# Vulnerabilities published in 2026


- [CVE-2026-105217](https://insights.sbomify.com/CVE-2026-105217/): Cockpit CMS 2.12.0 before 2.14.1 Disabled TLS Verification via cron.php (low 2.3)
- [CVE-2026-105216](https://insights.sbomify.com/CVE-2026-105216/): go-micro before 6.0.0 Disabled TLS Certificate Verification via tls.Config Helper (critical 9.1)
- [CVE-2026-105215](https://insights.sbomify.com/CVE-2026-105215/): ZITADEL before 4.16.2 Account Pre-Hijacking via Forged External IdP Callback (critical 9.3)
- [CVE-2026-105214](https://insights.sbomify.com/CVE-2026-105214/): Zitadel before 4.16.2 SSRF via Organization Domain HTTP Verification (low 2.3)
- [CVE-2026-105213](https://insights.sbomify.com/CVE-2026-105213/): ZITADEL before 4.17.1 Authentication Bypass via Login V2 for Deactivated Organizations (high 8.8)
- [CVE-2026-105212](https://insights.sbomify.com/CVE-2026-105212/): ZITADEL before 3.4.14 and 4.16.2 Account Takeover via Passkey Enrollment (high 8.7)
- [CVE-2026-105211](https://insights.sbomify.com/CVE-2026-105211/): ZITADEL before 4.17.1 Authentication Bypass via Login V2 OTP returnCode (critical 9.2)
- [CVE-2026-105210](https://insights.sbomify.com/CVE-2026-105210/): ZITADEL before 4.17.1 Unauthenticated MFA Enrollment via Login V1 Init Handlers (high 8.8)
- [CVE-2026-10521](https://insights.sbomify.com/CVE-2026-10521/): Authenticated unintended access to critical program parameters (high 8.6)
- [CVE-2026-105209](https://insights.sbomify.com/CVE-2026-105209/): ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollment (critical 9.3)
- [CVE-2026-105208](https://insights.sbomify.com/CVE-2026-105208/): ZITADEL before 4.17.3 Session Hijacking via Forgeable IdP Intent Tokens (high 8.7)
- [CVE-2026-105207](https://insights.sbomify.com/CVE-2026-105207/): ZITADEL before 4.17.3 Account Takeover via External IdP Linking (critical 9.3)
- [CVE-2026-105206](https://insights.sbomify.com/CVE-2026-105206/): ZITADEL before 4.17.3 Cross-Organization Authentication Method Enumeration via User Service (medium 5.3)
- [CVE-2026-105205](https://insights.sbomify.com/CVE-2026-105205/): SiYuan before 3.8.5 Information Disclosure via /api/block/getDocInfo and getDocsInfo (medium 6.9)
- [CVE-2026-10520](https://insights.sbomify.com/CVE-2026-10520/): Ivanti Sentry OS Command Injection (critical 10.0, exploited in the wild)
- [CVE-2026-105199](https://insights.sbomify.com/CVE-2026-105199/): Pixel Tag Manager for WooCommerce < 2.2.3 - Contributor+ Stored XSS via Google Tag Manager Container ID (medium 6.8)
- [CVE-2026-105198](https://insights.sbomify.com/CVE-2026-105198/): LatePoint < 5.7.3 - Unauthenticated Customer PII Disclosure via IDOR (medium 5.3)
- [CVE-2026-105197](https://insights.sbomify.com/CVE-2026-105197/): LatePoint < 5.6.5 - Agent+ Arbitrary Order, Customer and Transaction Deletion via IDOR (low 2.7)
- [CVE-2026-105196](https://insights.sbomify.com/CVE-2026-105196/): LatePoint < 5.6.9 - Agent+ Cross-Agent Data Disclosure and Modification via Abilities API (low 3.3)
- [CVE-2026-105195](https://insights.sbomify.com/CVE-2026-105195/): Booking Calendar 10.15 - 11.8.2 - Editor+ Arbitrary Option Disclosure (low 2.7)
- [CVE-2026-105194](https://insights.sbomify.com/CVE-2026-105194/): Easy Digital Downloads < 3.7.1 - Subscriber+ Sensitive Information Disclosure via User Downloads Block (medium 4.3)
- [CVE-2026-105193](https://insights.sbomify.com/CVE-2026-105193/): Booking Calendar < 11.8 - Unauthenticated Booking Information Disclosure and Modification via Predictable Booking Hash (medium 4.8)
- [CVE-2026-105192](https://insights.sbomify.com/CVE-2026-105192/): LMCache Unauthenticated RCE in multiprocess mode via pickle deserialization (critical 9.8)
- [CVE-2026-105190](https://insights.sbomify.com/CVE-2026-105190/): Easy Digital Downloads < 3.7.1 - Unauthenticated Account Creation with Registration Disabled (medium 5.3)
- [CVE-2026-105188](https://insights.sbomify.com/CVE-2026-105188/): code-projects Human Resource Management System Live Event History liveEventHistory.php cross site scripting (medium 5.1)
- [CVE-2026-105187](https://insights.sbomify.com/CVE-2026-105187/): itsourcecode Online Admission System key.php sql injection (medium 5.3)
- [CVE-2026-105186](https://insights.sbomify.com/CVE-2026-105186/): itsourcecode Online Admission System new.php sql injection (medium 5.3)
- [CVE-2026-105185](https://insights.sbomify.com/CVE-2026-105185/): itsourcecode Online Admission System examinee.php sql injection (medium 6.9)
- [CVE-2026-105184](https://insights.sbomify.com/CVE-2026-105184/): itsourcecode Online Admission System creteria.php sql injection (medium 6.9)
- [CVE-2026-105183](https://insights.sbomify.com/CVE-2026-105183/): itsourcecode Online Admission System confirm.php sql injection (medium 6.9)
- [CVE-2026-105182](https://insights.sbomify.com/CVE-2026-105182/): SourceCodester Online Reviewer Management System btn_functions.php update sql injection (medium 6.9)
- [CVE-2026-105181](https://insights.sbomify.com/CVE-2026-105181/): itsourcecode Online Admission System register1.php sql injection (medium 5.3)
- [CVE-2026-105180](https://insights.sbomify.com/CVE-2026-105180/): Jeebase UserService info updateUser dynamically-determined object attributes (medium 5.3)
- [CVE-2026-10518](https://insights.sbomify.com/CVE-2026-10518/): Incorrect Authorization in GitLab (medium 4.3)
- [CVE-2026-105179](https://insights.sbomify.com/CVE-2026-105179/): SourceCodester Drug Recommendation System Password add_user.php missing encryption (medium 5.1)
- [CVE-2026-105178](https://insights.sbomify.com/CVE-2026-105178/): SourceCodester Drug Recommendation System Symptom Creation add_symptom.php mysqli_real_escape_string sql injection (medium 5.1)
- [CVE-2026-105177](https://insights.sbomify.com/CVE-2026-105177/): SourceCodester Drug Recommendation System Drug Creation add_drug.php sql injection (medium 5.1)
- [CVE-2026-105176](https://insights.sbomify.com/CVE-2026-105176/): SourceCodester Drug Recommendation System edit_class.php sql injection (medium 5.1)
- [CVE-2026-105175](https://insights.sbomify.com/CVE-2026-105175/): SourceCodester Drug Recommendation System Student Registration add_student.php sql injection (medium 6.9)
- [CVE-2026-105174](https://insights.sbomify.com/CVE-2026-105174/): Gerapy Project Management views.py project_create path traversal (medium 5.3)
- [CVE-2026-105173](https://insights.sbomify.com/CVE-2026-105173/): code-projects Human Resource Management Event Creation EventStore.php cross site scripting (medium 5.1)
- [CVE-2026-105172](https://insights.sbomify.com/CVE-2026-105172/): itsourcecode Online Admission System login1.php sql injection (medium 6.9)
- [CVE-2026-105171](https://insights.sbomify.com/CVE-2026-105171/): kishor-23 food-waste-management-system Role Attribute admin.php authorization (medium 5.3)
- [CVE-2026-105170](https://insights.sbomify.com/CVE-2026-105170/): kishor-23 food-waste-management-system Admin Signup signup.php missing authentication (medium 6.9)
- [CVE-2026-105169](https://insights.sbomify.com/CVE-2026-105169/): kishor-23 food-waste-management-system Take Order delivery.php sql injection (medium 6.9)
- [CVE-2026-105168](https://insights.sbomify.com/CVE-2026-105168/): kishor-23 food-waste-management-system Order Assignment Block admin.php sql injection (medium 5.3)
- [CVE-2026-105167](https://insights.sbomify.com/CVE-2026-105167/): kishor-23 food-waste-management-system donate.php sql injection (medium 6.9)
- [CVE-2026-105166](https://insights.sbomify.com/CVE-2026-105166/): kishor-23 food-waste-management-system Food Donation Form fooddonateform.php insert sql injection (medium 6.9)
- [CVE-2026-105165](https://insights.sbomify.com/CVE-2026-105165/): devopspolis secrets-replicator AssumeRole handler.py process_single_secret permission assignment (medium 5.3)
- [CVE-2026-105164](https://insights.sbomify.com/CVE-2026-105164/): NASA cFS cfe_fs_api.c CFE_FS_ParseInputFileNameEx out-of-bounds (medium 5.1)
- [CVE-2026-105163](https://insights.sbomify.com/CVE-2026-105163/): crossplane crossplane-runtime ImageConfig client.go Get toctou (medium 6.9)
- [CVE-2026-105161](https://insights.sbomify.com/CVE-2026-105161/): invariant-systems-ai aiir Policy Gate signature verification (medium 6.9)
- [CVE-2026-105158](https://insights.sbomify.com/CVE-2026-105158/): RainyGao DocSys Database Management BaseController.java BaseController.createDBForMysql sql injection (medium 6.9)
- [CVE-2026-105157](https://insights.sbomify.com/CVE-2026-105157/): RainyGao DocSys Document Controller doGetTmpFile.do DocController.doGetTmp path traversal (medium 5.3)
- [CVE-2026-105156](https://insights.sbomify.com/CVE-2026-105156/): YzmCMS MD5 system.func.php password weak password hash (medium 6.3)
- [CVE-2026-105149](https://insights.sbomify.com/CVE-2026-105149/): mooSocial all-products sql injection (medium 6.9)
- [CVE-2026-105148](https://insights.sbomify.com/CVE-2026-105148/): SciPhi-AI R2R Retrieval Completion API Endpoint llm.py server-side request forgery (medium 6.9)
- [CVE-2026-105147](https://insights.sbomify.com/CVE-2026-105147/): SciPhi-AI R2R JWT Secret hard-coded credentials (medium 6.9)
- [CVE-2026-105146](https://insights.sbomify.com/CVE-2026-105146/): Comsenz Discuz! Admin Medal Moderation mod.php modmedalsubmit sql injection (medium 5.1)
- [CVE-2026-105145](https://insights.sbomify.com/CVE-2026-105145/): Weaviate Verba generate_stream Endpoint util.py get_environment information disclosure (medium 6.9)
- [CVE-2026-105144](https://insights.sbomify.com/CVE-2026-105144/): Drogon Static File Router StaticFileRouter.cc route path traversal (medium 6.9)
- [CVE-2026-105141](https://insights.sbomify.com/CVE-2026-105141/): topoteretes cognee JWT Signing Key get_api_auth_backend.py get_user_id_by_email hard-coded credentials (medium 5.3)
- [CVE-2026-105140](https://insights.sbomify.com/CVE-2026-105140/): Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 Race Condition Restores Revoked Group Membership (low 2.3)
- [CVE-2026-10514](https://insights.sbomify.com/CVE-2026-10514/): 1Panel-dev CordysCRM RequestParamTrimConfig.java cross site scripting (medium 4.8)
- [CVE-2026-105139](https://insights.sbomify.com/CVE-2026-105139/): Obot 0.26.0 before 0.26.2 Authorization Bypass via vMCP Profile Prompts and Resources (medium 5.3)
- [CVE-2026-105138](https://insights.sbomify.com/CVE-2026-105138/): Obot 0.12.0 before 0.26.2 Credential Exposure via MCP Catalog Entry API (high 7.1)
- [CVE-2026-105137](https://insights.sbomify.com/CVE-2026-105137/): Laradock Build Process Dockerfile code download (low 2.3)
- [CVE-2026-105135](https://insights.sbomify.com/CVE-2026-105135/): InternLM MindSearch Planner Agent graph.py ExecutionAction.run code injection (critical 10.0)
- [CVE-2026-105134](https://insights.sbomify.com/CVE-2026-105134/): Ahsay AhsayCBS Command Injection (critical 10.0, exploited in the wild)
- [CVE-2026-105133](https://insights.sbomify.com/CVE-2026-105133/): Ahsay AhsayCBS Improper Authentication (medium 6.9, exploited in the wild)
- [CVE-2026-105131](https://insights.sbomify.com/CVE-2026-105131/): mayswind ezBookkeeping 1.2.0 before 2.0.1 Privilege Escalation via Token Refresh Endpoint (medium 5.3)
- [CVE-2026-105130](https://insights.sbomify.com/CVE-2026-105130/): LaraDashboard 1.4.0 before 1.4.8 Race Condition Bypasses Per-IP Registration Limit (medium 6.3)
- [CVE-2026-10513](https://insights.sbomify.com/CVE-2026-10513/): Webmention <= 5.8.0 - Unauthenticated Stored Cross-Site Scripting via MF2 'photo'/'url' Author Properties (high 7.2)
- [CVE-2026-105129](https://insights.sbomify.com/CVE-2026-105129/): LaraDashboard before 1.4.8 Incorrect Authorization Exposes Secrets via Settings API (high 7.1)
- [CVE-2026-105128](https://insights.sbomify.com/CVE-2026-105128/): LaraDashboard before 1.4.8 Open Redirect via Email Template Builder redirect_url (medium 5.3)
- [CVE-2026-105127](https://insights.sbomify.com/CVE-2026-105127/): LaraDashboard 1.4.2 before 1.4.8 Resource Exhaustion via Password Recovery Endpoints (medium 6.9)
- [CVE-2026-105126](https://insights.sbomify.com/CVE-2026-105126/): LaraDashboard before 1.4.8 Privilege Escalation via Superadmin Role Tampering (high 8.6)
- [CVE-2026-105125](https://insights.sbomify.com/CVE-2026-105125/): LaraDashboard before 1.4.8 Path Traversal via /api/translations/{lang} Endpoint (medium 6.3)
- [CVE-2026-105124](https://insights.sbomify.com/CVE-2026-105124/): W (wcms) through 3.18.0 Unauthenticated Stored XSS via Login Username and Comments (medium 5.3)
- [CVE-2026-105123](https://insights.sbomify.com/CVE-2026-105123/): W (wcms) through 3.18.0 RCE and Arbitrary File Write via Media Upload API (high 8.7)
- [CVE-2026-105122](https://insights.sbomify.com/CVE-2026-105122/): OpenAM before 16.1.3 SSRF via OpenID Connect Client jwks_uri (medium 5.3)
- [CVE-2026-105121](https://insights.sbomify.com/CVE-2026-105121/): OpenAM before 16.1.3 Improper Authorization in Delegated Session-Destroy Realm Scoping (medium 6.9)
- [CVE-2026-105120](https://insights.sbomify.com/CVE-2026-105120/): OpenAM before 16.1.3 Cross-Realm Session Disclosure via Sessions REST Endpoint (medium 6.9)
- [CVE-2026-10512](https://insights.sbomify.com/CVE-2026-10512/): X25519 x86_64 assembly final reduction leaves non-canonical field element (low 2.3)
- [CVE-2026-105119](https://insights.sbomify.com/CVE-2026-105119/): OpenAM before 16.1.3 PKCE Enforcement Bypass via OAuth 2.0 Hybrid Flows (high 7.6)
- [CVE-2026-105118](https://insights.sbomify.com/CVE-2026-105118/): OpenAM before 16.1.3 Open Redirect via Unverified id_token_hint in endSession (low 2.3)
- [CVE-2026-105117](https://insights.sbomify.com/CVE-2026-105117/): OpenAM before 16.1.3 Email Content Injection via Users REST Self-Service Actions (medium 5.3)
- [CVE-2026-105116](https://insights.sbomify.com/CVE-2026-105116/): OpenAM before 16.1.3 Latent XSS in SAML Load-Balancer Cookie Bounce Page (medium 5.1)
- [CVE-2026-105115](https://insights.sbomify.com/CVE-2026-105115/): OpenAM before 16.1.3 Unauthenticated Arbitrary Class Instantiation via JAX-RPC Interface (high 8.8)
- [CVE-2026-105114](https://insights.sbomify.com/CVE-2026-105114/): OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page (medium 5.3)
- [CVE-2026-105113](https://insights.sbomify.com/CVE-2026-105113/): Nezha 1.8.0 before 2.3.13 Denial of Service via Notification Mutex Deadlock (high 7.1)
- [CVE-2026-105112](https://insights.sbomify.com/CVE-2026-105112/): Nezha 1.8.0 before 2.3.13 Deadlock DoS via notification-group endpoints (medium 6.0)
- [CVE-2026-105111](https://insights.sbomify.com/CVE-2026-105111/): Apache Commons BCEL: Class2HTML emits unescaped class strings, enabling stored XSS (low 2.3)
- [CVE-2026-105110](https://insights.sbomify.com/CVE-2026-105110/): Iskratel Innbox Unauthenticated Remote Code Execution via login.xgi CLI Parameter (critical 9.3)
- [CVE-2026-10511](https://insights.sbomify.com/CVE-2026-10511/): Cross-site scripting in Jupiter X Core (medium 6.4)
- [CVE-2026-105107](https://insights.sbomify.com/CVE-2026-105107/): Koha SQL injection in reports/cat_issues_top.pl via the Criteria, Filter and Limit request parameters (high 7.2)
- [CVE-2026-105106](https://insights.sbomify.com/CVE-2026-105106/): Koha authenticated OS command injection in tools/scheduler.pl via the jobid parameter when deleting a scheduled task (high 8.8)
- [CVE-2026-105105](https://insights.sbomify.com/CVE-2026-105105/): Missing authorization in AIT-Core (critical 9.8)
- [CVE-2026-10510](https://insights.sbomify.com/CVE-2026-10510/): GeniexWebView XSS in com.transsion.aiassistantlifestyle (medium 6.1)
- [CVE-2026-1051](https://insights.sbomify.com/CVE-2026-1051/): Newsletter – Send awesome emails from WordPress <= 9.1.0 - Cross-Site Request Forgery to Newsletter Unsubscription (medium 4.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/971/