# Vulnerabilities published in 2026


- [CVE-2026-101894](https://insights.sbomify.com/CVE-2026-101894/): @xhmikosr/decompress: Path traversal via symlink chain (critical 9.1)
- [CVE-2026-101893](https://insights.sbomify.com/CVE-2026-101893/): Newell Brands DYMO ID document parsing failing file type extension authentication check (medium 5.1)
- [CVE-2026-101891](https://insights.sbomify.com/CVE-2026-101891/): WatchGuard AP Improper Access Control in API Service Allows Unauthenticated Access (critical 9.3)
- [CVE-2026-101890](https://insights.sbomify.com/CVE-2026-101890/): Prime Mover < 2.2.1 Stored XSS via Package Metadata (medium 5.1)
- [CVE-2026-10189](https://insights.sbomify.com/CVE-2026-10189/): Tenda W12 httpd cgiSysTimeInfoSet stack-based overflow (high 8.7)
- [CVE-2026-101889](https://insights.sbomify.com/CVE-2026-101889/): Prime Mover < 2.2.1 Path Traversal via wprime-config.json (high 7.0)
- [CVE-2026-101888](https://insights.sbomify.com/CVE-2026-101888/): Prime Mover < 2.2.1 Zip Slip Path Traversal File Write (high 8.6)
- [CVE-2026-101887](https://insights.sbomify.com/CVE-2026-101887/): BlueALSA bluealsad LC3plus Decoder Division-by-Zero DoS (low 2.1)
- [CVE-2026-101886](https://insights.sbomify.com/CVE-2026-101886/): Cisco Jabber for Android Path Traversal via Shared Content URI (medium 5.1)
- [CVE-2026-101885](https://insights.sbomify.com/CVE-2026-101885/): ZeroClaw before 0.8.5 Path Traversal via Plugin Manifest wasm_path (high 8.5)
- [CVE-2026-101884](https://insights.sbomify.com/CVE-2026-101884/): OpenClaw Windows Node before 2026.7.1 Remote Code Execution via Environment Override (high 7.7)
- [CVE-2026-101883](https://insights.sbomify.com/CVE-2026-101883/): OpenClaw Windows Node through 2026.9.4 SSRF via canvas.present (medium 5.3)
- [CVE-2026-101882](https://insights.sbomify.com/CVE-2026-101882/): OpenClaw Windows Node before 2026.7.1 Remote Code Execution via system.execApprovals.set (high 8.7)
- [CVE-2026-101881](https://insights.sbomify.com/CVE-2026-101881/): OpenClaw Windows Node before 2026.7.1 Denial of Service (high 7.1)
- [CVE-2026-101880](https://insights.sbomify.com/CVE-2026-101880/): OpenClaw Windows Node before 2026.7.1 Authorization Bypass (high 8.7)
- [CVE-2026-10188](https://insights.sbomify.com/CVE-2026-10188/): Tenda W12 httpd cgistaKickOff stack-based overflow (high 8.7)
- [CVE-2026-101879](https://insights.sbomify.com/CVE-2026-101879/): OpenClaw Windows Node before 2026.7.1-3 Missing Authorization (high 7.1)
- [CVE-2026-101878](https://insights.sbomify.com/CVE-2026-101878/): Bitwarden Server 2025.6.0 < 2025.6.0 Authentication Bypass via SSO Identifier Truncation (high 7.7)
- [CVE-2026-10187](https://insights.sbomify.com/CVE-2026-10187/): Totolink N300RH Web Management wireless.so setWiFiBasicConfig stack-based overflow (critical 9.3)
- [CVE-2026-101861](https://insights.sbomify.com/CVE-2026-101861/): Langflow Code Execution via eval() in Component Input Schema (low 2.1)
- [CVE-2026-101860](https://insights.sbomify.com/CVE-2026-101860/): RaspAP raspap-webgui sudo Configuration PluginInstaller.php addSudoers privileges management (high 8.7)
- [CVE-2026-10186](https://insights.sbomify.com/CVE-2026-10186/): code-projects Online Hospital Management System patient.php sql injection (medium 6.9)
- [CVE-2026-101859](https://insights.sbomify.com/CVE-2026-101859/): RaspAP raspap-webgui OpenVPN Configuration del_ovpncfg.php escapeshellcmd os command injection (medium 5.3)
- [CVE-2026-101858](https://insights.sbomify.com/CVE-2026-101858/): RaspAP raspap-webgui SSID Processing WiFiManager.php writeWpaSupplicant os command injection (medium 5.1)
- [CVE-2026-101857](https://insights.sbomify.com/CVE-2026-101857/): Information disclosure in Oracle Order Management (medium 6.5)
- [CVE-2026-101856](https://insights.sbomify.com/CVE-2026-101856/): Information disclosure in Oracle Order Management (medium 6.5)
- [CVE-2026-101855](https://insights.sbomify.com/CVE-2026-101855/): Information disclosure in Oracle Product Hub (medium 6.5)
- [CVE-2026-101854](https://insights.sbomify.com/CVE-2026-101854/): Missing authorization in Oracle Product Hub (high 8.8)
- [CVE-2026-101853](https://insights.sbomify.com/CVE-2026-101853/): Missing authorization in Oracle Product Hub (high 8.8)
- [CVE-2026-101852](https://insights.sbomify.com/CVE-2026-101852/): Missing authorization in Oracle Product Hub (high 8.8)
- [CVE-2026-101851](https://insights.sbomify.com/CVE-2026-101851/): Information disclosure in Installed Base (high 7.1)
- [CVE-2026-101850](https://insights.sbomify.com/CVE-2026-101850/): Information disclosure in Installed Base (medium 6.1)
- [CVE-2026-10185](https://insights.sbomify.com/CVE-2026-10185/): SourceCodester Hospitals Patient Records Management System Users.php save sql injection (medium 6.9)
- [CVE-2026-101849](https://insights.sbomify.com/CVE-2026-101849/): Information disclosure in Installed Base (high 7.6)
- [CVE-2026-101847](https://insights.sbomify.com/CVE-2026-101847/): Information disclosure in Oracle Bills of Material (high 7.5)
- [CVE-2026-101846](https://insights.sbomify.com/CVE-2026-101846/): Information disclosure in Oracle Purchasing (low 3.5)
- [CVE-2026-101845](https://insights.sbomify.com/CVE-2026-101845/): Information disclosure in Oracle Purchasing (low 3.1)
- [CVE-2026-101844](https://insights.sbomify.com/CVE-2026-101844/): Information disclosure in Oracle Concurrent Processing (low 3.1)
- [CVE-2026-101843](https://insights.sbomify.com/CVE-2026-101843/): Information disclosure in Production Scheduling (medium 4.5)
- [CVE-2026-101842](https://insights.sbomify.com/CVE-2026-101842/): Missing authorization in Strategic Network Optimization (high 8.8)
- [CVE-2026-101841](https://insights.sbomify.com/CVE-2026-101841/): Missing authorization in Global Order Promising (high 8.2)
- [CVE-2026-101840](https://insights.sbomify.com/CVE-2026-101840/): Missing authorization in Oracle Contract Lifecycle Management for Public Sector (high 7.2)
- [CVE-2026-10184](https://insights.sbomify.com/CVE-2026-10184/): SourceCodester Hospitals Patient Records Management System Users.php delete sql injection (medium 6.9)
- [CVE-2026-101837](https://insights.sbomify.com/CVE-2026-101837/): Missing authorization in Oracle Shipping Execution (high 7.7)
- [CVE-2026-101836](https://insights.sbomify.com/CVE-2026-101836/): Missing authorization in iSupplier Portal (medium 6.5)
- [CVE-2026-101835](https://insights.sbomify.com/CVE-2026-101835/): Missing authorization in Oracle Shipping Execution (high 7.5)
- [CVE-2026-101834](https://insights.sbomify.com/CVE-2026-101834/): Missing authorization in Oracle Shipping Execution (high 8.1)
- [CVE-2026-101833](https://insights.sbomify.com/CVE-2026-101833/): Missing authorization in Oracle Shipping Execution (high 7.6)
- [CVE-2026-101832](https://insights.sbomify.com/CVE-2026-101832/): Missing authorization in Oracle Order Management (medium 6.5)
- [CVE-2026-101831](https://insights.sbomify.com/CVE-2026-101831/): Missing authorization in Oracle Quality (high 8.1)
- [CVE-2026-101830](https://insights.sbomify.com/CVE-2026-101830/): Missing authorization in Oracle Project Contracts (high 7.7)
- [CVE-2026-10183](https://insights.sbomify.com/CVE-2026-10183/): TRENDnet TEW-432BRP formWlanSetup stack-based overflow (high 8.7)
- [CVE-2026-101829](https://insights.sbomify.com/CVE-2026-101829/): Missing authorization in Oracle Mobile Application Server (high 7.4)
- [CVE-2026-101828](https://insights.sbomify.com/CVE-2026-101828/): Missing authorization in Oracle Mobile Application Server (medium 6.5)
- [CVE-2026-101827](https://insights.sbomify.com/CVE-2026-101827/): Missing authorization in Oracle HCM Common Architecture (high 7.1)
- [CVE-2026-101826](https://insights.sbomify.com/CVE-2026-101826/): Missing authorization in Oracle HCM Common Architecture (high 7.5)
- [CVE-2026-101825](https://insights.sbomify.com/CVE-2026-101825/): Missing authorization in Oracle HCM Common Architecture (high 7.5)
- [CVE-2026-101824](https://insights.sbomify.com/CVE-2026-101824/): Missing authorization in Document Management and Collaboration (high 8.7)
- [CVE-2026-101823](https://insights.sbomify.com/CVE-2026-101823/): Missing authorization in Oracle Bills of Material (high 7.5)
- [CVE-2026-101822](https://insights.sbomify.com/CVE-2026-101822/): Missing authorization in Oracle Bills of Material (high 7.2)
- [CVE-2026-101821](https://insights.sbomify.com/CVE-2026-101821/): Missing authorization in Oracle Compensation Workbench (medium 5.4)
- [CVE-2026-101820](https://insights.sbomify.com/CVE-2026-101820/): Missing authorization in Oracle General Ledger (high 7.5)
- [CVE-2026-10182](https://insights.sbomify.com/CVE-2026-10182/): TRENDnet TEW-432BRP formWlanSetup command injection (medium 5.3)
- [CVE-2026-101819](https://insights.sbomify.com/CVE-2026-101819/): Missing authorization in Oracle General Ledger (medium 6.5)
- [CVE-2026-101818](https://insights.sbomify.com/CVE-2026-101818/): Missing authorization in Oracle Product Hub (high 7.7)
- [CVE-2026-101816](https://insights.sbomify.com/CVE-2026-101816/): Missing authorization in Oracle Product Hub (high 7.2)
- [CVE-2026-101815](https://insights.sbomify.com/CVE-2026-101815/): Missing authorization in Assets (high 7.6)
- [CVE-2026-101814](https://insights.sbomify.com/CVE-2026-101814/): Missing authorization in Oracle Engineering (medium 5.3)
- [CVE-2026-101813](https://insights.sbomify.com/CVE-2026-101813/): Missing authorization in Oracle Engineering (high 8.8)
- [CVE-2026-101812](https://insights.sbomify.com/CVE-2026-101812/): Missing authorization in Oracle Complex Maintenance, Repair and Overhaul (medium 6.8)
- [CVE-2026-101810](https://insights.sbomify.com/CVE-2026-101810/): Denial of service in MySQL Router (high 7.5)
- [CVE-2026-10181](https://insights.sbomify.com/CVE-2026-10181/): TRENDnet TEW-432BRP formSysCmd stack-based overflow (high 8.7)
- [CVE-2026-101809](https://insights.sbomify.com/CVE-2026-101809/): Missing authorization in Workflow (critical 10.0)
- [CVE-2026-101808](https://insights.sbomify.com/CVE-2026-101808/): Auth bypass in Oracle Product Workbench (critical 9.1)
- [CVE-2026-101807](https://insights.sbomify.com/CVE-2026-101807/): Missing authorization in Oracle Communications Billing and Revenue Management (medium 4.8)
- [CVE-2026-101806](https://insights.sbomify.com/CVE-2026-101806/): Missing authorization in MySQL Connectors (medium 6.8)
- [CVE-2026-101805](https://insights.sbomify.com/CVE-2026-101805/): Missing authorization in Oracle Applications Manager (low 3.3)
- [CVE-2026-101804](https://insights.sbomify.com/CVE-2026-101804/): Denial of service in MySQL Connectors (low 2.5)
- [CVE-2026-101803](https://insights.sbomify.com/CVE-2026-101803/): Other in MySQL Cluster (medium 6.5)
- [CVE-2026-101802](https://insights.sbomify.com/CVE-2026-101802/): Denial of service in MySQL Cluster (medium 6.5)
- [CVE-2026-101801](https://insights.sbomify.com/CVE-2026-101801/): Denial of service in MySQL Cluster (medium 4.9)
- [CVE-2026-101800](https://insights.sbomify.com/CVE-2026-101800/): Missing authorization in MySQL Cluster (medium 6.8)
- [CVE-2026-10180](https://insights.sbomify.com/CVE-2026-10180/): TRENDnet TEW-432BRP formSysCmd command injection (medium 5.3)
- [CVE-2026-101799](https://insights.sbomify.com/CVE-2026-101799/): Denial of service in MySQL Cluster (medium 6.5)
- [CVE-2026-101798](https://insights.sbomify.com/CVE-2026-101798/): Denial of service in MySQL Cluster (medium 4.9)
- [CVE-2026-101797](https://insights.sbomify.com/CVE-2026-101797/): Other in MySQL Cluster (high 7.5)
- [CVE-2026-101796](https://insights.sbomify.com/CVE-2026-101796/): Other in MySQL Cluster (high 7.5)
- [CVE-2026-101795](https://insights.sbomify.com/CVE-2026-101795/): Other in MySQL Cluster (medium 6.7)
- [CVE-2026-101794](https://insights.sbomify.com/CVE-2026-101794/): Denial of service in MySQL Cluster (medium 6.5)
- [CVE-2026-101793](https://insights.sbomify.com/CVE-2026-101793/): Missing authorization in Oracle Communications BRM - Elastic Charging Engine (medium 5.5)
- [CVE-2026-101792](https://insights.sbomify.com/CVE-2026-101792/): Missing authorization in Oracle Communications BRM - Elastic Charging Engine (medium 5.9)
- [CVE-2026-101791](https://insights.sbomify.com/CVE-2026-101791/): Missing authorization in Oracle Communications BRM - Elastic Charging Engine (high 8.1)
- [CVE-2026-101790](https://insights.sbomify.com/CVE-2026-101790/): Missing authorization in Oracle Communications BRM - Elastic Charging Engine (low 3.3)
- [CVE-2026-10179](https://insights.sbomify.com/CVE-2026-10179/): TRENDnet TEW-432BRP formSetWlanEncrypt stack-based overflow (high 8.7)
- [CVE-2026-101789](https://insights.sbomify.com/CVE-2026-101789/): Denial of service in MySQL Cluster (medium 6.5)
- [CVE-2026-101788](https://insights.sbomify.com/CVE-2026-101788/): Denial of service in MySQL Cluster (medium 5.9)
- [CVE-2026-101787](https://insights.sbomify.com/CVE-2026-101787/): Denial of service in MySQL Cluster (medium 4.9)
- [CVE-2026-101786](https://insights.sbomify.com/CVE-2026-101786/): Other in MySQL Cluster (high 7.2)
- [CVE-2026-101785](https://insights.sbomify.com/CVE-2026-101785/): Missing authorization in MySQL Cluster (high 8.3)
- [CVE-2026-101784](https://insights.sbomify.com/CVE-2026-101784/): Denial of service in MySQL Cluster (medium 4.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/991/