# Vulnerabilities published in 2026


- [CVE-2026-9106](https://insights.sbomify.com/CVE-2026-9106/): Security feature bypass in Enterprise Server (medium 4.8)
- [CVE-2026-91059](https://insights.sbomify.com/CVE-2026-91059/): JPEG decoder: a duplicate SOF0 after SOS publishes a pixelmap that misreports its own allocation size (medium 6.8)
- [CVE-2026-91057](https://insights.sbomify.com/CVE-2026-91057/): Out-of-bounds read when a multi-line text view string ends with a carriage return (medium 4.6)
- [CVE-2026-91051](https://insights.sbomify.com/CVE-2026-91051/): EWWW Image Optimizer 8.6.0 - 8.7.7 - Author+ PHP Object Injection via 'eio_page_settings' Post Meta (medium 6.6)
- [CVE-2026-91050](https://insights.sbomify.com/CVE-2026-91050/): Missing authorization in Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress (medium 4.3)
- [CVE-2026-9105](https://insights.sbomify.com/CVE-2026-9105/): Authenticated Stack-Based Buffer Overflow in TP-Link TL-WR841N Web Interface (medium 6.8)
- [CVE-2026-91048](https://insights.sbomify.com/CVE-2026-91048/): Missing authorization in Apache Karaf (critical 9.8)
- [CVE-2026-91047](https://insights.sbomify.com/CVE-2026-91047/): ElementsReady Addons for Elementor <= 6.7.2 - Unauthenticated Paid Download Access Bypass via 'downloadtype' Parameter (medium 5.3)
- [CVE-2026-91046](https://insights.sbomify.com/CVE-2026-91046/): ElementsReady Addons for Elementor <= 6.7.2 - Subscriber+ Plugin Settings Overwrite via Missing Authorization (medium 4.3)
- [CVE-2026-91043](https://insights.sbomify.com/CVE-2026-91043/): HPACK-indexed cookie fields in Mint HTTP/2 responses bypass max_header_list_size and exhaust client memory (high 8.2)
- [CVE-2026-91041](https://insights.sbomify.com/CVE-2026-91041/): FileX fault-tolerant log replay writes past the destination sector when mounting a crafted FAT image (high 7.8)
- [CVE-2026-9104](https://insights.sbomify.com/CVE-2026-9104/): Draft List <= 2.6.3 - Authenticated (Author+) Stored Cross-Site Scripting via Draft Post Title (medium 6.4)
- [CVE-2026-91039](https://insights.sbomify.com/CVE-2026-91039/): Auth bypass in ash authentication (critical 9.1)
- [CVE-2026-9103](https://insights.sbomify.com/CVE-2026-9103/): Unauthenticated Superuser Token Issuance via Auto-Login Endpoint (critical 9.8)
- [CVE-2026-91025](https://insights.sbomify.com/CVE-2026-91025/): Booking Manager < 2.1.21 - Subscriber+ Arbitrary User Plugin Meta Modification via IDOR (medium 4.3)
- [CVE-2026-91024](https://insights.sbomify.com/CVE-2026-91024/): Booking Manager < 2.1.21 - Author+ SQLi via ICS Import Feed UID (sync_gid) (medium 6.8)
- [CVE-2026-91023](https://insights.sbomify.com/CVE-2026-91023/): Missing authorization in Motors (low 3.1)
- [CVE-2026-91022](https://insights.sbomify.com/CVE-2026-91022/): Motors < 1.4.124 - Listing Manager+ Stored XSS via Badge Color (medium 6.8)
- [CVE-2026-91021](https://insights.sbomify.com/CVE-2026-91021/): CVE-2026-91021 (medium 5.4)
- [CVE-2026-91020](https://insights.sbomify.com/CVE-2026-91020/): WebToffee Gift Cards for WooCommerce < 1.3.1 - Unauthenticated Gift Card Amount Manipulation via wt_credit_amount (medium 5.3)
- [CVE-2026-9102](https://insights.sbomify.com/CVE-2026-9102/): Path Traversal in Altium Enterprise Server ComparisonService Allows Arbitrary File Write (critical 9.4)
- [CVE-2026-91019](https://insights.sbomify.com/CVE-2026-91019/): Event Booking Manager for WooCommerce < 5.6.0 - Contributor+ Payment Gateway Credential Disclosure (medium 4.9)
- [CVE-2026-91018](https://insights.sbomify.com/CVE-2026-91018/): Double Free in lwIP (lightweight IP) (high 8.7)
- [CVE-2026-91017](https://insights.sbomify.com/CVE-2026-91017/): Robokassa payment gateway for Woocommerce < 1.8.9 - Unauthenticated Payment Bypass via Forged JWT Callback (low 3.7)
- [CVE-2026-91016](https://insights.sbomify.com/CVE-2026-91016/): Motors < 1.4.121 - Unauthenticated Draft/Private Listing Disclosure (medium 5.3)
- [CVE-2026-91015](https://insights.sbomify.com/CVE-2026-91015/): Master Addons for Elementor < 3.1.9 - Unauthenticated Popup Deactivation via jltma_popup_disable_expired (medium 5.3)
- [CVE-2026-91014](https://insights.sbomify.com/CVE-2026-91014/): Realtyna Organic IDX plugin + WPL Real Estate < 5.4.2 - Reflected XSS via Location Selector Endpoint (high 7.1)
- [CVE-2026-91013](https://insights.sbomify.com/CVE-2026-91013/): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (critical 9.3)
- [CVE-2026-91012](https://insights.sbomify.com/CVE-2026-91012/): Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalation (critical 9.8)
- [CVE-2026-91011](https://insights.sbomify.com/CVE-2026-91011/): EWWW Image Optimizer < 8.7.7 - Author+ Stored XSS via Image Class Attribute Backreference Expansion (medium 6.8)
- [CVE-2026-91010](https://insights.sbomify.com/CVE-2026-91010/): Invisible Anti-Spam & CAPTCHA < 5.1.1 - Subscriber+ Arbitrary Form Submission Deletion (medium 4.3)
- [CVE-2026-9101](https://insights.sbomify.com/CVE-2026-9101/): Prototype pollution in csv parsing (medium 5.3)
- [CVE-2026-91009](https://insights.sbomify.com/CVE-2026-91009/): Missing authorization in Active Woot Products Tables for WooCommerce. 100% FREE (medium 4.3)
- [CVE-2026-91008](https://insights.sbomify.com/CVE-2026-91008/): Event Booking Manager for WooCommerce < 5.3.8 - Unauthenticated Attendee PII Disclosure via Booking Confirmation Panel (low 3.7)
- [CVE-2026-91006](https://insights.sbomify.com/CVE-2026-91006/): Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean) (high 8.8)
- [CVE-2026-91005](https://insights.sbomify.com/CVE-2026-91005/): File upload in Online Faculty Clearance System (medium 5.3)
- [CVE-2026-91004](https://insights.sbomify.com/CVE-2026-91004/): SourceCodester Online Faculty Clearance System delete_faculty1.php sql injection (medium 6.9)
- [CVE-2026-91003](https://insights.sbomify.com/CVE-2026-91003/): D-Link DI-8300 CGI Service rzgl.asp rzgl_asp stack-based overflow (critical 9.4)
- [CVE-2026-91002](https://insights.sbomify.com/CVE-2026-91002/): stamparm maltrail Blacklist Endpoint httpd.py _blacklist missing authentication (medium 6.9)
- [CVE-2026-91001](https://insights.sbomify.com/CVE-2026-91001/): D-Link DI-8400 DDNS Configuration ddns.asp ddns_asp stack-based overflow (critical 9.4)
- [CVE-2026-9100](https://insights.sbomify.com/CVE-2026-9100/): Heap memory out of bounds read and crash in C Driver legacy GridFS file reader (medium 6.0)
- [CVE-2026-90999](https://insights.sbomify.com/CVE-2026-90999/): Sentry Seer vulnerability allows attacker-controlled input to be executed in a privileged environment (critical 9.8)
- [CVE-2026-90997](https://insights.sbomify.com/CVE-2026-90997/): Auth bypass in Keycloak (high 7.4)
- [CVE-2026-90996](https://insights.sbomify.com/CVE-2026-90996/): Sssd: sssd: denial of service in nss responder via crafted zero-length requests (medium 4.0)
- [CVE-2026-90995](https://insights.sbomify.com/CVE-2026-90995/): Sssd: sssd: local denial of service due to null pointer dereference in pam responder (medium 5.5)
- [CVE-2026-90994](https://insights.sbomify.com/CVE-2026-90994/): Sssd: sssd: denial of service via malformed pam v1 requests (medium 4.0)
- [CVE-2026-90992](https://insights.sbomify.com/CVE-2026-90992/): Redux Framework <= 4.5.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user-mediaurl' Media Field (medium 6.4)
- [CVE-2026-90991](https://insights.sbomify.com/CVE-2026-90991/): Langflow OSS is affected by multiple vulnerabilities (medium 6.5)
- [CVE-2026-90990](https://insights.sbomify.com/CVE-2026-90990/): Livestatus injection via monitoring filter values (medium 5.3)
- [CVE-2026-9099](https://insights.sbomify.com/CVE-2026-9099/): Keycloak: group-admin escalation to realm-admin (high 7.7)
- [CVE-2026-90989](https://insights.sbomify.com/CVE-2026-90989/): Tainacan < 1.4.0 - Subscriber+ Repository Staff Email Address Disclosure via Reports REST Endpoints (medium 4.3)
- [CVE-2026-90988](https://insights.sbomify.com/CVE-2026-90988/): Request a Quote <= 2.5.6 - Unauthenticated Quote Request Contact Record Disclosure via emd_get_std_pagenum (medium 5.3)
- [CVE-2026-90987](https://insights.sbomify.com/CVE-2026-90987/): Easy PayPal & Stripe Buy Now Button 1.8 - 2.0.5 - Unauthenticated Payment Amount Manipulation via Client-Supplied Price (medium 5.3)
- [CVE-2026-90986](https://insights.sbomify.com/CVE-2026-90986/): WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.21 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-90985](https://insights.sbomify.com/CVE-2026-90985/): Information disclosure in WPC Smart Compare for WooCommerce (medium 5.3)
- [CVE-2026-90984](https://insights.sbomify.com/CVE-2026-90984/): Generate PDF using Contact Form 7 < 4.2.2 - Unauthenticated Server-Side Request Forgery via Array-Valued Form Field (medium 5.8)
- [CVE-2026-90983](https://insights.sbomify.com/CVE-2026-90983/): OTP Code Exposure in Hayat Hospital's Hayat Mobile (high 8.2)
- [CVE-2026-90982](https://insights.sbomify.com/CVE-2026-90982/): @fastify/static vulnerable to route guard bypass via path case-folding (medium 5.3)
- [CVE-2026-90981](https://insights.sbomify.com/CVE-2026-90981/): Newsletter <= 9.3.8 - Reflected Cross-Site Scripting via 'nn' Parameter (medium 6.1)
- [CVE-2026-9098](https://insights.sbomify.com/CVE-2026-9098/): CVE-2026-9098 (critical 9.1)
- [CVE-2026-90979](https://insights.sbomify.com/CVE-2026-90979/): Apache Karaf: LDAP filter injection in JAAS LDAP login modules (high 7.3)
- [CVE-2026-90978](https://insights.sbomify.com/CVE-2026-90978/): Filter Gallery < 1.1.5 - Subscriber+ Arbitrary Post Overwrite and Plugin Option Deletion via Fail-Open Nonce Check (high 7.1)
- [CVE-2026-90977](https://insights.sbomify.com/CVE-2026-90977/): Clean Login < 1.19 - Unauthenticated CAPTCHA Bypass via Empty Session Comparison (medium 5.3)
- [CVE-2026-90976](https://insights.sbomify.com/CVE-2026-90976/): Clean Login < 1.19 - Unauthenticated Account Creation with Registration Disabled (medium 5.3)
- [CVE-2026-90974](https://insights.sbomify.com/CVE-2026-90974/): WP Fusion Lite 3.37.14 - 3.47.14 - Unauthenticated CRM Integration Settings Update (medium 6.5)
- [CVE-2026-90972](https://insights.sbomify.com/CVE-2026-90972/): WP Fusion Lite < 3.48.0 - Subscriber+ User Email Disclosure and Cross-User CRM Data Deletion (medium 5.4)
- [CVE-2026-90971](https://insights.sbomify.com/CVE-2026-90971/): Server-side request forgery in Server (medium 6.5)
- [CVE-2026-90970](https://insights.sbomify.com/CVE-2026-90970/): Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway (critical 9.9)
- [CVE-2026-9097](https://insights.sbomify.com/CVE-2026-9097/): CVE-2026-9097 (critical 9.8)
- [CVE-2026-90969](https://insights.sbomify.com/CVE-2026-90969/): Missing authorization in Server (medium 6.5)
- [CVE-2026-90961](https://insights.sbomify.com/CVE-2026-90961/): MISP LdapAuth and LinOTPAuth Authentication Bypass via Empty or Non-String Credentials (critical 9.3)
- [CVE-2026-9096](https://insights.sbomify.com/CVE-2026-9096/): CVE-2026-9096 (high 7.5)
- [CVE-2026-90959](https://insights.sbomify.com/CVE-2026-90959/): Path traversal in Red Hat Ansible Automation Platform 2 (high 8.1)
- [CVE-2026-90957](https://insights.sbomify.com/CVE-2026-90957/): MISP: Stored XSS via Inline-Served SVG Organisation Logos and Report Pictures (medium 5.1)
- [CVE-2026-90955](https://insights.sbomify.com/CVE-2026-90955/): MISP CLI Shell Audit Logs Lose User Identity and CLI Marker After First Lazy Model Load (medium 4.6)
- [CVE-2026-90954](https://insights.sbomify.com/CVE-2026-90954/): Busybox: busybox: dpkg-deb extraction-root escape via per-ar-member deferred symlink flush (high 7.8)
- [CVE-2026-90953](https://insights.sbomify.com/CVE-2026-90953/): Missing authorization in Image Optimizer (medium 4.3)
- [CVE-2026-90952](https://insights.sbomify.com/CVE-2026-90952/): WP Edit Password Protected 2.0.0 - 2.0.6 - Unauthenticated Site-Wide Access Mode Bypass via REST API (medium 5.3)
- [CVE-2026-90951](https://insights.sbomify.com/CVE-2026-90951/): Paid Member Subscriptions < 3.1.0 - Unauthenticated In-Flight Checkout State Deletion via pms_process_payment (low 3.7)
- [CVE-2026-90950](https://insights.sbomify.com/CVE-2026-90950/): Paid Member Subscriptions < 3.1.0 - Unauthenticated reCAPTCHA Bypass via Registration Form (medium 5.3)
- [CVE-2026-9095](https://insights.sbomify.com/CVE-2026-9095/): CVE-2026-9095 (high 8.1)
- [CVE-2026-90949](https://insights.sbomify.com/CVE-2026-90949/): Gimp: gimp: heap-based buffer overflow in psp loader due to selection-channel geometry mismatch (high 7.8)
- [CVE-2026-90948](https://insights.sbomify.com/CVE-2026-90948/): Gimp: gimp: heap-based buffer overflow in ico loader via integer overflow in embedded png dimensions (high 7.8)
- [CVE-2026-90947](https://insights.sbomify.com/CVE-2026-90947/): Gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file (high 7.8)
- [CVE-2026-90946](https://insights.sbomify.com/CVE-2026-90946/): DeepWiki-Open through commit d92819a Arbitrary File Read via /ws/chat WebSocket (high 8.7)
- [CVE-2026-90945](https://insights.sbomify.com/CVE-2026-90945/): Crawlab through 0.6.3 Authentication Bypass via Hard-coded JWT Secret (critical 9.3)
- [CVE-2026-90944](https://insights.sbomify.com/CVE-2026-90944/): Krayin CRM through 2.2.6 Unauthenticated Email Injection via inbound-parse (high 8.8)
- [CVE-2026-90943](https://insights.sbomify.com/CVE-2026-90943/): parallax filament-comments through 3.0.0 Stored XSS via Comment Body (critical 9.3)
- [CVE-2026-90942](https://insights.sbomify.com/CVE-2026-90942/): Casdoor through 4.4.0 Private Key Exposure via Certificate Endpoints (critical 9.3)
- [CVE-2026-90941](https://insights.sbomify.com/CVE-2026-90941/): novel-plus through 5.3.3 Missing Authorization on the Admin Book Download Endpoint (medium 5.3)
- [CVE-2026-90940](https://insights.sbomify.com/CVE-2026-90940/): novel-plus through 5.3.3 Default Cache Management Password in the Front Portal (medium 6.9)
- [CVE-2026-9094](https://insights.sbomify.com/CVE-2026-9094/): CVE-2026-9094 (critical 9.8)
- [CVE-2026-90939](https://insights.sbomify.com/CVE-2026-90939/): novel-plus through 5.3.3 Missing Authorization on the Admin /sys/user/list Endpoint (high 7.1)
- [CVE-2026-90938](https://insights.sbomify.com/CVE-2026-90938/): LangBot through 0.4.17 Unauthenticated Plugin Registration via WebSocket (high 8.8)
- [CVE-2026-90937](https://insights.sbomify.com/CVE-2026-90937/): froxlor before 2.2.5 nginx/Apache Configuration Injection via subdomain redirect URL (critical 9.4)
- [CVE-2026-90936](https://insights.sbomify.com/CVE-2026-90936/): Froxlor before 2.3.7 Information Disclosure via customer_email.php (medium 5.3)
- [CVE-2026-90935](https://insights.sbomify.com/CVE-2026-90935/): Froxlor before 2.3.7 Authorization Bypass via Mysqls.add API (medium 5.3)
- [CVE-2026-90934](https://insights.sbomify.com/CVE-2026-90934/): EspoCRM before 10.0.4 Field-level Security Bypass via Attendees (high 8.7)
- [CVE-2026-90933](https://insights.sbomify.com/CVE-2026-90933/): laradashboard through 1.2.2 Missing Authorization via License API (high 7.1)
- [CVE-2026-90932](https://insights.sbomify.com/CVE-2026-90932/): LaraDashboard 0.9.2 through 1.2.2 Path Traversal RCE (high 8.6)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/260/