# Vulnerabilities published in 2026


- [CVE-2026-57866](https://insights.sbomify.com/CVE-2026-57866/): Apache Impala: Secrets Exfiltration via SSRF (high 8.8)
- [CVE-2026-57863](https://insights.sbomify.com/CVE-2026-57863/): Crater Invoice 6.0.6 Path Traversal RCE via update/unzip endpoint (high 8.7)
- [CVE-2026-57862](https://insights.sbomify.com/CVE-2026-57862/): Kanboard 1.2.52 and prior SSRF Filter Bypass via Hexadecimal IP Notation (high 8.4)
- [CVE-2026-57860](https://insights.sbomify.com/CVE-2026-57860/): ForgeCode Arbitrary Code Execution via Unvetted .mcp.json in Untrusted Repository (high 8.4)
- [CVE-2026-5786](https://insights.sbomify.com/CVE-2026-5786/): Privilege escalation in Endpoint Manager Mobile (high 8.8)
- [CVE-2026-57859](https://insights.sbomify.com/CVE-2026-57859/): e107 Second-Order Code Execution via eval()-Based Deserialization in e_array::unserialize() (high 7.7)
- [CVE-2026-57858](https://insights.sbomify.com/CVE-2026-57858/): Cal.com Cal.diy 6.2.0 Stored XSS via BookingPageTagManager Analytics Tracking ID (critical 9.3)
- [CVE-2026-57857](https://insights.sbomify.com/CVE-2026-57857/): Flow Payment Plugin for WordPress Reflected Cross-Site Scripting via error_message Parameter (medium 5.1)
- [CVE-2026-57856](https://insights.sbomify.com/CVE-2026-57856/): Cockpit CMS Path Traversal via Bucket Name in Bucket File Storage API (high 8.7)
- [CVE-2026-57855](https://insights.sbomify.com/CVE-2026-57855/): Cockpit CMS Missing Authorization in Bucket File Storage API (high 8.7)
- [CVE-2026-57852](https://insights.sbomify.com/CVE-2026-57852/): Authentication Bypass via Null Short-Circuit in Grav CMS Scheduler Webhook Token Check (medium 6.3)
- [CVE-2026-57851](https://insights.sbomify.com/CVE-2026-57851/): MSI KernCoreLib64.sys Privilege Escalation via IOCTL Handlers (high 8.5)
- [CVE-2026-57850](https://insights.sbomify.com/CVE-2026-57850/): RustDesk Missing Session Scope Enforcement Allows Out-of-Scope Control Message Injection (high 8.7)
- [CVE-2026-5785](https://insights.sbomify.com/CVE-2026-5785/): SQL Injection (high 8.1)
- [CVE-2026-57848](https://insights.sbomify.com/CVE-2026-57848/): Stoat for Android Internal File Disclosure via Exported ShareTargetActivity URI Validation (medium 6.8)
- [CVE-2026-57845](https://insights.sbomify.com/CVE-2026-57845/): Hugging Face Datasets through 5.1.0 Pickle Deserialization RCE via Pandas Builder (high 8.7)
- [CVE-2026-57843](https://insights.sbomify.com/CVE-2026-57843/): NetBSD mm_open() PK_KMEM Flag Kernel Pointer Information Disclosure (medium 6.8)
- [CVE-2026-57842](https://insights.sbomify.com/CVE-2026-57842/): NetBSD COMPAT_NETBSD32 Double Free / Use-After-Free via recvmsg() msg_iovlen (high 7.3)
- [CVE-2026-5784](https://insights.sbomify.com/CVE-2026-5784/): Stored XSS in DivvyDrive Information Technologies' DivvyDrive (high 8.8)
- [CVE-2026-57834](https://insights.sbomify.com/CVE-2026-57834/): Apache Traffic Server: Malformed chunked message body allows request smuggling (high 7.0)
- [CVE-2026-57833](https://insights.sbomify.com/CVE-2026-57833/): Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics < 5.0.2 (high 8.6)
- [CVE-2026-57832](https://insights.sbomify.com/CVE-2026-57832/): Joomla Extension - joomdonation.com - Unauthenticated blind SQL injection in EDocman < 3.9 (high 8.7)
- [CVE-2026-57831](https://insights.sbomify.com/CVE-2026-57831/): Joomla Extension - digital-peak.com - Unauthenticated blind SQL injection in DP Calendar 8.18.0 - 10.11.2 (high 8.7)
- [CVE-2026-57830](https://insights.sbomify.com/CVE-2026-57830/): Joomla Extension - joomshaper.com - Unauthenticated arbitrary file deletion in Helix Ultimate < 2.2.7 (high 8.8)
- [CVE-2026-5783](https://insights.sbomify.com/CVE-2026-5783/): Reflected XSS in Beyaz Computer's CityPLus (high 7.6)
- [CVE-2026-57829](https://insights.sbomify.com/CVE-2026-57829/): Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Helix Ultimate < 2.2.7 (high 8.7)
- [CVE-2026-57828](https://insights.sbomify.com/CVE-2026-57828/): Joomla Extension - phoca.cz - Authenticated file upload in Phoca Downloads component < 6.1.3 (critical 9.0)
- [CVE-2026-57827](https://insights.sbomify.com/CVE-2026-57827/): Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12 (critical 10.0)
- [CVE-2026-57826](https://insights.sbomify.com/CVE-2026-57826/): An issue was discovered in openHiTLS 0.2.0 through 0.3.2. (medium 6.8)
- [CVE-2026-57825](https://insights.sbomify.com/CVE-2026-57825/): Security feature bypass in opam (medium 5.7)
- [CVE-2026-57822](https://insights.sbomify.com/CVE-2026-57822/): Deserialization in Apache ActiveMQ Artemis (medium 6.5)
- [CVE-2026-57821](https://insights.sbomify.com/CVE-2026-57821/): Apache Fineract: Office list: SQL Injection via Subquery in orderBy (high 8.1)
- [CVE-2026-5782](https://insights.sbomify.com/CVE-2026-5782/): Reflected XSS in MRV Technology's TurkHotspot (medium 5.2)
- [CVE-2026-57819](https://insights.sbomify.com/CVE-2026-57819/): Apache CXF: No default restriction on the amount of form parameters per message (high 7.5)
- [CVE-2026-57818](https://insights.sbomify.com/CVE-2026-57818/): Apache CXF: OAuth2 Authorization Code Replay via TOCTOU in JCacheCodeDataProvider (high 8.1)
- [CVE-2026-57817](https://insights.sbomify.com/CVE-2026-57817/): Apache CXF: The authorization code hash (c_hash) is not enforced for the hybrid OIDC flow (high 8.1)
- [CVE-2026-57816](https://insights.sbomify.com/CVE-2026-57816/): WordPress Funnel Builder by FunnelKit plugin <= 3.15.0.8 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57815](https://insights.sbomify.com/CVE-2026-57815/): WordPress Forminator plugin <= 1.55.0.2 - Arbitrary File Download vulnerability (high 7.5)
- [CVE-2026-57814](https://insights.sbomify.com/CVE-2026-57814/): WordPress Forminator plugin <= 1.55.0.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57813](https://insights.sbomify.com/CVE-2026-57813/): WordPress MailOptin plugin <= 1.2.77.3 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2026-57812](https://insights.sbomify.com/CVE-2026-57812/): WordPress Simply Schedule Appointments plugin <= 1.6.12.4 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-57811](https://insights.sbomify.com/CVE-2026-57811/): WordPress Realtyna Organic IDX plugin plugin <= 5.2.0 - Remote Code Execution (RCE) vulnerability (critical 10.0)
- [CVE-2026-57810](https://insights.sbomify.com/CVE-2026-57810/): WordPress APIExperts Square for WooCommerce plugin <= 4.7.4 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-5781](https://insights.sbomify.com/CVE-2026-5781/): Multiple vulnerabilities in MphRx's Minerva (high 8.5)
- [CVE-2026-57809](https://insights.sbomify.com/CVE-2026-57809/): WordPress AffiliateWP plugin <= 2.34.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57808](https://insights.sbomify.com/CVE-2026-57808/): WordPress WP EasyPay plugin <= 4.5.0 - Arbitrary Content Deletion vulnerability (medium 6.5)
- [CVE-2026-57807](https://insights.sbomify.com/CVE-2026-57807/): WordPress OAuth Single Sign On - SSO (OAuth Client) plugin <= 38.5.8 - Broken Authentication vulnerability (critical 9.8)
- [CVE-2026-57806](https://insights.sbomify.com/CVE-2026-57806/): Cross-site scripting in Martfury - WooCommerce Marketplace WordPress Theme (high 7.1)
- [CVE-2026-57805](https://insights.sbomify.com/CVE-2026-57805/): WordPress Tonda theme <= 2.5 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-57804](https://insights.sbomify.com/CVE-2026-57804/): WordPress TheGem Theme Elements (for Elementor) plugin < 5.12.1.1 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-57803](https://insights.sbomify.com/CVE-2026-57803/): WordPress Struktur Core plugin < 2.7 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-57802](https://insights.sbomify.com/CVE-2026-57802/): WordPress Struktur theme < 2.7 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-57801](https://insights.sbomify.com/CVE-2026-57801/): WordPress SetSail theme <= 2.1 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-57800](https://insights.sbomify.com/CVE-2026-57800/): WordPress Overworld theme <= 1.5 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-5780](https://insights.sbomify.com/CVE-2026-5780/): Multiple vulnerabilities in MphRx's Minerva (high 8.5)
- [CVE-2026-57799](https://insights.sbomify.com/CVE-2026-57799/): WordPress Nuss theme <= 1.3.6 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-57798](https://insights.sbomify.com/CVE-2026-57798/): WordPress NewsPlus Shortcodes plugin <= 4.2.0 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-57797](https://insights.sbomify.com/CVE-2026-57797/): WordPress EduMall theme <= 4.5.1 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-57796](https://insights.sbomify.com/CVE-2026-57796/): WordPress Leedo theme <= 3.0.0 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-57795](https://insights.sbomify.com/CVE-2026-57795/): WordPress Kitchor theme <= 1.4.3 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-57794](https://insights.sbomify.com/CVE-2026-57794/): WordPress Golo Framework plugin <= 1.7.3 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-57793](https://insights.sbomify.com/CVE-2026-57793/): WordPress Flow theme <= 1.8 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-57792](https://insights.sbomify.com/CVE-2026-57792/): WordPress Dør theme <= 2.4.1 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-57791](https://insights.sbomify.com/CVE-2026-57791/): WordPress Brook theme <= 2.9.0 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-57790](https://insights.sbomify.com/CVE-2026-57790/): WordPress Billey theme <= 2.1.8 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-5779](https://insights.sbomify.com/CVE-2026-5779/): Multiple vulnerabilities in MphRx's Minerva (critical 9.4)
- [CVE-2026-57789](https://insights.sbomify.com/CVE-2026-57789/): WordPress Aqua theme <= 5.1.2 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-57788](https://insights.sbomify.com/CVE-2026-57788/): WordPress Aalto theme <= 1.8 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-57787](https://insights.sbomify.com/CVE-2026-57787/): WordPress CWS SVGicons plugin <= 1.5.5 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-57786](https://insights.sbomify.com/CVE-2026-57786/): WordPress WorkScout-Core plugin <= 1.7.08 - Cross Site Request Forgery (CSRF) to Broken Authentication vulnerability (high 8.8)
- [CVE-2026-57785](https://insights.sbomify.com/CVE-2026-57785/): WordPress ApusListing theme <= 1.2.63 - Cross Site Request Forgery (CSRF) vulnerability (high 8.8)
- [CVE-2026-57784](https://insights.sbomify.com/CVE-2026-57784/): WordPress Ninja Forms File Uploads Extension plugin <= 3.3.26 - Cross Site Request Forgery (CSRF) vulnerability (critical 9.6)
- [CVE-2026-57783](https://insights.sbomify.com/CVE-2026-57783/): WordPress Speaker plugin <= 4.1.13 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-57782](https://insights.sbomify.com/CVE-2026-57782/): WordPress Universal Clocks plugin <= 1.2.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-57781](https://insights.sbomify.com/CVE-2026-57781/): WordPress MeetingHub plugin <= 1.25.10 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-57780](https://insights.sbomify.com/CVE-2026-57780/): WordPress Envision Page Builder plugin <= 0.22 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-5778](https://insights.sbomify.com/CVE-2026-5778/): Integer underflow leads to out-of-bounds access in sniffer ChaCha decrypt path. (low 2.1)
- [CVE-2026-57779](https://insights.sbomify.com/CVE-2026-57779/): WordPress Fascinate theme <= 1.1.5 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-57778](https://insights.sbomify.com/CVE-2026-57778/): WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-57777](https://insights.sbomify.com/CVE-2026-57777/): WordPress WooCommerce plugin < 11.0 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-57776](https://insights.sbomify.com/CVE-2026-57776/): WordPress VW Wedding theme <= 1.3.7 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-57774](https://insights.sbomify.com/CVE-2026-57774/): WordPress VW Food Corner theme <= 1.1.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-57773](https://insights.sbomify.com/CVE-2026-57773/): WordPress Advanced Shipment Tracking for WooCommerce plugin <= 4.0 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-57772](https://insights.sbomify.com/CVE-2026-57772/): WordPress WP Inventory Manager plugin <= 2.4.0 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-57771](https://insights.sbomify.com/CVE-2026-57771/): WordPress GD Rating System plugin <= 3.7 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-57770](https://insights.sbomify.com/CVE-2026-57770/): WordPress Grand Photography theme <= 5.7.8 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-5777](https://insights.sbomify.com/CVE-2026-5777/): Security Misconfiguration Vulnerability in Atom 3x Projector (high 8.7)
- [CVE-2026-57769](https://insights.sbomify.com/CVE-2026-57769/): WordPress Grand Photography theme <= 5.7.8 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57768](https://insights.sbomify.com/CVE-2026-57768/): WordPress Houzez Login Register plugin <= 3.3.3 - Privilege Escalation vulnerability (high 8.2)
- [CVE-2026-57767](https://insights.sbomify.com/CVE-2026-57767/): WordPress WP Google Maps Pro plugin <= 10.1.02 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57766](https://insights.sbomify.com/CVE-2026-57766/): WordPress WPIDE – File Manager & Code Editor plugin <= 3.5.6 - Cross Site Request Forgery (CSRF) vulnerability (high 8.8)
- [CVE-2026-57765](https://insights.sbomify.com/CVE-2026-57765/): WordPress WP EasyCart plugin <= 5.9.0 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-57764](https://insights.sbomify.com/CVE-2026-57764/): WordPress Surbma | Yoast SEO Breadcrumb Shortcode plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-57763](https://insights.sbomify.com/CVE-2026-57763/): WordPress Structured Content plugin <= 1.7.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-57762](https://insights.sbomify.com/CVE-2026-57762/): WordPress Simple URLs plugin <= 151 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2026-57761](https://insights.sbomify.com/CVE-2026-57761/): WordPress SEOWP theme <= 3.12.2 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2026-57760](https://insights.sbomify.com/CVE-2026-57760/): WordPress Sendcloud Shipping plugin <= 1.0.29 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-5776](https://insights.sbomify.com/CVE-2026-5776/): Email Encoder < 2.4.7 - Unauthenticated Stored XSS (medium 6.1)
- [CVE-2026-57759](https://insights.sbomify.com/CVE-2026-57759/): WordPress ProfileGrid plugin <= 6.0.0.2 - Cross Site Request Forgery (CSRF) vulnerability (high 8.8)
- [CVE-2026-57758](https://insights.sbomify.com/CVE-2026-57758/): WordPress Permalink Manager for WooCommerce plugin <= 1.0.8.2 - CSRF to Stored XSS vulnerability (high 7.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/523/