# Vulnerabilities published in 2026


- [CVE-2026-59657](https://insights.sbomify.com/CVE-2026-59657/): Apache CloudStack: Sensitive Information Disclosure via Cleartext Storage in AsyncJob (high 7.5)
- [CVE-2026-59655](https://insights.sbomify.com/CVE-2026-59655/): Apache CloudStack: Unauthenticated OAuth provider client-secret disclosure (high 7.5)
- [CVE-2026-59654](https://insights.sbomify.com/CVE-2026-59654/): Apache CloudStack: DoS caused by database connections leak (medium 6.8)
- [CVE-2026-59652](https://insights.sbomify.com/CVE-2026-59652/): LDAP filter injection in legacy jdk1.4 LDAPStoreHelper (medium 6.9)
- [CVE-2026-59651](https://insights.sbomify.com/CVE-2026-59651/): BKS keystore accepts legacy version with 16-bit integrity MAC key (high 7.1)
- [CVE-2026-59650](https://insights.sbomify.com/CVE-2026-59650/): MTI/A0 DH agreement exponentiates unvalidated peer value (critical 9.3)
- [CVE-2026-5965](https://insights.sbomify.com/CVE-2026-5965/): NewSoft｜NewSoftOA - OS Command Injection (critical 9.3)
- [CVE-2026-59649](https://insights.sbomify.com/CVE-2026-59649/): OpenPGP user-attribute subpacket length bounded only by JVM max memory (high 8.7)
- [CVE-2026-59648](https://insights.sbomify.com/CVE-2026-59648/): OpenPGP Argon2 S2K honours attacker-chosen memory and passes (medium 6.9)
- [CVE-2026-59647](https://insights.sbomify.com/CVE-2026-59647/): CRMF/CMP password-MAC honours unbounded iteration count (medium 6.9)
- [CVE-2026-59646](https://insights.sbomify.com/CVE-2026-59646/): DTLS handshake reassembler allocates buffer from unchecked 24-bit length (high 8.7)
- [CVE-2026-59645](https://insights.sbomify.com/CVE-2026-59645/): OER parser recurses without depth limit on self-referential IEEE 1609.2 schema (high 8.7)
- [CVE-2026-59644](https://insights.sbomify.com/CVE-2026-59644/): MLS hash-ratchet honours arbitrary 32-bit generation counter from sender (high 8.7)
- [CVE-2026-59643](https://insights.sbomify.com/CVE-2026-59643/): OpenPGP inline-signature policy failures silently ignored (high 8.7)
- [CVE-2026-59642](https://insights.sbomify.com/CVE-2026-59642/): CMS AuthenticatedData content not bound to MAC when authAttrs present (high 8.7)
- [CVE-2026-59641](https://insights.sbomify.com/CVE-2026-59641/): S/MIME validator trusts signer-asserted signingTime for path validation (high 8.7)
- [CVE-2026-59640](https://insights.sbomify.com/CVE-2026-59640/): OpenPGP CFB quick-check oracle active on symmetric/session-key paths (high 8.7)
- [CVE-2026-5964](https://insights.sbomify.com/CVE-2026-5964/): Digiwin｜EasyFlow .NET - SQL Injection (critical 9.3)
- [CVE-2026-59639](https://insights.sbomify.com/CVE-2026-59639/): CMS verifySignatures returns true for SignedData with zero signers (high 8.7)
- [CVE-2026-59638](https://insights.sbomify.com/CVE-2026-59638/): JSSE hostname verifier CN-fallback enabled by default despite documented opt-in (critical 9.3)
- [CVE-2026-5963](https://insights.sbomify.com/CVE-2026-5963/): Digiwin｜EasyFlow .NET - SQL Injection (critical 9.3)
- [CVE-2026-5962](https://insights.sbomify.com/CVE-2026-5962/): Tenda CH22 httpd R7WebsSecurityHandlerfunction path traversal (medium 6.9)
- [CVE-2026-5961](https://insights.sbomify.com/CVE-2026-5961/): code-projects Simple IT Discussion Forum topic-details.php sql injection (medium 6.9)
- [CVE-2026-5960](https://insights.sbomify.com/CVE-2026-5960/): code-projects Patient Record Management System SQL Database Backup File hcpms.sql information disclosure (medium 5.3)
- [CVE-2026-5959](https://insights.sbomify.com/CVE-2026-5959/): GL.iNet GL-RM1/GL-RM10/GL-RM10RC/GL-RM1PE Factory Reset improper authentication (high 7.5)
- [CVE-2026-5958](https://insights.sbomify.com/CVE-2026-5958/): Race Condition in GNU Sed (low 2.1)
- [CVE-2026-59570](https://insights.sbomify.com/CVE-2026-59570/): Android ZCC denial of service (high 7.5)
- [CVE-2026-5957](https://insights.sbomify.com/CVE-2026-5957/): EmailKit <= 1.6.5 - Authenticated (Author+) Arbitrary File Read via 'emailkit-editor-template' REST Parameter (medium 6.5)
- [CVE-2026-59569](https://insights.sbomify.com/CVE-2026-59569/): Android ZCC VPN API method privilege escalation (high 8.1)
- [CVE-2026-59568](https://insights.sbomify.com/CVE-2026-59568/): Remote Code Execution (critical 9.1)
- [CVE-2026-59567](https://insights.sbomify.com/CVE-2026-59567/): Local privilege escalation (high 8.8)
- [CVE-2026-59566](https://insights.sbomify.com/CVE-2026-59566/): Local denial-of-service (high 8.4)
- [CVE-2026-59565](https://insights.sbomify.com/CVE-2026-59565/): Local and kernel denial-of-service (high 8.8)
- [CVE-2026-59564](https://insights.sbomify.com/CVE-2026-59564/): Authentication bypass between ZCC and client connector portal (critical 9.1)
- [CVE-2026-59563](https://insights.sbomify.com/CVE-2026-59563/): HMAC Confirmation Token Unbinding in zscaler-mcp-server (medium 4.6)
- [CVE-2026-59562](https://insights.sbomify.com/CVE-2026-59562/): Apache IoTDB: Remote code execution and Unauthenticated path traversal in legacy pipe sendFile RPC (not scored)
- [CVE-2026-59561](https://insights.sbomify.com/CVE-2026-59561/): Command injection in Sakura Editor (high 8.4)
- [CVE-2026-59560](https://insights.sbomify.com/CVE-2026-59560/): WordPress FundEngine plugin <= 1.7.8 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-5956](https://insights.sbomify.com/CVE-2026-5956/): SQLi in Ankara Hosting's Site Management Panel (high 8.8)
- [CVE-2026-59559](https://insights.sbomify.com/CVE-2026-59559/): Cross-site scripting in RT Mega Menu – Mega Menu Builder for Elementor &amp; Gutenberg (medium 6.5)
- [CVE-2026-59558](https://insights.sbomify.com/CVE-2026-59558/): WordPress Booking Calendar plugin <= 11.4.2 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-59557](https://insights.sbomify.com/CVE-2026-59557/): WordPress Events Made Easy plugin <= 3.1.3 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-59556](https://insights.sbomify.com/CVE-2026-59556/): Cross-site scripting in Dynamic Pricing With Discount Rules for WooCommerce (high 7.1)
- [CVE-2026-59555](https://insights.sbomify.com/CVE-2026-59555/): WordPress Participants Database plugin <= 2.7.8.3 - Arbitrary File Deletion vulnerability (critical 10.0)
- [CVE-2026-59554](https://insights.sbomify.com/CVE-2026-59554/): WordPress Ziina plugin <= 1.2.21 - Broken Authentication vulnerability (high 7.5)
- [CVE-2026-59553](https://insights.sbomify.com/CVE-2026-59553/): WordPress Product Feed Manager plugin <= 7.6.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-59552](https://insights.sbomify.com/CVE-2026-59552/): WordPress 3D Flipbook PDF Viewer & Embedder plugin <= 1.4.2 - Server Side Request Forgery (SSRF) vulnerability (high 7.2)
- [CVE-2026-59551](https://insights.sbomify.com/CVE-2026-59551/): WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.10 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-59550](https://insights.sbomify.com/CVE-2026-59550/): WordPress AWP Classifieds plugin <= 4.4.7 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-5955](https://insights.sbomify.com/CVE-2026-5955/): SQLi in Inrove Software's BiEticaret (critical 9.8)
- [CVE-2026-59549](https://insights.sbomify.com/CVE-2026-59549/): WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.10 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-59548](https://insights.sbomify.com/CVE-2026-59548/): WordPress Byteflows Travel & Hotel Booking plugin <= 1.0.0 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2026-59547](https://insights.sbomify.com/CVE-2026-59547/): WordPress Payment Gateway for PayPal on WooCommerce plugin <= 9.1.4 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-59546](https://insights.sbomify.com/CVE-2026-59546/): WordPress Hide My WP Ghost plugin <= 7.0.06 - 2FA Bypass vulnerability (high 7.4)
- [CVE-2026-59545](https://insights.sbomify.com/CVE-2026-59545/): WordPress miniOrange Discord Integration plugin <= 2.2.4 - Broken Authentication vulnerability (high 8.1)
- [CVE-2026-59544](https://insights.sbomify.com/CVE-2026-59544/): WordPress Thrive Quiz Builder plugin <= 10.9.3.0 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-59543](https://insights.sbomify.com/CVE-2026-59543/): WordPress Advanced Views plugin <= 3.8.11 - Remote Code Execution (RCE) vulnerability (critical 9.9)
- [CVE-2026-59542](https://insights.sbomify.com/CVE-2026-59542/): WordPress Kali Forms plugin <= 2.4.18 - Arbitrary File Deletion vulnerability (high 7.7)
- [CVE-2026-59541](https://insights.sbomify.com/CVE-2026-59541/): WordPress WP BASE Booking plugin <= 6.3.1 - Privilege Escalation vulnerability (high 8.8)
- [CVE-2026-59540](https://insights.sbomify.com/CVE-2026-59540/): WordPress SMS Alert Order Notifications plugin <= 3.9.6 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2026-5954](https://insights.sbomify.com/CVE-2026-5954/): Incorrect Authorization in GitLab (medium 4.2)
- [CVE-2026-59539](https://insights.sbomify.com/CVE-2026-59539/): WordPress Paid Member Subscriptions plugin <= 3.0.7 - Insecure Direct Object References (IDOR) vulnerability (high 7.5)
- [CVE-2026-59538](https://insights.sbomify.com/CVE-2026-59538/): WordPress GamiPress plugin <= 7.9.7 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-59537](https://insights.sbomify.com/CVE-2026-59537/): SQL injection in Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce (high 7.6)
- [CVE-2026-59536](https://insights.sbomify.com/CVE-2026-59536/): WordPress CoCart – Headless ecommerce plugin <= 4.8.4 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-59535](https://insights.sbomify.com/CVE-2026-59535/): WordPress Thrive Product Manager plugin <= 10.9.2 - Broken Access Control vulnerability (high 7.3)
- [CVE-2026-59534](https://insights.sbomify.com/CVE-2026-59534/): WordPress Post My CF7 Form plugin <= 6.2.0 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-59533](https://insights.sbomify.com/CVE-2026-59533/): WordPress Relevanssi Light plugin <= 1.2.2 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-59532](https://insights.sbomify.com/CVE-2026-59532/): WordPress Booking and Rental Manager plugin <= 2.7.2 - Price Manipulation vulnerability (high 7.5)
- [CVE-2026-59531](https://insights.sbomify.com/CVE-2026-59531/): WordPress Falcon – WordPress Optimizations & Tweaks plugin <= 2.10.0 - Unknown vulnerability (high 7.5)
- [CVE-2026-59530](https://insights.sbomify.com/CVE-2026-59530/): WordPress Stripe For WooCommerce plugin <= 4.0.7 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-5953](https://insights.sbomify.com/CVE-2026-5953/): Reflected XSS in Ceviz Informatics's Web Design (medium 6.1)
- [CVE-2026-59529](https://insights.sbomify.com/CVE-2026-59529/): WordPress Ebook Store plugin <= 6.19 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2026-59528](https://insights.sbomify.com/CVE-2026-59528/): WordPress ShipTime: Discounted Shipping Rates plugin <= 1.1.1 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2026-59527](https://insights.sbomify.com/CVE-2026-59527/): WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-59526](https://insights.sbomify.com/CVE-2026-59526/): WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-59525](https://insights.sbomify.com/CVE-2026-59525/): WordPress Participants Database plugin <= 2.7.8.3 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-59524](https://insights.sbomify.com/CVE-2026-59524/): WordPress Easy Digital Downloads plugin <= 3.6.7 - Broken Authentication vulnerability (medium 6.5)
- [CVE-2026-59523](https://insights.sbomify.com/CVE-2026-59523/): WordPress Simply Schedule Appointments plugin <= 1.6.11.11 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-59522](https://insights.sbomify.com/CVE-2026-59522/): WordPress WP ERP plugin <= 1.17.5 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-59521](https://insights.sbomify.com/CVE-2026-59521/): WordPress Real Testimonials plugin <= 3.1.15 - PHP Object Injection vulnerability (high 7.2)
- [CVE-2026-59520](https://insights.sbomify.com/CVE-2026-59520/): WordPress CrawlWP SEO plugin <= 3.0.16 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2026-5952](https://insights.sbomify.com/CVE-2026-5952/): Incorrect Authorization in GitLab (medium 4.3)
- [CVE-2026-59519](https://insights.sbomify.com/CVE-2026-59519/): WordPress FormLayer plugin <= 1.0.6 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-59518](https://insights.sbomify.com/CVE-2026-59518/): WordPress Directorist plugin <= 8.8.2 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-59517](https://insights.sbomify.com/CVE-2026-59517/): WordPress Easy Form Builder plugin <= 4.0.12 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-59516](https://insights.sbomify.com/CVE-2026-59516/): WordPress ICS Calendar plugin <= 12.1.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-59515](https://insights.sbomify.com/CVE-2026-59515/): WordPress AIWU plugin <= 1.5.4 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-59514](https://insights.sbomify.com/CVE-2026-59514/): WordPress Buddyboss Platform plugin <= 3.0.5 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-59513](https://insights.sbomify.com/CVE-2026-59513/): WordPress Masteriyo - LMS plugin <= 2.3.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-59512](https://insights.sbomify.com/CVE-2026-59512/): WordPress Product Enquiry for WooCommerce plugin <= 2.2.34.43 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-59511](https://insights.sbomify.com/CVE-2026-59511/): WordPress Exclusive Addons Elementor plugin <= 2.7.9.9 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-59510](https://insights.sbomify.com/CVE-2026-59510/): Authenticated Path Traversal in AIL Framework PDF Object Handling Enables Potential Arbitrary File Read (high 7.1)
- [CVE-2026-59509](https://insights.sbomify.com/CVE-2026-59509/): Unauthenticated arbitrary MongoDB collection read in cve-search (critical 9.2)
- [CVE-2026-59508](https://insights.sbomify.com/CVE-2026-59508/): Interuse i-Bos CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (medium 5.9)
- [CVE-2026-59507](https://insights.sbomify.com/CVE-2026-59507/): Hardcoded credentials in Portal Generator addon to Priority ERP (developed by Soft Solutions) (critical 9.3)
- [CVE-2026-59506](https://insights.sbomify.com/CVE-2026-59506/): Priority – CWE-306: Missing Authentication for Critical Function (critical 9.3)
- [CVE-2026-59505](https://insights.sbomify.com/CVE-2026-59505/): Priority - CWE-284: Improper Access Control (high 8.6)
- [CVE-2026-59504](https://insights.sbomify.com/CVE-2026-59504/): Priority – CWE-602: Client-Side Enforcement of Server-Side Security (critical 9.1)
- [CVE-2026-59503](https://insights.sbomify.com/CVE-2026-59503/): Information disclosure in Portal Generator addon to Priority ERP (developed by Soft Solutions) (critical 9.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/512/