# Vulnerabilities published in 2026


- [CVE-2026-86793](https://insights.sbomify.com/CVE-2026-86793/): CVE-2026-86793 (critical 9.8)
- [CVE-2026-86792](https://insights.sbomify.com/CVE-2026-86792/): Code injection in Apache Airflow Apache Kafka provider (high 8.8)
- [CVE-2026-86791](https://insights.sbomify.com/CVE-2026-86791/): iPOSpays Payment Gateway for WooCommerce < 1.4.7 - Unauthenticated Payment Confirmation Forgery (medium 5.3)
- [CVE-2026-86790](https://insights.sbomify.com/CVE-2026-86790/): WP Highlight Box <= 1.0 - Contributor+ Stored XSS via highlight-box Shortcode (medium 6.8)
- [CVE-2026-8679](https://insights.sbomify.com/CVE-2026-8679/): Missing authorization in AudioIgniter Music Player (high 7.5)
- [CVE-2026-86789](https://insights.sbomify.com/CVE-2026-86789/): Information disclosure in Connections Business Directory (medium 5.3)
- [CVE-2026-86788](https://insights.sbomify.com/CVE-2026-86788/): HT Mega 3.2.0 - 3.2.5 - Contributor+ Stored XSS via Section Headline Tag (medium 6.8)
- [CVE-2026-86787](https://insights.sbomify.com/CVE-2026-86787/): Affiliate Toolkit 3.8.7 - 3.9.0 - Contributor+ RCE via BladeOne @php Directive (high 7.2)
- [CVE-2026-86786](https://insights.sbomify.com/CVE-2026-86786/): Slider Pro <= 1.0.0 - Unauthenticated Sensitive Data Disclosure via sliderpro_multiple_images (medium 5.3)
- [CVE-2026-86785](https://insights.sbomify.com/CVE-2026-86785/): Social Commerce for WooCommerce <= 2.5.4 - Unauthenticated Plugin Option and Product Sync Status Update (medium 5.3)
- [CVE-2026-86784](https://insights.sbomify.com/CVE-2026-86784/): Visualizer < 4.0.8 - Contributor+ Stored XSS via JSON Data Source (medium 6.8)
- [CVE-2026-86783](https://insights.sbomify.com/CVE-2026-86783/): PostX < 5.0.41 - Unauthenticated Custom Field Key Disclosure via REST API (medium 5.3)
- [CVE-2026-86782](https://insights.sbomify.com/CVE-2026-86782/): Visualizer < 4.0.6 - Contributor+ Arbitrary Post/Page Modification via IDOR (medium 5.5)
- [CVE-2026-86781](https://insights.sbomify.com/CVE-2026-86781/): SSL Zen < 4.7.40 - Subscriber+ TLS Private Key Disclosure (medium 5.3)
- [CVE-2026-86780](https://insights.sbomify.com/CVE-2026-86780/): Featured Image with URL < 1.0.6 - Contributor+ Stored XSS via Image Alt Text (medium 6.8)
- [CVE-2026-8678](https://insights.sbomify.com/CVE-2026-8678/): Missing authorization in MyParcel (medium 4.3)
- [CVE-2026-86779](https://insights.sbomify.com/CVE-2026-86779/): Visualizer < 4.0.6 - Contributor+ Arbitrary Chart Deletion via deleteChart (low 2.7)
- [CVE-2026-86778](https://insights.sbomify.com/CVE-2026-86778/): Username Enumeration in Maksisoft Technology's Maksisoft Gym (medium 5.3)
- [CVE-2026-86777](https://insights.sbomify.com/CVE-2026-86777/): AlchemyCMS before 7.4.16 and 8.x before 8.3.6 Missing Authorization on GET /api/nodes (medium 6.9)
- [CVE-2026-86776](https://insights.sbomify.com/CVE-2026-86776/): KeePass 2.35 through 2.61.1 Memory Exhaustion via KDBX Header Field Size (medium 4.6)
- [CVE-2026-86775](https://insights.sbomify.com/CVE-2026-86775/): knowns before 0.30.0 Path Traversal via Document API (high 8.8)
- [CVE-2026-86774](https://insights.sbomify.com/CVE-2026-86774/): Snipe-IT before 8.7.0 Broken Access Control via AssetModelPolicy (medium 5.3)
- [CVE-2026-86773](https://insights.sbomify.com/CVE-2026-86773/): Snipe-IT 8.6.3 Broken Access Control via Kit Update Endpoints (medium 5.3)
- [CVE-2026-86772](https://insights.sbomify.com/CVE-2026-86772/): Snipe-IT 8.6.3 Stored XSS via Department Names (medium 5.1)
- [CVE-2026-86771](https://insights.sbomify.com/CVE-2026-86771/): Snipe-IT before 8.7.0 Server-Side Request Forgery via employee_num (high 8.3)
- [CVE-2026-86770](https://insights.sbomify.com/CVE-2026-86770/): Snipe-IT before 8.7.0 Authentication Bypass via SAML Username Collation (high 8.6)
- [CVE-2026-8677](https://insights.sbomify.com/CVE-2026-8677/): Prime Elementor Addons <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget HTML Tag Settings (medium 6.4)
- [CVE-2026-86769](https://insights.sbomify.com/CVE-2026-86769/): Snipe-IT before 8.7.0 Audit Log Misattribution via Consumables Checkout (medium 5.3)
- [CVE-2026-86768](https://insights.sbomify.com/CVE-2026-86768/): Snipe-IT before 8.7.0 Improper Input Validation via API Checkout (medium 5.3)
- [CVE-2026-86767](https://insights.sbomify.com/CVE-2026-86767/): Snipe-IT before 8.7.0 Cross-Company Read via requested-assets (medium 5.3)
- [CVE-2026-86766](https://insights.sbomify.com/CVE-2026-86766/): Snipe-IT 8.6.3 Race Condition via Consumable Checkout (high 7.1)
- [CVE-2026-86765](https://insights.sbomify.com/CVE-2026-86765/): Snipe-IT 8.6.3 Authorization Bypass via Asset Update Endpoint (high 7.1)
- [CVE-2026-86764](https://insights.sbomify.com/CVE-2026-86764/): Snipe-IT 8.6.4 before 8.7.0 Permission Bypass via assigned components (high 7.1)
- [CVE-2026-86763](https://insights.sbomify.com/CVE-2026-86763/): snipe-it 7.0.12 through 8.6.3 Authorization Bypass via Importer (medium 5.1)
- [CVE-2026-86762](https://insights.sbomify.com/CVE-2026-86762/): Snipe-IT before 8.7.0 Authentication Bypass via API Middleware (high 8.6)
- [CVE-2026-86761](https://insights.sbomify.com/CVE-2026-86761/): snipe-it 8.6.3 before 8.7.0 Authorization Bypass via print endpoints (medium 5.3)
- [CVE-2026-86760](https://insights.sbomify.com/CVE-2026-86760/): snipe-it 8.2.0 before 8.7.0 Authentication Bypass via activated flag (medium 5.3)
- [CVE-2026-8676](https://insights.sbomify.com/CVE-2026-8676/): Auth bypass in Simplicity SDK (high 8.8)
- [CVE-2026-86759](https://insights.sbomify.com/CVE-2026-86759/): Snipe-IT before 8.7.0 Missing Authorization via asset-history CSV importer (high 7.1)
- [CVE-2026-86758](https://insights.sbomify.com/CVE-2026-86758/): Snipe-IT before 8.7.0 License Key Exposure via CSV Export (high 7.1)
- [CVE-2026-86757](https://insights.sbomify.com/CVE-2026-86757/): Snipe-IT before 8.7.0 Information Disclosure via Custom Fields (high 7.1)
- [CVE-2026-86756](https://insights.sbomify.com/CVE-2026-86756/): Snipe-IT 8.5.0 through 8.6.3 Open Redirect via SAML RelayState (medium 5.3)
- [CVE-2026-86755](https://insights.sbomify.com/CVE-2026-86755/): Snipe-IT 4.2.0 through 8.6.3 Permission Bypass via OAuth (medium 5.3)
- [CVE-2026-86754](https://insights.sbomify.com/CVE-2026-86754/): Snipe-IT before 8.7.0 Authorization Bypass via OAuth Clients (high 8.5)
- [CVE-2026-86753](https://insights.sbomify.com/CVE-2026-86753/): snipe-it before 8.7.0 Business Logic Bypass via asset_model endpoint (medium 5.3)
- [CVE-2026-86752](https://insights.sbomify.com/CVE-2026-86752/): snipe-it before 8.7.0 Authorization Bypass via Asset Audit Endpoints (medium 5.3)
- [CVE-2026-86751](https://insights.sbomify.com/CVE-2026-86751/): Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Markdown (high 8.4)
- [CVE-2026-86750](https://insights.sbomify.com/CVE-2026-86750/): snipe-it before 8.7.0 Authorization Bypass via API User Create/Update (high 8.3)
- [CVE-2026-86749](https://insights.sbomify.com/CVE-2026-86749/): snipe-it before 8.7.0 Data Loss via Failed Image Write (high 7.0)
- [CVE-2026-86748](https://insights.sbomify.com/CVE-2026-86748/): Snipe-IT before 8.7.0 Database Wipe via Invalid Backup Archive (medium 6.9)
- [CVE-2026-86747](https://insights.sbomify.com/CVE-2026-86747/): snipe-it before 8.7.0 Authorization Bypass via Pivot-Only User (medium 5.3)
- [CVE-2026-86746](https://insights.sbomify.com/CVE-2026-86746/): Snipe-IT before 8.7.0 Authorization Bypass via Livewire Snapshot Replay (high 7.4)
- [CVE-2026-86745](https://insights.sbomify.com/CVE-2026-86745/): Snipe-IT before 8.7.0 CSV Formula Injection via Location-Scoping Export (medium 5.1)
- [CVE-2026-86744](https://insights.sbomify.com/CVE-2026-86744/): snipe-it before 8.7.0 Race Condition in Asset Checkout (low 2.1)
- [CVE-2026-86743](https://insights.sbomify.com/CVE-2026-86743/): Snipe-IT before 8.7.0 Authorization Bypass via Asset Acceptance Report (medium 5.3)
- [CVE-2026-86742](https://insights.sbomify.com/CVE-2026-86742/): Snipe-IT before 8.7.0 CSV Formula Injection via Asset Acceptance Report (medium 5.1)
- [CVE-2026-86741](https://insights.sbomify.com/CVE-2026-86741/): Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Category EULA (high 8.4)
- [CVE-2026-86740](https://insights.sbomify.com/CVE-2026-86740/): Snipe-IT before 8.7.0 Attachment Deletion Reports Success While File Remains (medium 5.1)
- [CVE-2026-8674](https://insights.sbomify.com/CVE-2026-8674/): Assertion failure in the DNS stub resolver with a long search domain (medium 5.3)
- [CVE-2026-86739](https://insights.sbomify.com/CVE-2026-86739/): Snipe-IT before 8.7.0 Acceptance Finalization Without Stored Evidence (low 2.3)
- [CVE-2026-86738](https://insights.sbomify.com/CVE-2026-86738/): Snipe-IT before 8.7.0 CSS Injection via Custom CSS (critical 9.3)
- [CVE-2026-86737](https://insights.sbomify.com/CVE-2026-86737/): snipe-it before 8.7.0 Missing Authorization via barcode endpoint (medium 5.3)
- [CVE-2026-86736](https://insights.sbomify.com/CVE-2026-86736/): snipe-it before 8.7.0 Checkout Request Counter Integrity Failure (medium 5.3)
- [CVE-2026-86735](https://insights.sbomify.com/CVE-2026-86735/): snipe-it before 8.7.0 SSRF via IPv6 transition address bypass (medium 5.9)
- [CVE-2026-86734](https://insights.sbomify.com/CVE-2026-86734/): Snipe-IT before 8.7.1 Denial of Service via Unbounded Note Field (high 7.1)
- [CVE-2026-86733](https://insights.sbomify.com/CVE-2026-86733/): Snipe-IT before 8.7.0 Remote Code Execution via Backup Restore (high 8.6)
- [CVE-2026-86732](https://insights.sbomify.com/CVE-2026-86732/): Craft CMS before 5.10.12 Remote Code Execution via element-index (high 8.7)
- [CVE-2026-86731](https://insights.sbomify.com/CVE-2026-86731/): Craft CMS 5.0.0-RC1 before 5.10.12 Permission Escalation via UsersController (high 7.1)
- [CVE-2026-86730](https://insights.sbomify.com/CVE-2026-86730/): Craft CMS 5.0.0-RC1 before 5.10.12 Behavior Injection RCE (high 8.7)
- [CVE-2026-8673](https://insights.sbomify.com/CVE-2026-8673/): Password re-initialization mechanism sends passwords in plain text (medium 5.9)
- [CVE-2026-86729](https://insights.sbomify.com/CVE-2026-86729/): WWBN AVideo Unrestricted Authentication Attempts via get_api_preauthorize (critical 9.1)
- [CVE-2026-86728](https://insights.sbomify.com/CVE-2026-86728/): AVideo through 29.0 Unauthenticated Disclosure via epg.json.php (high 8.7)
- [CVE-2026-86727](https://insights.sbomify.com/CVE-2026-86727/): AVideo through 29.0 Information Disclosure via stats.json.php (high 8.7)
- [CVE-2026-86726](https://insights.sbomify.com/CVE-2026-86726/): AVideo through 29.0 Information Disclosure via restreamsActive.json.php (high 7.1)
- [CVE-2026-86725](https://insights.sbomify.com/CVE-2026-86725/): AVideo SocialMediaPublisher Missing Authorization via add.json.php (high 7.1)
- [CVE-2026-86724](https://insights.sbomify.com/CVE-2026-86724/): AVideo YPTWallet saveBalance.php Cross-Site Request Forgery (high 7.1)
- [CVE-2026-86723](https://insights.sbomify.com/CVE-2026-86723/): AVideo LoginControl PGP Authentication Bypass via verifyChallenge (high 8.6)
- [CVE-2026-86722](https://insights.sbomify.com/CVE-2026-86722/): AVideo Authentication Bypass via SQL Cache Invalidation (high 8.6)
- [CVE-2026-86721](https://insights.sbomify.com/CVE-2026-86721/): AVideo through c3edcc274c Authorization Bypass via Session Cookie (high 8.7)
- [CVE-2026-86720](https://insights.sbomify.com/CVE-2026-86720/): WWBN AVideo Missing Authorization via resendRestreamer.json.php (high 8.6)
- [CVE-2026-8672](https://insights.sbomify.com/CVE-2026-8672/): Default credentials for internal DB (medium 5.1)
- [CVE-2026-86719](https://insights.sbomify.com/CVE-2026-86719/): WWBN AVideo CustomizeUser Cross-Site Request Forgery Session Hijacking (medium 5.3)
- [CVE-2026-86718](https://insights.sbomify.com/CVE-2026-86718/): WWBN AVideo Cross-Site Request Forgery via deleteHistory.json.php (high 7.1)
- [CVE-2026-86717](https://insights.sbomify.com/CVE-2026-86717/): Insurify <= 1.0 - Unauthenticated Arbitrary Option Deletion via removeimg_popup (critical 9.1)
- [CVE-2026-86716](https://insights.sbomify.com/CVE-2026-86716/): Cesanta mJS mjs_tok.c skip_spaces_and_comments heap-based overflow (medium 6.9)
- [CVE-2026-86714](https://insights.sbomify.com/CVE-2026-86714/): PX4 Autopilot through 1.17.0 Stack Buffer Over-read via netman (medium 5.3)
- [CVE-2026-86713](https://insights.sbomify.com/CVE-2026-86713/): PX4 Autopilot through 1.17.0 Use-After-Free in load_mon (high 7.1)
- [CVE-2026-86712](https://insights.sbomify.com/CVE-2026-86712/): SiYuan before 3.8.2 Remote Code Execution via Clipboard (high 8.6)
- [CVE-2026-86711](https://insights.sbomify.com/CVE-2026-86711/): electerm before 5.3.15 Arbitrary Command Execution via Unvalidated runGlobalAsync IPC Bridge (high 7.5)
- [CVE-2026-86710](https://insights.sbomify.com/CVE-2026-86710/): Login with QR <= 1.0.0 - Unauthenticated Authentication Bypass via 'autologin_code' Parameter (critical 9.8)
- [CVE-2026-8671](https://insights.sbomify.com/CVE-2026-8671/): Log Files contain encrypted secrets (high 7.5)
- [CVE-2026-86709](https://insights.sbomify.com/CVE-2026-86709/): The Pressengine <= 1.0 - Unauthenticated Authentication Bypass (critical 9.8)
- [CVE-2026-86708](https://insights.sbomify.com/CVE-2026-86708/): Sensitive data exposure (critical 10.0)
- [CVE-2026-86707](https://insights.sbomify.com/CVE-2026-86707/): Private Feed Key <= 0.1 - Unauthenticated Authentication Bypass via 'feedkey' Parameter (critical 9.8)
- [CVE-2026-86706](https://insights.sbomify.com/CVE-2026-86706/): Quick quotes <= 1.0.0 - Unauthenticated Integer-Value Option Update (critical 9.1)
- [CVE-2026-86701](https://insights.sbomify.com/CVE-2026-86701/): Missing authorization in ManabiPocket for Parents (low 1.8)
- [CVE-2026-8670](https://insights.sbomify.com/CVE-2026-8670/): Insecure session handling on metrics web server (critical 9.6)
- [CVE-2026-86698](https://insights.sbomify.com/CVE-2026-86698/): Refresh tokens accepted as private repository credentials at the CDN (low 2.3)
- [CVE-2026-86696](https://insights.sbomify.com/CVE-2026-86696/): Unbounded atom creation from unsigned LogoutResponse status codes in esaml allows atom table exhaustion (high 8.2)
- [CVE-2026-8669](https://insights.sbomify.com/CVE-2026-8669/): Imager versions through 1.030 for Perl allow a heap out of bounds (OOB) write on crafted multi-frame GIF files (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/296/