# Vulnerabilities published in 2026


- [CVE-2026-84963](https://insights.sbomify.com/CVE-2026-84963/): Silent field truncation via unchecked int cast of huge JSON string values in JSON-to-BSON parser (medium 6.3)
- [CVE-2026-84962](https://insights.sbomify.com/CVE-2026-84962/): Authenticated KMS request forgery via CRLF injection in GCP key identifier strings (medium 5.7)
- [CVE-2026-84961](https://insights.sbomify.com/CVE-2026-84961/): undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool (high 7.4)
- [CVE-2026-84960](https://insights.sbomify.com/CVE-2026-84960/): WP-Members Membership Plugin <= 3.5.6 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2026-8496](https://insights.sbomify.com/CVE-2026-8496/): A cross-site scripting (XSS) vulnerability in Alinto SOGo, version 5.12.7 (medium 6.1)
- [CVE-2026-8495](https://insights.sbomify.com/CVE-2026-8495/): Date iCal - Critical - Information disclosure - SA-CONTRIB-2026-037 (critical 9.8)
- [CVE-2026-84947](https://insights.sbomify.com/CVE-2026-84947/): undici vulnerable to response truncation via oversized chunked responses in the dump interceptor (low 3.7)
- [CVE-2026-84942](https://insights.sbomify.com/CVE-2026-84942/): Stored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch Dashboards (medium 6.3)
- [CVE-2026-84941](https://insights.sbomify.com/CVE-2026-84941/): Omada Controller XML External Entity (XXE) Injection in SAML IdP Metadata Parsing Leading to Arbitrary Local File Read (medium 6.9)
- [CVE-2026-8494](https://insights.sbomify.com/CVE-2026-8494/): Permalink Manager Lite <= 2.5.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title (medium 6.4)
- [CVE-2026-84939](https://insights.sbomify.com/CVE-2026-84939/): Apache FreeMarker, Apache FreeMarker: A malformed locale may be exploitable for path traversal attacks (critical 9.1)
- [CVE-2026-84937](https://insights.sbomify.com/CVE-2026-84937/): YT Player < 2.1.0 - Contributor+ SQLi via ytp_ajax (medium 6.8)
- [CVE-2026-84936](https://insights.sbomify.com/CVE-2026-84936/): EmbedPress 4.6.0 - 4.6.3 - Unauthenticated Google Reviews API Quota Consumption and Database Bloat (medium 5.3)
- [CVE-2026-84935](https://insights.sbomify.com/CVE-2026-84935/): HT Menu < 1.2.7 - Subscriber+ Stored XSS via Menu Settings (high 8.0)
- [CVE-2026-84934](https://insights.sbomify.com/CVE-2026-84934/): JCH Optimize < 6.0.1 - Subscriber+ Stored XSS via getcacheinfo Task Override (high 8.0)
- [CVE-2026-84933](https://insights.sbomify.com/CVE-2026-84933/): undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches (medium 6.5)
- [CVE-2026-84931](https://insights.sbomify.com/CVE-2026-84931/): Joli Table Of Contents < 3.0.3 - Author+ Stored XSS via joli-toc Shortcode Theme Attribute (medium 6.8)
- [CVE-2026-84930](https://insights.sbomify.com/CVE-2026-84930/): CatFolders Document Gallery < 2.0.7 - Author+ Stored XSS via titleTag Block Attribute (medium 6.8)
- [CVE-2026-8493](https://insights.sbomify.com/CVE-2026-8493/): Colorbox Inline - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-036 (medium 5.4)
- [CVE-2026-84927](https://insights.sbomify.com/CVE-2026-84927/): EmbedPress 4.6.0 - 4.6.3 - Contributor+ Google Reviews Modification (low 2.7)
- [CVE-2026-84926](https://insights.sbomify.com/CVE-2026-84926/): EmbedPress 4.6.0 - 4.6.3 - Contributor+ Administrator Email Disclosure via Google Reviews REST Route (low 2.7)
- [CVE-2026-84925](https://insights.sbomify.com/CVE-2026-84925/): Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Reflected Cross-Site Scripting via 'lang' Parameter (medium 6.1)
- [CVE-2026-84924](https://insights.sbomify.com/CVE-2026-84924/): Email Verification / SMS Verification / OTP Verification - Critical - Cross Site Scripting - SA-CONTRIB-2026-125 (medium 5.4)
- [CVE-2026-84923](https://insights.sbomify.com/CVE-2026-84923/): Email Verification / SMS Verification / OTP Verification - Critical - Access Bypass - SA-CONTRIB-2026-124 (medium 6.5)
- [CVE-2026-84921](https://insights.sbomify.com/CVE-2026-84921/): Webform Submissions Delete - Moderately critical - Access bypass - SA-CONTRIB-2026-133 (medium 5.3)
- [CVE-2026-84920](https://insights.sbomify.com/CVE-2026-84920/): Unpublished Node Permissions - Critical - Access bypass - SA-CONTRIB-2026-132 (medium 5.3)
- [CVE-2026-8492](https://insights.sbomify.com/CVE-2026-8492/): Translate Drupal with GTranslate - Less critical - DOM clobbering / link manipulation - SA-CONTRIB-2026-035 (low 2.7)
- [CVE-2026-84919](https://insights.sbomify.com/CVE-2026-84919/): Cross-site scripting in PhotoSwipe - Responsive JavaScript Modal Image Gallery (medium 4.6)
- [CVE-2026-84918](https://insights.sbomify.com/CVE-2026-84918/): Monobank payment API - Moderately critical - Access bypass - SA-CONTRIB-2026-130 (low 3.7)
- [CVE-2026-84917](https://insights.sbomify.com/CVE-2026-84917/): Jsonapi Role Access - Critical - Access bypass - SA-CONTRIB-2026-127 (medium 6.5)
- [CVE-2026-84916](https://insights.sbomify.com/CVE-2026-84916/): Islandora - Moderately critical - Access bypass - SA-CONTRIB-2026-126 (low 3.7)
- [CVE-2026-84915](https://insights.sbomify.com/CVE-2026-84915/): Component blocks - Moderately critical - Cross site scripting - SA-CONTRIB-2026-123 (medium 4.6)
- [CVE-2026-84914](https://insights.sbomify.com/CVE-2026-84914/): Calculate Working Days - Critical - Access bypass - SA-CONTRIB-2026-122 (medium 5.3)
- [CVE-2026-84913](https://insights.sbomify.com/CVE-2026-84913/): AI translate - Moderately critical - Access Bypass - SA-CONTRIB-2026-121 (medium 4.6)
- [CVE-2026-84912](https://insights.sbomify.com/CVE-2026-84912/): AI (Artificial Intelligence) - Moderately critical - Access Bypass - SA-CONTRIB-2026-120 (medium 4.6)
- [CVE-2026-84911](https://insights.sbomify.com/CVE-2026-84911/): AI (Artificial Intelligence) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-119 (low 3.1)
- [CVE-2026-84910](https://insights.sbomify.com/CVE-2026-84910/): Advanced Search - Moderately critical - Access bypass - SA-CONTRIB-2026-118 (medium 4.2)
- [CVE-2026-8491](https://insights.sbomify.com/CVE-2026-8491/): Node View Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-034 (low 3.7)
- [CVE-2026-84909](https://insights.sbomify.com/CVE-2026-84909/): Cross-site scripting in Custom Twitter Feeds – A Tweets Widget or X Feed Widget (medium 6.4)
- [CVE-2026-84908](https://insights.sbomify.com/CVE-2026-84908/): Missing authorization in WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell (medium 5.3)
- [CVE-2026-84907](https://insights.sbomify.com/CVE-2026-84907/): Eventin < 4.1.24 - Unauthenticated Order and Attendee Status Reset via Payment REST Endpoint (low 3.7)
- [CVE-2026-84906](https://insights.sbomify.com/CVE-2026-84906/): Eventin < 4.1.24 - Unauthenticated Payment Bypass via Stripe and PayPal Cross-Order Transaction Replay (medium 5.3)
- [CVE-2026-84905](https://insights.sbomify.com/CVE-2026-84905/): Eventin < 4.1.24 - Contributor+ User Creation via Speaker Creation (low 2.7)
- [CVE-2026-84904](https://insights.sbomify.com/CVE-2026-84904/): King Addons for Elementor 51.1.56 - 51.1.80 - Author+ Missing Authorization via Image Optimizer (low 3.8)
- [CVE-2026-84903](https://insights.sbomify.com/CVE-2026-84903/): King Addons for Elementor < 51.1.81 - Contributor+ Private Post Content Disclosure via kng_maintenance_page Shortcode (low 2.7)
- [CVE-2026-84902](https://insights.sbomify.com/CVE-2026-84902/): King Addons for Elementor < 51.1.81 - Contributor+ Stored XSS via Template Catalog Import (medium 6.8)
- [CVE-2026-84901](https://insights.sbomify.com/CVE-2026-84901/): Eventin < 4.1.22 - Contributor+ Site Homepage Hijack and Event Taxonomy Manipulation via Missing Authorization (medium 4.9)
- [CVE-2026-84900](https://insights.sbomify.com/CVE-2026-84900/): HP ThinPro 8.1 SP10 and ThinPro 9 SP3 Security Updates (medium 6.8)
- [CVE-2026-84899](https://insights.sbomify.com/CVE-2026-84899/): VikWidgetsLoader < 1.12.0 - Contributor+ Stored XSS via Gutenberg Block class_suffix (medium 6.8)
- [CVE-2026-84898](https://insights.sbomify.com/CVE-2026-84898/): Eventin < 4.1.21 - Contributor+ LFI via Event Layout Meta (medium 6.6)
- [CVE-2026-84897](https://insights.sbomify.com/CVE-2026-84897/): Denial of service in wolfSSH (medium 6.9)
- [CVE-2026-84896](https://insights.sbomify.com/CVE-2026-84896/): King Addons for Elementor < 51.1.77 - Contributor+ Stored XSS via Magazine Grid Widget (medium 6.8)
- [CVE-2026-84895](https://insights.sbomify.com/CVE-2026-84895/): Use after free in proxygen (high 7.3)
- [CVE-2026-84894](https://insights.sbomify.com/CVE-2026-84894/): Use after free in moxygen (high 7.5)
- [CVE-2026-84893](https://insights.sbomify.com/CVE-2026-84893/): IBM Guardium Data Protection is affected by multiple vulnerabilities. (high 7.6)
- [CVE-2026-84891](https://insights.sbomify.com/CVE-2026-84891/): Security vulnerability affects the Windows GIM component as part of IBM Guardium Data Protection (medium 5.9)
- [CVE-2026-84890](https://insights.sbomify.com/CVE-2026-84890/): undici vulnerable to Denial of Service via unbounded decompression of compressed responses (medium 5.9)
- [CVE-2026-8489](https://insights.sbomify.com/CVE-2026-8489/): Cross-site scripting in Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin (medium 6.4)
- [CVE-2026-84889](https://insights.sbomify.com/CVE-2026-84889/): Path traversal in Langflow OSS (high 8.8)
- [CVE-2026-84888](https://insights.sbomify.com/CVE-2026-84888/): RightNow-AI OpenFang tool_runner.rs shell_exec memory allocation (medium 5.3)
- [CVE-2026-84887](https://insights.sbomify.com/CVE-2026-84887/): simular-ai Agent-S Model-generated GUI Action Execution Workflow grounding.py denial of service (medium 5.3)
- [CVE-2026-84886](https://insights.sbomify.com/CVE-2026-84886/): simular-ai Agent-S OCR HTTP API ocr_server.py ImageData resource consumption (medium 6.9)
- [CVE-2026-84885](https://insights.sbomify.com/CVE-2026-84885/): simular-ai Agent-S CodeAgent code_agent.py denial of service (medium 5.3)
- [CVE-2026-84884](https://insights.sbomify.com/CVE-2026-84884/): IBM Guardium Data Protection is affected by multiple vulnerabilities. (high 7.5)
- [CVE-2026-84882](https://insights.sbomify.com/CVE-2026-84882/): IBM Guardium Data Protection is affected by multiple vulnerabilities. (high 7.5)
- [CVE-2026-8488](https://insights.sbomify.com/CVE-2026-8488/): Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation (medium 4.3)
- [CVE-2026-84875](https://insights.sbomify.com/CVE-2026-84875/): Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection (high 7.5)
- [CVE-2026-8487](https://insights.sbomify.com/CVE-2026-8487/): Incorrect default permissions vulnerability in Progress Software MOVEit Automation (medium 6.5)
- [CVE-2026-84869](https://insights.sbomify.com/CVE-2026-84869/): ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization (critical 9.9, exploited in the wild)
- [CVE-2026-84862](https://insights.sbomify.com/CVE-2026-84862/): IBM Guardium Data Protection is affected by multiple vulnerabilities. (high 7.2)
- [CVE-2026-84860](https://insights.sbomify.com/CVE-2026-84860/): Scada-LTS DWR Authorization Bypass - Systemic (high 8.8)
- [CVE-2026-8486](https://insights.sbomify.com/CVE-2026-8486/): Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation (medium 5.3)
- [CVE-2026-84859](https://insights.sbomify.com/CVE-2026-84859/): Scada-LTS Authenticated Blind SQL Injection (medium 6.5)
- [CVE-2026-84858](https://insights.sbomify.com/CVE-2026-84858/): Scada-LTS Authenticated Remote Code Execution via Scripting Sandbox Bypass (high 8.8)
- [CVE-2026-84857](https://insights.sbomify.com/CVE-2026-84857/): sigoden aichat API Endpoint serve.rs memory allocation (medium 6.9)
- [CVE-2026-84856](https://insights.sbomify.com/CVE-2026-84856/): rowboatlabs rowboat Composio Webhook Endpoint route.ts req.json denial of service (medium 6.9)
- [CVE-2026-84854](https://insights.sbomify.com/CVE-2026-84854/): Out of Bound Write on WibuKey for Windows (high 7.0)
- [CVE-2026-84852](https://insights.sbomify.com/CVE-2026-84852/): Reader Tools PDF Reader App File ActSplashNew.handleDeeplink path traversal (medium 4.8)
- [CVE-2026-84851](https://insights.sbomify.com/CVE-2026-84851/): Uncontrolled recursion in the Ion reader in Amazon Ion-C before 1.1.6 (high 8.7)
- [CVE-2026-84850](https://insights.sbomify.com/CVE-2026-84850/): Security feature bypass in Server (medium 4.8)
- [CVE-2026-8485](https://insights.sbomify.com/CVE-2026-8485/): Uncontrolled Memory Allocation vulnerability in Progress Software MOVEit Automation (medium 5.9)
- [CVE-2026-84849](https://insights.sbomify.com/CVE-2026-84849/): WordPress Pre-Orders for WooCommerce plugin <= 2.3 - Bypass Vulnerability vulnerability (medium 6.5)
- [CVE-2026-84848](https://insights.sbomify.com/CVE-2026-84848/): WordPress Quick Event Manager plugin <= 9.17 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-84847](https://insights.sbomify.com/CVE-2026-84847/): WordPress Quick Event Manager plugin <= 9.17 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-84842](https://insights.sbomify.com/CVE-2026-84842/): IBM Guardium Data Protection is affected by multiple vulnerabilities. (high 8.1)
- [CVE-2026-84841](https://insights.sbomify.com/CVE-2026-84841/): tsi-coop tsi-dpdp-cms client-side enforcement of server-side security (medium 6.9)
- [CVE-2026-84840](https://insights.sbomify.com/CVE-2026-84840/): tsi-coop tsi-dpdp-cms Bootstrap Setup Endpoint InterceptingFilter.java missing authentication (medium 6.9)
- [CVE-2026-8484](https://insights.sbomify.com/CVE-2026-8484/): Heap buffer overflow in Jansi (medium 4.8)
- [CVE-2026-84839](https://insights.sbomify.com/CVE-2026-84839/): tsi-coop tsi-dpdp-cms Admin Console/DPO Compliance Console web.xml missing authentication (medium 6.9)
- [CVE-2026-84838](https://insights.sbomify.com/CVE-2026-84838/): Rpm: command injection in rpmuncompress via unescaped filenames passed to popen() (high 7.8)
- [CVE-2026-84837](https://insights.sbomify.com/CVE-2026-84837/): Rpm: command injection in `rpmbuild -t*` (`gettarspec`) via unescaped tarball path (high 7.8)
- [CVE-2026-84836](https://insights.sbomify.com/CVE-2026-84836/): WordPress WC Ukraine Shipping plugin <= 1.22.3 - Insecure Direct Object References (IDOR) vulnerability (high 7.1)
- [CVE-2026-84835](https://insights.sbomify.com/CVE-2026-84835/): WordPress Rentsyst plugin <= 2.1.5 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-84834](https://insights.sbomify.com/CVE-2026-84834/): WordPress JobSearch plugin <= 3.2.0 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-84833](https://insights.sbomify.com/CVE-2026-84833/): ntegrals openbrowser Browser Agent Message Construction agent.ts resource consumption (medium 5.3)
- [CVE-2026-84832](https://insights.sbomify.com/CVE-2026-84832/): Unsafe deserialization in the REST interface (high 8.6)
- [CVE-2026-84831](https://insights.sbomify.com/CVE-2026-84831/): Mandatory MFA bypass before enrollment (high 7.7)
- [CVE-2026-84830](https://insights.sbomify.com/CVE-2026-84830/): OS command injection in privileged configuration handling (high 8.6)
- [CVE-2026-84829](https://insights.sbomify.com/CVE-2026-84829/): Optimole < 4.2.12 - Unauthenticated Stored XSS via Srcset Descriptor Parameter (high 8.8)
- [CVE-2026-84828](https://insights.sbomify.com/CVE-2026-84828/): Pcs: pcs: non-root haclient users can read arbitrary files via pcs host auth --token (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/311/