# Vulnerabilities published in 2026


- [CVE-2026-11451](https://insights.sbomify.com/CVE-2026-11451/): GL.iNet GL-MT3000 FTP Protocol glc snprintf command injection (medium 6.9)
- [CVE-2026-114509](https://insights.sbomify.com/CVE-2026-114509/): Laravel TokenGuard authentication bypass through non-string API credentials (critical 9.2)
- [CVE-2026-114508](https://insights.sbomify.com/CVE-2026-114508/): Laravel relationship inclusion can trigger unauthorized data destruction (medium 6.5)
- [CVE-2026-114501](https://insights.sbomify.com/CVE-2026-114501/): Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1 (medium 6.3)
- [CVE-2026-11450](https://insights.sbomify.com/CVE-2026-11450/): GL.iNet GL-MT3000 Path Normalization dlopen command injection (medium 6.9)
- [CVE-2026-1145](https://insights.sbomify.com/CVE-2026-1145/): quickjs-ng quickjs quickjs.c js_typed_array_constructor_ta heap-based overflow (medium 5.3)
- [CVE-2026-114493](https://insights.sbomify.com/CVE-2026-114493/): LocalAI v4.6.0 through v4.11.0 SSRF Guard Bypass via HTTP Redirects (critical 9.2)
- [CVE-2026-114492](https://insights.sbomify.com/CVE-2026-114492/): gin-vue-admin through 2.9.2 Path Traversal via removePlugin Endpoint (high 7.0)
- [CVE-2026-114491](https://insights.sbomify.com/CVE-2026-114491/): pdfmake 0.3.8 before 0.3.12 Local File Policy Bypass via SVG Images (medium 6.9)
- [CVE-2026-114490](https://insights.sbomify.com/CVE-2026-114490/): Incorrect Authorization in hMailServer (high 7.8)
- [CVE-2026-11449](https://insights.sbomify.com/CVE-2026-11449/): GL.iNet GL-MT3000 LuCI JSON-RPC rpc rpc_sys command injection (medium 5.3)
- [CVE-2026-114489](https://insights.sbomify.com/CVE-2026-114489/): Missing Authorization in hMailServer (high 8.1)
- [CVE-2026-114488](https://insights.sbomify.com/CVE-2026-114488/): Auth bypass in Red Hat Fuse 7 (high 7.4)
- [CVE-2026-114487](https://insights.sbomify.com/CVE-2026-114487/): Missing authorization in Server (not scored)
- [CVE-2026-114486](https://insights.sbomify.com/CVE-2026-114486/): Security feature bypass in Server (not scored)
- [CVE-2026-114485](https://insights.sbomify.com/CVE-2026-114485/): Information disclosure in Server (not scored)
- [CVE-2026-11448](https://insights.sbomify.com/CVE-2026-11448/): GL.iNet GL-MT3000 Minidlna Service rpc realpath command injection (medium 5.1)
- [CVE-2026-114479](https://insights.sbomify.com/CVE-2026-114479/): Not Failing Securely ('Failing Open') in hMailServer (medium 5.8)
- [CVE-2026-114478](https://insights.sbomify.com/CVE-2026-114478/): Unintended Proxy or Intermediary ('Confused Deputy') in hMailServer (medium 5.9)
- [CVE-2026-114477](https://insights.sbomify.com/CVE-2026-114477/): Missing Authorization in hMailServer (medium 4.3)
- [CVE-2026-114476](https://insights.sbomify.com/CVE-2026-114476/): Incorrect Authorization in hMailServer (high 7.5)
- [CVE-2026-114475](https://insights.sbomify.com/CVE-2026-114475/): Missing Authorization in hMailServer (medium 6.5)
- [CVE-2026-114474](https://insights.sbomify.com/CVE-2026-114474/): Use of Less Trusted Source in hMailServer (medium 5.9)
- [CVE-2026-114473](https://insights.sbomify.com/CVE-2026-114473/): Incorrect Authorization in hMailServer (medium 5.0)
- [CVE-2026-114472](https://insights.sbomify.com/CVE-2026-114472/): Insufficient Resource Pool in hMailServer (low 3.7)
- [CVE-2026-114471](https://insights.sbomify.com/CVE-2026-114471/): Insertion of Sensitive Information into Log File in hMailServer (medium 4.7)
- [CVE-2026-114470](https://insights.sbomify.com/CVE-2026-114470/): Cross-Site Request Forgery (CSRF) in hMailServer (medium 5.3)
- [CVE-2026-11447](https://insights.sbomify.com/CVE-2026-11447/): GL.iNet GL-MT3000 MTK Backend iwinfo.so iwinfo_backend command injection (medium 5.3)
- [CVE-2026-114463](https://insights.sbomify.com/CVE-2026-114463/): CVE-2026-114463 (not scored)
- [CVE-2026-114462](https://insights.sbomify.com/CVE-2026-114462/): Arbitrary File Read via Symlink in Velneo vServer HTTP Server (medium 6.0)
- [CVE-2026-114460](https://insights.sbomify.com/CVE-2026-114460/): Mod_qos: query truncation during json body merging permits security-rule bypass (medium 5.3)
- [CVE-2026-11446](https://insights.sbomify.com/CVE-2026-11446/): Booktics – Booking Calendar for Appointments and Service Businesses <= 1.0.23 - Missing Authorization (medium 5.3)
- [CVE-2026-114459](https://insights.sbomify.com/CVE-2026-114459/): Mod_qos: out-of-bounds reads in response-body substring matching (low 3.7)
- [CVE-2026-114458](https://insights.sbomify.com/CVE-2026-114458/): Mod_qos: undersized connection-monitor scratch array permits heap buffer overflow (medium 5.9)
- [CVE-2026-114457](https://insights.sbomify.com/CVE-2026-114457/): Mod_qos: missing nul termination in json value escaping permits out-of-bounds reads (low 3.7)
- [CVE-2026-114441](https://insights.sbomify.com/CVE-2026-114441/): oretnom23 php-travel-agency-system update.php sql injection (medium 6.9)
- [CVE-2026-114440](https://insights.sbomify.com/CVE-2026-114440/): oretnom23 php-travel-agency-system delete.php sql injection (medium 6.9)
- [CVE-2026-114439](https://insights.sbomify.com/CVE-2026-114439/): oretnom23 php-travel-agency-system Session session.php missing authentication (medium 6.9)
- [CVE-2026-114438](https://insights.sbomify.com/CVE-2026-114438/): Keycloak-services: keycloak-services: required otp enrollment bypassed via update user locale required action ordering (medium 4.2)
- [CVE-2026-114437](https://insights.sbomify.com/CVE-2026-114437/): Chi Client IP Spoofing in ClientIPFromXFF via X-Forwarded-For (medium 6.3)
- [CVE-2026-11443](https://insights.sbomify.com/CVE-2026-11443/): Allegra downloadAttachment Cross-Site Scripting Authentication Bypass Vulnerability (medium 4.6)
- [CVE-2026-114429](https://insights.sbomify.com/CVE-2026-114429/): WP VR 8.5.49 - 9.0.2 - Contributor+ Stored XSS via Hotspot Content (medium 6.8)
- [CVE-2026-11442](https://insights.sbomify.com/CVE-2026-11442/): Allegra exportReport Directory Traversal Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-11441](https://insights.sbomify.com/CVE-2026-11441/): theonedev Pull Request issues canAccessIssue improper authorization (medium 5.3)
- [CVE-2026-114409](https://insights.sbomify.com/CVE-2026-114409/): Docker Desktop logs can expose stored third-party credentials (medium 5.7)
- [CVE-2026-114407](https://insights.sbomify.com/CVE-2026-114407/): e107 CMS before 2.3.13 Reflected XSS via search.php author Parameter (medium 5.1)
- [CVE-2026-114406](https://insights.sbomify.com/CVE-2026-114406/): Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns (medium 6.8)
- [CVE-2026-114405](https://insights.sbomify.com/CVE-2026-114405/): Denial of Service via Malformed VATP Packet in Velneo vServer (high 8.7)
- [CVE-2026-114404](https://insights.sbomify.com/CVE-2026-114404/): PHPPresentation 1.2.0 XSS via Writer\HTML Text Runs, Hyperlinks and Descriptions (medium 5.3)
- [CVE-2026-114403](https://insights.sbomify.com/CVE-2026-114403/): PHPOffice PHPPresentation through 1.2.0 Deserialization via Reader\Serialized::load (critical 9.2)
- [CVE-2026-114402](https://insights.sbomify.com/CVE-2026-114402/): Trudesk through 1.2.11 Path Traversal and Authorization Bypass via Profile Image Upload (medium 5.3)
- [CVE-2026-114401](https://insights.sbomify.com/CVE-2026-114401/): Trudesk through 1.2.11 Username Enumeration via Regex Injection in /api/v1/login (medium 6.9)
- [CVE-2026-114400](https://insights.sbomify.com/CVE-2026-114400/): Trudesk through 1.2.11 Missing Authentication for Ticket Attachments via /uploads (high 8.2)
- [CVE-2026-11440](https://insights.sbomify.com/CVE-2026-11440/): theonedev REST API default-branch improper authorization (medium 5.3)
- [CVE-2026-1144](https://insights.sbomify.com/CVE-2026-1144/): quickjs-ng quickjs Atomics Ops quickjs.c use after free (medium 5.3)
- [CVE-2026-114399](https://insights.sbomify.com/CVE-2026-114399/): Trudesk through 1.2.11 Path Traversal via Backup Delete and Restore API (high 7.0)
- [CVE-2026-114398](https://insights.sbomify.com/CVE-2026-114398/): Trudesk through 1.2.11 Unrestricted File Upload via /settings/general/uploadlogo (medium 5.1)
- [CVE-2026-114397](https://insights.sbomify.com/CVE-2026-114397/): Trudesk through 1.2.11 Missing Authentication on Debug Routes (high 8.3)
- [CVE-2026-114396](https://insights.sbomify.com/CVE-2026-114396/): Trudesk through 1.2.11 MongoDB $where Injection via tickets search API (high 7.1)
- [CVE-2026-114395](https://insights.sbomify.com/CVE-2026-114395/): Trudesk through 1.2.11 Authorization Bypass via /api/v1/messages/send (medium 5.3)
- [CVE-2026-114394](https://insights.sbomify.com/CVE-2026-114394/): Trudesk through 1.2.11 Authorization Bypass via Ticket Comment and Create APIs (medium 5.3)
- [CVE-2026-114393](https://insights.sbomify.com/CVE-2026-114393/): Trudesk through 1.2.11 Authorization Bypass via Ticket Update API Endpoints (medium 5.3)
- [CVE-2026-114392](https://insights.sbomify.com/CVE-2026-114392/): Trudesk through 1.2.11 Authorization Bypass via GET /api/v1/tickets/:uid (medium 6.9)
- [CVE-2026-114391](https://insights.sbomify.com/CVE-2026-114391/): ZenTao PMS before 22.3 Authorization Bypass via Ajax Controller Methods (high 7.1)
- [CVE-2026-114390](https://insights.sbomify.com/CVE-2026-114390/): Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authorization in AJAX Handlers (medium 6.9)
- [CVE-2026-11439](https://insights.sbomify.com/CVE-2026-11439/): theonedev Parent Project projects improper authorization (medium 5.3)
- [CVE-2026-114389](https://insights.sbomify.com/CVE-2026-114389/): Chamilo LMS 2.0.0-alpha.4 before 2.0.0-RC.3 Missing Authorization via openAnswerGrade (medium 5.3)
- [CVE-2026-114388](https://insights.sbomify.com/CVE-2026-114388/): Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authorization via GradebookController (medium 6.9)
- [CVE-2026-114387](https://insights.sbomify.com/CVE-2026-114387/): Shopper 2.0.0 before 2.6.0 Privilege Escalation via Unguarded Livewire Components (high 8.7)
- [CVE-2026-114386](https://insights.sbomify.com/CVE-2026-114386/): Pydantic AI Harness before 0.59.0 CodeMode Tool Call Limit Bypass via run_code (medium 6.3)
- [CVE-2026-114384](https://insights.sbomify.com/CVE-2026-114384/): itsourcecode Online Cake Ordering System transactionsave.php sql injection (medium 5.3)
- [CVE-2026-114383](https://insights.sbomify.com/CVE-2026-114383/): TOTOLINK EX200 wireless.so cstecgi.cgi setWiFiAclAddConfig stack-based overflow (critical 10.0)
- [CVE-2026-114382](https://insights.sbomify.com/CVE-2026-114382/): TOTOLINK EX200 lan.so cstecgi.cgi setStaticDhcpConfig stack-based overflow (critical 10.0)
- [CVE-2026-114381](https://insights.sbomify.com/CVE-2026-114381/): itsourcecode Online Cake Ordering System orderdetail.php sql injection (medium 5.3)
- [CVE-2026-114380](https://insights.sbomify.com/CVE-2026-114380/): itsourcecode Online Cake Ordering System inserttrans.php sql injection (medium 5.3)
- [CVE-2026-11438](https://insights.sbomify.com/CVE-2026-11438/): theonedev projects improper authorization (medium 5.3)
- [CVE-2026-114379](https://insights.sbomify.com/CVE-2026-114379/): EKKOLearnAI ekko-studio Media Generation API media.ts saveGeneratedImages file inclusion (medium 5.3)
- [CVE-2026-114378](https://insights.sbomify.com/CVE-2026-114378/): itsourcecode Online Cake Ordering System deleteproduct.php sql injection (medium 5.3)
- [CVE-2026-114377](https://insights.sbomify.com/CVE-2026-114377/): leomoon-studios wiki-go Comment Deletion comments.go DeleteComment path traversal (medium 5.1)
- [CVE-2026-114376](https://insights.sbomify.com/CVE-2026-114376/): leomoon-studios wiki-go API editor.go SourceHandler path traversal (medium 5.3)
- [CVE-2026-114375](https://insights.sbomify.com/CVE-2026-114375/): leomoon-studios wiki-go Files Rename API files.go RenameFileHandler path traversal (medium 5.3)
- [CVE-2026-114374](https://insights.sbomify.com/CVE-2026-114374/): leomoon-studios wiki-go fetch-metadata Endpoint metadata_api.go server-side request forgery (medium 5.3)
- [CVE-2026-114370](https://insights.sbomify.com/CVE-2026-114370/): Undertow: undertow: pathresourcemanager safepaths check allows sibling-directory symlink traversal (low 3.7)
- [CVE-2026-11437](https://insights.sbomify.com/CVE-2026-11437/): perfree go-fastdfs-web Installation Endpoint checkServer server-side request forgery (medium 6.9)
- [CVE-2026-114362](https://insights.sbomify.com/CVE-2026-114362/): HarnessRouter Targets Test Endpoint app.py server-side request forgery (medium 5.3)
- [CVE-2026-114361](https://insights.sbomify.com/CVE-2026-114361/): HarnessRouter Identity Mode app.py improper authorization (medium 6.3)
- [CVE-2026-11436](https://insights.sbomify.com/CVE-2026-11436/): Mage AI Sign-in Flow index.tsx useMutation cross site scripting (medium 5.3)
- [CVE-2026-114358](https://insights.sbomify.com/CVE-2026-114358/): SQL Injection Vulnerability in Radius Xenia M2M Platform (critical 9.3)
- [CVE-2026-114357](https://insights.sbomify.com/CVE-2026-114357/): DJI CrystalSky ZS600C ships ADB without authentication (ro.adb.secure=0) (high 7.0)
- [CVE-2026-114356](https://insights.sbomify.com/CVE-2026-114356/): DJI CrystalSky ZS600C DJIUpdateService binder exposes privileged operations without authorization (high 7.0)
- [CVE-2026-114355](https://insights.sbomify.com/CVE-2026-114355/): DJI CrystalSky ZS600C hardware_monitor evaluates attacker-controlled log data as root (high 8.6)
- [CVE-2026-114354](https://insights.sbomify.com/CVE-2026-114354/): DJI CrystalSky ZS600C android.dji.server binder transaction 1018 command injection as root (high 8.6)
- [CVE-2026-114353](https://insights.sbomify.com/CVE-2026-114353/): DJI CrystalSky ZS600C USB-gadget backdoor allows root command execution (high 7.0)
- [CVE-2026-11435](https://insights.sbomify.com/CVE-2026-11435/): Jinher OA nextselectplan.aspx sql injection (medium 6.9)
- [CVE-2026-114349](https://insights.sbomify.com/CVE-2026-114349/): Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batches (not scored)
- [CVE-2026-114348](https://insights.sbomify.com/CVE-2026-114348/): webpack-dev-server vulnerable to information disclosure via Host validation bypass in the open-editor endpoint (medium 5.3)
- [CVE-2026-11434](https://insights.sbomify.com/CVE-2026-11434/): FluentCMS Blocks Plugin blocks cross site scripting (medium 4.8)
- [CVE-2026-11431](https://insights.sbomify.com/CVE-2026-11431/): Path Traversal in Altium Projects Service Allows Arbitrary File Read (high 8.3)
- [CVE-2026-11430](https://insights.sbomify.com/CVE-2026-11430/): Grav CMS Scheduler Webhook Authentication Bypass via Null Short-Circuit (medium 6.9)
- [CVE-2026-1143](https://insights.sbomify.com/CVE-2026-1143/): TOTOLINK A3700R cstecgi.cgi setWiFiEasyGuestCfg buffer overflow (high 8.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/909/