2026-14745](https://insights.sbomify.com/CVE-2026-14745/): code-projects Real State Services single-list_rent.php sql injection (medium 6.9)
- [CVE-2026-14744](https://insights.sbomify.com/CVE-2026-14744/): code-projects Real State Services normalHomeRent.php sql injection (medium 6.9)
- [CVE-2026-14743](https://insights.sbomify.com/CVE-2026-14743/): code-projects Real State Services normalHomeSale.php sql injection (medium 6.9)
- [CVE-2026-14742](https://insights.sbomify.com/CVE-2026-14742/): langchain-ai langgraph Task Result Cache _cache.py _freeze weak hash (low 2.3)
- [CVE-2026-14741](https://insights.sbomify.com/CVE-2026-14741/): HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_date (high 7.5)
- [CVE-2026-14740](https://insights.sbomify.com/CVE-2026-14740/): DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment (critical 9.1)
- [CVE-2026-1474](https://insights.sbomify.com/CVE-2026-1474/): Out-of-band SQL injection in Quatuor Performance Evaluation (critical 9.3)
- [CVE-2026-14739](https://insights.sbomify.com/CVE-2026-14739/): Memory corruption in DBI (critical 9.8)
- [CVE-2026-14738](https://insights.sbomify.com/CVE-2026-14738/): exo-explore exo Vision Feature Cache vision.py _image_cache_key weak hash (medium 6.3)
- [CVE-2026-14737](https://insights.sbomify.com/CVE-2026-14737/): Hanwang e-Face General Management Platform querySysAuthStr.do sql injection (medium 6.9)
- [CVE-2026-14736](https://insights.sbomify.com/CVE-2026-14736/): Ruijie RG-UAC user_auth_commit.php unrestricted upload (medium 6.9)
- [CVE-2026-14735](https://insights.sbomify.com/CVE-2026-14735/): code-projects Smart Parking System parkings.php sql injection (medium 6.9)
- [CVE-2026-14734](https://insights.sbomify.com/CVE-2026-14734/): SourceCodester Class and Exam Timetabling System edit_product.php sql injection (medium 6.9)
- [CVE-2026-14733](https://insights.sbomify.com/CVE-2026-14733/): SourceCodester Class and Exam Timetabling System edit_coursea.php sql injection (medium 6.9)
- [CVE-2026-14732](https://insights.sbomify.com/CVE-2026-14732/): SourceCodester Class and Exam Timetabling System edit_exam.php sql injection (medium 6.9)
- [CVE-2026-14731](https://insights.sbomify.com/CVE-2026-14731/): itsourcecode Hospital Management System patientreport.php sql injection (medium 5.3)
- [CVE-2026-14730](https://insights.sbomify.com/CVE-2026-14730/): itsourcecode Hospital Management System patientprofile.php sql injection (medium 5.3)
- [CVE-2026-1473](https://insights.sbomify.com/CVE-2026-1473/): Out-of-band SQL injection in Quatuor Performance Evaluation (critical 9.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/864/