# Vulnerabilities published in 2026


- [CVE-2026-86900](https://insights.sbomify.com/CVE-2026-86900/): Memory corruption in macOS (medium 6.5)
- [CVE-2026-8690](https://insights.sbomify.com/CVE-2026-8690/): Missing authorization in RentMy Real-Time Rental Management Plugin (medium 5.3)
- [CVE-2026-86898](https://insights.sbomify.com/CVE-2026-86898/): Cross-site scripting in Safari (medium 5.4)
- [CVE-2026-86897](https://insights.sbomify.com/CVE-2026-86897/): Missing authorization in Safari (medium 5.5)
- [CVE-2026-86896](https://insights.sbomify.com/CVE-2026-86896/): Privilege escalation in macOS (not scored)
- [CVE-2026-86895](https://insights.sbomify.com/CVE-2026-86895/): Information disclosure in iOS and iPadOS (high 7.5)
- [CVE-2026-86894](https://insights.sbomify.com/CVE-2026-86894/): Security feature bypass in macOS (high 7.5)
- [CVE-2026-86893](https://insights.sbomify.com/CVE-2026-86893/): Information disclosure in iOS and iPadOS (low 3.3)
- [CVE-2026-86892](https://insights.sbomify.com/CVE-2026-86892/): Denial of service in iOS and iPadOS (medium 5.5)
- [CVE-2026-86891](https://insights.sbomify.com/CVE-2026-86891/): Missing authorization in macOS (low 3.5)
- [CVE-2026-86890](https://insights.sbomify.com/CVE-2026-86890/): Auth bypass in iOS and iPadOS (medium 4.6)
- [CVE-2026-8689](https://insights.sbomify.com/CVE-2026-8689/): Missing authorization in Visualizer: Tables and Charts Manager for WordPress (medium 4.3)
- [CVE-2026-86889](https://insights.sbomify.com/CVE-2026-86889/): Security feature bypass in macOS (medium 4.8)
- [CVE-2026-86888](https://insights.sbomify.com/CVE-2026-86888/): Information disclosure in iOS and iPadOS (low 3.3)
- [CVE-2026-86887](https://insights.sbomify.com/CVE-2026-86887/): Security feature bypass in iOS and iPadOS (low 3.3)
- [CVE-2026-86886](https://insights.sbomify.com/CVE-2026-86886/): Path traversal in iOS and iPadOS (medium 5.5)
- [CVE-2026-86885](https://insights.sbomify.com/CVE-2026-86885/): Denial of service in iOS and iPadOS (medium 6.5)
- [CVE-2026-86884](https://insights.sbomify.com/CVE-2026-86884/): Privilege escalation in iOS and iPadOS (medium 5.5)
- [CVE-2026-86883](https://insights.sbomify.com/CVE-2026-86883/): Information disclosure in iOS and iPadOS (medium 5.5)
- [CVE-2026-86882](https://insights.sbomify.com/CVE-2026-86882/): Memory corruption in iOS and iPadOS (medium 6.5)
- [CVE-2026-86881](https://insights.sbomify.com/CVE-2026-86881/): Security feature bypass in iOS and iPadOS (critical 9.1)
- [CVE-2026-86880](https://insights.sbomify.com/CVE-2026-86880/): Missing authorization in iOS and iPadOS (not scored)
- [CVE-2026-8688](https://insights.sbomify.com/CVE-2026-8688/): Missing authorization in Advance Nav Menu Manager (medium 4.3)
- [CVE-2026-86879](https://insights.sbomify.com/CVE-2026-86879/): Denial of service in iOS and iPadOS (medium 6.5)
- [CVE-2026-86878](https://insights.sbomify.com/CVE-2026-86878/): Information disclosure in iOS and iPadOS (medium 5.5)
- [CVE-2026-86877](https://insights.sbomify.com/CVE-2026-86877/): Path traversal in macOS (not scored)
- [CVE-2026-86876](https://insights.sbomify.com/CVE-2026-86876/): Memory corruption in iOS and iPadOS (medium 5.2)
- [CVE-2026-86875](https://insights.sbomify.com/CVE-2026-86875/): Denial of service in Xcode (medium 4.3)
- [CVE-2026-86874](https://insights.sbomify.com/CVE-2026-86874/): Memory corruption in Xcode (low 3.3)
- [CVE-2026-86872](https://insights.sbomify.com/CVE-2026-86872/): Business logic in Safari (medium 5.4)
- [CVE-2026-86871](https://insights.sbomify.com/CVE-2026-86871/): Integer overflow in macOS (medium 5.9)
- [CVE-2026-86870](https://insights.sbomify.com/CVE-2026-86870/): Memory corruption in iOS and iPadOS (medium 6.5)
- [CVE-2026-86869](https://insights.sbomify.com/CVE-2026-86869/): Memory corruption in iOS and iPadOS (medium 6.5)
- [CVE-2026-86868](https://insights.sbomify.com/CVE-2026-86868/): Auth bypass in macOS (critical 9.1)
- [CVE-2026-86867](https://insights.sbomify.com/CVE-2026-86867/): Cinnamon's kotaemon contains improper authorization checks in multi‑user chat handlers (medium 6.5)
- [CVE-2026-86865](https://insights.sbomify.com/CVE-2026-86865/): Tanium addressed a SQL injection vulnerability in Asset. (high 7.2)
- [CVE-2026-86864](https://insights.sbomify.com/CVE-2026-86864/): pgAdmin 4: Argument and connection-string injection via the database field in the Backup tool (high 8.7)
- [CVE-2026-86863](https://insights.sbomify.com/CVE-2026-86863/): pgAdmin 4: Authentication bypass via a client-controlled identity header in Webserver authentication mode (critical 9.3)
- [CVE-2026-86862](https://insights.sbomify.com/CVE-2026-86862/): pgAdmin 4: Connection-string injection via the database field in the Restore and Maintenance tools (high 7.1)
- [CVE-2026-86861](https://insights.sbomify.com/CVE-2026-86861/): pgAdmin 4: File Manager save_file writes through a symbolic link planted after the containment check (medium 6.0)
- [CVE-2026-86860](https://insights.sbomify.com/CVE-2026-86860/): Unauthenticated Sensitive Data Disclosure in ServiceNow AI Platform (critical 9.3)
- [CVE-2026-8686](https://insights.sbomify.com/CVE-2026-8686/): DoS from MQTT v5.0 Deserialization Fault in core MQTT (high 8.7)
- [CVE-2026-86859](https://insights.sbomify.com/CVE-2026-86859/): Unauthenticated Arbitrary Record Disclosure in ServiceNow AI Platform (high 8.7)
- [CVE-2026-86858](https://insights.sbomify.com/CVE-2026-86858/): Unauthenticated Privilege Escalation via GraphQL in ServiceNow AI Platform (high 8.7)
- [CVE-2026-86857](https://insights.sbomify.com/CVE-2026-86857/): Authorization Bypass in ServiceNow AI Platform (high 8.4)
- [CVE-2026-86856](https://insights.sbomify.com/CVE-2026-86856/): Dpdk: dpdk: stack and heap buffer overflow in nfp vdpa driver (medium 6.5)
- [CVE-2026-86853](https://insights.sbomify.com/CVE-2026-86853/): Repeated external URL scheme launches could potentially cause a denial of service in Firefox for iOS (medium 4.3)
- [CVE-2026-86851](https://insights.sbomify.com/CVE-2026-86851/): Livees Checkout 6.8 - 7.0.2 - Unauthenticated Order Status Change, Order Note Injection & Order Key Disclosure (medium 6.5)
- [CVE-2026-86850](https://insights.sbomify.com/CVE-2026-86850/): SKU Error Fixer for WooCommerce <= 1.0 - Unauthenticated Orphaned Product Variation Deletion (medium 6.5)
- [CVE-2026-8685](https://insights.sbomify.com/CVE-2026-8685/): Infility Global <= 2.15.16 - Authenticated (Subscriber+) SQL Injection via 'orderby' Parameter (medium 6.5)
- [CVE-2026-86849](https://insights.sbomify.com/CVE-2026-86849/): Dpdk: dpdk: integer overflow combined with missing validation leads to host buffer overflow in vhost-crypto (medium 6.5)
- [CVE-2026-86848](https://insights.sbomify.com/CVE-2026-86848/): Dpdk: dpdk: time-of-check/time-of-use vulnerability allowing guest-triggered out-of-bounds write in vhost-crypto (high 8.8)
- [CVE-2026-86847](https://insights.sbomify.com/CVE-2026-86847/): Dpdk: dpdk: guest can trigger infinite loop in vhost-crypto writeback chain cleanup (medium 6.5)
- [CVE-2026-86846](https://insights.sbomify.com/CVE-2026-86846/): Dpdk: dpdk: guest can trigger out-of-bounds write by controlling avail ring index in vhost-crypto (medium 6.5)
- [CVE-2026-86845](https://insights.sbomify.com/CVE-2026-86845/): Dpdk: dpdk: guest-triggered use-after-free and type confusion in vhost-crypto session cleanup (medium 6.5)
- [CVE-2026-86843](https://insights.sbomify.com/CVE-2026-86843/): Apache Airflow Teradata provider: SQL injection via unvalidated Dag Params in the compute-cluster example Dag (medium 6.3)
- [CVE-2026-86842](https://insights.sbomify.com/CVE-2026-86842/): Real3D Flipbook Lite < 5.4 - Author+ Content Deletion and Stored XSS via Global Settings Overwrite (medium 6.8)
- [CVE-2026-86841](https://insights.sbomify.com/CVE-2026-86841/): Bookly 23.2 - 28.2 - Bookly Administrator+ PHP Object Injection via Diagnostics Advanced Options (medium 4.7)
- [CVE-2026-86840](https://insights.sbomify.com/CVE-2026-86840/): Bifrost Unauthorized Channel Commission Attribution Allows Commission Diversion (critical 9.1)
- [CVE-2026-8684](https://insights.sbomify.com/CVE-2026-8684/): Missing authorization in MotoPress Hotel Booking (medium 5.3)
- [CVE-2026-86839](https://insights.sbomify.com/CVE-2026-86839/): Bookly < 28.3 - Staff+ Appointment and Payment Disclosure, Modification and Deletion via IDOR (low 3.8)
- [CVE-2026-86838](https://insights.sbomify.com/CVE-2026-86838/): Bookly < 28.3 - Unauthenticated Payment Bypass via Booking Price Manipulation (medium 5.3)
- [CVE-2026-86837](https://insights.sbomify.com/CVE-2026-86837/): Bookly < 28.3 - Unauthenticated Customer PII Update via Verification Bypass (medium 5.3)
- [CVE-2026-86836](https://insights.sbomify.com/CVE-2026-86836/): Race condition in Eclipse Ankaios (high 8.4)
- [CVE-2026-86834](https://insights.sbomify.com/CVE-2026-86834/): MetForm 2.2.1 - 4.3.0 - Unauthenticated Debug File Disclosure via HubSpot Forms Integration (low 3.7)
- [CVE-2026-86833](https://insights.sbomify.com/CVE-2026-86833/): MetForm < 4.3.1 - Unauthenticated HTML Injection in Notification Emails via Field Shortcodes (medium 5.4)
- [CVE-2026-86832](https://insights.sbomify.com/CVE-2026-86832/): MetForm < 4.3.1 - Unauthenticated Form Entry Data Disclosure via REST API (medium 5.3)
- [CVE-2026-86831](https://insights.sbomify.com/CVE-2026-86831/): Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS (high 8.7)
- [CVE-2026-86830](https://insights.sbomify.com/CVE-2026-86830/): Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center (high 8.6)
- [CVE-2026-8683](https://insights.sbomify.com/CVE-2026-8683/): Overly long URLs crash the Mattermost Desktop App (medium 6.5)
- [CVE-2026-86828](https://insights.sbomify.com/CVE-2026-86828/): BackWPup < 5.7.7 - Admin+ Path Traversal to RCE via Restore PclZip Fallback (medium 6.6)
- [CVE-2026-86827](https://insights.sbomify.com/CVE-2026-86827/): BackWPup 3.3 - 5.7.6 - Unauthenticated Backup Job Execution via wp-cron.php (medium 5.3)
- [CVE-2026-86826](https://insights.sbomify.com/CVE-2026-86826/): BackWPup < 5.7.7 - Unauthenticated Sensitive Data Disclosure via Restore Working Directory on NGINX (medium 5.9)
- [CVE-2026-86824](https://insights.sbomify.com/CVE-2026-86824/): Newsletter < 9.3.8 - Unauthenticated Subscriber PII Disclosure and Modification via Predictable Tracking Signature Key (medium 4.8)
- [CVE-2026-86823](https://insights.sbomify.com/CVE-2026-86823/): Newsletter < 9.3.7 - Unauthenticated Open Redirect and Subscriber Token Disclosure via ncu Parameter (medium 5.3)
- [CVE-2026-8682](https://insights.sbomify.com/CVE-2026-8682/): Missing authorization in 3D Viewer – 3D Model Viewer – Augmented Reality – Virtual Try On (medium 4.3)
- [CVE-2026-86819](https://insights.sbomify.com/CVE-2026-86819/): Waves Central local privilege escalation via Improper XPC Client Authentication in macOS (high 8.4)
- [CVE-2026-86818](https://insights.sbomify.com/CVE-2026-86818/): fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization (medium 4.8)
- [CVE-2026-86817](https://insights.sbomify.com/CVE-2026-86817/): Information disclosure in Five Star Business Profile and Schema (medium 4.9)
- [CVE-2026-86816](https://insights.sbomify.com/CVE-2026-86816/): WPCafe < 3.0.21 - Unauthenticated Product Data Disclosure via REST API (medium 5.3)
- [CVE-2026-86815](https://insights.sbomify.com/CVE-2026-86815/): Missing authorization in BackWPup (medium 5.5)
- [CVE-2026-86814](https://insights.sbomify.com/CVE-2026-86814/): UsersWP - Social Login < 1.5.10 - Unauthenticated Account Takeover via Unverified Provider Email (high 8.1)
- [CVE-2026-86813](https://insights.sbomify.com/CVE-2026-86813/): MetForm < 4.1.9 - Unauthenticated Email Header Injection via Notification Reply-To (medium 4.8)
- [CVE-2026-86812](https://insights.sbomify.com/CVE-2026-86812/): WPCafe 3.0.10 - 3.0.17 - Unauthenticated Order Disclosure and Modification via food-orders REST API (medium 6.5)
- [CVE-2026-86810](https://insights.sbomify.com/CVE-2026-86810/): Open-Web-Analytics Controller Controller.php checkCapabilityAndAuthenticateUser improper authentication (medium 6.9)
- [CVE-2026-8681](https://insights.sbomify.com/CVE-2026-8681/): Missing authorization in Essential Chat Support (medium 5.3)
- [CVE-2026-86809](https://insights.sbomify.com/CVE-2026-86809/): Persian Elementor < 2.8.2 - Unauthenticated ZarinPal Payment Callback Authority Bypass (medium 5.3)
- [CVE-2026-86808](https://insights.sbomify.com/CVE-2026-86808/): moltis-org moltis vault.rs vault_recovery_handler missing authentication (medium 6.9)
- [CVE-2026-86806](https://insights.sbomify.com/CVE-2026-86806/): opengeos GeoLibre _is_within_roots server-side request forgery (medium 6.9)
- [CVE-2026-86805](https://insights.sbomify.com/CVE-2026-86805/): AT_SECURE programs may load attacker-controlled code via $ORIGIN (medium 6.3)
- [CVE-2026-86804](https://insights.sbomify.com/CVE-2026-86804/): seakee CPA-Manager-Plus HTTP handler.go CPAResource improper authorization (medium 6.9)
- [CVE-2026-86803](https://insights.sbomify.com/CVE-2026-86803/): Ocean Extra <= 2.6.0 - Unauthenticated Arbitrary Shortcode Execution via 'oceanwp_library' Shortcode Template (medium 6.5)
- [CVE-2026-86802](https://insights.sbomify.com/CVE-2026-86802/): To Do List Member 1.4 - 1.6 - Unauthenticated Content Injection via Import (low 3.7)
- [CVE-2026-86801](https://insights.sbomify.com/CVE-2026-86801/): To Do List Member 1.4 - 1.6 - Unauthenticated Stored XSS, File Listing and Deletion via Unprotected Upload Handler (high 8.8)
- [CVE-2026-86800](https://insights.sbomify.com/CVE-2026-86800/): WP Ghost (Hide My WP Ghost) < 7.0.11 - Unauthenticated URL Hiding Bypass via Loopback Compatibility Check (medium 5.3)
- [CVE-2026-86799](https://insights.sbomify.com/CVE-2026-86799/): Forms < 3.0.2 - Unauthenticated Stored XSS via Form Submission (high 8.8)
- [CVE-2026-86798](https://insights.sbomify.com/CVE-2026-86798/): HootBoard <= 3.1.4 - Unauthenticated Stored XSS via Board Configuration REST Endpoint (high 8.8)
- [CVE-2026-86797](https://insights.sbomify.com/CVE-2026-86797/): Pricing Table Block 1.0.7 - 2.1.4 - Contributor+ Stored XSS via Pricing Link (medium 6.8)
- [CVE-2026-86796](https://insights.sbomify.com/CVE-2026-86796/): Security feature bypass in Hide My WP Ghost (medium 5.3)
- [CVE-2026-86794](https://insights.sbomify.com/CVE-2026-86794/): Community Events 1.4.9 - 1.5.9 - Unauthenticated Stored XSS via Event Submission Form (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/295/