# Vulnerabilities published in 2026


- [CVE-2026-61976](https://insights.sbomify.com/CVE-2026-61976/): WordPress JetBlocks For Elementor plugin <= 1.5.0 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-61975](https://insights.sbomify.com/CVE-2026-61975/): WordPress JetReviews plugin <= 3.0.1 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-61974](https://insights.sbomify.com/CVE-2026-61974/): WordPress Mang Board WP plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-61973](https://insights.sbomify.com/CVE-2026-61973/): WordPress ShopLentor Pro plugin <= 2.8.5 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-61972](https://insights.sbomify.com/CVE-2026-61972/): WordPress ShopLentor Pro plugin <= 2.8.5 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-61971](https://insights.sbomify.com/CVE-2026-61971/): WordPress User Profile Picture plugin <= 2.6.3 - Insecure Direct Object References (IDOR) vulnerability (low 2.7)
- [CVE-2026-61970](https://insights.sbomify.com/CVE-2026-61970/): WordPress Auto Featured Image (Auto Post Thumbnail) plugin <= 5.0.4 - Server Side Request Forgery (SSRF) vulnerability (medium 4.9)
- [CVE-2026-6197](https://insights.sbomify.com/CVE-2026-6197/): Tenda F456 AdvSetWrlsafeset formWrlsafeset stack-based overflow (high 8.7)
- [CVE-2026-61969](https://insights.sbomify.com/CVE-2026-61969/): WordPress Listdom plugin <= 5.6.0 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-61968](https://insights.sbomify.com/CVE-2026-61968/): WordPress myCred plugin <= 3.1.2 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-61967](https://insights.sbomify.com/CVE-2026-61967/): WordPress miniorange otp verification plugin <= 5.5.1 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2026-61966](https://insights.sbomify.com/CVE-2026-61966/): WordPress WPJAM Basic plugin <= 7.0.1 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-61965](https://insights.sbomify.com/CVE-2026-61965/): WordPress GeekyBot plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-61964](https://insights.sbomify.com/CVE-2026-61964/): WordPress Ninja Tables plugin <= 5.2.9 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-61963](https://insights.sbomify.com/CVE-2026-61963/): WordPress Media LIbrary Assistant plugin <= 3.38 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-61962](https://insights.sbomify.com/CVE-2026-61962/): WordPress WP BASE Booking plugin <= 6.3.0 - Arbitrary Code Execution vulnerability (critical 10.0)
- [CVE-2026-61961](https://insights.sbomify.com/CVE-2026-61961/): WordPress EmbedPress plugin <= 4.5.6 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-61960](https://insights.sbomify.com/CVE-2026-61960/): WordPress WP Full Stripe Free plugin <= 8.5.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-6196](https://insights.sbomify.com/CVE-2026-6196/): Tenda F456 exeCommand fromexeCommand stack-based overflow (high 8.7)
- [CVE-2026-61959](https://insights.sbomify.com/CVE-2026-61959/): WordPress Business Directory plugin <= 6.4.24 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-61958](https://insights.sbomify.com/CVE-2026-61958/): WordPress License Manager for WooCommerce plugin <= 3.0.17 - Arbitrary Content Deletion vulnerability (medium 5.4)
- [CVE-2026-61957](https://insights.sbomify.com/CVE-2026-61957/): WordPress miniorange otp verification plugin <= 5.5.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-61956](https://insights.sbomify.com/CVE-2026-61956/): WordPress ووسلام – همگام سازی ووکامرس و باسلام plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) vulnerability (high 7.1)
- [CVE-2026-61955](https://insights.sbomify.com/CVE-2026-61955/): WordPress گرویتی فرم فارسی plugin <= 3.0.2 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-61954](https://insights.sbomify.com/CVE-2026-61954/): WordPress PayU India plugin <= 3.8.9 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-61953](https://insights.sbomify.com/CVE-2026-61953/): WordPress Simple Link Directory Pro plugin <= 15.0.6 - Server Side Request Forgery (SSRF) vulnerability (high 7.2)
- [CVE-2026-61952](https://insights.sbomify.com/CVE-2026-61952/): WordPress WooCommerce Bulk Edit Products – WP Sheet Editor plugin <= 1.8.21 - Broken Access Control vulnerability (medium 4.9)
- [CVE-2026-61951](https://insights.sbomify.com/CVE-2026-61951/): WordPress TrueBooker plugin <= 1.2.3 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2026-61950](https://insights.sbomify.com/CVE-2026-61950/): WordPress TrueBooker plugin <= 1.2.3 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-6195](https://insights.sbomify.com/CVE-2026-6195/): Totolink A7100RU CGI cstecgi.cgi setPasswordCfg os command injection (critical 9.3)
- [CVE-2026-61949](https://insights.sbomify.com/CVE-2026-61949/): WordPress Bookly plugin <= 27.7 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-61948](https://insights.sbomify.com/CVE-2026-61948/): WordPress WPDM – Premium Packages plugin <= 6.2.0 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-61947](https://insights.sbomify.com/CVE-2026-61947/): WordPress Form Vibes – Database Manager for Forms plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-61946](https://insights.sbomify.com/CVE-2026-61946/): WordPress Easy Appointments plugin <= 3.12.27 - Insecure Direct Object References (IDOR) vulnerability (medium 6.5)
- [CVE-2026-61945](https://insights.sbomify.com/CVE-2026-61945/): WordPress WooCommerce Product Stock Alert plugin <= 3.0.6 - Sensitive Data Exposure vulnerability (medium 6.5)
- [CVE-2026-61944](https://insights.sbomify.com/CVE-2026-61944/): WordPress Bookly plugin <= 27.7 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-61943](https://insights.sbomify.com/CVE-2026-61943/): WordPress WPDM – Premium Packages plugin <= 6.2.0 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-6194](https://insights.sbomify.com/CVE-2026-6194/): Totolink A3002MU HTTP Request formWlanSetup sub_410188 stack-based overflow (high 8.7)
- [CVE-2026-61939](https://insights.sbomify.com/CVE-2026-61939/): Winlogon Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-61938](https://insights.sbomify.com/CVE-2026-61938/): Windows Installer Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-61937](https://insights.sbomify.com/CVE-2026-61937/): Windows HTTP.sys Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-61936](https://insights.sbomify.com/CVE-2026-61936/): Windows Defender Firewall Service Security Feature Bypass Vulnerability (medium 5.5)
- [CVE-2026-61934](https://insights.sbomify.com/CVE-2026-61934/): Windows Bind Filter Driver Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-61933](https://insights.sbomify.com/CVE-2026-61933/): Windows DWM Core Library Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-61932](https://insights.sbomify.com/CVE-2026-61932/): Windows DWM Core Library Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-61931](https://insights.sbomify.com/CVE-2026-61931/): Windows Perception Simulation Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-61930](https://insights.sbomify.com/CVE-2026-61930/): Windows Kernel Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-6193](https://insights.sbomify.com/CVE-2026-6193/): PHPGurukul Daily Expense Tracking System register.php sql injection (medium 6.9)
- [CVE-2026-61929](https://insights.sbomify.com/CVE-2026-61929/): Windows Kernel Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-61928](https://insights.sbomify.com/CVE-2026-61928/): Windows Hello Tampering Vulnerability (medium 5.5)
- [CVE-2026-61927](https://insights.sbomify.com/CVE-2026-61927/): Windows Bind Filter Driver Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-61926](https://insights.sbomify.com/CVE-2026-61926/): Windows USB Driver Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-61925](https://insights.sbomify.com/CVE-2026-61925/): Windows Installer Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-61924](https://insights.sbomify.com/CVE-2026-61924/): Windows Remote Desktop Client Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-61923](https://insights.sbomify.com/CVE-2026-61923/): Windows Display Enhancement Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-61921](https://insights.sbomify.com/CVE-2026-61921/): Windows Remote Desktop Client Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-61920](https://insights.sbomify.com/CVE-2026-61920/): Windows DNS Server Remote Code Execution Vulnerability (medium 6.6)
- [CVE-2026-6192](https://insights.sbomify.com/CVE-2026-6192/): uclouvain openjpeg pi.c opj_pi_initialise_encode integer overflow (medium 4.8)
- [CVE-2026-61918](https://insights.sbomify.com/CVE-2026-61918/): Windows Remote Desktop Client Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-61916](https://insights.sbomify.com/CVE-2026-61916/): Apache bRPC: Out-of-bounds Read in URL and Header Lookup Tables on Unsigned-char Platforms (not scored)
- [CVE-2026-61915](https://insights.sbomify.com/CVE-2026-61915/): Memory corruption in Cyrus IMAP (medium 4.2)
- [CVE-2026-61911](https://insights.sbomify.com/CVE-2026-61911/): Information disclosure in Cyrus IMAP (medium 4.3)
- [CVE-2026-61910](https://insights.sbomify.com/CVE-2026-61910/): Missing authorization in Cyrus IMAP (low 3.5)
- [CVE-2026-6191](https://insights.sbomify.com/CVE-2026-6191/): itsourcecode Construction Management System equipments.php sql injection (medium 5.3)
- [CVE-2026-61909](https://insights.sbomify.com/CVE-2026-61909/): Missing authorization in Cyrus IMAP (low 3.5)
- [CVE-2026-61908](https://insights.sbomify.com/CVE-2026-61908/): Memory corruption in Cyrus IMAP (low 3.1)
- [CVE-2026-61907](https://insights.sbomify.com/CVE-2026-61907/): Missing authorization in Cyrus IMAP (medium 4.3)
- [CVE-2026-61902](https://insights.sbomify.com/CVE-2026-61902/): Apache bRPC: Memory Exhaustion Through Inconsistent Message Body Limits (not scored)
- [CVE-2026-61901](https://insights.sbomify.com/CVE-2026-61901/): Joomla Extension - hikashop.com - Open redirect in Hikashop < 6.5.2 (medium 6.1)
- [CVE-2026-61900](https://insights.sbomify.com/CVE-2026-61900/): Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-jDownloads < 4.1.6 (critical 10.0)
- [CVE-2026-6190](https://insights.sbomify.com/CVE-2026-6190/): itsourcecode Construction Management System employees.php sql injection (medium 5.3)
- [CVE-2026-61899](https://insights.sbomify.com/CVE-2026-61899/): Apache Tapestry: Possible classpath file download through URL manipulation (high 7.5)
- [CVE-2026-61898](https://insights.sbomify.com/CVE-2026-61898/): accountsservice: shell injection via attacker-controlled ~/.pam_environment in Ubuntu language helper scripts (high 7.8)
- [CVE-2026-61897](https://insights.sbomify.com/CVE-2026-61897/): accountsservice: incomplete privilege drop when running Ubuntu-specific language helper scripts (high 7.8)
- [CVE-2026-61893](https://insights.sbomify.com/CVE-2026-61893/): MZ Automation lib60870 Out-of-bounds Read (medium 6.9)
- [CVE-2026-61892](https://insights.sbomify.com/CVE-2026-61892/): Weintek cMT3092X Incorrect Permission Assignment for Critical Resource (high 8.7)
- [CVE-2026-61891](https://insights.sbomify.com/CVE-2026-61891/): Missing authorization in Eclipse Theia (high 7.5)
- [CVE-2026-6189](https://insights.sbomify.com/CVE-2026-6189/): SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection (medium 6.9)
- [CVE-2026-61886](https://insights.sbomify.com/CVE-2026-61886/): Weintek cMT3092X Plaintext Storage of a Password (high 7.1)
- [CVE-2026-61884](https://insights.sbomify.com/CVE-2026-61884/): Tycon Systems TPDIN-Monitor-WEB2 Missing Authentication for Critical Function (critical 9.3)
- [CVE-2026-6188](https://insights.sbomify.com/CVE-2026-6188/): SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection (medium 6.9)
- [CVE-2026-61876](https://insights.sbomify.com/CVE-2026-61876/): LuCI DHCPv6 Lease Hostname Stored Cross-Site Scripting (critical 9.4)
- [CVE-2026-61875](https://insights.sbomify.com/CVE-2026-61875/): luci-app-upnp Stored XSS via UPnP Port Mapping Description (high 8.7)
- [CVE-2026-61874](https://insights.sbomify.com/CVE-2026-61874/): filebrowser before 2.63.17 Stale Public Share via Trailing-Slash Delete (low 2.3)
- [CVE-2026-61873](https://insights.sbomify.com/CVE-2026-61873/): Grav before 9.1.8 Arbitrary File Write via Twig-Processed Filename (high 7.2)
- [CVE-2026-61872](https://insights.sbomify.com/CVE-2026-61872/): ImageMagick before 7.1.2-26 Memory Leak via TIFF Encoder (low 2.0)
- [CVE-2026-61871](https://insights.sbomify.com/CVE-2026-61871/): ImageMagick before 7.1.2-26 Memory Leak in ICON decoder (medium 6.3)
- [CVE-2026-61870](https://insights.sbomify.com/CVE-2026-61870/): ImageMagick before 7.1.2-26 Memory Leak via VIFF Encoder (low 2.1)
- [CVE-2026-6187](https://insights.sbomify.com/CVE-2026-6187/): SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection (medium 6.9)
- [CVE-2026-61869](https://insights.sbomify.com/CVE-2026-61869/): ImageMagick before 7.1.2-26 Memory Leak in MIFF Encoder (low 2.1)
- [CVE-2026-61868](https://insights.sbomify.com/CVE-2026-61868/): ImageMagick before 7.1.2-26 Memory Leak in YUV Decoder (medium 6.3)
- [CVE-2026-61867](https://insights.sbomify.com/CVE-2026-61867/): ImageMagick before 7.1.2-26 Memory Leak in TIFF Encoder (low 2.1)
- [CVE-2026-61866](https://insights.sbomify.com/CVE-2026-61866/): ImageMagick before 7.1.2-26 Memory Leak in JNG encoder (low 2.1)
- [CVE-2026-61865](https://insights.sbomify.com/CVE-2026-61865/): ImageMagick before 7.1.2-26 Memory Leak in Hough Lines (low 2.1)
- [CVE-2026-61864](https://insights.sbomify.com/CVE-2026-61864/): ImageMagick before 7.1.2-26 Memory Leak in Log Colorspace (low 2.1)
- [CVE-2026-61863](https://insights.sbomify.com/CVE-2026-61863/): ImageMagick before 7.1.2-26 Memory Leak in TIFF Encoder (low 2.1)
- [CVE-2026-61862](https://insights.sbomify.com/CVE-2026-61862/): ImageMagick before 7.1.2-26 Information Disclosure via identify (low 2.1)
- [CVE-2026-61861](https://insights.sbomify.com/CVE-2026-61861/): ImageMagick before 7.1.2-26 Use-After-Free in FormatMagickCaption (medium 6.3)
- [CVE-2026-61860](https://insights.sbomify.com/CVE-2026-61860/): ImageMagick before 7.1.2-26 Use-After-Free via freetype (medium 6.3)
- [CVE-2026-6186](https://insights.sbomify.com/CVE-2026-6186/): UTT HiPER 1200GW formNatStaticMap strcpy buffer overflow (high 8.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/491/