# Vulnerabilities published in 2026


- [CVE-2026-56128](https://insights.sbomify.com/CVE-2026-56128/): pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_schedule_edit.php (medium 5.1)
- [CVE-2026-56127](https://insights.sbomify.com/CVE-2026-56127/): pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_rules_edit.php (medium 5.1)
- [CVE-2026-56126](https://insights.sbomify.com/CVE-2026-56126/): pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via status_monitoring.php (medium 5.1)
- [CVE-2026-56124](https://insights.sbomify.com/CVE-2026-56124/): phpUploader < 2.0.2 Unauthenticated Database Exposure via index model (high 8.7)
- [CVE-2026-56123](https://insights.sbomify.com/CVE-2026-56123/): socat 1.8.0.0 - 1.8.1.1 Heap Buffer Overflow via SOCKS5 Reply Parser (critical 9.2)
- [CVE-2026-56122](https://insights.sbomify.com/CVE-2026-56122/): Winstone Servlet Engine 0.9.10 Path Traversal via HTTP Request Paths (high 8.7)
- [CVE-2026-56121](https://insights.sbomify.com/CVE-2026-56121/): Feast < 0.63.0 Unauthenticated RCE via ApplyFeatureView gRPC Deserialization (critical 9.3)
- [CVE-2026-5612](https://insights.sbomify.com/CVE-2026-5612/): Belkin F9K1015 formWlEncrypt stack-based overflow (high 8.7)
- [CVE-2026-56117](https://insights.sbomify.com/CVE-2026-56117/): dhcpcd Heap Use-After-Free via Control Socket Handling (medium 5.7)
- [CVE-2026-56116](https://insights.sbomify.com/CVE-2026-56116/): dhcpcd Memory Leak DoS via IPv6 Router Advertisement Handling (high 7.1)
- [CVE-2026-56115](https://insights.sbomify.com/CVE-2026-56115/): Bootimus 0.1.70 Broken Access Control via JWTMiddleware Authorization Bypass (high 8.7)
- [CVE-2026-56114](https://insights.sbomify.com/CVE-2026-56114/): dhcpcd Stack Out-of-Bounds Write in dhcp6_makemessage() (medium 6.0)
- [CVE-2026-56113](https://insights.sbomify.com/CVE-2026-56113/): dhcpcd Heap Use-After-Free in dhcp6_deprecateaddrs via DHCPv6 RENEW (medium 6.0)
- [CVE-2026-56111](https://insights.sbomify.com/CVE-2026-56111/): Marlin Firmware 2.1.2.7 Out-of-Bounds Write via M421 G-code Handler (high 8.3)
- [CVE-2026-5611](https://insights.sbomify.com/CVE-2026-5611/): Belkin F9K1015 formCrossBandSwitch stack-based overflow (high 8.7)
- [CVE-2026-56109](https://insights.sbomify.com/CVE-2026-56109/): ALSA Library < 1.2.16.1 Double-Free via parse_def() in conf.c (high 7.0)
- [CVE-2026-56104](https://insights.sbomify.com/CVE-2026-56104/): Chainlit < 2.10.1 Session Hijacking via WebSocket Session Restoration (high 8.8)
- [CVE-2026-56101](https://insights.sbomify.com/CVE-2026-56101/): OpenBSD ieee80211_crypto_tkip.c TKIP MIC Countermeasure Logic Inversion DoS (medium 6.0)
- [CVE-2026-56100](https://insights.sbomify.com/CVE-2026-56100/): SpringBlade 2.7.3 < 5.0.0 Privilege Escalation via Exposed Feign Endpoint (high 8.6)
- [CVE-2026-5610](https://insights.sbomify.com/CVE-2026-5610/): Belkin F9K1015 formWISP5G stack-based overflow (high 8.7)
- [CVE-2026-56099](https://insights.sbomify.com/CVE-2026-56099/): OpenBSD mpls_do_error Kernel Stack Memory Disclosure via MPLS Input (medium 6.9)
- [CVE-2026-56098](https://insights.sbomify.com/CVE-2026-56098/): Rubygem-katello: improper authorization logic allows resource enumeration (medium 4.3)
- [CVE-2026-56097](https://insights.sbomify.com/CVE-2026-56097/): Rubygem-katello: sql injection in registry proxy via labels (medium 6.5)
- [CVE-2026-56096](https://insights.sbomify.com/CVE-2026-56096/): Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr) (medium 6.3)
- [CVE-2026-56095](https://insights.sbomify.com/CVE-2026-56095/): Insecure Deserialization in extension "Apache Solr for TYPO3 - Enterprise Search" (solr) (high 7.7)
- [CVE-2026-56094](https://insights.sbomify.com/CVE-2026-56094/): Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr) (medium 6.3)
- [CVE-2026-56093](https://insights.sbomify.com/CVE-2026-56093/): Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr) (medium 6.3)
- [CVE-2026-56092](https://insights.sbomify.com/CVE-2026-56092/): Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr) (high 7.6)
- [CVE-2026-56091](https://insights.sbomify.com/CVE-2026-56091/): Apache Shiro: Authentication bypass in Guice-Web integration (high 8.2)
- [CVE-2026-56090](https://insights.sbomify.com/CVE-2026-56090/): Privilege escalation in ObjectScale (high 7.3)
- [CVE-2026-5609](https://insights.sbomify.com/CVE-2026-5609/): Tenda i12 Parameter wifiSSIDset formwrlSSIDset stack-based overflow (high 8.7)
- [CVE-2026-56089](https://insights.sbomify.com/CVE-2026-56089/): Path traversal in ObjectScale (low 3.3)
- [CVE-2026-56088](https://insights.sbomify.com/CVE-2026-56088/): SQL injection in OpenManage Enterprise (high 7.1)
- [CVE-2026-56087](https://insights.sbomify.com/CVE-2026-56087/): Security feature bypass in ThinOS 10 (medium 6.1)
- [CVE-2026-56086](https://insights.sbomify.com/CVE-2026-56086/): Missing authorization in PowerProtect Data Domain (high 8.8)
- [CVE-2026-56085](https://insights.sbomify.com/CVE-2026-56085/): Information disclosure in PowerProtect Data Domain (low 3.3)
- [CVE-2026-56084](https://insights.sbomify.com/CVE-2026-56084/): Server-side request forgery in PowerProtect Data Domain (medium 5.8)
- [CVE-2026-56082](https://insights.sbomify.com/CVE-2026-56082/): Capgo - Unauthenticated Cross-Tenant Billing Log Tampering via public.record_build_time RPC (high 8.7)
- [CVE-2026-56081](https://insights.sbomify.com/CVE-2026-56081/): Cap-go - Account Lockout via 2FA Misconfiguration on Unverified Email (critical 9.3)
- [CVE-2026-56080](https://insights.sbomify.com/CVE-2026-56080/): Cap-go - Authentication Logic Flaw in Enforce Password Policy (medium 6.9)
- [CVE-2026-5608](https://insights.sbomify.com/CVE-2026-5608/): Belkin F9K1122 formWlanSetup stack-based overflow (high 8.7)
- [CVE-2026-56079](https://insights.sbomify.com/CVE-2026-56079/): Capgo - Cross-Tenant Authorization Bypass via PostgREST Webhook Access (high 7.1)
- [CVE-2026-56078](https://insights.sbomify.com/CVE-2026-56078/): PraisonAI - Arbitrary File Read and Write via Path Traversal in MultiAgentMonitor (high 8.7)
- [CVE-2026-56077](https://insights.sbomify.com/CVE-2026-56077/): PraisonAI - Information Disclosure via Shared MultiAgentLedger State (high 7.1)
- [CVE-2026-56076](https://insights.sbomify.com/CVE-2026-56076/): PraisonAI - Cross-Origin Agent Execution via Hardcoded Wildcard CORS and Missing Authentication on AGUI Endpoint (high 8.6)
- [CVE-2026-56075](https://insights.sbomify.com/CVE-2026-56075/): PraisonAI - Arbitrary Shell Command Execution via Hardcoded Approval Mode Override (high 8.7)
- [CVE-2026-56074](https://insights.sbomify.com/CVE-2026-56074/): PraisonAI - Tool Approval Cache Bypass via Coarse-Grained Caching (medium 6.8)
- [CVE-2026-56073](https://insights.sbomify.com/CVE-2026-56073/): Cap-go - OTP Bypass via Response Manipulation in Email Verification (critical 9.3)
- [CVE-2026-56072](https://insights.sbomify.com/CVE-2026-56072/): WordPress WoodMart theme <= 8.5.3 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-56071](https://insights.sbomify.com/CVE-2026-56071/): WordPress Forminator plugin <= 1.53.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-56070](https://insights.sbomify.com/CVE-2026-56070/): WordPress Advance Product Search plugin <= 1.4.4 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-5607](https://insights.sbomify.com/CVE-2026-5607/): imprvhub mcp-browser-agent URL Parameter handlers.ts CallToolRequestSchema server-side request forgery (medium 5.3)
- [CVE-2026-56069](https://insights.sbomify.com/CVE-2026-56069/): WordPress Toolset Forms plugin <= 2.6.24 - Insecure Direct Object References (IDOR) vulnerability (high 7.5)
- [CVE-2026-56068](https://insights.sbomify.com/CVE-2026-56068/): WordPress JetEngine plugin <= 3.8.10.2 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-56067](https://insights.sbomify.com/CVE-2026-56067/): WordPress JetSmartFilters plugin <= 3.8.3 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-56066](https://insights.sbomify.com/CVE-2026-56066/): WordPress ShortPixel Adaptive Images plugin <= 3.11.4 - Arbitrary File Deletion vulnerability (medium 5.8)
- [CVE-2026-56064](https://insights.sbomify.com/CVE-2026-56064/): WordPress Tourfic plugin <= 2.22.5 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-56063](https://insights.sbomify.com/CVE-2026-56063/): WordPress MailChimp Block plugin <= 1.1.15 - Broken Access Control vulnerability (high 8.3)
- [CVE-2026-56062](https://insights.sbomify.com/CVE-2026-56062/): WordPress Quotes llama plugin <= 3.1.5 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-56061](https://insights.sbomify.com/CVE-2026-56061/): WordPress Subscriptions for WooCommerce plugin <= 1.9.5 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-56060](https://insights.sbomify.com/CVE-2026-56060/): WordPress Print Invoice & Delivery Notes for WooCommerce plugin <= 7.1.1 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2026-5606](https://insights.sbomify.com/CVE-2026-5606/): PHPGurukul Online Shopping Portal Project Parameter order-details.php sql injection (medium 5.3)
- [CVE-2026-56059](https://insights.sbomify.com/CVE-2026-56059/): WordPress Travel Booking theme <= 2.2.5 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2026-56058](https://insights.sbomify.com/CVE-2026-56058/): WordPress Quform plugin <= 2.23.0 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2026-56057](https://insights.sbomify.com/CVE-2026-56057/): WordPress Uncanny Automator Pro plugin <= 7.3.0.6 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-56056](https://insights.sbomify.com/CVE-2026-56056/): WordPress The Post Grid plugin <= 7.9.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-56055](https://insights.sbomify.com/CVE-2026-56055/): WordPress RealHomes theme <= 4.5.3 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-56054](https://insights.sbomify.com/CVE-2026-56054/): WordPress JS Help Desk plugin <= 3.1.1 - Arbitrary File Deletion vulnerability (high 7.7)
- [CVE-2026-56053](https://insights.sbomify.com/CVE-2026-56053/): WordPress EventPrime plugin <= 4.3.4.1 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-56052](https://insights.sbomify.com/CVE-2026-56052/): WordPress Funnel Builder by FunnelKit plugin <= 3.15.0.5 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-56051](https://insights.sbomify.com/CVE-2026-56051/): WordPress TablePress plugin <= 3.3.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-56050](https://insights.sbomify.com/CVE-2026-56050/): WordPress PPOM for WooCommerce plugin <= 33.0.18 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-5605](https://insights.sbomify.com/CVE-2026-5605/): Tenda CH22 WrlExtraSet formWrlExtraSet stack-based overflow (high 8.7)
- [CVE-2026-56049](https://insights.sbomify.com/CVE-2026-56049/): WordPress Post Snippets plugin <= 4.0.19 - Remote Code Execution (RCE) vulnerability (high 8.5)
- [CVE-2026-56048](https://insights.sbomify.com/CVE-2026-56048/): Missing authorization in Payment Gateway Based Fees and Discounts for WooCommerce (medium 6.5)
- [CVE-2026-56047](https://insights.sbomify.com/CVE-2026-56047/): WordPress perfmatters plugin <= 2.6.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-56046](https://insights.sbomify.com/CVE-2026-56046/): WordPress ListingPro theme <= 2.9.11 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-56045](https://insights.sbomify.com/CVE-2026-56045/): WordPress Automatic plugin < 3.135.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-56044](https://insights.sbomify.com/CVE-2026-56044/): WordPress Blog2Social plugin <= 8.9.2 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-56043](https://insights.sbomify.com/CVE-2026-56043/): WordPress Customer Reviews for WooCommerce plugin <= 5.110.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-56042](https://insights.sbomify.com/CVE-2026-56042/): WordPress Advanced Order Export For WooCommerce plugin <= 4.0.9 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-56041](https://insights.sbomify.com/CVE-2026-56041/): WordPress Responsive Lightbox plugin <= 2.7.6 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-56040](https://insights.sbomify.com/CVE-2026-56040/): WordPress Gutenverse Form plugin <= 2.4.7 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-5604](https://insights.sbomify.com/CVE-2026-5604/): Tenda CH22 Parameter CertLocalPrecreate formCertLocalPrecreate stack-based overflow (high 8.7)
- [CVE-2026-56039](https://insights.sbomify.com/CVE-2026-56039/): WordPress Quick Interest Slider plugin <= 3.1.6 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-56038](https://insights.sbomify.com/CVE-2026-56038/): WordPress Frisbii Pay plugin <= 1.8.2 - Privilege Escalation vulnerability (high 8.8)
- [CVE-2026-56037](https://insights.sbomify.com/CVE-2026-56037/): WordPress Themify Popup plugin <= 1.4.3 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-56036](https://insights.sbomify.com/CVE-2026-56036/): WordPress 워드프레스 결제 심플페이 plugin <= 5.5.6 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-56035](https://insights.sbomify.com/CVE-2026-56035/): WordPress BitFire Security plugin <= 5.0.3 - Multiple Vulnerabilities vulnerability (high 8.6)
- [CVE-2026-56034](https://insights.sbomify.com/CVE-2026-56034/): WordPress Library Management System plugin <= 3.5.7 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-56033](https://insights.sbomify.com/CVE-2026-56033/): WordPress Dokan Pro plugin <= 5.0.4 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2026-56032](https://insights.sbomify.com/CVE-2026-56032/): WordPress Buddyboss Platform plugin <= 3.0.4 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-56031](https://insights.sbomify.com/CVE-2026-56031/): WordPress Uncanny Automator plugin <= 7.3.1.2 - PHP Object Injection vulnerability (high 8.1)
- [CVE-2026-56030](https://insights.sbomify.com/CVE-2026-56030/): WordPress Paytium plugin <= 5.0.2 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2026-5603](https://insights.sbomify.com/CVE-2026-5603/): elgentos magento2-dev-mcp index.ts executeMagerun2Command os command injection (medium 4.8)
- [CVE-2026-56029](https://insights.sbomify.com/CVE-2026-56029/): WordPress CorvusPay WooCommerce Payment Gateway plugin <= 2.7.4 - Broken Authentication vulnerability (high 7.5)
- [CVE-2026-56028](https://insights.sbomify.com/CVE-2026-56028/): WordPress Easy Elements for Elementor – Addons & Website Templates plugin <= 1.4.9 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2026-56027](https://insights.sbomify.com/CVE-2026-56027/): WordPress Booster for WooCommerce plugin <= 8.0.1 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2026-56026](https://insights.sbomify.com/CVE-2026-56026/): WordPress utm.codes plugin <= 1.9.0 - Server Side Request Forgery (SSRF) vulnerability (medium 6.4)
- [CVE-2026-56025](https://insights.sbomify.com/CVE-2026-56025/): WordPress Paymob for WooCommerce plugin <= 4.1.2 - Broken Access Control vulnerability (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/537/