# Vulnerabilities published in 2026


- [CVE-2026-39836](https://insights.sbomify.com/CVE-2026-39836/): Panic in Dial and LookupPort when handling NUL byte on Windows in net (high 7.5)
- [CVE-2026-39835](https://insights.sbomify.com/CVE-2026-39835/): Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (medium 5.3)
- [CVE-2026-39834](https://insights.sbomify.com/CVE-2026-39834/): Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (critical 9.1)
- [CVE-2026-39833](https://insights.sbomify.com/CVE-2026-39833/): Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (critical 9.1)
- [CVE-2026-39832](https://insights.sbomify.com/CVE-2026-39832/): Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (critical 9.1)
- [CVE-2026-39831](https://insights.sbomify.com/CVE-2026-39831/): Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (critical 9.1)
- [CVE-2026-39830](https://insights.sbomify.com/CVE-2026-39830/): Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (critical 9.1)
- [CVE-2026-3983](https://insights.sbomify.com/CVE-2026-3983/): Campcodes Division Regional Athletic Meet Game Result Matrix System save-games.php cross site scripting (medium 5.1)
- [CVE-2026-39829](https://insights.sbomify.com/CVE-2026-39829/): Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (high 7.5)
- [CVE-2026-39828](https://insights.sbomify.com/CVE-2026-39828/): Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (medium 6.3)
- [CVE-2026-39827](https://insights.sbomify.com/CVE-2026-39827/): Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (medium 6.5)
- [CVE-2026-39826](https://insights.sbomify.com/CVE-2026-39826/): Escaper bypass leads to XSS in html/template (medium 6.1)
- [CVE-2026-39825](https://insights.sbomify.com/CVE-2026-39825/): ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil (medium 5.3)
- [CVE-2026-39824](https://insights.sbomify.com/CVE-2026-39824/): Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows (low 3.3)
- [CVE-2026-39823](https://insights.sbomify.com/CVE-2026-39823/): Bypass of meta content URL escaping causes XSS in html/template (medium 6.1)
- [CVE-2026-39822](https://insights.sbomify.com/CVE-2026-39822/): Root escape via symlink plus trailing slash in os (high 7.8)
- [CVE-2026-39821](https://insights.sbomify.com/CVE-2026-39821/): Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna (critical 9.6)
- [CVE-2026-39820](https://insights.sbomify.com/CVE-2026-39820/): Quadratic string concatentation in consumeComment in net/mail (high 7.5)
- [CVE-2026-3982](https://insights.sbomify.com/CVE-2026-3982/): itsourcecode University Management System view_result.php cross site scripting (medium 5.3)
- [CVE-2026-39819](https://insights.sbomify.com/CVE-2026-39819/): Invoking "go bug" follows symlinks in predictable temporary filenames in cmd/go (medium 5.3)
- [CVE-2026-39817](https://insights.sbomify.com/CVE-2026-39817/): Invoking "go tool pack" does not sanitize output paths in cmd/go (medium 5.9)
- [CVE-2026-39816](https://insights.sbomify.com/CVE-2026-39816/): Apache NiFi: Missing Execute Code Required Permission on TinkerpopClientService (high 7.5)
- [CVE-2026-39815](https://insights.sbomify.com/CVE-2026-39815/): SQL injection in FortiDDoS-F (high 7.9)
- [CVE-2026-39814](https://insights.sbomify.com/CVE-2026-39814/): Path traversal in FortiWeb (medium 6.2)
- [CVE-2026-39813](https://insights.sbomify.com/CVE-2026-39813/): Path traversal in FortiSandbox (critical 9.1)
- [CVE-2026-39812](https://insights.sbomify.com/CVE-2026-39812/): Cross-site scripting in FortiSandbox (medium 4.3)
- [CVE-2026-39811](https://insights.sbomify.com/CVE-2026-39811/): Integer overflow in FortiWeb (medium 4.4)
- [CVE-2026-39810](https://insights.sbomify.com/CVE-2026-39810/): Hardcoded credentials in FortiClientEMS (medium 5.2)
- [CVE-2026-3981](https://insights.sbomify.com/CVE-2026-3981/): itsourcecode Online Doctor Appointment System doctor_action.php sql injection (medium 6.9)
- [CVE-2026-39809](https://insights.sbomify.com/CVE-2026-39809/): SQL injection in FortiClientEMS (medium 6.2)
- [CVE-2026-39808](https://insights.sbomify.com/CVE-2026-39808/): Fortinet FortiSandbox OS Command Injection (critical 9.1, exploited in the wild)
- [CVE-2026-39807](https://insights.sbomify.com/CVE-2026-39807/): Client-supplied URI scheme trusted without transport verification in bandit (medium 6.3)
- [CVE-2026-39806](https://insights.sbomify.com/CVE-2026-39806/): HTTP/1 chunked decoder infinite loop on requests with trailer fields in bandit (high 8.7)
- [CVE-2026-39805](https://insights.sbomify.com/CVE-2026-39805/): CL.CL HTTP request smuggling via duplicate Content-Length in bandit (medium 6.3)
- [CVE-2026-39804](https://insights.sbomify.com/CVE-2026-39804/): WebSocket permessage-deflate inflate has no output-size cap in bandit (high 8.2)
- [CVE-2026-39803](https://insights.sbomify.com/CVE-2026-39803/): HTTP/1 chunked body reader ignores length cap in bandit (high 8.7)
- [CVE-2026-39802](https://insights.sbomify.com/CVE-2026-39802/): WordPress Everest Backup plugin <= 2.3.13 - Remote Code Execution (RCE) vulnerability (high 8.1)
- [CVE-2026-39801](https://insights.sbomify.com/CVE-2026-39801/): WordPress AIWU plugin <= 1.5.9 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2026-39800](https://insights.sbomify.com/CVE-2026-39800/): WordPress Additional Order Filters for WooCommerce plugin <= 1.24 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-3980](https://insights.sbomify.com/CVE-2026-3980/): itsourcecode Online Doctor Appointment System patient_action.php sql injection (medium 6.9)
- [CVE-2026-39799](https://insights.sbomify.com/CVE-2026-39799/): WordPress WP File Download plugin <= 6.3.6 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-39798](https://insights.sbomify.com/CVE-2026-39798/): WordPress TrueBooker plugin <= 1.2.9 - Settings Change vulnerability (medium 6.5)
- [CVE-2026-39797](https://insights.sbomify.com/CVE-2026-39797/): WordPress GDPR Framework By Data443 plugin <= 2.5.0 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-39796](https://insights.sbomify.com/CVE-2026-39796/): WordPress Advanced Posts Listing – Show Post List Easily plugin <= 1.0.8 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-39795](https://insights.sbomify.com/CVE-2026-39795/): WordPress SendPress Newsletters plugin <= 1.26.1.20 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-39794](https://insights.sbomify.com/CVE-2026-39794/): WordPress WooCommerce Multivendor Marketplace – REST API plugin <= 1.6.3 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-39793](https://insights.sbomify.com/CVE-2026-39793/): WordPress Simple JWT Login plugin 4.0.0 - Broken Authentication vulnerability (high 8.8)
- [CVE-2026-39792](https://insights.sbomify.com/CVE-2026-39792/): WordPress Simple File List plugin <= 6.3.11 - Arbitrary File Deletion vulnerability (high 8.6)
- [CVE-2026-39791](https://insights.sbomify.com/CVE-2026-39791/): WordPress Mailjet Email Marketing plugin <= 6.2.3 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-39790](https://insights.sbomify.com/CVE-2026-39790/): WordPress VikRentCar plugin <= 1.4.7 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-3979](https://insights.sbomify.com/CVE-2026-3979/): quickjs-ng quickjs quickjs.c js_iterator_concat_return use after free (medium 4.8)
- [CVE-2026-39789](https://insights.sbomify.com/CVE-2026-39789/): WordPress Fluent Affiliate Pro plugin <= 1.6.4 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-39788](https://insights.sbomify.com/CVE-2026-39788/): WordPress Front End PM plugin <= 11.4.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-39787](https://insights.sbomify.com/CVE-2026-39787/): WordPress 10Web Social Photo Feed plugin <= 1.4.35 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-39785](https://insights.sbomify.com/CVE-2026-39785/): WordPress Gmedia Photo Gallery plugin <= 1.25.1 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-39784](https://insights.sbomify.com/CVE-2026-39784/): WordPress Hotel Booking plugin <= 3.8 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-39783](https://insights.sbomify.com/CVE-2026-39783/): WordPress Polylang plugin <= 3.8.7 - Sensitive Data Exposure vulnerability (medium 4.3)
- [CVE-2026-39782](https://insights.sbomify.com/CVE-2026-39782/): WordPress Kali Forms plugin <= 2.4.27 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-39781](https://insights.sbomify.com/CVE-2026-39781/): WordPress Document Gallery plugin <= 5.1.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-39780](https://insights.sbomify.com/CVE-2026-39780/): WordPress Youzify plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-3978](https://insights.sbomify.com/CVE-2026-3978/): D-Link DIR-513 formEasySetupWizard3 stack-based overflow (high 8.7)
- [CVE-2026-39779](https://insights.sbomify.com/CVE-2026-39779/): WordPress Asgaros Forum plugin <= 3.4.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-39778](https://insights.sbomify.com/CVE-2026-39778/): Cross-site scripting in Ansar Import – One Click Starter Sites – for Elementor &amp; Themes (high 7.1)
- [CVE-2026-39776](https://insights.sbomify.com/CVE-2026-39776/): WordPress Tabs plugin <= 2.5 - Remote Code Execution (RCE) vulnerability (high 8.0)
- [CVE-2026-39775](https://insights.sbomify.com/CVE-2026-39775/): WordPress JobZilla - Job Board WordPress Theme theme <= 2.2 - Privilege Escalation vulnerability (high 8.8)
- [CVE-2026-39774](https://insights.sbomify.com/CVE-2026-39774/): WordPress Tourfic Pro plugin <= 1.17.3 - Privilege Escalation vulnerability (high 8.8)
- [CVE-2026-39773](https://insights.sbomify.com/CVE-2026-39773/): WordPress Doctreat Core plugin <= 1.7.0 - Privilege Escalation vulnerability (critical 10.0)
- [CVE-2026-39772](https://insights.sbomify.com/CVE-2026-39772/): WordPress Captcha by BestWebSoft plugin <= 5.2.8 - Bypass Vulnerability vulnerability (medium 5.3)
- [CVE-2026-39771](https://insights.sbomify.com/CVE-2026-39771/): WordPress Buddyboss Platform plugin <= 3.1.0 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-39770](https://insights.sbomify.com/CVE-2026-39770/): WordPress Doctreat theme <= 1.7.0 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2026-3977](https://insights.sbomify.com/CVE-2026-3977/): projectsend AJAX Endpoints authorization (medium 5.3)
- [CVE-2026-39769](https://insights.sbomify.com/CVE-2026-39769/): WordPress Graphina plugin <= 3.1.12 - Broken Authentication vulnerability (high 7.5)
- [CVE-2026-39767](https://insights.sbomify.com/CVE-2026-39767/): WordPress WPBase Cache plugin <= 5.5.6 - Denial of Service Attack vulnerability (medium 6.5)
- [CVE-2026-39766](https://insights.sbomify.com/CVE-2026-39766/): WordPress ARForms plugin <= 7.1.2 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-39765](https://insights.sbomify.com/CVE-2026-39765/): WordPress Challan plugin <= 3.7.88 - Privilege Escalation vulnerability (high 7.2)
- [CVE-2026-39764](https://insights.sbomify.com/CVE-2026-39764/): WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.19 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-39763](https://insights.sbomify.com/CVE-2026-39763/): WordPress WP Dummy Content Generator plugin <= 4.0.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-39762](https://insights.sbomify.com/CVE-2026-39762/): WordPress Autoship Cloud for WooCommerce Subscription Products plugin <= 2.17.1 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-39761](https://insights.sbomify.com/CVE-2026-39761/): WordPress Meta Box AIO plugin <= 3.7.1 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2026-39760](https://insights.sbomify.com/CVE-2026-39760/): WordPress Real 3D FlipBook plugin <= 5.5 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-3976](https://insights.sbomify.com/CVE-2026-3976/): Tenda W3 POST Parameter WifiMacFilterSet formWifiMacFilterSet stack-based overflow (high 8.7)
- [CVE-2026-39759](https://insights.sbomify.com/CVE-2026-39759/): WordPress Workreap Core plugin <= 3.4.5 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2026-39758](https://insights.sbomify.com/CVE-2026-39758/): WordPress Midtrans-WooCommerce plugin <= 2.32.3 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-39757](https://insights.sbomify.com/CVE-2026-39757/): WordPress Taskbot plugin <= 6.6 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2026-39756](https://insights.sbomify.com/CVE-2026-39756/): WordPress Wappointment plugin <= 2.7.7 - Insecure Direct Object References (IDOR) vulnerability (medium 6.5)
- [CVE-2026-39755](https://insights.sbomify.com/CVE-2026-39755/): WordPress WP Duplicate plugin <= 1.1.11 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2026-39754](https://insights.sbomify.com/CVE-2026-39754/): WordPress Piotnet Addons For Elementor plugin <= 7.1.71 - Arbitrary File Download vulnerability (medium 6.5)
- [CVE-2026-39753](https://insights.sbomify.com/CVE-2026-39753/): WordPress Taskbot plugin <= 6.6 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2026-39752](https://insights.sbomify.com/CVE-2026-39752/): WordPress Jobs for WordPress plugin <= 2.8.2 - Arbitrary File Deletion vulnerability (high 7.7)
- [CVE-2026-39751](https://insights.sbomify.com/CVE-2026-39751/): WordPress PayPlug for WooCommerce (Official) plugin <= 3.1.0 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-39750](https://insights.sbomify.com/CVE-2026-39750/): Cross-site scripting in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart (high 7.1)
- [CVE-2026-3975](https://insights.sbomify.com/CVE-2026-3975/): Tenda W3 POST Parameter WifiMacFilterGet formWifiMacFilterGet stack-based overflow (high 8.7)
- [CVE-2026-39749](https://insights.sbomify.com/CVE-2026-39749/): WordPress App for Cloudflare® plugin <= 1.10.1 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-39748](https://insights.sbomify.com/CVE-2026-39748/): WordPress EduMall theme <= 4.5.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-39747](https://insights.sbomify.com/CVE-2026-39747/): WordPress Woffice theme <= 5.4.35 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-39746](https://insights.sbomify.com/CVE-2026-39746/): WordPress Booknetic plugin < 5.10.3 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-39745](https://insights.sbomify.com/CVE-2026-39745/): WordPress Contact Form to DB by BestWebSoft plugin <= 1.7.6 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-39742](https://insights.sbomify.com/CVE-2026-39742/): WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.8.0.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-39741](https://insights.sbomify.com/CVE-2026-39741/): WordPress Simple Cloudflare Turnstile plugin <= 1.44.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-3974](https://insights.sbomify.com/CVE-2026-3974/): Tenda W3 HTTP exeCommand formexeCommand stack-based overflow (high 8.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/674/