# Vulnerabilities published in 2026


- [CVE-2026-108381](https://insights.sbomify.com/CVE-2026-108381/): dataclasses-avroschema pydantic-class metadata allows code injection in generated annotations (high 8.8)
- [CVE-2026-108380](https://insights.sbomify.com/CVE-2026-108380/): dataclasses-avroschema field documentation allows code injection in generated Pydantic descriptions (high 8.8)
- [CVE-2026-108379](https://insights.sbomify.com/CVE-2026-108379/): dataclasses-avroschema fixed namespaces allow code injection in generated annotations (high 8.8)
- [CVE-2026-108378](https://insights.sbomify.com/CVE-2026-108378/): dataclasses-avroschema record documentation can terminate generated class docstrings (high 8.8)
- [CVE-2026-108377](https://insights.sbomify.com/CVE-2026-108377/): dataclasses-avroschema allows code injection through generated Meta.schema_name (high 8.8)
- [CVE-2026-108376](https://insights.sbomify.com/CVE-2026-108376/): dataclasses-avroschema allows code injection through record names in generated default factories (high 8.8)
- [CVE-2026-108375](https://insights.sbomify.com/CVE-2026-108375/): dataclasses-avroschema allows code injection through generated field-default literals (high 8.8)
- [CVE-2026-108374](https://insights.sbomify.com/CVE-2026-108374/): ERPNext: Unauthorised status modification due to missing validation (high 7.7)
- [CVE-2026-108373](https://insights.sbomify.com/CVE-2026-108373/): ERPNext: Unauthorised access to financial data due to missing validation (medium 6.5)
- [CVE-2026-108372](https://insights.sbomify.com/CVE-2026-108372/): LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files (high 7.1)
- [CVE-2026-10837](https://insights.sbomify.com/CVE-2026-10837/): Open redirection vulnerability in Password Manager (medium 5.1)
- [CVE-2026-108366](https://insights.sbomify.com/CVE-2026-108366/): easy.jobs <= 2.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Block Attribute (medium 6.4)
- [CVE-2026-108362](https://insights.sbomify.com/CVE-2026-108362/): Privasys attested TLS accepted evidence from any unrevoked TEE platform (diversion attack) (critical 9.1)
- [CVE-2026-108361](https://insights.sbomify.com/CVE-2026-108361/): Privasys Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacks (high 7.2)
- [CVE-2026-108360](https://insights.sbomify.com/CVE-2026-108360/): PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading (medium 6.4)
- [CVE-2026-10836](https://insights.sbomify.com/CVE-2026-10836/): Improper neutralization of HTTP headers in Password Manager (medium 5.1)
- [CVE-2026-108359](https://insights.sbomify.com/CVE-2026-108359/): PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS) (high 8.7)
- [CVE-2026-108358](https://insights.sbomify.com/CVE-2026-108358/): PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service (high 8.8)
- [CVE-2026-108357](https://insights.sbomify.com/CVE-2026-108357/): PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service (high 8.8)
- [CVE-2026-10835](https://insights.sbomify.com/CVE-2026-10835/): SALESmanago & Leadoo < 3.11.3 - Subscriber+ SQL Injection (high 7.7)
- [CVE-2026-10834](https://insights.sbomify.com/CVE-2026-10834/): WP Travel Engine < 6.8.1 - Subscriber+ Arbitrary Media File Move via user_profile_image (medium 4.6)
- [CVE-2026-108337](https://insights.sbomify.com/CVE-2026-108337/): Password Reset Code Accessible in User Listing API (high 7.4)
- [CVE-2026-108336](https://insights.sbomify.com/CVE-2026-108336/): Token Signing Key Allows Unauthenticated Administrative Access (critical 9.1)
- [CVE-2026-108335](https://insights.sbomify.com/CVE-2026-108335/): Password Reset Functionality Missing Brute-Force Protection (critical 9.1)
- [CVE-2026-108334](https://insights.sbomify.com/CVE-2026-108334/): Security feature bypass in Red Hat Connectivity Link 1 (high 7.4)
- [CVE-2026-108333](https://insights.sbomify.com/CVE-2026-108333/): Tanium addressed a use-after-free vulnerability in Threat Response Client Extension. (low 2.5)
- [CVE-2026-108332](https://insights.sbomify.com/CVE-2026-108332/): Tanium addressed an improper link resolution before file access vulnerability in Threat Response Client Extension. (medium 6.3)
- [CVE-2026-108331](https://insights.sbomify.com/CVE-2026-108331/): Tanium addressed an infinite loop vulnerability in Threat Response Client Extension. (low 3.3)
- [CVE-2026-108330](https://insights.sbomify.com/CVE-2026-108330/): Tanium addressed an information disclosure vulnerability in Threat Response Client Extension. (low 3.6)
- [CVE-2026-10833](https://insights.sbomify.com/CVE-2026-10833/): Cross-site scripting in Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns (medium 6.4)
- [CVE-2026-108329](https://insights.sbomify.com/CVE-2026-108329/): Tanium addressed an unauthorized code execution vulnerability in Threat Response. (high 8.8)
- [CVE-2026-108328](https://insights.sbomify.com/CVE-2026-108328/): Tanium addressed an insertion of sensitive information into log file vulnerability in Threat Response. (medium 4.2)
- [CVE-2026-108326](https://insights.sbomify.com/CVE-2026-108326/): Tanium addressed an improper certificate validation vulnerability in Stream Client Extension. (medium 6.5)
- [CVE-2026-108325](https://insights.sbomify.com/CVE-2026-108325/): Tanium addressed an insertion of sensitive information into log file vulnerability in Reputation. (medium 6.6)
- [CVE-2026-10832](https://insights.sbomify.com/CVE-2026-10832/): Denial of service in Cryostat 4 (medium 5.9)
- [CVE-2026-108316](https://insights.sbomify.com/CVE-2026-108316/): Tanium addressed an information disclosure vulnerability in Tanium Server. (medium 4.3)
- [CVE-2026-108313](https://insights.sbomify.com/CVE-2026-108313/): Tanium addressed an incorrect privilege assignment vulnerability in Tanium Server. (medium 6.6)
- [CVE-2026-108311](https://insights.sbomify.com/CVE-2026-108311/): Tanium addressed an insufficient logging vulnerability in Tanium Server. (low 2.7)
- [CVE-2026-108310](https://insights.sbomify.com/CVE-2026-108310/): Tanium addressed a denial of service vulnerability in Tanium Server. (medium 5.3)
- [CVE-2026-10831](https://insights.sbomify.com/CVE-2026-10831/): Improper Authorization of Break Signal Commands in Devices (medium 6.9)
- [CVE-2026-108309](https://insights.sbomify.com/CVE-2026-108309/): Tanium addressed an uncontrolled resource consumption vulnerability in Performance Client Extension. (medium 5.5)
- [CVE-2026-108308](https://insights.sbomify.com/CVE-2026-108308/): Tanium addressed a SQL injection vulnerability in Patch. (medium 6.5)
- [CVE-2026-108307](https://insights.sbomify.com/CVE-2026-108307/): Tanium addressed a heap-based buffer overflow vulnerability in Index. (high 7.8)
- [CVE-2026-108306](https://insights.sbomify.com/CVE-2026-108306/): Tanium addressed a local privilege escalation vulnerability in End-User Notifications. (high 7.8)
- [CVE-2026-108305](https://insights.sbomify.com/CVE-2026-108305/): Tanium addressed a local privilege escalation vulnerability in End-User Notifications. (high 7.8)
- [CVE-2026-108304](https://insights.sbomify.com/CVE-2026-108304/): Tanium addressed a local privilege escalation vulnerability in End-User Notifications. (high 7.8)
- [CVE-2026-108303](https://insights.sbomify.com/CVE-2026-108303/): Tanium addressed an unauthorized code execution vulnerability in Certificate Manager. (high 8.8)
- [CVE-2026-108302](https://insights.sbomify.com/CVE-2026-108302/): Tanium addressed an improper access controls vulnerability in Comply. (medium 4.3)
- [CVE-2026-108301](https://insights.sbomify.com/CVE-2026-108301/): Tanium addressed an improper access controls vulnerability in Comply. (medium 6.0)
- [CVE-2026-10830](https://insights.sbomify.com/CVE-2026-10830/): AllCoach < 1.0.2 - Unauthenticated Account Takeover (high 8.8)
- [CVE-2026-1083](https://insights.sbomify.com/CVE-2026-1083/): Cross-site scripting in Appointment Hour Booking – Booking Calendar (medium 4.4)
- [CVE-2026-108291](https://insights.sbomify.com/CVE-2026-108291/): WordPress Affiliates plugin <= 7.0.1 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-10829](https://insights.sbomify.com/CVE-2026-10829/): Memory corruption in NPort W2150A-W4/W2250A-W4 Series (high 8.6)
- [CVE-2026-10828](https://insights.sbomify.com/CVE-2026-10828/): Memory corruption in NPort W2150A-W4/W2250A-W4 Series (medium 6.9)
- [CVE-2026-10827](https://insights.sbomify.com/CVE-2026-10827/): Spectra (Ultimate Addons for Gutenberg) < 2.20.0 - Contributor+ Stored CSS Injection via Block Attributes (low 3.5)
- [CVE-2026-108269](https://insights.sbomify.com/CVE-2026-108269/): ra-tls-clients: RA-TLS challenge verifier accepted quotes not bound to the TLS session (critical 9.1)
- [CVE-2026-108268](https://insights.sbomify.com/CVE-2026-108268/): enclave-os-virtual: RA-TLS challenge certificates were not bound to the TLS session (critical 9.1)
- [CVE-2026-108267](https://insights.sbomify.com/CVE-2026-108267/): Privasys Go fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session (critical 9.1)
- [CVE-2026-108266](https://insights.sbomify.com/CVE-2026-108266/): Privasys rustls fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session (critical 9.1)
- [CVE-2026-108265](https://insights.sbomify.com/CVE-2026-108265/): enclave-os-mini: RA-TLS challenge certificates were not bound to the TLS session (critical 9.1)
- [CVE-2026-108264](https://insights.sbomify.com/CVE-2026-108264/): Code injection in wizarr (critical 9.1)
- [CVE-2026-108263](https://insights.sbomify.com/CVE-2026-108263/): Astron Agent: Unsandboxed code-node leads to cross-tenant RCE (critical 9.9)
- [CVE-2026-108261](https://insights.sbomify.com/CVE-2026-108261/): TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment (critical 9.3)
- [CVE-2026-108260](https://insights.sbomify.com/CVE-2026-108260/): @tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS (high 7.6)
- [CVE-2026-108259](https://insights.sbomify.com/CVE-2026-108259/): Tina: Code injection via unescaped Git branch name in generated client source (high 8.2)
- [CVE-2026-108258](https://insights.sbomify.com/CVE-2026-108258/): Shiny for Python - Path traversal in bookmark restore (medium 6.9)
- [CVE-2026-10825](https://insights.sbomify.com/CVE-2026-10825/): Improper JSON Input Validation in WebSocket API Leads to Denial of Service (high 7.1)
- [CVE-2026-10824](https://insights.sbomify.com/CVE-2026-10824/): Masteriyo LMS < 2.2.1 - Unauthenticated Course Progress Disclosure and Deletion (medium 6.5)
- [CVE-2026-10823](https://insights.sbomify.com/CVE-2026-10823/): YMC Smart Filter < 3.11.3 - Unauthenticated Private/Draft Post Disclosure (high 7.5)
- [CVE-2026-10822](https://insights.sbomify.com/CVE-2026-10822/): Key Record using PRIVATEDNS algorithm may lead to unexpected exit (medium 6.5)
- [CVE-2026-10821](https://insights.sbomify.com/CVE-2026-10821/): Yoast SEO Premium < 27.6.1 - Author+ Arbitrary .htaccess Directive Injection to RCE (medium 6.6)
- [CVE-2026-10820](https://insights.sbomify.com/CVE-2026-10820/): ProfilePress < 4.16.17 - Subscriber+ Subscription Cancellation via IDOR (high 8.1)
- [CVE-2026-1082](https://insights.sbomify.com/CVE-2026-1082/): TITLE ANIMATOR <= 1.0 - Cross-Site Request Forgery to Settings Update (medium 4.3)
- [CVE-2026-10819](https://insights.sbomify.com/CVE-2026-10819/): Mattermost Server Denial of Service via Animated GIF Emoji Upload (medium 6.5)
- [CVE-2026-108185](https://insights.sbomify.com/CVE-2026-108185/): Security feature bypass in Zoom Clients (high 7.4)
- [CVE-2026-108184](https://insights.sbomify.com/CVE-2026-108184/): Security feature bypass in Zoom Clients (high 7.4)
- [CVE-2026-10818](https://insights.sbomify.com/CVE-2026-10818/): WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize Ordering (high 8.1)
- [CVE-2026-108179](https://insights.sbomify.com/CVE-2026-108179/): WordPress WOLF plugin <= 1.1.1 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-108175](https://insights.sbomify.com/CVE-2026-108175/): WordPress MDTF plugin <= 1.4.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-108174](https://insights.sbomify.com/CVE-2026-108174/): WordPress FOX plugin <= 1.5.4 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-10817](https://insights.sbomify.com/CVE-2026-10817/): Insufficient input validation leading to memory overread (medium 6.9)
- [CVE-2026-108168](https://insights.sbomify.com/CVE-2026-108168/): WordPress Custom Query Blocks plugin <= 5.6.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-108165](https://insights.sbomify.com/CVE-2026-108165/): Immich through 3.3.1 Missing Authorization in Partner Sync Exposes Locked Folder Metadata (medium 5.3)
- [CVE-2026-108164](https://insights.sbomify.com/CVE-2026-108164/): Open Source Social Network (OSSN) through 10.1 IDOR via Message Attachment Route (high 7.1)
- [CVE-2026-108163](https://insights.sbomify.com/CVE-2026-108163/): Pingvin Share X before 1.22.0 Ineffective Authentication Rate Limiting via Throttler TTL (medium 6.9)
- [CVE-2026-108162](https://insights.sbomify.com/CVE-2026-108162/): Pingvin Share X before 1.22.0 Rate Limit Bypass via Spoofed X-Forwarded-For (medium 6.9)
- [CVE-2026-108161](https://insights.sbomify.com/CVE-2026-108161/): FusionPBX through 5.6.5 OS Command Injection via Caller ID in Recording ZIP Download (high 7.7)
- [CVE-2026-108160](https://insights.sbomify.com/CVE-2026-108160/): AstronRPA through 1.1.6 Unsigned Update Installation via Plain-HTTP Feed (high 7.7)
- [CVE-2026-10816](https://insights.sbomify.com/CVE-2026-10816/): Arbitrary File Read (Unauthenticated) (high 7.1)
- [CVE-2026-108159](https://insights.sbomify.com/CVE-2026-108159/): AstronRPA through 1.1.6 RCE via Smart-Component Chat XSS and IPC Bridge (high 7.7)
- [CVE-2026-108158](https://insights.sbomify.com/CVE-2026-108158/): plugNmeet Server through 2.5.2 Path Traversal via /api/whiteboard/convert (high 7.1)
- [CVE-2026-108157](https://insights.sbomify.com/CVE-2026-108157/): Pingvin Share X 0.19.0 before 1.22.0 Account Takeover via OAuth Email Linking (critical 9.2)
- [CVE-2026-108156](https://insights.sbomify.com/CVE-2026-108156/): LobsterAI 2026.5.27 through 2026.9.23 Arbitrary Directory Deletion via Skill _meta.json (medium 6.9)
- [CVE-2026-108151](https://insights.sbomify.com/CVE-2026-108151/): WordPress MDTF plugin <= 1.3.9 - Arbitrary Code Execution vulnerability (medium 5.3)
- [CVE-2026-10815](https://insights.sbomify.com/CVE-2026-10815/): LakshayD02 Hostel-Management-System-PHP Admin Dashboard index.php authorization (medium 5.3)
- [CVE-2026-108142](https://insights.sbomify.com/CVE-2026-108142/): Auth bypass in Backup and Replication (critical 9.1)
- [CVE-2026-108141](https://insights.sbomify.com/CVE-2026-108141/): Path traversal in Backup and Replication (medium 5.9)
- [CVE-2026-108140](https://insights.sbomify.com/CVE-2026-108140/): Path traversal in Backup and Replication (medium 5.9)
- [CVE-2026-10814](https://insights.sbomify.com/CVE-2026-10814/): milvus-io milvus Grantee ID Hash kv_catalog.go weak hash (low 2.0)
- [CVE-2026-108136](https://insights.sbomify.com/CVE-2026-108136/): Microsoft Windows Search Component Elevation of Privilege Vulnerability (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/952/