# Vulnerabilities published in 2026


- [CVE-2026-96377](https://insights.sbomify.com/CVE-2026-96377/): Combined image style - Moderately critical - Improper access control - SA-CONTRIB-2026-188 (medium 5.3)
- [CVE-2026-96376](https://insights.sbomify.com/CVE-2026-96376/): Cloud - Critical - Remote code execution - SA-CONTRIB-2026-177 (medium 6.4)
- [CVE-2026-96375](https://insights.sbomify.com/CVE-2026-96375/): Cloud - Critical - Remote code execution - SA-CONTRIB-2026-176 (medium 4.8)
- [CVE-2026-96374](https://insights.sbomify.com/CVE-2026-96374/): Project Browser - Critical - Cross-site request forgery - SA-CONTRIB-2026-178 (medium 4.2)
- [CVE-2026-96373](https://insights.sbomify.com/CVE-2026-96373/): Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168 (low 3.3)
- [CVE-2026-96372](https://insights.sbomify.com/CVE-2026-96372/): Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-167 (medium 5.4)
- [CVE-2026-96371](https://insights.sbomify.com/CVE-2026-96371/): Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-166 (medium 5.4)
- [CVE-2026-96370](https://insights.sbomify.com/CVE-2026-96370/): Webform - Moderately critical - Access bypass, Server-side request forgery - SA-CONTRIB-2026-164 (medium 5.4)
- [CVE-2026-9637](https://insights.sbomify.com/CVE-2026-9637/): CompactLogix® 5380 / ControlLogix® 5580 - Multiple Vulnerabilities (high 8.7)
- [CVE-2026-96369](https://insights.sbomify.com/CVE-2026-96369/): Webform - Less critical - Access bypass - SA-CONTRIB-2026-165 (low 3.1)
- [CVE-2026-96368](https://insights.sbomify.com/CVE-2026-96368/): Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-163 (medium 4.6)
- [CVE-2026-96367](https://insights.sbomify.com/CVE-2026-96367/): Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-162 (medium 4.6)
- [CVE-2026-96366](https://insights.sbomify.com/CVE-2026-96366/): Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-169 (medium 5.3)
- [CVE-2026-96365](https://insights.sbomify.com/CVE-2026-96365/): Webform - Less critical - Denial of service - SA-CONTRIB-2026-170 (high 7.5)
- [CVE-2026-96364](https://insights.sbomify.com/CVE-2026-96364/): Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-171 (medium 5.3)
- [CVE-2026-96363](https://insights.sbomify.com/CVE-2026-96363/): Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-161 (not scored)
- [CVE-2026-96362](https://insights.sbomify.com/CVE-2026-96362/): Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-160 (medium 4.2)
- [CVE-2026-96361](https://insights.sbomify.com/CVE-2026-96361/): Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-155 (medium 4.6)
- [CVE-2026-96360](https://insights.sbomify.com/CVE-2026-96360/): Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-154 (low 3.5)
- [CVE-2026-9636](https://insights.sbomify.com/CVE-2026-9636/): Security feature bypass in ControlLogix® 5580, CompactLogix® 5380, GuardLogix® 5580, Compact GuardLogix® 5380, 1756-EN4TR (high 8.2)
- [CVE-2026-96359](https://insights.sbomify.com/CVE-2026-96359/): Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-159 (medium 4.6)
- [CVE-2026-96358](https://insights.sbomify.com/CVE-2026-96358/): Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-158 (medium 4.6)
- [CVE-2026-96357](https://insights.sbomify.com/CVE-2026-96357/): Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-172 (medium 4.6)
- [CVE-2026-96356](https://insights.sbomify.com/CVE-2026-96356/): Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-174 (medium 5.3)
- [CVE-2026-96355](https://insights.sbomify.com/CVE-2026-96355/): Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175 (critical 9.1)
- [CVE-2026-96352](https://insights.sbomify.com/CVE-2026-96352/): WordPress YITH WooCommerce Ajax Search plugin <= 2.28.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-96351](https://insights.sbomify.com/CVE-2026-96351/): WordPress Classified Listing plugin <= 6.1.3 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-96350](https://insights.sbomify.com/CVE-2026-96350/): WordPress Estatik plugin <= 4.3.5 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2026-9635](https://insights.sbomify.com/CVE-2026-9635/): Cross-site scripting in WP Shortcode by MyThemeShop (medium 6.4)
- [CVE-2026-96349](https://insights.sbomify.com/CVE-2026-96349/): WordPress SiteSkite plugin <= 2.1.8 - Remote Code Execution (RCE) vulnerability (critical 10.0)
- [CVE-2026-96348](https://insights.sbomify.com/CVE-2026-96348/): WordPress Bookly plugin <= 28.2 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-96347](https://insights.sbomify.com/CVE-2026-96347/): WordPress Bookly plugin <= 28.2 - Insecure Direct Object References (IDOR) vulnerability (medium 6.5)
- [CVE-2026-96346](https://insights.sbomify.com/CVE-2026-96346/): WordPress WP ERP plugin <= 1.17.9 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-96345](https://insights.sbomify.com/CVE-2026-96345/): WordPress Estatik plugin <= 4.3.5 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-96344](https://insights.sbomify.com/CVE-2026-96344/): WordPress eCommerce Product Catalog plugin <= 3.6.0 - PHP Object Injection vulnerability (high 7.2)
- [CVE-2026-96343](https://insights.sbomify.com/CVE-2026-96343/): WordPress WP ERP plugin <= 1.17.9 - PHP Object Injection vulnerability (high 7.2)
- [CVE-2026-96342](https://insights.sbomify.com/CVE-2026-96342/): WordPress WPMobile.App plugin <= 11.83 - Sensitive Data Exposure vulnerability (medium 6.9)
- [CVE-2026-96341](https://insights.sbomify.com/CVE-2026-96341/): WordPress Forminator plugin <= 1.57.3 - Privilege Escalation vulnerability (high 8.2)
- [CVE-2026-9634](https://insights.sbomify.com/CVE-2026-9634/): Redundancy Module Configuration Tool - Multiple Vulnerabilities (high 7.0)
- [CVE-2026-96339](https://insights.sbomify.com/CVE-2026-96339/): WordPress Houzez theme <= 4.4.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-96338](https://insights.sbomify.com/CVE-2026-96338/): WordPress Profile Builder plugin <= 4.0.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-96337](https://insights.sbomify.com/CVE-2026-96337/): WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-96336](https://insights.sbomify.com/CVE-2026-96336/): WordPress Forminator plugin <= 1.57.2 - Payment Bypass vulnerability (high 7.5)
- [CVE-2026-96335](https://insights.sbomify.com/CVE-2026-96335/): WordPress Forminator plugin <= 1.57.2 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-96334](https://insights.sbomify.com/CVE-2026-96334/): WordPress User Registration plugin <= 5.2.7 - Broken Access Control vulnerability (medium 5.6)
- [CVE-2026-96333](https://insights.sbomify.com/CVE-2026-96333/): WordPress GiveWP plugin <= 4.16.8.1 - Payment Bypass vulnerability (high 7.5)
- [CVE-2026-96332](https://insights.sbomify.com/CVE-2026-96332/): WordPress Simple Payment plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-96331](https://insights.sbomify.com/CVE-2026-96331/): WordPress Ajax Search Pro plugin <= 4.29.1 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-96330](https://insights.sbomify.com/CVE-2026-96330/): WordPress tagDiv Opt-In Builder plugin <= 1.7.6 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-9633](https://insights.sbomify.com/CVE-2026-9633/): Redundancy Module Configuration Tool - Multiple Vulnerabilities (high 7.0)
- [CVE-2026-96329](https://insights.sbomify.com/CVE-2026-96329/): WordPress tagDiv Opt-In Builder plugin <= 1.7.6 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-96328](https://insights.sbomify.com/CVE-2026-96328/): WordPress JNews - Pay Writer plugin <= 12.0.1 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-96327](https://insights.sbomify.com/CVE-2026-96327/): WordPress WPLMS plugin < 1.9.9.8.2 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-96326](https://insights.sbomify.com/CVE-2026-96326/): Cross-site scripting in HT Contact Form – Drag & Drop Form Builder for WordPress (high 7.2)
- [CVE-2026-96325](https://insights.sbomify.com/CVE-2026-96325/): Windows SMB Server Denial of Service Vulnerability (high 7.5)
- [CVE-2026-96324](https://insights.sbomify.com/CVE-2026-96324/): Microsoft Windows Search Component Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-96323](https://insights.sbomify.com/CVE-2026-96323/): Windows Update Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-96322](https://insights.sbomify.com/CVE-2026-96322/): Windows Remote Desktop Protocol Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-96321](https://insights.sbomify.com/CVE-2026-96321/): Remote Desktop Display Driver Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-96320](https://insights.sbomify.com/CVE-2026-96320/): Windows DHCP Server Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-9632](https://insights.sbomify.com/CVE-2026-9632/): UTT HiPER 1250GW Web Management formGroupConfig strcpy stack-based overflow (high 8.7)
- [CVE-2026-96319](https://insights.sbomify.com/CVE-2026-96319/): Windows USB Print Driver Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-96318](https://insights.sbomify.com/CVE-2026-96318/): Windows Resume Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-96317](https://insights.sbomify.com/CVE-2026-96317/): Windows Kernel Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-96316](https://insights.sbomify.com/CVE-2026-96316/): Windows Routing and Remote Access Service (RRAS) Tampering Vulnerability (medium 5.5)
- [CVE-2026-96315](https://insights.sbomify.com/CVE-2026-96315/): Windows Overlay Filter Tampering Vulnerability (medium 5.5)
- [CVE-2026-96314](https://insights.sbomify.com/CVE-2026-96314/): Windows Audio Service Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-96313](https://insights.sbomify.com/CVE-2026-96313/): Windows Push Notifications Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-96312](https://insights.sbomify.com/CVE-2026-96312/): Windows Kernel Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-96311](https://insights.sbomify.com/CVE-2026-96311/): Windows Network List Service Tampering Vulnerability (medium 5.5)
- [CVE-2026-96310](https://insights.sbomify.com/CVE-2026-96310/): Windows USB Print Driver Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-9631](https://insights.sbomify.com/CVE-2026-9631/): UTT HiPER 1250GW Web Management formConfigFastDirectionW strcpy stack-based overflow (high 8.7)
- [CVE-2026-96309](https://insights.sbomify.com/CVE-2026-96309/): Windows Subsystem for Linux Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-96308](https://insights.sbomify.com/CVE-2026-96308/): Windows Installer Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-96307](https://insights.sbomify.com/CVE-2026-96307/): Windows Installer Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-96306](https://insights.sbomify.com/CVE-2026-96306/): Windows Sysmain Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-96305](https://insights.sbomify.com/CVE-2026-96305/): Windows Installer Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-96304](https://insights.sbomify.com/CVE-2026-96304/): Windows USB Print Driver Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-96303](https://insights.sbomify.com/CVE-2026-96303/): Microsoft PowerShell Security Feature Bypass Vulnerability (medium 6.5)
- [CVE-2026-96302](https://insights.sbomify.com/CVE-2026-96302/): Windows Installer Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-96301](https://insights.sbomify.com/CVE-2026-96301/): Windows USB Print Driver Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-96300](https://insights.sbomify.com/CVE-2026-96300/): RPC Endpoint Mapper Service Denial of Service Vulnerability (medium 5.9)
- [CVE-2026-96299](https://insights.sbomify.com/CVE-2026-96299/): Missing Authorization Check on Internal Aggregation Stage in MongoDB Server mongos Leads to Denial of Service (high 7.1)
- [CVE-2026-96297](https://insights.sbomify.com/CVE-2026-96297/): MongoDB Server may disclose process memory via a crafted `$_internalApplyOplogUpdate` aggregation pipeline (medium 6.0)
- [CVE-2026-96294](https://insights.sbomify.com/CVE-2026-96294/): Apache Thrift: nodejs web server: no `error` listener on an upgraded WebSocket connection (high 8.7)
- [CVE-2026-96293](https://insights.sbomify.com/CVE-2026-96293/): Endpoint Security Cleartext Storage of FileVault Recovery Key in Log File (medium 6.9)
- [CVE-2026-96292](https://insights.sbomify.com/CVE-2026-96292/): Apache Thrift: Lua `THttpTransport:_parseHeaders` matches each header line with a backtracking pattern (quadratic) (high 8.2)
- [CVE-2026-9629](https://insights.sbomify.com/CVE-2026-9629/): Canvas <= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Block Attribute (medium 6.4)
- [CVE-2026-96289](https://insights.sbomify.com/CVE-2026-96289/): Apache Thrift: php `--gen php:inlined` struct readers (and `TProtocol::skipBinary`) have no recursion-depth guard (high 8.2)
- [CVE-2026-96288](https://insights.sbomify.com/CVE-2026-96288/): Apache Thrift: Erlang generated struct reads have no recursion-depth guard (unbounded memory) (high 8.2)
- [CVE-2026-96287](https://insights.sbomify.com/CVE-2026-96287/): Denial of service in Apache Thrift (high 8.2)
- [CVE-2026-96286](https://insights.sbomify.com/CVE-2026-96286/): Apache Thrift: Perl servers end `serve()` when serving one connection fails (high 8.2)
- [CVE-2026-96284](https://insights.sbomify.com/CVE-2026-96284/): Flatpak: flatpak: arbitrary read-access to files in the system-helper context via oci symlink following (low 2.5)
- [CVE-2026-96283](https://insights.sbomify.com/CVE-2026-96283/): Flatpak: flatpak: flatpak-system-helper cross-user cancelpull orphans another user's ongoing pull (low 3.3)
- [CVE-2026-96282](https://insights.sbomify.com/CVE-2026-96282/): Flatpak: flatpak: extension metadata path traversal file existence oracle (low 3.1)
- [CVE-2026-96281](https://insights.sbomify.com/CVE-2026-96281/): Flatpak: flatpak: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes (medium 6.2)
- [CVE-2026-96280](https://insights.sbomify.com/CVE-2026-96280/): Flatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systems (high 7.5)
- [CVE-2026-9628](https://insights.sbomify.com/CVE-2026-9628/): UTT HiPER 1200GW Web Management formPptpClientConfig stack-based overflow (high 8.7)
- [CVE-2026-96279](https://insights.sbomify.com/CVE-2026-96279/): Flatpak: flatpak: path traversal issue in oci archive extraction via hardlinks (medium 6.5)
- [CVE-2026-96278](https://insights.sbomify.com/CVE-2026-96278/): WP Photo Album Plus <= 9.3.03.002 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Session History (high 7.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/225/