# Vulnerabilities published in 2026


- [CVE-2026-104714](https://insights.sbomify.com/CVE-2026-104714/): Apache Struts: Shared message formatter exposes date and time values across concurrent requests (high 8.8)
- [CVE-2026-104713](https://insights.sbomify.com/CVE-2026-104713/): Apache Struts: Unbounded request body read in the REST plugin (medium 6.5)
- [CVE-2026-104712](https://insights.sbomify.com/CVE-2026-104712/): Apache Struts: Disproportionate response size when rendering BigDecimal request parameters (high 7.5)
- [CVE-2026-104711](https://insights.sbomify.com/CVE-2026-104711/): Apache Struts: OGNL injection in the legacy RESTful action mapper (critical 9.8)
- [CVE-2026-104706](https://insights.sbomify.com/CVE-2026-104706/): Mitel MiVoice Office 400 view system files path traversal (high 8.4)
- [CVE-2026-104704](https://insights.sbomify.com/CVE-2026-104704/): Cleartext Transmission of Sensitive Information in hMailServer (high 7.4)
- [CVE-2026-1047](https://insights.sbomify.com/CVE-2026-1047/): salavat counter Plugin <= 0.9.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'image_url' Parameter (medium 4.4)
- [CVE-2026-104694](https://insights.sbomify.com/CVE-2026-104694/): Thrive Automator < 11.2 - Editor+ Blind SQLi via 'additional' Parameter (medium 6.8)
- [CVE-2026-104684](https://insights.sbomify.com/CVE-2026-104684/): Envira Gallery < 1.16.2 - Author+ IDOR via Shortcode (low 2.7)
- [CVE-2026-104682](https://insights.sbomify.com/CVE-2026-104682/): Envira Gallery < 1.16.2 - Contributor Missing Authorization via Convert Gallery REST Route (low 2.7)
- [CVE-2026-104681](https://insights.sbomify.com/CVE-2026-104681/): Envira Gallery < 1.16.2 - Author+ Non-Public Post Title and Excerpt Disclosure via Gallery REST Field (low 2.7)
- [CVE-2026-104680](https://insights.sbomify.com/CVE-2026-104680/): Envira Gallery < 1.16.2 - Multisite Subsite Admin+ Arbitrary Plugin Installation via Onboarding Wizard (high 7.2)
- [CVE-2026-104679](https://insights.sbomify.com/CVE-2026-104679/): XML external entity in VOCALOID6 Editor (medium 6.9)
- [CVE-2026-104678](https://insights.sbomify.com/CVE-2026-104678/): CP Media Player < 1.3.4 - Contributor+ Media Player Settings Update (low 2.7)
- [CVE-2026-104677](https://insights.sbomify.com/CVE-2026-104677/): WP Coder 4.0 - 4.5.1 - Editor+ RCE via Global PHP (high 7.2)
- [CVE-2026-104675](https://insights.sbomify.com/CVE-2026-104675/): WordPress Event Tickets plugin <= 5.30.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-104673](https://insights.sbomify.com/CVE-2026-104673/): Cross-site scripting in MP3 Audio Player for Music, Radio & Podcast by Sonaar (medium 6.5)
- [CVE-2026-104672](https://insights.sbomify.com/CVE-2026-104672/): WordPress GiveWP plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-104671](https://insights.sbomify.com/CVE-2026-104671/): TutorStarter < 4.0.4 - Unauthenticated User Registration Bypass via AJAX (medium 5.3)
- [CVE-2026-104670](https://insights.sbomify.com/CVE-2026-104670/): WordPress LearnPress plugin <= 4.4.9 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-104667](https://insights.sbomify.com/CVE-2026-104667/): Animated Number Counters < 3.1 - Editor+ Second-Order SQLi via Counter Order (medium 6.8)
- [CVE-2026-104661](https://insights.sbomify.com/CVE-2026-104661/): Incorrect Privilege Assignment in GitLab (medium 4.3)
- [CVE-2026-104660](https://insights.sbomify.com/CVE-2026-104660/): Missing Authorization in hMailServer (high 7.8)
- [CVE-2026-104659](https://insights.sbomify.com/CVE-2026-104659/): Origin Validation Error in hMailServer (high 7.5)
- [CVE-2026-104658](https://insights.sbomify.com/CVE-2026-104658/): Reliance on Untrusted Inputs in a Security Decision in hMailServer (high 7.8)
- [CVE-2026-104653](https://insights.sbomify.com/CVE-2026-104653/): Envira Gallery < 1.16.1 - Author+ Stored XSS via Gallery Crop Dimensions (medium 6.8)
- [CVE-2026-104652](https://insights.sbomify.com/CVE-2026-104652/): Envira Gallery < 1.16.1 - Author+ Stored XSS via Gallery Image ID (medium 6.8)
- [CVE-2026-104651](https://insights.sbomify.com/CVE-2026-104651/): Yaad Sarig Payment Gateway For WC < 2.2.13 - Subscriber+ Arbitrary Order Payment Manipulation via IDOR (medium 4.3)
- [CVE-2026-104646](https://insights.sbomify.com/CVE-2026-104646/): Image Photo Gallery Final Tiles Grid < 3.6.14 - Contributor+ Stored XSS via Gallery Shortcode Attributes (medium 6.8)
- [CVE-2026-104645](https://insights.sbomify.com/CVE-2026-104645/): Missing authorization in Image Photo Gallery Final Tiles Grid (low 2.7)
- [CVE-2026-104644](https://insights.sbomify.com/CVE-2026-104644/): Image Photo Gallery Final Tiles Grid < 3.6.15 - Contributor+ Stored XSS via Gallery Configuration Update (medium 6.8)
- [CVE-2026-104643](https://insights.sbomify.com/CVE-2026-104643/): Easy HTTPS Redirection (SSL) < 2.0.2 - Subscriber+ Scan Result Disclosure and Site-Wide URL Rewrite (medium 4.2)
- [CVE-2026-104642](https://insights.sbomify.com/CVE-2026-104642/): Simple Shopping Cart 5.1.3 - 5.3.2 - Contributor+ Price Manipulation via Price Verification Bypass (low 2.7)
- [CVE-2026-104641](https://insights.sbomify.com/CVE-2026-104641/): Simple Shopping Cart < 5.3.3 - Unauthenticated Payment Bypass via Unverified PayPal IPN Recipient (medium 5.3)
- [CVE-2026-104638](https://insights.sbomify.com/CVE-2026-104638/): onetwothreeneth HospitalManagementSystem sessions.php improper authentication (medium 6.9)
- [CVE-2026-104637](https://insights.sbomify.com/CVE-2026-104637/): onetwothreeneth HospitalManagementSystem controller.php edit_patient unrestricted upload (medium 6.9)
- [CVE-2026-104636](https://insights.sbomify.com/CVE-2026-104636/): Gitea SSRF through Git HTTP redirects in mirrors and fetches (high 7.5)
- [CVE-2026-104635](https://insights.sbomify.com/CVE-2026-104635/): Uncontrolled recursion in elixir-protobuf/protobuf JSON decoding of self-referential messages (high 8.2)
- [CVE-2026-104634](https://insights.sbomify.com/CVE-2026-104634/): beam_mcp: JSON boolean and null tool arguments reach dispatch as strings (low 2.3)
- [CVE-2026-104633](https://insights.sbomify.com/CVE-2026-104633/): Gitea migration memory exhaustion from zero page size (medium 6.5)
- [CVE-2026-104632](https://insights.sbomify.com/CVE-2026-104632/): Gitea fork workflow approval bypass through cancel and rerun (high 8.8)
- [CVE-2026-104629](https://insights.sbomify.com/CVE-2026-104629/): Grid Protection Alliance openPDC and openHistorian Use of Externally-Controlled Input to Select Classes or Code (high 7.7)
- [CVE-2026-104628](https://insights.sbomify.com/CVE-2026-104628/): Satel Netco Design Inefficient Regular Expression Complexity (high 7.1)
- [CVE-2026-104627](https://insights.sbomify.com/CVE-2026-104627/): Gitea OpenID account linking without session binding (medium 5.4)
- [CVE-2026-104626](https://insights.sbomify.com/CVE-2026-104626/): Gitea fork workflow job revival through later approval (high 8.8)
- [CVE-2026-104625](https://insights.sbomify.com/CVE-2026-104625/): CodeAstro Simple Loan Management System index.php sql injection (medium 5.3)
- [CVE-2026-104618](https://insights.sbomify.com/CVE-2026-104618/): sdbootutil: world-readable debug log (medium 6.9)
- [CVE-2026-104617](https://insights.sbomify.com/CVE-2026-104617/): sdbootutil: qrencode invocation leaks PIN/recovery key in /proc/<pid>/cmdline (medium 5.9)
- [CVE-2026-104614](https://insights.sbomify.com/CVE-2026-104614/): CodeAstro Simple Pharmacy Management System delete.php sql injection (medium 5.3)
- [CVE-2026-104613](https://insights.sbomify.com/CVE-2026-104613/): CodeAstro Simple Pharmacy Management System view.php sql injection (medium 5.3)
- [CVE-2026-104612](https://insights.sbomify.com/CVE-2026-104612/): SourceCodester Student Result Management System Announcement new_announcement.php cross site scripting (medium 5.3)
- [CVE-2026-104611](https://insights.sbomify.com/CVE-2026-104611/): Tenda AC9 POST Request fast_setting_internet_set stack-based overflow (critical 9.4)
- [CVE-2026-104610](https://insights.sbomify.com/CVE-2026-104610/): Tenda HG7/HG9/HG10 Boa Web Server formLoopBack boaGetVar stack-based overflow (critical 10.0)
- [CVE-2026-104609](https://insights.sbomify.com/CVE-2026-104609/): onetwothreeneth HospitalManagementSystem edit_accounts.php get sql injection (medium 6.9)
- [CVE-2026-104606](https://insights.sbomify.com/CVE-2026-104606/): itsourcecode Online Admission System Project confirm.php sql injection (medium 5.3)
- [CVE-2026-1046](https://insights.sbomify.com/CVE-2026-1046/): Arbitrary application execution via unvalidated server-controlled URLs in Help menu (high 7.6)
- [CVE-2026-104598](https://insights.sbomify.com/CVE-2026-104598/): libosmo-sigtran through 2.2.1 contains an out-of-bounds read in the M3UA NOTIFY decoder in src/m3ua.c. (not scored)
- [CVE-2026-104597](https://insights.sbomify.com/CVE-2026-104597/): libosmocore through 1.14.1 contains an out-of-bounds read in iuup_rx_initialization() in src/gsm/iuup.c. (not scored)
- [CVE-2026-104596](https://insights.sbomify.com/CVE-2026-104596/): libosmocore through 1.14.1 contains out-of-bounds reads in the GSM 04.80 supplementary-service component parsers in src/gsm/gsm0480.c. (high 7.5)
- [CVE-2026-104594](https://insights.sbomify.com/CVE-2026-104594/): libosmocore through 1.14.1 contains out-of-bounds reads in the IPA CCM identity-tag parsers in src/gsm/ipa.c. (not scored)
- [CVE-2026-104593](https://insights.sbomify.com/CVE-2026-104593/): osmo-msc through 1.15.0 contains a stack-based buffer overflow in decode_mme_name() in src/libmsc/sgs_iface.c. (not scored)
- [CVE-2026-104592](https://insights.sbomify.com/CVE-2026-104592/): libosmocore through 1.14.1 contains an out-of-bounds read in the CBSP WRITE-REPLACE decoder in src/gsm/cbsp.c. (not scored)
- [CVE-2026-104591](https://insights.sbomify.com/CVE-2026-104591/): libosmocore through 1.14.1 contains a buffer overflow in osmo_iuup_compute_payload_crc() in src/gsm/iuup.c. (high 7.5)
- [CVE-2026-104587](https://insights.sbomify.com/CVE-2026-104587/): blob42 gosuki through commit 6e2bf34 contains a Stored Cross-Site Scripting (XSS) vulnerability. (medium 5.4)
- [CVE-2026-104586](https://insights.sbomify.com/CVE-2026-104586/): AUTOM8N (WHM/cPanel plugin) through commit 82821f7 contains an OS Command Injection in borg_restore.cgi. (critical 9.8)
- [CVE-2026-104585](https://insights.sbomify.com/CVE-2026-104585/): Mobile Security Framework (MobSF) v4.5.2 is vulnerable to Command Injection in /download_data/, /api/v1/scan, Dynamic Analyzer ADB integration module. (critical 9.8)
- [CVE-2026-104584](https://insights.sbomify.com/CVE-2026-104584/): reNgine up to v2.2.0 and current master branch (commit de4199222cca5618f1255930ce78987e47d43a99) is vulnerable to OS Command Injection via t (critical 9.8)
- [CVE-2026-1045](https://insights.sbomify.com/CVE-2026-1045/): Cross-site scripting in Viet contact (medium 4.4)
- [CVE-2026-104480](https://insights.sbomify.com/CVE-2026-104480/): Improper MLS Welcome roster validation in Discord libdave allows unauthorized group membership (critical 9.4)
- [CVE-2026-104479](https://insights.sbomify.com/CVE-2026-104479/): Shopclass before 6.2.0 Stored XSS via Listing Description Field (medium 5.1)
- [CVE-2026-104478](https://insights.sbomify.com/CVE-2026-104478/): Formwork before 2.3.13 Path Traversal via BackupController Download and Delete (high 7.1)
- [CVE-2026-104477](https://insights.sbomify.com/CVE-2026-104477/): Showdown through 2.1.0 XSS via unescaped quote in href and src attributes (medium 5.3)
- [CVE-2026-104476](https://insights.sbomify.com/CVE-2026-104476/): Backdrop CMS before 1.35.1 Information Disclosure via Configuration Export Archive (high 8.2)
- [CVE-2026-104475](https://insights.sbomify.com/CVE-2026-104475/): IDURAR ERP CRM through 4.1.1 Stored XSS via SVG Upload (medium 5.1)
- [CVE-2026-104474](https://insights.sbomify.com/CVE-2026-104474/): OpenLiteSpeed before 1.9.3 Local Privilege Escalation via lsup.sh Auto-Update (medium 5.4)
- [CVE-2026-104473](https://insights.sbomify.com/CVE-2026-104473/): YesWiki before 4.5.3 Multiple Reflected XSS via BazaR and listpages (medium 5.1)
- [CVE-2026-104472](https://insights.sbomify.com/CVE-2026-104472/): YesWiki before 4.6.7 Missing Authorization via Attachment Download Handler (high 8.7)
- [CVE-2026-104471](https://insights.sbomify.com/CVE-2026-104471/): YesWiki before 4.6.7 Unrestricted File Upload via Bazar CSV Import (high 8.6)
- [CVE-2026-104470](https://insights.sbomify.com/CVE-2026-104470/): YesWiki before 4.6.7 SSRF via Bazar valeur Action url Parameter (medium 5.3)
- [CVE-2026-104469](https://insights.sbomify.com/CVE-2026-104469/): YesWiki before 4.6.7 Session Fixation via Login in AuthController.php (high 7.6)
- [CVE-2026-104468](https://insights.sbomify.com/CVE-2026-104468/): YesWiki before 4.6.7 Non-Expiring Password Reset Tokens via LostPasswordAction (medium 6.3)
- [CVE-2026-104467](https://insights.sbomify.com/CVE-2026-104467/): YesWiki before 4.6.7 Authorization Bypass via Public API Mode (critical 9.2)
- [CVE-2026-104466](https://insights.sbomify.com/CVE-2026-104466/): YesWiki before 4.6.7 Stored XSS via Wakka Markdown Image src Attribute (medium 5.1)
- [CVE-2026-104465](https://insights.sbomify.com/CVE-2026-104465/): YesWiki before 4.6.7 Reflected XSS via field Parameter in mail Handler (medium 5.1)
- [CVE-2026-104464](https://insights.sbomify.com/CVE-2026-104464/): YesWiki before 4.6.7 SSRF via Bazar abonnements sync actor parameter (high 8.8)
- [CVE-2026-104463](https://insights.sbomify.com/CVE-2026-104463/): YesWiki before 4.6.7 Unauthenticated SSRF via ActivityPub Inbox (high 8.3)
- [CVE-2026-104462](https://insights.sbomify.com/CVE-2026-104462/): YesWiki before 4.6.7 SQL Injection via nuagetag tags parameter (high 8.8)
- [CVE-2026-104461](https://insights.sbomify.com/CVE-2026-104461/): YesWiki before 4.6.7 Stored XSS via Unsanitized SVG Upload in Bazar FileField (medium 5.1)
- [CVE-2026-104460](https://insights.sbomify.com/CVE-2026-104460/): YesWiki before 4.6.7 Unauthenticated Blind SQL Injection via newtextsearch (high 8.7)
- [CVE-2026-104459](https://insights.sbomify.com/CVE-2026-104459/): YesWiki before 4.6.7 SSRF via ActivityPub WebFinger actor_handle (medium 6.9)
- [CVE-2026-104458](https://insights.sbomify.com/CVE-2026-104458/): YesWiki before 4.6.7 SSRF Guard Bypass via IPv6 Transition Addresses (high 8.3)
- [CVE-2026-104457](https://insights.sbomify.com/CVE-2026-104457/): YesWiki before 4.6.7 SQL Injection via filtertags filterN parameter (high 8.8)
- [CVE-2026-104456](https://insights.sbomify.com/CVE-2026-104456/): YesWiki before 4.6.7 Second-Order SQL Injection via ACL Username (high 7.2)
- [CVE-2026-104455](https://insights.sbomify.com/CVE-2026-104455/): YesWiki before 4.6.7 Read-ACL Bypass via recentchangesrssplus RSS Action (medium 6.9)
- [CVE-2026-104454](https://insights.sbomify.com/CVE-2026-104454/): YesWiki before 4.6.7 ReDoS via wakka.php Edit-Preview Endpoint (medium 6.9)
- [CVE-2026-104453](https://insights.sbomify.com/CVE-2026-104453/): YesWiki before 4.6.7 CSRF Tag Deletion via admintag Action (medium 5.3)
- [CVE-2026-104452](https://insights.sbomify.com/CVE-2026-104452/): YesWiki before 4.6.7 CSRF Attachment Deletion via filemanager Handler (medium 5.3)
- [CVE-2026-104451](https://insights.sbomify.com/CVE-2026-104451/): YesWiki before 4.6.7 CSRF Page Revision Restore via RevisionsHandler (medium 5.3)
- [CVE-2026-104450](https://insights.sbomify.com/CVE-2026-104450/): YesWiki before 4.6.7 ACL Bypass and Stored XSS via pointimage Action (high 8.2)
- [CVE-2026-104449](https://insights.sbomify.com/CVE-2026-104449/): YesWiki before 4.6.7 Unauthenticated Page Overwrite via Bazar id_fiche (high 8.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/974/