# Vulnerabilities published in 2026


- [CVE-2026-108823](https://insights.sbomify.com/CVE-2026-108823/): Apache Kylin: Potential unauthenticated job metadata replacement (not scored)
- [CVE-2026-108822](https://insights.sbomify.com/CVE-2026-108822/): Kamailio sipt ss7_parser.c isup_get_calling_party buffer overflow (medium 6.9)
- [CVE-2026-108821](https://insights.sbomify.com/CVE-2026-108821/): Tencent WeKnora SQL Validator inject.go validateSubquery sql injection (medium 5.3)
- [CVE-2026-108820](https://insights.sbomify.com/CVE-2026-108820/): agno-agi agno Delegation Feature _default_tools.py member_agent.run unnecessary privileges (medium 5.3)
- [CVE-2026-10882](https://insights.sbomify.com/CVE-2026-10882/): Use after free in Chrome (high 8.8)
- [CVE-2026-108819](https://insights.sbomify.com/CVE-2026-108819/): agno-agi agno Agent Orchestration Layer exec dynamically-managed code resources (medium 6.9)
- [CVE-2026-108818](https://insights.sbomify.com/CVE-2026-108818/): agno-agi agno auth.py get_authentication_dependency missing authentication (medium 6.9)
- [CVE-2026-108817](https://insights.sbomify.com/CVE-2026-108817/): agno-agi agno CodingTools coding.py agno.CodingTools.run_shell os command injection (medium 5.1)
- [CVE-2026-108816](https://insights.sbomify.com/CVE-2026-108816/): agno-agi agno PythonTools python.py run_python_code code injection (medium 5.3)
- [CVE-2026-108815](https://insights.sbomify.com/CVE-2026-108815/): idcCMS member_deal.php cross site scripting (medium 5.1)
- [CVE-2026-108814](https://insights.sbomify.com/CVE-2026-108814/): SEMCMS SEMCMS_Banner.php sql injection (medium 5.3)
- [CVE-2026-108813](https://insights.sbomify.com/CVE-2026-108813/): SEMCMS SEMCMS_Download.php sql injection (medium 5.3)
- [CVE-2026-108812](https://insights.sbomify.com/CVE-2026-108812/): SEMCMS SEMCMS_User.php user improper authorization (medium 6.9)
- [CVE-2026-108811](https://insights.sbomify.com/CVE-2026-108811/): WMCMS index.php information disclosure (medium 5.3)
- [CVE-2026-108810](https://insights.sbomify.com/CVE-2026-108810/): tsi-coop tsi-dpdp-cms JSON Schema Validation information disclosure (medium 6.9)
- [CVE-2026-10881](https://insights.sbomify.com/CVE-2026-10881/): Memory corruption in Chrome (critical 9.6)
- [CVE-2026-108809](https://insights.sbomify.com/CVE-2026-108809/): Eleveo Call Recording Software logout session expiration (medium 5.1)
- [CVE-2026-108808](https://insights.sbomify.com/CVE-2026-108808/): Eleveo Call Recording Software JWT Token logout get request method with sensitive query strings (low 2.1)
- [CVE-2026-108807](https://insights.sbomify.com/CVE-2026-108807/): krupalshah EmployeeRecruitmentSystem Registration adminregister.php mysql_query sql injection (medium 6.9)
- [CVE-2026-108806](https://insights.sbomify.com/CVE-2026-108806/): krupalshah EmployeeRecruitmentSystem Forgot Password authprocessing.php mysql_query sql injection (medium 6.9)
- [CVE-2026-108805](https://insights.sbomify.com/CVE-2026-108805/): krupalshah EmployeeRecruitmentSystem Login loginprocessing.php mysql_query sql injection (medium 6.9)
- [CVE-2026-108804](https://insights.sbomify.com/CVE-2026-108804/): TRENDnet TEW-751DR/TEW-752DRU/TEW733GR Web Management Backend pigwidgeon.cgi fwrite os command injection (critical 10.0)
- [CVE-2026-108803](https://insights.sbomify.com/CVE-2026-108803/): y_project RuoYi Disable API add changeStatus session expiration (medium 5.3)
- [CVE-2026-108802](https://insights.sbomify.com/CVE-2026-108802/): y_project RuoYi Dictionary Data Drawer Preview add renderDrawer cross site scripting (medium 5.1)
- [CVE-2026-108801](https://insights.sbomify.com/CVE-2026-108801/): prasathmani TinyFileManager tinyfilemanager.php move_uploaded_file unrestricted upload (medium 5.3)
- [CVE-2026-108800](https://insights.sbomify.com/CVE-2026-108800/): yangzongzhuan RuoYi cross-site request forgery (medium 5.3)
- [CVE-2026-10880](https://insights.sbomify.com/CVE-2026-10880/): Unauthenticated SQL Injection in Osnexus Quantastor (critical 9.8)
- [CVE-2026-1088](https://insights.sbomify.com/CVE-2026-1088/): Login Page Editor <= 1.2 - Cross-Site Request Forgery to Settings Update (medium 4.3)
- [CVE-2026-108799](https://insights.sbomify.com/CVE-2026-108799/): jackq XCMS Password Recovery Mail Endpoint PublicController.class.php sendFindPwdMail sql injection (medium 6.9)
- [CVE-2026-108798](https://insights.sbomify.com/CVE-2026-108798/): ZKTeco BioTime hard-coded key (medium 6.9)
- [CVE-2026-108797](https://insights.sbomify.com/CVE-2026-108797/): ZKTeco BioTime Employee REST API employees authorization (medium 5.3)
- [CVE-2026-108796](https://insights.sbomify.com/CVE-2026-108796/): ZKTeco BioTime Biometric Data Endpoint finger_data authorization (medium 5.3)
- [CVE-2026-108795](https://insights.sbomify.com/CVE-2026-108795/): ZKTeco BioTime System Settings API systemSettings access control (medium 5.3)
- [CVE-2026-108794](https://insights.sbomify.com/CVE-2026-108794/): ZKTeco BioTime Database Migration Functionality db_migrate_setting sql injection (medium 5.3)
- [CVE-2026-108791](https://insights.sbomify.com/CVE-2026-108791/): westboy CicadasCMS Template Management input TemplateController.input path traversal (medium 5.3)
- [CVE-2026-108790](https://insights.sbomify.com/CVE-2026-108790/): westboy CicadasCMS Backend Template Editor save TemplateController.save path traversal (medium 5.1)
- [CVE-2026-10879](https://insights.sbomify.com/CVE-2026-10879/): DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders (critical 9.8)
- [CVE-2026-108789](https://insights.sbomify.com/CVE-2026-108789/): deepseek-ai deepseek-harness dsh-workflow-worker-thread agent behavioral workflow (medium 5.1)
- [CVE-2026-108788](https://insights.sbomify.com/CVE-2026-108788/): deepseek-ai deepseek-harness Sandbox spawn sandbox (medium 4.8)
- [CVE-2026-108787](https://insights.sbomify.com/CVE-2026-108787/): houtini-ai voice-analyser-mcp collect_corpus crawler.ts fetch server-side request forgery (medium 5.3)
- [CVE-2026-108786](https://insights.sbomify.com/CVE-2026-108786/): houtini-ai seo-crawler-mcp Crawler CrawlOrchestrator.ts run_seo_audit server-side request forgery (medium 5.3)
- [CVE-2026-108785](https://insights.sbomify.com/CVE-2026-108785/): macrozheng mall JwtAuthenticationTokenFilter refreshToken JwtTokenUtil.refreshHeadToken session expiration (medium 5.3)
- [CVE-2026-108784](https://insights.sbomify.com/CVE-2026-108784/): macrozheng mall Payment Endpoint AlipayServiceImpl.java AlipayServiceImpl.pay logic error (medium 6.9)
- [CVE-2026-108783](https://insights.sbomify.com/CVE-2026-108783/): PRVTPRO Amnezia-Web-Panel Backup Download app.py default credentials (medium 6.9)
- [CVE-2026-108782](https://insights.sbomify.com/CVE-2026-108782/): erzhongxmu JEEWMS Autocomplete CommonServiceImpl.java CommonServiceImpl.getAutoList sql injection (medium 5.3)
- [CVE-2026-108781](https://insights.sbomify.com/CVE-2026-108781/): erzhongxmu JEEWMS PDA WmToMoveGoodsController.java WmToMoveGoodsController.list sql injection (medium 5.3)
- [CVE-2026-108780](https://insights.sbomify.com/CVE-2026-108780/): Apache Kylin: Potential JDBC source configuration validation issue (not scored)
- [CVE-2026-10878](https://insights.sbomify.com/CVE-2026-10878/): D-Link DWR-M920 formSmsManage sub_41C8E8 command injection (medium 5.3)
- [CVE-2026-108779](https://insights.sbomify.com/CVE-2026-108779/): erzhongxmu JEEWMS WmSttInGoodsController.java WmSttInGoodsController.list sql injection (medium 5.3)
- [CVE-2026-108778](https://insights.sbomify.com/CVE-2026-108778/): erzhongxmu JEEWMS Inbound Quality Check Pda WmInQmIController.java WmInQmIController.list sql injection (medium 5.3)
- [CVE-2026-108777](https://insights.sbomify.com/CVE-2026-108777/): erzhongxmu JEEWMS WvGiController.java WvGiController.list sql injection (medium 5.3)
- [CVE-2026-108776](https://insights.sbomify.com/CVE-2026-108776/): Apache Kylin: tables/names SparkSQL injection (not scored)
- [CVE-2026-108775](https://insights.sbomify.com/CVE-2026-108775/): erzhongxmu JEEWMS Search Endpoint WvNoticeController.java WvNoticeController.list sql injection (medium 5.3)
- [CVE-2026-108774](https://insights.sbomify.com/CVE-2026-108774/): erzhongxmu JEEWMS MdBinController.java getbinallagv sql injection (medium 5.3)
- [CVE-2026-108773](https://insights.sbomify.com/CVE-2026-108773/): erzhongxmu JEEWMS WmOmNoticeHController.java docheck sql injection (medium 5.3)
- [CVE-2026-108772](https://insights.sbomify.com/CVE-2026-108772/): bleenco abstruse Cache Endpoint download_cache.go filepath.Join path traversal (medium 6.9)
- [CVE-2026-108771](https://insights.sbomify.com/CVE-2026-108771/): Apache Kylin: unauthenticated broadcast API and polymorphic deserialization (not scored)
- [CVE-2026-108770](https://insights.sbomify.com/CVE-2026-108770/): Appwrite Browser Screenshot Service Get.php PublicHostname server-side request forgery (medium 6.9)
- [CVE-2026-10877](https://insights.sbomify.com/CVE-2026-10877/): SourceCodester Ship Ferry Ticket Reservation System Admin Login login.php sql injection (medium 6.9)
- [CVE-2026-108769](https://insights.sbomify.com/CVE-2026-108769/): zhayujie CowAgent Markdown Rendering Markdown.tsx denial of service (medium 5.3)
- [CVE-2026-108768](https://insights.sbomify.com/CVE-2026-108768/): zhayujie CowAgent Streaming Tool-Call Argument json.loads allocation of resources (medium 5.3)
- [CVE-2026-108766](https://insights.sbomify.com/CVE-2026-108766/): Apache Kylin: missing JDBC-config authorization (not scored)
- [CVE-2026-108764](https://insights.sbomify.com/CVE-2026-108764/): Apache Kylin: job-driver UI proxy SSRF (not scored)
- [CVE-2026-108763](https://insights.sbomify.com/CVE-2026-108763/): Wallet System for WooCommerce < 2.8.2 - Subscriber+ KYC Document Overwrite via IDOR (medium 4.3)
- [CVE-2026-108762](https://insights.sbomify.com/CVE-2026-108762/): Apache Kylin: delete metadata backup path-confinement bypass (not scored)
- [CVE-2026-108760](https://insights.sbomify.com/CVE-2026-108760/): LlamaFarm through 0.0.34 Unauthenticated API Exposed on All Interfaces (high 7.2)
- [CVE-2026-10876](https://insights.sbomify.com/CVE-2026-10876/): SourceCodester Ship Ferry Ticket Reservation System admin improper authorization (medium 5.3)
- [CVE-2026-108759](https://insights.sbomify.com/CVE-2026-108759/): mistral.rs 0.9.0 through 0.9.4 Sandbox Escape via Symlink Following in mistralrs-code-exec (high 7.6)
- [CVE-2026-108758](https://insights.sbomify.com/CVE-2026-108758/): Easy!Appointments through 1.6.0 Authorization Bypass via booking/register Endpoint (high 8.8)
- [CVE-2026-108757](https://insights.sbomify.com/CVE-2026-108757/): Nexting pinclaw through 0.3.0 Missing Authentication via POST /pinclaw/send (high 7.1)
- [CVE-2026-108756](https://insights.sbomify.com/CVE-2026-108756/): Abilityai Trinity through 0.9.5 Missing Authorization in Telegram Binding Routes (medium 5.3)
- [CVE-2026-108755](https://insights.sbomify.com/CVE-2026-108755/): Hatchet through 0.110.5 Unauthenticated Memory Exhaustion via SNS Ingestion Endpoint (medium 6.9)
- [CVE-2026-108754](https://insights.sbomify.com/CVE-2026-108754/): GPT-Load through 1.4.11 Cleartext Proxy Key Logging via Access Logger (medium 4.8)
- [CVE-2026-108753](https://insights.sbomify.com/CVE-2026-108753/): Agnaistic agnai through 1.0.555 Hard-Coded Credentials in self-host Docker Compose (critical 9.3)
- [CVE-2026-108752](https://insights.sbomify.com/CVE-2026-108752/): JupyterHub through 6.0.1 OAuth Client ID Collision via Unescaped Hyphen (low 2.3)
- [CVE-2026-108751](https://insights.sbomify.com/CVE-2026-108751/): MoAI-ADK through 3.1.2 Symlink Following via moai init Template Deployer (medium 4.8)
- [CVE-2026-108750](https://insights.sbomify.com/CVE-2026-108750/): OpenDocMan 2.4.0 through 2.10.0 Decompression Bomb DoS via Upload Text Extraction (medium 5.3)
- [CVE-2026-10875](https://insights.sbomify.com/CVE-2026-10875/): projectworlds Online Art Gallery Shop Project adminHome.ph sql injection (medium 5.3)
- [CVE-2026-108748](https://insights.sbomify.com/CVE-2026-108748/): Quarkus LangChain4j 1.9.0 through 1.14.1 Memory Exhaustion via /_chat/routes WebSocket (medium 6.9)
- [CVE-2026-108747](https://insights.sbomify.com/CVE-2026-108747/): Lightdash through 2.556.0 Authorization Bypass via Personal Access Token Deletion (low 2.3)
- [CVE-2026-108746](https://insights.sbomify.com/CVE-2026-108746/): Vearch 3.5.2 through 3.5.9 Incorrect Authorization via Role.HasPermissionForResources (high 8.7)
- [CVE-2026-108745](https://insights.sbomify.com/CVE-2026-108745/): CloudBeaver through 25.3.5 Missing Authorization via /api/sql-result-value Servlet (low 2.3)
- [CVE-2026-108744](https://insights.sbomify.com/CVE-2026-108744/): pbi-cli 3.10.1 through 3.12.0 OS Command Injection via Desktop Sync (high 7.3)
- [CVE-2026-108743](https://insights.sbomify.com/CVE-2026-108743/): Apache Kylin: spark job OS command injection (high 8.8)
- [CVE-2026-108742](https://insights.sbomify.com/CVE-2026-108742/): CloudBeaver through 25.3.5 Missing Authorization via initConnection GraphQL Mutation (medium 5.3)
- [CVE-2026-108741](https://insights.sbomify.com/CVE-2026-108741/): Shepherd through 0.3.1 SSRF via DNS Rebinding in Citation Checker (low 2.3)
- [CVE-2026-108740](https://insights.sbomify.com/CVE-2026-108740/): GoatCounter through 2.7.0 Privilege Escalation via /user/pref Mass Assignment (high 7.2)
- [CVE-2026-10874](https://insights.sbomify.com/CVE-2026-10874/): projectworlds Online Art Gallery Shop Project adminHome.php sql injection (medium 5.3)
- [CVE-2026-108739](https://insights.sbomify.com/CVE-2026-108739/): OpenAgents Workspace through launcher-v1.0.17 Unauthenticated Credential Exposure via /v1/workspaces (high 8.7)
- [CVE-2026-108738](https://insights.sbomify.com/CVE-2026-108738/): Traccar 5.7 through 6.16.0 Login CSRF via OpenID Connect Callback (low 2.3)
- [CVE-2026-108737](https://insights.sbomify.com/CVE-2026-108737/): Traccar through 6.16.0 Weak Password Recovery via TokenManager Token Purpose Confusion (high 7.6)
- [CVE-2026-108736](https://insights.sbomify.com/CVE-2026-108736/): Speedtest Tracker through 1.15.0 IP Allowlist Bypass via X-Forwarded-For Spoofing (medium 6.3)
- [CVE-2026-108735](https://insights.sbomify.com/CVE-2026-108735/): Miniflux 2.3.0 through 2.3.3 SSRF via Per-Feed Proxy URL (medium 5.3)
- [CVE-2026-108734](https://insights.sbomify.com/CVE-2026-108734/): Frappe CRM 1.49.0 through 1.87.0 Missing Authorization via get_linked_docs_of_document (medium 5.3)
- [CVE-2026-108733](https://insights.sbomify.com/CVE-2026-108733/): Frappe HR (hrms) before 16.11.0 Missing Authorization via expire_allocation (medium 5.3)
- [CVE-2026-108732](https://insights.sbomify.com/CVE-2026-108732/): Frappe HR (hrms) before 16.11.0 Missing Authorization via get_account_and_amount (medium 5.3)
- [CVE-2026-108731](https://insights.sbomify.com/CVE-2026-108731/): Raven 2.0.0 through 3.0.0 Missing Authorization via join_workspace Invite-Only Bypass (medium 5.3)
- [CVE-2026-108730](https://insights.sbomify.com/CVE-2026-108730/): Raven 2.0.0 through 3.0.0 Missing Authorization via Legacy Message and File APIs (medium 5.3)
- [CVE-2026-10873](https://insights.sbomify.com/CVE-2026-10873/): Shibby Tomato Web UI rstats rstats_path os command injection (high 8.6)
- [CVE-2026-108729](https://insights.sbomify.com/CVE-2026-108729/): Corteza through 2024.9.10 Unauthenticated Attachment Access via Compose Attachment Endpoints (high 8.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/948/