# Vulnerabilities published in 2026


- [CVE-2026-9433](https://insights.sbomify.com/CVE-2026-9433/): Totolink A8000RU Web Management cstecgi.cgi setMacFilterRules os command injection (critical 9.3)
- [CVE-2026-9432](https://insights.sbomify.com/CVE-2026-9432/): Totolink A8000RU Web Management cstecgi.cgi setWiFiAdvancedCfg os command injection (critical 9.3)
- [CVE-2026-9431](https://insights.sbomify.com/CVE-2026-9431/): Tenda F1202 PptpUserAdd fromPptpUserAdd stack-based overflow (high 8.7)
- [CVE-2026-94301](https://insights.sbomify.com/CVE-2026-94301/): Apache MINA: CVE-2026-47065 resolveProxyClass fix missing from 2.0.X and 2.1.X branches (2.0.30 / 2.1.14) ZDRES-232 (critical 9.8)
- [CVE-2026-94300](https://insights.sbomify.com/CVE-2026-94300/): Concurrent GSS-TSIG messages corrupt memory (high 8.1)
- [CVE-2026-9430](https://insights.sbomify.com/CVE-2026-9430/): Tenda F1202 GstDhcpSetSerof formGstDhcpSetSer stack-based overflow (high 8.7)
- [CVE-2026-94299](https://insights.sbomify.com/CVE-2026-94299/): elegro Crypto Payment <= 1.0.1 - Unauthenticated Arbitrary Order Status Change via IPN Callback (medium 6.5)
- [CVE-2026-94298](https://insights.sbomify.com/CVE-2026-94298/): BuildKit < 1.0.29 - Contributor+ Stored SQLi via list_content Parameter (medium 6.2)
- [CVE-2026-94297](https://insights.sbomify.com/CVE-2026-94297/): Media Library Organizer 2.0.4 - 2.1.3 - Contributor+ Arbitrary Taxonomy Term Creation (low 2.7)
- [CVE-2026-94295](https://insights.sbomify.com/CVE-2026-94295/): Chikkili Google Pay for WooCommerce <= 1.0.6 - Unauthenticated Payment Confirmation Forgery via Unverified Signature (medium 5.3)
- [CVE-2026-94294](https://insights.sbomify.com/CVE-2026-94294/): App Builder 3.8.4 - 5.7.0 - Unauthenticated Option Write and Redirect via includes/pure.php (medium 5.3)
- [CVE-2026-94293](https://insights.sbomify.com/CVE-2026-94293/): Missing authentication for critical function in the aas-edge-client REST API (critical 9.3)
- [CVE-2026-9429](https://insights.sbomify.com/CVE-2026-9429/): Tenda F1202 WrlExtraSet formWrlExtraSet stack-based overflow (high 8.7)
- [CVE-2026-94287](https://insights.sbomify.com/CVE-2026-94287/): Denial of service via unsigned underflow in libXpm's write path (medium 5.5)
- [CVE-2026-94286](https://insights.sbomify.com/CVE-2026-94286/): Out-of-bounds read in libXtst's RECORD reply parser (high 7.1)
- [CVE-2026-94285](https://insights.sbomify.com/CVE-2026-94285/): Out-of-bounds read in libX11's byte-oriented codeset parser (medium 5.1)
- [CVE-2026-94284](https://insights.sbomify.com/CVE-2026-94284/): Out-of-bounds read vulnerability in libX11's XIM trigger-keyregistration parser.registration parser (medium 5.5)
- [CVE-2026-94283](https://insights.sbomify.com/CVE-2026-94283/): Out-of-bounds read vulnerability in libX11's XIM (X Input Method) attribute parser (medium 6.5)
- [CVE-2026-94282](https://insights.sbomify.com/CVE-2026-94282/): Out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion (medium 5.6)
- [CVE-2026-94281](https://insights.sbomify.com/CVE-2026-94281/): Out-of-bounds read in libXi's XListInputDevices() class parsing (medium 6.5)
- [CVE-2026-9428](https://insights.sbomify.com/CVE-2026-9428/): Tenda F1202 PPTPUserSetting fromPPTPUserSetting stack-based overflow (high 8.7)
- [CVE-2026-94278](https://insights.sbomify.com/CVE-2026-94278/): File Media Renamer <= 1.3 - Author+ Arbitrary File Rename via save-attachment-compat (medium 5.5)
- [CVE-2026-94277](https://insights.sbomify.com/CVE-2026-94277/): Stored Cross-Site Scripting in MISP Galaxy Matrix Statistics via Unescaped Galaxy Name (medium 6.3)
- [CVE-2026-94276](https://insights.sbomify.com/CVE-2026-94276/): Apache APISIX: Openid-connect introspection validation issue (medium 5.1)
- [CVE-2026-94275](https://insights.sbomify.com/CVE-2026-94275/): Track Orders for WooCommerce < 1.2.7 - Unauthenticated PII Disclosure via 'email' Parameter (medium 5.3)
- [CVE-2026-94274](https://insights.sbomify.com/CVE-2026-94274/): YayReviews 1.0.4 - 1.4.0 - Unauthenticated Sensitive Data Disclosure via REST API (medium 5.3)
- [CVE-2026-94273](https://insights.sbomify.com/CVE-2026-94273/): Snap Finance <= 3.11.0 - Unauthenticated Payment Confirmation Forgery via snap_finance_complete_payment (medium 5.3)
- [CVE-2026-94272](https://insights.sbomify.com/CVE-2026-94272/): Snap Finance 1.0.8 - 3.11.0 - Unauthenticated Arbitrary Order Status Change via Multiple AJAX Actions (medium 5.3)
- [CVE-2026-94271](https://insights.sbomify.com/CVE-2026-94271/): Deema Payment Gateway <= 1.1.2 - Unauthenticated Payment Confirmation Forgery via Unverified Success Return (medium 5.3)
- [CVE-2026-94270](https://insights.sbomify.com/CVE-2026-94270/): Deema Payment Gateway <= 1.1.2 - Unauthenticated Payment Bypass and Order Manipulation via Webhook (medium 5.3)
- [CVE-2026-9427](https://insights.sbomify.com/CVE-2026-9427/): Edimax EW-7438RPn webs formWlSiteSurvey stack-based overflow (high 8.7)
- [CVE-2026-94269](https://insights.sbomify.com/CVE-2026-94269/): Apache APISIX: Servlet-style normalization creates a route/upstream authorization mismatch (medium 6.3)
- [CVE-2026-94268](https://insights.sbomify.com/CVE-2026-94268/): Privilege escalation in Advanced Custom Fields: Extended (high 8.1)
- [CVE-2026-94267](https://insights.sbomify.com/CVE-2026-94267/): Advanced Custom Fields: Extended < 0.9.2.8 - Unauthenticated RCE via Front-End Post Update Action (critical 9.0)
- [CVE-2026-94266](https://insights.sbomify.com/CVE-2026-94266/): password leak in CURLINFO_EFFECTIVE_URL (not scored)
- [CVE-2026-94265](https://insights.sbomify.com/CVE-2026-94265/): Authorization: Negotiate sent to foreign origin (not scored)
- [CVE-2026-94264](https://insights.sbomify.com/CVE-2026-94264/): Advanced Custom Fields: Extended 0.8.9.4 - 0.9.2.7 - Contributor+ XSS via Form Shortcode Attributes (medium 6.8)
- [CVE-2026-94263](https://insights.sbomify.com/CVE-2026-94263/): Code injection in Advanced Custom Fields: Extended (medium 4.8)
- [CVE-2026-94262](https://insights.sbomify.com/CVE-2026-94262/): Missing authorization in Advanced Custom Fields: Extended (high 8.1)
- [CVE-2026-94261](https://insights.sbomify.com/CVE-2026-94261/): Sifalo Pay 2.0 - 2.5.2 - Unauthenticated Payment Confirmation Forgery via an Unbound Transaction Id (medium 5.3)
- [CVE-2026-94260](https://insights.sbomify.com/CVE-2026-94260/): Sifalo Pay 2.0 - 2.5.2 - Unauthenticated Order Payment Metadata Modification and Forced Order Failure (medium 5.3)
- [CVE-2026-9426](https://insights.sbomify.com/CVE-2026-9426/): Edimax EW-7438RPn formHwSet stack-based overflow (high 8.7)
- [CVE-2026-94258](https://insights.sbomify.com/CVE-2026-94258/): SMS Alert 3.6.4 - 4.0.0 - Admin+ Network User Billing Phone Disclosure via Bulk User Actions (low 2.7)
- [CVE-2026-94257](https://insights.sbomify.com/CVE-2026-94257/): SMS Alert 3.9.6 - 4.0.0 - Unauthenticated Privilege Escalation via Arbitrary Password Reset (high 8.1)
- [CVE-2026-94256](https://insights.sbomify.com/CVE-2026-94256/): SMS Alert 4.0.0 - Unauthenticated Authentication Bypass via Login with OTP (high 8.1)
- [CVE-2026-94254](https://insights.sbomify.com/CVE-2026-94254/): SellKit 2.3.5 - 2.7.0 - Unauthenticated Arbitrary Price Manipulation via 'sellkit_product_prices' Parameter (medium 5.3)
- [CVE-2026-94251](https://insights.sbomify.com/CVE-2026-94251/): Apache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape of a resource (medium 6.5)
- [CVE-2026-94250](https://insights.sbomify.com/CVE-2026-94250/): Apache APISIX: Batch response aggregation can exhaust worker memory (high 8.2)
- [CVE-2026-9425](https://insights.sbomify.com/CVE-2026-9425/): Edimax EW-7438RPn formWlanMP stack-based overflow (high 8.7)
- [CVE-2026-94246](https://insights.sbomify.com/CVE-2026-94246/): Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Forged Wallet Withdrawal Request via IDOR (medium 6.3)
- [CVE-2026-94245](https://insights.sbomify.com/CVE-2026-94245/): Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Arbitrary Wallet Balance Theft via IDOR (medium 6.5)
- [CVE-2026-94244](https://insights.sbomify.com/CVE-2026-94244/): Wallet System for WooCommerce < 2.8.0 - Subscriber+ Store-Wide Wallet Transaction Disclosure via Export (medium 4.3)
- [CVE-2026-94243](https://insights.sbomify.com/CVE-2026-94243/): Apache Sling Security Bundle: RefererFilter accepts weaker-than-origin evidence (high 7.3)
- [CVE-2026-9424](https://insights.sbomify.com/CVE-2026-9424/): Edimax EW-7438RPn Content-Type formWlanMP os command injection (medium 5.3)
- [CVE-2026-94239](https://insights.sbomify.com/CVE-2026-94239/): Loco Translate < 2.8.9 - Translator+ Stored XSS via Bundle Configuration (medium 6.8)
- [CVE-2026-94238](https://insights.sbomify.com/CVE-2026-94238/): Loco Translate < 2.8.9 - Translator+ Limited File Read via 'path' Parameter (medium 6.8)
- [CVE-2026-94235](https://insights.sbomify.com/CVE-2026-94235/): Simple User Registration <= 6.9 - Subscriber+ Arbitrary Email Sending via wpr_send_email_to_user (medium 4.3)
- [CVE-2026-94231](https://insights.sbomify.com/CVE-2026-94231/): TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Service and Category Creation and Modification (medium 5.3)
- [CVE-2026-94230](https://insights.sbomify.com/CVE-2026-94230/): Missing authorization in TrueBooker (medium 5.3)
- [CVE-2026-9423](https://insights.sbomify.com/CVE-2026-9423/): Edimax BR-6675nD POST Request mp command injection (medium 5.1)
- [CVE-2026-94229](https://insights.sbomify.com/CVE-2026-94229/): Missing authorization in TrueBooker (medium 5.3)
- [CVE-2026-94228](https://insights.sbomify.com/CVE-2026-94228/): TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Plugin Settings Overwrite via admin_setting_setup_data (medium 5.3)
- [CVE-2026-94220](https://insights.sbomify.com/CVE-2026-94220/): Apache APISIX: session fixation issue in feishu-auth and dingtalk-auth plugin (low 2.1)
- [CVE-2026-9422](https://insights.sbomify.com/CVE-2026-9422/): KLiK SocialMediaWebsite HTTP POST Request Parameter injection (medium 6.9)
- [CVE-2026-94218](https://insights.sbomify.com/CVE-2026-94218/): Keycloak-services: keycloak-services: 2fa setup enforcement bypass via authentication session restart endpoint (low 3.1)
- [CVE-2026-94217](https://insights.sbomify.com/CVE-2026-94217/): Keycloak-services: keycloak-services: uma scope merge across resource owners via resource name collision (low 3.5)
- [CVE-2026-94216](https://insights.sbomify.com/CVE-2026-94216/): ST Engineering iDirect iDX/Evo iDX HTTP Request authorize response splitting (medium 5.3)
- [CVE-2026-94215](https://insights.sbomify.com/CVE-2026-94215/): Missing authorization in Red Hat Build of Keycloak (medium 5.5)
- [CVE-2026-94214](https://insights.sbomify.com/CVE-2026-94214/): ST Engineering iDirect iDX/Evo iDX Location Header redirect (medium 5.3)
- [CVE-2026-94213](https://insights.sbomify.com/CVE-2026-94213/): Keycloak-services: keycloak-services: authorization services policy evaluation endpoint leaks user identity (medium 4.9)
- [CVE-2026-94212](https://insights.sbomify.com/CVE-2026-94212/): Apache APISIX: unauthenticated impersonation issue in saml-auth (medium 6.4)
- [CVE-2026-94211](https://insights.sbomify.com/CVE-2026-94211/): Hyve5 Leantime Project Dashboard show.blade.php cross site scripting (medium 4.8)
- [CVE-2026-94210](https://insights.sbomify.com/CVE-2026-94210/): Hyve5 Leantime Kanban Board Tickets.php getAllGrouped cross site scripting (medium 5.1)
- [CVE-2026-9421](https://insights.sbomify.com/CVE-2026-9421/): KLiK SocialMediaWebsite File upload.inc.php uniqid unrestricted upload (medium 6.9)
- [CVE-2026-94206](https://insights.sbomify.com/CVE-2026-94206/): Cloak PBKDF2 field ignores the configured iteration count and runs only :size rounds (medium 6.3)
- [CVE-2026-94205](https://insights.sbomify.com/CVE-2026-94205/): Gitea fork workflow approval bypass through maintainer-triggered events (critical 9.8)
- [CVE-2026-94204](https://insights.sbomify.com/CVE-2026-94204/): Incorrect Permission Assignment for Critical Resource in Viidure Dashcam Android Application (high 8.7)
- [CVE-2026-94202](https://insights.sbomify.com/CVE-2026-94202/): Module block-pool create validates two of the four parameter words it reads (medium 4.8)
- [CVE-2026-94201](https://insights.sbomify.com/CVE-2026-94201/): Filtering an :atom attribute with unsafe_to_atom? can exhaust the BEAM atom table in Ash (high 8.2)
- [CVE-2026-94200](https://insights.sbomify.com/CVE-2026-94200/): TLS 1.3 client ticket store crashed by NewSessionTicket with empty early_data extension in ssl (high 8.2)
- [CVE-2026-9420](https://insights.sbomify.com/CVE-2026-9420/): KLiK SocialMediaWebsite HTTP GET Request Parameter injection (medium 5.3)
- [CVE-2026-94197](https://insights.sbomify.com/CVE-2026-94197/): NGINX Ingress Controller vulnerability (high 8.7)
- [CVE-2026-94194](https://insights.sbomify.com/CVE-2026-94194/): Other in mint (medium 6.3)
- [CVE-2026-94192](https://insights.sbomify.com/CVE-2026-94192/): Module object deallocation can free a live ThreadX kernel object (high 8.5)
- [CVE-2026-9419](https://insights.sbomify.com/CVE-2026-9419/): code-projects Employee Management System empproject.php cross site scripting (medium 5.3)
- [CVE-2026-94185](https://insights.sbomify.com/CVE-2026-94185/): nvm alias resolution follows `..` and discloses files outside $NVM_DIR/alias (medium 6.7)
- [CVE-2026-94184](https://insights.sbomify.com/CVE-2026-94184/): Fetchmail: fetchmail: stack-based buffer overflow in ntlm authentication (fetchmail-sa-2026-01) (medium 5.3)
- [CVE-2026-94183](https://insights.sbomify.com/CVE-2026-94183/): Address bar spoofing risk in affected Android versions of Arc Search (high 7.4)
- [CVE-2026-94181](https://insights.sbomify.com/CVE-2026-94181/): Address Bar Spoof Risk; Missing Fullscreen Notification via Select Element (high 7.4)
- [CVE-2026-94180](https://insights.sbomify.com/CVE-2026-94180/): WordPress Advanced Ads plugin <= 2.0.26 - Sensitive Data Exposure vulnerability (medium 4.3)
- [CVE-2026-9418](https://insights.sbomify.com/CVE-2026-9418/): code-projects Employee Management System changepassemp.php cross site scripting (medium 5.3)
- [CVE-2026-94179](https://insights.sbomify.com/CVE-2026-94179/): WordPress Razorpay Payment Button plugin <= 2.4.9 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-94178](https://insights.sbomify.com/CVE-2026-94178/): WordPress Import and export users and customers plugin <= 2.5.2 - Privilege Escalation vulnerability (high 7.5)
- [CVE-2026-94177](https://insights.sbomify.com/CVE-2026-94177/): WordPress GamiPress plugin <= 8.0.2 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-94176](https://insights.sbomify.com/CVE-2026-94176/): WordPress Mang Board WP plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-94174](https://insights.sbomify.com/CVE-2026-94174/): WordPress Email Log plugin <= 2.63 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-94173](https://insights.sbomify.com/CVE-2026-94173/): WordPress Business Directory plugin <= 6.4.27 - Insecure Direct Object References (IDOR) vulnerability (medium 5.4)
- [CVE-2026-94171](https://insights.sbomify.com/CVE-2026-94171/): WordPress CURCY plugin 2.2.18 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-94170](https://insights.sbomify.com/CVE-2026-94170/): WordPress Sassy Social Share plugin <= 3.3.79 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-9417](https://insights.sbomify.com/CVE-2026-9417/): code-projects Employee Management System myprofileup.php cross site scripting (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/234/