# Vulnerabilities published in 2026


- [CVE-2026-103068](https://insights.sbomify.com/CVE-2026-103068/): WordPress ByteCoreStack – MCP Connector for AI Tools plugin <= 1.2.2 - Privilege Escalation vulnerability (high 8.8)
- [CVE-2026-103067](https://insights.sbomify.com/CVE-2026-103067/): WordPress Memberful - Membership Plugin plugin <= 1.81.0 - Cross Site Request Forgery (CSRF) vulnerability (high 8.0)
- [CVE-2026-103066](https://insights.sbomify.com/CVE-2026-103066/): WordPress WP BASE Booking plugin <= 6.4.0 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-103065](https://insights.sbomify.com/CVE-2026-103065/): WordPress Kirki plugin <= 6.3.1 - Arbitrary Code Execution vulnerability (high 8.2)
- [CVE-2026-103064](https://insights.sbomify.com/CVE-2026-103064/): WordPress ElementsKit Elementor addons Lite plugin <= 4.0.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-103063](https://insights.sbomify.com/CVE-2026-103063/): WordPress ElementsKit Elementor addons Lite plugin <= 4.0.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-103062](https://insights.sbomify.com/CVE-2026-103062/): WordPress TranslatePress plugin <= 3.3.6 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-103061](https://insights.sbomify.com/CVE-2026-103061/): Path traversal in Gleam via unvalidated package application names (medium 5.9)
- [CVE-2026-103060](https://insights.sbomify.com/CVE-2026-103060/): Path traversal in rebar3 via unvalidated dependency app names (high 7.5)
- [CVE-2026-103059](https://insights.sbomify.com/CVE-2026-103059/): Gitea built-in SSH server authentication bypass through key case folding (critical 9.1)
- [CVE-2026-103057](https://insights.sbomify.com/CVE-2026-103057/): AiSOC 5.1.0 before 12.0.0 Missing Authentication on Realtime Service Internal Endpoints (medium 5.3)
- [CVE-2026-103056](https://insights.sbomify.com/CVE-2026-103056/): AiSOC 7.2.0 before 12.0.0 Command Injection via CrowdStrike RTR (critical 9.4)
- [CVE-2026-103055](https://insights.sbomify.com/CVE-2026-103055/): AiSOC 7.5.0 before 12.0.0 Authentication Bypass via Hard-coded JWT Secret (high 8.7)
- [CVE-2026-103054](https://insights.sbomify.com/CVE-2026-103054/): AiSOC 10.0.0 before 12.0.0 Unauthorized Tenant Access via MSSP (high 7.1)
- [CVE-2026-103053](https://insights.sbomify.com/CVE-2026-103053/): AiSOC 9.0.0 before 12.0.0 Missing Authentication on Actions Service Response-Action API (medium 5.3)
- [CVE-2026-103051](https://insights.sbomify.com/CVE-2026-103051/): Stored i18n XSSs in CentralNotice (medium 6.1)
- [CVE-2026-103050](https://insights.sbomify.com/CVE-2026-103050/): Stored i18n XSS in MassMessage (medium 6.1)
- [CVE-2026-10305](https://insights.sbomify.com/CVE-2026-10305/): Memory corruption in rlottie (medium 6.1)
- [CVE-2026-103049](https://insights.sbomify.com/CVE-2026-103049/): XSS in Cargo's Special:CargoQuery page due to unsanitized table headers (medium 6.1)
- [CVE-2026-103048](https://insights.sbomify.com/CVE-2026-103048/): Open Redirect in Special:Book (medium 6.1)
- [CVE-2026-103047](https://insights.sbomify.com/CVE-2026-103047/): XSS through i18n message in CentralAuth (medium 6.1)
- [CVE-2026-103046](https://insights.sbomify.com/CVE-2026-103046/): WikifunctionsFragmentRenderer does unsafe string replacements on user-provided HTML (medium 6.1)
- [CVE-2026-103045](https://insights.sbomify.com/CVE-2026-103045/): XSS in Refreshed skin (medium 6.1)
- [CVE-2026-103044](https://insights.sbomify.com/CVE-2026-103044/): EasyTimeline should not serve image maps as application/xml (critical 9.8)
- [CVE-2026-103043](https://insights.sbomify.com/CVE-2026-103043/): anchorme through 3.0.8 Regular Expression Denial of Service (high 8.7)
- [CVE-2026-103042](https://insights.sbomify.com/CVE-2026-103042/): LightLLM through 1.2.0 Unauthenticated Memory Exhaustion via NCCL Control Channel set_value (high 8.7)
- [CVE-2026-103041](https://insights.sbomify.com/CVE-2026-103041/): LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Embed Cache RPyC Service (critical 9.3)
- [CVE-2026-103040](https://insights.sbomify.com/CVE-2026-103040/): LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Router Profiler RPyC Service (critical 9.3)
- [CVE-2026-103038](https://insights.sbomify.com/CVE-2026-103038/): PingTools Network Utilities 4.64 - OS command injection through Watcher ICMP host (high 8.6)
- [CVE-2026-103036](https://insights.sbomify.com/CVE-2026-103036/): @orpc/json-schema: Prototype injection in smart coercion (medium 6.5)
- [CVE-2026-103030](https://insights.sbomify.com/CVE-2026-103030/): Dio: Cross-origin redirect leaks sensitive request headers in `dio_http2_adapter` (high 7.5)
- [CVE-2026-10303](https://insights.sbomify.com/CVE-2026-10303/): ServerCo getssl ACME shell script path injection (high 7.4)
- [CVE-2026-103028](https://insights.sbomify.com/CVE-2026-103028/): SFTPGo source-side file-pattern filter bypass during copy operations (medium 4.3)
- [CVE-2026-10302](https://insights.sbomify.com/CVE-2026-10302/): itsourcecode Fees Management System manage_fee.php sql injection (medium 5.3)
- [CVE-2026-103012](https://insights.sbomify.com/CVE-2026-103012/): Security feature bypass in @anthropic-ai/claude-code (low 2.0)
- [CVE-2026-103011](https://insights.sbomify.com/CVE-2026-103011/): Heap-based Buffer Overflow in hMailServer (medium 6.5)
- [CVE-2026-103010](https://insights.sbomify.com/CVE-2026-103010/): Heap-based Buffer Overflow in hMailServer (high 7.8)
- [CVE-2026-10301](https://insights.sbomify.com/CVE-2026-10301/): itsourcecode Fees Management System index.php cross site scripting (medium 5.3)
- [CVE-2026-103009](https://insights.sbomify.com/CVE-2026-103009/): Authorization Bypass Through User-Controlled Key in Elasticsearch Leading to Information Disclosure (high 7.1)
- [CVE-2026-103008](https://insights.sbomify.com/CVE-2026-103008/): Uncontrolled Recursion in Elasticsearch Leading to Denial of Service (medium 6.5)
- [CVE-2026-103007](https://insights.sbomify.com/CVE-2026-103007/): Incorrect Authorization in Elasticsearch Leading to Privilege Escalation (high 7.2)
- [CVE-2026-103006](https://insights.sbomify.com/CVE-2026-103006/): Uncontrolled Recursion in Elasticsearch Leading to Denial of Service (medium 6.5)
- [CVE-2026-103005](https://insights.sbomify.com/CVE-2026-103005/): Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service (medium 6.5)
- [CVE-2026-103004](https://insights.sbomify.com/CVE-2026-103004/): next.js cache leak on warm `use cache` handlers accessing root param (medium 6.3)
- [CVE-2026-103001](https://insights.sbomify.com/CVE-2026-103001/): PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse (medium 6.5)
- [CVE-2026-103000](https://insights.sbomify.com/CVE-2026-103000/): pypdf: Possible large memory usage when retrieving alphabetical page labels (high 8.7)
- [CVE-2026-10300](https://insights.sbomify.com/CVE-2026-10300/): SGLang Inference HTTP Endpoint lora_manager.py assertion (medium 6.3)
- [CVE-2026-1030](https://insights.sbomify.com/CVE-2026-1030/): Information disclosure in Common Licensing (medium 4.3)
- [CVE-2026-102999](https://insights.sbomify.com/CVE-2026-102999/): pypdf: Possible long runtimes with large amount of embedded files (high 8.7)
- [CVE-2026-102998](https://insights.sbomify.com/CVE-2026-102998/): pypdf: Possible long runtimes when generating appearance streams (high 8.7)
- [CVE-2026-102997](https://insights.sbomify.com/CVE-2026-102997/): pypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up) (high 8.7)
- [CVE-2026-102996](https://insights.sbomify.com/CVE-2026-102996/): pypdf: Possible large memory usage when parsing font data (high 8.7)
- [CVE-2026-102995](https://insights.sbomify.com/CVE-2026-102995/): pypdf: Possible large memory usage for large /ToUnicode streams (Follow-up 2) (high 8.7)
- [CVE-2026-102994](https://insights.sbomify.com/CVE-2026-102994/): pypdf: Possible long runtimes/large memory usage when parsing indirect objects (high 8.7)
- [CVE-2026-102993](https://insights.sbomify.com/CVE-2026-102993/): pypdf: Possible large memory usage when retrieving Roman page labels (high 8.7)
- [CVE-2026-102992](https://insights.sbomify.com/CVE-2026-102992/): piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env (critical 9.2)
- [CVE-2026-102991](https://insights.sbomify.com/CVE-2026-102991/): Mako: Path traversal via drive-letter URI on Windows in TemplateLookup (medium 6.5)
- [CVE-2026-102990](https://insights.sbomify.com/CVE-2026-102990/): basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking) (high 8.2)
- [CVE-2026-10299](https://insights.sbomify.com/CVE-2026-10299/): code-projects Online Hospital Management System viewdoctortimings.php resource injection (medium 5.1)
- [CVE-2026-102989](https://insights.sbomify.com/CVE-2026-102989/): TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses (critical 9.3)
- [CVE-2026-102988](https://insights.sbomify.com/CVE-2026-102988/): Plane: ORM Field Injection via Unvalidated `order_by` Parameter (Including Unauthenticated Path) (medium 5.3)
- [CVE-2026-102986](https://insights.sbomify.com/CVE-2026-102986/): Missing authorization in plane (high 8.1)
- [CVE-2026-102985](https://insights.sbomify.com/CVE-2026-102985/): Plane: Any project member can modify (deactivate) other members' records (medium 6.5)
- [CVE-2026-102984](https://insights.sbomify.com/CVE-2026-102984/): Astro: Malformed port in the Host header can crash the Node adapter (high 8.2)
- [CVE-2026-102983](https://insights.sbomify.com/CVE-2026-102983/): Astro: Netlify Image CDN allowlist bypass enables SSRF (medium 6.3)
- [CVE-2026-102982](https://insights.sbomify.com/CVE-2026-102982/): Plane: XSS in work item comments (high 8.5)
- [CVE-2026-102981](https://insights.sbomify.com/CVE-2026-102981/): Plane: Unauthenticated Workspace Invitation Token Leakage (medium 6.5)
- [CVE-2026-102980](https://insights.sbomify.com/CVE-2026-102980/): Plane: Cross-Project Page Content Disclosure via PageVersionEndpoint Missing Project Scope (medium 6.5)
- [CVE-2026-10298](https://insights.sbomify.com/CVE-2026-10298/): ggml-org whisper.cpp ggml.c whisper_model_load null pointer dereference (medium 4.8)
- [CVE-2026-10297](https://insights.sbomify.com/CVE-2026-10297/): itsourcecode Fees Management System manage_course.php sql injection (medium 5.3)
- [CVE-2026-10296](https://insights.sbomify.com/CVE-2026-10296/): itsourcecode Fees Management System ajax.php sql injection (medium 5.3)
- [CVE-2026-10295](https://insights.sbomify.com/CVE-2026-10295/): SourceCodester Customer Review App review_app.py get_all_reviews denial of service (medium 4.8)
- [CVE-2026-102946](https://insights.sbomify.com/CVE-2026-102946/): joserfc: JWS signature verification bypass via empty signatures array in jws.deserialize_json (critical 9.1)
- [CVE-2026-102944](https://insights.sbomify.com/CVE-2026-102944/): cpp-httplib: Cookie header leaked on cross-origin redirect (high 7.5)
- [CVE-2026-102941](https://insights.sbomify.com/CVE-2026-102941/): gomarkdown/markdown IsSafeURL panics on short URLs (high 7.5)
- [CVE-2026-10294](https://insights.sbomify.com/CVE-2026-10294/): PackageKit API pk-transaction.c g_file_test improper authorization (medium 5.3)
- [CVE-2026-102938](https://insights.sbomify.com/CVE-2026-102938/): virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection (medium 5.8)
- [CVE-2026-102937](https://insights.sbomify.com/CVE-2026-102937/): virtualenv: Command injection via --prompt in activate.bat (batch activator) (high 7.3)
- [CVE-2026-102930](https://insights.sbomify.com/CVE-2026-102930/): virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use (high 7.7)
- [CVE-2026-10293](https://insights.sbomify.com/CVE-2026-10293/): UTT HiPER 1200GW formFireWall strcpy stack-based overflow (high 8.7)
- [CVE-2026-102925](https://insights.sbomify.com/CVE-2026-102925/): virtualenv bash and fish activation scripts execute commands embedded in paths (high 7.8)
- [CVE-2026-102923](https://insights.sbomify.com/CVE-2026-102923/): SparkyFitness: SSRF via unvalidated custom_url in AI service settings (medium 5.4)
- [CVE-2026-10292](https://insights.sbomify.com/CVE-2026-10292/): UTT HiPER 1200GW formTaskEdit strcpy stack-based overflow (high 8.7)
- [CVE-2026-102917](https://insights.sbomify.com/CVE-2026-102917/): IBM i is Affected By An Improper Privilege Management Vulnerability (high 7.8)
- [CVE-2026-102916](https://insights.sbomify.com/CVE-2026-102916/): Reachable assertion in illumos bhyve REP string instruction emulation allows guest to panic host (medium 6.8)
- [CVE-2026-102915](https://insights.sbomify.com/CVE-2026-102915/): WordPress WPO365 plugin <= 44.1 - Broken Access Control vulnerability (high 8.5)
- [CVE-2026-102914](https://insights.sbomify.com/CVE-2026-102914/): WordPress Presto Player plugin <= 4.5.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-102913](https://insights.sbomify.com/CVE-2026-102913/): SourceCodester Car Driving School Management System Master.php save_enrollment sql injection (medium 6.9)
- [CVE-2026-102912](https://insights.sbomify.com/CVE-2026-102912/): SourceCodester Online Leave Management System page reports sql injection (medium 5.1)
- [CVE-2026-102911](https://insights.sbomify.com/CVE-2026-102911/): zosmaai pi-llm-wiki wiki_capture_source MCP tool index.ts os command injection (critical 9.4)
- [CVE-2026-102910](https://insights.sbomify.com/CVE-2026-102910/): SourceCodester Online Reviewer Management System exam-delete.php sql injection (medium 6.9)
- [CVE-2026-10291](https://insights.sbomify.com/CVE-2026-10291/): Enderfga claw-orchestrator Session Grep Endpoint embedded-server.ts validateRegex redos (medium 5.3)
- [CVE-2026-102909](https://insights.sbomify.com/CVE-2026-102909/): SourceCodester Online Reviewer Management System btn_functions.php sql injection (medium 6.9)
- [CVE-2026-102908](https://insights.sbomify.com/CVE-2026-102908/): SourceCodester Online Reviewer Management System questions-view.php sql injection (medium 6.9)
- [CVE-2026-102906](https://insights.sbomify.com/CVE-2026-102906/): 0xshariq github-mcp-server Git Remove MCP Tool github.ts child_process.exec os command injection (medium 5.3)
- [CVE-2026-102904](https://insights.sbomify.com/CVE-2026-102904/): JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs (medium 5.4)
- [CVE-2026-10290](https://insights.sbomify.com/CVE-2026-10290/): code-projects Hotel and Tourism Reservation System GET Parameter tour.php sql injection (medium 6.9)
- [CVE-2026-1029](https://insights.sbomify.com/CVE-2026-1029/): Cross-site scripting in Common Licensing (medium 5.4)
- [CVE-2026-102899](https://insights.sbomify.com/CVE-2026-102899/): Sentry: Improper authentication on SAML SSO process allows user identity linking (high 7.6)
- [CVE-2026-102893](https://insights.sbomify.com/CVE-2026-102893/): Zulip: OpenID Connect authentication ignores the email_verified claim (critical 9.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/982/