# Vulnerabilities published in 2026


- [CVE-2026-81784](https://insights.sbomify.com/CVE-2026-81784/): WordPress Wise Chat plugin <= 3.4.2 - PHP Object Injection vulnerability (high 8.1)
- [CVE-2026-81783](https://insights.sbomify.com/CVE-2026-81783/): WordPress MailMunch – Grow your Email List plugin <= 3.2.5 - Broken Authentication vulnerability (high 7.1)
- [CVE-2026-81782](https://insights.sbomify.com/CVE-2026-81782/): WordPress WP Docs plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-81781](https://insights.sbomify.com/CVE-2026-81781/): WordPress Unbounce Landing Pages plugin <= 1.1.4 - Broken Access Control vulnerability (high 7.1)
- [CVE-2026-81780](https://insights.sbomify.com/CVE-2026-81780/): WordPress Hash Form plugin <= 1.4.2 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2026-8178](https://insights.sbomify.com/CVE-2026-8178/): Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver (critical 9.2)
- [CVE-2026-81779](https://insights.sbomify.com/CVE-2026-81779/): WordPress Newspapers X theme 1.0.46-1.0.48 - Backdoor vulnerability (critical 10.0)
- [CVE-2026-81778](https://insights.sbomify.com/CVE-2026-81778/): WordPress Kalles Addons plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-81777](https://insights.sbomify.com/CVE-2026-81777/): WordPress Essential Addons for Elementor plugin <= 6.8.0 - Bypass vulnerability vulnerability (medium 5.3)
- [CVE-2026-81776](https://insights.sbomify.com/CVE-2026-81776/): WordPress WP QuickLaTeX plugin <= 3.8.8 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-81775](https://insights.sbomify.com/CVE-2026-81775/): WordPress Estatik plugin <= 4.3.4 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-81774](https://insights.sbomify.com/CVE-2026-81774/): WordPress WooCommerce Product Attachment plugin <= 2.3.4 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2026-81773](https://insights.sbomify.com/CVE-2026-81773/): WordPress Ninja Forms File Uploads Extension plugin <= 3.3.26 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-81772](https://insights.sbomify.com/CVE-2026-81772/): WordPress Ninja Forms - Layout & Styles plugin <= 3.0.31 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-81771](https://insights.sbomify.com/CVE-2026-81771/): WordPress TrustedSite plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-81770](https://insights.sbomify.com/CVE-2026-81770/): WordPress Interactive Geo Maps plugin <= 1.6.30 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-8177](https://insights.sbomify.com/CVE-2026-8177/): Memory corruption in XML::LibXML (high 7.5)
- [CVE-2026-81769](https://insights.sbomify.com/CVE-2026-81769/): WordPress Booking Hub plugin <= 1.3.1 - Privilege Escalation vulnerability (high 8.8)
- [CVE-2026-81768](https://insights.sbomify.com/CVE-2026-81768/): WordPress Super Store Finder plugin <= 7.10 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-81767](https://insights.sbomify.com/CVE-2026-81767/): WordPress Simple Payment plugin <= 2.5.2 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-81766](https://insights.sbomify.com/CVE-2026-81766/): Really Simple Security < 9.8.0 - Multisite Subsite Admin+ Arbitrary Plugin Installation via rsp_upgrade_install_plugin (medium 6.6)
- [CVE-2026-81765](https://insights.sbomify.com/CVE-2026-81765/): WordPress Tailored Tools plugin <= 3.0.2 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-81764](https://insights.sbomify.com/CVE-2026-81764/): WordPress Email Essentials plugin <= 6.0.6 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-81763](https://insights.sbomify.com/CVE-2026-81763/): WordPress Throws SPAM Away plugin <= 3.8.2 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-81762](https://insights.sbomify.com/CVE-2026-81762/): WordPress Booking and Rental Manager plugin <= 2.7.6 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-81761](https://insights.sbomify.com/CVE-2026-81761/): WordPress WpEvently plugin <= 5.5.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-81760](https://insights.sbomify.com/CVE-2026-81760/): WordPress JetEngine plugin <= 3.8.14.2 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-8176](https://insights.sbomify.com/CVE-2026-8176/): Privilege escalation in LatePoint – Calendar Booking Plugin for Appointments and Events (high 7.5)
- [CVE-2026-81759](https://insights.sbomify.com/CVE-2026-81759/): WordPress WpEvently plugin <= 5.5.0 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-81758](https://insights.sbomify.com/CVE-2026-81758/): WordPress OwnerRez API plugin <= 1.2.6 - Broken Access Control vulnerability (medium 6.3)
- [CVE-2026-81757](https://insights.sbomify.com/CVE-2026-81757/): WordPress Rank Math SEO plugin <= 1.0.276 - Remote Code Execution (RCE) vulnerability (high 7.2)
- [CVE-2026-81756](https://insights.sbomify.com/CVE-2026-81756/): WordPress Smart Marketing SMS and Newsletters Forms plugin <= 5.1.24 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-81755](https://insights.sbomify.com/CVE-2026-81755/): Apache bRPC: Uncontrolled Resource Consumption via Excessive Streams in a Single RPC Request (not scored)
- [CVE-2026-81754](https://insights.sbomify.com/CVE-2026-81754/): Vigilant <= 2.10.2 - Unauthenticated Stored Cross-Site Scripting (high 7.2)
- [CVE-2026-81753](https://insights.sbomify.com/CVE-2026-81753/): Flowintel Stored XSS in Case Notes via Malicious Mermaid Diagram Content (medium 5.1)
- [CVE-2026-8175](https://insights.sbomify.com/CVE-2026-8175/): Multiple vulnerabilities in Aspera applications. (critical 9.8)
- [CVE-2026-81743](https://insights.sbomify.com/CVE-2026-81743/): Flowintel Arbitrary Log File Path Allows Remote Code Execution via Template Injection (high 7.5)
- [CVE-2026-81742](https://insights.sbomify.com/CVE-2026-81742/): BE REST Endpoints <= 1.0.0 - Unauthenticated Stored XSS and Widget Manipulation (high 8.8)
- [CVE-2026-81741](https://insights.sbomify.com/CVE-2026-81741/): Groundhogg < 4.7.2 - Open Redirect via 'redirect_to' Parameter (medium 4.7)
- [CVE-2026-81740](https://insights.sbomify.com/CVE-2026-81740/): Paytm Payment Gateway < 2.8.9 - Unauthenticated Order Status Manipulation via Payment Callback (medium 5.3)
- [CVE-2026-8174](https://insights.sbomify.com/CVE-2026-8174/): Cross-site Request Forgery (medium 5.7)
- [CVE-2026-81739](https://insights.sbomify.com/CVE-2026-81739/): Paytm Payment Gateway < 2.8.9 - Unauthenticated Stored XSS via Payment Callback (high 7.5)
- [CVE-2026-81738](https://insights.sbomify.com/CVE-2026-81738/): Memory corruption in OpenVPN (low 2.3)
- [CVE-2026-81737](https://insights.sbomify.com/CVE-2026-81737/): FAQ Builder AYS 1.6.3 - 1.8.4 - Unauthenticated Stored XSS via ays_get_user_information (high 8.8)
- [CVE-2026-81736](https://insights.sbomify.com/CVE-2026-81736/): Remote CPU denial of service through cached SVCB/HTTPS AliasMode trees (high 7.5)
- [CVE-2026-81735](https://insights.sbomify.com/CVE-2026-81735/): Missing authorization in UI-TARS-desktop (critical 10.0)
- [CVE-2026-81733](https://insights.sbomify.com/CVE-2026-81733/): WWBN AVideo through 30.0 CSRF via myLiveControls.save.json.php (medium 5.1)
- [CVE-2026-81732](https://insights.sbomify.com/CVE-2026-81732/): WWBN AVideo through 30.0 Information Disclosure via report4.json.php (medium 6.9)
- [CVE-2026-81731](https://insights.sbomify.com/CVE-2026-81731/): Frappe 15.11.0 through 16.32.0 Stored XSS via Workspace Link Description (medium 5.1)
- [CVE-2026-81730](https://insights.sbomify.com/CVE-2026-81730/): Dolibarr 9.0.0 through 23.0.4 Path Traversal via EmailCollector Attachment Filename (high 8.8)
- [CVE-2026-8173](https://insights.sbomify.com/CVE-2026-8173/): Information Disclosure via 'Copy learned MAC Addresses' Function (medium 5.3)
- [CVE-2026-81729](https://insights.sbomify.com/CVE-2026-81729/): Dolibarr before 23.0.4 Incorrect Authorization on REST API Document Deletion (high 7.1)
- [CVE-2026-81728](https://insights.sbomify.com/CVE-2026-81728/): Dolibarr before 24.0.0 SQL Injection via the CSV and XLSX Import Update Keys (high 8.6)
- [CVE-2026-81727](https://insights.sbomify.com/CVE-2026-81727/): NLTK before 3.10.3 Hardlink File Overwrite via downloader (medium 6.9)
- [CVE-2026-81726](https://insights.sbomify.com/CVE-2026-81726/): NLTK through 3.10.3 Path Traversal via Model-Artifact APIs (high 8.3)
- [CVE-2026-81725](https://insights.sbomify.com/CVE-2026-81725/): NLTK before 3.10.3 Regular Expression Denial of Service via Pl196xCorpusReader (medium 6.3)
- [CVE-2026-81724](https://insights.sbomify.com/CVE-2026-81724/): NLTK before 3.10.3 Denial of Service via Uncontrolled Recursion (medium 6.9)
- [CVE-2026-81723](https://insights.sbomify.com/CVE-2026-81723/): NLTK before 3.10.3 Quadratic CPU Exhaustion via XMLCorpusView (medium 6.3)
- [CVE-2026-81722](https://insights.sbomify.com/CVE-2026-81722/): nltk PorterStemmer before 3.10.3 Quadratic-time DoS (high 8.7)
- [CVE-2026-81721](https://insights.sbomify.com/CVE-2026-81721/): openssl_encrypt before 1.4.9 Denial of Service via KDF (high 8.7)
- [CVE-2026-81720](https://insights.sbomify.com/CVE-2026-81720/): openssl_encrypt before 1.4.9 Denial of Service via Unbounded Argon2 (medium 6.9)
- [CVE-2026-8172](https://insights.sbomify.com/CVE-2026-8172/): Simple Basic Contact Form <= 20250114 - Reflected XSS (high 7.1)
- [CVE-2026-81719](https://insights.sbomify.com/CVE-2026-81719/): openssl_encrypt before 1.4.9 Remote Code Execution via Plugin (critical 9.3)
- [CVE-2026-81718](https://insights.sbomify.com/CVE-2026-81718/): openssl_encrypt before 1.4.9 Weak Cryptographic Parameters (high 8.7)
- [CVE-2026-81717](https://insights.sbomify.com/CVE-2026-81717/): openssl_encrypt before 1.4.9 Integrity Bypass via Added Files (critical 9.3)
- [CVE-2026-81716](https://insights.sbomify.com/CVE-2026-81716/): openssl_encrypt before 1.4.9 Plugin Sandbox Path Traversal (high 8.7)
- [CVE-2026-81715](https://insights.sbomify.com/CVE-2026-81715/): openssl_encrypt before 1.4.9 Credential Exposure via Debug Output (high 8.7)
- [CVE-2026-81714](https://insights.sbomify.com/CVE-2026-81714/): openssl_encrypt before 1.4.9 Plugin Signing Trust Anchor Enrollment Bypass (critical 9.3)
- [CVE-2026-81707](https://insights.sbomify.com/CVE-2026-81707/): openssl_encrypt before 1.4.9 ANSI Escape Injection via Identity Email (critical 9.3)
- [CVE-2026-81706](https://insights.sbomify.com/CVE-2026-81706/): openssl_encrypt before 1.4.9 Key Substitution via Identity Shadowing (critical 9.3)
- [CVE-2026-81705](https://insights.sbomify.com/CVE-2026-81705/): openssl-encrypt before 1.4.9 Password Cleartext Leak via Debug (high 8.7)
- [CVE-2026-81704](https://insights.sbomify.com/CVE-2026-81704/): openssl_encrypt before 1.4.9 Weak Key Derivation via D-Bus (high 8.7)
- [CVE-2026-81703](https://insights.sbomify.com/CVE-2026-81703/): openssl_encrypt before 1.4.9 Authentication Bypass via Unencrypted PQC Key (high 8.7)
- [CVE-2026-81702](https://insights.sbomify.com/CVE-2026-81702/): openssl_encrypt before 1.4.9 Key Substitution via Identity Load (critical 9.3)
- [CVE-2026-81701](https://insights.sbomify.com/CVE-2026-81701/): openssl_encrypt before 1.4.9 Arbitrary Code Execution via unsigned plugin (critical 9.3)
- [CVE-2026-81700](https://insights.sbomify.com/CVE-2026-81700/): openssl_encrypt before 1.4.9 GPG Signature Verification Bypass (critical 9.3)
- [CVE-2026-8170](https://insights.sbomify.com/CVE-2026-8170/): ExtremeXOS Privilege Escalation via Symlink Following in File Utilities (high 8.7)
- [CVE-2026-81699](https://insights.sbomify.com/CVE-2026-81699/): openssl_encrypt before 1.4.9 Denial of Service via unbounded KDF cost (high 8.7)
- [CVE-2026-81698](https://insights.sbomify.com/CVE-2026-81698/): openssl_encrypt before 1.4.9 Shell Injection via info command (critical 9.3)
- [CVE-2026-81697](https://insights.sbomify.com/CVE-2026-81697/): openssl_encrypt before 1.4.9 KDF Downgrade via CWD-relative Configuration (high 8.7)
- [CVE-2026-81696](https://insights.sbomify.com/CVE-2026-81696/): openssl_encrypt before 1.4.9 Terminal Injection via info Command (critical 9.3)
- [CVE-2026-81695](https://insights.sbomify.com/CVE-2026-81695/): openssl_encrypt before 1.4.9 Terminal Injection via key_id (critical 9.3)
- [CVE-2026-81694](https://insights.sbomify.com/CVE-2026-81694/): openssl-encrypt before 1.4.9 Output Injection via Unsanitized Filenames in verify-usb Command (critical 9.3)
- [CVE-2026-81693](https://insights.sbomify.com/CVE-2026-81693/): openssl_encrypt before 1.4.9 Denial of Service via QR total field (high 8.7)
- [CVE-2026-81692](https://insights.sbomify.com/CVE-2026-81692/): openssl_encrypt before 1.4.9 Denial of Service via STREAMINFO (high 8.7)
- [CVE-2026-81691](https://insights.sbomify.com/CVE-2026-81691/): openssl_encrypt before 1.4.9 Credential Leakage via Unvalidated Server URLs (high 8.7)
- [CVE-2026-81690](https://insights.sbomify.com/CVE-2026-81690/): verify-usb before 1.4.9 Symlink Directory Traversal Code Execution (high 8.7)
- [CVE-2026-8169](https://insights.sbomify.com/CVE-2026-8169/): ExtremeXOS Debug-Mode Privilege Escalation via Weak PRNG (high 8.7)
- [CVE-2026-81689](https://insights.sbomify.com/CVE-2026-81689/): openssl_encrypt before 1.4.9 Weak Pepper Key Derivation (high 8.7)
- [CVE-2026-81688](https://insights.sbomify.com/CVE-2026-81688/): openssl_encrypt before 1.4.9 Plaintext Confirmation Oracle via SHA-256 (high 8.7)
- [CVE-2026-81687](https://insights.sbomify.com/CVE-2026-81687/): openssl_encrypt before 1.4.9 Denial of Service via KDF (high 8.7)
- [CVE-2026-81686](https://insights.sbomify.com/CVE-2026-81686/): openssl_encrypt before 1.4.9 D-Bus Properties Authorization Bypass (medium 6.9)
- [CVE-2026-81685](https://insights.sbomify.com/CVE-2026-81685/): openssl_encrypt before 1.4.9 Text Injection via Recovery Slot Metadata (critical 9.3)
- [CVE-2026-81684](https://insights.sbomify.com/CVE-2026-81684/): openssl_encrypt before 1.4.9 Information Disclosure via Command Line (medium 6.9)
- [CVE-2026-81683](https://insights.sbomify.com/CVE-2026-81683/): openssl_encrypt before 1.4.9 Plaintext Private Key Storage (high 8.6)
- [CVE-2026-81682](https://insights.sbomify.com/CVE-2026-81682/): openssl_encrypt before 1.4.9 Insecure File Permissions (high 8.6)
- [CVE-2026-81681](https://insights.sbomify.com/CVE-2026-81681/): openssl_encrypt before 1.4.9 False Encryption via Cleartext Storage (critical 9.3)
- [CVE-2026-81680](https://insights.sbomify.com/CVE-2026-81680/): openssl_encrypt before 1.4.9 Authentication Bypass via Recovery Slot Removal (critical 9.3)
- [CVE-2026-8168](https://insights.sbomify.com/CVE-2026-8168/): Denial-of-service vulnerability in the SVG parser and renderer impacts Qt (high 7.1)
- [CVE-2026-81679](https://insights.sbomify.com/CVE-2026-81679/): OpenRemote before 1.28.0 Cross-Realm Information Disclosure via Notification API (high 8.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/339/