# Vulnerabilities published in 2026


- [CVE-2026-105969](https://insights.sbomify.com/CVE-2026-105969/): CodeAtoz B2B Suite for WooCommerce < 1.6.1 - Unauthenticated Guest Quote Disclosure (medium 5.3)
- [CVE-2026-105964](https://insights.sbomify.com/CVE-2026-105964/): Gitea Actions artifact v4 API unbounded request body (medium 6.5)
- [CVE-2026-105963](https://insights.sbomify.com/CVE-2026-105963/): Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments (medium 5.1)
- [CVE-2026-105960](https://insights.sbomify.com/CVE-2026-105960/): HMS Networks PEAK-System PCAN Windows drivers Improper Handling of Length Parameter Inconsistency (medium 6.8)
- [CVE-2026-105959](https://insights.sbomify.com/CVE-2026-105959/): Spice-server: spice: heap buffer overflow via glz dictionary max_encoders integer truncation (high 7.5)
- [CVE-2026-105958](https://insights.sbomify.com/CVE-2026-105958/): Spice-server: spice: heap oob read/write via unchecked migration data offsets (high 7.5)
- [CVE-2026-105957](https://insights.sbomify.com/CVE-2026-105957/): SourceCodester Performance Indicator System view_product.php sql injection (medium 5.3)
- [CVE-2026-105950](https://insights.sbomify.com/CVE-2026-105950/): getformwork URI Sanitizer DomSanitizer.php sanitizeNodeAttribute cross site scripting (medium 5.1)
- [CVE-2026-10595](https://insights.sbomify.com/CVE-2026-10595/): Path Traversal Vulnerability in parisneo/lollms (high 7.5)
- [CVE-2026-105949](https://insights.sbomify.com/CVE-2026-105949/): Auth bypass in streams for Apache Kafka 2 (high 8.8)
- [CVE-2026-105947](https://insights.sbomify.com/CVE-2026-105947/): Arbitrary File Read in Innotim Software's Logsign SIEM (medium 6.5)
- [CVE-2026-105946](https://insights.sbomify.com/CVE-2026-105946/): Out-of-bounds read vulnerability in NTLM authentication handling impacts Qt (medium 5.3)
- [CVE-2026-105945](https://insights.sbomify.com/CVE-2026-105945/): Path traversal in Apache Pulsar (high 7.7)
- [CVE-2026-105944](https://insights.sbomify.com/CVE-2026-105944/): Missing authorization in Apache Pulsar Manager (critical 10.0)
- [CVE-2026-105942](https://insights.sbomify.com/CVE-2026-105942/): Privilege escalation in Apache Pulsar (high 7.7)
- [CVE-2026-105941](https://insights.sbomify.com/CVE-2026-105941/): Server-side request forgery in streams for Apache Kafka 3 (high 8.1)
- [CVE-2026-105938](https://insights.sbomify.com/CVE-2026-105938/): Missing authorization in Apache Pulsar (low 2.3)
- [CVE-2026-105937](https://insights.sbomify.com/CVE-2026-105937/): Missing authorization in Apache Pulsar (high 8.7)
- [CVE-2026-105936](https://insights.sbomify.com/CVE-2026-105936/): Apache Pulsar: Functions connectors list endpoint does not apply the super-user check of the worker connectors endpoint (medium 5.3)
- [CVE-2026-105935](https://insights.sbomify.com/CVE-2026-105935/): Apache Pulsar: Function trigger publishes to the input topic without checking the caller's produce permission (medium 4.9)
- [CVE-2026-105934](https://insights.sbomify.com/CVE-2026-105934/): Apache Pulsar: Missing tenant admin authorization check when truncating a partitioned topic (high 7.2)
- [CVE-2026-105933](https://insights.sbomify.com/CVE-2026-105933/): Apache Pulsar: Namespace encryption requirement not enforced after a failure during topic initialization (low 2.3)
- [CVE-2026-105932](https://insights.sbomify.com/CVE-2026-105932/): Apache Pulsar: Missing topic policy authorization on non-persistent topic entry filter endpoints (low 2.3)
- [CVE-2026-105931](https://insights.sbomify.com/CVE-2026-105931/): Missing authorization in Apache Pulsar (low 2.3)
- [CVE-2026-105930](https://insights.sbomify.com/CVE-2026-105930/): Apache Pulsar: Improper Authorization of Function, Source and Sink Package URLs Allows Cross-Tenant Package Download (medium 6.0)
- [CVE-2026-10593](https://insights.sbomify.com/CVE-2026-10593/): Remotely triggerable NULL-pointer dereference in Bluetooth LE Audio BAP unicast client QoS-state handling (medium 6.5)
- [CVE-2026-105927](https://insights.sbomify.com/CVE-2026-105927/): Apache Pulsar: Improper authorization of WebSocket consumer dead letter topic allows writes without PRODUCE permission (low 2.3)
- [CVE-2026-105926](https://insights.sbomify.com/CVE-2026-105926/): Apache Pulsar: Missing Topic Authorization on Binary Protocol GetSchema and GetOrCreateSchema Commands (medium 5.3)
- [CVE-2026-105923](https://insights.sbomify.com/CVE-2026-105923/): Null-pointer dereference in QTriangulator reachable through VectorImage (medium 4.0)
- [CVE-2026-105922](https://insights.sbomify.com/CVE-2026-105922/): vllm-project vLLM Penalty utils.py get_token_bin_counts_and_mask denial of service (medium 5.3)
- [CVE-2026-105921](https://insights.sbomify.com/CVE-2026-105921/): Kusalkasilva Learning-Management-System search_class.php sql injection (medium 5.3)
- [CVE-2026-105920](https://insights.sbomify.com/CVE-2026-105920/): Kusalkasilva Learning-Management-System Student Registration Endpoint student_signup.php sql injection (medium 6.9)
- [CVE-2026-10592](https://insights.sbomify.com/CVE-2026-10592/): Wildcard DNS SAN bypasses CA name-constraint checks (medium 6.3)
- [CVE-2026-105919](https://insights.sbomify.com/CVE-2026-105919/): Kusalkasilva Learning-Management-System Administrator Login Endpoint login.php mysql_query sql injection (medium 6.9)
- [CVE-2026-105918](https://insights.sbomify.com/CVE-2026-105918/): Kusalkasilva Learning-Management-System Login Endpoint login.php mysql_error sql injection (medium 6.9)
- [CVE-2026-10591](https://insights.sbomify.com/CVE-2026-10591/): Kiro IDE Insufficient File Write Restrictions to Execution-Sensitive Paths (high 8.6)
- [CVE-2026-105903](https://insights.sbomify.com/CVE-2026-105903/): ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94) (critical 9.9)
- [CVE-2026-105902](https://insights.sbomify.com/CVE-2026-105902/): CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400) (high 7.5)
- [CVE-2026-105901](https://insights.sbomify.com/CVE-2026-105901/): ColdFusion | Incorrect Authorization (CWE-863) (high 8.8)
- [CVE-2026-105900](https://insights.sbomify.com/CVE-2026-105900/): ColdFusion | Improper Input Validation (CWE-20) (high 7.5)
- [CVE-2026-10590](https://insights.sbomify.com/CVE-2026-10590/): Auth bypass in IdeaPad 5 15ABA7 BIOS (medium 6.7)
- [CVE-2026-1059](https://insights.sbomify.com/CVE-2026-1059/): FeMiner wms chkuser.php sql injection (medium 6.9)
- [CVE-2026-105899](https://insights.sbomify.com/CVE-2026-105899/): ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434) (critical 10.0)
- [CVE-2026-105898](https://insights.sbomify.com/CVE-2026-105898/): ColdFusion | Incorrect Authorization (CWE-863) (high 8.2)
- [CVE-2026-105897](https://insights.sbomify.com/CVE-2026-105897/): ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) (high 8.6)
- [CVE-2026-105896](https://insights.sbomify.com/CVE-2026-105896/): Photoshop Desktop | NULL Pointer Dereference (CWE-476) (medium 5.5)
- [CVE-2026-105895](https://insights.sbomify.com/CVE-2026-105895/): Adobe Experience Manager | Improper Input Validation (CWE-20) (critical 9.9)
- [CVE-2026-105893](https://insights.sbomify.com/CVE-2026-105893/): WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-105892](https://insights.sbomify.com/CVE-2026-105892/): WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.13 - Arbitrary File Deletion vulnerability (critical 9.8)
- [CVE-2026-105891](https://insights.sbomify.com/CVE-2026-105891/): WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-105890](https://insights.sbomify.com/CVE-2026-105890/): WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.12 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-10589](https://insights.sbomify.com/CVE-2026-10589/): Memory corruption in IdeaPad 5 15ABA7 BIOS (medium 6.8)
- [CVE-2026-105889](https://insights.sbomify.com/CVE-2026-105889/): WordPress Tickera plugin <= 3.6.0.6 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-105888](https://insights.sbomify.com/CVE-2026-105888/): WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-105887](https://insights.sbomify.com/CVE-2026-105887/): WordPress Robo Gallery plugin <= 5.1.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-105886](https://insights.sbomify.com/CVE-2026-105886/): WordPress Ultimate Post Kit plugin <= 4.5.5 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-105885](https://insights.sbomify.com/CVE-2026-105885/): WordPress Slider by 10Web plugin <= 1.2.62 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-105884](https://insights.sbomify.com/CVE-2026-105884/): WordPress Rocket Lazy Load plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-105883](https://insights.sbomify.com/CVE-2026-105883/): WordPress Th Shop Mania theme <= 1.9.1 - Broken Access Control vulnerability (high 7.1)
- [CVE-2026-105882](https://insights.sbomify.com/CVE-2026-105882/): WordPress User Registration plugin <= 5.2.8 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-105881](https://insights.sbomify.com/CVE-2026-105881/): WordPress User Registration plugin <= 5.2.8 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-10588](https://insights.sbomify.com/CVE-2026-10588/): Information disclosure in IdeaPad 5 15ABA7 BIOS (medium 6.7)
- [CVE-2026-105879](https://insights.sbomify.com/CVE-2026-105879/): WordPress JetElements For Elementor plugin <= 2.9.2.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-105878](https://insights.sbomify.com/CVE-2026-105878/): WordPress YITH WooCommerce Product Bundles plugin <= 2.29.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-105877](https://insights.sbomify.com/CVE-2026-105877/): WordPress QA Analytics plugin <= 5.3.0.0 - Sensitive Data Exposure vulnerability (medium 6.9)
- [CVE-2026-105876](https://insights.sbomify.com/CVE-2026-105876/): WordPress Modula Image Gallery plugin <= 3.0.11 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-105875](https://insights.sbomify.com/CVE-2026-105875/): WordPress Prime Slider – Addons For Elementor plugin <= 4.6.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-105874](https://insights.sbomify.com/CVE-2026-105874/): WordPress SureCart plugin <= 4.9.3 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-105873](https://insights.sbomify.com/CVE-2026-105873/): WordPress Element Pack Elementor Addons plugin <= 8.8.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-105872](https://insights.sbomify.com/CVE-2026-105872/): WordPress Product Configurator for WooCommerce plugin <= 1.7.5 - PHP Object Injection vulnerability (high 7.2)
- [CVE-2026-105871](https://insights.sbomify.com/CVE-2026-105871/): WordPress Element Pack Elementor Addons plugin <= 8.8.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-105870](https://insights.sbomify.com/CVE-2026-105870/): WordPress WP Associate Post R2 plugin <= 5.0.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-10587](https://insights.sbomify.com/CVE-2026-10587/): Memory corruption in IdeaPad 5 15ABA7 BIOS (medium 6.8)
- [CVE-2026-105869](https://insights.sbomify.com/CVE-2026-105869/): Auth bypass in Apache Pulsar (critical 9.2)
- [CVE-2026-105868](https://insights.sbomify.com/CVE-2026-105868/): Payload: Uploaded XML files could execute same-origin JavaScript (high 8.6)
- [CVE-2026-105867](https://insights.sbomify.com/CVE-2026-105867/): Payload: Client uploads could overwrite S3 objects (high 7.1)
- [CVE-2026-105866](https://insights.sbomify.com/CVE-2026-105866/): Payload: Unauthenticated account-lockout denial of service (medium 6.9)
- [CVE-2026-105865](https://insights.sbomify.com/CVE-2026-105865/): Payload: Incomplete validation during the upload file lifecycle (high 8.1)
- [CVE-2026-105864](https://insights.sbomify.com/CVE-2026-105864/): Payload: Cross-tenant create in @payloadcms/plugin-multi-tenant (medium 5.3)
- [CVE-2026-105863](https://insights.sbomify.com/CVE-2026-105863/): Payload authentication token field handling issue (critical 9.2)
- [CVE-2026-105862](https://insights.sbomify.com/CVE-2026-105862/): Payload: Bypassed sanitization of user uploaded SVGs (high 8.7)
- [CVE-2026-105861](https://insights.sbomify.com/CVE-2026-105861/): Payload external upload trust validation issue (high 7.2)
- [CVE-2026-105860](https://insights.sbomify.com/CVE-2026-105860/): Payload: Tenant authorization bypass in Multi-Tenant Plugin (high 7.1)
- [CVE-2026-10586](https://insights.sbomify.com/CVE-2026-10586/): Server-side request forgery in Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns (high 7.2)
- [CVE-2026-105859](https://insights.sbomify.com/CVE-2026-105859/): Payload: Unauthorized update to collection documents (critical 9.8)
- [CVE-2026-105858](https://insights.sbomify.com/CVE-2026-105858/): Payload: Remote Code Execution through first-register (high 8.1)
- [CVE-2026-105857](https://insights.sbomify.com/CVE-2026-105857/): Payload: RCE in Payload Form Builder (critical 10.0)
- [CVE-2026-105856](https://insights.sbomify.com/CVE-2026-105856/): Payload: SQL injection in SQLite/Postgres (high 8.6)
- [CVE-2026-105855](https://insights.sbomify.com/CVE-2026-105855/): Payload: Field-level password update restrictions were not enforced (high 7.6)
- [CVE-2026-105854](https://insights.sbomify.com/CVE-2026-105854/): Payload: ReDoS in Multipart Content-Type Validation (high 8.7)
- [CVE-2026-105853](https://insights.sbomify.com/CVE-2026-105853/): Payload: Token refresh and password reset responses may expose restricted user fields (high 7.1)
- [CVE-2026-105852](https://insights.sbomify.com/CVE-2026-105852/): Payload relationship-query authorization bypass (medium 6.9)
- [CVE-2026-105851](https://insights.sbomify.com/CVE-2026-105851/): Payload: Field access control bypass on auth collections (critical 9.3)
- [CVE-2026-105850](https://insights.sbomify.com/CVE-2026-105850/): Payload: Order confirmation validation issue in Payload Ecommerce (high 8.8)
- [CVE-2026-10585](https://insights.sbomify.com/CVE-2026-10585/): Cross-site scripting in Enterprise Server (medium 6.3)
- [CVE-2026-105849](https://insights.sbomify.com/CVE-2026-105849/): Payload: API key disclosure through ordinary document reads (high 7.7)
- [CVE-2026-105848](https://insights.sbomify.com/CVE-2026-105848/): Payload: Insufficient Access Control in Stripe REST Proxy (medium 6.4)
- [CVE-2026-105847](https://insights.sbomify.com/CVE-2026-105847/): Payload: Polymorphic join queries could disclose hidden fields (high 7.1)
- [CVE-2026-105846](https://insights.sbomify.com/CVE-2026-105846/): Payload: Untrusted redirect URL parameter exploit (medium 6.1)
- [CVE-2026-105845](https://insights.sbomify.com/CVE-2026-105845/): Payload: SQL Injection in SQLite and Postgres (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/966/