# Vulnerabilities published in 2026


- [CVE-2026-107098](https://insights.sbomify.com/CVE-2026-107098/): Royal Elementor Addons 1.7.1037 - 1.7.1069 - Contributor+ Stored XSS via Google Maps Widget Height Setting (medium 6.8)
- [CVE-2026-107097](https://insights.sbomify.com/CVE-2026-107097/): Royal Elementor Addons 1.3.71 - 1.7.1069 - Unauthenticated Mailchimp Audience Injection via mailchimp_subscribe (medium 5.3)
- [CVE-2026-107092](https://insights.sbomify.com/CVE-2026-107092/): NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint. (critical 9.8)
- [CVE-2026-107091](https://insights.sbomify.com/CVE-2026-107091/): An issue in HUION Inspiroy Frego S (L310) Windows Driver 20.0.1.118 allows a local attacker to execute arbitrary code via the HUION driver i (high 7.8)
- [CVE-2026-107090](https://insights.sbomify.com/CVE-2026-107090/): An issue in Maltego Technologies GmbH Maltego Windows Installer 4.13.0 allows a local attacker to execute arbitrary code via the Maltego Win (not scored)
- [CVE-2026-10709](https://insights.sbomify.com/CVE-2026-10709/): FBX BinaryReadSectionHeader Stack-Based Buffer Overflow Vulnerability in Autodesk FBX SDK (high 7.8)
- [CVE-2026-107084](https://insights.sbomify.com/CVE-2026-107084/): Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows cross-site request forgery (CSRF) against admin/modules/circulation/loan_hi (high 8.8)
- [CVE-2026-107083](https://insights.sbomify.com/CVE-2026-107083/): SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injection in admin/modules/reporting/customs/dl_ (critical 9.8)
- [CVE-2026-107082](https://insights.sbomify.com/CVE-2026-107082/): Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticated staff user to perform SQL injection via the opac_hide and (high 8.8)
- [CVE-2026-107081](https://insights.sbomify.com/CVE-2026-107081/): SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints (admin/AJAX_lookup_handler.p (critical 9.8)
- [CVE-2026-107080](https://insights.sbomify.com/CVE-2026-107080/): OpenJPEG 2.4.0 through 2.5.4, and git master through commit 8314119b, contains an out-of-bounds read and write in opj_dwt_encode_and_deinter (not scored)
- [CVE-2026-10708](https://insights.sbomify.com/CVE-2026-10708/): Insufficiently Protected Credentials (high 7.5)
- [CVE-2026-107079](https://insights.sbomify.com/CVE-2026-107079/): An issue in Systrome Validation & Certification 1.0 allows an attacker to cause a denial of service via the t URL parameter in the qrcode_au (not scored)
- [CVE-2026-107067](https://insights.sbomify.com/CVE-2026-107067/): An issue in Shirt Pocket's SuperDuper! (not scored)
- [CVE-2026-107060](https://insights.sbomify.com/CVE-2026-107060/): Insecure permissions in Tailscale versionCode 297862600 allows unauthorized attackers to make arbitrary changes to another user's VPN config (not scored)
- [CVE-2026-10706](https://insights.sbomify.com/CVE-2026-10706/): Exposure of Sensitive Information to an Unauthorized attacker (high 7.5)
- [CVE-2026-107059](https://insights.sbomify.com/CVE-2026-107059/): An issue in Nextcloud versionCode 30390190 allows attackers to force victim users to logout of their accounts and switch to an attacker cont (not scored)
- [CVE-2026-107058](https://insights.sbomify.com/CVE-2026-107058/): An issue in Shelter versionCode 445 allows attackers to register their own auth_key and execute a takeover of another user's binder service (critical 9.8)
- [CVE-2026-107057](https://insights.sbomify.com/CVE-2026-107057/): An issue in AndBible versionCode 1111 allows attackers to execute arbitrary code via uploading a crafted module zip. (not scored)
- [CVE-2026-107056](https://insights.sbomify.com/CVE-2026-107056/): Insecure permissions in the io.file.importer.ImportActivity component of OpenTracks versionCode 6751 allows unauthorized attackers to inject (not scored)
- [CVE-2026-107055](https://insights.sbomify.com/CVE-2026-107055/): Insecure permissions in the autosave component of AppML neutriNote CE versionCode 1387 allows unauthorized attackers to write arbitrary files. (not scored)
- [CVE-2026-107053](https://insights.sbomify.com/CVE-2026-107053/): Insecure permissions in foobnix Librera PDF Reader versionCode 7222 allows unauthorized attackers to arbitrarily write and truncate files in (not scored)
- [CVE-2026-107052](https://insights.sbomify.com/CVE-2026-107052/): Insecure permissions in the AIDL interface of ProjectMAXS MAXS Module FileRead versionCode 27 allows unauthorized attackers to arbitrarily r (high 7.5)
- [CVE-2026-107051](https://insights.sbomify.com/CVE-2026-107051/): Insecure permissions in klassm AndFHEM v2.4.1 (versionCode 241, the verified build) allows unauthorized attackers to arbitrarily manipulate (not scored)
- [CVE-2026-107050](https://insights.sbomify.com/CVE-2026-107050/): An issue in libretro RetroArch v1.22.2 allows attackers to force another user into loading attacker-supplied code in their uid, leading to a (not scored)
- [CVE-2026-10705](https://insights.sbomify.com/CVE-2026-10705/): dask HLL hyperloglog.py nunique_approx resource consumption (low 2.3)
- [CVE-2026-107049](https://insights.sbomify.com/CVE-2026-107049/): An issue in Forkyz versionCode 8500000 allows attackers to arbitrarily change another user's storage settings via supplying a crafted URI string. (not scored)
- [CVE-2026-107048](https://insights.sbomify.com/CVE-2026-107048/): An issue in the WebView rendering path component of MotionCreative Motion UI versionCode 101 allows attackers to execute arbitrary code via (not scored)
- [CVE-2026-107047](https://insights.sbomify.com/CVE-2026-107047/): Insecure permissions in mendhak GPSLogger versionCode 137 allows unauthorized attackers to arbitrarily manipulate the app's logging mechanism and log data. (high 7.5)
- [CVE-2026-107046](https://insights.sbomify.com/CVE-2026-107046/): A Server-Side Request Forgery (SSRF) in the url/title/author/coverUrl component of FocusPodcast versionCode 70allows attackers to scan inter (not scored)
- [CVE-2026-107045](https://insights.sbomify.com/CVE-2026-107045/): Insecure permissions in the CitrineContentProvider component of Citrine v3.1.0 (versionCode 62) allows unauthorized attackers to arbitrarily (not scored)
- [CVE-2026-107044](https://insights.sbomify.com/CVE-2026-107044/): Insecure permissions in ProjectMAXS MAXS Main v0.5.19 (versionCode 19) allows unauthorized attackers to arbitrarily manipulate the app's MAX (not scored)
- [CVE-2026-107043](https://insights.sbomify.com/CVE-2026-107043/): Insecure permissions in Code Catcher versionCode 131 allow unauthorized attackers to arbitrarily manipulate the app's SMS-code-capture mechanism. (not scored)
- [CVE-2026-107042](https://insights.sbomify.com/CVE-2026-107042/): Insecure permissions in USP Ultimate Screenshot Painter versionCode 240213.009 allows unauthorized attackers to move or overwrite files in a (high 7.5)
- [CVE-2026-107041](https://insights.sbomify.com/CVE-2026-107041/): Insecure permissions in the FeatureActionActivity component of Oasis Feng Island versionCode 51801 allows unauthorized attackers to arbitrar (not scored)
- [CVE-2026-107040](https://insights.sbomify.com/CVE-2026-107040/): Insecure permissions in MBasov OMN-Go versionCode 26080824 allows unauthorized attackers to invoke an exported component, leading to arbitra (not scored)
- [CVE-2026-10704](https://insights.sbomify.com/CVE-2026-10704/): SourceCodester Pizzafy E-Commerce System Administrative Control Panel admin_class_novo.php login sql injection (medium 6.9)
- [CVE-2026-107039](https://insights.sbomify.com/CVE-2026-107039/): Insecure permissions in the ActivityMain component of M66B/Marcel Bokhorst NetGuard no-root firewall versionCode 2026080101/versionName 2.33 (not scored)
- [CVE-2026-107038](https://insights.sbomify.com/CVE-2026-107038/): Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an exported component, leading (not scored)
- [CVE-2026-107037](https://insights.sbomify.com/CVE-2026-107037/): Insecure permissions in the NotificationHelper component of NoNonsense Notes versionCode 72600 allows unauthorized attackers to write in ano (high 7.5)
- [CVE-2026-107036](https://insights.sbomify.com/CVE-2026-107036/): Insecure permissions in Mission Control / AIMSICD versionCode 2026080501 allows unauthorized attackers to invoke an exported component, impa (not scored)
- [CVE-2026-107035](https://insights.sbomify.com/CVE-2026-107035/): Insecure permissions in the object/Page.java component of MBasov OMN Outline notes Markdown versionCode 3400 allows unauthorized attackers t (not scored)
- [CVE-2026-107034](https://insights.sbomify.com/CVE-2026-107034/): Insecure permissions in LeafPad / Leaf Note v1.21 (versionCode 21) allows unauthorized attackers to arbitrarily read another user's note data. (not scored)
- [CVE-2026-107033](https://insights.sbomify.com/CVE-2026-107033/): Insecure permissions in the MirakelInternalContentProvider component of Mirakel v3.0 (versionCode 60) allows unauthorized attackers to arbit (not scored)
- [CVE-2026-107032](https://insights.sbomify.com/CVE-2026-107032/): Insecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allows unauthorized attackers to invoke an exported component, l (critical 9.1)
- [CVE-2026-107030](https://insights.sbomify.com/CVE-2026-107030/): Insecure permissions in craftxbox YubiClip XOR fork v1.0.1 (versionCode 10003) allows unauthorized attackers to trigger the OTP-clipboard (O (not scored)
- [CVE-2026-10703](https://insights.sbomify.com/CVE-2026-10703/): EIPStackGroup OpENer SendRRData cipmessagerouter.c CreateMessageRouterRequestStructure use after free (medium 5.3)
- [CVE-2026-107029](https://insights.sbomify.com/CVE-2026-107029/): Insecure permissions in rubenalfon Pile v1.1.3 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwriting. (not scored)
- [CVE-2026-107028](https://insights.sbomify.com/CVE-2026-107028/): Insecure permissions in wbpxre150 Shopping List v11.0 (versionCode 11) allows unauthorized attackers to invoke an exported component, leadin (not scored)
- [CVE-2026-107027](https://insights.sbomify.com/CVE-2026-107027/): Insecure permissions in lz233 Tarnhelm v1.8.2 (versionCode 20250630) allows unauthorized attackers to invoke an exported component, leading (not scored)
- [CVE-2026-107026](https://insights.sbomify.com/CVE-2026-107026/): Insecure permissions in Share to Clipboard v1.14.1 (versionCode 32) allows unauthorized attackers to arbitrarily overwrite another user's clipboard content. (high 7.5)
- [CVE-2026-107025](https://insights.sbomify.com/CVE-2026-107025/): Insecure permissions in WikiAndPad alpha/beta v0.2alpha03 (versionCode 200300) allows unauthorized attackers to export the application's data. (not scored)
- [CVE-2026-107024](https://insights.sbomify.com/CVE-2026-107024/): Insecure permissions in Share 2 Archive Today versionCode 61 allows unauthorized attackers to arbitrarily overwrite another user's clipboard (not scored)
- [CVE-2026-107023](https://insights.sbomify.com/CVE-2026-107023/): Insecure permissions in the ContentProvider component of mhss1 MyBrain v3.1.0 allows unauthorized attackers to arbitrarily read another user (not scored)
- [CVE-2026-107021](https://insights.sbomify.com/CVE-2026-107021/): Insecure permissions in the CardProvider content provider component of helloworld1 AnyMemo versionCode 20260730 allows unauthorized attacker (not scored)
- [CVE-2026-107020](https://insights.sbomify.com/CVE-2026-107020/): An issue in the activity.LoadLinkLaterActivity component of FeedEx / Handy News Reader versionCode 116 allows attackers to force victim user (high 7.5)
- [CVE-2026-10702](https://insights.sbomify.com/CVE-2026-10702/): JIT miscompilation in the JavaScript Engine: JIT component (medium 4.3)
- [CVE-2026-107019](https://insights.sbomify.com/CVE-2026-107019/): Insecure permissions in the feiertage.ImportActivity component of Arbeitszeiterfassung2 versionCode 159 allows unauthorized attackers to cre (not scored)
- [CVE-2026-107018](https://insights.sbomify.com/CVE-2026-107018/): Insecure permissions in Ghost Commander File Manager versionCode 479 allows unauthorized attackers to arbitrarily read and write files insid (not scored)
- [CVE-2026-107017](https://insights.sbomify.com/CVE-2026-107017/): Insecure permissions in the ShortcutDispatchActivity component of canvoki versionCode 14 allows unauthorized attackers to arbitrarily trigge (not scored)
- [CVE-2026-107016](https://insights.sbomify.com/CVE-2026-107016/): Insecure permissions in Fossify v1.3.0 allows unauthorized attackers to access and read another user's stored contacts. (not scored)
- [CVE-2026-107015](https://insights.sbomify.com/CVE-2026-107015/): Insecure permissions in Simple Contacts Pro versionCode 107 allow unauthorized attackers to write and read notes in another user's' note database. (critical 9.1)
- [CVE-2026-107014](https://insights.sbomify.com/CVE-2026-107014/): Insecure permissions in Bander Notepad (bander.notepad) versionCode 12 allow unauthorized attackers to write and read notes in another user's' note database. (not scored)
- [CVE-2026-10701](https://insights.sbomify.com/CVE-2026-10701/): Incorrect boundary conditions in the Graphics: Text component (high 7.5)
- [CVE-2026-10700](https://insights.sbomify.com/CVE-2026-10700/): Missing authorization in Langflow OSS (medium 6.5)
- [CVE-2026-1070](https://insights.sbomify.com/CVE-2026-1070/): Alex User Counter <= 6.0 - Cross-Site Request Forgery to Settings Update (medium 4.3)
- [CVE-2026-10699](https://insights.sbomify.com/CVE-2026-10699/): Memory leak in SFTP service can result in a denial of service in MOVEit Transfer (high 7.5)
- [CVE-2026-10698](https://insights.sbomify.com/CVE-2026-10698/): Table scope bypass vulnerability in custom reports (high 7.2)
- [CVE-2026-106972](https://insights.sbomify.com/CVE-2026-106972/): Uncontrolled recursion in MessagePack\BufferUnpacker::unpack() in rybakit/msgpack versions prior to 0.11.0 allows attackers to cause a denia (not scored)
- [CVE-2026-106971](https://insights.sbomify.com/CVE-2026-106971/): An integer overflow in the MessagePack\BufferUnpacker component of rybakit/msgpack versions prior to 0.11.0 allows attackers to cause a deni (not scored)
- [CVE-2026-10697](https://insights.sbomify.com/CVE-2026-10697/): MFA Bypass in MOVEit Transfer (high 7.5)
- [CVE-2026-10696](https://insights.sbomify.com/CVE-2026-10696/): Code injection in UniGetUI (high 7.5)
- [CVE-2026-10695](https://insights.sbomify.com/CVE-2026-10695/): IBM® Db2® is vulnerable to a denial of service when running non fenced federated queries (medium 6.2)
- [CVE-2026-10694](https://insights.sbomify.com/CVE-2026-10694/): SourceCodester Online Food Ordering System index.php include file inclusion (medium 6.9)
- [CVE-2026-106933](https://insights.sbomify.com/CVE-2026-106933/): Blaze Demo Importer < 1.0.17 - Author+ Stored XSS via SVG Upload (medium 6.8)
- [CVE-2026-106932](https://insights.sbomify.com/CVE-2026-106932/): Moloni < 5.0.14 - Subscriber+ Arbitrary Order Invoice Generation via genInvoice (medium 6.5)
- [CVE-2026-106931](https://insights.sbomify.com/CVE-2026-106931/): EG Secure Solutions SiteGuard Server Edition OS Command Injection (high 8.5, exploited in the wild)
- [CVE-2026-10693](https://insights.sbomify.com/CVE-2026-10693/): SourceCodester Online Boat Reservation System Administrative Endpoint improper authorization (medium 5.3)
- [CVE-2026-10692](https://insights.sbomify.com/CVE-2026-10692/): johnhuang316 code-index-mcp search_code_advanced is_safe_regex_pattern redos (medium 5.3)
- [CVE-2026-10691](https://insights.sbomify.com/CVE-2026-10691/): wonderwhy-er DesktopCommanderMCP start_search search-manager.ts redos (medium 5.3)
- [CVE-2026-10690](https://insights.sbomify.com/CVE-2026-10690/): wonderwhy-er DesktopCommanderMCP read_file filesystem.ts readFileFromUrl server-side request forgery (medium 5.3)
- [CVE-2026-1069](https://insights.sbomify.com/CVE-2026-1069/): Uncontrolled Recursion in GitLab (high 7.5)
- [CVE-2026-10688](https://insights.sbomify.com/CVE-2026-10688/): ahujasid blender-mcp server.py execute_blender_code code injection (medium 5.1)
- [CVE-2026-10686](https://insights.sbomify.com/CVE-2026-10686/): Missing hop-limit decrement on IPv6 forwarding path allows unbounded packet looping (DoS) in Zephyr routers (medium 5.8)
- [CVE-2026-10685](https://insights.sbomify.com/CVE-2026-10685/): Use-after-free of GATT subscribe params in Bluetooth host CCC-write response handler (high 7.6)
- [CVE-2026-10684](https://insights.sbomify.com/CVE-2026-10684/): Out-of-bounds read in coredump shell when printing stored-dump target code (low 3.0)
- [CVE-2026-10683](https://insights.sbomify.com/CVE-2026-10683/): DesignWare I2C target driver can be wedged into a permanent stuck state by an on-bus master (DoS) (low 2.4)
- [CVE-2026-10682](https://insights.sbomify.com/CVE-2026-10682/): Out-of-bounds write in Zephyr `log_filter_set` syscall verifier reachable from userspace (medium 6.6)
- [CVE-2026-10681](https://insights.sbomify.com/CVE-2026-10681/): Race condition in zephyr (medium 6.5)
- [CVE-2026-10680](https://insights.sbomify.com/CVE-2026-10680/): Out-of-bounds access in Zephyr BR/EDR L2CAP configuration request handling via `uint16_t` length underflow (high 7.6)
- [CVE-2026-1068](https://insights.sbomify.com/CVE-2026-1068/): Security feature bypass in FileZ (medium 6.0)
- [CVE-2026-10679](https://insights.sbomify.com/CVE-2026-10679/): Divide-by-zero in DesignWare SPI driver reachable from spi_transceive syscall (local DoS) (low 3.3)
- [CVE-2026-106781](https://insights.sbomify.com/CVE-2026-106781/): An issue in WCH CH340/CH341 USB-to-Serial Windows Driver setup package CH341SER.EXE version 4.0 allows a local attacker to escalate privileges. (not scored)
- [CVE-2026-10678](https://insights.sbomify.com/CVE-2026-10678/): NULL-pointer / out-of-bounds write in Zephyr MCTP I2C+GPIO target binding driven by an unauthenticated I2C controller (high 8.1)
- [CVE-2026-10677](https://insights.sbomify.com/CVE-2026-10677/): Kernel heap memory leak in `z_vrfy_k_poll()` lets an unprivileged user thread exhaust the kernel resource pool (medium 6.5)
- [CVE-2026-106765](https://insights.sbomify.com/CVE-2026-106765/): An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function. (high 7.5)
- [CVE-2026-106764](https://insights.sbomify.com/CVE-2026-106764/): @rog0x/mcp-git-tools executes arbitrary code via the resolveBaseBranch function (high 7.5)
- [CVE-2026-106763](https://insights.sbomify.com/CVE-2026-106763/): @justice8096/sagemath-mcp-server: executes arbitrary code via the escapeShellString and sanitizeCode functions (high 7.5)
- [CVE-2026-10675](https://insights.sbomify.com/CVE-2026-10675/): Bluetooth Mesh PB-ADV: invalidated provisioning link kept alive indefinitely, blocking (re)provisioning (DoS) (medium 4.3)
- [CVE-2026-10674](https://insights.sbomify.com/CVE-2026-10674/): DoS (hard fault) in NXP LPUART driver: unsupported runtime UART config leaves clocks disabled (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/959/