# Vulnerabilities published in 2026


- [CVE-2026-10289](https://insights.sbomify.com/CVE-2026-10289/): code-projects Hotel and Tourism Reservation System tour.php cross site scripting (medium 5.3)
- [CVE-2026-10288](https://insights.sbomify.com/CVE-2026-10288/): code-projects Hotel and Tourism Reservation System Admin Login login.php password_verify improper authentication (medium 6.9)
- [CVE-2026-102879](https://insights.sbomify.com/CVE-2026-102879/): ClaraVerse through 0.3.1 SSRF Protection Bypass (medium 5.3)
- [CVE-2026-102878](https://insights.sbomify.com/CVE-2026-102878/): mcp-chrome-bridge through 1.0.31 CORS Origin Bypass (high 8.6)
- [CVE-2026-102877](https://insights.sbomify.com/CVE-2026-102877/): Fider before 0.38.0 SSRF via DNS rebinding in webhook validation (low 2.1)
- [CVE-2026-102876](https://insights.sbomify.com/CVE-2026-102876/): SurrealDB before 3.3.0 Cross-Tenant Access via Headers (high 8.6)
- [CVE-2026-102875](https://insights.sbomify.com/CVE-2026-102875/): VLC media player before 3.0.24 Path Traversal via skins2 (high 8.5)
- [CVE-2026-102874](https://insights.sbomify.com/CVE-2026-102874/): HKUDS AnyTool Execute Endpoint main.py subprocess.run os command injection (medium 6.9)
- [CVE-2026-102870](https://insights.sbomify.com/CVE-2026-102870/): ASP.NET Core Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-10287](https://insights.sbomify.com/CVE-2026-10287/): SourceCodester SEO Meta Tag Extractor index.php get_headers server-side request forgery (medium 6.9)
- [CVE-2026-102869](https://insights.sbomify.com/CVE-2026-102869/): .NET and Visual Studio Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-102867](https://insights.sbomify.com/CVE-2026-102867/): Microsoft Office Word Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-102866](https://insights.sbomify.com/CVE-2026-102866/): Microsoft Office SharePoint Elevation of Privilege Vulnerability (high 8.1)
- [CVE-2026-102865](https://insights.sbomify.com/CVE-2026-102865/): Microsoft Office SharePoint Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-102864](https://insights.sbomify.com/CVE-2026-102864/): Microsoft Office SharePoint Spoofing Vulnerability (medium 4.6)
- [CVE-2026-102863](https://insights.sbomify.com/CVE-2026-102863/): Microsoft Office SharePoint Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-102862](https://insights.sbomify.com/CVE-2026-102862/): Microsoft Office SharePoint Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-102861](https://insights.sbomify.com/CVE-2026-102861/): Microsoft Office SharePoint Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-102860](https://insights.sbomify.com/CVE-2026-102860/): Microsoft Office SharePoint Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-10286](https://insights.sbomify.com/CVE-2026-10286/): CodeAstro Payroll System home_employee.php sql injection (medium 5.3)
- [CVE-2026-102859](https://insights.sbomify.com/CVE-2026-102859/): Microsoft Office SharePoint Spoofing Vulnerability (medium 4.6)
- [CVE-2026-102858](https://insights.sbomify.com/CVE-2026-102858/): Microsoft Office OneNote Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-102857](https://insights.sbomify.com/CVE-2026-102857/): Microsoft Office Visio Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-102856](https://insights.sbomify.com/CVE-2026-102856/): Microsoft Office Visio Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-102855](https://insights.sbomify.com/CVE-2026-102855/): Microsoft Office Visio Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-102851](https://insights.sbomify.com/CVE-2026-102851/): Visual Studio Code Security Feature Bypass Vulnerability (medium 6.1)
- [CVE-2026-102850](https://insights.sbomify.com/CVE-2026-102850/): Microsoft Office Access Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-10285](https://insights.sbomify.com/CVE-2026-10285/): DevaslanPHP project-management Ticket KanbanScrumHelper.php recordUpdated improper authorization (medium 5.3)
- [CVE-2026-102849](https://insights.sbomify.com/CVE-2026-102849/): Microsoft Office Access Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-102847](https://insights.sbomify.com/CVE-2026-102847/): gedelumbung HospitalManagement Guest Book buku_tamu.php kirim cross site scripting (medium 5.3)
- [CVE-2026-102846](https://insights.sbomify.com/CVE-2026-102846/): gedelumbung HospitalManagement Configuration sistem.php simpan improper authorization (medium 5.1)
- [CVE-2026-102845](https://insights.sbomify.com/CVE-2026-102845/): gedelumbung HospitalManagement HTTP Response index.php error_reporting information disclosure (medium 6.9)
- [CVE-2026-102844](https://insights.sbomify.com/CVE-2026-102844/): gedelumbung HospitalManagement laporan_data_pasien.php detail authorization (medium 5.1)
- [CVE-2026-102843](https://insights.sbomify.com/CVE-2026-102843/): gedelumbung HospitalManagement Endpoint data_galeri.php hapus path traversal (medium 5.1)
- [CVE-2026-102842](https://insights.sbomify.com/CVE-2026-102842/): gedelumbung HospitalManagement KCFinder File Manager app_user_login_model.php cekUserLogin unrestricted upload (medium 5.3)
- [CVE-2026-10284](https://insights.sbomify.com/CVE-2026-10284/): DevaslanPHP project-management Livewire ViewTicket.php doDeleteComment improper authorization (medium 5.3)
- [CVE-2026-102834](https://insights.sbomify.com/CVE-2026-102834/): JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoS (high 7.5)
- [CVE-2026-102832](https://insights.sbomify.com/CVE-2026-102832/): JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked (medium 4.2)
- [CVE-2026-102831](https://insights.sbomify.com/CVE-2026-102831/): JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard (high 8.1)
- [CVE-2026-102830](https://insights.sbomify.com/CVE-2026-102830/): JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json) (medium 6.8)
- [CVE-2026-10283](https://insights.sbomify.com/CVE-2026-10283/): Bottelet DaybydayCRM Setting missing authentication (medium 5.3)
- [CVE-2026-102829](https://insights.sbomify.com/CVE-2026-102829/): simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection (critical 9.2)
- [CVE-2026-102828](https://insights.sbomify.com/CVE-2026-102828/): simple-git unsafe-operation guard does not block trailer command configuration (critical 9.2)
- [CVE-2026-102827](https://insights.sbomify.com/CVE-2026-102827/): simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291) (high 8.1)
- [CVE-2026-102826](https://insights.sbomify.com/CVE-2026-102826/): simple-git allows command execution through unblocked Git configuration includes (high 8.1)
- [CVE-2026-102825](https://insights.sbomify.com/CVE-2026-102825/): Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime path (low 3.7)
- [CVE-2026-102824](https://insights.sbomify.com/CVE-2026-102824/): Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange (medium 4.3)
- [CVE-2026-102823](https://insights.sbomify.com/CVE-2026-102823/): russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened (high 7.5)
- [CVE-2026-102822](https://insights.sbomify.com/CVE-2026-102822/): russh: negotiating a MAC-requiring block cipher (CTR/CBC) with mac=none causes a slice-index-out-of-range panic (low 3.7)
- [CVE-2026-102821](https://insights.sbomify.com/CVE-2026-102821/): Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekey (medium 6.5)
- [CVE-2026-102820](https://insights.sbomify.com/CVE-2026-102820/): pageant: Out-of-bounds read / oversized allocation in `pageant` MemoryMap::read via a malicious Pageant agent (Windows) (medium 6.2)
- [CVE-2026-10282](https://insights.sbomify.com/CVE-2026-10282/): Bottelet DaybydayCRM DocumentsController.php view improper authorization (medium 5.3)
- [CVE-2026-102816](https://insights.sbomify.com/CVE-2026-102816/): Unauthenticated Wireless Regulatory Region Configuration in TP-Link RE305 (medium 5.3)
- [CVE-2026-102815](https://insights.sbomify.com/CVE-2026-102815/): Command Injection in tmpServer Allows Local Privilege Escalation in TP-Link RE305 (medium 6.9)
- [CVE-2026-102814](https://insights.sbomify.com/CVE-2026-102814/): Improper Authentication in TP-Link TDDP v2 Allows Root Command Execution in TP-Link RE305 (high 8.7)
- [CVE-2026-102813](https://insights.sbomify.com/CVE-2026-102813/): Administrator Password Reset Through the Verification-Code Interface in TP-Link RE305 (medium 6.1)
- [CVE-2026-102812](https://insights.sbomify.com/CVE-2026-102812/): Hardcoded AES-128 Key and Fixed IV in Configuration Backup Encryption in TP-Link RE305 and Archer C7 (medium 6.9)
- [CVE-2026-102811](https://insights.sbomify.com/CVE-2026-102811/): Marmite through 0.4.2 Unauthenticated API Access via Development Server (high 8.7)
- [CVE-2026-102810](https://insights.sbomify.com/CVE-2026-102810/): Marmite through 0.4.2 Path Traversal via Development Server (high 8.7)
- [CVE-2026-10281](https://insights.sbomify.com/CVE-2026-10281/): Enderfga claw-orchestrator API Endpoint embedded-server.ts EmbeddedServer missing authentication (medium 6.9)
- [CVE-2026-102809](https://insights.sbomify.com/CVE-2026-102809/): PX4 Autopilot through 1.17.0 Stack Exhaustion via tests file2 Command (high 7.1)
- [CVE-2026-102808](https://insights.sbomify.com/CVE-2026-102808/): PX4 Autopilot through 1.17.0 NULL Pointer Dereference via sd_stress (high 7.1)
- [CVE-2026-102807](https://insights.sbomify.com/CVE-2026-102807/): OpenClaw before 2026.9.4 Authorization Bypass via MCP App Standalone Ticket (medium 6.0)
- [CVE-2026-102806](https://insights.sbomify.com/CVE-2026-102806/): OpenClaw before 2026.9.5 Sandbox Isolation Bypass via Media Pipelines (medium 6.0)
- [CVE-2026-102805](https://insights.sbomify.com/CVE-2026-102805/): Nothings stb Image Encoding stb_image_write.h stbi_write_tga_core integer overflow (medium 6.9)
- [CVE-2026-102804](https://insights.sbomify.com/CVE-2026-102804/): Nothings stb stb_hexwave.h hexwave_init integer overflow (medium 6.9)
- [CVE-2026-102800](https://insights.sbomify.com/CVE-2026-102800/): Joomla Extension - dj-extensions.com - Unauthenticated Stored XSS in DJ-HelpfulArticles < 1.3.0 (high 8.7)
- [CVE-2026-10280](https://insights.sbomify.com/CVE-2026-10280/): horizon921 mcpilot MCP API Call Endpoint route.ts server-side request forgery (medium 6.9)
- [CVE-2026-102799](https://insights.sbomify.com/CVE-2026-102799/): Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.16 (medium 5.3)
- [CVE-2026-102798](https://insights.sbomify.com/CVE-2026-102798/): WordPress ThemeREX Addons plugin <= 2.46.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-102797](https://insights.sbomify.com/CVE-2026-102797/): WordPress ThemeREX Addons plugin <= 2.46.0 - Server Side Request Forgery (SSRF) vulnerability (medium 6.4)
- [CVE-2026-102796](https://insights.sbomify.com/CVE-2026-102796/): Unauthenticated SQL injection in UserPageViewTracker via filterusers and ignoreusers parameters (high 7.5)
- [CVE-2026-102795](https://insights.sbomify.com/CVE-2026-102795/): Apache Traffic Server: SNI to Host header matching policy is not properly enforced (high 7.0)
- [CVE-2026-102794](https://insights.sbomify.com/CVE-2026-102794/): Ziroom ZHOME A0101 ping command injection (critical 9.4)
- [CVE-2026-102793](https://insights.sbomify.com/CVE-2026-102793/): Ziroom ZHOME A0101 set_time_zone command injection (critical 9.4)
- [CVE-2026-102792](https://insights.sbomify.com/CVE-2026-102792/): Ziroom ZHOME A0101 set_syslog command injection (critical 9.4)
- [CVE-2026-102790](https://insights.sbomify.com/CVE-2026-102790/): Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12 (high 8.6)
- [CVE-2026-10279](https://insights.sbomify.com/CVE-2026-10279/): hiraishikentaro wezterm-mcp switch_pane/write_to_specific_pane wezterm_executor.ts os command injection (medium 5.3)
- [CVE-2026-102789](https://insights.sbomify.com/CVE-2026-102789/): Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2 (critical 9.3)
- [CVE-2026-102788](https://insights.sbomify.com/CVE-2026-102788/): Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2 (critical 9.3)
- [CVE-2026-102787](https://insights.sbomify.com/CVE-2026-102787/): Joomla Extension - phoca.cz - CSRF in category management in Phoca Download 3.1.0 - 6.1.5 (medium 5.3)
- [CVE-2026-102786](https://insights.sbomify.com/CVE-2026-102786/): Cross-site scripting in Phoca Gallery extension for Joomla (high 8.6)
- [CVE-2026-102785](https://insights.sbomify.com/CVE-2026-102785/): Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 (critical 10.0)
- [CVE-2026-102784](https://insights.sbomify.com/CVE-2026-102784/): Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox < 2.20.4.0 (high 8.7)
- [CVE-2026-102783](https://insights.sbomify.com/CVE-2026-102783/): Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox < 2.20.4.0 (medium 6.3)
- [CVE-2026-102782](https://insights.sbomify.com/CVE-2026-102782/): Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0 (critical 9.3)
- [CVE-2026-102781](https://insights.sbomify.com/CVE-2026-102781/): Joomla Extension - ordasoft.com - Unauthenticated Destructive CRUD in OrdaSoft Touch Slider < 5.4.6 (medium 6.9)
- [CVE-2026-102780](https://insights.sbomify.com/CVE-2026-102780/): Missing authorization in TF Content for Joomla (medium 6.9)
- [CVE-2026-10278](https://insights.sbomify.com/CVE-2026-10278/): ishayoyo excel-mcp read_file/write_file index.ts path traversal (medium 5.3)
- [CVE-2026-102779](https://insights.sbomify.com/CVE-2026-102779/): Missing authorization in TF Content for Joomla (medium 6.9)
- [CVE-2026-102778](https://insights.sbomify.com/CVE-2026-102778/): Cross-site scripting in Event Gallery for Joomla (medium 5.3)
- [CVE-2026-102777](https://insights.sbomify.com/CVE-2026-102777/): Server-side request forgery in Event Gallery for Joomla (medium 6.3)
- [CVE-2026-102776](https://insights.sbomify.com/CVE-2026-102776/): Cross-site request forgery in Event Gallery for Joomla (medium 5.1)
- [CVE-2026-102775](https://insights.sbomify.com/CVE-2026-102775/): Missing authorization in Phoca Cart extension for Joomla (high 8.7)
- [CVE-2026-102774](https://insights.sbomify.com/CVE-2026-102774/): Cross-site scripting in SureDash – Community, Courses & Member Dashboard (medium 6.4)
- [CVE-2026-102772](https://insights.sbomify.com/CVE-2026-102772/): CMB2 <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'textarea_code' Field (high 7.2)
- [CVE-2026-102771](https://insights.sbomify.com/CVE-2026-102771/): Naichen ThinkCMF Email Template MailController.php templatePut special elements in template engine (medium 5.1)
- [CVE-2026-10277](https://insights.sbomify.com/CVE-2026-10277/): j3k0 mcp-google-workspace MCP Gmail Tool gmail.ts saveToDisk access control (medium 5.3)
- [CVE-2026-102764](https://insights.sbomify.com/CVE-2026-102764/): BeyondTrust Remote Support Authentication Bypass by Spoofing (critical 9.3, exploited in the wild)
- [CVE-2026-102762](https://insights.sbomify.com/CVE-2026-102762/): Denial of service in NetX Duo (high 8.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/983/