# Vulnerabilities published in 2026


- [CVE-2026-10533](https://insights.sbomify.com/CVE-2026-10533/): Denial of service in Red Hat OpenShift Container Platform 4 (medium 5.0)
- [CVE-2026-105329](https://insights.sbomify.com/CVE-2026-105329/): TallCMS PluginManager ThemeManager.php code injection (medium 5.3)
- [CVE-2026-105326](https://insights.sbomify.com/CVE-2026-105326/): Cups: cups: argument injection in mailto notifier via notify-recipient-uri (low 2.5)
- [CVE-2026-105324](https://insights.sbomify.com/CVE-2026-105324/): An HTTP header injection vulnerability was found in the ADM (critical 9.2)
- [CVE-2026-105323](https://insights.sbomify.com/CVE-2026-105323/): Reflected XSS in Kulga Software's Kulga News Software (medium 6.1)
- [CVE-2026-105322](https://insights.sbomify.com/CVE-2026-105322/): Magee Shortcodes <= 2.1.1 - Unauthenticated Mail Relay via Contact Form (medium 5.3)
- [CVE-2026-10532](https://insights.sbomify.com/CVE-2026-10532/): Logback deserialization whitelist bypass for Proxy objects (low 2.9)
- [CVE-2026-105318](https://insights.sbomify.com/CVE-2026-105318/): WordPress AcyMailing SMTP Newsletter plugin <= 11.1.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-105317](https://insights.sbomify.com/CVE-2026-105317/): WordPress Paid Member Subscriptions plugin <= 3.1.1 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-105316](https://insights.sbomify.com/CVE-2026-105316/): Magee Shortcodes <= 2.1.1 - Reflected XSS via live_preview and magee_create_shortcode Actions (high 7.1)
- [CVE-2026-105315](https://insights.sbomify.com/CVE-2026-105315/): django-haystack more_like_this Template Tag elasticsearch_backend.py _to_python eval injection (medium 5.1)
- [CVE-2026-105314](https://insights.sbomify.com/CVE-2026-105314/): Path traversal in Papermerge (high 7.5)
- [CVE-2026-105312](https://insights.sbomify.com/CVE-2026-105312/): Privilege escalation in StreamsHub Console for Apache Kafka® (critical 9.9)
- [CVE-2026-105311](https://insights.sbomify.com/CVE-2026-105311/): Console-operator: streams for apache kafka console: cross-namespace kafkauser secret exfiltration via confused deputy (high 7.7)
- [CVE-2026-10531](https://insights.sbomify.com/CVE-2026-10531/): AI Share & Summarize < 2.0.4 - Contributor+ Stored XSS via title_style Shortcode Attribute (medium 5.4)
- [CVE-2026-105307](https://insights.sbomify.com/CVE-2026-105307/): Casdoor API Endpoint authz_filter.go ApiFilter missing authentication (medium 6.9)
- [CVE-2026-105306](https://insights.sbomify.com/CVE-2026-105306/): Keycloak-services: keycloak-services: token introspection audience bypass via dynamic client registration (medium 6.5)
- [CVE-2026-105305](https://insights.sbomify.com/CVE-2026-105305/): Keycloak-services: keycloak-services: device authorization grant bypasses per-client minimum.acr.value enforcement (medium 5.4)
- [CVE-2026-105302](https://insights.sbomify.com/CVE-2026-105302/): Keycloak-services: keycloak-services: user session note mapper exposes upstream idp access tokens (medium 5.7)
- [CVE-2026-10530](https://insights.sbomify.com/CVE-2026-10530/): Pie Register < 3.8.4.10 - Unauthenticated Email Verification Bypass via Predictable Token (medium 5.3)
- [CVE-2026-1053](https://insights.sbomify.com/CVE-2026-1053/): Cross-site scripting in Ivory Search – WordPress Search Plugin (medium 4.4)
- [CVE-2026-105299](https://insights.sbomify.com/CVE-2026-105299/): Security feature bypass in https://github.com/cloudflare/pingora (high 8.7)
- [CVE-2026-105298](https://insights.sbomify.com/CVE-2026-105298/): Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypass (medium 6.3)
- [CVE-2026-105297](https://insights.sbomify.com/CVE-2026-105297/): Pingora HTTP/2 server memory exhaustion through unbounded default header-list and concurrent-stream limits (high 7.5)
- [CVE-2026-105295](https://insights.sbomify.com/CVE-2026-105295/): GitAhead 2.5.0 through 2.7.1 Unverified Update Installation and TLS Bypass (high 7.7)
- [CVE-2026-105294](https://insights.sbomify.com/CVE-2026-105294/): Legcord 1.1.0 through 1.3.0 Chromium Switch Injection via settings.setConfig (critical 9.1)
- [CVE-2026-105293](https://insights.sbomify.com/CVE-2026-105293/): Legcord 1.1.0 through 1.3.0 Path Traversal via Theme IPC Handlers (critical 9.2)
- [CVE-2026-105292](https://insights.sbomify.com/CVE-2026-105292/): Chaterm before 0.12.1 Login CSRF via chaterm:// OAuth Callback (medium 6.0)
- [CVE-2026-105291](https://insights.sbomify.com/CVE-2026-105291/): feelec-yishu feelcrm-os Department Search Endpoint GroupController.class.php index cross site scripting (medium 5.3)
- [CVE-2026-105290](https://insights.sbomify.com/CVE-2026-105290/): feelec-yishu feelcrm-os getCurlData Endpoint GoogleController.class.php server-side request forgery (medium 6.9)
- [CVE-2026-10529](https://insights.sbomify.com/CVE-2026-10529/): westboy CicadasCMS Task Scheduling Management ScheduleJobController.java cross site scripting (medium 4.8)
- [CVE-2026-105289](https://insights.sbomify.com/CVE-2026-105289/): Cross-site scripting in feelcrm-os (medium 5.1)
- [CVE-2026-105288](https://insights.sbomify.com/CVE-2026-105288/): feelec-yishu feelcrm-os Crm Endpoint functions.php index cross site scripting (medium 5.3)
- [CVE-2026-105287](https://insights.sbomify.com/CVE-2026-105287/): feelec-yishu feelcrm-os getMemberByGroups Endpoint AjaxRequestController.class.php sql injection (medium 5.3)
- [CVE-2026-105286](https://insights.sbomify.com/CVE-2026-105286/): Totolink A3002MU File Upload formUploadFile sub_44B250 path traversal (medium 5.3)
- [CVE-2026-105285](https://insights.sbomify.com/CVE-2026-105285/): Totolink A3002MU QoS Rule formIpQoS stack-based overflow (critical 10.0)
- [CVE-2026-105284](https://insights.sbomify.com/CVE-2026-105284/): Totolink A3002MU Authentication Check boa sub_40FCFC improper authorization (critical 10.0)
- [CVE-2026-105283](https://insights.sbomify.com/CVE-2026-105283/): Internal error terms inspected into AshTypescript RPC error responses (medium 6.3)
- [CVE-2026-105281](https://insights.sbomify.com/CVE-2026-105281/): Grid Protection Alliance openPDC and openHistorian Missing Authentication for Critical Function (high 8.7)
- [CVE-2026-105280](https://insights.sbomify.com/CVE-2026-105280/): Hex writes unverified package tarballs to standard output in mix hex.package fetch (medium 6.9)
- [CVE-2026-10528](https://insights.sbomify.com/CVE-2026-10528/): Orthanc DICOM Server DCMTK FromDcmtkBridge.cpp read stack-based overflow (medium 4.8)
- [CVE-2026-105279](https://insights.sbomify.com/CVE-2026-105279/): J4Care dcm4che Missing Authentication for Critical Function (critical 9.3)
- [CVE-2026-105278](https://insights.sbomify.com/CVE-2026-105278/): Grid Protection Alliance openPDC (Docker image) Use of Hard-coded Credentials (critical 9.3)
- [CVE-2026-105275](https://insights.sbomify.com/CVE-2026-105275/): Satel Netco Design Relative Path Traversal (medium 5.3)
- [CVE-2026-105274](https://insights.sbomify.com/CVE-2026-105274/): hex_core decompresses registry and Erlang term API responses without size limits (low 2.1)
- [CVE-2026-105273](https://insights.sbomify.com/CVE-2026-105273/): J4Care dcm4che Loop with Unreachable Exit Condition (high 8.7)
- [CVE-2026-105272](https://insights.sbomify.com/CVE-2026-105272/): Missing authorization in GROWI (low 2.3)
- [CVE-2026-105271](https://insights.sbomify.com/CVE-2026-105271/): Information disclosure in "ゲオアプリ" for Android (medium 5.1)
- [CVE-2026-105270](https://insights.sbomify.com/CVE-2026-105270/): Unbounded atom creation while parsing SAML messages in esaml allows atom table exhaustion (high 8.7)
- [CVE-2026-10527](https://insights.sbomify.com/CVE-2026-10527/): Boards plugin retains Board Admin rights for users demoted to System Guest (medium 6.3)
- [CVE-2026-105269](https://insights.sbomify.com/CVE-2026-105269/): Satel Netco Design Cross-site Scripting (high 8.5)
- [CVE-2026-105268](https://insights.sbomify.com/CVE-2026-105268/): Gitea issue attachment API allows changing comment attachments (medium 4.3)
- [CVE-2026-105267](https://insights.sbomify.com/CVE-2026-105267/): Gitea tag delete route deletes releases without release permission (high 8.1)
- [CVE-2026-105265](https://insights.sbomify.com/CVE-2026-105265/): Kiloview E3 NDI Encoder Path Traversal (medium 6.0)
- [CVE-2026-105263](https://insights.sbomify.com/CVE-2026-105263/): Shaarli Admin Metadata Endpoint MetadataController.php MetadataController server-side request forgery (medium 5.1)
- [CVE-2026-105262](https://insights.sbomify.com/CVE-2026-105262/): Falang multilanguage for WordPress < 1.4.6 - Subscriber+ Stored XSS via Term Translation (high 8.0)
- [CVE-2026-105261](https://insights.sbomify.com/CVE-2026-105261/): PublishPress Future 4.10.1 - 4.10.5 - Contributor+ Stored XSS via 'wrapper' and 'dateformat' Shortcode Attributes (medium 6.8)
- [CVE-2026-105260](https://insights.sbomify.com/CVE-2026-105260/): Database Addon For WPForms < 1.1.1 - Arbitrary Form Entry Deletion via CSRF (medium 4.3)
- [CVE-2026-10526](https://insights.sbomify.com/CVE-2026-10526/): EmbedPress < 4.6.1 - Unauthenticated Blind SSRF (medium 5.8)
- [CVE-2026-105258](https://insights.sbomify.com/CVE-2026-105258/): LatePoint < 5.7.6 - Admin+ Stored XSS via Booking Form Step Settings (low 3.5)
- [CVE-2026-105257](https://insights.sbomify.com/CVE-2026-105257/): LatePoint < 5.7.5 - Agent+ Customer PII Disclosure via IDOR (low 2.7)
- [CVE-2026-105256](https://insights.sbomify.com/CVE-2026-105256/): LatePoint < 5.7.5 - Unauthenticated Payment Bypass via 'payment_portion' Parameter (medium 5.3)
- [CVE-2026-105254](https://insights.sbomify.com/CVE-2026-105254/): itsourcecode Online Admission System schoolyear.php sql injection (medium 5.3)
- [CVE-2026-105253](https://insights.sbomify.com/CVE-2026-105253/): itsourcecode Online Admission System Project login1.php sql injection (medium 6.9)
- [CVE-2026-105251](https://insights.sbomify.com/CVE-2026-105251/): vgmstream VAG File psx_decoder.c ps_find_padding out-of-bounds (medium 5.3)
- [CVE-2026-105250](https://insights.sbomify.com/CVE-2026-105250/): vgmstream Microsoft IMA Decoder ima_decoder.c decode_ms_ima divide by zero (medium 5.3)
- [CVE-2026-10525](https://insights.sbomify.com/CVE-2026-10525/): NEX-Forms < 9.2.3 - Unauthenticated Stored XSS via Form Submission (medium 6.1)
- [CVE-2026-105249](https://insights.sbomify.com/CVE-2026-105249/): vgmstream TXTP File txtp_process.c make_group_random use after free (low 2.4)
- [CVE-2026-105248](https://insights.sbomify.com/CVE-2026-105248/): vgmstream TXTP File txtp_parser.c txtp_parse out-of-bounds write (medium 5.3)
- [CVE-2026-105247](https://insights.sbomify.com/CVE-2026-105247/): SourceCodester Online Reviewer Management System btn_functions.php course sql injection (medium 6.9)
- [CVE-2026-105246](https://insights.sbomify.com/CVE-2026-105246/): SourceCodester Online Reviewer Management System btn_functions.php update sql injection (medium 6.9)
- [CVE-2026-105245](https://insights.sbomify.com/CVE-2026-105245/): sgl-project sglang HTTP Endpoint http_server.py server_info cleartext transmission (medium 6.3)
- [CVE-2026-105244](https://insights.sbomify.com/CVE-2026-105244/): Apache log4net: RemoteSyslogAppender silently deletes non-ASCII content (medium 5.3)
- [CVE-2026-105243](https://insights.sbomify.com/CVE-2026-105243/): Apache log4net: Oversize EventLogAppender record silently discarded (medium 5.3)
- [CVE-2026-105242](https://insights.sbomify.com/CVE-2026-105242/): Apache log4net: Request validation failure drops the event in the aspnet-request converter (medium 5.3)
- [CVE-2026-105241](https://insights.sbomify.com/CVE-2026-105241/): Apache log4net: Unencodable content discards a whole SmtpPickupDirAppender batch (medium 5.3)
- [CVE-2026-105240](https://insights.sbomify.com/CVE-2026-105240/): Apache log4net: NUL character truncates OutputDebugStringAppender records (medium 5.3)
- [CVE-2026-10524](https://insights.sbomify.com/CVE-2026-10524/): CoCart < 4.9.0 - Unauthenticated Arbitrary Price Manipulation (high 7.5)
- [CVE-2026-105239](https://insights.sbomify.com/CVE-2026-105239/): Apache log4net: NUL character truncates EventLogAppender records (medium 5.3)
- [CVE-2026-105238](https://insights.sbomify.com/CVE-2026-105238/): ChatGPTNextWeb NextChat Proxy Fallback proxy.ts proxyHandler server-side request forgery (medium 6.9)
- [CVE-2026-105237](https://insights.sbomify.com/CVE-2026-105237/): linlinjava litemall Login Endpoint AdminAuthController.java excessive authentication (medium 6.3)
- [CVE-2026-105236](https://insights.sbomify.com/CVE-2026-105236/): TLS 1.2 session resumption in ssl crosses SNI virtual-host client-certificate trust boundaries (medium 6.3)
- [CVE-2026-105233](https://insights.sbomify.com/CVE-2026-105233/): kishor-23 food-waste-management-system Login Flow login.php session fixiation (medium 5.3)
- [CVE-2026-105232](https://insights.sbomify.com/CVE-2026-105232/): kishor-23 food-waste-management-system Registration deliverysignup.php sql injection (medium 6.9)
- [CVE-2026-105231](https://insights.sbomify.com/CVE-2026-105231/): kishor-23 food-waste-management-system Admin Registration signup.php sql injection (medium 6.9)
- [CVE-2026-105230](https://insights.sbomify.com/CVE-2026-105230/): kishor-23 food-waste-management-system deliverymyord.php sql injection (medium 6.9)
- [CVE-2026-10523](https://insights.sbomify.com/CVE-2026-10523/): Auth bypass in Sentry (critical 9.9)
- [CVE-2026-105229](https://insights.sbomify.com/CVE-2026-105229/): kishor-23 food-waste-management-system User Registration Endpoint signup.php sql injection (medium 6.9)
- [CVE-2026-105228](https://insights.sbomify.com/CVE-2026-105228/): ISPSoft Out-of-Bounds Read Vulnerability (high 7.0)
- [CVE-2026-105227](https://insights.sbomify.com/CVE-2026-105227/): ISPSoft Out-of-Bounds Read Vulnerability (high 7.0)
- [CVE-2026-105226](https://insights.sbomify.com/CVE-2026-105226/): osCommerce osCommerce2 Newsletter Management newsletters.php include code injection (medium 5.1)
- [CVE-2026-105225](https://insights.sbomify.com/CVE-2026-105225/): osCommerce osCommerce2 Payment payment.php include code injection (medium 4.8)
- [CVE-2026-105224](https://insights.sbomify.com/CVE-2026-105224/): YesWiki before 4.6.7 Stored XSS via Bazar valeur Action (medium 5.1)
- [CVE-2026-105223](https://insights.sbomify.com/CVE-2026-105223/): maclof kubernetes-client 0.17.0 before 0.32.0 Disabled TLS Certificate Verification (critical 9.1)
- [CVE-2026-105222](https://insights.sbomify.com/CVE-2026-105222/): alexpechkarev/google-maps through 12.16 Disabled TLS Certificate Verification via ssl_verify_peer (critical 9.1)
- [CVE-2026-105221](https://insights.sbomify.com/CVE-2026-105221/): Gist RubyGem before 6.1.0 Disabled TLS Certificate Verification (critical 9.1)
- [CVE-2026-105220](https://insights.sbomify.com/CVE-2026-105220/): Twine 2 Desktop through 2.12.0 Arbitrary Code Execution via Imported Story Files (high 8.5)
- [CVE-2026-10522](https://insights.sbomify.com/CVE-2026-10522/): Simple User Registration <= 6.9 - Unauthenticated Privilege Escalation to Administrator (critical 9.8)
- [CVE-2026-105219](https://insights.sbomify.com/CVE-2026-105219/): Mammoth.js 1.3.0 before 1.12.3 ReDoS via Style Map Tokeniser (high 8.7)
- [CVE-2026-105218](https://insights.sbomify.com/CVE-2026-105218/): gopay before 1.5.119 Disabled TLS Certificate Verification in xhttp Client (critical 9.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/970/