# Vulnerabilities published in 2026


- [CVE-2026-104005](https://insights.sbomify.com/CVE-2026-104005/): Incorrect authorization in MongoDB Server router for bulk writes to system namespaces (high 7.1)
- [CVE-2026-104004](https://insights.sbomify.com/CVE-2026-104004/): Collection validators using collation-accepting expressions can crash MongoDB Server on insert (high 7.1)
- [CVE-2026-104003](https://insights.sbomify.com/CVE-2026-104003/): Code injection in Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress (medium 5.4)
- [CVE-2026-104002](https://insights.sbomify.com/CVE-2026-104002/): Fail-open error handling in the data masking utility in Powertools for AWS Lambda (Python) (medium 6.0)
- [CVE-2026-104001](https://insights.sbomify.com/CVE-2026-104001/): Slim SEO <= 4.11.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'Biographical Info' User Meta (medium 5.4)
- [CVE-2026-104000](https://insights.sbomify.com/CVE-2026-104000/): Cross-site scripting in Simply Schedule Appointments (high 7.2)
- [CVE-2026-103999](https://insights.sbomify.com/CVE-2026-103999/): Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated Stored Cross-Site Scripting via File Upload (high 7.2)
- [CVE-2026-103998](https://insights.sbomify.com/CVE-2026-103998/): Form Maker by 10Web <= 1.15.48 - Reflected Cross-Site Scripting via 'inputs' Parameter Array Key (medium 6.1)
- [CVE-2026-103996](https://insights.sbomify.com/CVE-2026-103996/): Cross-site scripting in If-So Dynamic Content – Elementor & All Page Builders Personalization (medium 6.4)
- [CVE-2026-103995](https://insights.sbomify.com/CVE-2026-103995/): Lenient parsing of integers for response body and chunk framing (low 2.0)
- [CVE-2026-103994](https://insights.sbomify.com/CVE-2026-103994/): Junos OS: A crafted OVSDB message crashes vgd and allows remote code execution (high 8.7)
- [CVE-2026-103993](https://insights.sbomify.com/CVE-2026-103993/): Memory corruption in Junos OS (medium 6.9)
- [CVE-2026-103988](https://insights.sbomify.com/CVE-2026-103988/): FileRise renameFolder omits destination-parent authorization (medium 5.4)
- [CVE-2026-103977](https://insights.sbomify.com/CVE-2026-103977/): FileRise: Session-scoped TOTP rate limiting permits repeated verification attempts (high 8.1)
- [CVE-2026-103975](https://insights.sbomify.com/CVE-2026-103975/): Appium: Symlink based Zip Slip in @appium/support ZIP extraction (medium 6.5)
- [CVE-2026-103974](https://insights.sbomify.com/CVE-2026-103974/): lichess.org: Stored HTML Injection via PGN Annotator Tag in Studies (medium 5.4)
- [CVE-2026-103967](https://insights.sbomify.com/CVE-2026-103967/): Adobe Framemaker | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-103966](https://insights.sbomify.com/CVE-2026-103966/): Adobe Framemaker | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2026-103965](https://insights.sbomify.com/CVE-2026-103965/): Fixed values in MongoDB Server $bucket stage may be misread as field references (medium 5.3)
- [CVE-2026-103964](https://insights.sbomify.com/CVE-2026-103964/): Information disclosure in Download Manager (medium 4.3)
- [CVE-2026-103958](https://insights.sbomify.com/CVE-2026-103958/): Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS (high 8.3)
- [CVE-2026-103957](https://insights.sbomify.com/CVE-2026-103957/): Server-side request forgery in the OAuth2 discovery handling in Loom for AWS (high 8.2)
- [CVE-2026-103956](https://insights.sbomify.com/CVE-2026-103956/): Missing authentication for critical function in Loom for AWS (critical 10.0)
- [CVE-2026-103946](https://insights.sbomify.com/CVE-2026-103946/): SQL Injection (high 8.7)
- [CVE-2026-103937](https://insights.sbomify.com/CVE-2026-103937/): Misskey: Denial of service resulting from insufficient cleanup processing during file uploads (high 8.7)
- [CVE-2026-103936](https://insights.sbomify.com/CVE-2026-103936/): libp2p: Single pre-auth STUN packet terminates `@libp2p/webrtc` WebRTC-direct Node.js listeners (high 7.5)
- [CVE-2026-103930](https://insights.sbomify.com/CVE-2026-103930/): cpp-httplib open_stream serializes CRLF in request target into HTTP request line (low 3.7)
- [CVE-2026-103929](https://insights.sbomify.com/CVE-2026-103929/): mise permits untrusted local configuration to override default shell arguments (high 7.8)
- [CVE-2026-103928](https://insights.sbomify.com/CVE-2026-103928/): Metabase: Arbitrary File Read/Write via Unsafe H2 Built-in Functions (critical 9.3)
- [CVE-2026-103923](https://insights.sbomify.com/CVE-2026-103923/): KaTeX: Existing prototype pollution can bypass trust restrictions (low 2.1)
- [CVE-2026-103922](https://insights.sbomify.com/CVE-2026-103922/): Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path (critical 9.3)
- [CVE-2026-103921](https://insights.sbomify.com/CVE-2026-103921/): GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor (high 7.4)
- [CVE-2026-103918](https://insights.sbomify.com/CVE-2026-103918/): @orpc/zod: Prototype injection in smart coercion (medium 6.5)
- [CVE-2026-103913](https://insights.sbomify.com/CVE-2026-103913/): GeoDirectory <= 2.8.186 - Unauthenticated SQL Injection via 'latitude' Parameter via Stored Pending Listing (high 7.5)
- [CVE-2026-103912](https://insights.sbomify.com/CVE-2026-103912/): Cross-site scripting in JetFormBuilder — Dynamic Blocks Form Builder (medium 4.7)
- [CVE-2026-103911](https://insights.sbomify.com/CVE-2026-103911/): Code injection in Forminator Forms – Contact Form, Payment Form & Custom Form Builder (medium 6.5)
- [CVE-2026-103909](https://insights.sbomify.com/CVE-2026-103909/): Cross-site scripting in Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More (medium 6.1)
- [CVE-2026-103907](https://insights.sbomify.com/CVE-2026-103907/): Missing authorization in Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress (medium 6.5)
- [CVE-2026-103905](https://insights.sbomify.com/CVE-2026-103905/): Unauthenticated Plugin Safe Mode Toggle Vulnerability in JTL-Shop (high 8.7)
- [CVE-2026-103904](https://insights.sbomify.com/CVE-2026-103904/): Stored XSS Vulnerability in JTL-Shop (high 8.6)
- [CVE-2026-103903](https://insights.sbomify.com/CVE-2026-103903/): MikroTik RouterOS WinBox split-principal authentication bypass allows privilege escalation (high 8.7)
- [CVE-2026-103902](https://insights.sbomify.com/CVE-2026-103902/): DigiDoc improper signature verification (high 7.5)
- [CVE-2026-103899](https://insights.sbomify.com/CVE-2026-103899/): Cross-site scripting in EU VAT Assistant for WooCommerce (high 7.2)
- [CVE-2026-103897](https://insights.sbomify.com/CVE-2026-103897/): Cross-site scripting in Responsive Lightbox & Gallery (medium 4.4)
- [CVE-2026-103896](https://insights.sbomify.com/CVE-2026-103896/): Path traversal in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer (high 7.5)
- [CVE-2026-103895](https://insights.sbomify.com/CVE-2026-103895/): Auth bypass in miniOrange OTP Login, Verification and SMS Notifications (high 8.1)
- [CVE-2026-103889](https://insights.sbomify.com/CVE-2026-103889/): 3D Product configurator for WooCommerce <= 2.16.2 - Unauthenticated Remote Code Execution via 'xpv_image' Parameter (critical 9.8)
- [CVE-2026-103888](https://insights.sbomify.com/CVE-2026-103888/): WPC Smart Quick View for WooCommerce <= 4.4.0 - Reflected Cross-Site Scripting via 'woosq-redirect' Parameter (medium 6.1)
- [CVE-2026-103885](https://insights.sbomify.com/CVE-2026-103885/): Apache Directory LDAP API: Denial of service via crafted telephone number values (high 7.5)
- [CVE-2026-103884](https://insights.sbomify.com/CVE-2026-103884/): Keycloak-services: keycloak-services: path traversal in x.509 crl distribution point allows arbitrary local file read (medium 6.5)
- [CVE-2026-103880](https://insights.sbomify.com/CVE-2026-103880/): Apache Directory LDAP API: Denial of service via excessive bcrypt cost factor in stored passwords (high 7.5)
- [CVE-2026-103878](https://insights.sbomify.com/CVE-2026-103878/): Apache Directory LDAP API: Injection of plaintext responses during StartTLS (high 7.5)
- [CVE-2026-103877](https://insights.sbomify.com/CVE-2026-103877/): Apache Directory LDAP API: Unsafe loading of Java code from LDAP schema elements (critical 9.8)
- [CVE-2026-103875](https://insights.sbomify.com/CVE-2026-103875/): Cross-site scripting in Media Library Assistant (medium 4.7)
- [CVE-2026-103870](https://insights.sbomify.com/CVE-2026-103870/): Pulp-rpm: distribution tree publish creates directories from .treeinfo ids (medium 5.0)
- [CVE-2026-103869](https://insights.sbomify.com/CVE-2026-103869/): Pulp-ansible: bearer tokens are reused across remotes in a worker (medium 6.5)
- [CVE-2026-103868](https://insights.sbomify.com/CVE-2026-103868/): Pulp-container: registry credentials are reused across remotes in a worker (medium 6.5)
- [CVE-2026-103858](https://insights.sbomify.com/CVE-2026-103858/): MISP Incomplete Thread Authorization Allows Unauthorized Read and Post Access to Discussions (medium 5.3)
- [CVE-2026-103857](https://insights.sbomify.com/CVE-2026-103857/): Adobe Framemaker | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2026-103856](https://insights.sbomify.com/CVE-2026-103856/): Adobe Framemaker | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2026-103855](https://insights.sbomify.com/CVE-2026-103855/): Dimension | NULL Pointer Dereference (CWE-476) (medium 5.5)
- [CVE-2026-103854](https://insights.sbomify.com/CVE-2026-103854/): Dimension | Stack-based Buffer Overflow (CWE-121) (high 7.8)
- [CVE-2026-103853](https://insights.sbomify.com/CVE-2026-103853/): Dimension | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2026-103852](https://insights.sbomify.com/CVE-2026-103852/): Substance3D - Stager | NULL Pointer Dereference (CWE-476) (medium 5.5)
- [CVE-2026-103851](https://insights.sbomify.com/CVE-2026-103851/): Substance3D - Stager | Stack-based Buffer Overflow (CWE-121) (high 7.8)
- [CVE-2026-103850](https://insights.sbomify.com/CVE-2026-103850/): Substance3D - Stager | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2026-103849](https://insights.sbomify.com/CVE-2026-103849/): Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) (critical 10.0)
- [CVE-2026-103848](https://insights.sbomify.com/CVE-2026-103848/): Command injection in Adobe Experience Manager 6.5 (critical 9.9)
- [CVE-2026-103847](https://insights.sbomify.com/CVE-2026-103847/): Dimension | Untrusted Search Path (CWE-426) (high 8.6)
- [CVE-2026-103846](https://insights.sbomify.com/CVE-2026-103846/): Dimension | Improper Neutralization of Input During Web Page Generation (Cross-Site Scripting) (CWE-79) (high 8.6)
- [CVE-2026-103845](https://insights.sbomify.com/CVE-2026-103845/): Dimension | Uncontrolled Search Path Element (CWE-427) (high 8.6)
- [CVE-2026-103844](https://insights.sbomify.com/CVE-2026-103844/): Dimension | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-103843](https://insights.sbomify.com/CVE-2026-103843/): Substance3D - Stager | Use After Free (CWE-416) (high 7.8)
- [CVE-2026-103842](https://insights.sbomify.com/CVE-2026-103842/): Substance3D - Stager | Out-of-bounds Read (CWE-125) (high 7.8)
- [CVE-2026-103841](https://insights.sbomify.com/CVE-2026-103841/): Substance3D - Stager | Out-of-bounds Read (CWE-125) (high 7.8)
- [CVE-2026-103840](https://insights.sbomify.com/CVE-2026-103840/): Substance3D - Stager | Out-of-bounds Read (CWE-125) (high 7.8)
- [CVE-2026-103839](https://insights.sbomify.com/CVE-2026-103839/): Substance3D - Stager | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-103838](https://insights.sbomify.com/CVE-2026-103838/): Substance3D - Stager | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-103837](https://insights.sbomify.com/CVE-2026-103837/): Substance3D - Stager | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-103836](https://insights.sbomify.com/CVE-2026-103836/): Substance3D - Stager | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-103835](https://insights.sbomify.com/CVE-2026-103835/): Substance3D - Stager | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-103834](https://insights.sbomify.com/CVE-2026-103834/): Substance3D - Stager | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-103833](https://insights.sbomify.com/CVE-2026-103833/): Substance3D - Stager | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-103832](https://insights.sbomify.com/CVE-2026-103832/): Substance3D - Stager | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-103831](https://insights.sbomify.com/CVE-2026-103831/): Insecure deserialization in the TrueLayer Magento 2 plugin (high 7.5)
- [CVE-2026-103830](https://insights.sbomify.com/CVE-2026-103830/): Substance3D - Stager | Stack-based Buffer Overflow (CWE-121) (high 7.8)
- [CVE-2026-103829](https://insights.sbomify.com/CVE-2026-103829/): Substance3D - Designer | NULL Pointer Dereference (CWE-476) (medium 5.5)
- [CVE-2026-103828](https://insights.sbomify.com/CVE-2026-103828/): Substance3D - Designer | NULL Pointer Dereference (CWE-476) (medium 5.5)
- [CVE-2026-103827](https://insights.sbomify.com/CVE-2026-103827/): Substance3D - Designer | Stack-based Buffer Overflow (CWE-121) (medium 5.5)
- [CVE-2026-103826](https://insights.sbomify.com/CVE-2026-103826/): Substance3D - Designer | NULL Pointer Dereference (CWE-476) (medium 5.5)
- [CVE-2026-103825](https://insights.sbomify.com/CVE-2026-103825/): Substance3D - Designer | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2026-103824](https://insights.sbomify.com/CVE-2026-103824/): Substance3D - Designer | NULL Pointer Dereference (CWE-476) (medium 5.5)
- [CVE-2026-103823](https://insights.sbomify.com/CVE-2026-103823/): Substance3D - Designer | Stack-based Buffer Overflow (CWE-121) (medium 5.5)
- [CVE-2026-103822](https://insights.sbomify.com/CVE-2026-103822/): Substance3D - Designer | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2026-103821](https://insights.sbomify.com/CVE-2026-103821/): Substance3D - Designer | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-103820](https://insights.sbomify.com/CVE-2026-103820/): CAI Content Credentials | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) (medium 5.5)
- [CVE-2026-103799](https://insights.sbomify.com/CVE-2026-103799/): Missing authorization in PowerProtect Data Domain Management Center (critical 9.6)
- [CVE-2026-103792](https://insights.sbomify.com/CVE-2026-103792/): SQL injection in PowerProtect Data Domain Management Center (critical 9.6)
- [CVE-2026-103780](https://insights.sbomify.com/CVE-2026-103780/): Memory corruption in PowerProtect Data Domain (critical 9.8)
- [CVE-2026-103779](https://insights.sbomify.com/CVE-2026-103779/): Auth bypass in PowerProtect Data Domain (high 8.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/977/