# Vulnerabilities published in 2026


- [CVE-2026-103406](https://insights.sbomify.com/CVE-2026-103406/): Session Smart Conductor: An unauthenticated attacker causes arbitrary command execution during key management. (critical 9.8)
- [CVE-2026-103405](https://insights.sbomify.com/CVE-2026-103405/): Session Smart Router and Session Smart Conductor: Unsanitized input causes HTTP response splitting (medium 5.8)
- [CVE-2026-103404](https://insights.sbomify.com/CVE-2026-103404/): Session Smart Conductor: Insecure file permissions cause unauthorized access to sensitive routing credentials (medium 6.8)
- [CVE-2026-103403](https://insights.sbomify.com/CVE-2026-103403/): Command injection in Session Smart Conductor (high 8.8)
- [CVE-2026-103402](https://insights.sbomify.com/CVE-2026-103402/): Security feature bypass in Session Smart Conductor (high 8.8)
- [CVE-2026-103401](https://insights.sbomify.com/CVE-2026-103401/): Session Smart Router and Session Smart Conductor: An attacker can overwrite arbitrary files as root (high 8.8)
- [CVE-2026-103400](https://insights.sbomify.com/CVE-2026-103400/): Path traversal in Session Smart Conductor (medium 5.5)
- [CVE-2026-103399](https://insights.sbomify.com/CVE-2026-103399/): Libsoup: soupserver: http/1 request smuggling via undrained expect: 100-continue body (medium 5.3)
- [CVE-2026-103398](https://insights.sbomify.com/CVE-2026-103398/): OpenSave through 2.4.0 Arbitrary File Read and Write via Peer-Controlled Save Path (high 8.6)
- [CVE-2026-103397](https://insights.sbomify.com/CVE-2026-103397/): OpenSave before 2.4.0-beta.1 Authentication Bypass via Spoofed Relay Sender (medium 6.3)
- [CVE-2026-103396](https://insights.sbomify.com/CVE-2026-103396/): bbs-go through 4.4.6 Incorrect Authorization via /api/admin/user/synccount (medium 5.3)
- [CVE-2026-103395](https://insights.sbomify.com/CVE-2026-103395/): LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Visual-Only RPyC Service (critical 9.3)
- [CVE-2026-103394](https://insights.sbomify.com/CVE-2026-103394/): Weak cryptography in Session Smart Router (low 3.7)
- [CVE-2026-103393](https://insights.sbomify.com/CVE-2026-103393/): Session Smart Router: An attacker can cause an out-of-bounds read during VRRP packet processing (medium 4.3)
- [CVE-2026-103392](https://insights.sbomify.com/CVE-2026-103392/): Memory corruption in Session Smart Router (medium 4.8)
- [CVE-2026-103391](https://insights.sbomify.com/CVE-2026-103391/): Session Smart Router: An attacker-controlled TCP option causes an out-of-bounds write when using the TCP proxy feature (medium 5.3)
- [CVE-2026-103390](https://insights.sbomify.com/CVE-2026-103390/): Memory corruption in Session Smart Conductor (medium 5.3)
- [CVE-2026-103389](https://insights.sbomify.com/CVE-2026-103389/): MISP Stored Cross-Site Scripting via Unvalidated Galaxy Icon Field in Correlation Graph (medium 6.2)
- [CVE-2026-103388](https://insights.sbomify.com/CVE-2026-103388/): MISP Stored Cross-Site Scripting via JavaScript URL in Galaxy Cluster Source Field (medium 6.2)
- [CVE-2026-103387](https://insights.sbomify.com/CVE-2026-103387/): garycourt uri-js Mailto Header mailto.ts URI.parse uncaught exception (medium 5.3)
- [CVE-2026-103382](https://insights.sbomify.com/CVE-2026-103382/): Casso Auto-confirm Bank Transfer < 4.2.0 - Unauthenticated WooCommerce Order Payment Confirmation (medium 5.3)
- [CVE-2026-103381](https://insights.sbomify.com/CVE-2026-103381/): Mintpay <= 2.2.3 - Unauthenticated Order Payment Completion and Cancellation via Callback Forgery (medium 6.5)
- [CVE-2026-103380](https://insights.sbomify.com/CVE-2026-103380/): Information disclosure in Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress (medium 4.3)
- [CVE-2026-103378](https://insights.sbomify.com/CVE-2026-103378/): Geliver Akıllı Kargo Pazaryeri 3.0.0 - 3.1.0 - Unauthenticated API Key Disclosure via Public Log File (medium 6.5)
- [CVE-2026-103377](https://insights.sbomify.com/CVE-2026-103377/): Reflected cross-site scripting in the video library of the Regional Parliament of Castile-La Mancha (medium 5.1)
- [CVE-2026-103376](https://insights.sbomify.com/CVE-2026-103376/): PeachPay 1.117.9 - 1.120.69 - Unauthenticated Order Key Disclosure via ConvesioPay BTCPay Status Check (medium 5.3)
- [CVE-2026-103372](https://insights.sbomify.com/CVE-2026-103372/): Payconiq for WooCommerce <= 1.0.4 - Unauthenticated Order Key Disclosure (medium 5.3)
- [CVE-2026-103371](https://insights.sbomify.com/CVE-2026-103371/): Apache Geode: Management REST API: Insertion of Sensitive Information into Log File (high 7.5)
- [CVE-2026-103370](https://insights.sbomify.com/CVE-2026-103370/): Awesome Support <= 6.4.1 - Authenticated (Custom+) Stored Cross-Site Scripting via Ticket Attachment MIME Confusion (medium 6.4)
- [CVE-2026-103369](https://insights.sbomify.com/CVE-2026-103369/): Cross-site scripting in Social Share Buttons & Analytics Plugin – GetSocial.io (medium 6.4)
- [CVE-2026-103367](https://insights.sbomify.com/CVE-2026-103367/): ShopMagic <= 4.9.0 - Unauthenticated Local File Inclusion via 'billing.first_name' Parameter (high 8.1)
- [CVE-2026-103366](https://insights.sbomify.com/CVE-2026-103366/): Missing authorization in Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress (high 7.5)
- [CVE-2026-103365](https://insights.sbomify.com/CVE-2026-103365/): Information disclosure in Online Scheduling and Appointment Booking System – Bookly (medium 5.3)
- [CVE-2026-103360](https://insights.sbomify.com/CVE-2026-103360/): Langflow OSS is affected by multiple vulnerabilities (high 8.1)
- [CVE-2026-103359](https://insights.sbomify.com/CVE-2026-103359/): PayDunya WooCommerce Payment Gateway 1.1.6 - Unauthenticated Order Payment Completion via Webhook Forgery (medium 5.3)
- [CVE-2026-103358](https://insights.sbomify.com/CVE-2026-103358/): WordPress Email Template Customizer for WooCommerce plugin <= 1.3.4 - Content Injection vulnerability (high 7.5)
- [CVE-2026-103357](https://insights.sbomify.com/CVE-2026-103357/): WordPress GIFT4U plugin <= 1.1.3 - Broken Access Control vulnerability (medium 6.9)
- [CVE-2026-103356](https://insights.sbomify.com/CVE-2026-103356/): WordPress TMDS plugin <= 1.0.15 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-103355](https://insights.sbomify.com/CVE-2026-103355/): SQL injection in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) (critical 9.3)
- [CVE-2026-103354](https://insights.sbomify.com/CVE-2026-103354/): WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.11.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-103353](https://insights.sbomify.com/CVE-2026-103353/): WordPress FluentForm plugin <= 6.2.14 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-103352](https://insights.sbomify.com/CVE-2026-103352/): WordPress WP BASE Booking plugin <= 6.4.0 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-103351](https://insights.sbomify.com/CVE-2026-103351/): WordPress Taxi Booking Manager for WooCommerce plugin <= 2.1.1 - Other vulnerability Type vulnerability (medium 5.3)
- [CVE-2026-103350](https://insights.sbomify.com/CVE-2026-103350/): WordPress Booking and Rental Manager plugin <= 2.8.0 - Other vulnerability Type vulnerability (medium 5.3)
- [CVE-2026-103349](https://insights.sbomify.com/CVE-2026-103349/): WordPress Product Feed PRO for WooCommerce plugin <= 13.5.7 - PHP Object Injection vulnerability (high 7.2)
- [CVE-2026-103348](https://insights.sbomify.com/CVE-2026-103348/): WordPress WP Ultimate Exporter plugin <= 3.0 - PHP Object Injection vulnerability (high 7.2)
- [CVE-2026-103347](https://insights.sbomify.com/CVE-2026-103347/): WordPress hCaptcha for WP plugin <= 5.3.0 - Bypass Vulnerability vulnerability (medium 5.3)
- [CVE-2026-103346](https://insights.sbomify.com/CVE-2026-103346/): WordPress Payflex Payment Gateway plugin <= 2.7.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-103345](https://insights.sbomify.com/CVE-2026-103345/): WordPress Pie Register plugin <= 3.8.4.13 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-103344](https://insights.sbomify.com/CVE-2026-103344/): Cross-site scripting in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) (high 7.1)
- [CVE-2026-103343](https://insights.sbomify.com/CVE-2026-103343/): WordPress FluentForm plugin <= 6.2.14 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-103342](https://insights.sbomify.com/CVE-2026-103342/): Cross-site scripting in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) (high 7.1)
- [CVE-2026-103341](https://insights.sbomify.com/CVE-2026-103341/): Missing authorization in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) (medium 5.3)
- [CVE-2026-103340](https://insights.sbomify.com/CVE-2026-103340/): WordPress Site Reviews plugin <= 8.3.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-103339](https://insights.sbomify.com/CVE-2026-103339/): WordPress Metform plugin <= 4.3.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-103338](https://insights.sbomify.com/CVE-2026-103338/): SQL injection in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) (high 8.5)
- [CVE-2026-103337](https://insights.sbomify.com/CVE-2026-103337/): WordPress WC Ukraine Shipping plugin <= 1.23.2 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-103336](https://insights.sbomify.com/CVE-2026-103336/): WordPress WP Ultimate CSV Importer plugin <= 9.1 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-103335](https://insights.sbomify.com/CVE-2026-103335/): WordPress Video Conferencing with Zoom plugin <= 4.6.10 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-103334](https://insights.sbomify.com/CVE-2026-103334/): WordPress Five Star Restaurant Reservations plugin <= 2.7.24 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2026-103332](https://insights.sbomify.com/CVE-2026-103332/): Auth bypass in Payex Payment Gateway for Woocommerce (medium 5.3)
- [CVE-2026-103331](https://insights.sbomify.com/CVE-2026-103331/): UniPAY Payment Gateway For WooCommerce <= 2.3 - Unauthenticated Order Payment Forgery via Empty IPN Secret (medium 5.3)
- [CVE-2026-103330](https://insights.sbomify.com/CVE-2026-103330/): Sadad QA Payment 1.28 - Unauthenticated Arbitrary Order Payment Confirmation via Signature Bypass (medium 5.3)
- [CVE-2026-103329](https://insights.sbomify.com/CVE-2026-103329/): Super Payments < 1.43.1 - Unauthenticated Payment Confirmation Forgery via Webhook Signature (medium 5.3)
- [CVE-2026-103325](https://insights.sbomify.com/CVE-2026-103325/): TiendaCrypto para WooCommerce 1.0.1 - 1.2.1 - Unauthenticated Order Payment Forgery via Webhook HMAC Bypass (low 3.7)
- [CVE-2026-103324](https://insights.sbomify.com/CVE-2026-103324/): Security feature bypass in Cardinity Payment Gateway for WooCommerce (medium 5.3)
- [CVE-2026-103323](https://insights.sbomify.com/CVE-2026-103323/): Integration for Epos Now and WooCommerce 4.6.0 - 4.11.1 - Unauthenticated Action Scheduler Queue Disclosure (medium 5.9)
- [CVE-2026-103321](https://insights.sbomify.com/CVE-2026-103321/): MISP Stored Cross-Site Scripting (XSS) via Unvalidated Event Graph Preview Image (high 8.3)
- [CVE-2026-103319](https://insights.sbomify.com/CVE-2026-103319/): Auth bypass in OPay Payment Gateway for WooCommerce (medium 5.3)
- [CVE-2026-103316](https://insights.sbomify.com/CVE-2026-103316/): The macOS version of the DigiD app is not signed with Hardened Runtime (high 7.1)
- [CVE-2026-103314](https://insights.sbomify.com/CVE-2026-103314/): Stackrox: stackrox: saml response replay allows multiple central authentication tokens (high 7.4)
- [CVE-2026-103313](https://insights.sbomify.com/CVE-2026-103313/): BitPay Gateway for WooCommerce <= 4.1.3 - Unauthenticated Payment Bypass via Payment Return Handler (medium 5.3)
- [CVE-2026-103312](https://insights.sbomify.com/CVE-2026-103312/): Payment Integration Wompi <= 4.0.1 - Unauthenticated Payment Confirmation Forgery via IPN Callback (medium 5.3)
- [CVE-2026-103311](https://insights.sbomify.com/CVE-2026-103311/): Security feature bypass in Coinbase Commerce Payment Gateway for WooCommerce (medium 5.3)
- [CVE-2026-103309](https://insights.sbomify.com/CVE-2026-103309/): GPTranslate < 2.34.14 - Unauthenticated Stored XSS via REST API Translation Storage (high 7.5)
- [CVE-2026-103308](https://insights.sbomify.com/CVE-2026-103308/): Auth bypass in Visma Pay for WooCommerce (medium 6.5)
- [CVE-2026-103307](https://insights.sbomify.com/CVE-2026-103307/): Walletdoc Payment Gateway for WooCommerce < 1.8.5 - Unauthenticated SQLi and Order Payment Forgery via Webhook (high 8.6)
- [CVE-2026-103306](https://insights.sbomify.com/CVE-2026-103306/): iKhokha Payment Gateway < 3.0.4 - Unauthenticated Order Payment Forgery via Callback (medium 5.3)
- [CVE-2026-103305](https://insights.sbomify.com/CVE-2026-103305/): Prenotazioni <= 1.7.5 - Unauthenticated Stored XSS via Settings Update (high 8.8)
- [CVE-2026-103304](https://insights.sbomify.com/CVE-2026-103304/): eaSYNC < 1.3.31 - Unauthenticated Cancellation Request Creation and Email Template Update (medium 5.3)
- [CVE-2026-103302](https://insights.sbomify.com/CVE-2026-103302/): Payment Gateway for Idram < 2.1.6 - Unauthenticated Payment Confirmation Forgery via Empty-Default Merchant Secret (medium 5.3)
- [CVE-2026-103301](https://insights.sbomify.com/CVE-2026-103301/): Payment Gateway for Telcell < 2.0.5 - Unauthenticated Payment Confirmation Forgery via Empty-Default Merchant Secret (medium 5.3)
- [CVE-2026-103300](https://insights.sbomify.com/CVE-2026-103300/): Eurobank WooCommerce Payment Gateway <= 2.1.1 - Unauthenticated Order Payment Forgery via Unverified Callback (medium 5.3)
- [CVE-2026-103299](https://insights.sbomify.com/CVE-2026-103299/): nexi Alpha Bank for WooCommerce <= 2.2.0 - Unauthenticated Payment Confirmation Forgery via Empty Shared Secret (not scored)
- [CVE-2026-103298](https://insights.sbomify.com/CVE-2026-103298/): CCAvenue Payment Gateway for WooCommerce <= 3.1 - Unauthenticated Order Payment Completion via Webhook Forgery (medium 5.3)
- [CVE-2026-103297](https://insights.sbomify.com/CVE-2026-103297/): CAI Content Credentials | Improper Verification of Cryptographic Signature (CWE-347) (high 7.5)
- [CVE-2026-103296](https://insights.sbomify.com/CVE-2026-103296/): CAI Content Credentials | Improper Verification of Cryptographic Signature (CWE-347) (high 7.5)
- [CVE-2026-103294](https://insights.sbomify.com/CVE-2026-103294/): CAI Content Credentials | Improper Certificate Validation (CWE-295) (medium 5.9)
- [CVE-2026-103293](https://insights.sbomify.com/CVE-2026-103293/): MPG < 4.2.3 - Editor+ Arbitrary File Read via Project Import (medium 6.8)
- [CVE-2026-103292](https://insights.sbomify.com/CVE-2026-103292/): Ghost 0.5.3 before 6.50.0 Cross-Site Scripting via ghost_head (high 8.6)
- [CVE-2026-103291](https://insights.sbomify.com/CVE-2026-103291/): Ghost 3.20.2 before 6.51.0 SSRF via image-size fetch (medium 5.3)
- [CVE-2026-103290](https://insights.sbomify.com/CVE-2026-103290/): Ghost 6.14.0 before 6.27.0 Path Traversal via ImageSize (medium 5.1)
- [CVE-2026-103289](https://insights.sbomify.com/CVE-2026-103289/): Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comments (high 7.1)
- [CVE-2026-103288](https://insights.sbomify.com/CVE-2026-103288/): Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comment Like (high 7.1)
- [CVE-2026-103287](https://insights.sbomify.com/CVE-2026-103287/): Ghost 1.18.0 before 6.27.0 Server-Side Request Forgery via Webhook (medium 5.1)
- [CVE-2026-103286](https://insights.sbomify.com/CVE-2026-103286/): Ghost 2.21.0 before 6.56.0 Privilege Escalation via Notifications (high 8.5)
- [CVE-2026-103285](https://insights.sbomify.com/CVE-2026-103285/): Ghost 5.19.0 before 6.57.1 Cross-Site Request Forgery (medium 5.3)
- [CVE-2026-103284](https://insights.sbomify.com/CVE-2026-103284/): Ghost 5.125.1 before 6.57.1 Information Disclosure via Feedback (medium 5.3)
- [CVE-2026-103283](https://insights.sbomify.com/CVE-2026-103283/): Ghost 6.20.0 before 6.57.1 Authentication Bypass via Session Handling (high 8.6)
- [CVE-2026-103282](https://insights.sbomify.com/CVE-2026-103282/): Ghost 0.5.0 before 6.23.0 Multiple Account Creation via Invite Token (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/980/