# Vulnerabilities published in 2026


- [CVE-2026-8898](https://insights.sbomify.com/CVE-2026-8898/): Events In City <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-88978](https://insights.sbomify.com/CVE-2026-88978/): Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter (medium 4.3)
- [CVE-2026-88976](https://insights.sbomify.com/CVE-2026-88976/): @platejs/core HTML deserialization can trigger browser behavior during parsing (medium 6.1)
- [CVE-2026-88975](https://insights.sbomify.com/CVE-2026-88975/): Http4s: Ember HTTP/2 buffers a frame's declared payload before checking SETTINGS_MAX_FRAME_SIZE (high 7.5)
- [CVE-2026-88974](https://insights.sbomify.com/CVE-2026-88974/): WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost (medium 5.4)
- [CVE-2026-8897](https://insights.sbomify.com/CVE-2026-8897/): Shortcode Buddy <= 0.1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-88967](https://insights.sbomify.com/CVE-2026-88967/): Azure Monitor access token disclosure via SSRF (high 7.7)
- [CVE-2026-88964](https://insights.sbomify.com/CVE-2026-88964/): Integer overflow in OpenVPN (high 7.1)
- [CVE-2026-88963](https://insights.sbomify.com/CVE-2026-88963/): Tutor LMS <= 4.0.8 - Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting via 'redirect_url' Parameter (medium 6.1)
- [CVE-2026-88962](https://insights.sbomify.com/CVE-2026-88962/): Langflow OSS is affected by multiple vulnerabilities (high 8.8)
- [CVE-2026-8896](https://insights.sbomify.com/CVE-2026-8896/): MIR blocks and shortcodes <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-88959](https://insights.sbomify.com/CVE-2026-88959/): Anchor CMS through 0.12.7 Privilege Escalation via Missing Authorization on Admin User-Management Endpoints (high 8.7)
- [CVE-2026-88956](https://insights.sbomify.com/CVE-2026-88956/): Botslab G980H Dashcams Missing Authentication for Critical Function (high 7.0)
- [CVE-2026-88952](https://insights.sbomify.com/CVE-2026-88952/): OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication (critical 9.1)
- [CVE-2026-8895](https://insights.sbomify.com/CVE-2026-8895/): kk blog card <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-88944](https://insights.sbomify.com/CVE-2026-88944/): Missing authorization in Tutor LMS – eLearning and online course solution (medium 4.3)
- [CVE-2026-88941](https://insights.sbomify.com/CVE-2026-88941/): Denial of service in Administration Server (medium 6.2)
- [CVE-2026-88940](https://insights.sbomify.com/CVE-2026-88940/): knowns through 0.33.0 Arbitrary Directory Enumeration via workspace browse endpoint (medium 6.9)
- [CVE-2026-8894](https://insights.sbomify.com/CVE-2026-8894/): iWR Tooltip <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-88939](https://insights.sbomify.com/CVE-2026-88939/): knowns through 0.33.0 Authorization Bypass via project.set Bootstrap Exemption (high 8.7)
- [CVE-2026-88938](https://insights.sbomify.com/CVE-2026-88938/): knowns through 0.33.0 Path Traversal via code.find MCP tool (high 7.1)
- [CVE-2026-88937](https://insights.sbomify.com/CVE-2026-88937/): knowns through 0.33.0 Path Traversal via Template Engine (high 8.6)
- [CVE-2026-88932](https://insights.sbomify.com/CVE-2026-88932/): multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads (medium 5.3)
- [CVE-2026-88931](https://insights.sbomify.com/CVE-2026-88931/): Social Web Suite <= 4.1.12 - Unauthenticated Arbitrary Plugin Settings Update (medium 5.3)
- [CVE-2026-88930](https://insights.sbomify.com/CVE-2026-88930/): Social Web Suite <= 4.1.12 - Unauthenticated Blind SQLi via Unset Shared Secret (high 8.6)
- [CVE-2026-8893](https://insights.sbomify.com/CVE-2026-8893/): Cross-site scripting in Express Payment For Stripe (medium 6.4)
- [CVE-2026-88929](https://insights.sbomify.com/CVE-2026-88929/): Sale Booster 7.0.0 - 7.5.1 - Unauthenticated Non-Public Product Disclosure (medium 5.3)
- [CVE-2026-88928](https://insights.sbomify.com/CVE-2026-88928/): PAYCOMET for WooCommerce 5.36 - 5.45 - Unauthenticated Stored Payment Token Overwrite via Signature Verification Bypass (medium 6.5)
- [CVE-2026-88927](https://insights.sbomify.com/CVE-2026-88927/): rtMedia for WordPress, BuddyPress and bbPress < 4.7.14 - Subscriber+ Arbitrary Album Media Injection via IDOR (medium 4.3)
- [CVE-2026-88926](https://insights.sbomify.com/CVE-2026-88926/): VikRentItems Flexible Rental Management System < 1.2.4 - Unauthenticated SQLi (high 8.6)
- [CVE-2026-88924](https://insights.sbomify.com/CVE-2026-88924/): Gvfs: gvfs-admin socket ownership race permits local root (high 7.0)
- [CVE-2026-88922](https://insights.sbomify.com/CVE-2026-88922/): Go-getter vulnerable to a privilege escalation issue in its archive decompression handling (medium 6.7)
- [CVE-2026-88921](https://insights.sbomify.com/CVE-2026-88921/): MISP: Unescaped HTML Injection in PDF Report Element Rendering (medium 5.1)
- [CVE-2026-88920](https://insights.sbomify.com/CVE-2026-88920/): Apache WSS4J: SAML Sender-Vouches Authentication Bypass (critical 9.8)
- [CVE-2026-8892](https://insights.sbomify.com/CVE-2026-8892/): Cross-site scripting in CM Business Directory – Optimise and showcase local business (medium 6.4)
- [CVE-2026-88916](https://insights.sbomify.com/CVE-2026-88916/): Admin Access Bypass via Header Fallback in TÜBİTAK ULAKBİM's UlakPDF (medium 6.8)
- [CVE-2026-88915](https://insights.sbomify.com/CVE-2026-88915/): MISP Event Template Instantiation Bypasses Sharing Group and Tagging Authorization (high 7.1)
- [CVE-2026-88914](https://insights.sbomify.com/CVE-2026-88914/): Gstreamer1-plugins-good: gstreamer: integer overflow and out-of-bounds read in qtdemux cea-608 closed-caption parser (medium 4.4)
- [CVE-2026-88912](https://insights.sbomify.com/CVE-2026-88912/): rtMedia for WordPress, BuddyPress and bbPress < 4.7.12 - Subscriber+ Arbitrary Activity Privacy Modification via IDOR (medium 4.2)
- [CVE-2026-88910](https://insights.sbomify.com/CVE-2026-88910/): KBoard < 6.7 - Unauthenticated Board Media Deletion via IDOR (medium 5.3)
- [CVE-2026-8891](https://insights.sbomify.com/CVE-2026-8891/): BitForm <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-88907](https://insights.sbomify.com/CVE-2026-88907/): SAML ePPN Attribute Validation Bypass in TÜBİTAK ULAKBİM's UlakPDF (high 7.4)
- [CVE-2026-88905](https://insights.sbomify.com/CVE-2026-88905/): KeyWord Collector <= 1.4 - Unauthenticated Stored XSS and Settings Update via WPKeyWordSettings (high 8.8)
- [CVE-2026-88904](https://insights.sbomify.com/CVE-2026-88904/): PuppyFW <= 0.4.4 - Subscriber+ Arbitrary Blog Options Update and Deletion Leading to Privilege Escalation (high 8.8)
- [CVE-2026-88903](https://insights.sbomify.com/CVE-2026-88903/): Topcontent <= 1.2.1 - Unauthenticated Stored XSS via Content Webhook (high 8.8)
- [CVE-2026-88901](https://insights.sbomify.com/CVE-2026-88901/): Apache Camel: Camel-Smooks XML External Entity Processing, external entities resolved by default (high 8.2)
- [CVE-2026-88900](https://insights.sbomify.com/CVE-2026-88900/): Deserialization in Apache Camel (high 8.8)
- [CVE-2026-8890](https://insights.sbomify.com/CVE-2026-8890/): code100x Mobile API Authentication Bypass via Header Spoofing (high 8.8)
- [CVE-2026-88899](https://insights.sbomify.com/CVE-2026-88899/): knowns before 0.31.0 External Control of Agent Working Directory via x-opencode-directory Header (critical 9.3)
- [CVE-2026-88898](https://insights.sbomify.com/CVE-2026-88898/): AppFlowy-Cloud 0.7.2 through 0.9.64 Missing Workspace Authorization on Bulk Publish Endpoint (high 7.1)
- [CVE-2026-88897](https://insights.sbomify.com/CVE-2026-88897/): Flextype CMS through 1.0.0-alpha.3 API Token Exposure via Query String (high 8.2)
- [CVE-2026-88896](https://insights.sbomify.com/CVE-2026-88896/): EspoCRM before 10.0.4 SSRF via IPv6 Transition Address Bypass (medium 6.9)
- [CVE-2026-88895](https://insights.sbomify.com/CVE-2026-88895/): CyberPanel before 3.0.5 Authentication Bypass via API (high 8.6)
- [CVE-2026-88894](https://insights.sbomify.com/CVE-2026-88894/): Snipe-IT before 8.7.2 Authorization Bypass via Predefined Kit Checkout (medium 5.3)
- [CVE-2026-88893](https://insights.sbomify.com/CVE-2026-88893/): OpenPanel through 2.3.0 Unauthenticated Share Lookup Information Disclosure (high 8.7)
- [CVE-2026-88892](https://insights.sbomify.com/CVE-2026-88892/): OpenPanel through 2.3.0 SSRF via Unguarded Importer File URL Fetch (medium 5.3)
- [CVE-2026-88891](https://insights.sbomify.com/CVE-2026-88891/): OpenPanel through 2.3.0 Read-Only Access Level Enforcement Bypass via Mutations (high 7.2)
- [CVE-2026-88890](https://insights.sbomify.com/CVE-2026-88890/): OpenPanel through 2.3.0 SQL Injection via unvalidated profile filter column identifier (high 8.4)
- [CVE-2026-8889](https://insights.sbomify.com/CVE-2026-8889/): CVE-2026-8889 (high 7.5)
- [CVE-2026-88889](https://insights.sbomify.com/CVE-2026-88889/): Renovate before 44.14.7 Command Injection via distributionType (high 8.5)
- [CVE-2026-88888](https://insights.sbomify.com/CVE-2026-88888/): Renovate before 44.14.7 Command Injection via Mix organization (high 7.3)
- [CVE-2026-88887](https://insights.sbomify.com/CVE-2026-88887/): Renovate before 44.11.2 Credential Exfiltration via Link Header (critical 9.2)
- [CVE-2026-88886](https://insights.sbomify.com/CVE-2026-88886/): Renovate before 44.14.7 Command Injection via gradle-wrapper (high 8.5)
- [CVE-2026-88885](https://insights.sbomify.com/CVE-2026-88885/): Renovate before 44.14.7 Command Injection via depName (high 7.3)
- [CVE-2026-88884](https://insights.sbomify.com/CVE-2026-88884/): Renovate before 44.3.1 Authentication Bypass via Digest Updates (medium 6.9)
- [CVE-2026-88883](https://insights.sbomify.com/CVE-2026-88883/): Renovate before 44.14.4 TLS Private Key Log Sanitisation (high 8.3)
- [CVE-2026-88882](https://insights.sbomify.com/CVE-2026-88882/): Renovate before 44.11.2 Credential Exfiltration via Link Header (critical 9.2)
- [CVE-2026-88881](https://insights.sbomify.com/CVE-2026-88881/): Renovate before 44.11.3 Credential Exfiltration via Link Header (critical 9.2)
- [CVE-2026-88880](https://insights.sbomify.com/CVE-2026-88880/): Renovate before 44.11.3 Credential Exfiltration via Link Header (critical 9.2)
- [CVE-2026-8888](https://insights.sbomify.com/CVE-2026-8888/): CVE-2026-8888 (high 7.5)
- [CVE-2026-88879](https://insights.sbomify.com/CVE-2026-88879/): Traefik before v2.11.56 Identity Spoofing via Header Alias (medium 5.3)
- [CVE-2026-88878](https://insights.sbomify.com/CVE-2026-88878/): Traefik v2.8.2 through v3.6 HTTP/3 Timeout Bypass (medium 6.9)
- [CVE-2026-88877](https://insights.sbomify.com/CVE-2026-88877/): Traefik v3.7.0 Authentication Bypass via from-to-www-redirect (critical 9.3)
- [CVE-2026-88876](https://insights.sbomify.com/CVE-2026-88876/): AVideo PlayerSkins seo.php Missing Authorization Password-Protected VOD (high 8.7)
- [CVE-2026-88875](https://insights.sbomify.com/CVE-2026-88875/): AVideo Incomplete API Sanitization Information Disclosure (medium 5.3)
- [CVE-2026-88874](https://insights.sbomify.com/CVE-2026-88874/): AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 Authentication Bypass (high 8.7)
- [CVE-2026-88873](https://insights.sbomify.com/CVE-2026-88873/): WWBN AVideo Cross-Site Request Forgery via logArchive.json.php (high 7.1)
- [CVE-2026-88872](https://insights.sbomify.com/CVE-2026-88872/): AVideo CustomizeUser setPassword.json.php CSRF (high 7.1)
- [CVE-2026-88871](https://insights.sbomify.com/CVE-2026-88871/): WWBN AVideo CustomizeUser setSubscribers CSRF via GET (medium 5.3)
- [CVE-2026-88870](https://insights.sbomify.com/CVE-2026-88870/): WWBN AVideo LoginControl PGP Key CSRF via GET Request (high 7.1)
- [CVE-2026-8887](https://insights.sbomify.com/CVE-2026-8887/): Listen Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-88869](https://insights.sbomify.com/CVE-2026-88869/): AVideo AD_Server Stored XSS via log.php label parameter (critical 9.3)
- [CVE-2026-88868](https://insights.sbomify.com/CVE-2026-88868/): AVideo LiveLinks Stored XSS via title and description fields (critical 9.3)
- [CVE-2026-88867](https://insights.sbomify.com/CVE-2026-88867/): WWBN AVideo Stored XSS via Category Name and Icon Class (critical 9.3)
- [CVE-2026-88866](https://insights.sbomify.com/CVE-2026-88866/): WWBN AVideo LoginControl Stored XSS via User-Agent Header (critical 9.3)
- [CVE-2026-88865](https://insights.sbomify.com/CVE-2026-88865/): AVideo Missing Authorization via getRestream.json.php (high 8.6)
- [CVE-2026-88864](https://insights.sbomify.com/CVE-2026-88864/): Capgo SSO Provider Authentication Bypass via PostgREST Direct Write (critical 9.3)
- [CVE-2026-88863](https://insights.sbomify.com/CVE-2026-88863/): capgo.app through 12.207.1 Privilege Escalation via invite_new_user_to_org (high 8.6)
- [CVE-2026-88862](https://insights.sbomify.com/CVE-2026-88862/): Capgo API Key Manager Authentication Bypass via x-limited-key-id (high 8.7)
- [CVE-2026-88861](https://insights.sbomify.com/CVE-2026-88861/): Capgo AAL1 Session MFA Bypass via Direct RBAC Authorization (high 8.7)
- [CVE-2026-88860](https://insights.sbomify.com/CVE-2026-88860/): Capgo Authorization Bypass via Stale Channel Permission Overrides (critical 9.3)
- [CVE-2026-8886](https://insights.sbomify.com/CVE-2026-8886/): hk_shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute (medium 6.4)
- [CVE-2026-88859](https://insights.sbomify.com/CVE-2026-88859/): Evolution: evolution: javascript execution via spoofed vcard control bypasses mail script-markup restriction (medium 6.3)
- [CVE-2026-88858](https://insights.sbomify.com/CVE-2026-88858/): Server-side expression parser denial of service (medium 6.5)
- [CVE-2026-88857](https://insights.sbomify.com/CVE-2026-88857/): File upload in OrdaSoft Joomla Gallery extension for Joomla (critical 9.4)
- [CVE-2026-88856](https://insights.sbomify.com/CVE-2026-88856/): Code injection in OrdaSoft Joomla Gallery extension for Joomla (critical 9.4)
- [CVE-2026-88855](https://insights.sbomify.com/CVE-2026-88855/): SQL injection in OrdaSoft Joomla Gallery extension for Joomla (high 8.6)
- [CVE-2026-88854](https://insights.sbomify.com/CVE-2026-88854/): Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 (critical 9.3)
- [CVE-2026-88853](https://insights.sbomify.com/CVE-2026-88853/): Cross-site scripting in Modals (Pro) extension for Joomla (high 7.5)
- [CVE-2026-88852](https://insights.sbomify.com/CVE-2026-88852/): Cross-site scripting in Snippets (Free) extension for Joomla (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/279/