# Vulnerabilities published in 2026


- [CVE-2026-115214](https://insights.sbomify.com/CVE-2026-115214/): Datawiza Proxy Auth Plugin 1.1.0 - Unauthenticated Privilege Escalation via X-User and Role Headers (critical 9.8)
- [CVE-2026-11521](https://insights.sbomify.com/CVE-2026-11521/): Mohammed-eid35 bank-management-system-springboot Transaction Endpoint TransactionController.java improper authorization (medium 5.3)
- [CVE-2026-115207](https://insights.sbomify.com/CVE-2026-115207/): Patch: filename validation bypass in reversal fallback allows file creation outside the working directory (medium 5.5)
- [CVE-2026-11520](https://insights.sbomify.com/CVE-2026-11520/): SourceCodester Inventory System header.php cross site scripting (medium 5.1)
- [CVE-2026-1152](https://insights.sbomify.com/CVE-2026-1152/): technical-laohu mpay QR Code Image unrestricted upload (medium 5.1)
- [CVE-2026-115196](https://insights.sbomify.com/CVE-2026-115196/): An Open Redirect vulnerability exists in the public form submission endpoint (/form/submit) of Mautic. (medium 5.4)
- [CVE-2026-115195](https://insights.sbomify.com/CVE-2026-115195/): A broken access control vulnerability exists in the Mautic Stats API (/api/stats/{table}). (medium 6.5)
- [CVE-2026-115194](https://insights.sbomify.com/CVE-2026-115194/): A path traversal vulnerability exists in the Mautic Asset API. (medium 6.5)
- [CVE-2026-115193](https://insights.sbomify.com/CVE-2026-115193/): A stored Cross-Site Scripting (XSS) vulnerability exists in the contact detail view of Mautic 7. (high 8.2)
- [CVE-2026-115192](https://insights.sbomify.com/CVE-2026-115192/): An SQL Injection vulnerability exists in the dashboard widget data API endpoint (/api/data/{type}). (high 7.1)
- [CVE-2026-115191](https://insights.sbomify.com/CVE-2026-115191/): A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration interface (/s/ajax). (high 7.1)
- [CVE-2026-115190](https://insights.sbomify.com/CVE-2026-115190/): An insecure deserialization (PHP object injection) vulnerability exists in Mautic's handling of segment filters and custom field properties. (high 8.0)
- [CVE-2026-11519](https://insights.sbomify.com/CVE-2026-11519/): SourceCodester Inventory System Account Creation users_handler.php improper authorization (medium 5.3)
- [CVE-2026-115189](https://insights.sbomify.com/CVE-2026-115189/): A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic. (high 8.8)
- [CVE-2026-115188](https://insights.sbomify.com/CVE-2026-115188/): An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. (critical 9.9)
- [CVE-2026-115183](https://insights.sbomify.com/CVE-2026-115183/): Qi Addons For Elementor < 1.11.2 - Contributor+ Content Injection via Animated Text Widget (low 2.4)
- [CVE-2026-11518](https://insights.sbomify.com/CVE-2026-11518/): SourceCodester Inventory System User Management users.php cross site scripting (medium 5.3)
- [CVE-2026-11517](https://insights.sbomify.com/CVE-2026-11517/): UTT HiPER 2610G formConfigDnsFilterGlobal strcpy buffer overflow (high 8.7)
- [CVE-2026-11516](https://insights.sbomify.com/CVE-2026-11516/): UTT HiPER 2610G formNatStaticMap strcpy buffer overflow (medium 5.1)
- [CVE-2026-11515](https://insights.sbomify.com/CVE-2026-11515/): Hardcoded credentials in Barangay Resident Profiling and Information Management System (medium 6.9)
- [CVE-2026-11514](https://insights.sbomify.com/CVE-2026-11514/): itsourcecode Hospital Management System addpatient.php sql injection (medium 5.3)
- [CVE-2026-11513](https://insights.sbomify.com/CVE-2026-11513/): itsourcecode Hospital Management System adminaccount.php sql injection (medium 5.3)
- [CVE-2026-11512](https://insights.sbomify.com/CVE-2026-11512/): itsourcecode Hospital Management System billing.php cross site scripting (medium 5.3)
- [CVE-2026-11511](https://insights.sbomify.com/CVE-2026-11511/): Bolt CMS HTML Attribute TextType.php HTML injection (medium 5.1)
- [CVE-2026-11510](https://insights.sbomify.com/CVE-2026-11510/): CodeAstro Leave Management System add_leave.php sql injection (medium 5.3)
- [CVE-2026-1151](https://insights.sbomify.com/CVE-2026-1151/): technical-laohu mpay User Center cross site scripting (medium 4.8)
- [CVE-2026-11509](https://insights.sbomify.com/CVE-2026-11509/): CodeAstro Leave Management System search_staff_for_updation.php sql injection (medium 5.3)
- [CVE-2026-11508](https://insights.sbomify.com/CVE-2026-11508/): CodeAstro Leave Management System search_staff_to_assign_pc.php sql injection (medium 5.3)
- [CVE-2026-11507](https://insights.sbomify.com/CVE-2026-11507/): CodeAstro Leave Management System delete_leave_type.php sql injection (medium 5.3)
- [CVE-2026-11506](https://insights.sbomify.com/CVE-2026-11506/): CodeAstro Leave Management System search_staff_for_deletion.php sql injection (medium 5.3)
- [CVE-2026-11505](https://insights.sbomify.com/CVE-2026-11505/): GL.iNet XE3000 glnassys hard-coded key (low 2.3)
- [CVE-2026-11504](https://insights.sbomify.com/CVE-2026-11504/): Tenda CX12L Wi-Fi Schedule Configuration Endpoint openSchedWifi setSchedWifi stack-based overflow (high 8.7)
- [CVE-2026-11503](https://insights.sbomify.com/CVE-2026-11503/): Tenda CX12L Wi-Fi Configuration Endpoint fast_setting_wifi_set form_fast_setting_wifi_set stack-based overflow (high 8.7)
- [CVE-2026-11502](https://insights.sbomify.com/CVE-2026-11502/): JeecgBoot Third-Party Login ThirdLoginController.java HttpServletResponse.sendRedirect redirect (low 2.3)
- [CVE-2026-11501](https://insights.sbomify.com/CVE-2026-11501/): SourceCodester Hospitals Patient Records Management System Master.php save_patient sql injection (medium 6.9)
- [CVE-2026-11500](https://insights.sbomify.com/CVE-2026-11500/): Weaviate Static API Key client.go validateConfig authorization (low 2.3)
- [CVE-2026-1150](https://insights.sbomify.com/CVE-2026-1150/): Totolink LR350 POST Request cstecgi.cgi setTracerouteCfg command injection (medium 5.3)
- [CVE-2026-11499](https://insights.sbomify.com/CVE-2026-11499/): Tenda HG7/HG9/HG10 formDOMAINBLK stack-based overflow (critical 9.3)
- [CVE-2026-11498](https://insights.sbomify.com/CVE-2026-11498/): Tenda HG7/HG9/HG10 Web Management voip_other_set asp_voip_OtherSet stack-based overflow (high 8.7)
- [CVE-2026-11497](https://insights.sbomify.com/CVE-2026-11497/): D-Link DCS-5615 Boa Webserver boa.conf least privilege violation (medium 6.9)
- [CVE-2026-11496](https://insights.sbomify.com/CVE-2026-11496/): Missing authorization in PDF Builder for WooCommerce. Create invoices,packing slips and more (medium 6.5)
- [CVE-2026-11495](https://insights.sbomify.com/CVE-2026-11495/): CodeAstro Ingredients Stock Management System add_stock.php sql injection (medium 5.3)
- [CVE-2026-11494](https://insights.sbomify.com/CVE-2026-11494/): TOTOLINK AC1200 T8 vsftpd vsftpd.conf least privilege violation (medium 5.3)
- [CVE-2026-11493](https://insights.sbomify.com/CVE-2026-11493/): Tenda AC15 Samba smb.conf weak password (low 2.3)
- [CVE-2026-11492](https://insights.sbomify.com/CVE-2026-11492/): D-Link DIR-823G vsftpd vsftpd.conf least privilege violation (medium 5.3)
- [CVE-2026-11491](https://insights.sbomify.com/CVE-2026-11491/): CodeAstro Human Resource Management System Notice Board Management All_notice cross site scripting (medium 4.8)
- [CVE-2026-11490](https://insights.sbomify.com/CVE-2026-11490/): code-projects Online Music Site Search.php sql injection (medium 6.9)
- [CVE-2026-1149](https://insights.sbomify.com/CVE-2026-1149/): Totolink LR350 POST Request cstecgi.cgi setDiagnosisCfg command injection (medium 5.3)
- [CVE-2026-11489](https://insights.sbomify.com/CVE-2026-11489/): code-projects Online Music Site AdminDeleteAlbum.php sql injection (medium 6.9)
- [CVE-2026-11488](https://insights.sbomify.com/CVE-2026-11488/): code-projects Simple Flight Ticket Booking System POST Parameter checkUser.php sql injection (medium 6.9)
- [CVE-2026-11487](https://insights.sbomify.com/CVE-2026-11487/): Neovim View Branch secure.lua M.read command injection (medium 4.8)
- [CVE-2026-11486](https://insights.sbomify.com/CVE-2026-11486/): SourceCodester Class and Exam Timetabling System archive1.php sql injection (medium 6.9)
- [CVE-2026-11485](https://insights.sbomify.com/CVE-2026-11485/): SourceCodester Class and Exam Timetabling System archive2.php sql injection (medium 6.9)
- [CVE-2026-11484](https://insights.sbomify.com/CVE-2026-11484/): SourceCodester Class and Exam Timetabling System archive3.php sql injection (medium 6.9)
- [CVE-2026-11483](https://insights.sbomify.com/CVE-2026-11483/): SourceCodester Class and Exam Timetabling System archive4.php sql injection (medium 6.9)
- [CVE-2026-114820](https://insights.sbomify.com/CVE-2026-114820/): Weak cryptography in Oracle GraalVM Enterprise Edition (critical 9.1)
- [CVE-2026-11482](https://insights.sbomify.com/CVE-2026-11482/): SourceCodester Class and Exam Timetabling System archive5.php sql injection (medium 6.9)
- [CVE-2026-11481](https://insights.sbomify.com/CVE-2026-11481/): yoanbernabeu grepai Postgres Embedding Cache chunker.go PostgresStore.LookupByContentHash weak hash (low 2.0)
- [CVE-2026-11480](https://insights.sbomify.com/CVE-2026-11480/): Chengdu Everbrite Network Technology BeikeShop Admin Design Builder Endpoint admin.php sql injection (medium 5.3)
- [CVE-2026-1148](https://insights.sbomify.com/CVE-2026-1148/): SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System cross-site request forgery (medium 5.3)
- [CVE-2026-11479](https://insights.sbomify.com/CVE-2026-11479/): yoanbernabeu grepai Qdrant Backend chunker.go weak hash (low 2.3)
- [CVE-2026-11478](https://insights.sbomify.com/CVE-2026-11478/): kokke tiny-regex-c Pattern re.c matchstar redos (medium 4.8)
- [CVE-2026-11477](https://insights.sbomify.com/CVE-2026-11477/): hs-web hsweb-framework OAuth2 Client OAuth2Client.java OAuth2Client redirect (medium 5.3)
- [CVE-2026-11476](https://insights.sbomify.com/CVE-2026-11476/): Kushan2k student-management-system Profile Update Endpoint AdminController.php edit-admin improper authorization (medium 5.3)
- [CVE-2026-11475](https://insights.sbomify.com/CVE-2026-11475/): Kushan2k student-management-system Certificate Verification Endpoint GradeController.php getStatus sql injection (medium 5.3)
- [CVE-2026-114743](https://insights.sbomify.com/CVE-2026-114743/): InstaWP Connect < 0.1.4.2 - Authenticated Plugin Settings Update via instawp_update_settings (low 3.1)
- [CVE-2026-114742](https://insights.sbomify.com/CVE-2026-114742/): WP VR 8.3.0 - 9.0.2 - Contributor+ Arbitrary Tour Update via IDOR (low 2.7)
- [CVE-2026-114741](https://insights.sbomify.com/CVE-2026-114741/): WP VR 9.0.0 - 9.0.2 - Contributor+ Arbitrary Tour Update and Disclosure via IDOR (low 3.8)
- [CVE-2026-114740](https://insights.sbomify.com/CVE-2026-114740/): WP VR 8.5.55 - 9.1.2 - Contributor+ Arbitrary Tour Creation and Publishing via Setup Wizard (medium 4.9)
- [CVE-2026-11474](https://insights.sbomify.com/CVE-2026-11474/): Kushan2k student-management-system Registration Endpoint RegisterService.php unrestricted upload (medium 6.9)
- [CVE-2026-114732](https://insights.sbomify.com/CVE-2026-114732/): Auth bypass in Webmail (medium 6.8)
- [CVE-2026-114731](https://insights.sbomify.com/CVE-2026-114731/): Denial of service in Webmail (medium 5.3)
- [CVE-2026-114730](https://insights.sbomify.com/CVE-2026-114730/): Server-side request forgery in Webmail (high 7.2)
- [CVE-2026-11473](https://insights.sbomify.com/CVE-2026-11473/): jflyfox jfinal_cms AdvicefeedbackController.java list sql injection (medium 5.3)
- [CVE-2026-114729](https://insights.sbomify.com/CVE-2026-114729/): Security feature bypass in Webmail (medium 5.3)
- [CVE-2026-114728](https://insights.sbomify.com/CVE-2026-114728/): Security feature bypass in Webmail (medium 5.3)
- [CVE-2026-114727](https://insights.sbomify.com/CVE-2026-114727/): Code injection in Webmail (high 8.3)
- [CVE-2026-114726](https://insights.sbomify.com/CVE-2026-114726/): Other in Webmail (medium 5.8)
- [CVE-2026-114725](https://insights.sbomify.com/CVE-2026-114725/): Other in Webmail (medium 5.0)
- [CVE-2026-114724](https://insights.sbomify.com/CVE-2026-114724/): Deserialization in Webmail (high 7.4)
- [CVE-2026-114723](https://insights.sbomify.com/CVE-2026-114723/): Denial of service in Webmail (low 3.7)
- [CVE-2026-114722](https://insights.sbomify.com/CVE-2026-114722/): Security feature bypass in Webmail (medium 6.5)
- [CVE-2026-114721](https://insights.sbomify.com/CVE-2026-114721/): Security feature bypass in Webmail (low 3.1)
- [CVE-2026-114720](https://insights.sbomify.com/CVE-2026-114720/): Command injection in Webmail (high 7.1)
- [CVE-2026-11472](https://insights.sbomify.com/CVE-2026-11472/): SourceCodester Class and Exam Timetabling System index1.php sql injection (medium 6.9)
- [CVE-2026-114719](https://insights.sbomify.com/CVE-2026-114719/): Cross-site request forgery in Webmail (low 3.7)
- [CVE-2026-114718](https://insights.sbomify.com/CVE-2026-114718/): Cross-site scripting in Webmail (medium 4.7)
- [CVE-2026-114717](https://insights.sbomify.com/CVE-2026-114717/): Other in Webmail (medium 4.0)
- [CVE-2026-114716](https://insights.sbomify.com/CVE-2026-114716/): Other in Webmail (high 8.5)
- [CVE-2026-114715](https://insights.sbomify.com/CVE-2026-114715/): Missing authorization in Webmail (medium 6.8)
- [CVE-2026-114714](https://insights.sbomify.com/CVE-2026-114714/): Path traversal in Webmail (medium 5.3)
- [CVE-2026-114710](https://insights.sbomify.com/CVE-2026-114710/): WordPress Gallery PhotoBlocks plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-11471](https://insights.sbomify.com/CVE-2026-11471/): SourceCodester Class and Exam Timetabling System index2.php sql injection (medium 6.9)
- [CVE-2026-114709](https://insights.sbomify.com/CVE-2026-114709/): WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-114708](https://insights.sbomify.com/CVE-2026-114708/): WordPress JetSmartFilters plugin <= 3.8.6.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-114707](https://insights.sbomify.com/CVE-2026-114707/): WordPress JetElements For Elementor plugin <= 2.9.2.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-114706](https://insights.sbomify.com/CVE-2026-114706/): WordPress Strong Testimonials plugin <= 3.3.15 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-114705](https://insights.sbomify.com/CVE-2026-114705/): WordPress WP Social Feed Gallery plugin <= 5.0.13 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-114704](https://insights.sbomify.com/CVE-2026-114704/): WordPress Relevanssi plugin <= 4.28.4 - PHP Object Injection vulnerability (high 7.2)
- [CVE-2026-114703](https://insights.sbomify.com/CVE-2026-114703/): WordPress Extensions for Leaflet Map plugin <= 6.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/907/