# Vulnerabilities published in 2026


- [CVE-2026-103541](https://insights.sbomify.com/CVE-2026-103541/): formtools.org Form Tools Ajax actions.php uploadFile unrestricted upload (medium 5.3)
- [CVE-2026-103540](https://insights.sbomify.com/CVE-2026-103540/): formtools.org Form Tools Client Settings Clients.class.php updateClientSettingsTab special elements in template engine (medium 5.3)
- [CVE-2026-103539](https://insights.sbomify.com/CVE-2026-103539/): ZongXR SuperMarket Instant Buy InstantBuyController.java startBuy missing authentication (medium 5.3)
- [CVE-2026-103538](https://insights.sbomify.com/CVE-2026-103538/): ZongXR SuperMarket Order Deletion Endpoint OrderController.java OrderController.deleteOrder missing authentication (medium 6.9)
- [CVE-2026-103537](https://insights.sbomify.com/CVE-2026-103537/): CVE-2026-103537 (medium 5.4)
- [CVE-2026-103536](https://insights.sbomify.com/CVE-2026-103536/): ZongXR Supermarket save Endpoint OrderController.java OrderController.addOrder missing authentication (medium 6.9)
- [CVE-2026-103535](https://insights.sbomify.com/CVE-2026-103535/): CVE-2026-103535 (high 8.8)
- [CVE-2026-103534](https://insights.sbomify.com/CVE-2026-103534/): David-Crty databasement Snapshot Model snapshots SnapshotPolicy.view access control (medium 5.3)
- [CVE-2026-103533](https://insights.sbomify.com/CVE-2026-103533/): David-Crty databasement database-servers API Endpoint RestoreRequest.php 511 path traversal (low 2.1)
- [CVE-2026-103532](https://insights.sbomify.com/CVE-2026-103532/): immich-app Immich Shared Link Preview access.ts checkSharedLinkAccess improper authorization (medium 6.9)
- [CVE-2026-103531](https://insights.sbomify.com/CVE-2026-103531/): OpenSC card-setcos.c setcos_construct_fci_44 stack-based overflow (medium 5.1)
- [CVE-2026-103530](https://insights.sbomify.com/CVE-2026-103530/): decolua 9Router Search Endpoint ssrfGuard.js fetch server-side request forgery (medium 6.9)
- [CVE-2026-103529](https://insights.sbomify.com/CVE-2026-103529/): CVE-2026-103529 (medium 5.4)
- [CVE-2026-103528](https://insights.sbomify.com/CVE-2026-103528/): CVE-2026-103528 (medium 5.4)
- [CVE-2026-103527](https://insights.sbomify.com/CVE-2026-103527/): CVE-2026-103527 (medium 6.1)
- [CVE-2026-103526](https://insights.sbomify.com/CVE-2026-103526/): CVE-2026-103526 (low 3.7)
- [CVE-2026-103525](https://insights.sbomify.com/CVE-2026-103525/): Missing authorization in FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler (high 7.5)
- [CVE-2026-103524](https://insights.sbomify.com/CVE-2026-103524/): CVE-2026-103524 (medium 4.8)
- [CVE-2026-103523](https://insights.sbomify.com/CVE-2026-103523/): CVE-2026-103523 (medium 6.1)
- [CVE-2026-103522](https://insights.sbomify.com/CVE-2026-103522/): CVE-2026-103522 (high 7.2)
- [CVE-2026-103521](https://insights.sbomify.com/CVE-2026-103521/): CVE-2026-103521 (high 7.2)
- [CVE-2026-103520](https://insights.sbomify.com/CVE-2026-103520/): Cross-site scripting in HivePress – Business Directory, Listings & Classified Ads Plugin (medium 6.4)
- [CVE-2026-103519](https://insights.sbomify.com/CVE-2026-103519/): Code injection in WP Ultimate Review (medium 5.4)
- [CVE-2026-103518](https://insights.sbomify.com/CVE-2026-103518/): SQL injection in FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler (medium 4.9)
- [CVE-2026-103517](https://insights.sbomify.com/CVE-2026-103517/): Airwallex Online Payments Gateway < 1.36.0 - Unauthenticated Payment Bypass via Forged Webhook (medium 5.3)
- [CVE-2026-103515](https://insights.sbomify.com/CVE-2026-103515/): Incorrect Authorization in GitLab (low 2.7)
- [CVE-2026-103514](https://insights.sbomify.com/CVE-2026-103514/): WP 2FA < 4.1.0 - Two-Factor Authentication Bypass via TOTP Code Replay (high 7.5)
- [CVE-2026-103513](https://insights.sbomify.com/CVE-2026-103513/): Memory corruption in Apache DataSketches (critical 9.8)
- [CVE-2026-103512](https://insights.sbomify.com/CVE-2026-103512/): Ticket host-binding bypass via spoofed client IP in P4Search (medium 5.3)
- [CVE-2026-103511](https://insights.sbomify.com/CVE-2026-103511/): Arbitrary file-write via extension installation in P4Search (medium 5.1)
- [CVE-2026-103510](https://insights.sbomify.com/CVE-2026-103510/): Authentication bypass via blank auth token in P4Search (critical 9.5)
- [CVE-2026-103509](https://insights.sbomify.com/CVE-2026-103509/): Credential Disclosure in P4 Search Configuration API (high 8.5)
- [CVE-2026-103508](https://insights.sbomify.com/CVE-2026-103508/): Path traversal via logging configuration in P4Search (high 7.3)
- [CVE-2026-103507](https://insights.sbomify.com/CVE-2026-103507/): Arbitrary file-write via log configuration path in P4Search (high 7.5)
- [CVE-2026-103506](https://insights.sbomify.com/CVE-2026-103506/): SSO settings authorization bypass (high 8.9)
- [CVE-2026-103505](https://insights.sbomify.com/CVE-2026-103505/): AWS EFS CSI Driver Mount Option Injection via mounttargetipmap (medium 6.9)
- [CVE-2026-103504](https://insights.sbomify.com/CVE-2026-103504/): Gitea API team demotion not applied to unit permissions (high 8.1)
- [CVE-2026-103503](https://insights.sbomify.com/CVE-2026-103503/): Hex trusts its bundled CA certificates when cacerts_path is set (medium 5.9)
- [CVE-2026-103502](https://insights.sbomify.com/CVE-2026-103502/): hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25 (medium 5.9)
- [CVE-2026-103501](https://insights.sbomify.com/CVE-2026-103501/): Memory corruption in Apache DataSketches (critical 9.8)
- [CVE-2026-103500](https://insights.sbomify.com/CVE-2026-103500/): Heap buffer overflow opening large email (medium 6.3)
- [CVE-2026-1035](https://insights.sbomify.com/CVE-2026-1035/): Org.keycloak.protocol.oidc: keycloak refresh token reuse bypass via toctou race condition (low 3.1)
- [CVE-2026-103499](https://insights.sbomify.com/CVE-2026-103499/): IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a denial of service (high 7.5)
- [CVE-2026-103497](https://insights.sbomify.com/CVE-2026-103497/): Server-side request forgery in YouTrack (medium 5.5)
- [CVE-2026-103496](https://insights.sbomify.com/CVE-2026-103496/): Missing authorization in YouTrack (medium 5.4)
- [CVE-2026-103495](https://insights.sbomify.com/CVE-2026-103495/): Missing authorization in YouTrack (medium 4.3)
- [CVE-2026-103494](https://insights.sbomify.com/CVE-2026-103494/): Privilege escalation in YouTrack (medium 6.6)
- [CVE-2026-103493](https://insights.sbomify.com/CVE-2026-103493/): Cross-site scripting in YouTrack (high 8.1)
- [CVE-2026-103492](https://insights.sbomify.com/CVE-2026-103492/): Denial of service in YouTrack (medium 6.5)
- [CVE-2026-103491](https://insights.sbomify.com/CVE-2026-103491/): Missing authorization in YouTrack (medium 6.5)
- [CVE-2026-103490](https://insights.sbomify.com/CVE-2026-103490/): Privilege escalation in YouTrack (high 7.2)
- [CVE-2026-103489](https://insights.sbomify.com/CVE-2026-103489/): Cross-site scripting in YouTrack (low 2.0)
- [CVE-2026-103488](https://insights.sbomify.com/CVE-2026-103488/): Missing authorization in YouTrack (high 7.1)
- [CVE-2026-103485](https://insights.sbomify.com/CVE-2026-103485/): Extensions for Leaflet Map <= 5.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via External GeoJSON Property (medium 5.4)
- [CVE-2026-103484](https://insights.sbomify.com/CVE-2026-103484/): pgvector buffer overflow in IVFFlat index build (high 8.8)
- [CVE-2026-103482](https://insights.sbomify.com/CVE-2026-103482/): Cross-site scripting in Noptin – Newsletter, New Post Notifications & Email Automation (medium 5.4)
- [CVE-2026-103481](https://insights.sbomify.com/CVE-2026-103481/): Gwolle Guestbook <= 5.1.1 - Reflected Cross-Site Scripting via 'permalink' Parameter (medium 6.1)
- [CVE-2026-103480](https://insights.sbomify.com/CVE-2026-103480/): Tourfic <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute (medium 6.4)
- [CVE-2026-103478](https://insights.sbomify.com/CVE-2026-103478/): Cross-site scripting in Premium Packages – Sell Digital Products Securely (medium 6.4)
- [CVE-2026-103476](https://insights.sbomify.com/CVE-2026-103476/): yii2-starter-kit through 4.2.0 Unauthorized File Download via attachment-download (medium 6.9)
- [CVE-2026-103475](https://insights.sbomify.com/CVE-2026-103475/): yii2-starter-kit through 4.2.0 Debug and Gii Module Exposure (critical 9.3)
- [CVE-2026-103474](https://insights.sbomify.com/CVE-2026-103474/): yii2-starter-kit through 4.2.0 Unrestricted File Upload RCE (high 8.7)
- [CVE-2026-103473](https://insights.sbomify.com/CVE-2026-103473/): Deno 2.7.0 through 2.9.7 Command Injection via node:child_process (critical 9.2)
- [CVE-2026-103472](https://insights.sbomify.com/CVE-2026-103472/): restbed through 5.0.0 WebSocket Memory Exhaustion via Unbounded Frame Buffering (high 8.7)
- [CVE-2026-103471](https://insights.sbomify.com/CVE-2026-103471/): restbed through 5.0.0 Denial of Service via Unbounded Header Buffering (high 8.7)
- [CVE-2026-103470](https://insights.sbomify.com/CVE-2026-103470/): Privilege escalation in Grouper (critical 9.3)
- [CVE-2026-103446](https://insights.sbomify.com/CVE-2026-103446/): WikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragments (high 7.4)
- [CVE-2026-103445](https://insights.sbomify.com/CVE-2026-103445/): Stored XSS through PageForms #autoedit redirect links (low 1.2)
- [CVE-2026-103444](https://insights.sbomify.com/CVE-2026-103444/): Stored XSS through system messages in WikiForum (low 1.1)
- [CVE-2026-103443](https://insights.sbomify.com/CVE-2026-103443/): API permits session-seeded javascript URL XSS (low 1.1)
- [CVE-2026-103442](https://insights.sbomify.com/CVE-2026-103442/): MergeAccount PHP object injection via session-key substitution (high 7.2)
- [CVE-2026-103441](https://insights.sbomify.com/CVE-2026-103441/): Unauthenticated arbitrary file deletion through Wikibase serialized entity parsing (high 7.2)
- [CVE-2026-103440](https://insights.sbomify.com/CVE-2026-103440/): pagetriagelist discloses suppressed reviewer usernames (low 1.2)
- [CVE-2026-103439](https://insights.sbomify.com/CVE-2026-103439/): Various rawParams() and escaped() updates to prevent XSS in Wikibase extension (low 0.3)
- [CVE-2026-103438](https://insights.sbomify.com/CVE-2026-103438/): Various rawParams() and escaped() updates to prevent XSS in Wikistories extension (low 0.3)
- [CVE-2026-103437](https://insights.sbomify.com/CVE-2026-103437/): ReadingLists imported metadata permits JavaScript URL XSS (low 1.1)
- [CVE-2026-103436](https://insights.sbomify.com/CVE-2026-103436/): Information disclosure in apcupsd (low 3.7)
- [CVE-2026-103435](https://insights.sbomify.com/CVE-2026-103435/): Arbitrary File Write via Write-Time Symlink Following (TOCTOU) in Claude Code (high 7.7)
- [CVE-2026-103433](https://insights.sbomify.com/CVE-2026-103433/): Bake filesystem entitlement consent is skipped for certain secret and oci-layout definitions (medium 6.9)
- [CVE-2026-103432](https://insights.sbomify.com/CVE-2026-103432/): Memory corruption in apcupsd (high 8.1)
- [CVE-2026-103431](https://insights.sbomify.com/CVE-2026-103431/): colmux in collectl before 4.3.20.2 does not sanitize ANSI/VT100 terminal escape sequences in data received from remote collectl instances be (high 7.7)
- [CVE-2026-103427](https://insights.sbomify.com/CVE-2026-103427/): Simple Membership <= 4.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Country Field (medium 6.4)
- [CVE-2026-103426](https://insights.sbomify.com/CVE-2026-103426/): Relevanssi Premium <= 2.31.4 - Unauthenticated Stored Cross-Site Scripting via '_rt' Parameter (high 7.2)
- [CVE-2026-103425](https://insights.sbomify.com/CVE-2026-103425/): Booking Package <= 1.7.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute (medium 6.4)
- [CVE-2026-103424](https://insights.sbomify.com/CVE-2026-103424/): Cross-site scripting in Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA (medium 5.4)
- [CVE-2026-103423](https://insights.sbomify.com/CVE-2026-103423/): Missing authorization in Booking Package (high 7.5)
- [CVE-2026-103422](https://insights.sbomify.com/CVE-2026-103422/): AnyComment <= 0.3.6 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter (high 7.2)
- [CVE-2026-103421](https://insights.sbomify.com/CVE-2026-103421/): WPMobile.App <= 11.84 - Unauthenticated Stored Cross-Site Scripting via '/android_json/search/<value>/0' Path Segment (medium 5.4)
- [CVE-2026-103418](https://insights.sbomify.com/CVE-2026-103418/): Universal XSS via the HTML language attribute in Translation Services (high 8.8)
- [CVE-2026-103417](https://insights.sbomify.com/CVE-2026-103417/): Saved credentials can be autofilled after cross-origin navigation (medium 5.5)
- [CVE-2026-103416](https://insights.sbomify.com/CVE-2026-103416/): Memory corruption in Eclipse ThreadX - NetX Duo (critical 9.3)
- [CVE-2026-103415](https://insights.sbomify.com/CVE-2026-103415/): Memory corruption in NetX Duo (critical 9.3)
- [CVE-2026-103414](https://insights.sbomify.com/CVE-2026-103414/): Memory corruption in GUIX (high 8.4)
- [CVE-2026-103413](https://insights.sbomify.com/CVE-2026-103413/): Apache Camel Karavan: unvalidated Kubernetes resources applied from a project's kubernetes.yaml (high 8.8)
- [CVE-2026-103412](https://insights.sbomify.com/CVE-2026-103412/): Apache Camel Karavan: project file name path traversal when committing a project to Git (high 8.8)
- [CVE-2026-103411](https://insights.sbomify.com/CVE-2026-103411/): Integer overflow in Session Smart Router (high 7.1)
- [CVE-2026-103410](https://insights.sbomify.com/CVE-2026-103410/): Session Smart Router: Integer overflow causes denial of service during TLS certificate inspection (high 7.5)
- [CVE-2026-103409](https://insights.sbomify.com/CVE-2026-103409/): Auth bypass in Session Smart Router (critical 9.8)
- [CVE-2026-103408](https://insights.sbomify.com/CVE-2026-103408/): Session Smart Router: An attacker-controlled input causes remote code execution when parsing DHCP options (high 8.8)
- [CVE-2026-103407](https://insights.sbomify.com/CVE-2026-103407/): Path traversal in Session Smart Conductor (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/979/