# Vulnerabilities published in 2026


- [CVE-2026-10673](https://insights.sbomify.com/CVE-2026-10673/): Out-of-bounds write in ADIN2111/ADIN1110 OA SPI Ethernet RX frame reassembly (high 8.3)
- [CVE-2026-10672](https://insights.sbomify.com/CVE-2026-10672/): Unterminated URI buffer causes out-of-bounds read in LwM2M firmware pull (Package URI) (high 8.2)
- [CVE-2026-10671](https://insights.sbomify.com/CVE-2026-10671/): User thread can re-initialize an in-use `k_pipe`, corrupting kernel wait queues (`CONFIG_USERSPACE`) (high 7.1)
- [CVE-2026-106708](https://insights.sbomify.com/CVE-2026-106708/): XXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability in the user management controller (JobUserController). (high 8.8)
- [CVE-2026-106707](https://insights.sbomify.com/CVE-2026-106707/): XXL-JOB <=3.5.0-SNAPSHOT contains a stored Cross-Site Scripting (XSS) vulnerability in the job log list page (/joblog). (medium 5.4)
- [CVE-2026-106706](https://insights.sbomify.com/CVE-2026-106706/): XXL-JOB through 3.5.0-SNAPSHOT is vulnerable to stored cross-site scripting (XSS) in the GLUE code editor. (medium 5.4)
- [CVE-2026-106705](https://insights.sbomify.com/CVE-2026-106705/): ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability in the role management module. (high 8.8)
- [CVE-2026-106701](https://insights.sbomify.com/CVE-2026-106701/): ELADMIN v2.7 and before is vulnerable to Cross Site Scripting (XSS) via the component WebSocketServer, SpringSecurityConfig, deploy.vue. (medium 6.1)
- [CVE-2026-106700](https://insights.sbomify.com/CVE-2026-106700/): ELADMIN v2.7 and earlier contains an improper access control vulnerability in the user-management endpoint PUT /api/users/resetPwd of me.zhe (high 8.8)
- [CVE-2026-10670](https://insights.sbomify.com/CVE-2026-10670/): User-triggerable kernel NULL-pointer dereference (DoS) in `k_thread_name_copy()` syscall verifier (medium 5.5)
- [CVE-2026-10669](https://insights.sbomify.com/CVE-2026-10669/): Xtensa MPU `arch_buffer_validate()` integer-overflow lets a user thread bypass syscall pointer validation (high 7.8)
- [CVE-2026-10668](https://insights.sbomify.com/CVE-2026-10668/): Host-triggerable control-endpoint wedge (DoS) in Nuvoton NuMaker HSUSBD UDC driver (low 2.4)
- [CVE-2026-106677](https://insights.sbomify.com/CVE-2026-106677/): Homestay3 homestay-backend 0.0.1-SNAPSHOT contains an IDOR in ChatServiceImpl. (not scored)
- [CVE-2026-106676](https://insights.sbomify.com/CVE-2026-106676/): qiujie mall-server 0.0.1-SNAPSHOT contains an integer overflow in CartServiceImpl that allows an authenticated user to wrap a cart quantity to a negative value. (not scored)
- [CVE-2026-10667](https://insights.sbomify.com/CVE-2026-10667/): Use after free in zephyr (high 7.8)
- [CVE-2026-10666](https://insights.sbomify.com/CVE-2026-10666/): Stack buffer overflow in `net_ipaddr_parse()` IPv4 address-with-port parsing in `subsys/net/ip/utils.c` (high 8.1)
- [CVE-2026-10665](https://insights.sbomify.com/CVE-2026-10665/): Heap buffer overflow on WireGuard receive path via unbounded incoming packet length (high 7.4)
- [CVE-2026-106648](https://insights.sbomify.com/CVE-2026-106648/): Royal Elementor Addons < 1.7.1070 - Unauthenticated Arbitrary Email Recipient Injection via Form Field ID Shortcodes (medium 5.3)
- [CVE-2026-106647](https://insights.sbomify.com/CVE-2026-106647/): Royal Elementor Addons 1.3.68 - 1.7.1069 - Author+ Form Submission Interception via Widget ID Collision (low 3.8)
- [CVE-2026-106646](https://insights.sbomify.com/CVE-2026-106646/): Classified Listing < 6.1.1 - Subscriber+ Unattached Media Deletion and Modification via Gallery AJAX Handlers (medium 5.9)
- [CVE-2026-10664](https://insights.sbomify.com/CVE-2026-10664/): Out-of-bounds write in nRF70 Wi-Fi driver power-save event handler (unbounded TWT flow count) (medium 5.0)
- [CVE-2026-106634](https://insights.sbomify.com/CVE-2026-106634/): Adobe Experience Manager | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) (high 7.7)
- [CVE-2026-106633](https://insights.sbomify.com/CVE-2026-106633/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2026-106632](https://insights.sbomify.com/CVE-2026-106632/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-106631](https://insights.sbomify.com/CVE-2026-106631/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2026-106630](https://insights.sbomify.com/CVE-2026-106630/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (critical 9.3)
- [CVE-2026-10663](https://insights.sbomify.com/CVE-2026-10663/): Use-after-free / double-free of the root USB device in the experimental USB host stack (medium 6.1)
- [CVE-2026-106629](https://insights.sbomify.com/CVE-2026-106629/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (critical 9.3)
- [CVE-2026-106628](https://insights.sbomify.com/CVE-2026-106628/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-106627](https://insights.sbomify.com/CVE-2026-106627/): CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400) (high 7.5)
- [CVE-2026-106626](https://insights.sbomify.com/CVE-2026-106626/): Adobe Experience Manager | Improper Input Validation (CWE-20) (critical 9.1)
- [CVE-2026-106625](https://insights.sbomify.com/CVE-2026-106625/): Adobe Framemaker | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-106624](https://insights.sbomify.com/CVE-2026-106624/): ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94) (critical 10.0)
- [CVE-2026-106623](https://insights.sbomify.com/CVE-2026-106623/): ColdFusion | Incorrect Authorization (CWE-863) (high 7.5)
- [CVE-2026-106622](https://insights.sbomify.com/CVE-2026-106622/): ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) (critical 10.0)
- [CVE-2026-106621](https://insights.sbomify.com/CVE-2026-106621/): ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94) (critical 9.1)
- [CVE-2026-106620](https://insights.sbomify.com/CVE-2026-106620/): ColdFusion | Incorrect Authorization (CWE-863) (critical 9.6)
- [CVE-2026-10662](https://insights.sbomify.com/CVE-2026-10662/): ahujasid blender-mcp ZIP File server.py requests.get server-side request forgery (medium 5.3)
- [CVE-2026-106619](https://insights.sbomify.com/CVE-2026-106619/): ColdFusion | Improper Input Validation (CWE-20) (critical 9.0)
- [CVE-2026-106618](https://insights.sbomify.com/CVE-2026-106618/): ColdFusion | Incorrect Authorization (CWE-863) (high 8.8)
- [CVE-2026-106617](https://insights.sbomify.com/CVE-2026-106617/): ColdFusion | Incorrect Authorization (CWE-863) (high 8.8)
- [CVE-2026-106616](https://insights.sbomify.com/CVE-2026-106616/): ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) (high 8.6)
- [CVE-2026-106615](https://insights.sbomify.com/CVE-2026-106615/): ColdFusion | Incorrect Authorization (CWE-863) (high 8.8)
- [CVE-2026-106614](https://insights.sbomify.com/CVE-2026-106614/): ColdFusion | Incorrect Authorization (CWE-863) (high 7.8)
- [CVE-2026-106613](https://insights.sbomify.com/CVE-2026-106613/): ColdFusion | Improper Input Validation (CWE-20) (high 8.8)
- [CVE-2026-106612](https://insights.sbomify.com/CVE-2026-106612/): ColdFusion | Incorrect Authorization (CWE-863) (critical 9.9)
- [CVE-2026-106611](https://insights.sbomify.com/CVE-2026-106611/): WordPress Forminator plugin <= 1.57.3 - Cross Site Request Forgery (CSRF) vulnerability (high 7.1)
- [CVE-2026-106610](https://insights.sbomify.com/CVE-2026-106610/): WordPress miniorange otp verification plugin <= 5.5.7 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2026-10661](https://insights.sbomify.com/CVE-2026-10661/): ahujasid blender-mcp server.py open injection (medium 5.3)
- [CVE-2026-106609](https://insights.sbomify.com/CVE-2026-106609/): WordPress Bayarcash WooCommerce plugin <= 4.4.2 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-106608](https://insights.sbomify.com/CVE-2026-106608/): WordPress WooCommerce plugin 9.8.0-11.1.2 - Shop Manager+ Privilege Escalation vulnerability (high 7.2)
- [CVE-2026-106606](https://insights.sbomify.com/CVE-2026-106606/): WordPress YITH WooCommerce Affiliates plugin <= 3.31.0 - PHP Object Injection vulnerability (high 7.2)
- [CVE-2026-106605](https://insights.sbomify.com/CVE-2026-106605/): Business logic in Flexible Quantity – Measurement Price Calculator for WooCommerce (medium 5.3)
- [CVE-2026-106604](https://insights.sbomify.com/CVE-2026-106604/): WordPress YITH WooCommerce Compare plugin <= 3.15.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-106603](https://insights.sbomify.com/CVE-2026-106603/): WordPress HollerBox plugin <= 2.3.14 - Insecure Direct Object References (IDOR) vulnerability (medium 6.5)
- [CVE-2026-106602](https://insights.sbomify.com/CVE-2026-106602/): WordPress Jetpack plugin <= 16.2 - Broken Authentication vulnerability (medium 4.8)
- [CVE-2026-106601](https://insights.sbomify.com/CVE-2026-106601/): WordPress Jetpack plugin <= 16.2 - Broken Authentication vulnerability (medium 5.4)
- [CVE-2026-106600](https://insights.sbomify.com/CVE-2026-106600/): WordPress GiveWP plugin <= 4.18.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-10660](https://insights.sbomify.com/CVE-2026-10660/): Shared reassembly buffer in Bluetooth BAP Broadcast Assistant enables cross-connection memory corruption (medium 6.4)
- [CVE-2026-1066](https://insights.sbomify.com/CVE-2026-1066/): kalcaddle kodbox Compression zip command injection (medium 5.3)
- [CVE-2026-106599](https://insights.sbomify.com/CVE-2026-106599/): WordPress SureCart plugin <= 4.9.3 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-106598](https://insights.sbomify.com/CVE-2026-106598/): WordPress User Registration plugin <= 5.2.8 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-106597](https://insights.sbomify.com/CVE-2026-106597/): WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-106596](https://insights.sbomify.com/CVE-2026-106596/): WordPress Visual Composer Website Builder plugin <= 45.16.3 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-10659](https://insights.sbomify.com/CVE-2026-10659/): NULL pointer dereference in Zephyr Dhara FTL disk driver on flash read error during journal resume (medium 4.7)
- [CVE-2026-106589](https://insights.sbomify.com/CVE-2026-106589/): Privilege escalation in OpenSSH (low 2.9)
- [CVE-2026-106588](https://insights.sbomify.com/CVE-2026-106588/): Security feature bypass in OpenSSH (low 3.1)
- [CVE-2026-106587](https://insights.sbomify.com/CVE-2026-106587/): Security feature bypass in OpenSSH (low 3.6)
- [CVE-2026-106586](https://insights.sbomify.com/CVE-2026-106586/): Security feature bypass in OpenSSH (low 2.5)
- [CVE-2026-106585](https://insights.sbomify.com/CVE-2026-106585/): Denial of service in OpenSSH (medium 6.5)
- [CVE-2026-106584](https://insights.sbomify.com/CVE-2026-106584/): Other in OpenSSH (low 2.5)
- [CVE-2026-106583](https://insights.sbomify.com/CVE-2026-106583/): Command injection in OpenSSH (low 2.5)
- [CVE-2026-106582](https://insights.sbomify.com/CVE-2026-106582/): Weak cryptography in OpenSSH (low 3.7)
- [CVE-2026-106581](https://insights.sbomify.com/CVE-2026-106581/): Docker Desktop for Windows installer failed to verify external packages (high 8.2)
- [CVE-2026-106580](https://insights.sbomify.com/CVE-2026-106580/): ImageMagick: Policy Bypass in CUT encoder (medium 4.0)
- [CVE-2026-10658](https://insights.sbomify.com/CVE-2026-10658/): Out-of-bounds access in Bluetooth ISO receive (`bt_iso_recv`) due to missing SDU-header length validation (high 7.1)
- [CVE-2026-106579](https://insights.sbomify.com/CVE-2026-106579/): ImageMagick: Policy Bypass when using coder as the domain. (medium 6.2)
- [CVE-2026-106578](https://insights.sbomify.com/CVE-2026-106578/): ImageMagick: Invalid Memory Free in MVG decoder (medium 5.9)
- [CVE-2026-106577](https://insights.sbomify.com/CVE-2026-106577/): ImageMagick: Code Injection in the postscript coders (medium 5.3)
- [CVE-2026-106576](https://insights.sbomify.com/CVE-2026-106576/): ImageMagick: Denial of service possible when parsing an XMP profile. (medium 5.3)
- [CVE-2026-106575](https://insights.sbomify.com/CVE-2026-106575/): ImageMagick: Unclosed file pointer in magick script (medium 5.3)
- [CVE-2026-106574](https://insights.sbomify.com/CVE-2026-106574/): ImageMagick: Heap Buffer Over-Write in distributed pixel cache server will result in a crash (medium 5.3)
- [CVE-2026-106573](https://insights.sbomify.com/CVE-2026-106573/): ImageMagick: Denial of service in MVG decoder (medium 5.3)
- [CVE-2026-106572](https://insights.sbomify.com/CVE-2026-106572/): ImageMagick: Stack Overflown CALS decoder due to missing depth check. (medium 5.3)
- [CVE-2026-106571](https://insights.sbomify.com/CVE-2026-106571/): ImageMagick: Heap Buffer Over-Write in GetVirtualPixels api will result in a crash (medium 5.1)
- [CVE-2026-106570](https://insights.sbomify.com/CVE-2026-106570/): ImageMagick: Denial of service in distributed pixel cache server (medium 4.3)
- [CVE-2026-10657](https://insights.sbomify.com/CVE-2026-10657/): Out-of-bounds read in Zephyr DNS resolver mDNS suffix check (memcmp past string NUL) (low 3.7)
- [CVE-2026-106569](https://insights.sbomify.com/CVE-2026-106569/): ImageMagick: Denial of service in ASE decoder because of missing security checks (medium 5.3)
- [CVE-2026-106568](https://insights.sbomify.com/CVE-2026-106568/): ImageMagick: Infinite Loop when reading a crafted XMP profile (medium 5.3)
- [CVE-2026-106567](https://insights.sbomify.com/CVE-2026-106567/): ImageMagick: Infinite Loop in PSD decoder on 32-bit builds (medium 5.9)
- [CVE-2026-106566](https://insights.sbomify.com/CVE-2026-106566/): ImageMagick: Policy Bypass in delegate symlink cleanup due to missing check (medium 4.0)
- [CVE-2026-106565](https://insights.sbomify.com/CVE-2026-106565/): ImageMagick: Infinite Loop in bzip2 compressed images. (medium 5.9)
- [CVE-2026-106564](https://insights.sbomify.com/CVE-2026-106564/): ImageMagick: Heap Buffer Over-Write in EXR decoder (medium 5.3)
- [CVE-2026-106563](https://insights.sbomify.com/CVE-2026-106563/): Backstage: Improper entity validation in deprecated Kubernetes services endpoint (medium 5.3)
- [CVE-2026-106562](https://insights.sbomify.com/CVE-2026-106562/): Backstage: Incorrect authorization in search engine permission filtering (medium 4.3)
- [CVE-2026-106561](https://insights.sbomify.com/CVE-2026-106561/): Backstage: Sensitive information disclosure in Kubernetes resource queries (medium 5.0)
- [CVE-2026-106560](https://insights.sbomify.com/CVE-2026-106560/): Backstage: Improper repository path validation in a Scaffolder backend module (high 7.1)
- [CVE-2026-10656](https://insights.sbomify.com/CVE-2026-10656/): NULL-pointer dereference DoS in MAX32 USB device controller transfer-completion handlers (medium 4.6)
- [CVE-2026-106559](https://insights.sbomify.com/CVE-2026-106559/): Backstage: Improper input validation in Confluence to Markdown scaffolder module (medium 6.3)
- [CVE-2026-106558](https://insights.sbomify.com/CVE-2026-106558/): Backstage: Improper validation of TechDocs MkDocs configuration (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/960/