# Vulnerabilities published in 2026


- [CVE-2026-11770](https://insights.sbomify.com/CVE-2026-11770/): 389-ds-base: 389-ds-base: pre-auth ldap filter injection in cleanallruv status check (high 7.5)
- [CVE-2026-1177](https://insights.sbomify.com/CVE-2026-1177/): Yonyou KSOA HTTP GET Parameter save_folder.jsp sql injection (medium 6.9)
- [CVE-2026-11769](https://insights.sbomify.com/CVE-2026-11769/): Operator - Namespaced User Path Traversal (medium 6.4)
- [CVE-2026-117688](https://insights.sbomify.com/CVE-2026-117688/): Keycloak-services: keycloak-services: vault secret disclosure via client registration installation configuration (medium 5.3)
- [CVE-2026-11767](https://insights.sbomify.com/CVE-2026-11767/): CRT Addons for Elementor < 1.6.7 - Unauthenticated Stored XSS via Contact Form (high 8.8)
- [CVE-2026-11766](https://insights.sbomify.com/CVE-2026-11766/): Ultimate Member < 2.12.0 - Subscriber+ Stored XSS via Custom Textarea Profile Fields (high 8.0)
- [CVE-2026-11765](https://insights.sbomify.com/CVE-2026-11765/): Argument Injection in TUBITAK BILGEM's Pardus Pen (low 3.3)
- [CVE-2026-11764](https://insights.sbomify.com/CVE-2026-11764/): Data exposed without proper permission (low 3.6)
- [CVE-2026-11763](https://insights.sbomify.com/CVE-2026-11763/): IDOR in GIS Informatics' GisLab Laboratory Management System (medium 6.5)
- [CVE-2026-117627](https://insights.sbomify.com/CVE-2026-117627/): Keycloak-services: keycloak-services: jwt authorization grant bypasses identity provider login restrictions (medium 5.4)
- [CVE-2026-117626](https://insights.sbomify.com/CVE-2026-117626/): Path traversal in Jenkins (not scored)
- [CVE-2026-117625](https://insights.sbomify.com/CVE-2026-117625/): Missing authorization in Jenkins (not scored)
- [CVE-2026-117624](https://insights.sbomify.com/CVE-2026-117624/): Deserialization in Jenkins (not scored)
- [CVE-2026-117623](https://insights.sbomify.com/CVE-2026-117623/): Cross-site scripting in Jenkins (not scored)
- [CVE-2026-117622](https://insights.sbomify.com/CVE-2026-117622/): Cross-site scripting in Jenkins (not scored)
- [CVE-2026-117621](https://insights.sbomify.com/CVE-2026-117621/): Cross-site scripting in Jenkins (not scored)
- [CVE-2026-117620](https://insights.sbomify.com/CVE-2026-117620/): Missing authorization in Jenkins (not scored)
- [CVE-2026-117619](https://insights.sbomify.com/CVE-2026-117619/): Auth bypass in Jenkins (not scored)
- [CVE-2026-117618](https://insights.sbomify.com/CVE-2026-117618/): Race condition in Jenkins (not scored)
- [CVE-2026-117617](https://insights.sbomify.com/CVE-2026-117617/): Path traversal in Jenkins (not scored)
- [CVE-2026-117616](https://insights.sbomify.com/CVE-2026-117616/): Path traversal in Jenkins (not scored)
- [CVE-2026-117615](https://insights.sbomify.com/CVE-2026-117615/): Path traversal in Jenkins (not scored)
- [CVE-2026-117614](https://insights.sbomify.com/CVE-2026-117614/): Code injection in Jenkins (not scored)
- [CVE-2026-117613](https://insights.sbomify.com/CVE-2026-117613/): Deserialization in Jenkins (not scored)
- [CVE-2026-117612](https://insights.sbomify.com/CVE-2026-117612/): Deserialization in Jenkins (not scored)
- [CVE-2026-117611](https://insights.sbomify.com/CVE-2026-117611/): Trust of compromised eMudhra root CA in bundled CA stores (high 7.1)
- [CVE-2026-117610](https://insights.sbomify.com/CVE-2026-117610/): libexpat through 2.9.0 NULL Pointer Dereference via External Entity Subparser (high 8.2)
- [CVE-2026-117609](https://insights.sbomify.com/CVE-2026-117609/): rtl_433 through 25.12 Stack-Based Buffer Overflow via Proflame 2 Decoder (high 7.1)
- [CVE-2026-117608](https://insights.sbomify.com/CVE-2026-117608/): Assimp through 6.0.5 Heap Out-of-Bounds Read via MD2 Importer Integer Overflow (medium 6.9)
- [CVE-2026-117607](https://insights.sbomify.com/CVE-2026-117607/): Xerte Online Toolkits through 3.15.5 RCE via Language Pack Import (high 8.6)
- [CVE-2026-117606](https://insights.sbomify.com/CVE-2026-117606/): NexoPOS through 6.3.0 Missing Authorization via Cash Register Session Actions (medium 5.3)
- [CVE-2026-117605](https://insights.sbomify.com/CVE-2026-117605/): nopCommerce before 5.00.0 Missing Authorization via Admin ProductController Add Popup Handlers (medium 5.3)
- [CVE-2026-117604](https://insights.sbomify.com/CVE-2026-117604/): Grav from 1.7.53.3 before 1.7.53.6 Clockwork Profiler Authorization Bypass via Loopback Fallback (high 8.7)
- [CVE-2026-117603](https://insights.sbomify.com/CVE-2026-117603/): Electrum before 4.7.2 Nostr Wallet Connect Plugin Daily Spending Limit Bypass (critical 9.3)
- [CVE-2026-117602](https://insights.sbomify.com/CVE-2026-117602/): Electrum before 4.7.2 External Plugin Authorization Bypass Local Code Execution (high 8.6)
- [CVE-2026-117601](https://insights.sbomify.com/CVE-2026-117601/): Electrum before 4.8.3 Missing Signature Verification of Mempool Transactions (critical 9.3)
- [CVE-2026-1176](https://insights.sbomify.com/CVE-2026-1176/): itsourcecode School Management System index.php sql injection (medium 6.9)
- [CVE-2026-117574](https://insights.sbomify.com/CVE-2026-117574/): Missing authorization in Red Hat OpenShift AI (RHOAI) (critical 9.1)
- [CVE-2026-117573](https://insights.sbomify.com/CVE-2026-117573/): hagent through commit 761eec6 OS Command Injection via Arduino and ESP32 MCP Tools (high 8.5)
- [CVE-2026-117570](https://insights.sbomify.com/CVE-2026-117570/): nmap-mcp through commit 3636afa Permissive NSE Script Allowlist in scan_vulnerabilities (medium 4.8)
- [CVE-2026-11757](https://insights.sbomify.com/CVE-2026-11757/): Reflected XSS in KA Informatics' Bar Association Website (medium 6.1)
- [CVE-2026-117569](https://insights.sbomify.com/CVE-2026-117569/): Kali-GPT through commit a608c74 OS Command Injection via MCP Scanner Tool Parameters (high 8.5)
- [CVE-2026-117568](https://insights.sbomify.com/CVE-2026-117568/): mcp-ffmpeg through 1.0.5 OS Command Injection via videoPath and outputDir (high 7.3)
- [CVE-2026-117567](https://insights.sbomify.com/CVE-2026-117567/): esp-mcp through commit 28afddf OS Command Injection via MCP Tool Parameters (high 8.5)
- [CVE-2026-117566](https://insights.sbomify.com/CVE-2026-117566/): EasyImages2.0 through 2.8.6 Unauthenticated Path Traversal via down.php, thumb.php and info.php (medium 6.9)
- [CVE-2026-117565](https://insights.sbomify.com/CVE-2026-117565/): Artalk before 2.10.1 Unauthenticated SSRF via Comment Page Title Fetch (medium 6.9)
- [CVE-2026-117564](https://insights.sbomify.com/CVE-2026-117564/): nest-admin before 1.0.1 Authentication Bypass via Hardcoded JWT Secret (critical 9.3)
- [CVE-2026-117563](https://insights.sbomify.com/CVE-2026-117563/): MrDoc through 1.1.1 Broken Access Control via manage_doc_share (medium 5.3)
- [CVE-2026-117562](https://insights.sbomify.com/CVE-2026-117562/): rssant 1.9.0 through 1.9.1 Information Disclosure via publish.story_get Endpoint (medium 6.9)
- [CVE-2026-117561](https://insights.sbomify.com/CVE-2026-117561/): sf-mcp through 1.3.2 OS Command Injection via Salesforce CLI Flag Values (high 8.5)
- [CVE-2026-117560](https://insights.sbomify.com/CVE-2026-117560/): ATXP Gemini CLI Extension through 1.0.0 OS Command Injection via MCP Tools (high 8.5)
- [CVE-2026-11756](https://insights.sbomify.com/CVE-2026-11756/): Deserialization in Station Launcher App in 3DEXPERIENCE platform (critical 10.0)
- [CVE-2026-117559](https://insights.sbomify.com/CVE-2026-117559/): DroidMind through 0.4.0 Command Injection via Shell Allowlist Bypass (high 8.5)
- [CVE-2026-117558](https://insights.sbomify.com/CVE-2026-117558/): ai-sdlc MCP Server through 0.31.2 Command Injection via check_issue and check_pr_status (high 8.5)
- [CVE-2026-117557](https://insights.sbomify.com/CVE-2026-117557/): SDL_image through 3.4.8 and 2.8.12 Stack Out-of-Bounds Read in ILBM Loader (medium 6.9)
- [CVE-2026-117556](https://insights.sbomify.com/CVE-2026-117556/): zchunk before 1.5.5 Heap Out-of-Bounds Read via read_preface() (medium 5.3)
- [CVE-2026-117555](https://insights.sbomify.com/CVE-2026-117555/): GreycLab CImg through 4.0.6 Heap Out-of-Bounds Read via Integer Overflow in _load_bmp() (medium 6.9)
- [CVE-2026-117554](https://insights.sbomify.com/CVE-2026-117554/): Admidio before 5.0.17 Event Guest Restriction Bypass via events_function.php (medium 5.3)
- [CVE-2026-117553](https://insights.sbomify.com/CVE-2026-117553/): Umbraco CMS before 17.7.2 and 18.2.2 Account Takeover via Host Header Poisoning (high 7.7)
- [CVE-2026-117548](https://insights.sbomify.com/CVE-2026-117548/): Null dereference in Red Hat Directory Server 11 (medium 6.5)
- [CVE-2026-117541](https://insights.sbomify.com/CVE-2026-117541/): svg-sanitizer 0.11.0 before 1.1.0 Uncaught LogicException DoS via sanitize() (medium 6.9)
- [CVE-2026-117540](https://insights.sbomify.com/CVE-2026-117540/): svg-sanitizer before 1.1.0 Quadratic CPU-Exhaustion DoS via PHP-Tag Stripping Loop (high 8.7)
- [CVE-2026-11754](https://insights.sbomify.com/CVE-2026-11754/): User Enumeration in Seres Software's syWEB (medium 5.3)
- [CVE-2026-117539](https://insights.sbomify.com/CVE-2026-117539/): darylldoyle svg-sanitizer before 1.0.0 CSS Injection and Remote Reference Bypass (medium 5.1)
- [CVE-2026-117538](https://insights.sbomify.com/CVE-2026-117538/): REDAXO before 5.21.0 Reflected XSS via Packages API function Parameter (low 2.1)
- [CVE-2026-117537](https://insights.sbomify.com/CVE-2026-117537/): REDAXO before 5.21.0 Reflected XSS via Metainfo API type Parameter (low 2.1)
- [CVE-2026-117536](https://insights.sbomify.com/CVE-2026-117536/): REDAXO before 5.21.3 CSRF Token Bypass via users/users Privilege Escalation (high 8.6)
- [CVE-2026-117535](https://insights.sbomify.com/CVE-2026-117535/): REDAXO before 5.21.3 Reflected XSS via opener_link in Media Pool (medium 5.1)
- [CVE-2026-117534](https://insights.sbomify.com/CVE-2026-117534/): REDAXO before 5.21.3 CSRF in Article History Plugin (medium 5.1)
- [CVE-2026-117533](https://insights.sbomify.com/CVE-2026-117533/): REDAXO 5.18.0 before 5.21.4 Stored XSS via Unsanitized Mediapool SVG Uploads (low 2.1)
- [CVE-2026-117532](https://insights.sbomify.com/CVE-2026-117532/): REDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History Plugin (critical 9.3)
- [CVE-2026-117530](https://insights.sbomify.com/CVE-2026-117530/): Command injection in Junie CLI (medium 6.7)
- [CVE-2026-117526](https://insights.sbomify.com/CVE-2026-117526/): reduxjs redux-devtools Remotedev Server evalAction code injection (medium 4.8)
- [CVE-2026-11752](https://insights.sbomify.com/CVE-2026-11752/): Armeria: External Control of File Name or Path in xDS SDS DataSource (medium 5.9)
- [CVE-2026-117516](https://insights.sbomify.com/CVE-2026-117516/): oretnom23 php-travel-agency-system Contact Form contact_insert.php sql injection (medium 6.9)
- [CVE-2026-117515](https://insights.sbomify.com/CVE-2026-117515/): oretnom23 php-travel-agency-system traceapplication.php sql injection (medium 6.9)
- [CVE-2026-117514](https://insights.sbomify.com/CVE-2026-117514/): oretnom23 php-travel-agency-system Admin Record Pages customer_detail.php sql injection (medium 6.9)
- [CVE-2026-117513](https://insights.sbomify.com/CVE-2026-117513/): oretnom23 php-travel-agency-system Admin Search Pages customer_search.php sql injection (medium 6.9)
- [CVE-2026-117512](https://insights.sbomify.com/CVE-2026-117512/): oretnom23 php-travel-agency-system employee_insert.php unrestricted upload (medium 6.9)
- [CVE-2026-117511](https://insights.sbomify.com/CVE-2026-117511/): desmondmorris node-tesseract Command Builder tesseract.js process os command injection (medium 6.9)
- [CVE-2026-117510](https://insights.sbomify.com/CVE-2026-117510/): Dexmal Dexbotic gr00tsonic Checkpoint Loader gr00tsonic_arch.py load_pretrained_gr00t path traversal (medium 5.3)
- [CVE-2026-11751](https://insights.sbomify.com/CVE-2026-11751/): Security feature bypass in Armeria (critical 9.1)
- [CVE-2026-117509](https://insights.sbomify.com/CVE-2026-117509/): crownpku Rasa_NLU_Chi Model Persistor persistor.py Persistor._decompress path traversal (medium 5.3)
- [CVE-2026-117507](https://insights.sbomify.com/CVE-2026-117507/): a2aproject a2a-java TaskManager.saveTaskEvent race condition (medium 5.3)
- [CVE-2026-117506](https://insights.sbomify.com/CVE-2026-117506/): Denial of service in a2a-java (medium 5.3)
- [CVE-2026-117505](https://insights.sbomify.com/CVE-2026-117505/): a2aproject a2a-java ChildQueue queue.offer resource consumption (medium 5.3)
- [CVE-2026-117504](https://insights.sbomify.com/CVE-2026-117504/): a2aproject a2a-go Distributed Manager distributed_manager.go Cancel denial of service (medium 6.9)
- [CVE-2026-117503](https://insights.sbomify.com/CVE-2026-117503/): a2aproject a2a-go REST SSE handler rest.go resource consumption (medium 6.9)
- [CVE-2026-117501](https://insights.sbomify.com/CVE-2026-117501/): HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies (not scored)
- [CVE-2026-117500](https://insights.sbomify.com/CVE-2026-117500/): HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload. (not scored)
- [CVE-2026-1175](https://insights.sbomify.com/CVE-2026-1175/): birkir prime GraphQL Directive graphql information exposure (medium 6.9)
- [CVE-2026-117499](https://insights.sbomify.com/CVE-2026-117499/): @fastify/session vulnerable to session revocation bypass via a logout race condition (low 3.7)
- [CVE-2026-117494](https://insights.sbomify.com/CVE-2026-117494/): Multiple vulnerabilities in Sisense’s Cloud BI Platform (high 8.3)
- [CVE-2026-117493](https://insights.sbomify.com/CVE-2026-117493/): Multiple vulnerabilities in Sisense’s Cloud BI Platform (high 8.3)
- [CVE-2026-11748](https://insights.sbomify.com/CVE-2026-11748/): Central Dogma: LDAP injection in SearchFirstActiveDirectoryRealm enables authentication confusion and audit log evasion (medium 6.9)
- [CVE-2026-117472](https://insights.sbomify.com/CVE-2026-117472/): URL prefix handling permits API key read-scope bypass in Psono Server (medium 4.3)
- [CVE-2026-117471](https://insights.sbomify.com/CVE-2026-117471/): User-controlled Duo host permits authenticated SSRF in Psono Server (medium 5.4)
- [CVE-2026-117470](https://insights.sbomify.com/CVE-2026-117470/): WebAuthn assertion replay permits second-factor bypass in Psono Server (medium 6.5)
- [CVE-2026-11747](https://insights.sbomify.com/CVE-2026-11747/): Reflected XSS in Seres Software's syWEB (medium 6.1)
- [CVE-2026-117469](https://insights.sbomify.com/CVE-2026-117469/): File-transfer type confusion permits unauthorized repository writes in Psono Server (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/896/