# Vulnerabilities published in 2026


- [CVE-2026-101082](https://insights.sbomify.com/CVE-2026-101082/): PMWeb downloader.aspx path traversal (medium 6.9)
- [CVE-2026-101081](https://insights.sbomify.com/CVE-2026-101081/): D-Link DI-8400 Web Administration Service menu_nat_more.asp menu_nat_more_asp stack-based overflow (critical 9.4)
- [CVE-2026-101080](https://insights.sbomify.com/CVE-2026-101080/): Tencent AI-Infra-Guard File Access dir_actions.py startsWith path traversal (low 2.4)
- [CVE-2026-10108](https://insights.sbomify.com/CVE-2026-10108/): xiaomusic 0.5.7 Path Traversal via GET /music endpoint (high 8.7)
- [CVE-2026-101079](https://insights.sbomify.com/CVE-2026-101079/): agentverus agentverus-scanner context.js isSecurityDefenseSkill reliance on untrusted inputs in a security decision (low 2.4)
- [CVE-2026-101078](https://insights.sbomify.com/CVE-2026-101078/): deepseek-ai deepseek-harness Landlock Backend profiles.ts isolation (medium 4.8)
- [CVE-2026-101077](https://insights.sbomify.com/CVE-2026-101077/): Netcore NR289-GE boa_temp process_request missing authentication (critical 10.0)
- [CVE-2026-101076](https://insights.sbomify.com/CVE-2026-101076/): Netcore NR289-GE CGI set_ntp_server_ip.cgi system os command injection (critical 10.0)
- [CVE-2026-101075](https://insights.sbomify.com/CVE-2026-101075/): Netcore NR289-GE Location Time location_time.cgi system os command injection (critical 10.0)
- [CVE-2026-101074](https://insights.sbomify.com/CVE-2026-101074/): Netcore NR289-GE Authentication boa password-check stack-based overflow (critical 9.3)
- [CVE-2026-101073](https://insights.sbomify.com/CVE-2026-101073/): Netcore NR289-GE CGI Dispatcher boa improper authentication (medium 6.9)
- [CVE-2026-101072](https://insights.sbomify.com/CVE-2026-101072/): Netcore NR289-GE CGI ap_ip.cgi system os command injection (critical 10.0)
- [CVE-2026-101071](https://insights.sbomify.com/CVE-2026-101071/): Acrel Electric Unet Web Service Upload Endpoint upload unrestricted upload (medium 5.3)
- [CVE-2026-101070](https://insights.sbomify.com/CVE-2026-101070/): dbgate Files Endpoint runners.js files path traversal (medium 6.9)
- [CVE-2026-10107](https://insights.sbomify.com/CVE-2026-10107/): MoviePilot v2 SSRF via /api/v1/system/img/{proxy} Endpoint (high 7.0)
- [CVE-2026-101069](https://insights.sbomify.com/CVE-2026-101069/): dbgate Export databaseConnections.js exportModelSql path traversal (medium 6.9)
- [CVE-2026-101068](https://insights.sbomify.com/CVE-2026-101068/): dbgate Create Connection Endpoint zipJsonLinesData.js zipJsonLinesData path traversal (medium 6.9)
- [CVE-2026-101067](https://insights.sbomify.com/CVE-2026-101067/): dbgate save-uploaded-file Endpoint files.js saveUploadedFile path traversal (medium 6.9)
- [CVE-2026-101066](https://insights.sbomify.com/CVE-2026-101066/): dbgate Archive Link Creation archive.js createLink path traversal (medium 6.9)
- [CVE-2026-101065](https://insights.sbomify.com/CVE-2026-101065/): Obot Quickstart Docker Deployment Unauthenticated Admin Access (critical 9.3)
- [CVE-2026-101064](https://insights.sbomify.com/CVE-2026-101064/): Obot before v0.23.0 Server-Side Request Forgery via MCP (high 8.3)
- [CVE-2026-101063](https://insights.sbomify.com/CVE-2026-101063/): Obot before v0.23.0 Authentication Bypass via Registry API (medium 6.9)
- [CVE-2026-101062](https://insights.sbomify.com/CVE-2026-101062/): Obot before v0.23.0 Authentication Bypass via OAuth Dynamic Client Registration (high 8.7)
- [CVE-2026-101061](https://insights.sbomify.com/CVE-2026-101061/): utcp-gql and utcp-websocket before 1.1.1 SSRF via URL validation bypass (low 2.3)
- [CVE-2026-101060](https://insights.sbomify.com/CVE-2026-101060/): python-utcp before 1.1.4 SSRF via unvalidated HTTP redirects (high 8.4)
- [CVE-2026-10106](https://insights.sbomify.com/CVE-2026-10106/): Missing authorization in Mattermost (medium 6.5)
- [CVE-2026-101059](https://insights.sbomify.com/CVE-2026-101059/): utcp-http before 1.1.4 OAuth2 tokenUrl Trust Boundary Bypass (high 7.1)
- [CVE-2026-101058](https://insights.sbomify.com/CVE-2026-101058/): python-utcp before 1.1.12 SSRF via Remote HTTP Manual (high 7.1)
- [CVE-2026-101057](https://insights.sbomify.com/CVE-2026-101057/): utcp-mcp before 1.1.3 SSRF via unvalidated MCP server URL (low 2.3)
- [CVE-2026-101056](https://insights.sbomify.com/CVE-2026-101056/): Cloudreve before 4.16.1 Authentication Bypass via Cached Context Hint (medium 6.9)
- [CVE-2026-101055](https://insights.sbomify.com/CVE-2026-101055/): Thinkware U3000 TCP Service GET_STATUS information disclosure (medium 6.9)
- [CVE-2026-101054](https://insights.sbomify.com/CVE-2026-101054/): Thinkware U3000 TCP Service wpa_supplicant.conf get_file access control (medium 6.9)
- [CVE-2026-101053](https://insights.sbomify.com/CVE-2026-101053/): Thinkware U3000 TCP Service wpa_supplicant.conf PUT_FILE access control (medium 6.9)
- [CVE-2026-101052](https://insights.sbomify.com/CVE-2026-101052/): refly-ai refly JWT Token app.config.ts hard-coded credentials (medium 6.9)
- [CVE-2026-101051](https://insights.sbomify.com/CVE-2026-101051/): Cloudreve before 4.16.1 Path Traversal via Remote Download (low 2.3)
- [CVE-2026-101050](https://insights.sbomify.com/CVE-2026-101050/): Heym before 0.0.53 Authentication Bypass via Telegram Webhook (high 8.3)
- [CVE-2026-10105](https://insights.sbomify.com/CVE-2026-10105/): agno 2.6.5 SQL Injection via ClickHouse delete_by_metadata() (high 8.7)
- [CVE-2026-101049](https://insights.sbomify.com/CVE-2026-101049/): Heym before 0.0.53 Slack Webhook Signature Verification Bypass (high 8.3)
- [CVE-2026-101048](https://insights.sbomify.com/CVE-2026-101048/): Cloudreve before 4.17.0 SSRF via Admin.Read OAuth scope (medium 5.3)
- [CVE-2026-101047](https://insights.sbomify.com/CVE-2026-101047/): Fleet before 4.87.0 Unauthenticated iOS App Download via Predictable URLs (medium 6.9)
- [CVE-2026-101046](https://insights.sbomify.com/CVE-2026-101046/): Fleet before 4.89.0 SQL Injection via ORDER BY Activity Endpoints (low 2.3)
- [CVE-2026-101045](https://insights.sbomify.com/CVE-2026-101045/): Fleet Homebrew Cask OS Command Injection via Metadata (high 8.9)
- [CVE-2026-101044](https://insights.sbomify.com/CVE-2026-101044/): pacquet before 12.0.0-alpha.5 Path Traversal via lockfile alias (high 7.1)
- [CVE-2026-101043](https://insights.sbomify.com/CVE-2026-101043/): pnpm 11.0.0 before 11.11.0 Environment Variable Exfiltration via Proxy Settings (high 8.3)
- [CVE-2026-101042](https://insights.sbomify.com/CVE-2026-101042/): Parse Server 9.0.0 Authentication Bypass via Unverified Provider Identity (high 7.4)
- [CVE-2026-101041](https://insights.sbomify.com/CVE-2026-101041/): Vulnerability-Lookup - Race Condition in Account Recovery Token Consumption Allows Password Takeover (medium 6.3)
- [CVE-2026-101040](https://insights.sbomify.com/CVE-2026-101040/): Ricoh SP 330DN/SP 221/SP C252SF/Aficio SP 3500SF HTTP Multipart Form-Data denial of service (high 7.1)
- [CVE-2026-10104](https://insights.sbomify.com/CVE-2026-10104/): Cross-site scripting in Product Video Gallery for Woocommerce (medium 4.4)
- [CVE-2026-101039](https://insights.sbomify.com/CVE-2026-101039/): FAST FAC1900R devdiscover Service copy_msg_element stack-based overflow (critical 10.0)
- [CVE-2026-101038](https://insights.sbomify.com/CVE-2026-101038/): FAST FAC1200R MmtAtePrase stack-based overflow (critical 9.4)
- [CVE-2026-101037](https://insights.sbomify.com/CVE-2026-101037/): FAST FAC1200R devdiscover Service parse_advertisement_frame stack-based overflow (critical 9.4)
- [CVE-2026-101036](https://insights.sbomify.com/CVE-2026-101036/): FLB-Music FLB-Music-Player createParsedTrack.ts path.join path traversal (medium 4.8)
- [CVE-2026-101035](https://insights.sbomify.com/CVE-2026-101035/): aligungr UERANSIM nr-gnb encode.cpp DecodePlainMmMessage uncaught exception (medium 6.9)
- [CVE-2026-101034](https://insights.sbomify.com/CVE-2026-101034/): Security Advisory for offline recovery of Symantec GSS 3.3 RU11 stored domain credentials (medium 6.8)
- [CVE-2026-101033](https://insights.sbomify.com/CVE-2026-101033/): KitchenOwl through 0.7.10 IDOR via unchecked category ID (medium 5.3)
- [CVE-2026-101032](https://insights.sbomify.com/CVE-2026-101032/): navi through 2.24.0 OS Command Injection via Cheatsheet Variables (high 7.3)
- [CVE-2026-10103](https://insights.sbomify.com/CVE-2026-10103/): Missing authorization in Mattermost (medium 4.3)
- [CVE-2026-101029](https://insights.sbomify.com/CVE-2026-101029/): Gitea migration and pull mirror SSRF through multi-answer DNS (medium 4.3)
- [CVE-2026-101028](https://insights.sbomify.com/CVE-2026-101028/): Ash.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters and sorts (medium 6.0)
- [CVE-2026-101027](https://insights.sbomify.com/CVE-2026-101027/): Gitea migration SSRF through ALLOWED_DOMAINS address check bypass (high 7.7)
- [CVE-2026-101025](https://insights.sbomify.com/CVE-2026-101025/): NGINX ngx_http_js_module vulnerability (medium 6.9)
- [CVE-2026-101024](https://insights.sbomify.com/CVE-2026-101024/): Satel Netco Design Relative path traversal (high 8.7)
- [CVE-2026-101023](https://insights.sbomify.com/CVE-2026-101023/): Gitea OAuth2 refresh token grant accepts access tokens (critical 9.1)
- [CVE-2026-101022](https://insights.sbomify.com/CVE-2026-101022/): Grid Protection Alliance openPDC and openHistorian Server-Side Request Forgery (SSRF) (medium 5.3)
- [CVE-2026-101021](https://insights.sbomify.com/CVE-2026-101021/): J4Care dcm4che Inefficient Algorithmic Complexity (high 8.7)
- [CVE-2026-101020](https://insights.sbomify.com/CVE-2026-101020/): Privilege escalation in AssetView (high 8.5)
- [CVE-2026-101019](https://insights.sbomify.com/CVE-2026-101019/): NGINX ngx_http_js_module vulnerability (high 8.3)
- [CVE-2026-101018](https://insights.sbomify.com/CVE-2026-101018/): dayrui XunruiCMS Group Editing Home.php group_all_edit sql injection (medium 5.1)
- [CVE-2026-101017](https://insights.sbomify.com/CVE-2026-101017/): Trusted Domain Project OpenDMARC opendmarc_policy.c strcasecmp exceptional condition (medium 6.9)
- [CVE-2026-101016](https://insights.sbomify.com/CVE-2026-101016/): Trusted Domain Project OpenDMARC opendmarc_policy.c opendmarc_policy_parse_dmarc exceptional condition (medium 6.9)
- [CVE-2026-101015](https://insights.sbomify.com/CVE-2026-101015/): Trusted Domain Project OpenDMARC policy.c improper validation of unsafe equivalence in input (medium 6.9)
- [CVE-2026-101014](https://insights.sbomify.com/CVE-2026-101014/): Trusted Domain Project OpenDMARC DMARC Record opendmarc_util.c opendmarc_util_cleanup off-by-one (medium 6.9)
- [CVE-2026-101013](https://insights.sbomify.com/CVE-2026-101013/): mathurvishal CloudClassroom-PHP-Project updateresultdetails.php sql injection (medium 6.9)
- [CVE-2026-101012](https://insights.sbomify.com/CVE-2026-101012/): mathurvishal CloudClassroom-PHP-Project makeresult.php sql injection (medium 6.9)
- [CVE-2026-101011](https://insights.sbomify.com/CVE-2026-101011/): aaPanel BaoTa Domain domainMod.py get_domain_status sql injection (medium 5.1)
- [CVE-2026-101010](https://insights.sbomify.com/CVE-2026-101010/): aaPanel BaoTa data.py getData sql injection (medium 5.1)
- [CVE-2026-10101](https://insights.sbomify.com/CVE-2026-10101/): Assisted-service: assisted-service: infraenv status leaks referenced pull-secret contents to namespace view users (medium 6.3)
- [CVE-2026-101009](https://insights.sbomify.com/CVE-2026-101009/): aaPanel BaoTa Unzip panelTask.py panelTask.bt_task._unzip os command injection (critical 9.3)
- [CVE-2026-101008](https://insights.sbomify.com/CVE-2026-101008/): aaPanel BaoTa File Merge files.py merge_split_file command injection (critical 9.4)
- [CVE-2026-101007](https://insights.sbomify.com/CVE-2026-101007/): aaPanel BaoTa Database Backup database.py InputSql os command injection (critical 9.3)
- [CVE-2026-101006](https://insights.sbomify.com/CVE-2026-101006/): Frappe HR Permission Validation __init__.py get_attendance_requests authorization (medium 5.3)
- [CVE-2026-101005](https://insights.sbomify.com/CVE-2026-101005/): October CMS SSRF Protection ResizeImages.php validateExternalImageHost server-side request forgery (medium 6.9)
- [CVE-2026-101004](https://insights.sbomify.com/CVE-2026-101004/): notionnext-org NotionNext Authentication Guard cache.js cleanCache missing authentication (medium 6.9)
- [CVE-2026-101003](https://insights.sbomify.com/CVE-2026-101003/): Cesanta Mongoose MQTT Broker main.c fn stack-based overflow (medium 6.9)
- [CVE-2026-101002](https://insights.sbomify.com/CVE-2026-101002/): Netcore NBR200V2 Tools Ping network_tools system os command injection (critical 9.4)
- [CVE-2026-101001](https://insights.sbomify.com/CVE-2026-101001/): Netcore NBR200V2 Web Management network_tools eval os command injection (critical 10.0)
- [CVE-2026-101000](https://insights.sbomify.com/CVE-2026-101000/): Netcore NBR100V2 ACL unauthenticated.json uci.apply authorization (critical 10.0)
- [CVE-2026-10100](https://insights.sbomify.com/CVE-2026-10100/): Simple Custom Login Page <= 1.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2026-1010](https://insights.sbomify.com/CVE-2026-1010/): Stored Cross-Site Scripting in Altium Enterprise Server Workflow Engine Allows Privilege Escalation (high 8.0)
- [CVE-2026-10099](https://insights.sbomify.com/CVE-2026-10099/): XX-Net V5.16.6 WebSocket Frame Parsing Data Corruption via simple_http_server.py (medium 5.1)
- [CVE-2026-10098](https://insights.sbomify.com/CVE-2026-10098/): OCSP CertID serial-number length-confusion in wolfSSL_OCSP_resp_find_status (medium 6.3)
- [CVE-2026-10097](https://insights.sbomify.com/CVE-2026-10097/): ML-KEM-1024 x64 AVX2 incomplete cipher text comparison enables IND-CCA2 break and static private-key recovery (high 8.3)
- [CVE-2026-10096](https://insights.sbomify.com/CVE-2026-10096/): Missing authorization in Qi Blocks (medium 4.3)
- [CVE-2026-10095](https://insights.sbomify.com/CVE-2026-10095/): Cross-site scripting in WP Photo Album Plus (medium 6.4)
- [CVE-2026-10094](https://insights.sbomify.com/CVE-2026-10094/): Path traversal in SOLIDWORKS Visualize (critical 9.8)
- [CVE-2026-10093](https://insights.sbomify.com/CVE-2026-10093/): Cross-site scripting in Secure Client Portal and Private File Sharing Plugin – User Private Files (medium 6.4)
- [CVE-2026-10092](https://insights.sbomify.com/CVE-2026-10092/): Cross-site scripting in Cincopa video and media plug-in (high 7.2)
- [CVE-2026-10091](https://insights.sbomify.com/CVE-2026-10091/): Email JavaScript Cloak <= 1.03 - Unauthenticated Stored Cross-Site Scripting (high 7.2)
- [CVE-2026-100909](https://insights.sbomify.com/CVE-2026-100909/): OctoberCMS ResizeImages.php getSourcePathForResize server-side request forgery (medium 6.9)
- [CVE-2026-100908](https://insights.sbomify.com/CVE-2026-100908/): Eyeplus p2pcam HTTP stack-based overflow (high 8.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/998/