# Vulnerabilities published in 2026


- [CVE-2026-42426](https://insights.sbomify.com/CVE-2026-42426/): OpenClaw < 2026.4.8 - Improper Authorization in node.pair.approve via operator.write Scope (high 8.7)
- [CVE-2026-42425](https://insights.sbomify.com/CVE-2026-42425/): OpenKM 6.3.12 Unrestricted SQL Execution via DatabaseQuery (high 8.6)
- [CVE-2026-42424](https://insights.sbomify.com/CVE-2026-42424/): OpenClaw < 2026.4.8 - Local File Exfiltration via Shared Reply MEDIA Paths (medium 5.9)
- [CVE-2026-42423](https://insights.sbomify.com/CVE-2026-42423/): OpenClaw < 2026.4.8 - strictInlineEval Approval Boundary Bypass via Approval-Timeout Fallback (high 7.7)
- [CVE-2026-42422](https://insights.sbomify.com/CVE-2026-42422/): OpenClaw < 2026.4.8 - Role Bypass in device.token.rotate Function (high 7.7)
- [CVE-2026-42421](https://insights.sbomify.com/CVE-2026-42421/): OpenClaw < 2026.4.8 - WebSocket Session Persistence via Shared Gateway Token Rotation (low 2.3)
- [CVE-2026-42420](https://insights.sbomify.com/CVE-2026-42420/): OpenClaw < 2026.4.8 - Improper Base64 Decoding Size Validation (medium 5.3)
- [CVE-2026-4242](https://insights.sbomify.com/CVE-2026-4242/): BabyChakra Pregnancy & Parenting App app.babychakra.babychakra Configuration.java credentials storage (low 2.0)
- [CVE-2026-42419](https://insights.sbomify.com/CVE-2026-42419/): WordPress Swish Migrate and Backup plugin <= 1.4.0 - Sensitive Data Exposure vulnerability (medium 5.9)
- [CVE-2026-42418](https://insights.sbomify.com/CVE-2026-42418/): WordPress Social Rocket plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-42417](https://insights.sbomify.com/CVE-2026-42417/): WordPress ARMember Premium plugin <= 7.8 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-42416](https://insights.sbomify.com/CVE-2026-42416/): WordPress UDesign Core plugin <= 4.15.0 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-42415](https://insights.sbomify.com/CVE-2026-42415/): WordPress Porto Theme - Functionality plugin <= 3.9.3 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-42414](https://insights.sbomify.com/CVE-2026-42414/): WordPress ListingPro plugin <= 2.9.12 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-42413](https://insights.sbomify.com/CVE-2026-42413/): WordPress Snapshotify – All-in-One Backup & Restore & Migrate plugin <= 1.3.2 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2026-42412](https://insights.sbomify.com/CVE-2026-42412/): WordPress WP User Frontend plugin <= 4.3.1 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-42411](https://insights.sbomify.com/CVE-2026-42411/): WordPress CloudSecure WP Security plugin <= 1.4.7 - Broken Authentication vulnerability (high 8.1)
- [CVE-2026-42410](https://insights.sbomify.com/CVE-2026-42410/): WordPress TheGem theme Elements (for Elementor) plugin < 5.12.1.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-4241](https://insights.sbomify.com/CVE-2026-4241/): itsourcecode College Management System time-table.php sql injection (medium 5.3)
- [CVE-2026-42409](https://insights.sbomify.com/CVE-2026-42409/): BIG-IP HTTP/2 vulnerability (high 8.7)
- [CVE-2026-42408](https://insights.sbomify.com/CVE-2026-42408/): BIG-IP DNS tmsh vulnerability (medium 6.7)
- [CVE-2026-42406](https://insights.sbomify.com/CVE-2026-42406/): BIG-IP and BIG-IQ privilege escalation vulnerability (high 8.5)
- [CVE-2026-42404](https://insights.sbomify.com/CVE-2026-42404/): Apache Neethi: Unrestricted HTTP Redirect Following in Policy References (medium 6.5)
- [CVE-2026-42403](https://insights.sbomify.com/CVE-2026-42403/): Apache Neethi: Circular Policy Reference Infinite Loop (high 7.5)
- [CVE-2026-42402](https://insights.sbomify.com/CVE-2026-42402/): Apache Neethi: Policy Normalization Unbounded Resource Allocation DoS (high 7.5)
- [CVE-2026-42401](https://insights.sbomify.com/CVE-2026-42401/): Improper Neutralization of Input During Web Page Generation in Kibana Leading to Stored HTML Injection (medium 4.1)
- [CVE-2026-42400](https://insights.sbomify.com/CVE-2026-42400/): Uncontrolled Resource Consumption in Kibana Leading to Denial of Service (medium 6.5)
- [CVE-2026-4240](https://insights.sbomify.com/CVE-2026-4240/): Open5GS CCA smf_s6b_sta_cb denial of service (medium 6.9)
- [CVE-2026-42399](https://insights.sbomify.com/CVE-2026-42399/): Uncontrolled Resource Consumption in Kibana Leading to Denial of Service (medium 6.5)
- [CVE-2026-42398](https://insights.sbomify.com/CVE-2026-42398/): Server-Side Request Forgery (SSRF) in Kibana Leading to Unauthorized Network Access (high 7.7)
- [CVE-2026-42397](https://insights.sbomify.com/CVE-2026-42397/): Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service (medium 6.5)
- [CVE-2026-42396](https://insights.sbomify.com/CVE-2026-42396/): Insufficient Validation of Member Zone Data May Cause Catalog Zone Transfer to Fail (medium 4.9)
- [CVE-2026-42395](https://insights.sbomify.com/CVE-2026-42395/): Denial of service in OX Dovecot CE (medium 4.3)
- [CVE-2026-42393](https://insights.sbomify.com/CVE-2026-42393/): Information disclosure in OX Dovecot CE (low 3.1)
- [CVE-2026-42392](https://insights.sbomify.com/CVE-2026-42392/): Information disclosure in OX Dovecot CE (medium 4.3)
- [CVE-2026-42391](https://insights.sbomify.com/CVE-2026-42391/): Denial of service in OX Dovecot CE (high 7.5)
- [CVE-2026-42390](https://insights.sbomify.com/CVE-2026-42390/): ZONEMD validation can be bypassed (medium 5.3)
- [CVE-2026-4239](https://insights.sbomify.com/CVE-2026-4239/): Lagom WHMCS Template Datatables prototype pollution (medium 5.1)
- [CVE-2026-42389](https://insights.sbomify.com/CVE-2026-42389/): Reject more queries with invalid header values (medium 5.3)
- [CVE-2026-42388](https://insights.sbomify.com/CVE-2026-42388/): Missing input validation for catalog zones (medium 5.9)
- [CVE-2026-42387](https://insights.sbomify.com/CVE-2026-42387/): Insufficient input validation in ZoneToCache (medium 5.9)
- [CVE-2026-42386](https://insights.sbomify.com/CVE-2026-42386/): WordPress Order Delivery Date for WooCommerce plugin <= 4.5.1 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-42385](https://insights.sbomify.com/CVE-2026-42385/): WordPress Profile Builder Pro plugin <= 3.15.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-42384](https://insights.sbomify.com/CVE-2026-42384/): WordPress Simply Schedule Appointments plugin < 1.6.11.2 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2026-42383](https://insights.sbomify.com/CVE-2026-42383/): WordPress YITH WooCommerce Product Add-Ons plugin <= 4.29.0 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-42382](https://insights.sbomify.com/CVE-2026-42382/): WordPress Audrey theme <= 1.5 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-42381](https://insights.sbomify.com/CVE-2026-42381/): WordPress Funnel Builder by FunnelKit plugin <= 3.15.0.1 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-42380](https://insights.sbomify.com/CVE-2026-42380/): WordPress AI Lab theme < 5.4.2 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-4238](https://insights.sbomify.com/CVE-2026-4238/): itsourcecode College Management System courses.php sql injection (medium 5.1)
- [CVE-2026-42379](https://insights.sbomify.com/CVE-2026-42379/): WordPress Templately plugin <= 3.6.1 - Sensitive Data Exposure vulnerability (high 7.7)
- [CVE-2026-42378](https://insights.sbomify.com/CVE-2026-42378/): WordPress WP Full Stripe Free plugin <= 8.4.1 - Broken Authentication vulnerability (medium 6.5)
- [CVE-2026-42377](https://insights.sbomify.com/CVE-2026-42377/): WordPress SureForms Pro plugin <= 2.8.0 - Broken Access Control vulnerability (high 7.3)
- [CVE-2026-42376](https://insights.sbomify.com/CVE-2026-42376/): D-Link DIR-456U A1 Hardcoded Telnet Backdoor Credentials (critical 9.8)
- [CVE-2026-42375](https://insights.sbomify.com/CVE-2026-42375/): D-Link DIR-600L A1 Hardcoded Telnet Backdoor Credentials (critical 9.8)
- [CVE-2026-42374](https://insights.sbomify.com/CVE-2026-42374/): D-Link DIR-600L B1 Hardcoded Telnet Backdoor Credentials (critical 9.8)
- [CVE-2026-42373](https://insights.sbomify.com/CVE-2026-42373/): D-Link DIR-605L B2 Hardcoded Telnet Backdoor Credentials (critical 9.8)
- [CVE-2026-42372](https://insights.sbomify.com/CVE-2026-42372/): D-Link DIR-605L A1 Hardcoded Telnet Backdoor Credentials (high 8.8)
- [CVE-2026-42371](https://insights.sbomify.com/CVE-2026-42371/): Integer overflow in uriparser (medium 5.1)
- [CVE-2026-42370](https://insights.sbomify.com/CVE-2026-42370/): GeoVision GV-VMS V20 WebCam Server Login stack overflow vulnerability (critical 9.0)
- [CVE-2026-4237](https://insights.sbomify.com/CVE-2026-4237/): itsourcecode Free Hotel Reservation System index.php sql injection (medium 6.9)
- [CVE-2026-42369](https://insights.sbomify.com/CVE-2026-42369/): GeoVision GV-VMS V20 WebCam Server stack overflow vulnerability (critical 10.0)
- [CVE-2026-42368](https://insights.sbomify.com/CVE-2026-42368/): GeoVision LPC2011/LPC2211 Web Interface privilege escalation vulnerability (critical 9.9)
- [CVE-2026-42367](https://insights.sbomify.com/CVE-2026-42367/): Information disclosure in GV-LPC2011/LPC2211 (medium 6.5)
- [CVE-2026-42366](https://insights.sbomify.com/CVE-2026-42366/): GeoVision LPC2011/LPC2211 Web Interface / ssi.cgi reflected cross-site scripting (XSS) vulnerabilities (high 7.4)
- [CVE-2026-42365](https://insights.sbomify.com/CVE-2026-42365/): GeoVision LPC2011/LPC2211 Web Interface guessable session cookie vulnerability (high 8.6)
- [CVE-2026-42364](https://insights.sbomify.com/CVE-2026-42364/): GeoVision LPC2011/LPC2211 Web Interface / DdnsSetting.cgi OS command injection vulnerability (critical 9.9)
- [CVE-2026-42363](https://insights.sbomify.com/CVE-2026-42363/): GeoVision GV-IP Device Utility Device Authentication insufficient encryption vulnerability (critical 9.3)
- [CVE-2026-42360](https://insights.sbomify.com/CVE-2026-42360/): Apache Airflow: Rendered template truncation bypasses nested sensitive-key masking (medium 6.5)
- [CVE-2026-4236](https://insights.sbomify.com/CVE-2026-4236/): itsourcecode Online Enrollment System index.php sql injection (medium 6.9)
- [CVE-2026-42359](https://insights.sbomify.com/CVE-2026-42359/): Apache Airflow: Authenticated RCE via XCom PATCH endpoint — XComUpdateBody missing FORBIDDEN_XCOM_KEYS validator (high 8.8)
- [CVE-2026-42358](https://insights.sbomify.com/CVE-2026-42358/): Apache Airflow: Variable masker depth-limit bypass returns cleartext nested secrets (medium 6.5)
- [CVE-2026-42357](https://insights.sbomify.com/CVE-2026-42357/): Apache DolphinScheduler: Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access. (medium 6.5)
- [CVE-2026-42356](https://insights.sbomify.com/CVE-2026-42356/): Apache HTTP Server: limited RCE for some internal redirects to non-CGI files in CGI directories (low 3.7)
- [CVE-2026-42355](https://insights.sbomify.com/CVE-2026-42355/): NanaZip: Uncontrolled recursion in NanaZip Electron ASAR parser causes stack exhaustion (low 3.3)
- [CVE-2026-42354](https://insights.sbomify.com/CVE-2026-42354/): Sentry: Improper authentication on SAML SSO process allows user identity linking (critical 9.1)
- [CVE-2026-42353](https://insights.sbomify.com/CVE-2026-42353/): Path traversal / SSRF in i18next-http-middleware via user-controlled language and namespace parameters (high 8.2)
- [CVE-2026-42352](https://insights.sbomify.com/CVE-2026-42352/): pygeoapi 0.23.x: Unauthenticated SSRF via OGC API - Processes Subscriber (high 8.6)
- [CVE-2026-42351](https://insights.sbomify.com/CVE-2026-42351/): pygeoapi: Path Traversal in STAC FileSystemProvider (high 7.5)
- [CVE-2026-42350](https://insights.sbomify.com/CVE-2026-42350/): Kargo: Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter (medium 5.1)
- [CVE-2026-4235](https://insights.sbomify.com/CVE-2026-4235/): itsourcecode Online Enrollment System login.php sql injection (medium 6.9)
- [CVE-2026-42349](https://insights.sbomify.com/CVE-2026-42349/): Clerk: Authorization bypass when combining organization, billing, or reverification checks (high 7.6)
- [CVE-2026-42348](https://insights.sbomify.com/CVE-2026-42348/): OpAMP client reads unbounded HTTP response bodies (medium 5.9)
- [CVE-2026-42346](https://insights.sbomify.com/CVE-2026-42346/): Postiz: TOCTOU DNS rebinding bypasses all SSRF URL validation paths (medium 6.5)
- [CVE-2026-42345](https://insights.sbomify.com/CVE-2026-42345/): Server-side request forgery in FastGPT (high 7.7)
- [CVE-2026-42344](https://insights.sbomify.com/CVE-2026-42344/): FastGPT: DNS rebinding TOCTOU bypass in isInternalAddress allows SSRF on all protected endpoints (medium 6.3)
- [CVE-2026-42343](https://insights.sbomify.com/CVE-2026-42343/): FastGPT: Uncontrolled Resource Consumption leading to Sandbox Exhaustion (medium 6.3)
- [CVE-2026-42342](https://insights.sbomify.com/CVE-2026-42342/): React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint (high 7.5)
- [CVE-2026-42341](https://insights.sbomify.com/CVE-2026-42341/): FOSSBilling has an unauthenticated payment bypass via IPN callback forgery (critical 9.2)
- [CVE-2026-4234](https://insights.sbomify.com/CVE-2026-4234/): SSCMS DDL SitesAddController.Submit.cs sql injection (medium 5.3)
- [CVE-2026-42339](https://insights.sbomify.com/CVE-2026-42339/): New API: SSRF Filter Bypass via 0.0.0.0 (high 7.1)
- [CVE-2026-42338](https://insights.sbomify.com/CVE-2026-42338/): ip-address: XSS in Address6 HTML-emitting methods (medium 5.3)
- [CVE-2026-42337](https://insights.sbomify.com/CVE-2026-42337/): MaxKB: Broken Access Control in MaxKB OSS URL Fetch API (medium 5.3)
- [CVE-2026-42336](https://insights.sbomify.com/CVE-2026-42336/): MaxKB: SSRF Bypass via DNS Rebinding in MaxKB OSS URL Fetch (medium 5.1)
- [CVE-2026-42335](https://insights.sbomify.com/CVE-2026-42335/): MaxKB: SSRF Bypass in MaxKB OSS URL Fetch due to URL Parsing Discrepancy (medium 6.3)
- [CVE-2026-42334](https://insights.sbomify.com/CVE-2026-42334/): Mongoose: Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection (high 7.5)
- [CVE-2026-42333](https://insights.sbomify.com/CVE-2026-42333/): quarkus-openapi-generator has overly broad path-parameter matching that sends authentication headers to unintended operations (medium 6.3)
- [CVE-2026-42331](https://insights.sbomify.com/CVE-2026-42331/): FOSSBilling missing authorization in guest Invoice API endpoints (high 7.7)
- [CVE-2026-4233](https://insights.sbomify.com/CVE-2026-4233/): ThingsGateway download path traversal (medium 5.3)
- [CVE-2026-42329](https://insights.sbomify.com/CVE-2026-42329/): Iris has an Open Redirect issue (medium 4.7)
- [CVE-2026-42328](https://insights.sbomify.com/CVE-2026-42328/): go-ipld-prime: DAG-CBOR and DAG-JSON decoders unbounded recursion depth (medium 6.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/651/