# Vulnerabilities published in 2026


- [CVE-2026-57662](https://insights.sbomify.com/CVE-2026-57662/): WordPress Contest Gallery plugin <= 30.0.0 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-57661](https://insights.sbomify.com/CVE-2026-57661/): WordPress WPComplete plugin <= 2.9.5.5 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-57660](https://insights.sbomify.com/CVE-2026-57660/): WordPress Booking and Rental Manager plugin <= 2.7.1 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-5766](https://insights.sbomify.com/CVE-2026-5766/): Potential denial-of-service vulnerability in ASGI requests via file upload limit bypass (medium 6.3)
- [CVE-2026-57659](https://insights.sbomify.com/CVE-2026-57659/): Cross-site request forgery in Paid Memberships Pro - Add Member From Admin (high 8.8)
- [CVE-2026-57658](https://insights.sbomify.com/CVE-2026-57658/): WordPress TemplateSpare plugin <= 4.2.0 - Arbitrary File Upload vulnerability (critical 9.1)
- [CVE-2026-57657](https://insights.sbomify.com/CVE-2026-57657/): WordPress Gmail SMTP plugin <= 1.2.3.19 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2026-57656](https://insights.sbomify.com/CVE-2026-57656/): WordPress Hester Core plugin <= 1.1.8 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2026-57655](https://insights.sbomify.com/CVE-2026-57655/): WordPress Child theme Wizard plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerability (high 8.2)
- [CVE-2026-57654](https://insights.sbomify.com/CVE-2026-57654/): WordPress Affiliates Manager plugin <= 2.9.49 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-57653](https://insights.sbomify.com/CVE-2026-57653/): WordPress WP Job Portal plugin <= 2.5.2 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-57652](https://insights.sbomify.com/CVE-2026-57652/): WordPress JS Help Desk plugin <= 3.1.0 - Insecure Direct Object References (IDOR) vulnerability (medium 5.3)
- [CVE-2026-57651](https://insights.sbomify.com/CVE-2026-57651/): WordPress Ghost Kit plugin <= 3.6.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-57650](https://insights.sbomify.com/CVE-2026-57650/): WordPress Magazine Blocks plugin <= 1.8.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-57649](https://insights.sbomify.com/CVE-2026-57649/): WordPress Shoppable Images Lite plugin <= 1.3 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-57648](https://insights.sbomify.com/CVE-2026-57648/): WordPress Nelio Content plugin <= 4.3.4 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-57647](https://insights.sbomify.com/CVE-2026-57647/): WordPress Panorama Viewer – 360 Degree Image + Video Viewer plugin <= 1.6.1 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-57646](https://insights.sbomify.com/CVE-2026-57646/): WordPress Majestic Support plugin <= 1.1.7 - Insecure Direct Object References (IDOR) vulnerability (medium 5.4)
- [CVE-2026-57645](https://insights.sbomify.com/CVE-2026-57645/): WordPress Newsletters plugin <= 4.13 - Broken Access Control vulnerability (high 8.1)
- [CVE-2026-57644](https://insights.sbomify.com/CVE-2026-57644/): WordPress Restaurant Menu by MotoPress plugin <= 2.4.10 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-57643](https://insights.sbomify.com/CVE-2026-57643/): WordPress WP Post Author plugin <= 3.9.1 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-57642](https://insights.sbomify.com/CVE-2026-57642/): WordPress Gallery plugin <= 4.7.8 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-57641](https://insights.sbomify.com/CVE-2026-57641/): WordPress Real Estate 7 theme <= 3.5.9 - Cross Site Request Forgery (CSRF) vulnerability (medium 6.5)
- [CVE-2026-57640](https://insights.sbomify.com/CVE-2026-57640/): WordPress MasterStudy LMS plugin <= 3.7.30 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-57638](https://insights.sbomify.com/CVE-2026-57638/): WordPress Fluent Booking plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-57637](https://insights.sbomify.com/CVE-2026-57637/): WordPress Abandoned Cart Lite for WooCommerce plugin <= 6.8.0 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2026-57636](https://insights.sbomify.com/CVE-2026-57636/): WordPress wpForo Forum plugin <= 3.0.9 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-57635](https://insights.sbomify.com/CVE-2026-57635/): Cross-site request forgery in FunnelKit Payment Gateway for Stripe WooCommerce (medium 6.5)
- [CVE-2026-57634](https://insights.sbomify.com/CVE-2026-57634/): WordPress PPWP plugin <= 1.9.19 - Insecure Direct Object References (IDOR) vulnerability (medium 4.3)
- [CVE-2026-57633](https://insights.sbomify.com/CVE-2026-57633/): WordPress WCBoost &#8211; Products Compare plugin <= 1.1.0 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-57632](https://insights.sbomify.com/CVE-2026-57632/): WordPress Email Marketing for WooCommerce by Omnisend plugin <= 1.19.0 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-57631](https://insights.sbomify.com/CVE-2026-57631/): WordPress Popup box plugin <= 6.0.1 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-57630](https://insights.sbomify.com/CVE-2026-57630/): WordPress Blocksy Companion Pro plugin <= 2.1.46 - Insecure Direct Object References (IDOR) vulnerability (medium 5.3)
- [CVE-2026-57629](https://insights.sbomify.com/CVE-2026-57629/): WordPress StatCounter plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-57628](https://insights.sbomify.com/CVE-2026-57628/): WordPress WP All Import plugin <= 4.0.1 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-57627](https://insights.sbomify.com/CVE-2026-57627/): WordPress Kirki plugin <= 6.0.11 - Server Side Request Forgery (SSRF) vulnerability (medium 4.9)
- [CVE-2026-57626](https://insights.sbomify.com/CVE-2026-57626/): WordPress MailPoet plugin 5.30.0-5.33.0 - Cross Site Request Forgery (CSRF) vulnerability (high 7.1)
- [CVE-2026-57625](https://insights.sbomify.com/CVE-2026-57625/): WordPress Admin and Site Enhancements (ASE) Pro plugin <= 8.8.5 - Cross Site Scripting (XSS) vulnerability (critical 9.6)
- [CVE-2026-57624](https://insights.sbomify.com/CVE-2026-57624/): WordPress Blocksy Companion Pro plugin <= 2.1.46 - Remote Code Execution (RCE) vulnerability (critical 10.0)
- [CVE-2026-57623](https://insights.sbomify.com/CVE-2026-57623/): WordPress W3 Total Cache plugin <= 2.9.4 - Arbitrary Code Execution vulnerability (critical 9.0)
- [CVE-2026-57622](https://insights.sbomify.com/CVE-2026-57622/): WordPress WPCafe plugin <= 3.0.14 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-57621](https://insights.sbomify.com/CVE-2026-57621/): WordPress Booktics plugin <= 1.0.21 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-57620](https://insights.sbomify.com/CVE-2026-57620/): WordPress Exclusive Addons Elementor plugin <= 2.7.9.8 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-5762](https://insights.sbomify.com/CVE-2026-5762/): ReportIncident DiscussionTools integration causes slow requests (medium 5.3)
- [CVE-2026-57619](https://insights.sbomify.com/CVE-2026-57619/): WordPress Elementor Website Builder plugin <= 4.1.3 - Sensitive Data Exposure vulnerability (medium 6.5)
- [CVE-2026-57618](https://insights.sbomify.com/CVE-2026-57618/): WordPress Neve PRO theme <= 3.1.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-57617](https://insights.sbomify.com/CVE-2026-57617/): WordPress SeedProd Pro plugin < 6.19.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-57600](https://insights.sbomify.com/CVE-2026-57600/): Information disclosure in DS-2CD Series (high 7.5)
- [CVE-2026-5760](https://insights.sbomify.com/CVE-2026-5760/): CVE-2026-5760 (critical 9.8)
- [CVE-2026-57599](https://insights.sbomify.com/CVE-2026-57599/): Privilege escalation in DS-2CD Series (medium 6.6)
- [CVE-2026-57590](https://insights.sbomify.com/CVE-2026-57590/): Apache DolphinScheduler: Missing Authorization in Task Group APIs Allows Unauthorized Cross-Project Operations (high 8.1)
- [CVE-2026-5759](https://insights.sbomify.com/CVE-2026-5759/): Double free and use-after-free in FalkorDB RdbLoadDeletedNodes allows remote code execution via crafted RDB (critical 9.3)
- [CVE-2026-57589](https://insights.sbomify.com/CVE-2026-57589/): Use after free in OpenBSD (high 7.4)
- [CVE-2026-57588](https://insights.sbomify.com/CVE-2026-57588/): SQL Injection in Nessus via Malicious Scan Result File Import (low 1.6)
- [CVE-2026-57587](https://insights.sbomify.com/CVE-2026-57587/): SQL Injection in Nessus via Reverse DNS Lookup (low 2.1)
- [CVE-2026-57586](https://insights.sbomify.com/CVE-2026-57586/): CodeRAG: Gradle Wrapper Execution During Dependency Discovery Enables Arbitrary Code Execution (high 8.6)
- [CVE-2026-57585](https://insights.sbomify.com/CVE-2026-57585/): MessagePack: Out-of-bounds read/crash on Unpacker reuse after caught error (high 7.5)
- [CVE-2026-57584](https://insights.sbomify.com/CVE-2026-57584/): Phalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoS (high 8.7)
- [CVE-2026-57583](https://insights.sbomify.com/CVE-2026-57583/): OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source (low 3.3)
- [CVE-2026-57581](https://insights.sbomify.com/CVE-2026-57581/): DotVVM: Unrestricted file upload (medium 5.3)
- [CVE-2026-57580](https://insights.sbomify.com/CVE-2026-57580/): authentik: Account Takeover via SAML NameID Comment Truncation (critical 9.4)
- [CVE-2026-5758](https://insights.sbomify.com/CVE-2026-5758/): Mafintosh's protocol-buffers-schema is vulnerable to prototype pollution (medium 6.5)
- [CVE-2026-57579](https://insights.sbomify.com/CVE-2026-57579/): Alchemy: Unauthenticated nested page API leaks restricted & unpublished content (high 7.5)
- [CVE-2026-57578](https://insights.sbomify.com/CVE-2026-57578/): DotVVM: Missing authorization in AuthorizeActionFilter (critical 9.2)
- [CVE-2026-57577](https://insights.sbomify.com/CVE-2026-57577/): DotVVM: ReDOS in routing (high 8.2)
- [CVE-2026-57576](https://insights.sbomify.com/CVE-2026-57576/): plone.app.dexterity and plone.app.contenttypes have a Denial of Service due to excessive title or description length (medium 6.5)
- [CVE-2026-57575](https://insights.sbomify.com/CVE-2026-57575/): Misskey: SSRF bypass in URL Preview (medium 6.9)
- [CVE-2026-57574](https://insights.sbomify.com/CVE-2026-57574/): Misskey: TOTP tokens can be reused (high 7.4)
- [CVE-2026-57573](https://insights.sbomify.com/CVE-2026-57573/): Crawl4AI unauthenticated SSRF in Docker streaming crawl endpoint (high 8.6)
- [CVE-2026-57572](https://insights.sbomify.com/CVE-2026-57572/): Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_args (critical 10.0)
- [CVE-2026-57571](https://insights.sbomify.com/CVE-2026-57571/): Crawl4AI arbitrary file write via download filename path traversal (critical 9.6)
- [CVE-2026-57570](https://insights.sbomify.com/CVE-2026-57570/): backpack/crud: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation (medium 6.5)
- [CVE-2026-5757](https://insights.sbomify.com/CVE-2026-5757/): There exists an unauthenticated remote information disclosure vulnerability in Ollama's model quantization engine (high 7.5)
- [CVE-2026-57569](https://insights.sbomify.com/CVE-2026-57569/): Lychee: Distinct post-fix SSRF variant in Photo::fromUrl due to missing IP pinning after DNS-based validation (low 2.3)
- [CVE-2026-57568](https://insights.sbomify.com/CVE-2026-57568/): Lychee: Stored XSS via Markdown javascript: Links in Photo and Album Descriptions (Gallery View) (medium 5.7)
- [CVE-2026-5756](https://insights.sbomify.com/CVE-2026-5756/): Unauthenticated Configuration File Modification Vulnerability in DRC Central Office Services (COS) (high 7.5)
- [CVE-2026-57559](https://insights.sbomify.com/CVE-2026-57559/): Use After Free in DSP_Services (high 7.8)
- [CVE-2026-57555](https://insights.sbomify.com/CVE-2026-57555/): Use After Free in DSP Service (high 7.8)
- [CVE-2026-57554](https://insights.sbomify.com/CVE-2026-57554/): Use After Free in DSP Service (high 7.8)
- [CVE-2026-5755](https://insights.sbomify.com/CVE-2026-5755/): Denial of service via crafted TIFF file upload (medium 6.5)
- [CVE-2026-57546](https://insights.sbomify.com/CVE-2026-57546/): Buffer Over-read in WLAN HAL (high 7.5)
- [CVE-2026-57545](https://insights.sbomify.com/CVE-2026-57545/): Untrusted Pointer Dereference in Graphics (high 7.8)
- [CVE-2026-5754](https://insights.sbomify.com/CVE-2026-5754/): Radware Alteon has a reflected XSS vulnerability (medium 6.1)
- [CVE-2026-57537](https://insights.sbomify.com/CVE-2026-57537/): Use After Free in DSP Service (high 7.8)
- [CVE-2026-57536](https://insights.sbomify.com/CVE-2026-57536/): Insufficient validation of payment status in pretix-mollie (medium 6.3)
- [CVE-2026-57535](https://insights.sbomify.com/CVE-2026-57535/): Server-side request forgery in pretix (low 2.1)
- [CVE-2026-57534](https://insights.sbomify.com/CVE-2026-57534/): Stored XSS in pretix-pages (low 2.1)
- [CVE-2026-57533](https://insights.sbomify.com/CVE-2026-57533/): Cross-site scripting in pretix (low 2.1)
- [CVE-2026-57532](https://insights.sbomify.com/CVE-2026-57532/): Cross-site scripting in pretix (high 8.8)
- [CVE-2026-57531](https://insights.sbomify.com/CVE-2026-57531/): Milkdown < 7.21.3 DOM XSS via innerHTML Assignment (medium 5.1)
- [CVE-2026-57530](https://insights.sbomify.com/CVE-2026-57530/): Milkdown < 7.21.3 Stored XSS via javascript: URL in link href (medium 5.1)
- [CVE-2026-5753](https://insights.sbomify.com/CVE-2026-5753/): Missing authorization in All-in-One WP Migration Unlimited Extension (medium 6.5)
- [CVE-2026-57527](https://insights.sbomify.com/CVE-2026-57527/): ZAP ViewState Add-on Insecure Deserialization via JSFViewState.decode() (high 8.7)
- [CVE-2026-57522](https://insights.sbomify.com/CVE-2026-57522/): Bitwarden Server < 2026.5.0 JSON Injection via Webhook Templates (low 2.3)
- [CVE-2026-57521](https://insights.sbomify.com/CVE-2026-57521/): Bitwarden Server < 2026.5.0 Broken Access Control via PreviewInvoiceController (medium 5.3)
- [CVE-2026-57520](https://insights.sbomify.com/CVE-2026-57520/): Bitwarden Server < 2026.5.0 Privilege Escalation via Bulk User Remove Endpoint (high 7.1)
- [CVE-2026-5752](https://insights.sbomify.com/CVE-2026-5752/): CVE-2026-5752 (critical 9.3)
- [CVE-2026-57518](https://insights.sbomify.com/CVE-2026-57518/): Pagekit CMS 1.0.18 Privilege Escalation via UserApiController (high 8.7)
- [CVE-2026-57517](https://insights.sbomify.com/CVE-2026-57517/): Control Web Panel < 0.9.8.1225 Blind SQL Injection via userRes Parameter (critical 9.3)
- [CVE-2026-57516](https://insights.sbomify.com/CVE-2026-57516/): Ray < 2.56.0 Unsafe Deserialization RCE via WebDataset Reader (high 8.6)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/525/