# Vulnerabilities published in 2026


- [CVE-2026-27985](https://insights.sbomify.com/CVE-2026-27985/): WordPress Humanum theme <= 1.1.4 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-27984](https://insights.sbomify.com/CVE-2026-27984/): WordPress Widget Options plugin <= 4.1.3 - Remote Code Execution (RCE) vulnerability (critical 9.0)
- [CVE-2026-27983](https://insights.sbomify.com/CVE-2026-27983/): WordPress LMS Elementor Pro plugin <= 1.0.4 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2026-27982](https://insights.sbomify.com/CVE-2026-27982/): django-allauth has an open redirect vulnerability (medium 5.1)
- [CVE-2026-27981](https://insights.sbomify.com/CVE-2026-27981/): HomeBox has an Auth Rate Limit Bypass via IP Spoofing (high 7.4)
- [CVE-2026-27980](https://insights.sbomify.com/CVE-2026-27980/): Next.js: Unbounded next/image disk cache growth can exhaust storage (medium 6.9)
- [CVE-2026-2798](https://insights.sbomify.com/CVE-2026-2798/): Use-after-free in the DOM: Core & HTML component (high 8.8)
- [CVE-2026-27979](https://insights.sbomify.com/CVE-2026-27979/): Next.js: Unbounded postponed resume buffering can lead to DoS (medium 6.9)
- [CVE-2026-27978](https://insights.sbomify.com/CVE-2026-27978/): Next.js: null origin can bypass Server Actions CSRF checks (medium 5.3)
- [CVE-2026-27977](https://insights.sbomify.com/CVE-2026-27977/): Next.js: null origin can bypass dev HMR websocket CSRF checks (low 2.3)
- [CVE-2026-27976](https://insights.sbomify.com/CVE-2026-27976/): Zed Extension Sandbox Escape via Tar Symlink Following (high 8.8)
- [CVE-2026-27975](https://insights.sbomify.com/CVE-2026-27975/): Ajenti has a potential Remote Code Execution (high 8.1)
- [CVE-2026-27974](https://insights.sbomify.com/CVE-2026-27974/): Audiobooksheld VUlnerable to Stored XSS in WrappingMarquee.js via Audiobook Metadata (Mobile App Audio Player) (medium 4.8)
- [CVE-2026-27973](https://insights.sbomify.com/CVE-2026-27973/): Audiobookshelf has Stored XSS in ItemSearchCard.vue via Audiobook Metadata (Search Results on Mobile App) (medium 4.0)
- [CVE-2026-27971](https://insights.sbomify.com/CVE-2026-27971/): Qwik affected by unauthenticated RCE via server$ Deserialization (critical 9.2)
- [CVE-2026-27970](https://insights.sbomify.com/CVE-2026-27970/): Angular i18n vulnerable to Cross-Site Scripting (XSS) (high 7.6)
- [CVE-2026-2797](https://insights.sbomify.com/CVE-2026-2797/): Use-after-free in the JavaScript: GC component (high 8.8)
- [CVE-2026-27969](https://insights.sbomify.com/CVE-2026-27969/): Vitess users with backup storage access can write to arbitrary file paths on restore (critical 9.3)
- [CVE-2026-27968](https://insights.sbomify.com/CVE-2026-27968/): Packistry accepts expired access tokens (medium 4.3)
- [CVE-2026-27967](https://insights.sbomify.com/CVE-2026-27967/): Symlink Escape in Agent File Tools (high 7.1)
- [CVE-2026-27966](https://insights.sbomify.com/CVE-2026-27966/): Langflow has Remote Code Execution in CSV Agent (critical 9.8)
- [CVE-2026-27965](https://insights.sbomify.com/CVE-2026-27965/): Vitess users with backup storage access can gain unauthorized access to production deployment environments (high 8.4)
- [CVE-2026-27964](https://insights.sbomify.com/CVE-2026-27964/): FacturaScripts: Reflected Cross-Site Scripting (XSS) via Cookie Manipulation (low 3.9)
- [CVE-2026-27963](https://insights.sbomify.com/CVE-2026-27963/): Audiobookshelf has Stored XSS in Tooltip.vue via Audiobook Metadata (medium 4.8)
- [CVE-2026-27962](https://insights.sbomify.com/CVE-2026-27962/): Authlib JWS JWK Header Injection: Signature Verification Bypass (critical 9.1)
- [CVE-2026-27961](https://insights.sbomify.com/CVE-2026-27961/): Agenta's Server-Side Template Injection (SSTI) via custom evaluator Jinja2 templates allows RCE (high 8.8)
- [CVE-2026-27960](https://insights.sbomify.com/CVE-2026-27960/): OpenCTI privilege escalation and unauthenticated access via default admin account (critical 9.8)
- [CVE-2026-2796](https://insights.sbomify.com/CVE-2026-2796/): JIT miscompilation in the JavaScript: WebAssembly component (critical 9.8)
- [CVE-2026-27959](https://insights.sbomify.com/CVE-2026-27959/): Koa has Host Header Injection via `ctx.hostname` (high 7.5)
- [CVE-2026-27957](https://insights.sbomify.com/CVE-2026-27957/): Coolify: Authenticated RCE via command injection in CA certificate management feature (high 8.8)
- [CVE-2026-27956](https://insights.sbomify.com/CVE-2026-27956/): Coolify: Cross-team application domain enumeration via domains_by_server endpoint (medium 4.3)
- [CVE-2026-27955](https://insights.sbomify.com/CVE-2026-27955/): Coolify: Command Injection via Single-Quote Breakout in `executeInDocker()` (medium 6.6)
- [CVE-2026-27954](https://insights.sbomify.com/CVE-2026-27954/): LiveHelperChat has department-level authorization bypass in holdaction, blockuser, and transferchat endpoints (medium 4.9)
- [CVE-2026-27953](https://insights.sbomify.com/CVE-2026-27953/): ormar has a Pydantic Validation Bypass via Kwargs Injection in Model Constructor (high 7.1)
- [CVE-2026-27952](https://insights.sbomify.com/CVE-2026-27952/): Agenta has Python Sandbox Escape, Leading to Remote Code Execution (RCE) (high 8.8)
- [CVE-2026-27951](https://insights.sbomify.com/CVE-2026-27951/): FreeRDP has possible Integer overflow in Stream_EnsureCapacity (medium 5.3)
- [CVE-2026-27950](https://insights.sbomify.com/CVE-2026-27950/): FreeRDP heap-use-after-free in update_pointer_new(SDL): Fix Applied in the Wrong File (medium 5.5)
- [CVE-2026-2795](https://insights.sbomify.com/CVE-2026-2795/): Use-after-free in the JavaScript: GC component (high 8.8)
- [CVE-2026-27949](https://insights.sbomify.com/CVE-2026-27949/): Plane Exposes User Email (PII and part of credential) in GET Parameter (low 2.0)
- [CVE-2026-27948](https://insights.sbomify.com/CVE-2026-27948/): Copyparty vulnerable to eflected cross-site scripting via setck parameter (medium 5.4)
- [CVE-2026-27947](https://insights.sbomify.com/CVE-2026-27947/): Group-Office Vulnerable to Remote Code Execution (RCE) (critical 9.4)
- [CVE-2026-27946](https://insights.sbomify.com/CVE-2026-27946/): ZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser API (high 8.2)
- [CVE-2026-27945](https://insights.sbomify.com/CVE-2026-27945/): ZITADEL has potential SSRF via Actions (low 2.1)
- [CVE-2026-27944](https://insights.sbomify.com/CVE-2026-27944/): Nginx UI: Unauthenticated Backup Download with Encryption Key Disclosure (critical 9.8)
- [CVE-2026-27943](https://insights.sbomify.com/CVE-2026-27943/): OpenEMR's Eye Exam View Trusts form_id Without Verifying Patient/Encounter Ownership (medium 6.5)
- [CVE-2026-27942](https://insights.sbomify.com/CVE-2026-27942/): fast-xml-parser has stack overflow in XMLBuilder with preserveOrder (low 2.7)
- [CVE-2026-27941](https://insights.sbomify.com/CVE-2026-27941/): Code injection in openlit (critical 10.0)
- [CVE-2026-27940](https://insights.sbomify.com/CVE-2026-27940/): llama.cpp has a Heap Buffer Overflow via Integer Overflow in `mem_size` Calculation — Bypass of CVE-2025-53630 Fix (high 7.8)
- [CVE-2026-2794](https://insights.sbomify.com/CVE-2026-2794/): Information disclosure due to uninitialized memory in Firefox and Firefox Focus for Android (medium 6.5)
- [CVE-2026-27939](https://insights.sbomify.com/CVE-2026-27939/): Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypass (high 8.8)
- [CVE-2026-27938](https://insights.sbomify.com/CVE-2026-27938/): WPGraphQL Repo Vulnerable to Command Injection via Unsanitized GitHub Actions Expression in Release Workflow (high 7.7)
- [CVE-2026-27937](https://insights.sbomify.com/CVE-2026-27937/): October: Reflected XSS via DataTable Form Widget (low 3.1)
- [CVE-2026-27936](https://insights.sbomify.com/CVE-2026-27936/): Discourse discloses restricted post-action counts to non-privileged users (medium 6.9)
- [CVE-2026-27935](https://insights.sbomify.com/CVE-2026-27935/): Discourse leaks private topic metadata to non-authorized users (medium 6.9)
- [CVE-2026-27934](https://insights.sbomify.com/CVE-2026-27934/): Discourse leaks private topic title and post excerpt via user action API endpoint (high 8.7)
- [CVE-2026-27933](https://insights.sbomify.com/CVE-2026-27933/): Manyfold vulnerable to session hijack via cookie leakage in proxy caches (medium 6.8)
- [CVE-2026-27932](https://insights.sbomify.com/CVE-2026-27932/): joserfc PBES2 p2c Unbounded Iteration Count enables Denial of Service (DoS) (high 7.5)
- [CVE-2026-27931](https://insights.sbomify.com/CVE-2026-27931/): Windows GDI Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-27930](https://insights.sbomify.com/CVE-2026-27930/): Windows GDI Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-2793](https://insights.sbomify.com/CVE-2026-2793/): Memory corruption in Firefox (critical 9.8)
- [CVE-2026-27929](https://insights.sbomify.com/CVE-2026-27929/): Windows LUA File Virtualization Filter Driver Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-27928](https://insights.sbomify.com/CVE-2026-27928/): Windows Hello Security Feature Bypass Vulnerability (high 8.7)
- [CVE-2026-27927](https://insights.sbomify.com/CVE-2026-27927/): Windows Projected File System Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-27926](https://insights.sbomify.com/CVE-2026-27926/): Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-27925](https://insights.sbomify.com/CVE-2026-27925/): Windows UPnP Device Host Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-27924](https://insights.sbomify.com/CVE-2026-27924/): Desktop Window Manager Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-27923](https://insights.sbomify.com/CVE-2026-27923/): Desktop Window Manager Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-27922](https://insights.sbomify.com/CVE-2026-27922/): Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-27921](https://insights.sbomify.com/CVE-2026-27921/): Windows TDI Translation Driver (tdx.sys) Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-27920](https://insights.sbomify.com/CVE-2026-27920/): Windows UPnP Device Host Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-2792](https://insights.sbomify.com/CVE-2026-2792/): Memory safety bugs fixed in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148 (critical 9.8)
- [CVE-2026-27919](https://insights.sbomify.com/CVE-2026-27919/): Windows UPnP Device Host Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-27918](https://insights.sbomify.com/CVE-2026-27918/): Windows Shell Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-27917](https://insights.sbomify.com/CVE-2026-27917/): Windows WFP NDIS Lightweight Filter Driver (wfplwfs.sys) Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-27916](https://insights.sbomify.com/CVE-2026-27916/): Windows UPnP Device Host Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-27915](https://insights.sbomify.com/CVE-2026-27915/): Windows UPnP Device Host Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-27914](https://insights.sbomify.com/CVE-2026-27914/): Microsoft Management Console Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-27913](https://insights.sbomify.com/CVE-2026-27913/): Windows BitLocker Security Feature Bypass Vulnerability (high 7.7)
- [CVE-2026-27912](https://insights.sbomify.com/CVE-2026-27912/): Windows Kerberos Elevation of Privilege Vulnerability (high 8.0)
- [CVE-2026-27911](https://insights.sbomify.com/CVE-2026-27911/): Windows User Interface Core Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-27910](https://insights.sbomify.com/CVE-2026-27910/): Windows Installer Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-2791](https://insights.sbomify.com/CVE-2026-2791/): Mitigation bypass in the Networking: Cache component (critical 9.8)
- [CVE-2026-27909](https://insights.sbomify.com/CVE-2026-27909/): Windows Search Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-27908](https://insights.sbomify.com/CVE-2026-27908/): Windows TDI Translation Driver (tdx.sys) Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-27907](https://insights.sbomify.com/CVE-2026-27907/): Windows Storage Spaces Controller Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-27906](https://insights.sbomify.com/CVE-2026-27906/): Windows Hello Security Feature Bypass Vulnerability (medium 4.4)
- [CVE-2026-27905](https://insights.sbomify.com/CVE-2026-27905/): BentoML has an Arbitrary File Write via Symlink Path Traversal in Tar Extraction (high 8.6)
- [CVE-2026-27904](https://insights.sbomify.com/CVE-2026-27904/): minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions (high 7.5)
- [CVE-2026-27903](https://insights.sbomify.com/CVE-2026-27903/): minimatch has a ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments (high 7.5)
- [CVE-2026-27902](https://insights.sbomify.com/CVE-2026-27902/): Svelte Vulnerable to XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers (medium 5.3)
- [CVE-2026-27901](https://insights.sbomify.com/CVE-2026-27901/): Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent` (medium 5.3)
- [CVE-2026-27900](https://insights.sbomify.com/CVE-2026-27900/): Terraform Provider Debug Logs Vulnerable to Sensitive Information Exposure (medium 5.0)
- [CVE-2026-2790](https://insights.sbomify.com/CVE-2026-2790/): Same-origin policy bypass in the Networking: JAR component (high 8.8)
- [CVE-2026-27899](https://insights.sbomify.com/CVE-2026-27899/): WireGuard Portal Vulnerable to Privilege Escalation to Admin via User Self-Update (high 8.8)
- [CVE-2026-27898](https://insights.sbomify.com/CVE-2026-27898/): Vaultwarden: Unauthorized Access via Partial Update API on Another User’s Cipher (medium 5.4)
- [CVE-2026-27897](https://insights.sbomify.com/CVE-2026-27897/): Vociferous Unauthenticated Remote Path Traversal (RCE via CSRF) (critical 10.0)
- [CVE-2026-27896](https://insights.sbomify.com/CVE-2026-27896/): MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity (high 7.0)
- [CVE-2026-27895](https://insights.sbomify.com/CVE-2026-27895/): LAM has incorrect regular expression in PDF export component that allows user to upload files of any type (medium 4.3)
- [CVE-2026-27894](https://insights.sbomify.com/CVE-2026-27894/): LAM has Authenticated Local File Inclusion (LFI) in PDF export (high 8.8)
- [CVE-2026-27893](https://insights.sbomify.com/CVE-2026-27893/): vLLM's hardcoded trust_remote_code=True in NemotronVL and KimiK25 bypasses user security opt-out (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/750/