# Vulnerabilities published in 2026


- [CVE-2026-8885](https://insights.sbomify.com/CVE-2026-8885/): DeMomentSomTres Shortcodes <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-88849](https://insights.sbomify.com/CVE-2026-88849/): MasterStudy LMS 3.7.13 - 3.7.54 - Instructor+ Arbitrary User Display Name Update via Student Enrollment (low 2.7)
- [CVE-2026-88848](https://insights.sbomify.com/CVE-2026-88848/): MasterStudy LMS 1.9 - < 3.7.50 - Subscriber+ Membership Plan Quota and Category Restriction Bypass (medium 4.2)
- [CVE-2026-88847](https://insights.sbomify.com/CVE-2026-88847/): MasterStudy LMS < 3.7.50 - Subscriber+ Lesson Completion Record Creation (medium 4.3)
- [CVE-2026-88846](https://insights.sbomify.com/CVE-2026-88846/): MasterStudy LMS 2.3.0 - < 3.7.50 - Unauthenticated Account Creation with Registration Disabled (medium 5.3)
- [CVE-2026-88845](https://insights.sbomify.com/CVE-2026-88845/): MasterStudy LMS 2.3.0 - < 3.7.50 - Subscriber+ Course and Lesson Creation via Demo Import (medium 4.3)
- [CVE-2026-88844](https://insights.sbomify.com/CVE-2026-88844/): MasterStudy LMS 3.6.2 - < 3.7.50 - Instructor+ Student PII Disclosure via IDOR (low 2.7)
- [CVE-2026-88843](https://insights.sbomify.com/CVE-2026-88843/): MasterStudy LMS 3.5.29 - < 3.7.50 - Contributor+ LFI via Elementor Courses Categories Widget (high 7.2)
- [CVE-2026-88842](https://insights.sbomify.com/CVE-2026-88842/): Busybox: busybox: dpkg stale field_start pointer causes out-of-bounds read and status file corruption (low 3.3)
- [CVE-2026-88840](https://insights.sbomify.com/CVE-2026-88840/): Busybox: busybox: tls ssl_server reads one byte out of bounds when parsing truncated clienthello (medium 5.3)
- [CVE-2026-8884](https://insights.sbomify.com/CVE-2026-8884/): Cross-site scripting in Instant-Quote.co Quotation Page (medium 6.4)
- [CVE-2026-88839](https://insights.sbomify.com/CVE-2026-88839/): Busybox: busybox: passwd/group parser writes heap pointers out of bounds due to stale tokenize() endpoint (medium 6.7)
- [CVE-2026-88838](https://insights.sbomify.com/CVE-2026-88838/): Busybox: busybox: non-root mount option filter bypass allows clearing fstab security restrictions (medium 5.5)
- [CVE-2026-88837](https://insights.sbomify.com/CVE-2026-88837/): Busybox: busybox: httpd misidentifies yescrypt password hashes as plaintext, inverting authentication (medium 6.5)
- [CVE-2026-88835](https://insights.sbomify.com/CVE-2026-88835/): Memory corruption in Red Hat Hardened Images (medium 6.1)
- [CVE-2026-88834](https://insights.sbomify.com/CVE-2026-88834/): Busybox: busybox: httpd user existence oracle in non-default shadow-disabled builds (low 3.7)
- [CVE-2026-88833](https://insights.sbomify.com/CVE-2026-88833/): Busybox: busybox: udhcpc integer underflow in dhcp packet length calculation causes denial of service (medium 6.5)
- [CVE-2026-88832](https://insights.sbomify.com/CVE-2026-88832/): Busybox: busybox: romfs volume id parsing performs unbounded memcpy into fixed-size label buffer, causing heap overflow (high 7.3)
- [CVE-2026-88831](https://insights.sbomify.com/CVE-2026-88831/): Busybox: busybox: httpd silently fails open when ip deny rules contain invalid cidr prefix lengths (medium 5.3)
- [CVE-2026-88830](https://insights.sbomify.com/CVE-2026-88830/): Busybox: busybox: tls montgomery reduction allocates bytes instead of digits, causing a pre-auth heap buffer overflow (high 7.5)
- [CVE-2026-8883](https://insights.sbomify.com/CVE-2026-8883/): Cross-site scripting in Global Body Mass Index Calculator (medium 6.4)
- [CVE-2026-88829](https://insights.sbomify.com/CVE-2026-88829/): Busybox: busybox: http request smuggling via pipelined requests in httpd reverse proxy (high 7.2)
- [CVE-2026-88828](https://insights.sbomify.com/CVE-2026-88828/): Blacklist Manager for WooCommerce 1.3.0 - 2.3.1 - Blocked User Restriction Bypass via XML-RPC and Application Passwords (medium 5.4)
- [CVE-2026-88827](https://insights.sbomify.com/CVE-2026-88827/): Disable Users <= 1.0.5 - Disabled Account Authentication Bypass via XML-RPC and Application Passwords (high 8.8)
- [CVE-2026-88826](https://insights.sbomify.com/CVE-2026-88826/): SmugMug Embed <= 3.13 - Unauthenticated Stored XSS via saveSelectedAlbums (high 8.8)
- [CVE-2026-88825](https://insights.sbomify.com/CVE-2026-88825/): iGMS Direct Booking < 2.0 - Unauthenticated Stored XSS via Widget Settings (high 8.8)
- [CVE-2026-88824](https://insights.sbomify.com/CVE-2026-88824/): Master Blocks 1.4.1 - 1.4.1.4 - Unauthenticated Stored XSS via White Label Settings (high 8.8)
- [CVE-2026-8882](https://insights.sbomify.com/CVE-2026-8882/): Cross-site scripting in WP ApplicantStack Jobs Display (medium 6.4)
- [CVE-2026-88819](https://insights.sbomify.com/CVE-2026-88819/): Auth bypass in Eclipse Data Plane Core (medium 6.3)
- [CVE-2026-88817](https://insights.sbomify.com/CVE-2026-88817/): Privilege escalation via legacy access group creation endpoint (high 8.7)
- [CVE-2026-88816](https://insights.sbomify.com/CVE-2026-88816/): DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName (high 7.5)
- [CVE-2026-88815](https://insights.sbomify.com/CVE-2026-88815/): DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv (medium 6.2)
- [CVE-2026-88812](https://insights.sbomify.com/CVE-2026-88812/): X.Org Server XKB SetGeometry TextDoodad Double Free (high 7.8)
- [CVE-2026-8881](https://insights.sbomify.com/CVE-2026-8881/): CVE-2026-8881 (high 7.5)
- [CVE-2026-88808](https://insights.sbomify.com/CVE-2026-88808/): Privilege escalation in Rancher (high 8.8)
- [CVE-2026-88807](https://insights.sbomify.com/CVE-2026-88807/): libXrender RenderQueryPictFormats Reply Heap-based Buffer Overflow (high 8.9)
- [CVE-2026-88806](https://insights.sbomify.com/CVE-2026-88806/): libX11 XkbGetMap Reply Heap-based Buffer Overflow (high 7.5)
- [CVE-2026-88805](https://insights.sbomify.com/CVE-2026-88805/): Session Not Revoked Server-Side on Logout in Rancher (high 8.1)
- [CVE-2026-88804](https://insights.sbomify.com/CVE-2026-88804/): Unauthenticated update of public UI settings leading to stored cross-site scripting in Rancher (critical 9.6)
- [CVE-2026-88802](https://insights.sbomify.com/CVE-2026-88802/): MDJM Event Management and Mobile Events Manager - Unauthenticated Arbitrary Post Deletion (high 7.5)
- [CVE-2026-8880](https://insights.sbomify.com/CVE-2026-8880/): RomanCart Ecommerce <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-88798](https://insights.sbomify.com/CVE-2026-88798/): Really Simple Security (Free) < 9.8.3 - Unauthenticated Unbounded Option Growth via Spoofed Client IP Header (medium 5.3)
- [CVE-2026-88797](https://insights.sbomify.com/CVE-2026-88797/): Vayu X < 1.0.6 - Subscriber+ Arbitrary WordPress.org Plugin Installation and Activation (high 7.1)
- [CVE-2026-88795](https://insights.sbomify.com/CVE-2026-88795/): wpShopGermany IT-RECHT KANZLEI < 2.4 - Unauthenticated RCE via Predictable API Token (critical 9.0)
- [CVE-2026-88794](https://insights.sbomify.com/CVE-2026-88794/): XML External Entity injection in Sparx Enterprise Architect (high 8.2)
- [CVE-2026-88793](https://insights.sbomify.com/CVE-2026-88793/): YouTube Embed 10.0 - 10.3 - Unauthenticated Stored XSS via youram_server (high 8.8)
- [CVE-2026-88792](https://insights.sbomify.com/CVE-2026-88792/): Dictionary <= 1.0 - Unauthenticated Stored XSS via Direct Dictionary Update (high 8.8)
- [CVE-2026-88791](https://insights.sbomify.com/CVE-2026-88791/): Safe Redirect Manager < 2.3.0 - Open Redirect via Wildcard Redirect Rules (low 3.4)
- [CVE-2026-88790](https://insights.sbomify.com/CVE-2026-88790/): proma-ai Proma File Preview Service file-preview-service.ts resolveTargetPath path traversal (low 2.4)
- [CVE-2026-8879](https://insights.sbomify.com/CVE-2026-8879/): CVE-2026-8879 (high 7.5)
- [CVE-2026-88789](https://insights.sbomify.com/CVE-2026-88789/): Apache Camel Quarkus: Camel Quarkus: Forced Xalan TransformerFactory drops upstream external-DTD/stylesheet hardening (high 8.6)
- [CVE-2026-88788](https://insights.sbomify.com/CVE-2026-88788/): Text Styler <= 1.1.1 - Contributor+ Stored XSS (medium 6.8)
- [CVE-2026-88785](https://insights.sbomify.com/CVE-2026-88785/): Simple Membership < 4.8.3 - Newly Registered Member Password Disclosure via URL Query String (medium 4.7)
- [CVE-2026-88784](https://insights.sbomify.com/CVE-2026-88784/): Weglot < 6.4.3 - Unauthenticated Stored XSS via Translated Page Link Rewriting (high 7.5)
- [CVE-2026-88783](https://insights.sbomify.com/CVE-2026-88783/): Kubio AI Page Builder < 2.9.3 - Unauthenticated Stored XSS via Comment Content (high 8.8)
- [CVE-2026-88782](https://insights.sbomify.com/CVE-2026-88782/): Kubio AI Page Builder < 2.9.3 - Contributor+ Stored XSS via Image Gallery Item URL Attribute (medium 6.8)
- [CVE-2026-88781](https://insights.sbomify.com/CVE-2026-88781/): Memory corruption in motherboards firmware (medium 6.8)
- [CVE-2026-8878](https://insights.sbomify.com/CVE-2026-8878/): CVE-2026-8878 (high 7.5)
- [CVE-2026-88779](https://insights.sbomify.com/CVE-2026-88779/): Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer (high 8.7, exploited in the wild)
- [CVE-2026-88778](https://insights.sbomify.com/CVE-2026-88778/): TCP Initial Sequence Number (ISN) prediction (high 8.8)
- [CVE-2026-88777](https://insights.sbomify.com/CVE-2026-88777/): Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service (high 8.8)
- [CVE-2026-88776](https://insights.sbomify.com/CVE-2026-88776/): Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service (high 8.8)
- [CVE-2026-88775](https://insights.sbomify.com/CVE-2026-88775/): Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service (high 8.8)
- [CVE-2026-88774](https://insights.sbomify.com/CVE-2026-88774/): Feature policy bypass due to improper HTTP URL based expression usage (high 7.0)
- [CVE-2026-88773](https://insights.sbomify.com/CVE-2026-88773/): HTTP Request Smuggling (critical 9.3)
- [CVE-2026-88772](https://insights.sbomify.com/CVE-2026-88772/): Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer (critical 9.5, exploited in the wild)
- [CVE-2026-88771](https://insights.sbomify.com/CVE-2026-88771/): Citrix NetScaler Improper Input Validation (critical 9.5, exploited in the wild)
- [CVE-2026-88770](https://insights.sbomify.com/CVE-2026-88770/): Keycloak-services: keycloak-services: device authorization grant issues tokens to brute-force-locked accounts (medium 6.5)
- [CVE-2026-8877](https://insights.sbomify.com/CVE-2026-8877/): Responsive Video Embedder <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-88765](https://insights.sbomify.com/CVE-2026-88765/): Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab (high 8.5)
- [CVE-2026-88764](https://insights.sbomify.com/CVE-2026-88764/): Simple Membership < 4.7.8 - Subscriber+ Membership Level Escalation via PayPal Standard subsc_ref (medium 5.4)
- [CVE-2026-88763](https://insights.sbomify.com/CVE-2026-88763/): Skupper-router: skupper-router: unbounded recursion in amqp field parser leads to denial of service (medium 5.9)
- [CVE-2026-88761](https://insights.sbomify.com/CVE-2026-88761/): Botslab G980H Dashcams Use of Weak Credentials (medium 6.0)
- [CVE-2026-8876](https://insights.sbomify.com/CVE-2026-8876/): CVE-2026-8876 (high 7.3)
- [CVE-2026-88756](https://insights.sbomify.com/CVE-2026-88756/): Pagekit CMS <= 1.0.18 allows an unauthenticated attacker to perform SQL injection through the credentials array submitted to the public logi (medium 5.3)
- [CVE-2026-88755](https://insights.sbomify.com/CVE-2026-88755/): Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace conf (high 7.8)
- [CVE-2026-88753](https://insights.sbomify.com/CVE-2026-88753/): A Regular-Expression Denial of Service (ReDoS) in the Markdown2. (high 7.5)
- [CVE-2026-8875](https://insights.sbomify.com/CVE-2026-8875/): Cross-site scripting in Easy Prism Syntax Highlighter (medium 6.4)
- [CVE-2026-88746](https://insights.sbomify.com/CVE-2026-88746/): idccms V1.70 is vulnerable to Cross Site Scripting (XSS) in /admin/makeDiy_deal.php. (high 7.1)
- [CVE-2026-88745](https://insights.sbomify.com/CVE-2026-88745/): EMLOG-Pro 2.6.29 contains a XSS vulnerability that enables attackers to upload a malicious shell. (medium 6.1)
- [CVE-2026-88743](https://insights.sbomify.com/CVE-2026-88743/): Bacularis 4.7.0 - 6.5.0 is vulnerable to Stored cross-site scripting (XSS) in director tags. (medium 6.1)
- [CVE-2026-88742](https://insights.sbomify.com/CVE-2026-88742/): Bacularis 1.0.0 - 6.5.0 is vulnerable to Stored cross-site scripting (XSS) in the client address field. (medium 5.4)
- [CVE-2026-8874](https://insights.sbomify.com/CVE-2026-8874/): CVE-2026-8874 (high 7.1)
- [CVE-2026-88738](https://insights.sbomify.com/CVE-2026-88738/): Jazzware RT1000 Edge webUI v. (high 8.8)
- [CVE-2026-8873](https://insights.sbomify.com/CVE-2026-8873/): Content Slideshow <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-8872](https://insights.sbomify.com/CVE-2026-8872/): Animate Your Content <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-8871](https://insights.sbomify.com/CVE-2026-8871/): Formidable Kinetic <= 1.1.01 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-8870](https://insights.sbomify.com/CVE-2026-8870/): Team Master <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-8869](https://insights.sbomify.com/CVE-2026-8869/): Mutual Funds Data <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute (medium 6.4)
- [CVE-2026-8868](https://insights.sbomify.com/CVE-2026-8868/): Single Mailchimp <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-8867](https://insights.sbomify.com/CVE-2026-8867/): Post Categories Gallery <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-8866](https://insights.sbomify.com/CVE-2026-8866/): jQuery googleslides <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-8865](https://insights.sbomify.com/CVE-2026-8865/): Cross-site scripting in Avalon23 Products Filter for WooCommerce (medium 6.4)
- [CVE-2026-88648](https://insights.sbomify.com/CVE-2026-88648/): Incomplete X.509 implementation in GnuTLS v3.8.13 allows attackers controlling a subordinate Certificate Authority to bypass cross-domain PK (low 3.7)
- [CVE-2026-88647](https://insights.sbomify.com/CVE-2026-88647/): A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent the Common Name fallback mechanism and eavesdrop on communic (medium 6.5)
- [CVE-2026-8864](https://insights.sbomify.com/CVE-2026-8864/): HP Fan Control App – Potential Escalation of Privilege (high 7.3)
- [CVE-2026-8863](https://insights.sbomify.com/CVE-2026-8863/): CVE-2026-8863 (high 7.8)
- [CVE-2026-88624](https://insights.sbomify.com/CVE-2026-88624/): Missing path validation in the Worktree.remove component of openCode v1.18.26 allows attackers to execute arbitrary recursive directory dele (critical 9.1)
- [CVE-2026-88623](https://insights.sbomify.com/CVE-2026-88623/): NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read. (high 7.5)
- [CVE-2026-88622](https://insights.sbomify.com/CVE-2026-88622/): NUUO Network Video Recorder 2.0.0 is vulnerable to Command Injection in handle_import_privilege.php. (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/280/