# Vulnerabilities published in 2026


- [CVE-2026-105615](https://insights.sbomify.com/CVE-2026-105615/): PostgreSQL Anonymizer: Masked roles can read the statistics of masked columns in pg_stats (low 3.5)
- [CVE-2026-105614](https://insights.sbomify.com/CVE-2026-105614/): PostgreSQL Anonymizer: Unbounded image-decode memory allocation (DoS) in anon.image_blur() (medium 4.7)
- [CVE-2026-105613](https://insights.sbomify.com/CVE-2026-105613/): PostgreSQL Anonymizer: Unbounded memory allocation (DoS) in range-based dummy functions (medium 4.7)
- [CVE-2026-105612](https://insights.sbomify.com/CVE-2026-105612/): PostgreSQL Anonymizer: Data-modifying CTEs bypass the read-only restriction of masked roles (low 3.5)
- [CVE-2026-105611](https://insights.sbomify.com/CVE-2026-105611/): chillzhuang SpringBlade User Detail Endpoint RoleController.java improper authorization (medium 5.1)
- [CVE-2026-105610](https://insights.sbomify.com/CVE-2026-105610/): chillzhuang SpringBlade Parameter Submit Management ParamController.java improper authorization (medium 5.1)
- [CVE-2026-10561](https://insights.sbomify.com/CVE-2026-10561/): Unauthenticated Remote Code Execution in Langflow OSS PythonREPLComponent via Builtins Injection (critical 10.0)
- [CVE-2026-105608](https://insights.sbomify.com/CVE-2026-105608/): Consul vulnerable to an authorization bypass in service mesh registration (high 8.8)
- [CVE-2026-10560](https://insights.sbomify.com/CVE-2026-10560/): Unauthenticated Access to Private Flow Build Events and Cancellation in Langflow OSS (high 8.2)
- [CVE-2026-1056](https://insights.sbomify.com/CVE-2026-1056/): Snow Monkey Forms <= 12.0.3 - Unauthenticated Arbitrary File Deletion via Path Traversal (critical 9.8)
- [CVE-2026-105599](https://insights.sbomify.com/CVE-2026-105599/): Microsoft Office PowerPoint Remote Code Execution Vulnerability (high 7.5)
- [CVE-2026-105598](https://insights.sbomify.com/CVE-2026-105598/): Microsoft Office Access Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-105597](https://insights.sbomify.com/CVE-2026-105597/): Microsoft Office Access Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-105596](https://insights.sbomify.com/CVE-2026-105596/): Microsoft Office Access Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-105595](https://insights.sbomify.com/CVE-2026-105595/): Microsoft Office Access Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-105593](https://insights.sbomify.com/CVE-2026-105593/): Microsoft Office Access Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-105592](https://insights.sbomify.com/CVE-2026-105592/): Microsoft Office Access Remote Code Execution Vulnerability (high 7.5)
- [CVE-2026-105591](https://insights.sbomify.com/CVE-2026-105591/): Microsoft Office Access Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-10559](https://insights.sbomify.com/CVE-2026-10559/): SourceCodester Pizzafy Ecommerce System index.php file inclusion (medium 5.3)
- [CVE-2026-10558](https://insights.sbomify.com/CVE-2026-10558/): SourceCodester Pizzafy Ecommerce System index.php file inclusion (medium 5.3)
- [CVE-2026-105573](https://insights.sbomify.com/CVE-2026-105573/): newbee-ltd newbee-mall Shopping Cart Quantity updateAccountHeadAndDetail logic error (medium 5.3)
- [CVE-2026-105572](https://insights.sbomify.com/CVE-2026-105572/): PickMall Lilishop Buyer Invoice List receipt authorization (medium 5.3)
- [CVE-2026-105571](https://insights.sbomify.com/CVE-2026-105571/): PickMall Lilishop Mobile Binding bindMobile improper authorization (medium 6.9)
- [CVE-2026-105570](https://insights.sbomify.com/CVE-2026-105570/): Docker Sandboxes OAuth response masking could be bypassed with a case-variant token host (medium 6.7)
- [CVE-2026-10557](https://insights.sbomify.com/CVE-2026-10557/): Yarbo Android/iOS Mobile Application and Cloud Infrastructure Use of Hard-coded Credentials (critical 9.3)
- [CVE-2026-10556](https://insights.sbomify.com/CVE-2026-10556/): Unauthenticated webhook request with null notification entry could crash the Microsoft Calendar plugin. (medium 5.3)
- [CVE-2026-10553](https://insights.sbomify.com/CVE-2026-10553/): jQuery Hover Footnotes <= 1.4 - Cross-Site Request Forgery to Plugin Settings Update (medium 4.3)
- [CVE-2026-10552](https://insights.sbomify.com/CVE-2026-10552/): Blue Captcha <= 2.0.1 - Cross-Site Request Forgery via 'blcap_action' Parameter (medium 4.3)
- [CVE-2026-10551](https://insights.sbomify.com/CVE-2026-10551/): Breeze Cache < 2.5.6 - Unauthenticated Stored XSS via Minify Library (medium 6.1)
- [CVE-2026-10550](https://insights.sbomify.com/CVE-2026-10550/): elunez eladmin Application Deployment App.java command injection (medium 5.3)
- [CVE-2026-1055](https://insights.sbomify.com/CVE-2026-1055/): TalkJS <= 0.1.15 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'welcomeMessage' Parameter (medium 4.4)
- [CVE-2026-10549](https://insights.sbomify.com/CVE-2026-10549/): Privilege escalation in Yandex Database (medium 5.3)
- [CVE-2026-105489](https://insights.sbomify.com/CVE-2026-105489/): SQL injection in Adobe Campaign Classic (critical 9.9)
- [CVE-2026-105488](https://insights.sbomify.com/CVE-2026-105488/): Missing authorization in Server (high 7.1)
- [CVE-2026-105487](https://insights.sbomify.com/CVE-2026-105487/): yogeshojha reNgine listTargets Endpoint tasks.py subdomain_discovery os command injection (medium 5.3)
- [CVE-2026-105486](https://insights.sbomify.com/CVE-2026-105486/): OSSRS srs System API api.go systemAPI.Run missing authentication (medium 6.9)
- [CVE-2026-105485](https://insights.sbomify.com/CVE-2026-105485/): Auth bypass in Server (medium 6.8)
- [CVE-2026-105484](https://insights.sbomify.com/CVE-2026-105484/): TOTOLINK X6000R UploadFirmwareFile cstecgi.cgi firmware_check os command injection (critical 10.0)
- [CVE-2026-105483](https://insights.sbomify.com/CVE-2026-105483/): Security feature bypass in node (high 7.4)
- [CVE-2026-105482](https://insights.sbomify.com/CVE-2026-105482/): Security feature bypass in node (high 7.4)
- [CVE-2026-105481](https://insights.sbomify.com/CVE-2026-105481/): Race condition in node (medium 6.5)
- [CVE-2026-10548](https://insights.sbomify.com/CVE-2026-10548/): Auth bypass in hermes-agent (medium 4.8)
- [CVE-2026-105477](https://insights.sbomify.com/CVE-2026-105477/): Privilege escalation in Agent for Linux (high 7.3)
- [CVE-2026-105474](https://insights.sbomify.com/CVE-2026-105474/): Code injection in SolusVM 2 (critical 9.4)
- [CVE-2026-105472](https://insights.sbomify.com/CVE-2026-105472/): girishsaraf Online-Appointment-Booking-System Booking book.php sql injection (medium 5.3)
- [CVE-2026-105471](https://insights.sbomify.com/CVE-2026-105471/): girishsaraf Online-Appointment-Booking-System Registration signup.php sql injection (medium 6.9)
- [CVE-2026-105470](https://insights.sbomify.com/CVE-2026-105470/): girishsaraf Online-Appointment-Booking-System Doctor Search Endpoint locateus.php mysqli_query sql injection (medium 6.9)
- [CVE-2026-10547](https://insights.sbomify.com/CVE-2026-10547/): Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement (medium 5.9)
- [CVE-2026-105469](https://insights.sbomify.com/CVE-2026-105469/): girishsaraf Online-Appointment-Booking-System AJAX Endpoint get_town.php sql injection (medium 6.9)
- [CVE-2026-105468](https://insights.sbomify.com/CVE-2026-105468/): girishsaraf Online-Appointment-Booking-System Login mlogin.php mysqli_query sql injection (medium 6.9)
- [CVE-2026-105466](https://insights.sbomify.com/CVE-2026-105466/): IBM® Db2® is vulnerable to a denial of service when inserting into a table with XML columns under specific conditions (medium 6.5)
- [CVE-2026-105465](https://insights.sbomify.com/CVE-2026-105465/): IBM® Db2® is vulnerable to privilege escalation when db2ssh is enabled with the db2 instance (high 8.8)
- [CVE-2026-105464](https://insights.sbomify.com/CVE-2026-105464/): Privilege escalation in Db2 (high 8.8)
- [CVE-2026-105460](https://insights.sbomify.com/CVE-2026-105460/): Bluez: bluez: stack-based out-of-bounds read in btmon via unvalidated num_keys in return_link_keys_evt() (medium 5.5)
- [CVE-2026-10546](https://insights.sbomify.com/CVE-2026-10546/): DNS Rebinding TOCTOU Bypass of SSRF Protection in Langflow OSS URL Component (high 7.1)
- [CVE-2026-105458](https://insights.sbomify.com/CVE-2026-105458/): Reliance on Untrusted Inputs in a Security Decision in GitLab (medium 4.3)
- [CVE-2026-105457](https://insights.sbomify.com/CVE-2026-105457/): Authenticated Arbitrary Local File Read via Path Traversal in HAVELSAN's Liman MYS (medium 6.5)
- [CVE-2026-105453](https://insights.sbomify.com/CVE-2026-105453/): IBM Sterling Connect:Direct for Unix Improper Privilege Management (high 8.4)
- [CVE-2026-105452](https://insights.sbomify.com/CVE-2026-105452/): Docker Sandboxes egress proxy could forward unrecognized client credentials to managed hosts (medium 5.9)
- [CVE-2026-10545](https://insights.sbomify.com/CVE-2026-10545/): IBM Planning Analytics Local is affected by Open Redirect (high 7.5)
- [CVE-2026-105447](https://insights.sbomify.com/CVE-2026-105447/): Quay: quay: global read-only superuser can access build trigger write credentials (medium 5.5)
- [CVE-2026-105445](https://insights.sbomify.com/CVE-2026-105445/): Docker Hub account conversion could reassign an active personal access token to another user (critical 9.4)
- [CVE-2026-105444](https://insights.sbomify.com/CVE-2026-105444/): dotnet eShop Ordering API OrdersApi.cs GetOrderAsync resource injection (medium 5.3)
- [CVE-2026-105443](https://insights.sbomify.com/CVE-2026-105443/): IBM WebSphere Application Server Liberty is affected by an improper access control (high 8.2)
- [CVE-2026-105442](https://insights.sbomify.com/CVE-2026-105442/): Deserialization in WebSphere Application Server (high 7.5)
- [CVE-2026-10544](https://insights.sbomify.com/CVE-2026-10544/): Command injection in Server (medium 6.5)
- [CVE-2026-105438](https://insights.sbomify.com/CVE-2026-105438/): O2OA General url ActionUploadExcelWithUrl server-side request forgery (medium 5.3)
- [CVE-2026-105436](https://insights.sbomify.com/CVE-2026-105436/): WordPress MainWP Child plugin <= 6.2.1 - Deserialization of untrusted data vulnerability (high 8.8)
- [CVE-2026-10543](https://insights.sbomify.com/CVE-2026-10543/): IBM® Db2® is vulnerable to privilege escalation with a specially crafted query (high 8.2)
- [CVE-2026-105429](https://insights.sbomify.com/CVE-2026-105429/): NetBird client SSH config Match line injection via peer FQDN or hostname allows local command execution (high 8.9)
- [CVE-2026-105421](https://insights.sbomify.com/CVE-2026-105421/): WordPress Kit (formerly ConvertKit) for WooCommerce plugin <= 2.2.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-105420](https://insights.sbomify.com/CVE-2026-105420/): Path Traversal in Wing WFTP Server leading to Remote Code Execution (critical 9.4)
- [CVE-2026-10542](https://insights.sbomify.com/CVE-2026-10542/): Playbooks channel action update validation issue (medium 5.0)
- [CVE-2026-105412](https://insights.sbomify.com/CVE-2026-105412/): SQL Injection vulnerability affecting Tuleap Enterprise Edition 17.5 (high 7.1)
- [CVE-2026-105411](https://insights.sbomify.com/CVE-2026-105411/): Missing authorization in Tuleap Enterprise Edition (high 8.1)
- [CVE-2026-105410](https://insights.sbomify.com/CVE-2026-105410/): Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 (high 8.7)
- [CVE-2026-105409](https://insights.sbomify.com/CVE-2026-105409/): Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 (high 8.7)
- [CVE-2026-105408](https://insights.sbomify.com/CVE-2026-105408/): Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 (high 8.7)
- [CVE-2026-105407](https://insights.sbomify.com/CVE-2026-105407/): OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 (high 8.8)
- [CVE-2026-10540](https://insights.sbomify.com/CVE-2026-10540/): Weak password hash protection in Control-M/Entreprise Manager (medium 5.6)
- [CVE-2026-1054](https://insights.sbomify.com/CVE-2026-1054/): RegistrationMagic <= 6.0.7.4 - Missing Authorization to Unauthenticated Arbitrary Settings Modification (medium 5.3)
- [CVE-2026-105397](https://insights.sbomify.com/CVE-2026-105397/): LearnPress WordPress Plugin through 4.4.9.1 Stored XSS via Quiz Question Hint and Explanation (medium 5.1)
- [CVE-2026-105396](https://insights.sbomify.com/CVE-2026-105396/): Heym before v0.0.112 HITL Review Token Leak via Spoofable Origin Header (medium 5.3)
- [CVE-2026-105392](https://insights.sbomify.com/CVE-2026-105392/): Lybbn Django-Vue-Lyadmin JWT Signing settings.py hard-coded key (medium 6.9)
- [CVE-2026-105390](https://insights.sbomify.com/CVE-2026-105390/): Race condition in ovpn-dco-win (medium 6.9)
- [CVE-2026-10539](https://insights.sbomify.com/CVE-2026-10539/): Unauthenticated command injection in Control-M/Server communication command (critical 9.5)
- [CVE-2026-105389](https://insights.sbomify.com/CVE-2026-105389/): feelec-yishu feelcrm-os UploadTicketFile Endpoint UploadController.class.php unrestricted upload (medium 5.3)
- [CVE-2026-105388](https://insights.sbomify.com/CVE-2026-105388/): feelec-yishu feelcrm-os Member Endpoint MemberController.class.php index sql injection (medium 5.3)
- [CVE-2026-105387](https://insights.sbomify.com/CVE-2026-105387/): girishsaraf Online-Appointment-Booking-System Patient Login cover.php mysqli_query sql injection (medium 6.9)
- [CVE-2026-105386](https://insights.sbomify.com/CVE-2026-105386/): onetwothreeneth HospitalManagementSystem print.php get sql injection (medium 6.9)
- [CVE-2026-105385](https://insights.sbomify.com/CVE-2026-105385/): onetwothreeneth HospitalManagementSystem transaction_details.php sql injection (medium 6.9)
- [CVE-2026-105384](https://insights.sbomify.com/CVE-2026-105384/): UNION HospitalManagementSystem patient_info.php sql injection (medium 6.9)
- [CVE-2026-105383](https://insights.sbomify.com/CVE-2026-105383/): onetwothreeneth HospitalManagementSystem controller.php sql injection (medium 6.9)
- [CVE-2026-105382](https://insights.sbomify.com/CVE-2026-105382/): onetwothreeneth HospitalManagementSystem Account Administration controller.php update_subaccount improper authorization (medium 6.9)
- [CVE-2026-10538](https://insights.sbomify.com/CVE-2026-10538/): Improper deserialization handling in Control-M Components (high 8.9)
- [CVE-2026-10537](https://insights.sbomify.com/CVE-2026-10537/): Remote unauthenticated information disclosure and denial of service due to unauthenticated service access (medium 6.9)
- [CVE-2026-10536](https://insights.sbomify.com/CVE-2026-10536/): HTTP/2 stream-dependency tree UAF (critical 9.8)
- [CVE-2026-10535](https://insights.sbomify.com/CVE-2026-10535/): Memory corruption in Db2 (high 8.4)
- [CVE-2026-10534](https://insights.sbomify.com/CVE-2026-10534/): IBM® Db2® is vulnerable to buffer overflow in the IXF IMPORT parser (high 8.4)
- [CVE-2026-105331](https://insights.sbomify.com/CVE-2026-105331/): mk-oracle: Local privilege escalation via malicious Oracle Instant Client (medium 5.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/969/