# Vulnerabilities published in 2026


- [CVE-2026-109147](https://insights.sbomify.com/CVE-2026-109147/): WP Booking System < 2.1.0.3 - Reflected XSS via 'booking_id' Parameter (high 7.1)
- [CVE-2026-109145](https://insights.sbomify.com/CVE-2026-109145/): User Rights Access Manager <= 1.1.3 - Unauthenticated Privilege Escalation via AJAX Registration Handler (critical 9.8)
- [CVE-2026-109144](https://insights.sbomify.com/CVE-2026-109144/): wbond certvalidator Certificate Path Builder resource consumption (medium 6.9)
- [CVE-2026-109143](https://insights.sbomify.com/CVE-2026-109143/): calcom cal.com/cal.diy Credentials delete credentials.delete privileges management (medium 5.3)
- [CVE-2026-10914](https://insights.sbomify.com/CVE-2026-10914/): Use after free in Chrome (high 8.8)
- [CVE-2026-109131](https://insights.sbomify.com/CVE-2026-109131/): Cross-site scripting in Red Hat Ansible Automation Platform 2 (medium 5.4)
- [CVE-2026-10913](https://insights.sbomify.com/CVE-2026-10913/): Use after free in Chrome (high 8.8)
- [CVE-2026-109126](https://insights.sbomify.com/CVE-2026-109126/): IBM Verify Identity Access and IBM Security Verify Access Hard-coded Credentials (high 8.8)
- [CVE-2026-109125](https://insights.sbomify.com/CVE-2026-109125/): Possible cache poisoning vulnerability via a cache side-channel exposed by 'unwanted-reply-threshold' (medium 5.3)
- [CVE-2026-109122](https://insights.sbomify.com/CVE-2026-109122/): Kiloview E3 NDI Encoder OS Command Injection (critical 9.4)
- [CVE-2026-10912](https://insights.sbomify.com/CVE-2026-10912/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-109119](https://insights.sbomify.com/CVE-2026-109119/): Missing Authorization in rdiffweb (high 8.8)
- [CVE-2026-109118](https://insights.sbomify.com/CVE-2026-109118/): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in rdiffweb (medium 4.6)
- [CVE-2026-109116](https://insights.sbomify.com/CVE-2026-109116/): AdithyaYelloju Restaurant-Management-System Order Management mysqli_query authorization (medium 6.9)
- [CVE-2026-109115](https://insights.sbomify.com/CVE-2026-109115/): AdithyaYelloju Restaurant-Management-System Password Reset forgot3.php sql injection (medium 6.9)
- [CVE-2026-109114](https://insights.sbomify.com/CVE-2026-109114/): AdithyaYelloju Restaurant-Management-System Login Form login.php improper authentication (medium 6.9)
- [CVE-2026-109110](https://insights.sbomify.com/CVE-2026-109110/): Wavlink WL-WN592AX6 wmapd system os command injection (critical 10.0)
- [CVE-2026-10911](https://insights.sbomify.com/CVE-2026-10911/): Security feature bypass in Chrome (high 8.3)
- [CVE-2026-109109](https://insights.sbomify.com/CVE-2026-109109/): Wavlink WL-WN530BE1-A Settings Export CGI ExportAllSettings.cgi strcpy stack-based overflow (critical 10.0)
- [CVE-2026-109108](https://insights.sbomify.com/CVE-2026-109108/): Wavlink WL-WN530BE1-A uploadVpn.cgi popen os command injection (critical 9.4)
- [CVE-2026-109107](https://insights.sbomify.com/CVE-2026-109107/): Wavlink WL-WN592AX6 upload.cgi main null pointer dereference (medium 6.9)
- [CVE-2026-109106](https://insights.sbomify.com/CVE-2026-109106/): Polaris Office App Document Intake com.infraware.service.m.n.a path traversal (medium 4.8)
- [CVE-2026-10910](https://insights.sbomify.com/CVE-2026-10910/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-109090](https://insights.sbomify.com/CVE-2026-109090/): libXi XGetDeviceControl DEVICE_ENABLE Heap Buffer Overflow (high 7.5)
- [CVE-2026-10909](https://insights.sbomify.com/CVE-2026-10909/): Use after free in Chrome (high 8.3)
- [CVE-2026-109089](https://insights.sbomify.com/CVE-2026-109089/): libXi XGetDeviceControl Control Type Mismatch Heap Buffer Overflow (high 7.5)
- [CVE-2026-109088](https://insights.sbomify.com/CVE-2026-109088/): libXtst RECORD EnableContext Reply Endless Loop (medium 6.5)
- [CVE-2026-109082](https://insights.sbomify.com/CVE-2026-109082/): Keycloak-services: keycloak-services: ciba confidential-only contract not enforced for public clients (medium 6.8)
- [CVE-2026-109080](https://insights.sbomify.com/CVE-2026-109080/): SQL injection in Night Shift bulk license plate search allows cross-organization data access (high 7.1)
- [CVE-2026-10908](https://insights.sbomify.com/CVE-2026-10908/): Use after free in Chrome (high 8.3)
- [CVE-2026-10907](https://insights.sbomify.com/CVE-2026-10907/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-10906](https://insights.sbomify.com/CVE-2026-10906/): Use after free in Chrome (high 7.5)
- [CVE-2026-10905](https://insights.sbomify.com/CVE-2026-10905/): Use after free in Chrome (high 8.3)
- [CVE-2026-10904](https://insights.sbomify.com/CVE-2026-10904/): Code injection in Chrome (high 8.8)
- [CVE-2026-10903](https://insights.sbomify.com/CVE-2026-10903/): Use after free in Chrome (high 8.8)
- [CVE-2026-10902](https://insights.sbomify.com/CVE-2026-10902/): Use after free in Chrome (high 8.8)
- [CVE-2026-10901](https://insights.sbomify.com/CVE-2026-10901/): Use after free in Chrome (high 7.5)
- [CVE-2026-10900](https://insights.sbomify.com/CVE-2026-10900/): Use after free in Chrome (high 7.5)
- [CVE-2026-1090](https://insights.sbomify.com/CVE-2026-1090/): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (high 8.7)
- [CVE-2026-10899](https://insights.sbomify.com/CVE-2026-10899/): Use after free in Chrome (high 7.5)
- [CVE-2026-108985](https://insights.sbomify.com/CVE-2026-108985/): Memory corruption in libnfs (high 7.1)
- [CVE-2026-108984](https://insights.sbomify.com/CVE-2026-108984/): GV-ASManager Web Server Buffer Overflow Vulnerability (high 7.5)
- [CVE-2026-108983](https://insights.sbomify.com/CVE-2026-108983/): GV-ASManager Web Server Command Injection Vulnerability (critical 9.8)
- [CVE-2026-108982](https://insights.sbomify.com/CVE-2026-108982/): Security feature bypass in VeraCrypt (high 7.2)
- [CVE-2026-108981](https://insights.sbomify.com/CVE-2026-108981/): Path traversal in ngx cache purge (low 3.6)
- [CVE-2026-108980](https://insights.sbomify.com/CVE-2026-108980/): Path traversal in Blinko (high 8.8)
- [CVE-2026-10898](https://insights.sbomify.com/CVE-2026-10898/): Memory corruption in Chrome (high 8.3)
- [CVE-2026-108978](https://insights.sbomify.com/CVE-2026-108978/): Memory corruption in rlottie (medium 5.5)
- [CVE-2026-108976](https://insights.sbomify.com/CVE-2026-108976/): Command injection in Emacs (high 7.8)
- [CVE-2026-108975](https://insights.sbomify.com/CVE-2026-108975/): SourceCodester Library Management System add_admin.php move_uploaded_file unrestricted upload (medium 6.9)
- [CVE-2026-108974](https://insights.sbomify.com/CVE-2026-108974/): SourceCodester E-Learning System Users.php save_users unrestricted upload (medium 6.9)
- [CVE-2026-108973](https://insights.sbomify.com/CVE-2026-108973/): SourceCodester Contact Tracing System Users.php move_uploaded_file unrestricted upload (medium 6.9)
- [CVE-2026-108972](https://insights.sbomify.com/CVE-2026-108972/): SourceCodester Human Resource Management System Employee Endpoint employee.php session_start improper authentication (medium 6.9)
- [CVE-2026-108971](https://insights.sbomify.com/CVE-2026-108971/): D-Link DCS-930L Emergency HTTP Recovery Server bootloader_region.bin mpfd_decode signature verification (critical 9.4)
- [CVE-2026-108970](https://insights.sbomify.com/CVE-2026-108970/): itsmeravitejak Online-Examination-System Registration Form database.php addNewUser sql injection (medium 6.9)
- [CVE-2026-10897](https://insights.sbomify.com/CVE-2026-10897/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-108969](https://insights.sbomify.com/CVE-2026-108969/): itsmeravitejak Online-Examination-System Session session.php checkLogin comparison (medium 6.9)
- [CVE-2026-108968](https://insights.sbomify.com/CVE-2026-108968/): SourceCodester Performance Indicator System sales_history.php sql injection (medium 6.9)
- [CVE-2026-108967](https://insights.sbomify.com/CVE-2026-108967/): SourceCodester Performance Indicator System edit_credit.php sql injection (medium 6.9)
- [CVE-2026-108966](https://insights.sbomify.com/CVE-2026-108966/): SourceCodester Performance Indicator System product.php sql injection (medium 6.9)
- [CVE-2026-108965](https://insights.sbomify.com/CVE-2026-108965/): SourceCodester Performance Indicator System edit_quantity.php sql injection (medium 6.9)
- [CVE-2026-108964](https://insights.sbomify.com/CVE-2026-108964/): SourceCodester Performance Indicator System addproduct.php sql injection (medium 6.9)
- [CVE-2026-108963](https://insights.sbomify.com/CVE-2026-108963/): Command injection in databasement (high 8.8)
- [CVE-2026-108962](https://insights.sbomify.com/CVE-2026-108962/): storyicon comfyui_segment_anything GroundingDINO Model Loading slconfig.py SLConfig._file2dict code injection (medium 5.3)
- [CVE-2026-108961](https://insights.sbomify.com/CVE-2026-108961/): PaddlePaddle PaddleX Preprocessor processors.py NormalizeImage.__init__ code injection (medium 5.3)
- [CVE-2026-108960](https://insights.sbomify.com/CVE-2026-108960/): Tiiny-AI PowerInfer FFN GPU-split Loader ggml-cuda.cu create_striped_mat_to_gpu out-of-bounds (medium 4.8)
- [CVE-2026-10896](https://insights.sbomify.com/CVE-2026-10896/): Use after free in Chrome (high 8.8)
- [CVE-2026-108959](https://insights.sbomify.com/CVE-2026-108959/): itsourcecode Online Cake Ordering System addtransacdetail.php sql injection (medium 5.3)
- [CVE-2026-108958](https://insights.sbomify.com/CVE-2026-108958/): TensorLayer HDF5 Loading utils.py load_hdf5_graph deserialization (medium 5.3)
- [CVE-2026-108957](https://insights.sbomify.com/CVE-2026-108957/): TinyLLaVA TinyLLaVA_Factory TinyLlavaConfig configuration_tinyllava.py _load_text_config code injection (medium 5.3)
- [CVE-2026-108956](https://insights.sbomify.com/CVE-2026-108956/): code-projects Online Reviewer System User Update btn_functions.php sql injection (medium 6.9)
- [CVE-2026-108955](https://insights.sbomify.com/CVE-2026-108955/): Tiiny-AI PowerInfer GGUF ggml.c gguf_init_from_file out-of-bounds (medium 4.8)
- [CVE-2026-108954](https://insights.sbomify.com/CVE-2026-108954/): Memory corruption in sherpa-onnx (medium 5.3)
- [CVE-2026-108953](https://insights.sbomify.com/CVE-2026-108953/): mac-shell-mcp before 2.0.0 OS Command Injection via execute_command Arguments (high 8.5)
- [CVE-2026-108952](https://insights.sbomify.com/CVE-2026-108952/): RT-Thread through 5.3.0 Memory Corruption via USB CDC VCOM Driver (medium 5.1)
- [CVE-2026-108951](https://insights.sbomify.com/CVE-2026-108951/): LavaLite CMS through 10.1.2 Authorization Bypass via User Update API (high 7.1)
- [CVE-2026-108950](https://insights.sbomify.com/CVE-2026-108950/): Open Source Social Network (OSSN) through 10.1 Missing Authorization via Album Photo Routes (medium 6.9)
- [CVE-2026-10895](https://insights.sbomify.com/CVE-2026-10895/): Use after free in Chrome (high 8.8)
- [CVE-2026-108948](https://insights.sbomify.com/CVE-2026-108948/): code-projects Online Reviewer System User Profile Update btn_functions.php dynamically-determined object attributes (medium 5.3)
- [CVE-2026-108947](https://insights.sbomify.com/CVE-2026-108947/): yoshitomo-matsubara torchdistill main_util.py load_ckpt deserialization (medium 4.8)
- [CVE-2026-108945](https://insights.sbomify.com/CVE-2026-108945/): iMoonLab yolov13 AutoBackend Model Loading autobackend.py eval code injection (medium 4.8)
- [CVE-2026-108944](https://insights.sbomify.com/CVE-2026-108944/): repository RAE Config-Driven Model Instantiation model_utils.py get_obj_from_str code injection (low 2.4)
- [CVE-2026-108943](https://insights.sbomify.com/CVE-2026-108943/): ModelTC LightX2V Tokenizer cosmos3_runner.py AutoTokenizer.from_pretrained code injection (medium 4.8)
- [CVE-2026-108942](https://insights.sbomify.com/CVE-2026-108942/): Cross-site scripting in clarity-upscaler (medium 5.1)
- [CVE-2026-108941](https://insights.sbomify.com/CVE-2026-108941/): Linketic CityGaussian Sidecar Parsing common.py parse_cfg_args code injection (low 2.4)
- [CVE-2026-108940](https://insights.sbomify.com/CVE-2026-108940/): EricLBuehler Mistral.rs handlers.rs calibration_apply path traversal (medium 6.9)
- [CVE-2026-10894](https://insights.sbomify.com/CVE-2026-10894/): Use after free in Chrome (high 8.3)
- [CVE-2026-108939](https://insights.sbomify.com/CVE-2026-108939/): EricLBuehler mistral.rs media_source.rs is_global_ip server-side request forgery (medium 6.9)
- [CVE-2026-108938](https://insights.sbomify.com/CVE-2026-108938/): code-projects Matrimonial System matrimony.sql file access (medium 6.9)
- [CVE-2026-108937](https://insights.sbomify.com/CVE-2026-108937/): code-projects Online Ticket Reservation System medallion.sql file information disclosure (medium 6.9)
- [CVE-2026-108936](https://insights.sbomify.com/CVE-2026-108936/): Edimax BR-6208AC QoS Page formQoS cross site scripting (medium 4.8)
- [CVE-2026-108935](https://insights.sbomify.com/CVE-2026-108935/): Edimax BR-6208AC Port Forwarding formPortFw cross site scripting (medium 4.8)
- [CVE-2026-108934](https://insights.sbomify.com/CVE-2026-108934/): Edimax BR-6208AC HTTP Blocking formUrlb cross site scripting (medium 4.8)
- [CVE-2026-108933](https://insights.sbomify.com/CVE-2026-108933/): Edimax BR-6208AC formFilter cross site scripting (medium 4.8)
- [CVE-2026-108932](https://insights.sbomify.com/CVE-2026-108932/): Netcore NR268 DHCP Hostname filter_hosts_dump.cgi eval cross site scripting (medium 5.3)
- [CVE-2026-108931](https://insights.sbomify.com/CVE-2026-108931/): Netcore NR268 DHCP dhcp_dynamicip_show.cgi eval cross site scripting (medium 5.3)
- [CVE-2026-108930](https://insights.sbomify.com/CVE-2026-108930/): Netcore NR268 DDNS ddns_wan_list_show.cgi ddns_wan_list_show information disclosure (medium 5.1)
- [CVE-2026-10893](https://insights.sbomify.com/CVE-2026-10893/): Use after free in Chrome (high 8.8)
- [CVE-2026-108929](https://insights.sbomify.com/CVE-2026-108929/): Netcore NR268 DDNS DDNSset.cgi execvp argument injection (critical 9.4)
- [CVE-2026-108928](https://insights.sbomify.com/CVE-2026-108928/): itsourcecode Online Admission System sum.php sql injection (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/946/