# Vulnerabilities published in 2026


- [CVE-2026-92462](https://insights.sbomify.com/CVE-2026-92462/): yshop-crm through 2.1.3 Missing Authorization via CrmFlowController deleteFlowStep (high 7.1)
- [CVE-2026-92461](https://insights.sbomify.com/CVE-2026-92461/): yshop-crm through 2.1.3 Missing Authorization via CRM Approval-Chain Endpoint (medium 5.3)
- [CVE-2026-92460](https://insights.sbomify.com/CVE-2026-92460/): yshop-crm through 2.1.3 Missing Authorization via CRM Operation-Log Listing (high 7.1)
- [CVE-2026-9246](https://insights.sbomify.com/CVE-2026-9246/): Missing authorization in Server (medium 4.3)
- [CVE-2026-92459](https://insights.sbomify.com/CVE-2026-92459/): yshop-crm through 2.1.3 Missing Authorization via CRM Lead-Claim Endpoint (high 7.1)
- [CVE-2026-92458](https://insights.sbomify.com/CVE-2026-92458/): yshop-crm through 2.1.3 Missing Authorization via StoreProductController onSale (medium 5.3)
- [CVE-2026-92457](https://insights.sbomify.com/CVE-2026-92457/): yshop-crm through 2.1.3 Missing Authorization via CrmInvoiceController issueInvoice (high 7.1)
- [CVE-2026-92456](https://insights.sbomify.com/CVE-2026-92456/): yshop-crm through 2.1.3 Missing Authorization via CRM Customer Rule-Configuration Endpoints (high 7.1)
- [CVE-2026-92455](https://insights.sbomify.com/CVE-2026-92455/): yshop-crm through 2.1.3 Missing Authorization via CRM Customer Messaging Endpoints (medium 5.3)
- [CVE-2026-92454](https://insights.sbomify.com/CVE-2026-92454/): JPEG decoder: truncated segments are read past the image buffer, and a zero sampling factor hangs the decode (medium 6.8)
- [CVE-2026-92450](https://insights.sbomify.com/CVE-2026-92450/): Kiloview E3 NDI Encoder Use of Hard-coded Credentials (high 8.7)
- [CVE-2026-9245](https://insights.sbomify.com/CVE-2026-9245/): Open redirect in Server (medium 5.0)
- [CVE-2026-92449](https://insights.sbomify.com/CVE-2026-92449/): Memory corruption in Eclipse ThreadX - GUIX (medium 6.8)
- [CVE-2026-92446](https://insights.sbomify.com/CVE-2026-92446/): GUIX binary resource loader reads past the end of a resource, because no length for it ever reaches the loader (medium 6.8)
- [CVE-2026-92438](https://insights.sbomify.com/CVE-2026-92438/): Ninja Forms 3.15.3 - Unauthenticated Stored XSS via Paragraph Text Field in Submissions Admin (high 8.8)
- [CVE-2026-92437](https://insights.sbomify.com/CVE-2026-92437/): Mailchimp for WooCommerce < 6.3 - Unauthenticated Abandoned Cart Modification and Deletion (medium 5.3)
- [CVE-2026-92436](https://insights.sbomify.com/CVE-2026-92436/): Mailchimp for WooCommerce < 6.3 - Unauthenticated Customer Email and Cart Disclosure via IDOR (medium 5.3)
- [CVE-2026-92435](https://insights.sbomify.com/CVE-2026-92435/): Mailchimp for WooCommerce < 6.1.1 - Unauthenticated Broken Access Control in REST API (medium 5.3)
- [CVE-2026-92433](https://insights.sbomify.com/CVE-2026-92433/): Patreon WordPress < 1.10.0 - Patreon Integration Takeover via CSRF (medium 6.5)
- [CVE-2026-92432](https://insights.sbomify.com/CVE-2026-92432/): Patreon WordPress < 1.10.0 - Open Redirect via 'state' Parameter (medium 4.3)
- [CVE-2026-92431](https://insights.sbomify.com/CVE-2026-92431/): Patreon WordPress < 1.10.0 - Unauthenticated Taxonomy and Term Enumeration (low 3.7)
- [CVE-2026-92430](https://insights.sbomify.com/CVE-2026-92430/): Rede Itaú for WooCommerce < 5.4.7 - Unauthenticated Order Status Manipulation via PIX Webhook (medium 5.3)
- [CVE-2026-9243](https://insights.sbomify.com/CVE-2026-9243/): Cross-site scripting in The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce (medium 6.4)
- [CVE-2026-92429](https://insights.sbomify.com/CVE-2026-92429/): Rede Itaú for WooCommerce 3.7.1 - 5.5.2 - Unauthenticated Order Status Manipulation via maxiPago Debit Webhook (medium 5.3)
- [CVE-2026-92428](https://insights.sbomify.com/CVE-2026-92428/): Rede Itaú for WooCommerce < 5.5.3 - Unauthenticated Order Status Manipulation via 3DS Failure Webhook (medium 5.3)
- [CVE-2026-92427](https://insights.sbomify.com/CVE-2026-92427/): Coinsnap Bitcoin Crowdfunding <= 1.2.0 - Unauthenticated Payment Record Forgery via Webhook Secret Disclosure (medium 5.3)
- [CVE-2026-92426](https://insights.sbomify.com/CVE-2026-92426/): YITH WooCommerce Popup < 1.60.0 - Contributor+ Arbitrary Post Meta Deletion (medium 4.9)
- [CVE-2026-92425](https://insights.sbomify.com/CVE-2026-92425/): Hydra Booking < 1.2.4 - Hydra Host+ Cross-Host Account Modification and Deletion via IDOR (medium 5.5)
- [CVE-2026-92424](https://insights.sbomify.com/CVE-2026-92424/): Content Egg < 11.9.0 - Contributor+ Stored XSS via Import Queue (medium 6.8)
- [CVE-2026-92423](https://insights.sbomify.com/CVE-2026-92423/): Meow Gallery < 5.5.5 - Author+ Draft and Private Post Disclosure via fetch_posts (low 2.7)
- [CVE-2026-92422](https://insights.sbomify.com/CVE-2026-92422/): Meow Gallery < 5.5.5 - Unauthenticated Arbitrary Shortcode Execution via load_gallery_collection REST Route (medium 6.5)
- [CVE-2026-92421](https://insights.sbomify.com/CVE-2026-92421/): Hydra Booking 1.1.0 - < 1.2.3 - Hydra Host+ Host Profile Takeover via IDOR (medium 4.7)
- [CVE-2026-92420](https://insights.sbomify.com/CVE-2026-92420/): Hydra Booking < 1.2.2 - Hydra Host+ Cross-Host Booking Deletion and Modification via IDOR (low 3.8)
- [CVE-2026-9242](https://insights.sbomify.com/CVE-2026-9242/): RegistrationMagic <= 6.0.8.6 - Authenticated (Subscriber+) Authentication Bypass via Forged PayPal IPN Request (medium 5.3)
- [CVE-2026-92419](https://insights.sbomify.com/CVE-2026-92419/): IDOR in WEBCON BPS (medium 5.3)
- [CVE-2026-92418](https://insights.sbomify.com/CVE-2026-92418/): ChangeWeDer crm Save Endpoint customer.serve.js cross site scripting (medium 5.1)
- [CVE-2026-92417](https://insights.sbomify.com/CVE-2026-92417/): Open5GS PFCP types.c ogs_pfcp_parse_volume_measurement null pointer dereference (high 7.1)
- [CVE-2026-92416](https://insights.sbomify.com/CVE-2026-92416/): Open5GS PFCP Session Report Request n4-handler.c smf_n4_handle_session_report_request assertion (medium 5.3)
- [CVE-2026-92415](https://insights.sbomify.com/CVE-2026-92415/): Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies (medium 6.9)
- [CVE-2026-92414](https://insights.sbomify.com/CVE-2026-92414/): Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens (critical 9.3)
- [CVE-2026-92413](https://insights.sbomify.com/CVE-2026-92413/): Artifex MuPDF PDF Xref Loading pdf-stream.c pdf_open_filter null pointer dereference (medium 5.3)
- [CVE-2026-92412](https://insights.sbomify.com/CVE-2026-92412/): Five Star Restaurant Reviews < 2.3.14 - Reflected XSS (high 7.1)
- [CVE-2026-92411](https://insights.sbomify.com/CVE-2026-92411/): WP Delicious < 1.10.8 - Contributor+ Stored XSS via Recipe Block Tag Name (medium 6.8)
- [CVE-2026-92410](https://insights.sbomify.com/CVE-2026-92410/): Sign-up Sheets < 2.4.0 - Arbitrary Sign-up Deletion via CSRF (medium 4.3)
- [CVE-2026-9241](https://insights.sbomify.com/CVE-2026-9241/): Missing authorization in FOX – Currency Switcher Professional for WooCommerce (medium 4.3)
- [CVE-2026-92409](https://insights.sbomify.com/CVE-2026-92409/): Donation Thermometer 2.2.9 - 2.2.11 - Contributor+ Stored XSS via Shortcode (medium 6.8)
- [CVE-2026-92406](https://insights.sbomify.com/CVE-2026-92406/): SourceCodester Inventory and Monitoring System btn_functions.php add sql injection (medium 6.9)
- [CVE-2026-92405](https://insights.sbomify.com/CVE-2026-92405/): SourceCodester Inventory and Monitoring System index.php sql injection (medium 6.9)
- [CVE-2026-92404](https://insights.sbomify.com/CVE-2026-92404/): MgoSync 2.1.5 - 2.1.6 - Unauthenticated WooCommerce API Credential Disclosure (high 7.5)
- [CVE-2026-92403](https://insights.sbomify.com/CVE-2026-92403/): Secure Custom Fields < 6.9.4 - Unauthenticated Post Modification via Front-End Form ID Substitution (low 3.7)
- [CVE-2026-92402](https://insights.sbomify.com/CVE-2026-92402/): ChangeWeDer crm top.upstudy.crm.controller.UserController UserController.java index authorization (medium 5.3)
- [CVE-2026-92401](https://insights.sbomify.com/CVE-2026-92401/): ChangeWeDer crm improper authentication (medium 6.9)
- [CVE-2026-92400](https://insights.sbomify.com/CVE-2026-92400/): Business logic in Payment Gateway for PayPal on WooCommerce (medium 5.3)
- [CVE-2026-9240](https://insights.sbomify.com/CVE-2026-9240/): Missing authorization in Colissimo shipping methods for WooCommerce (medium 4.3)
- [CVE-2026-92399](https://insights.sbomify.com/CVE-2026-92399/): GPAC WebSocket rmt_ws.c rmt_client_handle_ws_frame heap-based overflow (medium 6.9)
- [CVE-2026-92398](https://insights.sbomify.com/CVE-2026-92398/): Ruijie RG-EW3000GX user_list_note admin os command injection (critical 9.4)
- [CVE-2026-92397](https://insights.sbomify.com/CVE-2026-92397/): Ruijie RG-EW3000GX configChange unifyframe-sgi.elf cc_set os command injection (critical 9.4)
- [CVE-2026-92395](https://insights.sbomify.com/CVE-2026-92395/): @fastify/proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet (critical 9.1)
- [CVE-2026-92393](https://insights.sbomify.com/CVE-2026-92393/): Apache YuniKorn: Admission control bypass via workload UPDATE operation (low 2.0)
- [CVE-2026-92392](https://insights.sbomify.com/CVE-2026-92392/): HTTP/2 upload Use-After-Free (high 8.1)
- [CVE-2026-92391](https://insights.sbomify.com/CVE-2026-92391/): curl_mime_free stack overflow by recursion (not scored)
- [CVE-2026-92390](https://insights.sbomify.com/CVE-2026-92390/): -J no-clobber guarantee bypassed with 103 early hints (not scored)
- [CVE-2026-92389](https://insights.sbomify.com/CVE-2026-92389/): TFTP direction confusion (not scored)
- [CVE-2026-92388](https://insights.sbomify.com/CVE-2026-92388/): FTP wildcard write callback mixup (not scored)
- [CVE-2026-92387](https://insights.sbomify.com/CVE-2026-92387/): never-ending loop via server response omission (high 8.1)
- [CVE-2026-92386](https://insights.sbomify.com/CVE-2026-92386/): server-set cookie aborts cookie jar load (high 8.1)
- [CVE-2026-92385](https://insights.sbomify.com/CVE-2026-92385/): SourceCodester Online Food Ordering System Category Update update_category.php cross site scripting (medium 4.8)
- [CVE-2026-92383](https://insights.sbomify.com/CVE-2026-92383/): PbootCMS User Management UserController.php mod cross-site request forgery (medium 5.3)
- [CVE-2026-92382](https://insights.sbomify.com/CVE-2026-92382/): Usbredir: usbredir: unbounded iso_packet_desc[] index in usbredirhost_iso_packet() leads to heap out-of-bounds write (medium 4.1)
- [CVE-2026-92381](https://insights.sbomify.com/CVE-2026-92381/): PbootCMS Template Rendering ContentController.php decode_string cross site scripting (medium 5.1)
- [CVE-2026-92380](https://insights.sbomify.com/CVE-2026-92380/): WuzhiCMS Remote Image Fetch index.php saveRemote server-side request forgery (medium 6.9)
- [CVE-2026-92378](https://insights.sbomify.com/CVE-2026-92378/): uniFLOW Online Legacy UI Previous login session retained when entering Reduced Function Login (medium 4.1)
- [CVE-2026-92377](https://insights.sbomify.com/CVE-2026-92377/): Local Privilege Escalation via DLL Sideloading in TeamViewer Patch Management for Windows (high 7.8)
- [CVE-2026-92376](https://insights.sbomify.com/CVE-2026-92376/): Local Privilege Escalation via IPC Broker Impersonation in TeamViewer Remote Management Monitoring for Windows (high 7.8)
- [CVE-2026-92375](https://insights.sbomify.com/CVE-2026-92375/): Local privilege escalation via improper IPC access control in TeamViewer Remote Management Monitoring (high 7.8)
- [CVE-2026-92374](https://insights.sbomify.com/CVE-2026-92374/): Privilege Escalation via Insecure Package Handling in TeamViewer Full Client and Host for macOS (high 7.8)
- [CVE-2026-92372](https://insights.sbomify.com/CVE-2026-92372/): Out-of-bounds Write in TeamViewer Full Client for Linux and macOS Allows Remote Code Execution (high 8.8)
- [CVE-2026-92371](https://insights.sbomify.com/CVE-2026-92371/): Local Privilege Escalation via Improper Link Resolution in Cloud Session Recording (high 7.0)
- [CVE-2026-92370](https://insights.sbomify.com/CVE-2026-92370/): Remote Session Access Control Bypass Leading to Remote Code Execution (high 8.8)
- [CVE-2026-9237](https://insights.sbomify.com/CVE-2026-9237/): Missing authorization in Employee, Leave and Recruitment Management System – Crew HRM (medium 4.3)
- [CVE-2026-92369](https://insights.sbomify.com/CVE-2026-92369/): Race condition in Full Client (high 7.3)
- [CVE-2026-92368](https://insights.sbomify.com/CVE-2026-92368/): Heap-Based Buffer Overflow in TeamViewer Session Recording Playback Leads to Remote Code Execution (high 7.8)
- [CVE-2026-92366](https://insights.sbomify.com/CVE-2026-92366/): code-projects Matrimonial System Regular Search search.php sql injection (medium 6.9)
- [CVE-2026-92365](https://insights.sbomify.com/CVE-2026-92365/): vllm-project vllm thinking_budget_state.py algorithmic complexity (medium 5.3)
- [CVE-2026-92364](https://insights.sbomify.com/CVE-2026-92364/): itsourcecode Leave Management System index.php sql injection (medium 5.3)
- [CVE-2026-92363](https://insights.sbomify.com/CVE-2026-92363/): ag-ui-protocol ag-ui JSON sse_parser.cpp resource consumption (medium 5.3)
- [CVE-2026-92362](https://insights.sbomify.com/CVE-2026-92362/): ag-ui-protocol ag-ui SSE Frame sse.rs resource consumption (medium 6.9)
- [CVE-2026-92361](https://insights.sbomify.com/CVE-2026-92361/): ag-ui-protocol ag-ui SSE Client client.go resource consumption (medium 5.3)
- [CVE-2026-92360](https://insights.sbomify.com/CVE-2026-92360/): ag-ui-protocol ag-ui Event Application Layer agent.ts prepareRunAgentInput origin validation (medium 5.3)
- [CVE-2026-9236](https://insights.sbomify.com/CVE-2026-9236/): CM Ad Changer <= 2.0.7 - Cross-Site Request Forgery to Campaign Deletion via Campaign Management (medium 4.3)
- [CVE-2026-92359](https://insights.sbomify.com/CVE-2026-92359/): ag-ui-protocol ag-ui CORSMiddleware utils.py create_strands_app cross-domain policy (low 2.3)
- [CVE-2026-92358](https://insights.sbomify.com/CVE-2026-92358/): Keycloak-services: keycloak-services: residual cross-browser account-link proof allows silent re-linking (medium 6.4)
- [CVE-2026-92357](https://insights.sbomify.com/CVE-2026-92357/): a2ui-project a2ui Model Processor model-processor.ts information disclosure (medium 5.3)
- [CVE-2026-92356](https://insights.sbomify.com/CVE-2026-92356/): a2ui-project a2ui Update Components basic_functions.ts updateComponents resource consumption (medium 5.3)
- [CVE-2026-92355](https://insights.sbomify.com/CVE-2026-92355/): Path traversal in Octopus Server (high 8.7)
- [CVE-2026-9235](https://insights.sbomify.com/CVE-2026-9235/): Missing authorization in DHL eCommerce (Benelux) for WooCommerce (medium 4.3)
- [CVE-2026-9234](https://insights.sbomify.com/CVE-2026-9234/): Missing authorization in JTL-Connector for WooCommerce (medium 4.3)
- [CVE-2026-9233](https://insights.sbomify.com/CVE-2026-9233/): Missing authorization in Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker (medium 4.3)
- [CVE-2026-9232](https://insights.sbomify.com/CVE-2026-9232/): Missing authorization in Easy Appointments (medium 6.5)
- [CVE-2026-9231](https://insights.sbomify.com/CVE-2026-9231/): WP Travel Engine <= 6.8.0 - Authenticated (Contributor+) Local File Inclusion via 'template' Shortcode Attribute (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/249/