# Vulnerabilities published in 2026


- [CVE-2026-116266](https://insights.sbomify.com/CVE-2026-116266/): MIME::Head versions from 5.518 before 5.521 for Perl decode a partly encoded multipart boundary without flagging the parse as ambiguous. (not scored)
- [CVE-2026-116265](https://insights.sbomify.com/CVE-2026-116265/): MIME::Field::ParamVal versions before 5.521 for Perl do not flag an ambiguous multipart boundary written as RFC 2231 continuations. (not scored)
- [CVE-2026-116264](https://insights.sbomify.com/CVE-2026-116264/): MIME::Field::ParamVal versions before 5.521 for Perl allow one invalid Content-Type parameter to hide the parameters after it, including the multipart boundary. (not scored)
- [CVE-2026-116263](https://insights.sbomify.com/CVE-2026-116263/): HaschekSolutions PictShare File Upload core.php architect race condition (low 2.1)
- [CVE-2026-116262](https://insights.sbomify.com/CVE-2026-116262/): libimobiledevice Web Inspector webinspector.c webinspector_receive_with_timeout heap-based overflow (medium 5.3)
- [CVE-2026-116261](https://insights.sbomify.com/CVE-2026-116261/): libimobiledevice AFC File afc.c afc_file_open out-of-bounds (medium 5.1)
- [CVE-2026-116260](https://insights.sbomify.com/CVE-2026-116260/): libimobiledevice AFC Service afc.c service_receive double free (medium 6.9)
- [CVE-2026-11626](https://insights.sbomify.com/CVE-2026-11626/): Local Privilege Escalation in Symantec Endpoint Protection macOS CleanWipe Removal Tool (medium 5.4)
- [CVE-2026-116259](https://insights.sbomify.com/CVE-2026-116259/): libimobiledevice Device Info afc.c afc_get_device_info_key memory corruption (medium 4.8)
- [CVE-2026-116258](https://insights.sbomify.com/CVE-2026-116258/): libimobiledevice AFC afc.c heap-based overflow (medium 5.3)
- [CVE-2026-116257](https://insights.sbomify.com/CVE-2026-116257/): BillaBear Installation InstallController.php processInstall missing authentication (medium 6.9)
- [CVE-2026-116256](https://insights.sbomify.com/CVE-2026-116256/): geesondog RhaPHP Mp Module Media Proxy Show.php image server-side request forgery (medium 6.9)
- [CVE-2026-116255](https://insights.sbomify.com/CVE-2026-116255/): PGYER codefever URI Sanitizer doc.php _detail path traversal (medium 6.9)
- [CVE-2026-116254](https://insights.sbomify.com/CVE-2026-116254/): rathena FluxCP PayPal IPN PaymentNotifyRequest.php verifyiprange origin validation (medium 6.9)
- [CVE-2026-116253](https://insights.sbomify.com/CVE-2026-116253/): DedeCMS Advertisement Rendering ad_js.php _RunMagicQuotes code injection (medium 6.9)
- [CVE-2026-11625](https://insights.sbomify.com/CVE-2026-11625/): Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes (high 7.5)
- [CVE-2026-11624](https://insights.sbomify.com/CVE-2026-11624/): MCP Toolbox for Databases has an Origin Validation Error (critical 9.4)
- [CVE-2026-116237](https://insights.sbomify.com/CVE-2026-116237/): Oray Pugongying X5 Pro Dnsmasq crlf injection (critical 9.3)
- [CVE-2026-116236](https://insights.sbomify.com/CVE-2026-116236/): Oray Pugongying X5 Pro PPPoE WAN Setting upload_files plugin_init unrestricted upload (high 8.6)
- [CVE-2026-116235](https://insights.sbomify.com/CVE-2026-116235/): Oray Pugongying X5 Pro L2TP Authentication crlf injection (critical 9.4)
- [CVE-2026-116234](https://insights.sbomify.com/CVE-2026-116234/): Oray Pugongying X5 Pro IPsec Policy ipsec.conf crlf injection (critical 9.4)
- [CVE-2026-116233](https://insights.sbomify.com/CVE-2026-116233/): Oray Pugongying X5 Pro Dnsmasq crlf injection (critical 9.4)
- [CVE-2026-116232](https://insights.sbomify.com/CVE-2026-116232/): Oray Pugongying X5 Pro SNMP snmp_set crlf injection (critical 9.4)
- [CVE-2026-116231](https://insights.sbomify.com/CVE-2026-116231/): Oray Pugongying X5 Pro Ser2net crlf injection (critical 9.4)
- [CVE-2026-116230](https://insights.sbomify.com/CVE-2026-116230/): Ndemic Creations Plague Inc Evolved Workshop Scenario Loader deserialization (medium 5.3)
- [CVE-2026-11623](https://insights.sbomify.com/CVE-2026-11623/): tmux image.c image_free use after free (low 2.0)
- [CVE-2026-116229](https://insights.sbomify.com/CVE-2026-116229/): ffxiv-teamcraft FFXIV Teamcraft Renderer-Process IPC Bridge preload.ts clipboard.readText cross site scripting (medium 5.1)
- [CVE-2026-116228](https://insights.sbomify.com/CVE-2026-116228/): 777genius agent-teams-ai Local HTTP Service HttpServer.ts doStart missing authentication (medium 4.8)
- [CVE-2026-116227](https://insights.sbomify.com/CVE-2026-116227/): Edimax BR-6208AC Virtual Server cross site scripting (medium 4.8)
- [CVE-2026-116224](https://insights.sbomify.com/CVE-2026-116224/): fr0tt benotes Bookmark Metadata Endpoint PostController.php getUrlInfo server-side request forgery (medium 5.3)
- [CVE-2026-116223](https://insights.sbomify.com/CVE-2026-116223/): icret EasyImage del.php privileges management (medium 6.9)
- [CVE-2026-11622](https://insights.sbomify.com/CVE-2026-11622/): Potential memory usage beyond configured limits (high 7.5)
- [CVE-2026-116219](https://insights.sbomify.com/CVE-2026-116219/): Dolibarr ERP CRM before 24.0.0 OS Command Injection via mysqldump Parameter (high 8.6)
- [CVE-2026-116218](https://insights.sbomify.com/CVE-2026-116218/): Dolibarr ERP CRM 19.0.0 before 23.0.4 SQL Injection via bankaccounts API type field (high 7.2)
- [CVE-2026-116217](https://insights.sbomify.com/CVE-2026-116217/): RosarioSIS before 12.9.2 Reflected XSS via menu_id in MenuReports.php (medium 5.3)
- [CVE-2026-116216](https://insights.sbomify.com/CVE-2026-116216/): MacCMS v10 through 2026.1000.4056 Comment Impersonation via user_id Mass Assignment (medium 6.9)
- [CVE-2026-116215](https://insights.sbomify.com/CVE-2026-116215/): MacCMS v10 through 2026.1000.4056 Race Condition via Card Redemption (low 2.3)
- [CVE-2026-116214](https://insights.sbomify.com/CVE-2026-116214/): MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code (critical 9.3)
- [CVE-2026-116213](https://insights.sbomify.com/CVE-2026-116213/): Webasyst Framework through 4.4.0 Arbitrary File Read via waArchiveTar Symlinks (medium 6.9)
- [CVE-2026-116212](https://insights.sbomify.com/CVE-2026-116212/): Webasyst Framework through 4.4.0 Stored XSS via Photos Album URL (medium 5.1)
- [CVE-2026-116211](https://insights.sbomify.com/CVE-2026-116211/): YesWiki 4.5.0 before 4.7.0 SQL Injection via date_maj_fiche in Bazar entry create (high 8.8)
- [CVE-2026-116210](https://insights.sbomify.com/CVE-2026-116210/): Webasyst Framework through 4.4.0 Photos App CSRF via Backend Actions (high 7.1)
- [CVE-2026-11621](https://insights.sbomify.com/CVE-2026-11621/): Dcat-Admin User Setting upload editorMDUpload unrestricted upload (medium 5.1)
- [CVE-2026-116208](https://insights.sbomify.com/CVE-2026-116208/): YesWiki 4.6.2 before 4.7.0 Missing Authorization in ActivityPub syncActorPosts (high 7.2)
- [CVE-2026-116207](https://insights.sbomify.com/CVE-2026-116207/): YesWiki 4.6.0 before 4.7.0 SQL Injection via Bazar Entries Search API (high 8.8)
- [CVE-2026-116206](https://insights.sbomify.com/CVE-2026-116206/): YesWiki 4.2.0 before 4.7.0 Stored XSS via Comment Raw-HTML Syntax (medium 5.3)
- [CVE-2026-116205](https://insights.sbomify.com/CVE-2026-116205/): YesWiki before 4.7.0 Unauthenticated SSRF via [[|URL]] Raw-Inclusion Syntax (medium 6.9)
- [CVE-2026-116204](https://insights.sbomify.com/CVE-2026-116204/): YesWiki before 4.7.0 CSRF via despam Admin Action (high 7.2)
- [CVE-2026-116203](https://insights.sbomify.com/CVE-2026-116203/): YesWiki before 4.7.0 Stored XSS via filtertags Action Parameters (medium 5.3)
- [CVE-2026-116202](https://insights.sbomify.com/CVE-2026-116202/): YesWiki before 4.7.0 Stored XSS via ImageField SVG Upload (medium 5.1)
- [CVE-2026-116201](https://insights.sbomify.com/CVE-2026-116201/): Snipe-IT before 8.5.0 SAML Assertion Replay via Race Condition (high 8.7)
- [CVE-2026-116200](https://insights.sbomify.com/CVE-2026-116200/): Snipe-IT before 8.6.3 LDAP StartTLS Downgrade via connectToLdap() (high 8.2)
- [CVE-2026-11620](https://insights.sbomify.com/CVE-2026-11620/): TOTOLINK EX200 vsftpd vsftpd.conf least privilege violation (medium 6.9)
- [CVE-2026-1162](https://insights.sbomify.com/CVE-2026-1162/): UTT HiPER 810 setSysAdm strcpy buffer overflow (critical 9.3)
- [CVE-2026-116199](https://insights.sbomify.com/CVE-2026-116199/): Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback (critical 9.2)
- [CVE-2026-116198](https://insights.sbomify.com/CVE-2026-116198/): Snipe-IT before 8.7.0 Missing Encryption via Api AssetsController store (medium 5.3)
- [CVE-2026-116197](https://insights.sbomify.com/CVE-2026-116197/): Contrast 1.21.0 before 1.25.0 Credential Leak via imagepuller Wildcard Registry Selection (low 2.1)
- [CVE-2026-116196](https://insights.sbomify.com/CVE-2026-116196/): Rclone before v1.75.2 B2 Credential Leak on Redirect via --b2-download-url (medium 6.0)
- [CVE-2026-116195](https://insights.sbomify.com/CVE-2026-116195/): Rclone before 1.75.2 Path Traversal via translateLink .rclonelink Suffix Trim (high 7.0)
- [CVE-2026-116194](https://insights.sbomify.com/CVE-2026-116194/): Rclone 1.52.0 before 1.75.2 CSRF via pCloud OAuth Callback (high 7.6)
- [CVE-2026-116193](https://insights.sbomify.com/CVE-2026-116193/): Rclone 1.64.0 before 1.75.2 serve webdav Authentication Bypass via OPTIONS Requests (medium 6.9)
- [CVE-2026-116192](https://insights.sbomify.com/CVE-2026-116192/): rclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote roots (high 8.2)
- [CVE-2026-116191](https://insights.sbomify.com/CVE-2026-116191/): Rclone before 1.75.2 Path Traversal via serve webdav MKCOL (high 8.7)
- [CVE-2026-116190](https://insights.sbomify.com/CVE-2026-116190/): rclone v1.56.0 before v1.75.2 WebDAV Credential Header Leak on Redirect (medium 6.3)
- [CVE-2026-11619](https://insights.sbomify.com/CVE-2026-11619/): Dolibarr ERP CRM Legacy Filemanager config.inc.php improper authorization (medium 5.3)
- [CVE-2026-116189](https://insights.sbomify.com/CVE-2026-116189/): rclone 1.55.0 before 1.75.2 selfupdate Signature Verification Bypass via SHA256SUMS (high 7.7)
- [CVE-2026-116188](https://insights.sbomify.com/CVE-2026-116188/): rclone serve s3 1.75.0 before 1.75.2 Memory Limit Bypass via Multipart Overflow (medium 6.9)
- [CVE-2026-116187](https://insights.sbomify.com/CVE-2026-116187/): Rclone v1.68.0 before v1.75.2 Authorization Bypass in serve s3 Multipart Uploads (medium 6.1)
- [CVE-2026-116186](https://insights.sbomify.com/CVE-2026-116186/): OpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetId (low 2.3)
- [CVE-2026-116185](https://insights.sbomify.com/CVE-2026-116185/): OpenRemote before 1.31.0 Cross-Realm Information Disclosure via getGatewayActiveTunnelInfos (medium 5.3)
- [CVE-2026-116184](https://insights.sbomify.com/CVE-2026-116184/): OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocket (low 2.1)
- [CVE-2026-116183](https://insights.sbomify.com/CVE-2026-116183/): phpMyFAQ before 4.1.10 Authorization Bypass via /api/faq/create openQuestionID (high 8.7)
- [CVE-2026-116182](https://insights.sbomify.com/CVE-2026-116182/): phpMyFAQ before 4.1.10 SSRF via PDF Export Image Fetching (medium 5.3)
- [CVE-2026-116181](https://insights.sbomify.com/CVE-2026-116181/): vLLM 0.20.1 before 0.29.0 DoS and GPU Out-of-Bounds Write via stop_token_ids (high 7.1)
- [CVE-2026-116180](https://insights.sbomify.com/CVE-2026-116180/): vLLM from 0.8.5 before 0.31.0 Cross-Tenant DoS via Uninitialized LogprobsTensors (high 8.3)
- [CVE-2026-11618](https://insights.sbomify.com/CVE-2026-11618/): DTStack Taier Source Connection Test Endpoint LoginInterceptor.java preHandle improper authentication (medium 6.9)
- [CVE-2026-116179](https://insights.sbomify.com/CVE-2026-116179/): vLLM 0.18.0 before 0.31.0 Memory Exhaustion via media_io_kwargs num_frames Override (high 8.7)
- [CVE-2026-116178](https://insights.sbomify.com/CVE-2026-116178/): vLLM 0.20.0 before 0.30.0 DoS via /inference/v1/generate mm_placeholders (high 8.2)
- [CVE-2026-116177](https://insights.sbomify.com/CVE-2026-116177/): vLLM 0.10.2 before 0.25.0 DoS via Nemotron-VL Processor Decompression-Bomb Guard Bypass (high 8.7)
- [CVE-2026-116176](https://insights.sbomify.com/CVE-2026-116176/): vLLM 0.9.2 before 0.24.0 SSRF via X-Request-Id in P2pNcclConnector (high 8.8)
- [CVE-2026-116175](https://insights.sbomify.com/CVE-2026-116175/): vLLM 0.19.0 before 0.24.0 Audio Decompression Bomb DoS via Chat Completions (high 7.1)
- [CVE-2026-116174](https://insights.sbomify.com/CVE-2026-116174/): vLLM 0.22.0 before 0.24.0 Denial of Service via Rust gRPC Generate (high 8.2)
- [CVE-2026-116173](https://insights.sbomify.com/CVE-2026-116173/): vLLM 0.22.0 before 0.24.0 Denial of Service via gRPC output_candidates.token_ids (high 8.2)
- [CVE-2026-116172](https://insights.sbomify.com/CVE-2026-116172/): vLLM 0.22.0 before 0.24.0 DoS via Rust gRPC CandidateTokens.top_n (high 8.2)
- [CVE-2026-116171](https://insights.sbomify.com/CVE-2026-116171/): SiYuan 3.5.4 before 3.8.7 Sensitive Path Bypass via Windows Extended-Length Prefix (medium 5.9)
- [CVE-2026-116170](https://insights.sbomify.com/CVE-2026-116170/): SiYuan before v3.8.7 SQL Injection via History Search op and query (medium 6.9)
- [CVE-2026-11617](https://insights.sbomify.com/CVE-2026-11617/): Tanium addressed a compression bomb vulnerability in Findings. (low 3.1)
- [CVE-2026-116169](https://insights.sbomify.com/CVE-2026-116169/): SiYuan 2.10.0 before 3.8.7 Stored XSS via KaTeX \href in Math Blocks (medium 5.1)
- [CVE-2026-116168](https://insights.sbomify.com/CVE-2026-116168/): SiYuan before v3.8.7 Path Traversal Local File Read via MCP Asset Tool (medium 6.9)
- [CVE-2026-116167](https://insights.sbomify.com/CVE-2026-116167/): SiYuan 2.9.0 before 3.8.7 XSS via check-auth to Parameter (high 7.6)
- [CVE-2026-116166](https://insights.sbomify.com/CVE-2026-116166/): SiYuan 3.6.0 before 3.8.7 Cleartext Transmission via Unenforced networkServeTLS Setting (high 7.6)
- [CVE-2026-116165](https://insights.sbomify.com/CVE-2026-116165/): Parse Server 9.0.0 before 9.10.4-alpha.4 Unauthenticated Class Schema Deletion on MongoDB (high 8.8)
- [CVE-2026-116164](https://insights.sbomify.com/CVE-2026-116164/): Parse Server 9.0.0 before 9.10.4-alpha.3 Reserved Field Name Injection via Object Writes (medium 6.3)
- [CVE-2026-116163](https://insights.sbomify.com/CVE-2026-116163/): Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses (critical 9.1)
- [CVE-2026-116162](https://insights.sbomify.com/CVE-2026-116162/): Parse Server 9.0.0 before 9.10.5-alpha.5 Privilege Escalation via SMS MFA Login (low 2.1)
- [CVE-2026-116161](https://insights.sbomify.com/CVE-2026-116161/): Parse Server 9.0.0 before 9.10.5-alpha.4 LiveQuery Information Disclosure via $or Subscriptions (medium 6.0)
- [CVE-2026-116160](https://insights.sbomify.com/CVE-2026-116160/): ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Heap Buffer Overflow via X11 Animate (medium 4.8)
- [CVE-2026-11616](https://insights.sbomify.com/CVE-2026-11616/): Events Calendar for GeoDirectory <= 2.3.28 - Authenticated (Subscriber+) Privilege Escalation (high 8.8)
- [CVE-2026-116159](https://insights.sbomify.com/CVE-2026-116159/): ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via -cdl Option (medium 4.8)
- [CVE-2026-116158](https://insights.sbomify.com/CVE-2026-116158/): ImageMagick before 7.1.2-33 Memory Leak in magick compare (low 2.0)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/901/