# Vulnerabilities published in 2026


- [CVE-2026-49147](https://insights.sbomify.com/CVE-2026-49147/): Other in App::Ack (high 7.5)
- [CVE-2026-49146](https://insights.sbomify.com/CVE-2026-49146/): App::Ack versions before 3.10.0 for Perl allow memory exhaustion via an unbounded context value in a project .ackrc (high 7.5)
- [CVE-2026-49145](https://insights.sbomify.com/CVE-2026-49145/): App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc (high 7.5)
- [CVE-2026-49144](https://insights.sbomify.com/CVE-2026-49144/): BrowserStack Runner 0.9.5 Path Traversal via _default HTTP Handler (high 7.1)
- [CVE-2026-49143](https://insights.sbomify.com/CVE-2026-49143/): BrowserStack Runner 0.9.5 Unauthenticated RCE via /_log HTTP Handler (high 8.7)
- [CVE-2026-49142](https://insights.sbomify.com/CVE-2026-49142/): OpenEMR Before 8.5.0 SQL Injection via form_icd_codes[] (high 8.7)
- [CVE-2026-49141](https://insights.sbomify.com/CVE-2026-49141/): WACRM Authorization Bypass via Automation Engine Endpoint (medium 5.1)
- [CVE-2026-49140](https://insights.sbomify.com/CVE-2026-49140/): Nanobot < 0.2.1 Denial of Service via Matrix Media Download Handler (medium 5.3)
- [CVE-2026-4914](https://insights.sbomify.com/CVE-2026-4914/): Cross-site scripting in Neurons for ITSM (Cloud) (medium 5.4)
- [CVE-2026-49139](https://insights.sbomify.com/CVE-2026-49139/): Nanobot < 0.2.1 SSRF via Microsoft Teams Channel serviceUrl Poisoning (high 7.0)
- [CVE-2026-49138](https://insights.sbomify.com/CVE-2026-49138/): Nanobot < 0.2.1 SSRF via web_fetch Tool Redirect Following (medium 5.3)
- [CVE-2026-49136](https://insights.sbomify.com/CVE-2026-49136/): Banana Slides 0.4.0 Path Traversal via generate_image() in ai_service.py (high 8.7)
- [CVE-2026-49135](https://insights.sbomify.com/CVE-2026-49135/): CodexBar < 0.32.0 Insecure Temporary File Handling in Notarization Workflow (high 7.2)
- [CVE-2026-49134](https://insights.sbomify.com/CVE-2026-49134/): CodexBar < 0.32.0 Privilege Escalation via CLI Installer Temp File (high 7.5)
- [CVE-2026-49133](https://insights.sbomify.com/CVE-2026-49133/): Typemill < 2.24.0 Path Traversal via ControllerApiImage::getPagemedia() (high 7.1)
- [CVE-2026-49132](https://insights.sbomify.com/CVE-2026-49132/): OPNsense < 26.1.9 Stored XSS via Certificate Description Field (medium 5.1)
- [CVE-2026-49131](https://insights.sbomify.com/CVE-2026-49131/): OPNsense < 26.1.9 Stored XSS via Firewall Rule Description Field (medium 5.1)
- [CVE-2026-49130](https://insights.sbomify.com/CVE-2026-49130/): Music Player Daemon < 0.24.11 CRLF Injection via XspfPlaylistPlugin.cxx (medium 6.9)
- [CVE-2026-4913](https://insights.sbomify.com/CVE-2026-4913/): Auth bypass in Neurons for ITSM (Cloud) (medium 5.7)
- [CVE-2026-49129](https://insights.sbomify.com/CVE-2026-49129/): Music Player Daemon < 0.24.11 SSRF via CurlInputPlugin (medium 6.9)
- [CVE-2026-49128](https://insights.sbomify.com/CVE-2026-49128/): Music Player Daemon < 0.24.11 Path Traversal via LocalStorage URI Handling (high 8.7)
- [CVE-2026-49127](https://insights.sbomify.com/CVE-2026-49127/): Music Player Daemon < 0.24.11 Stack Buffer Overflow via pcm_unpack_24be (high 8.8)
- [CVE-2026-49121](https://insights.sbomify.com/CVE-2026-49121/): AI Tensor Engine for ROCm (AITER) 0.1.14 Unauthenticated RCE via MessageQueue.recv() Pickle Deserialization (critical 9.2)
- [CVE-2026-49120](https://insights.sbomify.com/CVE-2026-49120/): Medplum < 5.1.14 SSRF via FHIR Subscription Endpoint (medium 6.3)
- [CVE-2026-4912](https://insights.sbomify.com/CVE-2026-4912/): Media Cleaner: Clean your WordPress! <= 7.0.3 - Authenticated (Administrator+) Server-Side Request Forgery (medium 4.1)
- [CVE-2026-49119](https://insights.sbomify.com/CVE-2026-49119/): Gradio < 6.16.0 Path Traversal via FileExplorer.preprocess() (high 8.7)
- [CVE-2026-49114](https://insights.sbomify.com/CVE-2026-49114/): ONNX symlink-following and path-traversal arbitrary file write (medium 6.8)
- [CVE-2026-49113](https://insights.sbomify.com/CVE-2026-49113/): WordPress Cornerstone plugin < 7.8.8 - Arbitrary Code Execution vulnerability (high 8.5)
- [CVE-2026-49112](https://insights.sbomify.com/CVE-2026-49112/): WordPress Shared Files plugin <= 1.7.64 - Path Traversal vulnerability (high 7.5)
- [CVE-2026-49111](https://insights.sbomify.com/CVE-2026-49111/): WordPress Masteriyo - LMS plugin <= 2.2.0 - Privilege Escalation vulnerability (high 8.8)
- [CVE-2026-49110](https://insights.sbomify.com/CVE-2026-49110/): WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.4 - Price Manipulation vulnerability (high 7.5)
- [CVE-2026-4911](https://insights.sbomify.com/CVE-2026-4911/): Booking Package <= 1.7.06 - Unauthenticated Price Manipulation via 'amount' Parameter (medium 5.3)
- [CVE-2026-49109](https://insights.sbomify.com/CVE-2026-49109/): Deserialization in Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms (critical 9.8)
- [CVE-2026-49108](https://insights.sbomify.com/CVE-2026-49108/): WordPress Moderno theme < 1.43 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-49107](https://insights.sbomify.com/CVE-2026-49107/): WordPress Thrive Apprentice plugin < 10.8.10.2 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-49106](https://insights.sbomify.com/CVE-2026-49106/): WordPress Integration for Contact Form 7 and Constant Contact plugin <= 1.1.6 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-49105](https://insights.sbomify.com/CVE-2026-49105/): Deserialization in WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms (critical 9.8)
- [CVE-2026-49104](https://insights.sbomify.com/CVE-2026-49104/): Deserialization in Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms (critical 9.8)
- [CVE-2026-49103](https://insights.sbomify.com/CVE-2026-49103/): Path traversal in Webmin (critical 9.4)
- [CVE-2026-49102](https://insights.sbomify.com/CVE-2026-49102/): Cross-site scripting in Webmin (medium 6.1)
- [CVE-2026-4910](https://insights.sbomify.com/CVE-2026-4910/): Shenzhen Ruiming Technology Streamax Crocus Endpoint RemoteFormat.do sql injection (medium 6.9)
- [CVE-2026-49099](https://insights.sbomify.com/CVE-2026-49099/): Apache Camel-Salesforce: Non-Camel-prefixed Exchange header constants bypass the HTTP header filter (medium 5.3)
- [CVE-2026-49098](https://insights.sbomify.com/CVE-2026-49098/): Apache Camel-Kafka: The kafka.OVERRIDE_TOPIC (and other kafka.*) Exchange header constants used non-Camel-prefixed names that bypass the upstream HTTP header filter (medium 5.3)
- [CVE-2026-49097](https://insights.sbomify.com/CVE-2026-49097/): Apache Camel-IRC: The irc.sendTo (and other irc.*) Exchange header constants used non-Camel-prefixed names that bypass the HTTP header filter (medium 6.5)
- [CVE-2026-49096](https://insights.sbomify.com/CVE-2026-49096/): Uncaught Exception in Kibana Cases Leading to Denial of Service (medium 4.3)
- [CVE-2026-49095](https://insights.sbomify.com/CVE-2026-49095/): Improper Input Validation in Kibana Fleet Leading to Privilege Escalation (high 7.2)
- [CVE-2026-49094](https://insights.sbomify.com/CVE-2026-49094/): Uncontrolled Resource Consumption in Kibana Leading to Denial of Service (medium 6.5)
- [CVE-2026-49093](https://insights.sbomify.com/CVE-2026-49093/): Server-Side Request Forgery (SSRF) in Kibana Leading to Unauthorized Network Access (medium 6.3)
- [CVE-2026-49092](https://insights.sbomify.com/CVE-2026-49092/): Unintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Unauthorized Information Exposure (medium 4.3)
- [CVE-2026-49091](https://insights.sbomify.com/CVE-2026-49091/): Improper Output Neutralization for Logs in Kibana Leading to Log Injection (high 8.0)
- [CVE-2026-49090](https://insights.sbomify.com/CVE-2026-49090/): Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service (medium 6.5)
- [CVE-2026-4909](https://insights.sbomify.com/CVE-2026-4909/): code-projects Exam Form Submission update_s7.php cross site scripting (medium 4.8)
- [CVE-2026-49089](https://insights.sbomify.com/CVE-2026-49089/): Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service (medium 6.5)
- [CVE-2026-49088](https://insights.sbomify.com/CVE-2026-49088/): Insertion of Sensitive Information into Log File in Kibana Leading to Information Disclosure (medium 4.4)
- [CVE-2026-49087](https://insights.sbomify.com/CVE-2026-49087/): Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service (medium 6.5)
- [CVE-2026-49086](https://insights.sbomify.com/CVE-2026-49086/): Apache Camel-Dapr: The Dapr Pub/Sub consumer copied the inbound CloudEvent's pub/sub-name and topic into producer-direction routing headers (medium 6.5)
- [CVE-2026-49085](https://insights.sbomify.com/CVE-2026-49085/): Deserialization in WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms (critical 9.8)
- [CVE-2026-49084](https://insights.sbomify.com/CVE-2026-49084/): WordPress JetEngine plugin < 3.8.9.1 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-49083](https://insights.sbomify.com/CVE-2026-49083/): WordPress LatePoint plugin <= 5.5.1 - Privilege Escalation vulnerability (high 7.5)
- [CVE-2026-49082](https://insights.sbomify.com/CVE-2026-49082/): Information disclosure in Chatway Live Chat &#8211; AI Chatbot, Customer Support, FAQ &amp; Helpdesk Customer Service &amp; Chat Buttons (high 7.4)
- [CVE-2026-49081](https://insights.sbomify.com/CVE-2026-49081/): WordPress User Registration Stripe plugin <= 1.3.12 - Broken Access Control vulnerability (high 8.2)
- [CVE-2026-49080](https://insights.sbomify.com/CVE-2026-49080/): WordPress wpDataTables plugin <= 7.3.6 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-4908](https://insights.sbomify.com/CVE-2026-4908/): code-projects Simple Laundry System Parameter modstaffinfo.php sql injection (medium 6.9)
- [CVE-2026-49079](https://insights.sbomify.com/CVE-2026-49079/): WordPress JetSearch plugin <= 3.5.17 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-49078](https://insights.sbomify.com/CVE-2026-49078/): WordPress WP Travel Engine plugin <= 6.7.10 - Other Vulnerability Type vulnerability (high 7.5)
- [CVE-2026-49077](https://insights.sbomify.com/CVE-2026-49077/): WordPress WP eMember plugin <= v10.2.2 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-49076](https://insights.sbomify.com/CVE-2026-49076/): WordPress JetEngine plugin <= 3.8.9.1 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-49075](https://insights.sbomify.com/CVE-2026-49075/): WordPress JetEngine plugin <= 3.8.9.1 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-49074](https://insights.sbomify.com/CVE-2026-49074/): WordPress JetEngine plugin <= 3.8.9.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-49073](https://insights.sbomify.com/CVE-2026-49073/): WordPress Directorist Booking plugin <= 3.0.3 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-49072](https://insights.sbomify.com/CVE-2026-49072/): WordPress WooCommerce Anti-Fraud plugin <= 7.2.6 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-49071](https://insights.sbomify.com/CVE-2026-49071/): WordPress WooCommerce Dropshipping plugin <= 5.2.4 - Broken Authentication vulnerability (medium 6.5)
- [CVE-2026-49070](https://insights.sbomify.com/CVE-2026-49070/): WordPress Knit Pay plugin <= 9.4.0.0 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-4907](https://insights.sbomify.com/CVE-2026-4907/): Page-Replica Page Replica Endpoint sitemap sitemap.fetch server-side request forgery (medium 5.3)
- [CVE-2026-49069](https://insights.sbomify.com/CVE-2026-49069/): WordPress WPZOOM Portfolio plugin <= 1.4.21 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-49068](https://insights.sbomify.com/CVE-2026-49068/): WordPress Coupon Affiliates plugin <= 7.8.1 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2026-49067](https://insights.sbomify.com/CVE-2026-49067/): WordPress Advanced 301 and 302 Redirect plugin <= 1.6.9 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-49066](https://insights.sbomify.com/CVE-2026-49066/): WordPress Conekta Payment Gateway plugin <= 6.0.0 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2026-49065](https://insights.sbomify.com/CVE-2026-49065/): WordPress Hippoo Mobile App for WooCommerce plugin <= 1.9.5 - Broken Access Control vulnerability (high 8.2)
- [CVE-2026-49064](https://insights.sbomify.com/CVE-2026-49064/): WordPress GetPaid plugin <= 2.8.49 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2026-49063](https://insights.sbomify.com/CVE-2026-49063/): WordPress Listdom plugin <= 5.5.0 - Privilege Escalation vulnerability (high 7.3)
- [CVE-2026-49062](https://insights.sbomify.com/CVE-2026-49062/): WordPress Faust.js plugin <= 1.8.7 - Broken Authentication vulnerability (high 8.8)
- [CVE-2026-49061](https://insights.sbomify.com/CVE-2026-49061/): WordPress WPC Product Options for WooCommerce plugin <= 3.2.1 - Arbitrary File Download vulnerability (high 7.5)
- [CVE-2026-49060](https://insights.sbomify.com/CVE-2026-49060/): WordPress Hippoo Mobile App for WooCommerce plugin <= 1.9.4 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2026-4906](https://insights.sbomify.com/CVE-2026-4906/): Tenda AC5 POST Request WizardHandle decodePwd stack-based overflow (high 8.7)
- [CVE-2026-49059](https://insights.sbomify.com/CVE-2026-49059/): WordPress Facebook for WooCommerce plugin <= 3.7.0 - Open Redirection vulnerability (medium 4.7)
- [CVE-2026-49058](https://insights.sbomify.com/CVE-2026-49058/): WordPress LoginPress Pro plugin <= 6.2.2 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2026-49057](https://insights.sbomify.com/CVE-2026-49057/): WordPress JobSearch plugin <= 3.2.7 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-49056](https://insights.sbomify.com/CVE-2026-49056/): Information disclosure in WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels (high 7.5)
- [CVE-2026-49055](https://insights.sbomify.com/CVE-2026-49055/): Cross-site scripting in Drag and Drop Multiple File Upload – Contact Form 7 (high 7.1)
- [CVE-2026-49054](https://insights.sbomify.com/CVE-2026-49054/): WordPress The Post Grid plugin <= 7.9.2 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-49053](https://insights.sbomify.com/CVE-2026-49053/): WordPress ElementsKit Elementor addons Lite plugin <= 3.9.6 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-49052](https://insights.sbomify.com/CVE-2026-49052/): WordPress ElementsKit Elementor addons Lite plugin <= 3.9.6 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-49051](https://insights.sbomify.com/CVE-2026-49051/): WordPress WP Meta and Date Remover plugin <= 2.3.6 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-49050](https://insights.sbomify.com/CVE-2026-49050/): Apache DolphinScheduler: General user can mint admin access tokens via /access-tokens (high 8.8)
- [CVE-2026-4905](https://insights.sbomify.com/CVE-2026-4905/): Tenda AC5 POST Request WifiWpsOOB formWifiWpsOOB stack-based overflow (high 8.7)
- [CVE-2026-49049](https://insights.sbomify.com/CVE-2026-49049/): Joomla Extension - joomshaper.com - Unauthenticated access to Helix3 template ajax handler (high 7.5)
- [CVE-2026-49048](https://insights.sbomify.com/CVE-2026-49048/): Joomla Extension - joomcoder.com - Unauthenticated SQL Injection in JoomCCK extension for Joomla < 6.4.1 (high 8.7)
- [CVE-2026-49047](https://insights.sbomify.com/CVE-2026-49047/): WordPress DearFlip plugin <= 2.4.27 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-49046](https://insights.sbomify.com/CVE-2026-49046/): WordPress Duplicate Page and Post plugin <= 2.9.5 - SQL Injection vulnerability (high 8.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/587/