# Vulnerabilities published in 2026


- [CVE-2026-96560](https://insights.sbomify.com/CVE-2026-96560/): LightLLM through 1.2.0 Unauthenticated Remote Code Execution via NCCL PD RPyC Control Channel (critical 9.3)
- [CVE-2026-9656](https://insights.sbomify.com/CVE-2026-9656/): Information disclosure in HubSpot All-In-One Marketing – Forms, Popups, Live Chat (medium 4.3)
- [CVE-2026-96558](https://insights.sbomify.com/CVE-2026-96558/): Cross-site scripting in Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker (high 7.2)
- [CVE-2026-96556](https://insights.sbomify.com/CVE-2026-96556/): Neethuharii CafeManagement AddCashierCode.php addcashier improper authorization (medium 6.9)
- [CVE-2026-96553](https://insights.sbomify.com/CVE-2026-96553/): WordPress FiboSearch plugin <= 1.34.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-96552](https://insights.sbomify.com/CVE-2026-96552/): sfturing hosp_order User Password MD5.java MD5.getMD5 hash without salt (low 2.3)
- [CVE-2026-96551](https://insights.sbomify.com/CVE-2026-96551/): sfturing hosp_order CommonUserController.java cross-site request forgery (medium 5.3)
- [CVE-2026-96550](https://insights.sbomify.com/CVE-2026-96550/): sfturing hosp_order MailUtil.java getProperties cleartext transmission (medium 6.3)
- [CVE-2026-96549](https://insights.sbomify.com/CVE-2026-96549/): sfturing hosp_order CommonUserServiceImpl.java cleartext storage (medium 4.8)
- [CVE-2026-96548](https://insights.sbomify.com/CVE-2026-96548/): sfturing hosp_order jdbc.properties hard-coded credentials (medium 6.3)
- [CVE-2026-96546](https://insights.sbomify.com/CVE-2026-96546/): Gimp: gimp: one-byte out-of-bounds heap read in the uncompressed dds loader (low 2.5)
- [CVE-2026-96545](https://insights.sbomify.com/CVE-2026-96545/): Gimp: gimp: out-of-bounds heap read in the 4bpp tim image loader (medium 4.4)
- [CVE-2026-96542](https://insights.sbomify.com/CVE-2026-96542/): EA Javelin Anticheat Installer Local Privilege Escalation (medium 5.0)
- [CVE-2026-96541](https://insights.sbomify.com/CVE-2026-96541/): Gnome-remote-desktop: gnome-remote-desktop: unauthenticated rdp sockets lack a handshake deadline (high 7.5)
- [CVE-2026-96540](https://insights.sbomify.com/CVE-2026-96540/): Missing authorization in Network Security Manager (NSM) (high 8.8)
- [CVE-2026-96539](https://insights.sbomify.com/CVE-2026-96539/): WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability (medium 5.6)
- [CVE-2026-96538](https://insights.sbomify.com/CVE-2026-96538/): WarehousePG pg_file_write/pg_file_rename/pg_file_unlink/pg_logdir_ls privilege escalation (high 8.7)
- [CVE-2026-96537](https://insights.sbomify.com/CVE-2026-96537/): Tutor LMS < 4.1.1 - Unauthenticated Tutor Page Force-Publish and Content Overwrite (high 7.5)
- [CVE-2026-96535](https://insights.sbomify.com/CVE-2026-96535/): Cross-Site Scripting in the YouMind web application (medium 5.1)
- [CVE-2026-96534](https://insights.sbomify.com/CVE-2026-96534/): Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_fes_csv_export (high 7.7)
- [CVE-2026-96533](https://insights.sbomify.com/CVE-2026-96533/): Testimonials Widget <= 4.0.4 - Unauthenticated SSRF via Featured Image URL (medium 5.8)
- [CVE-2026-96532](https://insights.sbomify.com/CVE-2026-96532/): Testimonials Widget <= 4.0.4 - Unauthenticated Arbitrary Post Update (high 7.5)
- [CVE-2026-96531](https://insights.sbomify.com/CVE-2026-96531/): Optimole 4.0.0 - 4.2.12 - Author+ Stored XSS via Video Player Block (medium 6.8)
- [CVE-2026-96530](https://insights.sbomify.com/CVE-2026-96530/): Optimole 4.0.0 - 4.2.14 - Subscriber+ Sensitive Data Disclosure via Dashboard Widget (medium 6.5)
- [CVE-2026-9653](https://insights.sbomify.com/CVE-2026-9653/): 1756-EN2, 1756-EN3, and 1756-ENBT - Denial of Service via CIP Connection ID (high 8.7)
- [CVE-2026-96526](https://insights.sbomify.com/CVE-2026-96526/): MCP Server for WordPress < 1.8.2 - Contributor+ Arbitrary Post Title Disclosure via workflows/run REST Route (low 2.7)
- [CVE-2026-96525](https://insights.sbomify.com/CVE-2026-96525/): MCP Server for WordPress < 1.8.2 - Contributor+ Workflow Modification and Deletion via Missing Ownership Check (low 2.7)
- [CVE-2026-96524](https://insights.sbomify.com/CVE-2026-96524/): MCP Server for WordPress < 1.8.2 - Administrator Account Creation via CSRF (high 8.8)
- [CVE-2026-96523](https://insights.sbomify.com/CVE-2026-96523/): Photoshop Desktop | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-96522](https://insights.sbomify.com/CVE-2026-96522/): Photoshop Desktop | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-96521](https://insights.sbomify.com/CVE-2026-96521/): Photoshop Desktop | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-96518](https://insights.sbomify.com/CVE-2026-96518/): WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability (medium 5.9)
- [CVE-2026-96515](https://insights.sbomify.com/CVE-2026-96515/): Command Injection Vulnerability in Netlink ICT HG323RW Router (high 8.6)
- [CVE-2026-96514](https://insights.sbomify.com/CVE-2026-96514/): Neethuharii CafeManagement Login CafePortalLogin.php sql injection (medium 6.9)
- [CVE-2026-96513](https://insights.sbomify.com/CVE-2026-96513/): Neethuharii CafeManagement AddProductCode.php unrestricted upload (medium 6.9)
- [CVE-2026-96512](https://insights.sbomify.com/CVE-2026-96512/): Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorization (high 7.8)
- [CVE-2026-9651](https://insights.sbomify.com/CVE-2026-9651/): Misconfiguration in EasyLogic T150 (formerly Saitel DR) Remote Terminal Unit & Controller (medium 6.7)
- [CVE-2026-9650](https://insights.sbomify.com/CVE-2026-9650/): Information disclosure in EasyLogic T150 (formerly Saitel DR) Remote Terminal Unit & Controller (high 8.7)
- [CVE-2026-9648](https://insights.sbomify.com/CVE-2026-9648/): CVE-2026-9648 (critical 9.1)
- [CVE-2026-96461](https://insights.sbomify.com/CVE-2026-96461/): WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-9646](https://insights.sbomify.com/CVE-2026-9646/): ScadaBR Unauthenticated Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2026-96456](https://insights.sbomify.com/CVE-2026-96456/): Reachy Mini Bluetooth PIN authentication can be bypassed by racing an authenticated device (medium 6.3)
- [CVE-2026-96455](https://insights.sbomify.com/CVE-2026-96455/): Reachy Mini daemon allows unauthenticated remote code execution through the app installation endpoint (high 8.8)
- [CVE-2026-96454](https://insights.sbomify.com/CVE-2026-96454/): Pake grants unrestricted IPC access to every HTTPS origin loaded in generated applications (high 8.2)
- [CVE-2026-96451](https://insights.sbomify.com/CVE-2026-96451/): WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability (high 8.8)
- [CVE-2026-96450](https://insights.sbomify.com/CVE-2026-96450/): WordPress pixfort Core plugin < 4.3.3 - Cross Site Scripting (XSS) vulnerability (medium 5.4)
- [CVE-2026-9645](https://insights.sbomify.com/CVE-2026-9645/): ScadaBR Authenticated Remote Code Execution (critical 9.9)
- [CVE-2026-96449](https://insights.sbomify.com/CVE-2026-96449/): WordPress WP EasyPay plugin <= 4.5.4 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-96448](https://insights.sbomify.com/CVE-2026-96448/): Keycloak-services: keycloak-services: fgap v2 composite-blind role mapping allows privilege escalation (medium 6.6)
- [CVE-2026-96446](https://insights.sbomify.com/CVE-2026-96446/): Keycloak-services: keycloak-services: par single-use bypass via prompt=none silent authentication path (medium 4.2)
- [CVE-2026-96445](https://insights.sbomify.com/CVE-2026-96445/): Keycloak-services: keycloak-services: conditional otp skip-header policy evaluated against untrusted proxy headers (medium 6.8)
- [CVE-2026-96443](https://insights.sbomify.com/CVE-2026-96443/): Apache Doris: JDBC driver URL validation bypass leads to remote code execution (medium 6.5)
- [CVE-2026-96442](https://insights.sbomify.com/CVE-2026-96442/): Emacs: emacs: arbitrary code execution in flymake mode (high 7.8)
- [CVE-2026-96440](https://insights.sbomify.com/CVE-2026-96440/): Flowring Agentflow 4.0 - Improper Limitation of a Pathname to a Restricted Directory（Path Traversal） (high 7.1)
- [CVE-2026-9644](https://insights.sbomify.com/CVE-2026-9644/): LiveSmart Video Chat <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2026-96432](https://insights.sbomify.com/CVE-2026-96432/): Null pointer dereference vulnerability in QNetworkAccessManager impacts Qt (low 2.1)
- [CVE-2026-96431](https://insights.sbomify.com/CVE-2026-96431/): Flowring Agentflow 4.0 - Unrestricted Upload of File with Dangerous Type (critical 9.3)
- [CVE-2026-96430](https://insights.sbomify.com/CVE-2026-96430/): Flowring Agentflow 4.0 - Exposed Dangerous Method or Function (high 8.7)
- [CVE-2026-9643](https://insights.sbomify.com/CVE-2026-9643/): WP Meta SEO <= 4.5.18 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI in 404 Logging (high 7.2)
- [CVE-2026-96429](https://insights.sbomify.com/CVE-2026-96429/): Flowring Agentflow 4.0 - SQL Injection (critical 9.3)
- [CVE-2026-96428](https://insights.sbomify.com/CVE-2026-96428/): Flowring Agentflow 4.0 - SQL Injection (critical 9.3)
- [CVE-2026-96425](https://insights.sbomify.com/CVE-2026-96425/): Incorrect Permission Assignment for Critical Resource in lomiri-download-manager (medium 5.5)
- [CVE-2026-96424](https://insights.sbomify.com/CVE-2026-96424/): Incorrect Permission Assignment for Critical Resource in lomiri-download-manager (high 7.8)
- [CVE-2026-96423](https://insights.sbomify.com/CVE-2026-96423/): Heap-based Buffer Overflow in Wireshark (medium 5.5)
- [CVE-2026-96422](https://insights.sbomify.com/CVE-2026-96422/): Reachable Assertion in Wireshark (medium 5.5)
- [CVE-2026-96421](https://insights.sbomify.com/CVE-2026-96421/): Improperly Controlled Sequential Memory Allocation in Wireshark (medium 5.5)
- [CVE-2026-96420](https://insights.sbomify.com/CVE-2026-96420/): Buffer Over-read in Wireshark (medium 4.7)
- [CVE-2026-96419](https://insights.sbomify.com/CVE-2026-96419/): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Wireshark (medium 5.5)
- [CVE-2026-96418](https://insights.sbomify.com/CVE-2026-96418/): Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark (medium 5.5)
- [CVE-2026-96417](https://insights.sbomify.com/CVE-2026-96417/): Heap-based Buffer Overflow in Wireshark (medium 5.5)
- [CVE-2026-96416](https://insights.sbomify.com/CVE-2026-96416/): Heap-based Buffer Overflow in Wireshark (medium 5.5)
- [CVE-2026-96415](https://insights.sbomify.com/CVE-2026-96415/): Stack-based Buffer Overflow in Wireshark (medium 5.5)
- [CVE-2026-9641](https://insights.sbomify.com/CVE-2026-9641/): Crypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number of iterations (medium 5.3)
- [CVE-2026-96408](https://insights.sbomify.com/CVE-2026-96408/): Code injection in Movable Type (critical 9.3)
- [CVE-2026-96406](https://insights.sbomify.com/CVE-2026-96406/): VIDEO class descriptor walk consumes device-controlled wTotalLength as its bound (medium 4.9)
- [CVE-2026-96405](https://insights.sbomify.com/CVE-2026-96405/): Aggregate DNS name chained pointer decompression work leads to degradation of service. (medium 5.3)
- [CVE-2026-96404](https://insights.sbomify.com/CVE-2026-96404/): Gitea installer authentication bypass for existing accounts (high 8.1)
- [CVE-2026-96402](https://insights.sbomify.com/CVE-2026-96402/): USBX PIMA/MTP host class reads past its receive buffer when a device over-reports its object handle count (medium 5.2)
- [CVE-2026-96400](https://insights.sbomify.com/CVE-2026-96400/): Gitea migration SSRF to reserved addresses through ALLOWED_DOMAINS (medium 4.3)
- [CVE-2026-9640](https://insights.sbomify.com/CVE-2026-9640/): LXD Snapshot Import Privilege Escalation Vulnerability (high 7.2)
- [CVE-2026-96399](https://insights.sbomify.com/CVE-2026-96399/): Gitea denial of service through external issue tracker patterns (high 7.5)
- [CVE-2026-96398](https://insights.sbomify.com/CVE-2026-96398/): Webform - Less critical - Access bypass - SA-CONTRIB-2026-173 (medium 4.3)
- [CVE-2026-96396](https://insights.sbomify.com/CVE-2026-96396/): Integer overflow in affinity (medium 4.9)
- [CVE-2026-96395](https://insights.sbomify.com/CVE-2026-96395/): Memory corruption in affinity (low 3.6)
- [CVE-2026-96394](https://insights.sbomify.com/CVE-2026-96394/): Memory corruption in affinity (low 2.9)
- [CVE-2026-96393](https://insights.sbomify.com/CVE-2026-96393/): Memory corruption in affinity (low 3.6)
- [CVE-2026-96392](https://insights.sbomify.com/CVE-2026-96392/): AI CKEditor - Moderately critical - Code execution via Twig templates - SA-CONTRIB-2026-187 (low 3.5)
- [CVE-2026-96391](https://insights.sbomify.com/CVE-2026-96391/): Webform REST - Less critical - Access bypass - SA-CONTRIB-2026-186 (not scored)
- [CVE-2026-96390](https://insights.sbomify.com/CVE-2026-96390/): Editoria11y Accessibility Checker - Moderately critical - Access bypass - SA-CONTRIB-2026-185 (medium 4.3)
- [CVE-2026-9639](https://insights.sbomify.com/CVE-2026-9639/): Authenticated Denial of Service via Malicious Backup Tarball in LXD (medium 6.5)
- [CVE-2026-96388](https://insights.sbomify.com/CVE-2026-96388/): Tawk.to - Live chat application - Critical - Cross Site Request Forgery - SA-CONTRIB-2026-184 (medium 5.4)
- [CVE-2026-96387](https://insights.sbomify.com/CVE-2026-96387/): Stop administrator login - Moderately critical - Access bypass - SA-CONTRIB-2026-183 (low 3.8)
- [CVE-2026-96386](https://insights.sbomify.com/CVE-2026-96386/): Smart Content - Moderately critical - Access bypass - SA-CONTRIB-2026-190 (medium 6.5)
- [CVE-2026-96385](https://insights.sbomify.com/CVE-2026-96385/): REST & JSON API Authentication for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2026-182 (medium 6.5)
- [CVE-2026-96384](https://insights.sbomify.com/CVE-2026-96384/): Mermaid Diagram Field - Moderately critical - Access bypass - SA-CONTRIB-2026-180 (low 3.5)
- [CVE-2026-96382](https://insights.sbomify.com/CVE-2026-96382/): Diba carousel slider - Moderately critical - Cross Site Scripting (XSS) - SA-CONTRIB-2026-191 (medium 4.6)
- [CVE-2026-96380](https://insights.sbomify.com/CVE-2026-96380/): CSS Usage Analyzer - Moderately critical - Improper access control - SA-CONTRIB-2026-189 (medium 6.5)
- [CVE-2026-9638](https://insights.sbomify.com/CVE-2026-9638/): Crypt::PBKDF2 versions before 0.261630 for Perl generate insecure random values for salts (high 7.5)
- [CVE-2026-96379](https://insights.sbomify.com/CVE-2026-96379/): CookieCuttr - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-181 (not scored)
- [CVE-2026-96378](https://insights.sbomify.com/CVE-2026-96378/): Commerce Decoupled Checkout - Moderately critical - Access bypass - SA-CONTRIB-2026-179 (medium 4.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/224/