# Vulnerabilities published in 2026


- [CVE-2026-106117](https://insights.sbomify.com/CVE-2026-106117/): ImageSharp: CCITT fax decompression (T4/Modified Huffman): unbounded WriteBits overflows strip buffer — heap OOB write in SixLabors.ImageSharp (high 7.5)
- [CVE-2026-106116](https://insights.sbomify.com/CVE-2026-106116/): ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loop (medium 5.3)
- [CVE-2026-106115](https://insights.sbomify.com/CVE-2026-106115/): ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer (high 7.5)
- [CVE-2026-106114](https://insights.sbomify.com/CVE-2026-106114/): ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions (medium 5.3)
- [CVE-2026-106113](https://insights.sbomify.com/CVE-2026-106113/): ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index (high 7.5)
- [CVE-2026-106112](https://insights.sbomify.com/CVE-2026-106112/): ImageSharp: ICC LUT16 output channel count can write beyond Vector4 (high 7.5)
- [CVE-2026-106111](https://insights.sbomify.com/CVE-2026-106111/): ImageSharp: EXR ZIP decoder can expose stale allocator data after a short inflate (medium 5.9)
- [CVE-2026-106110](https://insights.sbomify.com/CVE-2026-106110/): ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer (high 7.5)
- [CVE-2026-10611](https://insights.sbomify.com/CVE-2026-10611/): OTP bypass via plugin-based LDAP authentication in MISP when LDAP mixed authentication is enabled (high 8.2)
- [CVE-2026-106109](https://insights.sbomify.com/CVE-2026-106109/): Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories (medium 4.1)
- [CVE-2026-106108](https://insights.sbomify.com/CVE-2026-106108/): Quasar Framework: App Vite SSG page output paths can escape the configured distribution directory (medium 5.7)
- [CVE-2026-106107](https://insights.sbomify.com/CVE-2026-106107/): Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained (high 8.3)
- [CVE-2026-106106](https://insights.sbomify.com/CVE-2026-106106/): Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable (high 7.1)
- [CVE-2026-106105](https://insights.sbomify.com/CVE-2026-106105/): Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions (high 8.4)
- [CVE-2026-106104](https://insights.sbomify.com/CVE-2026-106104/): Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server (high 8.7)
- [CVE-2026-106103](https://insights.sbomify.com/CVE-2026-106103/): Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile (high 7.1)
- [CVE-2026-106102](https://insights.sbomify.com/CVE-2026-106102/): Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead() (critical 10.0)
- [CVE-2026-106101](https://insights.sbomify.com/CVE-2026-106101/): Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service (low 3.1)
- [CVE-2026-106100](https://insights.sbomify.com/CVE-2026-106100/): Payload: Field-level write access bypass in Payload on MongoDB (high 7.1)
- [CVE-2026-10610](https://insights.sbomify.com/CVE-2026-10610/): Local privilege escalation in ESET security applications for macOS (high 8.5)
- [CVE-2026-1061](https://insights.sbomify.com/CVE-2026-1061/): xiweicheng TMS FileController.java upload unrestricted upload (medium 5.3)
- [CVE-2026-106099](https://insights.sbomify.com/CVE-2026-106099/): WP Data Access < 5.5.84 - Unauthenticated Sensitive Data Disclosure via Table Export (medium 5.3)
- [CVE-2026-106098](https://insights.sbomify.com/CVE-2026-106098/): WP Data Access < 5.5.77 - Unauthenticated Incorrect Authorization via Inline App Update (medium 5.3)
- [CVE-2026-106097](https://insights.sbomify.com/CVE-2026-106097/): Code Snippets < 3.10.0 - Admin+ SQLi in Migration Importers Leading to Network-Wide Credential Disclosure (Multisite) (medium 6.8)
- [CVE-2026-106095](https://insights.sbomify.com/CVE-2026-106095/): Code Snippets < 3.10.0 - Admin+ Network-Scoped Snippet Activation and Deactivation via update_code_snippet (low 3.3)
- [CVE-2026-106090](https://insights.sbomify.com/CVE-2026-106090/): ColdFusion | Incorrect Authorization (CWE-863) (high 8.8)
- [CVE-2026-10609](https://insights.sbomify.com/CVE-2026-10609/): OpenShift Cluster Logging Operator missing authorization flaw (medium 6.8)
- [CVE-2026-106089](https://insights.sbomify.com/CVE-2026-106089/): ColdFusion | Incorrect Authorization (CWE-863) (high 8.8)
- [CVE-2026-106087](https://insights.sbomify.com/CVE-2026-106087/): Missing authorization in TRO600 Series Firmware (high 8.7)
- [CVE-2026-10608](https://insights.sbomify.com/CVE-2026-10608/): DedeCMS carbuyaction.php RemoveXSS sql injection (medium 6.9)
- [CVE-2026-106079](https://insights.sbomify.com/CVE-2026-106079/): Command injection in Session Smart Conductor (high 8.8)
- [CVE-2026-106078](https://insights.sbomify.com/CVE-2026-106078/): Auth bypass in Backup for Microsoft 365 (medium 6.9)
- [CVE-2026-106077](https://insights.sbomify.com/CVE-2026-106077/): Missing authorization in Backup for Microsoft 365 (high 8.3)
- [CVE-2026-106076](https://insights.sbomify.com/CVE-2026-106076/): SQL injection in Backup for Microsoft 365 (critical 9.0)
- [CVE-2026-106074](https://insights.sbomify.com/CVE-2026-106074/): Weak cryptography in node (medium 4.8)
- [CVE-2026-106073](https://insights.sbomify.com/CVE-2026-106073/): Security feature bypass in node (low 3.3)
- [CVE-2026-106072](https://insights.sbomify.com/CVE-2026-106072/): Security feature bypass in node (medium 6.7)
- [CVE-2026-106071](https://insights.sbomify.com/CVE-2026-106071/): Security feature bypass in node (low 3.6)
- [CVE-2026-106070](https://insights.sbomify.com/CVE-2026-106070/): Security feature bypass in node (low 3.7)
- [CVE-2026-10607](https://insights.sbomify.com/CVE-2026-10607/): DedeCMS flink.php dede_htmlspecialchars sql injection (medium 6.9)
- [CVE-2026-106069](https://insights.sbomify.com/CVE-2026-106069/): Security feature bypass in node (high 7.4)
- [CVE-2026-106067](https://insights.sbomify.com/CVE-2026-106067/): Gimp: gimp: heap buffer overflow in hot color filter on oversized image (medium 6.3)
- [CVE-2026-106066](https://insights.sbomify.com/CVE-2026-106066/): Gimp: gimp: heap buffer overflow in raw data export on oversized image dimensions (medium 6.3)
- [CVE-2026-106065](https://insights.sbomify.com/CVE-2026-106065/): Gimp: gimp: heap buffer overflow in pcx export on oversized image dimensions (medium 6.3)
- [CVE-2026-106064](https://insights.sbomify.com/CVE-2026-106064/): Gimp: gimp: heap buffer overflow in gif export on oversized image dimensions (medium 6.3)
- [CVE-2026-106063](https://insights.sbomify.com/CVE-2026-106063/): Gimp: gimp: heap buffer overflow in dicom export on oversized image dimensions (medium 6.3)
- [CVE-2026-106062](https://insights.sbomify.com/CVE-2026-106062/): Gimp: gimp: heap buffer overflow in dds loader on crafted directdraw surface file (high 7.8)
- [CVE-2026-106061](https://insights.sbomify.com/CVE-2026-106061/): Gimp: gimp: heap buffer over-read in x cursor (xmc) thumbnail loader on crafted file (medium 5.5)
- [CVE-2026-10606](https://insights.sbomify.com/CVE-2026-10606/): DedeCMS Feedback feedback.php TrimMsg sql injection (medium 6.9)
- [CVE-2026-106059](https://insights.sbomify.com/CVE-2026-106059/): GitAhead through 2.7.1 on macOS Command Injection via Show in Finder AppleScript (high 8.7)
- [CVE-2026-106058](https://insights.sbomify.com/CVE-2026-106058/): GitAhead through 2.7.1 OS Command Injection via Git Filter Filenames (high 7.7)
- [CVE-2026-106057](https://insights.sbomify.com/CVE-2026-106057/): patool before 4.0.6 OS Command Injection on Windows via shell_quote_nt (high 8.5)
- [CVE-2026-106056](https://insights.sbomify.com/CVE-2026-106056/): Rundeck before 6.2.0 OS Command Injection via Windows Job Option Quoting (high 7.7)
- [CVE-2026-106047](https://insights.sbomify.com/CVE-2026-106047/): Path traversal in Xtraction (high 7.7)
- [CVE-2026-106043](https://insights.sbomify.com/CVE-2026-106043/): Missing authorization in Xtraction (high 7.5)
- [CVE-2026-106042](https://insights.sbomify.com/CVE-2026-106042/): Server-side request forgery in Xtraction (critical 9.9)
- [CVE-2026-106041](https://insights.sbomify.com/CVE-2026-106041/): Mooncake Store through 0.3.13.post1 Missing Authorization via NotifyOffloadSuccess RPC (medium 6.9)
- [CVE-2026-106040](https://insights.sbomify.com/CVE-2026-106040/): Mooncake Store through 0.3.13.post1 Missing Authorization via EvictDiskReplica RPC (high 8.8)
- [CVE-2026-106039](https://insights.sbomify.com/CVE-2026-106039/): Mooncake Store through 0.3.13.post1 Missing Authorization in Replication Task RPC (medium 6.9)
- [CVE-2026-106038](https://insights.sbomify.com/CVE-2026-106038/): Mooncake Store through 0.3.13.post1 Unauthenticated Object Deletion via Remove RPCs (high 8.8)
- [CVE-2026-106037](https://insights.sbomify.com/CVE-2026-106037/): Mooncake through 0.3.13.post1 Missing Authentication in Store REST Service (critical 9.3)
- [CVE-2026-106036](https://insights.sbomify.com/CVE-2026-106036/): Improper certificate validation in Szafir (medium 6.9)
- [CVE-2026-106035](https://insights.sbomify.com/CVE-2026-106035/): Information disclosure in Xtraction (medium 5.5)
- [CVE-2026-106034](https://insights.sbomify.com/CVE-2026-106034/): Path traversal in Xtraction (medium 5.0)
- [CVE-2026-106033](https://insights.sbomify.com/CVE-2026-106033/): Ansible: ansible-ui: ansible ui dom xss in /redirect next parameter (medium 5.4)
- [CVE-2026-106032](https://insights.sbomify.com/CVE-2026-106032/): Server-side request forgery in bedrock-agentcore-starter-toolkit (medium 5.7)
- [CVE-2026-106031](https://insights.sbomify.com/CVE-2026-106031/): Spin Wheel < 2.2.1 - Unauthenticated Coupon Code Disclosure via Forged Spin Result (medium 6.5)
- [CVE-2026-106030](https://insights.sbomify.com/CVE-2026-106030/): Missing Authorization in NordVPN for Windows (medium 6.8)
- [CVE-2026-106029](https://insights.sbomify.com/CVE-2026-106029/): WeddingCity Lite <= 1.0.4 - Unauthenticated Arbitrary Post and Attachment Deletion (high 7.5)
- [CVE-2026-106028](https://insights.sbomify.com/CVE-2026-106028/): ActiveTrail for WooCommerce <= 1.2.6 - Unauthenticated Arbitrary Coupon Creation (medium 5.3)
- [CVE-2026-106026](https://insights.sbomify.com/CVE-2026-106026/): tftp-hpa 5.4 before 6.0 Out-of-Bounds Read via tftpd Remap Jump Rule (medium 6.3)
- [CVE-2026-106017](https://insights.sbomify.com/CVE-2026-106017/): Security feature bypass in OpenVPN 3 Core Library (medium 6.3)
- [CVE-2026-106016](https://insights.sbomify.com/CVE-2026-106016/): Mitigation bypass in the File Handling component (critical 9.8)
- [CVE-2026-106014](https://insights.sbomify.com/CVE-2026-106014/): Gateway for Vantiv on WC <= 1.0.1 - Unauthenticated Order Payment Completion via Payment Callback Forgery (medium 5.3)
- [CVE-2026-106013](https://insights.sbomify.com/CVE-2026-106013/): Jupiter X Core <= 4.61.0 - Unauthenticated Authentication Bypass via Twitter/X Social Login oauth_verifier Parameter (critical 9.8)
- [CVE-2026-106010](https://insights.sbomify.com/CVE-2026-106010/): BDM Digital Payment Gateway 1.2.7 - 1.3.12 - Unauthenticated Payment Confirmation Forgery (medium 5.3)
- [CVE-2026-10601](https://insights.sbomify.com/CVE-2026-10601/): Path traversal in the Tempo and Loki data source plugins (medium 5.4)
- [CVE-2026-106003](https://insights.sbomify.com/CVE-2026-106003/): Court Reservation < 1.12.4 - Unauthenticated Reservation Type Addition and Deletion (medium 5.3)
- [CVE-2026-106002](https://insights.sbomify.com/CVE-2026-106002/): Court Reservation < 1.12.4 - Unauthenticated Arbitrary Challenge Deletion (medium 5.3)
- [CVE-2026-10600](https://insights.sbomify.com/CVE-2026-10600/): Denial of service via unbounded document content extraction in Mattermost Server (medium 4.3)
- [CVE-2026-1060](https://insights.sbomify.com/CVE-2026-1060/): WP Adminify <= 4.0.7.7 - Unauthenticated Sensitive Information Exposure via 'get-addons-list' REST API (medium 5.3)
- [CVE-2026-105999](https://insights.sbomify.com/CVE-2026-105999/): Booking Package < 1.7.31 - Unauthenticated Calendar Account Information Disclosure (medium 5.3)
- [CVE-2026-105998](https://insights.sbomify.com/CVE-2026-105998/): Booking Package < 1.7.31 - Unauthenticated Subscription Deactivation via Missing Authorization (medium 5.3)
- [CVE-2026-105997](https://insights.sbomify.com/CVE-2026-105997/): Booking Package < 1.7.33 - Unauthenticated Verification Email Sending to Arbitrary Recipient (medium 5.3)
- [CVE-2026-105996](https://insights.sbomify.com/CVE-2026-105996/): Booking Package < 1.7.31 - Unauthenticated Booking PII Disclosure and Cancellation via Predictable Token (medium 4.8)
- [CVE-2026-105995](https://insights.sbomify.com/CVE-2026-105995/): Booking Package < 1.7.30 - Unauthenticated Booking Customer PII Disclosure (medium 5.3)
- [CVE-2026-105994](https://insights.sbomify.com/CVE-2026-105994/): ColdFusion | Incorrect Authorization (CWE-863) (high 7.7)
- [CVE-2026-105992](https://insights.sbomify.com/CVE-2026-105992/): Ettrick Escape Room Booking < 1.3.1 - Unauthenticated Payment Confirmation Bypass (medium 5.3)
- [CVE-2026-105990](https://insights.sbomify.com/CVE-2026-105990/): Accept PayPal Payments Using Contact Form 7 < 4.0.7 - Unauthenticated PII Disclosure via CSV Export (medium 5.3)
- [CVE-2026-10599](https://insights.sbomify.com/CVE-2026-10599/): Integrate PhonePe with WooCommerce <= 1.2.1 - Unauthenticated Payment Bypass via Transaction ID Reuse (high 7.5)
- [CVE-2026-105989](https://insights.sbomify.com/CVE-2026-105989/): Accept PayPal Payments using Contact Form 7 < 4.0.7 - Unauthenticated Transaction Status Forgery (medium 5.3)
- [CVE-2026-105987](https://insights.sbomify.com/CVE-2026-105987/): Stored XSS in KGS Software tia Viewer (medium 5.1)
- [CVE-2026-105985](https://insights.sbomify.com/CVE-2026-105985/): Authenticated RCE via render-components Entry Type overrides (high 8.7)
- [CVE-2026-105977](https://insights.sbomify.com/CVE-2026-105977/): Missing authorization in Portfolio Filter Gallery (low 2.2)
- [CVE-2026-105976](https://insights.sbomify.com/CVE-2026-105976/): Portfolio Filter Gallery < 2.2.1 - Contributor+ Missing Authorization via Multiple AJAX Actions (medium 4.7)
- [CVE-2026-105975](https://insights.sbomify.com/CVE-2026-105975/): CamPay Shortcode Payment Gateway < 1.7 - Unauthenticated Payment Status Forgery via external_reference (medium 5.3)
- [CVE-2026-105974](https://insights.sbomify.com/CVE-2026-105974/): Visual Form Builder <= 3.1 - Subscriber+ Sensitive Data Disclosure via Dashboard Widget (medium 4.3)
- [CVE-2026-105973](https://insights.sbomify.com/CVE-2026-105973/): Visual Form Builder <= 3.1 - Subscriber+ Arbitrary Form Field Reordering via Missing Authorization (medium 4.3)
- [CVE-2026-105972](https://insights.sbomify.com/CVE-2026-105972/): WooCommerce Menu Cart < 3.2.1 - Unauthenticated Stored XSS via Cart Item Variation Attribute (high 7.5)
- [CVE-2026-10597](https://insights.sbomify.com/CVE-2026-10597/): ITPison｜OMICARD EDM - Insecure Direct Object Reference (medium 6.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/965/