# Vulnerabilities published in 2026


- [CVE-2026-39455](https://insights.sbomify.com/CVE-2026-39455/): BIG-IP Configuration utility vulnerability (high 8.7)
- [CVE-2026-39454](https://insights.sbomify.com/CVE-2026-39454/): Misconfiguration in SKYMEC IT Manager (high 8.5)
- [CVE-2026-39453](https://insights.sbomify.com/CVE-2026-39453/): Red Lion Controls N-Tron 700 Series Reachable Assertion (high 8.5)
- [CVE-2026-39452](https://insights.sbomify.com/CVE-2026-39452/): Security feature bypass in Intel(R) Transfer Learning Tool (medium 6.3)
- [CVE-2026-39451](https://insights.sbomify.com/CVE-2026-39451/): WordPress WP Google Review Slider plugin <= 18.0 - Cross Site Scripting (XSS) vulnerability (medium 6.3)
- [CVE-2026-39450](https://insights.sbomify.com/CVE-2026-39450/): WordPress FunnelKit Automations plugin <= 3.7.3 - Broken Authentication vulnerability (high 7.1)
- [CVE-2026-3945](https://insights.sbomify.com/CVE-2026-3945/): tinyproxy Integer Overflow in HTTP Chunked Transfer-Encoding Parser Leading to Denial of Service (high 8.7)
- [CVE-2026-39449](https://insights.sbomify.com/CVE-2026-39449/): WordPress Contact Form to Any API plugin <= 3.0.3 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-39448](https://insights.sbomify.com/CVE-2026-39448/): WordPress NOWPayments for WooCommerce plugin <= 1.4.0 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-39447](https://insights.sbomify.com/CVE-2026-39447/): WordPress Simply Schedule Appointments plugin <= 1.6.10.6 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-39446](https://insights.sbomify.com/CVE-2026-39446/): WordPress Kapee theme < 1.7.0 - PHP Object Injection vulnerability (high 8.1)
- [CVE-2026-39445](https://insights.sbomify.com/CVE-2026-39445/): WordPress Alukas theme < 3.0.0 - PHP Object Injection vulnerability (high 8.1)
- [CVE-2026-39444](https://insights.sbomify.com/CVE-2026-39444/): WordPress PublishPress Series plugin <= 3.1.3 - Insecure Direct Object References (IDOR) vulnerability (medium 5.4)
- [CVE-2026-39443](https://insights.sbomify.com/CVE-2026-39443/): WordPress EmallShop theme <= 2.4.21 - PHP Object Injection vulnerability (high 8.1)
- [CVE-2026-39442](https://insights.sbomify.com/CVE-2026-39442/): WordPress PressMart theme <= 1.2.26 - PHP Object Injection vulnerability (high 8.1)
- [CVE-2026-39441](https://insights.sbomify.com/CVE-2026-39441/): WordPress Feed KuantoKusta for WooCommerce – Free plugin <= 5.3 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-39440](https://insights.sbomify.com/CVE-2026-39440/): WordPress FunnelFormsPro plugin <= 3.8.1 - Remote Code Execution (RCE) vulnerability (critical 9.9)
- [CVE-2026-3944](https://insights.sbomify.com/CVE-2026-3944/): itsourcecode University Management System att_add.php sql injection (medium 6.9)
- [CVE-2026-39439](https://insights.sbomify.com/CVE-2026-39439/): WordPress WebSamurai plugin <= 1.0.7 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-39438](https://insights.sbomify.com/CVE-2026-39438/): WordPress ListingPro plugin <= 2.9.10 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-39437](https://insights.sbomify.com/CVE-2026-39437/): Cross-site scripting in Min Max Step Quantity Limits Manager for WooCommerce (high 7.1)
- [CVE-2026-39436](https://insights.sbomify.com/CVE-2026-39436/): WordPress CformsII plugin <= 15.1.3 - Cross Site Request Forgery (CSRF) vulnerability (high 7.1)
- [CVE-2026-39435](https://insights.sbomify.com/CVE-2026-39435/): WordPress CformsII plugin <= 15.1.3 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-39434](https://insights.sbomify.com/CVE-2026-39434/): WordPress CTX Feed plugin <= 6.6.26 - PHP Object Injection vulnerability (high 7.2)
- [CVE-2026-39433](https://insights.sbomify.com/CVE-2026-39433/): WordPress WPAMS plugin < 49.5.3 - Arbitrary Content Deletion vulnerability (medium 6.5)
- [CVE-2026-39432](https://insights.sbomify.com/CVE-2026-39432/): WordPress Timetics plugin <= 1.0.53 - Broken Access Control vulnerability (high 8.2)
- [CVE-2026-3943](https://insights.sbomify.com/CVE-2026-3943/): H3C ACG1000-AK230 aaa_portal_auth_local_submit command injection (medium 6.9)
- [CVE-2026-39429](https://insights.sbomify.com/CVE-2026-39429/): kcp's cache server is accessible without authentication or authorization checks (high 8.2)
- [CVE-2026-39428](https://insights.sbomify.com/CVE-2026-39428/): CubeCart: Stored Cross-Site Scripting (XSS) (medium 4.8)
- [CVE-2026-39426](https://insights.sbomify.com/CVE-2026-39426/): MaxKB: Stored XSS via Unsanitized iframe_render Parsing (medium 5.1)
- [CVE-2026-39425](https://insights.sbomify.com/CVE-2026-39425/): MaxKB: Stored XSS via Unsanitized html_rander Tags in Markdown Rendering (medium 5.1)
- [CVE-2026-39424](https://insights.sbomify.com/CVE-2026-39424/): MaxKB has CSV Injection in its Application Chat Export Functionality (medium 5.3)
- [CVE-2026-39423](https://insights.sbomify.com/CVE-2026-39423/): Stored XSS via Eval Injection in EchartsRander Component (medium 6.9)
- [CVE-2026-39422](https://insights.sbomify.com/CVE-2026-39422/): MaxKB has Stored XSS via ChatHeadersMiddleware (medium 6.9)
- [CVE-2026-39421](https://insights.sbomify.com/CVE-2026-39421/): MaxKB: Sandbox escape via ctypes and unhooked SYS_pkey_mprotect (medium 6.3)
- [CVE-2026-39420](https://insights.sbomify.com/CVE-2026-39420/): MaxKB: Sandbox escape via LD_PRELOAD bypass (medium 6.3)
- [CVE-2026-3942](https://insights.sbomify.com/CVE-2026-3942/): Other in Chrome (medium 4.3)
- [CVE-2026-39419](https://insights.sbomify.com/CVE-2026-39419/): MaxKB: Sandbox Result Validation Bypass via Tool Output Spoofing (low 3.1)
- [CVE-2026-39418](https://insights.sbomify.com/CVE-2026-39418/): MaxKB: SSRF via sandbox network hook bypass (medium 5.0)
- [CVE-2026-39417](https://insights.sbomify.com/CVE-2026-39417/): MaxKB: RCE via MCP stdio command injection in workflow engine (medium 4.6)
- [CVE-2026-39416](https://insights.sbomify.com/CVE-2026-39416/): Stored XSS in modal item preview for long item content in AIL Framework (high 8.5)
- [CVE-2026-39415](https://insights.sbomify.com/CVE-2026-39415/): Frappe Learning Management System has Client-Side Manipulation of Quiz Scores (medium 5.3)
- [CVE-2026-39414](https://insights.sbomify.com/CVE-2026-39414/): MinIO affected a DoS via Unbounded Memory Allocation in S3 Select CSV Parsing (high 7.1)
- [CVE-2026-39413](https://insights.sbomify.com/CVE-2026-39413/): LightRAG has a JWT Algorithm Confusion Vulnerability in LightRAG API (medium 4.2)
- [CVE-2026-39412](https://insights.sbomify.com/CVE-2026-39412/): LiquidJS: ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting side-channel (medium 5.3)
- [CVE-2026-39411](https://insights.sbomify.com/CVE-2026-39411/): LobeHub has an unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` header (medium 5.0)
- [CVE-2026-39410](https://insights.sbomify.com/CVE-2026-39410/): Hono has a non-breaking space prefix bypass in cookie name handling in getCookie() (medium 4.8)
- [CVE-2026-3941](https://insights.sbomify.com/CVE-2026-3941/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2026-39409](https://insights.sbomify.com/CVE-2026-39409/): Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses (medium 6.3)
- [CVE-2026-39408](https://insights.sbomify.com/CVE-2026-39408/): Hono has a path traversal in toSSG() allows writing files outside the output directory (medium 5.9)
- [CVE-2026-39407](https://insights.sbomify.com/CVE-2026-39407/): Hono has a middleware bypass via repeated slashes in serveStatic (medium 5.3)
- [CVE-2026-39406](https://insights.sbomify.com/CVE-2026-39406/): @hono/node-server has a middleware bypass via repeated slashes in serveStatic (medium 5.3)
- [CVE-2026-39405](https://insights.sbomify.com/CVE-2026-39405/): Frappe has Path Transversal via SCORM (critical 9.4)
- [CVE-2026-39402](https://insights.sbomify.com/CVE-2026-39402/): lxc lxc-user-nic insufficient ownership validation allows cross-tenant OVS port deletion (medium 4.3)
- [CVE-2026-39401](https://insights.sbomify.com/CVE-2026-39401/): Privilege Escalation via update_event Job Output in Cronicle (medium 5.3)
- [CVE-2026-39400](https://insights.sbomify.com/CVE-2026-39400/): Stored XSS via Job HTML/Table Output in Cronicle (medium 5.3)
- [CVE-2026-3940](https://insights.sbomify.com/CVE-2026-3940/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2026-39399](https://insights.sbomify.com/CVE-2026-39399/): NuGet Gallery: Arbitrary Blob Overwrite via Nuspec Confusion and URI Fragment Truncation (critical 9.6)
- [CVE-2026-39397](https://insights.sbomify.com/CVE-2026-39397/): @delmaredigital/payload-puc is missing authorization on /api/puck/* CRUD endpoints allows unauthenticated access to Puck-registered collections (critical 9.4)
- [CVE-2026-39396](https://insights.sbomify.com/CVE-2026-39396/): OpenBao has Decompression Bomb via Unbounded Copy in OCI Plugin Extraction (DoS) (low 3.1)
- [CVE-2026-39395](https://insights.sbomify.com/CVE-2026-39395/): Cosign's verify-blob-attestation reports false positive when payload parsing fails (medium 4.3)
- [CVE-2026-39394](https://insights.sbomify.com/CVE-2026-39394/): CI4MS has an .env CRLF Injection via Unvalidated `host` Parameter in Install Controller (high 8.1)
- [CVE-2026-39393](https://insights.sbomify.com/CVE-2026-39393/): Post-Installation Re-entry via Cache-Dependent Install Guard Bypass in ci4ms (high 8.1)
- [CVE-2026-39392](https://insights.sbomify.com/CVE-2026-39392/): CI4MS has Stored XSS in Pages Content Due to Missing html_purify Sanitization (medium 5.5)
- [CVE-2026-39391](https://insights.sbomify.com/CVE-2026-39391/): CI4MS has Stored XSS via Unescaped Blacklist Note in Admin User List (medium 4.8)
- [CVE-2026-39390](https://insights.sbomify.com/CVE-2026-39390/): CI4MS has Stored XSS via srcdoc attribute bypass in Google Maps iframe setting (medium 5.5)
- [CVE-2026-3939](https://insights.sbomify.com/CVE-2026-3939/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-39389](https://insights.sbomify.com/CVE-2026-39389/): CI4MS has a Hidden Items Authorization Bypass in Fileeditor Allows Reading Secrets and Writing Protected Files (medium 6.7)
- [CVE-2026-39388](https://insights.sbomify.com/CVE-2026-39388/): OpenBao's Certificate Authentication Allows Token Renewal With Different Certificate (low 2.0)
- [CVE-2026-39387](https://insights.sbomify.com/CVE-2026-39387/): BoidCMS: Local File Inclusion (LFI) leads to Remote Code Execution (RCE) via tpl parameter (high 7.2)
- [CVE-2026-39386](https://insights.sbomify.com/CVE-2026-39386/): Neko has Self-service Privilege Escalation for Authenticated Users (high 8.8)
- [CVE-2026-39385](https://insights.sbomify.com/CVE-2026-39385/): Frappe LMS enrollment bypass in paid courses via unrelated batch (high 7.1)
- [CVE-2026-39384](https://insights.sbomify.com/CVE-2026-39384/): FreeScout Customer Merge Cross-Mailbox Authorization Bypass (high 7.6)
- [CVE-2026-39383](https://insights.sbomify.com/CVE-2026-39383/): Gotenberg unauthenticated blind SSRF via unfiltered webhook URL (medium 6.9)
- [CVE-2026-39382](https://insights.sbomify.com/CVE-2026-39382/): dbt has a Command Injection in Reusable Workflow via Unsanitized comment-body Output (critical 9.3)
- [CVE-2026-39381](https://insights.sbomify.com/CVE-2026-39381/): Parse Server's Endpoint `/sessions/me` bypasses `_Session` `protectedFields` (medium 5.3)
- [CVE-2026-39380](https://insights.sbomify.com/CVE-2026-39380/): Open Source Point of Sale has Stored XSS in Stock Location (Configuration) (medium 5.4)
- [CVE-2026-3938](https://insights.sbomify.com/CVE-2026-3938/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-39378](https://insights.sbomify.com/CVE-2026-39378/): nbconvert has an Arbitrary File Read via Path Traversal in HTMLExporter Image Embedding (medium 6.5)
- [CVE-2026-39377](https://insights.sbomify.com/CVE-2026-39377/): nbconvert has an Arbitrary File Write via Path Traversal in Cell Attachment Filenames (medium 6.5)
- [CVE-2026-39376](https://insights.sbomify.com/CVE-2026-39376/): FastFeedParser has an infinite redirect loop DoS via meta-refresh chain (high 7.5)
- [CVE-2026-39374](https://insights.sbomify.com/CVE-2026-39374/): Plane IDOR: Cross-Project Issue Date Modification via Bulk Update Endpoint (medium 6.5)
- [CVE-2026-39373](https://insights.sbomify.com/CVE-2026-39373/): JWCrypto: JWE ZIP decompression bomb (medium 5.3)
- [CVE-2026-39372](https://insights.sbomify.com/CVE-2026-39372/): InvoicePlane: Sensitive Information Disclosure via Unstripped EXIF Metadata in Attachments (medium 4.9)
- [CVE-2026-39371](https://insights.sbomify.com/CVE-2026-39371/): RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requests (high 8.1)
- [CVE-2026-39370](https://insights.sbomify.com/CVE-2026-39370/): WWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltration (Incomplete fix for CVE-2026-27732) (high 7.1)
- [CVE-2026-3937](https://insights.sbomify.com/CVE-2026-3937/): Other in Chrome (medium 6.5)
- [CVE-2026-39369](https://insights.sbomify.com/CVE-2026-39369/): WWBN AVideo's GIF poster fetch bypasses traversal scrubbing and exposes local files through public media URLs (high 7.6)
- [CVE-2026-39368](https://insights.sbomify.com/CVE-2026-39368/): WWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal services (medium 6.5)
- [CVE-2026-39367](https://insights.sbomify.com/CVE-2026-39367/): WWBN AVideo has Stored XSS via Malicious EPG XML Program Titles in AVideo EPG Page (medium 5.4)
- [CVE-2026-39366](https://insights.sbomify.com/CVE-2026-39366/): WWBN AVideo Affected by a PayPal IPN Replay Attack Enabling Wallet Balance Inflation via Missing Transaction Deduplication in ipn.php (medium 6.5)
- [CVE-2026-39365](https://insights.sbomify.com/CVE-2026-39365/): Vite has a Path Traversal in Optimized Deps `.map` Handling (medium 6.3)
- [CVE-2026-39364](https://insights.sbomify.com/CVE-2026-39364/): Vite has a `server.fs.deny` bypass with queries (high 8.2)
- [CVE-2026-39363](https://insights.sbomify.com/CVE-2026-39363/): Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket (high 8.2)
- [CVE-2026-39362](https://insights.sbomify.com/CVE-2026-39362/): InvenTree has SSRF via Remote Image Download — No IP/Hostname Validation on remote_image URLs (medium 5.3)
- [CVE-2026-39361](https://insights.sbomify.com/CVE-2026-39361/): OpenObserve has a SSRF Protection Bypass via IPv6 Bracket Notation in validate_enrichment_url (high 7.7)
- [CVE-2026-39360](https://insights.sbomify.com/CVE-2026-39360/): RustFS has an authorization bypass in multipart UploadPartCopy enables cross-bucket object exfiltration (medium 5.3)
- [CVE-2026-3936](https://insights.sbomify.com/CVE-2026-3936/): Use after free in Chrome (high 8.8)
- [CVE-2026-39359](https://insights.sbomify.com/CVE-2026-39359/): Wazuh: Unauthenticated Path Traversal in authd via Agent Group Name (high 7.5)
- [CVE-2026-39358](https://insights.sbomify.com/CVE-2026-39358/): CubeCart: Time-based Blind SQL Injection (high 7.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/678/