# Vulnerabilities published in 2026 - [CVE-2026-96879](https://insights.sbomify.com/CVE-2026-96879/): "Checked by" label in page history should not be shown if the underlying review log entry is suppressed" (medium 6.9) - [CVE-2026-96878](https://insights.sbomify.com/CVE-2026-96878/): Cargo Exhibit field alias allows stored XSS (medium 6.9) - [CVE-2026-96877](https://insights.sbomify.com/CVE-2026-96877/): Reflected XSS through Cargo Drilldown full-text search (medium 6.9) - [CVE-2026-96876](https://insights.sbomify.com/CVE-2026-96876/): Anonymous reflected XSS in CargoExport invalid-alias errors (medium 6.9) - [CVE-2026-96875](https://insights.sbomify.com/CVE-2026-96875/): Reflected XSS in Cargo Drilldown hierarchy filters (medium 6.9) - [CVE-2026-96874](https://insights.sbomify.com/CVE-2026-96874/): Stored XSS in Cargo Drilldown tab names (low 2.3) - [CVE-2026-96873](https://insights.sbomify.com/CVE-2026-96873/): Reflected XSS in CirrusSearch debug explain output (medium 5.5) - [CVE-2026-96872](https://insights.sbomify.com/CVE-2026-96872/): WikiLambda public function execution bypasses the unsaved-code permission through nested Z825 compositions (low 2.9) - [CVE-2026-96871](https://insights.sbomify.com/CVE-2026-96871/): Mang Board <= 2.4.2 - Unauthenticated Stored Cross-Site Scripting via 'data_type' Parameter (high 7.2) - [CVE-2026-96870](https://insights.sbomify.com/CVE-2026-96870/): SureDash <= 1.12.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter (medium 6.4) - [CVE-2026-96869](https://insights.sbomify.com/CVE-2026-96869/): Information disclosure in the Networking component (medium 4.3) - [CVE-2026-96868](https://insights.sbomify.com/CVE-2026-96868/): Windows Kernel Elevation of Privilege Vulnerability (high 7.0) - [CVE-2026-96867](https://insights.sbomify.com/CVE-2026-96867/): Windows NTFS Remote Code Execution Vulnerability (high 7.8) - [CVE-2026-96866](https://insights.sbomify.com/CVE-2026-96866/): Network Device Enrollment Service (NDES) Denial of Service Vulnerability (high 7.5) - [CVE-2026-96865](https://insights.sbomify.com/CVE-2026-96865/): Windows Secure Kernel Mode Information Disclosure Vulnerability (medium 5.6) - [CVE-2026-96864](https://insights.sbomify.com/CVE-2026-96864/): Microsoft Failover Cluster Virtual Driver Remote Code Execution Vulnerability (critical 9.8) - [CVE-2026-96863](https://insights.sbomify.com/CVE-2026-96863/): Windows Storage Port Driver Elevation of Privilege Vulnerability (medium 6.8) - [CVE-2026-96862](https://insights.sbomify.com/CVE-2026-96862/): Windows Spaceport.sys Elevation of Privilege Vulnerability (high 7.8) - [CVE-2026-96861](https://insights.sbomify.com/CVE-2026-96861/): Network Device Enrollment Service (NDES) Denial of Service Vulnerability (high 7.5) - [CVE-2026-96860](https://insights.sbomify.com/CVE-2026-96860/): Windows USB Print Driver Information Disclosure Vulnerability (medium 5.5) - [CVE-2026-96859](https://insights.sbomify.com/CVE-2026-96859/): Windows Imaging Component Information Disclosure Vulnerability (medium 5.5) - [CVE-2026-96858](https://insights.sbomify.com/CVE-2026-96858/): Windows Security Account Manager Tampering Vulnerability (medium 5.5) - [CVE-2026-96857](https://insights.sbomify.com/CVE-2026-96857/): Windows Projected File System Information Disclosure Vulnerability (medium 5.5) - [CVE-2026-96856](https://insights.sbomify.com/CVE-2026-96856/): Windows Management Instrumentation Elevation of Privilege Vulnerability (high 7.8) - [CVE-2026-96855](https://insights.sbomify.com/CVE-2026-96855/): Windows Modern Device Management (MDM) Tampering Vulnerability (medium 5.5) - [CVE-2026-96854](https://insights.sbomify.com/CVE-2026-96854/): Windows Device Association Service Information Disclosure Vulnerability (medium 5.5) - [CVE-2026-96853](https://insights.sbomify.com/CVE-2026-96853/): Windows Win32 Kernel Subsystem Information Disclosure Vulnerability (medium 4.7) - [CVE-2026-96852](https://insights.sbomify.com/CVE-2026-96852/): Windows TCP/IP Elevation of Privilege Vulnerability (high 7.0) - [CVE-2026-96851](https://insights.sbomify.com/CVE-2026-96851/): Windows Management Instrumentation Information Disclosure Vulnerability (medium 5.5) - [CVE-2026-96850](https://insights.sbomify.com/CVE-2026-96850/): Windows Modern Device Management (MDM) Information Disclosure Vulnerability (medium 5.5) - [CVE-2026-96849](https://insights.sbomify.com/CVE-2026-96849/): Windows Kernel-Mode Drivers Information Disclosure Vulnerability (medium 5.5) - [CVE-2026-96848](https://insights.sbomify.com/CVE-2026-96848/): Windows Win32 Kernel Subsystem Information Disclosure Vulnerability (medium 5.5) - [CVE-2026-96847](https://insights.sbomify.com/CVE-2026-96847/): WebDAV Elevation of Privilege Vulnerability (high 7.8) - [CVE-2026-96846](https://insights.sbomify.com/CVE-2026-96846/): WebDAV Information Disclosure Vulnerability (medium 5.5) - [CVE-2026-96844](https://insights.sbomify.com/CVE-2026-96844/): Microsoft Bluetooth Driver Elevation of Privilege Vulnerability (high 8.0) - [CVE-2026-96843](https://insights.sbomify.com/CVE-2026-96843/): WebDAV Elevation of Privilege Vulnerability (high 7.8) - [CVE-2026-96840](https://insights.sbomify.com/CVE-2026-96840/): Post Grid Gutenberg Blocks <= 5.1.0 - Unauthenticated Stored Cross-Site Scripting via display_name User Field (high 7.2) - [CVE-2026-96838](https://insights.sbomify.com/CVE-2026-96838/): Cross-site request forgery in Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification (high 8.8) - [CVE-2026-96837](https://insights.sbomify.com/CVE-2026-96837/): WordPress CartFlows plugin <= 3.2.0 - Remote Code Execution (RCE) vulnerability (high 8.8) - [CVE-2026-96836](https://insights.sbomify.com/CVE-2026-96836/): WordPress Parsi Date plugin <= 6.3 - Cross Site Scripting (XSS) vulnerability (high 7.1) - [CVE-2026-96835](https://insights.sbomify.com/CVE-2026-96835/): WordPress King Addons for Elementor plugin <= 51.1.85 - Cross Site Scripting (XSS) vulnerability (medium 6.5) - [CVE-2026-96834](https://insights.sbomify.com/CVE-2026-96834/): WordPress GiveWP plugin <= 4.16.9 - Sensitive Data Exposure vulnerability (medium 6.5) - [CVE-2026-96833](https://insights.sbomify.com/CVE-2026-96833/): WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.51 - PHP Object Injection vulnerability (high 7.2) - [CVE-2026-96832](https://insights.sbomify.com/CVE-2026-96832/): WordPress Content Egg plugin <= 6.3.1 - PHP Object Injection vulnerability (high 7.2) - [CVE-2026-96831](https://insights.sbomify.com/CVE-2026-96831/): WordPress Themify Builder plugin <= 7.8.1 - PHP Object Injection vulnerability (high 8.8) - [CVE-2026-96830](https://insights.sbomify.com/CVE-2026-96830/): WordPress GiveWP plugin <= 4.16.9 - Cross Site Scripting (XSS) vulnerability (high 7.1) - [CVE-2026-96829](https://insights.sbomify.com/CVE-2026-96829/): WordPress The Plus Addons for Elementor Page Builder Lite plugin <= 6.5.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5) - [CVE-2026-96828](https://insights.sbomify.com/CVE-2026-96828/): WordPress Category Discount Woocommerce plugin <= 5.18 - SQL Injection vulnerability (high 7.6) - [CVE-2026-96827](https://insights.sbomify.com/CVE-2026-96827/): WordPress Admin Notices Manager plugin <= 1.6.0 - SQL Injection vulnerability (high 7.6) - [CVE-2026-96826](https://insights.sbomify.com/CVE-2026-96826/): WordPress W4 Post List plugin <= 3.0.6 - SQL Injection vulnerability (high 7.6) - [CVE-2026-96825](https://insights.sbomify.com/CVE-2026-96825/): WordPress All In One WP Security & Firewall plugin <= 5.4.8 - Bypass Vulnerability vulnerability (medium 4.2) - [CVE-2026-96824](https://insights.sbomify.com/CVE-2026-96824/): WordPress Template Kit – Import plugin <= 1.0.16 - Arbitrary File Deletion vulnerability (medium 6.8) - [CVE-2026-96823](https://insights.sbomify.com/CVE-2026-96823/): WordPress Customer Reviews for WooCommerce plugin <= 5.120.0 - Arbitrary Content Deletion vulnerability (high 7.5) - [CVE-2026-96822](https://insights.sbomify.com/CVE-2026-96822/): WordPress Books Gallery plugin <= 4.8.3 - SQL Injection vulnerability (critical 9.3) - [CVE-2026-96821](https://insights.sbomify.com/CVE-2026-96821/): WordPress FluentBoards plugin <= 2.0.12 - Privilege Escalation vulnerability (medium 6.3) - [CVE-2026-96820](https://insights.sbomify.com/CVE-2026-96820/): WordPress Awesome Support plugin <= 6.3.9 - Cross Site Scripting (XSS) vulnerability (high 7.1) - [CVE-2026-96819](https://insights.sbomify.com/CVE-2026-96819/): WordPress oik plugin <= 4.15.4 - Cross Site Scripting (XSS) vulnerability (high 7.1) - [CVE-2026-96818](https://insights.sbomify.com/CVE-2026-96818/): WordPress WP Express Checkout (Accept PayPal Payments) plugin <= 2.4.9 - Broken Access Control vulnerability (high 7.5) - [CVE-2026-96817](https://insights.sbomify.com/CVE-2026-96817/): WordPress MakeCommerce for WooCommerce plugin <= 4.1.0 - Broken Access Control vulnerability (high 8.2) - [CVE-2026-96816](https://insights.sbomify.com/CVE-2026-96816/): WordPress Trusted Shops Easy Integration for WooCommerce plugin <= 2.0.6 - Cross Site Scripting (XSS) vulnerability (high 7.1) - [CVE-2026-96815](https://insights.sbomify.com/CVE-2026-96815/): WordPress Vitepos plugin <= 3.5.0 - Privilege Escalation vulnerability (high 7.2) - [CVE-2026-96814](https://insights.sbomify.com/CVE-2026-96814/): WordPress WooCommerce Product Table Lite plugin <= 5.6.7 - Cross Site Scripting (XSS) vulnerability (high 7.1) - [CVE-2026-96813](https://insights.sbomify.com/CVE-2026-96813/): Form Maker by 10Web <= 1.15.47 - Unauthenticated Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields (high 7.2) - [CVE-2026-96812](https://insights.sbomify.com/CVE-2026-96812/): Host Root Sandbox Escape in gVisor via Character Device Passthrough and CUSE (high 8.8) - [CVE-2026-96810](https://insights.sbomify.com/CVE-2026-96810/): huanzi-qch base-admin Add User CommonController.java save cross site scripting (medium 5.1) - [CVE-2026-96809](https://insights.sbomify.com/CVE-2026-96809/): WordPress EduAdmin Booking plugin < 6.0.0 - SQL Injection vulnerability (critical 9.3) - [CVE-2026-96808](https://insights.sbomify.com/CVE-2026-96808/): Privilege escalation in Flatpak (high 7.4) - [CVE-2026-96807](https://insights.sbomify.com/CVE-2026-96807/): Path traversal in Flatpak (medium 4.0) - [CVE-2026-96806](https://insights.sbomify.com/CVE-2026-96806/): Auth bypass in Apache Airflow Keycloak provider (medium 5.8) - [CVE-2026-96804](https://insights.sbomify.com/CVE-2026-96804/): CVE-2026-96804 (high 8.8) - [CVE-2026-96803](https://insights.sbomify.com/CVE-2026-96803/): java110 MicroCommunity fallBack API Endpoint BusinessApi.java QueryServiceSMOImpl.fallBack sql injection (medium 6.9) - [CVE-2026-9680](https://insights.sbomify.com/CVE-2026-9680/): MCP Server Exposure via Insecure Default Binding on alibabacloud-rds-openapi-mcp-server (medium 5.8) - [CVE-2026-96795](https://insights.sbomify.com/CVE-2026-96795/): Horilla: Authenticated RCE in Horilla List-View Export (high 8.8) - [CVE-2026-9679](https://insights.sbomify.com/CVE-2026-9679/): undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (medium 5.9) - [CVE-2026-96780](https://insights.sbomify.com/CVE-2026-96780/): figlet is vulnerable to denial of service via unbounded loop when whitespaceBreak is used with a small width (high 8.2) - [CVE-2026-9678](https://insights.sbomify.com/CVE-2026-9678/): undici vulnerable to cross-user information disclosure via shared cache whitespace bypass (medium 5.9) - [CVE-2026-96778](https://insights.sbomify.com/CVE-2026-96778/): Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer (high 7.7) - [CVE-2026-96777](https://insights.sbomify.com/CVE-2026-96777/): Forma LMS Multi-User-Selector AJAX Endpoint getData getDataTask sql injection (medium 5.3) - [CVE-2026-96775](https://insights.sbomify.com/CVE-2026-96775/): MLflow dspy bypasses pickle deserialization control (high 8.8) - [CVE-2026-96774](https://insights.sbomify.com/CVE-2026-96774/): Information disclosure in IP Network Audio Device XC-9603 (medium 6.9) - [CVE-2026-96773](https://insights.sbomify.com/CVE-2026-96773/): Intelliants Subrion CMS Login Page login.php authorize redirect (medium 5.3) - [CVE-2026-96772](https://insights.sbomify.com/CVE-2026-96772/): Intelliants Subrion CMS actions.json assign-owner information disclosure (medium 6.9) - [CVE-2026-96770](https://insights.sbomify.com/CVE-2026-96770/): s2s-proxy accepts untrusted client certificates (critical 9.3) - [CVE-2026-9677](https://insights.sbomify.com/CVE-2026-9677/): Shariff for WordPress <= 1.0.11 - Admin+ Stored Cross-Site Scripting (medium 4.8) - [CVE-2026-96768](https://insights.sbomify.com/CVE-2026-96768/): GoSMTP Pro <= 1.2.3 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Email Log Body (high 7.2) - [CVE-2026-96767](https://insights.sbomify.com/CVE-2026-96767/): NEX-Forms <= 9.3.2 - Unauthenticated Stored Cross-Site Scripting via Content-Type Header (high 7.2) - [CVE-2026-96766](https://insights.sbomify.com/CVE-2026-96766/): GeoDirectory <= 2.8.183 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'business_hours' Parameter (medium 6.4) - [CVE-2026-96765](https://insights.sbomify.com/CVE-2026-96765/): Cross-site scripting in WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) (high 7.2) - [CVE-2026-96764](https://insights.sbomify.com/CVE-2026-96764/): kvcache-ai mooncake Regular Expression GetReplicaListByRegex allocation of resources (medium 5.3) - [CVE-2026-96763](https://insights.sbomify.com/CVE-2026-96763/): kvcache-ai mooncake MountSegment Request Processing segment.cpp access control (medium 5.3) - [CVE-2026-96762](https://insights.sbomify.com/CVE-2026-96762/): kvcache-ai mooncake RPC Path UnmountSegment authorization (medium 6.9) - [CVE-2026-96761](https://insights.sbomify.com/CVE-2026-96761/): WordPress Welcart e-Commerce plugin <= 2.12.3 - Cross Site Scripting (XSS) vulnerability (high 7.1) - [CVE-2026-96760](https://insights.sbomify.com/CVE-2026-96760/): Authlib library contains a signature‑verification bypass vulnerability (critical 9.8) - [CVE-2026-9676](https://insights.sbomify.com/CVE-2026-9676/): f4 Post Tree < 2.0.5 - Subscriber+ Arbitrary Post Parent/Menu Order Modification (medium 4.3) - [CVE-2026-96759](https://insights.sbomify.com/CVE-2026-96759/): orval before 8.29.0 Code Injection via operationId (critical 9.3) - [CVE-2026-96758](https://insights.sbomify.com/CVE-2026-96758/): orval @orval/core before 8.28.0 Code Injection via Form-Data (critical 9.3) - [CVE-2026-96757](https://insights.sbomify.com/CVE-2026-96757/): orval before 8.29.0 Code Injection via unescaped OpenAPI media-type (critical 9.3) - [CVE-2026-96756](https://insights.sbomify.com/CVE-2026-96756/): orval before 8.30.0 Code Injection via Factory Generation (critical 9.2) - [CVE-2026-96755](https://insights.sbomify.com/CVE-2026-96755/): orval @orval/effect 8.14.0 through 8.28.1 Code Injection (critical 9.3) - [CVE-2026-96754](https://insights.sbomify.com/CVE-2026-96754/): orval @orval/hono before 8.29.0 Code Injection via OpenAPI Path (critical 9.3) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/222/