# Vulnerabilities published in 2026


- [CVE-2026-84823](https://insights.sbomify.com/CVE-2026-84823/): Org.wildfly.core: wildfly: path traversal in take-snapshot discloses the server configuration to the monitor role (high 7.1)
- [CVE-2026-84821](https://insights.sbomify.com/CVE-2026-84821/): WordPress WP Fast Total Search plugin <= 1.82.284 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-84820](https://insights.sbomify.com/CVE-2026-84820/): Cross-site scripting in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) (high 7.1)
- [CVE-2026-8482](https://insights.sbomify.com/CVE-2026-8482/): Information leak in NSRPC client history (medium 4.3)
- [CVE-2026-84819](https://insights.sbomify.com/CVE-2026-84819/): WordPress WPAdverts plugin <= 2.3.3 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-84818](https://insights.sbomify.com/CVE-2026-84818/): WordPress Open User Map plugin <= 1.4.50 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-84817](https://insights.sbomify.com/CVE-2026-84817/): WordPress JetFormBuilder plugin <= 3.6.5.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-84816](https://insights.sbomify.com/CVE-2026-84816/): WordPress WPCS plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-84815](https://insights.sbomify.com/CVE-2026-84815/): WordPress Enfold theme <= 8.0 - Cross Site Scripting (XSS) vulnerability (medium 5.8)
- [CVE-2026-84814](https://insights.sbomify.com/CVE-2026-84814/): WordPress Bricksforge plugin <= 3.1.8.8 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2026-84813](https://insights.sbomify.com/CVE-2026-84813/): WordPress GeoDirectory plugin <= 2.8.174 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-84812](https://insights.sbomify.com/CVE-2026-84812/): WordPress BP Better Messages plugin <= 2.15.27 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-84811](https://insights.sbomify.com/CVE-2026-84811/): agentverus-scanner Companion Code Analysis Bypass via Excluded Python Bytecode (high 7.1)
- [CVE-2026-84810](https://insights.sbomify.com/CVE-2026-84810/): claude-skill-antivirus Analysis Bypass via Manifest-Only Local Directory Scan (high 7.1)
- [CVE-2026-8481](https://insights.sbomify.com/CVE-2026-8481/): Remote Code Execution via Code Validation Endpoint (critical 9.9)
- [CVE-2026-84809](https://insights.sbomify.com/CVE-2026-84809/): Tencent AI-Infra-Guard skill-scan Analysis Bypass via Excluded Python Bytecode (high 7.1)
- [CVE-2026-84808](https://insights.sbomify.com/CVE-2026-84808/): Kimai before 2.65.0 Authorization Bypass via API Timesheet (medium 5.3)
- [CVE-2026-84807](https://insights.sbomify.com/CVE-2026-84807/): Kimai before 2.65.0 Authentication Bypass via Team Creation (medium 5.3)
- [CVE-2026-84806](https://insights.sbomify.com/CVE-2026-84806/): Kimai before 2.63.0 Authorization Bypass via Team Access Endpoints (medium 5.3)
- [CVE-2026-84805](https://insights.sbomify.com/CVE-2026-84805/): Kimai 2.61.0 before 2.63.0 Authentication Bypass via API (medium 5.3)
- [CVE-2026-84804](https://insights.sbomify.com/CVE-2026-84804/): Kimai before 2.65.0 Authorization Bypass via Team Activity API (medium 5.3)
- [CVE-2026-84803](https://insights.sbomify.com/CVE-2026-84803/): SiYuan before v3.8.2 Stored XSS via incomplete asset blocklist (high 8.6)
- [CVE-2026-84802](https://insights.sbomify.com/CVE-2026-84802/): Craft CMS 5.7.0 before 5.10.12 Information Disclosure via AssetsController (medium 5.3)
- [CVE-2026-84801](https://insights.sbomify.com/CVE-2026-84801/): Craft CMS 5.0.0-RC1 before 5.10.11 Authentication Bypass via administrateUsers (high 8.7)
- [CVE-2026-84800](https://insights.sbomify.com/CVE-2026-84800/): Craft CMS 5.0.0-RC1 before 5.10.11 File Overwrite via assets/replace-file (high 7.1)
- [CVE-2026-8480](https://insights.sbomify.com/CVE-2026-8480/): Connection possible to the Administration portal with a revoked certificate (medium 4.3)
- [CVE-2026-84799](https://insights.sbomify.com/CVE-2026-84799/): Craft CMS before 5.11.0 PII Disclosure via GraphQL User Relations (medium 5.3)
- [CVE-2026-84798](https://insights.sbomify.com/CVE-2026-84798/): Craft CMS before 5.10.11 Authorization Bypass via actionDeleteForSite (high 7.1)
- [CVE-2026-84797](https://insights.sbomify.com/CVE-2026-84797/): Craft CMS 5.0.0-RC1 before 5.10.11 Authorization Bypass via actionDuplicate (medium 5.3)
- [CVE-2026-84796](https://insights.sbomify.com/CVE-2026-84796/): Craft CMS 5.0.0-RC1 before 5.10.11 GraphQL Entry Mutation Site Scope Bypass (high 8.7)
- [CVE-2026-84795](https://insights.sbomify.com/CVE-2026-84795/): Craft CMS before 5.10.11 Authentication Bypass via Admin Flag Inheritance (critical 9.2)
- [CVE-2026-84794](https://insights.sbomify.com/CVE-2026-84794/): Craft CMS 5.0.0 through 5.10.10 Authorization Bypass via assets/move-asset (high 7.1)
- [CVE-2026-84793](https://insights.sbomify.com/CVE-2026-84793/): Craft CMS 5.0.0-RC1 before 5.10.11 Stored XSS via site name (medium 4.8)
- [CVE-2026-84792](https://insights.sbomify.com/CVE-2026-84792/): Craft CMS before 5.10.11 Broken Access Control via element-indexes (medium 5.3)
- [CVE-2026-84791](https://insights.sbomify.com/CVE-2026-84791/): Broken Access Control vulnerability (high 7.1)
- [CVE-2026-84790](https://insights.sbomify.com/CVE-2026-84790/): Auth bypass in OpenVPN (high 7.6)
- [CVE-2026-8479](https://insights.sbomify.com/CVE-2026-8479/): Null dereference in RTU500 series CMU firmware (medium 6.9)
- [CVE-2026-84789](https://insights.sbomify.com/CVE-2026-84789/): Broken Access Control vulnerability (high 7.1)
- [CVE-2026-84787](https://insights.sbomify.com/CVE-2026-84787/): Privilege Escalation vulnerability (high 8.1)
- [CVE-2026-84784](https://insights.sbomify.com/CVE-2026-84784/): QUIC: Unbounded RETIRE_CONNECTION_ID Backlog (high 7.5)
- [CVE-2026-84783](https://insights.sbomify.com/CVE-2026-84783/): Use-After-Free in X.509 Extension Cache Under Concurrent Use (high 7.5)
- [CVE-2026-84782](https://insights.sbomify.com/CVE-2026-84782/): DTLS Retransmits Handshake Messages From a Stale Buffer Offset (high 8.2)
- [CVE-2026-84781](https://insights.sbomify.com/CVE-2026-84781/): WordPress Gallery PhotoBlocks plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-84780](https://insights.sbomify.com/CVE-2026-84780/): WordPress WP Go Maps plugin <= 10.1.08 - Denial of Service Attack vulnerability (medium 5.3)
- [CVE-2026-8478](https://insights.sbomify.com/CVE-2026-8478/): Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling (high 8.8)
- [CVE-2026-84779](https://insights.sbomify.com/CVE-2026-84779/): WordPress Agentimus – AI SEO, llms.txt & MCP for AI Agents plugin <= 1.51.0 - Broken Access Control vulnerability (high 8.1)
- [CVE-2026-84778](https://insights.sbomify.com/CVE-2026-84778/): WordPress Migrate Guru – Site Migration & Cloning plugin <= 6.65 - Denial of Service Attack vulnerability (high 7.5)
- [CVE-2026-84777](https://insights.sbomify.com/CVE-2026-84777/): WordPress Really Simple SSL plugin <= 9.8.0 - 2FA Bypass vulnerability (high 7.4)
- [CVE-2026-84776](https://insights.sbomify.com/CVE-2026-84776/): WordPress MalCare Security plugin <= 6.69 - Denial of Service Attack vulnerability (high 7.5)
- [CVE-2026-84775](https://insights.sbomify.com/CVE-2026-84775/): WordPress Really Simple SSL plugin <= 9.8.0 - Denial of Service Attack vulnerability (medium 5.3)
- [CVE-2026-84774](https://insights.sbomify.com/CVE-2026-84774/): WordPress WP Statistics plugin <= 14.16.11 - Cross Site Scripting (XSS) vulnerability (medium 6.1)
- [CVE-2026-84773](https://insights.sbomify.com/CVE-2026-84773/): WordPress EWWW Image Optimizer plugin <= 8.7.6 - Cross Site Scripting (XSS) vulnerability (high 7.2)
- [CVE-2026-84772](https://insights.sbomify.com/CVE-2026-84772/): WordPress Broken Link Checker plugin <= 2.4.14 - Server Side Request Forgery (SSRF) vulnerability (medium 5.5)
- [CVE-2026-84771](https://insights.sbomify.com/CVE-2026-84771/): WordPress PublishPress Permissions plugin <= 4.8.3 - Insecure Direct Object References (IDOR) vulnerability (medium 5.3)
- [CVE-2026-84770](https://insights.sbomify.com/CVE-2026-84770/): WordPress Mang Board WP plugin <= 2.3.8 - Cross Site Request Forgery (CSRF) vulnerability (high 8.8)
- [CVE-2026-8477](https://insights.sbomify.com/CVE-2026-8477/): Security feature bypass in Server (low 2.7)
- [CVE-2026-84769](https://insights.sbomify.com/CVE-2026-84769/): WordPress Business Directory plugin <= 6.4.26 - Insecure Direct Object References (IDOR) vulnerability (medium 6.5)
- [CVE-2026-84768](https://insights.sbomify.com/CVE-2026-84768/): WordPress VikAppointments Services Booking Calendar plugin <= 1.2.20 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-84767](https://insights.sbomify.com/CVE-2026-84767/): WordPress BookIt plugin <= 2.6.0.3 - Bypass Vulnerability vulnerability (medium 5.3)
- [CVE-2026-84766](https://insights.sbomify.com/CVE-2026-84766/): WordPress FluentBooking Pro plugin <= 2.2.1 - Bypass Vulnerability vulnerability (medium 5.9)
- [CVE-2026-84765](https://insights.sbomify.com/CVE-2026-84765/): WordPress Breadcrumb NavXT plugin <= 7.5.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-84764](https://insights.sbomify.com/CVE-2026-84764/): WordPress Simply Schedule Appointments plugin <= 1.6.12.23 - Cross Site Request Forgery (CSRF) vulnerability (high 8.8)
- [CVE-2026-84763](https://insights.sbomify.com/CVE-2026-84763/): WordPress RTMKit plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-84762](https://insights.sbomify.com/CVE-2026-84762/): WordPress WP EasyPay plugin <= 4.5.3 - Bypass Vulnerability vulnerability (medium 5.3)
- [CVE-2026-84761](https://insights.sbomify.com/CVE-2026-84761/): WordPress LiteSpeed Cache plugin <= 7.9 - Server Side Request Forgery (SSRF) vulnerability (high 7.2)
- [CVE-2026-84760](https://insights.sbomify.com/CVE-2026-84760/): WordPress Ultimate Gift Cards For WooCommerce plugin <= 3.2.9 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-8476](https://insights.sbomify.com/CVE-2026-8476/): Disk Cache Deserialization Remote Code Execution Vulnerability (critical 9.9)
- [CVE-2026-84759](https://insights.sbomify.com/CVE-2026-84759/): WordPress Activity Log plugin <= 2.13.1 - Cross Site Request Forgery (CSRF) vulnerability (high 7.1)
- [CVE-2026-84758](https://insights.sbomify.com/CVE-2026-84758/): WordPress Business Directory plugin <= 6.4.26 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-84757](https://insights.sbomify.com/CVE-2026-84757/): WordPress WP Compress plugin <= 7.21.28 - Settings Change vulnerability (high 8.2)
- [CVE-2026-84756](https://insights.sbomify.com/CVE-2026-84756/): WordPress WCFM Membership plugin <= 2.11.11 - Privilege Escalation vulnerability (high 7.1)
- [CVE-2026-84755](https://insights.sbomify.com/CVE-2026-84755/): WordPress Mail Mint plugin <= 1.31.0 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-84754](https://insights.sbomify.com/CVE-2026-84754/): WordPress WPFunnels plugin <= 3.12.13 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-84753](https://insights.sbomify.com/CVE-2026-84753/): WordPress Mail Mint plugin <= 1.31.0 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-84752](https://insights.sbomify.com/CVE-2026-84752/): WordPress RTMKit plugin <= 2.1.5 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-84750](https://insights.sbomify.com/CVE-2026-84750/): Ultimate Addons for Contact Form 7 3.2.4 - 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Field (medium 6.5)
- [CVE-2026-84748](https://insights.sbomify.com/CVE-2026-84748/): Missing authorization in Apache bRPC (not scored)
- [CVE-2026-84747](https://insights.sbomify.com/CVE-2026-84747/): Apache bRPC: Access Control Bypass via HTTP Request Paths Containing Empty Path Segments (not scored)
- [CVE-2026-84745](https://insights.sbomify.com/CVE-2026-84745/): The Events Calendar &lt; 6.17.3.1 - Contributor+ Non-Public Event, Venue and Organizer Content Disclosure via REST API (low 2.7)
- [CVE-2026-84744](https://insights.sbomify.com/CVE-2026-84744/): WPForms Lite 1.5.0.1 - 2.0.2 - Unauthenticated Arbitrary Shortcode Execution via Form Field Repopulation (medium 6.5)
- [CVE-2026-84743](https://insights.sbomify.com/CVE-2026-84743/): Missing authorization in The Events Calendar (low 3.8)
- [CVE-2026-84742](https://insights.sbomify.com/CVE-2026-84742/): The Events Calendar 6.15.0 - 6.17.4.1 - Contributor+ Content Publication via TEC V1 REST API (low 2.7)
- [CVE-2026-84741](https://insights.sbomify.com/CVE-2026-84741/): The Events Calendar 4.5 - 6.17.4.1 - Unauthenticated Non-Public Venue and Organizer Disclosure via REST API (medium 5.3)
- [CVE-2026-84740](https://insights.sbomify.com/CVE-2026-84740/): The Events Calendar 6.12.0 - 6.17.5 - Unauthenticated Arbitrary Shortcode Execution via 'view_data' Parameter (medium 6.5)
- [CVE-2026-8474](https://insights.sbomify.com/CVE-2026-8474/): Possible to run a Cross Site Scripting request on the login API available on Stormshield SNS appliances. (medium 5.3)
- [CVE-2026-84739](https://insights.sbomify.com/CVE-2026-84739/): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (high 8.7)
- [CVE-2026-84738](https://insights.sbomify.com/CVE-2026-84738/): AF Companion < 2.2.0 - Shop Manager+ Arbitrary File Upload to RCE (critical 9.1)
- [CVE-2026-84737](https://insights.sbomify.com/CVE-2026-84737/): Freeton WP <= 1.0.0 - Unauthenticated Account Takeover via 'secod' Parameter (critical 9.8)
- [CVE-2026-84736](https://insights.sbomify.com/CVE-2026-84736/): Security feature bypass in Eclipse aeriOS (high 8.3)
- [CVE-2026-84734](https://insights.sbomify.com/CVE-2026-84734/): Mindstien Quick Login <= 1.0 - Unauthenticated Administrator Account Takeover via 'mql_pass' Parameter (critical 9.8)
- [CVE-2026-84732](https://insights.sbomify.com/CVE-2026-84732/): Integer overflow in OpenVPN (high 8.7)
- [CVE-2026-84731](https://insights.sbomify.com/CVE-2026-84731/): Pre-Authentication Admin Bypass and Remote Code Execution in Nutanix Prism Gateway inside AOS (critical 9.3)
- [CVE-2026-84727](https://insights.sbomify.com/CVE-2026-84727/): Apache bRPC: Use-After-Free in RTMP Chunk Stream Handling via Abort Message (medium 5.4)
- [CVE-2026-84725](https://insights.sbomify.com/CVE-2026-84725/): Openjdk-orb: incomplete fix for cve-2026-15560,unauthed class loading via iiop in eap (high 8.1)
- [CVE-2026-84724](https://insights.sbomify.com/CVE-2026-84724/): Command injection in Red Hat Ansible Automation Platform 2.5 for RHEL 8 (medium 6.6)
- [CVE-2026-84721](https://insights.sbomify.com/CVE-2026-84721/): Server-side request forgery in Red Hat Ansible Automation Platform 2 (medium 6.4)
- [CVE-2026-84720](https://insights.sbomify.com/CVE-2026-84720/): Information disclosure in Red Hat Ansible Automation Platform 2.5 for RHEL 8 (medium 6.5)
- [CVE-2026-8472](https://insights.sbomify.com/CVE-2026-8472/): Missing Authorization in GitLab (medium 4.3)
- [CVE-2026-84719](https://insights.sbomify.com/CVE-2026-84719/): Missing authorization in Red Hat Ansible Automation Platform 2.4 for RHEL 8 (critical 9.9)
- [CVE-2026-84718](https://insights.sbomify.com/CVE-2026-84718/): Security feature bypass in Red Hat Ansible Automation Platform 2.5 for RHEL 8 (medium 4.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/312/