# Vulnerabilities published in 2026


- [CVE-2026-40758](https://insights.sbomify.com/CVE-2026-40758/): WordPress Léonie theme <= 1.2.1 - PHP Object Injection vulnerability (high 8.1)
- [CVE-2026-40757](https://insights.sbomify.com/CVE-2026-40757/): WordPress Château theme <= 1.2.1 - PHP Object Injection vulnerability (high 8.1)
- [CVE-2026-40756](https://insights.sbomify.com/CVE-2026-40756/): WordPress Zoya theme <= 1.4 - PHP Object Injection vulnerability (high 8.1)
- [CVE-2026-40755](https://insights.sbomify.com/CVE-2026-40755/): WordPress TechLink theme <= 1.3 - PHP Object Injection vulnerability (high 8.1)
- [CVE-2026-40754](https://insights.sbomify.com/CVE-2026-40754/): WordPress Roisin theme <= 1.4 - PHP Object Injection vulnerability (high 8.1)
- [CVE-2026-40753](https://insights.sbomify.com/CVE-2026-40753/): WordPress EasyMeals theme <= 1.5.1 - PHP Object Injection vulnerability (high 8.1)
- [CVE-2026-40752](https://insights.sbomify.com/CVE-2026-40752/): WordPress Manufaktur Solutions theme <= 1.1.1 - PHP Object Injection vulnerability (high 8.1)
- [CVE-2026-40751](https://insights.sbomify.com/CVE-2026-40751/): WordPress Ashtanga theme <= 1.2 - PHP Object Injection vulnerability (high 8.1)
- [CVE-2026-40750](https://insights.sbomify.com/CVE-2026-40750/): WordPress Kids Online Store theme <= 0.8.9 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2026-4075](https://insights.sbomify.com/CVE-2026-4075/): Cross-site scripting in BWL Advanced FAQ Manager Lite (medium 6.4)
- [CVE-2026-40749](https://insights.sbomify.com/CVE-2026-40749/): WordPress Charity Zone theme <= 1.1.1 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2026-40748](https://insights.sbomify.com/CVE-2026-40748/): WordPress Kids Gift Shop theme <= 0.5.4 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2026-40747](https://insights.sbomify.com/CVE-2026-40747/): WordPress Ecommerce Zone theme <= 0.9.7 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2026-40746](https://insights.sbomify.com/CVE-2026-40746/): WordPress Restaurant Zone theme <= 0.7.8 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2026-40745](https://insights.sbomify.com/CVE-2026-40745/): WordPress Element Pack Elementor Addons plugin <= 8.4.2 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-40744](https://insights.sbomify.com/CVE-2026-40744/): WordPress Beaver Builder plugin <= 2.10.1.2 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-40743](https://insights.sbomify.com/CVE-2026-40743/): WordPress Tutor LMS plugin <= 3.9.7 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-40742](https://insights.sbomify.com/CVE-2026-40742/): WordPress Nelio AB Testing plugin <= 8.2.8 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-40741](https://insights.sbomify.com/CVE-2026-40741/): WordPress Redsys for WooCommerce Light plugin <= 7.0.0 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-40740](https://insights.sbomify.com/CVE-2026-40740/): WordPress Tutor LMS plugin <= 3.9.7 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-4074](https://insights.sbomify.com/CVE-2026-4074/): Quran Live Multilanguage <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-40739](https://insights.sbomify.com/CVE-2026-40739/): WordPress LuxeDrive theme <= 1.4 - PHP Object Injection vulnerability (high 8.1)
- [CVE-2026-40738](https://insights.sbomify.com/CVE-2026-40738/): WordPress Eldon theme <= 1.4.1 - PHP Object Injection vulnerability (high 8.1)
- [CVE-2026-40737](https://insights.sbomify.com/CVE-2026-40737/): WordPress COMPE plugin <= 1.1.4 - Insecure Direct Object References (IDOR) vulnerability (medium 5.3)
- [CVE-2026-40736](https://insights.sbomify.com/CVE-2026-40736/): WordPress Laurits theme <= 1.5.1 - PHP Object Injection vulnerability (high 8.1)
- [CVE-2026-40735](https://insights.sbomify.com/CVE-2026-40735/): WordPress Reina theme <= 2.1 - PHP Object Injection vulnerability (high 8.1)
- [CVE-2026-40734](https://insights.sbomify.com/CVE-2026-40734/): WordPress Categories Images plugin <= 3.3.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-40733](https://insights.sbomify.com/CVE-2026-40733/): WordPress ShiftUp theme <= 1.3 - PHP Object Injection vulnerability (high 8.1)
- [CVE-2026-40732](https://insights.sbomify.com/CVE-2026-40732/): WordPress Notification for Telegram plugin <= 3.5 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-40731](https://insights.sbomify.com/CVE-2026-40731/): WordPress ChapterOne theme <= 1.7 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-40730](https://insights.sbomify.com/CVE-2026-40730/): WordPress ThemeGrill Demo Importer plugin <= 2.0.0.6 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-4073](https://insights.sbomify.com/CVE-2026-4073/): pdfl.io <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'text' Shortcode Attribute (medium 6.4)
- [CVE-2026-40729](https://insights.sbomify.com/CVE-2026-40729/): WordPress 3D viewer – Embed 3D Models plugin <= 1.8.5 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-40728](https://insights.sbomify.com/CVE-2026-40728/): WordPress Magazine Blocks plugin <= 1.8.3 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-40727](https://insights.sbomify.com/CVE-2026-40727/): WordPress Groundhogg plugin <= 4.4 - Arbitrary File Deletion vulnerability (high 7.7)
- [CVE-2026-40726](https://insights.sbomify.com/CVE-2026-40726/): WordPress User Registration Stripe plugin <= 1.3.14 - Broken Access Control vulnerability (high 8.2)
- [CVE-2026-40725](https://insights.sbomify.com/CVE-2026-40725/): WordPress WooCommerce Product Filters plugin < 2.0.6 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-40724](https://insights.sbomify.com/CVE-2026-40724/): WordPress Client Portal (Pro) plugin <= 5.6.2 - Arbitrary File Download vulnerability (medium 6.5)
- [CVE-2026-40723](https://insights.sbomify.com/CVE-2026-40723/): WordPress Bricks Builder theme <= 2.1.4 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-40722](https://insights.sbomify.com/CVE-2026-40722/): WordPress Yoast SEO Premium plugin <= 26.6 - Broken Access Control vulnerability (medium 5.5)
- [CVE-2026-40721](https://insights.sbomify.com/CVE-2026-40721/): WordPress Element Pack Pro plugin <= 9.0.6 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-40720](https://insights.sbomify.com/CVE-2026-40720/): WordPress Royal Elementor Addons Pro plugin < 1.7.1041 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-4072](https://insights.sbomify.com/CVE-2026-4072/): Cross-site scripting in WordPress PayPal Donation (medium 6.4)
- [CVE-2026-40719](https://insights.sbomify.com/CVE-2026-40719/): Denial of service in MaraDNS (high 7.5)
- [CVE-2026-40717](https://insights.sbomify.com/CVE-2026-40717/): Privilege escalation in Monitor driver (medium 6.6)
- [CVE-2026-40715](https://insights.sbomify.com/CVE-2026-40715/): Privilege escalation in ThinOS 10 (high 7.8)
- [CVE-2026-40714](https://insights.sbomify.com/CVE-2026-40714/): Privilege escalation in PowerProtect Data Manager (high 7.2)
- [CVE-2026-40713](https://insights.sbomify.com/CVE-2026-40713/): Missing authorization in ThinOS 10 (medium 6.1)
- [CVE-2026-40712](https://insights.sbomify.com/CVE-2026-40712/): Privilege escalation in PowerProtect Data Manager (critical 9.1)
- [CVE-2026-40711](https://insights.sbomify.com/CVE-2026-40711/): Command injection in Container Storage Modules (high 8.0)
- [CVE-2026-4071](https://insights.sbomify.com/CVE-2026-4071/): BirdSeed <= 2.2.0 - Cross-Site Request Forgery via BirdSeed Token Change (medium 4.3)
- [CVE-2026-40706](https://insights.sbomify.com/CVE-2026-40706/): Memory corruption in NTFS-3G (high 8.4)
- [CVE-2026-40703](https://insights.sbomify.com/CVE-2026-40703/): BIG-IP Configuration utility CSRF vulnerability (medium 5.3)
- [CVE-2026-40702](https://insights.sbomify.com/CVE-2026-40702/): EVoke Systems EVoke CSMS Missing Authentication for Critical Function (critical 9.3)
- [CVE-2026-40701](https://insights.sbomify.com/CVE-2026-40701/): NGINX ngx_http_ssl_module vulnerability (medium 6.3)
- [CVE-2026-4070](https://insights.sbomify.com/CVE-2026-4070/): Alfie <= 1.2.1 - Cross-Site Request Forgery to Feed Deletion via 'delete' Parameter (medium 4.3)
- [CVE-2026-40699](https://insights.sbomify.com/CVE-2026-40699/): BIG-IP Configuration utility vulnerability (high 7.1)
- [CVE-2026-40698](https://insights.sbomify.com/CVE-2026-40698/): iControl REST and TMSH vulnerability (high 8.5)
- [CVE-2026-40691](https://insights.sbomify.com/CVE-2026-40691/): Packet of death for DNSCrypt over TCP (high 7.5)
- [CVE-2026-40690](https://insights.sbomify.com/CVE-2026-40690/): Apache Airflow's asset dependency graph did not restrict nodes by the viewer's DAG read permissions (medium 4.3)
- [CVE-2026-4069](https://insights.sbomify.com/CVE-2026-4069/): Alfie – Feed Plugin <= 1.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'naam' Parameter (medium 6.1)
- [CVE-2026-40688](https://insights.sbomify.com/CVE-2026-40688/): Memory corruption in FortiWeb (medium 6.7)
- [CVE-2026-40687](https://insights.sbomify.com/CVE-2026-40687/): Memory corruption in Exim (medium 4.8)
- [CVE-2026-40686](https://insights.sbomify.com/CVE-2026-40686/): Memory corruption in Exim (low 3.7)
- [CVE-2026-40685](https://insights.sbomify.com/CVE-2026-40685/): Memory corruption in Exim (medium 6.5)
- [CVE-2026-40684](https://insights.sbomify.com/CVE-2026-40684/): Denial of service in Exim (medium 5.9)
- [CVE-2026-40683](https://insights.sbomify.com/CVE-2026-40683/): OpenStack Keystone: LDAP identity backend does not convert enabled attribute to boolean (high 7.7)
- [CVE-2026-40682](https://insights.sbomify.com/CVE-2026-40682/): Apache OpenNLP: XXE via Dictionary Parsing in DictionaryEntryPersistor (critical 9.1)
- [CVE-2026-4068](https://insights.sbomify.com/CVE-2026-4068/): Add Custom Fields to Media <= 2.0.3 - Cross-Site Request Forgery to Custom Field Deletion via 'delete' Parameter (medium 4.3)
- [CVE-2026-40677](https://insights.sbomify.com/CVE-2026-40677/): Weak cryptography in AMD Management Console (AMC) (high 7.7)
- [CVE-2026-4067](https://insights.sbomify.com/CVE-2026-4067/): Ad Short <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'client' Shortcode Attribute (medium 6.4)
- [CVE-2026-4066](https://insights.sbomify.com/CVE-2026-4066/): Missing authorization in Smart Custom Fields (medium 4.3)
- [CVE-2026-4065](https://insights.sbomify.com/CVE-2026-4065/): Missing authorization in Smart Slider 3 (medium 5.4)
- [CVE-2026-40641](https://insights.sbomify.com/CVE-2026-40641/): Weak cryptography in PowerFlex (medium 4.8)
- [CVE-2026-4064](https://insights.sbomify.com/CVE-2026-4064/): Missing authorization in PowerShell Universal (high 8.3)
- [CVE-2026-40639](https://insights.sbomify.com/CVE-2026-40639/): Weak cryptography in DELL EMBEDDED PC 3000 (medium 5.7)
- [CVE-2026-40638](https://insights.sbomify.com/CVE-2026-40638/): Privilege escalation in PowerScale InsightIQ (medium 6.7)
- [CVE-2026-40636](https://insights.sbomify.com/CVE-2026-40636/): Hardcoded credentials in ECS (critical 9.8)
- [CVE-2026-40635](https://insights.sbomify.com/CVE-2026-40635/): Other in PowerScale OneFS (medium 5.4)
- [CVE-2026-40633](https://insights.sbomify.com/CVE-2026-40633/): Information disclosure in PowerScale OneFS (high 7.8)
- [CVE-2026-40631](https://insights.sbomify.com/CVE-2026-40631/): BIG-IP iControl SOAP vulnerability (high 8.5)
- [CVE-2026-40630](https://insights.sbomify.com/CVE-2026-40630/): SenseLive X3050 Authentication bypass using an alternate path or channel (critical 9.3)
- [CVE-2026-4063](https://insights.sbomify.com/CVE-2026-4063/): Missing authorization in Social Icons Widget & Block – Social Media Icons & Share Buttons (medium 4.3)
- [CVE-2026-40629](https://insights.sbomify.com/CVE-2026-40629/): BIG-IP SSL/TLS vulnerability (high 8.7)
- [CVE-2026-40627](https://insights.sbomify.com/CVE-2026-40627/): Command injection in Totolink (critical 9.1)
- [CVE-2026-40624](https://insights.sbomify.com/CVE-2026-40624/): AVer PTC cameras Files or Directories Accessible to External Parties (critical 9.3)
- [CVE-2026-40623](https://insights.sbomify.com/CVE-2026-40623/): SenseLive X3050 Missing Authorization (high 7.2)
- [CVE-2026-40622](https://insights.sbomify.com/CVE-2026-40622/): Another 'ghost domain names' attack variant (medium 6.6)
- [CVE-2026-40621](https://insights.sbomify.com/CVE-2026-40621/): Auth bypass in WRC-BE65QSD-B (critical 9.3)
- [CVE-2026-40620](https://insights.sbomify.com/CVE-2026-40620/): SenseLive X3050 Missing authentication for critical function (critical 9.3)
- [CVE-2026-4062](https://insights.sbomify.com/CVE-2026-4062/): Geo Mashup <= 1.13.18 - Unauthenticated Time-Based SQL Injection via 'object_ids' Parameter (high 7.5)
- [CVE-2026-40619](https://insights.sbomify.com/CVE-2026-40619/): Information disclosure in Genetec Security Center (high 7.8)
- [CVE-2026-40618](https://insights.sbomify.com/CVE-2026-40618/): BIG-IP SSL/TLS vulnerability (high 8.7)
- [CVE-2026-40615](https://insights.sbomify.com/CVE-2026-40615/): Memory corruption in Totolink (critical 9.1)
- [CVE-2026-40614](https://insights.sbomify.com/CVE-2026-40614/): PJSIP: Heap buffer overflow in Opus codec decoding (high 8.5)
- [CVE-2026-40613](https://insights.sbomify.com/CVE-2026-40613/): Coturn: Misaligned Memory Access in coturn STUN Attribute Parser (Remote DoS on ARM64) (high 7.5)
- [CVE-2026-40612](https://insights.sbomify.com/CVE-2026-40612/): jq: Stack overflow via unbounded recursion in jv_contains (medium 5.4)
- [CVE-2026-40611](https://insights.sbomify.com/CVE-2026-40611/): Lego: Arbitrary File Write via Path Traversal in Webroot HTTP-01 Provider (high 8.8)
- [CVE-2026-40610](https://insights.sbomify.com/CVE-2026-40610/): BentoML has Information Disclosure in `bentoml build` via symlink traversal in the build context (medium 5.5)
- [CVE-2026-4061](https://insights.sbomify.com/CVE-2026-4061/): Geo Mashup <= 1.13.18 - Unauthenticated Time-Based SQL Injection via 'map_post_type' Parameter (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/666/