# Vulnerabilities published in 2026


- [CVE-2026-100525](https://insights.sbomify.com/CVE-2026-100525/): OpenClaw diagnostics-prometheus before 2026.9.3 Authentication Bypass (medium 5.3)
- [CVE-2026-100524](https://insights.sbomify.com/CVE-2026-100524/): Cotonti through 1.0.0 Cross-Site Request Forgery via Extensions Manager (medium 5.3)
- [CVE-2026-100523](https://insights.sbomify.com/CVE-2026-100523/): Cotonti through 1.0.0 Open Redirect via message.php redirect parameter (medium 5.1)
- [CVE-2026-100522](https://insights.sbomify.com/CVE-2026-100522/): Cotonti through 1.0.0 Reflected XSS via message.php lng parameter (medium 5.1)
- [CVE-2026-100521](https://insights.sbomify.com/CVE-2026-100521/): Cotonti through 1.0.0 Reflected XSS via search highlight parameter (medium 5.1)
- [CVE-2026-100520](https://insights.sbomify.com/CVE-2026-100520/): Laranode before 1.2.1 Path Traversal in File Manager Upload Endpoint (high 8.7)
- [CVE-2026-10052](https://insights.sbomify.com/CVE-2026-10052/): Quay/config-tool: quay/config-tool: ssrf via unfiltered ldap and smtp config validation endpoints (medium 4.1)
- [CVE-2026-100518](https://insights.sbomify.com/CVE-2026-100518/): WordPress Advanced Google reCAPTCHA plugin <= 5.40 - Broken Authentication vulnerability (medium 5.3)
- [CVE-2026-100517](https://insights.sbomify.com/CVE-2026-100517/): WordPress Photo Reviews for WooCommerce plugin <= 1.2.30 - Insecure Direct Object References (IDOR) vulnerability (high 7.5)
- [CVE-2026-100515](https://insights.sbomify.com/CVE-2026-100515/): WordPress Photo Reviews for WooCommerce plugin <= 1.2.30 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-100514](https://insights.sbomify.com/CVE-2026-100514/): WordPress REST API Log plugin <= 1.7.2 - Insecure Direct Object References (IDOR) vulnerability (high 7.5)
- [CVE-2026-100513](https://insights.sbomify.com/CVE-2026-100513/): Cross-site scripting in CF7 Views &#8211; Complete Entry Management for Contact Form 7 (medium 6.5)
- [CVE-2026-100512](https://insights.sbomify.com/CVE-2026-100512/): WordPress Nested Pages plugin <= 3.3.2 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-100511](https://insights.sbomify.com/CVE-2026-100511/): WordPress VK Google Job Posting Manager plugin <= 1.3.1 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-100510](https://insights.sbomify.com/CVE-2026-100510/): WordPress Post and Page Builder by BoldGrid plugin <= 1.27.14 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-10051](https://insights.sbomify.com/CVE-2026-10051/): Eclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connections (medium 6.9)
- [CVE-2026-100509](https://insights.sbomify.com/CVE-2026-100509/): WordPress RepairBuddy plugin <= 4.1225 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-100508](https://insights.sbomify.com/CVE-2026-100508/): WordPress Two Factor plugin <= 0.16.0 - Denial of Service Attack vulnerability (medium 5.3)
- [CVE-2026-100507](https://insights.sbomify.com/CVE-2026-100507/): WordPress If-So Dynamic Content Personalization plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-100506](https://insights.sbomify.com/CVE-2026-100506/): WordPress WP Spell Check plugin <= 12.1 - PHP Object Injection vulnerability (high 7.2)
- [CVE-2026-100505](https://insights.sbomify.com/CVE-2026-100505/): Ghidra 9.2 through 12.1.4 Heap Out-of-Bounds Read via StringManager (medium 4.8)
- [CVE-2026-100504](https://insights.sbomify.com/CVE-2026-100504/): Ghidra through 12.1.4 Stack-based Buffer Overflow via leftshift128 (high 7.3)
- [CVE-2026-100503](https://insights.sbomify.com/CVE-2026-100503/): Ghidra through 12.1.4 Heap Use-After-Free in Decompiler (medium 4.8)
- [CVE-2026-100502](https://insights.sbomify.com/CVE-2026-100502/): Flame through 2.4.0 Admin Token Insufficient Session Expiration (medium 5.9)
- [CVE-2026-100501](https://insights.sbomify.com/CVE-2026-100501/): Flame through 2.4.0 Brute-Force Attack via Login Endpoint (high 8.3)
- [CVE-2026-10050](https://insights.sbomify.com/CVE-2026-10050/): Digest authentication lossy encoding (high 8.7)
- [CVE-2026-1005](https://insights.sbomify.com/CVE-2026-1005/): Integer underflow leads to out-of-bounds access in sniffer AES-GCM/CCM/ARIA-GCM decrypt path (low 2.1)
- [CVE-2026-10047](https://insights.sbomify.com/CVE-2026-10047/): Out-of-bounds write in Napoca real-mode hook handler via guest-controlled SS:SP (VA-13905) (high 8.5)
- [CVE-2026-10046](https://insights.sbomify.com/CVE-2026-10046/): Out-of-bounds write in Napoca BIOS INT 0x15 E820 memory map handler (VA-13905) (high 8.5)
- [CVE-2026-10045](https://insights.sbomify.com/CVE-2026-10045/): CVE-2026-10045 (critical 9.8)
- [CVE-2026-10044](https://insights.sbomify.com/CVE-2026-10044/): ai-goofish-monitor Unauthenticated Arbitrary File Read via GET /api/prompts/ (high 8.2)
- [CVE-2026-10043](https://insights.sbomify.com/CVE-2026-10043/): MosaicML Composer Deserialization of Untrusted Data Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-100420](https://insights.sbomify.com/CVE-2026-100420/): Information disclosure vulnerability in the cloud-client daemon of Deco BE63 (medium 6.8)
- [CVE-2026-10042](https://insights.sbomify.com/CVE-2026-10042/): manga-image-translator RCE via Unsafe Pickle Deserialization in Share Model (critical 9.2)
- [CVE-2026-100419](https://insights.sbomify.com/CVE-2026-100419/): gitoxide gix-fs before 0.23.0 Worktree Escape via Symlink (high 7.3)
- [CVE-2026-100418](https://insights.sbomify.com/CVE-2026-100418/): Flame through 2.4.0 Information Exposure via GET /api/config (medium 6.9)
- [CVE-2026-100417](https://insights.sbomify.com/CVE-2026-100417/): RustDesk before 1.5.0 One-Way File Transfer Bypass (low 2.3)
- [CVE-2026-100413](https://insights.sbomify.com/CVE-2026-100413/): SeaweedFS: Hard-coded SSH host key can be presented by certain standalone SFTP Helm deployments (high 7.0)
- [CVE-2026-10041](https://insights.sbomify.com/CVE-2026-10041/): Missing authorization in WCFM – Frontend Manager for WooCommerce (medium 4.3)
- [CVE-2026-100409](https://insights.sbomify.com/CVE-2026-100409/): OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths (high 7.5)
- [CVE-2026-100406](https://insights.sbomify.com/CVE-2026-100406/): dbt: Unauthenticated Arbitrary SQL Execution in `dbt docs serve` (high 8.2)
- [CVE-2026-100404](https://insights.sbomify.com/CVE-2026-100404/): Zulip: Guests can read new messages in non-subscribed public channels (medium 6.5)
- [CVE-2026-1004](https://insights.sbomify.com/CVE-2026-1004/): Essential Addons for Elementor <= 6.5.5 - Missing Authorization to Unauthenticated Sensitive Information Exposure (medium 5.3)
- [CVE-2026-100394](https://insights.sbomify.com/CVE-2026-100394/): Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenant (medium 6.5)
- [CVE-2026-100392](https://insights.sbomify.com/CVE-2026-100392/): InvoicePlane: Primary Administrator Privilege Downgrade via `Users::form()` (Missing Object-Level Authorization) (high 7.0)
- [CVE-2026-100391](https://insights.sbomify.com/CVE-2026-100391/): MediaFlow Proxy through 2.4.9 Server-Side Request Forgery via Incomplete Validation (high 8.8)
- [CVE-2026-100390](https://insights.sbomify.com/CVE-2026-100390/): Zoraxy 3.2.3 through 3.3.4 Client IP Spoofing via X-Forwarded-For IPv6 (critical 9.1)
- [CVE-2026-10039](https://insights.sbomify.com/CVE-2026-10039/): Frontend Admin by DynamiApps <= 3.28.28 - Authenticated (Administrator+) SQL Injection via 'order' Parameter (medium 4.9)
- [CVE-2026-100389](https://insights.sbomify.com/CVE-2026-100389/): GestSup before 3.2.62 Remote Code Execution via IMAP Attachment (critical 9.2)
- [CVE-2026-100388](https://insights.sbomify.com/CVE-2026-100388/): RustDesk before 1.5.0 Missing Authorization Check on Incoming File Clipboard Messages (medium 5.3)
- [CVE-2026-100387](https://insights.sbomify.com/CVE-2026-100387/): pgPointcloud through 1.2.5 heap out-of-bounds read via WKB deserialization (high 7.2)
- [CVE-2026-100383](https://insights.sbomify.com/CVE-2026-100383/): Stored i18n XSS in WikiLambda's VisualEditor integration (medium 4.8)
- [CVE-2026-100382](https://insights.sbomify.com/CVE-2026-100382/): Unauthenticated remote code execution through wikitext in ExternalData (critical 10.0)
- [CVE-2026-100381](https://insights.sbomify.com/CVE-2026-100381/): UploadWizard Flickr collection and set titles allow DOM XSS (medium 5.3)
- [CVE-2026-100380](https://insights.sbomify.com/CVE-2026-100380/): Reflected XSS in Wikibase Special:SetLabel language validation (medium 5.3)
- [CVE-2026-10038](https://insights.sbomify.com/CVE-2026-10038/): Missing authorization in Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More (medium 4.3)
- [CVE-2026-100379](https://insights.sbomify.com/CVE-2026-100379/): Cross-request disclosure of CentralAuth cookies in Wikipedia Android App (medium 5.3)
- [CVE-2026-100378](https://insights.sbomify.com/CVE-2026-100378/): Missing permission check in the Translate sandbox doRemind action (medium 5.3)
- [CVE-2026-100377](https://insights.sbomify.com/CVE-2026-100377/): Revision-deleted pages can be viewed through WikiLambda's action=edit and Special:ViewAbstract (medium 6.9)
- [CVE-2026-100376](https://insights.sbomify.com/CVE-2026-100376/): TemplateSandbox can be abused for XSS by asking another user to preview a page with a certain sandbox prefix (medium 4.8)
- [CVE-2026-100373](https://insights.sbomify.com/CVE-2026-100373/): OpenMetadata through 2.0.2 SSRF via Webhook URL Validation Bypass (medium 5.1)
- [CVE-2026-100372](https://insights.sbomify.com/CVE-2026-100372/): ClipBucket v5 before 5.5.3-#197 Path Traversal via template_editor.php (high 8.6)
- [CVE-2026-100371](https://insights.sbomify.com/CVE-2026-100371/): Missing authorization in InvoicePlane (high 8.7)
- [CVE-2026-100370](https://insights.sbomify.com/CVE-2026-100370/): Cross-site scripting in dom-sanitizer (medium 4.7)
- [CVE-2026-10037](https://insights.sbomify.com/CVE-2026-10037/): Sandbox Escape in Ubuntu OpenJDK Packages via xdg-desktop-portal (high 8.8)
- [CVE-2026-100369](https://insights.sbomify.com/CVE-2026-100369/): CliInvoke: Argument Injection in Extensibility Runner Factory (high 8.4)
- [CVE-2026-100368](https://insights.sbomify.com/CVE-2026-100368/): CliInvoke.Specializations: Command injection in PowerShell and Cmd shell wrappers (high 8.4)
- [CVE-2026-10036](https://insights.sbomify.com/CVE-2026-10036/): SpeechBrain < 1.1.1 Arbitrary Code Execution via CKPT.yaml Parsing (high 8.7)
- [CVE-2026-100354](https://insights.sbomify.com/CVE-2026-100354/): kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash (high 7.5)
- [CVE-2026-100353](https://insights.sbomify.com/CVE-2026-100353/): kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter (high 7.5)
- [CVE-2026-100352](https://insights.sbomify.com/CVE-2026-100352/): kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path (high 7.5)
- [CVE-2026-100351](https://insights.sbomify.com/CVE-2026-100351/): kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion (high 7.4)
- [CVE-2026-100350](https://insights.sbomify.com/CVE-2026-100350/): kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression (medium 5.3)
- [CVE-2026-10035](https://insights.sbomify.com/CVE-2026-10035/): Turnkey bbPress by WeaverTheme <= 1.7.1 - Authenticated (Administrator+) PHP Object Injection (medium 6.6)
- [CVE-2026-100349](https://insights.sbomify.com/CVE-2026-100349/): kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content (high 8.2)
- [CVE-2026-100348](https://insights.sbomify.com/CVE-2026-100348/): kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS) (medium 5.3)
- [CVE-2026-100347](https://insights.sbomify.com/CVE-2026-100347/): kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path (medium 5.3)
- [CVE-2026-10034](https://insights.sbomify.com/CVE-2026-10034/): Missing authorization in WP DSGVO Tools (GDPR) (medium 5.3)
- [CVE-2026-10033](https://insights.sbomify.com/CVE-2026-10033/): Missing authorization in EventON Action User (high 7.3)
- [CVE-2026-10032](https://insights.sbomify.com/CVE-2026-10032/): Arbitrary JavaScript Execution via openUrl in @a2ui/web_core (medium 6.1)
- [CVE-2026-100316](https://insights.sbomify.com/CVE-2026-100316/): Cross-site scripting in European VAT Compliance Assistant for WooCommerce (high 7.2)
- [CVE-2026-100315](https://insights.sbomify.com/CVE-2026-100315/): mathurvishal CloudClassroom-PHP-Project mydetailsfaculty.php sql injection (medium 6.9)
- [CVE-2026-100314](https://insights.sbomify.com/CVE-2026-100314/): mathurvishal CloudClassroom-PHP-Project updatedetailsfromstudent.php sql injection (medium 6.9)
- [CVE-2026-100313](https://insights.sbomify.com/CVE-2026-100313/): mathurvishal CloudClassroom-PHP-Project updatequery.php cross site scripting (medium 5.3)
- [CVE-2026-100312](https://insights.sbomify.com/CVE-2026-100312/): mathurvishal CloudClassroom-PHP-Project updateguest.php sql injection (medium 5.3)
- [CVE-2026-100311](https://insights.sbomify.com/CVE-2026-100311/): mathurvishal CloudClassroom-PHP-Project Faculty Video Management managevideos2.php cross site scripting (medium 5.1)
- [CVE-2026-100310](https://insights.sbomify.com/CVE-2026-100310/): GNU libextractor before 1.16 Privilege Escalation via LIBEXTRACTOR_PREFIX (high 7.3)
- [CVE-2026-10031](https://insights.sbomify.com/CVE-2026-10031/): SFTPGo < 2.7.4 Permission Bypass via Symbolic Link Creation (medium 5.3)
- [CVE-2026-100308](https://insights.sbomify.com/CVE-2026-100308/): GluonTS arbitrary command execution during model deserialization (high 8.4)
- [CVE-2026-100306](https://insights.sbomify.com/CVE-2026-100306/): TDuck survey form through 6.0 Write Password Bypass via Client-Side Enforcement (medium 6.9)
- [CVE-2026-100305](https://insights.sbomify.com/CVE-2026-100305/): TDuck survey form through 6.0 Fill-In Restriction Bypass via Authenticated Submission Endpoint (medium 5.3)
- [CVE-2026-100304](https://insights.sbomify.com/CVE-2026-100304/): TDuck survey form 6.0 Information Disclosure via Fail-Open Form Ownership Check (medium 6.0)
- [CVE-2026-100303](https://insights.sbomify.com/CVE-2026-100303/): TDuck survey form through 6.0 Missing Authorization in Form Theme Management Endpoints (medium 5.3)
- [CVE-2026-10030](https://insights.sbomify.com/CVE-2026-10030/): IBM MQ Console is vulnerable to privilege escalation (high 7.1)
- [CVE-2026-1003](https://insights.sbomify.com/CVE-2026-1003/): Missing authorization in GetGenie – AI Content Writer with Keyword Research & SEO Tracking Tools (medium 4.3)
- [CVE-2026-100299](https://insights.sbomify.com/CVE-2026-100299/): Use of Weak Credentials in Anjvision YSSD-RTMP-H5 (high 7.0)
- [CVE-2026-100298](https://insights.sbomify.com/CVE-2026-100298/): Insufficiently Protected Credentials in Anjvision YSSD-RTMP-H5 (high 8.7)
- [CVE-2026-100297](https://insights.sbomify.com/CVE-2026-100297/): Server-Side request forgery (SSRF) in Anjvision YSSD-RTMP-H5 (medium 6.9)
- [CVE-2026-100296](https://insights.sbomify.com/CVE-2026-100296/): Improper Check for Unusual or Exceptional Conditions in Anjvision YSSD-RTMP-H5 (high 7.2)
- [CVE-2026-100295](https://insights.sbomify.com/CVE-2026-100295/): Active debug code in Anjvision YSSD-RTMP-H5 (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/1003/