# Vulnerabilities published in 2026


- [CVE-2026-108506](https://insights.sbomify.com/CVE-2026-108506/): Unauthorized access vulnerability in ZTE Z80 Ultra product (medium 5.5)
- [CVE-2026-108505](https://insights.sbomify.com/CVE-2026-108505/): Information disclosure vulnerability in ZTE Z80 Ultra product (low 3.3)
- [CVE-2026-108504](https://insights.sbomify.com/CVE-2026-108504/): Unauthorized information retrieval vulnerability in ZTE Z80 Ultra product (medium 5.5)
- [CVE-2026-108503](https://insights.sbomify.com/CVE-2026-108503/): Unauthorized information acquisition vulnerability in ZTE Z80 Ultra product (low 3.3)
- [CVE-2026-108502](https://insights.sbomify.com/CVE-2026-108502/): Information disclosure vulnerability in ZTE Z80 Ultra product (low 3.3)
- [CVE-2026-108501](https://insights.sbomify.com/CVE-2026-108501/): Unauthorized access vulnerability in ZTE Z80 Ultra product (medium 5.7)
- [CVE-2026-10850](https://insights.sbomify.com/CVE-2026-10850/): Plane 1.3.1 - Stored XSS in intake issue description_html (medium 6.9)
- [CVE-2026-1085](https://insights.sbomify.com/CVE-2026-1085/): True Ranker <= 2.2.9 - Cross-Site Request Forgery to Unauthorized True Ranker Disconnection (medium 4.3)
- [CVE-2026-108499](https://insights.sbomify.com/CVE-2026-108499/): WordPress Knowledge Base plugin <= 3.2.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-108498](https://insights.sbomify.com/CVE-2026-108498/): WordPress BSK PDF Manager plugin <= 3.8.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-108497](https://insights.sbomify.com/CVE-2026-108497/): WordPress Amelia plugin <= 2.4.10 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-108496](https://insights.sbomify.com/CVE-2026-108496/): WordPress WP User Manager plugin <= 2.9.24 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-108495](https://insights.sbomify.com/CVE-2026-108495/): WordPress SureForms plugin <= 2.12.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-108494](https://insights.sbomify.com/CVE-2026-108494/): WordPress Chained Quiz plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-108493](https://insights.sbomify.com/CVE-2026-108493/): WordPress Pay for Payment for WooCommerce plugin <= 3.0.1 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-108492](https://insights.sbomify.com/CVE-2026-108492/): WordPress Quick Paypal Payments plugin <= 6.0.3 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-108491](https://insights.sbomify.com/CVE-2026-108491/): WordPress Everest Forms plugin <= 3.6.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-108490](https://insights.sbomify.com/CVE-2026-108490/): WordPress Premium Addons for Elementor plugin <= 4.11.110 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-10849](https://insights.sbomify.com/CVE-2026-10849/): Heap out-of-bounds write in Zephyr hawkBit OTA client when terminating server response body (high 8.2)
- [CVE-2026-108489](https://insights.sbomify.com/CVE-2026-108489/): WordPress Active Products Tables for WooCommerce plugin <= 2.1.3 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-108488](https://insights.sbomify.com/CVE-2026-108488/): WordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-108487](https://insights.sbomify.com/CVE-2026-108487/): WordPress Books Gallery plugin <= 4.8.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-108486](https://insights.sbomify.com/CVE-2026-108486/): WordPress Forminator plugin <= 1.58.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-108485](https://insights.sbomify.com/CVE-2026-108485/): WordPress eStore theme <= 1.6.13 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-108484](https://insights.sbomify.com/CVE-2026-108484/): WordPress Best Payments Plugin for WP plugin <= 4.6.27 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-108483](https://insights.sbomify.com/CVE-2026-108483/): WordPress Hippoo Mobile App for WooCommerce plugin <= 1.12.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-108482](https://insights.sbomify.com/CVE-2026-108482/): WordPress Premium Addons for Elementor plugin <= 4.11.110 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-108481](https://insights.sbomify.com/CVE-2026-108481/): WordPress Patreon WordPress plugin <= 1.10.0 - Cross Site Request Forgery (CSRF) vulnerability (high 7.4)
- [CVE-2026-108480](https://insights.sbomify.com/CVE-2026-108480/): WordPress Skydropx plugin <= 2.1.4 - Broken Access Control vulnerability (high 8.2)
- [CVE-2026-10848](https://insights.sbomify.com/CVE-2026-10848/): Out-of-bounds read in Zephyr OCPP 1.6 RPC message parser (parse_rpc_msg) (high 7.0)
- [CVE-2026-108479](https://insights.sbomify.com/CVE-2026-108479/): WordPress Patreon WordPress plugin <= 1.9.17 - Cross Site Request Forgery (CSRF) vulnerability (high 8.1)
- [CVE-2026-108478](https://insights.sbomify.com/CVE-2026-108478/): WordPress Element Pack Elementor Addons plugin <= 8.8.8 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-108477](https://insights.sbomify.com/CVE-2026-108477/): WordPress Booktics plugin <= 1.0.28 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-108476](https://insights.sbomify.com/CVE-2026-108476/): WordPress Paid Videochat Turnkey Site plugin <= 7.5.13 - Broken Access Control vulnerability (medium 5.0)
- [CVE-2026-108475](https://insights.sbomify.com/CVE-2026-108475/): WordPress Broadcast Live Video plugin <= 7.3.6 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-108474](https://insights.sbomify.com/CVE-2026-108474/): SQL injection in Exposed (critical 9.8)
- [CVE-2026-108473](https://insights.sbomify.com/CVE-2026-108473/): Improper Authentication and Credential Exposure in Multiple TP-Link Kasa Devices (high 8.7)
- [CVE-2026-108471](https://insights.sbomify.com/CVE-2026-108471/): Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-10847](https://insights.sbomify.com/CVE-2026-10847/): Local Privilege Escalation vulnerability in Check Point Identity Agent Full for Windows OS (high 7.8)
- [CVE-2026-108468](https://insights.sbomify.com/CVE-2026-108468/): Windows Installer Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-108467](https://insights.sbomify.com/CVE-2026-108467/): Microsoft PostScript Printer Driver Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-108466](https://insights.sbomify.com/CVE-2026-108466/): Windows Kernel Denial of Service Vulnerability (medium 5.3)
- [CVE-2026-108465](https://insights.sbomify.com/CVE-2026-108465/): Windows Update Delivery Optimization Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-108464](https://insights.sbomify.com/CVE-2026-108464/): Software Protection Platform (SPP) Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-108463](https://insights.sbomify.com/CVE-2026-108463/): Windows SmartScreen Security Feature Bypass Vulnerability (high 8.8)
- [CVE-2026-108462](https://insights.sbomify.com/CVE-2026-108462/): Windows Kernel Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-108461](https://insights.sbomify.com/CVE-2026-108461/): Windows Broadcast DVR User Service Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-108460](https://insights.sbomify.com/CVE-2026-108460/): Windows Message Queuing Remote Code Execution Vulnerability (high 8.1)
- [CVE-2026-10846](https://insights.sbomify.com/CVE-2026-10846/): Insufficient verification that responses belong to a query (high 8.2)
- [CVE-2026-108458](https://insights.sbomify.com/CVE-2026-108458/): Remote Desktop Client Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-108457](https://insights.sbomify.com/CVE-2026-108457/): Microsoft Windows PDF Remote Code Execution Vulnerability (high 8.1)
- [CVE-2026-108456](https://insights.sbomify.com/CVE-2026-108456/): Azure AI Foundry Elevation of Privilege Vulnerability (high 7.7)
- [CVE-2026-108455](https://insights.sbomify.com/CVE-2026-108455/): Microsoft Office PowerPoint Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-108454](https://insights.sbomify.com/CVE-2026-108454/): Microsoft Office PowerPoint Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-108453](https://insights.sbomify.com/CVE-2026-108453/): Microsoft Office PowerPoint Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-108452](https://insights.sbomify.com/CVE-2026-108452/): Microsoft Office SharePoint Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-108451](https://insights.sbomify.com/CVE-2026-108451/): Microsoft Office Word Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-108450](https://insights.sbomify.com/CVE-2026-108450/): Microsoft Office Word Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-10845](https://insights.sbomify.com/CVE-2026-10845/): IBM WebSphere Application Server is affected by an authentication bypass vulnerability (high 7.3)
- [CVE-2026-108449](https://insights.sbomify.com/CVE-2026-108449/): Microsoft Office Word Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-108448](https://insights.sbomify.com/CVE-2026-108448/): Microsoft Office Outlook Remote Code Execution Vulnerability (high 7.5)
- [CVE-2026-108447](https://insights.sbomify.com/CVE-2026-108447/): Microsoft Office Word Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-108446](https://insights.sbomify.com/CVE-2026-108446/): Microsoft Office Excel Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-108445](https://insights.sbomify.com/CVE-2026-108445/): Microsoft Office Word Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-108444](https://insights.sbomify.com/CVE-2026-108444/): Microsoft Office Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-108443](https://insights.sbomify.com/CVE-2026-108443/): Microsoft Office Word Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-108442](https://insights.sbomify.com/CVE-2026-108442/): Microsoft Office Word Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-108441](https://insights.sbomify.com/CVE-2026-108441/): Microsoft Office Word Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-108440](https://insights.sbomify.com/CVE-2026-108440/): Microsoft Office Word Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-108439](https://insights.sbomify.com/CVE-2026-108439/): Microsoft Office Word Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-108438](https://insights.sbomify.com/CVE-2026-108438/): Microsoft Office Word Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-108437](https://insights.sbomify.com/CVE-2026-108437/): Microsoft Office Word Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-108436](https://insights.sbomify.com/CVE-2026-108436/): Microsoft Office Word Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-108435](https://insights.sbomify.com/CVE-2026-108435/): Microsoft Office Word Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-108434](https://insights.sbomify.com/CVE-2026-108434/): Microsoft Office Word Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-108433](https://insights.sbomify.com/CVE-2026-108433/): Microsoft Office Word Security Feature Bypass Vulnerability (high 7.8)
- [CVE-2026-108432](https://insights.sbomify.com/CVE-2026-108432/): Microsoft Office Word Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-108431](https://insights.sbomify.com/CVE-2026-108431/): Microsoft Office Word Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-108430](https://insights.sbomify.com/CVE-2026-108430/): Microsoft Office Word Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-10843](https://insights.sbomify.com/CVE-2026-10843/): Misconfiguration in Red Hat OpenShift Container Platform 4 (high 7.2)
- [CVE-2026-108429](https://insights.sbomify.com/CVE-2026-108429/): Microsoft Office Word Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-108428](https://insights.sbomify.com/CVE-2026-108428/): Microsoft Office Word Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-108427](https://insights.sbomify.com/CVE-2026-108427/): Microsoft Office Word Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-108426](https://insights.sbomify.com/CVE-2026-108426/): Microsoft Office Word Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-10842](https://insights.sbomify.com/CVE-2026-10842/): Security feature bypass in WebSphere Application Server (high 7.5)
- [CVE-2026-10841](https://insights.sbomify.com/CVE-2026-10841/): IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty HTTP Request Smuggling (medium 4.8)
- [CVE-2026-108400](https://insights.sbomify.com/CVE-2026-108400/): HEVC Video Extensions Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-10840](https://insights.sbomify.com/CVE-2026-10840/): Misconfiguration in OpenShift Pipelines (high 7.1)
- [CVE-2026-1084](https://insights.sbomify.com/CVE-2026-1084/): Cross-site scripting in Cookie consent for developers (medium 4.4)
- [CVE-2026-108399](https://insights.sbomify.com/CVE-2026-108399/): Windows Hyper-V Elevation of Privilege Vulnerability (high 7.2)
- [CVE-2026-108398](https://insights.sbomify.com/CVE-2026-108398/): .NET Framework Security Feature Bypass Vulnerability (high 8.8)
- [CVE-2026-108396](https://insights.sbomify.com/CVE-2026-108396/): Windows Modern Device Management (MDM) Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-108395](https://insights.sbomify.com/CVE-2026-108395/): Model Context Protocol Java SDK HTTP server transports allow memory exhaustion through unbounded request bodies (high 7.5)
- [CVE-2026-108390](https://insights.sbomify.com/CVE-2026-108390/): HestiaCP Low-Privileged User to Root via Config-Field Injection and PATH Hijacking (critical 9.9)
- [CVE-2026-10839](https://insights.sbomify.com/CVE-2026-10839/): Open redirection vulnerability in Password Manager (medium 5.1)
- [CVE-2026-108388](https://insights.sbomify.com/CVE-2026-108388/): Indico legacy contribution export cache poisoning discloses restricted metadata (low 3.5)
- [CVE-2026-108385](https://insights.sbomify.com/CVE-2026-108385/): dataclasses-avroschema enum symbols can inject statements through generated member names (high 8.8)
- [CVE-2026-108384](https://insights.sbomify.com/CVE-2026-108384/): dataclasses-avroschema allows code injection through fixed-type aliases supplied as a bare string (high 8.8)
- [CVE-2026-108383](https://insights.sbomify.com/CVE-2026-108383/): dataclasses-avroschema enum field defaults can inject statements into generated modules (high 8.8)
- [CVE-2026-108382](https://insights.sbomify.com/CVE-2026-108382/): dataclasses-avroschema allows code injection through generated enum-symbol string literals (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/951/