# Vulnerabilities published in 2026


- [CVE-2026-74007](https://insights.sbomify.com/CVE-2026-74007/): Information disclosure in 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery (medium 5.3)
- [CVE-2026-74006](https://insights.sbomify.com/CVE-2026-74006/): WordPress WP Table Builder plugin <= 2.2.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-74005](https://insights.sbomify.com/CVE-2026-74005/): WordPress PublishPress Series plugin <= 3.1.3 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2026-74004](https://insights.sbomify.com/CVE-2026-74004/): Missing authorization in Gravity Booster &#8211; Styles &amp; Layouts for Gravity Forms (medium 5.4)
- [CVE-2026-74003](https://insights.sbomify.com/CVE-2026-74003/): WordPress RomethemeForm For Elementor plugin <= 1.2.6 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-74002](https://insights.sbomify.com/CVE-2026-74002/): WordPress Booking Calendar plugin <= 11.7 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-74001](https://insights.sbomify.com/CVE-2026-74001/): WordPress User Registration & Membership Pro plugin <= 5.4.5 - Account Takeover vulnerability (critical 9.8)
- [CVE-2026-74000](https://insights.sbomify.com/CVE-2026-74000/): WordPress Simple Membership plugin <= 4.8.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-7400](https://insights.sbomify.com/CVE-2026-7400/): geekgod382 filesystem-mcp-server read_file_tool/write_file_tool server.py is_path_allowed path traversal (medium 6.9)
- [CVE-2026-73999](https://insights.sbomify.com/CVE-2026-73999/): WordPress Cooked plugin <= 1.16.0 - Insecure Direct Object References (IDOR) vulnerability (medium 5.4)
- [CVE-2026-73998](https://insights.sbomify.com/CVE-2026-73998/): WordPress WP w3all phpBB plugin <= 3.0.5 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-73997](https://insights.sbomify.com/CVE-2026-73997/): WordPress Starter Templates by Kadence WP plugin <= 2.3.3 - Denial of Service Attack vulnerability (high 7.5)
- [CVE-2026-73996](https://insights.sbomify.com/CVE-2026-73996/): WordPress Masteriyo - LMS plugin <= 2.3.2 - Arbitrary File Upload vulnerability (critical 9.8)
- [CVE-2026-73995](https://insights.sbomify.com/CVE-2026-73995/): WordPress User Registration plugin <= 5.2.6 - Broken Authentication vulnerability (medium 5.4)
- [CVE-2026-73994](https://insights.sbomify.com/CVE-2026-73994/): WordPress Charitable plugin <= 1.8.11.3 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-73993](https://insights.sbomify.com/CVE-2026-73993/): WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-73992](https://insights.sbomify.com/CVE-2026-73992/): WordPress Query Wrangler plugin <= 1.5.57 - Remote Code Execution (RCE) vulnerability (critical 9.9)
- [CVE-2026-7399](https://insights.sbomify.com/CVE-2026-7399/): IDOR in MeWare Software's PDKS (high 8.1)
- [CVE-2026-7398](https://insights.sbomify.com/CVE-2026-7398/): florensiawidjaja BioinfoMCP Upload Endpoint app.py upload path traversal (medium 6.9)
- [CVE-2026-73976](https://insights.sbomify.com/CVE-2026-73976/): djehuty: Unauthenticated SPARQL injection in the search API (`order`, `operator`, `key`) (high 7.1)
- [CVE-2026-73975](https://insights.sbomify.com/CVE-2026-73975/): djehuty: Authenticated SPARQL injection in session editing allows writing arbitrary RDF triples (high 8.4)
- [CVE-2026-73974](https://insights.sbomify.com/CVE-2026-73974/): linuxfabrik-lib: Arbitrary root file read via live --test argument (lib.lftest) across sudoers-whitelisted plugins (LPE) (medium 5.5)
- [CVE-2026-73973](https://insights.sbomify.com/CVE-2026-73973/): Path traversal in monitoring-plugins (medium 5.5)
- [CVE-2026-7397](https://insights.sbomify.com/CVE-2026-7397/): NousResearch hermes-agent file_tools.py _check_sensitive_path symlink (medium 4.8)
- [CVE-2026-73966](https://insights.sbomify.com/CVE-2026-73966/): Missing authorization in Siebel Apps - Marketing (high 7.2)
- [CVE-2026-73965](https://insights.sbomify.com/CVE-2026-73965/): Missing authorization in Siebel CRM Deployment (medium 6.8)
- [CVE-2026-73964](https://insights.sbomify.com/CVE-2026-73964/): Information disclosure in Oracle Database Server (low 2.7)
- [CVE-2026-73963](https://insights.sbomify.com/CVE-2026-73963/): Auth bypass in Oracle WebCenter Portal (critical 9.8)
- [CVE-2026-73962](https://insights.sbomify.com/CVE-2026-73962/): Missing authorization in Oracle Access Manager (critical 9.6)
- [CVE-2026-73961](https://insights.sbomify.com/CVE-2026-73961/): Auth bypass in Oracle JDeveloper (critical 9.8)
- [CVE-2026-73960](https://insights.sbomify.com/CVE-2026-73960/): Denial of service in PeopleSoft Enterprise PeopleTools (high 7.5)
- [CVE-2026-7396](https://insights.sbomify.com/CVE-2026-7396/): NousResearch hermes-agent WeChat Work Platform Adapter wecom.py path traversal (medium 6.9)
- [CVE-2026-73959](https://insights.sbomify.com/CVE-2026-73959/): Missing authorization in Oracle WebCenter Portal (high 8.8)
- [CVE-2026-73958](https://insights.sbomify.com/CVE-2026-73958/): Missing authorization in Oracle Access Manager (high 8.1)
- [CVE-2026-73957](https://insights.sbomify.com/CVE-2026-73957/): Missing authorization in Oracle WebCenter Portal (critical 9.3)
- [CVE-2026-73956](https://insights.sbomify.com/CVE-2026-73956/): Auth bypass in Oracle WebCenter Portal (critical 9.8)
- [CVE-2026-73955](https://insights.sbomify.com/CVE-2026-73955/): Missing authorization in PeopleSoft Enterprise PeopleTools (high 7.3)
- [CVE-2026-73954](https://insights.sbomify.com/CVE-2026-73954/): Missing authorization in PeopleSoft Enterprise PeopleTools (high 8.1)
- [CVE-2026-73953](https://insights.sbomify.com/CVE-2026-73953/): Auth bypass in Oracle WebCenter Portal (critical 9.8)
- [CVE-2026-73952](https://insights.sbomify.com/CVE-2026-73952/): Auth bypass in Oracle WebCenter Portal (critical 9.1)
- [CVE-2026-73951](https://insights.sbomify.com/CVE-2026-73951/): Missing authorization in Oracle WebCenter Portal (high 8.1)
- [CVE-2026-73950](https://insights.sbomify.com/CVE-2026-73950/): Auth bypass in Oracle Access Manager (critical 9.8)
- [CVE-2026-7395](https://insights.sbomify.com/CVE-2026-7395/): Missing authorization in Asset Suite (high 8.5)
- [CVE-2026-73949](https://insights.sbomify.com/CVE-2026-73949/): Missing authorization in Oracle WebCenter Portal (high 8.8)
- [CVE-2026-73948](https://insights.sbomify.com/CVE-2026-73948/): Missing authorization in Oracle WebCenter Portal (critical 9.9)
- [CVE-2026-73947](https://insights.sbomify.com/CVE-2026-73947/): Auth bypass in Oracle Access Manager (critical 9.8)
- [CVE-2026-73946](https://insights.sbomify.com/CVE-2026-73946/): Missing authorization in Oracle Access Manager (critical 9.1)
- [CVE-2026-73945](https://insights.sbomify.com/CVE-2026-73945/): Missing authorization in Oracle Access Manager (critical 9.9)
- [CVE-2026-73944](https://insights.sbomify.com/CVE-2026-73944/): Auth bypass in Oracle Access Manager (critical 9.1)
- [CVE-2026-73943](https://insights.sbomify.com/CVE-2026-73943/): Missing authorization in Oracle Identity Manager (high 7.6)
- [CVE-2026-73942](https://insights.sbomify.com/CVE-2026-73942/): Missing authorization in Oracle Identity Manager (high 8.8)
- [CVE-2026-73941](https://insights.sbomify.com/CVE-2026-73941/): Missing authorization in Oracle Access Manager (high 8.6)
- [CVE-2026-73940](https://insights.sbomify.com/CVE-2026-73940/): Auth bypass in Oracle Access Manager (critical 9.8)
- [CVE-2026-7394](https://insights.sbomify.com/CVE-2026-7394/): SourceCodester Pizzafy Ecommerce System GET Parameter view_order.php sql injection (medium 5.1)
- [CVE-2026-73939](https://insights.sbomify.com/CVE-2026-73939/): Missing authorization in Helidon (high 8.6)
- [CVE-2026-73938](https://insights.sbomify.com/CVE-2026-73938/): Missing authorization in Helidon (high 7.5)
- [CVE-2026-73937](https://insights.sbomify.com/CVE-2026-73937/): Other in Helidon (high 8.2)
- [CVE-2026-73936](https://insights.sbomify.com/CVE-2026-73936/): Denial of service in Helidon (high 7.5)
- [CVE-2026-73935](https://insights.sbomify.com/CVE-2026-73935/): Denial of service in Helidon (high 7.5)
- [CVE-2026-73934](https://insights.sbomify.com/CVE-2026-73934/): Denial of service in Helidon (high 7.5)
- [CVE-2026-73933](https://insights.sbomify.com/CVE-2026-73933/): Missing authorization in Helidon (high 7.3)
- [CVE-2026-73932](https://insights.sbomify.com/CVE-2026-73932/): Denial of service in Helidon (medium 5.3)
- [CVE-2026-73931](https://insights.sbomify.com/CVE-2026-73931/): Missing authorization in Helidon (high 8.3)
- [CVE-2026-73930](https://insights.sbomify.com/CVE-2026-73930/): Missing authorization in Helidon (critical 9.9)
- [CVE-2026-7393](https://insights.sbomify.com/CVE-2026-7393/): SourceCodester Pizzafy Ecommerce System File Extension admin_class_novo.php save_menu unrestricted upload (medium 5.1)
- [CVE-2026-73929](https://insights.sbomify.com/CVE-2026-73929/): Missing authorization in Helidon (high 8.3)
- [CVE-2026-73928](https://insights.sbomify.com/CVE-2026-73928/): Missing authorization in Helidon (high 7.2)
- [CVE-2026-73927](https://insights.sbomify.com/CVE-2026-73927/): Denial of service in Helidon (high 7.5)
- [CVE-2026-73926](https://insights.sbomify.com/CVE-2026-73926/): Missing authorization in Oracle Access Manager (high 8.7)
- [CVE-2026-73925](https://insights.sbomify.com/CVE-2026-73925/): Missing authorization in Helidon (high 8.2)
- [CVE-2026-73924](https://insights.sbomify.com/CVE-2026-73924/): Missing authorization in Helidon (critical 9.1)
- [CVE-2026-73923](https://insights.sbomify.com/CVE-2026-73923/): Missing authorization in Helidon (low 3.7)
- [CVE-2026-73922](https://insights.sbomify.com/CVE-2026-73922/): Missing authorization in Helidon (critical 9.1)
- [CVE-2026-73921](https://insights.sbomify.com/CVE-2026-73921/): Missing authorization in Helidon (critical 9.8)
- [CVE-2026-73920](https://insights.sbomify.com/CVE-2026-73920/): Missing authorization in Helidon (critical 9.4)
- [CVE-2026-7392](https://insights.sbomify.com/CVE-2026-7392/): SourceCodester Pharmacy Sales and Inventory System ajax.php delete_supplier sql injection (medium 5.3)
- [CVE-2026-73919](https://insights.sbomify.com/CVE-2026-73919/): Missing authorization in Helidon (medium 5.4)
- [CVE-2026-73918](https://insights.sbomify.com/CVE-2026-73918/): Missing authorization in Helidon (high 7.3)
- [CVE-2026-73917](https://insights.sbomify.com/CVE-2026-73917/): Missing authorization in Helidon (critical 9.1)
- [CVE-2026-73916](https://insights.sbomify.com/CVE-2026-73916/): Missing authorization in Helidon (critical 9.1)
- [CVE-2026-73915](https://insights.sbomify.com/CVE-2026-73915/): Denial of service in Helidon (high 7.5)
- [CVE-2026-73914](https://insights.sbomify.com/CVE-2026-73914/): Missing authorization in Helidon (medium 6.5)
- [CVE-2026-73913](https://insights.sbomify.com/CVE-2026-73913/): Missing authorization in Helidon (medium 5.4)
- [CVE-2026-73912](https://insights.sbomify.com/CVE-2026-73912/): Missing authorization in Helidon (critical 9.8)
- [CVE-2026-73911](https://insights.sbomify.com/CVE-2026-73911/): Missing authorization in Helidon (medium 5.4)
- [CVE-2026-73910](https://insights.sbomify.com/CVE-2026-73910/): Missing authorization in Helidon (medium 5.3)
- [CVE-2026-7391](https://insights.sbomify.com/CVE-2026-7391/): SourceCodester Pharmacy Sales and Inventory System ajax.php save_supplier sql injection (medium 5.3)
- [CVE-2026-73909](https://insights.sbomify.com/CVE-2026-73909/): Missing authorization in Helidon (medium 5.9)
- [CVE-2026-73908](https://insights.sbomify.com/CVE-2026-73908/): Missing authorization in Helidon (high 7.5)
- [CVE-2026-73907](https://insights.sbomify.com/CVE-2026-73907/): Missing authorization in Helidon (high 7.5)
- [CVE-2026-73906](https://insights.sbomify.com/CVE-2026-73906/): Missing authorization in Helidon (medium 5.3)
- [CVE-2026-73905](https://insights.sbomify.com/CVE-2026-73905/): Missing authorization in Helidon (critical 9.8)
- [CVE-2026-73904](https://insights.sbomify.com/CVE-2026-73904/): Missing authorization in Helidon (medium 6.5)
- [CVE-2026-73903](https://insights.sbomify.com/CVE-2026-73903/): Missing authorization in Helidon (high 7.5)
- [CVE-2026-73902](https://insights.sbomify.com/CVE-2026-73902/): Denial of service in Helidon (high 7.5)
- [CVE-2026-73901](https://insights.sbomify.com/CVE-2026-73901/): Missing authorization in Helidon (medium 4.8)
- [CVE-2026-73900](https://insights.sbomify.com/CVE-2026-73900/): Missing authorization in Helidon (medium 5.3)
- [CVE-2026-7390](https://insights.sbomify.com/CVE-2026-7390/): SourceCodester Pharmacy Sales and Inventory System index.php customer cross site scripting (medium 5.1)
- [CVE-2026-73899](https://insights.sbomify.com/CVE-2026-73899/): Missing authorization in Helidon (medium 5.3)
- [CVE-2026-73898](https://insights.sbomify.com/CVE-2026-73898/): Missing authorization in Helidon (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/396/