# Vulnerabilities published in 2026


- [CVE-2026-104935](https://insights.sbomify.com/CVE-2026-104935/): Ivanti Connect Secure Authentication Bypass by Spoofing (high 8.6, exploited in the wild)
- [CVE-2026-104932](https://insights.sbomify.com/CVE-2026-104932/): Search Regex 3.5 - Authenticated (Subscriber+) Remote Code Execution via User Meta Serialized String Corruption (high 8.0)
- [CVE-2026-104915](https://insights.sbomify.com/CVE-2026-104915/): Missing authorization in Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning (medium 6.5)
- [CVE-2026-104914](https://insights.sbomify.com/CVE-2026-104914/): MISP: Soft-Deleted Attributes from Other Organizations Exposed via Attribute Search and Paginated View (medium 5.3)
- [CVE-2026-104912](https://insights.sbomify.com/CVE-2026-104912/): MISP Correlation Authorization Bypass Exposes Restricted Event and Attribute Data (high 7.1)
- [CVE-2026-104910](https://insights.sbomify.com/CVE-2026-104910/): MISP Information Disclosure via Related Events Listing Bypassing Per-Event Authorization (medium 5.3)
- [CVE-2026-104909](https://insights.sbomify.com/CVE-2026-104909/): Mang Board <= 2.4.3 - Unauthenticated Local File Inclusion via '<mode>_type' Parameter (high 8.1)
- [CVE-2026-104908](https://insights.sbomify.com/CVE-2026-104908/): MISP Decaying Model Import Mass Assignment Allows Cross-Organization Model Overwrite and Default Flagging (high 7.1)
- [CVE-2026-104907](https://insights.sbomify.com/CVE-2026-104907/): MISP: JavaScript Injection via Remote Tag ID in Event Preview Inline Handler (medium 4.8)
- [CVE-2026-104906](https://insights.sbomify.com/CVE-2026-104906/): MISP TAXII Object Viewer Stored XSS via Unescaped JSON Output (medium 6.2)
- [CVE-2026-104905](https://insights.sbomify.com/CVE-2026-104905/): FacturaScripts < 2026.7 PHP Object Injection via WidgetSelect (medium 6.1)
- [CVE-2026-104901](https://insights.sbomify.com/CVE-2026-104901/): MISP ID Translator: Unescaped Remote Event ID Enables Cross-Site Scripting via Linked Server (medium 5.1)
- [CVE-2026-104900](https://insights.sbomify.com/CVE-2026-104900/): MISP Stored XSS via Unescaped Count Field Value in Remote Event Preview Index (medium 5.3)
- [CVE-2026-1049](https://insights.sbomify.com/CVE-2026-1049/): LigeroSmart index.pl cross site scripting (medium 5.1)
- [CVE-2026-104899](https://insights.sbomify.com/CVE-2026-104899/): GeoDirectory <= 2.8.187 - Unauthenticated Local File Inclusion via 'design_type' Parameter (high 8.1)
- [CVE-2026-104898](https://insights.sbomify.com/CVE-2026-104898/): Privilege escalation in Online Scheduling and Appointment Booking System – Bookly (medium 6.8)
- [CVE-2026-104895](https://insights.sbomify.com/CVE-2026-104895/): Denial of service in jackson-dataformat-smile (high 7.5)
- [CVE-2026-104894](https://insights.sbomify.com/CVE-2026-104894/): Plane: Cross-Tenant Module Issue Linking via IDOR (medium 4.3)
- [CVE-2026-104893](https://insights.sbomify.com/CVE-2026-104893/): Plane: Improper validation allows arbitrary modification of API token rate limits (medium 5.4)
- [CVE-2026-104892](https://insights.sbomify.com/CVE-2026-104892/): Plane: Plaintext logging of API token (high 8.7)
- [CVE-2026-104891](https://insights.sbomify.com/CVE-2026-104891/): mppx-condition-gate: Free-access path grants on a self-declared wallet without proving control (high 7.5)
- [CVE-2026-104890](https://insights.sbomify.com/CVE-2026-104890/): Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code execution (high 7.2)
- [CVE-2026-104875](https://insights.sbomify.com/CVE-2026-104875/): Ente: Accepted emergency contact can bypass the recovery notice period (high 7.1)
- [CVE-2026-104874](https://insights.sbomify.com/CVE-2026-104874/): Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction (medium 5.3)
- [CVE-2026-104873](https://insights.sbomify.com/CVE-2026-104873/): LangGraph SDK custom auth silently ignores actions= on resource decorators (high 7.6)
- [CVE-2026-104872](https://insights.sbomify.com/CVE-2026-104872/): Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute (medium 5.8)
- [CVE-2026-104871](https://insights.sbomify.com/CVE-2026-104871/): Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows (medium 6.3)
- [CVE-2026-104861](https://insights.sbomify.com/CVE-2026-104861/): probe-image-size: Quadratic-time Denial of Service in the SVG Parser (high 7.5)
- [CVE-2026-104859](https://insights.sbomify.com/CVE-2026-104859/): Nx: OS command injection in the @nx/docker release pipeline (high 7.3)
- [CVE-2026-104855](https://insights.sbomify.com/CVE-2026-104855/): Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state (low 2.0)
- [CVE-2026-104854](https://insights.sbomify.com/CVE-2026-104854/): Nx daemon and plugin worker sockets are accessible to other local users (high 8.5)
- [CVE-2026-104853](https://insights.sbomify.com/CVE-2026-104853/): Nx: Path traversal in nx migrate package-migrations extraction (medium 5.8)
- [CVE-2026-104852](https://insights.sbomify.com/CVE-2026-104852/): GraphQL Tools has prototype pollution in well-established utility function `mergeDeep` (high 8.2)
- [CVE-2026-104851](https://insights.sbomify.com/CVE-2026-104851/): fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution (high 8.8)
- [CVE-2026-104850](https://insights.sbomify.com/CVE-2026-104850/): MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server (high 7.5)
- [CVE-2026-104849](https://insights.sbomify.com/CVE-2026-104849/): Tinypool: Prototype Pollution Gadget to RCE in run() options (critical 9.5)
- [CVE-2026-104848](https://insights.sbomify.com/CVE-2026-104848/): Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution (critical 9.5)
- [CVE-2026-104847](https://insights.sbomify.com/CVE-2026-104847/): ProseMirror: XSS vulnerability in prosemirror-view's paste handling (high 8.5)
- [CVE-2026-104846](https://insights.sbomify.com/CVE-2026-104846/): Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of CVE-2026-59940) (critical 9.8)
- [CVE-2026-104845](https://insights.sbomify.com/CVE-2026-104845/): Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization (high 7.5)
- [CVE-2026-104844](https://insights.sbomify.com/CVE-2026-104844/): PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion (medium 5.9)
- [CVE-2026-104843](https://insights.sbomify.com/CVE-2026-104843/): uv: Path traversal on Windows through wheel extraction (medium 5.9)
- [CVE-2026-104828](https://insights.sbomify.com/CVE-2026-104828/): HtmlUnit Neko: Mutation XSS (mXSS) in HTMLWriterFilter - TEXTAREA/TITLE entity decode without re-encode (high 7.2)
- [CVE-2026-104827](https://insights.sbomify.com/CVE-2026-104827/): react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS (high 7.5)
- [CVE-2026-104817](https://insights.sbomify.com/CVE-2026-104817/): Misskey: Lack of rate limiting and size restrictions in RSS fetching API (high 8.7)
- [CVE-2026-104816](https://insights.sbomify.com/CVE-2026-104816/): Misskey: Cross-site scripting in RSS feed item links (high 8.5)
- [CVE-2026-104814](https://insights.sbomify.com/CVE-2026-104814/): WordPress Form Block plugin <= 1.8.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-104811](https://insights.sbomify.com/CVE-2026-104811/): Mitel MiVoice Office 400 Music on Hold WAV File Upload Code Execution (high 8.4)
- [CVE-2026-104810](https://insights.sbomify.com/CVE-2026-104810/): Mitel MiVoice Office 400 File Management File Browser path traversal vulnerability (high 8.4)
- [CVE-2026-104809](https://insights.sbomify.com/CVE-2026-104809/): Mitel MiVoice Office 400 Shared Object Hijacking Leading to Arbitrary Code Execution (high 8.4)
- [CVE-2026-104808](https://insights.sbomify.com/CVE-2026-104808/): Mitel MiVoice Office 400 stored Cross-Site Scripting (low 1.9)
- [CVE-2026-104807](https://insights.sbomify.com/CVE-2026-104807/): Mitel MiVoice Office 400 stored Cross-Site Scripting (low 1.9)
- [CVE-2026-104806](https://insights.sbomify.com/CVE-2026-104806/): Mitel MiVoice Office 400 System Logs Path Traversal Information Disclosure (medium 5.5)
- [CVE-2026-104805](https://insights.sbomify.com/CVE-2026-104805/): Mitel MiVoice Office 400 Backup Restoration Arbitrary File Write Leading to Root Code Execution (high 8.5)
- [CVE-2026-104803](https://insights.sbomify.com/CVE-2026-104803/): Auth bypass in WPCOM Member (critical 9.8)
- [CVE-2026-104801](https://insights.sbomify.com/CVE-2026-104801/): PPOM <= 34.0.10 - Unauthenticated Arbitrary File Deletion via 'ppom[fields][<data_name>][n][org]' Parameter (critical 9.1)
- [CVE-2026-104800](https://insights.sbomify.com/CVE-2026-104800/): Code injection in AGE-GATE (critical 9.8)
- [CVE-2026-1048](https://insights.sbomify.com/CVE-2026-1048/): LigeroSmart index.pl cross site scripting (medium 5.1)
- [CVE-2026-104798](https://insights.sbomify.com/CVE-2026-104798/): Code injection in My Calendar – Accessible Event Manager (critical 9.8)
- [CVE-2026-104797](https://insights.sbomify.com/CVE-2026-104797/): Auth bypass in Advanced Form Integration — Connect Forms to 300+ Apps (high 8.1)
- [CVE-2026-104795](https://insights.sbomify.com/CVE-2026-104795/): Insights-runtime-extractor: insights-runtime-extractor: container escape via privileged binary execution (high 8.8)
- [CVE-2026-104774](https://insights.sbomify.com/CVE-2026-104774/): OWASP Coraza WAF: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass (medium 5.8)
- [CVE-2026-104769](https://insights.sbomify.com/CVE-2026-104769/): Path traversal in Debloat – Remove Unused CSS, Optimize JS (medium 5.9)
- [CVE-2026-104767](https://insights.sbomify.com/CVE-2026-104767/): Privilege escalation in Membership & User Roles for WooCommerce (Automatic Role Changer) (high 7.5)
- [CVE-2026-104766](https://insights.sbomify.com/CVE-2026-104766/): Privilege escalation in Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress (high 8.8)
- [CVE-2026-104764](https://insights.sbomify.com/CVE-2026-104764/): Deserialization in Post Export Import with Media (high 7.2)
- [CVE-2026-104763](https://insights.sbomify.com/CVE-2026-104763/): Path traversal in Post Export Import with Media (medium 4.9)
- [CVE-2026-104762](https://insights.sbomify.com/CVE-2026-104762/): Kadence Blocks <= 3.7.12 - Authenticated (Author+) Stored Cross-Site Scripting via Block Font Family Attribute (medium 6.4)
- [CVE-2026-104761](https://insights.sbomify.com/CVE-2026-104761/): Mang Board <= 2.4.3 - Authenticated (Custom+) Stored Cross-Site Scripting via 'content' Parameter (medium 6.4)
- [CVE-2026-104759](https://insights.sbomify.com/CVE-2026-104759/): Auth bypass in WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) (high 8.1)
- [CVE-2026-104757](https://insights.sbomify.com/CVE-2026-104757/): WordPress Import and export users and customers plugin <= 2.5.5 - Privilege Escalation vulnerability (high 7.2)
- [CVE-2026-104755](https://insights.sbomify.com/CVE-2026-104755/): WP Compress <= 7.25.00 - Unauthenticated Privilege Escalation to 'group'/'setting'/'value' Parameters on comms Endpoint (medium 4.8)
- [CVE-2026-104754](https://insights.sbomify.com/CVE-2026-104754/): Rank Math SEO < 1.0.280 - Admin+ Stored XSS via Redirection Source URL (low 3.5)
- [CVE-2026-104753](https://insights.sbomify.com/CVE-2026-104753/): Rank Math SEO < 1.0.280 - Admin+ SQLi via 'per_page' Parameter (medium 4.1)
- [CVE-2026-104752](https://insights.sbomify.com/CVE-2026-104752/): Rank Math SEO < 1.0.280 - Admin+ Arbitrary File Upload to RCE via Settings Import (high 7.2)
- [CVE-2026-104751](https://insights.sbomify.com/CVE-2026-104751/): Rank Math SEO < 1.0.280 - Unauthenticated SEO Analyzer Results Deletion (medium 5.3)
- [CVE-2026-104749](https://insights.sbomify.com/CVE-2026-104749/): Privilege escalation in Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation (high 7.5)
- [CVE-2026-104748](https://insights.sbomify.com/CVE-2026-104748/): Privilege escalation in SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications (critical 9.8)
- [CVE-2026-104747](https://insights.sbomify.com/CVE-2026-104747/): WordPress Haaken theme <= 1.5 - PHP Object Injection vulnerability (high 8.1)
- [CVE-2026-104745](https://insights.sbomify.com/CVE-2026-104745/): Weak cryptography in Customer Email Verification for WooCommerce (high 8.1)
- [CVE-2026-104743](https://insights.sbomify.com/CVE-2026-104743/): Path traversal in Tainacan (medium 4.9)
- [CVE-2026-104742](https://insights.sbomify.com/CVE-2026-104742/): Missing authorization in AI Puffer – AI Chatbot, AI Writer & Automation (low 3.1)
- [CVE-2026-104741](https://insights.sbomify.com/CVE-2026-104741/): Missing authorization in AI Puffer – AI Chatbot, AI Writer & Automation (low 3.1)
- [CVE-2026-104740](https://insights.sbomify.com/CVE-2026-104740/): Cross-site scripting in If-So Dynamic Content – Elementor & All Page Builders Personalization (medium 6.4)
- [CVE-2026-104736](https://insights.sbomify.com/CVE-2026-104736/): LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter (critical 9.8)
- [CVE-2026-104735](https://insights.sbomify.com/CVE-2026-104735/): Cross-site scripting in RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator (medium 6.4)
- [CVE-2026-104734](https://insights.sbomify.com/CVE-2026-104734/): Deserialization in Kirki – Freeform Page Builder, Website Builder & Customizer (high 7.2)
- [CVE-2026-104733](https://insights.sbomify.com/CVE-2026-104733/): User Impersonation/Authorization Bypass in XMPP Server ejabberd (high 7.4)
- [CVE-2026-104732](https://insights.sbomify.com/CVE-2026-104732/): Advanced IP Blocker <= 8.13.13 - Unauthenticated Authentication Bypass via Missing Step-1 Binding to 2FA Login Handler (critical 9.8)
- [CVE-2026-104730](https://insights.sbomify.com/CVE-2026-104730/): Sunshine Photo Cart <= 3.7.4 - Unauthenticated PHP Object Injection via 'key' Parameter (critical 9.8)
- [CVE-2026-104729](https://insights.sbomify.com/CVE-2026-104729/): Cross-site scripting in Avada (Fusion) Builder (medium 6.4)
- [CVE-2026-104728](https://insights.sbomify.com/CVE-2026-104728/): Missing authorization in AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI (medium 4.3)
- [CVE-2026-104727](https://insights.sbomify.com/CVE-2026-104727/): Cross-site scripting in Sequential Order Numbers for WooCommerce (medium 6.4)
- [CVE-2026-104726](https://insights.sbomify.com/CVE-2026-104726/): Name Directory <= 1.34.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dir' Shortcode Attribute (medium 6.4)
- [CVE-2026-104725](https://insights.sbomify.com/CVE-2026-104725/): Groundhogg <= 4.9 - Authenticated (Custom+) Privilege Escalation to 'user' Parameter (high 8.8)
- [CVE-2026-104724](https://insights.sbomify.com/CVE-2026-104724/): FireBox <= 3.1.13 - Authenticated (Author+) SQL Injection via FireBox Form Display Condition (medium 5.3)
- [CVE-2026-104723](https://insights.sbomify.com/CVE-2026-104723/): LifterLMS <= 10.2.1 - Authenticated (Custom+) PHP Object Injection via 'custom' Lesson Data (high 8.8)
- [CVE-2026-104722](https://insights.sbomify.com/CVE-2026-104722/): Path traversal in Listdom: AI-powered Business Directory with Classifieds Ads Listings (medium 4.9)
- [CVE-2026-104721](https://insights.sbomify.com/CVE-2026-104721/): Logback: Incomplete protection against CVE-2026-19880 (medium 6.3)
- [CVE-2026-104715](https://insights.sbomify.com/CVE-2026-104715/): Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary bypass (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/973/