# Vulnerabilities published in 2026


- [CVE-2026-81353](https://insights.sbomify.com/CVE-2026-81353/): HEIF Image Extensions Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-81352](https://insights.sbomify.com/CVE-2026-81352/): Web Media Extensions Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-8135](https://insights.sbomify.com/CVE-2026-8135/): Concrete CMS Vulnerable to Deserialization of Untrusted Data (high 8.9)
- [CVE-2026-81349](https://insights.sbomify.com/CVE-2026-81349/): Azure HDInsight Ambari Elevation of Privilege Vulnerability (high 7.2)
- [CVE-2026-81348](https://insights.sbomify.com/CVE-2026-81348/): My Private Site < 4.2.3 - Unauthenticated Sensitive Information Exposure via RSS Feeds and Sitemap (low 3.7)
- [CVE-2026-81347](https://insights.sbomify.com/CVE-2026-81347/): Path traversal in Frontend Admin by DynamiApps (medium 5.9)
- [CVE-2026-81346](https://insights.sbomify.com/CVE-2026-81346/): Frontend Admin by DynamiApps < 3.29.11 - Subscriber+ Arbitrary Membership Plan Deletion (medium 4.3)
- [CVE-2026-81344](https://insights.sbomify.com/CVE-2026-81344/): Frontend Admin by DynamiApps <= 3.29.13 - Admin+ PHP Object Injection (medium 6.6)
- [CVE-2026-81343](https://insights.sbomify.com/CVE-2026-81343/): Frontend Admin by DynamiApps <= 3.29.13 - Unauthenticated ACF Options Page Field Update via Form Submission (medium 5.3)
- [CVE-2026-81342](https://insights.sbomify.com/CVE-2026-81342/): MasterStudy LMS < 3.7.43 - Unauthenticated Open Redirect (medium 4.7)
- [CVE-2026-81341](https://insights.sbomify.com/CVE-2026-81341/): wolfEngine reuses the AES-CCM nonce on TLS 1.2 / DTLS 1.2 records (medium 6.5)
- [CVE-2026-81340](https://insights.sbomify.com/CVE-2026-81340/): MasterStudy LMS < 3.7.50 - Instructor+ Order Status Manipulation via IDOR (low 3.8)
- [CVE-2026-8134](https://insights.sbomify.com/CVE-2026-8134/): Concrete CMS Vulnerable to Relative Path Traversal (critical 9.4)
- [CVE-2026-81339](https://insights.sbomify.com/CVE-2026-81339/): MasterStudy LMS < 3.7.50 - Subscriber+ Quiz Attempt Grade Disclosure via IDOR (medium 4.3)
- [CVE-2026-81338](https://insights.sbomify.com/CVE-2026-81338/): MasterStudy LMS < 3.7.50 - Subscriber+ Stored HTML Injection via Course Discussions (medium 4.6)
- [CVE-2026-81335](https://insights.sbomify.com/CVE-2026-81335/): Baserow before 2.3.1 Unauthenticated Data Disclosure via Discarded Permission Check on Builder Data Sources (high 8.7)
- [CVE-2026-81334](https://insights.sbomify.com/CVE-2026-81334/): darknet through 6.0 Out-of-Bounds Read and Write via Unchecked Layer Index in .cfg Parser (medium 6.9)
- [CVE-2026-81330](https://insights.sbomify.com/CVE-2026-81330/): Softish C6 Ear Camera and EarVision Android Application Cleartext transmission of sensitive information (high 7.1)
- [CVE-2026-8133](https://insights.sbomify.com/CVE-2026-8133/): zyx0814 FilePress Shares Filelist API admin.php sql injection (medium 6.9)
- [CVE-2026-81326](https://insights.sbomify.com/CVE-2026-81326/): Hardcoded credentials in QND Advance (medium 6.8)
- [CVE-2026-81322](https://insights.sbomify.com/CVE-2026-81322/): Cloaked plaintext leaks through a non-sensitive action argument in AshCloak (low 2.1)
- [CVE-2026-81321](https://insights.sbomify.com/CVE-2026-81321/): CareCam CM2507 Cleartext Storage of Sensitive Information (critical 9.3)
- [CVE-2026-81320](https://insights.sbomify.com/CVE-2026-81320/): Hawtio-operator: hawtio-operator: tls private key written to operator log at debug level (medium 5.5)
- [CVE-2026-8132](https://insights.sbomify.com/CVE-2026-8132/): CodeAstro Leave Management System login.php sql injection (medium 6.9)
- [CVE-2026-81319](https://insights.sbomify.com/CVE-2026-81319/): Unsafe deserialization of decrypted terms enables node DoS in AshCloak (medium 5.9)
- [CVE-2026-81318](https://insights.sbomify.com/CVE-2026-81318/): Distinct-query aggregate drops the tenant schema prefix, leaking across tenants in AshSql (low 2.1)
- [CVE-2026-81316](https://insights.sbomify.com/CVE-2026-81316/): Same-named aggregates with differing filters are conflated in AshSql (low 2.1)
- [CVE-2026-81315](https://insights.sbomify.com/CVE-2026-81315/): MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header (high 7.4)
- [CVE-2026-81310](https://insights.sbomify.com/CVE-2026-81310/): Path traversal in Image Scanner Driver for Linux (SP Series) (medium 5.2)
- [CVE-2026-8131](https://insights.sbomify.com/CVE-2026-8131/): SourceCodester SUP Online Shopping replymsg.php sql injection (medium 6.9)
- [CVE-2026-81305](https://insights.sbomify.com/CVE-2026-81305/): CareCam CM2507 Inclusion of Functionality from Untrusted Control Sphere (high 7.0)
- [CVE-2026-81303](https://insights.sbomify.com/CVE-2026-81303/): Hawtio-operator: hawtio-operator: routes/custom-host confused-deputy via spec.routehostname (medium 6.3)
- [CVE-2026-81302](https://insights.sbomify.com/CVE-2026-81302/): Misconfiguration in PALLET CONTROL (high 8.5)
- [CVE-2026-81301](https://insights.sbomify.com/CVE-2026-81301/): Ekia File Manager 1.2.7 - Exported ContentProvider allows unauthorized file access (high 8.5)
- [CVE-2026-81300](https://insights.sbomify.com/CVE-2026-81300/): WordPress Calculation For Contact Form 7 plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-8130](https://insights.sbomify.com/CVE-2026-8130/): SourceCodester SUP Online Shopping message.php sql injection (medium 6.9)
- [CVE-2026-81299](https://insights.sbomify.com/CVE-2026-81299/): WordPress WP Job Portal plugin <= 2.5.9 - Insecure Direct Object References (IDOR) vulnerability (medium 4.3)
- [CVE-2026-81298](https://insights.sbomify.com/CVE-2026-81298/): WordPress LeadConnector plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-81297](https://insights.sbomify.com/CVE-2026-81297/): WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Privilege Escalation vulnerability (high 7.5)
- [CVE-2026-81296](https://insights.sbomify.com/CVE-2026-81296/): WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-81295](https://insights.sbomify.com/CVE-2026-81295/): WordPress Under Construction plugin <= 5.82 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-81294](https://insights.sbomify.com/CVE-2026-81294/): WordPress Authorizer plugin <= 3.15.1 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2026-81293](https://insights.sbomify.com/CVE-2026-81293/): WordPress WP Data Access plugin <= 5.5.81 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-81292](https://insights.sbomify.com/CVE-2026-81292/): WordPress Simple Payment plugin <= 2.5.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-81291](https://insights.sbomify.com/CVE-2026-81291/): WordPress Uncode theme <= 2.12.7 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-81290](https://insights.sbomify.com/CVE-2026-81290/): WordPress Email Subscribers & Newsletters plugin <= 5.9.33 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-8129](https://insights.sbomify.com/CVE-2026-8129/): SourceCodester SUP Online Shopping wishlist.php sql injection (medium 6.9)
- [CVE-2026-81289](https://insights.sbomify.com/CVE-2026-81289/): Cross-site scripting in MP3 Audio Player for Music, Radio & Podcast by Sonaar (high 7.1)
- [CVE-2026-81288](https://insights.sbomify.com/CVE-2026-81288/): WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-81287](https://insights.sbomify.com/CVE-2026-81287/): WordPress Charitable plugin <= 1.8.12.1 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-81286](https://insights.sbomify.com/CVE-2026-81286/): WordPress WCFM Marketplace plugin <= 3.8.1 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-81285](https://insights.sbomify.com/CVE-2026-81285/): WordPress Smush Image Compression and Optimization plugin <= 4.2.0 - Denial of Service Attack vulnerability (high 7.5)
- [CVE-2026-81284](https://insights.sbomify.com/CVE-2026-81284/): WordPress ACF Extended plugin <= 0.9.2.6 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-81283](https://insights.sbomify.com/CVE-2026-81283/): WordPress WP User Frontend plugin <= 4.3.10 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-81282](https://insights.sbomify.com/CVE-2026-81282/): WordPress Product Variations Swatches for WooCommerce plugin <= 1.1.18 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-81281](https://insights.sbomify.com/CVE-2026-81281/): WordPress Graphene theme <= 2.9.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-81280](https://insights.sbomify.com/CVE-2026-81280/): Information disclosure in Print Barcode Labels for your WooCommerce products/orders (medium 6.5)
- [CVE-2026-8128](https://insights.sbomify.com/CVE-2026-8128/): SourceCodester SUP Online Shopping viewmsg.php sql injection (medium 6.9)
- [CVE-2026-81279](https://insights.sbomify.com/CVE-2026-81279/): WordPress Push Notification for Post and BuddyPress plugin <= 3.20 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-81278](https://insights.sbomify.com/CVE-2026-81278/): WordPress Post SMTP plugin 4.0.0-beta.1 - Settings Change vulnerability (medium 5.4)
- [CVE-2026-81277](https://insights.sbomify.com/CVE-2026-81277/): WordPress Suggestion Engine for WooCommerce plugin <= 2.0.11 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-81276](https://insights.sbomify.com/CVE-2026-81276/): WordPress Kali Forms plugin <= 2.4.23 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-81275](https://insights.sbomify.com/CVE-2026-81275/): WordPress Youzify plugin <= 1.3.7 - Arbitrary File Download vulnerability (medium 6.5)
- [CVE-2026-81274](https://insights.sbomify.com/CVE-2026-81274/): WordPress Ditty plugin <= 3.1.67 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-81273](https://insights.sbomify.com/CVE-2026-81273/): WordPress FluentBooking Pro plugin <= 2.2.4 - Cross Site Request Forgery (CSRF) vulnerability (high 8.1)
- [CVE-2026-81272](https://insights.sbomify.com/CVE-2026-81272/): WordPress FluentPlayer Pro plugin <= 1.3.2 - Broken Access Control vulnerability (medium 4.9)
- [CVE-2026-81271](https://insights.sbomify.com/CVE-2026-81271/): WordPress GeoDirectory plugin <= 2.8.176 - Cross Site Request Forgery (CSRF) vulnerability (high 8.8)
- [CVE-2026-81270](https://insights.sbomify.com/CVE-2026-81270/): Apache Allura: Information exposure via search (high 7.5)
- [CVE-2026-8127](https://insights.sbomify.com/CVE-2026-8127/): eladmin Users API Endpoint UserController.java checkLevel access control (medium 5.3)
- [CVE-2026-81269](https://insights.sbomify.com/CVE-2026-81269/): Data field - Moderately critical - Information disclosure - SA-CONTRIB-2026-108 (medium 5.3)
- [CVE-2026-81268](https://insights.sbomify.com/CVE-2026-81268/): Langflow is vulnerable to authentication bypass and insufficient session expiration (high 8.1)
- [CVE-2026-81267](https://insights.sbomify.com/CVE-2026-81267/): Stalled popup navigation could allow address bar origin spoofing in Firefox for iOS (medium 5.4)
- [CVE-2026-81265](https://insights.sbomify.com/CVE-2026-81265/): Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches (high 7.5)
- [CVE-2026-8126](https://insights.sbomify.com/CVE-2026-8126/): SourceCodester Comment System post_comment.php sql injection (medium 6.9)
- [CVE-2026-8125](https://insights.sbomify.com/CVE-2026-8125/): code-projects Simple Chat System sendMessage.php sql injection (medium 5.3)
- [CVE-2026-81240](https://insights.sbomify.com/CVE-2026-81240/): File upload in Wyse Management Suite (high 8.6)
- [CVE-2026-8124](https://insights.sbomify.com/CVE-2026-8124/): GPAC box_code_base.c sidx_box_read allocation of resources (medium 4.8)
- [CVE-2026-81239](https://insights.sbomify.com/CVE-2026-81239/): File upload in Wyse Management Suite (high 8.6)
- [CVE-2026-81238](https://insights.sbomify.com/CVE-2026-81238/): Auth bypass in Wyse Management Suite (high 7.5)
- [CVE-2026-81237](https://insights.sbomify.com/CVE-2026-81237/): Auth bypass in Wyse Management Suite (medium 6.5)
- [CVE-2026-81236](https://insights.sbomify.com/CVE-2026-81236/): File upload in Wyse Management Suite (high 8.6)
- [CVE-2026-81235](https://insights.sbomify.com/CVE-2026-81235/): Weak cryptography in Wyse Management Suite (high 8.0)
- [CVE-2026-8123](https://insights.sbomify.com/CVE-2026-8123/): Open5GS NSSF message.c ogs_sbi_discovery_option_add_snssais denial of service (medium 5.3)
- [CVE-2026-8122](https://insights.sbomify.com/CVE-2026-8122/): Open5GS NSSF message.c ogs_sbi_discovery_option_add_service_names denial of service (medium 5.3)
- [CVE-2026-81213](https://insights.sbomify.com/CVE-2026-81213/): Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches (high 8.6)
- [CVE-2026-81212](https://insights.sbomify.com/CVE-2026-81212/): DataStage on Cloud Pak for Data Improper Authorization (critical 10.0)
- [CVE-2026-81211](https://insights.sbomify.com/CVE-2026-81211/): Missing authorization in Langflow OSS (high 8.8)
- [CVE-2026-81210](https://insights.sbomify.com/CVE-2026-81210/): DataStage on Cloud Pak for Data has several vulnerabilities due to open source software (high 7.7)
- [CVE-2026-8121](https://insights.sbomify.com/CVE-2026-8121/): Open5GS NSSF conv.c ogs_sbi_parse_plmn_list denial of service (medium 5.3)
- [CVE-2026-81208](https://insights.sbomify.com/CVE-2026-81208/): DataStage on Cloud Pak for Data has several vulnerabilities (high 7.7)
- [CVE-2026-81207](https://insights.sbomify.com/CVE-2026-81207/): DataStage on Cloud Pak for Data has several vulnerabilities due to open source software (high 8.5)
- [CVE-2026-81205](https://insights.sbomify.com/CVE-2026-81205/): LDAP / Active Directory Integration - Moderately critical - Information Disclosure - SA-CONTRIB-2026-115 (medium 5.3)
- [CVE-2026-81204](https://insights.sbomify.com/CVE-2026-81204/): Code injection in Langflow OSS (critical 9.8)
- [CVE-2026-81203](https://insights.sbomify.com/CVE-2026-81203/): SourceCodester Simple Online Food Ordering System ajax.php login2 sql injection (medium 6.9)
- [CVE-2026-81202](https://insights.sbomify.com/CVE-2026-81202/): itsourcecode Payroll System CRUD Operation ajax.php delete missing authentication (medium 6.9)
- [CVE-2026-81201](https://insights.sbomify.com/CVE-2026-81201/): Monster Menus - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-116 (medium 6.1)
- [CVE-2026-81200](https://insights.sbomify.com/CVE-2026-81200/): MasterStudy LMS < 3.7.42 - Instructor+ Cross-Tenant Order Billing PII Disclosure via IDOR (low 2.7)
- [CVE-2026-8120](https://insights.sbomify.com/CVE-2026-8120/): Open5GS NSSF nnssf-handler.c denial of service (medium 5.3)
- [CVE-2026-81199](https://insights.sbomify.com/CVE-2026-81199/): MasterStudy LMS < 3.7.46 - Unauthenticated Student Statistics Disclosure via student/stats REST Route (medium 5.3)
- [CVE-2026-81198](https://insights.sbomify.com/CVE-2026-81198/): MasterStudy LMS < 3.7.46 - Instructor+ Cross-Course Curriculum Deletion and Tampering via IDOR (low 3.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/342/