# Vulnerabilities published in 2026


- [CVE-2026-54198](https://insights.sbomify.com/CVE-2026-54198/): WordPress Media LIbrary Assistant plugin <= 3.35 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-54197](https://insights.sbomify.com/CVE-2026-54197/): WordPress GetGenie plugin <= 4.4.1 - Sensitive Data Exposure vulnerability (medium 6.5)
- [CVE-2026-54196](https://insights.sbomify.com/CVE-2026-54196/): WordPress JetFormBuilder plugin <= 3.6.1 - Privilege Escalation vulnerability (medium 6.8)
- [CVE-2026-54195](https://insights.sbomify.com/CVE-2026-54195/): WordPress JetFormBuilder plugin <= 3.6.0.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-54194](https://insights.sbomify.com/CVE-2026-54194/): WordPress Fusion Builder plugin <= 3.15.4 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-54193](https://insights.sbomify.com/CVE-2026-54193/): WordPress Fusion Builder plugin <= 3.15.4 - Arbitrary File Deletion vulnerability (high 7.7)
- [CVE-2026-54192](https://insights.sbomify.com/CVE-2026-54192/): WordPress Popup box plugin <= 6.2.9 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-54191](https://insights.sbomify.com/CVE-2026-54191/): WordPress Pods plugin <= 3.3.8 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-54190](https://insights.sbomify.com/CVE-2026-54190/): WordPress Envira Photo Gallery plugin <= 1.12.5 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-5419](https://insights.sbomify.com/CVE-2026-5419/): Gnutls: gnutls: information disclosure via timing side-channel in pkcs#7 padding removal (low 3.7)
- [CVE-2026-54189](https://insights.sbomify.com/CVE-2026-54189/): WordPress JetEngine plugin <= 3.8.10 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-54188](https://insights.sbomify.com/CVE-2026-54188/): WordPress JetEngine plugin <= 3.8.10 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-54187](https://insights.sbomify.com/CVE-2026-54187/): WordPress JetEngine plugin <= 3.8.10.1 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-54186](https://insights.sbomify.com/CVE-2026-54186/): WordPress JobSearch plugin <= 3.2.9 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-54185](https://insights.sbomify.com/CVE-2026-54185/): WordPress Cornerstone plugin < 7.8.8 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-54184](https://insights.sbomify.com/CVE-2026-54184/): WordPress Clean Login plugin <= 1.15 - Insecure Direct Object References (IDOR) vulnerability (high 8.2)
- [CVE-2026-54183](https://insights.sbomify.com/CVE-2026-54183/): Apache Airflow: Airflow Variables were not masked in the UI for authenticated users (medium 4.3)
- [CVE-2026-54182](https://insights.sbomify.com/CVE-2026-54182/): backpack/crud: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth) (high 8.1)
- [CVE-2026-54181](https://insights.sbomify.com/CVE-2026-54181/): backpack/crud: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted (medium 5.4)
- [CVE-2026-54180](https://insights.sbomify.com/CVE-2026-54180/): backpack/crud: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR) (high 7.6)
- [CVE-2026-5418](https://insights.sbomify.com/CVE-2026-5418/): appsmithorg appsmith Dashboard WebClientUtils.java computeDisallowedHosts server-side request forgery (medium 6.9)
- [CVE-2026-54179](https://insights.sbomify.com/CVE-2026-54179/): Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk (medium 4.4)
- [CVE-2026-54178](https://insights.sbomify.com/CVE-2026-54178/): Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk (high 8.1)
- [CVE-2026-54177](https://insights.sbomify.com/CVE-2026-54177/): Laravel Backpack CRUD: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver (medium 6.6)
- [CVE-2026-54176](https://insights.sbomify.com/CVE-2026-54176/): backpack/crud: MyAccountController allows changing the login email without a current-password check (medium 6.5)
- [CVE-2026-54175](https://insights.sbomify.com/CVE-2026-54175/): backpack/crud: Unverified password change in MyAccountController via mass assignment (high 7.6)
- [CVE-2026-54174](https://insights.sbomify.com/CVE-2026-54174/): melange: Incomplete package integrity verification allows data section substitution (high 8.3)
- [CVE-2026-54171](https://insights.sbomify.com/CVE-2026-54171/): Excon: redact additional sensitive/risky headers when following redirects (medium 6.5)
- [CVE-2026-5417](https://insights.sbomify.com/CVE-2026-5417/): Dataease SQLbot Elasticsearch es_engine.py get_es_data_by_http server-side request forgery (medium 5.1)
- [CVE-2026-54168](https://insights.sbomify.com/CVE-2026-54168/): Tekton Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution (medium 6.5)
- [CVE-2026-54167](https://insights.sbomify.com/CVE-2026-54167/): Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header (high 8.2)
- [CVE-2026-54166](https://insights.sbomify.com/CVE-2026-54166/): Shelf Vulnerable to Server-Side Request Forgery (SSRF) via Asset CSV Import imageUrl Validation Bypass (high 7.1)
- [CVE-2026-54165](https://insights.sbomify.com/CVE-2026-54165/): Stored DOM-XSS in public shared-folder image gallery (one-click, unauthenticated victim) (medium 6.4)
- [CVE-2026-54164](https://insights.sbomify.com/CVE-2026-54164/): API Platform Core: Missing IRI type check enables resource type confusion (medium 6.5)
- [CVE-2026-54163](https://insights.sbomify.com/CVE-2026-54163/): secure_headers: CSP directive injection via sandbox, plugin_types, and report_to when given untrusted input (medium 4.7)
- [CVE-2026-54162](https://insights.sbomify.com/CVE-2026-54162/): Ember: Unneutralised terminal escape/control sequences from Caddy logs injected into the operator's TUI (medium 4.7)
- [CVE-2026-54160](https://insights.sbomify.com/CVE-2026-54160/): Network UPS Tools: A PWN Request in make-dist workflow can execute PR-controlled code with write-scoped GITHUB_TOKEN (high 8.2)
- [CVE-2026-5416](https://insights.sbomify.com/CVE-2026-5416/): Command Injection via name parameter (high 8.7)
- [CVE-2026-54159](https://insights.sbomify.com/CVE-2026-54159/): ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE (critical 10.0)
- [CVE-2026-54158](https://insights.sbomify.com/CVE-2026-54158/): SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML() (critical 9.9)
- [CVE-2026-54157](https://insights.sbomify.com/CVE-2026-54157/): LobeHub: Unauthenticated SSRF in `/webapi/proxy` (critical 9.0)
- [CVE-2026-54156](https://insights.sbomify.com/CVE-2026-54156/): node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS (high 7.5)
- [CVE-2026-54155](https://insights.sbomify.com/CVE-2026-54155/): node-opcua: Missing nonce verification in UserNameIdentityToken authentication (high 7.7)
- [CVE-2026-54150](https://insights.sbomify.com/CVE-2026-54150/): next-video: Unauthenticated arbitrary file read via /api/video request handler (medium 6.9)
- [CVE-2026-5415](https://insights.sbomify.com/CVE-2026-5415/): WP Captcha PRO <= 5.38 - Authenticated (Subscriber+) Authentication Bypass via Temporary Login Link (high 8.8)
- [CVE-2026-54149](https://insights.sbomify.com/CVE-2026-54149/): MaxKB MCP tool import validation bypass allows post-authentication remote code execution (high 8.8)
- [CVE-2026-54148](https://insights.sbomify.com/CVE-2026-54148/): http4k: `DigestAuthProvider.verify` did not bind to request URI (high 8.1)
- [CVE-2026-54147](https://insights.sbomify.com/CVE-2026-54147/): http4k: `DigestAuthProvider.verify` ignored configured algorithm and did not bind to request URI (medium 6.5)
- [CVE-2026-5414](https://insights.sbomify.com/CVE-2026-5414/): Newgen OmniDocs WebApiRequestRedirection resource injection (medium 6.9)
- [CVE-2026-54136](https://insights.sbomify.com/CVE-2026-54136/): Windmill: Resource-scoped API tokens can read script contents outside their allowed path via scripts/list_search (medium 5.1)
- [CVE-2026-54135](https://insights.sbomify.com/CVE-2026-54135/): AirSane has a Remote Denial of Service (OOM) via Unvalidated Content-Length in HTTP Server (high 7.5)
- [CVE-2026-54134](https://insights.sbomify.com/CVE-2026-54134/): OctoPrint: File exfiltration possible via query parameters on upload endpoints (high 7.0)
- [CVE-2026-54133](https://insights.sbomify.com/CVE-2026-54133/): jmespath.php has CompilerRuntime code injection via unescaped function names (critical 9.8)
- [CVE-2026-54132](https://insights.sbomify.com/CVE-2026-54132/): Windows Kernel Elevation of Privilege Vulnerability (medium 6.8)
- [CVE-2026-54131](https://insights.sbomify.com/CVE-2026-54131/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-54130](https://insights.sbomify.com/CVE-2026-54130/): M365 Copilot Information Disclosure Vulnerability (critical 9.8)
- [CVE-2026-5413](https://insights.sbomify.com/CVE-2026-5413/): Newgen OmniDocs GetWebApiConfiguration information disclosure (medium 6.3)
- [CVE-2026-54129](https://insights.sbomify.com/CVE-2026-54129/): Windows Hyper-V Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-54128](https://insights.sbomify.com/CVE-2026-54128/): Windows DHCP Client Remote Code Execution Vulnerability (high 8.4)
- [CVE-2026-54127](https://insights.sbomify.com/CVE-2026-54127/): Windows Hyper-V Elevation of Privilege Vulnerability (high 7.4)
- [CVE-2026-54126](https://insights.sbomify.com/CVE-2026-54126/): Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-54125](https://insights.sbomify.com/CVE-2026-54125/): Windows Runtime Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-54124](https://insights.sbomify.com/CVE-2026-54124/): Windows Terminal Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-54123](https://insights.sbomify.com/CVE-2026-54123/): Microsoft Defender for Endpoint for Mac Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-54122](https://insights.sbomify.com/CVE-2026-54122/): Windows GDI+ Remote Code Execution Vulnerability (high 8.4)
- [CVE-2026-54121](https://insights.sbomify.com/CVE-2026-54121/): Active Directory Certificate Services Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-54120](https://insights.sbomify.com/CVE-2026-54120/): Microsoft Surface Remote Code Execution Vulnerability (critical 9.9)
- [CVE-2026-5412](https://insights.sbomify.com/CVE-2026-5412/): Juju CloudSpec API could leak senstive information (critical 9.9)
- [CVE-2026-54119](https://insights.sbomify.com/CVE-2026-54119/): Windows Active Directory Denial of Service Vulnerability (high 7.5)
- [CVE-2026-54118](https://insights.sbomify.com/CVE-2026-54118/): Microsoft SQL Server Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-54117](https://insights.sbomify.com/CVE-2026-54117/): Microsoft SQL Server Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-54116](https://insights.sbomify.com/CVE-2026-54116/): Microsoft SQL Server Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-54115](https://insights.sbomify.com/CVE-2026-54115/): Windows Message Queuing (MSMQ) Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-54114](https://insights.sbomify.com/CVE-2026-54114/): Windows Win32k Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-54113](https://insights.sbomify.com/CVE-2026-54113/): Remote Procedure Call Denial of Service Vulnerability (high 7.5)
- [CVE-2026-54112](https://insights.sbomify.com/CVE-2026-54112/): Windows Win32k Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-54111](https://insights.sbomify.com/CVE-2026-54111/): Universal Print Management Service Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-5411](https://insights.sbomify.com/CVE-2026-5411/): WP Captcha PRO <= 5.38 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload (high 8.8)
- [CVE-2026-54109](https://insights.sbomify.com/CVE-2026-54109/): Windows Resilient File System (ReFS) Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-54108](https://insights.sbomify.com/CVE-2026-54108/): Microsoft SharePoint Server Spoofing Vulnerability (medium 6.5)
- [CVE-2026-54107](https://insights.sbomify.com/CVE-2026-54107/): Windows Win32k Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-54106](https://insights.sbomify.com/CVE-2026-54106/): U.S. GAO EPDS and CBCA EDS network access control bypass (medium 5.1)
- [CVE-2026-54105](https://insights.sbomify.com/CVE-2026-54105/): U.S. GAO EPDS and CBCA EDS user information disclosure (medium 6.9)
- [CVE-2026-54104](https://insights.sbomify.com/CVE-2026-54104/): U.S. GAO EPDS and CBCA EDS client-based privilege escalation (high 8.7)
- [CVE-2026-54103](https://insights.sbomify.com/CVE-2026-54103/): U.S. GAO EPDS and CBCA EDS unauthenticated password change (critical 9.3)
- [CVE-2026-54100](https://insights.sbomify.com/CVE-2026-54100/): Windows-machine-config-operator: windows-machine-config-operator: ssh host key not verified enables credential theft (high 8.3)
- [CVE-2026-5410](https://insights.sbomify.com/CVE-2026-5410/): Redux Framework <= 4.5.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Spinner Field Input (medium 6.4)
- [CVE-2026-54099](https://insights.sbomify.com/CVE-2026-54099/): Privilege escalation in Red Hat OpenShift Container Platform 4 (high 8.8)
- [CVE-2026-54097](https://insights.sbomify.com/CVE-2026-54097/): File Browser: Cross-user unauthorized share-link deletion via unbounded prefix match in DeleteWithPathPrefix (high 7.2)
- [CVE-2026-54096](https://insights.sbomify.com/CVE-2026-54096/): File Browser: Improper Access Control Occurs via Pre-Created Public Share for a Non-existent Path (high 8.4)
- [CVE-2026-54094](https://insights.sbomify.com/CVE-2026-54094/): File Browser: Symlink following lets scoped users read, overwrite, and share files outside their filebrowser scope (high 7.5)
- [CVE-2026-54093](https://insights.sbomify.com/CVE-2026-54093/): File Browser: Path traversal in download-as-zip/tar via Windows-style backslash separators in stored filenames (medium 6.8)
- [CVE-2026-54092](https://insights.sbomify.com/CVE-2026-54092/): File Browser: DoS Vulnerability on Public Login API (medium 6.5)
- [CVE-2026-54091](https://insights.sbomify.com/CVE-2026-54091/): File Browser: Incorrect access control in public directory shares via rule path rebasing (high 7.5)
- [CVE-2026-54090](https://insights.sbomify.com/CVE-2026-54090/): File Browser: Command Allowlist Bypass via Shell Metacharacter Injection (high 8.7)
- [CVE-2026-5409](https://insights.sbomify.com/CVE-2026-5409/): Uncontrolled Recursion in Wireshark (medium 5.5)
- [CVE-2026-54089](https://insights.sbomify.com/CVE-2026-54089/): File Browser: Authentication Bypass via Proxy Auth Header Forgery (critical 9.1)
- [CVE-2026-54088](https://insights.sbomify.com/CVE-2026-54088/): File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE) (critical 9.3)
- [CVE-2026-54087](https://insights.sbomify.com/CVE-2026-54087/): EasyAdmin: Stored Cross-Site Scripting (XSS) via uploaded files served inline in FileField and ImageField (high 7.6)
- [CVE-2026-54086](https://insights.sbomify.com/CVE-2026-54086/): SLE API for Java: Uncontrolled Memory Allocation / handled exception leading to Denial of Service (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/554/