# Vulnerabilities published in 2026


- [CVE-2026-49787](https://insights.sbomify.com/CVE-2026-49787/): HTTP.sys Denial of Service Vulnerability (high 7.5)
- [CVE-2026-49785](https://insights.sbomify.com/CVE-2026-49785/): UEFI Secure Boot Security Feature Bypass Vulnerability (high 7.8)
- [CVE-2026-49784](https://insights.sbomify.com/CVE-2026-49784/): Microsoft Windows App Store Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-49783](https://insights.sbomify.com/CVE-2026-49783/): Secure Boot Security Feature Bypass Vulnerability (high 7.8)
- [CVE-2026-49782](https://insights.sbomify.com/CVE-2026-49782/): WordPress Elementor Website Builder plugin <= 4.1.0 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-49781](https://insights.sbomify.com/CVE-2026-49781/): WordPress OttoKit plugin <= 1.1.27 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-49780](https://insights.sbomify.com/CVE-2026-49780/): WordPress Dokan plugin <= 5.0.2 - Privilege Escalation vulnerability (high 8.8)
- [CVE-2026-4978](https://insights.sbomify.com/CVE-2026-4978/): SQLi in UMAI Vision's Traffic Analysis System (critical 9.8)
- [CVE-2026-49779](https://insights.sbomify.com/CVE-2026-49779/): WordPress Tax Exempt for WooCommerce plugin < 1.9.5 - Path Traversal vulnerability (medium 6.5)
- [CVE-2026-49778](https://insights.sbomify.com/CVE-2026-49778/): WordPress WPFunnels Pro plugin <= 2.9.4 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-49777](https://insights.sbomify.com/CVE-2026-49777/): WordPress Product Slider Pro for WooCommerce plugin < 3.5.4 - Backdoor vulnerability (critical 10.0)
- [CVE-2026-49776](https://insights.sbomify.com/CVE-2026-49776/): SQL injection in GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites (critical 9.3)
- [CVE-2026-49775](https://insights.sbomify.com/CVE-2026-49775/): WordPress Welcart e-Commerce plugin <= 2.11.28 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-49774](https://insights.sbomify.com/CVE-2026-49774/): WordPress RD Station plugin <= 5.6.0 - Remote Code Execution (RCE) vulnerability (critical 9.9)
- [CVE-2026-49773](https://insights.sbomify.com/CVE-2026-49773/): WordPress FV Flowplayer Video Player plugin < 7.5.51.7212 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-49772](https://insights.sbomify.com/CVE-2026-49772/): WordPress The Events Calendar plugin 6.15.12-6.16.2 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-49771](https://insights.sbomify.com/CVE-2026-49771/): WordPress Photo Gallery by 10Web plugin <= 1.8.41 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-49770](https://insights.sbomify.com/CVE-2026-49770/): WordPress WP Travel Engine plugin <= 6.7.12 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-4977](https://insights.sbomify.com/CVE-2026-4977/): UsersWP <= 1.2.58 - Authenticated (Subscriber+) Restricted Usermeta Modification via 'htmlvar' Parameter (medium 4.3)
- [CVE-2026-49769](https://insights.sbomify.com/CVE-2026-49769/): WordPress wpForo Forum plugin <= 3.1.0 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-49768](https://insights.sbomify.com/CVE-2026-49768/): WordPress Happyforms plugin <= 1.26.13 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-49767](https://insights.sbomify.com/CVE-2026-49767/): WordPress wpForo Forum plugin <= 3.1.0 - Broken Authentication vulnerability (critical 9.8)
- [CVE-2026-49766](https://insights.sbomify.com/CVE-2026-49766/): WordPress WP User Manager plugin <= 2.9.16 - Arbitrary File Deletion vulnerability (critical 9.9)
- [CVE-2026-49765](https://insights.sbomify.com/CVE-2026-49765/): Deserialization in Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms (critical 9.8)
- [CVE-2026-49764](https://insights.sbomify.com/CVE-2026-49764/): WordPress RegistrationMagic plugin <= 6.0.8.6 - Broken Authentication vulnerability (critical 9.8)
- [CVE-2026-49763](https://insights.sbomify.com/CVE-2026-49763/): WordPress Integration for Contact Form 7 HubSpot plugin <= 1.3.7 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-49762](https://insights.sbomify.com/CVE-2026-49762/): Unbounded integer parsing in the Version module enables CPU and memory exhaustion denial of service (medium 5.1)
- [CVE-2026-49760](https://insights.sbomify.com/CVE-2026-49760/): Stack Buffer Overflow in ei_s_print_term at Very Large Integer (medium 6.9)
- [CVE-2026-4976](https://insights.sbomify.com/CVE-2026-4976/): Totolink LR350 cstecgi.cgi setWiFiGuestCfg buffer overflow (high 8.7)
- [CVE-2026-49759](https://insights.sbomify.com/CVE-2026-49759/): Stack buffer overflow in SCTP error cause parsing in inet_drv allows remote VM crash (high 8.8)
- [CVE-2026-49757](https://insights.sbomify.com/CVE-2026-49757/): OAuth2/OIDC account takeover in AshAuthentication via email-based user matching (critical 9.2)
- [CVE-2026-49756](https://insights.sbomify.com/CVE-2026-49756/): Multipart form-data header injection in Req via unescaped name/filename/content_type (low 2.1)
- [CVE-2026-49755](https://insights.sbomify.com/CVE-2026-49755/): Decompression bomb DoS in Req via auto-decoded archive and compressed response bodies (high 8.2)
- [CVE-2026-49754](https://insights.sbomify.com/CVE-2026-49754/): HTTP/2 CONTINUATION flood in Mint client via unbounded header-block accumulation (high 8.2)
- [CVE-2026-49753](https://insights.sbomify.com/CVE-2026-49753/): HTTP response smuggling in Mint HTTP/1 client via lenient Content-Length parsing (medium 6.3)
- [CVE-2026-4975](https://insights.sbomify.com/CVE-2026-4975/): Tenda AC15 POST Request setcfm formSetCfm memory corruption (high 8.7)
- [CVE-2026-49746](https://insights.sbomify.com/CVE-2026-49746/): GPU DDK - Dimension Mismatch and Integer Truncation in PMRDevPhysAddrOSMem (high 7.1)
- [CVE-2026-49745](https://insights.sbomify.com/CVE-2026-49745/): GPU DDK - Unvalidated sHWPerfCtlDMABuf GPU-VA, DMA-write into FW privdata via MMU ctx 0 (high 7.8)
- [CVE-2026-49744](https://insights.sbomify.com/CVE-2026-49744/): GPU DDK - Unchecked ui32TracePointer in rgxfw_log_ex() (high 7.8)
- [CVE-2026-49743](https://insights.sbomify.com/CVE-2026-49743/): GPU DDK - Write UAF of sync checkpoint in GPU kick function after export fence file descriptor is prematurely closed (high 7.8)
- [CVE-2026-49742](https://insights.sbomify.com/CVE-2026-49742/): TYPO3 CMS - Broken Access Control in Media Module (high 7.1)
- [CVE-2026-49741](https://insights.sbomify.com/CVE-2026-49741/): TYPO3 CMS - Privilege Escalation & SQL Injection in Form Framework (high 8.7)
- [CVE-2026-49740](https://insights.sbomify.com/CVE-2026-49740/): TYPO3 CMS - Insecure Deserialization in Core API (medium 6.3)
- [CVE-2026-4974](https://insights.sbomify.com/CVE-2026-4974/): Tenda AC7 POST Request SetSysTimeCfg fromSetSysTime memory corruption (high 8.7)
- [CVE-2026-49738](https://insights.sbomify.com/CVE-2026-49738/): TYPO3 CMS - Broken Access Control in File Abstraction Layer (low 2.1)
- [CVE-2026-4973](https://insights.sbomify.com/CVE-2026-4973/): SourceCodester Online Quiz System add-question.php cross site scripting (medium 5.1)
- [CVE-2026-4972](https://insights.sbomify.com/CVE-2026-4972/): code-projects Online Reviewer System btn_functions.php cross site scripting (medium 4.8)
- [CVE-2026-4971](https://insights.sbomify.com/CVE-2026-4971/): SourceCodester Note Taking App cross-site request forgery (medium 5.3)
- [CVE-2026-4970](https://insights.sbomify.com/CVE-2026-4970/): code-projects Social Networking Site Endpoint delete_photos.php sql injection (medium 5.3)
- [CVE-2026-4969](https://insights.sbomify.com/CVE-2026-4969/): code-projects Social Networking Site Alert home.php cross site scripting (medium 5.1)
- [CVE-2026-4968](https://insights.sbomify.com/CVE-2026-4968/): SourceCodester Diary App diary.php cross-site request forgery (medium 5.3)
- [CVE-2026-4967](https://insights.sbomify.com/CVE-2026-4967/): Memory corruption in SC7731E/SC9832E/SC9863A/T310/T610/T618/T7200/T7225/T7250/T7255/T7280/T7300/T8100/T9100/T8200/T8300 (high 7.5)
- [CVE-2026-4966](https://insights.sbomify.com/CVE-2026-4966/): itsourcecode Free Hotel Reservation System index.php sql injection (medium 5.3)
- [CVE-2026-4965](https://insights.sbomify.com/CVE-2026-4965/): letta-ai letta Incomplete Fix CVE-2025-6101 ast_parsers.py resolve_type eval injection (medium 6.9)
- [CVE-2026-4964](https://insights.sbomify.com/CVE-2026-4964/): letta-ai letta File URL message_helper.py _convert_message_create_to_message server-side request forgery (medium 5.3)
- [CVE-2026-4963](https://insights.sbomify.com/CVE-2026-4963/): huggingface smolagents Incomplete Fix CVE-2025-9959 local_python_executor.py evaluate_with code injection (medium 5.3)
- [CVE-2026-4962](https://insights.sbomify.com/CVE-2026-4962/): UltraVNC Service version.dll uncontrolled search path (high 7.3)
- [CVE-2026-4961](https://insights.sbomify.com/CVE-2026-4961/): Tenda AC6 POST Request QuickIndex formQuickIndex stack-based overflow (high 8.7)
- [CVE-2026-4960](https://insights.sbomify.com/CVE-2026-4960/): Tenda AC6 POST Request WizardHandle fromWizardHandle stack-based overflow (high 8.7)
- [CVE-2026-4959](https://insights.sbomify.com/CVE-2026-4959/): OpenBMB XAgent ShareServer WebSocket Endpoint share.py check_user missing authentication (medium 6.9)
- [CVE-2026-4958](https://insights.sbomify.com/CVE-2026-4958/): OpenBMB XAgent WebSocket Endpoint replayer.py ReplayServer.send_data authorization (low 2.3)
- [CVE-2026-4957](https://insights.sbomify.com/CVE-2026-4957/): OpenBMB XAgent API Key function_handler.py FunctionHandler.handle_tool_call log file (medium 5.1)
- [CVE-2026-4956](https://insights.sbomify.com/CVE-2026-4956/): Shenzhen Ruiming Technology Streamax Crocus Parameter DevicePrint.do sql injection (medium 6.9)
- [CVE-2026-4955](https://insights.sbomify.com/CVE-2026-4955/): Shenzhen Ruiming Technology Streamax Crocus OperateStatistic.do sql injection (medium 6.9)
- [CVE-2026-4954](https://insights.sbomify.com/CVE-2026-4954/): mingSoft MCMS Web Content List Endpoint ContentAction.java list sql injection (medium 5.3)
- [CVE-2026-4953](https://insights.sbomify.com/CVE-2026-4953/): mingSoft MCMS Editor Endpoint BaseAction.java catchImage server-side request forgery (medium 6.9)
- [CVE-2026-4952](https://insights.sbomify.com/CVE-2026-4952/): Cross-site scripting in WebOrderSystem (AuftragsManager) (medium 5.1)
- [CVE-2026-49510](https://insights.sbomify.com/CVE-2026-49510/): Integer overflow in rlottie (medium 6.1)
- [CVE-2026-4951](https://insights.sbomify.com/CVE-2026-4951/): Reflected Cross-Site Scripting in CustomerAdministration Portal (KundenManager)in VertiGIS WebOrderSystem (medium 5.1)
- [CVE-2026-49509](https://insights.sbomify.com/CVE-2026-49509/): Memory corruption in rLottie (medium 4.4)
- [CVE-2026-49506](https://insights.sbomify.com/CVE-2026-49506/): Path traversal in Wyse Management Suite (high 7.2)
- [CVE-2026-49502](https://insights.sbomify.com/CVE-2026-49502/): Auth bypass in PowerFlex (high 7.4)
- [CVE-2026-49501](https://insights.sbomify.com/CVE-2026-49501/): Privilege escalation in PowerScale OneFS (medium 6.7)
- [CVE-2026-49500](https://insights.sbomify.com/CVE-2026-49500/): Privilege escalation in Alienware Command Center (AWCC (medium 6.0)
- [CVE-2026-4950](https://insights.sbomify.com/CVE-2026-4950/): Stored Cross-Site Scripting in CustomerAdministration Portal (KundenManager) in VertiGIS WebOrderSystem (medium 4.8)
- [CVE-2026-49499](https://insights.sbomify.com/CVE-2026-49499/): Privilege escalation in PowerProtect Data Manager (high 8.8)
- [CVE-2026-49498](https://insights.sbomify.com/CVE-2026-49498/): Ghidra 11.0 < 12.1 - SQL Injection in PostgreSQL Password Change via Unescaped Username (high 8.7)
- [CVE-2026-49497](https://insights.sbomify.com/CVE-2026-49497/): Ghidra < 12.1 - Path Traversal via .gnu_debuglink in DWARF External Debug File Resolution (medium 4.6)
- [CVE-2026-49496](https://insights.sbomify.com/CVE-2026-49496/): Ghidra < 12.1 - Heap-Use-After-Free in SleighBuilder::generatePointerAdd via Vector Reallocation (medium 6.9)
- [CVE-2026-49495](https://insights.sbomify.com/CVE-2026-49495/): Ghidra 10.2 < 12.1 - Denial of Service via Circular Reference in Mach-O Export Trie Parser (medium 6.7)
- [CVE-2026-49494](https://insights.sbomify.com/CVE-2026-49494/): Xcitium Client Security / Comodo Internet Security Remote Denial of Service (high 8.7)
- [CVE-2026-49493](https://insights.sbomify.com/CVE-2026-49493/): Markdown Preview Enhanced Arbitrary Code Execution via Bitfield interpretJS() (high 8.6)
- [CVE-2026-49492](https://insights.sbomify.com/CVE-2026-49492/): Markdown Preview Enhanced OS Command Injection in External File and Link Opening (high 8.6)
- [CVE-2026-49491](https://insights.sbomify.com/CVE-2026-49491/): Pixa Bank 2.0 SQL Injection via agence-ajax.php API (high 8.8)
- [CVE-2026-49490](https://insights.sbomify.com/CVE-2026-49490/): OpenCATS - SQL Injection in DataGrid Filter Handling for Tags Column (high 8.6)
- [CVE-2026-4949](https://insights.sbomify.com/CVE-2026-4949/): ProfilePress <= 4.16.12 - Missing Authorization to Authenticated (Subscriber+) Inactive Membership Plan Subscription (medium 4.3)
- [CVE-2026-49489](https://insights.sbomify.com/CVE-2026-49489/): OpenCATS - SQL Injection in DataGrid sortDirection Parameter (high 8.4)
- [CVE-2026-49488](https://insights.sbomify.com/CVE-2026-49488/): Apache OpenMeetings: Arbitrary File Read (medium 6.5)
- [CVE-2026-49487](https://insights.sbomify.com/CVE-2026-49487/): Apache Airflow: Task-instance API exposes secrets in deferred trigger kwargs (medium 6.5)
- [CVE-2026-49486](https://insights.sbomify.com/CVE-2026-49486/): Apache Airflow FTP provider: FTP Provider does not protect FTPS data channel (missing PROT_P) (high 7.5)
- [CVE-2026-49485](https://insights.sbomify.com/CVE-2026-49485/): HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint (high 7.5)
- [CVE-2026-49484](https://insights.sbomify.com/CVE-2026-49484/): Code for IBM i: Temporary files are visible to all users (medium 5.1)
- [CVE-2026-49483](https://insights.sbomify.com/CVE-2026-49483/): Code for IBMi: Uses IBM i components with blind check allowing arbitrary code execution (high 8.9)
- [CVE-2026-49482](https://insights.sbomify.com/CVE-2026-49482/): ClipBucket: SQL Wildcard Injection in Subtitle Edit Endpoint Allows Mass Subtitle Overwrite (medium 4.3)
- [CVE-2026-49481](https://insights.sbomify.com/CVE-2026-49481/): UpSnap vulnerable to Remote Code Execution via IP Field Template Injection in wake_cmd/shutdown_cmd (critical 9.6)
- [CVE-2026-4948](https://insights.sbomify.com/CVE-2026-4948/): Firewalld: firewalld: local unprivileged user can modify firewall state due to d-bus setter mis-authorization (medium 5.5)
- [CVE-2026-49478](https://insights.sbomify.com/CVE-2026-49478/): Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage (high 8.7)
- [CVE-2026-49477](https://insights.sbomify.com/CVE-2026-49477/): Soup Sieve: Regular Expression Denial of Service (ReDoS) in soupsieve Selector Parser (high 7.5)
- [CVE-2026-49476](https://insights.sbomify.com/CVE-2026-49476/): Soup Sieve: Memory Exhaustion via Large Comma-Separated Selector Lists in soupsieve (high 7.5)
- [CVE-2026-49475](https://insights.sbomify.com/CVE-2026-49475/): FreeSWITCH: Out-of-bounds memory access in core STUN attribute parsing (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/583/