# Vulnerabilities published in 2026


- [CVE-2026-107886](https://insights.sbomify.com/CVE-2026-107886/): Memory corruption in CUPS (low 2.3)
- [CVE-2026-107885](https://insights.sbomify.com/CVE-2026-107885/): Denial of service in CUPS (low 3.3)
- [CVE-2026-107870](https://insights.sbomify.com/CVE-2026-107870/): WordPress JetEngine plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-10787](https://insights.sbomify.com/CVE-2026-10787/): Missing authorization in Server (medium 4.3)
- [CVE-2026-107869](https://insights.sbomify.com/CVE-2026-107869/): WordPress Flexible Subscriptions plugin <= 1.8.4 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-107867](https://insights.sbomify.com/CVE-2026-107867/): WordPress JetProductTables plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-107866](https://insights.sbomify.com/CVE-2026-107866/): WordPress JetElements For Elementor plugin <= 2.9.2.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-107865](https://insights.sbomify.com/CVE-2026-107865/): WordPress JetMenu plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-107864](https://insights.sbomify.com/CVE-2026-107864/): WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-107863](https://insights.sbomify.com/CVE-2026-107863/): WordPress Products Restricted Users for WooCommerce plugin <= 0.7 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-107862](https://insights.sbomify.com/CVE-2026-107862/): WordPress Quiz And Survey Master plugin <= 11.2.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-107861](https://insights.sbomify.com/CVE-2026-107861/): Kiloview E3 NDI Encoder OS Command Injection (critical 9.4)
- [CVE-2026-10786](https://insights.sbomify.com/CVE-2026-10786/): Information disclosure in Server (medium 6.5)
- [CVE-2026-107858](https://insights.sbomify.com/CVE-2026-107858/): Cross-Site WebSocket Hijacking and Permissive CORS in Google Agent Development Kit (ADK) for Java Development Server (high 7.2)
- [CVE-2026-107857](https://insights.sbomify.com/CVE-2026-107857/): Mindwtr: Cloud token and WebDAV password stored in plaintext on mobile (medium 4.4)
- [CVE-2026-107856](https://insights.sbomify.com/CVE-2026-107856/): CiviForm: Trusted-Intermediary IDOR discloses any citizen's name and email (medium 4.5)
- [CVE-2026-107854](https://insights.sbomify.com/CVE-2026-107854/): Jexactyl: Free-billing order endpoint renews and unsuspends arbitrary servers by ID (missing ownership check) (medium 5.4)
- [CVE-2026-107852](https://insights.sbomify.com/CVE-2026-107852/): Jexactyl: Stripe checkout confirmation accepts mismatched-currency/amount payments as full payment (payment forgery) (high 7.1)
- [CVE-2026-107851](https://insights.sbomify.com/CVE-2026-107851/): Contao: Improper access control in the table access voter (medium 4.3)
- [CVE-2026-107850](https://insights.sbomify.com/CVE-2026-107850/): Contao: Improper access control in the preview links module (medium 4.3)
- [CVE-2026-107848](https://insights.sbomify.com/CVE-2026-107848/): Contao: Cross-site request forgery in custom backend actions (low 3.5)
- [CVE-2026-107845](https://insights.sbomify.com/CVE-2026-107845/): Contao: Cross-site scripting in the comments bundle (critical 9.3)
- [CVE-2026-107844](https://insights.sbomify.com/CVE-2026-107844/): Contao: Path traversal in the images controller (medium 5.3)
- [CVE-2026-107843](https://insights.sbomify.com/CVE-2026-107843/): Contao: The registration module re-sends activation mails (medium 5.3)
- [CVE-2026-107842](https://insights.sbomify.com/CVE-2026-107842/): Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled (medium 5.3)
- [CVE-2026-107841](https://insights.sbomify.com/CVE-2026-107841/): pacioli: A submit consent marker licensed cancellation of caller-named pre-existing documents (medium 5.7)
- [CVE-2026-107840](https://insights.sbomify.com/CVE-2026-107840/): yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels (high 7.5)
- [CVE-2026-107839](https://insights.sbomify.com/CVE-2026-107839/): ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Service (high 7.5)
- [CVE-2026-107838](https://insights.sbomify.com/CVE-2026-107838/): RIOT: nanocoap_fileserver ignores response initialization failure, leading to reachable assertion (high 7.5)
- [CVE-2026-107837](https://insights.sbomify.com/CVE-2026-107837/): RIOT: Out-of-Bounds Read in RIOT OS 6LoWPAN SFF Fragment Handling (high 8.2)
- [CVE-2026-107836](https://insights.sbomify.com/CVE-2026-107836/): RIOT: nanoCoAP Block2 client slice handling underflows on inconsistent server-controlled block size (high 7.1)
- [CVE-2026-107835](https://insights.sbomify.com/CVE-2026-107835/): OWASP Coraza WAF: Cookie Parser Confusion (medium 4.0)
- [CVE-2026-107834](https://insights.sbomify.com/CVE-2026-107834/): OWASP Coraza WAF: Resource exhaustion via deferred file handle accumulation in multipart body processor (medium 5.3)
- [CVE-2026-107833](https://insights.sbomify.com/CVE-2026-107833/): OWASP Coraza WAF: Unbounded recursion in JSON response body processor causes CPU exhaustion (medium 5.9)
- [CVE-2026-107832](https://insights.sbomify.com/CVE-2026-107832/): fastify vulnerable to header validation bypass via case-sensitive propertyNames (low 3.7)
- [CVE-2026-107831](https://insights.sbomify.com/CVE-2026-107831/): Jivejdon through 5.0 CSRF via GET-based Account and Thread Actions (medium 5.3)
- [CVE-2026-107830](https://insights.sbomify.com/CVE-2026-107830/): Jivejdon through commit ee67a65e Missing Rate Limiting via /account/smsVRAction SMS Endpoint (medium 6.9)
- [CVE-2026-10783](https://insights.sbomify.com/CVE-2026-10783/): gradio-app gradio Audio Cache Key save_audio_to_cache weak hash (low 2.0)
- [CVE-2026-107829](https://insights.sbomify.com/CVE-2026-107829/): Jivejdon through 5.0 Unsalted MD5 Password Storage via AccountDaoSql (high 8.2)
- [CVE-2026-107828](https://insights.sbomify.com/CVE-2026-107828/): Jivejdon through 5.0 Predictable Passwords via Sina Weibo OAuth Login (medium 6.9)
- [CVE-2026-107826](https://insights.sbomify.com/CVE-2026-107826/): Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) (high 7.5)
- [CVE-2026-107825](https://insights.sbomify.com/CVE-2026-107825/): Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations (medium 4.0)
- [CVE-2026-107824](https://insights.sbomify.com/CVE-2026-107824/): x64dbg-MCP Server exposes debugger operations to unauthenticated network clients (critical 9.3)
- [CVE-2026-107823](https://insights.sbomify.com/CVE-2026-107823/): MariaDB: privilege escalation via incorrect view frm parsing (high 7.2)
- [CVE-2026-107822](https://insights.sbomify.com/CVE-2026-107822/): MariaDB: database privilege escalation via user / role name collision in the acl cache (medium 6.4)
- [CVE-2026-107821](https://insights.sbomify.com/CVE-2026-107821/): MariaDB: insufficient validation of binary frm data when opening a table (high 8.0)
- [CVE-2026-107820](https://insights.sbomify.com/CVE-2026-107820/): x64dbg-MCP Server vulnerable to pre-authentication denial of service through Content-Length integer overflow (medium 5.3)
- [CVE-2026-10782](https://insights.sbomify.com/CVE-2026-10782/): Missing authorization in RealHomes Memberships (medium 4.3)
- [CVE-2026-107819](https://insights.sbomify.com/CVE-2026-107819/): MariaDB Connector/C: libmariadb allowed cleartext password leakage on TLS hostname verification failure (medium 5.9)
- [CVE-2026-107818](https://insights.sbomify.com/CVE-2026-107818/): MariaDB: environment injection via wsrep bootstrap in the mariadb.service file (high 8.4)
- [CVE-2026-107817](https://insights.sbomify.com/CVE-2026-107817/): MariaDB: mysql_json plugin OOB reads (medium 4.4)
- [CVE-2026-107816](https://insights.sbomify.com/CVE-2026-107816/): MariaDB: `qc_info` plugin can do OOB reads if query contains \0 (medium 6.4)
- [CVE-2026-107815](https://insights.sbomify.com/CVE-2026-107815/): MariaDB: one byte OOB write in DOS tables of the CONNECT engine (high 8.5)
- [CVE-2026-107814](https://insights.sbomify.com/CVE-2026-107814/): MariaDB: Insecure $HOME in MariaDB rpm packages (high 8.4)
- [CVE-2026-107813](https://insights.sbomify.com/CVE-2026-107813/): Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up (high 8.8)
- [CVE-2026-107812](https://insights.sbomify.com/CVE-2026-107812/): Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM (high 7.5)
- [CVE-2026-107811](https://insights.sbomify.com/CVE-2026-107811/): 0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser (high 8.8)
- [CVE-2026-107810](https://insights.sbomify.com/CVE-2026-107810/): Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied (high 8.1)
- [CVE-2026-107809](https://insights.sbomify.com/CVE-2026-107809/): Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs (high 8.8)
- [CVE-2026-107808](https://insights.sbomify.com/CVE-2026-107808/): Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass) (high 8.1)
- [CVE-2026-107807](https://insights.sbomify.com/CVE-2026-107807/): Nginx UI: Node Secret Credential Exposure via URL Query Parameter (high 8.8)
- [CVE-2026-107806](https://insights.sbomify.com/CVE-2026-107806/): Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite (critical 9.4)
- [CVE-2026-107805](https://insights.sbomify.com/CVE-2026-107805/): Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage (high 7.5)
- [CVE-2026-107804](https://insights.sbomify.com/CVE-2026-107804/): Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout (medium 5.3)
- [CVE-2026-107803](https://insights.sbomify.com/CVE-2026-107803/): ProcessMaker has SQL injection in the tasks endpoint through the order_by parameter (medium 6.5)
- [CVE-2026-107802](https://insights.sbomify.com/CVE-2026-107802/): SumatraPDF — Windows command-line argument injection in AI selection-translate (high 7.1)
- [CVE-2026-107801](https://insights.sbomify.com/CVE-2026-107801/): Jivejdon through 5.0 Stored XSS via Attachment Upload Content-Type (medium 5.1)
- [CVE-2026-107800](https://insights.sbomify.com/CVE-2026-107800/): Jivejdon through 5.0 Stored XSS via Private Short Messages (medium 5.1)
- [CVE-2026-10780](https://insights.sbomify.com/CVE-2026-10780/): Missing authorization in Static Block (medium 4.3)
- [CVE-2026-1078](https://insights.sbomify.com/CVE-2026-1078/): Other in Pega Robot Studio (high 7.2)
- [CVE-2026-107799](https://insights.sbomify.com/CVE-2026-107799/): Jivejdon through 5.0 Stored XSS via messageListBody.jsp Forum Message Rendering (medium 5.1)
- [CVE-2026-107798](https://insights.sbomify.com/CVE-2026-107798/): Jivejdon through commit ee67a65e Stored XSS via Markdown Links in TextStyle Rendering Filter (medium 5.1)
- [CVE-2026-107797](https://insights.sbomify.com/CVE-2026-107797/): Jivejdon through 5.0 Reflected XSS via postThread.jsp to and tag Parameters (medium 5.3)
- [CVE-2026-107796](https://insights.sbomify.com/CVE-2026-107796/): Jivejdon through commit ee67a65e Reflected XSS via taggedThreadList.jsp tagID and count Parameters (medium 5.3)
- [CVE-2026-107795](https://insights.sbomify.com/CVE-2026-107795/): Improper Authorization in TP-Link Omada Controller TLS Certificate and Private Key Management API (high 7.5)
- [CVE-2026-107794](https://insights.sbomify.com/CVE-2026-107794/): ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list (high 7.5)
- [CVE-2026-107793](https://insights.sbomify.com/CVE-2026-107793/): Jivejdon through 5.0 IDOR via subSaveAction Subscription Delete (medium 5.3)
- [CVE-2026-107792](https://insights.sbomify.com/CVE-2026-107792/): Jivejdon through commit ee67a65e Missing Authorization via /message/threadToForum/save Thread Move (medium 5.3)
- [CVE-2026-107791](https://insights.sbomify.com/CVE-2026-107791/): WP Comment Cleaner 6.1 - 7.1 - Subscriber+ Bulk Comment Deletion via nav_delete_all_comment (medium 6.5)
- [CVE-2026-107790](https://insights.sbomify.com/CVE-2026-107790/): WP Job Openings < 4.1.1 - Author+ Stored XSS via Job Title (medium 6.8)
- [CVE-2026-10779](https://insights.sbomify.com/CVE-2026-10779/): Missing authorization in Classified Listing – AI-Powered Classified ads & Business Directory (medium 4.3)
- [CVE-2026-107789](https://insights.sbomify.com/CVE-2026-107789/): SmartyParcel < 1.23.4 - Unauthenticated Shipping Label Disclosure via IDOR (medium 5.3)
- [CVE-2026-107788](https://insights.sbomify.com/CVE-2026-107788/): SmartyParcel (WC Ukr Shipping) < 1.23.4 - Subscriber+ Arbitrary Shipping Label Deletion (medium 4.3)
- [CVE-2026-107785](https://insights.sbomify.com/CVE-2026-107785/): Crux Agent silently fails SKA preshared key rotation when SHA-512 peering is negotiated (medium 6.3)
- [CVE-2026-107783](https://insights.sbomify.com/CVE-2026-107783/): Insertion of sensitive information into log file in AWS Tools for PowerShell (medium 6.7)
- [CVE-2026-107782](https://insights.sbomify.com/CVE-2026-107782/): System Informer before 4.0.26241.138 Incorrect Authorization in phsvc ALPC Port (high 8.5)
- [CVE-2026-107781](https://insights.sbomify.com/CVE-2026-107781/): Dromara Skyeye Unauthenticated SSRF and File Overwrite via editUploadOfficeFileById (critical 9.1)
- [CVE-2026-107780](https://insights.sbomify.com/CVE-2026-107780/): Dromara Skyeye Unauthenticated OS Command Injection via textToSpeech format Parameter (critical 9.3)
- [CVE-2026-107779](https://insights.sbomify.com/CVE-2026-107779/): Dromara Skyeye xxl-job-admin Missing Authentication on Job Endpoints Allows RCE (critical 9.3)
- [CVE-2026-107778](https://insights.sbomify.com/CVE-2026-107778/): MIT krb5 through 1.22.2 NULL Pointer Dereference via krb5_rd_cred() (high 7.1)
- [CVE-2026-107777](https://insights.sbomify.com/CVE-2026-107777/): Thermo Fisher Torrent Suite Software Path Traversal (high 7.1)
- [CVE-2026-107770](https://insights.sbomify.com/CVE-2026-107770/): Missing authorization in Photo Engine (Media Organizer & Lightroom) (medium 6.8)
- [CVE-2026-10777](https://insights.sbomify.com/CVE-2026-10777/): ealpha072 Student-Management-System Administrative Backend config.php improper authentication (medium 6.9)
- [CVE-2026-107768](https://insights.sbomify.com/CVE-2026-107768/): Cross-site scripting in TranslatePress – Translate Multilingual sites with AI Translation (high 7.2)
- [CVE-2026-107764](https://insights.sbomify.com/CVE-2026-107764/): Cross-site scripting in SiteOrigin CSS (high 7.2)
- [CVE-2026-107763](https://insights.sbomify.com/CVE-2026-107763/): Missing authorization in Fastcache by Host.it (medium 4.3)
- [CVE-2026-107762](https://insights.sbomify.com/CVE-2026-107762/): Missing authorization in Kirki – Freeform Page Builder, Website Builder & Customizer (high 7.5)
- [CVE-2026-107761](https://insights.sbomify.com/CVE-2026-107761/): Channel tokens and organization API key exposed in API responses (medium 5.3)
- [CVE-2026-107758](https://insights.sbomify.com/CVE-2026-107758/): Colibri Page Builder <= 1.0.390 - Unauthenticated Stored Cross-Site Scripting via Comments (high 7.2)
- [CVE-2026-107757](https://insights.sbomify.com/CVE-2026-107757/): Cross-site scripting in Gallery Custom Links (medium 4.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/954/