# Vulnerabilities published in 2026


- [CVE-2026-49045](https://insights.sbomify.com/CVE-2026-49045/): WordPress Adminimize plugin <= 1.11.11 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-49044](https://insights.sbomify.com/CVE-2026-49044/): WordPress Advanced Custom Fields: Font Awesome Field plugin <= 5.0.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-49043](https://insights.sbomify.com/CVE-2026-49043/): WordPress WP Migrate Lite plugin <= 2.7.8 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.7)
- [CVE-2026-49042](https://insights.sbomify.com/CVE-2026-49042/): Apache Camel: langchain4j-tools: filter tool argument headers against declared parameters (high 7.3)
- [CVE-2026-4904](https://insights.sbomify.com/CVE-2026-4904/): Tenda AC5 POST Request setcfm formSetCfm stack-based overflow (high 8.7)
- [CVE-2026-49035](https://insights.sbomify.com/CVE-2026-49035/): Stack-based Buffer Overflow in MZ Automation libIEC61850 (critical 9.2)
- [CVE-2026-49033](https://insights.sbomify.com/CVE-2026-49033/): Stack-Based Buffer Overflow in Labcenter Proteus (high 8.4)
- [CVE-2026-4903](https://insights.sbomify.com/CVE-2026-4903/): Tenda AC5 POST Request QuickIndex formQuickIndex memory corruption (high 8.7)
- [CVE-2026-4902](https://insights.sbomify.com/CVE-2026-4902/): Tenda AC5 POST Request addressNat fromAddressNat memory corruption (high 8.7)
- [CVE-2026-49017](https://insights.sbomify.com/CVE-2026-49017/): OpenStack Swift: s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body (high 7.1)
- [CVE-2026-49014](https://insights.sbomify.com/CVE-2026-49014/): GDAL: scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow (high 7.4)
- [CVE-2026-4901](https://insights.sbomify.com/CVE-2026-4901/): Insertion of Sesitive Information into Log File in AlanWeb SCADA (medium 6.9)
- [CVE-2026-49009](https://insights.sbomify.com/CVE-2026-49009/): Northern.tech Mender Server v4.1.0, v4.0.1 and below, and fixed in v4.1.1 and v4.0.2 allows Directory Traversal. (low 3.1)
- [CVE-2026-49008](https://insights.sbomify.com/CVE-2026-49008/): Integrity‑check credential leakage vulnerability in an application function of ZTE F689 product (medium 6.5)
- [CVE-2026-49007](https://insights.sbomify.com/CVE-2026-49007/): Information leakage vulnerability in ZTE F689 product (high 7.5)
- [CVE-2026-49006](https://insights.sbomify.com/CVE-2026-49006/): TLS credential leakage vulnerability in ZTE F689 product (medium 5.3)
- [CVE-2026-49005](https://insights.sbomify.com/CVE-2026-49005/): Root password hash exposure vulnerability in ZTE F689 product (low 2.4)
- [CVE-2026-49004](https://insights.sbomify.com/CVE-2026-49004/): PostgreSQL Misconfiguration and Command Injection Vulnerability in ZTE NX799J (Red Magic 11 Air) Product (medium 6.5)
- [CVE-2026-49003](https://insights.sbomify.com/CVE-2026-49003/): Unauthenticated RCE Vulnerability in ZTE ZXDU68 S202 V5.0 Product (critical 9.6)
- [CVE-2026-49002](https://insights.sbomify.com/CVE-2026-49002/): Broken Access Control Vulnerabily in ZTE ZXUniPOS NDS-LTE product (critical 9.1)
- [CVE-2026-49001](https://insights.sbomify.com/CVE-2026-49001/): Cross-Site Request Forgery (CSRF) vulnerability in ZTE ZXUniPOS NDS-LTE product (medium 5.3)
- [CVE-2026-49000](https://insights.sbomify.com/CVE-2026-49000/): Cryptography Implementation Flaw vulnerability in ZTE ZXUniPOS NDS-LTE product (high 7.0)
- [CVE-2026-4900](https://insights.sbomify.com/CVE-2026-4900/): code-projects Online Food Ordering System localhost.sql privilege escalation (medium 6.9)
- [CVE-2026-48999](https://insights.sbomify.com/CVE-2026-48999/): Stored Cross-Site Scripting (XSS) vulnerability in ZTE ZXUniPOS NDS-LTE product (medium 5.7)
- [CVE-2026-48998](https://insights.sbomify.com/CVE-2026-48998/): guzzlehttp/psr7 has Host Confusion via Authority Reinterpretation (medium 5.3)
- [CVE-2026-48997](https://insights.sbomify.com/CVE-2026-48997/): e107: Command Injection via shell expansion in ImageMagick resize destination path (high 7.1)
- [CVE-2026-48996](https://insights.sbomify.com/CVE-2026-48996/): Trilium: Malicious import with GeoMap marker title XSS leads to RCE on the desktop client (critical 9.3)
- [CVE-2026-48995](https://insights.sbomify.com/CVE-2026-48995/): pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile (medium 4.8)
- [CVE-2026-48994](https://insights.sbomify.com/CVE-2026-48994/): ImageMagick: Heap Buffer Over-Write in MAT decoder on 32-bit systems (medium 5.9)
- [CVE-2026-48991](https://insights.sbomify.com/CVE-2026-48991/): XianYuLauncher: Legacy Microsoft account OAuth sign-in flow lacks PKCE and state validation (medium 5.5)
- [CVE-2026-48990](https://insights.sbomify.com/CVE-2026-48990/): joserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserialization (medium 5.3)
- [CVE-2026-4899](https://insights.sbomify.com/CVE-2026-4899/): code-projects Online Food Ordering System food.php cross site scripting (medium 4.8)
- [CVE-2026-48989](https://insights.sbomify.com/CVE-2026-48989/): Windows-MCP: HTTP transports expose unauthenticated PowerShell control with wildcard CORS (high 8.9)
- [CVE-2026-48988](https://insights.sbomify.com/CVE-2026-48988/): markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations (medium 5.3)
- [CVE-2026-48987](https://insights.sbomify.com/CVE-2026-48987/): pyLoad: Unbounded Memory Growth Leading to DoS and Potential DDoS in EventManager (medium 6.5)
- [CVE-2026-48986](https://insights.sbomify.com/CVE-2026-48986/): pam_usb: Infinite loop DoS in process-tree walk when parent process exits during authentication (medium 4.7)
- [CVE-2026-48985](https://insights.sbomify.com/CVE-2026-48985/): pam_usb: NULL Dereference Crash in pusb_is_loginctl_local when loginctl Returns Empty Remote Field (medium 5.5)
- [CVE-2026-48984](https://insights.sbomify.com/CVE-2026-48984/): pam_usb: xfree() does not call explicit_bzero — sensitive cryptographic material may linger in freed heap (medium 4.7)
- [CVE-2026-48983](https://insights.sbomify.com/CVE-2026-48983/): pam_usb: TOCTOU race condition in pad directory creation allows symlink substitution (medium 5.8)
- [CVE-2026-48982](https://insights.sbomify.com/CVE-2026-48982/): pam_usb: Missing O_EXCL on pad temp file creation allows concurrent update race (medium 5.8)
- [CVE-2026-48981](https://insights.sbomify.com/CVE-2026-48981/): pam_usb: xmlReadFile flags=0 permits XXE network entity fetching in conf.c (medium 6.7)
- [CVE-2026-48980](https://insights.sbomify.com/CVE-2026-48980/): pam_usb: getenv() used in PAM context allows environment variable injection into local-check logic (medium 6.3)
- [CVE-2026-4898](https://insights.sbomify.com/CVE-2026-4898/): code-projects Online Food Ordering System contact.php cross site scripting (medium 5.3)
- [CVE-2026-48979](https://insights.sbomify.com/CVE-2026-48979/): PHP Standard Library: HTTP/2 server-side missing content-length validation enables request smuggling (high 7.5)
- [CVE-2026-48978](https://insights.sbomify.com/CVE-2026-48978/): oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (low 2.1)
- [CVE-2026-48977](https://insights.sbomify.com/CVE-2026-48977/): OpenSlide: Arbitrary memory write with crafted Ventana BIF file (high 7.7)
- [CVE-2026-48976](https://insights.sbomify.com/CVE-2026-48976/): HomeBox: Cross-Tenant IDOR in Notifier Update Leaks Shoutrrr Credentials and Allows Webhook Hijack (high 8.1)
- [CVE-2026-48975](https://insights.sbomify.com/CVE-2026-48975/): Missing authorization in homebox (high 8.1)
- [CVE-2026-48974](https://insights.sbomify.com/CVE-2026-48974/): HomeBox: Forced Group Membership Without Consent in Homebox AddMember Handler (medium 5.4)
- [CVE-2026-48973](https://insights.sbomify.com/CVE-2026-48973/): WordPress SVG Support plugin <= 2.5.14 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-48972](https://insights.sbomify.com/CVE-2026-48972/): WordPress SeedProd Pro plugin < 6.19.5 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-48971](https://insights.sbomify.com/CVE-2026-48971/): WordPress Product Import Export for WooCommerce plugin <= 2.5.6 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-48970](https://insights.sbomify.com/CVE-2026-48970/): WordPress Really Simple SSL plugin <= 9.5.10 - Broken Authentication vulnerability (high 8.1)
- [CVE-2026-4897](https://insights.sbomify.com/CVE-2026-4897/): Polkit: polkit: denial of service via unbounded input processing through standard input (medium 5.5)
- [CVE-2026-48969](https://insights.sbomify.com/CVE-2026-48969/): WordPress Really Simple SSL plugin <= 9.5.9 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-48968](https://insights.sbomify.com/CVE-2026-48968/): WordPress Master Slider plugin <= 3.10.8 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-48967](https://insights.sbomify.com/CVE-2026-48967/): WordPress Geo Mashup plugin <= 1.13.19 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-48966](https://insights.sbomify.com/CVE-2026-48966/): WordPress Funnel Builder by FunnelKit plugin <= 3.15.0.2 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-48965](https://insights.sbomify.com/CVE-2026-48965/): WordPress XCloner plugin <= 4.8.6 - Sensitive Data Exposure vulnerability (medium 6.5)
- [CVE-2026-48964](https://insights.sbomify.com/CVE-2026-48964/): WordPress ELEX WordPress HelpDesk & Customer Ticketing System plugin <= 3.3.6 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-48962](https://insights.sbomify.com/CVE-2026-48962/): Code injection in IO::Compress (high 7.3)
- [CVE-2026-48961](https://insights.sbomify.com/CVE-2026-48961/): Denial of service in IO::Compress (high 7.3)
- [CVE-2026-4896](https://insights.sbomify.com/CVE-2026-4896/): Missing authorization in WCFM – Frontend Manager for WooCommerce (high 8.1)
- [CVE-2026-48959](https://insights.sbomify.com/CVE-2026-48959/): IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward (high 7.5)
- [CVE-2026-48958](https://insights.sbomify.com/CVE-2026-48958/): Joomla! Core - [20260712] - Incorrect Access Control in com_fields webservice endpoints (medium 6.4)
- [CVE-2026-48957](https://insights.sbomify.com/CVE-2026-48957/): Joomla! Core - [20260711] - Incorrect Access Control in com_privacy webservice endpoints (medium 6.4)
- [CVE-2026-48956](https://insights.sbomify.com/CVE-2026-48956/): Joomla! Core - [20260710] - Incorrect Access Control in com_modules (medium 6.4)
- [CVE-2026-48955](https://insights.sbomify.com/CVE-2026-48955/): Joomla! Core - [20260709] - Incorrect Access Control in com_workflow (medium 6.4)
- [CVE-2026-48954](https://insights.sbomify.com/CVE-2026-48954/): Joomla! Core - [20260708] - XSS through language overrides (medium 5.9)
- [CVE-2026-48953](https://insights.sbomify.com/CVE-2026-48953/): Joomla! Core - [20260707] - XSS in the generic image output layout (medium 5.9)
- [CVE-2026-48952](https://insights.sbomify.com/CVE-2026-48952/): Joomla! Core - [20260706] - XSS in com_installer (medium 5.9)
- [CVE-2026-48951](https://insights.sbomify.com/CVE-2026-48951/): Joomla! Core - [20260705] - XSS in various modalreturn layouts (medium 5.9)
- [CVE-2026-48950](https://insights.sbomify.com/CVE-2026-48950/): Joomla! Core - [20260704] - XSS in com_templates (medium 5.9)
- [CVE-2026-4895](https://insights.sbomify.com/CVE-2026-4895/): Greenshift <= 12.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via disablelazy Attribute (medium 6.4)
- [CVE-2026-48949](https://insights.sbomify.com/CVE-2026-48949/): Joomla! Core - [20260703] - XSS in MFA method management (medium 5.9)
- [CVE-2026-48948](https://insights.sbomify.com/CVE-2026-48948/): Joomla! Core - [20260702] - Incorrect Access Control in com_contact vcf download (medium 6.4)
- [CVE-2026-48947](https://insights.sbomify.com/CVE-2026-48947/): Joomla! Core - [20260701] - Incorrect Access Control in com_media webservice endpoints (medium 6.4)
- [CVE-2026-48946](https://insights.sbomify.com/CVE-2026-48946/): Joomla Extension - getk2.org - Privileged RCE vulnerability in K2 extension for Joomla < 2.26 (medium 6.3)
- [CVE-2026-48945](https://insights.sbomify.com/CVE-2026-48945/): Joomla Extension - getk2.org - Privileged RCE vulnerability in K2 extension for Joomla < 2.26 (medium 5.3)
- [CVE-2026-48944](https://insights.sbomify.com/CVE-2026-48944/): Joomla Extension - getk2.org - Exposure of sensitive files via attachment copy in K2 extension for Joomla < 2.26 (medium 6.5)
- [CVE-2026-48943](https://insights.sbomify.com/CVE-2026-48943/): Joomla Extension - getk2.org - Authenticated user property mass-assignment in K2 extension for Joomla < 2.26 (medium 6.5)
- [CVE-2026-48942](https://insights.sbomify.com/CVE-2026-48942/): Joomla Extension - getk2.org - Stored-XSS in K2 extension for Joomla < 2.26 (medium 6.1)
- [CVE-2026-48941](https://insights.sbomify.com/CVE-2026-48941/): Joomla Extension - getk2.org - Unauthenticated folder delete in K2 extension for Joomla < 2.26 (medium 6.5)
- [CVE-2026-48940](https://insights.sbomify.com/CVE-2026-48940/): Joomla Extension - getk2.org - Stored-XSS in K2 extension for Joomla < 2.26 (low 3.4)
- [CVE-2026-4894](https://insights.sbomify.com/CVE-2026-4894/): Authentication bypass in multiple products from Frappe Technologies (medium 6.9)
- [CVE-2026-48939](https://insights.sbomify.com/CVE-2026-48939/): iCagenda Unrestricted Upload of File with Dangerous Type (critical 10.0, exploited in the wild)
- [CVE-2026-48937](https://insights.sbomify.com/CVE-2026-48937/): Denial of service in node (medium 5.3)
- [CVE-2026-48936](https://insights.sbomify.com/CVE-2026-48936/): Security feature bypass in node (low 3.3)
- [CVE-2026-48935](https://insights.sbomify.com/CVE-2026-48935/): Security feature bypass in node (low 3.3)
- [CVE-2026-48934](https://insights.sbomify.com/CVE-2026-48934/): Security feature bypass in node (medium 4.3)
- [CVE-2026-48933](https://insights.sbomify.com/CVE-2026-48933/): Denial of service in node (high 7.5)
- [CVE-2026-48932](https://insights.sbomify.com/CVE-2026-48932/): Other in node (low 3.7)
- [CVE-2026-48931](https://insights.sbomify.com/CVE-2026-48931/): Race condition in node (low 3.7)
- [CVE-2026-48930](https://insights.sbomify.com/CVE-2026-48930/): Security feature bypass in node (medium 5.6)
- [CVE-2026-4893](https://insights.sbomify.com/CVE-2026-4893/): CVE-2026-4893 (medium 5.3)
- [CVE-2026-48929](https://insights.sbomify.com/CVE-2026-48929/): Missing authorization in Rocket.Chat (high 7.5)
- [CVE-2026-48928](https://insights.sbomify.com/CVE-2026-48928/): Security feature bypass in node (medium 4.2)
- [CVE-2026-48927](https://insights.sbomify.com/CVE-2026-48927/): Jenkins buildgraph-view Plugin does not escape the build URL (medium 5.5)
- [CVE-2026-48926](https://insights.sbomify.com/CVE-2026-48926/): Jenkins Job Import Plugin does not perform a permission check in an HTTP endpoint (medium 4.3)
- [CVE-2026-48925](https://insights.sbomify.com/CVE-2026-48925/): Jenkins GitHub Integration Plugin has a cross-site request forgery (CSRF) vulnerability (medium 4.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/588/