# Vulnerabilities published in 2026


- [CVE-2026-42810](https://insights.sbomify.com/CVE-2026-42810/): Apache Polaris: could broaden vended S3 credentials through wildcard-bearing namespace or table names (critical 9.4)
- [CVE-2026-4281](https://insights.sbomify.com/CVE-2026-4281/): Missing authorization in FormLift for Infusionsoft Web Forms (medium 5.3)
- [CVE-2026-42809](https://insights.sbomify.com/CVE-2026-42809/): Apache Polaris: staged table creation could vend storage credentials for unvalidated locations (critical 9.4)
- [CVE-2026-42808](https://insights.sbomify.com/CVE-2026-42808/): Memory corruption in COINES SDK (medium 6.8)
- [CVE-2026-42807](https://insights.sbomify.com/CVE-2026-42807/): Memory corruption in COINES SDK (high 8.0)
- [CVE-2026-42806](https://insights.sbomify.com/CVE-2026-42806/): Memory corruption in BME690 SensorAPI (C) (medium 4.3)
- [CVE-2026-42805](https://insights.sbomify.com/CVE-2026-42805/): Memory corruption in BHI385 SensorAPI (C Library) (high 8.4)
- [CVE-2026-42804](https://insights.sbomify.com/CVE-2026-42804/): Memory corruption in BHI360 SensorAPI (C-Library) (high 7.6)
- [CVE-2026-42801](https://insights.sbomify.com/CVE-2026-42801/): Deference after null check in as_rrc (high 7.4)
- [CVE-2026-42800](https://insights.sbomify.com/CVE-2026-42800/): Deference after null check in ims_client sip (high 7.4)
- [CVE-2026-4280](https://insights.sbomify.com/CVE-2026-4280/): Breaking News WP <= 1.3 - Missing Authorization to Authenticated (Subscriber+) Local File Inclusion/Read (medium 6.5)
- [CVE-2026-42799](https://insights.sbomify.com/CVE-2026-42799/): Out-of-bounds read in ulp (high 7.4)
- [CVE-2026-42798](https://insights.sbomify.com/CVE-2026-42798/): Integer overflow in little cms color engine (medium 4.0)
- [CVE-2026-42797](https://insights.sbomify.com/CVE-2026-42797/): Apache Syncope: JexlContextBuilder Information Disclosure (medium 4.9)
- [CVE-2026-42796](https://insights.sbomify.com/CVE-2026-42796/): Arelle < 2.39.10 Unauthenticated RCE via /rest/configure (critical 9.2)
- [CVE-2026-42795](https://insights.sbomify.com/CVE-2026-42795/): Symlink Following in Hex Package Export Allows Embedding Files Outside Project Root (medium 5.1)
- [CVE-2026-42794](https://insights.sbomify.com/CVE-2026-42794/): Reflected XSS via backslash bypass in GraphiQL js_escape in absinthe_plug (low 2.3)
- [CVE-2026-42793](https://insights.sbomify.com/CVE-2026-42793/): Atom table exhaustion via attacker-controlled GraphQL SDL names in absinthe (high 8.2)
- [CVE-2026-42792](https://insights.sbomify.com/CVE-2026-42792/): epmd permanent DoS via EMFILE on accept(2) in erts (medium 6.3)
- [CVE-2026-42791](https://insights.sbomify.com/CVE-2026-42791/): OCSP responder certificate validity period not checked in public_key (medium 6.3)
- [CVE-2026-42790](https://insights.sbomify.com/CVE-2026-42790/): nameConstraints DNS bypass via subject CommonName fallback in public_key hostname verification (high 7.6)
- [CVE-2026-4279](https://insights.sbomify.com/CVE-2026-4279/): Cross-site scripting in Bread & Butter: AI-Powered Lead Intelligence (medium 6.4)
- [CVE-2026-42789](https://insights.sbomify.com/CVE-2026-42789/): Non-CA certificate accepted as intermediate issuer in public_key path validation (high 7.0)
- [CVE-2026-42788](https://insights.sbomify.com/CVE-2026-42788/): HTTP/2 frame size limit checked after body is buffered in bandit (medium 6.9)
- [CVE-2026-42786](https://insights.sbomify.com/CVE-2026-42786/): WebSocket fragmented message reassembly unbounded in bandit (high 8.7)
- [CVE-2026-42785](https://insights.sbomify.com/CVE-2026-42785/): OpenKM 6.3.12 Remote Code Execution via Administrative Scripting (high 8.6)
- [CVE-2026-42784](https://insights.sbomify.com/CVE-2026-42784/): Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion (high 7.4)
- [CVE-2026-42782](https://insights.sbomify.com/CVE-2026-42782/): Apache Syncope: Post-auth RCE via Groovy static (high 7.2)
- [CVE-2026-42781](https://insights.sbomify.com/CVE-2026-42781/): BIG-IP FastL4 virtual server vulnerability (high 7.1)
- [CVE-2026-42780](https://insights.sbomify.com/CVE-2026-42780/): BIG-IP SSL Orchestrator vulnerability (medium 6.9)
- [CVE-2026-4278](https://insights.sbomify.com/CVE-2026-4278/): Cross-site scripting in Simple Download Counter (medium 6.4)
- [CVE-2026-42779](https://insights.sbomify.com/CVE-2026-42779/): Apache MINA vulnerable to Deserialization of Untrusted Data (CVE-2026-41635 Incomplete Fix) (critical 9.8)
- [CVE-2026-42778](https://insights.sbomify.com/CVE-2026-42778/): Apache MINA: CWE-502 Deserialization of Untrusted Data (take 2) (critical 9.8)
- [CVE-2026-42777](https://insights.sbomify.com/CVE-2026-42777/): WordPress Aalto theme <= 1.8 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-42776](https://insights.sbomify.com/CVE-2026-42776/): WordPress Sunshine Photo Cart plugin <= 3.6.7 - Broken Access Control vulnerability (medium 6.3)
- [CVE-2026-42775](https://insights.sbomify.com/CVE-2026-42775/): WordPress AutomatorWP plugin <= 5.7.2 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-42774](https://insights.sbomify.com/CVE-2026-42774/): WordPress JetEngine plugin <= 3.8.8.1 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-42773](https://insights.sbomify.com/CVE-2026-42773/): WordPress eMagicOne Store Manager plugin <= 1.3.2 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-42772](https://insights.sbomify.com/CVE-2026-42772/): Potential CPU DoS via O(n^2) Fragment Reassembly in QUIC (medium 5.3)
- [CVE-2026-42771](https://insights.sbomify.com/CVE-2026-42771/): Possible Out of Bounds Read in X509_VERIFY_PARAM_set1_email() (medium 6.2)
- [CVE-2026-42770](https://insights.sbomify.com/CVE-2026-42770/): FFC-DH Peer Validation Uses Attacker-Supplied q (low 3.7)
- [CVE-2026-4277](https://insights.sbomify.com/CVE-2026-4277/): Privilege abuse in GenericInlineModelAdmin (critical 9.8)
- [CVE-2026-42769](https://insights.sbomify.com/CVE-2026-42769/): Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (medium 5.3)
- [CVE-2026-42768](https://insights.sbomify.com/CVE-2026-42768/): Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (low 3.7)
- [CVE-2026-42767](https://insights.sbomify.com/CVE-2026-42767/): NULL Pointer Dereference in CRMF EncryptedValue Decryption (medium 5.9)
- [CVE-2026-42766](https://insights.sbomify.com/CVE-2026-42766/): Possible NULL Dereference in Password-Based CMS Decryption (medium 5.9)
- [CVE-2026-42765](https://insights.sbomify.com/CVE-2026-42765/): NULL Dereference in Certificate Verification with OCSP Checking (high 7.5)
- [CVE-2026-42764](https://insights.sbomify.com/CVE-2026-42764/): NULL Pointer Dereference in QUIC Server Initial Packet Handling (high 7.5)
- [CVE-2026-42763](https://insights.sbomify.com/CVE-2026-42763/): WordPress SePay Gateway plugin <= 1.1.20 - Sensitive Data Exposure vulnerability (medium 6.5)
- [CVE-2026-42762](https://insights.sbomify.com/CVE-2026-42762/): WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.9 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-42761](https://insights.sbomify.com/CVE-2026-42761/): WordPress Active Products Tables for WooCommerce plugin <= 1.0.9 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-42760](https://insights.sbomify.com/CVE-2026-42760/): WordPress Backup and Staging by WP Time Capsule plugin <= 1.22.25 - Broken Authentication vulnerability (high 7.5)
- [CVE-2026-4276](https://insights.sbomify.com/CVE-2026-4276/): LibreChat RAG API, version 0.7.0, contains a log-injection vulnerability that allows attackers to forge log entries. (high 7.5)
- [CVE-2026-42759](https://insights.sbomify.com/CVE-2026-42759/): WordPress Affiliate Super Assistent plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-42758](https://insights.sbomify.com/CVE-2026-42758/): WordPress WebinarIgnition plugin < 4.08.253 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2026-42757](https://insights.sbomify.com/CVE-2026-42757/): WordPress WebinarIgnition plugin < 4.08.253 - Arbitrary File Deletion vulnerability (critical 9.9)
- [CVE-2026-42756](https://insights.sbomify.com/CVE-2026-42756/): Path traversal in QuickWebP &#8211; Compress / Optimize Images &amp; Convert WebP | SEO Friendly (critical 9.9)
- [CVE-2026-42755](https://insights.sbomify.com/CVE-2026-42755/): WordPress TableOn plugin <= 1.0.5.1 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-42754](https://insights.sbomify.com/CVE-2026-42754/): WordPress Favicon plugin <= 1.3.46 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-42753](https://insights.sbomify.com/CVE-2026-42753/): WordPress WCFM Membership plugin <= 2.11.10 - Broken Access Control vulnerability (high 7.3)
- [CVE-2026-42752](https://insights.sbomify.com/CVE-2026-42752/): WordPress Stripe Payments plugin <= 2.0.98 - Bypass Vulnerability vulnerability (medium 6.5)
- [CVE-2026-42751](https://insights.sbomify.com/CVE-2026-42751/): WordPress Booking Manager plugin <= 2.1.18 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-42750](https://insights.sbomify.com/CVE-2026-42750/): WordPress WPComplete plugin <= 2.9.5.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-4275](https://insights.sbomify.com/CVE-2026-4275/): Cross-site request forgery in Divi Torque Lite – Divi Modules for the Divi Builder & Theme (high 8.8)
- [CVE-2026-42749](https://insights.sbomify.com/CVE-2026-42749/): WordPress Disable Comments for Any Post Types (Remove comments) plugin <= 1.3.0 - Broken Authentication vulnerability (high 7.1)
- [CVE-2026-42748](https://insights.sbomify.com/CVE-2026-42748/): WordPress WPify Woo Czech plugin <= 5.4.1 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2026-42747](https://insights.sbomify.com/CVE-2026-42747/): WordPress Easy Form Builder plugin <= 4.0.6 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-42746](https://insights.sbomify.com/CVE-2026-42746/): WordPress Smart Online Order for Clover plugin <= 1.6.0 - Sensitive Data Exposure vulnerability (high 7.3)
- [CVE-2026-42745](https://insights.sbomify.com/CVE-2026-42745/): WordPress Smart Online Order for Clover plugin <= 1.6.0 - Broken Authentication vulnerability (high 7.3)
- [CVE-2026-42744](https://insights.sbomify.com/CVE-2026-42744/): WordPress Ads by WPQuads plugin <= 3.0.2 - Bypass Vulnerability vulnerability (medium 6.5)
- [CVE-2026-42743](https://insights.sbomify.com/CVE-2026-42743/): WordPress Masteriyo - LMS plugin <= 2.1.8 - Broken Authentication vulnerability (medium 6.5)
- [CVE-2026-42742](https://insights.sbomify.com/CVE-2026-42742/): WordPress Views for WPForms plugin <= 3.4.6 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-42741](https://insights.sbomify.com/CVE-2026-42741/): SQL injection in Ninja Forms Views &#8211; Display &amp; Edit Ninja Forms Submissions on your site frontend (high 8.5)
- [CVE-2026-42740](https://insights.sbomify.com/CVE-2026-42740/): WordPress Tainacan plugin <= 1.0.3 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-4274](https://insights.sbomify.com/CVE-2026-4274/): Insufficient authorization in shared channel membership sync grants team-level access instead of channel-level access (medium 5.4)
- [CVE-2026-42739](https://insights.sbomify.com/CVE-2026-42739/): WordPress Advanced IP Blocker plugin <= 8.10.7 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-42738](https://insights.sbomify.com/CVE-2026-42738/): WordPress Smart Online Order for Clover plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-42737](https://insights.sbomify.com/CVE-2026-42737/): WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.9 - Arbitrary File Deletion vulnerability (high 8.6)
- [CVE-2026-42736](https://insights.sbomify.com/CVE-2026-42736/): WordPress BP Better Messages plugin <= 2.14.16 - Insecure Direct Object References (IDOR) vulnerability (high 7.5)
- [CVE-2026-42735](https://insights.sbomify.com/CVE-2026-42735/): WordPress KiviCare plugin <= 4.3.0 - Broken Authentication vulnerability (high 8.2)
- [CVE-2026-42734](https://insights.sbomify.com/CVE-2026-42734/): WordPress Geo Mashup plugin <= 1.13.19 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-42733](https://insights.sbomify.com/CVE-2026-42733/): WordPress WPCS plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-42732](https://insights.sbomify.com/CVE-2026-42732/): WordPress Ads by WPQuads plugin <= 3.0.2 - Broken Authentication vulnerability (medium 6.5)
- [CVE-2026-42731](https://insights.sbomify.com/CVE-2026-42731/): WordPress miniorange otp verification plugin <= 5.4.9 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2026-42730](https://insights.sbomify.com/CVE-2026-42730/): WordPress MasterStudy LMS plugin <= 3.7.29 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-4273](https://insights.sbomify.com/CVE-2026-4273/): Insufficient token rotation validation in remote cluster invite confirmation (low 3.7)
- [CVE-2026-42729](https://insights.sbomify.com/CVE-2026-42729/): WordPress PropertyHive plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-42728](https://insights.sbomify.com/CVE-2026-42728/): WordPress HT Contact Form 7 plugin <= 2.8.2 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-42727](https://insights.sbomify.com/CVE-2026-42727/): WordPress Active Products Tables for WooCommerce plugin <= 1.0.8 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-42726](https://insights.sbomify.com/CVE-2026-42726/): WordPress AWP Classifieds plugin <= 4.4.5 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-42725](https://insights.sbomify.com/CVE-2026-42725/): Missing authorization in Checkout Files Upload for WooCommerce (medium 6.5)
- [CVE-2026-42724](https://insights.sbomify.com/CVE-2026-42724/): WordPress CleanSkin theme <= 1.5.0 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-42723](https://insights.sbomify.com/CVE-2026-42723/): WordPress CleanSkin theme <= 1.5.0 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-42722](https://insights.sbomify.com/CVE-2026-42722/): WordPress Frontend Admin by DynamiApps plugin <= 3.29.13 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-42721](https://insights.sbomify.com/CVE-2026-42721/): WordPress affiliate-toolkit plugin <= 3.9.1 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-42720](https://insights.sbomify.com/CVE-2026-42720/): WordPress Dynamic User Directory plugin <= 2.4 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-4272](https://insights.sbomify.com/CVE-2026-4272/): CVE-2026-4272 - Bluetooth Remote Execution of System Commands Vulnerability (high 8.1)
- [CVE-2026-42719](https://insights.sbomify.com/CVE-2026-42719/): WordPress Dynamic User Directory plugin <= 2.4 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-42718](https://insights.sbomify.com/CVE-2026-42718/): WordPress Booster for WooCommerce plugin <= 8.4.0 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-42717](https://insights.sbomify.com/CVE-2026-42717/): WordPress Leyka plugin <= 3.32.3 - SQL Injection vulnerability (high 7.6)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/647/