# Vulnerabilities published in 2026


- [CVE-2026-94169](https://insights.sbomify.com/CVE-2026-94169/): WordPress The Grid plugin <= 2.8.1 - Remote Code Execution (RCE) vulnerability (critical 10.0)
- [CVE-2026-94168](https://insights.sbomify.com/CVE-2026-94168/): WordPress Premium Addons for Elementor plugin <= 4.11.105 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-94167](https://insights.sbomify.com/CVE-2026-94167/): WordPress Kubio AI Page Builder plugin <= 2.9.3 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-94166](https://insights.sbomify.com/CVE-2026-94166/): WordPress UpSolution Core plugin <= 8.44 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-94161](https://insights.sbomify.com/CVE-2026-94161/): WordPress Grand Restaurant theme < 7.0.11 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-94160](https://insights.sbomify.com/CVE-2026-94160/): WordPress ThemeStek Extras for LabtechCO Theme plugin <= 8.4 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-9416](https://insights.sbomify.com/CVE-2026-9416/): code-projects Employee Management System myprofile.php cross site scripting (medium 5.3)
- [CVE-2026-94159](https://insights.sbomify.com/CVE-2026-94159/): WordPress Total Donations plugin <= 2.0.5 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-94158](https://insights.sbomify.com/CVE-2026-94158/): WordPress Gloria Admin Panel plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-94154](https://insights.sbomify.com/CVE-2026-94154/): Aurora Heatmap <= 1.7.2 - Unauthenticated Stored Cross-Site Scripting via 'url' Parameter (medium 6.1)
- [CVE-2026-94152](https://insights.sbomify.com/CVE-2026-94152/): Omega Solution FBP Fulfillment by People User Profile API user authorization (medium 5.3)
- [CVE-2026-94151](https://insights.sbomify.com/CVE-2026-94151/): Omega Solution HRM OS Role Permission API permission missing authentication (medium 6.9)
- [CVE-2026-94150](https://insights.sbomify.com/CVE-2026-94150/): Omega Solution HRM OS SVG File Upload view cross site scripting (medium 4.8)
- [CVE-2026-9415](https://insights.sbomify.com/CVE-2026-9415/): code-projects Employee Management System eloginwel.php cross site scripting (medium 5.3)
- [CVE-2026-94149](https://insights.sbomify.com/CVE-2026-94149/): Omega Solution HRM OS Role Permission Retrieval Endpoint permission resource injection (medium 5.3)
- [CVE-2026-94148](https://insights.sbomify.com/CVE-2026-94148/): ScadaBR Export Project Endpoint export_project.htm EmportDwr.createExportJSON information disclosure (medium 6.9)
- [CVE-2026-94146](https://insights.sbomify.com/CVE-2026-94146/): BioStar BIOS Update Utility IOCTL BSMEM64_W10.sys sub_110BC write-what-where (critical 9.3)
- [CVE-2026-94145](https://insights.sbomify.com/CVE-2026-94145/): xuxueli xxl-job Task Management JobInfoController.java cross site scripting (medium 5.1)
- [CVE-2026-94144](https://insights.sbomify.com/CVE-2026-94144/): drogonframework drogon ORM Criteria.cc makeCriteria sql injection (medium 6.9)
- [CVE-2026-94143](https://insights.sbomify.com/CVE-2026-94143/): drogonframework drogon ORM Mapper Mapper.h orderBy sql injection (medium 6.9)
- [CVE-2026-94142](https://insights.sbomify.com/CVE-2026-94142/): BioStar Temperature Monitor Utility IOCTL BS_HWMIO64_W10.sys sub_1105C write-what-where (critical 9.3)
- [CVE-2026-94140](https://insights.sbomify.com/CVE-2026-94140/): Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no. (not scored)
- [CVE-2026-9414](https://insights.sbomify.com/CVE-2026-9414/): SourceCodester Indian Invoicing System Invoice Template Render Database-Backed add_order.php cross site scripting (medium 5.1)
- [CVE-2026-94139](https://insights.sbomify.com/CVE-2026-94139/): Chengdu Feiyuxing Technology Feiyu Star Router Cookie send_order.cgi command injection (medium 5.3)
- [CVE-2026-94138](https://insights.sbomify.com/CVE-2026-94138/): Chengdu Feiyuxing Technology Feiyu Star Router send_order.cgi command injection (medium 5.1)
- [CVE-2026-94137](https://insights.sbomify.com/CVE-2026-94137/): Hangzhou Shunwang Technology shzh IRP_MJ_DEVICE_CONTROL shdrv_x64.sys sub_180004AC0 denial of service (medium 4.8)
- [CVE-2026-94135](https://insights.sbomify.com/CVE-2026-94135/): Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default (medium 4.3)
- [CVE-2026-94134](https://insights.sbomify.com/CVE-2026-94134/): Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default (critical 9.1)
- [CVE-2026-94132](https://insights.sbomify.com/CVE-2026-94132/): File upload in AcyMailing Enterprise extension for Joomla (critical 9.5)
- [CVE-2026-94131](https://insights.sbomify.com/CVE-2026-94131/): Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.0 (high 8.3)
- [CVE-2026-94130](https://insights.sbomify.com/CVE-2026-94130/): Joomla Extension - joomlaboat.com - Unauthenticated SQL injection in YouTube Gallery extension < 5.7.3 (critical 9.3)
- [CVE-2026-9413](https://insights.sbomify.com/CVE-2026-9413/): SourceCodester Indian Invoicing System category.php cross site scripting (medium 5.3)
- [CVE-2026-94129](https://insights.sbomify.com/CVE-2026-94129/): BioStar VALKYRIE AURORA IOCTL BS_RVSIO64.sys sub_1105C write-what-where (critical 9.3)
- [CVE-2026-94128](https://insights.sbomify.com/CVE-2026-94128/): BioStar VIVID LED DJ IOCTL BS_LED64.sys sub_1105C write-what-where (critical 9.3)
- [CVE-2026-94127](https://insights.sbomify.com/CVE-2026-94127/): F5 BIG-IP APM Heap-based Buffer Overflow (critical 9.3, exploited in the wild)
- [CVE-2026-94124](https://insights.sbomify.com/CVE-2026-94124/): WordPress WP EasyCart plugin <= 5.9.4 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-94123](https://insights.sbomify.com/CVE-2026-94123/): WordPress NextGEN Gallery plugin <= 4.5.0 - Arbitrary File Download vulnerability (high 7.5)
- [CVE-2026-94122](https://insights.sbomify.com/CVE-2026-94122/): WordPress Responsive Slider Gallery plugin <= 1.5.5 - PHP Object Injection vulnerability (high 7.2)
- [CVE-2026-94121](https://insights.sbomify.com/CVE-2026-94121/): Deserialization in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer (high 8.8)
- [CVE-2026-94120](https://insights.sbomify.com/CVE-2026-94120/): WordPress GravityExport Lite for Gravity Forms plugin <= 2.7.2 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-9412](https://insights.sbomify.com/CVE-2026-9412/): SourceCodester Indian Invoicing System Backend Endpoint access control (medium 5.3)
- [CVE-2026-94118](https://insights.sbomify.com/CVE-2026-94118/): WordPress Premium Blocks – Gutenberg Blocks for WordPress plugin <= 2.3.17 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-94117](https://insights.sbomify.com/CVE-2026-94117/): WordPress HashBar – WordPress Notification Bar plugin <= 2.0.3 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-94115](https://insights.sbomify.com/CVE-2026-94115/): WordPress Easy Pricing Tables plugin <= 4.1.2 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-94114](https://insights.sbomify.com/CVE-2026-94114/): Apache Commons BCEL: Class repositories cache class files under their self-declared names, enabling cache poisoning (high 8.2)
- [CVE-2026-94113](https://insights.sbomify.com/CVE-2026-94113/): Frappe ERPNext before 15.121.0 and 16.34.0 Missing Authorization in Timesheet Endpoints (high 7.1)
- [CVE-2026-94112](https://insights.sbomify.com/CVE-2026-94112/): mayswind ezBookkeeping before 2.0.0 TOTP Replay Attack (high 7.6)
- [CVE-2026-94111](https://insights.sbomify.com/CVE-2026-94111/): Tencent BrowserSkill through 0.3.0 Origin Validation Error in Local WebSocket Daemon (medium 6.9)
- [CVE-2026-94110](https://insights.sbomify.com/CVE-2026-94110/): QCMS Content Detail Controllers.php self_Tmp sql injection (medium 6.9)
- [CVE-2026-9411](https://insights.sbomify.com/CVE-2026-9411/): SourceCodester Indian Invoicing System Invoice Generation IGST_Invoice.php sql injection (medium 5.3)
- [CVE-2026-94109](https://insights.sbomify.com/CVE-2026-94109/): openEQUELLA < 2026.1.0 Authenticated Stored SSTI via FreemarkerPortletRenderer (high 8.6)
- [CVE-2026-94108](https://insights.sbomify.com/CVE-2026-94108/): getID3 through 1.9.26 XML External Entity Injection via XML2array (high 8.3)
- [CVE-2026-94107](https://insights.sbomify.com/CVE-2026-94107/): NivoCart through 2.4.0 Predictable Administrator Password Reset Token (critical 9.2)
- [CVE-2026-94106](https://insights.sbomify.com/CVE-2026-94106/): getID3 before 1.9.26 OS Command Injection via Unescaped Filenames (high 8.7)
- [CVE-2026-94105](https://insights.sbomify.com/CVE-2026-94105/): NivoCart through 2.4.0 Destructive Configuration Write via the Password Reset Controller (medium 6.9)
- [CVE-2026-94104](https://insights.sbomify.com/CVE-2026-94104/): NivoCart through 2.4.0 Arbitrary File Upload RCE via filemanager (high 8.7)
- [CVE-2026-94103](https://insights.sbomify.com/CVE-2026-94103/): RooCMS Frontend Rendering site_pagePHP.php eval code injection (medium 5.1)
- [CVE-2026-94102](https://insights.sbomify.com/CVE-2026-94102/): WuzhiCMS Login index.php redirect (medium 5.3)
- [CVE-2026-94101](https://insights.sbomify.com/CVE-2026-94101/): Netcore NBR200V2 routerd vlan_load_form_uci buffer overflow (critical 9.4)
- [CVE-2026-94100](https://insights.sbomify.com/CVE-2026-94100/): Netcore NBR200V2 WAN VLAN Reconfiguration routerd wan_config_set_vlan buffer overflow (critical 9.4)
- [CVE-2026-9410](https://insights.sbomify.com/CVE-2026-9410/): Sushmi-pal Invoice-System Profile Workflow profile improper authorization (medium 5.3)
- [CVE-2026-94099](https://insights.sbomify.com/CVE-2026-94099/): Netcore NBR200V2 Backup Restore restore.cgi command injection (critical 9.4)
- [CVE-2026-94098](https://insights.sbomify.com/CVE-2026-94098/): Netcore NBR200V2 Firmware Upgrade CGI Endpoint upgrade command injection (critical 9.4)
- [CVE-2026-94097](https://insights.sbomify.com/CVE-2026-94097/): Netcore NBR200V2 CGI Diagnostic Endpoint network_tools command injection (critical 10.0)
- [CVE-2026-94096](https://insights.sbomify.com/CVE-2026-94096/): Netcore NBR200V2 LAN IP Configuration network_tools command injection (critical 9.4)
- [CVE-2026-94095](https://insights.sbomify.com/CVE-2026-94095/): Netcore NBR200V2 Traceroute Diagnostic Feature network_tools command injection (critical 9.4)
- [CVE-2026-94094](https://insights.sbomify.com/CVE-2026-94094/): OpenClaw Canvas Host Route server.ts createCanvasHostHandler denial of service (medium 5.3)
- [CVE-2026-94093](https://insights.sbomify.com/CVE-2026-94093/): DLR-RM stable-baselines3 save_util.py VecNormalize.load deserialization (medium 5.3)
- [CVE-2026-94092](https://insights.sbomify.com/CVE-2026-94092/): dmlc dgl utils.py _read_torch_data deserialization (medium 5.1)
- [CVE-2026-94091](https://insights.sbomify.com/CVE-2026-94091/): piskvorky gensim Model Loader utils.py load deserialization (medium 5.1)
- [CVE-2026-94090](https://insights.sbomify.com/CVE-2026-94090/): JusticeRage Manalyze PE Parser pe.cpp _parse_debug integer underflow (medium 5.3)
- [CVE-2026-9409](https://insights.sbomify.com/CVE-2026-9409/): Sushmi-pal Invoice-System User Management user improper authorization (medium 5.3)
- [CVE-2026-94089](https://insights.sbomify.com/CVE-2026-94089/): D-Link DIR-868L Authentication webfa_authentication.cgi strcpy stack-based overflow (critical 10.0)
- [CVE-2026-94084](https://insights.sbomify.com/CVE-2026-94084/): Use after free in Suricata (critical 9.4)
- [CVE-2026-94083](https://insights.sbomify.com/CVE-2026-94083/): Memory corruption in Suricata (critical 9.4)
- [CVE-2026-94082](https://insights.sbomify.com/CVE-2026-94082/): WordPress Quiz Cat plugin <= 3.1.1 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-94081](https://insights.sbomify.com/CVE-2026-94081/): WordPress WordPress Persistent Login plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-94080](https://insights.sbomify.com/CVE-2026-94080/): WordPress MarketKing plugin <= 2.1.70 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-9408](https://insights.sbomify.com/CVE-2026-9408/): Totolink A8000RU Web Management cstecgi.cgi setStaticDhcpRules os command injection (critical 9.3)
- [CVE-2026-94079](https://insights.sbomify.com/CVE-2026-94079/): WordPress WP User Manager plugin <= 2.9.19 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-94078](https://insights.sbomify.com/CVE-2026-94078/): WordPress Site Reviews plugin <= 8.3.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-94077](https://insights.sbomify.com/CVE-2026-94077/): WordPress Safe SVG plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-94076](https://insights.sbomify.com/CVE-2026-94076/): WordPress SEO Plugin by Squirrly SEO plugin <= 14.2.5 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-94075](https://insights.sbomify.com/CVE-2026-94075/): WordPress Newsletters plugin <= 4.18.1 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-94074](https://insights.sbomify.com/CVE-2026-94074/): WordPress Simply Schedule Appointments plugin <= 1.6.12.29 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-9407](https://insights.sbomify.com/CVE-2026-9407/): Totolink A8000RU Web Management cstecgi.cgi setFirewallType os command injection (critical 9.3)
- [CVE-2026-94067](https://insights.sbomify.com/CVE-2026-94067/): WordPress The Voux theme <= 6.9.5 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-94066](https://insights.sbomify.com/CVE-2026-94066/): WordPress Pond theme <= 2.6.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-94065](https://insights.sbomify.com/CVE-2026-94065/): WordPress ColorFolio theme <= 1.3 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-94064](https://insights.sbomify.com/CVE-2026-94064/): WordPress Neo | Barber Shop WordPress Theme theme <= 3.5 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-94063](https://insights.sbomify.com/CVE-2026-94063/): WordPress Education Center theme <= 3.6.12 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-94062](https://insights.sbomify.com/CVE-2026-94062/): WordPress Werkstatt theme <= 4.8.3 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-94061](https://insights.sbomify.com/CVE-2026-94061/): WordPress Whistle - Sports Club theme <= 4.2 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-94060](https://insights.sbomify.com/CVE-2026-94060/): WordPress Voldor theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-9406](https://insights.sbomify.com/CVE-2026-9406/): Totolink A8000RU Web Management cstecgi.cgi setRemoteCfg os command injection (critical 9.3)
- [CVE-2026-94059](https://insights.sbomify.com/CVE-2026-94059/): WordPress Ogency theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-94058](https://insights.sbomify.com/CVE-2026-94058/): WordPress Treck theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-94057](https://insights.sbomify.com/CVE-2026-94057/): Other in Exim (medium 4.0)
- [CVE-2026-94056](https://insights.sbomify.com/CVE-2026-94056/): Information disclosure in Exim (high 7.5)
- [CVE-2026-94055](https://insights.sbomify.com/CVE-2026-94055/): Use after free in Exim (low 3.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/235/