# Vulnerabilities published in 2026


- [CVE-2026-8794](https://insights.sbomify.com/CVE-2026-8794/): PaperCut NG/MF: User enumeration via timing attack (medium 6.9)
- [CVE-2026-87939](https://insights.sbomify.com/CVE-2026-87939/): Feed Block - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-137 (medium 4.2)
- [CVE-2026-87938](https://insights.sbomify.com/CVE-2026-87938/): CSP log - Critical - SQL Injection - SA-CONTRIB-2026-136 (not scored)
- [CVE-2026-87937](https://insights.sbomify.com/CVE-2026-87937/): Central Authentication System (CAS) Server - Moderately critical - Open redirect - SA-CONTRIB-2026-135 (medium 6.5)
- [CVE-2026-87936](https://insights.sbomify.com/CVE-2026-87936/): amazee.ai Private AI Provider - Critical - SQL injection - SA-CONTRIB-2026-134 (medium 6.5)
- [CVE-2026-87935](https://insights.sbomify.com/CVE-2026-87935/): Paid Downloads <= 3.15 - Unauthenticated Arbitrary File Upload via 'paiddownloads_update_file' Action (high 8.1)
- [CVE-2026-87933](https://insights.sbomify.com/CVE-2026-87933/): DaveGamble cJSON cJSON_Utils.c cJSONUtils_MergePatch use after free (medium 6.9)
- [CVE-2026-87931](https://insights.sbomify.com/CVE-2026-87931/): Memory corruption in Pavlok Behavioral Conditioning Wearable (critical 9.4)
- [CVE-2026-87930](https://insights.sbomify.com/CVE-2026-87930/): MaxSite CMS through 109.6 PHP Object Injection via ci_session (critical 9.2)
- [CVE-2026-8793](https://insights.sbomify.com/CVE-2026-8793/): PaperCut NG/MF: Insufficient brute-force protection (medium 6.9)
- [CVE-2026-87929](https://insights.sbomify.com/CVE-2026-87929/): MaxSite CMS through 109.6 Authentication Bypass via Hardcoded Encryption Key (critical 9.3)
- [CVE-2026-87928](https://insights.sbomify.com/CVE-2026-87928/): MaxSite CMS 0.94 through 109.6 HTML Upload XSS via admin_page (medium 5.1)
- [CVE-2026-87927](https://insights.sbomify.com/CVE-2026-87927/): MaxSite CMS through 109.6 Local File Inclusion via ajax dispatcher (high 8.8)
- [CVE-2026-87926](https://insights.sbomify.com/CVE-2026-87926/): Rizwan17 inventory-management-system Login Page index.php cross site scripting (medium 5.3)
- [CVE-2026-87925](https://insights.sbomify.com/CVE-2026-87925/): Rizwan17 inventory-management-system manage.php storeCustomerOrderInvoice sql injection (medium 6.9)
- [CVE-2026-87924](https://insights.sbomify.com/CVE-2026-87924/): Rizwan17 inventory-management-system Invoice Generation invoice_bill.php missing authentication (medium 6.9)
- [CVE-2026-87923](https://insights.sbomify.com/CVE-2026-87923/): Rizwan17 inventory-management-system List DBOperation.php cross site scripting (medium 5.3)
- [CVE-2026-87922](https://insights.sbomify.com/CVE-2026-87922/): Rizwan17 inventory-management-system AJAX Backend process.php DBOperation.addCategory missing authentication (medium 6.9)
- [CVE-2026-87921](https://insights.sbomify.com/CVE-2026-87921/): Rizwan17 inventory-management-system manage.php update_record sql injection (medium 6.9)
- [CVE-2026-87920](https://insights.sbomify.com/CVE-2026-87920/): W3 Total Cache <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content (high 7.2)
- [CVE-2026-87919](https://insights.sbomify.com/CVE-2026-87919/): Product XML Feed Manager for WooCommerce < 3.1.1 - Contributor+ Arbitrary Product Deletion via Shortcode (medium 4.9)
- [CVE-2026-87918](https://insights.sbomify.com/CVE-2026-87918/): WPBot < 8.5.7 - Unauthenticated AI Provider API Abuse via Multiple AJAX Actions (medium 5.3)
- [CVE-2026-87917](https://insights.sbomify.com/CVE-2026-87917/): MC4WP: Mailchimp for WordPress <= 4.14.0 - Reflected Cross-Site Scripting via 'data' Dynamic Content Tag (medium 6.1)
- [CVE-2026-87916](https://insights.sbomify.com/CVE-2026-87916/): WPBot 8.4.9 - 8.5.9 - Unauthenticated Chat Visitor PII Disclosure (medium 5.3)
- [CVE-2026-87915](https://insights.sbomify.com/CVE-2026-87915/): Popup Maker <= 1.24.0 - Unauthenticated Stored Cross-Site Scripting via values[Name] Parameter (high 7.2)
- [CVE-2026-87913](https://insights.sbomify.com/CVE-2026-87913/): Missing S3 bucket ownership verification in the AWS Security Agent MCP server (medium 5.1)
- [CVE-2026-87912](https://insights.sbomify.com/CVE-2026-87912/): Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops (medium 5.1)
- [CVE-2026-87911](https://insights.sbomify.com/CVE-2026-87911/): Command injection in AWS Labs postgres MCP Server (critical 9.0)
- [CVE-2026-87910](https://insights.sbomify.com/CVE-2026-87910/): tarfile hardlink fallback ignores custom extraction filter rejection via None (medium 5.7)
- [CVE-2026-8791](https://insights.sbomify.com/CVE-2026-8791/): Booking System Trafft <= 1.0.17 - Authenticated (Subscriber+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2026-87909](https://insights.sbomify.com/CVE-2026-87909/): Command injection in WP Photo Album Plus (high 7.5)
- [CVE-2026-87908](https://insights.sbomify.com/CVE-2026-87908/): multiparty vulnerable to Denial of Service via unbounded part-header accumulation (high 7.5)
- [CVE-2026-87907](https://insights.sbomify.com/CVE-2026-87907/): Rox Appointment Booking < 1.2.8 - Unauthenticated Internal Notes Disclosure via Service and Category REST Routes (medium 5.3)
- [CVE-2026-87902](https://insights.sbomify.com/CVE-2026-87902/): WordPress Core Remote File Inclusion (high 8.1, exploited in the wild)
- [CVE-2026-87901](https://insights.sbomify.com/CVE-2026-87901/): Cross-site scripting in phpBB (high 8.3)
- [CVE-2026-87900](https://insights.sbomify.com/CVE-2026-87900/): Command injection in WP Toolkit for cPanel (critical 9.4)
- [CVE-2026-8790](https://insights.sbomify.com/CVE-2026-8790/): Football Pool <= 2.13.4 - Authenticated (Subscriber+) Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2026-87899](https://insights.sbomify.com/CVE-2026-87899/): Privilege escalation in cPanel (critical 9.4)
- [CVE-2026-87898](https://insights.sbomify.com/CVE-2026-87898/): Command injection in Plesk extension "Site Import" (critical 9.4)
- [CVE-2026-87897](https://insights.sbomify.com/CVE-2026-87897/): Server-side request forgery in whiteboard (medium 4.6)
- [CVE-2026-87896](https://insights.sbomify.com/CVE-2026-87896/): Rox Appointment Booking < 1.2.8 - Unauthenticated Staff PII Disclosure via Agent REST Route (medium 5.3)
- [CVE-2026-87894](https://insights.sbomify.com/CVE-2026-87894/): Rox Appointment Booking 1.0.9 - 1.2.2 - Unauthenticated Customer PII Disclosure via IDOR (medium 5.3)
- [CVE-2026-87892](https://insights.sbomify.com/CVE-2026-87892/): Rox Appointment Booking < 1.2.0 - Unauthenticated Price Manipulation and Payment Method Restriction Bypass (medium 5.3)
- [CVE-2026-87891](https://insights.sbomify.com/CVE-2026-87891/): Rox Appointment Booking < 1.2.0 - Unauthenticated Holiday Schedule Modification via REST API (medium 6.5)
- [CVE-2026-87890](https://insights.sbomify.com/CVE-2026-87890/): Potential request forgery via spatial lookup byte values (medium 6.9)
- [CVE-2026-8789](https://insights.sbomify.com/CVE-2026-8789/): Easy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Arbitrary Connection Deletion (high 8.1)
- [CVE-2026-87888](https://insights.sbomify.com/CVE-2026-87888/): YayPricing < 3.5.7 - Subscriber+ Stored XSS via save_page_data REST Route (high 8.0)
- [CVE-2026-87886](https://insights.sbomify.com/CVE-2026-87886/): Acronis Backup Incorrect Default Permissions (high 7.8, exploited in the wild)
- [CVE-2026-87880](https://insights.sbomify.com/CVE-2026-87880/): Security feature bypass in Acronis Cyber Protect 17 (medium 6.8)
- [CVE-2026-8788](https://insights.sbomify.com/CVE-2026-8788/): Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections (high 7.3)
- [CVE-2026-87879](https://insights.sbomify.com/CVE-2026-87879/): Security feature bypass in Acronis Cyber Protect 17 (medium 5.9)
- [CVE-2026-87878](https://insights.sbomify.com/CVE-2026-87878/): Misconfiguration in Acronis Cyber Protect 17 (medium 6.3)
- [CVE-2026-87877](https://insights.sbomify.com/CVE-2026-87877/): zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close() (high 7.0)
- [CVE-2026-87876](https://insights.sbomify.com/CVE-2026-87876/): Auth bypass in Red Hat Enterprise Linux 10 (low 3.0)
- [CVE-2026-87875](https://insights.sbomify.com/CVE-2026-87875/): Cups: openprinting cups: heap out-of-bounds read in cupsutf32toutf8() via missing source-length bound (medium 4.3)
- [CVE-2026-87874](https://insights.sbomify.com/CVE-2026-87874/): Deserialization in Red Hat Ceph Storage 5 (high 8.1)
- [CVE-2026-87872](https://insights.sbomify.com/CVE-2026-87872/): Weak cryptography in Red Hat Ceph Storage 5 (medium 6.8)
- [CVE-2026-87870](https://insights.sbomify.com/CVE-2026-87870/): Cross-site scripting in Ninja Forms - Scheduled Exports (medium 6.4)
- [CVE-2026-8787](https://insights.sbomify.com/CVE-2026-8787/): Firebase Support & Chat Management <= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation (high 8.8)
- [CVE-2026-87869](https://insights.sbomify.com/CVE-2026-87869/): Cross-site scripting in Filter Everything — WordPress & WooCommerce Filters (medium 6.1)
- [CVE-2026-87866](https://insights.sbomify.com/CVE-2026-87866/): wolfSSL public-key pinning bypass (critical 9.1)
- [CVE-2026-87865](https://insights.sbomify.com/CVE-2026-87865/): knownhost callback mismatches key as missing (not scored)
- [CVE-2026-87864](https://insights.sbomify.com/CVE-2026-87864/): IMAP APPEND plus CRLF conversion command injection (not scored)
- [CVE-2026-87863](https://insights.sbomify.com/CVE-2026-87863/): HSTS response erases persisted entries (not scored)
- [CVE-2026-87862](https://insights.sbomify.com/CVE-2026-87862/): HSTS cache import drops longer-lived child (not scored)
- [CVE-2026-87861](https://insights.sbomify.com/CVE-2026-87861/): cross-origin reuse of a Negotiate connection (not scored)
- [CVE-2026-87860](https://insights.sbomify.com/CVE-2026-87860/): Subscriptions for WooCommerce < 2.0.3 - Subscription Cancellation via CSRF (medium 4.3)
- [CVE-2026-8786](https://insights.sbomify.com/CVE-2026-8786/): Tencent WeKnora Config API Endpoint initialization.go getKnowledgeBaseForInitialization authorization (medium 5.3)
- [CVE-2026-87859](https://insights.sbomify.com/CVE-2026-87859/): morgan vulnerable to Log Injection via unescaped double quote in quoted log fields (medium 5.3)
- [CVE-2026-87858](https://insights.sbomify.com/CVE-2026-87858/): Missing authorization in Temporal Server (high 7.2)
- [CVE-2026-87855](https://insights.sbomify.com/CVE-2026-87855/): JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated Arbitrary File Upload via 'image.push' Method (critical 9.8)
- [CVE-2026-87854](https://insights.sbomify.com/CVE-2026-87854/): Subscriptions for WooCommerce < 2.0.3 - Unauthenticated Subscription Data Disclosure via REST API Secret Key Bypass (medium 5.3)
- [CVE-2026-87853](https://insights.sbomify.com/CVE-2026-87853/): Sssd: sssd: idp authentication prefix comparison allows cross-user impersonation (high 7.5)
- [CVE-2026-8785](https://insights.sbomify.com/CVE-2026-8785/): projectworlds hospital-management-system-in-php GET Parameter update_info.php getAllPatientDetail sql injection (medium 6.9)
- [CVE-2026-87849](https://insights.sbomify.com/CVE-2026-87849/): Apache bRPC: Out-of-bounds read via non-object fields in Discovery naming-service reply parsing (medium 4.3)
- [CVE-2026-87848](https://insights.sbomify.com/CVE-2026-87848/): MPCX Lightbox 1.2.2 - 1.2.5 - Unauthenticated Non-Public Post Content Disclosure (low 3.7)
- [CVE-2026-87846](https://insights.sbomify.com/CVE-2026-87846/): Shipping for Nova Poshta 1.18.7 - 1.19.8 - Unauthenticated Order Shipment Record Deletion (medium 5.3)
- [CVE-2026-87844](https://insights.sbomify.com/CVE-2026-87844/): Product Designer <= 1.0.40 - Unauthenticated Design Template Data Injection (medium 5.3)
- [CVE-2026-87843](https://insights.sbomify.com/CVE-2026-87843/): Trust Payments Gateway for WooCommerce < 3.1.0 - Unauthenticated Order Payment Completion via Payment Return Page (medium 6.5)
- [CVE-2026-87842](https://insights.sbomify.com/CVE-2026-87842/): Zonify < 1.0.5 - Unauthenticated Account Login Token Disclosure (high 7.5)
- [CVE-2026-87841](https://insights.sbomify.com/CVE-2026-87841/): UnitechPay <= 1.0.6.3 - Unauthenticated Order Payment Bypass via Unsigned Webhook (medium 5.3)
- [CVE-2026-87840](https://insights.sbomify.com/CVE-2026-87840/): Tripzzy < 1.5.1 - Unauthenticated Booking Data Tampering (medium 5.3)
- [CVE-2026-8784](https://insights.sbomify.com/CVE-2026-8784/): npitre cramfs-tools cramfsck.c change_file_status symlink (medium 4.6)
- [CVE-2026-87839](https://insights.sbomify.com/CVE-2026-87839/): Tripzzy < 1.5.1 - Unauthenticated Arbitrary Comment Deletion (high 7.5)
- [CVE-2026-87838](https://insights.sbomify.com/CVE-2026-87838/): Wava Payment 0.3.1 - 0.3.9 - Unauthenticated Merchant Credential Overwrite via Install Webhook (medium 6.5)
- [CVE-2026-87837](https://insights.sbomify.com/CVE-2026-87837/): Wava Payment 0.3.1 - 0.3.9 - Unauthenticated Order Status Change via Payment Webhook (medium 5.3)
- [CVE-2026-87836](https://insights.sbomify.com/CVE-2026-87836/): Comments Import & Export 2.1.11 - 2.5.3 - Author+ Comment PII Disclosure via Export (low 2.7)
- [CVE-2026-87835](https://insights.sbomify.com/CVE-2026-87835/): Front End Users <= 3.2.35 - Unauthenticated Membership Level and Account Status Self-Assignment (medium 6.5)
- [CVE-2026-87831](https://insights.sbomify.com/CVE-2026-87831/): Checkout Field Manager < 7.9.7 - Subscriber+ Arbitrary Attachment Deletion via Customer Address Custom Field (medium 4.3)
- [CVE-2026-87830](https://insights.sbomify.com/CVE-2026-87830/): Apache WSS4J: Streaming WS-SecurityPolicy validation may skip element-protection checks. (critical 9.1)
- [CVE-2026-8783](https://insights.sbomify.com/CVE-2026-8783/): omec-project amf dispatcher.go UERadioCapabilityCheckResponse null pointer dereference (medium 5.3)
- [CVE-2026-87829](https://insights.sbomify.com/CVE-2026-87829/): Checkout Field Manager < 7.9.7 - Subscriber+ Arbitrary Attachment Deletion via Unvalidated Attachment ID Reparenting (medium 4.3)
- [CVE-2026-87828](https://insights.sbomify.com/CVE-2026-87828/): Seraphinite Accelerator < 2.29.24 - Subscriber+ DoS via seraph_accel_State Update (medium 5.7)
- [CVE-2026-87827](https://insights.sbomify.com/CVE-2026-87827/): KGUARD DVR unauthenticated remote command execution vulnerability (critical 10.0)
- [CVE-2026-87825](https://insights.sbomify.com/CVE-2026-87825/): zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free of Compression and Decompression Dictionaries (high 7.0)
- [CVE-2026-87824](https://insights.sbomify.com/CVE-2026-87824/): zstd-jni 1.3.3-1 through 1.5.7-13 Out-of-Bounds Read via Zstd.trainFromBufferDirect (high 8.7)
- [CVE-2026-87823](https://insights.sbomify.com/CVE-2026-87823/): zstd-jni 1.1.1 through 1.5.7-13 Out-of-Bounds Read via Direct ByteBuffer Frame-Size Methods (high 8.8)
- [CVE-2026-87822](https://insights.sbomify.com/CVE-2026-87822/): t-digest 3.1 through 3.3 Denial of Service via NaN Centroid Means in MergingDigest.fromBytes (high 8.7)
- [CVE-2026-87821](https://insights.sbomify.com/CVE-2026-87821/): Lara Dashboard 0.9.2 through 1.3.1 Server-Side Request Forgery in Builder Markdown Fetch (high 7.1)
- [CVE-2026-87820](https://insights.sbomify.com/CVE-2026-87820/): CyberPanel 2.4.3 through 2.4.5 Information Disclosure via AI Scanner (medium 6.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/285/