# Vulnerabilities published in 2026


- [CVE-2026-108728](https://insights.sbomify.com/CVE-2026-108728/): Flyte 2.0.1 through 2.0.51 Cleartext Secret Exposure via Admission Webhook (high 7.1)
- [CVE-2026-108727](https://insights.sbomify.com/CVE-2026-108727/): EdgeEver through 1.108.0 Missing Authorization via Memo-Template API Routes (medium 5.3)
- [CVE-2026-108726](https://insights.sbomify.com/CVE-2026-108726/): GLPI through 12.0.0 Missing Authorization via ajax/map.php (medium 5.3)
- [CVE-2026-108725](https://insights.sbomify.com/CVE-2026-108725/): Cheshire Cat AI core through 2.0.23 Stored XSS via uploads plugin (medium 5.1)
- [CVE-2026-108724](https://insights.sbomify.com/CVE-2026-108724/): Sylius through 2.3.0 Authorization Bypass via Shop API Product-Review Endpoint (medium 6.9)
- [CVE-2026-108723](https://insights.sbomify.com/CVE-2026-108723/): answer-me-with-html through 0.5.0 Symlink Following in Code Block src Embedding (low 2.0)
- [CVE-2026-108722](https://insights.sbomify.com/CVE-2026-108722/): open-computer-use through commit 610bac8 Stored XSS via log.html Session Log (low 2.3)
- [CVE-2026-108721](https://insights.sbomify.com/CVE-2026-108721/): Open Computer Use through 1.0.0 Denylist Bypass via Case-Variant Bundle ID (medium 5.8)
- [CVE-2026-108720](https://insights.sbomify.com/CVE-2026-108720/): phpIPAM through 1.8.3 Missing Authorization in Customers, Locations and NAT Pages (medium 5.3)
- [CVE-2026-10872](https://insights.sbomify.com/CVE-2026-10872/): Shibby Tomato Web UI rc start_vpnserver os command injection (high 8.6)
- [CVE-2026-108719](https://insights.sbomify.com/CVE-2026-108719/): LLMGateway through 1.20.0 Blind SSRF via Video-Generation callback_url (medium 5.3)
- [CVE-2026-108718](https://insights.sbomify.com/CVE-2026-108718/): Rill 0.77.0 through 0.90.5 OAuth Missing Authorization via Dynamic Client Registration (high 8.6)
- [CVE-2026-108717](https://insights.sbomify.com/CVE-2026-108717/): Combodo iTop 3.1.0 through 3.3.0 Missing Authorization via LinkSetController (medium 5.3)
- [CVE-2026-108716](https://insights.sbomify.com/CVE-2026-108716/): mcp-remote 0.8.0 through 0.14.3 Cleartext Credential Transmission via --device-code OAuth Grant (medium 6.0)
- [CVE-2026-108715](https://insights.sbomify.com/CVE-2026-108715/): LibreNMS through 26.9.1.1 Authorization Bypass via Smokeping Graph auth.inc.php (medium 5.3)
- [CVE-2026-108714](https://insights.sbomify.com/CVE-2026-108714/): MCP Kotlin SDK through 0.15.0 Memory Exhaustion via Application.mcpWebSocket (high 8.7)
- [CVE-2026-108713](https://insights.sbomify.com/CVE-2026-108713/): SuiteCRM through 7.15.2 and 8.10.2 Missing Authorization via setCampaignMarketingAndTemplate (medium 5.3)
- [CVE-2026-108712](https://insights.sbomify.com/CVE-2026-108712/): SuiteCRM through 7.15.2 and 8.10.2 Missing Authorization via DetailUserRole Entry Point (medium 5.3)
- [CVE-2026-108711](https://insights.sbomify.com/CVE-2026-108711/): Plastic Labs Honcho through 3.3.0 Incorrect Authorization via POST /v3/workspaces (medium 5.3)
- [CVE-2026-108710](https://insights.sbomify.com/CVE-2026-108710/): NornicDB through 1.4.1 Missing Authorization via Vector Search Endpoints (high 7.1)
- [CVE-2026-10871](https://insights.sbomify.com/CVE-2026-10871/): Shibby Tomato Web UI rc start_6rd_tunnel os command injection (high 8.6)
- [CVE-2026-108709](https://insights.sbomify.com/CVE-2026-108709/): Apache Kylin: Unauthenticated Metadata Broadcast (inside in-house network) (critical 9.8)
- [CVE-2026-108708](https://insights.sbomify.com/CVE-2026-108708/): Wukong_HRM through commit 186115e Missing Authorization via EmployeeAspect and EmployeeUtil (high 8.7)
- [CVE-2026-108707](https://insights.sbomify.com/CVE-2026-108707/): Wukong_HRM through commit 186115e Authentication Bypass via ParamAspect (critical 9.3)
- [CVE-2026-108706](https://insights.sbomify.com/CVE-2026-108706/): eladmin through commit 55fbf70 Missing Authorization via S3 Storage Download Endpoint (medium 5.3)
- [CVE-2026-108705](https://insights.sbomify.com/CVE-2026-108705/): CordysCRM through 1.9.3 Missing Authorization via /custom-form/data/import (medium 5.3)
- [CVE-2026-108704](https://insights.sbomify.com/CVE-2026-108704/): CordysCRM through 1.9.3 Authorization Bypass via Follow-Up Record Add Endpoints (medium 5.3)
- [CVE-2026-108703](https://insights.sbomify.com/CVE-2026-108703/): CordysCRM through 1.9.3 Missing Authorization via /approval-resource/push (medium 5.3)
- [CVE-2026-108702](https://insights.sbomify.com/CVE-2026-108702/): CordysCRM through 1.9.3 Missing Authorization and Blind SSRF via Webhook Test (medium 5.3)
- [CVE-2026-108701](https://insights.sbomify.com/CVE-2026-108701/): 1Panel-dev CordysCRM before 1.9.2 Missing Authorization via POST /contract/sort (medium 5.3)
- [CVE-2026-108700](https://insights.sbomify.com/CVE-2026-108700/): 1Panel-dev CordysCRM before 1.9.2 Missing Authorization via /field/source/business-title (high 7.1)
- [CVE-2026-10870](https://insights.sbomify.com/CVE-2026-10870/): Shibby Tomato Web UI rc start_dhcpc os command injection (high 8.6)
- [CVE-2026-1087](https://insights.sbomify.com/CVE-2026-1087/): The Guardian News Feed <= 1.2 - Cross-Site Request Forgery to Settings Update (medium 4.3)
- [CVE-2026-108699](https://insights.sbomify.com/CVE-2026-108699/): hyper-mcp through 0.8.3 Improper Signature Verification of OCI WebAssembly Plugins (high 8.3)
- [CVE-2026-108698](https://insights.sbomify.com/CVE-2026-108698/): hyper-mcp through 0.8.3 OCI Plugin Signature Verification TOCTOU Race Condition (high 8.3)
- [CVE-2026-108697](https://insights.sbomify.com/CVE-2026-108697/): CoreShop through 2026.2.2 Missing Authorization via ResourceController listAction (medium 5.3)
- [CVE-2026-108696](https://insights.sbomify.com/CVE-2026-108696/): CoreShop through 1.5.5 Authorization Bypass via OrderController OrderConfirm and SendReship (medium 5.3)
- [CVE-2026-108695](https://insights.sbomify.com/CVE-2026-108695/): MultiVendorX through 5.0.19 Incorrect Authorization via Settings REST Endpoint (high 7.1)
- [CVE-2026-108694](https://insights.sbomify.com/CVE-2026-108694/): ConvertX through 0.19.0 Arbitrary File Read via Pandoc Converter (high 7.1)
- [CVE-2026-108693](https://insights.sbomify.com/CVE-2026-108693/): ImageMagick through 7.1.2-33 and 6.9.13-58 Uncontrolled Search Path via Ghostscript Delegate (high 7.3)
- [CVE-2026-108692](https://insights.sbomify.com/CVE-2026-108692/): 1Panel-dev CordysCRM 1.9.0 before 1.9.2 Missing Authorization via /field/source Endpoints (high 7.1)
- [CVE-2026-108691](https://insights.sbomify.com/CVE-2026-108691/): mall4j through 4.0 Operator Precedence Error Deletes Other Users' Cart Items via /p/shopCart/cleanExpiryProdList (medium 5.3)
- [CVE-2026-108690](https://insights.sbomify.com/CVE-2026-108690/): mall4j through 4.0 Operator Precedence Error Exposes Other Users' Cart Items via /p/shopCart/expiryProdList (medium 5.3)
- [CVE-2026-108689](https://insights.sbomify.com/CVE-2026-108689/): Wukong AICRM through 20260610 Authorization Bypass via User-Controlled Session ID in POST /chat/send (medium 5.3)
- [CVE-2026-108688](https://insights.sbomify.com/CVE-2026-108688/): Eladmin through 2.7 Missing Authorization via /api/localStorage/pictures Upload (medium 5.3)
- [CVE-2026-108686](https://insights.sbomify.com/CVE-2026-108686/): WP Post Author < 4.2.0 - Unauthenticated reCAPTCHA Secret Key Disclosure (low 3.7)
- [CVE-2026-108685](https://insights.sbomify.com/CVE-2026-108685/): WP Post Author < 4.2.0 - Unauthenticated Modification of the First User Account's Profile Fields (low 3.7)
- [CVE-2026-108684](https://insights.sbomify.com/CVE-2026-108684/): erzhongxmu Jeewms Autocomplete Data JeecgFormDemoController.java getTreeData sql injection (medium 5.3)
- [CVE-2026-108683](https://insights.sbomify.com/CVE-2026-108683/): zhayujie CowAgent Media Download memory allocation (medium 5.3)
- [CVE-2026-108682](https://insights.sbomify.com/CVE-2026-108682/): zhayujie CowAgent Web Console upload read denial of service (medium 5.3)
- [CVE-2026-108681](https://insights.sbomify.com/CVE-2026-108681/): zhayujie CowAgent Web Console web_channel.py denial of service (medium 5.3)
- [CVE-2026-108680](https://insights.sbomify.com/CVE-2026-108680/): JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendTemplateAnnouncement (medium 5.3)
- [CVE-2026-10868](https://insights.sbomify.com/CVE-2026-10868/): MISP user edit endpoint mass assignment vulnerability allows unauthorized user account modification (critical 9.0)
- [CVE-2026-108679](https://insights.sbomify.com/CVE-2026-108679/): JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendBusAnnouncement (medium 5.3)
- [CVE-2026-108678](https://insights.sbomify.com/CVE-2026-108678/): JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserRoles (medium 5.3)
- [CVE-2026-108677](https://insights.sbomify.com/CVE-2026-108677/): JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserByName (high 7.1)
- [CVE-2026-108676](https://insights.sbomify.com/CVE-2026-108676/): JeecgBoot through 3.9.5 Missing Authorization via /sys/annountCement/downLoadFiles (medium 5.3)
- [CVE-2026-108675](https://insights.sbomify.com/CVE-2026-108675/): JeecgBoot through 3.9.5 Missing Authorization via /sys/annountCement/editIzTop (medium 5.3)
- [CVE-2026-108674](https://insights.sbomify.com/CVE-2026-108674/): JeecgBoot through 3.9.5 Missing Authorization via /openapi/queryById (medium 5.3)
- [CVE-2026-108673](https://insights.sbomify.com/CVE-2026-108673/): JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/exportXls (medium 5.3)
- [CVE-2026-108672](https://insights.sbomify.com/CVE-2026-108672/): JeecgBoot through 3.9.5 Authorization Bypass via /airag/video/listByUser (medium 5.3)
- [CVE-2026-108671](https://insights.sbomify.com/CVE-2026-108671/): JeecgBoot through 3.9.5 Missing Authorization via /airag/airagMcp/queryById (high 7.1)
- [CVE-2026-108670](https://insights.sbomify.com/CVE-2026-108670/): JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/experiment (medium 5.3)
- [CVE-2026-108669](https://insights.sbomify.com/CVE-2026-108669/): JeecgBoot through 3.9.5 Missing Authorization via /airag/knowledge/embedding/search (medium 5.3)
- [CVE-2026-108668](https://insights.sbomify.com/CVE-2026-108668/): JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/deleteRecycleBin (medium 5.3)
- [CVE-2026-108667](https://insights.sbomify.com/CVE-2026-108667/): JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/revertRecycleBin (medium 5.3)
- [CVE-2026-108666](https://insights.sbomify.com/CVE-2026-108666/): JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/deleteBatch (medium 5.3)
- [CVE-2026-108665](https://insights.sbomify.com/CVE-2026-108665/): JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/edit (medium 5.3)
- [CVE-2026-108664](https://insights.sbomify.com/CVE-2026-108664/): JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/queryById (medium 5.3)
- [CVE-2026-108663](https://insights.sbomify.com/CVE-2026-108663/): JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/deleteApply (medium 5.3)
- [CVE-2026-108662](https://insights.sbomify.com/CVE-2026-108662/): JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/deleteTenantPackUser (medium 5.3)
- [CVE-2026-108661](https://insights.sbomify.com/CVE-2026-108661/): JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/changeOwenUserTenant (high 7.1)
- [CVE-2026-108660](https://insights.sbomify.com/CVE-2026-108660/): JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/updateApplyStatus (medium 5.3)
- [CVE-2026-108659](https://insights.sbomify.com/CVE-2026-108659/): JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/listPackByTenantUserId (medium 5.3)
- [CVE-2026-108658](https://insights.sbomify.com/CVE-2026-108658/): JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/queryTenantAuthInfo (medium 5.3)
- [CVE-2026-108657](https://insights.sbomify.com/CVE-2026-108657/): JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/passApply (high 8.6)
- [CVE-2026-108656](https://insights.sbomify.com/CVE-2026-108656/): JeecgBoot through 3.9.5 Missing Authorization via getTenantPackApplyUsers Endpoint (medium 5.3)
- [CVE-2026-108655](https://insights.sbomify.com/CVE-2026-108655/): JeecgBoot through 3.9.5 Missing Authorization via /sys/quartzJob/queryById (medium 5.3)
- [CVE-2026-108654](https://insights.sbomify.com/CVE-2026-108654/): JeecgBoot through 3.9.5 Missing Authorization via /sys/oss/file/queryById (medium 5.3)
- [CVE-2026-108653](https://insights.sbomify.com/CVE-2026-108653/): JeecgBoot through 3.9.5 Missing Authorization via GET /openapi/list (medium 5.3)
- [CVE-2026-108652](https://insights.sbomify.com/CVE-2026-108652/): JeecgBoot through 3.9.5 Missing Authorization via /sys/api/updateAvatar (medium 5.3)
- [CVE-2026-108651](https://insights.sbomify.com/CVE-2026-108651/): JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getRolesByUserId (medium 5.3)
- [CVE-2026-108650](https://insights.sbomify.com/CVE-2026-108650/): JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserPermissionSet (medium 5.3)
- [CVE-2026-10865](https://insights.sbomify.com/CVE-2026-10865/): Cost Calculator Builder <= 4.0.11 - Unauthenticated Sensitive Information Exposure of Payment Gateway Secret Keys (medium 5.3)
- [CVE-2026-108649](https://insights.sbomify.com/CVE-2026-108649/): JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserRolesById (medium 5.3)
- [CVE-2026-108648](https://insights.sbomify.com/CVE-2026-108648/): JeecgBoot through 3.9.5 Missing Authorization via getDynamicDbSourceByCode Endpoint (high 7.1)
- [CVE-2026-108647](https://insights.sbomify.com/CVE-2026-108647/): JeecgBoot through 3.9.5 Missing Authorization via /sys/checkRule/importExcel (medium 5.3)
- [CVE-2026-108646](https://insights.sbomify.com/CVE-2026-108646/): JeecgBoot through 3.9.5 Missing Authorization via /sys/category/importExcel (medium 5.3)
- [CVE-2026-108645](https://insights.sbomify.com/CVE-2026-108645/): JeecgBoot through 3.9.5 Missing Authorization via /sys/category/edit (medium 5.3)
- [CVE-2026-108644](https://insights.sbomify.com/CVE-2026-108644/): JeecgBoot through 3.9.5 Missing Authorization via /sys/category/delete (medium 5.3)
- [CVE-2026-108643](https://insights.sbomify.com/CVE-2026-108643/): JeecgBoot through 3.9.5 Missing Authorization via /sys/category/deleteBatch (medium 5.3)
- [CVE-2026-108642](https://insights.sbomify.com/CVE-2026-108642/): JeecgBoot through 3.9.5 IDOR via PUT /sys/sysAnnouncementSend/edit (medium 5.3)
- [CVE-2026-108641](https://insights.sbomify.com/CVE-2026-108641/): JeecgBoot through 3.9.5 IDOR via /sys/sysAnnouncementSend/getOne (medium 5.3)
- [CVE-2026-108640](https://insights.sbomify.com/CVE-2026-108640/): JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartRole/queryById (medium 5.3)
- [CVE-2026-10864](https://insights.sbomify.com/CVE-2026-10864/): MISP Dashboard widget field selection may expose restricted user and organisation data (medium 5.3)
- [CVE-2026-108639](https://insights.sbomify.com/CVE-2026-108639/): JeecgBoot through 3.9.5 Missing Authorization via /sys/dict/deletePhysic/{id} (medium 5.3)
- [CVE-2026-108638](https://insights.sbomify.com/CVE-2026-108638/): JeecgBoot through 3.9.5 Missing Authorization via /sys/user/deleteGroupUser (medium 5.3)
- [CVE-2026-108637](https://insights.sbomify.com/CVE-2026-108637/): JeecgBoot through 3.9.5 Missing Authorization via deleteUserGroupBatch Endpoint (medium 5.3)
- [CVE-2026-108636](https://insights.sbomify.com/CVE-2026-108636/): JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepart/appImportExcel (medium 5.3)
- [CVE-2026-108635](https://insights.sbomify.com/CVE-2026-108635/): JeecgBoot through 3.9.5 Missing Authorization via getDepartmentHead Endpoint (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/949/