# Vulnerabilities published in 2026


- [CVE-2026-100907](https://insights.sbomify.com/CVE-2026-100907/): Eyeplus p2pcam Service snapshot information disclosure (medium 6.9)
- [CVE-2026-100906](https://insights.sbomify.com/CVE-2026-100906/): Eyeplus ONVIF Device GetUsers information disclosure (medium 6.9)
- [CVE-2026-100904](https://insights.sbomify.com/CVE-2026-100904/): amirsanni mini-inventory-and-sales-management-system Items Management Items.php cross site scripting (medium 5.1)
- [CVE-2026-100903](https://insights.sbomify.com/CVE-2026-100903/): ООО НПО Ритм GEOritm REST API obj-groups missing authentication (medium 6.9)
- [CVE-2026-100902](https://insights.sbomify.com/CVE-2026-100902/): Barco ClickShare CX-20 Gen2 Wallpaper Upload wallpaper improper validation of syntactic correctness of input (high 7.1)
- [CVE-2026-100901](https://insights.sbomify.com/CVE-2026-100901/): athlon1600 youtube-downloader stream.php stream server-side request forgery (medium 6.9)
- [CVE-2026-100900](https://insights.sbomify.com/CVE-2026-100900/): DevaslanPHP project-management Jira Import jira-import updateJiraProjects server-side request forgery (medium 5.1)
- [CVE-2026-10090](https://insights.sbomify.com/CVE-2026-10090/): Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2.11 (critical 9.0)
- [CVE-2026-1009](https://insights.sbomify.com/CVE-2026-1009/): Stored Cross-Site Scripting in Altium Live Forum Leading to Cross-Customer Data Exposure (critical 9.0)
- [CVE-2026-100899](https://insights.sbomify.com/CVE-2026-100899/): DevaslanPHP project-management Timesheet Dashboard MonthlyReport.php whereRaw sql injection (medium 5.3)
- [CVE-2026-100898](https://insights.sbomify.com/CVE-2026-100898/): DevaslanPHP project-management Timesheet Dashboard ActivitiesReport.php whereRaw sql injection (medium 5.3)
- [CVE-2026-100897](https://insights.sbomify.com/CVE-2026-100897/): fuzui StudentInfo Password Change Endpoint moditypasswordstu authorization (medium 5.1)
- [CVE-2026-100896](https://insights.sbomify.com/CVE-2026-100896/): TOTOLINK N150RT Web Management formWlSiteSurvey system os command injection (critical 9.4)
- [CVE-2026-100895](https://insights.sbomify.com/CVE-2026-100895/): Trusted Domain Project OpenARC libopenarc arc-canon.c arc_parse_canon_t null pointer dereference (medium 6.9)
- [CVE-2026-100894](https://insights.sbomify.com/CVE-2026-100894/): mathurvishal CloudClassroom-PHP-Project updateguest.php sql injection (medium 5.3)
- [CVE-2026-100893](https://insights.sbomify.com/CVE-2026-100893/): Privoce VoceChat Server open_graphic_parse Endpoint resource.rs fetch server-side request forgery (medium 6.9)
- [CVE-2026-100892](https://insights.sbomify.com/CVE-2026-100892/): aligungr UERANSIM nr-gnb handler.cpp ULInformationTransfer memory corruption (medium 6.9)
- [CVE-2026-100891](https://insights.sbomify.com/CVE-2026-100891/): Security feature bypass in OpenDMARC (medium 6.9)
- [CVE-2026-100890](https://insights.sbomify.com/CVE-2026-100890/): Trusted Domain Project OpenDMARC SPF Parser opendmarc_spf.c opendmarc_spf_ipv6_explode null pointer dereference (medium 6.9)
- [CVE-2026-10089](https://insights.sbomify.com/CVE-2026-10089/): Insert Pages <= 3.11.4 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Field Keys (Meta Key Names) (medium 6.4)
- [CVE-2026-100889](https://insights.sbomify.com/CVE-2026-100889/): Trusted Domain Project OpenDKIM Decoder util.c dkim_qp_decode off-by-one (medium 6.9)
- [CVE-2026-100888](https://insights.sbomify.com/CVE-2026-100888/): Trusted Domain Project OpenDKIM DKIM Signature Header Selection dkim-canon.c dkim_canon_selecthdrs out-of-bounds write (medium 6.9)
- [CVE-2026-100887](https://insights.sbomify.com/CVE-2026-100887/): amirsanni Mini-Inventory-and-Sales-Management-System Database Query Builder DB_query_builder.php order_by sql injection (medium 5.3)
- [CVE-2026-100886](https://insights.sbomify.com/CVE-2026-100886/): Seetong T8108/T8108P/T8116/T8232 Debug Service improper authentication (critical 10.0)
- [CVE-2026-100885](https://insights.sbomify.com/CVE-2026-100885/): Krayin laravel-crm admin-config-setup API Endpoint CanInstall.php authorization (medium 6.9)
- [CVE-2026-100884](https://insights.sbomify.com/CVE-2026-100884/): Krayin laravel-crm attachment-download Endpoint acl.php resource injection (medium 5.3)
- [CVE-2026-100883](https://insights.sbomify.com/CVE-2026-100883/): Krayin laravel-crm acl.php access control (medium 5.3)
- [CVE-2026-100882](https://insights.sbomify.com/CVE-2026-100882/): Krayin laravel-crm Admin Settings Endpoint index.blade.php cross site scripting (medium 4.8)
- [CVE-2026-100881](https://insights.sbomify.com/CVE-2026-100881/): zhistaredu StarTraining application.yml cross site scripting (low 2.1)
- [CVE-2026-100880](https://insights.sbomify.com/CVE-2026-100880/): zhistaredu StarTraining Upload Endpoint MimeTypeUtils.java cross site scripting (medium 5.1)
- [CVE-2026-100879](https://insights.sbomify.com/CVE-2026-100879/): zhistaredu StarTraining dataScope Endpoint SysRoleServiceImpl.java checkRoleAllowed authorization (medium 5.3)
- [CVE-2026-100878](https://insights.sbomify.com/CVE-2026-100878/): zhistaredu StarTraining authRole Endpoint SysUser.java SysUser.isAdmin authorization (medium 5.3)
- [CVE-2026-100877](https://insights.sbomify.com/CVE-2026-100877/): mathurvishal CloudClassroom-PHP-Project registrationform.php cross site scripting (medium 5.3)
- [CVE-2026-100876](https://insights.sbomify.com/CVE-2026-100876/): mathurvishal CloudClassroom-PHP-Project loginlinkstudent.php missing authentication (medium 5.3)
- [CVE-2026-100875](https://insights.sbomify.com/CVE-2026-100875/): mathurvishal CloudClassroom-PHP-Project updatedetailsfromfaculty.php sql injection (medium 6.9)
- [CVE-2026-100874](https://insights.sbomify.com/CVE-2026-100874/): mathurvishal CloudClassroom-PHP-Project addnewstudent.php sql injection (medium 6.9)
- [CVE-2026-100873](https://insights.sbomify.com/CVE-2026-100873/): mathurvishal CloudClassroom-PHP-Project cross-site request forgery (medium 5.3)
- [CVE-2026-100872](https://insights.sbomify.com/CVE-2026-100872/): Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite (high 8.7)
- [CVE-2026-100871](https://insights.sbomify.com/CVE-2026-100871/): Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 JWT Audience Confusion Allows Admin API Authentication (high 8.7)
- [CVE-2026-100870](https://insights.sbomify.com/CVE-2026-100870/): Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning via Host Header (high 8.7)
- [CVE-2026-10087](https://insights.sbomify.com/CVE-2026-10087/): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (high 8.7)
- [CVE-2026-100869](https://insights.sbomify.com/CVE-2026-100869/): Sylius 2.x before 2.1.16 and 2.2.9 Arbitrary Payment Action via Shop API (high 8.2)
- [CVE-2026-100868](https://insights.sbomify.com/CVE-2026-100868/): Penpot before 2.18.0 Unauthenticated WebSocket Access via MCP Bridge (medium 5.3)
- [CVE-2026-100867](https://insights.sbomify.com/CVE-2026-100867/): spaceship-prompt through 4.22.5 Terminal Escape Sequence Injection (medium 4.8)
- [CVE-2026-100866](https://insights.sbomify.com/CVE-2026-100866/): onefetch through 2.28.1 Terminal Escape Sequence Injection (medium 4.8)
- [CVE-2026-100865](https://insights.sbomify.com/CVE-2026-100865/): Heym before 0.0.53 Remote Code Execution via eval() Sandbox Escape (high 8.7)
- [CVE-2026-100864](https://insights.sbomify.com/CVE-2026-100864/): heym before 0.0.91 Remote Code Execution via Expression Engine (high 8.7)
- [CVE-2026-100863](https://insights.sbomify.com/CVE-2026-100863/): Heym before 0.0.91 SSRF via image fetching and IPv6 validation (medium 5.3)
- [CVE-2026-100862](https://insights.sbomify.com/CVE-2026-100862/): heym before 0.0.91 Multiple Secrets Plaintext Storage (medium 6.9)
- [CVE-2026-100861](https://insights.sbomify.com/CVE-2026-100861/): heym before 0.0.105 SSRF via credential-controlled base URLs (medium 5.3)
- [CVE-2026-100860](https://insights.sbomify.com/CVE-2026-100860/): heym before 0.0.105 Authentication Bypass via Redis Node (medium 6.8)
- [CVE-2026-10086](https://insights.sbomify.com/CVE-2026-10086/): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (high 8.7)
- [CVE-2026-100859](https://insights.sbomify.com/CVE-2026-100859/): Heym before 0.0.106 Credential Exfiltration via URL Override (high 7.1)
- [CVE-2026-100858](https://insights.sbomify.com/CVE-2026-100858/): heym before 0.0.109 Server-Side Request Forgery via Workflow Nodes (high 7.6)
- [CVE-2026-100857](https://insights.sbomify.com/CVE-2026-100857/): AzuraCast before 0.23.4 Remote Code Execution via Liquidsoap string interpolation (high 8.6)
- [CVE-2026-100856](https://insights.sbomify.com/CVE-2026-100856/): AzuraCast before 0.23.6 Code Injection via Remote Relay Password (high 8.7)
- [CVE-2026-100855](https://insights.sbomify.com/CVE-2026-100855/): AzuraCast before 0.23.6 Missing Permission Check via /play (high 7.1)
- [CVE-2026-100854](https://insights.sbomify.com/CVE-2026-100854/): AzuraCast before 0.23.6 Metadata Injection via Liquidsoap API (medium 5.3)
- [CVE-2026-100853](https://insights.sbomify.com/CVE-2026-100853/): AzuraCast before 0.23.8 On-Demand Download Endpoint Authorization Bypass (high 8.2)
- [CVE-2026-100852](https://insights.sbomify.com/CVE-2026-100852/): AzuraCast before 0.23.8 Command Injection via Streamer Username (high 8.7)
- [CVE-2026-100851](https://insights.sbomify.com/CVE-2026-100851/): AzuraCast before 0.23.8 Broken Access Control via GET /api/station/{id}/vue/profile (high 7.2)
- [CVE-2026-100850](https://insights.sbomify.com/CVE-2026-100850/): AzuraCast before 0.23.8 SSRF and Local File Read via Remote Playlist (medium 4.8)
- [CVE-2026-10085](https://insights.sbomify.com/CVE-2026-10085/): Ordinary group/direct message member can enable group_constrained and remove all channel participants (medium 5.4)
- [CVE-2026-100849](https://insights.sbomify.com/CVE-2026-100849/): AzuraCast before 0.23.8 SSRF Filter Bypass via Hostname and Private IPs (high 7.1)
- [CVE-2026-100848](https://insights.sbomify.com/CVE-2026-100848/): AzuraCast before 0.23.8 Server-Side Request Forgery via Remote Relay URL (high 7.1)
- [CVE-2026-100847](https://insights.sbomify.com/CVE-2026-100847/): AzuraCast before 0.23.8 DQL Injection via sortOrder (high 8.7)
- [CVE-2026-100846](https://insights.sbomify.com/CVE-2026-100846/): MONAI before 1.5.2 Remote Code Execution via Pickle Deserialization (high 8.8)
- [CVE-2026-100845](https://insights.sbomify.com/CVE-2026-100845/): MONAI before 1.6.0 Remote Code Execution via NumpyReader (high 8.5)
- [CVE-2026-100844](https://insights.sbomify.com/CVE-2026-100844/): MONAI before 1.6.0 OS Command Injection via dataset_name_or_id (high 8.6)
- [CVE-2026-100843](https://insights.sbomify.com/CVE-2026-100843/): MONAI before 1.6.0 Remote Code Execution via algo_from_pickle (high 8.5)
- [CVE-2026-100842](https://insights.sbomify.com/CVE-2026-100842/): MONAI through 1.6.0 _get_fake_spatial_shape eval() Sandbox Bypass via Attribute Chains (high 7.3)
- [CVE-2026-100841](https://insights.sbomify.com/CVE-2026-100841/): MONAI through 1.6.0 PersistentDataset Remote Code Execution via Pickle Cache (high 8.5)
- [CVE-2026-100840](https://insights.sbomify.com/CVE-2026-100840/): MONAI through 1.6.0 Remote Code Execution via bundle configuration (high 8.5)
- [CVE-2026-100839](https://insights.sbomify.com/CVE-2026-100839/): Contrast before 1.18.0 AML Injection Remote Code Execution (high 8.4)
- [CVE-2026-100838](https://insights.sbomify.com/CVE-2026-100838/): Contrast before 1.19.1 CopyFile Policy Symlink Subversion (high 8.6)
- [CVE-2026-100837](https://insights.sbomify.com/CVE-2026-100837/): Edgeless Systems Contrast through 1.20.0 Credential Leak via Registry Suffix Matching (medium 6.3)
- [CVE-2026-100836](https://insights.sbomify.com/CVE-2026-100836/): Edgeless Systems Contrast through 1.20.0 Denial of Service via ciphertextContainer (medium 5.3)
- [CVE-2026-100835](https://insights.sbomify.com/CVE-2026-100835/): Contrast before 1.16.0 Remote Attestation Relay Attack (critical 9.1)
- [CVE-2026-100834](https://insights.sbomify.com/CVE-2026-100834/): http4k before 6.48.0.0 Digest Authentication Replay Protection Bypass (high 8.2)
- [CVE-2026-100833](https://insights.sbomify.com/CVE-2026-100833/): Contrast before 1.23.1 Image Substitution via Policy Generation (high 8.6)
- [CVE-2026-100832](https://insights.sbomify.com/CVE-2026-100832/): Use-after-free in the Graphics: Canvas2D component (high 8.8)
- [CVE-2026-100831](https://insights.sbomify.com/CVE-2026-100831/): Use-after-free in the DOM: UI Events & Focus Handling component (high 8.8)
- [CVE-2026-100830](https://insights.sbomify.com/CVE-2026-100830/): Mitigation bypass in the DOM: Navigation component (high 8.1)
- [CVE-2026-10083](https://insights.sbomify.com/CVE-2026-10083/): APCu Manager < 4.5.0 - Unauthenticated Stored XSS via Cache Key Pollution (high 7.5)
- [CVE-2026-100829](https://insights.sbomify.com/CVE-2026-100829/): Mitigation bypass in the DOM: Security component (critical 9.6)
- [CVE-2026-100828](https://insights.sbomify.com/CVE-2026-100828/): Mitigation bypass in the Bookmarks & History component (critical 9.6)
- [CVE-2026-100826](https://insights.sbomify.com/CVE-2026-100826/): Denial-of-service in the Storage: StorageManager component (medium 6.5)
- [CVE-2026-100825](https://insights.sbomify.com/CVE-2026-100825/): Use-after-free in the JavaScript Engine: JIT component (high 8.8)
- [CVE-2026-100824](https://insights.sbomify.com/CVE-2026-100824/): Privilege escalation in the Places component (high 8.8)
- [CVE-2026-100823](https://insights.sbomify.com/CVE-2026-100823/): Spoofing issue in the Downloads component in Firefox for Android (medium 5.4)
- [CVE-2026-100822](https://insights.sbomify.com/CVE-2026-100822/): Spoofing issue in the Networking: HTTP component (medium 5.4)
- [CVE-2026-100821](https://insights.sbomify.com/CVE-2026-100821/): Site isolation issue in the Panning and Zooming component (medium 4.7)
- [CVE-2026-100820](https://insights.sbomify.com/CVE-2026-100820/): Privilege escalation in the Address Bar component (high 8.8)
- [CVE-2026-10082](https://insights.sbomify.com/CVE-2026-10082/): Advanced Ads – Ad Manager & AdSense < 2.0.23 - Contributor+ Stored XSS via the_ad Shortcode 'ad_args' Parameter (medium 6.1)
- [CVE-2026-100819](https://insights.sbomify.com/CVE-2026-100819/): Sandbox escape due to incorrect boundary conditions in the XPCOM component (critical 9.6)
- [CVE-2026-100818](https://insights.sbomify.com/CVE-2026-100818/): Sandbox escape due to use-after-free in the Widget: Gtk component (critical 9.6)
- [CVE-2026-100817](https://insights.sbomify.com/CVE-2026-100817/): Other issue in the JavaScript: WebAssembly component (medium 5.4)
- [CVE-2026-100816](https://insights.sbomify.com/CVE-2026-100816/): Site isolation issue in the DOM: Networking component (high 8.1)
- [CVE-2026-100815](https://insights.sbomify.com/CVE-2026-100815/): Use-after-free in the CSS Parsing and Computation component (high 8.8)
- [CVE-2026-100814](https://insights.sbomify.com/CVE-2026-100814/): Incorrect boundary conditions in the JavaScript Engine: JIT component (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/999/