# Vulnerabilities published in 2026


- [CVE-2026-54817](https://insights.sbomify.com/CVE-2026-54817/): WordPress MStore API plugin <= 4.18.4 - Broken Authentication vulnerability (medium 6.5)
- [CVE-2026-54816](https://insights.sbomify.com/CVE-2026-54816/): WordPress Advanced Ads plugin <= 2.0.21 - Remote Code Execution (RCE) vulnerability (high 7.5)
- [CVE-2026-54815](https://insights.sbomify.com/CVE-2026-54815/): WordPress Cargo Shipping Location for WooCommerce plugin <= 5.6 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-54814](https://insights.sbomify.com/CVE-2026-54814/): WordPress Motors plugin <= 1.4.109 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-54813](https://insights.sbomify.com/CVE-2026-54813/): WordPress SureDash plugin <= 1.8.0 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-54812](https://insights.sbomify.com/CVE-2026-54812/): WordPress Motors plugin <= 1.4.109 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-54811](https://insights.sbomify.com/CVE-2026-54811/): WordPress WP eMember plugin < v10.9.4 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-54810](https://insights.sbomify.com/CVE-2026-54810/): WordPress Nexi XPay plugin <= 8.3.1 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-54809](https://insights.sbomify.com/CVE-2026-54809/): WordPress GIFT4U plugin <= 1.0.10 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-54808](https://insights.sbomify.com/CVE-2026-54808/): WordPress WP Travel Gutenberg Blocks plugin <= 3.9.4 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-54807](https://insights.sbomify.com/CVE-2026-54807/): WordPress Registration Form for WooCommerce plugin <= 1.0.9 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2026-54806](https://insights.sbomify.com/CVE-2026-54806/): WordPress WP Activity Log plugin <= 5.6.3.1 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-54805](https://insights.sbomify.com/CVE-2026-54805/): WordPress Falang multilanguage plugin <= 1.4.2 - Privilege Escalation vulnerability (high 8.8)
- [CVE-2026-54804](https://insights.sbomify.com/CVE-2026-54804/): WordPress Melhor Envio plugin <= 2.16.3 - Broken Authentication vulnerability (high 7.6)
- [CVE-2026-54803](https://insights.sbomify.com/CVE-2026-54803/): WordPress SMS Alert Order Notifications plugin <= 3.9.4 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2026-54802](https://insights.sbomify.com/CVE-2026-54802/): WordPress SMS Alert Order Notifications plugin <= 3.9.3 - Broken Authentication vulnerability (high 7.5)
- [CVE-2026-54801](https://insights.sbomify.com/CVE-2026-54801/): Privilege escalation in CPCI85 Central Processing/Communication (high 8.6)
- [CVE-2026-54800](https://insights.sbomify.com/CVE-2026-54800/): Misconfiguration in CPCI85 Central Processing/Communication (medium 6.3)
- [CVE-2026-54799](https://insights.sbomify.com/CVE-2026-54799/): Security feature bypass in CPCI85 Central Processing/Communication (high 8.4)
- [CVE-2026-54798](https://insights.sbomify.com/CVE-2026-54798/): Denial of service in CPCI85 Central Processing/Communication (high 7.1)
- [CVE-2026-54796](https://insights.sbomify.com/CVE-2026-54796/): Command injection in OpenManage Enterprise (high 7.2)
- [CVE-2026-54795](https://insights.sbomify.com/CVE-2026-54795/): Command injection in OpenManage Enterprise (high 8.8)
- [CVE-2026-54794](https://insights.sbomify.com/CVE-2026-54794/): Server-side request forgery in OpenManage Enterprise (high 7.2)
- [CVE-2026-54793](https://insights.sbomify.com/CVE-2026-54793/): Cross-site scripting in OpenManage Enterprise (medium 4.6)
- [CVE-2026-54790](https://insights.sbomify.com/CVE-2026-54790/): InvoicePlane: Second-order SQL injection through the unvalidated custom_field_table field in the Custom Fields module (medium 6.0)
- [CVE-2026-5479](https://insights.sbomify.com/CVE-2026-5479/): wolfSSL EVP ChaCha20-Poly1305 AEAD authentication tag (high 7.6)
- [CVE-2026-54789](https://insights.sbomify.com/CVE-2026-54789/): mod_auth_openidc has out-of-bounds read and write in state cookie parsing (high 7.5)
- [CVE-2026-54788](https://insights.sbomify.com/CVE-2026-54788/): dd-trace-rs: Unbounded W3C tracestate parsing may lead to DoS (high 7.5)
- [CVE-2026-54787](https://insights.sbomify.com/CVE-2026-54787/): sigstore-go fails to check signature timestamps against a signing key's validity period (low 3.1)
- [CVE-2026-54786](https://insights.sbomify.com/CVE-2026-54786/): Wasmtime: Leak in WASIp1 `fd_renumber` implementation (low 2.3)
- [CVE-2026-54785](https://insights.sbomify.com/CVE-2026-54785/): gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode (medium 6.2)
- [CVE-2026-54784](https://insights.sbomify.com/CVE-2026-54784/): CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentiality (high 7.4)
- [CVE-2026-54783](https://insights.sbomify.com/CVE-2026-54783/): CoreWCF: XML Signature Wrapping in WS-Security endorsing/supporting signature verification allows replay of captured signed messages (high 7.4)
- [CVE-2026-54782](https://insights.sbomify.com/CVE-2026-54782/): CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation (critical 10.0)
- [CVE-2026-54781](https://insights.sbomify.com/CVE-2026-54781/): CoreWCF: SAML SubjectConfirmation methods and holder-of-key proof keys are not enforced (high 7.4)
- [CVE-2026-54780](https://insights.sbomify.com/CVE-2026-54780/): CoreWCF: WS-Security Reference DigestMethod Algorithm-Suite Bypass (low 3.7)
- [CVE-2026-5478](https://insights.sbomify.com/CVE-2026-5478/): Everest Forms <= 3.4.4 - Unauthenticated Arbitrary File Read and Deletion via Upload Field 'old_files' Parameter (high 8.1)
- [CVE-2026-54779](https://insights.sbomify.com/CVE-2026-54779/): CoreWCF: SAML token replay protection is inoperative (medium 5.9)
- [CVE-2026-54778](https://insights.sbomify.com/CVE-2026-54778/): CoreWCF: UnixDomainSocket Non-Reentrant POSIX Identity Resolution (medium 6.2)
- [CVE-2026-54777](https://insights.sbomify.com/CVE-2026-54777/): CoreWCF NetNamedPipe transport accepts attach to a pre-existing named pipe instance (medium 6.5)
- [CVE-2026-54776](https://insights.sbomify.com/CVE-2026-54776/): CoreWCF: Unix Domain Socket PosixIdentity transport accepts connections that skip the security upgrade (medium 4.4)
- [CVE-2026-54775](https://insights.sbomify.com/CVE-2026-54775/): CoreWCF: Kafka consume pump halts permanently on a Kafka tombstone (null-value record), causing persistent endpoint denial of service. (medium 6.5)
- [CVE-2026-54774](https://insights.sbomify.com/CVE-2026-54774/): CoreWCF: SamlSerializer skips SignatureValue verification when SAML signing token is not an X.509 certificate (high 7.4)
- [CVE-2026-54773](https://insights.sbomify.com/CVE-2026-54773/): CoreWCF: WS-Security signature substitution via document-wide Signature lookup (medium 5.9)
- [CVE-2026-54772](https://insights.sbomify.com/CVE-2026-54772/): CoreWCF: Pre-authentication infinite-loop CPU exhaustion in CoreWCF net.tcp / net.pipe / net.uds framing handshake (high 7.5)
- [CVE-2026-54771](https://insights.sbomify.com/CVE-2026-54771/): Langroid: handle_message() executes user-supplied tool JSON without sender verification (high 8.1)
- [CVE-2026-54770](https://insights.sbomify.com/CVE-2026-54770/): WebOb: Open redirect in Location header normalization via leading C0 control / space characters (medium 6.1)
- [CVE-2026-5477](https://insights.sbomify.com/CVE-2026-5477/): Prefix-substitution forgery via integer overflow in wolfCrypt CMAC (high 8.2)
- [CVE-2026-54769](https://insights.sbomify.com/CVE-2026-54769/): Langroid: Sandbox Escape to Remote Code Execution via Incomplete `eval()` Mitigation in TableChatAgent (critical 10.0)
- [CVE-2026-54768](https://insights.sbomify.com/CVE-2026-54768/): WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design) (medium 6.9)
- [CVE-2026-54767](https://insights.sbomify.com/CVE-2026-54767/): WeGIA: Hardcoded Secret Key Backdoor — Mass Data Destruction via deletar_socios.php (critical 9.1)
- [CVE-2026-54766](https://insights.sbomify.com/CVE-2026-54766/): Vikunja: Project duplication bypasses write-permission check on the target parent project (medium 5.3)
- [CVE-2026-54765](https://insights.sbomify.com/CVE-2026-54765/): Traefik: Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Service:port (medium 6.3)
- [CVE-2026-54764](https://insights.sbomify.com/CVE-2026-54764/): ForwardAuth middleware leaks X-Forwarded-Port spoofing via untrusted X-Forwarded-Proto when trustForwardHeader=false (medium 6.9)
- [CVE-2026-54763](https://insights.sbomify.com/CVE-2026-54763/): Traefik: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth (high 7.8)
- [CVE-2026-54762](https://insights.sbomify.com/CVE-2026-54762/): Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution fails (medium 5.9)
- [CVE-2026-54761](https://insights.sbomify.com/CVE-2026-54761/): Traefik: Kubernetes Gateway crossProviderNamespaces bypass allows HTTPRoute outside the allowlist to expose internal Traefik services (medium 6.0)
- [CVE-2026-54760](https://insights.sbomify.com/CVE-2026-54760/): Langroid: SQLChatAgent dangerous-function blocklist can be bypassed with quoted or schema-qualified pg_read_file calls (critical 9.3)
- [CVE-2026-5476](https://insights.sbomify.com/CVE-2026-5476/): NASA cFS cfe_tbl_passthru_codec.c CFE_TBL_ValidateCodecLoadSize integer overflow (low 2.1)
- [CVE-2026-54759](https://insights.sbomify.com/CVE-2026-54759/): Cross-site scripting in siyuan (high 8.7)
- [CVE-2026-54758](https://insights.sbomify.com/CVE-2026-54758/): Notepad++: Stack Buffer Overflow in expandNppEnvironmentStrs (high 7.8)
- [CVE-2026-54757](https://insights.sbomify.com/CVE-2026-54757/): Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data (high 7.8)
- [CVE-2026-54756](https://insights.sbomify.com/CVE-2026-54756/): Jodit Editor: Prototype pollution via Jodit.configure() / ConfigMerge (medium 6.3)
- [CVE-2026-54755](https://insights.sbomify.com/CVE-2026-54755/): Klever-Go: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token) (critical 9.6)
- [CVE-2026-54754](https://insights.sbomify.com/CVE-2026-54754/): Klever: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped) (critical 9.6)
- [CVE-2026-54753](https://insights.sbomify.com/CVE-2026-54753/): Nx: `nx graph` dev server permissive CORS policy (medium 5.9)
- [CVE-2026-54752](https://insights.sbomify.com/CVE-2026-54752/): Deserialization in devicetype-library (critical 9.6)
- [CVE-2026-5475](https://insights.sbomify.com/CVE-2026-5475/): NASA cFS CCSDS Header Size cfe_sb_priv.c CFE_SB_TransmitMsg memory corruption (medium 5.1)
- [CVE-2026-54746](https://insights.sbomify.com/CVE-2026-54746/): Hatchet: Cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe (medium 6.4)
- [CVE-2026-54745](https://insights.sbomify.com/CVE-2026-54745/): Server-side request forgery in pipelines (critical 10.0)
- [CVE-2026-54743](https://insights.sbomify.com/CVE-2026-54743/): Lemmy: Stored XSS via markdown image alt-text in lemmy-ui html5-embed (medium 6.4)
- [CVE-2026-54742](https://insights.sbomify.com/CVE-2026-54742/): Lemmy: `CollectionAdd::Featured` does not check the post is in the community (medium 5.1)
- [CVE-2026-54741](https://insights.sbomify.com/CVE-2026-54741/): Lemmy: Blocked users can edit private messages sent before the block (medium 5.3)
- [CVE-2026-54740](https://insights.sbomify.com/CVE-2026-54740/): Lemmy: Lower-ranked federated moderator can remove higher-ranked moderators (medium 6.5)
- [CVE-2026-5474](https://insights.sbomify.com/CVE-2026-5474/): NASA cFS CCSDS Packet Header to_lab_passthru_encode.c CFE_MSG_GetSize heap-based overflow (medium 5.3)
- [CVE-2026-54739](https://insights.sbomify.com/CVE-2026-54739/): Lemmy: Login Endpoint User Enumeration via HTTP Response Code Differential (medium 6.9)
- [CVE-2026-54738](https://insights.sbomify.com/CVE-2026-54738/): Lemmy: Rate limit bypass via X-Forwarded-For header spoofing in actix-web ConnectionInfo (medium 6.5)
- [CVE-2026-54737](https://insights.sbomify.com/CVE-2026-54737/): @phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging (high 7.3)
- [CVE-2026-54736](https://insights.sbomify.com/CVE-2026-54736/): Phalcon: Non-constant-time HMAC verification in `Encryption\Crypt::decrypt` (timing side-channel) (high 8.2)
- [CVE-2026-54735](https://insights.sbomify.com/CVE-2026-54735/): prebid-server's request forgery vulnerability allows for possible host environment data extraction (critical 10.0)
- [CVE-2026-54734](https://insights.sbomify.com/CVE-2026-54734/): Prebid Server Java: Vulnerability to request forgery allows for possible host environment data extraction (critical 10.0)
- [CVE-2026-54733](https://insights.sbomify.com/CVE-2026-54733/): moodle-local_o365: Authentication bypass via unverified JWT signature in Teams SSO endpoint (critical 9.3)
- [CVE-2026-54732](https://insights.sbomify.com/CVE-2026-54732/): libreoffice-convert: path traversal / arbitrary file write (medium 6.5)
- [CVE-2026-54730](https://insights.sbomify.com/CVE-2026-54730/): Auth bypass in authentik (high 8.6)
- [CVE-2026-5473](https://insights.sbomify.com/CVE-2026-5473/): NASA cFS Pickle pickle.load deserialization (low 2.0)
- [CVE-2026-54729](https://insights.sbomify.com/CVE-2026-54729/): dssrf: any users using 1.1.1.1 DNS is impacted by SSRF (high 8.7)
- [CVE-2026-54728](https://insights.sbomify.com/CVE-2026-54728/): Privilege escalation in bunkerweb (medium 6.1)
- [CVE-2026-54727](https://insights.sbomify.com/CVE-2026-54727/): proot-distro has a Container Isolation Bypass via Crafted Restore Archive (high 8.2)
- [CVE-2026-54725](https://insights.sbomify.com/CVE-2026-54725/): vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API (critical 9.6)
- [CVE-2026-54724](https://insights.sbomify.com/CVE-2026-54724/): Kiwi TCMS: Open Redirect via unvalidated next parameter in account confirmation endpoint (medium 6.1)
- [CVE-2026-54723](https://insights.sbomify.com/CVE-2026-54723/): devpi: Database contents leak (medium 6.5)
- [CVE-2026-54722](https://insights.sbomify.com/CVE-2026-54722/): dssrf: there a critical security bug with remove_at_symbol_in_string (high 8.7)
- [CVE-2026-54721](https://insights.sbomify.com/CVE-2026-54721/): Silverstripe UserForms: Remote code execution via userforms email subject (high 8.8)
- [CVE-2026-54720](https://insights.sbomify.com/CVE-2026-54720/): Silverstripe Framework: Possible XSS attack through media embed (medium 5.4)
- [CVE-2026-5472](https://insights.sbomify.com/CVE-2026-5472/): ProjectsAndPrograms School Management System Profile Picture settings.php unrestricted upload (medium 5.3)
- [CVE-2026-54719](https://insights.sbomify.com/CVE-2026-54719/): goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx) (high 7.5)
- [CVE-2026-54718](https://insights.sbomify.com/CVE-2026-54718/): Silverstripe Advanced Workflow: Remote code execution via advanced workflow email template (high 7.2)
- [CVE-2026-54717](https://insights.sbomify.com/CVE-2026-54717/): Silverstripe: XSS in breadcrumbs in page list view (medium 5.4)
- [CVE-2026-54716](https://insights.sbomify.com/CVE-2026-54716/): Valhalla: Degenerate exclude_polygons (collinear points, zero area) causes OOM in /sources_to_targets (high 7.5)
- [CVE-2026-54715](https://insights.sbomify.com/CVE-2026-54715/): GoAccess: Heap Out-of-Bounds Write in parse_browser() (high 7.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/548/