# Vulnerabilities published in 2026


- [CVE-2026-108634](https://insights.sbomify.com/CVE-2026-108634/): JeecgBoot through 3.9.5 Missing Authorization via sysDepartPermission deleteBatch Endpoint (medium 5.3)
- [CVE-2026-108633](https://insights.sbomify.com/CVE-2026-108633/): JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartPermission/add (medium 5.3)
- [CVE-2026-108632](https://insights.sbomify.com/CVE-2026-108632/): JeecgBoot through 3.9.5 Missing Authorization via sysDepartPermission queryById Endpoint (medium 5.3)
- [CVE-2026-108631](https://insights.sbomify.com/CVE-2026-108631/): JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartPermission/delete (medium 5.3)
- [CVE-2026-108630](https://insights.sbomify.com/CVE-2026-108630/): JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartPermission/edit (medium 5.3)
- [CVE-2026-10863](https://insights.sbomify.com/CVE-2026-10863/): MISP User-controlled order parameter in correlations over-correlation endpoint (medium 6.4)
- [CVE-2026-108629](https://insights.sbomify.com/CVE-2026-108629/): JeecgBoot through 3.9.5 Missing Authorization via sysDepartPermission datarule Endpoint (medium 5.3)
- [CVE-2026-108628](https://insights.sbomify.com/CVE-2026-108628/): JeecgBoot through 3.9.5 Missing Authorization via saveDeptRolePermission Endpoint (high 8.6)
- [CVE-2026-108627](https://insights.sbomify.com/CVE-2026-108627/): JeecgBoot through 3.9.5 Missing Authorization via /sys/role/datarule Endpoint (medium 5.3)
- [CVE-2026-108626](https://insights.sbomify.com/CVE-2026-108626/): JeecgBoot through 3.9.5 Missing Authorization via sysMessage queryById Endpoint (medium 5.3)
- [CVE-2026-108625](https://insights.sbomify.com/CVE-2026-108625/): JeecgBoot through 3.9.5 Missing Authorization via sysMessage Edit Endpoint (medium 5.3)
- [CVE-2026-108624](https://insights.sbomify.com/CVE-2026-108624/): JeecgBoot through 3.9.5 Missing Authorization via sysMessage deleteBatch Endpoint (medium 5.3)
- [CVE-2026-108623](https://insights.sbomify.com/CVE-2026-108623/): JeecgBoot through 3.9.5 Missing Authorization via /sys/log/deleteBatch (high 7.1)
- [CVE-2026-108622](https://insights.sbomify.com/CVE-2026-108622/): JeecgBoot through 3.9.5 Missing Authorization via /sys/log/delete Endpoint (medium 5.3)
- [CVE-2026-108621](https://insights.sbomify.com/CVE-2026-108621/): JeecgBoot through 3.9.5 Missing Authorization via /sys/position/edit (medium 5.3)
- [CVE-2026-108620](https://insights.sbomify.com/CVE-2026-108620/): JeecgBoot through 3.9.5 Missing Authorization via /sys/position/deleteBatch (medium 5.3)
- [CVE-2026-10862](https://insights.sbomify.com/CVE-2026-10862/): Accordions <= 2.3.23 - Authenticated (Custom+) Stored Cross-Site Scripting via Accordion Body Field (medium 6.4)
- [CVE-2026-108619](https://insights.sbomify.com/CVE-2026-108619/): JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate deleteBatch Endpoint (medium 5.3)
- [CVE-2026-108618](https://insights.sbomify.com/CVE-2026-108618/): JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate Edit Endpoint (medium 5.3)
- [CVE-2026-108617](https://insights.sbomify.com/CVE-2026-108617/): JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate/add Endpoint (medium 5.3)
- [CVE-2026-108616](https://insights.sbomify.com/CVE-2026-108616/): JeecgBoot through 3.9.5 Missing Authorization via /airag/extData/deleteBatch (medium 5.3)
- [CVE-2026-108615](https://insights.sbomify.com/CVE-2026-108615/): JeecgBoot through 3.9.5 Missing Authorization via /airag/extData/delete (medium 5.3)
- [CVE-2026-108614](https://insights.sbomify.com/CVE-2026-108614/): JeecgBoot through 3.9.5 Missing Authorization via /airag/extData/exportXls (medium 5.3)
- [CVE-2026-108613](https://insights.sbomify.com/CVE-2026-108613/): JeecgBoot through 3.9.5 Missing Authorization via /airag/app/release Endpoint (medium 5.3)
- [CVE-2026-108612](https://insights.sbomify.com/CVE-2026-108612/): JeecgBoot through 3.9.5 Missing Authorization via /airag/word/deleteBatch (medium 5.3)
- [CVE-2026-108611](https://insights.sbomify.com/CVE-2026-108611/): JeecgBoot through 3.9.5 Missing Authorization via /airag/word/delete Endpoint (medium 5.3)
- [CVE-2026-108610](https://insights.sbomify.com/CVE-2026-108610/): JeecgBoot through 3.9.5 Missing Authorization via /airag/word/edit Endpoint (medium 5.3)
- [CVE-2026-10861](https://insights.sbomify.com/CVE-2026-10861/): MISP post-login open redirect via pre_login_requested_url (medium 5.1)
- [CVE-2026-108609](https://insights.sbomify.com/CVE-2026-108609/): JeecgBoot through 3.9.5 IDOR via /airag/voice/listByUser userId Parameter (medium 5.3)
- [CVE-2026-108608](https://insights.sbomify.com/CVE-2026-108608/): JeecgBoot through 3.9.5 IDOR via deleteVoiceRecord userId Parameter (medium 5.3)
- [CVE-2026-108607](https://insights.sbomify.com/CVE-2026-108607/): JeecgBoot through 3.9.5 IDOR via deleteVideoRecord userId Parameter (medium 5.3)
- [CVE-2026-108606](https://insights.sbomify.com/CVE-2026-108606/): JeecgBoot through 3.9.5 Missing Authorization via /airag/ocr/deleteById (medium 5.3)
- [CVE-2026-108605](https://insights.sbomify.com/CVE-2026-108605/): JeecgBoot through 3.9.5 Missing Authorization via /airag/ocr/edit Endpoint (medium 5.3)
- [CVE-2026-108604](https://insights.sbomify.com/CVE-2026-108604/): Tabularis through 0.27.0 Read-Only Bypass via MCP run_query SELECT Classification (medium 5.8)
- [CVE-2026-108603](https://insights.sbomify.com/CVE-2026-108603/): slide-maker through 5.8.0 Path Traversal via generate_images_openai.py (medium 4.8)
- [CVE-2026-108602](https://insights.sbomify.com/CVE-2026-108602/): Helicone through v2025.08.21-1 SSRF via Jawn Webhook Sender DNS Resolution (medium 5.3)
- [CVE-2026-108600](https://insights.sbomify.com/CVE-2026-108600/): open-multi-agent 1.5.0 through 1.21.2 Sandbox Escape via file_write Dangling Symlink (medium 5.7)
- [CVE-2026-10860](https://insights.sbomify.com/CVE-2026-10860/): MISP CRUDComponent delete validation bypass via operator precedence error (high 7.9)
- [CVE-2026-1086](https://insights.sbomify.com/CVE-2026-1086/): Font Pairing Preview For Landing Pages <= 1.3 - Cross-Site Request Forgery to Settings Update (medium 4.3)
- [CVE-2026-108599](https://insights.sbomify.com/CVE-2026-108599/): Phi 0.1.1 through 0.28.4 Symlink Workspace Write Restriction Bypass (medium 5.7)
- [CVE-2026-108598](https://insights.sbomify.com/CVE-2026-108598/): Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates (critical 9.3)
- [CVE-2026-108597](https://insights.sbomify.com/CVE-2026-108597/): Cohere Python SDK 5.11.0 through 7.2.0 Path Traversal via SageMaker Tar Extraction (medium 5.9)
- [CVE-2026-108596](https://insights.sbomify.com/CVE-2026-108596/): OpenLIT 2.1.0 Authorization Bypass via x-openlit-project-id Header (medium 6.0)
- [CVE-2026-108595](https://insights.sbomify.com/CVE-2026-108595/): Phi 0.3.0 through 0.28.4 Permission Bypass via agent_spawn Workdir (medium 6.0)
- [CVE-2026-108594](https://insights.sbomify.com/CVE-2026-108594/): Mealie 3.26.0 through 3.28.0 SSRF via OIDC Picture Claim Avatar Fetch (low 2.3)
- [CVE-2026-108593](https://insights.sbomify.com/CVE-2026-108593/): 9router 0.4.1 through 0.5.99 Config Injection RCE via hermes-settings Endpoint (high 7.3)
- [CVE-2026-108592](https://insights.sbomify.com/CVE-2026-108592/): mini-swe-agent 1.10.0 through 2.4.6 Environment Exposure via BubblewrapEnvironment (medium 6.0)
- [CVE-2026-108591](https://insights.sbomify.com/CVE-2026-108591/): InnoShop 0.9.2 Local File Disclosure via AI Core MCP file_upload Tool (medium 5.9)
- [CVE-2026-108587](https://insights.sbomify.com/CVE-2026-108587/): 10Web Booster <= 2.34.10 - Unauthenticated Arbitrary File Upload via 'page_id' Parameter (critical 9.8)
- [CVE-2026-108586](https://insights.sbomify.com/CVE-2026-108586/): 1MCP Agent 0.20.0 through 0.39.0 OAuth Tag-Scope Bypass via Negated Tag Filter (medium 5.3)
- [CVE-2026-108585](https://insights.sbomify.com/CVE-2026-108585/): argocd-mcp through 0.9.0 Path Traversal via delete_application Tool (medium 5.3)
- [CVE-2026-108584](https://insights.sbomify.com/CVE-2026-108584/): FunnyWolf Viper config hard-coded credentials (medium 6.9)
- [CVE-2026-108583](https://insights.sbomify.com/CVE-2026-108583/): zotero-mcp 0.10.0 through 0.14.1 SSRF via zotero_add_by_url Tool (low 2.3)
- [CVE-2026-108582](https://insights.sbomify.com/CVE-2026-108582/): GenOffice through 0.11.505 Insecure Permissions in HTTP MCP Server File Store (medium 6.8)
- [CVE-2026-108581](https://insights.sbomify.com/CVE-2026-108581/): Octop through 1.0.2b6 Missing Authorization Exposes Provider API Keys via /api/providers (high 7.1)
- [CVE-2026-108580](https://insights.sbomify.com/CVE-2026-108580/): AniWorld Downloader before 5.3.0 WebUI Login Brute Force via /login (medium 6.9)
- [CVE-2026-10858](https://insights.sbomify.com/CVE-2026-10858/): IBM MQ for HPE NonStop is vulnerable to a denial of service attack (critical 9.9)
- [CVE-2026-108579](https://insights.sbomify.com/CVE-2026-108579/): OpenPanel through 2.3.0 CSV Formula Injection via Cohort Member Export (low 2.3)
- [CVE-2026-108578](https://insights.sbomify.com/CVE-2026-108578/): Neterbit NW-431F Embedded Web Server sms.json information disclosure (medium 6.9)
- [CVE-2026-108577](https://insights.sbomify.com/CVE-2026-108577/): Konstanty Bialkowski libmodplug ABC Music Format load_abc.cpp abc_add_gchord resource consumption (medium 5.3)
- [CVE-2026-108576](https://insights.sbomify.com/CVE-2026-108576/): TOZED X300 IPPingDiagnostics process_ping os command injection (critical 10.0)
- [CVE-2026-108575](https://insights.sbomify.com/CVE-2026-108575/): BerriAI LiteLLM Secret Resolution main.py get_secret improper authorization (medium 5.3)
- [CVE-2026-108574](https://insights.sbomify.com/CVE-2026-108574/): BerriAI LiteLLM Spend Tracking spend_management_endpoints.py ui_view_session_spend_logs authorization (medium 5.3)
- [CVE-2026-108573](https://insights.sbomify.com/CVE-2026-108573/): Open Asset Import Library Assimp PLY File getNextBlock out-of-bounds (medium 5.1)
- [CVE-2026-108572](https://insights.sbomify.com/CVE-2026-108572/): Casdoor Proxy Validation cas.go CasP3ProxyValidate server-side request forgery (medium 5.3)
- [CVE-2026-108571](https://insights.sbomify.com/CVE-2026-108571/): Xinhu Rainrock RockOA Openkqj Action openkqjAction.php returnchuli sql injection (medium 6.9)
- [CVE-2026-108570](https://insights.sbomify.com/CVE-2026-108570/): Furion .NET Framework View ViewEngine.cs RunCompile special elements in template engine (medium 5.3)
- [CVE-2026-10857](https://insights.sbomify.com/CVE-2026-10857/): Reflected XSS in Akinsoft's e-Commerce (medium 6.1)
- [CVE-2026-108569](https://insights.sbomify.com/CVE-2026-108569/): Furion .NET Framework StringRenderExtensions.cs String.Replace sql injection (medium 5.3)
- [CVE-2026-108568](https://insights.sbomify.com/CVE-2026-108568/): InstantSoft icms2 Billing paypal.php validatePaypalOrder data authenticity (medium 5.3)
- [CVE-2026-108567](https://insights.sbomify.com/CVE-2026-108567/): InstantSoft icms2 Image image.php files_delete_file path traversal (medium 5.3)
- [CVE-2026-108566](https://insights.sbomify.com/CVE-2026-108566/): InstantSoft icms2 Private Message index.tpl.php index cross site scripting (medium 5.1)
- [CVE-2026-10856](https://insights.sbomify.com/CVE-2026-10856/): Open redirect in MISP dashboard button widget URL handling (medium 5.1)
- [CVE-2026-108555](https://insights.sbomify.com/CVE-2026-108555/): PairDrop through 1.11.2 IP Spoofing via cf-connecting-ip Header (low 2.3)
- [CVE-2026-108554](https://insights.sbomify.com/CVE-2026-108554/): PDFMathTranslate through 1.9.11 SSRF via Gradio Web GUI Link Input (medium 6.9)
- [CVE-2026-108553](https://insights.sbomify.com/CVE-2026-108553/): OpenRefine through 3.10.1 CSRF to RCE via get-rows Command (high 7.7)
- [CVE-2026-108551](https://insights.sbomify.com/CVE-2026-108551/): openapi-typescript-codegen through 0.31.0 Code Injection via Handlebars Templates (critical 9.3)
- [CVE-2026-108550](https://insights.sbomify.com/CVE-2026-108550/): SkillHub before 0.2.22 Account Takeover via Account Merge Flow (high 8.7)
- [CVE-2026-10855](https://insights.sbomify.com/CVE-2026-10855/): MISP Event template importer authorization bypass (medium 5.1)
- [CVE-2026-108549](https://insights.sbomify.com/CVE-2026-108549/): cc-connect through 1.5.0 Missing Authentication via MAX Webhook Sender Spoofing (critical 9.2)
- [CVE-2026-108548](https://insights.sbomify.com/CVE-2026-108548/): AstronRPA through 1.1.6 Authentication Bypass via Arbitrary Bearer Token (medium 6.9)
- [CVE-2026-108547](https://insights.sbomify.com/CVE-2026-108547/): AstronRPA through 1.1.6 Cross-Tenant Shared Variable Disclosure via get-batch-shared-var (high 7.1)
- [CVE-2026-108546](https://insights.sbomify.com/CVE-2026-108546/): Spotweb through 1.5.8 OS Command Injection via Spot Title in Runcommand Integration (high 7.7)
- [CVE-2026-108545](https://insights.sbomify.com/CVE-2026-108545/): SillyTavern 1.12.13 through 1.19.0 Pre-Authentication Denial of Service via Body Parsing (high 8.2)
- [CVE-2026-108544](https://insights.sbomify.com/CVE-2026-108544/): Lippu Docx Reader Office Viewer App path traversal (medium 5.3)
- [CVE-2026-108543](https://insights.sbomify.com/CVE-2026-108543/): ag2ai ag2 UserProxyAgent os.path.join path traversal (medium 5.3)
- [CVE-2026-108542](https://insights.sbomify.com/CVE-2026-108542/): 021is elvix-sdk MCP Request index.ts server-side request forgery (medium 5.3)
- [CVE-2026-108541](https://insights.sbomify.com/CVE-2026-108541/): highwarden Super Store Finder index.php sql injection (medium 5.3)
- [CVE-2026-108540](https://insights.sbomify.com/CVE-2026-108540/): OpenSpug File Transfer transfer os command injection (critical 9.4)
- [CVE-2026-10854](https://insights.sbomify.com/CVE-2026-10854/): Unauthorized exposure of private galaxies in MISP event template creation (medium 5.3)
- [CVE-2026-108539](https://insights.sbomify.com/CVE-2026-108539/): GPAC MP4Box filter_queue.c gf_fq_pop use after free (medium 5.3)
- [CVE-2026-108538](https://insights.sbomify.com/CVE-2026-108538/): GPAC MP4Box os_thread.c gf_mx_v use after free (medium 5.3)
- [CVE-2026-10853](https://insights.sbomify.com/CVE-2026-10853/): IBM MQ queue manager is vulnerable to remote code execution (high 7.5)
- [CVE-2026-108529](https://insights.sbomify.com/CVE-2026-108529/): SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit (high 8.7)
- [CVE-2026-108525](https://insights.sbomify.com/CVE-2026-108525/): HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit (high 8.7)
- [CVE-2026-108523](https://insights.sbomify.com/CVE-2026-108523/): Studio-Saelix Sencho git-sources Browse API Endpoint outboundTarget.ts server-side request forgery (medium 5.3)
- [CVE-2026-108522](https://insights.sbomify.com/CVE-2026-108522/): Studio-Saelix Sencho Login Endpoint login improper authentication (medium 6.9)
- [CVE-2026-108521](https://insights.sbomify.com/CVE-2026-108521/): Studio-Saelix Sencho Add Remote Node API Endpoint validation.ts isValidRemoteUrl server-side request forgery (medium 5.1)
- [CVE-2026-10852](https://insights.sbomify.com/CVE-2026-10852/): Websphere Application Server is Affected By a Denial of Service (medium 5.9)
- [CVE-2026-108518](https://insights.sbomify.com/CVE-2026-108518/): DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an {attr} element. (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/950/