# Vulnerabilities published in 2026


- [CVE-2026-108135](https://insights.sbomify.com/CVE-2026-108135/): Windows Backup Engine Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-108134](https://insights.sbomify.com/CVE-2026-108134/): Windows Autopilot Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-108133](https://insights.sbomify.com/CVE-2026-108133/): Windows Modern Device Management (MDM) Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-108132](https://insights.sbomify.com/CVE-2026-108132/): Windows Kerberos Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-108131](https://insights.sbomify.com/CVE-2026-108131/): Active Directory Federation Services (AD FS) Spoofing Vulnerability (high 7.5)
- [CVE-2026-108130](https://insights.sbomify.com/CVE-2026-108130/): Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-10813](https://insights.sbomify.com/CVE-2026-10813/): LMCache KV Cache utils.py hex_hash_to_int16 weak hash (low 2.0)
- [CVE-2026-108129](https://insights.sbomify.com/CVE-2026-108129/): Role: DNS Server Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-108128](https://insights.sbomify.com/CVE-2026-108128/): Role: DNS Server Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-108127](https://insights.sbomify.com/CVE-2026-108127/): Role: DNS Server Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-108126](https://insights.sbomify.com/CVE-2026-108126/): temporal-proxy payload decryption is not bound to the request namespace (medium 6.0)
- [CVE-2026-108125](https://insights.sbomify.com/CVE-2026-108125/): WordPress Post Author Authenticated SQLi (high 7.1)
- [CVE-2026-108124](https://insights.sbomify.com/CVE-2026-108124/): WordPress Post Author Authenticated SQLi (medium 4.9)
- [CVE-2026-108123](https://insights.sbomify.com/CVE-2026-108123/): Missing authorization in WP Booking System – Booking Calendar (high 7.5)
- [CVE-2026-108121](https://insights.sbomify.com/CVE-2026-108121/): Koozali - SME Server Improper Input Validation in domain Creation Leads to Denial of Service (medium 6.9)
- [CVE-2026-108120](https://insights.sbomify.com/CVE-2026-108120/): path traversal inKoozali - SME Server (high 7.7)
- [CVE-2026-10812](https://insights.sbomify.com/CVE-2026-10812/): zilliztech GPTCache Cache Key pre.py BufferedReader.peek weak hash (low 2.0)
- [CVE-2026-108119](https://insights.sbomify.com/CVE-2026-108119/): Busybox: busybox: tar extraction-root escape via deferred symlink/hardlink creation bypasses cve-2026-26158 fix (medium 6.3)
- [CVE-2026-108116](https://insights.sbomify.com/CVE-2026-108116/): MDX and SOAP Injection in Kendo UI for jQuery (high 7.5)
- [CVE-2026-108115](https://insights.sbomify.com/CVE-2026-108115/): Kortix Suna 0.10.7 before 0.13.52 SSRF Guard Bypass via IPv6 6to4 Addresses (low 2.3)
- [CVE-2026-108114](https://insights.sbomify.com/CVE-2026-108114/): Strapi 5.47.0 through 5.57.0 Improper Authorization via Admin API Token Field Permissions (medium 5.3)
- [CVE-2026-108113](https://insights.sbomify.com/CVE-2026-108113/): ILIAS before 9.24, 10.12, and 11.5 Unrestricted File Upload via QTI Import (high 8.7)
- [CVE-2026-108112](https://insights.sbomify.com/CVE-2026-108112/): ruoyi-ai 3.0.0 through 3.1.0 Missing Authorization via Workflow Delete Endpoint (medium 5.3)
- [CVE-2026-108111](https://insights.sbomify.com/CVE-2026-108111/): ruoyi-ai 3.0.0 through 3.1.0 Missing Authorization via /workflow/search (medium 5.3)
- [CVE-2026-108110](https://insights.sbomify.com/CVE-2026-108110/): MOVO through 0.2.3 Authorization Bypass via Document Endpoints (high 7.6)
- [CVE-2026-10811](https://insights.sbomify.com/CVE-2026-10811/): itsourcecode Fees Management System receipt.php sql injection (medium 5.3)
- [CVE-2026-108109](https://insights.sbomify.com/CVE-2026-108109/): PHPNuxBill through 2025.3.20 Account Takeover via Brute-Forceable Password Reset Code (critical 9.3)
- [CVE-2026-108108](https://insights.sbomify.com/CVE-2026-108108/): PHPNuxBill through 2025.3.20 CHAP Authentication Bypass via Password::chap_verify() (high 7.1)
- [CVE-2026-108107](https://insights.sbomify.com/CVE-2026-108107/): PHPNuxBill through 2025.3.20 Unauthenticated SQL Injection via radius.php (critical 9.3)
- [CVE-2026-108106](https://insights.sbomify.com/CVE-2026-108106/): Xerial snappy-java before 1.1.10.9 Unbounded Memory Allocation Denial of Service (high 8.7)
- [CVE-2026-108105](https://insights.sbomify.com/CVE-2026-108105/): Open5GS through 2.8.0 MME Reachable Assertion via GTPv1 SGSN Context Request (high 8.2)
- [CVE-2026-108104](https://insights.sbomify.com/CVE-2026-108104/): Xerial snappy-java 1.1.7.4 before 1.1.10.10 Double Release of Pooled Buffers in SnappyFramedInputStream (medium 6.3)
- [CVE-2026-108103](https://insights.sbomify.com/CVE-2026-108103/): Open5GS through 2.8.0 Heap Out-of-Bounds Read via PFCP Dropped DL Traffic Threshold IE (medium 6.9)
- [CVE-2026-108102](https://insights.sbomify.com/CVE-2026-108102/): Open5GS through 2.8.0 Heap Out-of-Bounds Read via PFCP Volume Measurement IE (medium 6.9)
- [CVE-2026-108101](https://insights.sbomify.com/CVE-2026-108101/): HortusFox through 6.3 Unrestricted File Upload via Plant Attachments (high 7.7)
- [CVE-2026-108100](https://insights.sbomify.com/CVE-2026-108100/): HortusFox before 6.2 SQL Injection via /api/locations/list include_info Parameter (high 7.1)
- [CVE-2026-10810](https://insights.sbomify.com/CVE-2026-10810/): itsourcecode Fees Management System navbar.php cross site scripting (medium 5.3)
- [CVE-2026-1081](https://insights.sbomify.com/CVE-2026-1081/): Set Bulk Post Categories <= 1.1 - Cross-Site Request Forgery to Bulk Post Category Update (medium 4.3)
- [CVE-2026-108096](https://insights.sbomify.com/CVE-2026-108096/): Improper authorization in query resolvers for SQL-backed models in AWS Amplify API Category (high 7.1)
- [CVE-2026-108094](https://insights.sbomify.com/CVE-2026-108094/): Mutter: mutter: client-triggered use-after-free in wayland color-management icc image description path (high 7.8)
- [CVE-2026-108093](https://insights.sbomify.com/CVE-2026-108093/): Gimp: gimp: denial of service via null pointer dereference in xcf simulation parasite loading (medium 5.5)
- [CVE-2026-108092](https://insights.sbomify.com/CVE-2026-108092/): Missing authorization in Blog2Social: Social Media Auto Post & Scheduler (medium 4.3)
- [CVE-2026-10809](https://insights.sbomify.com/CVE-2026-10809/): itsourcecode Fees Management System manage_user.php sql injection (medium 5.3)
- [CVE-2026-108089](https://insights.sbomify.com/CVE-2026-108089/): Apache Cocoon: Unauthenticated access to diagnostic interfaces (high 7.5)
- [CVE-2026-108088](https://insights.sbomify.com/CVE-2026-108088/): Apache Cocoon: Cross-user cache poisoning (high 7.5)
- [CVE-2026-108087](https://insights.sbomify.com/CVE-2026-108087/): Apache Cocoon: SQL Injection (high 8.8)
- [CVE-2026-108086](https://insights.sbomify.com/CVE-2026-108086/): Apache Cocoon: XEE could lead to SSRF and information disclosure (high 7.5)
- [CVE-2026-108082](https://insights.sbomify.com/CVE-2026-108082/): Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header (high 8.7)
- [CVE-2026-10808](https://insights.sbomify.com/CVE-2026-10808/): itsourcecode Fees Management System manage_student.php sql injection (medium 5.3)
- [CVE-2026-108073](https://insights.sbomify.com/CVE-2026-108073/): SureCart < 4.9.5 - Unauthenticated Private Catalog Data Disclosure via 'expand' Parameter (medium 5.3)
- [CVE-2026-108072](https://insights.sbomify.com/CVE-2026-108072/): Insecure Permissions on Shared Startup Scripts Allow Cross-User Code Execution and Potential Privilege Escalation (medium 5.4)
- [CVE-2026-108071](https://insights.sbomify.com/CVE-2026-108071/): Improper Multi-Factor Authentication Validation Allows Authentication Bypass (high 8.7)
- [CVE-2026-108070](https://insights.sbomify.com/CVE-2026-108070/): Improper Access Control Allows Unauthorized Access to Protected Internal Web Resources in TSplus Remote Access (high 8.7)
- [CVE-2026-10807](https://insights.sbomify.com/CVE-2026-10807/): mjperpinosa stumasy change_profile_image.php unrestricted upload (medium 5.3)
- [CVE-2026-108069](https://insights.sbomify.com/CVE-2026-108069/): Sunshine Photo Cart < 3.7.4 - Unauthenticated Content Injection via sunshine_modal_add_comment() (medium 5.3)
- [CVE-2026-108066](https://insights.sbomify.com/CVE-2026-108066/): WP 2FA < 4.2.0 - Admin+ Arbitrary User 2FA Removal via IDOR (low 2.7)
- [CVE-2026-108065](https://insights.sbomify.com/CVE-2026-108065/): Unauthenticated SQL Injection in Channel Software WebAlliance eCommerce (critical 9.8)
- [CVE-2026-108064](https://insights.sbomify.com/CVE-2026-108064/): WP Encryption < 7.8.8.2 - Unauthenticated Certificate Private Key and ACME Order Replacement via wple_auto_handler (medium 6.5)
- [CVE-2026-108063](https://insights.sbomify.com/CVE-2026-108063/): Libhangul: null pointer dereference in hanja_new() when looking up a malformed hanja dictionary entry (medium 5.5)
- [CVE-2026-108062](https://insights.sbomify.com/CVE-2026-108062/): Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop (medium 6.9)
- [CVE-2026-10806](https://insights.sbomify.com/CVE-2026-10806/): mjperpinosa stumasy add_post.php unrestricted upload (medium 5.3)
- [CVE-2026-10805](https://insights.sbomify.com/CVE-2026-10805/): Networkmanager: networkmanager: local privilege escalation via malformed mud urls in dhclient backend (medium 6.7)
- [CVE-2026-10804](https://insights.sbomify.com/CVE-2026-10804/): Streamlit Palette hashing.py weak hash (low 2.0)
- [CVE-2026-108039](https://insights.sbomify.com/CVE-2026-108039/): Apache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character limits (high 7.5)
- [CVE-2026-10803](https://insights.sbomify.com/CVE-2026-10803/): MLflow Dataset Digest Computation digest_utils.py mlflow.data.digest_utils weak hash (low 2.0)
- [CVE-2026-10802](https://insights.sbomify.com/CVE-2026-10802/): keystonejs keystone GraphQL API Endpoint output-field.ts resource consumption (medium 5.3)
- [CVE-2026-108015](https://insights.sbomify.com/CVE-2026-108015/): eMudhra Compromised Certificate vulnerability impacts HCL Notes Client (critical 9.1)
- [CVE-2026-108014](https://insights.sbomify.com/CVE-2026-108014/): eMudhra Compromised Certificate vulnerability impacts HCL Domino Server (critical 9.1)
- [CVE-2026-108013](https://insights.sbomify.com/CVE-2026-108013/): HCL BigFix Platform is affected by security vulnerability around intermediate CA certificate bundle (CVE ID) (medium 6.8)
- [CVE-2026-10801](https://insights.sbomify.com/CVE-2026-10801/): modelscope ms-swift PIL Image Cache Key base.py Template._save_pil_image weak hash (low 2.0)
- [CVE-2026-10800](https://insights.sbomify.com/CVE-2026-10800/): PaddlePaddle FastDeploy MultimodalHasher hasher.py hash_features weak hash (low 2.0)
- [CVE-2026-1080](https://insights.sbomify.com/CVE-2026-1080/): Authorization Bypass Through User-Controlled Key in GitLab (medium 4.3)
- [CVE-2026-10796](https://insights.sbomify.com/CVE-2026-10796/): nvm executes commands from a malicious Node.js mirror's version strings (high 7.5)
- [CVE-2026-10795](https://insights.sbomify.com/CVE-2026-10795/): UpdraftPlus: WP Backup & Migration Plugin <= 1.26.4 - Unauthenticated Authentication Bypass via UpdraftCentral udrpc (high 8.1)
- [CVE-2026-107938](https://insights.sbomify.com/CVE-2026-107938/): Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification. (critical 9.1)
- [CVE-2026-107937](https://insights.sbomify.com/CVE-2026-107937/): Denial of service in Apache CXF (high 7.5)
- [CVE-2026-107935](https://insights.sbomify.com/CVE-2026-107935/): Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose (critical 9.3)
- [CVE-2026-107929](https://insights.sbomify.com/CVE-2026-107929/): local interface connection reuse mixup (not scored)
- [CVE-2026-107928](https://insights.sbomify.com/CVE-2026-107928/): info leak uploading over WebSockets with GnuTLS (not scored)
- [CVE-2026-107918](https://insights.sbomify.com/CVE-2026-107918/): Insufficient input validation vulnerability in NETGEAR R7300 (medium 4.3)
- [CVE-2026-107917](https://insights.sbomify.com/CVE-2026-107917/): Insufficient input validation vulnerability in NETGEAR R7300 router (medium 4.3)
- [CVE-2026-107914](https://insights.sbomify.com/CVE-2026-107914/): Information disclosure in Backdrop (high 7.8)
- [CVE-2026-107911](https://insights.sbomify.com/CVE-2026-107911/): Type confusion in FalkorDB GRAPH.QUERY via the --bolt argument (high 7.7)
- [CVE-2026-107910](https://insights.sbomify.com/CVE-2026-107910/): Authentication bypass in FalkorDB Bolt endpoint via fail-open AUTH probe error handling (critical 9.2)
- [CVE-2026-107909](https://insights.sbomify.com/CVE-2026-107909/): Pre-authentication heap out-of-bounds write in FalkorDB Bolt WebSocket frame handling via unbounded payload length (high 8.8)
- [CVE-2026-107908](https://insights.sbomify.com/CVE-2026-107908/): Pre-authentication heap out-of-bounds write in FalkorDB Bolt BoltReadHandler via RESET message (critical 9.3)
- [CVE-2026-107907](https://insights.sbomify.com/CVE-2026-107907/): MAS Videos <= 1.3.4 - Subscriber+ Arbitrary Post Deletion via delete_video/delete_playlist (medium 6.5)
- [CVE-2026-107900](https://insights.sbomify.com/CVE-2026-107900/): Memory corruption in V-SFT (high 8.4)
- [CVE-2026-1079](https://insights.sbomify.com/CVE-2026-1079/): Other in Pega Browser Extension (PBE) (medium 6.0)
- [CVE-2026-107899](https://insights.sbomify.com/CVE-2026-107899/): Memory corruption in V-SFT (high 8.4)
- [CVE-2026-107898](https://insights.sbomify.com/CVE-2026-107898/): Memory corruption in V-SFT (high 8.4)
- [CVE-2026-107897](https://insights.sbomify.com/CVE-2026-107897/): Memory corruption in V-SFT (high 8.4)
- [CVE-2026-107896](https://insights.sbomify.com/CVE-2026-107896/): Memory corruption in V-SFT (high 8.4)
- [CVE-2026-107895](https://insights.sbomify.com/CVE-2026-107895/): Memory corruption in V-SFT (high 8.4)
- [CVE-2026-107894](https://insights.sbomify.com/CVE-2026-107894/): Memory corruption in V-SFT (high 8.4)
- [CVE-2026-107890](https://insights.sbomify.com/CVE-2026-107890/): Null dereference in CUPS (low 3.3)
- [CVE-2026-10789](https://insights.sbomify.com/CVE-2026-10789/): MCP Extension Code Injection Vulnerability in Autodesk Fusion Desktop (critical 9.6)
- [CVE-2026-107889](https://insights.sbomify.com/CVE-2026-107889/): Keycloak-services: keycloak-services: stored xss on login page via kcsanitize bypass (medium 5.5)
- [CVE-2026-107888](https://insights.sbomify.com/CVE-2026-107888/): Null dereference in CUPS (medium 5.1)
- [CVE-2026-107887](https://insights.sbomify.com/CVE-2026-107887/): Advanced Twenty Seventeen <= 1.3.1 - Subscriber+ Site Theme Switch via ats_create_child_theme (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/953/