# Vulnerabilities published in 2026


- [CVE-2026-107275](https://insights.sbomify.com/CVE-2026-107275/): @fastify/jwt vulnerable to missing token expiration when temporal options cannot be parsed (medium 6.8)
- [CVE-2026-107273](https://insights.sbomify.com/CVE-2026-107273/): Gophish 0.11.0 through 0.12.1 SSRF via POST /api/import/site (medium 5.3)
- [CVE-2026-107272](https://insights.sbomify.com/CVE-2026-107272/): Gophish through 0.12.1 XSS via Unescaped SMTP Server Error Messages (low 2.3)
- [CVE-2026-107271](https://insights.sbomify.com/CVE-2026-107271/): Gophish through 0.12.1 Login Rate Limit Bypass via X-Forwarded-For Spoofing (medium 6.9)
- [CVE-2026-107270](https://insights.sbomify.com/CVE-2026-107270/): Gophish through 0.12.1 Object Takeover via Client-Supplied ID on API Create Endpoints (high 7.1)
- [CVE-2026-10727](https://insights.sbomify.com/CVE-2026-10727/): Command injection in Endpoint Manager Mobile (high 7.2)
- [CVE-2026-107269](https://insights.sbomify.com/CVE-2026-107269/): Gophish through 0.12.1 Username Enumeration via POST /login Timing Discrepancy (medium 6.3)
- [CVE-2026-10726](https://insights.sbomify.com/CVE-2026-10726/): Cato Windows SDP Client arbitrary file disclosure due to improper TLS certificate validation (medium 6.8)
- [CVE-2026-10725](https://insights.sbomify.com/CVE-2026-10725/): Protocol::HTTP2 versions before 1.13 for Perl is vulnerable to a HTTP/2 Bomb (high 7.5)
- [CVE-2026-107248](https://insights.sbomify.com/CVE-2026-107248/): CVE-2026-107248 (high 8.8)
- [CVE-2026-10724](https://insights.sbomify.com/CVE-2026-10724/): Reviews Feed < 2.6.5 - Unauthenticated Stored Arbitrary Shortcode Execution via Google Reviews (medium 4.8)
- [CVE-2026-107239](https://insights.sbomify.com/CVE-2026-107239/): Code injection in Management Pack for Microsoft System Center (high 8.8)
- [CVE-2026-107238](https://insights.sbomify.com/CVE-2026-107238/): Deserialization in Management Pack for Microsoft System Center (high 8.7)
- [CVE-2026-107237](https://insights.sbomify.com/CVE-2026-107237/): Backup and Staging by WP Time Capsule < 1.22.28 - Subscriber+ Staging-to-Live Deployment via wptc_copy_stage_to_live (high 8.2)
- [CVE-2026-107232](https://insights.sbomify.com/CVE-2026-107232/): AsyncHttpClient: Origin credentials sent in cleartext to a proxy that rejects the CONNECT (high 7.5)
- [CVE-2026-107231](https://insights.sbomify.com/CVE-2026-107231/): AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext (high 8.7)
- [CVE-2026-107230](https://insights.sbomify.com/CVE-2026-107230/): AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins (high 7.4)
- [CVE-2026-10723](https://insights.sbomify.com/CVE-2026-10723/): Incorrect acceptance of NSEC3 records (medium 6.8)
- [CVE-2026-107229](https://insights.sbomify.com/CVE-2026-107229/): Security feature bypass in async-http-client (medium 4.0)
- [CVE-2026-107228](https://insights.sbomify.com/CVE-2026-107228/): AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix) (medium 6.8)
- [CVE-2026-107227](https://insights.sbomify.com/CVE-2026-107227/): AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled (high 7.5)
- [CVE-2026-107226](https://insights.sbomify.com/CVE-2026-107226/): AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS (medium 6.8)
- [CVE-2026-107225](https://insights.sbomify.com/CVE-2026-107225/): Excelize: GetStyle panics on a negative fillId, borderId or fontId in styles.xml (medium 6.5)
- [CVE-2026-107224](https://insights.sbomify.com/CVE-2026-107224/): Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/OpenReader (medium 6.5)
- [CVE-2026-107223](https://insights.sbomify.com/CVE-2026-107223/): Excelize: Unbounded <col max> attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the process (high 7.1)
- [CVE-2026-107222](https://insights.sbomify.com/CVE-2026-107222/): Excelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no length or nil check (medium 6.5)
- [CVE-2026-107221](https://insights.sbomify.com/CVE-2026-107221/): Excelize: a row whose earlier cell has a higher column reference than its last cell panics index out of range on almost every worksheet read API (medium 6.5)
- [CVE-2026-107220](https://insights.sbomify.com/CVE-2026-107220/): Excelize: Panic in cellInRange on a worksheet with an empty mergeCell ref (medium 6.5)
- [CVE-2026-10722](https://insights.sbomify.com/CVE-2026-10722/): cilium ebpf LoadCollectionSpec/LoadCollectionSpecFromReader btf.go loadRawSpec integer overflow (medium 4.8)
- [CVE-2026-107219](https://insights.sbomify.com/CVE-2026-107219/): Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFile (high 7.5)
- [CVE-2026-107218](https://insights.sbomify.com/CVE-2026-107218/): Excelize: RIGHT() on supplementary-plane text slices with a negative index and panics (medium 5.3)
- [CVE-2026-107217](https://insights.sbomify.com/CVE-2026-107217/): Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r="0" rows (high 7.5)
- [CVE-2026-107216](https://insights.sbomify.com/CVE-2026-107216/): Excelize ANCHORARRAY: mutually-referencing array formulas recurse unboundedly via re-entrant CalcCellValue, causing a fatal stack overflow (high 7.5)
- [CVE-2026-107215](https://insights.sbomify.com/CVE-2026-107215/): Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoS (high 7.5)
- [CVE-2026-107214](https://insights.sbomify.com/CVE-2026-107214/): Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks (high 7.5)
- [CVE-2026-107213](https://insights.sbomify.com/CVE-2026-107213/): Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element (high 8.7)
- [CVE-2026-107212](https://insights.sbomify.com/CVE-2026-107212/): Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days (high 7.5)
- [CVE-2026-107211](https://insights.sbomify.com/CVE-2026-107211/): Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panic (high 8.7)
- [CVE-2026-107210](https://insights.sbomify.com/CVE-2026-107210/): ImageMagick: Policy Bypass in MAT decoder when reading highly compressed data (medium 5.3)
- [CVE-2026-10721](https://insights.sbomify.com/CVE-2026-10721/): Concrete CMS: PHP Object Injection via unserialize() calls (high 8.4)
- [CVE-2026-107209](https://insights.sbomify.com/CVE-2026-107209/): ImageMagick: Use-After-Free in RSVG decoder that is build without cairo support (medium 5.9)
- [CVE-2026-107208](https://insights.sbomify.com/CVE-2026-107208/): ImageMagick: Denial of service with crafted XMP profile (medium 5.3)
- [CVE-2026-107207](https://insights.sbomify.com/CVE-2026-107207/): LMCache through 0.5.5 Missing Authentication in Frontend Node Catalog Allows SSRF Allowlist Bypass (medium 6.9)
- [CVE-2026-107206](https://insights.sbomify.com/CVE-2026-107206/): LMCache through 0.5.5 Missing Authentication in MP HTTP Server Management API (high 8.8)
- [CVE-2026-107205](https://insights.sbomify.com/CVE-2026-107205/): LMCache through 0.5.5 Missing Authentication in MP Coordinator Fleet Control API (high 8.8)
- [CVE-2026-107204](https://insights.sbomify.com/CVE-2026-107204/): LMCache through 0.5.5 Unauthenticated RCE via /run_script Endpoint (critical 9.3)
- [CVE-2026-107203](https://insights.sbomify.com/CVE-2026-107203/): Foreman: domain and subnet interface api skips host search filters (medium 5.4)
- [CVE-2026-107202](https://insights.sbomify.com/CVE-2026-107202/): CVE-2026-107202 (critical 9.1)
- [CVE-2026-10720](https://insights.sbomify.com/CVE-2026-10720/): MicroCeph path traversal issue in the remote-import API (medium 5.1)
- [CVE-2026-1072](https://insights.sbomify.com/CVE-2026-1072/): Keybase.io Verification <= 1.4.5 - Cross-Site Request Forgery to Settings Update (medium 4.3)
- [CVE-2026-107194](https://insights.sbomify.com/CVE-2026-107194/): Auth bypass in iSolarCloud (critical 9.2)
- [CVE-2026-107193](https://insights.sbomify.com/CVE-2026-107193/): Foreman: api filter lookup ignores a search-limited filter permission (medium 6.5)
- [CVE-2026-10719](https://insights.sbomify.com/CVE-2026-10719/): Open Seachest/Seachest NVMe show Format Descriptors Vulnerability (low 1.8)
- [CVE-2026-107188](https://insights.sbomify.com/CVE-2026-107188/): Eptura Archibus Workflow Rule Enables Unauthenticated Arbitrary File Upload Leading to Remote Code Execution (critical 9.6)
- [CVE-2026-107187](https://insights.sbomify.com/CVE-2026-107187/): Eptura Archibus Workflow Rule Enables Unauthenticated Database Read of Sensitive Tables (high 8.5)
- [CVE-2026-107186](https://insights.sbomify.com/CVE-2026-107186/): Eptura Archibus Direct Web Remoting (DWR) API Authentication Bypass via Privileged Session Reuse (high 8.6)
- [CVE-2026-107183](https://insights.sbomify.com/CVE-2026-107183/): llama.cpp before b11393 Use-After-Free via common_chat_peg_mapper chat_parser (critical 9.2)
- [CVE-2026-107181](https://insights.sbomify.com/CVE-2026-107181/): Telegram Desktop before 7.2.9 IPC Record Injection File Exfiltration via interpret: Scheme (high 8.6)
- [CVE-2026-107180](https://insights.sbomify.com/CVE-2026-107180/): MISP: Forced TOTP Enrolment Bypassed via Non-Browser Request Types on otp_required Instances (high 7.1)
- [CVE-2026-10718](https://insights.sbomify.com/CVE-2026-10718/): Open Seachest/Seachest NVMe Trim (Deallocate) Vulnerability (medium 4.6)
- [CVE-2026-107178](https://insights.sbomify.com/CVE-2026-107178/): Image Photo Gallery Final Tiles Grid < 3.6.16 - Contributor+ Stored XSS via 'lightboxOptions' Parameter (medium 6.8)
- [CVE-2026-107177](https://insights.sbomify.com/CVE-2026-107177/): Express Gateway through 1.16.11 Hardcoded Default cipherKey Exposes OAuth Tokens (high 7.4)
- [CVE-2026-107176](https://insights.sbomify.com/CVE-2026-107176/): Cluster-samples-operator: role reads all secrets in openshift-config, not just pull-secret (medium 6.8)
- [CVE-2026-107175](https://insights.sbomify.com/CVE-2026-107175/): MISP Correlation Engine Fails to Refresh When Event Distribution or Sharing Group Changes (medium 5.3)
- [CVE-2026-107174](https://insights.sbomify.com/CVE-2026-107174/): Source-to-image: source-to-image: security boundary bypass via absolute symbolic link extraction (medium 6.4)
- [CVE-2026-107171](https://insights.sbomify.com/CVE-2026-107171/): Hardcoded credentials in Trellix Agent (medium 6.9)
- [CVE-2026-107170](https://insights.sbomify.com/CVE-2026-107170/): M17n-lib: null dereference in minput_open_im() after failed m17n_init() (low 2.9)
- [CVE-2026-10717](https://insights.sbomify.com/CVE-2026-10717/): Open-Seachest/Seachest show SCSI Defect List Vulnerability (low 1.8)
- [CVE-2026-107169](https://insights.sbomify.com/CVE-2026-107169/): M17n-lib: null-pointer write in read_mtext_element() on malformed utf-8 (medium 6.2)
- [CVE-2026-107168](https://insights.sbomify.com/CVE-2026-107168/): M17n-lib: parser infinite loop on malformed utf-8 in count_utf_8_chars() (medium 6.2)
- [CVE-2026-107167](https://insights.sbomify.com/CVE-2026-107167/): M17n-lib: heap use-after-free write in re_init_ic() (medium 6.2)
- [CVE-2026-107166](https://insights.sbomify.com/CVE-2026-107166/): Open5GS GTP-U Receive Path gtp-path.c ogs_pfcp_xact_local_create allocation of resources (medium 6.9)
- [CVE-2026-107162](https://insights.sbomify.com/CVE-2026-107162/): Express Gateway through 1.16.11 OAuth 2.0 Refresh Token Validation Bypass (high 7.6)
- [CVE-2026-107161](https://insights.sbomify.com/CVE-2026-107161/): Memory corruption in Red Hat Enterprise Linux 10 (high 7.5)
- [CVE-2026-107160](https://insights.sbomify.com/CVE-2026-107160/): LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated Stored HTML Injection via Checkout Error Message (medium 5.3)
- [CVE-2026-10716](https://insights.sbomify.com/CVE-2026-10716/): Directus <12.1.0 - Authenticated time-based SQL injection in PostgreSQL/PostGIS collection creation (high 7.5)
- [CVE-2026-107159](https://insights.sbomify.com/CVE-2026-107159/): MiniUPnPd through 2.3.11 Divide-by-Zero DoS via SSDP M-SEARCH MX Header (high 7.1)
- [CVE-2026-107158](https://insights.sbomify.com/CVE-2026-107158/): Missing authorization in LTL Freight Quotes (medium 5.3)
- [CVE-2026-107157](https://insights.sbomify.com/CVE-2026-107157/): Out-of-bounds read vulnerability in QCborValue::fromCbor() impacts Qt Framework (low 2.0)
- [CVE-2026-107153](https://insights.sbomify.com/CVE-2026-107153/): Hardcoded credentials in Rakuten BIGs (high 7.0)
- [CVE-2026-107151](https://insights.sbomify.com/CVE-2026-107151/): Rubygem-smart_proxy_dynflow: task update and done callbacks accept unauthenticated requests (medium 5.9)
- [CVE-2026-10715](https://insights.sbomify.com/CVE-2026-10715/): Camaleon CMS 2.9.2 - Improper authorization in draft autosave endpoint (medium 5.1)
- [CVE-2026-107147](https://insights.sbomify.com/CVE-2026-107147/): Authentication bypass by spoofing in twofactor_gauthenticator (medium 6.3)
- [CVE-2026-107146](https://insights.sbomify.com/CVE-2026-107146/): Insufficient session expiration in twofactor_gauthenticator (medium 6.3)
- [CVE-2026-107145](https://insights.sbomify.com/CVE-2026-107145/): Lack of rate-limiting in 2fa code check mechanism in twofactor_gauthenticator (medium 6.3)
- [CVE-2026-10714](https://insights.sbomify.com/CVE-2026-10714/): Rockwell Automation FactoryTalk® Services Platform FTSP - Weak Authentication via JWT Validation Bypass (high 8.8)
- [CVE-2026-107128](https://insights.sbomify.com/CVE-2026-107128/): Uncanny Toolkit for LearnDash < 3.8.2 - Admin+ Cross-Site Account Lockout via Missing Authorization (medium 5.0)
- [CVE-2026-107127](https://insights.sbomify.com/CVE-2026-107127/): Uncanny Toolkit for LearnDash < 3.8.2 - Account Takeover via Password Reset CSRF (high 7.5)
- [CVE-2026-107126](https://insights.sbomify.com/CVE-2026-107126/): WP Booking System < 2.1.0.1 - Unauthenticated Stored XSS via X-Forwarded-For Header (high 8.8)
- [CVE-2026-107125](https://insights.sbomify.com/CVE-2026-107125/): XnView Classic FLI File heap-based overflow (medium 5.3)
- [CVE-2026-107121](https://insights.sbomify.com/CVE-2026-107121/): Keycloak-services: keycloak-services: smtp starttls plaintext credential and message downgrade (medium 6.5)
- [CVE-2026-107120](https://insights.sbomify.com/CVE-2026-107120/): Contest Gallery < 33.0.1 - Unauthenticated Email Verification Bypass via Brute-Forceable Registration PIN (medium 5.3)
- [CVE-2026-10712](https://insights.sbomify.com/CVE-2026-10712/): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (high 8.0)
- [CVE-2026-10711](https://insights.sbomify.com/CVE-2026-10711/): RCE in Akınsoft's CafePlus (high 8.8)
- [CVE-2026-107104](https://insights.sbomify.com/CVE-2026-107104/): Unsafe Deserialization Vulnerability in Manacle Technologies ERP System (critical 9.3)
- [CVE-2026-107103](https://insights.sbomify.com/CVE-2026-107103/): SQL Injection Vulnerability in Manacle Technologies ERP System (critical 9.3)
- [CVE-2026-107102](https://insights.sbomify.com/CVE-2026-107102/): Account Takeover Vulnerability in Manacle Technologies ERP System (critical 9.3)
- [CVE-2026-107100](https://insights.sbomify.com/CVE-2026-107100/): Royal Elementor Addons 1.3.81 - 1.7.1069 - Unauthenticated Non-Public Post Content Disclosure via wpr_get_page_content (medium 5.3)
- [CVE-2026-10710](https://insights.sbomify.com/CVE-2026-10710/): FBX ExtractDrive Stack-Based Buffer Overflow Vulnerability in Autodesk FBX SDK (high 7.8)
- [CVE-2026-1071](https://insights.sbomify.com/CVE-2026-1071/): Carta Online <= 2.13.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings (medium 4.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/958/