# Vulnerabilities published in 2026


- [CVE-2026-9557](https://insights.sbomify.com/CVE-2026-9557/): Mautic Focus component Vulnerable to SSRF (medium 6.4)
- [CVE-2026-95534](https://insights.sbomify.com/CVE-2026-95534/): Deserialization in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) (high 8.8)
- [CVE-2026-95531](https://insights.sbomify.com/CVE-2026-95531/): WordPress Conversational Forms for ChatBot plugin <= 1.5.0 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-95530](https://insights.sbomify.com/CVE-2026-95530/): WordPress PixelYourSite – Your smart PIXEL (TAG) Manager plugin <= 11.4.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-95529](https://insights.sbomify.com/CVE-2026-95529/): WordPress Calculated Fields Form plugin <= 5.5.1.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-95528](https://insights.sbomify.com/CVE-2026-95528/): WordPress Core Web Vitals & PageSpeed Booster plugin <= 1.0.31 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-95527](https://insights.sbomify.com/CVE-2026-95527/): WordPress Conekta Payment Gateway plugin <= 6.2.4 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-95526](https://insights.sbomify.com/CVE-2026-95526/): WordPress BEAR plugin <= 1.2.2 - Broken Access Control vulnerability (high 7.3)
- [CVE-2026-95525](https://insights.sbomify.com/CVE-2026-95525/): WordPress WP User Frontend plugin <= 4.3.11 - Arbitrary File Deletion vulnerability (medium 6.5)
- [CVE-2026-95524](https://insights.sbomify.com/CVE-2026-95524/): WordPress WP User Frontend plugin <= 4.3.11 - Bypass Vulnerability vulnerability (medium 5.3)
- [CVE-2026-95523](https://insights.sbomify.com/CVE-2026-95523/): WordPress WP User Frontend plugin <= 4.3.11 - Bypass Vulnerability vulnerability (medium 6.5)
- [CVE-2026-95522](https://insights.sbomify.com/CVE-2026-95522/): WordPress Easy Digital Downloads plugin <= 3.7.0 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-95521](https://insights.sbomify.com/CVE-2026-95521/): Rpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpm (high 7.8)
- [CVE-2026-95520](https://insights.sbomify.com/CVE-2026-95520/): Integer overflow in Red Hat Enterprise Linux 10 (high 7.1)
- [CVE-2026-9552](https://insights.sbomify.com/CVE-2026-9552/): Das Parking Management System 停车场管理系统 Search API Endpoint sql injection (medium 6.9)
- [CVE-2026-95519](https://insights.sbomify.com/CVE-2026-95519/): Rpm: code execution via macro expansion of manifest entries in `rpmgi` (`-q -p` / verify manifest flows) (high 7.8)
- [CVE-2026-95515](https://insights.sbomify.com/CVE-2026-95515/): WordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-95514](https://insights.sbomify.com/CVE-2026-95514/): WordPress Netgsm plugin <= 2.10.0 - Bypass Vulnerability vulnerability (medium 5.3)
- [CVE-2026-95513](https://insights.sbomify.com/CVE-2026-95513/): Missing authorization in Online Booking & Scheduling Calendar for WordPress by vcita (high 7.5)
- [CVE-2026-95512](https://insights.sbomify.com/CVE-2026-95512/): Freetype: freetype: denial of service via repeated subroutine allocations in cid font loader (medium 5.5)
- [CVE-2026-9551](https://insights.sbomify.com/CVE-2026-9551/): Das Parking Management System 停车场管理系统 API Endpoint ExportParkingRecords xp_cmdshell sql injection (medium 6.9)
- [CVE-2026-95509](https://insights.sbomify.com/CVE-2026-95509/): Out-of-bounds read vulnerability in string formatting impacts Qt for MCUs (high 8.8)
- [CVE-2026-95508](https://insights.sbomify.com/CVE-2026-95508/): Libslirp: libslirp: heap buffer overflow in dhcpv6/tftp response builders on small interface mtu (high 7.4)
- [CVE-2026-95503](https://insights.sbomify.com/CVE-2026-95503/): Keycloak-services: keycloak-services: potential kdc spoofing bypass when kerberos password authentication is enabled (medium 6.8)
- [CVE-2026-95502](https://insights.sbomify.com/CVE-2026-95502/): Git Sync memory exhaustion via a malicious Git server (medium 5.3)
- [CVE-2026-95501](https://insights.sbomify.com/CVE-2026-95501/): mtrano APENCMS Template weasel.php eval code injection (medium 4.8)
- [CVE-2026-95500](https://insights.sbomify.com/CVE-2026-95500/): JosephChuks php-file-manager-with-code-editor Save codeEditor.php file_put_contents unrestricted upload (medium 6.9)
- [CVE-2026-9550](https://insights.sbomify.com/CVE-2026-9550/): Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform upfile path traversal (medium 6.9)
- [CVE-2026-95499](https://insights.sbomify.com/CVE-2026-95499/): JosephChuks php-file-manager-with-code-editor filemanager.php move_uploaded_file unrestricted upload (medium 6.9)
- [CVE-2026-9549](https://insights.sbomify.com/CVE-2026-9549/): Fix XSS in service discovery active check output (medium 4.8)
- [CVE-2026-9548](https://insights.sbomify.com/CVE-2026-9548/): Cross-site scripting in Synology Chat Server (medium 6.5)
- [CVE-2026-9547](https://insights.sbomify.com/CVE-2026-9547/): SSH improper host validation (high 7.4)
- [CVE-2026-9546](https://insights.sbomify.com/CVE-2026-9546/): sending old referer (high 7.5)
- [CVE-2026-9545](https://insights.sbomify.com/CVE-2026-9545/): exposing HTTP/3 early data (high 7.5)
- [CVE-2026-9544](https://insights.sbomify.com/CVE-2026-9544/): Shenzhen Sixun Software Sixun Shanghui Group Business Management System PayConfig sql injection (medium 6.9)
- [CVE-2026-9543](https://insights.sbomify.com/CVE-2026-9543/): Totolink N300RH Web Management cstecgi.cgi setPasswordCfg os command injection (critical 9.3)
- [CVE-2026-9542](https://insights.sbomify.com/CVE-2026-9542/): CodeAstro Leave Management System add_staff.php sql injection (medium 5.3)
- [CVE-2026-9541](https://insights.sbomify.com/CVE-2026-9541/): Squirrel Cnut File sqobject.cpp ReadObject heap-based overflow (medium 4.8)
- [CVE-2026-9540](https://insights.sbomify.com/CVE-2026-9540/): vllm-project vllm OpenAI-compatible Serving Path denial of service (medium 6.9)
- [CVE-2026-95396](https://insights.sbomify.com/CVE-2026-95396/): sfturing hosp_order Public Search Handlers HospitalController.java cross site scripting (medium 5.3)
- [CVE-2026-95395](https://insights.sbomify.com/CVE-2026-95395/): Missing Release of Memory after Effective Lifetime in Wireshark (medium 5.5)
- [CVE-2026-95394](https://insights.sbomify.com/CVE-2026-95394/): Unchecked Input for Loop Condition in Wireshark (medium 4.7)
- [CVE-2026-95393](https://insights.sbomify.com/CVE-2026-95393/): Heap-based Buffer Overflow in Wireshark (medium 4.7)
- [CVE-2026-95392](https://insights.sbomify.com/CVE-2026-95392/): Buffer Over-read in Wireshark (medium 5.5)
- [CVE-2026-95391](https://insights.sbomify.com/CVE-2026-95391/): Use After Free in Wireshark (medium 5.5)
- [CVE-2026-95390](https://insights.sbomify.com/CVE-2026-95390/): NULL Pointer Dereference in Wireshark (medium 5.5)
- [CVE-2026-9539](https://insights.sbomify.com/CVE-2026-9539/): libslirp TCP URG OOB Read Information Leak (medium 6.5)
- [CVE-2026-95389](https://insights.sbomify.com/CVE-2026-95389/): Heap-based Buffer Overflow in Wireshark (high 8.1)
- [CVE-2026-95388](https://insights.sbomify.com/CVE-2026-95388/): Heap-based Buffer Overflow in Wireshark (medium 5.5)
- [CVE-2026-95387](https://insights.sbomify.com/CVE-2026-95387/): Heap-based Buffer Overflow in Wireshark (high 8.1)
- [CVE-2026-95386](https://insights.sbomify.com/CVE-2026-95386/): Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark (medium 5.5)
- [CVE-2026-95385](https://insights.sbomify.com/CVE-2026-95385/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-95384](https://insights.sbomify.com/CVE-2026-95384/): Race condition in Chrome (medium 5.3)
- [CVE-2026-95382](https://insights.sbomify.com/CVE-2026-95382/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-95381](https://insights.sbomify.com/CVE-2026-95381/): Other in Chrome (high 8.3)
- [CVE-2026-95380](https://insights.sbomify.com/CVE-2026-95380/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-9538](https://insights.sbomify.com/CVE-2026-9538/): Denial of service in Archive::Tar (high 7.5)
- [CVE-2026-95376](https://insights.sbomify.com/CVE-2026-95376/): Security feature bypass in Chrome (high 8.0)
- [CVE-2026-95375](https://insights.sbomify.com/CVE-2026-95375/): Security feature bypass in Chrome (medium 6.3)
- [CVE-2026-95374](https://insights.sbomify.com/CVE-2026-95374/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-95373](https://insights.sbomify.com/CVE-2026-95373/): Use after free in Chrome (high 8.8)
- [CVE-2026-95372](https://insights.sbomify.com/CVE-2026-95372/): Use after free in Chrome (high 8.3)
- [CVE-2026-95371](https://insights.sbomify.com/CVE-2026-95371/): Missing authorization in Chrome (medium 5.4)
- [CVE-2026-95370](https://insights.sbomify.com/CVE-2026-95370/): Security feature bypass in Chrome (medium 5.4)
- [CVE-2026-9537](https://insights.sbomify.com/CVE-2026-9537/): Mojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time string comparison (medium 5.3)
- [CVE-2026-95369](https://insights.sbomify.com/CVE-2026-95369/): Code injection in Chrome (high 8.8)
- [CVE-2026-95368](https://insights.sbomify.com/CVE-2026-95368/): Missing authorization in Chrome (medium 4.3)
- [CVE-2026-95367](https://insights.sbomify.com/CVE-2026-95367/): Information disclosure in Chrome (medium 5.3)
- [CVE-2026-95366](https://insights.sbomify.com/CVE-2026-95366/): Use after free in Chrome (medium 6.5)
- [CVE-2026-95365](https://insights.sbomify.com/CVE-2026-95365/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-95364](https://insights.sbomify.com/CVE-2026-95364/): Other in Chrome (medium 5.4)
- [CVE-2026-95363](https://insights.sbomify.com/CVE-2026-95363/): Other in Chrome (medium 5.4)
- [CVE-2026-95362](https://insights.sbomify.com/CVE-2026-95362/): Cross-site request forgery in Chrome (high 8.8)
- [CVE-2026-95361](https://insights.sbomify.com/CVE-2026-95361/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2026-95360](https://insights.sbomify.com/CVE-2026-95360/): Race condition in Chrome (medium 5.3)
- [CVE-2026-9536](https://insights.sbomify.com/CVE-2026-9536/): Memory corruption in vtk (high 7.5)
- [CVE-2026-95359](https://insights.sbomify.com/CVE-2026-95359/): Information disclosure in Chrome (low 3.4)
- [CVE-2026-95358](https://insights.sbomify.com/CVE-2026-95358/): Security feature bypass in Chrome (medium 4.4)
- [CVE-2026-95357](https://insights.sbomify.com/CVE-2026-95357/): Memory corruption in Chrome (critical 9.6)
- [CVE-2026-95356](https://insights.sbomify.com/CVE-2026-95356/): Use after free in Chrome (critical 9.6)
- [CVE-2026-95355](https://insights.sbomify.com/CVE-2026-95355/): Missing authorization in Chrome (high 8.3)
- [CVE-2026-95354](https://insights.sbomify.com/CVE-2026-95354/): Use after free in Chrome (high 8.3)
- [CVE-2026-95353](https://insights.sbomify.com/CVE-2026-95353/): Use after free in Chrome (high 8.8)
- [CVE-2026-95352](https://insights.sbomify.com/CVE-2026-95352/): Security feature bypass in Chrome (medium 5.4)
- [CVE-2026-95351](https://insights.sbomify.com/CVE-2026-95351/): Use after free in Chrome (high 8.3)
- [CVE-2026-95350](https://insights.sbomify.com/CVE-2026-95350/): Memory corruption in Chrome (critical 9.6)
- [CVE-2026-9535](https://insights.sbomify.com/CVE-2026-9535/): Memory corruption in vtk (high 8.2)
- [CVE-2026-95349](https://insights.sbomify.com/CVE-2026-95349/): Memory corruption in Chrome (critical 9.6)
- [CVE-2026-95348](https://insights.sbomify.com/CVE-2026-95348/): Use after free in Chrome (high 8.3)
- [CVE-2026-95347](https://insights.sbomify.com/CVE-2026-95347/): Use after free in Chrome (critical 9.6)
- [CVE-2026-95346](https://insights.sbomify.com/CVE-2026-95346/): Other in Chrome (medium 4.8)
- [CVE-2026-95345](https://insights.sbomify.com/CVE-2026-95345/): Use after free in Chrome (high 8.8)
- [CVE-2026-95344](https://insights.sbomify.com/CVE-2026-95344/): Race condition in Chrome (high 8.0)
- [CVE-2026-95343](https://insights.sbomify.com/CVE-2026-95343/): Use after free in Chrome (high 8.8)
- [CVE-2026-95342](https://insights.sbomify.com/CVE-2026-95342/): Missing authorization in Chrome (medium 4.3)
- [CVE-2026-95341](https://insights.sbomify.com/CVE-2026-95341/): Other in Chrome (high 8.3)
- [CVE-2026-95340](https://insights.sbomify.com/CVE-2026-95340/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2026-9534](https://insights.sbomify.com/CVE-2026-9534/): Totolink CA750-PoE Setting cstecgi.cgi setWiFiWpsConfig os command injection (medium 5.3)
- [CVE-2026-95339](https://insights.sbomify.com/CVE-2026-95339/): Use after free in Chrome (critical 9.6)
- [CVE-2026-95338](https://insights.sbomify.com/CVE-2026-95338/): Use after free in Chrome (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/229/