# Vulnerabilities published in 2026


- [CVE-2026-28296](https://insights.sbomify.com/CVE-2026-28296/): Gvfs: ftp gvfs backend: arbitrary ftp command injection via crlf sequences in file paths (medium 4.3)
- [CVE-2026-28295](https://insights.sbomify.com/CVE-2026-28295/): Gvfs: gvfs ftp backend: information disclosure via untrusted pasv responses (medium 4.3)
- [CVE-2026-28292](https://insights.sbomify.com/CVE-2026-28292/): simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key that enables RCE (critical 9.8)
- [CVE-2026-28291](https://insights.sbomify.com/CVE-2026-28291/): simple-git has Command Execution via Option-Parsing Bypass (high 8.1)
- [CVE-2026-28289](https://insights.sbomify.com/CVE-2026-28289/): FreeScout 1.8.206 Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Remote Code Execution (critical 10.0)
- [CVE-2026-28288](https://insights.sbomify.com/CVE-2026-28288/): Dify has a user enumeration issue (medium 5.5)
- [CVE-2026-28287](https://insights.sbomify.com/CVE-2026-28287/): FreePBX: Authenticated Remote Code Execution via Recordings Module AJAX Endpoints (high 8.6)
- [CVE-2026-28286](https://insights.sbomify.com/CVE-2026-28286/): ZimaOS: Unauthorized Creation of Files/Folders in Restricted System Directories via API (high 8.6)
- [CVE-2026-28284](https://insights.sbomify.com/CVE-2026-28284/): FreePBX: Authenticated SQL Injection Vulnerabilities in FreePBX Logfiles Module (high 8.6)
- [CVE-2026-28282](https://insights.sbomify.com/CVE-2026-28282/): Discourse vulnerable to group membership addition permission bypass via discourse-policy plugin (low 2.3)
- [CVE-2026-28281](https://insights.sbomify.com/CVE-2026-28281/): InstantCMS has Multiple CSRF Vulnerabilities (high 7.1)
- [CVE-2026-28280](https://insights.sbomify.com/CVE-2026-28280/): `osctrl-admin` has Stored Cross-Site Scripting (XSS) in On-Demand Query List (medium 6.1)
- [CVE-2026-28279](https://insights.sbomify.com/CVE-2026-28279/): `osctrl-admin` Vulnerable to OS Command Injection via Environment Configuration (high 7.4)
- [CVE-2026-28277](https://insights.sbomify.com/CVE-2026-28277/): LangGraph: Unsafe msgpack deserialization in LangGraph checkpoint loading (medium 6.8)
- [CVE-2026-28276](https://insights.sbomify.com/CVE-2026-28276/): Initiative Allows Unauthenticated Access to Uploaded Documents via Public /uploads/ Endpoint (high 7.5)
- [CVE-2026-28275](https://insights.sbomify.com/CVE-2026-28275/): Initiative Vulnerable to Improper Session Invalidation (JWT Remains Valid) (high 8.1)
- [CVE-2026-28274](https://insights.sbomify.com/CVE-2026-28274/): Initiative Vulnerable to Token Theft via Stored XSS in Document Uploads (high 8.7)
- [CVE-2026-28272](https://insights.sbomify.com/CVE-2026-28272/): Kiteworks Email Protection Gateway has a Cross-site Scripting vulnerability (high 8.1)
- [CVE-2026-28271](https://insights.sbomify.com/CVE-2026-28271/): Kiteworks Core is vulnerable to Server-Side Request Forgery (SSRF) (medium 6.5)
- [CVE-2026-28270](https://insights.sbomify.com/CVE-2026-28270/): Kiteworks Core has an Unrestricted Upload of File with Dangerous Type (medium 4.9)
- [CVE-2026-2827](https://insights.sbomify.com/CVE-2026-2827/): Open User Map PRO <= 1.4.31 - Unauthenticated Stored Cross-Site Scripting via 'oum_location_notification' (medium 4.7)
- [CVE-2026-28269](https://insights.sbomify.com/CVE-2026-28269/): Kiteworks Core has an OS Command Injection (medium 5.9)
- [CVE-2026-28268](https://insights.sbomify.com/CVE-2026-28268/): Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse (critical 9.8)
- [CVE-2026-28267](https://insights.sbomify.com/CVE-2026-28267/): Misconfiguration in DigitalArts@Cloud Agent (for Windows) (medium 6.8)
- [CVE-2026-28265](https://insights.sbomify.com/CVE-2026-28265/): Path traversal in PowerStore (medium 4.4)
- [CVE-2026-28264](https://insights.sbomify.com/CVE-2026-28264/): Misconfiguration in PowerProtect Agent (low 3.3)
- [CVE-2026-28263](https://insights.sbomify.com/CVE-2026-28263/): Cross-site scripting in PowerProtect Data Domain (medium 5.9)
- [CVE-2026-28262](https://insights.sbomify.com/CVE-2026-28262/): Other in iDRAC Tools (medium 6.0)
- [CVE-2026-28261](https://insights.sbomify.com/CVE-2026-28261/): Information disclosure in Elastic Cloud Storage (high 7.8)
- [CVE-2026-2826](https://insights.sbomify.com/CVE-2026-2826/): Missing authorization in Kadence Blocks — Page Builder Toolkit for Gutenberg Editor (medium 4.3)
- [CVE-2026-28256](https://insights.sbomify.com/CVE-2026-28256/): Use of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge (medium 6.9)
- [CVE-2026-28255](https://insights.sbomify.com/CVE-2026-28255/): Use of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge (high 8.2)
- [CVE-2026-28254](https://insights.sbomify.com/CVE-2026-28254/): Missing Authorization vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge (medium 6.9)
- [CVE-2026-28253](https://insights.sbomify.com/CVE-2026-28253/): Memory Allocation with Excessive Size Value vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge (high 8.7)
- [CVE-2026-28252](https://insights.sbomify.com/CVE-2026-28252/): Use of a Broken or Risky Cryptographic Algorithm vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge (critical 9.2)
- [CVE-2026-2825](https://insights.sbomify.com/CVE-2026-2825/): rachelos WeRSS we-mp-rss Article fix.py fix_html cross site scripting (medium 5.1)
- [CVE-2026-2824](https://insights.sbomify.com/CVE-2026-2824/): Comfast CF-E7 webmggnt mbox-config sub_441CF4 command injection (medium 5.3)
- [CVE-2026-28237](https://insights.sbomify.com/CVE-2026-28237/): Denial of service in AMD µProf (medium 6.8)
- [CVE-2026-28231](https://insights.sbomify.com/CVE-2026-28231/): pillow_heif Has Integer Overflow in Encode Path Buffer Validation that Leads to Heap Out-of-Bounds Read (medium 5.5)
- [CVE-2026-28230](https://insights.sbomify.com/CVE-2026-28230/): Missing authorization in steve (medium 5.7)
- [CVE-2026-2823](https://insights.sbomify.com/CVE-2026-2823/): Comfast CF-E7 webmggnt mbox-config sub_41ACCC command injection (medium 5.3)
- [CVE-2026-28229](https://insights.sbomify.com/CVE-2026-28229/): Argo Workflows has unauthorized access to Argo Workflows Template (critical 9.8)
- [CVE-2026-28228](https://insights.sbomify.com/CVE-2026-28228/): OpenOLAT: Server-Side Template Injection (SSTI) in Velocity templates allows Remote Code Execution (high 8.8)
- [CVE-2026-28227](https://insights.sbomify.com/CVE-2026-28227/): Discourse Vulnerable to Unauthorized Topic Creation in Staff-Only Categories via Topic Timer publish_to_category (low 1.2)
- [CVE-2026-28226](https://insights.sbomify.com/CVE-2026-28226/): Phishing Club has Authenticated Blind SQL Injection in GetOrphaned Recipient Listing (medium 6.5)
- [CVE-2026-28225](https://insights.sbomify.com/CVE-2026-28225/): Manyfold has IDOR in ModelFilesController (medium 5.3)
- [CVE-2026-28224](https://insights.sbomify.com/CVE-2026-28224/): Firebird Null Pointer Dereference via CryptCallback causes DOS (high 8.2)
- [CVE-2026-28223](https://insights.sbomify.com/CVE-2026-28223/): Wagtail: Improper escaping of HTML (Cross-site Scripting) in simple_translation admin interface (medium 6.1)
- [CVE-2026-28222](https://insights.sbomify.com/CVE-2026-28222/): Wagtail: Improper escaping of HTML (Cross-site Scripting) on TableBlock class attributes (medium 6.1)
- [CVE-2026-28221](https://insights.sbomify.com/CVE-2026-28221/): Wazuh: Pre-auth stack-based buffer overflow in wazuh-remoted print_hex_string() due to signed char promotion on x86_64 (medium 6.5)
- [CVE-2026-28220](https://insights.sbomify.com/CVE-2026-28220/): Deserialization in wazuh (high 8.4)
- [CVE-2026-2822](https://insights.sbomify.com/CVE-2026-2822/): JeecgBoot Backend airag_app,1,create_by sql injection (medium 5.3)
- [CVE-2026-28219](https://insights.sbomify.com/CVE-2026-28219/): Privilege Escalation via Mass Assignment Allows Regular Users to Set Topics as Global Banners (low 1.3)
- [CVE-2026-28218](https://insights.sbomify.com/CVE-2026-28218/): Discourse's Fail-Open Access Control in Data Explorer Plugin Allows Unauthorized SQL Query Execution (medium 5.3)
- [CVE-2026-28217](https://insights.sbomify.com/CVE-2026-28217/): IDOR in GraphQL userCollection Query Exposes Other Users' Private Collections (medium 6.5)
- [CVE-2026-28216](https://insights.sbomify.com/CVE-2026-28216/): hoppscotch has IDOR in updateUserEnvironment / deleteUserEnvironment (high 8.3)
- [CVE-2026-28215](https://insights.sbomify.com/CVE-2026-28215/): hoppscotch Vulnerable to Unauthenticated Onboarding Config Takeover (critical 9.1)
- [CVE-2026-28214](https://insights.sbomify.com/CVE-2026-28214/): Firebird server hangs when using specific clumplet on batch creation (medium 6.0)
- [CVE-2026-28213](https://insights.sbomify.com/CVE-2026-28213/): EverShop Vulnerable to Arbitrary Customer Account Takeover via Exposure of Password Reset Token in API Response (critical 9.8)
- [CVE-2026-28212](https://insights.sbomify.com/CVE-2026-28212/): Firebird has potential server crash via null pointer dereference when processing op_slice packet (high 7.5)
- [CVE-2026-28211](https://insights.sbomify.com/CVE-2026-28211/): Arbitrary code execution in log reader via untrusted log file (high 7.8)
- [CVE-2026-28210](https://insights.sbomify.com/CVE-2026-28210/): FreePBX: Authenticated SQL Injection in CDR (Call Data Record) Reports (high 8.6)
- [CVE-2026-2821](https://insights.sbomify.com/CVE-2026-2821/): Fujian Smart Integrated Management Platform System XCamera.ashx sql injection (medium 6.9)
- [CVE-2026-28209](https://insights.sbomify.com/CVE-2026-28209/): FreePBX: Command Injection leading to Remote Code Execution in FreePBX ElevenLabs Text-to-Speech integration (high 7.5)
- [CVE-2026-28208](https://insights.sbomify.com/CVE-2026-28208/): Junrar has arbitrary file write due to backslash path traversal bypass in LocalFolderExtractor on Linux/Unix (medium 5.9)
- [CVE-2026-28207](https://insights.sbomify.com/CVE-2026-28207/): Zen-C Vulnerable to Command Injection via Malicious Output Filename (medium 6.6)
- [CVE-2026-28205](https://insights.sbomify.com/CVE-2026-28205/): Initialization of a resource with an insecure default in OpenPLC_V3 (critical 9.2)
- [CVE-2026-28204](https://insights.sbomify.com/CVE-2026-28204/): CTEK Chargeportal Insufficiently Protected Credentials (medium 6.9)
- [CVE-2026-28201](https://insights.sbomify.com/CVE-2026-28201/): SurrealDB Injection on Open Notebook (high 8.7)
- [CVE-2026-2820](https://insights.sbomify.com/CVE-2026-2820/): Fujian Smart Integrated Management Platform System XAccessPermissionPlus.ashx sql injection (medium 6.9)
- [CVE-2026-28199](https://insights.sbomify.com/CVE-2026-28199/): Sensitive File Disclosure via Relative Path Traversal in NetBackup Flex OS Shell (medium 4.8)
- [CVE-2026-28198](https://insights.sbomify.com/CVE-2026-28198/): Privilege Escalation via Cryptographic Signature Verification Bypass in NetBackup Flex OS Shell (critical 9.4)
- [CVE-2026-28197](https://insights.sbomify.com/CVE-2026-28197/): Privilege Escalation via Argument Injection in NetBackup Flex OS Shell (critical 9.4)
- [CVE-2026-28196](https://insights.sbomify.com/CVE-2026-28196/): Information disclosure in TeamCity (low 2.3)
- [CVE-2026-28195](https://insights.sbomify.com/CVE-2026-28195/): Missing authorization in TeamCity (medium 4.3)
- [CVE-2026-28194](https://insights.sbomify.com/CVE-2026-28194/): Open redirect in TeamCity (medium 4.3)
- [CVE-2026-28193](https://insights.sbomify.com/CVE-2026-28193/): Missing authorization in YouTrack (high 8.8)
- [CVE-2026-28192](https://insights.sbomify.com/CVE-2026-28192/): WordPress Piotnet Addons For Elementor Pro plugin <= 7.1.67 - Arbitrary File Upload vulnerability (critical 9.6)
- [CVE-2026-28191](https://insights.sbomify.com/CVE-2026-28191/): WordPress The Grid plugin <= 2.8.0 - Privilege Escalation vulnerability (high 8.8)
- [CVE-2026-28190](https://insights.sbomify.com/CVE-2026-28190/): WordPress ProLancer Element plugin <= 1.4.8 - Broken Access Control vulnerability (high 7.1)
- [CVE-2026-2819](https://insights.sbomify.com/CVE-2026-2819/): Dromara RuoYi-Vue-Plus Workflow deleteByInstanceIds SaServletFilter authorization (medium 5.3)
- [CVE-2026-28189](https://insights.sbomify.com/CVE-2026-28189/): WordPress Participants Database plugin <= 2.7.8.4 - Arbitrary File Deletion vulnerability (high 7.4)
- [CVE-2026-28188](https://insights.sbomify.com/CVE-2026-28188/): WordPress Hydra Booking plugin <= 1.2.2 - Broken Access Control vulnerability (high 7.3)
- [CVE-2026-28187](https://insights.sbomify.com/CVE-2026-28187/): Cross-site scripting in Knowledge Base for Documentation, FAQs with AI Assistance (high 7.1)
- [CVE-2026-28186](https://insights.sbomify.com/CVE-2026-28186/): WordPress Travelfic Toolkit plugin <= 1.5.1 - Broken Access Control vulnerability (high 8.1)
- [CVE-2026-28185](https://insights.sbomify.com/CVE-2026-28185/): WordPress Log in with Google plugin <= 1.4.2 - Broken Authentication vulnerability (critical 9.8)
- [CVE-2026-28183](https://insights.sbomify.com/CVE-2026-28183/): WordPress PublishPress Capabilities plugin <= 2.45.0 - Privilege Escalation vulnerability (high 7.2)
- [CVE-2026-28182](https://insights.sbomify.com/CVE-2026-28182/): WordPress AcyMailing SMTP Newsletter plugin <= 10.11.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-28181](https://insights.sbomify.com/CVE-2026-28181/): WordPress AcyMailing SMTP Newsletter plugin <= 10.11.1 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-28180](https://insights.sbomify.com/CVE-2026-28180/): Missing authorization in Mercado Pago payments for WooCommerce (medium 5.3)
- [CVE-2026-2818](https://insights.sbomify.com/CVE-2026-2818/): Zip Slip Path Traversal in Snapshot Archive Extraction (Windows-Specific) (high 8.2)
- [CVE-2026-28179](https://insights.sbomify.com/CVE-2026-28179/): WordPress FiboSearch plugin <= 1.33.0 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2026-28178](https://insights.sbomify.com/CVE-2026-28178/): WordPress Powerkit plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-28177](https://insights.sbomify.com/CVE-2026-28177/): WordPress Popup Maker plugin <= 1.23.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-28176](https://insights.sbomify.com/CVE-2026-28176/): WordPress Booking Activities plugin <= 1.18.4 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-28175](https://insights.sbomify.com/CVE-2026-28175/): WordPress Visitors Traffic Real Time Statistics plugin <= 8.11 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-28174](https://insights.sbomify.com/CVE-2026-28174/): WordPress WP Event SOlution plugin <= 4.1.18 - Sensitive Data Exposure vulnerability (medium 6.5)
- [CVE-2026-28173](https://insights.sbomify.com/CVE-2026-28173/): WordPress WP Event SOlution plugin <= 4.1.19 - Arbitrary Content Deletion vulnerability (high 7.1)
- [CVE-2026-28172](https://insights.sbomify.com/CVE-2026-28172/): WordPress Tracking Code Manager plugin <= 2.6.0 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2026-28171](https://insights.sbomify.com/CVE-2026-28171/): WordPress WooCommerce File Approval plugin <= 10.7 - Arbitrary File Deletion vulnerability (high 8.6)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/747/