# Vulnerabilities published in 2026


- [CVE-2026-0752](https://insights.sbomify.com/CVE-2026-0752/): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (high 8.0)
- [CVE-2026-0751](https://insights.sbomify.com/CVE-2026-0751/): Cross-site scripting in Payment Page | Payment Form for Stripe (medium 6.4)
- [CVE-2026-0750](https://insights.sbomify.com/CVE-2026-0750/): Payment bypass in Commerce Paybox (high 8.7)
- [CVE-2026-0749](https://insights.sbomify.com/CVE-2026-0749/): Cross-Site Scripting Vulnerability in Drupal Form Builder Module (medium 4.8)
- [CVE-2026-0748](https://insights.sbomify.com/CVE-2026-0748/): Access bypass in Drupal 7 i18n_node translation UI (medium 5.3)
- [CVE-2026-0747](https://insights.sbomify.com/CVE-2026-0747/): Information disclosure in Remote Desktop Manager (low 3.3)
- [CVE-2026-0746](https://insights.sbomify.com/CVE-2026-0746/): AI Engine <= 3.3.2 - Authenticated (Subscriber+) Server-Side Request Forgery (medium 6.4)
- [CVE-2026-0745](https://insights.sbomify.com/CVE-2026-0745/): Server-side request forgery in User Language Switch (medium 5.5)
- [CVE-2026-0743](https://insights.sbomify.com/CVE-2026-0743/): WP Content Permission <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'ohmem-message' Parameter (medium 4.4)
- [CVE-2026-0742](https://insights.sbomify.com/CVE-2026-0742/): Cross-site scripting in Smart Appointment & Booking (medium 6.4)
- [CVE-2026-0741](https://insights.sbomify.com/CVE-2026-0741/): Cross-site scripting in Electric Studio Download Counter (medium 4.4)
- [CVE-2026-0740](https://insights.sbomify.com/CVE-2026-0740/): Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2026-0739](https://insights.sbomify.com/CVE-2026-0739/): WMF Mobile Redirector <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Parameters (medium 4.4)
- [CVE-2026-0738](https://insights.sbomify.com/CVE-2026-0738/): Shortcodes Ultimate <= 7.4.8 - authenticated (Contributor+) Stored Cross-Site Scripting via 'su_carousel' Shortcode (medium 6.4)
- [CVE-2026-0737](https://insights.sbomify.com/CVE-2026-0737/): Shortcodes Ultimate <= 7.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'su_lightbox' Shortcode (medium 6.4)
- [CVE-2026-0736](https://insights.sbomify.com/CVE-2026-0736/): Cross-site scripting in Chatbot for WordPress by Collect.chat ⚡️ (medium 6.4)
- [CVE-2026-0735](https://insights.sbomify.com/CVE-2026-0735/): Cross-site scripting in User Language Switch (medium 4.4)
- [CVE-2026-0734](https://insights.sbomify.com/CVE-2026-0734/): WP Allowed Hosts <= 1.0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'allowed-hosts' Parameter (medium 4.4)
- [CVE-2026-0733](https://insights.sbomify.com/CVE-2026-0733/): PHPGurukul Online Course Registration System manage-students.php sql injection (medium 5.3)
- [CVE-2026-0732](https://insights.sbomify.com/CVE-2026-0732/): D-Link DI-8200G upgrade_filter.asp command injection (medium 5.3)
- [CVE-2026-0731](https://insights.sbomify.com/CVE-2026-0731/): TOTOLINK WA1200 HTTP Request cstecgi.cgi null pointer dereference (medium 6.9)
- [CVE-2026-0730](https://insights.sbomify.com/CVE-2026-0730/): PHPGurukul Staff Leave Management System SVG File adminviews.py UPDATE_STAFF cross site scripting (medium 4.8)
- [CVE-2026-0729](https://insights.sbomify.com/CVE-2026-0729/): code-projects Intern Membership Management System add_activity.php sql injection (medium 5.1)
- [CVE-2026-0728](https://insights.sbomify.com/CVE-2026-0728/): code-projects Intern Membership Management System delete_admin.php sql injection (medium 5.1)
- [CVE-2026-0727](https://insights.sbomify.com/CVE-2026-0727/): Missing authorization in Accordion and Accordion Slider (medium 5.4)
- [CVE-2026-0726](https://insights.sbomify.com/CVE-2026-0726/): Deserialization in Nexter Extension – Security, Performance, Code Snippets & Site Toolkit (high 8.1)
- [CVE-2026-0725](https://insights.sbomify.com/CVE-2026-0725/): Cross-site scripting in Integrate Dynamics 365 CRM (medium 4.4)
- [CVE-2026-0724](https://insights.sbomify.com/CVE-2026-0724/): Cross-site scripting in WPlyr Media Block (medium 4.4)
- [CVE-2026-0723](https://insights.sbomify.com/CVE-2026-0723/): Unchecked Return Value in GitLab (high 7.4)
- [CVE-2026-0722](https://insights.sbomify.com/CVE-2026-0722/): Shield Security <= 21.0.8 - Cross-Site Request Forgery to SQL Injection (medium 6.5)
- [CVE-2026-0719](https://insights.sbomify.com/CVE-2026-0719/): Libsoup: signed to unsigned conversion error leading to stack-based buffer overflow in libsoup ntlm authentication (high 8.6)
- [CVE-2026-0718](https://insights.sbomify.com/CVE-2026-0718/): Missing authorization in Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX (medium 5.3)
- [CVE-2026-0717](https://insights.sbomify.com/CVE-2026-0717/): LottieFiles – Lottie block for Gutenberg <= 3.0.0 - Unauthenticated Sensitive Information Exposure (medium 5.3)
- [CVE-2026-0716](https://insights.sbomify.com/CVE-2026-0716/): Libsoup: out-of-bounds read in libsoup websocket frame processing (medium 4.8)
- [CVE-2026-0715](https://insights.sbomify.com/CVE-2026-0715/): Information disclosure in UC-1200A Series (high 7.0)
- [CVE-2026-0714](https://insights.sbomify.com/CVE-2026-0714/): Information disclosure in UC-1200A Series (high 7.0)
- [CVE-2026-0711](https://insights.sbomify.com/CVE-2026-0711/): Command injection in DX3300-T0 firmware (medium 6.8)
- [CVE-2026-0710](https://insights.sbomify.com/CVE-2026-0710/): Sipp/sipp: sipp: denial of service and potential arbitrary code execution vulnerability (high 8.4)
- [CVE-2026-0709](https://insights.sbomify.com/CVE-2026-0709/): Command injection in DS-3WAP521-SI (high 7.2)
- [CVE-2026-0708](https://insights.sbomify.com/CVE-2026-0708/): Libucl: libucl: denial of service via embedded null byte in ucl input (high 8.3)
- [CVE-2026-0707](https://insights.sbomify.com/CVE-2026-0707/): Keycloak: keycloak authorization header parsing leading to potential security control bypass (medium 5.3)
- [CVE-2026-0705](https://insights.sbomify.com/CVE-2026-0705/): Privilege escalation in Acronis Cloud Manager (medium 6.7)
- [CVE-2026-0704](https://insights.sbomify.com/CVE-2026-0704/): Path traversal in Octopus Server (medium 5.9)
- [CVE-2026-0703](https://insights.sbomify.com/CVE-2026-0703/): Cross-site scripting in NextMove Lite – Thank You Page for WooCommerce (medium 6.4)
- [CVE-2026-0702](https://insights.sbomify.com/CVE-2026-0702/): VidShop – Shoppable Videos for WooCommerce <= 1.1.4 - Unauthenticated Time-Based SQL Injection via 'fields' (high 7.5)
- [CVE-2026-0701](https://insights.sbomify.com/CVE-2026-0701/): code-projects Intern Membership Management System add_admin.php sql injection (medium 5.1)
- [CVE-2026-0700](https://insights.sbomify.com/CVE-2026-0700/): code-projects Intern Membership Management System check_admin.php sql injection (medium 6.9)
- [CVE-2026-0699](https://insights.sbomify.com/CVE-2026-0699/): code-projects Intern Membership Management System edit_activity.php sql injection (medium 5.1)
- [CVE-2026-0698](https://insights.sbomify.com/CVE-2026-0698/): code-projects Intern Membership Management System edit_students.php sql injection (medium 5.1)
- [CVE-2026-0697](https://insights.sbomify.com/CVE-2026-0697/): code-projects Intern Membership Management System edit_admin.php sql injection (medium 5.1)
- [CVE-2026-0696](https://insights.sbomify.com/CVE-2026-0696/): Session Cookies Missing HttpOnly Attribute (medium 6.5)
- [CVE-2026-0695](https://insights.sbomify.com/CVE-2026-0695/): Stored XSS in Time Entry Audit Trail (high 8.7)
- [CVE-2026-0694](https://insights.sbomify.com/CVE-2026-0694/): SearchWiz <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title (medium 6.4)
- [CVE-2026-0693](https://insights.sbomify.com/CVE-2026-0693/): Cross-site scripting in Allow HTML in Category Descriptions (medium 4.4)
- [CVE-2026-0692](https://insights.sbomify.com/CVE-2026-0692/): Missing authorization in BlueSnap Payment Gateway for WooCommerce (high 7.5)
- [CVE-2026-0691](https://insights.sbomify.com/CVE-2026-0691/): CM E-Mail Blacklist <= 1.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'black_email' Parameter (medium 4.4)
- [CVE-2026-0690](https://insights.sbomify.com/CVE-2026-0690/): Cross-site scripting in FlatPM – Ad Manager, AdSense and Custom Code (medium 6.4)
- [CVE-2026-0689](https://insights.sbomify.com/CVE-2026-0689/): XIQ‑SE NAC Admin Credential Exposure via HTTP Response (medium 6.0)
- [CVE-2026-0688](https://insights.sbomify.com/CVE-2026-0688/): Webmention <= 5.6.2 - Authenticated (Subscriber+) Server-Side Request Forgery (medium 6.4)
- [CVE-2026-0687](https://insights.sbomify.com/CVE-2026-0687/): Meta-box GalleryMeta <= 3.0.1 - Missing Authorization to Authenticated (Author+) Gallery Management (medium 4.3)
- [CVE-2026-0686](https://insights.sbomify.com/CVE-2026-0686/): Webmention <= 5.6.2 - Unauthenticated Blind Server-Side Request Forgery (high 7.2)
- [CVE-2026-0685](https://insights.sbomify.com/CVE-2026-0685/): Server side template inject (SSTI) in Edgewall Genshi Template Engine (critical 9.8)
- [CVE-2026-0684](https://insights.sbomify.com/CVE-2026-0684/): CP Image Store with Slideshow <= 1.1.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Product Import (medium 4.3)
- [CVE-2026-0683](https://insights.sbomify.com/CVE-2026-0683/): SQL injection in SupportCandy – Helpdesk & Customer Support Ticket System (medium 6.5)
- [CVE-2026-0682](https://insights.sbomify.com/CVE-2026-0682/): Church Admin <= 5.0.28 - Authenticated (Administrator+) Blind Server-Side Request Forgery via 'audio_url' Parameter (low 2.2)
- [CVE-2026-0681](https://insights.sbomify.com/CVE-2026-0681/): Extended Random Number Generator <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings (medium 4.4)
- [CVE-2026-0680](https://insights.sbomify.com/CVE-2026-0680/): Real Post Slider Lite <= 2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings (medium 4.4)
- [CVE-2026-0679](https://insights.sbomify.com/CVE-2026-0679/): Missing authorization in Fortis for WooCommerce (medium 5.3)
- [CVE-2026-0678](https://insights.sbomify.com/CVE-2026-0678/): Shipping Rates by City for WooCommerce <= 1.0.3 - Authenticated (Shop Manager+) SQL Injection via 'cities' Parameter (medium 4.9)
- [CVE-2026-0677](https://insights.sbomify.com/CVE-2026-0677/): WordPress TotalContest Lite plugin <= 2.9.1 - PHP Object Injection vulnerability (medium 6.3)
- [CVE-2026-0676](https://insights.sbomify.com/CVE-2026-0676/): WordPress Zorka theme <= 1.5.7 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-0674](https://insights.sbomify.com/CVE-2026-0674/): WordPress Campaign Monitor for WordPress plugin <= 2.9.1 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-0673](https://insights.sbomify.com/CVE-2026-0673/): Element Pack Addons for Elementor <= 8.3.15 - Unauthenticated SMTP Header Injection (medium 5.3)
- [CVE-2026-0672](https://insights.sbomify.com/CVE-2026-0672/): Header injection in http.cookies.Morsel (medium 6.0)
- [CVE-2026-0671](https://insights.sbomify.com/CVE-2026-0671/): Multiple stored i18n/message-key XSSes in UploadWizard (medium 6.1)
- [CVE-2026-0670](https://insights.sbomify.com/CVE-2026-0670/): Stored XSS through a system message and a user-provided parameter in ProofreadPage (medium 6.1)
- [CVE-2026-0669](https://insights.sbomify.com/CVE-2026-0669/): Path Traversal vulnerability in CSS extension on certain web servers (high 7.5)
- [CVE-2026-0668](https://insights.sbomify.com/CVE-2026-0668/): VisualData extension: Regular Expression Denial of Service (ReDoS) via crafted user input (medium 5.3)
- [CVE-2026-0667](https://insights.sbomify.com/CVE-2026-0667/): Other in RemoteConnect (critical 9.3)
- [CVE-2026-0665](https://insights.sbomify.com/CVE-2026-0665/): Qemu-kvm: heap off-by-one in kvm xen physdevop_map_pirq (medium 6.5)
- [CVE-2026-0664](https://insights.sbomify.com/CVE-2026-0664/): Royal Elementor Addons <= 1.7.1049 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API Meta Bypass (medium 6.4)
- [CVE-2026-0663](https://insights.sbomify.com/CVE-2026-0663/): Denial of Service condition in M-Files Server (medium 6.9)
- [CVE-2026-0662](https://insights.sbomify.com/CVE-2026-0662/): Untrusted Search Path Vulnerability when opening max Files (high 7.8)
- [CVE-2026-0661](https://insights.sbomify.com/CVE-2026-0661/): Out-of-Bounds Write in RGB File Parsing (high 8.4)
- [CVE-2026-0660](https://insights.sbomify.com/CVE-2026-0660/): Stack Based Buffer Overflow in GIF File Parsing (high 8.4)
- [CVE-2026-0659](https://insights.sbomify.com/CVE-2026-0659/): USD File Parsing Out-of-Bounds Write Vulnerability (high 7.8)
- [CVE-2026-0658](https://insights.sbomify.com/CVE-2026-0658/): Five Star Restaurant Reservations < 2.7.9 - Arbitrary Bookings Deletion via CSRF (medium 4.3)
- [CVE-2026-0656](https://insights.sbomify.com/CVE-2026-0656/): Missing authorization in iPaymu Payment Gateway for WooCommerce (high 8.2)
- [CVE-2026-0655](https://insights.sbomify.com/CVE-2026-0655/): Path Traversal on TP-Link Deco BE25 (medium 6.9)
- [CVE-2026-0654](https://insights.sbomify.com/CVE-2026-0654/): Command injection on TP-Link Deco BE25 (high 8.5)
- [CVE-2026-0653](https://insights.sbomify.com/CVE-2026-0653/): Insecure Access Control on TP-Link Tapo D235 and C260 (high 7.2)
- [CVE-2026-0652](https://insights.sbomify.com/CVE-2026-0652/): Remote Code Execution on TP-Link Tapo C260 by Guest User (high 8.7)
- [CVE-2026-0651](https://insights.sbomify.com/CVE-2026-0651/): Path Traversal on TP-Link Tapo D235, C211, C520WS and C260 via Local https (medium 6.9)
- [CVE-2026-0650](https://insights.sbomify.com/CVE-2026-0650/): OpenFlagr <= 1.1.18 Authentication Bypass via Prefix Whitelist Path Normalization (critical 9.3)
- [CVE-2026-0649](https://insights.sbomify.com/CVE-2026-0649/): invoiceninja Migration Import Import.php copy server-side request forgery (medium 5.1)
- [CVE-2026-0648](https://insights.sbomify.com/CVE-2026-0648/): Memory corruption in Eclipse ThreadX (high 7.8)
- [CVE-2026-0647](https://insights.sbomify.com/CVE-2026-0647/): Rockwell Automation FLEX I/O Dual-port EtherNet/IP Adapters – Multiple Vulnerabilities (high 8.8)
- [CVE-2026-0646](https://insights.sbomify.com/CVE-2026-0646/): Rockwell Automation FLEX I/O Dual-port EtherNet/IP Adapters – Multiple Vulnerabilities (high 8.7)
- [CVE-2026-0643](https://insights.sbomify.com/CVE-2026-0643/): projectworlds House Rental and Property Listing Signup register.php unrestricted upload (medium 6.9)
- [CVE-2026-0642](https://insights.sbomify.com/CVE-2026-0642/): projectworlds House Rental and Property Listing complaint.php cross site scripting (medium 4.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/1008/