# Vulnerabilities published in 2026


- [CVE-2026-78292](https://insights.sbomify.com/CVE-2026-78292/): WordPress Hash Form plugin <= 1.4.1 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-78291](https://insights.sbomify.com/CVE-2026-78291/): WordPress RepairBuddy plugin <= 4.1223 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-78290](https://insights.sbomify.com/CVE-2026-78290/): WordPress Magazine Blocks plugin <= 1.8.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-7829](https://insights.sbomify.com/CVE-2026-7829/): UltraVNC repeater authenticated out-of-bounds write in rule parser via oversized token (high 7.2)
- [CVE-2026-78289](https://insights.sbomify.com/CVE-2026-78289/): WordPress CozyStay theme <= 1.10.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-78288](https://insights.sbomify.com/CVE-2026-78288/): WordPress Beautiful Taxonomy Filters plugin <= 2.4.6 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-78286](https://insights.sbomify.com/CVE-2026-78286/): WordPress Geo Controller plugin <= 8.9.8 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-78285](https://insights.sbomify.com/CVE-2026-78285/): WordPress Like Button Rating plugin <= 2.6.61 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-78284](https://insights.sbomify.com/CVE-2026-78284/): WordPress MasterStudy LMS plugin <= 3.7.42 - Arbitrary File Deletion vulnerability (high 8.6)
- [CVE-2026-78283](https://insights.sbomify.com/CVE-2026-78283/): WordPress Music Player for WooCommerce plugin <= 1.8.9 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-78282](https://insights.sbomify.com/CVE-2026-78282/): WordPress Stripe Payments plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-78281](https://insights.sbomify.com/CVE-2026-78281/): WordPress CP Media Player plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-78280](https://insights.sbomify.com/CVE-2026-78280/): WordPress Hash Form plugin <= 1.4.0 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2026-7828](https://insights.sbomify.com/CVE-2026-7828/): UltraVNC repeater integer overflow in win_log malloc leading to heap overflow (medium 5.3)
- [CVE-2026-78279](https://insights.sbomify.com/CVE-2026-78279/): WordPress Fluent Support Pro plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2026-78278](https://insights.sbomify.com/CVE-2026-78278/): WordPress Fluent Boards Pro plugin <= 2.0.11 - Insecure Direct Object References (IDOR) vulnerability (medium 5.3)
- [CVE-2026-78277](https://insights.sbomify.com/CVE-2026-78277/): WordPress FluentCRM Pro plugin <= 3.1.12 - Server Side Request Forgery (SSRF) vulnerability (medium 4.9)
- [CVE-2026-78276](https://insights.sbomify.com/CVE-2026-78276/): WordPress Fluent Boards Pro plugin <= 2.0.11 - PHP Object Injection vulnerability (high 7.2)
- [CVE-2026-78275](https://insights.sbomify.com/CVE-2026-78275/): WordPress Fluent Boards Pro plugin <= 2.0.11 - Arbitrary File Deletion vulnerability (medium 6.8)
- [CVE-2026-78274](https://insights.sbomify.com/CVE-2026-78274/): WordPress Fluent Boards Pro plugin <= 2.0.11 - Arbitrary File Upload vulnerability (critical 9.1)
- [CVE-2026-78273](https://insights.sbomify.com/CVE-2026-78273/): WordPress Fluent Boards Pro plugin <= 2.0.11 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-78272](https://insights.sbomify.com/CVE-2026-78272/): WordPress Fluent Support Pro plugin <= 2.3.1 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-78271](https://insights.sbomify.com/CVE-2026-78271/): WordPress FluentCRM Pro plugin <= 3.1.12 - Privilege Escalation vulnerability (high 7.2)
- [CVE-2026-78270](https://insights.sbomify.com/CVE-2026-78270/): WordPress FluentCRM Pro plugin <= 3.1.12 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-7827](https://insights.sbomify.com/CVE-2026-7827/): Stack-based buffer overflow in FalkorDB _RdbLoadEntity via unbounded property count in crafted RDB (critical 9.2)
- [CVE-2026-78269](https://insights.sbomify.com/CVE-2026-78269/): WordPress Shared Files plugin <= 1.7.69 - Server Side Request Forgery (SSRF) vulnerability (medium 6.4)
- [CVE-2026-78268](https://insights.sbomify.com/CVE-2026-78268/): Information disclosure in Lead Generation Contact Widget &amp; AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads (high 7.5)
- [CVE-2026-78267](https://insights.sbomify.com/CVE-2026-78267/): WordPress TranslatePress plugin <= 3.3.2 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2026-78266](https://insights.sbomify.com/CVE-2026-78266/): WordPress AutomatorWP plugin <= 5.8.3 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-78265](https://insights.sbomify.com/CVE-2026-78265/): WordPress The Events Calendar plugin <= 6.17.2 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-78264](https://insights.sbomify.com/CVE-2026-78264/): WordPress Toolset Blocks plugin <= 1.6.26 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-78263](https://insights.sbomify.com/CVE-2026-78263/): WordPress Event Tickets plugin <= 5.29.2.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-78262](https://insights.sbomify.com/CVE-2026-78262/): WordPress WP Project Manager plugin <= 4.0.6 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-78261](https://insights.sbomify.com/CVE-2026-78261/): WordPress Realtyna Organic IDX plugin plugin <= 5.4.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-78260](https://insights.sbomify.com/CVE-2026-78260/): WordPress Epayco plugin <= 8.4.6 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-7826](https://insights.sbomify.com/CVE-2026-7826/): Heap out-of-bounds read in FalkorDB BufferSerializerIOv2_ReadBuffer via crafted RDB (high 8.8)
- [CVE-2026-78259](https://insights.sbomify.com/CVE-2026-78259/): WordPress WPLegalPages plugin <= 3.7.0 - Broken Authentication vulnerability (high 7.3)
- [CVE-2026-78258](https://insights.sbomify.com/CVE-2026-78258/): WordPress Booking and Rental Manager plugin <= 2.7.5 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-78257](https://insights.sbomify.com/CVE-2026-78257/): WordPress Booking and Rental Manager plugin <= 2.7.5 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-78255](https://insights.sbomify.com/CVE-2026-78255/): DJI Drone HTTP Media Server Allows Unauthenticated Access to Stored Media (high 8.7)
- [CVE-2026-78254](https://insights.sbomify.com/CVE-2026-78254/): Apache Ant: Path traversal in ftp and scp tasks allows arbitrary file write (high 7.4)
- [CVE-2026-78253](https://insights.sbomify.com/CVE-2026-78253/): Denial-of-service (stack-exhaustion) vulnerability in QXmlStreamReader::readElementText() impacts Qt (low 2.3)
- [CVE-2026-78252](https://insights.sbomify.com/CVE-2026-78252/): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (high 8.2)
- [CVE-2026-78251](https://insights.sbomify.com/CVE-2026-78251/): DJI Drone FTP Service Allows Unrestricted Storage Consumption of the /blackbox Directory (critical 9.3)
- [CVE-2026-78250](https://insights.sbomify.com/CVE-2026-78250/): bytebot-ai bytebot Agent Execution Workflow infinite loop (medium 5.3)
- [CVE-2026-78249](https://insights.sbomify.com/CVE-2026-78249/): Path traversal in Apeos 3060 / 2560 / 1860 Japan model (medium 6.8)
- [CVE-2026-78248](https://insights.sbomify.com/CVE-2026-78248/): SourceCodester Simple Online Food Ordering System ajax.php save_settings sql injection (medium 6.9)
- [CVE-2026-78247](https://insights.sbomify.com/CVE-2026-78247/): SourceCodester Simple Online Food Ordering System ajax.php confirm_order sql injection (medium 6.9)
- [CVE-2026-78246](https://insights.sbomify.com/CVE-2026-78246/): itsourcecode Online Clinic Management System Admin Login login.php sql injection (medium 6.9)
- [CVE-2026-78245](https://insights.sbomify.com/CVE-2026-78245/): itsourcecode Online Pharmacy System User Registration register.php move_uploaded_file unrestricted upload (medium 6.9)
- [CVE-2026-78244](https://insights.sbomify.com/CVE-2026-78244/): itsourcecode Real Estate Management System search.php sql injection (medium 6.9)
- [CVE-2026-78243](https://insights.sbomify.com/CVE-2026-78243/): Apache YuniKorn: LDAP Group provider panics on lowercase attribute name (low 2.1)
- [CVE-2026-78242](https://insights.sbomify.com/CVE-2026-78242/): Apache APISIX: data-mask may fail to redact request headers in logger output (medium 5.7)
- [CVE-2026-7824](https://insights.sbomify.com/CVE-2026-7824/): PaperCut Hive (Ricoh): Plain text password in logs (medium 5.9)
- [CVE-2026-78239](https://insights.sbomify.com/CVE-2026-78239/): Xiiaozet LK100W Missing Authentication for Critical Function (critical 9.3)
- [CVE-2026-78238](https://insights.sbomify.com/CVE-2026-78238/): Cross-site scripting in SOY Gallery (medium 4.8)
- [CVE-2026-78237](https://insights.sbomify.com/CVE-2026-78237/): Insufficient input validation in Admin By Request (ABR) (high 7.8)
- [CVE-2026-78236](https://insights.sbomify.com/CVE-2026-78236/): Insecure PIN derivation mechanism in Admin By Request (ABR) (high 8.8)
- [CVE-2026-78234](https://insights.sbomify.com/CVE-2026-78234/): Privilege escalation in Red Hat build of Apache Camel - HawtIO 4 (critical 9.9)
- [CVE-2026-78231](https://insights.sbomify.com/CVE-2026-78231/): Gitea blind SSRF through OpenID assertion verification (medium 5.3)
- [CVE-2026-78230](https://insights.sbomify.com/CVE-2026-78230/): AshAi aggregate tool can read field-policy-protected fields (medium 6.0)
- [CVE-2026-7823](https://insights.sbomify.com/CVE-2026-7823/): Totolink A8000RU cstecgi.cgi setAppFilterCfg os command injection (critical 9.3)
- [CVE-2026-78229](https://insights.sbomify.com/CVE-2026-78229/): Command injection in Image Scanner Driver for Linux (SP Series) (medium 5.4)
- [CVE-2026-78228](https://insights.sbomify.com/CVE-2026-78228/): Unbounded handle_error recursion enables denial of service in AshOban triggers (medium 5.9)
- [CVE-2026-78227](https://insights.sbomify.com/CVE-2026-78227/): Use-after-free in DoQ stream output buffer on reset re-transmission (medium 6.5)
- [CVE-2026-78225](https://insights.sbomify.com/CVE-2026-78225/): Wärtsilä FOS-Onboard Use of Hard-coded Cryptographic Key (critical 9.5)
- [CVE-2026-78224](https://insights.sbomify.com/CVE-2026-78224/): NextGen Healthcare Mirth Connect Improper Restriction of XML External Entity Reference (high 8.8)
- [CVE-2026-78223](https://insights.sbomify.com/CVE-2026-78223/): Token revocation record built from unverified JWT claims in AshAuthentication (medium 6.9)
- [CVE-2026-78222](https://insights.sbomify.com/CVE-2026-78222/): NGINX ngx_http_js_module vulnerability (high 8.7)
- [CVE-2026-78221](https://insights.sbomify.com/CVE-2026-78221/): Memory corruption in OpenVPN (medium 5.9)
- [CVE-2026-7822](https://insights.sbomify.com/CVE-2026-7822/): itsourcecode Courier Management System print_pdets.php sql injection (medium 5.3)
- [CVE-2026-78216](https://insights.sbomify.com/CVE-2026-78216/): AshLua eval read operations can read field-policy-protected fields via aggregates (medium 6.0)
- [CVE-2026-78214](https://insights.sbomify.com/CVE-2026-78214/): Apache DolphinScheduler: Actuator Endpoint Authentication Bypass via Percent-Encoded Paths (medium 5.3)
- [CVE-2026-78213](https://insights.sbomify.com/CVE-2026-78213/): Hepta Platforms｜Heptabase - Stored Cross-Site Scripting (medium 6.2)
- [CVE-2026-78212](https://insights.sbomify.com/CVE-2026-78212/): 4MOSAn Security Technology｜4MOSAn Management Center - Arbitrary File Read (high 8.7)
- [CVE-2026-78211](https://insights.sbomify.com/CVE-2026-78211/): 4MOSAn Security Technology｜4MOSAn GCB Doctor - OS Command Injection (critical 9.3)
- [CVE-2026-78210](https://insights.sbomify.com/CVE-2026-78210/): Missing authorization in Octopus Server (high 7.1)
- [CVE-2026-7821](https://insights.sbomify.com/CVE-2026-7821/): Security feature bypass in Endpoint Manager Mobile (high 7.4)
- [CVE-2026-78209](https://insights.sbomify.com/CVE-2026-78209/): exceljs through 4.4.0 CSV Formula Injection via Unescaped Cell Values (high 8.4)
- [CVE-2026-78208](https://insights.sbomify.com/CVE-2026-78208/): exceljs through 4.4.0 Path Traversal via Unvalidated addImage filename (high 8.7)
- [CVE-2026-78207](https://insights.sbomify.com/CVE-2026-78207/): exceljs through 4.4.0 Prototype Pollution via deepMerge Reached From Note Serialization (critical 9.3)
- [CVE-2026-78206](https://insights.sbomify.com/CVE-2026-78206/): exceljs through 4.4.0 Uncontrolled Resource Consumption via Unbounded xlsx Decompression (high 8.7)
- [CVE-2026-78205](https://insights.sbomify.com/CVE-2026-78205/): BentoML 1.4.19 through 1.4.39 Server-Side Request Forgery via Unfiltered RFC 6598 Shared Address Space (medium 6.9)
- [CVE-2026-78204](https://insights.sbomify.com/CVE-2026-78204/): Ghostwriter through 7.2.6 Missing Authorization on Report Template Lint Endpoints (medium 5.3)
- [CVE-2026-78203](https://insights.sbomify.com/CVE-2026-78203/): Ghostwriter before 7.1.2 Cross-Client Report Template Disclosure via Unauthorized Template Swap (high 7.1)
- [CVE-2026-78202](https://insights.sbomify.com/CVE-2026-78202/): itsourcecode Payroll System admin_class.php save_settings unrestricted upload (medium 6.9)
- [CVE-2026-78201](https://insights.sbomify.com/CVE-2026-78201/): itsourcecode Payroll System admin_class.php login sql injection (medium 6.9)
- [CVE-2026-78200](https://insights.sbomify.com/CVE-2026-78200/): itsourcecode Library Management System editbooks.php sql injection (medium 5.3)
- [CVE-2026-7820](https://insights.sbomify.com/CVE-2026-7820/): pgAdmin 4: Account-lockout bypass via Flask-Security default /login view (medium 6.9)
- [CVE-2026-78199](https://insights.sbomify.com/CVE-2026-78199/): SourceCodester Simple Online Food Ordering System view_prod.php sql injection (medium 6.9)
- [CVE-2026-78198](https://insights.sbomify.com/CVE-2026-78198/): SourceCodester Simple Online Food Ordering System ajax.php add_to_cart sql injection (medium 6.9)
- [CVE-2026-78197](https://insights.sbomify.com/CVE-2026-78197/): SourceCodester Simple Online Food Ordering System ajax.php save_user sql injection (medium 6.9)
- [CVE-2026-78196](https://insights.sbomify.com/CVE-2026-78196/): achorein expo-share-intent Android File Copy Routine ExpoShareIntentModule.kt getDataColumn path traversal (medium 4.8)
- [CVE-2026-78193](https://insights.sbomify.com/CVE-2026-78193/): JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated SQL Injection (high 7.5)
- [CVE-2026-7819](https://insights.sbomify.com/CVE-2026-7819/): pgAdmin 4: Symbolic-link path traversal in File Manager allows arbitrary file write (high 7.2)
- [CVE-2026-78187](https://insights.sbomify.com/CVE-2026-78187/): Piwigo Public Authentication cross site scripting (low 2.3)
- [CVE-2026-78186](https://insights.sbomify.com/CVE-2026-78186/): Open5GS HSS hss-cx-path.c assertion (medium 5.3)
- [CVE-2026-78185](https://insights.sbomify.com/CVE-2026-78185/): itsourcecode Sales and Inventory System cust_edit.php sql injection (medium 5.3)
- [CVE-2026-78183](https://insights.sbomify.com/CVE-2026-78183/): DBD::Pg version 3.21.0 for Perl has a heap out-of-bounds write in quote_float (critical 9.8)
- [CVE-2026-78182](https://insights.sbomify.com/CVE-2026-78182/): SQL injection in XBROTHER Dynamic Environment Monitoring System (medium 6.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/364/