# Vulnerabilities published in 2026


- [CVE-2026-73356](https://insights.sbomify.com/CVE-2026-73356/): WordPress Breeze plugin <= 2.5.12 - Arbitrary Content Deletion vulnerability (high 8.2)
- [CVE-2026-73355](https://insights.sbomify.com/CVE-2026-73355/): WordPress Affiliates Manager plugin <= 2.9.53 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-73354](https://insights.sbomify.com/CVE-2026-73354/): WordPress SimplyRETS Real Estate IDX plugin <= 3.2.8 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-73353](https://insights.sbomify.com/CVE-2026-73353/): WordPress Revolut Gateway for WooCommerce plugin < 4.22.10 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-73352](https://insights.sbomify.com/CVE-2026-73352/): WordPress GiveWP plugin <= 4.16.5.1 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-73351](https://insights.sbomify.com/CVE-2026-73351/): WordPress WordPress Social Login and Register plugin <= 7.8.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-73350](https://insights.sbomify.com/CVE-2026-73350/): WordPress SupportCandy plugin <= 3.5.1 - Broken Authentication vulnerability (high 8.2)
- [CVE-2026-7335](https://insights.sbomify.com/CVE-2026-7335/): Use after free in Chrome (high 8.8)
- [CVE-2026-73349](https://insights.sbomify.com/CVE-2026-73349/): WordPress GiveWP plugin < 4.16.6 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-73348](https://insights.sbomify.com/CVE-2026-73348/): WordPress GiveWP plugin < 4.16.6 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-73347](https://insights.sbomify.com/CVE-2026-73347/): WordPress TrueBooker plugin <= 1.2.6 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2026-73346](https://insights.sbomify.com/CVE-2026-73346/): WordPress MailChimp For WooCommerce plugin < 6.2 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-73345](https://insights.sbomify.com/CVE-2026-73345/): WordPress License Manager for WooCommerce plugin <= 3.0.18 - SQL Injection vulnerability (high 7.1)
- [CVE-2026-73344](https://insights.sbomify.com/CVE-2026-73344/): WordPress WP Data Access plugin <= 5.5.79 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2026-73343](https://insights.sbomify.com/CVE-2026-73343/): WordPress WP Compress plugin < 7.20.01 - Remote Code Execution (RCE) vulnerability (critical 10.0)
- [CVE-2026-73342](https://insights.sbomify.com/CVE-2026-73342/): WordPress WP Multilang plugin <= 2.4.31 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-73341](https://insights.sbomify.com/CVE-2026-73341/): WordPress RegistrationMagic plugin <= 6.0.9.7 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-73340](https://insights.sbomify.com/CVE-2026-73340/): WordPress Featured Image from URL plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-7334](https://insights.sbomify.com/CVE-2026-7334/): Use after free in Chrome (high 8.8)
- [CVE-2026-73339](https://insights.sbomify.com/CVE-2026-73339/): WordPress Modern Events Calendar plugin < 7.35.0 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-73338](https://insights.sbomify.com/CVE-2026-73338/): WordPress Autopay plugin <= 5.0.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-73337](https://insights.sbomify.com/CVE-2026-73337/): Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 (high 8.2)
- [CVE-2026-73336](https://insights.sbomify.com/CVE-2026-73336/): Joomla! Core - [20260806] - XSS through schema.org outputs in Joomla 5.1.0-5.4.7, 6.0.0-6.1.2 (medium 5.1)
- [CVE-2026-73335](https://insights.sbomify.com/CVE-2026-73335/): Missing authorization in Android App "Myna Point" (medium 4.6)
- [CVE-2026-73334](https://insights.sbomify.com/CVE-2026-73334/): Apache Parquet Hadoop: File-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation (high 8.1)
- [CVE-2026-73332](https://insights.sbomify.com/CVE-2026-73332/): CamaleonCMS cama_contact_form Plugin Stored XSS via before_html Field (critical 9.2)
- [CVE-2026-73331](https://insights.sbomify.com/CVE-2026-73331/): CamaleonCMS 2.9.1 Authenticated SQL Injection via Post Slug Field (high 7.1)
- [CVE-2026-73330](https://insights.sbomify.com/CVE-2026-73330/): CamaleonCMS 2.9.1 Server-Side Template Injection via test_email Action (high 7.5)
- [CVE-2026-7333](https://insights.sbomify.com/CVE-2026-7333/): Use after free in Chrome (critical 9.6)
- [CVE-2026-73329](https://insights.sbomify.com/CVE-2026-73329/): CamaleonCMS Stored XSS via Draft Post Title Creation Endpoint (critical 9.2)
- [CVE-2026-73326](https://insights.sbomify.com/CVE-2026-73326/): CamaleonCMS Missing Authorization via Plugin Administration Endpoints (high 7.2)
- [CVE-2026-73325](https://insights.sbomify.com/CVE-2026-73325/): Fujitsu OneCompression < 1.2.1 Arbitrary Code Execution via torch.load Deserialization (high 8.4)
- [CVE-2026-73324](https://insights.sbomify.com/CVE-2026-73324/): VLC media player 3.0.0 through 3.0.23 information disclosure vulnerability (medium 5.3)
- [CVE-2026-73321](https://insights.sbomify.com/CVE-2026-73321/): XenForo < 2.3.13 Uncontrolled Recursion DoS via BBCode Parser (high 7.1)
- [CVE-2026-73320](https://insights.sbomify.com/CVE-2026-73320/): XenForo < 2.3.13 Unauthenticated Information Disclosure via Unfurl Endpoint (medium 5.1)
- [CVE-2026-7332](https://insights.sbomify.com/CVE-2026-7332/): LatePoint <= 5.5.0 - Unauthenticated Stored Cross-Site Scripting via 'booking_form_page_url' Parameter (high 7.2)
- [CVE-2026-73319](https://insights.sbomify.com/CVE-2026-73319/): XenForo < 2.3.13 XSS via Dynamic Redirect Handler (medium 5.1)
- [CVE-2026-73318](https://insights.sbomify.com/CVE-2026-73318/): XenForo < 2.3.13 Missing Authorization via force-agreement Controller (medium 5.1)
- [CVE-2026-73317](https://insights.sbomify.com/CVE-2026-73317/): XenForo < 2.3.13 Missing Authorization via ACP Cache-Rebuild Dispatcher (medium 5.1)
- [CVE-2026-73316](https://insights.sbomify.com/CVE-2026-73316/): XenForo < 2.3.13 Payment Replay via PayPal REST Payment Provider (high 8.7)
- [CVE-2026-73315](https://insights.sbomify.com/CVE-2026-73315/): XenForo < 2.3.13 SSRF via PayPal REST Webhook Handler (high 7.7)
- [CVE-2026-73314](https://insights.sbomify.com/CVE-2026-73314/): XenForo < 2.3.13 Signature Verification Bypass via PayPal REST Webhook (high 8.7)
- [CVE-2026-73313](https://insights.sbomify.com/CVE-2026-73313/): XenForo < 2.3.13 MFA Bypass via Passkey TFA Provider (high 7.6)
- [CVE-2026-73312](https://insights.sbomify.com/CVE-2026-73312/): XenForo < 2.3.13 Refresh Token Replay via Expired Access Token (critical 9.1)
- [CVE-2026-73311](https://insights.sbomify.com/CVE-2026-73311/): XenForo < 2.3.13 OAuth2 Authorization Code Reuse (critical 9.1)
- [CVE-2026-73310](https://insights.sbomify.com/CVE-2026-73310/): XenForo < 2.3.13 OAuth2 Authorization Code Token Theft via redirect_uri Bypass (high 8.2)
- [CVE-2026-73309](https://insights.sbomify.com/CVE-2026-73309/): XenForo < 2.3.13 Authentication Bypass via OAuth2 Token Endpoint (critical 9.1)
- [CVE-2026-73308](https://insights.sbomify.com/CVE-2026-73308/): Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders (medium 5.7)
- [CVE-2026-73307](https://insights.sbomify.com/CVE-2026-73307/): Budibase: SSRF via bare fetch() in uploadUrl during AI table generation (medium 4.9)
- [CVE-2026-73306](https://insights.sbomify.com/CVE-2026-73306/): Budibase: Account Enumeration via Login Lockout Response Differential (medium 5.3)
- [CVE-2026-73305](https://insights.sbomify.com/CVE-2026-73305/): Budibase: Privilege escalation via public role assignment API missing app-level authorization (high 8.8)
- [CVE-2026-73304](https://insights.sbomify.com/CVE-2026-73304/): Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users (medium 4.9)
- [CVE-2026-73303](https://insights.sbomify.com/CVE-2026-73303/): Budibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session) (high 8.2)
- [CVE-2026-73302](https://insights.sbomify.com/CVE-2026-73302/): Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified (critical 9.0)
- [CVE-2026-73301](https://insights.sbomify.com/CVE-2026-73301/): Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings (medium 4.3)
- [CVE-2026-73300](https://insights.sbomify.com/CVE-2026-73300/): Budibase: SQL Injection via `multipleStatements: true` (critical 9.6)
- [CVE-2026-7330](https://insights.sbomify.com/CVE-2026-7330/): Auto Affiliate Links <= 6.8.8 - Unauthenticated Stored Cross-Site Scripting via 'url' Parameter (high 7.2)
- [CVE-2026-73299](https://insights.sbomify.com/CVE-2026-73299/): Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer (critical 10.0)
- [CVE-2026-73298](https://insights.sbomify.com/CVE-2026-73298/): Microsoft Container Migration Solution Accelerator: Authenticated IDOR allowing read/write/delete processes (high 8.7)
- [CVE-2026-73297](https://insights.sbomify.com/CVE-2026-73297/): Microsoft UFO: IPv6 transition address bypass of SSRF guard in URL validation (medium 6.9)
- [CVE-2026-73296](https://insights.sbomify.com/CVE-2026-73296/): Microsoft UFO: Unauthenticated Mobile MCP access allows remote Android device control and screen disclosure (critical 9.4)
- [CVE-2026-73295](https://insights.sbomify.com/CVE-2026-73295/): Material for MkDocs: DOM XSS in search suggestions via query parameter (medium 5.4)
- [CVE-2026-73294](https://insights.sbomify.com/CVE-2026-73294/): Semaphore U: OS Command Injection (critical 9.9)
- [CVE-2026-73293](https://insights.sbomify.com/CVE-2026-73293/): Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision (high 8.8)
- [CVE-2026-73292](https://insights.sbomify.com/CVE-2026-73292/): Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation (high 8.3)
- [CVE-2026-73291](https://insights.sbomify.com/CVE-2026-73291/): Seerr: Path traversal to RCE via /avatarproxy image cache filename from upstream ETag (high 7.1)
- [CVE-2026-73290](https://insights.sbomify.com/CVE-2026-73290/): RustFS: Anonymous ListObjectVersions bypasses RestrictPublicBuckets through the ListBucket fallback (medium 5.3)
- [CVE-2026-7329](https://insights.sbomify.com/CVE-2026-7329/): Privilege escalation in Progress MarkLogic Server REST query interfaces (critical 9.9)
- [CVE-2026-73289](https://insights.sbomify.com/CVE-2026-73289/): RustFS: ForAllValues/ForAnyValue negated string conditions are transposed, inverting IAM and bucket-policy decisions (high 8.1)
- [CVE-2026-73288](https://insights.sbomify.com/CVE-2026-73288/): Security feature bypass in rustfs (medium 6.1)
- [CVE-2026-73287](https://insights.sbomify.com/CVE-2026-73287/): RustFS: FTPS MKD bypasses IAM CreateBucket authorization (medium 5.4)
- [CVE-2026-73286](https://insights.sbomify.com/CVE-2026-73286/): Security feature bypass in rustfs (high 8.1)
- [CVE-2026-73285](https://insights.sbomify.com/CVE-2026-73285/): Auth bypass in rustfs (high 7.5)
- [CVE-2026-73284](https://insights.sbomify.com/CVE-2026-73284/): RustFS: AddServiceAccount Handler Allows Creation of Root-Parent Service Accounts (high 8.8)
- [CVE-2026-73283](https://insights.sbomify.com/CVE-2026-73283/): Security feature bypass in OpenSSH (low 2.5)
- [CVE-2026-73282](https://insights.sbomify.com/CVE-2026-73282/): Use after free in OpenSSH (medium 4.8)
- [CVE-2026-73281](https://insights.sbomify.com/CVE-2026-73281/): Security feature bypass in OpenSSH (low 3.5)
- [CVE-2026-7328](https://insights.sbomify.com/CVE-2026-7328/): Unverified AXI Address in Subsystem Mode Commands Enables Denial of Service (medium 6.8)
- [CVE-2026-73278](https://insights.sbomify.com/CVE-2026-73278/): Gitea WebAuthn bypass during OAuth and OIDC sign-in (critical 9.8)
- [CVE-2026-73276](https://insights.sbomify.com/CVE-2026-73276/): inets, httpd: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping i (high 8.3)
- [CVE-2026-73273](https://insights.sbomify.com/CVE-2026-73273/): Gitea Maven checksum upload quota bypass and memory exhaustion (medium 4.3)
- [CVE-2026-73270](https://insights.sbomify.com/CVE-2026-73270/): httpd mod_auth directory protection bypassed by request path casing on case-insensitive filesystems (high 8.2)
- [CVE-2026-7327](https://insights.sbomify.com/CVE-2026-7327/): Privilege escalation in Progress MarkLogic Server REST API document processing (high 8.1)
- [CVE-2026-73269](https://insights.sbomify.com/CVE-2026-73269/): Privilege escalation in multicluster engine for Kubernetes 2.10 (critical 9.9)
- [CVE-2026-73268](https://insights.sbomify.com/CVE-2026-73268/): Cluster-curator-controller: cluster-curator-controller: spec.install.overridejob allows arbitrary job spec injection (critical 9.9)
- [CVE-2026-73267](https://insights.sbomify.com/CVE-2026-73267/): Missing authorization in multicluster engine for Kubernetes 2.10 (high 7.7)
- [CVE-2026-73266](https://insights.sbomify.com/CVE-2026-73266/): Privilege escalation in multicluster engine for Kubernetes 2.10 (high 7.1)
- [CVE-2026-73265](https://insights.sbomify.com/CVE-2026-73265/): RustFS: Version-specific object reads authorize the non-version action (medium 6.5)
- [CVE-2026-73264](https://insights.sbomify.com/CVE-2026-73264/): Prowler: Server-Side Request Forgery (SSRF) in Lighthouse Provider (high 7.6)
- [CVE-2026-73263](https://insights.sbomify.com/CVE-2026-73263/): Prowler: RCE on Prowler App workers via kubeconfig auth-provider cmd-path (critical 9.9)
- [CVE-2026-73262](https://insights.sbomify.com/CVE-2026-73262/): Prowler: Stored XSS in HTML reports through unescaped cloud resource tags (medium 5.4)
- [CVE-2026-73261](https://insights.sbomify.com/CVE-2026-73261/): Memory corruption in mongoose (high 7.5)
- [CVE-2026-73260](https://insights.sbomify.com/CVE-2026-73260/): Mongoose: Out-of-bounds Read via length-counter underflow in built-in TLS X.509 DER parser (high 7.5)
- [CVE-2026-7326](https://insights.sbomify.com/CVE-2026-7326/): Cross-site request forgery in Progress MarkLogic Server Admin UI (high 7.5)
- [CVE-2026-73259](https://insights.sbomify.com/CVE-2026-73259/): Mongoose: Reflected XSS via decoded URI in directory listing render (medium 5.4)
- [CVE-2026-73258](https://insights.sbomify.com/CVE-2026-73258/): Mongoose: Multipart boundary/header scan logic error in mg_http_next_multipart (medium 6.5)
- [CVE-2026-73257](https://insights.sbomify.com/CVE-2026-73257/): Mongoose: Content-Length + Transfer-Encoding coexistence enables request smuggling (critical 9.1)
- [CVE-2026-73256](https://insights.sbomify.com/CVE-2026-73256/): Mongoose: HTTP/1.0 detection off-by-one enables request smuggling via chunked TE (critical 9.1)
- [CVE-2026-73255](https://insights.sbomify.com/CVE-2026-73255/): Mongoose: Path traversal in SSI #include directives enables arbitrary file read (medium 6.5)
- [CVE-2026-73254](https://insights.sbomify.com/CVE-2026-73254/): Mongoose: Stored XSS via unescaped filenames in directory listing (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/402/