# Vulnerabilities published in 2026


- [CVE-2026-116157](https://insights.sbomify.com/CVE-2026-116157/): ImageMagick before 7.1.2-33 Memory Leak in PerlMagick Property Reading (medium 4.8)
- [CVE-2026-116156](https://insights.sbomify.com/CVE-2026-116156/): ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via -set profile Option (medium 4.8)
- [CVE-2026-116155](https://insights.sbomify.com/CVE-2026-116155/): ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via Crafted XMP Profile (medium 6.9)
- [CVE-2026-116154](https://insights.sbomify.com/CVE-2026-116154/): ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via XML Parsing Depth Limit (medium 6.9)
- [CVE-2026-116153](https://insights.sbomify.com/CVE-2026-116153/): ImageMagick before 7.1.2-33 Heap Buffer Overflow via Convex-Hull on 32-bit (low 2.0)
- [CVE-2026-116152](https://insights.sbomify.com/CVE-2026-116152/): ImageMagick before 7.1.2-33 Memory Leak in MAT Decoder Error Path (medium 6.9)
- [CVE-2026-116151](https://insights.sbomify.com/CVE-2026-116151/): ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak in JNG Encoder (medium 6.3)
- [CVE-2026-116150](https://insights.sbomify.com/CVE-2026-116150/): ImageMagick before 7.1.2-33 Memory Leak in FPX Encoder (low 2.3)
- [CVE-2026-116149](https://insights.sbomify.com/CVE-2026-116149/): ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Stack Buffer Overflow via bzip2 Compressed Images (high 7.2)
- [CVE-2026-116148](https://insights.sbomify.com/CVE-2026-116148/): ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Code Injection via MVG Encoder Drawing Options (medium 4.8)
- [CVE-2026-116147](https://insights.sbomify.com/CVE-2026-116147/): ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Null Pointer Dereference in DJVU Decoder (medium 6.3)
- [CVE-2026-116146](https://insights.sbomify.com/CVE-2026-116146/): ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak in MSL Decoder (medium 6.3)
- [CVE-2026-116145](https://insights.sbomify.com/CVE-2026-116145/): ImageMagick before 6.9.13-58 and 7.x before 7.1.2-32 Security Policy Bypass via Incomplete Fix (low 1.8)
- [CVE-2026-116144](https://insights.sbomify.com/CVE-2026-116144/): ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Stack Overflow via MVG Decoder (medium 4.8)
- [CVE-2026-116143](https://insights.sbomify.com/CVE-2026-116143/): ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Policy Bypass in PS, PDF and XPS Decoders (medium 4.8)
- [CVE-2026-116142](https://insights.sbomify.com/CVE-2026-116142/): ImageMagick before 7.1.2-33 Heap Buffer Over-Read via Minimum-Bounding-Box (medium 4.8)
- [CVE-2026-116141](https://insights.sbomify.com/CVE-2026-116141/): ImageMagick before 7.1.2-33 Policy Bypass in UHDR Decoder (medium 6.9)
- [CVE-2026-116140](https://insights.sbomify.com/CVE-2026-116140/): ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Policy Bypass via Delegate Invocation Parsing (medium 4.8)
- [CVE-2026-11614](https://insights.sbomify.com/CVE-2026-11614/): Cross-site scripting in Xpro Addons — 140+ Widgets for Elementor (medium 6.4)
- [CVE-2026-116139](https://insights.sbomify.com/CVE-2026-116139/): WWBN AVideo 26.0 through 29.3.0 Stored XSS via Comment Markdown Rendering (medium 5.1)
- [CVE-2026-116137](https://insights.sbomify.com/CVE-2026-116137/): adm-zip through 0.6.1 Duplicate-Entry Validation Bypass via Canonically Equivalent Names (medium 6.3)
- [CVE-2026-116136](https://insights.sbomify.com/CVE-2026-116136/): ProjectSend 2.0.0 through 2.7.1 Incorrect Authorization via File Version Linking (medium 6.0)
- [CVE-2026-116135](https://insights.sbomify.com/CVE-2026-116135/): HTTP::Body versions before 1.23_01 for Perl drop mixed-case percent escapes from urlencoded form fields instead of decoding them. (not scored)
- [CVE-2026-116134](https://insights.sbomify.com/CVE-2026-116134/): HTTP::Body versions before 1.23_01 for Perl allow memory exhaustion via an unbounded multipart part header block (not scored)
- [CVE-2026-116133](https://insights.sbomify.com/CVE-2026-116133/): HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic rescanning of a multipart body with a missing or malformed boundary. (not scored)
- [CVE-2026-116132](https://insights.sbomify.com/CVE-2026-116132/): HTTP::Body versions before 1.23_01 for Perl leave the temporary file of an incomplete multipart upload on disk (not scored)
- [CVE-2026-116131](https://insights.sbomify.com/CVE-2026-116131/): HTTP::Body versions before 1.23_01 for Perl allow memory and temporary file exhaustion via an unlimited number of form fields and multipart parts. (not scored)
- [CVE-2026-11613](https://insights.sbomify.com/CVE-2026-11613/): Divi Ajax Filter <= 5.1.2 - Unauthenticated Local File Inclusion via 'custom_loop_template' Parameter (critical 9.8)
- [CVE-2026-116124](https://insights.sbomify.com/CVE-2026-116124/): GNOME libgsf OLE2 gsf-infile-msole.c ole_info_read_metabat heap-based overflow (medium 5.3)
- [CVE-2026-116123](https://insights.sbomify.com/CVE-2026-116123/): NocoDB signup validatePassword excessive authentication (medium 6.3)
- [CVE-2026-116122](https://insights.sbomify.com/CVE-2026-116122/): NocoDB Sign-in Endpoint AuthService.validateUser information disclosure (medium 6.3)
- [CVE-2026-116121](https://insights.sbomify.com/CVE-2026-116121/): NocoDB Registration users.service.ts race condition (medium 6.3)
- [CVE-2026-116120](https://insights.sbomify.com/CVE-2026-116120/): NocoDB PublicApiLimiterGuard signup UserRefreshToken.deleteAllUserToken allocation of resources (medium 6.3)
- [CVE-2026-116119](https://insights.sbomify.com/CVE-2026-116119/): NocoDB Password-Reset Flow users.service.ts race condition (medium 5.1)
- [CVE-2026-116118](https://insights.sbomify.com/CVE-2026-116118/): Z.ai Zcode Sed Command Filter os command injection (medium 5.3)
- [CVE-2026-116117](https://insights.sbomify.com/CVE-2026-116117/): halo-dev halo View Name Resolver DefaultViewNameResolver.java path traversal (medium 6.9)
- [CVE-2026-116116](https://insights.sbomify.com/CVE-2026-116116/): Yoosee GM8135S Camera Secure Boot signature verification (critical 9.3)
- [CVE-2026-116115](https://insights.sbomify.com/CVE-2026-116115/): Yoosee GM8135S Camera WiFi Configuration wpa_supplicantX.conf initialization (low 2.3)
- [CVE-2026-116114](https://insights.sbomify.com/CVE-2026-116114/): Yoosee GM8135S Camera Live UDP H.264 Video Stream npc cleartext transmission (medium 6.3)
- [CVE-2026-116113](https://insights.sbomify.com/CVE-2026-116113/): GouGuOA Api.php chunkUpload unrestricted upload (medium 5.3)
- [CVE-2026-116112](https://insights.sbomify.com/CVE-2026-116112/): HashenUdara edoc-doctor-appointment-system add-new.php sql injection (medium 6.9)
- [CVE-2026-116111](https://insights.sbomify.com/CVE-2026-116111/): 2K Games Civilization V Lua Sandbox loadstring type confusion (medium 5.3)
- [CVE-2026-116110](https://insights.sbomify.com/CVE-2026-116110/): GiantappMan LiveWallPaper SignalR Hub UploadFile missing authentication (medium 6.9)
- [CVE-2026-11611](https://insights.sbomify.com/CVE-2026-11611/): 389-ds-base: 389-ds-base: content sync plugin unbounded queue growth and race conditions (medium 6.5)
- [CVE-2026-116109](https://insights.sbomify.com/CVE-2026-116109/): continuedev Continue MCP Server Transport ConfigHandler.ts MCPManagerSingleton.setConnections os command injection (medium 5.3)
- [CVE-2026-116108](https://insights.sbomify.com/CVE-2026-116108/): openbq-org OpenBB Local API Server api_settings.py access control (medium 5.3)
- [CVE-2026-116107](https://insights.sbomify.com/CVE-2026-116107/): Datafeedr Product Sets Plugin AJAX Handlers ajax.php dfrps_ajax_delete_saved_search authorization (medium 5.3)
- [CVE-2026-116106](https://insights.sbomify.com/CVE-2026-116106/): HeyCyan App FileProvider access control (medium 6.9)
- [CVE-2026-116105](https://insights.sbomify.com/CVE-2026-116105/): HeyCyan App Network Security Configuration AndroidManifest.xml cleartext transmission (medium 6.3)
- [CVE-2026-116104](https://insights.sbomify.com/CVE-2026-116104/): Sony Neural Network Libraries NNP Converter utils.py func_set_nnabla_version_decorate code injection (medium 5.3)
- [CVE-2026-116103](https://insights.sbomify.com/CVE-2026-116103/): Sony Neural Network Libraries Encode Param encode_decode_param.py load_param_in_txt code injection (medium 5.3)
- [CVE-2026-116102](https://insights.sbomify.com/CVE-2026-116102/): QuantGeekDev docker-mcp docker_executor.py _build_windows_command os command injection (medium 5.3)
- [CVE-2026-116101](https://insights.sbomify.com/CVE-2026-116101/): itsourcecode Online Cake Ordering System deletetransac.php sql injection (medium 5.3)
- [CVE-2026-116100](https://insights.sbomify.com/CVE-2026-116100/): gougucms User Level Level.php add cross site scripting (medium 4.8)
- [CVE-2026-11610](https://insights.sbomify.com/CVE-2026-11610/): 389-ds-base: 389-ds-base: heap buffer overflow in sasl_io_recv() via padded sasl unbind (high 8.8)
- [CVE-2026-1161](https://insights.sbomify.com/CVE-2026-1161/): pbrong hrms recruitment.go UpdateRecruitmentById cross site scripting (medium 5.1)
- [CVE-2026-116099](https://insights.sbomify.com/CVE-2026-116099/): Fusion Creators Studio SCP Containment Breach Multiplayer Skynet++ Virtual Machine BlitzBanks out-of-bounds write (medium 5.3)
- [CVE-2026-116098](https://insights.sbomify.com/CVE-2026-116098/): SteelRaven7 Ravenfield RFL Custom Map Handler/RFLD Custom Map cacheCoverPoints deserialization (medium 5.3)
- [CVE-2026-116097](https://insights.sbomify.com/CVE-2026-116097/): CloudClassroom-PHP-Project addnewstudent.php cross site scripting (medium 5.3)
- [CVE-2026-116096](https://insights.sbomify.com/CVE-2026-116096/): ggml-org llama.cpp Pocket-TTS pockettts-gen.cpp list_pockettts_state_slots out-of-bounds write (medium 4.8)
- [CVE-2026-116095](https://insights.sbomify.com/CVE-2026-116095/): smg-project smg llm-multimodal jpeg_turbo.rs decode_jpeg_rgb memory allocation (medium 6.9)
- [CVE-2026-116094](https://insights.sbomify.com/CVE-2026-116094/): EyouCMS function.php remote_file_to_local server-side request forgery (medium 6.9)
- [CVE-2026-11608](https://insights.sbomify.com/CVE-2026-11608/): WP Customer Reviews <= 3.7.8 - Reflected Cross-Site Scripting via 'wpcr3_fname' Parameter (medium 6.1)
- [CVE-2026-116078](https://insights.sbomify.com/CVE-2026-116078/): HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit (high 8.7)
- [CVE-2026-116073](https://insights.sbomify.com/CVE-2026-116073/): Leon before commit 50df142 Path Traversal via /download model Command (medium 6.9)
- [CVE-2026-116072](https://insights.sbomify.com/CVE-2026-116072/): Infinity for Reddit through 8.3.4 OAuth Login CSRF via LoginChromeCustomTabActivity (medium 5.3)
- [CVE-2026-116071](https://insights.sbomify.com/CVE-2026-116071/): rotki before 1.44.2 Weak Key Derivation for Premium Cloud Backup Encryption (high 8.2)
- [CVE-2026-116070](https://insights.sbomify.com/CVE-2026-116070/): Docker-Proxy through 5.1.9 Missing Authentication via hubcmdui /api/config (medium 6.9)
- [CVE-2026-11607](https://insights.sbomify.com/CVE-2026-11607/): TYPO3 CMS - Broken Access Control in Form Framework (high 7.6)
- [CVE-2026-116069](https://insights.sbomify.com/CVE-2026-116069/): NiubiGEO before 0.3.2 Unauthenticated SSRF via /audit-plan domain Field (medium 6.9)
- [CVE-2026-116068](https://insights.sbomify.com/CVE-2026-116068/): Dokploy through 0.30.10 Cross-Organization Authorization Bypass via Application tRPC Router (high 8.7)
- [CVE-2026-116067](https://insights.sbomify.com/CVE-2026-116067/): Paisa before 0.7.8 Path Traversal via Editor and Sheet API (high 8.8)
- [CVE-2026-116066](https://insights.sbomify.com/CVE-2026-116066/): Firecrawl before 2.11.586 SSRF Protection Bypass via DNS Rebinding in Playwright Service (high 7.0)
- [CVE-2026-116063](https://insights.sbomify.com/CVE-2026-116063/): DedeCMS update_guide.php require_once code injection (medium 5.1)
- [CVE-2026-116062](https://insights.sbomify.com/CVE-2026-116062/): SourceCodester Performance Indicator System save_profile.php sql injection (medium 6.9)
- [CVE-2026-116061](https://insights.sbomify.com/CVE-2026-116061/): SourceCodester Performance Indicator System edit_dealer.php sql injection (medium 6.9)
- [CVE-2026-116060](https://insights.sbomify.com/CVE-2026-116060/): SourceCodester Performance Indicator System adddealer.php sql injection (medium 6.9)
- [CVE-2026-116058](https://insights.sbomify.com/CVE-2026-116058/): Alfresco Activiti JuelScriptEngine.java JuelScriptEngine.eval code injection (medium 5.3)
- [CVE-2026-116057](https://insights.sbomify.com/CVE-2026-116057/): KodCloud KodExplorer Online Editor Save Endpoint editor.class.php unrestricted upload (medium 5.3)
- [CVE-2026-116056](https://insights.sbomify.com/CVE-2026-116056/): KodCloud KodExplorer Remote Download web.function.php request_url_safe server-side request forgery (medium 5.3)
- [CVE-2026-116055](https://insights.sbomify.com/CVE-2026-116055/): SourceCodester Performance Indicator System deleteproduct.php sql injection (medium 5.3)
- [CVE-2026-116054](https://insights.sbomify.com/CVE-2026-116054/): SH3 Módulo de Gestão/Módulo de Arrecadação weak password hash (low 2.1)
- [CVE-2026-116053](https://insights.sbomify.com/CVE-2026-116053/): dbcli mycli Whitelist source.py source_special_command_is_safe os command injection (medium 4.8)
- [CVE-2026-116052](https://insights.sbomify.com/CVE-2026-116052/): LinkStackOrg LinkStack cross-site request forgery (medium 5.3)
- [CVE-2026-116050](https://insights.sbomify.com/CVE-2026-116050/): krupalshah Employee Recruitment System Registration registerform3.php sql injection (medium 6.9)
- [CVE-2026-11605](https://insights.sbomify.com/CVE-2026-11605/): Unnecessary validation of DNSSEC signed records (high 7.5)
- [CVE-2026-116049](https://insights.sbomify.com/CVE-2026-116049/): krupalshah EmployeeRecruitmentSystem Registration Wizard registerform2.php mysql_query sql injection (medium 6.9)
- [CVE-2026-116048](https://insights.sbomify.com/CVE-2026-116048/): krupalshah EmployeeRecruitmentSystem Registration registerform1.php mysql_query sql injection (medium 6.9)
- [CVE-2026-116047](https://insights.sbomify.com/CVE-2026-116047/): Privoce Vocechat Query Parameter widget.html cross site scripting (medium 5.3)
- [CVE-2026-116046](https://insights.sbomify.com/CVE-2026-116046/): eventcatalog sdk Custom Documentation Helpers custom-docs.ts rmCustomDoc path traversal (medium 4.8)
- [CVE-2026-116045](https://insights.sbomify.com/CVE-2026-116045/): 1999AZZAR designer-mcp MCP motion-dev-guidelines.md get_reference path traversal (medium 5.3)
- [CVE-2026-116044](https://insights.sbomify.com/CVE-2026-116044/): prasathmani TinyFileManager Remote URL File Upload tinyfilemanager.php unrestricted upload (medium 5.3)
- [CVE-2026-11604](https://insights.sbomify.com/CVE-2026-11604/): Memory corruption in ovpn-dco-win (medium 5.6)
- [CVE-2026-11603](https://insights.sbomify.com/CVE-2026-11603/): Product Filter Widget for Elementor <= 1.0.6 - Reflected Cross-Site Scripting via 'args[filterFormArray]' Parameter (medium 6.1)
- [CVE-2026-116020](https://insights.sbomify.com/CVE-2026-116020/): BookStack before 26.09.2 Incorrect Authorization via AttachmentController on Draft Pages (medium 5.3)
- [CVE-2026-116019](https://insights.sbomify.com/CVE-2026-116019/): Grav 2.0.15 before 2.2.13 Allowlist Bypass via Flex Form Override Directives (high 8.7)
- [CVE-2026-116018](https://insights.sbomify.com/CVE-2026-116018/): ONEARMY community-platform before 2.165.2 IDOR via notification read endpoint (medium 5.3)
- [CVE-2026-116017](https://insights.sbomify.com/CVE-2026-116017/): Xiaozhi-esp32-server before 0.9.8 IDOR via device address-book endpoint (medium 5.3)
- [CVE-2026-116016](https://insights.sbomify.com/CVE-2026-116016/): yudao-cloud through 2026.09 Data Permission Bypass via data-permission-enable Header (high 7.1)
- [CVE-2026-116015](https://insights.sbomify.com/CVE-2026-116015/): yudao-cloud through 2026.09 IDOR via after-sale-log list endpoint (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/902/