# Vulnerabilities published in 2026


- [CVE-2026-11429](https://insights.sbomify.com/CVE-2026-11429/): Path Traversal in Altium Vault ScriptsController Allows Unauthenticated Remote Code Execution (critical 10.0)
- [CVE-2026-114278](https://insights.sbomify.com/CVE-2026-114278/): Unauthenticated Command Injection via kubeconfig Username in che-machine-exec (critical 9.8)
- [CVE-2026-114270](https://insights.sbomify.com/CVE-2026-114270/): GeoDirectory < 2.8.197 - Unauthenticated Password-Protected Listing Content Disclosure (medium 5.3)
- [CVE-2026-114268](https://insights.sbomify.com/CVE-2026-114268/): Tenda BE3L Pro WifiBasicSet formWifiBasicSet buffer overflow (critical 9.4)
- [CVE-2026-114267](https://insights.sbomify.com/CVE-2026-114267/): SourceCodester Food Order Management System Admin Endpoint authorization (medium 6.9)
- [CVE-2026-114266](https://insights.sbomify.com/CVE-2026-114266/): ProjectWorlds Advanced Library Management System profile.php mysqli_query sql injection (medium 5.3)
- [CVE-2026-114265](https://insights.sbomify.com/CVE-2026-114265/): ProjectWorlds Advanced Library Management System Search Form returned_book_search.php mysqli_query sql injection (medium 5.3)
- [CVE-2026-114264](https://insights.sbomify.com/CVE-2026-114264/): ProjectWorlds Advanced Library Management System edit_member.php sql injection (medium 5.1)
- [CVE-2026-114263](https://insights.sbomify.com/CVE-2026-114263/): ProjectWorlds Advanced Library Management System individual_report_search.php mysqli_query sql injection (medium 6.9)
- [CVE-2026-114262](https://insights.sbomify.com/CVE-2026-114262/): file-management-system FileController.php store unrestricted upload (medium 6.9)
- [CVE-2026-114261](https://insights.sbomify.com/CVE-2026-114261/): MomoTommy file-management-system Files API FileController.php destroy missing authentication (medium 6.9)
- [CVE-2026-114260](https://insights.sbomify.com/CVE-2026-114260/): oretnom23 file-management-system-php AJAX ajax.php delete_folder missing authentication (medium 6.9)
- [CVE-2026-11426](https://insights.sbomify.com/CVE-2026-11426/): UnderConstructionPage PRO <= 5.76 - Authenticated (Subscriber+) Arbitrary File Read via template_thumbnail Parameter (medium 6.5)
- [CVE-2026-114259](https://insights.sbomify.com/CVE-2026-114259/): oretnom23 file-management-system-php admin_class.php save_files unrestricted upload (medium 6.9)
- [CVE-2026-114258](https://insights.sbomify.com/CVE-2026-114258/): oretnom23 file-management-system-php File Management files.php sql injection (medium 6.9)
- [CVE-2026-114257](https://insights.sbomify.com/CVE-2026-114257/): oretnom23 file-management-system-php File Download download.php readfile sql injection (medium 6.9)
- [CVE-2026-114256](https://insights.sbomify.com/CVE-2026-114256/): oretnom23 file-management-system-php Folder Management admin_class.php save_files sql injection (medium 6.9)
- [CVE-2026-114255](https://insights.sbomify.com/CVE-2026-114255/): oretnom23 file-management-system-php User Account Management admin_class.php save_user sql injection (medium 6.9)
- [CVE-2026-114254](https://insights.sbomify.com/CVE-2026-114254/): oretnom23 file-management-system-php admin_class.php login sql injection (medium 6.9)
- [CVE-2026-114253](https://insights.sbomify.com/CVE-2026-114253/): oretnom23 file-management-system-php index.php include file inclusion (medium 5.3)
- [CVE-2026-114252](https://insights.sbomify.com/CVE-2026-114252/): itsourcecode Sales-and-Inventory-System cust_searchfrm.php sql injection (medium 5.3)
- [CVE-2026-114251](https://insights.sbomify.com/CVE-2026-114251/): itsourcecode Sales-and-Inventory-System cust_del.php sql injection (medium 5.3)
- [CVE-2026-114250](https://insights.sbomify.com/CVE-2026-114250/): itsourcecode Sales-and-Inventory-System cust_edit.php sql injection (medium 5.3)
- [CVE-2026-11425](https://insights.sbomify.com/CVE-2026-11425/): Domoticz Mobile Dashboard versions prior to 2026.3 Stored XSS via Text/Alert Device Rendering (low 2.0)
- [CVE-2026-114249](https://insights.sbomify.com/CVE-2026-114249/): dhikshitha29 Insurance-Management-System Policy Holder Update Form UpdatePolicyHolder-inc.php improper authorization (medium 6.9)
- [CVE-2026-114248](https://insights.sbomify.com/CVE-2026-114248/): dhikshitha29 Insurance-Management-System Plan Management Form AddNewPlan-inc.php missing authentication (medium 6.9)
- [CVE-2026-114245](https://insights.sbomify.com/CVE-2026-114245/): dhikshitha29 Insurance-Management-System Add New Admin Form Admin-Register-inc.php improper authorization (medium 6.9)
- [CVE-2026-114243](https://insights.sbomify.com/CVE-2026-114243/): dhikshitha29 Insurance-Management-System EditPolicyHolder.php mysqli_query sql injection (medium 6.9)
- [CVE-2026-114242](https://insights.sbomify.com/CVE-2026-114242/): dhikshitha29 Insurance-Management-System editPlan.php mysqli_query sql injection (medium 6.9)
- [CVE-2026-11424](https://insights.sbomify.com/CVE-2026-11424/): Server-Side Request Forgery in Altium Platform Design GraphQL Service Allows Information Disclosure (high 8.3)
- [CVE-2026-114236](https://insights.sbomify.com/CVE-2026-114236/): Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers (low 3.3)
- [CVE-2026-114230](https://insights.sbomify.com/CVE-2026-114230/): Apache Qpid Proton C: Potential authentication bypass: regular AMQP frames can be sent as SASL frames (not scored)
- [CVE-2026-11423](https://insights.sbomify.com/CVE-2026-11423/): Path Traversal in Altium Enterprise Server Collaboration Service Allows Privilege Escalation (critical 9.4)
- [CVE-2026-114223](https://insights.sbomify.com/CVE-2026-114223/): NewType Infortech｜NT OneAPP - Exposure of Sensitive Information (medium 6.7)
- [CVE-2026-114222](https://insights.sbomify.com/CVE-2026-114222/): NewType Infortech｜NT OneAPP - Authentication Bypass (medium 6.9)
- [CVE-2026-114221](https://insights.sbomify.com/CVE-2026-114221/): NewType Infortech｜NT OneAPP - Credential Disclosure (medium 5.9)
- [CVE-2026-114220](https://insights.sbomify.com/CVE-2026-114220/): NewType Infortech｜NT OneAPP - Improper Certificate Validation (critical 9.3)
- [CVE-2026-11422](https://insights.sbomify.com/CVE-2026-11422/): Markdown Preview Enhanced 0.8.x Code Injection via WaveDrom Rendering (high 8.4)
- [CVE-2026-114219](https://insights.sbomify.com/CVE-2026-114219/): NewType Infortech｜NT OneAPP - Hard-coded Credentials (critical 9.1)
- [CVE-2026-114216](https://insights.sbomify.com/CVE-2026-114216/): Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit (medium 6.3)
- [CVE-2026-114214](https://insights.sbomify.com/CVE-2026-114214/): Missing authorization in ash (medium 6.0)
- [CVE-2026-114213](https://insights.sbomify.com/CVE-2026-114213/): WebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit (high 8.7)
- [CVE-2026-11421](https://insights.sbomify.com/CVE-2026-11421/): SQL injection in ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce (medium 6.5)
- [CVE-2026-11420](https://insights.sbomify.com/CVE-2026-11420/): Path Traversal in Altium Enterprise Server NIS Allows Unauthenticated Arbitrary File Write and File Read (critical 10.0)
- [CVE-2026-1142](https://insights.sbomify.com/CVE-2026-1142/): PHPGurukul News Portal cross-site request forgery (medium 5.3)
- [CVE-2026-114198](https://insights.sbomify.com/CVE-2026-114198/): Deserialization of untrusted data in floss (high 8.7)
- [CVE-2026-114197](https://insights.sbomify.com/CVE-2026-114197/): Deserialization of untrusted data in capa (high 8.7)
- [CVE-2026-114196](https://insights.sbomify.com/CVE-2026-114196/): WordPress Paytium plugin <= 5.0.5 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-114195](https://insights.sbomify.com/CVE-2026-114195/): WordPress ShopMagic plugin <= 4.9.1 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-114194](https://insights.sbomify.com/CVE-2026-114194/): WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-114193](https://insights.sbomify.com/CVE-2026-114193/): WordPress GEO my WordPress plugin <= 4.5.5.5 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-114192](https://insights.sbomify.com/CVE-2026-114192/): WordPress WpEvently plugin <= 5.7.8 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-114191](https://insights.sbomify.com/CVE-2026-114191/): WordPress UPI QR Code Payment Gateway for WooCommerce plugin <= 1.6.3 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-114190](https://insights.sbomify.com/CVE-2026-114190/): WordPress LiteSpeed Cache plugin <= 7.9 - Sensitive Data Exposure vulnerability (medium 5.9)
- [CVE-2026-11419](https://insights.sbomify.com/CVE-2026-11419/): Path Traversal in Altium Enterprise Server Vault UploadController Allows Arbitrary File Write (critical 9.4)
- [CVE-2026-114184](https://insights.sbomify.com/CVE-2026-114184/): WordPress Elementor Addon Elements plugin <= 1.14.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-114182](https://insights.sbomify.com/CVE-2026-114182/): WordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-114181](https://insights.sbomify.com/CVE-2026-114181/): WordPress Taxi Booking Manager for WooCommerce plugin <= 2.1.6 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-114180](https://insights.sbomify.com/CVE-2026-114180/): WordPress Metform plugin <= 4.3.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-114179](https://insights.sbomify.com/CVE-2026-114179/): WordPress BP Better Messages plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-114178](https://insights.sbomify.com/CVE-2026-114178/): WordPress W3 Total Cache plugin <= 2.10.7 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-114177](https://insights.sbomify.com/CVE-2026-114177/): WordPress Xpro Elementor Addons plugin <= 1.7.10 - Cross Site Request Forgery (CSRF) vulnerability (high 8.8)
- [CVE-2026-114176](https://insights.sbomify.com/CVE-2026-114176/): WordPress eRoom plugin <= 1.7.1 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-114175](https://insights.sbomify.com/CVE-2026-114175/): WordPress eRoom plugin <= 1.7.1 - Settings Change vulnerability (medium 5.4)
- [CVE-2026-114173](https://insights.sbomify.com/CVE-2026-114173/): Information disclosure in ortto (medium 5.3)
- [CVE-2026-11417](https://insights.sbomify.com/CVE-2026-11417/): OS Command Injection in NodejsFunction Bundling in aws-cdk-lib (high 7.0)
- [CVE-2026-11416](https://insights.sbomify.com/CVE-2026-11416/): MoviePilot Path Traversal via Cloud Storage Download Handlers (high 7.2)
- [CVE-2026-114148](https://insights.sbomify.com/CVE-2026-114148/): ASP.NET Core Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-114145](https://insights.sbomify.com/CVE-2026-114145/): GitPython validates a submodule's ".git" path only after cloning into it (RCE) (high 7.5)
- [CVE-2026-114144](https://insights.sbomify.com/CVE-2026-114144/): toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse() (high 7.5)
- [CVE-2026-114143](https://insights.sbomify.com/CVE-2026-114143/): toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse() (high 8.7)
- [CVE-2026-114142](https://insights.sbomify.com/CVE-2026-114142/): toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype (high 8.8)
- [CVE-2026-114141](https://insights.sbomify.com/CVE-2026-114141/): toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse() (high 8.7)
- [CVE-2026-114140](https://insights.sbomify.com/CVE-2026-114140/): nbconvert: File write via path traversal in cell output filenames (high 8.8)
- [CVE-2026-11414](https://insights.sbomify.com/CVE-2026-11414/): Hardcoded credentials in Altium Enterprise Server (critical 10.0)
- [CVE-2026-114139](https://insights.sbomify.com/CVE-2026-114139/): Sentry-Javascript: Middleware Bypass when using Tunnel route (critical 9.1)
- [CVE-2026-114138](https://insights.sbomify.com/CVE-2026-114138/): Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation (high 7.5)
- [CVE-2026-114137](https://insights.sbomify.com/CVE-2026-114137/): Django REST framework: TokenProxy.delete() reports success and revokes nothing (high 7.4)
- [CVE-2026-114136](https://insights.sbomify.com/CVE-2026-114136/): Django REST framework: JSONParser applies an attacker-named codec to the request stream (high 7.5)
- [CVE-2026-114135](https://insights.sbomify.com/CVE-2026-114135/): Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization (high 8.8)
- [CVE-2026-114133](https://insights.sbomify.com/CVE-2026-114133/): Nuxt server islands render `useHeadSafe` input without sanitisation (medium 5.4)
- [CVE-2026-114132](https://insights.sbomify.com/CVE-2026-114132/): Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive (medium 6.3)
- [CVE-2026-114131](https://insights.sbomify.com/CVE-2026-114131/): Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes (medium 6.5)
- [CVE-2026-114130](https://insights.sbomify.com/CVE-2026-114130/): Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled (low 2.3)
- [CVE-2026-11413](https://insights.sbomify.com/CVE-2026-11413/): JingDong JD Cloud Box AX6600 jdcweb_rpc set_macfilter stack-based overflow (high 8.7)
- [CVE-2026-114129](https://insights.sbomify.com/CVE-2026-114129/): stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service (medium 6.2)
- [CVE-2026-114128](https://insights.sbomify.com/CVE-2026-114128/): Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering (medium 6.5)
- [CVE-2026-114127](https://insights.sbomify.com/CVE-2026-114127/): Astro: Arbitrary CSS injection in Astro View Transitions (low 2.3)
- [CVE-2026-114126](https://insights.sbomify.com/CVE-2026-114126/): Storybook dev server: devices on the same network can obtain the WebSocket token and write code into story files (high 8.7)
- [CVE-2026-114125](https://insights.sbomify.com/CVE-2026-114125/): Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites (high 8.6)
- [CVE-2026-114124](https://insights.sbomify.com/CVE-2026-114124/): Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry (low 3.9)
- [CVE-2026-114123](https://insights.sbomify.com/CVE-2026-114123/): Missing authorization in d365fo-mcp-server (high 7.5)
- [CVE-2026-114122](https://insights.sbomify.com/CVE-2026-114122/): Electron: Frame subscription trusts GPU-supplied frame geometry (low 3.9)
- [CVE-2026-114121](https://insights.sbomify.com/CVE-2026-114121/): Electron: openExternal permission requests can be attributed to the wrong origin (medium 5.4)
- [CVE-2026-114120](https://insights.sbomify.com/CVE-2026-114120/): SchedulePress before 5.3.5 Missing Authorization via wpsp_el_editor_form AJAX Action (medium 5.3)
- [CVE-2026-11412](https://insights.sbomify.com/CVE-2026-11412/): Jinher OA GetFormSn.aspx sql injection (medium 5.3)
- [CVE-2026-114119](https://insights.sbomify.com/CVE-2026-114119/): Best Practice Software Bp Premier before 1.14.1.1128 Hardcoded SQL Server Administrative Credential (critical 9.3)
- [CVE-2026-114118](https://insights.sbomify.com/CVE-2026-114118/): Vyper 0.3.4 through 0.5.0b1 create_from_blueprint Offset Validation Bypass via Unsigned Wraparound (medium 6.3)
- [CVE-2026-114117](https://insights.sbomify.com/CVE-2026-114117/): Vyper 0.3.8 through 0.5.0b1 Optimizer Miscompilation of msg.value | K in Ternary Branches (high 8.2)
- [CVE-2026-114116](https://insights.sbomify.com/CVE-2026-114116/): Vyper through 0.5.0b1 Literal Value Manipulation via Line Separators (medium 6.0)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/910/