# Vulnerabilities published in 2026


- [CVE-2026-108927](https://insights.sbomify.com/CVE-2026-108927/): itsourcecode Baptism Information Management System pbaptism.php sql injection (medium 5.3)
- [CVE-2026-108926](https://insights.sbomify.com/CVE-2026-108926/): itsourcecode Baptism Information Management System ebaptism.php sql injection (medium 5.3)
- [CVE-2026-108925](https://insights.sbomify.com/CVE-2026-108925/): Cohesity - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (medium 6.1)
- [CVE-2026-108924](https://insights.sbomify.com/CVE-2026-108924/): getkirby Kirby Dynamic Option Generation OptionsQuery.php resolve authorization (medium 5.3)
- [CVE-2026-108923](https://insights.sbomify.com/CVE-2026-108923/): 1024-lab smart-admin Support Config Query queryByKey access control (medium 5.3)
- [CVE-2026-108922](https://insights.sbomify.com/CVE-2026-108922/): KusalkaSilva Learning-Management-System upload_save.php getimagesize unrestricted upload (medium 5.3)
- [CVE-2026-108921](https://insights.sbomify.com/CVE-2026-108921/): Missing authorization in Learning-Management-System (medium 6.9)
- [CVE-2026-108920](https://insights.sbomify.com/CVE-2026-108920/): SourceCodester Drug Recommendation System Admin Record Tables user_record.php cross site scripting (medium 5.3)
- [CVE-2026-10892](https://insights.sbomify.com/CVE-2026-10892/): Memory corruption in Chrome (critical 9.6)
- [CVE-2026-108919](https://insights.sbomify.com/CVE-2026-108919/): SourceCodester Drug Recommendation System Student Registration add_student.php cross site scripting (medium 5.3)
- [CVE-2026-108918](https://insights.sbomify.com/CVE-2026-108918/): Edimax BR-6208AC formWlanMP command injection (critical 10.0)
- [CVE-2026-108917](https://insights.sbomify.com/CVE-2026-108917/): Edimax BR-6208AC formAutoFWupgrade command injection (critical 10.0)
- [CVE-2026-108916](https://insights.sbomify.com/CVE-2026-108916/): Edimax BR-6208AC formAccept command injection (medium 6.9)
- [CVE-2026-108915](https://insights.sbomify.com/CVE-2026-108915/): Edimax BR-6208AC formWlanMP buffer overflow (critical 9.4)
- [CVE-2026-108914](https://insights.sbomify.com/CVE-2026-108914/): Edimax BR-6208AC formWlSiteSurvey buffer overflow (critical 9.4)
- [CVE-2026-108913](https://insights.sbomify.com/CVE-2026-108913/): Code injection in Omarchy (high 7.1)
- [CVE-2026-10891](https://insights.sbomify.com/CVE-2026-10891/): Use after free in Chrome (high 8.8)
- [CVE-2026-108909](https://insights.sbomify.com/CVE-2026-108909/): Netcore NR268 CGI Endpoint cross-site request forgery (medium 5.3)
- [CVE-2026-108908](https://insights.sbomify.com/CVE-2026-108908/): Netcore NR268 Web UI l7_call_board_user_set.cgi eval cross site scripting (medium 4.8)
- [CVE-2026-108907](https://insights.sbomify.com/CVE-2026-108907/): Netcore NR268 CGI Execution user_ok improper authentication (critical 10.0)
- [CVE-2026-108906](https://insights.sbomify.com/CVE-2026-108906/): Netcore NR268 filter_arp_put_file.cgi filter_arp_put_file_cgi out-of-bounds (high 8.6)
- [CVE-2026-108905](https://insights.sbomify.com/CVE-2026-108905/): pH7Builder before 18.6.0 Hard-Coded API Key Bypass via Host Header (high 8.7)
- [CVE-2026-108904](https://insights.sbomify.com/CVE-2026-108904/): pH7Builder before 18.5.0 Sensitive Data Exposure via Member API UserController (high 7.1)
- [CVE-2026-108903](https://insights.sbomify.com/CVE-2026-108903/): pH7Builder before 19.3.0 CAPTCHA Bypass via Client-Chosen Form ID (medium 6.9)
- [CVE-2026-108902](https://insights.sbomify.com/CVE-2026-108902/): pH7Builder before 18.5.0 Path Traversal Arbitrary File Deletion via picture_link (high 7.2)
- [CVE-2026-108901](https://insights.sbomify.com/CVE-2026-108901/): Shenzhen HCC Technology MPOS M6 PLUS Display QR Code Rendering ui layer (medium 5.1)
- [CVE-2026-108900](https://insights.sbomify.com/CVE-2026-108900/): Exponent CMS XML-RPC xmlrpc.php userLogin sql injection (medium 6.9)
- [CVE-2026-10890](https://insights.sbomify.com/CVE-2026-10890/): Use after free in Chrome (high 8.8)
- [CVE-2026-1089](https://insights.sbomify.com/CVE-2026-1089/): User‑Controlled HTTP Header In Fortra's GoAnywhere MFT Allows Arbitrary DNS Lookups (medium 6.5)
- [CVE-2026-108899](https://insights.sbomify.com/CVE-2026-108899/): tobychui zoraxy Path Exception Matcher authProviders.go handleBasicAuth improper authorization (medium 6.9)
- [CVE-2026-108898](https://insights.sbomify.com/CVE-2026-108898/): Netis WF2409E Wireless Settings cross site scripting (medium 5.1)
- [CVE-2026-108897](https://insights.sbomify.com/CVE-2026-108897/): Smart Media4U Technology SHAREit App WebView JS Bridge syncInvoke routine (medium 6.9)
- [CVE-2026-108896](https://insights.sbomify.com/CVE-2026-108896/): Linksys E1700 setLinksysIpv6 os command injection (critical 9.4)
- [CVE-2026-108895](https://insights.sbomify.com/CVE-2026-108895/): Linksys E1700 setDMZ os command injection (critical 9.4)
- [CVE-2026-108894](https://insights.sbomify.com/CVE-2026-108894/): Linksys E1700 Static Route addStaticRoute os command injection (critical 9.4)
- [CVE-2026-108893](https://insights.sbomify.com/CVE-2026-108893/): Linksys E1700 setVlan stack-based overflow (critical 9.4)
- [CVE-2026-108892](https://insights.sbomify.com/CVE-2026-108892/): Linksys E1700 Mac Filter ssid1MACFilter stack-based overflow (critical 10.0)
- [CVE-2026-108891](https://insights.sbomify.com/CVE-2026-108891/): JeecgBoot through 3.9.5 Missing Authorization via /sys/user/getUserDetailByUserId (medium 5.3)
- [CVE-2026-108890](https://insights.sbomify.com/CVE-2026-108890/): BlackBeltTechnology pi-agent-dashboard Terminal terminal-handler.ts terminalManager.spawn improper authorization (medium 5.3)
- [CVE-2026-10889](https://insights.sbomify.com/CVE-2026-10889/): Memory corruption in Chrome (high 8.3)
- [CVE-2026-108889](https://insights.sbomify.com/CVE-2026-108889/): Missing authorization in Cloud Billing (medium 4.8)
- [CVE-2026-108888](https://insights.sbomify.com/CVE-2026-108888/): JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartRole/exportXls (medium 5.3)
- [CVE-2026-108887](https://insights.sbomify.com/CVE-2026-108887/): JeecgBoot through 3.9.5 Missing Authorization via /sys/comment/exportXls (medium 5.3)
- [CVE-2026-108886](https://insights.sbomify.com/CVE-2026-108886/): JeecgBoot through 3.9.5 Missing Authorization via /sys/user/queryChildrenByUsername (medium 5.3)
- [CVE-2026-108885](https://insights.sbomify.com/CVE-2026-108885/): JeecgBoot through 3.9.5 Missing Authorization via /sys/message/sysMessage/delete (medium 5.3)
- [CVE-2026-108884](https://insights.sbomify.com/CVE-2026-108884/): JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate Delete Endpoint (medium 5.3)
- [CVE-2026-108883](https://insights.sbomify.com/CVE-2026-108883/): JeecgBoot through 3.9.5 Missing Authorization via /sys/thirdApp/editThirdAppConfig (high 7.1)
- [CVE-2026-108882](https://insights.sbomify.com/CVE-2026-108882/): JeecgBoot through 3.9.5 Missing Authorization via /sys/position/removePositionUser (medium 5.3)
- [CVE-2026-108881](https://insights.sbomify.com/CVE-2026-108881/): JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/getTenantPackInfo (medium 5.3)
- [CVE-2026-108880](https://insights.sbomify.com/CVE-2026-108880/): JeecgBoot through 3.9.5 Missing Authorization via /sys/dict/editDictByLowAppId (medium 5.3)
- [CVE-2026-10888](https://insights.sbomify.com/CVE-2026-10888/): Use after free in Chrome (high 8.8)
- [CVE-2026-108879](https://insights.sbomify.com/CVE-2026-108879/): JeecgBoot through 3.9.5 IDOR via /airag/api/getChatVariable Username Parameter (medium 5.3)
- [CVE-2026-108878](https://insights.sbomify.com/CVE-2026-108878/): JeecgBoot through 3.9.5 Missing Authorization via /airag/app/queryById (medium 5.3)
- [CVE-2026-108877](https://insights.sbomify.com/CVE-2026-108877/): JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/delete (medium 5.3)
- [CVE-2026-108876](https://insights.sbomify.com/CVE-2026-108876/): JeecgBoot through 3.9.5 Missing Authorization via /sys/user/putCancelQuit (medium 5.3)
- [CVE-2026-108875](https://insights.sbomify.com/CVE-2026-108875/): JeecgBoot through 3.9.5 Missing Authorization via /sys/user/addSysUserGroup (medium 5.3)
- [CVE-2026-108874](https://insights.sbomify.com/CVE-2026-108874/): JeecgBoot through 3.9.5 Missing Authorization via /sys/user/changeDepartChargePerson (medium 5.3)
- [CVE-2026-108873](https://insights.sbomify.com/CVE-2026-108873/): JeecgBoot through 3.9.5 Missing Authorization via /sys/user/doUpdateDepartInfo (medium 5.3)
- [CVE-2026-108872](https://insights.sbomify.com/CVE-2026-108872/): JeecgBoot through 3.9.5 Missing Authorization via /sys/user/batchEditUsers (medium 5.3)
- [CVE-2026-108871](https://insights.sbomify.com/CVE-2026-108871/): JeecgBoot through 3.9.5 Missing Authorization via POST /sys/sysDepartRole/datarule (medium 5.3)
- [CVE-2026-108870](https://insights.sbomify.com/CVE-2026-108870/): JeecgBoot through 3.9.5 Missing Authorization via POST /sys/role/datarule (medium 5.3)
- [CVE-2026-10887](https://insights.sbomify.com/CVE-2026-10887/): Use after free in Chrome (high 8.1)
- [CVE-2026-108869](https://insights.sbomify.com/CVE-2026-108869/): JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendSysAnnouncement (medium 5.3)
- [CVE-2026-108868](https://insights.sbomify.com/CVE-2026-108868/): JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendBusTemplateAnnouncement (medium 5.3)
- [CVE-2026-108867](https://insights.sbomify.com/CVE-2026-108867/): JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserRoleSetById (medium 5.3)
- [CVE-2026-108866](https://insights.sbomify.com/CVE-2026-108866/): JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserAuths (medium 5.3)
- [CVE-2026-108865](https://insights.sbomify.com/CVE-2026-108865/): AmoyLab Unla through 0.10.0 OAuth2 Authentication Bypass via /authorize (high 8.8)
- [CVE-2026-108864](https://insights.sbomify.com/CVE-2026-108864/): iFlytek Astron Agent through 1.1.2 Authorization Bypass via /workflow/v1/resume Endpoint (low 2.3)
- [CVE-2026-108863](https://insights.sbomify.com/CVE-2026-108863/): Katanemo Plano through 0.4.37 Missing Authentication on Envoy Admin Interface (high 8.7)
- [CVE-2026-108862](https://insights.sbomify.com/CVE-2026-108862/): APIPark through 1.9.7-beta IDOR via application authorization endpoints (medium 6.0)
- [CVE-2026-108861](https://insights.sbomify.com/CVE-2026-108861/): Odoo MCP 1.0.0 through 1.3.2 Information Disclosure via execute_method Tool (medium 5.3)
- [CVE-2026-108860](https://insights.sbomify.com/CVE-2026-108860/): BotSharp through 5.2.0 Authentication Bypass via Hard-Coded JWT Signing Key (critical 9.3)
- [CVE-2026-10886](https://insights.sbomify.com/CVE-2026-10886/): Use after free in Chrome (critical 9.6)
- [CVE-2026-108859](https://insights.sbomify.com/CVE-2026-108859/): mcp-go through 1.2.1 Denial of Service via Unbounded POST Body Buffering (high 8.7)
- [CVE-2026-108858](https://insights.sbomify.com/CVE-2026-108858/): Predibase LoRAX through 0.12.1 API Token Exposure via Router Logs (medium 6.8)
- [CVE-2026-108857](https://insights.sbomify.com/CVE-2026-108857/): Hugging Face Text Embeddings Inference through 1.9.4 Cleartext API Key Logging (medium 4.8)
- [CVE-2026-108856](https://insights.sbomify.com/CVE-2026-108856/): UnicomAI Wanwu through 0.6.5 Authorization Bypass via /v1/appspace/app/key AppKey Minting (low 2.3)
- [CVE-2026-108855](https://insights.sbomify.com/CVE-2026-108855/): UnicomAI Wanwu through 0.6.5 Missing Authorization via DELETE /v1/appspace/app/publish (medium 5.3)
- [CVE-2026-108854](https://insights.sbomify.com/CVE-2026-108854/): Wanwu before 0.6.3 IDOR AppKey Deletion via DELETE /v1/appspace/app/key (medium 5.3)
- [CVE-2026-108853](https://insights.sbomify.com/CVE-2026-108853/): UnicomAI Wanwu before 0.6.3 IDOR via DELETE /v1/appspace/app (high 7.2)
- [CVE-2026-108852](https://insights.sbomify.com/CVE-2026-108852/): Deep Chat through 2.5.1 XSS via Markdown Link Validation Bypass (low 2.1)
- [CVE-2026-108851](https://insights.sbomify.com/CVE-2026-108851/): phpMyFAQ through 4.1.10 Missing Authorization via MCP Server faq_search Tool (medium 4.8)
- [CVE-2026-108850](https://insights.sbomify.com/CVE-2026-108850/): Company Research Agent through 2.2.0 SSRF via /generate-pdf ReportLab Markup (medium 6.9)
- [CVE-2026-10885](https://insights.sbomify.com/CVE-2026-10885/): Use after free in Chrome (high 8.8)
- [CVE-2026-10884](https://insights.sbomify.com/CVE-2026-10884/): Use after free in Chrome (high 8.3)
- [CVE-2026-108839](https://insights.sbomify.com/CVE-2026-108839/): thClaws through 0.141.0 Symlink Following File Write via POST /v1/inputs (low 2.3)
- [CVE-2026-108837](https://insights.sbomify.com/CVE-2026-108837/): Apache Kylin: Potential computed-column resource exhaustion (not scored)
- [CVE-2026-108836](https://insights.sbomify.com/CVE-2026-108836/): Ollama Pull API name.go IsValid server-side request forgery (medium 6.9)
- [CVE-2026-108835](https://insights.sbomify.com/CVE-2026-108835/): Yungengxin Yun Jia Security Guard kgameprotect.sys sub_14000885C privileges management (medium 4.8)
- [CVE-2026-108834](https://insights.sbomify.com/CVE-2026-108834/): Cairo-dock Glx-Dock Query Parameter ww_page.php cross site scripting (medium 5.3)
- [CVE-2026-108833](https://insights.sbomify.com/CVE-2026-108833/): Apache Kylin: default startup profile miss security settings (not scored)
- [CVE-2026-108831](https://insights.sbomify.com/CVE-2026-108831/): meetecho janus-gateway Admin API admin.js hard-coded credentials (medium 5.3)
- [CVE-2026-108830](https://insights.sbomify.com/CVE-2026-108830/): meetecho janus-gateway VideoRoom janus_videoroom.c race condition (low 2.3)
- [CVE-2026-10883](https://insights.sbomify.com/CVE-2026-10883/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-108829](https://insights.sbomify.com/CVE-2026-108829/): Zen Cart Module Configuration modules.php sql injection (medium 5.1)
- [CVE-2026-108828](https://insights.sbomify.com/CVE-2026-108828/): Zen Cart Admin Panel configuration.php eval sql injection (low 2.1)
- [CVE-2026-108827](https://insights.sbomify.com/CVE-2026-108827/): Zen Cart Administrative Module Management general.php zen_call_function code injection (low 2.1)
- [CVE-2026-108826](https://insights.sbomify.com/CVE-2026-108826/): Zen Cart PayPal IPN paypaldp.php zen_db_perform sql injection (medium 6.9)
- [CVE-2026-108825](https://insights.sbomify.com/CVE-2026-108825/): yangzongzhuan RuoYi authDataScope checkRoleAllowed privileges management (medium 5.3)
- [CVE-2026-108824](https://insights.sbomify.com/CVE-2026-108824/): DataEase Utils.java Utils.buildCalcField sql injection (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/947/