# Vulnerabilities published in 2026


- [CVE-2026-13635](https://insights.sbomify.com/CVE-2026-13635/): Information disclosure in DiskStation Manager (DSM) (medium 5.3)
- [CVE-2026-1363](https://insights.sbomify.com/CVE-2026-1363/): JNC｜IAQS and I6 - Client-Side Enforcement of Server-Side Security (critical 9.3)
- [CVE-2026-13623](https://insights.sbomify.com/CVE-2026-13623/): Cross-site scripting in DiskStation Manager (DSM) (medium 4.8)
- [CVE-2026-13622](https://insights.sbomify.com/CVE-2026-13622/): Kubevirt: virt-handler-rhel9: kubevirt: virt-handler migration proxy follows symlinks allowing container escape to host (high 8.8)
- [CVE-2026-13613](https://insights.sbomify.com/CVE-2026-13613/): KiviCare < 4.5.2 - Doctor/Receptionist+ SQL Injection via settings/listing REST Endpoint (high 8.8)
- [CVE-2026-13612](https://insights.sbomify.com/CVE-2026-13612/): KiviCare < 4.5.2 - Patient+ Cross-Patient Bill, Invoice and Appointment Disclosure via IDOR (medium 4.3)
- [CVE-2026-13611](https://insights.sbomify.com/CVE-2026-13611/): KiviCare – Clinic & Patient Management System (EHR) < 4.5.5 - Unauthenticated Patient Data Disclosure (medium 5.3)
- [CVE-2026-13610](https://insights.sbomify.com/CVE-2026-13610/): KiviCare < 4.5.2 - Unauthenticated Privilege Escalation via Registration (high 7.5)
- [CVE-2026-1361](https://insights.sbomify.com/CVE-2026-1361/): ASDA-Soft Stack-based Buffer Overflow Vulnerability (high 7.8)
- [CVE-2026-13609](https://insights.sbomify.com/CVE-2026-13609/): Frontend Admin by DynamiApps < 3.29.9 - Unauthenticated Stored Cross-Site Scripting via Form Field (high 8.8)
- [CVE-2026-13608](https://insights.sbomify.com/CVE-2026-13608/): OpenLDAP SASL authentication bypass (high 7.4)
- [CVE-2026-13607](https://insights.sbomify.com/CVE-2026-13607/): File Uploads Addon for WooCommerce <= 1.7.6 - Unauthenticated Direct File Access (medium 5.9)
- [CVE-2026-13605](https://insights.sbomify.com/CVE-2026-13605/): Photo Swipe <= 4.1.1.1 - Author+ Stored XSS via title Attribute (medium 6.8)
- [CVE-2026-13604](https://insights.sbomify.com/CVE-2026-13604/): Pixelavo < 1.5.4 - Unauthenticated Facebook CAPI Event Injection via pixelavo_event AJAX (medium 5.3)
- [CVE-2026-13603](https://insights.sbomify.com/CVE-2026-13603/): SSRF with API key leak in pretix-oppwa (critical 9.0)
- [CVE-2026-13602](https://insights.sbomify.com/CVE-2026-13602/): Session takeover vulnerability (high 7.7)
- [CVE-2026-13601](https://insights.sbomify.com/CVE-2026-13601/): Yelp: yelp-xsl: overly permissive content security policy in yelp allows host file disclosure from flatpak applications (high 7.1)
- [CVE-2026-13600](https://insights.sbomify.com/CVE-2026-13600/): AutoNetTV Relay < 3.0.14 - Unauthenticated Privilege Escalation via Scheduled Sync Cron (high 8.1)
- [CVE-2026-1360](https://insights.sbomify.com/CVE-2026-1360/): BuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data (high 7.5)
- [CVE-2026-13599](https://insights.sbomify.com/CVE-2026-13599/): ABB Ability Edgenius | Missing Authentication in Edgenius AuthDB (medium 5.8)
- [CVE-2026-13598](https://insights.sbomify.com/CVE-2026-13598/): RestrictMate < 1.3.0 - Unauthenticated Privilege Escalation to Administrator (critical 9.8)
- [CVE-2026-13597](https://insights.sbomify.com/CVE-2026-13597/): QRcode Login for WeChat <= 1.3 - Unauthenticated Account Takeover (critical 9.1)
- [CVE-2026-13596](https://insights.sbomify.com/CVE-2026-13596/): Participants Database < 2.7.8.4 - Unauthenticated SQL Injection via List Search (critical 9.1)
- [CVE-2026-13595](https://insights.sbomify.com/CVE-2026-13595/): Util-linux: util-linux: heap use-after-free in libblkid nested partition probing (medium 6.8)
- [CVE-2026-13593](https://insights.sbomify.com/CVE-2026-13593/): CSS::Minifier::XS versions before 0.14 for Perl have a memory leak when the entire document is minified away (medium 6.5)
- [CVE-2026-13592](https://insights.sbomify.com/CVE-2026-13592/): liftoff-sr CIPster EtherNet IP Message append out-of-bounds write (medium 6.9)
- [CVE-2026-13591](https://insights.sbomify.com/CVE-2026-13591/): DeepMyst Mysti Contact Tracking ChannelBridge.ts _isTrackedConversation improper authorization (low 2.3)
- [CVE-2026-13590](https://insights.sbomify.com/CVE-2026-13590/): seladb PcapPlusPlus Modbus Protocol ModbusLayer.h getLength heap-based overflow (medium 6.3)
- [CVE-2026-1359](https://insights.sbomify.com/CVE-2026-1359/): Missing authorization in Genolve – Genolve AI Business Graphics, AI Images (high 8.8)
- [CVE-2026-13589](https://insights.sbomify.com/CVE-2026-13589/): seladb PcapPlusPlus Telnet Subnegotiation Packet TelnetLayer.cpp getSubCommand heap-based overflow (medium 6.3)
- [CVE-2026-13588](https://insights.sbomify.com/CVE-2026-13588/): seladb PcapPlusPlus TLS Hello SSLHandshake.cpp getHandshakeVersion heap-based overflow (medium 6.3)
- [CVE-2026-13587](https://insights.sbomify.com/CVE-2026-13587/): seladb PcapPlusPlus LightPcapNg light_pcapng.c parse_by_block_type heap-based overflow (medium 6.3)
- [CVE-2026-13586](https://insights.sbomify.com/CVE-2026-13586/): PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS) (medium 5.3)
- [CVE-2026-13585](https://insights.sbomify.com/CVE-2026-13585/): Information disclosure in Business Manager (high 8.2)
- [CVE-2026-13584](https://insights.sbomify.com/CVE-2026-13584/): Information tampering and Denial-of-service (DoS) vulnerability in CC-Link IE TSN communication protocol (high 7.1)
- [CVE-2026-13583](https://insights.sbomify.com/CVE-2026-13583/): Edimax EW-7478APC POST Request formUSBFolder buffer overflow (high 8.7)
- [CVE-2026-13582](https://insights.sbomify.com/CVE-2026-13582/): Edimax EW-7478APC POST Request formUSBAccount buffer overflow (high 8.7)
- [CVE-2026-13581](https://insights.sbomify.com/CVE-2026-13581/): Edimax EW-7478APC POST Request formStaDrvSetup os command injection (medium 5.3)
- [CVE-2026-13580](https://insights.sbomify.com/CVE-2026-13580/): Edimax EW-7478APC POST Request formQoS buffer overflow (high 8.7)
- [CVE-2026-1358](https://insights.sbomify.com/CVE-2026-1358/): Airleader Master Unrestricted Upload of File with Dangerous Type (critical 9.3)
- [CVE-2026-13579](https://insights.sbomify.com/CVE-2026-13579/): itsourcecode Hospital Management System patientchangepassword.php sql injection (medium 5.3)
- [CVE-2026-13578](https://insights.sbomify.com/CVE-2026-13578/): itsourcecode Hospital Management System patientdetail.php sql injection (medium 5.3)
- [CVE-2026-13577](https://insights.sbomify.com/CVE-2026-13577/): Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable (high 8.2)
- [CVE-2026-13574](https://insights.sbomify.com/CVE-2026-13574/): llvm llvm-project Bitcode File IntrinsicInst.cpp getBasePtr heap-based overflow (medium 4.8)
- [CVE-2026-13573](https://insights.sbomify.com/CVE-2026-13573/): llvm llvm-project ValueSymbolTable ValueSymbolTable.cpp insert stack-based overflow (medium 4.8)
- [CVE-2026-13572](https://insights.sbomify.com/CVE-2026-13572/): itsourcecode Hospital Management System insertbillingrecord.php sql injection (medium 5.3)
- [CVE-2026-13571](https://insights.sbomify.com/CVE-2026-13571/): SourceCodester Simple Food Ordering System cart.php logic error (medium 6.9)
- [CVE-2026-13570](https://insights.sbomify.com/CVE-2026-13570/): SourceCodester Inventory Management System User Registration Endpoint users_handler.php cross site scripting (medium 5.1)
- [CVE-2026-1357](https://insights.sbomify.com/CVE-2026-1357/): Migration, Backup, Staging <= 0.9.123 - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2026-13569](https://insights.sbomify.com/CVE-2026-13569/): weng-xianhu EyouCMS API index.php sql injection (medium 5.1)
- [CVE-2026-13568](https://insights.sbomify.com/CVE-2026-13568/): SourceCodester Inventory Management System User Registration Endpoint users_handler.php access control (medium 6.9)
- [CVE-2026-13567](https://insights.sbomify.com/CVE-2026-13567/): code-projects Online Music Site POST Request Feedback.php cross site scripting (medium 5.3)
- [CVE-2026-13566](https://insights.sbomify.com/CVE-2026-13566/): SourceCodester Class and Exam Timetabling System preview3.php sql injection (medium 6.9)
- [CVE-2026-13565](https://insights.sbomify.com/CVE-2026-13565/): SourceCodester Class and Exam Timetabling System edit_class1.php sql injection (medium 6.9)
- [CVE-2026-13564](https://insights.sbomify.com/CVE-2026-13564/): Edimax EW-7478APC POST Request formPPPoESetup stack-based overflow (high 8.7)
- [CVE-2026-13563](https://insights.sbomify.com/CVE-2026-13563/): Edimax EW-7478APC POST Request formL2TPSetup stack-based overflow (high 8.7)
- [CVE-2026-13562](https://insights.sbomify.com/CVE-2026-13562/): Edimax EW-7478APC POST Request formiNICSiteSurvey buffer overflow (high 8.7)
- [CVE-2026-13561](https://insights.sbomify.com/CVE-2026-13561/): Edimax EW-7478APC POST Request formiNICbasic os command injection (medium 5.3)
- [CVE-2026-13560](https://insights.sbomify.com/CVE-2026-13560/): Edimax EW-7478APC POST Request formAccept os command injection (medium 5.3)
- [CVE-2026-1356](https://insights.sbomify.com/CVE-2026-1356/): Server-side request forgery in Converter for Media – Optimize images | Convert WebP & AVIF (medium 4.8)
- [CVE-2026-13559](https://insights.sbomify.com/CVE-2026-13559/): code-projects Real State Services single-list_sale.php add sql injection (medium 6.9)
- [CVE-2026-13558](https://insights.sbomify.com/CVE-2026-13558/): CodeAstro Complaint Management System Report addreport cross site scripting (medium 5.1)
- [CVE-2026-13557](https://insights.sbomify.com/CVE-2026-13557/): itsourcecode Online Hotel Management System POST Request controller.php add cross site scripting (medium 5.3)
- [CVE-2026-13556](https://insights.sbomify.com/CVE-2026-13556/): itsourcecode Online Hotel Management System POST Request controller.php edit cross site scripting (medium 5.3)
- [CVE-2026-13555](https://insights.sbomify.com/CVE-2026-13555/): itsourcecode Online Hotel Management System controller.php add sql injection (medium 6.9)
- [CVE-2026-13554](https://insights.sbomify.com/CVE-2026-13554/): itsourcecode Online Hotel Management System POST Request controller.php add cross site scripting (medium 5.3)
- [CVE-2026-13553](https://insights.sbomify.com/CVE-2026-13553/): itsourcecode Online Hotel Management System controller.php add unrestricted upload (medium 6.9)
- [CVE-2026-13552](https://insights.sbomify.com/CVE-2026-13552/): itsourcecode Online Hotel Management System controller.php edit sql injection (medium 6.9)
- [CVE-2026-13551](https://insights.sbomify.com/CVE-2026-13551/): itsourcecode Baptism Information Management System editBaptism.php sql injection (medium 6.9)
- [CVE-2026-13550](https://insights.sbomify.com/CVE-2026-13550/): itsourcecode Baptism Information Management System delbaptism.php sql injection (medium 6.9)
- [CVE-2026-1355](https://insights.sbomify.com/CVE-2026-1355/): Missing Authorization Check in GitHub Enterprise Server Allows Unauthorized Uploads to Repository Migration Exports (medium 6.0)
- [CVE-2026-13549](https://insights.sbomify.com/CVE-2026-13549/): CodeAstro Complaint Management System Report Endpoint Report.php deletereport authorization (medium 5.3)
- [CVE-2026-13548](https://insights.sbomify.com/CVE-2026-13548/): itsourcecode Hospital Management System doctortimings.php sql injection (medium 5.3)
- [CVE-2026-13547](https://insights.sbomify.com/CVE-2026-13547/): Hanwang e-Face General Management Platform upload.do unrestricted upload (medium 6.9)
- [CVE-2026-13546](https://insights.sbomify.com/CVE-2026-13546/): Feehi CMS REST API Endpoint articles missing authentication (medium 6.9)
- [CVE-2026-13545](https://insights.sbomify.com/CVE-2026-13545/): D-Link DCS-935L POST Parameter setconf.cgi sub_400E40 os command injection (high 8.7)
- [CVE-2026-13544](https://insights.sbomify.com/CVE-2026-13544/): Feehi CMS API users access control (medium 5.3)
- [CVE-2026-13543](https://insights.sbomify.com/CVE-2026-13543/): Documenso Google OAuth Login handle-oauth-callback-url.ts improper authentication (medium 6.3)
- [CVE-2026-13542](https://insights.sbomify.com/CVE-2026-13542/): itsourcecode Hospital Management System doctorprofile.php sql injection (medium 5.3)
- [CVE-2026-13541](https://insights.sbomify.com/CVE-2026-13541/): itsourcecode Hospital Management System doctorchangepassword.php sql injection (medium 5.3)
- [CVE-2026-13540](https://insights.sbomify.com/CVE-2026-13540/): GitBucket RepositoryCreationService.scala Git.cloneRepository.setURI server-side request forgery (medium 5.3)
- [CVE-2026-1354](https://insights.sbomify.com/CVE-2026-1354/): Zero Motorcycles Firmware Key Exchange without Entity Authentication (medium 5.9)
- [CVE-2026-13539](https://insights.sbomify.com/CVE-2026-13539/): Wavlink WL-NU516U1-A POST Parameter wireless.cgi sub_407504 stack-based overflow (high 8.7)
- [CVE-2026-13538](https://insights.sbomify.com/CVE-2026-13538/): Wavlink WL-NU516U1-A POST Parameter wireless.cgi sub_401D68 command injection (medium 5.3)
- [CVE-2026-13537](https://insights.sbomify.com/CVE-2026-13537/): CodeAstro Human Resource Management System cross-site request forgery (medium 5.3)
- [CVE-2026-13536](https://insights.sbomify.com/CVE-2026-13536/): GotoHTTP reg.12x cross site scripting (medium 5.3)
- [CVE-2026-13535](https://insights.sbomify.com/CVE-2026-13535/): CodeAstro Human Resource Management System View Endpoint Employee_model.php GetFileInfo sql injection (medium 5.3)
- [CVE-2026-13534](https://insights.sbomify.com/CVE-2026-13534/): CherryHQ cherry-studio CherryIN Preload API MemoryService.ts sha256 authorization (low 2.3)
- [CVE-2026-13533](https://insights.sbomify.com/CVE-2026-13533/): agentejo Cockpit CMS htaccess config.yaml YAMLLoad file access (medium 6.9)
- [CVE-2026-13532](https://insights.sbomify.com/CVE-2026-13532/): itsourcecode Hospital Management System departmentDoctor.php sql injection (medium 5.3)
- [CVE-2026-13531](https://insights.sbomify.com/CVE-2026-13531/): itsourcecode Hospital Management System department.php sql injection (medium 5.3)
- [CVE-2026-13530](https://insights.sbomify.com/CVE-2026-13530/): itsourcecode Hospital Management System Appointment appointmentdetail.php sql injection (medium 5.3)
- [CVE-2026-13529](https://insights.sbomify.com/CVE-2026-13529/): YzmCMS index.php sql injection (medium 6.3)
- [CVE-2026-13528](https://insights.sbomify.com/CVE-2026-13528/): Path traversal in ruoyi-vue-pro (medium 6.9)
- [CVE-2026-13527](https://insights.sbomify.com/CVE-2026-13527/): SourceCodester Class and Exam Timetabling System preview4.php sql injection (medium 6.9)
- [CVE-2026-13526](https://insights.sbomify.com/CVE-2026-13526/): SourceCodester Class and Exam Timetabling System edit_class.php sql injection (medium 6.9)
- [CVE-2026-13525](https://insights.sbomify.com/CVE-2026-13525/): CodeAstro Human Resource Management System Update_Earn_Leave Endpoint Employee_model.php emselectByCode sql injection (medium 5.3)
- [CVE-2026-13524](https://insights.sbomify.com/CVE-2026-13524/): CherryHQ cherry-studio MCP OAuth Local Callback Server callback.ts improper authorization (medium 6.3)
- [CVE-2026-13523](https://insights.sbomify.com/CVE-2026-13523/): GPAC ISOBMFF base_encoding.c data amplification (medium 4.8)
- [CVE-2026-13522](https://insights.sbomify.com/CVE-2026-13522/): Investintech SlimPDFReader PDF File SlimPDFReader.exe TeighaDo+0x25cde0 out-of-bounds (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/875/