# Vulnerabilities published in 2026


- [CVE-2026-104309](https://insights.sbomify.com/CVE-2026-104309/): Langflow OSS is affected by multiple vulnerabilities (medium 6.5)
- [CVE-2026-104308](https://insights.sbomify.com/CVE-2026-104308/): Langflow OSS is affected by multiple vulnerabilities (medium 4.3)
- [CVE-2026-1043](https://insights.sbomify.com/CVE-2026-1043/): PostmarkApp Email Integrator <= 2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings (medium 4.4)
- [CVE-2026-104286](https://insights.sbomify.com/CVE-2026-104286/): Fortinet FortiMail Path Traversal (critical 9.8, exploited in the wild)
- [CVE-2026-104266](https://insights.sbomify.com/CVE-2026-104266/): tinytag: Infinite loop when parsing certain M4A files containing invalid atoms (medium 6.5)
- [CVE-2026-104252](https://insights.sbomify.com/CVE-2026-104252/): Vitess vttablet /twopcz reflected XSS (critical 9.8)
- [CVE-2026-104250](https://insights.sbomify.com/CVE-2026-104250/): unstructured: Stored XSS via unescaped HTML generation (medium 6.1)
- [CVE-2026-104246](https://insights.sbomify.com/CVE-2026-104246/): Contact Form 7 Signature Addon <= 4.2.2 - Unauthenticated Arbitrary File Read via Path Traversal in Email Attachments (medium 5.9)
- [CVE-2026-10420](https://insights.sbomify.com/CVE-2026-10420/): Memory corruption in mTower (medium 5.5)
- [CVE-2026-1042](https://insights.sbomify.com/CVE-2026-1042/): Cross-site scripting in WP Hello Bar (medium 4.4)
- [CVE-2026-104198](https://insights.sbomify.com/CVE-2026-104198/): ZoneMinder failed token handling bypasses web authentication (medium 5.3)
- [CVE-2026-104192](https://insights.sbomify.com/CVE-2026-104192/): DragonflyDB stream RDB deserialization double-free (critical 9.6)
- [CVE-2026-104189](https://insights.sbomify.com/CVE-2026-104189/): 3Dviewer-Nextcloud: Share password not enforced when streaming 3D models from a public link share (high 7.5)
- [CVE-2026-104183](https://insights.sbomify.com/CVE-2026-104183/): stream-json: Prototype pollution: Assembler writes this.current[this.key] on plain objects (medium 5.1)
- [CVE-2026-104182](https://insights.sbomify.com/CVE-2026-104182/): stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk (medium 6.2)
- [CVE-2026-104181](https://insights.sbomify.com/CVE-2026-104181/): Filament: Multi-factor authentication (app) management actions do not require password reauthentication (medium 5.4)
- [CVE-2026-104150](https://insights.sbomify.com/CVE-2026-104150/): AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression Complexity (high 8.7)
- [CVE-2026-104143](https://insights.sbomify.com/CVE-2026-104143/): DataEase: Stored SQL Injection via dateFormat field templates (high 8.7)
- [CVE-2026-104142](https://insights.sbomify.com/CVE-2026-104142/): DataEase: Stored SQL Injection in group-field binning bounds (high 8.7)
- [CVE-2026-104141](https://insights.sbomify.com/CVE-2026-104141/): DataEase: SQL Injection in datasource metadata identifiers (high 8.7)
- [CVE-2026-104140](https://insights.sbomify.com/CVE-2026-104140/): QGIS: Stored XSS in WFS3 getFeatures HTML page via unescaped feature attribute values (medium 6.1)
- [CVE-2026-104126](https://insights.sbomify.com/CVE-2026-104126/): JumpServer: Ansible Automation Template Rendering Allows Unsafe Lookup Plugin Invocation (medium 6.0)
- [CVE-2026-104123](https://insights.sbomify.com/CVE-2026-104123/): SourceCodester Online Reviewer Management System btn_functions.php activity sql injection (medium 6.9)
- [CVE-2026-104122](https://insights.sbomify.com/CVE-2026-104122/): Ukr-To-Lat <= 1.3.5 - Contributor+ SQLi via Term Name (medium 6.8)
- [CVE-2026-104120](https://insights.sbomify.com/CVE-2026-104120/): modelcontextprotocol mcp-server-fetch/mcp-server-everything Fetch Tool server.py fetch_url server-side request forgery (medium 6.9)
- [CVE-2026-104119](https://insights.sbomify.com/CVE-2026-104119/): Simple Shopping Cart < 5.2.6 - Admin+ Stored XSS via PayPal API Credentials (low 3.5)
- [CVE-2026-104118](https://insights.sbomify.com/CVE-2026-104118/): Razorpay for WooCommerce < 4.8.8 - Unauthenticated Order Shipping Modification via IDOR (medium 5.3)
- [CVE-2026-104117](https://insights.sbomify.com/CVE-2026-104117/): Missing authorization in illumos ipmgmtd allows local users to change persistent IPMP group membership (low 1.9)
- [CVE-2026-104116](https://insights.sbomify.com/CVE-2026-104116/): Missing authorization in illumos zonestatd allows local users to disrupt zonestat and enumerate running zones (low 1.9)
- [CVE-2026-104115](https://insights.sbomify.com/CVE-2026-104115/): Stack buffer overflow in illumos reparsed nfs-basic plugin allows local users to crash the daemon (medium 5.4)
- [CVE-2026-104114](https://insights.sbomify.com/CVE-2026-104114/): NULL pointer dereference in illumos nwamd door handler allows local users to crash the daemon (medium 5.4)
- [CVE-2026-104113](https://insights.sbomify.com/CVE-2026-104113/): Double free in OmniOS and SmartOS ipmgmtd allows local users to crash the daemon (medium 5.4)
- [CVE-2026-104112](https://insights.sbomify.com/CVE-2026-104112/): Missing release of passed file descriptors in illumos nscd allows local users to exhaust kernel memory (medium 6.8)
- [CVE-2026-104110](https://insights.sbomify.com/CVE-2026-104110/): Missing authorization in FileRise (medium 5.3)
- [CVE-2026-104109](https://insights.sbomify.com/CVE-2026-104109/): FileRise: Authenticated ZIP extraction follows a pre-existing symlink and deletes files outside the storage root (medium 6.8)
- [CVE-2026-104108](https://insights.sbomify.com/CVE-2026-104108/): FileRise OIDC login can bind an attacker identity to an existing local account (high 8.1)
- [CVE-2026-104107](https://insights.sbomify.com/CVE-2026-104107/): FileRise: Authenticated path traversal escapes configured storage root through inherited ACLs (medium 6.5)
- [CVE-2026-104106](https://insights.sbomify.com/CVE-2026-104106/): FileRise: 2FA disable and TOTP enrollment lack step-up re-authentication; enrollment activates before verification (medium 6.5)
- [CVE-2026-104105](https://insights.sbomify.com/CVE-2026-104105/): FileRise: TOTP codes are not single-use — valid 6-digit code can be replayed within its window (capture-replay) (medium 6.4)
- [CVE-2026-104103](https://insights.sbomify.com/CVE-2026-104103/): Ludwig: Path traversal in dataset archive extraction allows arbitrary file write via symlink members (high 8.1)
- [CVE-2026-104102](https://insights.sbomify.com/CVE-2026-104102/): copyparty FTP: upload outside defined volumes (limited path traversal) (medium 5.3)
- [CVE-2026-104086](https://insights.sbomify.com/CVE-2026-104086/): 7-Zip < 26.03 SquashFS Uninitialized Memory Disclosure via UID/GID Table (medium 6.8)
- [CVE-2026-104085](https://insights.sbomify.com/CVE-2026-104085/): odt2spip < 4.4.0 OS Command Injection via Document Filename (high 8.7)
- [CVE-2026-104084](https://insights.sbomify.com/CVE-2026-104084/): SmarterMail < Build 9777 Stale JWT Role Claim Privilege Escalation via Refresh Token (high 8.7)
- [CVE-2026-104083](https://insights.sbomify.com/CVE-2026-104083/): SmarterMail < Build 9777 Stored Mutation XSS via MathML Foreign Content (medium 5.3)
- [CVE-2026-104082](https://insights.sbomify.com/CVE-2026-104082/): SmarterMail < Build 9777 SysAdmin Remote Code Execution via Volume Mount (high 8.6)
- [CVE-2026-104081](https://insights.sbomify.com/CVE-2026-104081/): KodExplorer < 4.55 Path Traversal via unzip_pre_name() ZIP Extraction (high 7.2)
- [CVE-2026-104079](https://insights.sbomify.com/CVE-2026-104079/): Envira Gallery Lite < 1.16.2 Missing Authorization via Gallery Conversion REST Endpoint (medium 5.3)
- [CVE-2026-104078](https://insights.sbomify.com/CVE-2026-104078/): Obsidian Desktop < 1.14.0 RCE via MathJax Safe Filter Bypass (high 8.4)
- [CVE-2026-104077](https://insights.sbomify.com/CVE-2026-104077/): Obsidian Desktop < 1.14.0 RCE via Slides Plugin Markdown (high 8.5)
- [CVE-2026-104076](https://insights.sbomify.com/CVE-2026-104076/): TVU Networks Receiver/Transceiver Missing Authentication via REST API (critical 9.3)
- [CVE-2026-104075](https://insights.sbomify.com/CVE-2026-104075/): TVU Networks Receiver/Transceiver Authentication Bypass via /tvu/Login (critical 9.3)
- [CVE-2026-104074](https://insights.sbomify.com/CVE-2026-104074/): Coturn 4.10.0 Uninitialized Stack Memory Disclosure via ERROR-CODE (medium 6.9)
- [CVE-2026-104073](https://insights.sbomify.com/CVE-2026-104073/): NetBox 2.9.5 < 4.7.0 Session Hijacking via Custom Links (medium 6.9)
- [CVE-2026-104070](https://insights.sbomify.com/CVE-2026-104070/): SPIP Crayons Plugin < 3.5.0 Authorization Bypass RCE (critical 9.3)
- [CVE-2026-104069](https://insights.sbomify.com/CVE-2026-104069/): HortusFox < 6.2 Remote Code Execution via Theme Import (high 8.6)
- [CVE-2026-104068](https://insights.sbomify.com/CVE-2026-104068/): JetBackup WordPress Plugin < 3.1.24.10 Symlink Arbitrary File Write via Backup Restore (high 8.6)
- [CVE-2026-104059](https://insights.sbomify.com/CVE-2026-104059/): Lektor 3.3.14 CSRF via Admin API Endpoints (high 7.0)
- [CVE-2026-104058](https://insights.sbomify.com/CVE-2026-104058/): Podgrab Missing Authentication on WebSocket /ws Endpoint (medium 6.3)
- [CVE-2026-104057](https://insights.sbomify.com/CVE-2026-104057/): Podgrab Unauthenticated DoS via Concurrent Map Access in WebSocket Handler (high 8.7)
- [CVE-2026-104056](https://insights.sbomify.com/CVE-2026-104056/): CVE-2026-104056 (critical 9.8)
- [CVE-2026-104055](https://insights.sbomify.com/CVE-2026-104055/): Monitoring-user password logged in cleartext by postgres_exporter in postgresql VM charm (medium 5.3)
- [CVE-2026-104054](https://insights.sbomify.com/CVE-2026-104054/): calcom cal.diy PBAC Permission BookingAccessService.ts doesUserIdHaveAccessToBooking authorization (medium 5.3)
- [CVE-2026-104053](https://insights.sbomify.com/CVE-2026-104053/): itsourcecode Pet Shop Management System admin_reservefilter.php sql injection (medium 5.3)
- [CVE-2026-104052](https://insights.sbomify.com/CVE-2026-104052/): itsourcecode Pet Shop Management System admin_reject_completed.php sql injection (medium 5.3)
- [CVE-2026-104051](https://insights.sbomify.com/CVE-2026-104051/): PictShare < 3.7.1 Sensitive Information Disclosure via info API (high 8.8)
- [CVE-2026-104050](https://insights.sbomify.com/CVE-2026-104050/): Academy LMS < 4.0.0 - Subscriber+ Cross-Course Quiz Answer Disclosure via render_quiz_answers (medium 4.3)
- [CVE-2026-104049](https://insights.sbomify.com/CVE-2026-104049/): Academy LMS < 4.0.0 - Subscriber+ Arbitrary Lesson Content Disclosure via Topic REST Endpoint (medium 4.3)
- [CVE-2026-104048](https://insights.sbomify.com/CVE-2026-104048/): Sssd: sssd: authorization bypass via cross-domain username collision in hbac evaluation (medium 6.8)
- [CVE-2026-104047](https://insights.sbomify.com/CVE-2026-104047/): Sssd: sssd: information disclosure via query injection in entra id lookups (medium 5.3)
- [CVE-2026-104046](https://insights.sbomify.com/CVE-2026-104046/): Sssd: sssd: denial of service via incomplete identity provider authentication requests (medium 6.2)
- [CVE-2026-104045](https://insights.sbomify.com/CVE-2026-104045/): Sssd: sssd: denial of service via race condition in autofs responder (medium 4.7)
- [CVE-2026-104044](https://insights.sbomify.com/CVE-2026-104044/): Sssd: sssd: denial of service via crafted passkey kerberos authentication request (medium 6.2)
- [CVE-2026-104043](https://insights.sbomify.com/CVE-2026-104043/): Sssd: sssd: denial of service via undersized packet parsing in nss responder (medium 5.5)
- [CVE-2026-104042](https://insights.sbomify.com/CVE-2026-104042/): Sssd: sssd: denial of service via out-of-bounds read in pam responder (medium 5.5)
- [CVE-2026-104041](https://insights.sbomify.com/CVE-2026-104041/): Sssd: sssd: denial of service via unbounded negative cache growth (medium 5.5)
- [CVE-2026-104040](https://insights.sbomify.com/CVE-2026-104040/): Sssd: sssd: information disclosure via odata injection in entra id lookups (medium 4.4)
- [CVE-2026-104039](https://insights.sbomify.com/CVE-2026-104039/): Sssd: sssd: denial of service via stale connection state reuse in pam gssapi responder (medium 4.7)
- [CVE-2026-104038](https://insights.sbomify.com/CVE-2026-104038/): Sssd: sssd: denial of service via missing sid extension in certificate mapping (medium 5.9)
- [CVE-2026-104037](https://insights.sbomify.com/CVE-2026-104037/): Sssd: sssd: denial of service via packet length underflow in autofs responder (medium 5.5)
- [CVE-2026-104036](https://insights.sbomify.com/CVE-2026-104036/): Sssd: sssd: denial of service via out-of-bounds write in nfs idmap plugin (medium 5.8)
- [CVE-2026-104035](https://insights.sbomify.com/CVE-2026-104035/): Sssd: sssd: denial of service via memory exhaustion in kcm responder (medium 5.5)
- [CVE-2026-104034](https://insights.sbomify.com/CVE-2026-104034/): Sssd: sssd: denial of service via use-after-free in kcm ticket renewal (medium 4.7)
- [CVE-2026-104033](https://insights.sbomify.com/CVE-2026-104033/): Sssd: sssd: access control bypass via improper ldap shadow expiration check (medium 5.4)
- [CVE-2026-104032](https://insights.sbomify.com/CVE-2026-104032/): Sssd: sssd: denial of service via unprivileged autofs cache invalidation (medium 5.5)
- [CVE-2026-104031](https://insights.sbomify.com/CVE-2026-104031/): Sssd: sssd: denial of service via memory exhaustion in autofs responder (medium 5.5)
- [CVE-2026-104030](https://insights.sbomify.com/CVE-2026-104030/): Sssd: sssd: denial of service via out-of-bounds read during passkey parsing (medium 5.5)
- [CVE-2026-104029](https://insights.sbomify.com/CVE-2026-104029/): Sssd: sssd: denial of service via out-of-bounds read in autofs responder (low 3.3)
- [CVE-2026-104028](https://insights.sbomify.com/CVE-2026-104028/): Anton Extensions <= 1.2.2 - Unauthenticated Arbitrary File Upload to RCE (critical 9.8)
- [CVE-2026-104026](https://insights.sbomify.com/CVE-2026-104026/): Command injection in Sapling SCM (high 7.8)
- [CVE-2026-104025](https://insights.sbomify.com/CVE-2026-104025/): Path traversal in PeaZip object preview allows execution of arbitrary programs via a crafted archive entry name (high 8.4)
- [CVE-2026-104024](https://insights.sbomify.com/CVE-2026-104024/): Security feature bypass in PeaZip (medium 4.6)
- [CVE-2026-104023](https://insights.sbomify.com/CVE-2026-104023/): Smart Popup by Supsystic <= 1.13.2 - Authenticated (Administrator+) SQL Injection via 'sidx' Parameter (medium 4.9)
- [CVE-2026-104022](https://insights.sbomify.com/CVE-2026-104022/): Academy LMS <= 4.0.3 - Authenticated (Custom+) Privilege Escalation to add_child REST endpoint (medium 5.4)
- [CVE-2026-104021](https://insights.sbomify.com/CVE-2026-104021/): Code injection in Fastcache by Host.it (high 7.2)
- [CVE-2026-104020](https://insights.sbomify.com/CVE-2026-104020/): Uncontrolled recursion in the Ion reader in Amazon Ion Python (high 8.7)
- [CVE-2026-104019](https://insights.sbomify.com/CVE-2026-104019/): Command injection in sagemaker-distribution (critical 9.3)
- [CVE-2026-104018](https://insights.sbomify.com/CVE-2026-104018/): VxWorks 7 improper privilege management (high 8.8)
- [CVE-2026-104016](https://insights.sbomify.com/CVE-2026-104016/): Integer overflow in jackson-dataformat-protobuf (high 7.5)
- [CVE-2026-104006](https://insights.sbomify.com/CVE-2026-104006/): Information disclosure in SpeedyCache – Cache, Optimization, Performance (low 3.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/976/