# Vulnerabilities published in 2026


- [CVE-2026-102189](https://insights.sbomify.com/CVE-2026-102189/): Windows Storage Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-102188](https://insights.sbomify.com/CVE-2026-102188/): Windows Storage Port Driver Elevation of Privilege Vulnerability (medium 6.8)
- [CVE-2026-102187](https://insights.sbomify.com/CVE-2026-102187/): Windows Kernel Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-102186](https://insights.sbomify.com/CVE-2026-102186/): Windows Network File System Information Disclosure Vulnerability (medium 4.7)
- [CVE-2026-102185](https://insights.sbomify.com/CVE-2026-102185/): Denial of service in Junos OS (high 8.7)
- [CVE-2026-102184](https://insights.sbomify.com/CVE-2026-102184/): Junos OS and Junos OS Evolved: A malformed EVPN SRv6 route causes an rpd crash (high 8.7)
- [CVE-2026-102183](https://insights.sbomify.com/CVE-2026-102183/): Junos OS and Junos OS Evolved: If in a BGP EVPN scenario a malformed NLRI is received rpd crashes (high 8.7)
- [CVE-2026-102182](https://insights.sbomify.com/CVE-2026-102182/): Junos OS: MX Series: Certificate-based IKE packets cause root-level code execution (critical 9.3)
- [CVE-2026-102180](https://insights.sbomify.com/CVE-2026-102180/): Junos OS and Junos OS Evolved: An attacker causes an rpd crash when BGP RIB streaming telemetry is in use (high 8.7)
- [CVE-2026-10218](https://insights.sbomify.com/CVE-2026-10218/): nextlevelbuilder GoClaw evolution_handlers.go auth improper authorization (medium 5.3)
- [CVE-2026-102179](https://insights.sbomify.com/CVE-2026-102179/): Junos OS and Junos OS Evolved: An attacker causes a routing daemon crash when BGP EVPN RIB telemetry is used (high 8.7)
- [CVE-2026-102178](https://insights.sbomify.com/CVE-2026-102178/): Memory corruption in Junos OS (critical 9.3)
- [CVE-2026-102177](https://insights.sbomify.com/CVE-2026-102177/): Junos OS and Junos OS Evolved: An out-of-bounds write causes an rpd crash when IS-IS backup selection is used (high 7.2)
- [CVE-2026-102176](https://insights.sbomify.com/CVE-2026-102176/): Memory corruption in Junos OS (high 8.7)
- [CVE-2026-102175](https://insights.sbomify.com/CVE-2026-102175/): Memory corruption in Junos OS (critical 9.3)
- [CVE-2026-102174](https://insights.sbomify.com/CVE-2026-102174/): Memory corruption in Junos OS (high 8.7)
- [CVE-2026-102173](https://insights.sbomify.com/CVE-2026-102173/): Cross-site scripting in Kirki – Freeform Page Builder, Website Builder & Customizer (high 7.2)
- [CVE-2026-10217](https://insights.sbomify.com/CVE-2026-10217/): nextlevelbuilder GoClaw RoleAdmin Gateway tts_config.go handleSave privileges management (medium 5.3)
- [CVE-2026-102169](https://insights.sbomify.com/CVE-2026-102169/): Security Advisory 0194 (high 7.1)
- [CVE-2026-102168](https://insights.sbomify.com/CVE-2026-102168/): Security Advisory 0194 (high 7.1)
- [CVE-2026-102167](https://insights.sbomify.com/CVE-2026-102167/): Security Advisory 0197 (critical 9.0)
- [CVE-2026-102165](https://insights.sbomify.com/CVE-2026-102165/): Security Advisory 0198 (high 7.7)
- [CVE-2026-102164](https://insights.sbomify.com/CVE-2026-102164/): Security Advisory 0196 (low 2.3)
- [CVE-2026-102163](https://insights.sbomify.com/CVE-2026-102163/): Security Advisory 0195 (high 8.7)
- [CVE-2026-102162](https://insights.sbomify.com/CVE-2026-102162/): Security Advisory 0193 (critical 9.4)
- [CVE-2026-102161](https://insights.sbomify.com/CVE-2026-102161/): Security Advisory 0190 (high 8.7)
- [CVE-2026-102160](https://insights.sbomify.com/CVE-2026-102160/): Security Advisory 0190 (high 8.6)
- [CVE-2026-10216](https://insights.sbomify.com/CVE-2026-10216/): unitedbyai droidclaw claim Endpoint pairing.ts excessive authentication (medium 6.3)
- [CVE-2026-102159](https://insights.sbomify.com/CVE-2026-102159/): Security Advisory 0190 (critical 9.3)
- [CVE-2026-102158](https://insights.sbomify.com/CVE-2026-102158/): Security Advisory 0190 (high 7.1)
- [CVE-2026-102157](https://insights.sbomify.com/CVE-2026-102157/): Security Advisory 0190 (medium 6.8)
- [CVE-2026-102156](https://insights.sbomify.com/CVE-2026-102156/): Security Advisory 0191 (medium 6.9)
- [CVE-2026-102155](https://insights.sbomify.com/CVE-2026-102155/): Security Advisory 0190 (high 7.1)
- [CVE-2026-102150](https://insights.sbomify.com/CVE-2026-102150/): Kiteworks Secure Data Forms Missing Authentication for Critical Function (high 7.2)
- [CVE-2026-10215](https://insights.sbomify.com/CVE-2026-10215/): Dolibarr ERP CRM Leave Request REST API api_holidays.class.php checkUserAccessToObject improper authorization (medium 5.3)
- [CVE-2026-102149](https://insights.sbomify.com/CVE-2026-102149/): Kiteworks Email Protection Gateway Improper Access Control (critical 9.4)
- [CVE-2026-102147](https://insights.sbomify.com/CVE-2026-102147/): Kiteworks Core Administrative Account Takeover through Stored Cross-site Scripting (XSS) (critical 9.3)
- [CVE-2026-102146](https://insights.sbomify.com/CVE-2026-102146/): Kiteworks Email Protection Gateway Arbitrary File Write through Server-Side Template Injection (medium 6.5)
- [CVE-2026-102145](https://insights.sbomify.com/CVE-2026-102145/): Kiteworks Core Server-Side Request Forgery through CRLF Injection (medium 6.6)
- [CVE-2026-102144](https://insights.sbomify.com/CVE-2026-102144/): Kiteworks Email Protection Gateway Uncontrolled Resource Consumption (medium 5.3)
- [CVE-2026-102143](https://insights.sbomify.com/CVE-2026-102143/): Kiteworks Email Protection Gateway Unrestricted Upload of File with Dangerous Type (high 7.5)
- [CVE-2026-102142](https://insights.sbomify.com/CVE-2026-102142/): Kiteworks Core Remote Code Execution through Server-Side Template Injection (high 7.2)
- [CVE-2026-102141](https://insights.sbomify.com/CVE-2026-102141/): Kiteworks Core Privilege Escalation through External Control of File Name or Path (medium 6.7)
- [CVE-2026-102140](https://insights.sbomify.com/CVE-2026-102140/): Kiteworks Core Insufficient Verification of Data Authenticity (medium 4.9)
- [CVE-2026-10214](https://insights.sbomify.com/CVE-2026-10214/): zhayujie chatgpt-on-wechat Bash Tool bash.py _get_safety_warning os command injection (medium 6.9)
- [CVE-2026-102139](https://insights.sbomify.com/CVE-2026-102139/): Kiteworks Email Protection Gateway Incorrect Authorization (medium 6.5)
- [CVE-2026-102138](https://insights.sbomify.com/CVE-2026-102138/): Kiteworks Core Server-Side Request Forgery (SSRF) (low 3.3)
- [CVE-2026-102137](https://insights.sbomify.com/CVE-2026-102137/): Kiteworks Core Unrestricted Upload of File with Dangerous Type (medium 4.1)
- [CVE-2026-102136](https://insights.sbomify.com/CVE-2026-102136/): Kiteworks Core Command Execution through Configuration Injection (medium 6.3)
- [CVE-2026-102135](https://insights.sbomify.com/CVE-2026-102135/): Kiteworks Email Protection Gateway Deserialization of Untrusted Data (medium 6.6)
- [CVE-2026-102134](https://insights.sbomify.com/CVE-2026-102134/): Kiteworks Core Unprotected Alternate Channel (medium 5.4)
- [CVE-2026-102133](https://insights.sbomify.com/CVE-2026-102133/): Kiteworks Core Arbitrary File Write through Command Injection (medium 6.6)
- [CVE-2026-102132](https://insights.sbomify.com/CVE-2026-102132/): Kiteworks Core Privilege Escalation through Improper Access Control (high 7.2)
- [CVE-2026-102131](https://insights.sbomify.com/CVE-2026-102131/): Kiteworks Email Protection Gateway Improper Handling of Case Sensitivity (high 7.2)
- [CVE-2026-102130](https://insights.sbomify.com/CVE-2026-102130/): Kiteworks Email Protection Gateway Remote Code Execution (high 7.2)
- [CVE-2026-10213](https://insights.sbomify.com/CVE-2026-10213/): AstrBotDevs AstrBot API Endpoint delete path traversal (medium 5.3)
- [CVE-2026-102129](https://insights.sbomify.com/CVE-2026-102129/): Kiteworks Core Incorrect Privilege Assignment (high 7.2)
- [CVE-2026-102128](https://insights.sbomify.com/CVE-2026-102128/): Kiteworks Email Protection Gateway Improper Authentication (high 7.5)
- [CVE-2026-102127](https://insights.sbomify.com/CVE-2026-102127/): Kiteworks Email Protection Gateway Improper Restriction of XML External Entity Reference (high 7.0)
- [CVE-2026-102126](https://insights.sbomify.com/CVE-2026-102126/): Kiteworks Core Stored Cross-site Scripting (XSS) (high 8.1)
- [CVE-2026-102125](https://insights.sbomify.com/CVE-2026-102125/): Kiteworks Core Sandbox Escape (high 8.8)
- [CVE-2026-102124](https://insights.sbomify.com/CVE-2026-102124/): Kiteworks Core Missing Authentication for Critical Function (medium 6.5)
- [CVE-2026-102123](https://insights.sbomify.com/CVE-2026-102123/): Kiteworks Core Path Traversal (high 7.4)
- [CVE-2026-102122](https://insights.sbomify.com/CVE-2026-102122/): Kiteworks Core Incorrect Authorization (medium 4.3)
- [CVE-2026-102121](https://insights.sbomify.com/CVE-2026-102121/): Kiteworks Secure Data Forms Exposure of Sensitive Information to an Unauthorized Actor (high 8.6)
- [CVE-2026-102120](https://insights.sbomify.com/CVE-2026-102120/): Kiteworks Core OS Command Injection (high 8.8)
- [CVE-2026-10212](https://insights.sbomify.com/CVE-2026-10212/): AstrBotDevs AstrBot astr_main_agent.py astr_main_agent authorization (medium 5.3)
- [CVE-2026-102119](https://insights.sbomify.com/CVE-2026-102119/): Kiteworks Email Protection Gateway Path Traversal (high 7.2)
- [CVE-2026-102118](https://insights.sbomify.com/CVE-2026-102118/): Kiteworks Core before version 9.5.0 is vulnerable to Local Privilege Escalation (high 7.8)
- [CVE-2026-102117](https://insights.sbomify.com/CVE-2026-102117/): Kiteworks Core Remote Code Execution (high 7.2)
- [CVE-2026-102116](https://insights.sbomify.com/CVE-2026-102116/): Kiteworks Email Protection Gateway Path Traversal (high 7.2)
- [CVE-2026-102115](https://insights.sbomify.com/CVE-2026-102115/): Kiteworks Core Authentication Bypass in the Password Reset Workflow (critical 9.8)
- [CVE-2026-102114](https://insights.sbomify.com/CVE-2026-102114/): Kiteworks Core OS Command Injection (high 7.2)
- [CVE-2026-102113](https://insights.sbomify.com/CVE-2026-102113/): Kiteworks Core Local Privilege Escalation (high 7.8)
- [CVE-2026-102112](https://insights.sbomify.com/CVE-2026-102112/): Kiteworks Core Local Privilege Escalation (high 7.8)
- [CVE-2026-102111](https://insights.sbomify.com/CVE-2026-102111/): Kiteworks Core Improper Validation of Specified Quantity in Input (medium 4.9)
- [CVE-2026-102110](https://insights.sbomify.com/CVE-2026-102110/): Missing authentication on a Kiteworks appliance setup function (medium 5.9)
- [CVE-2026-10211](https://insights.sbomify.com/CVE-2026-10211/): AstrBotDevs AstrBot fs.py _normalize_rw_path authorization (medium 5.3)
- [CVE-2026-102109](https://insights.sbomify.com/CVE-2026-102109/): Kiteworks Secure Data Forms SQL injection (high 7.1)
- [CVE-2026-102108](https://insights.sbomify.com/CVE-2026-102108/): Kiteworks Email Protection Gateway deserialization of untrusted data (high 7.2)
- [CVE-2026-102107](https://insights.sbomify.com/CVE-2026-102107/): Kiteworks Core user impersonation in a file-request feature (medium 4.6)
- [CVE-2026-102106](https://insights.sbomify.com/CVE-2026-102106/): Kiteworks Email Protection Gateway improper authentication (critical 9.1)
- [CVE-2026-102105](https://insights.sbomify.com/CVE-2026-102105/): Kiteworks Email Protection Gateway server-side request forgery (critical 9.1)
- [CVE-2026-102104](https://insights.sbomify.com/CVE-2026-102104/): Kiteworks Email Protection Gateway server-side request forgery (critical 9.1)
- [CVE-2026-102103](https://insights.sbomify.com/CVE-2026-102103/): Kiteworks Email Protection Gateway server-side request forgery (critical 9.1)
- [CVE-2026-102102](https://insights.sbomify.com/CVE-2026-102102/): Kiteworks Email Protection Gateway server-side request forgery (critical 9.1)
- [CVE-2026-102101](https://insights.sbomify.com/CVE-2026-102101/): Kiteworks Core deserialization of untrusted data (high 8.1)
- [CVE-2026-102100](https://insights.sbomify.com/CVE-2026-102100/): Kiteworks Core stored XSS (high 8.7)
- [CVE-2026-10210](https://insights.sbomify.com/CVE-2026-10210/): AstrBotDevs AstrBot skill_manager.py _sanitize_prompt_description injection (medium 5.3)
- [CVE-2026-102099](https://insights.sbomify.com/CVE-2026-102099/): Kiteworks Core arbitrary file write (high 7.2)
- [CVE-2026-102098](https://insights.sbomify.com/CVE-2026-102098/): Kiteworks Core SQL Injection (high 7.2)
- [CVE-2026-102097](https://insights.sbomify.com/CVE-2026-102097/): Kiteworks Email Protection Gateway remote code execution (high 7.2)
- [CVE-2026-102096](https://insights.sbomify.com/CVE-2026-102096/): Kiteworks Core OS command injection (high 7.2)
- [CVE-2026-102095](https://insights.sbomify.com/CVE-2026-102095/): Kiteworks Email Protection Gateway server-side request forgery (critical 9.1)
- [CVE-2026-102094](https://insights.sbomify.com/CVE-2026-102094/): Kiteworks Email Protection Gateway unsafe reflection (high 7.2)
- [CVE-2026-102093](https://insights.sbomify.com/CVE-2026-102093/): Kiteworks Core improper privilege management (high 7.2)
- [CVE-2026-102092](https://insights.sbomify.com/CVE-2026-102092/): Kiteworks Core stored XSS (high 8.7)
- [CVE-2026-102091](https://insights.sbomify.com/CVE-2026-102091/): Kiteworks Secure Data Forms server-side request forgery (high 7.5)
- [CVE-2026-102090](https://insights.sbomify.com/CVE-2026-102090/): Kiteworks Core content injection (medium 4.3)
- [CVE-2026-10209](https://insights.sbomify.com/CVE-2026-10209/): code-projects Online Hospital Management System Appointment appointmentdetail.php sql injection (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/988/