# Vulnerabilities published in 2026


- [CVE-2026-96752](https://insights.sbomify.com/CVE-2026-96752/): Cross-site scripting in Zero Spam for WordPress (high 7.2)
- [CVE-2026-96751](https://insights.sbomify.com/CVE-2026-96751/): pmTicket Project-Management-Software add_project.php setSync sql injection (medium 6.9)
- [CVE-2026-96750](https://insights.sbomify.com/CVE-2026-96750/): Shell script injection via server-supplied database name in Open MongoDB shell (high 7.3)
- [CVE-2026-9675](https://insights.sbomify.com/CVE-2026-9675/): undici WebSocket client vulnerable to denial of service via cumulative fragment bypass (high 7.5)
- [CVE-2026-96749](https://insights.sbomify.com/CVE-2026-96749/): Heap out-of-bounds write via signed size overflow in BSON document encoding (high 7.5)
- [CVE-2026-96748](https://insights.sbomify.com/CVE-2026-96748/): Connection redirection via percent-encoded delimiter injection in connection string hosts (high 8.3)
- [CVE-2026-96747](https://insights.sbomify.com/CVE-2026-96747/): Forced local Unix socket connection via dot-sock KMS endpoint in client-side field encryption (medium 5.3)
- [CVE-2026-96746](https://insights.sbomify.com/CVE-2026-96746/): Heap buffer overflow via mid-scan command list growth in client topology monitoring (high 8.3)
- [CVE-2026-96745](https://insights.sbomify.com/CVE-2026-96745/): PHP object injection via unsuppressible __pclass class inference in command monitoring events (medium 6.3)
- [CVE-2026-96744](https://insights.sbomify.com/CVE-2026-96744/): Unauthorized cache lock takeover via expression injection in lock owner values in MongoDB integration for Laravel (high 7.1)
- [CVE-2026-96743](https://insights.sbomify.com/CVE-2026-96743/): Cross-site scripting in Table Field Add-on for ACF and SCF (medium 6.4)
- [CVE-2026-96741](https://insights.sbomify.com/CVE-2026-96741/): Cross-site scripting in DSGVO All in one for WP (high 7.2)
- [CVE-2026-96740](https://insights.sbomify.com/CVE-2026-96740/): Information disclosure in StreamsHub Console for Apache Kafka® (medium 6.5)
- [CVE-2026-9674](https://insights.sbomify.com/CVE-2026-9674/): Jenkins Multijob Plugin has a cross-site request forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2026-96739](https://insights.sbomify.com/CVE-2026-96739/): SEMCMS KindEditor Upload upload_json.php cross site scripting (medium 5.3)
- [CVE-2026-9673](https://insights.sbomify.com/CVE-2026-9673/): json-2-csv vulnerable to CSV Injection via the preventCsvInjection optio (high 7.0)
- [CVE-2026-9669](https://insights.sbomify.com/CVE-2026-9669/): bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow (high 8.2)
- [CVE-2026-96682](https://insights.sbomify.com/CVE-2026-96682/): Presto Player <= 4.5.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content via <presto-player> Tag (high 7.2)
- [CVE-2026-96680](https://insights.sbomify.com/CVE-2026-96680/): ByteDance Coze Scraper Extension External Message index.js chrome.runtime.onMessageExternal.addListener authorization (medium 5.3)
- [CVE-2026-9668](https://insights.sbomify.com/CVE-2026-9668/): SQL injection vulnerability in ZTE SCP product (medium 6.3)
- [CVE-2026-96678](https://insights.sbomify.com/CVE-2026-96678/): weiqingwen spring-boot-forum Avatar Upload NewUserFormValidator.java validate path traversal (medium 5.3)
- [CVE-2026-96676](https://insights.sbomify.com/CVE-2026-96676/): Fast FAC1900R uhttpd get_alias_name stack-based overflow (medium 5.3)
- [CVE-2026-96675](https://insights.sbomify.com/CVE-2026-96675/): alsa-lib through 1.2.16.1 Denial of Service via pcm_multi (medium 4.8)
- [CVE-2026-96674](https://insights.sbomify.com/CVE-2026-96674/): alsa-lib through 1.2.16.1 Integer Overflow via Topology File (medium 4.8)
- [CVE-2026-96673](https://insights.sbomify.com/CVE-2026-96673/): Photoview through 2.4.0 SQL Injection via album download route (high 8.7)
- [CVE-2026-96672](https://insights.sbomify.com/CVE-2026-96672/): Frappe ERPNext before 16.34.1 Unauthorized Method Invocation (medium 5.3)
- [CVE-2026-96671](https://insights.sbomify.com/CVE-2026-96671/): WordPress Featured Image from URL plugin <= 6.0.7 - Cross Site Request Forgery (CSRF) vulnerability (high 8.8)
- [CVE-2026-9667](https://insights.sbomify.com/CVE-2026-9667/): IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities (medium 5.3)
- [CVE-2026-96669](https://insights.sbomify.com/CVE-2026-96669/): Food Store <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting via 'service_type' Cookie (high 7.2)
- [CVE-2026-96667](https://insights.sbomify.com/CVE-2026-96667/): Real Estate Manager <= 7.3 - Unauthenticated Stored Cross-Site Scripting via 'first_name' Parameter (high 7.2)
- [CVE-2026-96666](https://insights.sbomify.com/CVE-2026-96666/): Cross-site scripting in Schema App Structured Data (high 7.2)
- [CVE-2026-96662](https://insights.sbomify.com/CVE-2026-96662/): Appointment Booking Plugin <= 5.7.2 - Unauthenticated SQL Injection via 'booking[service_id]' Parameter (high 7.5)
- [CVE-2026-96661](https://insights.sbomify.com/CVE-2026-96661/): Gmedia Photo Gallery <= 1.25.1 - Unauthenticated SQL Injection via 'gmedia__in' Parameter (high 7.5)
- [CVE-2026-96660](https://insights.sbomify.com/CVE-2026-96660/): User Registration & Membership <= 5.2.8 - Unauthenticated Stored Cross-Site Scripting via Checkbox Field Value (high 7.2)
- [CVE-2026-96659](https://insights.sbomify.com/CVE-2026-96659/): Foreman: excessive permissions for viewer role on preview (critical 9.1)
- [CVE-2026-96658](https://insights.sbomify.com/CVE-2026-96658/): Foreman: foreman: arbitrary code execution via safemode sandbox bypass (high 8.8)
- [CVE-2026-96656](https://insights.sbomify.com/CVE-2026-96656/): Plex Media Server External Control of File Name or Path (high 8.6, exploited in the wild)
- [CVE-2026-96655](https://insights.sbomify.com/CVE-2026-96655/): Plex Media Server Server-Side Request Forgery (SSRF) (medium 5.3, exploited in the wild)
- [CVE-2026-96654](https://insights.sbomify.com/CVE-2026-96654/): Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page (medium 6.9, exploited in the wild)
- [CVE-2026-96653](https://insights.sbomify.com/CVE-2026-96653/): WP Directory Kit <= 1.5.9 - Authenticated (Subscriber+) SQL Injection via 'display_name' Profile Field (Second-Order) (medium 6.5)
- [CVE-2026-96652](https://insights.sbomify.com/CVE-2026-96652/): Plex Media Server Server-Side Request Forgery (SSRF) (medium 5.3, exploited in the wild)
- [CVE-2026-96651](https://insights.sbomify.com/CVE-2026-96651/): Plex Media Server path traversal (high 7.1)
- [CVE-2026-96650](https://insights.sbomify.com/CVE-2026-96650/): Strong Testimonials <= 3.3.11 - Unauthenticated Stored Cross-Site Scripting via 'platform_user_photo' Custom Field (high 7.2)
- [CVE-2026-96649](https://insights.sbomify.com/CVE-2026-96649/): Cross-site scripting in Frontend Post Submission Manager Lite – Guest Post and Frontend Submission Forms (high 7.2)
- [CVE-2026-96648](https://insights.sbomify.com/CVE-2026-96648/): Cross-site scripting in Data Tables Generator by Supsystic (medium 6.4)
- [CVE-2026-96647](https://insights.sbomify.com/CVE-2026-96647/): Cross-site scripting in Listdom: AI-powered Business Directory with Classifieds Ads Listings (medium 6.4)
- [CVE-2026-96644](https://insights.sbomify.com/CVE-2026-96644/): Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds) (high 7.1)
- [CVE-2026-96643](https://insights.sbomify.com/CVE-2026-96643/): Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time (high 7.1)
- [CVE-2026-96642](https://insights.sbomify.com/CVE-2026-96642/): Pillow: TarIO negative size field causes infinite CPU-spin loop (high 7.1)
- [CVE-2026-96641](https://insights.sbomify.com/CVE-2026-96641/): Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise (medium 6.5)
- [CVE-2026-96640](https://insights.sbomify.com/CVE-2026-96640/): Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion (high 8.2)
- [CVE-2026-96639](https://insights.sbomify.com/CVE-2026-96639/): Pillow multi-frame loaders can reuse stale native image storage after mode transitions (critical 9.8)
- [CVE-2026-96638](https://insights.sbomify.com/CVE-2026-96638/): Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode (medium 6.5)
- [CVE-2026-96637](https://insights.sbomify.com/CVE-2026-96637/): Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS (high 7.1)
- [CVE-2026-96636](https://insights.sbomify.com/CVE-2026-96636/): Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek) (medium 6.5)
- [CVE-2026-96628](https://insights.sbomify.com/CVE-2026-96628/): Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof` (medium 4.3)
- [CVE-2026-96627](https://insights.sbomify.com/CVE-2026-96627/): Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check) (high 8.8)
- [CVE-2026-96626](https://insights.sbomify.com/CVE-2026-96626/): Arcane: Container-registry credential exfiltration via URL repoint + test to attacker host (high 8.5)
- [CVE-2026-96620](https://insights.sbomify.com/CVE-2026-96620/): Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution (critical 9.2)
- [CVE-2026-9662](https://insights.sbomify.com/CVE-2026-9662/): Recover Exit For WooCommerce <= 1.0.3 - Unauthenticated Local File Inclusion via 'tpf' Parameter (high 8.1)
- [CVE-2026-96618](https://insights.sbomify.com/CVE-2026-96618/): Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror (low 2.1)
- [CVE-2026-96616](https://insights.sbomify.com/CVE-2026-96616/): Kiloview E3 NDI Encoder Insufficient Session Expiration (high 8.3)
- [CVE-2026-96615](https://insights.sbomify.com/CVE-2026-96615/): NGINX Gateway Fabric vulnerability (high 7.1)
- [CVE-2026-96614](https://insights.sbomify.com/CVE-2026-96614/): Open redirect in "ゲオアプリ" for Android (medium 5.1)
- [CVE-2026-96613](https://insights.sbomify.com/CVE-2026-96613/): Missing Authorization in Meari IoT Cloud Platform OpenAPI Service (high 7.1)
- [CVE-2026-96612](https://insights.sbomify.com/CVE-2026-96612/): Path traversal in Hex via unvalidated dependency app names (high 7.5)
- [CVE-2026-96611](https://insights.sbomify.com/CVE-2026-96611/): Integer overflow in FFmpeg (medium 6.9)
- [CVE-2026-96609](https://insights.sbomify.com/CVE-2026-96609/): Denial of service in Albatross (high 7.1)
- [CVE-2026-96607](https://insights.sbomify.com/CVE-2026-96607/): WordPress NEX-Forms plugin <= 9.3.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-96606](https://insights.sbomify.com/CVE-2026-96606/): LB-Link BL-CPE600EU Configuration Backup Mifi_config.bin information disclosure (medium 6.9)
- [CVE-2026-96604](https://insights.sbomify.com/CVE-2026-96604/): SoftNews Media Group DataLife Engine Search search.php strip_data sql injection (medium 6.9)
- [CVE-2026-96603](https://insights.sbomify.com/CVE-2026-96603/): Abdurrab5 online-makeup-store Admin functions.php confirm_user authorization (medium 6.9)
- [CVE-2026-96602](https://insights.sbomify.com/CVE-2026-96602/): Abdurrab5 online-makeup-store Customer Login customerSignin.php sql injection (medium 6.9)
- [CVE-2026-96601](https://insights.sbomify.com/CVE-2026-96601/): Abdurrab5 online-makeup-store Admin Login index.php sql injection (medium 6.9)
- [CVE-2026-96600](https://insights.sbomify.com/CVE-2026-96600/): Isotope eCommerce through 2.9.10 SQL Injection via Backend Callbacks (high 7.0)
- [CVE-2026-9660](https://insights.sbomify.com/CVE-2026-9660/): Memory corruption in Totolink (critical 9.1)
- [CVE-2026-96599](https://insights.sbomify.com/CVE-2026-96599/): Isotope eCommerce through 2.9.10 Weak Order Identifier Generation (high 8.2)
- [CVE-2026-96596](https://insights.sbomify.com/CVE-2026-96596/): erl_tar:extract/2 loops forever on a GNU sparse member with a trailing hole (medium 5.9)
- [CVE-2026-96594](https://insights.sbomify.com/CVE-2026-96594/): Gitea repository media API stored XSS (medium 6.1)
- [CVE-2026-9659](https://insights.sbomify.com/CVE-2026-9659/): Memory corruption in Totolink (critical 9.1)
- [CVE-2026-96589](https://insights.sbomify.com/CVE-2026-96589/): Gitea private repository access retained after rejected transfer (medium 4.3)
- [CVE-2026-96587](https://insights.sbomify.com/CVE-2026-96587/): Use of Hard-coded Credentials in Viidure Dashcam Android Application (critical 10.0)
- [CVE-2026-96582](https://insights.sbomify.com/CVE-2026-96582/): Out-of-bounds Read via Check-after-use in the USBX HID Report Descriptor Parser (medium 4.9)
- [CVE-2026-96581](https://insights.sbomify.com/CVE-2026-96581/): Missing authorization in ash (high 7.6)
- [CVE-2026-96580](https://insights.sbomify.com/CVE-2026-96580/): Gitea Actions memory exhaustion through large static matrices (high 7.5)
- [CVE-2026-9658](https://insights.sbomify.com/CVE-2026-9658/): Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths (high 7.3)
- [CVE-2026-96578](https://insights.sbomify.com/CVE-2026-96578/): GSpeech TTS <= 3.22.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content (high 7.2)
- [CVE-2026-96577](https://insights.sbomify.com/CVE-2026-96577/): Missing authorization in Assisted Installer for Red Hat OpenShift Container Platform 2 (high 7.1)
- [CVE-2026-96575](https://insights.sbomify.com/CVE-2026-96575/): Cross-site scripting in Transliterator – Multilingual and Multi-script Text Conversion (high 7.2)
- [CVE-2026-96574](https://insights.sbomify.com/CVE-2026-96574/): User Frontend <= 4.3.12 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpuf_payment_method' Parameter (medium 6.4)
- [CVE-2026-96573](https://insights.sbomify.com/CVE-2026-96573/): Cross-site scripting in Appointment Hour Booking – Booking Calendar (high 7.2)
- [CVE-2026-96572](https://insights.sbomify.com/CVE-2026-96572/): Cross-site scripting in WP Meteor Website Speed Optimization Addon (high 7.2)
- [CVE-2026-96570](https://insights.sbomify.com/CVE-2026-96570/): Cross-site scripting in Schema & Structured Data for WP & AMP (high 7.2)
- [CVE-2026-96568](https://insights.sbomify.com/CVE-2026-96568/): Restaurant Menu and Food Ordering <= 2.4.14 - Unauthenticated Stored Cross-Site Scripting via 'phone_number' Parameter (high 7.2)
- [CVE-2026-96567](https://insights.sbomify.com/CVE-2026-96567/): Cross-site scripting in MW WP Form (high 7.2)
- [CVE-2026-96566](https://insights.sbomify.com/CVE-2026-96566/): Newsletter <= 9.4.0 - Unauthenticated Stored Cross-Site Scripting via 'np1' Custom Field Parameter (high 7.2)
- [CVE-2026-96564](https://insights.sbomify.com/CVE-2026-96564/): SEOPress <= 10.2 - Unauthenticated Stored Cross-Site Scripting via Author Display Name (high 7.2)
- [CVE-2026-96563](https://insights.sbomify.com/CVE-2026-96563/): Motors <= 1.4.124 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'stm_f_s' Parameter (medium 6.4)
- [CVE-2026-96562](https://insights.sbomify.com/CVE-2026-96562/): Broken Link Checker <= 2.4.14.1 - Unauthenticated Arbitrary Shortcode Execution via parser_callback (medium 6.5)
- [CVE-2026-96561](https://insights.sbomify.com/CVE-2026-96561/): Cross-site scripting in AI Engine – The Chatbot, AI Framework & MCP for WordPress (high 7.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/223/