# Vulnerabilities published in 2026


- [CVE-2026-32381](https://insights.sbomify.com/CVE-2026-32381/): WordPress App Landing Page theme <= 1.2.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-32380](https://insights.sbomify.com/CVE-2026-32380/): WordPress Numinous theme <= 1.3.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-3238](https://insights.sbomify.com/CVE-2026-3238/): Samba: denial of service against ad dc wins server (high 7.5)
- [CVE-2026-32379](https://insights.sbomify.com/CVE-2026-32379/): WordPress Rara Academic theme <= 1.2.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-32378](https://insights.sbomify.com/CVE-2026-32378/): WordPress Book Landing Page theme <= 1.2.7 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-32377](https://insights.sbomify.com/CVE-2026-32377/): WordPress Pranayama Yoga theme <= 1.2.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-32376](https://insights.sbomify.com/CVE-2026-32376/): WordPress Kalon theme <= 1.2.9 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-32375](https://insights.sbomify.com/CVE-2026-32375/): WordPress Travel Diaries theme <= 1.2.4 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-32374](https://insights.sbomify.com/CVE-2026-32374/): WordPress The Minimal theme <= 1.2.9 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-32373](https://insights.sbomify.com/CVE-2026-32373/): WordPress SMS Alert Order Notifications plugin <= 3.9.0 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-32372](https://insights.sbomify.com/CVE-2026-32372/): WordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin <= 3.2.4 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-32371](https://insights.sbomify.com/CVE-2026-32371/): WordPress Elegant Pink theme <= 1.3.3 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-32370](https://insights.sbomify.com/CVE-2026-32370/): WordPress Influencer theme <= 1.1.7 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-3237](https://insights.sbomify.com/CVE-2026-3237/): Missing authorization in Octopus Server (low 2.3)
- [CVE-2026-32369](https://insights.sbomify.com/CVE-2026-32369/): WordPress Medilink-Core plugin < 2.0.7 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-32368](https://insights.sbomify.com/CVE-2026-32368/): WordPress Geo to Lat plugin <= 1.0.19 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-32367](https://insights.sbomify.com/CVE-2026-32367/): WordPress Modal Dialog plugin <= 3.5.16 - Remote Code Execution (RCE) vulnerability (critical 9.1)
- [CVE-2026-32366](https://insights.sbomify.com/CVE-2026-32366/): WordPress Collapsing Categories plugin <= 3.0.9 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-32365](https://insights.sbomify.com/CVE-2026-32365/): WordPress Collapsing Archives plugin <= 3.0.7 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-32364](https://insights.sbomify.com/CVE-2026-32364/): WordPress Turbo Manager plugin < 4.0.8 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-32363](https://insights.sbomify.com/CVE-2026-32363/): WordPress WPLifeCycle plugin <= 3.3.1 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-32362](https://insights.sbomify.com/CVE-2026-32362/): WordPress WP Sessions Time Monitoring Full Automatic plugin <= 1.1.3 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-32361](https://insights.sbomify.com/CVE-2026-32361/): WordPress Editorial Calendar plugin <= 3.9.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-32360](https://insights.sbomify.com/CVE-2026-32360/): WordPress Rich Showcase for Google Reviews plugin <= 6.9.4.3 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2026-3236](https://insights.sbomify.com/CVE-2026-3236/): Security feature bypass in Octopus Server (low 2.3)
- [CVE-2026-32359](https://insights.sbomify.com/CVE-2026-32359/): WordPress Icon List Block plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-32358](https://insights.sbomify.com/CVE-2026-32358/): WordPress Booking Calendar plugin <= 10.14.15 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-32357](https://insights.sbomify.com/CVE-2026-32357/): WordPress Simple Blog Card plugin <= 2.37 - Server Side Request Forgery (SSRF) vulnerability (medium 6.4)
- [CVE-2026-32356](https://insights.sbomify.com/CVE-2026-32356/): WordPress Robo Gallery plugin <= 5.1.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-32355](https://insights.sbomify.com/CVE-2026-32355/): WordPress JetEngine plugin < 3.8.4.1 - Deserialization of untrusted data vulnerability (high 8.8)
- [CVE-2026-32354](https://insights.sbomify.com/CVE-2026-32354/): WordPress WpEvently plugin < 5.1.9 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-32353](https://insights.sbomify.com/CVE-2026-32353/): WordPress MailerPress plugin <= 1.4.2 - Server Side Request Forgery (SSRF) vulnerability (medium 6.4)
- [CVE-2026-32352](https://insights.sbomify.com/CVE-2026-32352/): WordPress Elementor Website Builder plugin <= 3.35.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-32351](https://insights.sbomify.com/CVE-2026-32351/): WordPress PowerPress Podcasting plugin <= 11.15.13 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2026-32350](https://insights.sbomify.com/CVE-2026-32350/): WordPress Chocolate House theme <= 1.1.5 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-3235](https://insights.sbomify.com/CVE-2026-3235/): Missing authorization in WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards (medium 5.3)
- [CVE-2026-32349](https://insights.sbomify.com/CVE-2026-32349/): WordPress Embed PDF Viewer plugin <= 2.4.7 - Server Side Request Forgery (SSRF) vulnerability (medium 4.9)
- [CVE-2026-32348](https://insights.sbomify.com/CVE-2026-32348/): WordPress MAS Videos plugin <= 1.3.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-32347](https://insights.sbomify.com/CVE-2026-32347/): WordPress Restaurant and Cafe theme <= 1.2.5 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-32346](https://insights.sbomify.com/CVE-2026-32346/): WordPress Travel Agency theme <= 1.5.5 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-32345](https://insights.sbomify.com/CVE-2026-32345/): WordPress Perfect Portfolio theme <= 1.2.4 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-32344](https://insights.sbomify.com/CVE-2026-32344/): WordPress Corpiva theme <= 1.0.96 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2026-32343](https://insights.sbomify.com/CVE-2026-32343/): WordPress Easy Table of Contents plugin <= 2.0.80 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2026-32342](https://insights.sbomify.com/CVE-2026-32342/): WordPress Quiz Maker plugin <= 6.7.1.2 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2026-32341](https://insights.sbomify.com/CVE-2026-32341/): WordPress Benevolent theme <= 1.3.9 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-32340](https://insights.sbomify.com/CVE-2026-32340/): WordPress Business One Page theme <= 1.3.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-3234](https://insights.sbomify.com/CVE-2026-3234/): Mod_proxy_cluster: mod_proxy_cluster: response body corruption via crlf injection (medium 4.3)
- [CVE-2026-32339](https://insights.sbomify.com/CVE-2026-32339/): WordPress Bakes And Cakes theme <= 1.2.9 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-32338](https://insights.sbomify.com/CVE-2026-32338/): WordPress Construction Landing Page theme <= 1.4.1 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-32337](https://insights.sbomify.com/CVE-2026-32337/): WordPress Preschool and Kindergarten theme <= 1.2.5 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-32336](https://insights.sbomify.com/CVE-2026-32336/): WordPress Rara Business theme <= 1.3.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-32335](https://insights.sbomify.com/CVE-2026-32335/): WordPress The Conference theme <= 1.2.5 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-32334](https://insights.sbomify.com/CVE-2026-32334/): WordPress JobScout theme <= 1.1.7 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-32333](https://insights.sbomify.com/CVE-2026-32333/): WordPress Mayosis Core plugin <= 5.4.7 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-32332](https://insights.sbomify.com/CVE-2026-32332/): WordPress Easy Form plugin <= 2.7.9 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-32331](https://insights.sbomify.com/CVE-2026-32331/): WordPress Textmetrics plugin <= 3.6.4 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-32330](https://insights.sbomify.com/CVE-2026-32330/): WordPress Photo Gallery by 10Web plugin <= 1.8.37 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2026-32329](https://insights.sbomify.com/CVE-2026-32329/): WordPress Advanced Related Posts plugin <= 1.9.1 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-32328](https://insights.sbomify.com/CVE-2026-32328/): WordPress Lemmony theme < 1.7.1 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2026-32327](https://insights.sbomify.com/CVE-2026-32327/): Apache Portable Runtime Utility: apr-util XML stack recursion crash (critical 9.1)
- [CVE-2026-32326](https://insights.sbomify.com/CVE-2026-32326/): Missing authorization in 5G Mobile Router SH-U01 (medium 6.9)
- [CVE-2026-32325](https://insights.sbomify.com/CVE-2026-32325/): Privilege escalation in ServerView Agents for Windows (high 8.5)
- [CVE-2026-32324](https://insights.sbomify.com/CVE-2026-32324/): Anviz CX7 Firmware Use of Hard-coded Cryptographic Key (high 7.7)
- [CVE-2026-32323](https://insights.sbomify.com/CVE-2026-32323/): Mullvad VPN for macOS: Local Privilege Escalation via unverified bundle path in installer (high 7.3)
- [CVE-2026-32322](https://insights.sbomify.com/CVE-2026-32322/): soroban-sdk: `Fr` scalar field equality comparison bypasses modular reduction (medium 5.3)
- [CVE-2026-32321](https://insights.sbomify.com/CVE-2026-32321/): ClipBucket v5 has time-based Blind SQL Injection in ajax.php that leads to Data Exfiltration (high 8.8)
- [CVE-2026-32320](https://insights.sbomify.com/CVE-2026-32320/): Ella Core: AMF DoS via malformed PathSwitchRequest with empty NR security capability bitstrings (medium 6.5)
- [CVE-2026-32319](https://insights.sbomify.com/CVE-2026-32319/): Ella Core: Unauthenticated AMF DoS via malformed InitialUEMessage with undersized integrity-protected NAS payload (high 7.5)
- [CVE-2026-32318](https://insights.sbomify.com/CVE-2026-32318/): Cryptomator for IOS: Tampered vault configuration allows MITM attack on Hub API (high 7.6)
- [CVE-2026-32317](https://insights.sbomify.com/CVE-2026-32317/): Cryptomator for Android: Tampered vault configuration allows MITM attack on Hub API (high 7.6)
- [CVE-2026-32316](https://insights.sbomify.com/CVE-2026-32316/): jq: Integer overflow in jvp_string_append() allows Heap-based Buffer Overflow (high 8.2)
- [CVE-2026-32315](https://insights.sbomify.com/CVE-2026-32315/): motionEye: World-Readable Configuration File Exposes Admin Password Hash (medium 5.5)
- [CVE-2026-32314](https://insights.sbomify.com/CVE-2026-32314/): Yamux remote Panic via malformed Data frame with SYN set and len = 262145 (high 8.7)
- [CVE-2026-32313](https://insights.sbomify.com/CVE-2026-32313/): xmlseclibs is Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption (high 8.2)
- [CVE-2026-32312](https://insights.sbomify.com/CVE-2026-32312/): GLPI: Unauthorized export of form structure (medium 5.1)
- [CVE-2026-32311](https://insights.sbomify.com/CVE-2026-32311/): Command Injection and Docker container escape allows root on host machine (critical 9.3)
- [CVE-2026-32310](https://insights.sbomify.com/CVE-2026-32310/): Cryptomator: Unverified masterkeyfile key IDs can access arbitrary local or UNC paths (medium 4.1)
- [CVE-2026-3231](https://insights.sbomify.com/CVE-2026-3231/): Cross-site scripting in Checkout Field Editor (Checkout Manager) for WooCommerce (high 7.2)
- [CVE-2026-32309](https://insights.sbomify.com/CVE-2026-32309/): Cryptomator: Hub unlocking accepts plaintext HTTP and unvalidated endpoint schemes (high 8.7)
- [CVE-2026-32308](https://insights.sbomify.com/CVE-2026-32308/): OneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: "loose") (high 7.6)
- [CVE-2026-32306](https://insights.sbomify.com/CVE-2026-32306/): OneUptime ClickHouse SQL Injection via Aggregate Query Parameters (critical 10.0)
- [CVE-2026-32305](https://insights.sbomify.com/CVE-2026-32305/): Traefik mTLS bypass via fragmented ClientHello SNI extraction failure (high 7.8)
- [CVE-2026-32304](https://insights.sbomify.com/CVE-2026-32304/): Locutus: RCE via unsanitized input in create_function() (critical 9.8)
- [CVE-2026-32303](https://insights.sbomify.com/CVE-2026-32303/): Cryptomator: Tampered vault configuration allows MITM attack on Hub API (high 7.6)
- [CVE-2026-32302](https://insights.sbomify.com/CVE-2026-32302/): OpenClaw: Untrusted web origins can obtain authenticated operator.admin access in trusted-proxy mode (high 8.1)
- [CVE-2026-32301](https://insights.sbomify.com/CVE-2026-32301/): Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL (critical 9.3)
- [CVE-2026-32300](https://insights.sbomify.com/CVE-2026-32300/): Connect CMS: Improper Authorization in the My Page Profile Update Feature Allows Modification of Arbitrary User Information (high 8.1)
- [CVE-2026-3230](https://insights.sbomify.com/CVE-2026-3230/): Improper key_share validation in TLS 1.3 HelloRetryRequest (low 1.2)
- [CVE-2026-32299](https://insights.sbomify.com/CVE-2026-32299/): Connect CMS: Information Disclosure Due to Improper Authorization through the Page Content Retrieval Feature (high 7.5)
- [CVE-2026-32298](https://insights.sbomify.com/CVE-2026-32298/): Angeet ES3 KVM OS command injection (high 8.5)
- [CVE-2026-32297](https://insights.sbomify.com/CVE-2026-32297/): Angeet ES3 KVM unauthenticated arbitrary file write (critical 9.3)
- [CVE-2026-32296](https://insights.sbomify.com/CVE-2026-32296/): Sipeed NanoKVM unauthenticated Wi-Fi configuration endpoint (high 8.8)
- [CVE-2026-32295](https://insights.sbomify.com/CVE-2026-32295/): JetKVM insufficient login rate limiting (critical 9.3)
- [CVE-2026-32294](https://insights.sbomify.com/CVE-2026-32294/): JetKVM insufficient firmware verification (high 7.0)
- [CVE-2026-32293](https://insights.sbomify.com/CVE-2026-32293/): GL-iNet Comet (GL-RM1) KVM insufficient certificate validation (medium 6.3)
- [CVE-2026-32292](https://insights.sbomify.com/CVE-2026-32292/): GL-iNet Comet (GL-RM1) KVM insufficient login rate-limiting (critical 9.3)
- [CVE-2026-32291](https://insights.sbomify.com/CVE-2026-32291/): GL-iNet Comet (GL-RM1) KVM unauthenticated root access via UART serial console (high 7.0)
- [CVE-2026-32290](https://insights.sbomify.com/CVE-2026-32290/): GL-iNet Comet (GL-RM1) KVM insufficient firmware verification (high 7.0)
- [CVE-2026-3229](https://insights.sbomify.com/CVE-2026-3229/): Integer Overflow in Certificate Chain Allocation (low 1.2)
- [CVE-2026-32289](https://insights.sbomify.com/CVE-2026-32289/): JsBraceDepth Context Tracking Bugs (XSS) in html/template (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/720/