# Vulnerabilities published in 2026


- [CVE-2026-8942](https://insights.sbomify.com/CVE-2026-8942/): MetaMagic SEO Plugin <= 1.6 - Cross-Site Request Forgery to Plugin Settings Update via Settings Page (medium 4.3)
- [CVE-2026-89419](https://insights.sbomify.com/CVE-2026-89419/): Missing authorization in Ironic (medium 5.0)
- [CVE-2026-89418](https://insights.sbomify.com/CVE-2026-89418/): Uncontrolled Recursion leading to Denial of Service in protobuf-javascript (google-protobuf) (high 8.7)
- [CVE-2026-89417](https://insights.sbomify.com/CVE-2026-89417/): Cross-site scripting in OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. (high 7.2)
- [CVE-2026-89413](https://insights.sbomify.com/CVE-2026-89413/): Missing authorization in Filter Gallery (high 8.1)
- [CVE-2026-89412](https://insights.sbomify.com/CVE-2026-89412/): TranslatePress <= 3.3.5 - Unauthenticated Stored Cross-Site Scripting via Translation Memory Suggestion Panel (high 7.2)
- [CVE-2026-89411](https://insights.sbomify.com/CVE-2026-89411/): Paymattic < 4.6.26 - Unauthenticated Payment Bypass via Unbound Stripe PaymentIntent (medium 5.3)
- [CVE-2026-89410](https://insights.sbomify.com/CVE-2026-89410/): Out-of-bounds read in Z-Wave NCP SPI Handler (medium 5.1)
- [CVE-2026-8941](https://insights.sbomify.com/CVE-2026-8941/): CDN Linker lite <= 1.3.1 - Cross-Site Request Forgery to Plugin Settings Update (medium 4.3)
- [CVE-2026-89409](https://insights.sbomify.com/CVE-2026-89409/): Unvalidated ZWAVE_CMD_NODES_EXIST May Cause Deletion of End Nodes​ (medium 5.3)
- [CVE-2026-89407](https://insights.sbomify.com/CVE-2026-89407/): jackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() enables ReDoS (high 7.5)
- [CVE-2026-89406](https://insights.sbomify.com/CVE-2026-89406/): Missing authorization in Modula Image Gallery – Photo Grid & Video Gallery (high 7.5)
- [CVE-2026-8940](https://insights.sbomify.com/CVE-2026-8940/): WP Meta Sort Posts <= 0.9 - Cross-Site Request Forgery to Plugin Settings Update (medium 4.3)
- [CVE-2026-8939](https://insights.sbomify.com/CVE-2026-8939/): Search Simple Fields <= 0.2 - Cross-Site Request Forgery to Plugin Settings Update (medium 4.3)
- [CVE-2026-8938](https://insights.sbomify.com/CVE-2026-8938/): auto making JSON-LD <= 4.5.3 - Cross-Site Request Forgery to Plugin Certification Settings via Nonce Validation Bypass (medium 4.3)
- [CVE-2026-8937](https://insights.sbomify.com/CVE-2026-8937/): Missing Authorization in GitLab (medium 4.3)
- [CVE-2026-8936](https://insights.sbomify.com/CVE-2026-8936/): Unbounded recursion in grpcfuse kernel module allows container to crash Docker Desktop VM (high 8.2)
- [CVE-2026-8935](https://insights.sbomify.com/CVE-2026-8935/): Advanced Google Maps < 6.1.1 - Unauthenticated Administrator Account Creation (critical 9.8)
- [CVE-2026-8934](https://insights.sbomify.com/CVE-2026-8934/): Cross-Project Information Leakage in Google App Engine UI (medium 6.9)
- [CVE-2026-89334](https://insights.sbomify.com/CVE-2026-89334/): Missing authorization in Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots (medium 6.5)
- [CVE-2026-89333](https://insights.sbomify.com/CVE-2026-89333/): Missing authorization in Tutor LMS – eLearning and online course solution (medium 6.5)
- [CVE-2026-89332](https://insights.sbomify.com/CVE-2026-89332/): Kiro IDE Sensitive Workspace Data Exfiltration via Agent-Written Workspace Configuration (medium 6.7)
- [CVE-2026-89331](https://insights.sbomify.com/CVE-2026-89331/): FluentBoards 1.95 - 2.0.15 - Unauthenticated Board Member Email Address Disclosure via Public Board Endpoints (medium 5.3)
- [CVE-2026-89330](https://insights.sbomify.com/CVE-2026-89330/): EmbedPress <= 4.6.5 - Reflected Cross-Site Scripting via 'hash' and 'unique' Parameters (medium 6.1)
- [CVE-2026-8933](https://insights.sbomify.com/CVE-2026-8933/): snap-confine Local Privilege Escalation via Capabilities Misconfiguration or Flaw in Execution Environment Setup (high 7.8)
- [CVE-2026-89329](https://insights.sbomify.com/CVE-2026-89329/): Device-mapper-multipath: local denial of service via blocking ipc send operations (medium 6.2)
- [CVE-2026-89328](https://insights.sbomify.com/CVE-2026-89328/): FluentBoards < 2.0.15 - Board Member+ Board Membership and Public Access Modification (low 3.8)
- [CVE-2026-89327](https://insights.sbomify.com/CVE-2026-89327/): FluentBoards < 2.0.15 - Board Member+ Comment Author Spoofing via 'comment_by' Parameter (low 3.8)
- [CVE-2026-89325](https://insights.sbomify.com/CVE-2026-89325/): Privilege escalation in Insight Agent (high 7.8)
- [CVE-2026-89322](https://insights.sbomify.com/CVE-2026-89322/): Vault ACL Policy Evaluation May Allow Bypass of Deny Restrictions (high 7.2)
- [CVE-2026-89321](https://insights.sbomify.com/CVE-2026-89321/): Denial of service in Eclipse OpenVSX (medium 4.3)
- [CVE-2026-89320](https://insights.sbomify.com/CVE-2026-89320/): HmacShaCryptor.Hash never hashes its input — returns constant HMAC_K("") for all inputs, voiding CBC-HMAC JWE integrity (high 8.8)
- [CVE-2026-8932](https://insights.sbomify.com/CVE-2026-8932/): incomplete mTLS config matching in conn reuse (high 7.5)
- [CVE-2026-89319](https://insights.sbomify.com/CVE-2026-89319/): Memory corruption in Eclipse KeyPont - GOSE (medium 6.3)
- [CVE-2026-89318](https://insights.sbomify.com/CVE-2026-89318/): Denial of service in Eclipse KeyPont - GOSE (medium 6.9)
- [CVE-2026-89317](https://insights.sbomify.com/CVE-2026-89317/): JwtVerifierImpl.Verify does not enforce the JWS `crit` header (RFC 7515 §4.1.11) (medium 6.3)
- [CVE-2026-89316](https://insights.sbomify.com/CVE-2026-89316/): LoadPublicKey panics on kty/alg mismatch (kty=EC with a non-EC alg) via unchecked *ECDSAOptions type assertion (medium 6.3)
- [CVE-2026-89315](https://insights.sbomify.com/CVE-2026-89315/): JwtClaims.MarshalJSON panics via reflect.StructOf when any untyped claim key is not a valid Go identifier suffix (medium 6.9)
- [CVE-2026-89314](https://insights.sbomify.com/CVE-2026-89314/): Quadratic-time key_ops duplicate check lets a sub-1 MB JWKS body pin a CPU core for ~15 s (medium 6.9)
- [CVE-2026-89313](https://insights.sbomify.com/CVE-2026-89313/): JwksTrustStore.Get returns the last fetched JWKS key (err=nil) when the requested kid is absent, instead of nil (medium 6.3)
- [CVE-2026-89312](https://insights.sbomify.com/CVE-2026-89312/): Denial of service in Eclipse KeyPont - GOSE (medium 6.9)
- [CVE-2026-89310](https://insights.sbomify.com/CVE-2026-89310/): SQL Command Injection Vulnerability in JTL-WMS (critical 9.4)
- [CVE-2026-8931](https://insights.sbomify.com/CVE-2026-8931/): Critical RCE vulnerability in Disig Web Signer (critical 9.4)
- [CVE-2026-89309](https://insights.sbomify.com/CVE-2026-89309/): Missing Authentication Vulnerability in JTL-WMS (critical 10.0)
- [CVE-2026-89308](https://insights.sbomify.com/CVE-2026-89308/): Arbitrary command execution in TrxTimeATTENDANCE (critical 9.3)
- [CVE-2026-89307](https://insights.sbomify.com/CVE-2026-89307/): HTML injection allows open redirection in WordPress theme design-scuole-wordpress-theme (medium 5.1)
- [CVE-2026-89305](https://insights.sbomify.com/CVE-2026-89305/): Paymendo Bank Transfer <= 1.1 - Subscriber+ SQLi via 'orderBy' Parameter (medium 6.5)
- [CVE-2026-89304](https://insights.sbomify.com/CVE-2026-89304/): Paymendo Bank Transfer <= 1.1 - Unauthenticated Blind SQLi via 'paymendo_bank_transfer_completed_payment' Parameter (medium 6.5)
- [CVE-2026-89303](https://insights.sbomify.com/CVE-2026-89303/): Post Voting System <= 1.0 - Subscriber+ SQLi via 'row' Parameter (medium 6.4)
- [CVE-2026-89302](https://insights.sbomify.com/CVE-2026-89302/): Post Voting System <= 1.0 - Unauthenticated SQLi via 'id' Parameter (high 8.6)
- [CVE-2026-89301](https://insights.sbomify.com/CVE-2026-89301/): Missing authorization in rtMedia for WordPress, BuddyPress and bbPress (high 7.5)
- [CVE-2026-89300](https://insights.sbomify.com/CVE-2026-89300/): WP Verify API <= 1.0.0 - Unauthenticated Verification Code Email Sending to Arbitrary Recipients (medium 5.3)
- [CVE-2026-89299](https://insights.sbomify.com/CVE-2026-89299/): WP Verify API <= 1.0.0 - Unauthenticated SQLi via 'verify' Parameter (high 8.6)
- [CVE-2026-89298](https://insights.sbomify.com/CVE-2026-89298/): Information disclosure in Red Hat Build of Keycloak (medium 4.9)
- [CVE-2026-89297](https://insights.sbomify.com/CVE-2026-89297/): Loja Automática <= 1.0.0 - Unauthenticated SQLi via 'id' Parameter (high 8.6)
- [CVE-2026-89296](https://insights.sbomify.com/CVE-2026-89296/): Pro Like Button < 2.0 - Unauthenticated SQLi via 'postid' Parameter (high 8.6)
- [CVE-2026-89294](https://insights.sbomify.com/CVE-2026-89294/): Simply Schedule Appointments <= 1.6.12.27 - Authenticated (Subscriber+) Local File Inclusion via 'ssa_locale' Parameter (high 7.5)
- [CVE-2026-89290](https://insights.sbomify.com/CVE-2026-89290/): HTML Injection in İzometri Informatics' eimzamip (low 3.5)
- [CVE-2026-89289](https://insights.sbomify.com/CVE-2026-89289/): Fast Courier <= 5.2.3 - Unauthenticated Order Fulfillment Update via order-status-update REST Endpoint (medium 5.3)
- [CVE-2026-89288](https://insights.sbomify.com/CVE-2026-89288/): Fast Courier 5.0.0 - 5.2.3 - Unauthenticated SQLi via 'wp_order_id' Parameter (high 8.6)
- [CVE-2026-89287](https://insights.sbomify.com/CVE-2026-89287/): ASPL Product Quotation <= 1.1.0 - Unauthenticated SQLi via 'quote_id' Parameter (high 8.6)
- [CVE-2026-89286](https://insights.sbomify.com/CVE-2026-89286/): FormFlow for GoHighLevel <= 1.0.0 - Unauthenticated Sensitive Data Disclosure via Log File (medium 5.3)
- [CVE-2026-89285](https://insights.sbomify.com/CVE-2026-89285/): Datalist it <= 0.0.3 - Unauthenticated SQLi via dli_fronted_action (high 8.6)
- [CVE-2026-89283](https://insights.sbomify.com/CVE-2026-89283/): WP Posts Password Batch Manager <= 1.1 - Unauthenticated Bulk Post Password Rewrite (high 8.6)
- [CVE-2026-89282](https://insights.sbomify.com/CVE-2026-89282/): CVE-2026-89282 (critical 9.1)
- [CVE-2026-89281](https://insights.sbomify.com/CVE-2026-89281/): CVE-2026-89281 (high 8.4)
- [CVE-2026-89280](https://insights.sbomify.com/CVE-2026-89280/): Missing authorization in Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy (medium 4.3)
- [CVE-2026-89279](https://insights.sbomify.com/CVE-2026-89279/): Active Directory Password Change CSRF in AuthTake Technology's authtake (medium 6.5)
- [CVE-2026-89278](https://insights.sbomify.com/CVE-2026-89278/): GPTranslate <= 2.34.6 - Unauthenticated Sensitive Information Exposure in Public Frontend Inline Script (medium 5.3)
- [CVE-2026-89277](https://insights.sbomify.com/CVE-2026-89277/): CAI Content Credentials | Integer Overflow or Wraparound (CWE-190) (medium 5.5)
- [CVE-2026-89276](https://insights.sbomify.com/CVE-2026-89276/): Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94) (critical 9.9)
- [CVE-2026-89275](https://insights.sbomify.com/CVE-2026-89275/): Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94) (critical 10.0)
- [CVE-2026-89274](https://insights.sbomify.com/CVE-2026-89274/): WP Recipe Maker <= 10.8.1 - Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content (critical 9.1)
- [CVE-2026-89271](https://insights.sbomify.com/CVE-2026-89271/): WP-BusinessDirectory <= 4.0.2 - Unauthenticated Arbitrary File Write via uploadFile (medium 5.3)
- [CVE-2026-8927](https://insights.sbomify.com/CVE-2026-8927/): env-set cross-proxy Digest auth state leak (critical 9.1)
- [CVE-2026-89269](https://insights.sbomify.com/CVE-2026-89269/): WP Testimonials <= 1.4.13 - Author+ Stored XSS via wp-testimonials Shortcode (medium 6.8)
- [CVE-2026-89268](https://insights.sbomify.com/CVE-2026-89268/): QloApps through 1.7.0 Reflected XSS via List Filter Parameters (medium 5.1)
- [CVE-2026-89267](https://insights.sbomify.com/CVE-2026-89267/): starlette-admin 0.16.1 through 0.17.1 Searchable Fields Allowlist Bypass (medium 5.3)
- [CVE-2026-89266](https://insights.sbomify.com/CVE-2026-89266/): stb_vorbis through 1.22 heap buffer overflow via codebook multiplicands (high 8.8)
- [CVE-2026-89265](https://insights.sbomify.com/CVE-2026-89265/): MoguBlog through 6.2 Missing Authorization on the Admin getPictureSortByUid Endpoint (medium 5.3)
- [CVE-2026-89264](https://insights.sbomify.com/CVE-2026-89264/): MoguBlog through 6.2 Comment Author Spoofing via Request-Body Identity (medium 5.3)
- [CVE-2026-89263](https://insights.sbomify.com/CVE-2026-89263/): MoguBlog through 6.2 Missing Authentication on the Comment Email-Notification Endpoint (medium 6.9)
- [CVE-2026-89262](https://insights.sbomify.com/CVE-2026-89262/): MoguBlog through 6.2 Arbitrary Comment Deletion via Request-Body Ownership Check (high 8.7)
- [CVE-2026-89261](https://insights.sbomify.com/CVE-2026-89261/): MoguBlog through 6.2 Missing Authentication for Elasticsearch Index Management Endpoints (medium 6.9)
- [CVE-2026-89260](https://insights.sbomify.com/CVE-2026-89260/): MoguBlog through 6.2 XML External Entity Injection in the Unauthenticated WeChat Callback Endpoint (high 8.7)
- [CVE-2026-8926](https://insights.sbomify.com/CVE-2026-8926/): password leak with netrc and user in URL (critical 9.1)
- [CVE-2026-89259](https://insights.sbomify.com/CVE-2026-89259/): Hugo before v0.165.0 Insufficient Permission Restriction via TailwindCSS (critical 9.3)
- [CVE-2026-89258](https://insights.sbomify.com/CVE-2026-89258/): Hugo before v0.165.0 Symlink Confinement Bypass via resources.Get (critical 9.3)
- [CVE-2026-89257](https://insights.sbomify.com/CVE-2026-89257/): AVideo through 29.0 Cross-User Category Asset Deletion via Missing Ownership Check (medium 5.3)
- [CVE-2026-89256](https://insights.sbomify.com/CVE-2026-89256/): AVideo Bookmark Plugin Stored XSS via Chapter Names (critical 9.3)
- [CVE-2026-89255](https://insights.sbomify.com/CVE-2026-89255/): AVideo LoginControl Stored XSS via PGP Public Key (critical 9.3)
- [CVE-2026-89254](https://insights.sbomify.com/CVE-2026-89254/): AVideo CustomizeUser Stored XSS via field_name Parameter (critical 9.3)
- [CVE-2026-89253](https://insights.sbomify.com/CVE-2026-89253/): AVideo Stored XSS via donationLink in watch page button (critical 9.3)
- [CVE-2026-89252](https://insights.sbomify.com/CVE-2026-89252/): AVideo Missing Authorization in addLiveLink.php LiveLink Update (high 7.1)
- [CVE-2026-89251](https://insights.sbomify.com/CVE-2026-89251/): AVideo Missing Authorization via AD_Server log.php Wallet Credit (high 7.1)
- [CVE-2026-89250](https://insights.sbomify.com/CVE-2026-89250/): WWBN AVideo Unauthenticated File Read via getRecordedFile.php (high 8.7)
- [CVE-2026-8925](https://insights.sbomify.com/CVE-2026-8925/): SASL double-free (critical 9.8)
- [CVE-2026-89249](https://insights.sbomify.com/CVE-2026-89249/): AVideo YPTWallet Stored XSS via CryptoWallet Configuration (critical 9.3)
- [CVE-2026-89248](https://insights.sbomify.com/CVE-2026-89248/): AVideo WebRTC Plugin Information Disclosure via status.json.php (medium 6.9)
- [CVE-2026-89247](https://insights.sbomify.com/CVE-2026-89247/): WWBN AVideo XML Injection via plugin/AD_Server/VMAP.php (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/276/