# Vulnerabilities published in 2026


- [CVE-2026-57511](https://insights.sbomify.com/CVE-2026-57511/): SuperPlane < 0.30.0 SMTP Header Injection via Webhook Event Title (medium 6.3)
- [CVE-2026-57510](https://insights.sbomify.com/CVE-2026-57510/): SuperPlane < 0.27.0 Broken Object Level Authorization via CanvasService gRPC (high 8.7)
- [CVE-2026-5751](https://insights.sbomify.com/CVE-2026-5751/): justhtml before 1.14.0 Mutation XSS via custom sanitization policies (medium 5.1)
- [CVE-2026-57501](https://insights.sbomify.com/CVE-2026-57501/): Security feature bypass in desktop (not scored)
- [CVE-2026-5750](https://insights.sbomify.com/CVE-2026-5750/): Insecure direct object reference (IDOR) vulnerability in Fullstep (high 7.6)
- [CVE-2026-57499](https://insights.sbomify.com/CVE-2026-57499/): Liman: OS Command Injection in LogRotationController allows authenticated admin to execute arbitrary commands (RCE) (critical 9.1)
- [CVE-2026-57498](https://insights.sbomify.com/CVE-2026-57498/): Missing authorization in coolify (critical 9.6)
- [CVE-2026-57497](https://insights.sbomify.com/CVE-2026-57497/): webtransport-go: Memory Exhaustion Attack due to Buffering of Unknown Capsules (medium 5.3)
- [CVE-2026-57496](https://insights.sbomify.com/CVE-2026-57496/): NetLicensing MCP Server: REST Path Traversal Bypasses Token Redaction (critical 9.6)
- [CVE-2026-57495](https://insights.sbomify.com/CVE-2026-57495/): AgenticMail: Unauthenticated inbound mail triggers bypassPermissions resume of the operator's Claude Code session (bridge-wake) (high 8.2)
- [CVE-2026-57494](https://insights.sbomify.com/CVE-2026-57494/): AgenticMail: Cross-agent task authorization bypass in AgenticMail API (high 7.1)
- [CVE-2026-57493](https://insights.sbomify.com/CVE-2026-57493/): FileRise: Remember-me auto-login uses stale admin role from token instead of current role (medium 6.8)
- [CVE-2026-57492](https://insights.sbomify.com/CVE-2026-57492/): FileRise: Setup mode re-activates when users.txt becomes empty, allowing unauthenticated admin creation (high 7.4)
- [CVE-2026-57491](https://insights.sbomify.com/CVE-2026-57491/): FileRise: ZIP extraction writes blocked file extensions to disk, bypassing the upload blocklist (medium 6.5)
- [CVE-2026-57490](https://insights.sbomify.com/CVE-2026-57490/): FileRise: WebDAV authentication bypasses TOTP/MFA entirely (high 8.1)
- [CVE-2026-5749](https://insights.sbomify.com/CVE-2026-5749/): Inadequate access control vulnerability in Fullstep (high 8.7)
- [CVE-2026-57489](https://insights.sbomify.com/CVE-2026-57489/): FileRise: AUTH_BYPASS reverse-proxy header trust without source IP validation enables full authentication bypass (high 8.1)
- [CVE-2026-57488](https://insights.sbomify.com/CVE-2026-57488/): pupnp: Integer truncation in HTTP Content-Length parsing enables request smuggling (high 7.1)
- [CVE-2026-57487](https://insights.sbomify.com/CVE-2026-57487/): libupnp chunked HTTP bodies can bypass g_maxContentLength and be fully buffered (high 7.5)
- [CVE-2026-57486](https://insights.sbomify.com/CVE-2026-57486/): pupnp: NULL pointer dereference in ixmlNode_compare crashes on non-namespaced attributes (high 7.5)
- [CVE-2026-57485](https://insights.sbomify.com/CVE-2026-57485/): Stirling-PDF: Internal Service Account API Key Disclosure via Pipeline Endpoint (high 8.5)
- [CVE-2026-57481](https://insights.sbomify.com/CVE-2026-57481/): Parse Server: LiveQuery discloses object data to a subscriber across an ACL read-access change (low 2.3)
- [CVE-2026-57480](https://insights.sbomify.com/CVE-2026-57480/): Parse Server: Denial of service via exponential-time processing of deeply nested query operators (high 8.7)
- [CVE-2026-5748](https://insights.sbomify.com/CVE-2026-5748/): Text Snippets <= 0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'w' Shortcode Attribute (medium 6.4)
- [CVE-2026-57476](https://insights.sbomify.com/CVE-2026-57476/): Deloitte AI Assist for Customer unauthenticated RAG corpus read and write (medium 6.3)
- [CVE-2026-57475](https://insights.sbomify.com/CVE-2026-57475/): Deloitte AI Assist for Customer unauthenticated configuration write (medium 6.9)
- [CVE-2026-57474](https://insights.sbomify.com/CVE-2026-57474/): Deloitte AI Assist for Customer information disclosure (medium 6.9)
- [CVE-2026-57473](https://insights.sbomify.com/CVE-2026-57473/): Weak cryptography in Home Hub (medium 5.8)
- [CVE-2026-57472](https://insights.sbomify.com/CVE-2026-57472/): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in KUNBUS RevPiPyLoad (medium 6.9)
- [CVE-2026-57471](https://insights.sbomify.com/CVE-2026-57471/): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in KUNBUS RevPiPyLoad (medium 6.8)
- [CVE-2026-5747](https://insights.sbomify.com/CVE-2026-5747/): Out-of-bounds Write in Firecracker virtio-pci Transport (high 8.7)
- [CVE-2026-57469](https://insights.sbomify.com/CVE-2026-57469/): Cross-Site Request Forgery (CSRF) in KUNBUS PiCtory (medium 5.1)
- [CVE-2026-57458](https://insights.sbomify.com/CVE-2026-57458/): Vikunja: Scoped API token can mint unrestricted OAuth session credentials (high 8.1)
- [CVE-2026-57456](https://insights.sbomify.com/CVE-2026-57456/): Vim: Arbitrary Code Execution via Python Omni-Completion Docstrings (high 8.4)
- [CVE-2026-57455](https://insights.sbomify.com/CVE-2026-57455/): Vim: Stack out-of-bounds write in `spell_soundfold_sofo()` via an over-length `soundfold()` argument (medium 4.0)
- [CVE-2026-57454](https://insights.sbomify.com/CVE-2026-57454/): Vim: Out-of-bounds Read with Text Properties (medium 6.8)
- [CVE-2026-57453](https://insights.sbomify.com/CVE-2026-57453/): Vim: PowerShell Command Injection via Unescaped Filename in zip.vim Extraction (medium 6.5)
- [CVE-2026-57452](https://insights.sbomify.com/CVE-2026-57452/): Vim: Out-of-bounds Read with libsodium-encrypted Files (medium 5.5)
- [CVE-2026-57451](https://insights.sbomify.com/CVE-2026-57451/): Vim: Out-of-bounds Read in Text Property Count (medium 5.3)
- [CVE-2026-5745](https://insights.sbomify.com/CVE-2026-5745/): Libarchive: a null pointer dereference vulnerability exists in the acl parser of libarchive (medium 5.5)
- [CVE-2026-57449](https://insights.sbomify.com/CVE-2026-57449/): Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token (high 7.1)
- [CVE-2026-57448](https://insights.sbomify.com/CVE-2026-57448/): Blombooru: administrator image-proxy server-side request forgery (medium 6.2)
- [CVE-2026-57447](https://insights.sbomify.com/CVE-2026-57447/): Discourse Doc Categories: Doc category index refresh leaks private topic titles (medium 4.3)
- [CVE-2026-57446](https://insights.sbomify.com/CVE-2026-57446/): libIEC61850: Server-side double free in MMS ObtainFile task reuse due to stale FILE* handle (medium 5.3)
- [CVE-2026-57445](https://insights.sbomify.com/CVE-2026-57445/): Gardens v2: Approve-side dispute resolution drains active streaming escrow reserve (high 8.7)
- [CVE-2026-57443](https://insights.sbomify.com/CVE-2026-57443/): SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests (high 7.5)
- [CVE-2026-57442](https://insights.sbomify.com/CVE-2026-57442/): MCPVault: PathFilter restricted directories (.git/.obsidian/node_modules) only denied at vault root, not nested (medium 6.9)
- [CVE-2026-57441](https://insights.sbomify.com/CVE-2026-57441/): MCPVault: PathFilter restricted-directory deny-list bypass via case and trailing dot/space equivalence (high 8.4)
- [CVE-2026-57440](https://insights.sbomify.com/CVE-2026-57440/): Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled (high 7.5)
- [CVE-2026-57439](https://insights.sbomify.com/CVE-2026-57439/): CyberChef: Prototype pollution in Series Chart operation (medium 5.0)
- [CVE-2026-57438](https://insights.sbomify.com/CVE-2026-57438/): Nokogiri: Possible Use-After-Free in XInclude Processing (low 2.2)
- [CVE-2026-57437](https://insights.sbomify.com/CVE-2026-57437/): Nokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetime (low 1.7)
- [CVE-2026-57436](https://insights.sbomify.com/CVE-2026-57436/): Nokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node type (low 1.7)
- [CVE-2026-57435](https://insights.sbomify.com/CVE-2026-57435/): Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=` (low 1.7)
- [CVE-2026-57434](https://insights.sbomify.com/CVE-2026-57434/): Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes (low 1.7)
- [CVE-2026-57433](https://insights.sbomify.com/CVE-2026-57433/): Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record (critical 9.8)
- [CVE-2026-57432](https://insights.sbomify.com/CVE-2026-57432/): Integer overflow in perl:perl (high 8.4)
- [CVE-2026-57431](https://insights.sbomify.com/CVE-2026-57431/): WordPress Featured Image plugin <= 2.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-57430](https://insights.sbomify.com/CVE-2026-57430/): WordPress SEOPress PRO plugin <= 9.1.1 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-5743](https://insights.sbomify.com/CVE-2026-5743/): Cross-site scripting in SimpLy Gallery (medium 6.4)
- [CVE-2026-57429](https://insights.sbomify.com/CVE-2026-57429/): WordPress Slim SEO plugin <= 4.6.2 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-57428](https://insights.sbomify.com/CVE-2026-57428/): WordPress Sprout Clients plugin <= 3.2.3 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57427](https://insights.sbomify.com/CVE-2026-57427/): WordPress Download Monitor - WPForms Lock plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57426](https://insights.sbomify.com/CVE-2026-57426/): WordPress Modula - PRO plugin <= 2.10.8 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57425](https://insights.sbomify.com/CVE-2026-57425/): WordPress Autopay dla WooCommerce plugin <= 2.2.27 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-57424](https://insights.sbomify.com/CVE-2026-57424/): WordPress Razorpay Payment Links for WooCommerce plugin <= 2.1.4 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-57423](https://insights.sbomify.com/CVE-2026-57423/): WordPress Message Filter for Contact Form 7 plugin <= 1.6.3.8 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57422](https://insights.sbomify.com/CVE-2026-57422/): Cross-site scripting in Bopo – WooCommerce Product Bundle Builder (high 7.1)
- [CVE-2026-57421](https://insights.sbomify.com/CVE-2026-57421/): WordPress CRM Perks Forms plugin <= 1.1.7 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57420](https://insights.sbomify.com/CVE-2026-57420/): WordPress Author Box WP Lens plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-5742](https://insights.sbomify.com/CVE-2026-5742/): UsersWP <= 1.2.60 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Badge Link Substitution (medium 6.4)
- [CVE-2026-57419](https://insights.sbomify.com/CVE-2026-57419/): WordPress Stock Locations for WooCommerce plugin <= 3.1.8 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-57418](https://insights.sbomify.com/CVE-2026-57418/): WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.13 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-57417](https://insights.sbomify.com/CVE-2026-57417/): WordPress Cart Lift plugin <= 3.1.57 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57416](https://insights.sbomify.com/CVE-2026-57416/): WordPress SiteGround Email Marketing plugin <= 1.7.5 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57415](https://insights.sbomify.com/CVE-2026-57415/): WordPress Gift Vouchers plugin <= 4.7.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57414](https://insights.sbomify.com/CVE-2026-57414/): WordPress ChatBot for eCommerce – WoowBot plugin <= 4.6.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-57413](https://insights.sbomify.com/CVE-2026-57413/): WordPress Instant Image Generator plugin <= 2.1.4 - Server Side Request Forgery (SSRF) vulnerability (medium 6.4)
- [CVE-2026-57412](https://insights.sbomify.com/CVE-2026-57412/): WordPress Gift Vouchers plugin <= 4.6.9 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-57411](https://insights.sbomify.com/CVE-2026-57411/): Cross-site scripting in CF7 Views &#8211; Complete Entry Management for Contact Form 7 (high 7.1)
- [CVE-2026-57410](https://insights.sbomify.com/CVE-2026-57410/): WordPress MailerPress plugin <= 2.0.2 - Privilege Escalation vulnerability (high 8.8)
- [CVE-2026-5741](https://insights.sbomify.com/CVE-2026-5741/): suvarchal docker-mcp-server HTTP index.ts pull_image os command injection (medium 6.9)
- [CVE-2026-57409](https://insights.sbomify.com/CVE-2026-57409/): WordPress Active Products Tables for WooCommerce plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57408](https://insights.sbomify.com/CVE-2026-57408/): WordPress Peach Payments Gateway plugin <= 4.0.2 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-57407](https://insights.sbomify.com/CVE-2026-57407/): WordPress PDF Generator for WordPress plugin <= 1.6.2 - Server Side Request Forgery (SSRF) vulnerability (high 7.2)
- [CVE-2026-57406](https://insights.sbomify.com/CVE-2026-57406/): WordPress FundEngine plugin <= 1.7.6 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-57405](https://insights.sbomify.com/CVE-2026-57405/): WordPress Open Shop theme <= 1.7.1 - Broken Access Control vulnerability (high 7.1)
- [CVE-2026-57404](https://insights.sbomify.com/CVE-2026-57404/): WordPress Booking and Rental Manager plugin <= 2.6.9 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-57403](https://insights.sbomify.com/CVE-2026-57403/): WordPress GD Security Headers plugin <= 1.8 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57402](https://insights.sbomify.com/CVE-2026-57402/): WordPress Flexible Refund and Return Order for WooCommerce plugin <= 1.0.51 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-57401](https://insights.sbomify.com/CVE-2026-57401/): WordPress SureDash plugin <= 1.8.0 - Arbitrary File Deletion vulnerability (critical 9.9)
- [CVE-2026-57400](https://insights.sbomify.com/CVE-2026-57400/): WordPress Event Tickets Manager for WooCommerce plugin <= 1.5.5 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-5740](https://insights.sbomify.com/CVE-2026-5740/): Unauthenticated WebSocket binary frame causes denial of service in Mattermost Server (high 7.5)
- [CVE-2026-57399](https://insights.sbomify.com/CVE-2026-57399/): WordPress Proxy & VPN Blocker plugin <= 3.5.8 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57398](https://insights.sbomify.com/CVE-2026-57398/): WordPress Real Estate Manager Pro plugin <= 12.8.3 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57397](https://insights.sbomify.com/CVE-2026-57397/): WordPress Coaching theme <= 3.9.2 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57396](https://insights.sbomify.com/CVE-2026-57396/): WordPress Free Gifts for WooCommerce plugin <= 13.1.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57395](https://insights.sbomify.com/CVE-2026-57395/): WordPress Tourfic plugin <= 2.22.5 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-57394](https://insights.sbomify.com/CVE-2026-57394/): WordPress Newsletters plugin <= 4.14 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-57393](https://insights.sbomify.com/CVE-2026-57393/): WordPress WooCommerce PDF Invoice Builder plugin <= 2.0.8 - Sensitive Data Exposure vulnerability (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/526/