# Vulnerabilities published in 2026


- [CVE-2026-52748](https://insights.sbomify.com/CVE-2026-52748/): Missing authentication for backup functionality in Kaon AR2140X (high 7.1)
- [CVE-2026-52747](https://insights.sbomify.com/CVE-2026-52747/): Security feature bypass in ModSecurity (high 8.6)
- [CVE-2026-52746](https://insights.sbomify.com/CVE-2026-52746/): JSONata: Malicious inputs to "$toMillis" function can cause resource exhaustion (high 7.5)
- [CVE-2026-52745](https://insights.sbomify.com/CVE-2026-52745/): CordysCRM: Customer Public Pool Sorting Field SQL Injection (medium 5.3)
- [CVE-2026-52744](https://insights.sbomify.com/CVE-2026-52744/): GoCD is vulnerable to authorization bypass via fetch artifact autosuggestion API (medium 5.3)
- [CVE-2026-52743](https://insights.sbomify.com/CVE-2026-52743/): GoCD before 26.1.0 is vulnerable to authorization bypass via job status API (medium 4.3)
- [CVE-2026-52742](https://insights.sbomify.com/CVE-2026-52742/): GoCD is vulnerable to historical server configuration API authorization bypass (medium 5.1)
- [CVE-2026-52741](https://insights.sbomify.com/CVE-2026-52741/): GoCD has stored XSS possible via tracking tool link highlighting on Compare Pipeline pages (high 7.5)
- [CVE-2026-52740](https://insights.sbomify.com/CVE-2026-52740/): GoCD is vulnerable to pipeline template view API authorization bypass (medium 5.3)
- [CVE-2026-5274](https://insights.sbomify.com/CVE-2026-5274/): Integer overflow in Chrome (high 8.8)
- [CVE-2026-52739](https://insights.sbomify.com/CVE-2026-52739/): ZEBRA: Repeated Non-Finalized Shielded Transaction Aborts Zebra Before Duplicate-Nullifier Rejection (medium 5.9)
- [CVE-2026-52738](https://insights.sbomify.com/CVE-2026-52738/): ZEBRA: Finalized address balance credit-first overflow on consensus-valid blocks (medium 6.9)
- [CVE-2026-52737](https://insights.sbomify.com/CVE-2026-52737/): ZEBRA: Sync restart poisoning from single unauthenticated peer via above-lookahead block (medium 5.3)
- [CVE-2026-52736](https://insights.sbomify.com/CVE-2026-52736/): ZEBRA: Block suppression via NU5 same-header body poisoning of sent-hash cache (high 8.7)
- [CVE-2026-52735](https://insights.sbomify.com/CVE-2026-52735/): ZEBRA: Consensus divergence via P2SH sigop undercount in pure-Rust disabled-opcode parser (critical 9.3)
- [CVE-2026-52734](https://insights.sbomify.com/CVE-2026-52734/): ZEBRA: Unbounded memory leak in mempool download pipeline via timeout path cancel_handles retention (medium 5.3)
- [CVE-2026-52733](https://insights.sbomify.com/CVE-2026-52733/): ZEBRA: Persistent on-disk corruption of Sapling/Orchard subtree roots after chain fork via pop_tip (medium 6.5)
- [CVE-2026-52732](https://insights.sbomify.com/CVE-2026-52732/): ZEBRA: Mempool transaction admission denial via single-peer inbound queue saturation (medium 5.3)
- [CVE-2026-52731](https://insights.sbomify.com/CVE-2026-52731/): ZEBRA: Full node denial of service via non-ASCII LongPollId in getblocktemplate (medium 6.5)
- [CVE-2026-52730](https://insights.sbomify.com/CVE-2026-52730/): Xibo CMS Missing Authorization in Module::settingsForm due to PHP operator precedence (medium 4.3)
- [CVE-2026-5273](https://insights.sbomify.com/CVE-2026-5273/): Use after free in Chrome (medium 6.3)
- [CVE-2026-52729](https://insights.sbomify.com/CVE-2026-52729/): Missing authorization in xibo-cms (high 7.1)
- [CVE-2026-52727](https://insights.sbomify.com/CVE-2026-52727/): lxc-ci: Pacman keyring stored in archlinux image with a private key (high 7.2)
- [CVE-2026-52726](https://insights.sbomify.com/CVE-2026-52726/): Dulwich's submodule path traversal in porcelain.submodule_update / porcelain.clone(recurse_submodules=True) yields RCE via attacker-dropped .git/hooks payload (high 7.5)
- [CVE-2026-52725](https://insights.sbomify.com/CVE-2026-52725/): Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS) (medium 5.3)
- [CVE-2026-52724](https://insights.sbomify.com/CVE-2026-52724/): kuma-dp connects to control plane without verifying TLS certificate when no CA is configured (medium 5.8)
- [CVE-2026-52723](https://insights.sbomify.com/CVE-2026-52723/): ePA 3.x Integration: VAU Server Authentication Bypass via Circular Certificate Trust (critical 9.1)
- [CVE-2026-52722](https://insights.sbomify.com/CVE-2026-52722/): Gstreamer1-plugins-bad-free: gstreamer: signed integer overflow in vmnc decoder cursor payload handling (high 7.1)
- [CVE-2026-52721](https://insights.sbomify.com/CVE-2026-52721/): Gstreamer1-plugins-bad-free: gstreamer: multiple out-of-bounds reads in pcapparse ipv4/tcp header parsing (medium 5.3)
- [CVE-2026-52720](https://insights.sbomify.com/CVE-2026-52720/): Gstreamer1-plugins-bad-free: gstreamer: heap buffer overflow via crafted vnc server rectangle in librfb (high 8.8)
- [CVE-2026-5272](https://insights.sbomify.com/CVE-2026-5272/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-52719](https://insights.sbomify.com/CVE-2026-52719/): Gstreamer1-plugins-bad-free: gstreamer: out-of-bounds read via jpeg segment length validation in va decoder (high 7.1)
- [CVE-2026-52718](https://insights.sbomify.com/CVE-2026-52718/): Gstreamer1-plugins-bad-free: gstreamer: denial of service via av1 tile_list_obu parser byte/bit confusion (medium 6.5)
- [CVE-2026-52716](https://insights.sbomify.com/CVE-2026-52716/): WordPress WorkScout-Core plugin <= 1.7.11 - Arbitrary File Deletion vulnerability (medium 6.5)
- [CVE-2026-52715](https://insights.sbomify.com/CVE-2026-52715/): WordPress GEO my WordPress plugin <= 4.5.5 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-52714](https://insights.sbomify.com/CVE-2026-52714/): WordPress SEO Plugin by Squirrly SEO plugin <= 12.4.16 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-52712](https://insights.sbomify.com/CVE-2026-52712/): WordPress Attendance Manager plugin <= 0.6.2 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-52711](https://insights.sbomify.com/CVE-2026-52711/): WordPress WooCommerce POS plugin <= 1.8.14 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-5271](https://insights.sbomify.com/CVE-2026-5271/): Possible to hijack modules in current working directory (medium 5.6)
- [CVE-2026-52709](https://insights.sbomify.com/CVE-2026-52709/): WordPress Video Gallery Block plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-52708](https://insights.sbomify.com/CVE-2026-52708/): WordPress WP User Frontend plugin <= 4.3.13 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-52707](https://insights.sbomify.com/CVE-2026-52707/): WordPress Kastell theme <= 2.0 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-52706](https://insights.sbomify.com/CVE-2026-52706/): WordPress JetEngine plugin <= 3.8.10 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-52705](https://insights.sbomify.com/CVE-2026-52705/): WordPress SigmaForms Pro – AI Generated Forms plugin <= 1.4.5 - Arbitrary File Upload vulnerability (critical 9.0)
- [CVE-2026-52704](https://insights.sbomify.com/CVE-2026-52704/): WordPress WooCommerce PDF Invoice Builder plugin <= 2.0.8 - Remote Code Execution (RCE) vulnerability (critical 10.0)
- [CVE-2026-52703](https://insights.sbomify.com/CVE-2026-52703/): WordPress FastDup plugin <= 2.7.2 - Path Traversal vulnerability (critical 9.6)
- [CVE-2026-52702](https://insights.sbomify.com/CVE-2026-52702/): WordPress SEO Redirection plugin <= 9.17 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-52701](https://insights.sbomify.com/CVE-2026-52701/): WordPress User Registration plugin <= 5.2.2 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-52700](https://insights.sbomify.com/CVE-2026-52700/): WordPress WCMultiShipping plugin <= 3.0.2 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-5270](https://insights.sbomify.com/CVE-2026-5270/): Authentication Bypass in Navigator and Blue Planet Products (critical 9.8)
- [CVE-2026-52699](https://insights.sbomify.com/CVE-2026-52699/): WordPress VikRentCar plugin <= 1.4.5 - Insecure Direct Object References (IDOR) vulnerability (high 7.5)
- [CVE-2026-52698](https://insights.sbomify.com/CVE-2026-52698/): Information disclosure in PushEngage – Web Push Notifications, eCommerce Automation &amp; Chat Widget (high 7.4)
- [CVE-2026-52697](https://insights.sbomify.com/CVE-2026-52697/): WordPress Taskbuilder plugin <= 5.0.7 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-52696](https://insights.sbomify.com/CVE-2026-52696/): WordPress JetBlog plugin <= 2.4.8 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2026-52695](https://insights.sbomify.com/CVE-2026-52695/): WordPress ABC Crypto Checkout plugin <= 1.8.2 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2026-52694](https://insights.sbomify.com/CVE-2026-52694/): WordPress Signature Add-On for WooCommerce plugin <= 2.0 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2026-52693](https://insights.sbomify.com/CVE-2026-52693/): WordPress eCommerce Product Catalog plugin <= 3.5.5 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-52692](https://insights.sbomify.com/CVE-2026-52692/): WordPress Affiliates Manager plugin <= 2.9.50 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2026-52691](https://insights.sbomify.com/CVE-2026-52691/): Apache Griffin Hive Metastore Module: SQL Injection Vulnerability in Hive Metastore Module (high 8.8)
- [CVE-2026-52690](https://insights.sbomify.com/CVE-2026-52690/): Spoofed answers can mark an authoritative non-EDNS capable (medium 5.9)
- [CVE-2026-5269](https://insights.sbomify.com/CVE-2026-5269/): Navigator NCS and MCP System Accounts with Default Passwords (critical 9.8)
- [CVE-2026-52688](https://insights.sbomify.com/CVE-2026-52688/): RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation (high 7.5)
- [CVE-2026-52687](https://insights.sbomify.com/CVE-2026-52687/): Denial of service in OX Dovecot CE (medium 6.5)
- [CVE-2026-52686](https://insights.sbomify.com/CVE-2026-52686/): Wildcard CNAME proof validation bypass (low 3.7)
- [CVE-2026-52684](https://insights.sbomify.com/CVE-2026-52684/): Prefetch Feature Allows Persistent Ghost Domain Cache Poisoning Attack (low 3.7)
- [CVE-2026-52681](https://insights.sbomify.com/CVE-2026-52681/): Denial of service in OX Dovecot CE (low 3.1)
- [CVE-2026-52680](https://insights.sbomify.com/CVE-2026-52680/): Apache Kyuubi: REST batch multipart upload path traversal allows controlled file write (critical 9.8)
- [CVE-2026-5268](https://insights.sbomify.com/CVE-2026-5268/): SFTP Server Authentication Weakness (critical 9.1)
- [CVE-2026-52673](https://insights.sbomify.com/CVE-2026-52673/): SQL Injection vulnerability in Cboard v.0.4.2 and before allows a remote attacker to execute arbitrary code via the getDimensionsValues comp (medium 6.5)
- [CVE-2026-5267](https://insights.sbomify.com/CVE-2026-5267/): Unauthenticated Event Stream Exposure of Session Tokens in Navigator NCS (high 7.5)
- [CVE-2026-5266](https://insights.sbomify.com/CVE-2026-5266/): Information disclosure in Echo (low 2.3)
- [CVE-2026-52656](https://insights.sbomify.com/CVE-2026-52656/): An issue in SJCAM AllWinner Tech products SJ4000-Air V1.4C and before and Whitelabel based v.1.4C and before allows an attacker to execute a (critical 9.8)
- [CVE-2026-5265](https://insights.sbomify.com/CVE-2026-5265/): Ovn: ovn: heap over-read in icmp error response generation (medium 6.5)
- [CVE-2026-5264](https://insights.sbomify.com/CVE-2026-5264/): DTLS 1.3 ACK heap buffer overflow (high 8.3)
- [CVE-2026-52630](https://insights.sbomify.com/CVE-2026-52630/): SQL Injection vulnerability in Woltlab WCF v.6.2.4 and before allows a remote attacker to updateUserOptions in UserEditor.class.php and the (critical 9.8)
- [CVE-2026-5263](https://insights.sbomify.com/CVE-2026-5263/): URI nameConstraints not enforced in ConfirmNameConstraints() (high 7.0)
- [CVE-2026-52622](https://insights.sbomify.com/CVE-2026-52622/): An issue in Wellav Technologies Co., Ltd Wellav WES Emergency Broadcast Terminal WES100, WES270, WES280, and WES290 before 08-08-2023 allows (high 7.5)
- [CVE-2026-5262](https://insights.sbomify.com/CVE-2026-5262/): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (high 8.0)
- [CVE-2026-52610](https://insights.sbomify.com/CVE-2026-52610/): An arbitrary file write/directory traversal vulnerability in reportico-web <= 8.1.0 allows remote attackers to create or overwrite files any (critical 9.1)
- [CVE-2026-5261](https://insights.sbomify.com/CVE-2026-5261/): Shandong Hoteam InforCenter PLM BaseHandler.ashx uploadFileToIIS unrestricted upload (medium 6.9)
- [CVE-2026-52609](https://insights.sbomify.com/CVE-2026-52609/): A reflected cross-site scripting (XSS) vulnerability in reportico-web <= 8.1.0 allows remote attackers to execute arbitrary JavaScript in th (medium 6.1)
- [CVE-2026-52608](https://insights.sbomify.com/CVE-2026-52608/): An incorrect access control vulnerability in reportico-web <= 8.1.0 allows an unauthenticated attacker to inject arbitrary php code into the (critical 9.8)
- [CVE-2026-52607](https://insights.sbomify.com/CVE-2026-52607/): A directory traversal vulnerability in reportico-web <= 8.1.0 allows remote attackers to expose or execute arbitrary php files on the web se (medium 6.5)
- [CVE-2026-52606](https://insights.sbomify.com/CVE-2026-52606/): A reflected cross-site scripting (XSS) vulnerability in reportico-web <= 8.1.0 allows remote attackers to execute arbitrary JavaScript in th (medium 6.1)
- [CVE-2026-5260](https://insights.sbomify.com/CVE-2026-5260/): Gnutls: gnutls: information disclosure via heap overread in rsa key exchange (high 8.2)
- [CVE-2026-5259](https://insights.sbomify.com/CVE-2026-5259/): AutohomeCorp frostmourne Alarm Preview AlarmController.java server-side request forgery (medium 5.3)
- [CVE-2026-52584](https://insights.sbomify.com/CVE-2026-52584/): Buffer Overflow vulnerability in libjxl v.0.11.2 and before allows a local attacker to obtain sensitive information via the DecodeImageAPNG (high 7.1)
- [CVE-2026-5258](https://insights.sbomify.com/CVE-2026-5258/): Sanster IOPaint File Manager file_manager.py _get_file path traversal (medium 6.9)
- [CVE-2026-5257](https://insights.sbomify.com/CVE-2026-5257/): code-projects Simple Laundry System Parameter delstaffinfo.php sql injection (medium 6.9)
- [CVE-2026-5256](https://insights.sbomify.com/CVE-2026-5256/): code-projects Simple Laundry System Parameter modify.php sql injection (medium 6.9)
- [CVE-2026-5255](https://insights.sbomify.com/CVE-2026-5255/): code-projects Simple Laundry System Parameter delstaffinfo.php cross site scripting (medium 5.3)
- [CVE-2026-5254](https://insights.sbomify.com/CVE-2026-5254/): welovemedia FFmate Webhook AppJsonTreeView.vue cross site scripting (medium 5.1)
- [CVE-2026-52539](https://insights.sbomify.com/CVE-2026-52539/): Outstatic CMS <= 2.1.9 contains a hardcoded JWT signing secret. (critical 9.1)
- [CVE-2026-52533](https://insights.sbomify.com/CVE-2026-52533/): An issue in D-Link DIR-1253 v.1.0.1.250923.142435 allows an attacker to escalate privileges via the etc/shadow component file (critical 9.8)
- [CVE-2026-5253](https://insights.sbomify.com/CVE-2026-5253/): bufanyun HotGo editNotice Endpoint MessageList.vue cross site scripting (medium 5.1)
- [CVE-2026-52521](https://insights.sbomify.com/CVE-2026-52521/): A SQL injection vulnerability in Z-BlogPHP 1.7.5 allows authenticated attackers to execute arbitrary SQL commands via the id parameter in the CommentBat feature. (high 8.1)
- [CVE-2026-52520](https://insights.sbomify.com/CVE-2026-52520/): Emlog CMS <= 2.6.14 contains a stored cross-site scripting (XSS) vulnerability in the article publishing module (/admin/article.php). (medium 5.4)
- [CVE-2026-5252](https://insights.sbomify.com/CVE-2026-5252/): z-9527 admin Message Create Endpoint message.js cross site scripting (medium 5.1)
- [CVE-2026-5251](https://insights.sbomify.com/CVE-2026-5251/): z-9527 admin User Update Endpoint user.js dynamically-determined object attributes (medium 5.3)
- [CVE-2026-52492](https://insights.sbomify.com/CVE-2026-52492/): An integer overflow in the libtiff rgb2ycbcr utility's cvtRaster() function when computing strip buffer sizes can result in an undersized he (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/568/