# Vulnerabilities published in 2026


- [CVE-2026-102585](https://insights.sbomify.com/CVE-2026-102585/): Moodle: group validation missing when enrolling user to course (medium 4.3)
- [CVE-2026-102584](https://insights.sbomify.com/CVE-2026-102584/): Moodle: missing capability check allows unauthorised grade penalty recalculation (medium 4.3)
- [CVE-2026-102583](https://insights.sbomify.com/CVE-2026-102583/): Moodle: incorrect capability check in ai generate image web service (low 2.7)
- [CVE-2026-102582](https://insights.sbomify.com/CVE-2026-102582/): Moodle: manual enrolment page accessible when plugin disabled (low 2.2)
- [CVE-2026-102581](https://insights.sbomify.com/CVE-2026-102581/): Moodle: xss in forum post templates due to insufficient escaping (medium 4.6)
- [CVE-2026-102580](https://insights.sbomify.com/CVE-2026-102580/): Moodle: arbitrary class instantiation via report builder audience classname (low 2.2)
- [CVE-2026-10258](https://insights.sbomify.com/CVE-2026-10258/): itsourcecode Content Management System add_sub_topic.php sql injection (medium 5.3)
- [CVE-2026-102579](https://insights.sbomify.com/CVE-2026-102579/): Moodle: user profile information disclosure via grade web service (medium 4.3)
- [CVE-2026-102578](https://insights.sbomify.com/CVE-2026-102578/): Moodle: sql injection in question bank web service (medium 5.5)
- [CVE-2026-102577](https://insights.sbomify.com/CVE-2026-102577/): Moodle: ssrf risk in url downloader via ipv4-mapped ipv6 address bypass (medium 4.3)
- [CVE-2026-102576](https://insights.sbomify.com/CVE-2026-102576/): Quay: quay: dom-based cross-site scripting via unvalidated redirect_url on signin page (medium 4.2)
- [CVE-2026-102570](https://insights.sbomify.com/CVE-2026-102570/): ClipBucket v5 through 5.5.3-#197 SQL Injection via language_id Parameter (high 7.0)
- [CVE-2026-10257](https://insights.sbomify.com/CVE-2026-10257/): itsourcecode Content Management System update_ss_img.php sql injection (medium 5.3)
- [CVE-2026-102569](https://insights.sbomify.com/CVE-2026-102569/): ClipBucket v5 through 5.5.3-#197 SQL Injection via videoid Parameter (high 7.0)
- [CVE-2026-102568](https://insights.sbomify.com/CVE-2026-102568/): Pardus Parental Control before 0.7.0 Incorrect Authorization via PPCActivator.py (medium 6.8)
- [CVE-2026-102567](https://insights.sbomify.com/CVE-2026-102567/): CTranslate2 before 4.8.1 Out-of-Bounds Read via Model Deserialization (medium 6.9)
- [CVE-2026-102566](https://insights.sbomify.com/CVE-2026-102566/): CTranslate2 before 4.8.1 Heap Buffer Overflow via model.bin (high 8.5)
- [CVE-2026-102565](https://insights.sbomify.com/CVE-2026-102565/): BA Book Everything <= 1.8.28 - Unauthenticated Stored Cross-Site Scripting via 'booking_service_qty' Parameter (high 7.2)
- [CVE-2026-102562](https://insights.sbomify.com/CVE-2026-102562/): AcyMailing <= 11.1.0 - Unauthenticated Stored Cross-Site Scripting via 'customField[]' Parameter (high 7.2)
- [CVE-2026-102560](https://insights.sbomify.com/CVE-2026-102560/): Libsoup: libsoup: heap buffer overflow during outgoing permessage-deflate buffer growth (high 8.6)
- [CVE-2026-10256](https://insights.sbomify.com/CVE-2026-10256/): itsourcecode Content Management System save_comment.php sql injection (medium 5.3)
- [CVE-2026-102559](https://insights.sbomify.com/CVE-2026-102559/): Libsoup: libsoup: heap buffer overflow during websocket client-frame masking (high 8.6)
- [CVE-2026-102558](https://insights.sbomify.com/CVE-2026-102558/): Libsoup: libsoup: heap buffer overflow during websocket receive-buffer growth (high 8.6)
- [CVE-2026-102557](https://insights.sbomify.com/CVE-2026-102557/): Libsoup: libsoup: heap buffer overflow during websocket message reassembly (high 8.6)
- [CVE-2026-102556](https://insights.sbomify.com/CVE-2026-102556/): Libsoup: libsoup: heap buffer overflow from websocket pong signal type confusion (high 8.6)
- [CVE-2026-102555](https://insights.sbomify.com/CVE-2026-102555/): Libsoup: libsoup: heap buffer overflow via uninitialized length in data-uri base64 decoding (high 8.2)
- [CVE-2026-102554](https://insights.sbomify.com/CVE-2026-102554/): Denial of Service via Eager Array Allocation During Deserialization in Guava (high 8.2)
- [CVE-2026-102552](https://insights.sbomify.com/CVE-2026-102552/): Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP DNS resolver (high 8.2)
- [CVE-2026-102551](https://insights.sbomify.com/CVE-2026-102551/): Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP Router Advertisement handling (critical 9.2)
- [CVE-2026-10255](https://insights.sbomify.com/CVE-2026-10255/): SourceCodester Pharmacy Sales and Inventory System ShowForm.php sell_statement access control (medium 6.9)
- [CVE-2026-10254](https://insights.sbomify.com/CVE-2026-10254/): SourceCodester Pet Grooming Management Software admin file information disclosure (medium 6.9)
- [CVE-2026-102539](https://insights.sbomify.com/CVE-2026-102539/): Super Productivity: SuperSync E2EE setup uploads and stores all user operations in plaintext before password is set (medium 5.7)
- [CVE-2026-10253](https://insights.sbomify.com/CVE-2026-10253/): itsourcecode Online House Rental System manage_payment.php sql injection (medium 6.9)
- [CVE-2026-102527](https://insights.sbomify.com/CVE-2026-102527/): Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes (medium 6.9)
- [CVE-2026-102521](https://insights.sbomify.com/CVE-2026-102521/): lib0 `readFromDataView` out-of-bounds read (high 8.6)
- [CVE-2026-10252](https://insights.sbomify.com/CVE-2026-10252/): itsourcecode Online House Rental System manage_tenant.php sql injection (medium 6.9)
- [CVE-2026-102514](https://insights.sbomify.com/CVE-2026-102514/): Out-of-bounds write in PeaZip PEA extractor allows code execution via a crafted .pea archive (high 8.4)
- [CVE-2026-102511](https://insights.sbomify.com/CVE-2026-102511/): Other in Apache PLC4X (high 8.5)
- [CVE-2026-102510](https://insights.sbomify.com/CVE-2026-102510/): Apache PLC4X: Go binding: unbounded allocation and framing failures on wire-controlled lengths (high 8.7)
- [CVE-2026-10251](https://insights.sbomify.com/CVE-2026-10251/): itsourcecode Online House Rental System ajax.php login sql injection (medium 6.9)
- [CVE-2026-102509](https://insights.sbomify.com/CVE-2026-102509/): Apache PLC4X, Apache PLC4X: Pre-authentication resource exhaustion in the OPC UA driver and the Java SPI parser (high 8.7)
- [CVE-2026-102508](https://insights.sbomify.com/CVE-2026-102508/): Apache PLC4X: OPC UA secure channel: integrity bypass, unverifiable server certificate, and silent downgrade (critical 9.2)
- [CVE-2026-102507](https://insights.sbomify.com/CVE-2026-102507/): Sliver 1.7.7 Denial of Service via PE Parser Slice Bounds in Operator RPC (medium 6.8)
- [CVE-2026-102505](https://insights.sbomify.com/CVE-2026-102505/): Memory corruption in tonycoz:imager (medium 6.3)
- [CVE-2026-102504](https://insights.sbomify.com/CVE-2026-102504/): Denial of service in tonycoz:imager (high 7.5)
- [CVE-2026-102503](https://insights.sbomify.com/CVE-2026-102503/): Missing Authentication on /libp2p-http Ingress in Google OSS Agent Mesh (SAM) (critical 9.3)
- [CVE-2026-102502](https://insights.sbomify.com/CVE-2026-102502/): CAI Content Credentials | Improper Verification of Cryptographic Signature (CWE-347) (medium 5.3)
- [CVE-2026-102501](https://insights.sbomify.com/CVE-2026-102501/): CAI Content Credentials | Improper Input Validation (CWE-20) (medium 5.3)
- [CVE-2026-10250](https://insights.sbomify.com/CVE-2026-10250/): itsourcecode Online Blood Bank Management System campsdetails.php sql injection (medium 6.9)
- [CVE-2026-1025](https://insights.sbomify.com/CVE-2026-1025/): Cross-site scripting in Common Licensing (medium 6.1)
- [CVE-2026-102499](https://insights.sbomify.com/CVE-2026-102499/): Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_attendees AJAX Action (high 7.7)
- [CVE-2026-102497](https://insights.sbomify.com/CVE-2026-102497/): Apache XMLSchema: Denial of service through cyclic schema definitions in the schema walker (high 7.5)
- [CVE-2026-102496](https://insights.sbomify.com/CVE-2026-102496/): Apache XMLSchema: Denial of service through deeply nested schema structures (high 7.5)
- [CVE-2026-102495](https://insights.sbomify.com/CVE-2026-102495/): Apache XMLSchema: Denial of service through unbounded recursion when resolving schema imports and includes (high 7.5)
- [CVE-2026-102491](https://insights.sbomify.com/CVE-2026-102491/): mahonelau kykms SqlInjectionUtil QueryGenerator.java QueryGenerator.doMultiFieldsOrder sql injection (medium 6.9)
- [CVE-2026-102490](https://insights.sbomify.com/CVE-2026-102490/): Zammad GmbH Zammad Improper Privilege Management (high 8.5, exploited in the wild)
- [CVE-2026-10249](https://insights.sbomify.com/CVE-2026-10249/): itsourcecode Online Blood Bank Management System viewrequest.php sql injection (medium 6.9)
- [CVE-2026-102489](https://insights.sbomify.com/CVE-2026-102489/): Zammad GmbH Zammad Session Fixation (high 8.7, exploited in the wild)
- [CVE-2026-102488](https://insights.sbomify.com/CVE-2026-102488/): Privilege escalation in Octopus Server (high 8.7)
- [CVE-2026-102486](https://insights.sbomify.com/CVE-2026-102486/): Out-of-bounds Read in ntpsec (high 7.5)
- [CVE-2026-102485](https://insights.sbomify.com/CVE-2026-102485/): Out-of-bounds Read in ntpsec (medium 5.2)
- [CVE-2026-102484](https://insights.sbomify.com/CVE-2026-102484/): Heap-based Buffer Overflow in ntpsec (medium 6.4)
- [CVE-2026-102483](https://insights.sbomify.com/CVE-2026-102483/): Reachable Assertion in ntpsec (high 7.5)
- [CVE-2026-10248](https://insights.sbomify.com/CVE-2026-10248/): SourceCodester Pharmacy Sales and Inventory System Supplier Creation export create_supplier csv injection (medium 5.1)
- [CVE-2026-102479](https://insights.sbomify.com/CVE-2026-102479/): Other in Eclipse Vert.x (high 8.7)
- [CVE-2026-102478](https://insights.sbomify.com/CVE-2026-102478/): Privilege escalation in Octopus Server (high 8.7)
- [CVE-2026-102477](https://insights.sbomify.com/CVE-2026-102477/): Denial of service in Eclipse Vert.x (high 8.7)
- [CVE-2026-102476](https://insights.sbomify.com/CVE-2026-102476/): Security feature bypass in Eclipse Vert.x (critical 9.1)
- [CVE-2026-102475](https://insights.sbomify.com/CVE-2026-102475/): Denial of service in Eclipse Vert.x (high 8.7)
- [CVE-2026-102474](https://insights.sbomify.com/CVE-2026-102474/): Dash: dash: heap out-of-bounds write in conv_escape via undersized unicode escape reservation (medium 4.0)
- [CVE-2026-102473](https://insights.sbomify.com/CVE-2026-102473/): Dash: dash: super-polynomial backtracking in pmatch when libc fnmatch is disabled (medium 5.5)
- [CVE-2026-102471](https://insights.sbomify.com/CVE-2026-102471/): CRLF header injection in vertx-mail-client allows manipulation of outgoing SMTP messages (medium 6.9)
- [CVE-2026-10247](https://insights.sbomify.com/CVE-2026-10247/): SourceCodester Pharmacy Sales and Inventory System main create_generic_name cross site scripting (medium 5.1)
- [CVE-2026-102469](https://insights.sbomify.com/CVE-2026-102469/): Deserialization in Eclipse Vert.x (critical 9.2)
- [CVE-2026-102467](https://insights.sbomify.com/CVE-2026-102467/): Denial of service in Eclipse Vert.x (high 8.7)
- [CVE-2026-102466](https://insights.sbomify.com/CVE-2026-102466/): Denial of service in Eclipse Vert.x (high 8.2)
- [CVE-2026-102465](https://insights.sbomify.com/CVE-2026-102465/): Denial of service in Eclipse Vert.x (high 8.2)
- [CVE-2026-102464](https://insights.sbomify.com/CVE-2026-102464/): Denial of service in Eclipse Vert.x (high 8.2)
- [CVE-2026-102463](https://insights.sbomify.com/CVE-2026-102463/): Denial of service in Eclipse Vert.x (high 8.2)
- [CVE-2026-102462](https://insights.sbomify.com/CVE-2026-102462/): Denial of service in Eclipse Vert.x (high 8.2)
- [CVE-2026-102461](https://insights.sbomify.com/CVE-2026-102461/): Denial of service in Eclipse Vert.x (high 8.7)
- [CVE-2026-102460](https://insights.sbomify.com/CVE-2026-102460/): Auth bypass in Eclipse Vert.x (high 8.6)
- [CVE-2026-10246](https://insights.sbomify.com/CVE-2026-10246/): SourceCodester Pharmacy Sales and Inventory System main create_medicine_presentation cross site scripting (medium 5.1)
- [CVE-2026-102459](https://insights.sbomify.com/CVE-2026-102459/): DigiWin｜EasyFlow .NET - Reflected Cross-site Scripting (medium 5.1)
- [CVE-2026-102458](https://insights.sbomify.com/CVE-2026-102458/): DigiWin｜EasyFlow .NET - Missing Authentication (critical 9.3)
- [CVE-2026-102457](https://insights.sbomify.com/CVE-2026-102457/): DigiWin｜EasyFlow .NET - Arbitrary File Read (high 7.1)
- [CVE-2026-102456](https://insights.sbomify.com/CVE-2026-102456/): DigiWin｜EasyFlow .NET - SQL Injection (high 7.1)
- [CVE-2026-102455](https://insights.sbomify.com/CVE-2026-102455/): DigiWin｜EasyFlow .NET - Insecure Deserialization (critical 9.3)
- [CVE-2026-102454](https://insights.sbomify.com/CVE-2026-102454/): DigiWin｜EasyFlow .NET - Arbitrary File Upload (high 8.6)
- [CVE-2026-10245](https://insights.sbomify.com/CVE-2026-10245/): SourceCodester Pharmacy Sales and Inventory System main create_supplier cross site scripting (medium 5.1)
- [CVE-2026-10244](https://insights.sbomify.com/CVE-2026-10244/): SourceCodester Pharmacy Sales and Inventory System main create_medicine_name cross site scripting (medium 5.1)
- [CVE-2026-102438](https://insights.sbomify.com/CVE-2026-102438/): Privilege escalation in Armoury Crate (high 8.5)
- [CVE-2026-102437](https://insights.sbomify.com/CVE-2026-102437/): Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in DeepSeek-Reasonix (high 7.8)
- [CVE-2026-10243](https://insights.sbomify.com/CVE-2026-10243/): code-projects Smart Parking System Admin Endpoint missing authentication (medium 6.9)
- [CVE-2026-102428](https://insights.sbomify.com/CVE-2026-102428/): Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16 (critical 9.3)
- [CVE-2026-102427](https://insights.sbomify.com/CVE-2026-102427/): Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16 (critical 10.0)
- [CVE-2026-102426](https://insights.sbomify.com/CVE-2026-102426/): Cross-site scripting in SP Page Builder (Pro) extension for Joomla (medium 5.3)
- [CVE-2026-102425](https://insights.sbomify.com/CVE-2026-102425/): Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4 (critical 9.5)
- [CVE-2026-102424](https://insights.sbomify.com/CVE-2026-102424/): Path traversal in Balbooa Forms extension for Joomla (high 8.9)
- [CVE-2026-102422](https://insights.sbomify.com/CVE-2026-102422/): shell-quote `quote()` command injection via a line terminator in a token after a `{ comment }` token (critical 9.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/985/