# Vulnerabilities published in 2026


- [CVE-2026-48924](https://insights.sbomify.com/CVE-2026-48924/): Jenkins Bitbucket OAuth Plugin does not restrict the redirect URL after login (medium 4.3)
- [CVE-2026-48923](https://insights.sbomify.com/CVE-2026-48923/): Jenkins AppSpider Plugin does not perform a permission check in a method implementing form validation (medium 4.3)
- [CVE-2026-48922](https://insights.sbomify.com/CVE-2026-48922/): Jenkins Credentials Binding Plugin does not properly sanitize file names for file and zip file credentials (high 7.5)
- [CVE-2026-48921](https://insights.sbomify.com/CVE-2026-48921/): Jenkins Pipeline: Groovy Libraries Plugin does not prohibit symbolic links in shared libraries (high 7.5)
- [CVE-2026-48920](https://insights.sbomify.com/CVE-2026-48920/): Jenkins Email Extension Plugin: Attackers able to control email content may specify `file:` URLs for images to read arbitrary files from Jenkins controller filesystem (high 8.8)
- [CVE-2026-4892](https://insights.sbomify.com/CVE-2026-4892/): CVE-2026-4892 (high 8.4)
- [CVE-2026-48919](https://insights.sbomify.com/CVE-2026-48919/): Jenkins Active Directory Plugin deserializes data from LDAP referrals without validation (medium 6.6)
- [CVE-2026-48918](https://insights.sbomify.com/CVE-2026-48918/): Jenkins Active Directory Plugin follows LDAP referrals by default (medium 6.6)
- [CVE-2026-48917](https://insights.sbomify.com/CVE-2026-48917/): Jenkins LDAP Plugin deserializes data from LDAP referrals without validation (medium 6.6)
- [CVE-2026-48916](https://insights.sbomify.com/CVE-2026-48916/): Jenkins LDAP Plugin follows LDAP referrals (medium 6.6)
- [CVE-2026-48914](https://insights.sbomify.com/CVE-2026-48914/): Qemu-kvm: heap buffer overflow in virtio-blk scsi request handling (medium 6.7)
- [CVE-2026-48913](https://insights.sbomify.com/CVE-2026-48913/): Apache HTTP Server: mod_http2 memory corruption when file handles exhausted (high 7.3)
- [CVE-2026-48912](https://insights.sbomify.com/CVE-2026-48912/): Missing authorization in Apache Answer (medium 6.5)
- [CVE-2026-48911](https://insights.sbomify.com/CVE-2026-48911/): Apache Answer: Unauthenticated OAuth Email-Binding Account Takeover via Existing User Confirmation Flow (high 7.5)
- [CVE-2026-48910](https://insights.sbomify.com/CVE-2026-48910/): Apache JSPWiki: Markdown parser allows XSS injection in Markdown error processing (medium 6.5)
- [CVE-2026-4891](https://insights.sbomify.com/CVE-2026-4891/): CVE-2026-4891 (medium 5.3)
- [CVE-2026-48909](https://insights.sbomify.com/CVE-2026-48909/): Joomla Extension - joomshaper.com - PHP Object injection in SP LMS extension for Joomla < 4.1.4 (critical 9.5)
- [CVE-2026-48908](https://insights.sbomify.com/CVE-2026-48908/): JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type (critical 10.0, exploited in the wild)
- [CVE-2026-48907](https://insights.sbomify.com/CVE-2026-48907/): Widget Factory Joomla Content Editor Improper Access Control (critical 10.0, exploited in the wild)
- [CVE-2026-48906](https://insights.sbomify.com/CVE-2026-48906/): Extension - tassos.gr - Arbitrary File Deletion in Novarain/Tassos Framework < 6.1.0 for Joomla (critical 9.3)
- [CVE-2026-48905](https://insights.sbomify.com/CVE-2026-48905/): Joomla! Framework - [20260520] - Inadequate content filtering within the cleanAttributes filter code. (medium 6.9)
- [CVE-2026-48904](https://insights.sbomify.com/CVE-2026-48904/): Joomla! Core - [20260514] - Privilege escalation through com_users webservice endpoints (high 8.2)
- [CVE-2026-48903](https://insights.sbomify.com/CVE-2026-48903/): Joomla! Framework - [20260519] - Inadequate content filtering within the checkAttribute filter code. (medium 6.9)
- [CVE-2026-48902](https://insights.sbomify.com/CVE-2026-48902/): Joomla! Core - [20260518] - Transport encryption downgrade for password and username reset links (critical 9.8)
- [CVE-2026-48901](https://insights.sbomify.com/CVE-2026-48901/): Joomla! Core - [20260517] - Incorrect Cache Key Construction for InputFilter objects (high 7.5)
- [CVE-2026-48900](https://insights.sbomify.com/CVE-2026-48900/): Joomla! Core - [20260516] - Incorrect Access Control in com_scheduler (medium 6.4)
- [CVE-2026-4890](https://insights.sbomify.com/CVE-2026-4890/): CVE-2026-4890 (high 7.5)
- [CVE-2026-48899](https://insights.sbomify.com/CVE-2026-48899/): Joomla! Core - [20260515] - Incorrect Access Control in sample data plugins (medium 5.3)
- [CVE-2026-48898](https://insights.sbomify.com/CVE-2026-48898/): Joomla! Core - [20260513] - Privilege escalation through com_users batch task (high 8.2)
- [CVE-2026-48897](https://insights.sbomify.com/CVE-2026-48897/): Joomla! Core - [20260512] - MFA Authentication Bypass (high 8.2)
- [CVE-2026-48896](https://insights.sbomify.com/CVE-2026-48896/): Joomla! Core - [20260511] - MFA Authentication Bypass (high 8.2)
- [CVE-2026-48895](https://insights.sbomify.com/CVE-2026-48895/): Apache APISIX: Cas-auth Host header influence on CAS service URL (low 2.1)
- [CVE-2026-48892](https://insights.sbomify.com/CVE-2026-48892/): Apache Airflow: Config API leaks per-key secrets backend kwargs - masker bypass on synthetic options (medium 6.5)
- [CVE-2026-48891](https://insights.sbomify.com/CVE-2026-48891/): Apache Airflow exposes unreadable DAG identifiers in the scheduling dependencies graph (medium 4.3)
- [CVE-2026-4889](https://insights.sbomify.com/CVE-2026-4889/): SQL Injection (SQLi) in eLoanApp Platform by RDL Technologies (high 7.8)
- [CVE-2026-48889](https://insights.sbomify.com/CVE-2026-48889/): WordPress Amelia plugin <= 2.3 - Privilege Escalation vulnerability (high 8.8)
- [CVE-2026-48888](https://insights.sbomify.com/CVE-2026-48888/): WordPress WooCommerce plugin < 11.1.0 - Denial of Service Attack vulnerability (high 7.5)
- [CVE-2026-48887](https://insights.sbomify.com/CVE-2026-48887/): WordPress JS Help Desk plugin <= 3.0.9 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-48886](https://insights.sbomify.com/CVE-2026-48886/): WordPress JS Help Desk plugin <= 3.0.9 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-48885](https://insights.sbomify.com/CVE-2026-48885/): WordPress HollerBox plugin <= 2.3.10.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-48884](https://insights.sbomify.com/CVE-2026-48884/): WordPress WP User Frontend plugin <= 4.3.13 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-48883](https://insights.sbomify.com/CVE-2026-48883/): WordPress WPC Product Bundles for WooCommerce plugin <= 8.5.3 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-48882](https://insights.sbomify.com/CVE-2026-48882/): WordPress WP Time Slots Booking Form plugin <= 1.2.50 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-48881](https://insights.sbomify.com/CVE-2026-48881/): WordPress TrueBooker plugin <= 1.1.9 - Broken Access Control vulnerability (critical 9.1)
- [CVE-2026-48880](https://insights.sbomify.com/CVE-2026-48880/): WordPress WP Job Portal plugin <= 2.5.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-4888](https://insights.sbomify.com/CVE-2026-4888/): Missing authorization in Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder (medium 4.3)
- [CVE-2026-48879](https://insights.sbomify.com/CVE-2026-48879/): WordPress AIWU plugin <= 1.4.17 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2026-48878](https://insights.sbomify.com/CVE-2026-48878/): WordPress Visual Link Preview plugin <= 2.4.1 - Sensitive Data Exposure vulnerability (medium 6.5)
- [CVE-2026-48877](https://insights.sbomify.com/CVE-2026-48877/): WordPress GenerateBlocks plugin <= 2.1.0 - Sensitive Data Exposure vulnerability (medium 6.5)
- [CVE-2026-48876](https://insights.sbomify.com/CVE-2026-48876/): WordPress Stop Spammers plugin <= 2026.3 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-48875](https://insights.sbomify.com/CVE-2026-48875/): WordPress JetSmartFilters plugin <= 3.8.1 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-48874](https://insights.sbomify.com/CVE-2026-48874/): WordPress GamiPress plugin <= 7.8.7 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-48873](https://insights.sbomify.com/CVE-2026-48873/): WordPress Montonio for WooCommerce plugin <= 10.1.2 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-48872](https://insights.sbomify.com/CVE-2026-48872/): WordPress EmbedPress plugin <= 4.5.2 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2026-48871](https://insights.sbomify.com/CVE-2026-48871/): WordPress MW WP Form plugin <= 5.1.3 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-48870](https://insights.sbomify.com/CVE-2026-48870/): WordPress King Addons for Elementor plugin <= 51.1.62 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-4887](https://insights.sbomify.com/CVE-2026-4887/): Gimp: gimp:memory disclosure and denial of service via specially crafted pcx image (medium 6.1)
- [CVE-2026-48869](https://insights.sbomify.com/CVE-2026-48869/): WordPress Enfold theme <= 7.1.4 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-48868](https://insights.sbomify.com/CVE-2026-48868/): WordPress Simple Shopping Cart plugin <= 5.2.9 - Insecure Direct Object References (IDOR) vulnerability (high 7.5)
- [CVE-2026-48867](https://insights.sbomify.com/CVE-2026-48867/): WordPress Quiz And Survey Master plugin <= 11.1.2 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-48866](https://insights.sbomify.com/CVE-2026-48866/): WordPress Gravity Forms plugin <= 2.10.0.1 - Arbitrary File Deletion vulnerability (critical 9.6)
- [CVE-2026-48865](https://insights.sbomify.com/CVE-2026-48865/): WordPress LearnPress plugin <= 4.3.6 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-48864](https://insights.sbomify.com/CVE-2026-48864/): Libsolv: heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data (high 7.8)
- [CVE-2026-48863](https://insights.sbomify.com/CVE-2026-48863/): Libsolv: stack-based buffer overflow in libsolv eddsa pgp signature verification allows denial of service (high 7.5)
- [CVE-2026-48862](https://insights.sbomify.com/CVE-2026-48862/): Unbounded conn.streams growth in Mint HTTP/2 client via unenforced PUSH_PROMISE concurrency (high 8.2)
- [CVE-2026-48861](https://insights.sbomify.com/CVE-2026-48861/): CRLF injection in HTTP/1 request line via unvalidated method in Mint (low 2.1)
- [CVE-2026-48860](https://insights.sbomify.com/CVE-2026-48860/): Distribution-over-TLS LAN allowlist silently bypassed due to sockname/peername confusion in inet_tls_dist (high 7.5)
- [CVE-2026-48859](https://insights.sbomify.com/CVE-2026-48859/): SSH server timing side-channel in ssh_auth:check_password/3 allows unauthenticated username enumeration (medium 6.3)
- [CVE-2026-48858](https://insights.sbomify.com/CVE-2026-48858/): ftp client PASV response IP not validated against control peer, enabling SSRF and FTP bounce attacks (medium 6.3)
- [CVE-2026-48856](https://insights.sbomify.com/CVE-2026-48856/): httpc leaks Authorization header to cross-origin redirect targets (high 7.1)
- [CVE-2026-48855](https://insights.sbomify.com/CVE-2026-48855/): SFTP READLINK Leaks Absolute Backend Filesystem Path When Root Is Configured (low 2.3)
- [CVE-2026-48854](https://insights.sbomify.com/CVE-2026-48854/): Unbounded request body accumulation causes memory exhaustion in elixir-grpc/grpc (high 8.7)
- [CVE-2026-48853](https://insights.sbomify.com/CVE-2026-48853/): Remote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpc (critical 9.2)
- [CVE-2026-48852](https://insights.sbomify.com/CVE-2026-48852/): Denial of service in PuTTY (low 3.7)
- [CVE-2026-48851](https://insights.sbomify.com/CVE-2026-48851/): Security feature bypass in PuTTY (low 3.1)
- [CVE-2026-48850](https://insights.sbomify.com/CVE-2026-48850/): Memory corruption in PuTTY (low 3.7)
- [CVE-2026-4885](https://insights.sbomify.com/CVE-2026-4885/): Piotnet Addons for Elementor Pro <= 7.1.70 - Unauthenticated Arbitrary File Upload via Form File Upload (critical 9.8)
- [CVE-2026-48849](https://insights.sbomify.com/CVE-2026-48849/): Cross-site scripting in Webmail (medium 4.4)
- [CVE-2026-48848](https://insights.sbomify.com/CVE-2026-48848/): Cross-site scripting in Webmail (high 7.2)
- [CVE-2026-48847](https://insights.sbomify.com/CVE-2026-48847/): Auth bypass in Webmail (low 3.7)
- [CVE-2026-48846](https://insights.sbomify.com/CVE-2026-48846/): Security feature bypass in Webmail (medium 6.5)
- [CVE-2026-48845](https://insights.sbomify.com/CVE-2026-48845/): Security feature bypass in Webmail (medium 6.5)
- [CVE-2026-48844](https://insights.sbomify.com/CVE-2026-48844/): Code injection in Webmail (high 7.5)
- [CVE-2026-48843](https://insights.sbomify.com/CVE-2026-48843/): Server-side request forgery in Webmail (high 7.2)
- [CVE-2026-48842](https://insights.sbomify.com/CVE-2026-48842/): SQL injection in Webmail (high 8.1)
- [CVE-2026-48840](https://insights.sbomify.com/CVE-2026-48840/): Information disclosure in Exim (medium 5.3)
- [CVE-2026-48839](https://insights.sbomify.com/CVE-2026-48839/): WordPress WP Statistics plugin <= 14.16.6 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-48838](https://insights.sbomify.com/CVE-2026-48838/): WordPress Post SMTP plugin <= 3.6.2 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-48837](https://insights.sbomify.com/CVE-2026-48837/): WordPress Unlimited Elements For Elementor plugin <= 2.0.8 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-48836](https://insights.sbomify.com/CVE-2026-48836/): WordPress Easy Invoice plugin <= 2.1.19 - Remote Code Execution (RCE) vulnerability (critical 10.0)
- [CVE-2026-48835](https://insights.sbomify.com/CVE-2026-48835/): WordPress Contact Form by WPForms plugin <= 1.10.0.4 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-48834](https://insights.sbomify.com/CVE-2026-48834/): Apache Answer: Denial of service via crafted Accept-Language header parsing (high 7.5)
- [CVE-2026-48832](https://insights.sbomify.com/CVE-2026-48832/): Open redirect in SPIP (low 3.5)
- [CVE-2026-48831](https://insights.sbomify.com/CVE-2026-48831/): Security feature bypass in Wine (high 7.3)
- [CVE-2026-48830](https://insights.sbomify.com/CVE-2026-48830/): Apache bRPC: HTTP builtin request can mark a connection authenticated and bypass auth for later requests (not scored)
- [CVE-2026-4883](https://insights.sbomify.com/CVE-2026-4883/): Piotnet Forms <= 2.1.40 - Unauthenticated Arbitrary File Upload via Form File Upload (critical 9.8)
- [CVE-2026-48829](https://insights.sbomify.com/CVE-2026-48829/): Null dereference in GNU SASL (high 7.5)
- [CVE-2026-48828](https://insights.sbomify.com/CVE-2026-48828/): Apache Airflow: Bulk JSON Variables bypass should_hide_value_for_key - redact() called without the key (medium 6.5)
- [CVE-2026-48827](https://insights.sbomify.com/CVE-2026-48827/): Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git (high 7.1)
- [CVE-2026-48826](https://insights.sbomify.com/CVE-2026-48826/): HomeBox: Cross-Group Inventory Wipe in Homebox via Global Owner Role and X-Tenant Header Switching (high 8.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/589/