# Vulnerabilities published in 2026


- [CVE-2026-65631](https://insights.sbomify.com/CVE-2026-65631/): Denial of service in jose (medium 6.9)
- [CVE-2026-65630](https://insights.sbomify.com/CVE-2026-65630/): Timing side-channel in pure-Erlang X25519 scalar multiplication leaks the private key in jose (medium 5.9)
- [CVE-2026-6563](https://insights.sbomify.com/CVE-2026-6563/): H3C Magic B1 aspForm SetAPWifiorLedInfoById buffer overflow (high 8.7)
- [CVE-2026-65629](https://insights.sbomify.com/CVE-2026-65629/): Weak PBKDF2 parameters for password-encrypted private-key export in jose (high 7.4)
- [CVE-2026-65628](https://insights.sbomify.com/CVE-2026-65628/): Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key types (medium 5.9)
- [CVE-2026-65627](https://insights.sbomify.com/CVE-2026-65627/): Decompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2 (medium 6.9)
- [CVE-2026-65626](https://insights.sbomify.com/CVE-2026-65626/): Bleichenbacher padding oracle in RSAES-PKCS1-v1_5 decryption in jose (medium 5.9)
- [CVE-2026-65625](https://insights.sbomify.com/CVE-2026-65625/): Attacker-controlled AES-GCM authentication tag length allows tag forgery in jose (medium 5.9)
- [CVE-2026-65624](https://insights.sbomify.com/CVE-2026-65624/): Cowboy HTTP/1.1 max_headers Bypass via Duplicate Header Names Enables Memory Exhaustion (medium 6.9)
- [CVE-2026-65623](https://insights.sbomify.com/CVE-2026-65623/): Quadratic CPU blow-up reassembling fragmented WebSocket messages in Bandit (high 8.7)
- [CVE-2026-6562](https://insights.sbomify.com/CVE-2026-6562/): dameng100 muucmf index.html getListByPage sql injection (medium 6.9)
- [CVE-2026-65618](https://insights.sbomify.com/CVE-2026-65618/): Improper URL validation when handling specific URLs Pub, Terraform and Docker packages might lead to SSRF vulnerability (medium 6.5)
- [CVE-2026-65617](https://insights.sbomify.com/CVE-2026-65617/): Potential remote code execution on an Artifactory package service container. (high 8.8)
- [CVE-2026-65616](https://insights.sbomify.com/CVE-2026-65616/): Potential privilege escalation to JFrog administrator privileges (high 8.8)
- [CVE-2026-65613](https://insights.sbomify.com/CVE-2026-65613/): Apache CloudStack: Webhook Deliveries Incorrect Access (medium 4.3)
- [CVE-2026-65612](https://insights.sbomify.com/CVE-2026-65612/): Shell Command Injection in nnn (medium 5.1)
- [CVE-2026-65611](https://insights.sbomify.com/CVE-2026-65611/): Shell Command Injection in nnn (medium 5.1)
- [CVE-2026-65610](https://insights.sbomify.com/CVE-2026-65610/): Numeric Truncation Error in nnn (low 2.4)
- [CVE-2026-6561](https://insights.sbomify.com/CVE-2026-6561/): EyouCMS Index.php edit_adminlogo unrestricted upload (medium 5.1)
- [CVE-2026-65609](https://insights.sbomify.com/CVE-2026-65609/): Out-of-bounds write in nnn (low 2.4)
- [CVE-2026-65608](https://insights.sbomify.com/CVE-2026-65608/): Grav before 2.0.9 Remote Code Execution via FlexDirectory (high 8.7)
- [CVE-2026-65607](https://insights.sbomify.com/CVE-2026-65607/): SiYuan before v3.7.2 Path Traversal via /export/temp/ (high 7.1)
- [CVE-2026-65606](https://insights.sbomify.com/CVE-2026-65606/): SiYuan before v3.7.2 Cross-Site Scripting to RCE (critical 9.4)
- [CVE-2026-65605](https://insights.sbomify.com/CVE-2026-65605/): SiYuan before v3.7.2 Stored XSS to RCE via Attribute View (critical 9.4)
- [CVE-2026-65604](https://insights.sbomify.com/CVE-2026-65604/): Skipper Incomplete Fix for CVE-2026-50197 Policy Bypass (high 8.8)
- [CVE-2026-65603](https://insights.sbomify.com/CVE-2026-65603/): Grav Login Plugin 3.8.11 Privilege Escalation via Profile Update (high 8.7)
- [CVE-2026-65602](https://insights.sbomify.com/CVE-2026-65602/): Traefik before 3.6.23 IngressRouteTCP ServersTransport Namespace Bypass (medium 5.3)
- [CVE-2026-65601](https://insights.sbomify.com/CVE-2026-65601/): Traefik before 3.7.7 Namespace Confusion via HTTPRoute ExtensionRef (medium 5.3)
- [CVE-2026-65600](https://insights.sbomify.com/CVE-2026-65600/): Traefik before v2.11.52 Authentication Bypass via ReplacePathRegex (high 7.8)
- [CVE-2026-6560](https://insights.sbomify.com/CVE-2026-6560/): H3C Magic B0 aspForm Edit_BasicSSID buffer overflow (high 8.7)
- [CVE-2026-65599](https://insights.sbomify.com/CVE-2026-65599/): n8n before 1.123.64, 2.29.8, and 2.30.1 Credential Exposure via JWT Header (medium 5.1)
- [CVE-2026-65598](https://insights.sbomify.com/CVE-2026-65598/): n8n before 1.123.64 Remote Code Execution via Git Clone (high 8.9)
- [CVE-2026-65597](https://insights.sbomify.com/CVE-2026-65597/): n8n before 1.123.64 DOM-Based XSS via Unsandboxed iframe (high 8.2)
- [CVE-2026-65596](https://insights.sbomify.com/CVE-2026-65596/): n8n before 1.123.64 Credential Exfiltration via GraphQL Node (medium 5.1)
- [CVE-2026-65595](https://insights.sbomify.com/CVE-2026-65595/): n8n before 2.29.8 and 2.30.1 Privilege Escalation via Token Exchange (high 8.9)
- [CVE-2026-65594](https://insights.sbomify.com/CVE-2026-65594/): n8n before 2.30.1 Missing OAuth Authorization Check (medium 5.1)
- [CVE-2026-65593](https://insights.sbomify.com/CVE-2026-65593/): n8n before 1.123.64, 2.29.8, and 2.30.1 SSRF via Dynamic Node Parameters (medium 6.3)
- [CVE-2026-65592](https://insights.sbomify.com/CVE-2026-65592/): n8n before 1.123.64 Stored DOM XSS via cachedResultUrl (high 8.4)
- [CVE-2026-65591](https://insights.sbomify.com/CVE-2026-65591/): n8n before 1.123.64 Sanitizer Bypass Remote Code Execution (high 8.9)
- [CVE-2026-65590](https://insights.sbomify.com/CVE-2026-65590/): n8n before 2.30.1 Shell Sandbox Bypass on Linux Windows (medium 5.5)
- [CVE-2026-6559](https://insights.sbomify.com/CVE-2026-6559/): Wavlink WL-WN579A3 login.cgi sub_401F80 cross site scripting (medium 5.3)
- [CVE-2026-65589](https://insights.sbomify.com/CVE-2026-65589/): n8n before 1.123.64 Credential Exposure via LLM Node Execution Data (medium 5.1)
- [CVE-2026-65583](https://insights.sbomify.com/CVE-2026-65583/): Apache CXF: Self-issued ID token claims validation skipped (critical 9.1)
- [CVE-2026-65582](https://insights.sbomify.com/CVE-2026-65582/): WordPress AI Hub theme <= 1.3.10 - Arbitrary File Download vulnerability (high 7.7)
- [CVE-2026-65581](https://insights.sbomify.com/CVE-2026-65581/): WordPress AI ANN theme <= 1.29.0 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-65580](https://insights.sbomify.com/CVE-2026-65580/): WordPress Agrion theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-65579](https://insights.sbomify.com/CVE-2026-65579/): WordPress Agricola theme <= 1.21.0 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-65578](https://insights.sbomify.com/CVE-2026-65578/): WordPress Agora theme <= 1.9 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-65577](https://insights.sbomify.com/CVE-2026-65577/): WordPress Advice theme <= 1.18.0 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-65576](https://insights.sbomify.com/CVE-2026-65576/): WordPress Adrena theme <= 1.2.14 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-65575](https://insights.sbomify.com/CVE-2026-65575/): WordPress Accalia theme <= 1.5.3 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-65574](https://insights.sbomify.com/CVE-2026-65574/): WordPress Abogado theme <= 1.18 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-65573](https://insights.sbomify.com/CVE-2026-65573/): WordPress Abelle theme <= 1.22 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-65572](https://insights.sbomify.com/CVE-2026-65572/): WordPress A.Williams theme <= 1.3.1 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-65571](https://insights.sbomify.com/CVE-2026-65571/): WordPress 69 Clothing theme <= 1.2.11.1 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-65570](https://insights.sbomify.com/CVE-2026-65570/): WordPress Login with phone number plugin <= 1.8.70 - Bypass vulnerability vulnerability (high 8.1)
- [CVE-2026-65569](https://insights.sbomify.com/CVE-2026-65569/): WordPress WP Job Portal plugin <= 2.5.6 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-65568](https://insights.sbomify.com/CVE-2026-65568/): WordPress Visual Composer Website Builder plugin <= 45.15.0 - Broken Access Control vulnerability (medium 5.0)
- [CVE-2026-65567](https://insights.sbomify.com/CVE-2026-65567/): WordPress Event Tickets plugin <= 5.29.0.1 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-65565](https://insights.sbomify.com/CVE-2026-65565/): WordPress Survey Maker plugin <= 5.2.3.3 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-65564](https://insights.sbomify.com/CVE-2026-65564/): WordPress MapPress Maps for WordPress plugin <= 2.97.6 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-65563](https://insights.sbomify.com/CVE-2026-65563/): WordPress Orbit Fox by ThemeIsle plugin <= 3.0.7 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2026-65562](https://insights.sbomify.com/CVE-2026-65562/): WordPress BetterDocs plugin <= 4.6.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-65561](https://insights.sbomify.com/CVE-2026-65561/): WordPress WordPress Social Login and Register plugin <= 7.8.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-65560](https://insights.sbomify.com/CVE-2026-65560/): WordPress Houzez Property Feed plugin <= 2.5.48 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-6556](https://insights.sbomify.com/CVE-2026-6556/): @fastify/express vulnerable to middleware bypass via non-string mount paths in prefixed plugins (critical 9.1)
- [CVE-2026-65559](https://insights.sbomify.com/CVE-2026-65559/): WordPress Order Delivery Date for WooCommerce plugin <= 4.6.0 - Privilege Escalation vulnerability (high 7.2)
- [CVE-2026-65558](https://insights.sbomify.com/CVE-2026-65558/): WordPress AffiliateX plugin <= 2.3.5 - Server Side Request Forgery (SSRF) vulnerability (medium 5.4)
- [CVE-2026-65557](https://insights.sbomify.com/CVE-2026-65557/): WordPress Abandoned Cart Lite for WooCommerce plugin <= 6.8.0 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2026-65556](https://insights.sbomify.com/CVE-2026-65556/): WordPress WPBruiser {no- Captcha anti-Spam} plugin <= 3.1.43 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-65554](https://insights.sbomify.com/CVE-2026-65554/): WordPress AnsPress – Question and answer plugin 4.4.4 - Broken Access Control vulnerability (high 7.1)
- [CVE-2026-65553](https://insights.sbomify.com/CVE-2026-65553/): WordPress Spider Analyser – WordPress搜索引擎蜘蛛分析插件 plugin <= 2.1.3 - Remote Code Execution (RCE) vulnerability (critical 10.0)
- [CVE-2026-65552](https://insights.sbomify.com/CVE-2026-65552/): WordPress Export User Data plugin <= 2.2.6 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-65551](https://insights.sbomify.com/CVE-2026-65551/): WordPress Breakdance plugin < 2.7 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-65550](https://insights.sbomify.com/CVE-2026-65550/): WordPress Tabs plugin <= 2.5 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2026-6555](https://insights.sbomify.com/CVE-2026-6555/): ProSolution WP Client <= 2.0.0 - Unauthenticated Arbitrary File Upload via 'files' (critical 9.8)
- [CVE-2026-65549](https://insights.sbomify.com/CVE-2026-65549/): WordPress Jeg Elementor Kit plugin <= 3.2.10 - PHP Object Injection vulnerability (high 7.2)
- [CVE-2026-65548](https://insights.sbomify.com/CVE-2026-65548/): WordPress Betheme theme <= 28.4.2 - Remote Code Execution (RCE) vulnerability (critical 9.9)
- [CVE-2026-65546](https://insights.sbomify.com/CVE-2026-65546/): WordPress Qode Tours plugin <= 3.1.3.1 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-65545](https://insights.sbomify.com/CVE-2026-65545/): WordPress AI Engine plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-65544](https://insights.sbomify.com/CVE-2026-65544/): WordPress Super Socializer plugin <= 7.14.5 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-65543](https://insights.sbomify.com/CVE-2026-65543/): WordPress Vimeo plugin <= 1.2.2 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2026-65542](https://insights.sbomify.com/CVE-2026-65542/): WordPress Super Socializer plugin <= 7.14.5 - Broken Authentication vulnerability (high 8.8)
- [CVE-2026-65541](https://insights.sbomify.com/CVE-2026-65541/): WordPress Staff Training plugin <= 1.0.7 - Broken Access Control vulnerability (high 7.3)
- [CVE-2026-65540](https://insights.sbomify.com/CVE-2026-65540/): WordPress Popup for CF7 with Sweet Alert plugin <= 1.6.5 - Cross Site Request Forgery (CSRF) vulnerability (high 7.1)
- [CVE-2026-6554](https://insights.sbomify.com/CVE-2026-6554/): infinte loop in libpcap before 1.10.7 (high 7.5)
- [CVE-2026-65539](https://insights.sbomify.com/CVE-2026-65539/): WordPress Kwayy HTML Sitemap plugin <= 4.0 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2026-65538](https://insights.sbomify.com/CVE-2026-65538/): WordPress Machete plugin <= 5.2 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2026-65537](https://insights.sbomify.com/CVE-2026-65537/): Missing authorization in Cyr to Lat reloaded – transliteration of links and file names (medium 4.3)
- [CVE-2026-65536](https://insights.sbomify.com/CVE-2026-65536/): Cross-site request forgery in افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) (medium 6.5)
- [CVE-2026-65535](https://insights.sbomify.com/CVE-2026-65535/): WordPress TinyMCE Templates plugin <= 4.8.1 - Sensitive Data Exposure vulnerability (medium 4.3)
- [CVE-2026-65534](https://insights.sbomify.com/CVE-2026-65534/): WordPress Custom links in Elementor Image Carousel plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2026-65533](https://insights.sbomify.com/CVE-2026-65533/): WordPress Smart SEO Tool plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-65532](https://insights.sbomify.com/CVE-2026-65532/): WordPress Persian Woocommerce SMS plugin <= 7.2.2 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-65531](https://insights.sbomify.com/CVE-2026-65531/): WordPress Qubely plugin <= 1.8.14 - Broken Access Control vulnerability (medium 4.8)
- [CVE-2026-65530](https://insights.sbomify.com/CVE-2026-65530/): WordPress TemplateSpare plugin <= 4.2.2 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-6553](https://insights.sbomify.com/CVE-2026-6553/): TYPO3 CMS Stores Cleartext Password in User Settings Module (high 7.3)
- [CVE-2026-65529](https://insights.sbomify.com/CVE-2026-65529/): WordPress Graphina plugin <= 3.1.12 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-65528](https://insights.sbomify.com/CVE-2026-65528/): WordPress BSK PDF Manager plugin <= 3.8 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-65527](https://insights.sbomify.com/CVE-2026-65527/): WordPress LIQUID SPEECH BALLOON plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/461/