# Vulnerabilities published in 2026


- [CVE-2026-56024](https://insights.sbomify.com/CVE-2026-56024/): WordPress WP EasyPay plugin <= 4.5.0 - Cross Site Request Forgery (CSRF) vulnerability (medium 6.5)
- [CVE-2026-56023](https://insights.sbomify.com/CVE-2026-56023/): WordPress UPI QR Code Payment Gateway for WooCommerce plugin <= 1.6.2 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-56022](https://insights.sbomify.com/CVE-2026-56022/): Webmin MFA bypass (medium 6.9)
- [CVE-2026-56021](https://insights.sbomify.com/CVE-2026-56021/): Webmin information disclosure via regex pattern (medium 6.9)
- [CVE-2026-56020](https://insights.sbomify.com/CVE-2026-56020/): Webmin HTTP header authentication bypass (critical 9.2)
- [CVE-2026-5602](https://insights.sbomify.com/CVE-2026-5602/): Nor2-io heim-mcp new_heim_application tools.ts registerTools os command injection (medium 4.8)
- [CVE-2026-56018](https://insights.sbomify.com/CVE-2026-56018/): Denial of service in JavaScript::Minifier::XS (high 7.5)
- [CVE-2026-56017](https://insights.sbomify.com/CVE-2026-56017/): Null dereference in JavaScript::Minifier::XS (high 7.5)
- [CVE-2026-56016](https://insights.sbomify.com/CVE-2026-56016/): CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sources (medium 5.9)
- [CVE-2026-56015](https://insights.sbomify.com/CVE-2026-56015/): Net::IP::LPM versions before 1.11 for Perl allow a heap out-of-bounds read via an unbounded prefix length (critical 9.1)
- [CVE-2026-56014](https://insights.sbomify.com/CVE-2026-56014/): WordPress Master Slider plugin <= 3.11.5 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-56013](https://insights.sbomify.com/CVE-2026-56013/): WordPress License Manager for WooCommerce plugin <= 3.0.15 - Insecure Direct Object References (IDOR) vulnerability (medium 6.5)
- [CVE-2026-56012](https://insights.sbomify.com/CVE-2026-56012/): WordPress Media LIbrary Assistant plugin <= 3.35 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-56011](https://insights.sbomify.com/CVE-2026-56011/): WordPress MapPress Maps for WordPress plugin <= 2.97.3 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-56010](https://insights.sbomify.com/CVE-2026-56010/): WordPress Abandoned Cart Pro for WooCommerce plugin <= 10.4.0 - Privilege Escalation vulnerability (high 8.8)
- [CVE-2026-5601](https://insights.sbomify.com/CVE-2026-5601/): Acrel Electrical Prepaid Cloud Platform Backup File bin.rar information disclosure (medium 6.9)
- [CVE-2026-56009](https://insights.sbomify.com/CVE-2026-56009/): WordPress Bricksable for Bricks Builder plugin <= 1.6.83 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2026-56008](https://insights.sbomify.com/CVE-2026-56008/): WordPress Fusion Builder plugin <= 3.15.4 - Privilege Escalation vulnerability (high 8.8)
- [CVE-2026-56007](https://insights.sbomify.com/CVE-2026-56007/): WordPress Ocean Product Sharing plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2026-56006](https://insights.sbomify.com/CVE-2026-56006/): WordPress H5P plugin <= 1.17.6 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-56005](https://insights.sbomify.com/CVE-2026-56005/): WordPress WP Activity Log plugin <= 5.6.3.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-56004](https://insights.sbomify.com/CVE-2026-56004/): obs-service-tar_scm: command injection via mercurial handler (critical 10.0)
- [CVE-2026-56003](https://insights.sbomify.com/CVE-2026-56003/): libXfont2 computeProps Property Buffer Heap Buffer Overflow (high 8.5)
- [CVE-2026-56002](https://insights.sbomify.com/CVE-2026-56002/): libXfont2 PCF Font Parsing Heap Buffer Overflow (high 8.5)
- [CVE-2026-56001](https://insights.sbomify.com/CVE-2026-56001/): libXfont2 BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow (high 8.5)
- [CVE-2026-56000](https://insights.sbomify.com/CVE-2026-56000/): xorg-x11-server / xwayland GLX contextTags Use-After-Free in CommonMakeCurrent() (critical 9.0)
- [CVE-2026-5600](https://insights.sbomify.com/CVE-2026-5600/): pretix: API leaks check-in data between events of the same organizer (medium 5.5)
- [CVE-2026-55999](https://insights.sbomify.com/CVE-2026-55999/): xorg-server / xwayland glamor font atlas Heap Buffer Overflow (high 8.5)
- [CVE-2026-55998](https://insights.sbomify.com/CVE-2026-55998/): Cluster Existence Oracle via Unauthenticated Import Endpoint (medium 5.3)
- [CVE-2026-55997](https://insights.sbomify.com/CVE-2026-55997/): Long-lived Rancher registration token exposed in plaintext (high 8.8)
- [CVE-2026-55996](https://insights.sbomify.com/CVE-2026-55996/): Unauthenticated Denial-of-Service via TLS SAN Stuffing in Rancher and cattle-cluster-agent (medium 4.3)
- [CVE-2026-55995](https://insights.sbomify.com/CVE-2026-55995/): Double-free in the iSNS attribute decoder in open-iscsi (high 8.7)
- [CVE-2026-55994](https://insights.sbomify.com/CVE-2026-55994/): Apache Camel-Iggy: The inbound consumer maps externally-supplied Iggy message user-headers into the Exchange without a HeaderFilterStrategy (high 7.5)
- [CVE-2026-55993](https://insights.sbomify.com/CVE-2026-55993/): Apache Camel-Atmosphere-Websocket: The inbound consumer maps externally-supplied WebSocket query parameters into the Exchange without a HeaderFilterStrategy (high 7.5)
- [CVE-2026-55991](https://insights.sbomify.com/CVE-2026-55991/): Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2 (medium 5.9)
- [CVE-2026-55990](https://insights.sbomify.com/CVE-2026-55990/): Packet of death for a DNSCrypt misconfigured Unbound (medium 5.9)
- [CVE-2026-5599](https://insights.sbomify.com/CVE-2026-5599/): API allows deletion of users of other instance (high 7.3)
- [CVE-2026-55987](https://insights.sbomify.com/CVE-2026-55987/): Gitea: OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009) (high 8.1)
- [CVE-2026-55986](https://insights.sbomify.com/CVE-2026-55986/): Email Management API Bypasses ManageCredentials Feature Restrictions (medium 5.4)
- [CVE-2026-55985](https://insights.sbomify.com/CVE-2026-55985/): Tycon Systems TPDIN-Monitor-WEB2 Cleartext Storage of Sensitive Information (medium 5.3)
- [CVE-2026-55984](https://insights.sbomify.com/CVE-2026-55984/): Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service (low 2.7)
- [CVE-2026-55982](https://insights.sbomify.com/CVE-2026-55982/): OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes (critical 9.1)
- [CVE-2026-55981](https://insights.sbomify.com/CVE-2026-55981/): Firmware verification vulnerability (critical 9.6)
- [CVE-2026-55980](https://insights.sbomify.com/CVE-2026-55980/): Denial-of-service vulnerability in CatchPulse (medium 5.5)
- [CVE-2026-5598](https://insights.sbomify.com/CVE-2026-5598/): Non-constant time comparisons risk private key leakage in FrodoKEM. (high 8.9)
- [CVE-2026-55979](https://insights.sbomify.com/CVE-2026-55979/): Improper access control check in CatchPulse's named pipe communication interface (medium 5.2)
- [CVE-2026-55978](https://insights.sbomify.com/CVE-2026-55978/): Improper access control vulnerability in CatchPulse (high 8.4)
- [CVE-2026-55977](https://insights.sbomify.com/CVE-2026-55977/): Bypass of application rate-limiting mechanism (low 3.3)
- [CVE-2026-55976](https://insights.sbomify.com/CVE-2026-55976/): Apache Hive: SSRF vulnerability in Hive Avro Serde due to Insufficient input validation on avro.schema.url (critical 9.1)
- [CVE-2026-55975](https://insights.sbomify.com/CVE-2026-55975/): H.VIEW HV-500S6 IP Camera OS Command Injection (high 8.6)
- [CVE-2026-55973](https://insights.sbomify.com/CVE-2026-55973/): 'dns-error-reporting: yes' leads to stack buffer overflow (high 7.5)
- [CVE-2026-55971](https://insights.sbomify.com/CVE-2026-55971/): Apache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform() (critical 9.3)
- [CVE-2026-55970](https://insights.sbomify.com/CVE-2026-55970/): Apache Thrift: C++ heap out-of-bounds read in THeaderTransport::readHeaderFormat() (medium 6.9)
- [CVE-2026-5597](https://insights.sbomify.com/CVE-2026-5597/): griptape-ai griptape ComputerTool tool.py path traversal (medium 5.3)
- [CVE-2026-55969](https://insights.sbomify.com/CVE-2026-55969/): Integer overflow in Apache Thrift (high 8.7)
- [CVE-2026-55968](https://insights.sbomify.com/CVE-2026-55968/): Apache Thrift: Node.js quadratic-time DoS in server receive transports (high 8.7)
- [CVE-2026-55967](https://insights.sbomify.com/CVE-2026-55967/): AES-GCM streaming APIs do not reject >64 GiB cumulative single messages, enabling counter wrap and keystream reuse (low 2.0)
- [CVE-2026-55964](https://insights.sbomify.com/CVE-2026-55964/): Chain intermediate CA:TRUE without keyCertSign accepted as a signing CA (temporary CA exemption) (medium 6.3)
- [CVE-2026-55962](https://insights.sbomify.com/CVE-2026-55962/): TLS 1.3 post-handshake authentication: server accepts Finished without client Certificate/CertificateVerify (medium 6.0)
- [CVE-2026-55961](https://insights.sbomify.com/CVE-2026-55961/): wolfSSL_PKCS7_verify() reports success for degenerate (certs-only) PKCS#7 with no signer (high 8.2)
- [CVE-2026-55960](https://insights.sbomify.com/CVE-2026-55960/): Un-negotiated Raw Public Key (RFC 7250) accepted in place of X.509, bypassing chain validation (high 8.2)
- [CVE-2026-5596](https://insights.sbomify.com/CVE-2026-5596/): griptape-ai griptape SqlTool tool.py sql injection (medium 5.3)
- [CVE-2026-55958](https://insights.sbomify.com/CVE-2026-55958/): Renesas TSIP TLS 1.3 transcript buffer out-of-bounds write in tsip_StoreMessage (high 8.3)
- [CVE-2026-55957](https://insights.sbomify.com/CVE-2026-55957/): Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind (high 7.3)
- [CVE-2026-55956](https://insights.sbomify.com/CVE-2026-55956/): Apache Tomcat: Security constraints for default servlet ignored method (medium 6.5)
- [CVE-2026-55955](https://insights.sbomify.com/CVE-2026-55955/): Apache Tomcat: EncryptInterceptor not protected against replay attacks (medium 6.5)
- [CVE-2026-55954](https://insights.sbomify.com/CVE-2026-55954/): Missing ID token claim validation in ueberauth_apple allows account takeover (critical 9.1)
- [CVE-2026-55953](https://insights.sbomify.com/CVE-2026-55953/): TLS 1.2 and DTLS client accepts unoffered anonymous cipher suite, bypassing server authentication (critical 9.1)
- [CVE-2026-55952](https://insights.sbomify.com/CVE-2026-55952/): TLS 1.3 server denial of service via malformed ClientHello pre-shared key extension (high 8.2)
- [CVE-2026-55951](https://insights.sbomify.com/CVE-2026-55951/): httpc memory exhaustion via unbounded response header accumulation (high 8.2)
- [CVE-2026-55950](https://insights.sbomify.com/CVE-2026-55950/): DTLS listener crash via race condition in dtls_packet_demux causes denial of service for all sessions (high 8.7)
- [CVE-2026-5595](https://insights.sbomify.com/CVE-2026-5595/): griptape-ai griptape FileManagerTool save_memory_artifacts_to_disk path traversal (medium 5.3)
- [CVE-2026-55949](https://insights.sbomify.com/CVE-2026-55949/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-55948](https://insights.sbomify.com/CVE-2026-55948/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-55947](https://insights.sbomify.com/CVE-2026-55947/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-55946](https://insights.sbomify.com/CVE-2026-55946/): Microsoft Copilot Information Disclosure Vulnerability (medium 6.1)
- [CVE-2026-55945](https://insights.sbomify.com/CVE-2026-55945/): Microsoft Edge (Chromium-based) Information Disclosure Vulnerability (medium 4.2)
- [CVE-2026-55944](https://insights.sbomify.com/CVE-2026-55944/): Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-5594](https://insights.sbomify.com/CVE-2026-5594/): premAI-io premsql followup.py eval code injection (medium 5.3)
- [CVE-2026-5590](https://insights.sbomify.com/CVE-2026-5590/): net: ip/tcp: Null pointer dereference can be triggered by a race condition (medium 6.4)
- [CVE-2026-55899](https://insights.sbomify.com/CVE-2026-55899/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-55898](https://insights.sbomify.com/CVE-2026-55898/): Microsoft Excel Information Disclosure Vulnerability (medium 6.1)
- [CVE-2026-55897](https://insights.sbomify.com/CVE-2026-55897/): luci-app-advanced-reboot read ACL exposes /bin/sh through file.exec, allowing delegated users to run commands as root (high 8.8)
- [CVE-2026-55895](https://insights.sbomify.com/CVE-2026-55895/): Vim: Vimscript Code Injection in netrw NetrwLocalRmFile() via crafted filename (medium 5.7)
- [CVE-2026-55894](https://insights.sbomify.com/CVE-2026-55894/): Capstone SH disassembler `sh_disassemble` out-of-bounds read via crafted SH2A bytecode (medium 6.8)
- [CVE-2026-55893](https://insights.sbomify.com/CVE-2026-55893/): Capstone SH disassembler `set_reg_n` heap buffer overflow via crafted SH2A FPU bytecode (high 7.3)
- [CVE-2026-55892](https://insights.sbomify.com/CVE-2026-55892/): Vim: Out-of-bounds Write in Spell File Prefix Dump (medium 5.5)
- [CVE-2026-55891](https://insights.sbomify.com/CVE-2026-55891/): PrivateBin: Reflected JSON injection in backend responses via unescaped REQUEST_URI (not scored)
- [CVE-2026-55890](https://insights.sbomify.com/CVE-2026-55890/): Grav: Stored CSS injection via Markdown image ?style=… reaches MediaObjectTrait::style() (medium 4.8)
- [CVE-2026-5589](https://insights.sbomify.com/CVE-2026-5589/): Out-of-bounds write caused by an integer underflow in the Bluetooth Mesh subsystem. (medium 6.3)
- [CVE-2026-55889](https://insights.sbomify.com/CVE-2026-55889/): XDG Desktop Portal: Drag-and-drop and copy-paste theft via predictable FileTransfer key (high 8.3)
- [CVE-2026-55888](https://insights.sbomify.com/CVE-2026-55888/): XDG Desktop Portal: Arbitrary file access via SaveFiles "files" option path traversal (high 8.8)
- [CVE-2026-55887](https://insights.sbomify.com/CVE-2026-55887/): MCP Gateway: Argument injection via OCI image label YAML in Docker MCP Gateway (high 8.7)
- [CVE-2026-55886](https://insights.sbomify.com/CVE-2026-55886/): Jodit Editor: Prototype Pollution in Jodit via Jodit.modules.Helpers.set() (medium 6.3)
- [CVE-2026-55885](https://insights.sbomify.com/CVE-2026-55885/): Grav: Admin Backup Zip File Exposes Account Credentials and Configuration Secrets (medium 6.8)
- [CVE-2026-55884](https://insights.sbomify.com/CVE-2026-55884/): Tilt: Missing authentication on the network-exposed Tilt HUD server (critical 9.2)
- [CVE-2026-55883](https://insights.sbomify.com/CVE-2026-55883/): Tilt: Cross-site WebSocket hijacking of the Tilt HUD stream (high 8.3)
- [CVE-2026-55882](https://insights.sbomify.com/CVE-2026-55882/): Tilt: Unauthenticated pprof debug endpoints on the Tilt HUD server (high 8.3)
- [CVE-2026-55881](https://insights.sbomify.com/CVE-2026-55881/): OpenReplay: Cross-tenant session replay disclosure via missing session ownership check in first-mob endpoint (high 7.1)
- [CVE-2026-55880](https://insights.sbomify.com/CVE-2026-55880/): OpenReplay: Cross-user IDOR in notes and dashboard widgets (high 7.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/538/