# Vulnerabilities published in 2026


- [CVE-2026-104448](https://insights.sbomify.com/CVE-2026-104448/): YesWiki before 4.6.7 CSRF Page Deletion via ajaxdeletepage Handler (high 7.2)
- [CVE-2026-104447](https://insights.sbomify.com/CVE-2026-104447/): YesWiki before 4.6.7 CSRF Package Deletion via autoupdate UpdateAction (high 7.1)
- [CVE-2026-104446](https://insights.sbomify.com/CVE-2026-104446/): YesWiki before 4.6.7 Unauthenticated Open Mail Relay via Contact Mail Handler (medium 6.9)
- [CVE-2026-104445](https://insights.sbomify.com/CVE-2026-104445/): YesWiki before 4.6.7 Authentication Bypass via ActivityPub Inbox Actor Spoofing (high 8.8)
- [CVE-2026-104444](https://insights.sbomify.com/CVE-2026-104444/): YesWiki before 4.6.7 Authorization Bypass via Comments API editComment (high 7.1)
- [CVE-2026-104443](https://insights.sbomify.com/CVE-2026-104443/): YesWiki before 4.6.7 Scope Bypass via Triples Delete API (high 7.2)
- [CVE-2026-104442](https://insights.sbomify.com/CVE-2026-104442/): YesWiki before 4.6.7 Unauthenticated SSRF via syndication Action (medium 6.9)
- [CVE-2026-104441](https://insights.sbomify.com/CVE-2026-104441/): YesWiki before 4.6.7 Unauthenticated SSRF via valeur Action (medium 6.9)
- [CVE-2026-104440](https://insights.sbomify.com/CVE-2026-104440/): YesWiki before 4.6.7 Blind SSRF via bazarlist API idtypeannonce Parameter (medium 6.9)
- [CVE-2026-104439](https://insights.sbomify.com/CVE-2026-104439/): YesWiki before 4.6.7 User Enumeration via Lost-Password Flow (high 7.1)
- [CVE-2026-104438](https://insights.sbomify.com/CVE-2026-104438/): YesWiki before 4.6.7 Information Disclosure via listpagestag and includepages Actions (high 8.7)
- [CVE-2026-104437](https://insights.sbomify.com/CVE-2026-104437/): Zebra before 4.4.0 Consensus Split via SIGHASH_SINGLE Missing-Output Handling (high 8.3)
- [CVE-2026-104436](https://insights.sbomify.com/CVE-2026-104436/): Zebra before 4.5.0 CPU Amplification via Uncapped getblocks/getheaders Locator Length (medium 6.3)
- [CVE-2026-104435](https://insights.sbomify.com/CVE-2026-104435/): Zebra 4.4.0 Consensus Divergence via V5 SIGHASH_SINGLE Without Output (high 8.3)
- [CVE-2026-104434](https://insights.sbomify.com/CVE-2026-104434/): Zebra before 8.0.0 Denial of Service via z_listunifiedreceivers RPC (high 7.1)
- [CVE-2026-104433](https://insights.sbomify.com/CVE-2026-104433/): Mooncake before 0.3.12 Out-of-Bounds Read via P2P Handshake readString (high 8.7)
- [CVE-2026-104432](https://insights.sbomify.com/CVE-2026-104432/): Zebra before 6.3.0 False Readiness via Discarded One-Hash FindBlocks Response (medium 6.9)
- [CVE-2026-104431](https://insights.sbomify.com/CVE-2026-104431/): Zebra before 6.0.0 Denial of Service via Synchronous Script FFI Verification (high 8.7)
- [CVE-2026-104430](https://insights.sbomify.com/CVE-2026-104430/): Zebra 4.5.0 Consensus Split via P2SH Sigop Overcount (high 8.7)
- [CVE-2026-104429](https://insights.sbomify.com/CVE-2026-104429/): Zebra before 6.0.0-rc.0 Per-Peer Mempool Admission Bypass via P2P tx Messages (medium 6.9)
- [CVE-2026-104428](https://insights.sbomify.com/CVE-2026-104428/): Zebra before 11.0.0 Denial of Service via getblock Verbosity 2 (medium 6.9)
- [CVE-2026-104427](https://insights.sbomify.com/CVE-2026-104427/): Zebra before 6.1.0 Chain Stall via Stale parent_error_map Entry (high 8.2)
- [CVE-2026-104426](https://insights.sbomify.com/CVE-2026-104426/): Zebra before 6.1.0 Quadratic Complexity DoS via Block Transparent Value Check (high 8.2)
- [CVE-2026-104425](https://insights.sbomify.com/CVE-2026-104425/): Zebra before 6.1.0 Batch-Verification Poisoning DoS via Unattributed Pushed Transactions (medium 6.9)
- [CVE-2026-104424](https://insights.sbomify.com/CVE-2026-104424/): Zebra before 6.1.0 Incorrect Block Size Calculation in getblocktemplate (medium 6.3)
- [CVE-2026-104423](https://insights.sbomify.com/CVE-2026-104423/): Zebra before 6.2.1 Denial of Service via Uncapped V6 Shielded Proof Verification (high 8.7)
- [CVE-2026-104422](https://insights.sbomify.com/CVE-2026-104422/): Zebra before 6.3.0 Block Sync Denial of Service via Coinbase scriptSig Rewrite (high 8.7)
- [CVE-2026-104421](https://insights.sbomify.com/CVE-2026-104421/): Zebra before 6.2.1 Block Download Denial of Service via KnownBlock SentHashes Lockout (medium 6.9)
- [CVE-2026-104420](https://insights.sbomify.com/CVE-2026-104420/): Zebra before 6.3.0 Peer Misbehavior Ban Bypass via Gossiped Blocks (medium 6.9)
- [CVE-2026-104419](https://insights.sbomify.com/CVE-2026-104419/): Zebra before 6.3.0 Honest Peer Banning via Far-Ahead FindBlocks Hashes (medium 6.3)
- [CVE-2026-104418](https://insights.sbomify.com/CVE-2026-104418/): Ghost from 6.10.3 before 6.64.0 RCE via Theme Translation Files (high 8.6)
- [CVE-2026-104417](https://insights.sbomify.com/CVE-2026-104417/): Ghost 1.20.0 before 6.64.0 Path Traversal via Locale Setting (medium 6.9)
- [CVE-2026-104416](https://insights.sbomify.com/CVE-2026-104416/): Ghost 4.39.0 before 6.64.0 Invite Token Disclosure via Admin API (high 7.7)
- [CVE-2026-104415](https://insights.sbomify.com/CVE-2026-104415/): Ghost 0.7.2 before 6.64.0 Password Hash Ordering Disclosure via Admin API (low 2.3)
- [CVE-2026-104414](https://insights.sbomify.com/CVE-2026-104414/): Ghost from 2.5.0 before 6.64.0 Stored XSS via oEmbed Photo Responses (high 8.6)
- [CVE-2026-104413](https://insights.sbomify.com/CVE-2026-104413/): Ghost 5.94.0 before 6.64.0 Stored XSS via Bookmark Card Images (high 8.5)
- [CVE-2026-104412](https://insights.sbomify.com/CVE-2026-104412/): Ghost 0.5.0 before 6.64.0 Privilege Escalation via Staff Role Assignment (medium 5.3)
- [CVE-2026-104411](https://insights.sbomify.com/CVE-2026-104411/): Ghost 6.22.1 before 6.64.0 Stored XSS via Local Storage File Uploads (high 8.5)
- [CVE-2026-104410](https://insights.sbomify.com/CVE-2026-104410/): SiYuan before 3.8.5 Information Disclosure via /api/export/preview (high 8.7)
- [CVE-2026-104409](https://insights.sbomify.com/CVE-2026-104409/): WordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.13 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-104408](https://insights.sbomify.com/CVE-2026-104408/): WordPress Groundhogg plugin <= 4.8.3 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-104407](https://insights.sbomify.com/CVE-2026-104407/): WordPress PowerPress Podcasting plugin <= 11.17.9 - Cross Site Request Forgery (CSRF) vulnerability (high 7.1)
- [CVE-2026-104406](https://insights.sbomify.com/CVE-2026-104406/): WordPress picu plugin <= 3.10.1 - Broken Access Control vulnerability (high 7.3)
- [CVE-2026-104405](https://insights.sbomify.com/CVE-2026-104405/): WordPress GiveWP plugin <= 4.17.0 - Privilege Escalation vulnerability (high 8.1)
- [CVE-2026-104404](https://insights.sbomify.com/CVE-2026-104404/): WordPress GiveWP plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-104403](https://insights.sbomify.com/CVE-2026-104403/): WordPress LearnPress plugin <= 4.4.9 - Insecure Direct Object References (IDOR) vulnerability (medium 5.3)
- [CVE-2026-104402](https://insights.sbomify.com/CVE-2026-104402/): WordPress Mindio Magic MCP plugin <= 0.5.6 - Sensitive Data Exposure vulnerability (medium 4.3)
- [CVE-2026-104401](https://insights.sbomify.com/CVE-2026-104401/): WordPress Memberful - Membership Plugin plugin <= 1.81.2 - Sensitive Data Exposure vulnerability (medium 4.3)
- [CVE-2026-104400](https://insights.sbomify.com/CVE-2026-104400/): WordPress B Blocks plugin <= 2.1.8 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-1044](https://insights.sbomify.com/CVE-2026-1044/): Cross-site scripting in Tennis Court Bookings (medium 4.4)
- [CVE-2026-104399](https://insights.sbomify.com/CVE-2026-104399/): WordPress Motors plugin <= 1.4.124 - Sensitive Data Exposure vulnerability (medium 6.9)
- [CVE-2026-104398](https://insights.sbomify.com/CVE-2026-104398/): WordPress AFFI – Affiliate Marketing for WooCommerce plugin <= 1.0.10 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-104397](https://insights.sbomify.com/CVE-2026-104397/): WordPress Name Directory plugin <= 1.34.2 - Arbitrary Shortcode Execution vulnerability (medium 5.3)
- [CVE-2026-104396](https://insights.sbomify.com/CVE-2026-104396/): WordPress Name Directory plugin <= 1.34.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-104395](https://insights.sbomify.com/CVE-2026-104395/): WordPress picu plugin <= 3.10.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-104394](https://insights.sbomify.com/CVE-2026-104394/): WordPress Charitable plugin <= 1.8.12.3 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-104393](https://insights.sbomify.com/CVE-2026-104393/): WordPress Happy Addons for Elementor plugin <= 3.50.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-104392](https://insights.sbomify.com/CVE-2026-104392/): WordPress Quiz And Survey Master plugin <= 11.2.7 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-104391](https://insights.sbomify.com/CVE-2026-104391/): WordPress Quiz And Survey Master plugin <= 11.2.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-104390](https://insights.sbomify.com/CVE-2026-104390/): WordPress Booktics plugin <= 1.0.27 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-104389](https://insights.sbomify.com/CVE-2026-104389/): WordPress Sirv plugin <= 8.2.5 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-104388](https://insights.sbomify.com/CVE-2026-104388/): WordPress PowerPress Podcasting plugin <= 11.17.9 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-104387](https://insights.sbomify.com/CVE-2026-104387/): WordPress PowerPress Podcasting plugin <= 11.17.9 - Broken Access Control vulnerability (high 7.2)
- [CVE-2026-104386](https://insights.sbomify.com/CVE-2026-104386/): WordPress WP VR plugin <= 9.1.3 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-104385](https://insights.sbomify.com/CVE-2026-104385/): WordPress Groundhogg plugin <= 4.8.3 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2026-104384](https://insights.sbomify.com/CVE-2026-104384/): Insufficiently protected credentials in EagleCloud Aquila on-premises version (high 8.7)
- [CVE-2026-104383](https://insights.sbomify.com/CVE-2026-104383/): Code injection in EagleCloud Aquila on-premises version (critical 9.4)
- [CVE-2026-104381](https://insights.sbomify.com/CVE-2026-104381/): Fireware OS Missing Authentication in FireCluster State Sync Allows BOVPN Tunnel Denial of Service (medium 6.0)
- [CVE-2026-104380](https://insights.sbomify.com/CVE-2026-104380/): Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an Origin check in ps_serve_one. (medium 5.3)
- [CVE-2026-104364](https://insights.sbomify.com/CVE-2026-104364/): IBM® Db2® Denial of Service (low 3.3)
- [CVE-2026-104356](https://insights.sbomify.com/CVE-2026-104356/): PictShare < 3.7.1 Predictable Delete Code via rand() (high 8.2)
- [CVE-2026-104355](https://insights.sbomify.com/CVE-2026-104355/): Temporal Server applies inbound namespace replication from a connected peer cluster to local namespaces (high 7.0)
- [CVE-2026-104354](https://insights.sbomify.com/CVE-2026-104354/): SQL injection in Adobe Campaign Classic (critical 9.1)
- [CVE-2026-104353](https://insights.sbomify.com/CVE-2026-104353/): Command injection in Adobe Campaign Classic (critical 9.9)
- [CVE-2026-104351](https://insights.sbomify.com/CVE-2026-104351/): Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94) (critical 9.9)
- [CVE-2026-104350](https://insights.sbomify.com/CVE-2026-104350/): Adobe Campaign Classic (ACC) | Cross-site Scripting (Reflected XSS) (CWE-79) (critical 9.3)
- [CVE-2026-104349](https://insights.sbomify.com/CVE-2026-104349/): Creative Cloud Desktop | Uncontrolled Search Path Element (CWE-427) (high 7.3)
- [CVE-2026-104348](https://insights.sbomify.com/CVE-2026-104348/): Photoshop Desktop | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2026-104347](https://insights.sbomify.com/CVE-2026-104347/): Photoshop Desktop | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-104346](https://insights.sbomify.com/CVE-2026-104346/): Photoshop Desktop | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-104345](https://insights.sbomify.com/CVE-2026-104345/): CAI Content Credentials | Improper Input Validation (CWE-20) (high 7.5)
- [CVE-2026-104344](https://insights.sbomify.com/CVE-2026-104344/): Adobe Framemaker | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2026-104343](https://insights.sbomify.com/CVE-2026-104343/): Adobe Framemaker | NULL Pointer Dereference (CWE-476) (medium 5.5)
- [CVE-2026-104342](https://insights.sbomify.com/CVE-2026-104342/): Adobe Framemaker | Use After Free (CWE-416) (high 7.8)
- [CVE-2026-104341](https://insights.sbomify.com/CVE-2026-104341/): Adobe Framemaker | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-104340](https://insights.sbomify.com/CVE-2026-104340/): Adobe Framemaker | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2026-104339](https://insights.sbomify.com/CVE-2026-104339/): Langflow OSS is affected by multiple vulnerabilities (critical 9.8)
- [CVE-2026-104335](https://insights.sbomify.com/CVE-2026-104335/): Langflow OSS is affected by multiple vulnerabilities (high 8.8)
- [CVE-2026-104334](https://insights.sbomify.com/CVE-2026-104334/): Langflow OSS is affected by multiple vulnerabilities (critical 9.8)
- [CVE-2026-104332](https://insights.sbomify.com/CVE-2026-104332/): IBM® Db2® Denial of Service (medium 5.5)
- [CVE-2026-104331](https://insights.sbomify.com/CVE-2026-104331/): Langflow OSS is affected by multiple vulnerabilities (medium 5.4)
- [CVE-2026-104328](https://insights.sbomify.com/CVE-2026-104328/): Langflow OSS is affected by multiple vulnerabilities (high 8.8)
- [CVE-2026-104324](https://insights.sbomify.com/CVE-2026-104324/): Langflow OSS is affected by multiple vulnerabilities (high 8.8)
- [CVE-2026-104317](https://insights.sbomify.com/CVE-2026-104317/): Langflow OSS is affected by multiple vulnerabilities (high 8.1)
- [CVE-2026-104316](https://insights.sbomify.com/CVE-2026-104316/): Langflow OSS is affected by multiple vulnerabilities (medium 6.5)
- [CVE-2026-104315](https://insights.sbomify.com/CVE-2026-104315/): Langflow OSS is affected by multiple vulnerabilities (medium 4.3)
- [CVE-2026-104314](https://insights.sbomify.com/CVE-2026-104314/): Langflow OSS is affected by multiple vulnerabilities (medium 6.5)
- [CVE-2026-104313](https://insights.sbomify.com/CVE-2026-104313/): WPC Estimated Delivery Date for WooCommerce <= 4.0.1 - Reflected Cross-Site Scripting via 'rule_data' Parameter (medium 6.1)
- [CVE-2026-104312](https://insights.sbomify.com/CVE-2026-104312/): Langflow OSS is affected by multiple vulnerabilities (low 3.5)
- [CVE-2026-104310](https://insights.sbomify.com/CVE-2026-104310/): Langflow OSS is affected by multiple vulnerabilities (medium 4.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/975/