# Vulnerabilities published in 2026


- [CVE-2026-101270](https://insights.sbomify.com/CVE-2026-101270/): HTML injection (low 2.1)
- [CVE-2026-10127](https://insights.sbomify.com/CVE-2026-10127/): Edimax BR-6478AC POST Request formStaDrvSetup command injection (medium 5.3)
- [CVE-2026-101269](https://insights.sbomify.com/CVE-2026-101269/): Incorrect session validation for API-uploaded files (low 2.3)
- [CVE-2026-101268](https://insights.sbomify.com/CVE-2026-101268/): Customer session fixation (low 1.7)
- [CVE-2026-101267](https://insights.sbomify.com/CVE-2026-101267/): Revenue information leak (low 2.7)
- [CVE-2026-101266](https://insights.sbomify.com/CVE-2026-101266/): Checkout validation bypass (low 1.3)
- [CVE-2026-101265](https://insights.sbomify.com/CVE-2026-101265/): Intelbras TIP 125i Básico sensitive information in source (low 2.3)
- [CVE-2026-101264](https://insights.sbomify.com/CVE-2026-101264/): Ziroom ZHOME A0101 set_passwd command injection (critical 9.4)
- [CVE-2026-101263](https://insights.sbomify.com/CVE-2026-101263/): Ziroom ZHOME A0101 set_online_client command injection (critical 9.4)
- [CVE-2026-101262](https://insights.sbomify.com/CVE-2026-101262/): Ziroom ZHOME A0101 set_online_client command injection (critical 9.4)
- [CVE-2026-101261](https://insights.sbomify.com/CVE-2026-101261/): Ziroom ZHOME A0101 firstSetup_wifi command injection (critical 9.4)
- [CVE-2026-101260](https://insights.sbomify.com/CVE-2026-101260/): Ziroom ZHOME A0101 firstLogin command injection (critical 9.4)
- [CVE-2026-10126](https://insights.sbomify.com/CVE-2026-10126/): Edimax BR-6478AC POST Request formQoS buffer overflow (high 8.7)
- [CVE-2026-101259](https://insights.sbomify.com/CVE-2026-101259/): Apache Camel: Camel-CoAP Information Disclosure via Unmuted Consumer Exceptions (medium 5.3)
- [CVE-2026-101258](https://insights.sbomify.com/CVE-2026-101258/): Ghostscript: ghostscript: -dsafer sandbox bypass via type 5 shading oob write and procedure-stream use-after-free (high 7.8)
- [CVE-2026-10125](https://insights.sbomify.com/CVE-2026-10125/): Edimax BR-6478AC POST Request formPPPoESetup stack-based overflow (high 8.7)
- [CVE-2026-10124](https://insights.sbomify.com/CVE-2026-10124/): Shibby Tomato Zserv ripd rip_zebra_read_ipv4 stack-based overflow (high 8.7)
- [CVE-2026-10123](https://insights.sbomify.com/CVE-2026-10123/): TRENDnet TEW-432BRP formSetDomainFilter stack-based overflow (high 8.7)
- [CVE-2026-10122](https://insights.sbomify.com/CVE-2026-10122/): TRENDnet TEW-432BRP formSetProtocolFilter stack-based overflow (high 8.7)
- [CVE-2026-101217](https://insights.sbomify.com/CVE-2026-101217/): Path traversal in Unisphere for PowerMax vApp (medium 6.5)
- [CVE-2026-101216](https://insights.sbomify.com/CVE-2026-101216/): Command injection in Unisphere for PowerMax vApp (medium 6.6)
- [CVE-2026-101215](https://insights.sbomify.com/CVE-2026-101215/): Command injection in Unisphere for PowerMax vApp (medium 6.6)
- [CVE-2026-10121](https://insights.sbomify.com/CVE-2026-10121/): TRENDnet TEW-432BRP formSetUrlFilter stack-based overflow (high 8.7)
- [CVE-2026-101207](https://insights.sbomify.com/CVE-2026-101207/): Command injection in OpenManage Integration (high 8.8)
- [CVE-2026-101205](https://insights.sbomify.com/CVE-2026-101205/): FastStone Image Viewer PCX Decoder out-of-bounds (medium 5.3)
- [CVE-2026-101204](https://insights.sbomify.com/CVE-2026-101204/): FastStone Image Viewer TGA Image FSViewer.exe out-of-bounds (medium 5.3)
- [CVE-2026-101203](https://insights.sbomify.com/CVE-2026-101203/): FastStone Image Viewer 1bpp RLE Decoder out-of-bounds write (medium 5.3)
- [CVE-2026-101202](https://insights.sbomify.com/CVE-2026-101202/): FastStone Image Viewer TGA Image out-of-bounds write (medium 5.3)
- [CVE-2026-101201](https://insights.sbomify.com/CVE-2026-101201/): QBinaryJson::fromBinaryData() integer overflow leading to OOB read (medium 4.3)
- [CVE-2026-10120](https://insights.sbomify.com/CVE-2026-10120/): TRENDnet TEW-432BRP formSetFirewallRule stack-based overflow (high 8.7)
- [CVE-2026-10119](https://insights.sbomify.com/CVE-2026-10119/): TRENDnet TEW-432BRP formSetMACFilter stack-based overflow (high 8.7)
- [CVE-2026-101188](https://insights.sbomify.com/CVE-2026-101188/): Netcore POWER13 ubus routerd.passwd_set password recovery (medium 6.9)
- [CVE-2026-101187](https://insights.sbomify.com/CVE-2026-101187/): Ziroom ZHOME A0101 USB Device Management API zrUsb.lua pop_usb_device command injection (critical 9.4)
- [CVE-2026-10118](https://insights.sbomify.com/CVE-2026-10118/): Integer overflow in Red Hat AI Inference Server 3.3 (high 7.8)
- [CVE-2026-10117](https://insights.sbomify.com/CVE-2026-10117/): Open5GS nghttp2-server.c ogs_pool_id_calloc denial of service (medium 5.3)
- [CVE-2026-101169](https://insights.sbomify.com/CVE-2026-101169/): Deserialization in Octopus Server (high 8.7)
- [CVE-2026-101168](https://insights.sbomify.com/CVE-2026-101168/): Insertion of Sensitive Information into Log File in GitLab (medium 6.2)
- [CVE-2026-101162](https://insights.sbomify.com/CVE-2026-101162/): WP Ultimate Review < 2.4.4 - Author+ Stored XSS via Review Overview Settings (medium 6.4)
- [CVE-2026-101161](https://insights.sbomify.com/CVE-2026-101161/): WP Ultimate Review < 2.4.4 - Unauthenticated DoS via Unset Display Settings in wp-reviews Shortcode (high 7.5)
- [CVE-2026-101160](https://insights.sbomify.com/CVE-2026-101160/): WP Ultimate Review < 2.4.4 - Unauthenticated DoS via Non-Numeric Review Rating (high 7.5)
- [CVE-2026-10116](https://insights.sbomify.com/CVE-2026-10116/): Open5GS ue-authentications Endpoint ogs-timer.c ogs_sbi_xact_add denial of service (medium 5.3)
- [CVE-2026-101159](https://insights.sbomify.com/CVE-2026-101159/): WP Ultimate Review < 2.4.4 - Unauthenticated Stored XSS via Review Submission (high 7.5)
- [CVE-2026-101158](https://insights.sbomify.com/CVE-2026-101158/): Security Advisory 0185 (critical 9.3)
- [CVE-2026-101157](https://insights.sbomify.com/CVE-2026-101157/): Security Advisory 0192 (critical 9.3)
- [CVE-2026-101156](https://insights.sbomify.com/CVE-2026-101156/): Security Advisory 0192 (medium 6.2)
- [CVE-2026-101155](https://insights.sbomify.com/CVE-2026-101155/): Security Advisory 0189 (high 8.6)
- [CVE-2026-101154](https://insights.sbomify.com/CVE-2026-101154/): Security Advisory 0189 (high 8.6)
- [CVE-2026-101153](https://insights.sbomify.com/CVE-2026-101153/): Security Advisory 0188 (high 7.2)
- [CVE-2026-101152](https://insights.sbomify.com/CVE-2026-101152/): Security Advisory 0187 (high 7.6)
- [CVE-2026-101151](https://insights.sbomify.com/CVE-2026-101151/): Security Advisory 0187 (medium 5.3)
- [CVE-2026-101150](https://insights.sbomify.com/CVE-2026-101150/): Security Advisory 0186 (medium 5.1)
- [CVE-2026-10115](https://insights.sbomify.com/CVE-2026-10115/): Open5GS Shared NF-profile nnrf-handler.c denial of service (medium 5.3)
- [CVE-2026-101149](https://insights.sbomify.com/CVE-2026-101149/): Security Advisory 0186 (medium 5.1)
- [CVE-2026-101148](https://insights.sbomify.com/CVE-2026-101148/): BackupSheep <= 1.8 - Unauthenticated Arbitrary File Deletion and Backup Exfiltration via Empty Integration Key (critical 10.0)
- [CVE-2026-101147](https://insights.sbomify.com/CVE-2026-101147/): Featured Image from URL (FIFU) Free & Premium - Administrator Account Creation via CSRF (high 8.8)
- [CVE-2026-101146](https://insights.sbomify.com/CVE-2026-101146/): Eleveo Quality Management GWT RPC QMUtilsService UtilsService.createAndSaveAudit information disclosure (medium 5.3)
- [CVE-2026-101145](https://insights.sbomify.com/CVE-2026-101145/): Eleveo Call Recording Software User Management userAddAction.do ldap injection (medium 5.3)
- [CVE-2026-101144](https://insights.sbomify.com/CVE-2026-101144/): Eleveo Call Recording Software Query Builder searchAction.do access control (medium 5.3)
- [CVE-2026-101143](https://insights.sbomify.com/CVE-2026-101143/): Eleveo Quality Management QMBODownload information disclosure (medium 5.3)
- [CVE-2026-101142](https://insights.sbomify.com/CVE-2026-101142/): Eleveo Quality Management Questionnaire Audio Upload Scorecard.jsp path traversal (medium 5.3)
- [CVE-2026-101141](https://insights.sbomify.com/CVE-2026-101141/): Eleveo Call Recording Software Play Audio audio.jsp cross site scripting (medium 5.1)
- [CVE-2026-10114](https://insights.sbomify.com/CVE-2026-10114/): Open5GS Shared NF-profile nnrf-handler.c handle_scp_info out-of-bounds write (medium 5.3)
- [CVE-2026-101139](https://insights.sbomify.com/CVE-2026-101139/): Webkul Bagisto Invoice Mass Status Update state authorization (medium 5.1)
- [CVE-2026-101138](https://insights.sbomify.com/CVE-2026-101138/): CMP - Coming Soon & Maintenance 4.1.19 - 4.1.20 - Unauthenticated Maintenance Mode Bypass via Custom URL Whitelist (medium 5.3)
- [CVE-2026-101132](https://insights.sbomify.com/CVE-2026-101132/): DeepSeek deepseek-harness Bundle Patch profile.ts loadProfile path traversal (low 2.3)
- [CVE-2026-101131](https://insights.sbomify.com/CVE-2026-101131/): deepseek-ai deepseek-harness dsh index.ts reliance on untrusted inputs in a security decision (medium 4.8)
- [CVE-2026-101130](https://insights.sbomify.com/CVE-2026-101130/): Memory corruption in affinity (low 3.6)
- [CVE-2026-10113](https://insights.sbomify.com/CVE-2026-10113/): Open5GS Shared NF-profile nnrf-handler.c denial of service (medium 5.3)
- [CVE-2026-101127](https://insights.sbomify.com/CVE-2026-101127/): Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3.4 (high 8.6)
- [CVE-2026-101126](https://insights.sbomify.com/CVE-2026-101126/): Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms < 2.4.3.4 (medium 6.9)
- [CVE-2026-10112](https://insights.sbomify.com/CVE-2026-10112/): sambitraj STUDENT-MANAGEMENT-SYSTEM Dashboard cross site scripting (medium 4.8)
- [CVE-2026-101112](https://insights.sbomify.com/CVE-2026-101112/): Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms < 2.4.3.4 (medium 6.9)
- [CVE-2026-101111](https://insights.sbomify.com/CVE-2026-101111/): Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Book Library (Free) < 6.4.6 (medium 5.3)
- [CVE-2026-101110](https://insights.sbomify.com/CVE-2026-101110/): Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library (Free) < 6.4.6 (critical 9.3)
- [CVE-2026-10111](https://insights.sbomify.com/CVE-2026-10111/): sambitraj STUDENT-MANAGEMENT-SYSTEM Login Page sql injection (medium 6.9)
- [CVE-2026-101109](https://insights.sbomify.com/CVE-2026-101109/): Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager (Free) < 6.5.8 (medium 5.3)
- [CVE-2026-101108](https://insights.sbomify.com/CVE-2026-101108/): Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8 (critical 9.3)
- [CVE-2026-101105](https://insights.sbomify.com/CVE-2026-101105/): code-projects Matrimonial System Profile Creation Endpoint create_profile processprofile_form sql injection (medium 5.3)
- [CVE-2026-101104](https://insights.sbomify.com/CVE-2026-101104/): Missing Authorization in Meari IoT Cloud Platform OpenAPI Service (medium 6.3)
- [CVE-2026-101103](https://insights.sbomify.com/CVE-2026-101103/): HMS Networks PEAK-System PCAN Windows drivers Classic Buffer Overflow (medium 6.8)
- [CVE-2026-101102](https://insights.sbomify.com/CVE-2026-101102/): deepseek-ai deepseek-harness Code Mode Sandbox run_code sandbox (medium 5.3)
- [CVE-2026-101101](https://insights.sbomify.com/CVE-2026-101101/): ag-ui-protocol ag-ui Middleware convert.ts JSON.parse uncaught exception (medium 5.3)
- [CVE-2026-101100](https://insights.sbomify.com/CVE-2026-101100/): ag-ui-protocol ag-ui Middleware filter-tool-calls.ts FilterToolCallsMiddleware cleanup (medium 5.3)
- [CVE-2026-10110](https://insights.sbomify.com/CVE-2026-10110/): code-projects Student Details Management System index.php sql injection (medium 6.9)
- [CVE-2026-1011](https://insights.sbomify.com/CVE-2026-1011/): Stored Cross-Site Scripting in Altium Live Support Center Comment Endpoint (medium 6.1)
- [CVE-2026-101099](https://insights.sbomify.com/CVE-2026-101099/): ag-ui-protocol ag-ui Kotlin Community SDK SseParser.kt exceptional condition (medium 5.3)
- [CVE-2026-101098](https://insights.sbomify.com/CVE-2026-101098/): ag-ui-protocol ag-ui HTTP JdkAgentHttpHandler.java readAllBytes resource consumption (medium 5.3)
- [CVE-2026-101094](https://insights.sbomify.com/CVE-2026-101094/): Memory corruption in affinity (low 3.6)
- [CVE-2026-101093](https://insights.sbomify.com/CVE-2026-101093/): Cotonti through 1.0.0 Cross-Site Request Forgery via User Group Deletion (medium 5.3)
- [CVE-2026-101092](https://insights.sbomify.com/CVE-2026-101092/): SiYuan before v3.8.4 Information Disclosure via getCurrentAttrViewImages (medium 6.9)
- [CVE-2026-101091](https://insights.sbomify.com/CVE-2026-101091/): SiYuan before v3.8.4 SQL Injection via Block Query Embed (high 7.1)
- [CVE-2026-101090](https://insights.sbomify.com/CVE-2026-101090/): Nezha through 2.2.3 Host Header Injection via OAuth2 redirect_uri (critical 9.3)
- [CVE-2026-10109](https://insights.sbomify.com/CVE-2026-10109/): IBM® Db2® is vulnerable to remote code execution due to improper pre-auth DRDA handshake handling (critical 9.8)
- [CVE-2026-101089](https://insights.sbomify.com/CVE-2026-101089/): Nezha before 2.2.7 Information Disclosure via /api/v1/profile (low 2.3)
- [CVE-2026-101088](https://insights.sbomify.com/CVE-2026-101088/): Nezha before 2.3.1 Denial of Service via Concurrent Server Delete (medium 6.0)
- [CVE-2026-101087](https://insights.sbomify.com/CVE-2026-101087/): Nezha 2.0.10 through 2.3.2 SSRF Denylist Bypass IPv6 (medium 5.3)
- [CVE-2026-101086](https://insights.sbomify.com/CVE-2026-101086/): Nezha Dashboard before 2.3.5 Task Type Validation Bypass (high 7.1)
- [CVE-2026-101085](https://insights.sbomify.com/CVE-2026-101085/): Nezha before 2.3.8 Denial of Service via Alert Rule (high 7.1)
- [CVE-2026-101084](https://insights.sbomify.com/CVE-2026-101084/): obot before v0.21.1 Authorization Bypass via /mcp-connect (critical 9.3)
- [CVE-2026-101083](https://insights.sbomify.com/CVE-2026-101083/): PMWeb encryptionhelper.dll information disclosure (medium 6.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/997/