# Vulnerabilities published in 2026


- [CVE-2026-115392](https://insights.sbomify.com/CVE-2026-115392/): Security feature bypass in wasmtime (high 8.8)
- [CVE-2026-115391](https://insights.sbomify.com/CVE-2026-115391/): Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 Unbounded Heap Allocation via WASIp3 Streams (medium 6.9)
- [CVE-2026-115390](https://insights.sbomify.com/CVE-2026-115390/): Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 Fuel Accounting Bypass DoS (medium 6.9)
- [CVE-2026-11539](https://insights.sbomify.com/CVE-2026-11539/): IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities (medium 5.3)
- [CVE-2026-115389](https://insights.sbomify.com/CVE-2026-115389/): Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Denial of Service via Val API (low 1.0)
- [CVE-2026-115388](https://insights.sbomify.com/CVE-2026-115388/): Denial of service in wasmtime (medium 6.9)
- [CVE-2026-115387](https://insights.sbomify.com/CVE-2026-115387/): Integer overflow in wasmtime (medium 6.9)
- [CVE-2026-115386](https://insights.sbomify.com/CVE-2026-115386/): Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Memory Disclosure via fd_readdir (low 2.1)
- [CVE-2026-115385](https://insights.sbomify.com/CVE-2026-115385/): Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Host Panic via WASIp3 Timestamps (medium 6.9)
- [CVE-2026-115384](https://insights.sbomify.com/CVE-2026-115384/): Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Stack Buffer Overflow (critical 9.4)
- [CVE-2026-115383](https://insights.sbomify.com/CVE-2026-115383/): Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via Tag Imports (medium 5.9)
- [CVE-2026-115382](https://insights.sbomify.com/CVE-2026-115382/): Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 wasi:http Zero Timeout Panic DoS (medium 5.9)
- [CVE-2026-115381](https://insights.sbomify.com/CVE-2026-115381/): Denial of service in wasmtime (medium 5.9)
- [CVE-2026-115380](https://insights.sbomify.com/CVE-2026-115380/): Denial of service in wasmtime (medium 5.1)
- [CVE-2026-11538](https://insights.sbomify.com/CVE-2026-11538/): IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities (low 3.7)
- [CVE-2026-115379](https://insights.sbomify.com/CVE-2026-115379/): Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via try_call (medium 6.9)
- [CVE-2026-115378](https://insights.sbomify.com/CVE-2026-115378/): Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Recursive File Pull (medium 6.9)
- [CVE-2026-115377](https://insights.sbomify.com/CVE-2026-115377/): Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Symlink in Migration Stream (critical 9.4)
- [CVE-2026-115376](https://insights.sbomify.com/CVE-2026-115376/): Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 Project Restriction Bypass via Custom Volume Copy (high 8.3)
- [CVE-2026-115375](https://insights.sbomify.com/CVE-2026-115375/): Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Path Traversal via Instance Backup Dependent Volumes (critical 9.4)
- [CVE-2026-115374](https://insights.sbomify.com/CVE-2026-115374/): Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Unsigned Header Bypass in Presigned S3 Upload URLs (high 7.1)
- [CVE-2026-115373](https://insights.sbomify.com/CVE-2026-115373/): Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Authorization Bypass via GET /1.0/operations/{uuid} (high 7.0)
- [CVE-2026-115372](https://insights.sbomify.com/CVE-2026-115372/): Incus 7.3.0 before 7.5.0 Project Restriction Bypass via block.create_options (critical 9.0)
- [CVE-2026-115371](https://insights.sbomify.com/CVE-2026-115371/): Missing authorization in incus (high 7.1)
- [CVE-2026-115370](https://insights.sbomify.com/CVE-2026-115370/): Security feature bypass in incus (medium 5.3)
- [CVE-2026-11537](https://insights.sbomify.com/CVE-2026-11537/): IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities (medium 4.3)
- [CVE-2026-115369](https://insights.sbomify.com/CVE-2026-115369/): OpenBao 2.5.0 before 2.6.2 PKI allowed_ip_sans_cidr Bypass via CSR IP SANs (low 2.1)
- [CVE-2026-115366](https://insights.sbomify.com/CVE-2026-115366/): OpenBao 2.3.0 before 2.6.3 Missing Root Namespace Enforcement in Plugin Catalog APIs (low 2.0)
- [CVE-2026-115365](https://insights.sbomify.com/CVE-2026-115365/): OpenBao 2.3.0 before 2.6.3 Incorrect Authorization via Policy Cache Namespace Traversal (high 7.5)
- [CVE-2026-115364](https://insights.sbomify.com/CVE-2026-115364/): OpenBao before 2.6.3 Missing Header Check on Agent/Proxy Quit Endpoints (low 2.1)
- [CVE-2026-115363](https://insights.sbomify.com/CVE-2026-115363/): OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 ACME EAB MAC Key Disclosure via Sanitized Configuration (low 2.1)
- [CVE-2026-115362](https://insights.sbomify.com/CVE-2026-115362/): OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Expired AppRole SecretID Authentication Bypass (low 2.1)
- [CVE-2026-115361](https://insights.sbomify.com/CVE-2026-115361/): OpenBao before 2.6.3 ACL Bypass via Dropped Templated Policy Denial (low 2.1)
- [CVE-2026-115360](https://insights.sbomify.com/CVE-2026-115360/): OpenBao before 2.6.3 Open Redirect via OIDC Identity Provider UI (medium 5.3)
- [CVE-2026-11536](https://insights.sbomify.com/CVE-2026-11536/): IBM WebSphere Application Server is affected by a remote code execution vulnerability (high 8.5)
- [CVE-2026-115359](https://insights.sbomify.com/CVE-2026-115359/): OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Role-Based Rate Limit Quota Bypass via Request Parsing (medium 6.3)
- [CVE-2026-115358](https://insights.sbomify.com/CVE-2026-115358/): OpenBao before 2.6.3 Sensitive Data Leak in Audit Log via Malformed Parameters (low 2.0)
- [CVE-2026-115357](https://insights.sbomify.com/CVE-2026-115357/): OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Improper Audit Logging of Root Generation and Rekey Responses (low 2.1)
- [CVE-2026-115356](https://insights.sbomify.com/CVE-2026-115356/): OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Kubernetes Auth Method Token Renewal After Revocation (medium 5.3)
- [CVE-2026-115355](https://insights.sbomify.com/CVE-2026-115355/): Mistune before 3.3.0 Path Traversal and XSS via Include Directive (high 8.7)
- [CVE-2026-115354](https://insights.sbomify.com/CVE-2026-115354/): Mistune before 3.3.0 Arbitrary Local File Read via Include Directive (high 7.1)
- [CVE-2026-115353](https://insights.sbomify.com/CVE-2026-115353/): Mistune before 3.3.0 Path Traversal via include Directive (critical 9.2)
- [CVE-2026-115352](https://insights.sbomify.com/CVE-2026-115352/): Mistune before 3.3.0 Quadratic-Time DoS via Unmatched Brackets in Inline Parser (high 8.7)
- [CVE-2026-115351](https://insights.sbomify.com/CVE-2026-115351/): Mistune 3.2.1 before 3.3.0 CSS Injection via Figure Directive figwidth Option (medium 5.3)
- [CVE-2026-115350](https://insights.sbomify.com/CVE-2026-115350/): Mistune before 3.3.0 Stored XSS via Include Directive HTML Files (medium 5.3)
- [CVE-2026-11535](https://insights.sbomify.com/CVE-2026-11535/): Auth bypass in PcSuite (critical 9.4)
- [CVE-2026-115349](https://insights.sbomify.com/CVE-2026-115349/): Mistune 3.0.0 before 3.3.0 Denial of Service via Nested Bracket Parsing (high 8.7)
- [CVE-2026-115348](https://insights.sbomify.com/CVE-2026-115348/): Mistune before 3.3.0 Quadratic-Time DoS via parse_link_text (high 8.7)
- [CVE-2026-115347](https://insights.sbomify.com/CVE-2026-115347/): Mistune before 3.3.0 Quadratic Denial of Service via parse_link_text (high 8.7)
- [CVE-2026-11534](https://insights.sbomify.com/CVE-2026-11534/): imvks786 student_management_system add.php cross site scripting (medium 5.1)
- [CVE-2026-115334](https://insights.sbomify.com/CVE-2026-115334/): Lotus through 0.10.2 Authorization Bypass via switch_organization Endpoint (high 7.6)
- [CVE-2026-115333](https://insights.sbomify.com/CVE-2026-115333/): Lotus through 0.10.2 Improper Authentication via Event Ingestion API Key Prefix (high 8.2)
- [CVE-2026-115332](https://insights.sbomify.com/CVE-2026-115332/): Lotus through 0.10.2 SQL Injection via Subscription Filter Keys (high 8.7)
- [CVE-2026-115331](https://insights.sbomify.com/CVE-2026-115331/): Lotus through 0.10.2 SQL Injection via Metric Property Names and Filters (high 8.7)
- [CVE-2026-115330](https://insights.sbomify.com/CVE-2026-115330/): Lotus through 0.10.2 SQL Injection via Custom SQL Billable Metrics (high 8.7)
- [CVE-2026-11533](https://insights.sbomify.com/CVE-2026-11533/): imvks786 student_management_system Student Deletion Endpoint see.php improper authorization (medium 5.3)
- [CVE-2026-115329](https://insights.sbomify.com/CVE-2026-115329/): Lotus through 0.10.2 Cross-Organization IDOR via SubscriptionViewSet (medium 6.0)
- [CVE-2026-115328](https://insights.sbomify.com/CVE-2026-115328/): JSON-SCADA before 0.65-alpha SQL Injection via OPC HistoryRead API (high 8.7)
- [CVE-2026-115327](https://insights.sbomify.com/CVE-2026-115327/): libyang through 6.4.13 Uninitialized Pointer Free in NETCONF RPC Parser (medium 6.0)
- [CVE-2026-115326](https://insights.sbomify.com/CVE-2026-115326/): QloApps through 1.7.0 IDOR via OrderDetailController Refund Request (medium 5.3)
- [CVE-2026-115325](https://insights.sbomify.com/CVE-2026-115325/): Netmaker through 1.7.0 Authorization Bypass via updateExtClient Unscoped Lookup (high 8.7)
- [CVE-2026-115324](https://insights.sbomify.com/CVE-2026-115324/): mem0 0.1.117 before 1.0.8 SQL Injection via Databricks Vector Store (critical 9.2)
- [CVE-2026-115323](https://insights.sbomify.com/CVE-2026-115323/): EverShop 1.2.2 before 2.2.1 Missing Authorization via Customer Address API (medium 6.9)
- [CVE-2026-115322](https://insights.sbomify.com/CVE-2026-115322/): Bytebase before 3.16.0 Authorization Bypass via Rollout Service Task Run Handlers (medium 5.3)
- [CVE-2026-115321](https://insights.sbomify.com/CVE-2026-115321/): Bytebase before 3.16.0 Authorization Bypass via UpdateIssueComment (medium 5.3)
- [CVE-2026-11532](https://insights.sbomify.com/CVE-2026-11532/): imvks786 student_management_system Student Record add.php access control (medium 5.3)
- [CVE-2026-115319](https://insights.sbomify.com/CVE-2026-115319/): fzf 0.36.0 through 0.74.5 Denial of Service via maskActionContents (low 2.0)
- [CVE-2026-11531](https://insights.sbomify.com/CVE-2026-11531/): imvks786 student_management_system Administrator Login Endpoint admin_login.php sql injection (medium 6.9)
- [CVE-2026-115303](https://insights.sbomify.com/CVE-2026-115303/): Contact Form by Supsystic < 1.11.1 - Unauthenticated CRLF / Email Header Injection via Reply-To Field Mapping (low 3.7)
- [CVE-2026-115302](https://insights.sbomify.com/CVE-2026-115302/): Contact Form by Supsystic < 1.11.1 - Unauthenticated Arbitrary Statistics Deletion (medium 5.3)
- [CVE-2026-115301](https://insights.sbomify.com/CVE-2026-115301/): Contact Form by Supsystic < 1.11.1 - Admin+ SSTI via Form Text Block (high 7.2)
- [CVE-2026-115300](https://insights.sbomify.com/CVE-2026-115300/): Contact Form by Supsystic < 1.11.1 - Contact Submission and Statistics Deletion via CSRF (medium 4.3)
- [CVE-2026-11530](https://insights.sbomify.com/CVE-2026-11530/): imvks786 student_management_system Login index.ph sql injection (medium 6.9)
- [CVE-2026-1153](https://insights.sbomify.com/CVE-2026-1153/): technical-laohu mpay cross-site request forgery (medium 5.3)
- [CVE-2026-115299](https://insights.sbomify.com/CVE-2026-115299/): Contact Form by Supsystic < 1.11.1 - Arbitrary Plugin Settings Update via CSRF (medium 5.4)
- [CVE-2026-11529](https://insights.sbomify.com/CVE-2026-11529/): designcomputer mysql-mcp-server mysql URI server.py read_resource sql injection (medium 5.3)
- [CVE-2026-115282](https://insights.sbomify.com/CVE-2026-115282/): Recipe Card Blocks Lite 2.6.4 - 3.6.3 - Unauthenticated Unpublished Post Content Disclosure (medium 5.3)
- [CVE-2026-115281](https://insights.sbomify.com/CVE-2026-115281/): Recipe Card Blocks 3.5.0 - 3.6.3 - Contributor+ SQLi via 'recipeId' Attribute (medium 6.8)
- [CVE-2026-11528](https://insights.sbomify.com/CVE-2026-11528/): Tenda AC18 Web Management getRebootStatus sub_45304 stack-based overflow (high 8.7)
- [CVE-2026-11527](https://insights.sbomify.com/CVE-2026-11527/): Command injection in Config::IniFiles (high 8.6)
- [CVE-2026-115269](https://insights.sbomify.com/CVE-2026-115269/): HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit (high 8.7)
- [CVE-2026-11526](https://insights.sbomify.com/CVE-2026-11526/): Command injection in GD (critical 9.8)
- [CVE-2026-115259](https://insights.sbomify.com/CVE-2026-115259/): Photo Engine < 6.6.0 - Author+ Arbitrary Content Modification via IDOR (medium 4.9)
- [CVE-2026-115255](https://insights.sbomify.com/CVE-2026-115255/): WP Roster < 2.35 - Unauthenticated Roster Member Deletion (medium 5.3)
- [CVE-2026-115253](https://insights.sbomify.com/CVE-2026-115253/): WatchGuard Agent Incorrect Permission Assignment in Log Directory Allows Local Log Tampering (high 7.3)
- [CVE-2026-115251](https://insights.sbomify.com/CVE-2026-115251/): Duplicator 1.5.17 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via One-Click Upgrade (high 7.2)
- [CVE-2026-11525](https://insights.sbomify.com/CVE-2026-11525/): undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching (low 3.7)
- [CVE-2026-115249](https://insights.sbomify.com/CVE-2026-115249/): subhajitkhan online-clinic-management-system Appointment Booking patappointtime.php input validation (medium 5.1)
- [CVE-2026-115248](https://insights.sbomify.com/CVE-2026-115248/): subhajitkhan online-clinic-management-system Booking patappointtime.php behavioral workflow (medium 5.3)
- [CVE-2026-115247](https://insights.sbomify.com/CVE-2026-115247/): subhajitkhan online-clinic-management-system patientregistration.php missing encryption (medium 5.3)
- [CVE-2026-115246](https://insights.sbomify.com/CVE-2026-115246/): subhajitkhan online-clinic-management-system patdocmsg.php cross site scripting (medium 5.1)
- [CVE-2026-115245](https://insights.sbomify.com/CVE-2026-115245/): Chat AI with Dispatcher < 2.4 - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2026-11524](https://insights.sbomify.com/CVE-2026-11524/): Tenda W20E Web Management modifyWifiFilterRules stack-based overflow (high 8.7)
- [CVE-2026-11523](https://insights.sbomify.com/CVE-2026-11523/): Tenda W20E Web Management PortalAuth formPortalAuth stack-based overflow (high 8.7)
- [CVE-2026-115225](https://insights.sbomify.com/CVE-2026-115225/): Smart Popup by Supsystic < 2.0.2 - Unauthenticated SSRF via MailChimp Groups Lookup (medium 5.8)
- [CVE-2026-115224](https://insights.sbomify.com/CVE-2026-115224/): Smart Popup by Supsystic < 2.0.2 - Admin+ SQLi via Popup Page/Category Binding (medium 4.1)
- [CVE-2026-115223](https://insights.sbomify.com/CVE-2026-115223/): Smart Popup by Supsystic < 2.0.2 - Admin+ SSTI via Popup Text Block (medium 4.9)
- [CVE-2026-115221](https://insights.sbomify.com/CVE-2026-115221/): Ipa: freeipa: freeipa uses subject cn as proof of certificate ownership (medium 5.4)
- [CVE-2026-11522](https://insights.sbomify.com/CVE-2026-11522/): Tenda W20E setPortMirror formSetPortMirror stack-based overflow (high 8.7)
- [CVE-2026-115216](https://insights.sbomify.com/CVE-2026-115216/): Eclipse ioFog Operator disables TLS certificate verification when sending Controller and OIDC credentials (critical 9.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/906/