# Vulnerabilities published in 2026


- [CVE-2026-10573](https://insights.sbomify.com/CVE-2026-10573/): 1734 POINT I/OTM - Denial of Service via Malformed Inputs on CIP Object (medium 6.3)
- [CVE-2026-105729](https://insights.sbomify.com/CVE-2026-105729/): SysInternals Elevation of Privilege Vulnerability (high 7.1)
- [CVE-2026-105728](https://insights.sbomify.com/CVE-2026-105728/): Dynamics Business Central Information Disclosure Vulnerability (high 7.5)
- [CVE-2026-105727](https://insights.sbomify.com/CVE-2026-105727/): Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-105726](https://insights.sbomify.com/CVE-2026-105726/): Microsoft Defender Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-105725](https://insights.sbomify.com/CVE-2026-105725/): Windows Security App Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-105723](https://insights.sbomify.com/CVE-2026-105723/): Windows Distributed File System (DFS) Elevation of Privilege Vulnerability (high 7.5)
- [CVE-2026-105722](https://insights.sbomify.com/CVE-2026-105722/): Windows Broadcast DVR User Service Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-105720](https://insights.sbomify.com/CVE-2026-105720/): Microsoft Office SharePoint Elevation of Privilege Vulnerability (medium 4.3)
- [CVE-2026-10572](https://insights.sbomify.com/CVE-2026-10572/): IBM MQ Buffer Overflow (high 8.8)
- [CVE-2026-105719](https://insights.sbomify.com/CVE-2026-105719/): Microsoft SharePoint Server Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-105718](https://insights.sbomify.com/CVE-2026-105718/): Microsoft Excel Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-105717](https://insights.sbomify.com/CVE-2026-105717/): Microsoft Office Access Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-105716](https://insights.sbomify.com/CVE-2026-105716/): Microsoft Office Access Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-105715](https://insights.sbomify.com/CVE-2026-105715/): Microsoft Office Word Remote Code Execution Vulnerability (high 7.5)
- [CVE-2026-105714](https://insights.sbomify.com/CVE-2026-105714/): Microsoft Office Access Remote Code Execution Vulnerability (high 7.5)
- [CVE-2026-105713](https://insights.sbomify.com/CVE-2026-105713/): Microsoft Office SharePoint Spoofing Vulnerability (medium 5.7)
- [CVE-2026-105712](https://insights.sbomify.com/CVE-2026-105712/): Path traversal in GnuPG (low 3.6)
- [CVE-2026-105711](https://insights.sbomify.com/CVE-2026-105711/): Use of Cache Containing Sensitive Information in GitLab (low 3.5)
- [CVE-2026-10571](https://insights.sbomify.com/CVE-2026-10571/): IBM WebSphere Application Server Liberty is affected by a denial of service (medium 5.7)
- [CVE-2026-105708](https://insights.sbomify.com/CVE-2026-105708/): imgproxy SVG svg.go sanitizeElement cross site scripting (medium 5.3)
- [CVE-2026-105707](https://insights.sbomify.com/CVE-2026-105707/): uptrace user_handler.go Login information exposure (medium 6.9)
- [CVE-2026-105706](https://insights.sbomify.com/CVE-2026-105706/): SourceCodester Drug Recommendation System cross-site request forgery (medium 5.3)
- [CVE-2026-105705](https://insights.sbomify.com/CVE-2026-105705/): SourceCodester Drug Recommendation System add_drug.php cross site scripting (medium 5.3)
- [CVE-2026-105704](https://insights.sbomify.com/CVE-2026-105704/): SourceCodester Drug Recommendation System Auth Guard improper authentication (medium 6.9)
- [CVE-2026-105703](https://insights.sbomify.com/CVE-2026-105703/): PHPGurukul User Registration & Login and User Management System Change Password change-password.php authorization (medium 5.1)
- [CVE-2026-105701](https://insights.sbomify.com/CVE-2026-105701/): ACPT (Premium) <= 2.0.66 - Authenticated (Subscriber+) Remote Code Execution via REST API Email Template (high 8.8)
- [CVE-2026-10570](https://insights.sbomify.com/CVE-2026-10570/): Cross-site scripting in Sympl Repeater for ACF and Elementor (medium 6.4)
- [CVE-2026-105699](https://insights.sbomify.com/CVE-2026-105699/): Langflow: Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers (high 7.1)
- [CVE-2026-105698](https://insights.sbomify.com/CVE-2026-105698/): Langflow: Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints (medium 5.4)
- [CVE-2026-105697](https://insights.sbomify.com/CVE-2026-105697/): Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration (critical 9.9)
- [CVE-2026-105696](https://insights.sbomify.com/CVE-2026-105696/): Missing authorization in penpot (medium 6.5)
- [CVE-2026-105695](https://insights.sbomify.com/CVE-2026-105695/): Missing authorization in penpot (medium 5.9)
- [CVE-2026-105694](https://insights.sbomify.com/CVE-2026-105694/): Penpot: Stored XSS via Unsanitised SVG Uploads (medium 5.4)
- [CVE-2026-105693](https://insights.sbomify.com/CVE-2026-105693/): Penpot: Anonymous share-link token disclosure & page-scope bypass via get-view-only-bundle (medium 5.3)
- [CVE-2026-105692](https://insights.sbomify.com/CVE-2026-105692/): Penpot: IDOR in Share-Link Deletion Allows Any File Editor to Delete Share-Links They Did Not Create (medium 5.4)
- [CVE-2026-105691](https://insights.sbomify.com/CVE-2026-105691/): Penpot: Authenticated OS Command Injection in Penpot SVG Exporter via Legacy fill-color (critical 9.9)
- [CVE-2026-105690](https://insights.sbomify.com/CVE-2026-105690/): Penpot: Server-side session not invalidated on logout; stale auth-token cookie remains valid for full profile access (medium 5.9)
- [CVE-2026-10569](https://insights.sbomify.com/CVE-2026-10569/): IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to an Exposure of Sensitive Information Vulnerability (medium 4.3)
- [CVE-2026-105689](https://insights.sbomify.com/CVE-2026-105689/): Penpot: SSRF guard bypass via IPv6 transition addresses (NAT64/6to4/Teredo) in webhook delivery and media download (medium 6.0)
- [CVE-2026-105688](https://insights.sbomify.com/CVE-2026-105688/): Penpot: Team admin can escalate to owner via team invitation (missing owner-role guard on the invitation path) (medium 6.7)
- [CVE-2026-105687](https://insights.sbomify.com/CVE-2026-105687/): Penpot: A team admin (non-owner) can remove the team owner via ::delete-team-member — missing owner-protection (medium 4.9)
- [CVE-2026-105686](https://insights.sbomify.com/CVE-2026-105686/): Penpot: Repeated chunk index causes temporary-storage amplification (medium 5.3)
- [CVE-2026-105684](https://insights.sbomify.com/CVE-2026-105684/): Missing authorization in penpot (medium 4.3)
- [CVE-2026-105683](https://insights.sbomify.com/CVE-2026-105683/): Ghost: Path Traversal Vulnerability in Ghost ImageSize Service (low 3.8)
- [CVE-2026-105682](https://insights.sbomify.com/CVE-2026-105682/): Ghost: Server-Side Request Forgery in Webhook Trigger (low 2.7)
- [CVE-2026-105681](https://insights.sbomify.com/CVE-2026-105681/): Ghost: Authorization Bypass in Comments Feature (medium 6.5)
- [CVE-2026-105680](https://insights.sbomify.com/CVE-2026-105680/): Ghost: Authorization Issue Allowed Author Role to Delete any Post (medium 6.5)
- [CVE-2026-10568](https://insights.sbomify.com/CVE-2026-10568/): itsourcecode Fees Management System manage_payment.php sql injection (medium 5.3)
- [CVE-2026-105679](https://insights.sbomify.com/CVE-2026-105679/): Ghost: Stored XSS via File Uploads on Local Storage (high 7.3)
- [CVE-2026-105678](https://insights.sbomify.com/CVE-2026-105678/): Ghost: Editors Could Promote Staff Users to Their Own Role (medium 4.3)
- [CVE-2026-105677](https://insights.sbomify.com/CVE-2026-105677/): Ghost: Remote Code Execution via Theme Translation Files (high 7.2)
- [CVE-2026-105676](https://insights.sbomify.com/CVE-2026-105676/): Ghost: Path Traversal via Locale Setting (medium 4.9)
- [CVE-2026-105675](https://insights.sbomify.com/CVE-2026-105675/): Ghost: Invite Token Disclosure in Ghost Admin API (high 7.5)
- [CVE-2026-105674](https://insights.sbomify.com/CVE-2026-105674/): Predictable Media Stream Pre-Shared Key Vulnerability in TP-Link Tapo C325WB (high 8.7)
- [CVE-2026-105673](https://insights.sbomify.com/CVE-2026-105673/): Unauthenticated RTSP Tunnel Denial-of-Service Vulnerability in TP-Link Tapo C325WB (high 7.1)
- [CVE-2026-105672](https://insights.sbomify.com/CVE-2026-105672/): Unauthenticated JSON API Authorization Bypass Vulnerability in TP-Link Tapo C325WB (high 8.7)
- [CVE-2026-10567](https://insights.sbomify.com/CVE-2026-10567/): 1Panel-dev CordysCRM ModuleFormController ModuleFormService.java save cross site scripting (medium 5.1)
- [CVE-2026-105668](https://insights.sbomify.com/CVE-2026-105668/): Hex release-age cooldown is lifted package-wide when the locked release is retired (high 7.1)
- [CVE-2026-105667](https://insights.sbomify.com/CVE-2026-105667/): J4Care dcm4che Missing Authentication for Critical Function (high 8.7)
- [CVE-2026-105664](https://insights.sbomify.com/CVE-2026-105664/): Guangzhou Juan IoT Technology EseeCloud Observable Response Discrepancy (medium 6.9)
- [CVE-2026-105661](https://insights.sbomify.com/CVE-2026-105661/): Gitea panic on the repositories route of individual users (medium 5.3)
- [CVE-2026-105660](https://insights.sbomify.com/CVE-2026-105660/): Unvalidated HTTP/1 request-target authority lets a client choose conn.host and conn.port in Bandit (medium 6.9)
- [CVE-2026-10566](https://insights.sbomify.com/CVE-2026-10566/): FoundationAgents MetaGPT schema.py Message.check_instruct_content deserialization (medium 4.8)
- [CVE-2026-105659](https://insights.sbomify.com/CVE-2026-105659/): Denial of service in bandit (high 8.7)
- [CVE-2026-105652](https://insights.sbomify.com/CVE-2026-105652/): Ghost: Password Hash Ordering Disclosure in Ghost Admin API (low 3.1)
- [CVE-2026-105651](https://insights.sbomify.com/CVE-2026-105651/): Ghost: Stored XSS via Bookmark Card Images (high 7.3)
- [CVE-2026-105650](https://insights.sbomify.com/CVE-2026-105650/): Ghost: Stored XSS via oEmbed Photo Responses (high 8.1)
- [CVE-2026-10565](https://insights.sbomify.com/CVE-2026-10565/): Open5GS NGAP Handover gmm-sm.c gmm_state_security_mode race condition (low 2.3)
- [CVE-2026-105649](https://insights.sbomify.com/CVE-2026-105649/): Ghost: Stored XSS via SVG Uploads Bypassing Sanitization (high 7.3)
- [CVE-2026-105648](https://insights.sbomify.com/CVE-2026-105648/): Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses (medium 4.0)
- [CVE-2026-105647](https://insights.sbomify.com/CVE-2026-105647/): Ghost: Server-Side Request Forgery in Bookmark Fetching (medium 4.0)
- [CVE-2026-105646](https://insights.sbomify.com/CVE-2026-105646/): Ghost: Regular Expression Denial of Service in Content Import (medium 4.9)
- [CVE-2026-105645](https://insights.sbomify.com/CVE-2026-105645/): Ghost: Regular Expression Denial of Service in External Media Inliner (medium 4.9)
- [CVE-2026-105644](https://insights.sbomify.com/CVE-2026-105644/): Ghost: Stored XSS via SVG Files in Content Imports (medium 6.8)
- [CVE-2026-105643](https://insights.sbomify.com/CVE-2026-105643/): Ghost: Stored XSS via Embed Card Previews (high 7.3)
- [CVE-2026-105642](https://insights.sbomify.com/CVE-2026-105642/): Ghost: Remote Code Execution via Bookmark Card Images (high 8.8)
- [CVE-2026-105641](https://insights.sbomify.com/CVE-2026-105641/): Hardcoded credentials in plane (critical 9.8)
- [CVE-2026-105640](https://insights.sbomify.com/CVE-2026-105640/): Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab) (critical 9.1)
- [CVE-2026-10564](https://insights.sbomify.com/CVE-2026-10564/): SSRF Vulnerability in Langflow OSS Legacy Components Bypasses Protection (high 8.2)
- [CVE-2026-105639](https://insights.sbomify.com/CVE-2026-105639/): Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane (critical 9.8)
- [CVE-2026-105638](https://insights.sbomify.com/CVE-2026-105638/): Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute force (critical 9.1)
- [CVE-2026-105637](https://insights.sbomify.com/CVE-2026-105637/): Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-46558) (critical 9.6)
- [CVE-2026-105636](https://insights.sbomify.com/CVE-2026-105636/): Plane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set) (critical 9.9)
- [CVE-2026-105635](https://insights.sbomify.com/CVE-2026-105635/): Plane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Join Without Token (high 7.4)
- [CVE-2026-105634](https://insights.sbomify.com/CVE-2026-105634/): Plane: Privilege Escalation: Project Guest Can Demote Admin/Member Roles (high 8.1)
- [CVE-2026-105633](https://insights.sbomify.com/CVE-2026-105633/): Plane: Issue Attachment Ownership Hijacking via Missing `issue_id` Scope (high 7.1)
- [CVE-2026-105632](https://insights.sbomify.com/CVE-2026-105632/): Plane: Broken Access Control - joinProject GraphQL mutation allows self-join into private (secret) projects (high 8.7)
- [CVE-2026-105631](https://insights.sbomify.com/CVE-2026-105631/): Missing authorization in plane (high 7.5)
- [CVE-2026-105630](https://insights.sbomify.com/CVE-2026-105630/): Plane: Stored XSS via SVG attachment served inline on the application origin (account takeover) (high 8.7)
- [CVE-2026-105629](https://insights.sbomify.com/CVE-2026-105629/): Plane: Cross-Tenant Destructive IDOR: Estimate Point Deletion via Unscoped Primary Key Lookup (high 7.1)
- [CVE-2026-105628](https://insights.sbomify.com/CVE-2026-105628/): Plane: OAuth Avatar Redirect SSRF Leads to Internal Data Exfiltration via Static Asset Endpoint (high 7.6)
- [CVE-2026-105626](https://insights.sbomify.com/CVE-2026-105626/): Consul vulnerable to a denial of service in HTTP APIs (high 7.5)
- [CVE-2026-105621](https://insights.sbomify.com/CVE-2026-105621/): jishenghua jshERP Financial Receipt Update AccountHeadService.java updateAccountHeadAndDetail improper authorization (medium 5.3)
- [CVE-2026-105620](https://insights.sbomify.com/CVE-2026-105620/): PostgreSQL Anonymizer: A masked role reads the authentic data of masked tables through a masking rule with a sub-query (medium 6.5)
- [CVE-2026-10562](https://insights.sbomify.com/CVE-2026-10562/): Unauthenticated Open Redirect Vulnerability on TP-Link Archer AX20 Web Interface (medium 5.9)
- [CVE-2026-105619](https://insights.sbomify.com/CVE-2026-105619/): PostgreSQL Anonymizer: Masking rules of the tables are not applied through security_invoker views (medium 4.8)
- [CVE-2026-105618](https://insights.sbomify.com/CVE-2026-105618/): PostgreSQL Anonymizer: Masked partitions and child tables are not masked when they are queried through their parent (medium 5.7)
- [CVE-2026-105617](https://insights.sbomify.com/CVE-2026-105617/): PostgreSQL Anonymizer: Cached plans bypass transparent dynamic masking after a role change or a new masking rule (medium 5.7)
- [CVE-2026-105616](https://insights.sbomify.com/CVE-2026-105616/): PostgreSQL Anonymizer: The secret salt and shift of anon are readable by any role in pg_roles or pg_db_role_setting (medium 5.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/968/