# Vulnerabilities published in 2026


- [CVE-2026-13521](https://insights.sbomify.com/CVE-2026-13521/): SourceCodester Class and Exam Timetabling System preview5.php sql injection (medium 6.9)
- [CVE-2026-13520](https://insights.sbomify.com/CVE-2026-13520/): itsourcecode Hospital Management System Appointment appointmentapproval.php sql injection (medium 5.3)
- [CVE-2026-1352](https://insights.sbomify.com/CVE-2026-1352/): IBM® Db2® is vulnerable to a trap or return SQLCODE -901 when compiling a specially crafted query with a defined index (medium 6.5)
- [CVE-2026-13519](https://insights.sbomify.com/CVE-2026-13519/): Tenda JD12L NatStaticSetting fromNatStaticSetting stack-based overflow (high 8.7)
- [CVE-2026-13518](https://insights.sbomify.com/CVE-2026-13518/): Tenda JD12L addressNat fromAddressNat stack-based overflow (high 8.7)
- [CVE-2026-13517](https://insights.sbomify.com/CVE-2026-13517/): Tenda JD12L WifiBasicSet formWifiBasicSet stack-based overflow (high 8.7)
- [CVE-2026-13516](https://insights.sbomify.com/CVE-2026-13516/): Tenda JD12L WifiGuestSet fromSetWifiGusetBasic stack-based overflow (high 8.7)
- [CVE-2026-13515](https://insights.sbomify.com/CVE-2026-13515/): Tenda JD12L SetPptpServerCfg formSetPPTPServer stack-based overflow (high 8.7)
- [CVE-2026-13514](https://insights.sbomify.com/CVE-2026-13514/): Chess Play and Learn App com.chess AndroidManifest.xml backup (low 2.4)
- [CVE-2026-13513](https://insights.sbomify.com/CVE-2026-13513/): MyScale MyScaleDB SegmentId.h getCacheKey data authenticity (low 2.3)
- [CVE-2026-13512](https://insights.sbomify.com/CVE-2026-13512/): Databend Tenant client_session_manager.rs state_key authorization (medium 5.3)
- [CVE-2026-13511](https://insights.sbomify.com/CVE-2026-13511/): VoltAgent Memory REST API memory.handlers.ts handleGetMemoryConversation improper authorization (low 2.3)
- [CVE-2026-13510](https://insights.sbomify.com/CVE-2026-13510/): SimStudioAI sim Password Protection deployment.ts weak hash (medium 6.3)
- [CVE-2026-13509](https://insights.sbomify.com/CVE-2026-13509/): RAGapp Knowledge File files.py FileHandler.remove_file path traversal (medium 5.3)
- [CVE-2026-13508](https://insights.sbomify.com/CVE-2026-13508/): khoj-ai khoj Conversation Sharing api_chat.py authorization (medium 5.1)
- [CVE-2026-13507](https://insights.sbomify.com/CVE-2026-13507/): volcengine OpenViking Local VectorDB Primary-key Label str_to_uint64.py str_to_uint64 data authenticity (low 2.3)
- [CVE-2026-13506](https://insights.sbomify.com/CVE-2026-13506/): Lazy ASN.1 sequence forcing resets nesting-depth guard (high 8.7)
- [CVE-2026-13505](https://insights.sbomify.com/CVE-2026-13505/): Zeroisation of sensitive key material on garbage collection relies on finalization (high 8.7)
- [CVE-2026-13504](https://insights.sbomify.com/CVE-2026-13504/): code-projects Project Management System Mail Compose mail.php cross site scripting (medium 5.1)
- [CVE-2026-13503](https://insights.sbomify.com/CVE-2026-13503/): antlr ANTLR4 tokenVocab Grammar Option TokenVocabParser.java getImportedVocabFile path traversal (medium 6.9)
- [CVE-2026-13502](https://insights.sbomify.com/CVE-2026-13502/): antlr ANTLR4 Maven Plugin GrammarDependencies.java ObjectInputStream.readObject toctou (low 2.0)
- [CVE-2026-13501](https://insights.sbomify.com/CVE-2026-13501/): antlr ANTLR4 gofmt GoTarget.java GoTarget command injection (medium 4.8)
- [CVE-2026-13500](https://insights.sbomify.com/CVE-2026-13500/): antlr ANTLR4 Grammar Action Block OutputFile.java code injection (medium 6.9)
- [CVE-2026-13499](https://insights.sbomify.com/CVE-2026-13499/): yashpokharna2555 restaurent-management-system Registration login_register.php cross site scripting (medium 5.3)
- [CVE-2026-13498](https://insights.sbomify.com/CVE-2026-13498/): yashpokharna2555 restaurent-management-system POST Parameter forgotpassword.php sql injection (medium 6.9)
- [CVE-2026-13497](https://insights.sbomify.com/CVE-2026-13497/): itsourcecode Hospital Management System appointment.php sql injection (medium 5.3)
- [CVE-2026-13496](https://insights.sbomify.com/CVE-2026-13496/): itsourcecode Hospital Management System ajaxmedicine.php sql injection (medium 5.3)
- [CVE-2026-13495](https://insights.sbomify.com/CVE-2026-13495/): itsourcecode Hospital Management System adminprofile.php sql injection (medium 5.1)
- [CVE-2026-13493](https://insights.sbomify.com/CVE-2026-13493/): AIDC-AI ComfyUI-Copilot Workflow Checkpoint Restore conversation_api.py resource injection (low 2.3)
- [CVE-2026-13492](https://insights.sbomify.com/CVE-2026-13492/): UsersWP <= 1.2.65 - Authenticated (Subscriber+) Arbitrary File Deletion via File Upload Field (high 8.8)
- [CVE-2026-13491](https://insights.sbomify.com/CVE-2026-13491/): 78 xiaozhi-esp32 MQTT Goodbye mqtt_protocol.cc GetInstance denial of service (medium 6.3)
- [CVE-2026-13490](https://insights.sbomify.com/CVE-2026-13490/): glpi-project glpi Document document.send.php canViewFile authorization (medium 6.3)
- [CVE-2026-13489](https://insights.sbomify.com/CVE-2026-13489/): 78 xiaozhi-esp32 MCP Response mcp_server.cc ParseMessage improper synchronization (low 2.3)
- [CVE-2026-13488](https://insights.sbomify.com/CVE-2026-13488/): SourceCodester Class and Exam Timetabling System preview7.php sql injection (medium 6.9)
- [CVE-2026-13487](https://insights.sbomify.com/CVE-2026-13487/): SourceCodester Class and Exam Timetabling System archive.php sql injection (medium 6.9)
- [CVE-2026-13486](https://insights.sbomify.com/CVE-2026-13486/): SourceCodester Class and Exam Timetabling System preview6.php sql injection (medium 6.9)
- [CVE-2026-13485](https://insights.sbomify.com/CVE-2026-13485/): SourceCodester Class and Exam Timetabling System preview.php sql injection (medium 6.9)
- [CVE-2026-13484](https://insights.sbomify.com/CVE-2026-13484/): MLflow Experiment-scoped Label Schema CRUD API authorization (low 2.3)
- [CVE-2026-13483](https://insights.sbomify.com/CVE-2026-13483/): arc53 DocsGPT Credential Storage encryption.py encrypt_credentials data authenticity (low 2.3)
- [CVE-2026-13482](https://insights.sbomify.com/CVE-2026-13482/): skypilot-org skypilot User ID server.py username.encode weak hash (medium 6.3)
- [CVE-2026-13481](https://insights.sbomify.com/CVE-2026-13481/): Out-of-bounds read in PTP management TLV TIME parsing in Zephyr net PTP (medium 5.4)
- [CVE-2026-13480](https://insights.sbomify.com/CVE-2026-13480/): Out-of-bounds read in LoRaWAN fragmented data block transport (FUOTA) downlink handler (low 3.1)
- [CVE-2026-13479](https://insights.sbomify.com/CVE-2026-13479/): Out-of-bounds read in LoRaWAN clock-sync AppTimeAns downlink handler (low 3.1)
- [CVE-2026-13478](https://insights.sbomify.com/CVE-2026-13478/): Out-of-bounds read in Zephyr ext2 block-bitmap validation from a crafted s_blocks_count (medium 5.5)
- [CVE-2026-13477](https://insights.sbomify.com/CVE-2026-13477/): IBM QRadar SIEM is vulnerable to remote code execution by privileged users (medium 4.7)
- [CVE-2026-13476](https://insights.sbomify.com/CVE-2026-13476/): IBM Informix Wire Listener Vulnerable to Unauthenticated Remote Code Execution (high 7.3)
- [CVE-2026-13474](https://insights.sbomify.com/CVE-2026-13474/): Denial of service via malformed HTTP/2 requests (high 8.7)
- [CVE-2026-13473](https://insights.sbomify.com/CVE-2026-13473/): IBM Storage Protect Client is vulnerable to Heap-Based Buffer Overflow (high 8.1)
- [CVE-2026-13471](https://insights.sbomify.com/CVE-2026-13471/): Missing authorization in Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress (medium 4.3)
- [CVE-2026-13468](https://insights.sbomify.com/CVE-2026-13468/): Missing authorization in Visualizer – Tables & Charts Manager with Built-in AI Generator (high 7.5)
- [CVE-2026-13467](https://insights.sbomify.com/CVE-2026-13467/): Systemic Missing Address Validation in SiP SMC Handlers (high 8.3)
- [CVE-2026-13466](https://insights.sbomify.com/CVE-2026-13466/): Unit Confusion in VAB Authentication (high 8.3)
- [CVE-2026-13465](https://insights.sbomify.com/CVE-2026-13465/): EL3 Stack Buffer Overflow in FCS HKDF Request (high 8.3)
- [CVE-2026-13464](https://insights.sbomify.com/CVE-2026-13464/): Missing authorization in Kirki – Freeform Page Builder, Website Builder & Customizer (medium 5.3)
- [CVE-2026-13463](https://insights.sbomify.com/CVE-2026-13463/): Due to use of IBM Storage Protect, IBM Cloud Pak System is affected by vulnerability [] (high 7.5)
- [CVE-2026-13462](https://insights.sbomify.com/CVE-2026-13462/): PayRange for Android, version 7.0.7, contains an SSL bypass vulnerability (high 7.5)
- [CVE-2026-13461](https://insights.sbomify.com/CVE-2026-13461/): PayRange version 7.0.7 contains a JavaScript injection vulnerability (critical 9.6)
- [CVE-2026-13460](https://insights.sbomify.com/CVE-2026-13460/): Hardcoded credentials in Storage Scale (high 7.5)
- [CVE-2026-1346](https://insights.sbomify.com/CVE-2026-1346/): Security Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access (critical 9.3)
- [CVE-2026-13459](https://insights.sbomify.com/CVE-2026-13459/): Missing authorization in JetFormBuilder — Dynamic Blocks Form Builder (medium 5.3)
- [CVE-2026-13458](https://insights.sbomify.com/CVE-2026-13458/): Cross-site scripting in GenerateBlocks (medium 6.4)
- [CVE-2026-13457](https://insights.sbomify.com/CVE-2026-13457/): InstaWP Connect <= 0.1.3.6 - Unauthenticated Cryptographic Key Disclosure (high 7.5)
- [CVE-2026-13456](https://insights.sbomify.com/CVE-2026-13456/): WP Maps <= 4.9.8 - Authenticated (Subscriber+) Local File Inclusion via 'page' Parameter (high 7.5)
- [CVE-2026-13455](https://insights.sbomify.com/CVE-2026-13455/): PostgreSQL Anonymizer: Unrestricted function can leak the secret salt (medium 4.3)
- [CVE-2026-13454](https://insights.sbomify.com/CVE-2026-13454/): MotoPress Appointment Booking <= 2.4.5 - Authenticated (Staff+) SQL Injection via 's' Parameter (medium 6.5)
- [CVE-2026-13451](https://insights.sbomify.com/CVE-2026-13451/): Kserve: kserve: server-side request forgery via malicious storageuri (high 7.7)
- [CVE-2026-13450](https://insights.sbomify.com/CVE-2026-13450/): Missing authorization in GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress (medium 5.3)
- [CVE-2026-1345](https://insights.sbomify.com/CVE-2026-1345/): Security Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access (high 7.3)
- [CVE-2026-13449](https://insights.sbomify.com/CVE-2026-13449/): XXE attack in IBM Business Automation Manager Open Editions (high 7.6)
- [CVE-2026-13448](https://insights.sbomify.com/CVE-2026-13448/): Code injection in Langflow OSS (high 8.1)
- [CVE-2026-13447](https://insights.sbomify.com/CVE-2026-13447/): MStore API <= 4.20.0 - Unauthenticated Authentication Bypass via 'id_token' Parameter JWT Forgery (critical 9.8)
- [CVE-2026-13446](https://insights.sbomify.com/CVE-2026-13446/): Hardcoded credentials in Langflow OSS (critical 9.8)
- [CVE-2026-13445](https://insights.sbomify.com/CVE-2026-13445/): Missing authorization in Langflow OSS (high 8.1)
- [CVE-2026-13444](https://insights.sbomify.com/CVE-2026-13444/): Missing authorization in Langflow OSS (high 8.1)
- [CVE-2026-13443](https://insights.sbomify.com/CVE-2026-13443/): Tutor LMS <= 3.9.13 - Authenticated (Author+) Stored Cross-Site Scripting via Lesson Attachment Title (medium 6.4)
- [CVE-2026-13442](https://insights.sbomify.com/CVE-2026-13442/): Missing authorization in Langflow OSS (high 7.1)
- [CVE-2026-13441](https://insights.sbomify.com/CVE-2026-13441/): EventPrime <= 4.3.4.2 - Unauthenticated Stored Cross-Site Scripting via 'new_event_type_background_color' Parameter (high 7.2)
- [CVE-2026-13440](https://insights.sbomify.com/CVE-2026-13440/): Cross-site scripting in StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce (high 7.2)
- [CVE-2026-1344](https://insights.sbomify.com/CVE-2026-1344/): Insecure file permissions in Enforce Recovery Key Portal (medium 6.5)
- [CVE-2026-13439](https://insights.sbomify.com/CVE-2026-13439/): Privilege escalation in Easy Form Builder by WhiteStudio – Drag & Drop Form Builder (critical 9.8)
- [CVE-2026-13437](https://insights.sbomify.com/CVE-2026-13437/): Information disclosure in PowerShell Universal (medium 6.5)
- [CVE-2026-13435](https://insights.sbomify.com/CVE-2026-13435/): Python Interpreter Sandbox Bypass Leading to Sensitive Data Exposure (critical 9.9)
- [CVE-2026-13434](https://insights.sbomify.com/CVE-2026-13434/): Security feature bypass in Red Hat OpenShift Virtualization 4 (medium 4.9)
- [CVE-2026-13433](https://insights.sbomify.com/CVE-2026-13433/): IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities (high 8.3)
- [CVE-2026-13432](https://insights.sbomify.com/CVE-2026-13432/): ThumbPress < 6.2.2 - Subscriber+ Plugin Deactivation (medium 5.4)
- [CVE-2026-13430](https://insights.sbomify.com/CVE-2026-13430/): File upload in Post Export Import with Media (high 7.2)
- [CVE-2026-1343](https://insights.sbomify.com/CVE-2026-1343/): Security Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access (high 7.2)
- [CVE-2026-13426](https://insights.sbomify.com/CVE-2026-13426/): Client4 fails to validate path parameters (medium 5.4)
- [CVE-2026-13425](https://insights.sbomify.com/CVE-2026-13425/): Database for CF7 <= 1.2.6 - Unauthenticated Stored Cross-Site Scripting via Array Form Field Values (high 7.2)
- [CVE-2026-13424](https://insights.sbomify.com/CVE-2026-13424/): Cross-site scripting in Online Scheduling and Appointment Booking System – Bookly (high 7.2)
- [CVE-2026-13423](https://insights.sbomify.com/CVE-2026-13423/): Streamit <= 4.5.0 - Unauthenticated Remote Code Execution via Arbitrary Function Call (critical 9.8)
- [CVE-2026-13422](https://insights.sbomify.com/CVE-2026-13422/): HD Quiz 2.2.0 - 2.2.1 - Cross-Site Request Forgery via Multiple AJAX Handlers (medium 4.3)
- [CVE-2026-1342](https://insights.sbomify.com/CVE-2026-1342/): Security Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access (high 8.5)
- [CVE-2026-13417](https://insights.sbomify.com/CVE-2026-13417/): Boards plugin denial of service via unvalidated block fields.properties (medium 4.3)
- [CVE-2026-13416](https://insights.sbomify.com/CVE-2026-13416/): CMP - Coming Soon & Maintenance < 4.1.18 - Editor+ Stored XSS via niteoCS_socialmedia (low 3.5)
- [CVE-2026-13415](https://insights.sbomify.com/CVE-2026-13415/): CMP - Coming Soon & Maintenance < 4.1.18 - Editor+ Privilege Escalation via cmp_ajax_import_settings (high 7.2)
- [CVE-2026-13414](https://insights.sbomify.com/CVE-2026-13414/): CMP - Coming Soon & Maintenance < 4.1.18 - Unauthenticated Maintenance Mode Disable via cmp_disable_comingsoon_ajax (medium 4.8)
- [CVE-2026-13413](https://insights.sbomify.com/CVE-2026-13413/): CMP - Coming Soon & Maintenance < 4.1.20 - Unauthenticated Maintenance Mode Bypass via Login URL Match (medium 5.3)
- [CVE-2026-13411](https://insights.sbomify.com/CVE-2026-13411/): Null condition in Playbooks import crashes the plugin (medium 4.3)
- [CVE-2026-13410](https://insights.sbomify.com/CVE-2026-13410/): Dancer::Plugin::Auth::Google versions before 0.08 for Perl have TLS verification disabled (high 8.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/876/