# Vulnerabilities published in 2026


- [CVE-2026-97241](https://insights.sbomify.com/CVE-2026-97241/): WordPress BackupEase plugin <= 2.2.2 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2026-97240](https://insights.sbomify.com/CVE-2026-97240/): WordPress StifLi Backup Tools plugin <= 2.2.7 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2026-9724](https://insights.sbomify.com/CVE-2026-9724/): MotorDesk <= 1.1.2 - Cross-Site Request Forgery to Settings Update (medium 4.3)
- [CVE-2026-97239](https://insights.sbomify.com/CVE-2026-97239/): WordPress MCP Content Manager Lite plugin <= 1.1.0 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-97238](https://insights.sbomify.com/CVE-2026-97238/): WordPress JetEngine plugin <= 3.8.14.3 - Cross Site Scripting (XSS) vulnerability (medium 5.5)
- [CVE-2026-97237](https://insights.sbomify.com/CVE-2026-97237/): WordPress JetEngine plugin <= 3.8.14.3 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-97236](https://insights.sbomify.com/CVE-2026-97236/): WordPress ThemeREX Addons plugin < 2.45.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-97235](https://insights.sbomify.com/CVE-2026-97235/): WordPress ThemeREX Addons plugin < 2.45.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-97233](https://insights.sbomify.com/CVE-2026-97233/): volotat Anagnorisis Media Filename PlaylistManager.js html cross site scripting (medium 5.1)
- [CVE-2026-97232](https://insights.sbomify.com/CVE-2026-97232/): volotat Anagnorisis page.html start_streaming path traversal (medium 5.3)
- [CVE-2026-97231](https://insights.sbomify.com/CVE-2026-97231/): volotat Anagnorisis Socket.IO Connect app.py missing authentication (medium 6.9)
- [CVE-2026-97230](https://insights.sbomify.com/CVE-2026-97230/): IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated URL. (critical 9.8)
- [CVE-2026-9723](https://insights.sbomify.com/CVE-2026-9723/): Google Plus One Bottom <= 0.0.2 - Cross-Site Request Forgery to Plugin Settings Update via Settings Page (medium 4.3)
- [CVE-2026-97229](https://insights.sbomify.com/CVE-2026-97229/): GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound (critical 10.0, exploited in the wild)
- [CVE-2026-97228](https://insights.sbomify.com/CVE-2026-97228/): Rapid7 Bulk Export MCP — GraphQL Query Injection in Export Status Lookup (low 2.7)
- [CVE-2026-97227](https://insights.sbomify.com/CVE-2026-97227/): NextScripts: Social Networks Auto-Poster < 4.4.8 - Authenticated Social Account Credential Disclosure and Data Deletion (medium 5.9)
- [CVE-2026-97226](https://insights.sbomify.com/CVE-2026-97226/): DbGate files-style Endpoint files.js fs.readFile path traversal (medium 5.3)
- [CVE-2026-97225](https://insights.sbomify.com/CVE-2026-97225/): DbGate JSON Runner runners.js code injection (medium 5.3)
- [CVE-2026-97224](https://insights.sbomify.com/CVE-2026-97224/): Excalidraw Imported File restore.ts cross site scripting (medium 5.3)
- [CVE-2026-97222](https://insights.sbomify.com/CVE-2026-97222/): Gnumeric: gnumeric: heap use-after-free when opening a malformed workbook (medium 5.5)
- [CVE-2026-9722](https://insights.sbomify.com/CVE-2026-9722/): Laiser Tag <= 1.2.5 - Cross-Site Request Forgery to Plugin Settings Update via Settings Form (medium 4.3)
- [CVE-2026-97219](https://insights.sbomify.com/CVE-2026-97219/): MStore API 4.21.1 - 4.22.0 - Subscriber+ Payment Bypass via 'status' Parameter (medium 4.3)
- [CVE-2026-97212](https://insights.sbomify.com/CVE-2026-97212/): Monta monta.app Insufficient Session Expiration (medium 6.9)
- [CVE-2026-9721](https://insights.sbomify.com/CVE-2026-9721/): Book a Room Event Calendar <= 1.9 - Cross-Site Request Forgery to Settings Update (medium 4.3)
- [CVE-2026-97208](https://insights.sbomify.com/CVE-2026-97208/): Gitea push mirror API bypass of DISABLE_NEW_PUSH policy (medium 4.9)
- [CVE-2026-97206](https://insights.sbomify.com/CVE-2026-97206/): DNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployments. (high 7.5)
- [CVE-2026-97205](https://insights.sbomify.com/CVE-2026-97205/): NGINX ngx_http_core_module vulnerability (critical 9.2)
- [CVE-2026-97204](https://insights.sbomify.com/CVE-2026-97204/): Gitea label deletion across repository and organization IDs (low 3.1)
- [CVE-2026-97200](https://insights.sbomify.com/CVE-2026-97200/): Unbounded response body buffering and decompression in hackney (high 8.2)
- [CVE-2026-9720](https://insights.sbomify.com/CVE-2026-9720/): Facturación Electrónica Costa Rica <= 2.0.2 - Cross-Site Request Forgery to Plugin Settings Update (medium 4.3)
- [CVE-2026-97197](https://insights.sbomify.com/CVE-2026-97197/): WordPress WordPress Backup & Migration plugin <= 1.6.0 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-97196](https://insights.sbomify.com/CVE-2026-97196/): WordPress GiveWP plugin <= 4.16.9 - Broken Authentication vulnerability (critical 9.1)
- [CVE-2026-9719](https://insights.sbomify.com/CVE-2026-9719/): LatePoint <= 5.6.0 - Cross-Site Request Forgery via invoices__change_status Action (medium 4.3)
- [CVE-2026-97188](https://insights.sbomify.com/CVE-2026-97188/): String Locator < 2.6.8 - Unauthenticated PHP Object Injection via Database Editor (high 8.8)
- [CVE-2026-97185](https://insights.sbomify.com/CVE-2026-97185/): Gimp: gimp: out-of-bounds write in gimpressionist plugin via crafted preset file (high 7.8)
- [CVE-2026-97183](https://insights.sbomify.com/CVE-2026-97183/): WP-Invoice <= 4.3.1 - Subscriber+ User PII Disclosure via Unprotected AJAX Handlers (medium 4.3)
- [CVE-2026-97182](https://insights.sbomify.com/CVE-2026-97182/): halo-dev Halo SpEL ReplyNotificationSubscriptionHelper.java neutralization (medium 6.9)
- [CVE-2026-97181](https://insights.sbomify.com/CVE-2026-97181/): ezGlobal｜GPM LIGHT - Sensitive Data Exposure (medium 6.9)
- [CVE-2026-9718](https://insights.sbomify.com/CVE-2026-9718/): Denial of service in PowerLogic™ P7 (medium 6.9)
- [CVE-2026-97179](https://insights.sbomify.com/CVE-2026-97179/): O2OA Cipher Connection CipherConnectionAction.java list information disclosure (medium 5.3)
- [CVE-2026-97177](https://insights.sbomify.com/CVE-2026-97177/): Keycloak-services: keycloak-services: generic user update bypasses denied reset-password permission (medium 6.6)
- [CVE-2026-97176](https://insights.sbomify.com/CVE-2026-97176/): Keycloak-services: keycloak-services: essential acr requirement silently bypassed via cookie authenticator (medium 4.2)
- [CVE-2026-9717](https://insights.sbomify.com/CVE-2026-9717/): Command injection in PowerLogic™ P7 (high 8.6)
- [CVE-2026-97165](https://insights.sbomify.com/CVE-2026-97165/): Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension < 6.5.0 (medium 5.3)
- [CVE-2026-97164](https://insights.sbomify.com/CVE-2026-97164/): Joomla Extension - svenbluege.de - Path Traversal in Clear Cache task in Event Gallery extension < 6.5.0 (high 7.0)
- [CVE-2026-97163](https://insights.sbomify.com/CVE-2026-97163/): Path traversal in UP plugin for Joomla (critical 10.0)
- [CVE-2026-97162](https://insights.sbomify.com/CVE-2026-97162/): Joomla Extension - lomart.fr - Various SQL injection vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29 (high 8.3)
- [CVE-2026-97161](https://insights.sbomify.com/CVE-2026-97161/): Path traversal in UP plugin for Joomla (critical 9.2)
- [CVE-2026-97160](https://insights.sbomify.com/CVE-2026-97160/): Code injection in UP plugin for Joomla (critical 9.4)
- [CVE-2026-9716](https://insights.sbomify.com/CVE-2026-9716/): Null dereference in PowerLogic™ P7 (high 8.7)
- [CVE-2026-97155](https://insights.sbomify.com/CVE-2026-97155/): Security feature bypass in Folio Client (medium 6.5)
- [CVE-2026-97152](https://insights.sbomify.com/CVE-2026-97152/): Memory corruption in Nanomsg (high 8.6)
- [CVE-2026-97151](https://insights.sbomify.com/CVE-2026-97151/): Code injection in mammoth.js (high 8.4)
- [CVE-2026-97150](https://insights.sbomify.com/CVE-2026-97150/): Code injection in BcAddonMigrator (high 8.6)
- [CVE-2026-97149](https://insights.sbomify.com/CVE-2026-97149/): Security feature bypass in Swift (medium 5.3)
- [CVE-2026-97147](https://insights.sbomify.com/CVE-2026-97147/): Missing authorization in Mistral (high 7.2)
- [CVE-2026-97146](https://insights.sbomify.com/CVE-2026-97146/): Apache YuniKorn: Admission control bypass via system label forgery (medium 4.8)
- [CVE-2026-9714](https://insights.sbomify.com/CVE-2026-9714/): Simple Divi Shortcode <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute (medium 6.4)
- [CVE-2026-9713](https://insights.sbomify.com/CVE-2026-9713/): SQL injection in Product Designer for WooCommerce WordPress | Lumise (high 7.5)
- [CVE-2026-9712](https://insights.sbomify.com/CVE-2026-9712/): Insecure direct object reference (low 3.8)
- [CVE-2026-9711](https://insights.sbomify.com/CVE-2026-9711/): EventON - WordPress Virtual Event Calendar Plugin <= 5.0.11 - Unauthenticated Blind SQL Injection via Search Parameter (critical 9.8)
- [CVE-2026-9710](https://insights.sbomify.com/CVE-2026-9710/): Themeco Cornerstone < 7.8.8 (Premium, bundled with X Theme) - Subscriber+ Arbitrary User Password Hash Disclosure (high 7.7)
- [CVE-2026-9709](https://insights.sbomify.com/CVE-2026-9709/): Themeco Cornerstone < 7.8.9 (Premium, bundled with X Theme) - Subscriber+ Arbitrary User Meta Disclosure (high 7.7)
- [CVE-2026-9708](https://insights.sbomify.com/CVE-2026-9708/): Incoming webhook user attribution via unvalidated webhook owner (medium 4.9)
- [CVE-2026-97079](https://insights.sbomify.com/CVE-2026-97079/): WordPress Webba Booking plugin <= 6.5.0 - Insecure Direct Object References (IDOR) vulnerability (medium 4.3)
- [CVE-2026-97078](https://insights.sbomify.com/CVE-2026-97078/): Missing authorization in Client Invoicing by Sprout Invoices (medium 5.3)
- [CVE-2026-97077](https://insights.sbomify.com/CVE-2026-97077/): WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-97076](https://insights.sbomify.com/CVE-2026-97076/): WordPress WP Rocket plugin < 3.23.5 - Denial of Service Attack vulnerability (high 7.5)
- [CVE-2026-97075](https://insights.sbomify.com/CVE-2026-97075/): WordPress WP Rocket plugin < 3.23.5 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-97074](https://insights.sbomify.com/CVE-2026-97074/): Missing authorization in Newsletters, Email Marketing, SMS and Popups by Omnisend (medium 4.3)
- [CVE-2026-97073](https://insights.sbomify.com/CVE-2026-97073/): WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-97071](https://insights.sbomify.com/CVE-2026-97071/): WordPress CURCY plugin <= 2.2.17 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-97070](https://insights.sbomify.com/CVE-2026-97070/): WordPress Cozy Blocks plugin <= 2.2.23 - Insecure Direct Object References (IDOR) vulnerability (medium 6.9)
- [CVE-2026-97067](https://insights.sbomify.com/CVE-2026-97067/): WordPress EWWW Image Optimizer plugin <= 8.7.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-97066](https://insights.sbomify.com/CVE-2026-97066/): WordPress GiveWP plugin <= 4.16.9 - Insecure Direct Object References (IDOR) vulnerability (medium 5.3)
- [CVE-2026-97065](https://insights.sbomify.com/CVE-2026-97065/): WordPress Happyforms plugin <= 1.26.15 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-97064](https://insights.sbomify.com/CVE-2026-97064/): X-SpringBoot through 6.0 Authentication Bypass via Static Master Code (critical 9.3)
- [CVE-2026-97063](https://insights.sbomify.com/CVE-2026-97063/): X-SpringBoot through 6.0 Authentication Bypass via Login Code (critical 9.3)
- [CVE-2026-97062](https://insights.sbomify.com/CVE-2026-97062/): Aureus ERP 1.6.0 Stored XSS via SVG File Upload (medium 5.1)
- [CVE-2026-97061](https://insights.sbomify.com/CVE-2026-97061/): Black Candy through 3.2.1 Information Disclosure via Playlist Search (medium 5.3)
- [CVE-2026-97060](https://insights.sbomify.com/CVE-2026-97060/): X-SpringBoot through 6.0 Authorization Bypass via User Management (high 8.6)
- [CVE-2026-97059](https://insights.sbomify.com/CVE-2026-97059/): DCMTK through 3.7.0 Heap Over-read via NumberOfFrames (high 8.8)
- [CVE-2026-97057](https://insights.sbomify.com/CVE-2026-97057/): redis-parser through 3.0.0 Denial of Service via Invalid Array Length (high 8.7)
- [CVE-2026-97056](https://insights.sbomify.com/CVE-2026-97056/): SigNoz before 0.143.0 Insufficient Session Expiration Authentication Bypass (high 7.6)
- [CVE-2026-97055](https://insights.sbomify.com/CVE-2026-97055/): SigNoz before 0.143.0 Authentication Bypass via Empty JWT Secret (critical 9.2)
- [CVE-2026-9705](https://insights.sbomify.com/CVE-2026-9705/): Keycloak: keycloak: attacker can re-enable and take over disabled clients via registration access token (medium 6.5)
- [CVE-2026-97045](https://insights.sbomify.com/CVE-2026-97045/): Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net (not scored)
- [CVE-2026-9704](https://insights.sbomify.com/CVE-2026-9704/): Keycloak: keycloak: privilege escalation due to oversized subject_token jwt (medium 6.8)
- [CVE-2026-97032](https://insights.sbomify.com/CVE-2026-97032/): HTTP/2 server crash due to HPACK encoder race in net/http (high 7.5)
- [CVE-2026-97031](https://insights.sbomify.com/CVE-2026-97031/): Reject malformed ECH outer extension references in crypto/tls (high 7.5)
- [CVE-2026-97030](https://insights.sbomify.com/CVE-2026-97030/): Recognize yield as regexp preceder keyword in html/template (medium 6.1)
- [CVE-2026-9703](https://insights.sbomify.com/CVE-2026-9703/): Viewer role can create, modify and delete Loki alerting rules (high 7.1)
- [CVE-2026-97029](https://insights.sbomify.com/CVE-2026-97029/): Flatpak: flatpak: sandboxed app can signal unsandboxed processes in the same process group (medium 5.7)
- [CVE-2026-97027](https://insights.sbomify.com/CVE-2026-97027/): Flatpak: flatpak: denial of service via unsanitized keys in exported desktop entry / d-bus service files (low 3.6)
- [CVE-2026-97026](https://insights.sbomify.com/CVE-2026-97026/): Flatpak: flatpak: world-writable temporary child repositories in system-helper cache path (low 3.9)
- [CVE-2026-97025](https://insights.sbomify.com/CVE-2026-97025/): Flatpak: flatpak: world-readable oci authentication token in system-helper cache path (low 3.2)
- [CVE-2026-97024](https://insights.sbomify.com/CVE-2026-97024/): Flatpak: flatpak: arbitrary write in root context via path traversal in deploy directory files/etc (high 7.1)
- [CVE-2026-97023](https://insights.sbomify.com/CVE-2026-97023/): Flatpak: flatpak: arbitrary file deletion in root context via path traversal in deploy directory export/bin (high 7.1)
- [CVE-2026-97020](https://insights.sbomify.com/CVE-2026-97020/): PO/MO Editor <= 1.4.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'podata' Parameter (medium 6.4)
- [CVE-2026-9702](https://insights.sbomify.com/CVE-2026-9702/): InPost PL < 1.9.1 - Unauthenticated WooCommerce Order Parcel-Locker Hijacking (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/220/