# Vulnerabilities published in 2026


- [CVE-2026-103778](https://insights.sbomify.com/CVE-2026-103778/): Hardcoded credentials in Command | Configure (DCC) (medium 6.2)
- [CVE-2026-103768](https://insights.sbomify.com/CVE-2026-103768/): File upload in ELEX WordPress HelpDesk & Customer Ticketing System (critical 9.8)
- [CVE-2026-103766](https://insights.sbomify.com/CVE-2026-103766/): ClipBucket v5 through 5.5.3-#197 SQL Injection via ads_manager.php delete Parameter (high 8.6)
- [CVE-2026-103765](https://insights.sbomify.com/CVE-2026-103765/): Mooncake through 0.3.13.post1 Missing Authentication in HTTP Metadata Server (high 8.8)
- [CVE-2026-103764](https://insights.sbomify.com/CVE-2026-103764/): Mooncake transfer engine before 0.3.13 Unauthenticated Arbitrary Memory Read/Write via TCP Transport (critical 9.3)
- [CVE-2026-103763](https://insights.sbomify.com/CVE-2026-103763/): SiYuan before v3.8.5 Information Disclosure via /api/notebook/getNotebookInfo (medium 6.9)
- [CVE-2026-103762](https://insights.sbomify.com/CVE-2026-103762/): SiYuan before v3.8.5 Missing Authorization in Save-Path Resolver Endpoints (medium 6.9)
- [CVE-2026-103761](https://insights.sbomify.com/CVE-2026-103761/): Mooncake transfer engine through 0.3.13.post1 Memory Exhaustion via Unbounded Notify Queue (high 8.7)
- [CVE-2026-103760](https://insights.sbomify.com/CVE-2026-103760/): Mooncake transfer engine through 0.3.13.post1 Denial of Service via P2P Handshake Daemon Response Write (high 8.2)
- [CVE-2026-103758](https://insights.sbomify.com/CVE-2026-103758/): Obot 0.21.1 through 0.24.1 Authorization Bypass via /mcp-connect-composite/ Route (high 8.6)
- [CVE-2026-103757](https://insights.sbomify.com/CVE-2026-103757/): Budibase before 3.41.0 SSRF via uploadUrl in AI Table Generation (high 8.3)
- [CVE-2026-103754](https://insights.sbomify.com/CVE-2026-103754/): Path traversal in Red Hat Ansible Automation Platform 2 (medium 5.9)
- [CVE-2026-103752](https://insights.sbomify.com/CVE-2026-103752/): WordPress Authorizer plugin <= 3.15.3 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2026-1037](https://insights.sbomify.com/CVE-2026-1037/): Cross-site scripting in Common Licensing (medium 6.1)
- [CVE-2026-103696](https://insights.sbomify.com/CVE-2026-103696/): Mobile Builder <= 1.4.2 - Unauthenticated SQLi via 'delivery_id' Parameter (medium 6.8)
- [CVE-2026-103695](https://insights.sbomify.com/CVE-2026-103695/): Mobile Builder <= 1.4.2 - Unauthenticated SQLi via 'vendor_id' Parameter (high 8.6)
- [CVE-2026-103694](https://insights.sbomify.com/CVE-2026-103694/): Mobile builder <= 1.4.2 - Subscriber+ Privilege Escalation to Admin (high 8.8)
- [CVE-2026-103693](https://insights.sbomify.com/CVE-2026-103693/): Frontend Dashboard < 3.0.5 and ProfileGrid < 6.0.0.5 - Unauthenticated PHP Object Injection (critical 9.0)
- [CVE-2026-103692](https://insights.sbomify.com/CVE-2026-103692/): Frontend Dashboard 3.0.0 - 3.0.4 - Unauthenticated Privilege Escalation via Arbitrary Function Call (critical 9.8)
- [CVE-2026-103690](https://insights.sbomify.com/CVE-2026-103690/): itsourcecode Leave Management System controller.php sql injection (medium 5.3)
- [CVE-2026-103688](https://insights.sbomify.com/CVE-2026-103688/): Checkout Files Upload for WooCommerce < 2.4.0 - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2026-103687](https://insights.sbomify.com/CVE-2026-103687/): rhukster dom-sanitizer SVG Sanitization DOMSanitizer.php url incomplete blacklist (medium 6.9)
- [CVE-2026-103686](https://insights.sbomify.com/CVE-2026-103686/): rhukster dom-sanitizer URL Validation DOMSanitizer.php isDangerousUrl cross site scripting (medium 5.1)
- [CVE-2026-103685](https://insights.sbomify.com/CVE-2026-103685/): Missing authorization in ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce (medium 4.3)
- [CVE-2026-103684](https://insights.sbomify.com/CVE-2026-103684/): WordPress WP Event Solution plugin <= 4.1.25 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-103681](https://insights.sbomify.com/CVE-2026-103681/): Frontend Dashboard < 3.0.0 - Subscriber+ Profile and Post Field Deletion via fed_user_profile_delete (medium 4.3)
- [CVE-2026-103680](https://insights.sbomify.com/CVE-2026-103680/): Tnef: heap buffer overflow in find_free_number() via numbered-backup suffix generation (low 3.1)
- [CVE-2026-103679](https://insights.sbomify.com/CVE-2026-103679/): Tnef: use-after-free and double-free in get_body_files() via multi-value body extraction (medium 6.5)
- [CVE-2026-103678](https://insights.sbomify.com/CVE-2026-103678/): Tnef: heap out-of-bounds read in get_rtf_data_from_buf() via uncompressed rtf mapi value (medium 5.4)
- [CVE-2026-103672](https://insights.sbomify.com/CVE-2026-103672/): HMS Networks PEAK-System PCAN Windows drivers Improper Validation of Array Index (medium 6.9)
- [CVE-2026-103671](https://insights.sbomify.com/CVE-2026-103671/): Open redirect in AmazonPay Plugin (4.0 series) (medium 5.3)
- [CVE-2026-103670](https://insights.sbomify.com/CVE-2026-103670/): Gitea trusted workflow cancellation by unapproved fork runs (high 7.5)
- [CVE-2026-103668](https://insights.sbomify.com/CVE-2026-103668/): SQL injection in Movable Type (high 8.8)
- [CVE-2026-103667](https://insights.sbomify.com/CVE-2026-103667/): Gitea container registry stored XSS through blob media type (medium 5.4)
- [CVE-2026-103665](https://insights.sbomify.com/CVE-2026-103665/): Other in Yamaha LAN Monitor for Windows (high 8.4)
- [CVE-2026-103664](https://insights.sbomify.com/CVE-2026-103664/): MISP Reflected Cross-Site Scripting via Unsanitized Analyst Data Seed Parameter (medium 4.8)
- [CVE-2026-103663](https://insights.sbomify.com/CVE-2026-103663/): Path Traversal leading to Remote Code Execution in Ollama (medium 6.9)
- [CVE-2026-103662](https://insights.sbomify.com/CVE-2026-103662/): MISP Reflected XSS in Taxonomy Tag Confirmation Forms (medium 5.1)
- [CVE-2026-103659](https://insights.sbomify.com/CVE-2026-103659/): MISP: Object Distribution ACL Bypass via Event Flattening Exposes Organisation-Only Attributes (high 7.1)
- [CVE-2026-103658](https://insights.sbomify.com/CVE-2026-103658/): Memory corruption in Aspell (medium 5.9)
- [CVE-2026-103655](https://insights.sbomify.com/CVE-2026-103655/): MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period (critical 9.3)
- [CVE-2026-103651](https://insights.sbomify.com/CVE-2026-103651/): MISP HOTP Token Replay via Stale Session-Cached Counter Allows Second-Factor Authentication Bypass (high 7.6)
- [CVE-2026-103649](https://insights.sbomify.com/CVE-2026-103649/): Synchronous Access of Remote Resource without Timeout in hMailServer (high 7.5)
- [CVE-2026-103648](https://insights.sbomify.com/CVE-2026-103648/): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in image-downloader (critical 9.1)
- [CVE-2026-103647](https://insights.sbomify.com/CVE-2026-103647/): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in hMailServer (high 8.0)
- [CVE-2026-103646](https://insights.sbomify.com/CVE-2026-103646/): Ultimate Multisite < 2.17.0 - Unauthenticated Authentication Bypass via 'email_address' Parameter (critical 9.8)
- [CVE-2026-103641](https://insights.sbomify.com/CVE-2026-103641/): Gegl: gegl04: gegl: out-of-bounds read in the radiance hdr uncompressed scanline decoder (medium 5.5)
- [CVE-2026-103636](https://insights.sbomify.com/CVE-2026-103636/): Memory corruption in Apache DataSketches (high 7.5)
- [CVE-2026-103635](https://insights.sbomify.com/CVE-2026-103635/): Memory corruption in Apache DataSketches (critical 9.1)
- [CVE-2026-103634](https://insights.sbomify.com/CVE-2026-103634/): Memory corruption in Apache DataSketches (medium 5.3)
- [CVE-2026-103631](https://insights.sbomify.com/CVE-2026-103631/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-103630](https://insights.sbomify.com/CVE-2026-103630/): Use after free in Chrome (critical 9.6)
- [CVE-2026-103629](https://insights.sbomify.com/CVE-2026-103629/): Integer overflow in Chrome (medium 4.3)
- [CVE-2026-103628](https://insights.sbomify.com/CVE-2026-103628/): Memory corruption in Chrome (critical 9.6)
- [CVE-2026-103627](https://insights.sbomify.com/CVE-2026-103627/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-103626](https://insights.sbomify.com/CVE-2026-103626/): Missing authorization in Chrome (critical 9.6)
- [CVE-2026-103625](https://insights.sbomify.com/CVE-2026-103625/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-103624](https://insights.sbomify.com/CVE-2026-103624/): Use after free in Chrome (high 8.3)
- [CVE-2026-103623](https://insights.sbomify.com/CVE-2026-103623/): Use after free in Chrome (high 8.8)
- [CVE-2026-103622](https://insights.sbomify.com/CVE-2026-103622/): Use after free in Chrome (high 8.8)
- [CVE-2026-103621](https://insights.sbomify.com/CVE-2026-103621/): Integer overflow in Chrome (medium 4.3)
- [CVE-2026-103620](https://insights.sbomify.com/CVE-2026-103620/): Missing authorization in GitHub Enterprise Server allowed repository writers to replace default branches via GraphQL (medium 6.0)
- [CVE-2026-103604](https://insights.sbomify.com/CVE-2026-103604/): Quadratic-time escaping when converting X.509 distinguished names to strings (high 8.7)
- [CVE-2026-103603](https://insights.sbomify.com/CVE-2026-103603/): Unbounded HSS public key level count allows huge array allocation during signature verification (high 8.7)
- [CVE-2026-103602](https://insights.sbomify.com/CVE-2026-103602/): Name constraints bypass via trailing dot in rfc822Name, dNSName and URI hosts (high 8.2)
- [CVE-2026-103601](https://insights.sbomify.com/CVE-2026-103601/): CcmBlockCipher and KCcmBlockCipher leave unverified plaintext in the output buffer after a failed tag check (high 8.2)
- [CVE-2026-103600](https://insights.sbomify.com/CVE-2026-103600/): Unbounded ASN.1 nesting depth causes process-terminating stack overflow (high 8.7)
- [CVE-2026-1036](https://insights.sbomify.com/CVE-2026-1036/): Missing authorization in Photo Gallery by 10Web – Mobile-Friendly Image Gallery (medium 5.3)
- [CVE-2026-103594](https://insights.sbomify.com/CVE-2026-103594/): Fireware OS Stack Buffer Overflow in WireGuard Configuration Allows Remote Code Execution (critical 9.5)
- [CVE-2026-103593](https://insights.sbomify.com/CVE-2026-103593/): Fireware OS Stack Buffer Overflow in Logging Service Allows Remote Code Execution (critical 9.1)
- [CVE-2026-103592](https://insights.sbomify.com/CVE-2026-103592/): simple-php-router through 5.4.1.7 IP restriction bypass via forwarding headers (medium 6.9)
- [CVE-2026-103591](https://insights.sbomify.com/CVE-2026-103591/): DeepWiki-Open through commit d92819a Unauthenticated Arbitrary File Read via /codemap/file (high 8.7)
- [CVE-2026-103590](https://insights.sbomify.com/CVE-2026-103590/): QloApps through 1.7.0 Reflected XSS via Length of Stay Fields (medium 5.1)
- [CVE-2026-103589](https://insights.sbomify.com/CVE-2026-103589/): QloApps through 1.7.0 Reflected XSS via Room Type Editor (medium 5.1)
- [CVE-2026-103588](https://insights.sbomify.com/CVE-2026-103588/): QloApps through 1.7.0 Reflected XSS via exceptions field (medium 5.1)
- [CVE-2026-103587](https://insights.sbomify.com/CVE-2026-103587/): QloApps through 1.7.0 Reflected XSS via Book Now Search Parameters (medium 5.1)
- [CVE-2026-103585](https://insights.sbomify.com/CVE-2026-103585/): attacker-controlled javascript license URL via XSS (low 1.2)
- [CVE-2026-103584](https://insights.sbomify.com/CVE-2026-103584/): attacker-controlled javascript license URL via XSS (low 1.1)
- [CVE-2026-103578](https://insights.sbomify.com/CVE-2026-103578/): Windows Kernel Elevation of Privilege Vulnerability (medium 6.8)
- [CVE-2026-103577](https://insights.sbomify.com/CVE-2026-103577/): Microsoft QUIC Security Feature Bypass Vulnerability (high 7.5)
- [CVE-2026-103576](https://insights.sbomify.com/CVE-2026-103576/): Active Directory Federation Services (AD FS) Spoofing Vulnerability (medium 6.5)
- [CVE-2026-103575](https://insights.sbomify.com/CVE-2026-103575/): Remote Desktop Client Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-103572](https://insights.sbomify.com/CVE-2026-103572/): Visual Studio Tools for Applications and SQL Server Management Studio Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-103569](https://insights.sbomify.com/CVE-2026-103569/): Windows IKE Extension Information Disclosure Vulnerability (high 7.5)
- [CVE-2026-103568](https://insights.sbomify.com/CVE-2026-103568/): Windows Credential Providers Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-103567](https://insights.sbomify.com/CVE-2026-103567/): Windows Broadcast DVR User Service Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-103565](https://insights.sbomify.com/CVE-2026-103565/): Windows Broadcast DVR User Service Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-103560](https://insights.sbomify.com/CVE-2026-103560/): Role: DNS Server Tampering Vulnerability (medium 5.5)
- [CVE-2026-103558](https://insights.sbomify.com/CVE-2026-103558/): Windows Routing and Remote Access Service (RRAS) Denial of Service Vulnerability (high 7.5)
- [CVE-2026-103555](https://insights.sbomify.com/CVE-2026-103555/): Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-103554](https://insights.sbomify.com/CVE-2026-103554/): Windows Broadcast DVR User Service Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-103553](https://insights.sbomify.com/CVE-2026-103553/): Windows Partition Management Driver Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-103552](https://insights.sbomify.com/CVE-2026-103552/): Denial of service in Apache Directory LDAP API (high 7.3)
- [CVE-2026-103549](https://insights.sbomify.com/CVE-2026-103549/): Incorrect Authorization in GitLab (low 2.7)
- [CVE-2026-103548](https://insights.sbomify.com/CVE-2026-103548/): Improperly Stored Credentials (medium 5.3)
- [CVE-2026-103547](https://insights.sbomify.com/CVE-2026-103547/): Auth bypass in OpenBSD (critical 9.2)
- [CVE-2026-103546](https://insights.sbomify.com/CVE-2026-103546/): Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator (low 2.3)
- [CVE-2026-103544](https://insights.sbomify.com/CVE-2026-103544/): datadrivenconstruction OpenConstructionERP Al Provider Configuration ai_client.py wrong session (medium 5.3)
- [CVE-2026-103543](https://insights.sbomify.com/CVE-2026-103543/): itsourcecode Leave Management System controller.php sql injection (medium 5.3)
- [CVE-2026-103542](https://insights.sbomify.com/CVE-2026-103542/): formtools.org Form Tools AJAX Endpoint actions.php smart_fill server-side request forgery (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/978/