# Vulnerabilities published in 2026


- [CVE-2026-93944](https://insights.sbomify.com/CVE-2026-93944/): WordPress Camelia theme <= 1.2.15 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-93943](https://insights.sbomify.com/CVE-2026-93943/): WordPress Convex theme <= 1.16.0 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-93942](https://insights.sbomify.com/CVE-2026-93942/): WordPress Dwell theme <= 1.16.0 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-93941](https://insights.sbomify.com/CVE-2026-93941/): WordPress Edema theme <= 1.2.2.2 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-93940](https://insights.sbomify.com/CVE-2026-93940/): WordPress Greeny theme <= 2.10.0 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-9394](https://insights.sbomify.com/CVE-2026-9394/): Besen BS20 EV Charging Station Bluetooth Low Energy weak password (low 2.3)
- [CVE-2026-93938](https://insights.sbomify.com/CVE-2026-93938/): WordPress Hogwords theme <= 1.2.7 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-93937](https://insights.sbomify.com/CVE-2026-93937/): WordPress Hygia theme <= 1.21.0 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-93936](https://insights.sbomify.com/CVE-2026-93936/): WordPress IPharm theme <= 1.2.4 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-93935](https://insights.sbomify.com/CVE-2026-93935/): WordPress Let's Play theme <= 1.1.15 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-93934](https://insights.sbomify.com/CVE-2026-93934/): WordPress Partiso theme <= 1.1.13 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-93933](https://insights.sbomify.com/CVE-2026-93933/): WordPress Rosalinda theme <= 1.2.4 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-93932](https://insights.sbomify.com/CVE-2026-93932/): WordPress Smart Casa theme <= 1.0.12 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-93931](https://insights.sbomify.com/CVE-2026-93931/): WordPress Smash theme <= 1.12.0 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-93930](https://insights.sbomify.com/CVE-2026-93930/): WordPress Tantra theme <= 2.9.0 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-9393](https://insights.sbomify.com/CVE-2026-9393/): H3C Magic B0 aspForm Edit_BasicSSID_5G buffer overflow (high 8.7)
- [CVE-2026-93929](https://insights.sbomify.com/CVE-2026-93929/): WordPress Travesia theme <= 1.1.16 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-93928](https://insights.sbomify.com/CVE-2026-93928/): WordPress Taxi Booking Manager for WooCommerce plugin < 2.0.8 - Broken Authentication vulnerability (high 7.3)
- [CVE-2026-93927](https://insights.sbomify.com/CVE-2026-93927/): WordPress Veto theme <= 1.6.0 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-93926](https://insights.sbomify.com/CVE-2026-93926/): Apache Thrift: C++ `THeaderTransport::untransform()` leaks the zlib stream on the error path (high 8.7)
- [CVE-2026-93925](https://insights.sbomify.com/CVE-2026-93925/): Apache Thrift: C++ `THeaderTransport::writeVarint32()` stack buffer overflow on a negative protocol id (high 8.7)
- [CVE-2026-93923](https://insights.sbomify.com/CVE-2026-93923/): SiYuan through 3.8.4 Stored XSS via Heading Style Attribute (high 8.6)
- [CVE-2026-93922](https://insights.sbomify.com/CVE-2026-93922/): SiYuan through 3.8.4 Stored XSS via notebook names (high 8.6)
- [CVE-2026-93921](https://insights.sbomify.com/CVE-2026-93921/): SiYuan through 3.8.4 Access Control Bypass via Dynamic Icon Endpoint (medium 5.3)
- [CVE-2026-93909](https://insights.sbomify.com/CVE-2026-93909/): IBM WebSphere Application Server Liberty is affected by an authentication bypass (critical 9.1)
- [CVE-2026-93908](https://insights.sbomify.com/CVE-2026-93908/): Real Estate Manager <= 7.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'before_price_text' Parameter (medium 6.4)
- [CVE-2026-93907](https://insights.sbomify.com/CVE-2026-93907/): IBM WebSphere Application Server is affected by a bypass authentication vulnerability (high 8.1)
- [CVE-2026-93905](https://insights.sbomify.com/CVE-2026-93905/): IBM WebSphere Application Server Liberty is affected by a deserialization of untrusted data (high 8.2)
- [CVE-2026-93904](https://insights.sbomify.com/CVE-2026-93904/): Social Web Suite <= 4.1.12 - Unauthenticated SQL Injection via 'exclude_posts' Parameter (high 7.5)
- [CVE-2026-93903](https://insights.sbomify.com/CVE-2026-93903/): Open redirect in LiteSpeed Web Server (critical 9.4)
- [CVE-2026-93901](https://insights.sbomify.com/CVE-2026-93901/): Privilege escalation in Optima Express IDX (high 7.3)
- [CVE-2026-9390](https://insights.sbomify.com/CVE-2026-9390/): XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup (critical 9.1)
- [CVE-2026-93899](https://insights.sbomify.com/CVE-2026-93899/): Better Messages <= 3.0.4 - Authenticated (Subscriber+) SQL Injection via 'group_id' Message Meta Parameter (medium 6.5)
- [CVE-2026-93897](https://insights.sbomify.com/CVE-2026-93897/): Cross-site scripting in GeoDirectory – WP Business Directory Plugin and Classified Listings Directory (medium 6.4)
- [CVE-2026-93896](https://insights.sbomify.com/CVE-2026-93896/): WPFront Notification Bar <= 3.5.1 - Reflected Cross-Site Scripting via REQUEST_URI (medium 6.1)
- [CVE-2026-93895](https://insights.sbomify.com/CVE-2026-93895/): IBM WebSphere Application Server Liberty Improper Access Control (critical 9.1)
- [CVE-2026-93894](https://insights.sbomify.com/CVE-2026-93894/): Memory corruption in Varnish Cache (low 2.3)
- [CVE-2026-93892](https://insights.sbomify.com/CVE-2026-93892/): Security Vulnerability identified in IBM TRIRIGA - Information Disclosure in Admin Console (high 8.1)
- [CVE-2026-93891](https://insights.sbomify.com/CVE-2026-93891/): Security Vulnerability identified in IBM TRIRIGA - XXE (high 7.6)
- [CVE-2026-9389](https://insights.sbomify.com/CVE-2026-9389/): Tenda F456 L7Im frmL7ImForm buffer overflow (high 8.7)
- [CVE-2026-93889](https://insights.sbomify.com/CVE-2026-93889/): Mail logging <= 2.1.12 - Unauthenticated Stored Cross-Site Scripting via PHPMailer 'wp_mail_failed' Error Message (high 7.2)
- [CVE-2026-93888](https://insights.sbomify.com/CVE-2026-93888/): IBM Sterling Connect:Direct for Unix Buffer Overflow (high 7.8)
- [CVE-2026-93886](https://insights.sbomify.com/CVE-2026-93886/): IBM i is Affected By An Improper Neutralization of Input Vulnerability in HTTP Server Administration GUI (high 8.3)
- [CVE-2026-93885](https://insights.sbomify.com/CVE-2026-93885/): Cryptocurrency Donation Box <= 2.2.13 - Unauthenticated Stored Cross-Site Scripting via data_object Parameter (high 7.2)
- [CVE-2026-93883](https://insights.sbomify.com/CVE-2026-93883/): Cross-site scripting in Advanced Classifieds & Directory Pro (medium 6.4)
- [CVE-2026-93882](https://insights.sbomify.com/CVE-2026-93882/): Missing authorization in LearnPress – WordPress LMS Plugin for Create and Sell Online Courses (high 7.5)
- [CVE-2026-93880](https://insights.sbomify.com/CVE-2026-93880/): Greenshift <= 13.2.0 - Reflected Cross-Site Scripting via '{{GET:}}' Dynamic Placeholder (medium 6.1)
- [CVE-2026-9388](https://insights.sbomify.com/CVE-2026-9388/): Totolink A8000RU Web Management cstecgi.cgi setScheduleCfg os command injection (critical 9.3)
- [CVE-2026-93878](https://insights.sbomify.com/CVE-2026-93878/): DiviGear Carousel <= 5.2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via update_license AJAX Action (medium 6.4)
- [CVE-2026-93875](https://insights.sbomify.com/CVE-2026-93875/): JetAppointment <= 2.5.2.1 - Unauthenticated Stored Cross-Site Scripting via 'friendlyTime' Parameter (high 7.2)
- [CVE-2026-93873](https://insights.sbomify.com/CVE-2026-93873/): Cotonti through 1.0.0 Cross-Site Request Forgery in the Contact Plugin (medium 5.3)
- [CVE-2026-93872](https://insights.sbomify.com/CVE-2026-93872/): Cotonti 1.0.0 PHP Object Injection via Comments Plugin Edit Action cb Parameter (high 7.7)
- [CVE-2026-93871](https://insights.sbomify.com/CVE-2026-93871/): Cotonti through 1.0.0 Stored Open Redirect via Page redir: Prefix (medium 5.1)
- [CVE-2026-93870](https://insights.sbomify.com/CVE-2026-93870/): Cotonti through 1.0.0 Cross-Site Request Forgery in the Ratings Plugin AJAX Handler (medium 5.3)
- [CVE-2026-9387](https://insights.sbomify.com/CVE-2026-9387/): Totolink A8000RU Web Management cstecgi.cgi setUpgradeFW os command injection (critical 9.3)
- [CVE-2026-93869](https://insights.sbomify.com/CVE-2026-93869/): Cotonti through 1.0.0 Open Redirect via Unanchored cot_url_check() Regex (medium 5.3)
- [CVE-2026-93868](https://insights.sbomify.com/CVE-2026-93868/): Cotonti through 1.0.0 Predictable Password Recovery Token via Weak PRNG (critical 9.2)
- [CVE-2026-93866](https://insights.sbomify.com/CVE-2026-93866/): Fireware OS Pre-Authentication Integer Overflow in Access Portal Allows Out-of-Bounds Write (critical 9.2)
- [CVE-2026-93865](https://insights.sbomify.com/CVE-2026-93865/): Fireware OS Missing Authentication in FireCluster Sync Daemon Allows Remote Root Action Injection (critical 9.2)
- [CVE-2026-93864](https://insights.sbomify.com/CVE-2026-93864/): Fireware OS Link Following in firewalld Allows Local Arbitrary File Overwrite as Root (high 7.1)
- [CVE-2026-93862](https://insights.sbomify.com/CVE-2026-93862/): Fireware OS Out-of-Bounds Read in FireCluster Sync Allows Denial of Service (high 7.2)
- [CVE-2026-93861](https://insights.sbomify.com/CVE-2026-93861/): Missing authorization in Mistral (medium 6.0)
- [CVE-2026-93860](https://insights.sbomify.com/CVE-2026-93860/): Missing authorization in Mistral (high 7.1)
- [CVE-2026-9386](https://insights.sbomify.com/CVE-2026-9386/): Totolink A8000RU Web Management cstecgi.cgi setLanguageCfg os command injection (critical 9.3)
- [CVE-2026-93858](https://insights.sbomify.com/CVE-2026-93858/): Command injection in Mistral (high 8.7)
- [CVE-2026-93857](https://insights.sbomify.com/CVE-2026-93857/): Fireware OS Pre-Authentication Stack Buffer Overflow in SIP Proxy Allows Remote Code Execution (critical 9.2)
- [CVE-2026-93856](https://insights.sbomify.com/CVE-2026-93856/): Information disclosure in Cinder (medium 4.3)
- [CVE-2026-93855](https://insights.sbomify.com/CVE-2026-93855/): SendPress Newsletters <= 1.26.1.20 - Unauthenticated SQL Injection via 'subscriberid' Parameter (high 7.5)
- [CVE-2026-93854](https://insights.sbomify.com/CVE-2026-93854/): Missing authorization in Blazar (high 7.2)
- [CVE-2026-93853](https://insights.sbomify.com/CVE-2026-93853/): Barman snapshot backup deletion trusts unverified backup catalog metadata (high 7.2)
- [CVE-2026-93852](https://insights.sbomify.com/CVE-2026-93852/): Missing authorization in Blazar (high 7.1)
- [CVE-2026-93851](https://insights.sbomify.com/CVE-2026-93851/): Path traversal in Mattermost Agents plugin mention reminder allows plugin replacement via crafted post (high 8.0)
- [CVE-2026-93850](https://insights.sbomify.com/CVE-2026-93850/): Unbounded memory consumption during PDF text extraction (medium 6.5)
- [CVE-2026-9385](https://insights.sbomify.com/CVE-2026-9385/): Totolink A8000RU Web Management cstecgi.cgi setTracerouteCfg os command injection (critical 9.3)
- [CVE-2026-93849](https://insights.sbomify.com/CVE-2026-93849/): Denial of service in Mattermost (medium 6.5)
- [CVE-2026-93848](https://insights.sbomify.com/CVE-2026-93848/): Server-side request forgery in Mattermost (low 2.7)
- [CVE-2026-93847](https://insights.sbomify.com/CVE-2026-93847/): Improper post type validation on scheduled post endpoints (low 3.5)
- [CVE-2026-93846](https://insights.sbomify.com/CVE-2026-93846/): Team admin can escalate a team member's permissions via the team member roles endpoint (low 3.8)
- [CVE-2026-93841](https://insights.sbomify.com/CVE-2026-93841/): vLLM through 0.29.0 Adjacent-Request Sampler State Corruption via Unvalidated Prompt Token IDs (medium 6.3)
- [CVE-2026-93840](https://insights.sbomify.com/CVE-2026-93840/): vLLM before 0.29.0 Cross-Request Logits Corruption via allowed_token_ids (medium 6.3)
- [CVE-2026-9384](https://insights.sbomify.com/CVE-2026-9384/): Totolink A8000RU Web Management cstecgi.cgi setDiagnosisCfg os command injection (critical 9.3)
- [CVE-2026-93839](https://insights.sbomify.com/CVE-2026-93839/): LightLLM through 1.2.0 Missing Authentication in PD Master /pd_register WebSocket Endpoint (critical 9.3)
- [CVE-2026-93838](https://insights.sbomify.com/CVE-2026-93838/): SGLang through 0.5.20 Unbounded Memory Allocation via STAGING_REQ chunk_idx (high 8.2)
- [CVE-2026-93836](https://insights.sbomify.com/CVE-2026-93836/): WPC Product Bundles for WooCommerce <= 8.6.6 - Unauthenticated Stored Cross-Site Scripting via 'qty' Parameter (high 7.2)
- [CVE-2026-93834](https://insights.sbomify.com/CVE-2026-93834/): Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escape (high 8.8)
- [CVE-2026-93832](https://insights.sbomify.com/CVE-2026-93832/): Missing authorization in Setup App (medium 4.8)
- [CVE-2026-93830](https://insights.sbomify.com/CVE-2026-93830/): net: stmmac: xgmac2: disable RBUE in default RX interrupt mask (high 7.5)
- [CVE-2026-9383](https://insights.sbomify.com/CVE-2026-9383/): itsourcecode Electronic Judging System login.php sql injection (medium 6.9)
- [CVE-2026-93829](https://insights.sbomify.com/CVE-2026-93829/): smb: client: fix races in cifsd thread creation (not scored)
- [CVE-2026-93828](https://insights.sbomify.com/CVE-2026-93828/): exfat: fix handling of damaged volume in exfat_create_upcase_table() (not scored)
- [CVE-2026-93827](https://insights.sbomify.com/CVE-2026-93827/): virtio-fs: avoid double-free on failed queue setup (high 8.4)
- [CVE-2026-93826](https://insights.sbomify.com/CVE-2026-93826/): HID: hidpp: fix potential UAF in hidpp_connect_event() (high 7.5)
- [CVE-2026-93825](https://insights.sbomify.com/CVE-2026-93825/): spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data() (not scored)
- [CVE-2026-93824](https://insights.sbomify.com/CVE-2026-93824/): tls: reject the combination of TLS and sockmap (not scored)
- [CVE-2026-93823](https://insights.sbomify.com/CVE-2026-93823/): drm/amdkfd: Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctl (not scored)
- [CVE-2026-93822](https://insights.sbomify.com/CVE-2026-93822/): PCI: iproc: Protect root bus removal with rescan lock (not scored)
- [CVE-2026-93821](https://insights.sbomify.com/CVE-2026-93821/): PCI: altera: Protect root bus removal with rescan lock (not scored)
- [CVE-2026-93820](https://insights.sbomify.com/CVE-2026-93820/): PCI: rockchip: Protect root bus removal with rescan lock (not scored)
- [CVE-2026-9382](https://insights.sbomify.com/CVE-2026-9382/): Edimax BR-6675nD POST Request formPPTPSetup buffer overflow (high 8.7)
- [CVE-2026-93819](https://insights.sbomify.com/CVE-2026-93819/): PCI: mediatek: Protect root bus removal with rescan lock (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/237/