# Vulnerabilities published in 2026


- [CVE-2026-107756](https://insights.sbomify.com/CVE-2026-107756/): Cross-site scripting in Meow Lightbox (medium 6.4)
- [CVE-2026-107755](https://insights.sbomify.com/CVE-2026-107755/): Apache CouchDB: Credential Disclosure to Non-Owner Members via Object-Form Replication Endpoint URLs (medium 6.0)
- [CVE-2026-107754](https://insights.sbomify.com/CVE-2026-107754/): GeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Image Title (medium 6.4)
- [CVE-2026-107752](https://insights.sbomify.com/CVE-2026-107752/): Welcart e-Commerce <= 2.12.4 - Authenticated (Editor+) SQL Injection via 'wp_usces_order_old' Cookie (medium 4.9)
- [CVE-2026-107751](https://insights.sbomify.com/CVE-2026-107751/): Mang Board <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting via 'user_name' Parameter (high 7.2)
- [CVE-2026-10775](https://insights.sbomify.com/CVE-2026-10775/): sgl-project SGLang Cache data_hash denial of service (low 2.0)
- [CVE-2026-107748](https://insights.sbomify.com/CVE-2026-107748/): User Profile Builder <= 4.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter (medium 6.4)
- [CVE-2026-107746](https://insights.sbomify.com/CVE-2026-107746/): Missing authorization in FunnelKit – Funnel Builder Plugin for WooCommerce Checkout (high 7.5)
- [CVE-2026-107745](https://insights.sbomify.com/CVE-2026-107745/): AI Engine <= 3.8.4 - Authenticated (Subscriber+) Limited Media File Deletion via 'metadata' Parameter (medium 4.2)
- [CVE-2026-107744](https://insights.sbomify.com/CVE-2026-107744/): Missing authorization in LearnPress – WordPress LMS Plugin for Create and Sell Online Courses (medium 6.5)
- [CVE-2026-107743](https://insights.sbomify.com/CVE-2026-107743/): Mapster WP Maps <= 2.0.5 - Unauthenticated Stored Cross-Site Scripting via 'config.loading.background' Parameter (high 7.2)
- [CVE-2026-107742](https://insights.sbomify.com/CVE-2026-107742/): 10Web Booster <= 2.34.8 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name (high 7.2)
- [CVE-2026-10774](https://insights.sbomify.com/CVE-2026-10774/): PSA key-slot leak in Bluetooth Mesh subnet deletion leading to resource-exhaustion DoS (low 2.4)
- [CVE-2026-107738](https://insights.sbomify.com/CVE-2026-107738/): SumatraPDF: Untrusted binary record offset used without lower-bound validation (medium 6.8)
- [CVE-2026-107737](https://insights.sbomify.com/CVE-2026-107737/): SumatraPDF CHM `its://` signed index causes an out-of-bounds object lookup (medium 5.7)
- [CVE-2026-107736](https://insights.sbomify.com/CVE-2026-107736/): SumatraPDF: stack buffer overflow while processing EXIF Orientation metadata (medium 6.8)
- [CVE-2026-107735](https://insights.sbomify.com/CVE-2026-107735/): SumatraPDF: `sumatrapdfrestrict.ini` never revokes any permission (fail-open policy initialization) (medium 5.4)
- [CVE-2026-107734](https://insights.sbomify.com/CVE-2026-107734/): SumatraPDF: SyncTeX Argument Injection in Inverse Search Enables Arbitrary Command Execution via External Editors (high 7.1)
- [CVE-2026-107733](https://insights.sbomify.com/CVE-2026-107733/): SumatraPDF: Null-pointer dereference in `CmdExec` when no document tab is open (medium 6.8)
- [CVE-2026-107732](https://insights.sbomify.com/CVE-2026-107732/): SumatraPDF: Markup/command-link injection into UI notification text (high 8.4)
- [CVE-2026-107731](https://insights.sbomify.com/CVE-2026-107731/): SumatraPDF: LIT parser range-validation flaws cause invalid-pointer reads and denial of service (medium 5.5)
- [CVE-2026-107730](https://insights.sbomify.com/CVE-2026-107730/): SumatraPDF: Signed integer overflow in the LIT header parsing causes invalid-pointer read (medium 5.5)
- [CVE-2026-10773](https://insights.sbomify.com/CVE-2026-10773/): Out-of-bounds read in DHCPv4 client message-type name lookup (net_dhcpv4_msg_type_name) (medium 5.4)
- [CVE-2026-107729](https://insights.sbomify.com/CVE-2026-107729/): SumatraPDF: Unsigned-to-signed hdrLen validation bypass in SumatraPDF MOBI parsing causes out-of-bounds read (medium 5.5)
- [CVE-2026-107728](https://insights.sbomify.com/CVE-2026-107728/): Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy (high 7.5)
- [CVE-2026-107727](https://insights.sbomify.com/CVE-2026-107727/): Strawberry legacy graphql-ws retains naturally completed subscription slots (low 3.7)
- [CVE-2026-107726](https://insights.sbomify.com/CVE-2026-107726/): Hazelcast: Arbitrary member memory access by low-privileged client (critical 9.3)
- [CVE-2026-107725](https://insights.sbomify.com/CVE-2026-107725/): Hazelcast: Authorization bypass in IMap Predicates API (high 8.7)
- [CVE-2026-107724](https://insights.sbomify.com/CVE-2026-107724/): fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery (high 7.4)
- [CVE-2026-107723](https://insights.sbomify.com/CVE-2026-107723/): fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array (high 8.1)
- [CVE-2026-107722](https://insights.sbomify.com/CVE-2026-107722/): fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion (critical 9.8)
- [CVE-2026-107721](https://insights.sbomify.com/CVE-2026-107721/): fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache) (medium 5.9)
- [CVE-2026-107720](https://insights.sbomify.com/CVE-2026-107720/): fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set (high 7.4)
- [CVE-2026-107719](https://insights.sbomify.com/CVE-2026-107719/): fast-jwt: Verifier cache accepts expired JWTs without iat. (medium 4.2)
- [CVE-2026-107718](https://insights.sbomify.com/CVE-2026-107718/): AdonisJS: Unencoded route parameters can produce open redirects (medium 6.1)
- [CVE-2026-107717](https://insights.sbomify.com/CVE-2026-107717/): Banks: User-controlled prompt input can be parsed as privileged chat messages (medium 6.5)
- [CVE-2026-107716](https://insights.sbomify.com/CVE-2026-107716/): Banks: Symlink traversal and arbitrary file disclosure/overwrite in DirectoryPromptRegistry (high 7.3)
- [CVE-2026-107715](https://insights.sbomify.com/CVE-2026-107715/): Mechanize sends credential headers to another host after an HTTP redirect (medium 6.8)
- [CVE-2026-107714](https://insights.sbomify.com/CVE-2026-107714/): Mechanize sends credential headers to a different scheme or port after a redirect (medium 5.9)
- [CVE-2026-107712](https://insights.sbomify.com/CVE-2026-107712/): WP Booking System <= 2.1.0.1 - Authenticated (Subscriber+) SQL Injection via 'current_month' Parameter (medium 6.5)
- [CVE-2026-107710](https://insights.sbomify.com/CVE-2026-107710/): Hustle <= 7.8.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Content Title (medium 6.4)
- [CVE-2026-10771](https://insights.sbomify.com/CVE-2026-10771/): crmeb crmeb_java base64 Qrcode Endpoint RestTemplateUtil.java RestTemplate.getForEntity server-side request forgery (medium 6.9)
- [CVE-2026-107709](https://insights.sbomify.com/CVE-2026-107709/): Bower decompress-zip has a path traversal vulnerability (high 7.8)
- [CVE-2026-107708](https://insights.sbomify.com/CVE-2026-107708/): MIT krb5 through 1.22.2 KDC NULL Pointer Dereference via S4U2Proxy PAC (medium 6.9)
- [CVE-2026-107707](https://insights.sbomify.com/CVE-2026-107707/): Intego Antivirus through 3.0.0.1 Local Privilege Escalation via Optimization Module Junction (high 8.5)
- [CVE-2026-107706](https://insights.sbomify.com/CVE-2026-107706/): Dolibarr before 24.0.2 Incorrect Authorization via updateextrafield.php (medium 5.3)
- [CVE-2026-107705](https://insights.sbomify.com/CVE-2026-107705/): Poppler 0.42.0 through 26.10.0 Stack Buffer Overflow via Decrypt::revision6Hash() (high 8.3)
- [CVE-2026-107704](https://insights.sbomify.com/CVE-2026-107704/): image_optimizer 1.3.0 through 1.9.0 OS Command Injection via identify_format (critical 9.3)
- [CVE-2026-107703](https://insights.sbomify.com/CVE-2026-107703/): @enmaso/node-convert through 1.0.0 OS Command Injection via filepath and convertTo (critical 9.3)
- [CVE-2026-107702](https://insights.sbomify.com/CVE-2026-107702/): QloApps through 1.7.0 Authorization Bypass via id_hotel in Admin Room Booking (medium 5.3)
- [CVE-2026-107701](https://insights.sbomify.com/CVE-2026-107701/): dot-access through 1.0.0 Prototype Pollution via set() path argument (high 8.8)
- [CVE-2026-107700](https://insights.sbomify.com/CVE-2026-107700/): dot-access 0.0.3 through 1.0.0 Code Injection via get() Path Argument (critical 9.3)
- [CVE-2026-10770](https://insights.sbomify.com/CVE-2026-10770/): Anti-Spam by CleanTalk - Moderately critical - Cross site scripting - SA-CONTRIB-2026-042 (medium 6.1)
- [CVE-2026-107699](https://insights.sbomify.com/CVE-2026-107699/): ppt2png through 0.0.6 OS Command Injection via input and output paths (critical 9.3)
- [CVE-2026-107698](https://insights.sbomify.com/CVE-2026-107698/): FFmpeg before 7.1.4 and 8.0.2 SSRF via RTSP Redirect Handling (medium 5.3)
- [CVE-2026-107697](https://insights.sbomify.com/CVE-2026-107697/): FFmpeg before 8.1.3 HLS Demuxer Security Check Bypass via parse_playlist() (medium 5.3)
- [CVE-2026-107696](https://insights.sbomify.com/CVE-2026-107696/): FFmpeg through 9.0.2 Infinite Loop via RTSP Redirect Handling in rtsp.c (high 7.1)
- [CVE-2026-107695](https://insights.sbomify.com/CVE-2026-107695/): FFmpeg before 8.1.3 HLS Demuxer Infinite Loop via Self-Referencing Playlist (high 7.1)
- [CVE-2026-107694](https://insights.sbomify.com/CVE-2026-107694/): Dokan < 5.2.0 - Vendor+ Cross-Vendor Commission Settings Disclosure via Commission REST Endpoint (low 2.7)
- [CVE-2026-107692](https://insights.sbomify.com/CVE-2026-107692/): War Thunder Account Impersonation (medium 4.8)
- [CVE-2026-10769](https://insights.sbomify.com/CVE-2026-10769/): Commerce Core - Moderately critical - Cross site scripting - SA-CONTRIB-2026-041 (medium 5.4)
- [CVE-2026-107686](https://insights.sbomify.com/CVE-2026-107686/): Gitea reactions accepted on locked issues and comments (medium 4.3)
- [CVE-2026-107685](https://insights.sbomify.com/CVE-2026-107685/): WebSocket sessions do not verify TLS certificates, exposing API keys and OAuth tokens to on-path attackers (critical 9.1)
- [CVE-2026-107682](https://insights.sbomify.com/CVE-2026-107682/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-10768](https://insights.sbomify.com/CVE-2026-10768/): LocalGov Workflows - Moderately critical - Information disclosure - SA-CONTRIB-2026-039 (critical 9.8)
- [CVE-2026-107678](https://insights.sbomify.com/CVE-2026-107678/): FFmpeg through 9.0.2 Stack Exhaustion via Recursive Free of pssh Boxes (medium 5.7)
- [CVE-2026-107677](https://insights.sbomify.com/CVE-2026-107677/): FFmpeg through 9.0.2 DASH Demuxer Infinite Loop via Empty SegmentTemplate Media (medium 5.7)
- [CVE-2026-107676](https://insights.sbomify.com/CVE-2026-107676/): FFmpeg through 9.0.2 Uninitialized Memory Disclosure via HDR10+ Metadata Serializer (medium 4.8)
- [CVE-2026-107675](https://insights.sbomify.com/CVE-2026-107675/): FFmpeg through 9.0.2 Missing SSH Host Key Verification in sftp Protocol (medium 6.0)
- [CVE-2026-107674](https://insights.sbomify.com/CVE-2026-107674/): IBM i is Affected by a Denial of Service in Digital Certificate Manager (medium 5.1)
- [CVE-2026-107672](https://insights.sbomify.com/CVE-2026-107672/): Stack File Trusted Markdown Injection in Autodesk Fusion Post Processor Utility (high 8.8)
- [CVE-2026-107671](https://insights.sbomify.com/CVE-2026-107671/): Auth bypass in ONE (high 8.5)
- [CVE-2026-107660](https://insights.sbomify.com/CVE-2026-107660/): FFmpeg before 8.1.3 and 9.x before 9.0.2 mbedTLS Hostname Verification Bypass for IP Hosts (medium 6.3)
- [CVE-2026-10766](https://insights.sbomify.com/CVE-2026-10766/): mlrun DataFrame Hash helpers.py mlrun.utils.helpers.calculate_dataframe_hash weak hash (low 2.0)
- [CVE-2026-107659](https://insights.sbomify.com/CVE-2026-107659/): Missing authorization in Modula Image Gallery – Photo Grid & Video Gallery (high 7.5)
- [CVE-2026-107657](https://insights.sbomify.com/CVE-2026-107657/): HivePress <= 1.7.31 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value via Registration Form (high 7.2)
- [CVE-2026-107656](https://insights.sbomify.com/CVE-2026-107656/): Auth bypass in FortiSandbox (critical 9.6)
- [CVE-2026-107655](https://insights.sbomify.com/CVE-2026-107655/): Cups: null pointer dereference via embedded job ticket comments allows remote denial of service (medium 4.0)
- [CVE-2026-107652](https://insights.sbomify.com/CVE-2026-107652/): Path traversal in Database Addon for Contact Form 7 – CFDB7 (medium 5.3)
- [CVE-2026-107651](https://insights.sbomify.com/CVE-2026-107651/): Eog: eog: arbitrary code execution via heap buffer overflow in png metadata reader (medium 5.5)
- [CVE-2026-107650](https://insights.sbomify.com/CVE-2026-107650/): Cross-site scripting in GeoDirectory – WP Business Directory Plugin and Classified Listings Directory (medium 6.4)
- [CVE-2026-107649](https://insights.sbomify.com/CVE-2026-107649/): Events Made Easy <= 3.2.22 - Unauthenticated Stored Cross-Site Scripting via 'event[location_name]' Parameter (medium 5.4)
- [CVE-2026-107648](https://insights.sbomify.com/CVE-2026-107648/): Cross-site scripting in WP Sessions Time Monitoring Full Automatic (high 7.2)
- [CVE-2026-107646](https://insights.sbomify.com/CVE-2026-107646/): HUSKY <= 1.4.5 - Unauthenticated Sensitive Information Exposure in 'woof_tm_data' Localized Script (medium 5.3)
- [CVE-2026-107645](https://insights.sbomify.com/CVE-2026-107645/): Blocksy Companion <= 2.1.58 - Unauthenticated Privilege Escalation to 'role' Parameter (critical 9.1)
- [CVE-2026-107640](https://insights.sbomify.com/CVE-2026-107640/): Integrics Enswitch 3.13 through 4.4 Authentication Bypass via Password Reset API (critical 9.3)
- [CVE-2026-10764](https://insights.sbomify.com/CVE-2026-10764/): Information disclosure in BVMS 4.5 up to 12.3 (high 8.7)
- [CVE-2026-107639](https://insights.sbomify.com/CVE-2026-107639/): ILIAS before 9.24, 10.12, and 11.5 Argument Injection via Image Map Question Upload Filename (high 8.7)
- [CVE-2026-107638](https://insights.sbomify.com/CVE-2026-107638/): pH7Builder before 18.5.0 2FA Brute Force via VerificationCodeFormProcess.php (high 7.6)
- [CVE-2026-107637](https://insights.sbomify.com/CVE-2026-107637/): pH7Builder before 18.5.0 Improper Authorization via Note Module delete() Action (medium 5.3)
- [CVE-2026-107636](https://insights.sbomify.com/CVE-2026-107636/): pH7Builder before 18.5.1 Payment Bypass via Payment Module MainController (high 7.1)
- [CVE-2026-107635](https://insights.sbomify.com/CVE-2026-107635/): Dislocker through 0.7.3 Out-of-Bounds Heap Read via VMK/FVEK Datum Size Underflow (medium 6.9)
- [CVE-2026-107634](https://insights.sbomify.com/CVE-2026-107634/): Dislocker through 0.7.3 Heap Out-of-Bounds Read via BitLocker Metadata Dataset Size (medium 6.9)
- [CVE-2026-107631](https://insights.sbomify.com/CVE-2026-107631/): Record of Consent Extension for Complianz <= 2.5 - Unauthenticated Stored Cross-Site Scripting via 'uid' Parameter (high 7.2)
- [CVE-2026-10763](https://insights.sbomify.com/CVE-2026-10763/): Weak cryptography in PROMOD V (high 7.0)
- [CVE-2026-107629](https://insights.sbomify.com/CVE-2026-107629/): Cross-site scripting in Greenshift – animation and page builder blocks (medium 5.4)
- [CVE-2026-107627](https://insights.sbomify.com/CVE-2026-107627/): Cross-site scripting in Greenshift – animation and page builder blocks (medium 5.4)
- [CVE-2026-107625](https://insights.sbomify.com/CVE-2026-107625/): Ultimate Member <= 2.14.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user_url' Profile Field (medium 6.4)
- [CVE-2026-107623](https://insights.sbomify.com/CVE-2026-107623/): Keycloak-services: keycloak-services: oidc dcr read-modify-write silently disables offline token revocation (medium 4.3)
- [CVE-2026-107621](https://insights.sbomify.com/CVE-2026-107621/): J4Care dcm4che Loop with Unreachable Exit Condition (high 8.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/955/