# Vulnerabilities published in 2026


- [CVE-2026-89097](https://insights.sbomify.com/CVE-2026-89097/): Information disclosure in Ad Inserter – Ad Manager & AdSense Ads (medium 4.3)
- [CVE-2026-89096](https://insights.sbomify.com/CVE-2026-89096/): Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statd (medium 5.9)
- [CVE-2026-89094](https://insights.sbomify.com/CVE-2026-89094/): Code injection in Forgejo (critical 9.9)
- [CVE-2026-89093](https://insights.sbomify.com/CVE-2026-89093/): Better Messages <= 2.15.33 - Unauthenticated Information Exposure Spoofing via 'X-Real-IP' Header via /guests/register (medium 5.3)
- [CVE-2026-89092](https://insights.sbomify.com/CVE-2026-89092/): Stack overflow in nscd due to unbounded alloca use (medium 4.2)
- [CVE-2026-89091](https://insights.sbomify.com/CVE-2026-89091/): Path traversal in Migration Toolkit for Applications 8 (high 8.8)
- [CVE-2026-89090](https://insights.sbomify.com/CVE-2026-89090/): Denial of service in the event stream header decoder in AWS SDK for Go v2 (high 8.2)
- [CVE-2026-8909](https://insights.sbomify.com/CVE-2026-8909/): WpMobi <= 0.0.3 - Cross-Site Request Forgery via save_general_settings Action (medium 4.3)
- [CVE-2026-89089](https://insights.sbomify.com/CVE-2026-89089/): OpenNMS SQL injection in shipped Asset Management JasperReports via the DATE_FORMAT parameter (ROLE_USER) (medium 6.5)
- [CVE-2026-89088](https://insights.sbomify.com/CVE-2026-89088/): Parted: parted: denial of service via heap buffer overflow during fat16 resize (medium 5.5)
- [CVE-2026-89087](https://insights.sbomify.com/CVE-2026-89087/): Other in cstruct (high 7.3)
- [CVE-2026-89086](https://insights.sbomify.com/CVE-2026-89086/): Security feature bypass in jose (critical 9.1)
- [CVE-2026-89085](https://insights.sbomify.com/CVE-2026-89085/): Parted: parted: heap-based buffer overflow via crafted fat32 filesystem image (medium 6.6)
- [CVE-2026-89084](https://insights.sbomify.com/CVE-2026-89084/): HP Advance – Potential Elevation of Privilege, Remote Code Execution & Arbitrary File Write (high 8.8)
- [CVE-2026-89083](https://insights.sbomify.com/CVE-2026-89083/): HP Advance – Potential Elevation of Privilege, Remote Code Execution & Arbitrary File Write (critical 9.3)
- [CVE-2026-89082](https://insights.sbomify.com/CVE-2026-89082/): HP Advance – Potential Elevation of Privilege, Remote Code Execution & Arbitrary File Write (critical 9.3)
- [CVE-2026-89081](https://insights.sbomify.com/CVE-2026-89081/): Tutor LMS <= 4.0.8 - Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters (medium 6.1)
- [CVE-2026-89080](https://insights.sbomify.com/CVE-2026-89080/): Really Simple Security < 9.8.1 - Unauthenticated 2FA Bypass via Email Provider State Demotion (high 7.5)
- [CVE-2026-89079](https://insights.sbomify.com/CVE-2026-89079/): Privilege escalation in Theme My Login (critical 9.8)
- [CVE-2026-89078](https://insights.sbomify.com/CVE-2026-89078/): Double Free in GitLab (critical 9.9)
- [CVE-2026-89077](https://insights.sbomify.com/CVE-2026-89077/): MOVEit Transfer Identity validation flaw in SFTP authentication (high 7.5)
- [CVE-2026-89076](https://insights.sbomify.com/CVE-2026-89076/): MOVEit Transfer SQL injection in custom reporting (high 7.2)
- [CVE-2026-89075](https://insights.sbomify.com/CVE-2026-89075/): MOVEit Transfer Local Disclosure of Session Information Vulnerability (high 7.3)
- [CVE-2026-89074](https://insights.sbomify.com/CVE-2026-89074/): MOVEit Transfer Email MFA Bypass (high 7.5)
- [CVE-2026-89073](https://insights.sbomify.com/CVE-2026-89073/): MOVEit Transfer Access restriction bypass in OAuth authentication (high 7.5)
- [CVE-2026-89072](https://insights.sbomify.com/CVE-2026-89072/): MOVEit Transfer Authorization Flaw in Certificate Management (high 7.5)
- [CVE-2026-89071](https://insights.sbomify.com/CVE-2026-89071/): MOVEit Transfer LDAP injection in certificate-based authentication (high 7.5)
- [CVE-2026-89070](https://insights.sbomify.com/CVE-2026-89070/): MOVEit Transfer OIDC Authentication Replay Vulnerability (high 7.5)
- [CVE-2026-8907](https://insights.sbomify.com/CVE-2026-8907/): WP-Ultimate-Map <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'zoom-level' Parameter (medium 6.1)
- [CVE-2026-89069](https://insights.sbomify.com/CVE-2026-89069/): MOVEit Transfer Stored XSS Vulnerability in Ad Hoc Packages (high 8.0)
- [CVE-2026-89068](https://insights.sbomify.com/CVE-2026-89068/): MOVEit Transfer Authentication bypass in LDAP sign-on (high 8.1)
- [CVE-2026-89067](https://insights.sbomify.com/CVE-2026-89067/): MOVEit Transfer Secure Messaging Authentication Bypass (high 8.8)
- [CVE-2026-89066](https://insights.sbomify.com/CVE-2026-89066/): OS command injection in the task synthesis component in projen (high 8.4)
- [CVE-2026-89065](https://insights.sbomify.com/CVE-2026-89065/): Relative path traversal in the generated file manifest cleanup component in projen (medium 6.8)
- [CVE-2026-89064](https://insights.sbomify.com/CVE-2026-89064/): Information disclosure in All-in-One WP Migration and Backup (medium 5.3)
- [CVE-2026-89063](https://insights.sbomify.com/CVE-2026-89063/): Missing authorization in Online Scheduling and Appointment Booking System – Bookly (high 7.5)
- [CVE-2026-89062](https://insights.sbomify.com/CVE-2026-89062/): Memory corruption in Energy Management Driver (medium 6.8)
- [CVE-2026-89060](https://insights.sbomify.com/CVE-2026-89060/): Missing authorization in Red Hat Advanced Cluster Management for Kubernetes 2.13 (high 7.7)
- [CVE-2026-8906](https://insights.sbomify.com/CVE-2026-8906/): WP Promoter <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'popup_width' Parameter (medium 6.1)
- [CVE-2026-89059](https://insights.sbomify.com/CVE-2026-89059/): Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos) (high 7.5)
- [CVE-2026-89058](https://insights.sbomify.com/CVE-2026-89058/): Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config (high 7.4)
- [CVE-2026-89057](https://insights.sbomify.com/CVE-2026-89057/): Auth bypass in Idea Tab Pro (TB373FU) (high 7.0)
- [CVE-2026-89055](https://insights.sbomify.com/CVE-2026-89055/): Missing authorization in Customer Reviews for WooCommerce (critical 9.1)
- [CVE-2026-89054](https://insights.sbomify.com/CVE-2026-89054/): OpenNMS missing authorization on /api/v2 PATCH endpoints allows unauthenticated configuration changes (high 8.2)
- [CVE-2026-89052](https://insights.sbomify.com/CVE-2026-89052/): Hardcoded AES encryption key in Archer C6 (medium 5.9)
- [CVE-2026-89051](https://insights.sbomify.com/CVE-2026-89051/): Hide My WP Ghost <= 7.0.12 - Unauthenticated Stored Cross-Site Scripting via Comment Content (high 7.2)
- [CVE-2026-89050](https://insights.sbomify.com/CVE-2026-89050/): Quads Ads Manager for Google AdSense < 3.0.5 - Subscriber+ Ad-Selling Payment Bypass via Unverified Success Return URL (medium 4.3)
- [CVE-2026-8905](https://insights.sbomify.com/CVE-2026-8905/): Osiris Signature Banner <= 0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'prepend_text' Parameter (medium 6.1)
- [CVE-2026-89049](https://insights.sbomify.com/CVE-2026-89049/): Server-side request forgery in the Session Manager port forwarding functionality in AWS Systems Manager Agent (high 8.5)
- [CVE-2026-89047](https://insights.sbomify.com/CVE-2026-89047/): Social Media Share Buttons & Social Sharing Icons <= 3.0.1 - Reflected DOM-Based Cross-Site Scripting via URL (medium 6.1)
- [CVE-2026-89046](https://insights.sbomify.com/CVE-2026-89046/): zstd-jni 1.5.5-6 through 1.5.7-13 Out-of-Bounds Read via Negative Offset (high 8.8)
- [CVE-2026-89045](https://insights.sbomify.com/CVE-2026-89045/): zstd-jni 1.4.8-4 through 1.5.7-13 Denial of Service via Negative Length (medium 5.1)
- [CVE-2026-89044](https://insights.sbomify.com/CVE-2026-89044/): Other in netty (medium 6.9)
- [CVE-2026-89043](https://insights.sbomify.com/CVE-2026-89043/): passport-saml-encrypted through 0.1.13 XML Signature Wrapping via Assertion Prepending (critical 9.1)
- [CVE-2026-89042](https://insights.sbomify.com/CVE-2026-89042/): passport-saml-encrypted through 0.1.13 Authentication Bypass via Missing Signature Verification (critical 9.3)
- [CVE-2026-89040](https://insights.sbomify.com/CVE-2026-89040/): Tencent Mass Service Engine in Cluster (MSEC) path traversal (critical 9.3)
- [CVE-2026-8904](https://insights.sbomify.com/CVE-2026-8904/): Cross-site request forgery in FastPicker, an order picker and order management system (oms) for WooCommerce on steroids (medium 4.3)
- [CVE-2026-89039](https://insights.sbomify.com/CVE-2026-89039/): Arbitrary file read via the convert_playwright_script prompt in mcp-k6 (medium 6.5)
- [CVE-2026-89038](https://insights.sbomify.com/CVE-2026-89038/): Verizon Cloud for Android < 26.7.10 Path Traversal via OneTouchUploadActivity (medium 6.9)
- [CVE-2026-89036](https://insights.sbomify.com/CVE-2026-89036/): Appwrite < 2.0.0 Argument Injection via providerRootDirectory Parameter (high 8.7)
- [CVE-2026-89035](https://insights.sbomify.com/CVE-2026-89035/): MikroTik RouterOS 7.24.5 WebFig Session Token Replay Authentication Bypass (critical 9.1)
- [CVE-2026-89034](https://insights.sbomify.com/CVE-2026-89034/): TCH QRing R20_B006 Unauthenticated BLE Access (high 7.1)
- [CVE-2026-89032](https://insights.sbomify.com/CVE-2026-89032/): BerriAI LiteLLM < 1.101.0-rc.1 Tenant Isolation Bypass via Semantic Cache Layer (high 8.7)
- [CVE-2026-89031](https://insights.sbomify.com/CVE-2026-89031/): Blog2Social WordPress Plugin < 9.1.0 Broken Access Control via b2s_calendar_move_post (medium 5.3)
- [CVE-2026-89030](https://insights.sbomify.com/CVE-2026-89030/): Blog2Social WordPress Plugin < 9.1.0 User Email Disclosure via b2s_search_user (medium 5.3)
- [CVE-2026-8903](https://insights.sbomify.com/CVE-2026-8903/): Two-factor authentication (formerly IP Vault) <= 2.1 - Cross-Site Request Forgery to Settings Update (medium 4.3)
- [CVE-2026-89029](https://insights.sbomify.com/CVE-2026-89029/): Blog2Social WordPress Plugin < 9.1.0 User Enumeration via AJAX Handler (medium 5.3)
- [CVE-2026-89028](https://insights.sbomify.com/CVE-2026-89028/): MikroTik RouterOS < 7.24 Heap Corruption via SMB1 SessionSetupAndX (high 8.2)
- [CVE-2026-89027](https://insights.sbomify.com/CVE-2026-89027/): miniOrange JWT Authentication for WP REST APIs < 4.8.0 Authentication Downgrade (medium 6.9)
- [CVE-2026-89026](https://insights.sbomify.com/CVE-2026-89026/): Issabel Framework Hard-coded JWT Key RCE via pbxapi/manager/originate (critical 9.3)
- [CVE-2026-89025](https://insights.sbomify.com/CVE-2026-89025/): Hirschmann HiOS Switch Platform DoS via Malformed HTTP Request (high 8.7)
- [CVE-2026-89023](https://insights.sbomify.com/CVE-2026-89023/): ThemeAtelier Domain For Sale < 3.5.2 Missing Authorization via REST API (high 8.8)
- [CVE-2026-89022](https://insights.sbomify.com/CVE-2026-89022/): BookStack < 26.05.5 Authentication Bypass via Social Login Provider Confusion (critical 9.1)
- [CVE-2026-89021](https://insights.sbomify.com/CVE-2026-89021/): MikroTik RouterOS Path Traversal via Container OCI/tar Image Extraction (medium 6.9)
- [CVE-2026-89020](https://insights.sbomify.com/CVE-2026-89020/): MikroTik RouterOS Stack Buffer Overflow via TFTP URL Path (medium 5.3)
- [CVE-2026-8902](https://insights.sbomify.com/CVE-2026-8902/): AJAX Report Comments <= 2.0.4 - Cross-Site Request Forgery to Settings Update (medium 4.3)
- [CVE-2026-89013](https://insights.sbomify.com/CVE-2026-89013/): Dolibarr 23.0.4 < 24.0.1 Authorization Bypass via hashp Parameter in document.php (high 8.7)
- [CVE-2026-89012](https://insights.sbomify.com/CVE-2026-89012/): Dolibarr 24.0.0 < 24.0.1 SQL Filter Denylist Bypass via sqlfilters Parameter (high 7.1)
- [CVE-2026-89011](https://insights.sbomify.com/CVE-2026-89011/): isomorphic-git < 1.42.0 Prototype Pollution via getRemoteInfo (high 7.1)
- [CVE-2026-89010](https://insights.sbomify.com/CVE-2026-89010/): WAVLINK WN535M1/WN535M3 Unauthenticated OS Command Injection via sync_server (critical 9.3)
- [CVE-2026-8901](https://insights.sbomify.com/CVE-2026-8901/): Integration for Freshsales <= 1.0.15 - Unauthenticated Stored Cross-Site Scripting via Form Submission Data (high 7.2)
- [CVE-2026-89009](https://insights.sbomify.com/CVE-2026-89009/): WAVLINK WN535M1/WN535M3 Unauthenticated Arbitrary File Write via sync_server (high 8.8)
- [CVE-2026-89008](https://insights.sbomify.com/CVE-2026-89008/): Bookit < 2.6.0.5 - Bookit Staff+ Appointment PII Disclosure (low 2.7)
- [CVE-2026-89007](https://insights.sbomify.com/CVE-2026-89007/): Bookit < 2.6.0.5 - Bookit Staff+ Arbitrary Appointment Deletion via Missing Authorization (low 2.7)
- [CVE-2026-89006](https://insights.sbomify.com/CVE-2026-89006/): WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Stored XSS via Feed Import (medium 6.8)
- [CVE-2026-89005](https://insights.sbomify.com/CVE-2026-89005/): WPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Stored XSS via Word to Category (medium 6.8)
- [CVE-2026-89004](https://insights.sbomify.com/CVE-2026-89004/): WPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Campaign Configuration and Log Disclosure via IDOR (low 2.7)
- [CVE-2026-89003](https://insights.sbomify.com/CVE-2026-89003/): WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ SSRF via Campaign Preview (medium 4.1)
- [CVE-2026-89002](https://insights.sbomify.com/CVE-2026-89002/): WPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Stored XSS via Campaign Item Preview (medium 6.8)
- [CVE-2026-89001](https://insights.sbomify.com/CVE-2026-89001/): WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Post Publication and Author Spoofing via Campaign Settings (medium 4.9)
- [CVE-2026-89000](https://insights.sbomify.com/CVE-2026-89000/): WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ SSRF via Campaign Run (medium 4.1)
- [CVE-2026-8900](https://insights.sbomify.com/CVE-2026-8900/): Simple SEO Slideshow <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-88999](https://insights.sbomify.com/CVE-2026-88999/): Missing authorization in Redux Framework (medium 4.3)
- [CVE-2026-88998](https://insights.sbomify.com/CVE-2026-88998/): Tickera < 3.6.0.4 - Unauthenticated Order Payment Bypass via 2Checkout IPN (medium 5.3)
- [CVE-2026-88997](https://insights.sbomify.com/CVE-2026-88997/): JSM Show Post Metadata < 4.9.1 - Contributor+ Stored XSS via Custom Field Meta Key (medium 6.8)
- [CVE-2026-88996](https://insights.sbomify.com/CVE-2026-88996/): WPForms <= 2.0.2 - Reflected Cross-Site Scripting via 'page_title' POST Parameter (medium 6.1)
- [CVE-2026-88995](https://insights.sbomify.com/CVE-2026-88995/): Bookit < 2.6.0.1 - Unauthenticated Appointment PII Disclosure via Availability Check (medium 5.3)
- [CVE-2026-88994](https://insights.sbomify.com/CVE-2026-88994/): All Bootstrap Blocks 1.3.20 - 1.3.31 - Contributor+ LFI via lightspeed Block Attributes (medium 6.6)
- [CVE-2026-88993](https://insights.sbomify.com/CVE-2026-88993/): All Bootstrap Blocks <= 1.3.31 - Contributor+ Stored XSS via areoi/button type Attribute (medium 6.8)
- [CVE-2026-8899](https://insights.sbomify.com/CVE-2026-8899/): Auto Thumbnails <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/278/