# Vulnerabilities published in 2026


- [CVE-2026-27470](https://insights.sbomify.com/CVE-2026-27470/): ZoneMinder: Second-Order SQL Injection in `getNearEvents()` via Stored Event Name and Cause Fields (high 8.8)
- [CVE-2026-2747](https://insights.sbomify.com/CVE-2026-2747/): PGP Mixed Plaintext and Encrypted Content (medium 6.9)
- [CVE-2026-27469](https://insights.sbomify.com/CVE-2026-27469/): Isso: Stored XSS via comment website field (medium 6.1)
- [CVE-2026-27468](https://insights.sbomify.com/CVE-2026-27468/): Mastodon may allow unconfirmed FASP to make subscriptions (medium 4.8)
- [CVE-2026-27467](https://insights.sbomify.com/CVE-2026-27467/): BigBlueButton: Audio from participants to the server initially unmuted (low 2.0)
- [CVE-2026-27466](https://insights.sbomify.com/CVE-2026-27466/): BigBlueButton: Exposed ClamAV port enables Denial of Service (high 7.2)
- [CVE-2026-27465](https://insights.sbomify.com/CVE-2026-27465/): Fleet: Sensitive Google Calendar credentials disclosed to low-privileged users (low 1.3)
- [CVE-2026-27464](https://insights.sbomify.com/CVE-2026-27464/): Metabase: Server-Side Template Injection via Notifications Endpoint Leads to RCE (high 7.7)
- [CVE-2026-27463](https://insights.sbomify.com/CVE-2026-27463/): Combodo iTop: Version disclosure via login page logo (medium 5.3)
- [CVE-2026-27462](https://insights.sbomify.com/CVE-2026-27462/): Combodo iTop: User enumeration via password reset (high 7.5)
- [CVE-2026-27461](https://insights.sbomify.com/CVE-2026-27461/): Pimcore vulnerable to SQL injection via unsanitized filter value in Dependency Dao RLIKE clause (medium 6.9)
- [CVE-2026-27460](https://insights.sbomify.com/CVE-2026-27460/): Tandoor Recipes Affected by Denial of Service via Recipe Import (medium 6.5)
- [CVE-2026-2746](https://insights.sbomify.com/CVE-2026-2746/): Missing PGP Signature Tag (medium 6.9)
- [CVE-2026-27459](https://insights.sbomify.com/CVE-2026-27459/): pyOpenSSL DTLS cookie callback buffer overflow (high 7.2)
- [CVE-2026-27458](https://insights.sbomify.com/CVE-2026-27458/): LinkAce: Stored XSS in Atom Feed via CDATA Escape in List Description (high 8.7)
- [CVE-2026-27457](https://insights.sbomify.com/CVE-2026-27457/): Weblate: Missing access control for the AddonViewSet API exposes all addon configurations (medium 4.3)
- [CVE-2026-27456](https://insights.sbomify.com/CVE-2026-27456/): util-linux: TOCTOU Race Condition in util-linux mount(8) - Loop Device Setup (medium 4.7)
- [CVE-2026-27454](https://insights.sbomify.com/CVE-2026-27454/): Discourse has check revision visibility on posts endpoint (medium 5.3)
- [CVE-2026-27452](https://insights.sbomify.com/CVE-2026-27452/): ASN.1 TypeScript Library: Decoding an INTEGER could leak the underlying ArrayBuffer (critical 9.2)
- [CVE-2026-2745](https://insights.sbomify.com/CVE-2026-2745/): Authentication Bypass Using an Alternate Path or Channel in GitLab (medium 6.8)
- [CVE-2026-27449](https://insights.sbomify.com/CVE-2026-27449/): Umbraco.Engage.Forms Allows Unauthorized Access to Multiple API Endpoints (high 7.5)
- [CVE-2026-27448](https://insights.sbomify.com/CVE-2026-27448/): pyOpenSSL allows TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback (low 1.7)
- [CVE-2026-27447](https://insights.sbomify.com/CVE-2026-27447/): OpenPrinting CUPS: Authorization bypass via case-insensitive group-member lookup (medium 4.8)
- [CVE-2026-27446](https://insights.sbomify.com/CVE-2026-27446/): Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation (critical 9.3)
- [CVE-2026-27445](https://insights.sbomify.com/CVE-2026-27445/): PGP Signature Reflection (medium 6.9)
- [CVE-2026-27444](https://insights.sbomify.com/CVE-2026-27444/): Header Email Address Parsing (high 7.8)
- [CVE-2026-27443](https://insights.sbomify.com/CVE-2026-27443/): S/MIME Decryption Tag Sanitization Bypass (high 8.2)
- [CVE-2026-27442](https://insights.sbomify.com/CVE-2026-27442/): zip_attachments Path Traversal (critical 9.3)
- [CVE-2026-27441](https://insights.sbomify.com/CVE-2026-27441/): PDF Password CMDi (critical 9.5)
- [CVE-2026-27440](https://insights.sbomify.com/CVE-2026-27440/): WordPress myCred plugin <= 2.9.7.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-27439](https://insights.sbomify.com/CVE-2026-27439/): WordPress Dentario theme <= 1.5 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-27438](https://insights.sbomify.com/CVE-2026-27438/): WordPress Kingler theme <= 1.7 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-27437](https://insights.sbomify.com/CVE-2026-27437/): WordPress Tennis Club theme <= 1.2.3 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-27436](https://insights.sbomify.com/CVE-2026-27436/): WordPress Five Star Business Profile and Schema plugin <= 2.3.19 - Arbitrary Code Execution vulnerability (critical 9.1)
- [CVE-2026-27435](https://insights.sbomify.com/CVE-2026-27435/): WordPress Woffice theme < 5.4.33 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-27434](https://insights.sbomify.com/CVE-2026-27434/): WordPress WP Rentals theme <= 3.14.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-27433](https://insights.sbomify.com/CVE-2026-27433/): WordPress Motors theme < 5.6.85 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-27432](https://insights.sbomify.com/CVE-2026-27432/): WordPress WP Rentals theme < 3.16.0 - Insecure Direct Object References (IDOR) vulnerability (medium 5.4)
- [CVE-2026-27430](https://insights.sbomify.com/CVE-2026-27430/): WordPress TheFox theme <= 3.9.76 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-2743](https://insights.sbomify.com/CVE-2026-2743/): SEPPmail User Web Interface Arbitrary File Write to RCE (critical 10.0)
- [CVE-2026-27429](https://insights.sbomify.com/CVE-2026-27429/): WordPress Nifty theme <= 1.4.1 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-27428](https://insights.sbomify.com/CVE-2026-27428/): WordPress Eagle Booking plugin <= 1.3.4.3 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-27427](https://insights.sbomify.com/CVE-2026-27427/): WordPress Geo Mashup plugin <= 1.13.18 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-27426](https://insights.sbomify.com/CVE-2026-27426/): WordPress Automotive Car Dealership Business theme <= 13.3.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-27425](https://insights.sbomify.com/CVE-2026-27425/): WordPress Automotive Listings plugin <= 18.6 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-27424](https://insights.sbomify.com/CVE-2026-27424/): WordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.11 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-27423](https://insights.sbomify.com/CVE-2026-27423/): WordPress Participants Database plugin <= 2.7.8.4 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-27422](https://insights.sbomify.com/CVE-2026-27422/): WordPress YT Player plugin <= 2.1.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-27421](https://insights.sbomify.com/CVE-2026-27421/): WordPress Royal Elementor Addons plugin < 1.7.1053 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-27420](https://insights.sbomify.com/CVE-2026-27420/): WordPress Zotpress plugin <= 7.4.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-2742](https://insights.sbomify.com/CVE-2026-2742/): Unauthorized session creation via reserved framework path access (medium 5.3)
- [CVE-2026-27419](https://insights.sbomify.com/CVE-2026-27419/): WordPress Zegen theme <= 1.1.9 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2026-27418](https://insights.sbomify.com/CVE-2026-27418/): WordPress WP Fast Total Search plugin <= 1.81.282 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-27417](https://insights.sbomify.com/CVE-2026-27417/): WordPress Sweet Date theme < 4.0.1 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-27416](https://insights.sbomify.com/CVE-2026-27416/): WordPress PDF Poster plugin <= 2.4.1 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-27415](https://insights.sbomify.com/CVE-2026-27415/): WordPress BEAR plugin <= 1.1.5 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2026-27414](https://insights.sbomify.com/CVE-2026-27414/): WordPress Werkstatt theme <= 4.8.3 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-27413](https://insights.sbomify.com/CVE-2026-27413/): WordPress Profile Builder Pro plugin < 3.14.0 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-27412](https://insights.sbomify.com/CVE-2026-27412/): WordPress Pearl - Corporate Business theme <= 3.4.10 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-27411](https://insights.sbomify.com/CVE-2026-27411/): WordPress SiteGuard WP plugin plugin <= 1.7.9 - Captcha Bypass vulnerability (medium 5.4)
- [CVE-2026-27410](https://insights.sbomify.com/CVE-2026-27410/): WordPress Slimstat Analytics plugin < 5.4.0 - Deserialization of untrusted data vulnerability (medium 6.5)
- [CVE-2026-2741](https://insights.sbomify.com/CVE-2026-2741/): Zip Slip Path Traversal on Node Unpack (low 2.3)
- [CVE-2026-27409](https://insights.sbomify.com/CVE-2026-27409/): WordPress Webba Booking plugin <= 6.4.13 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-27408](https://insights.sbomify.com/CVE-2026-27408/): WordPress NativeChurch theme < 4.9.5 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-27407](https://insights.sbomify.com/CVE-2026-27407/): WordPress AI Engine plugin <= 3.4.9 - Privilege Escalation vulnerability (high 7.2)
- [CVE-2026-27406](https://insights.sbomify.com/CVE-2026-27406/): WordPress My Tickets plugin <= 2.1.0 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2026-27405](https://insights.sbomify.com/CVE-2026-27405/): WordPress WpBookingly plugin <= 1.2.9 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-27404](https://insights.sbomify.com/CVE-2026-27404/): WordPress LMS theme <= 9.7 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-27403](https://insights.sbomify.com/CVE-2026-27403/): WordPress Hubbub Lite plugin <= 1.36.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-27402](https://insights.sbomify.com/CVE-2026-27402/): WordPress Kids Life | Children School WordPress theme <= 5.2 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-27401](https://insights.sbomify.com/CVE-2026-27401/): WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.62.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-27400](https://insights.sbomify.com/CVE-2026-27400/): WordPress BookPro plugin <= 1.1.0 - Arbitrary File Deletion vulnerability (high 8.6)
- [CVE-2026-2740](https://insights.sbomify.com/CVE-2026-2740/): Remote Code Execution (high 8.4)
- [CVE-2026-27399](https://insights.sbomify.com/CVE-2026-27399/): WordPress MarketKing plugin <= 2.1.40 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-27398](https://insights.sbomify.com/CVE-2026-27398/): WordPress RSVP and Event Management plugin <= 2.7.16 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-27397](https://insights.sbomify.com/CVE-2026-27397/): WordPress Really Simple Security Pro plugin <= 9.5.4.0 - Insecure Direct Object References (IDOR) vulnerability (medium 6.5)
- [CVE-2026-27396](https://insights.sbomify.com/CVE-2026-27396/): WordPress Directory Pro plugin <= 2.5.6 - Broken Access Control vulnerability (high 7.3)
- [CVE-2026-27395](https://insights.sbomify.com/CVE-2026-27395/): WordPress Support Board plugin < 3.8.9 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2026-27394](https://insights.sbomify.com/CVE-2026-27394/): WordPress Eventer plugin <= 0.1.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-27393](https://insights.sbomify.com/CVE-2026-27393/): WordPress CF7 WOW Styler plugin <= 1.7.6 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-27392](https://insights.sbomify.com/CVE-2026-27392/): WordPress uListing plugin <= 2.2.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-27391](https://insights.sbomify.com/CVE-2026-27391/): WordPress uListing plugin <= 2.2.0 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-27390](https://insights.sbomify.com/CVE-2026-27390/): WordPress WeDesignTech Ultimate Booking Addon plugin <= 1.0.1 - Account Takeover vulnerability (high 8.8)
- [CVE-2026-2739](https://insights.sbomify.com/CVE-2026-2739/): bn.js affected by an infinite loop (medium 6.9)
- [CVE-2026-27389](https://insights.sbomify.com/CVE-2026-27389/): WordPress WeDesignTech Ultimate Booking Addon plugin <= 1.0.1 - Account Takeover vulnerability (critical 9.8)
- [CVE-2026-27388](https://insights.sbomify.com/CVE-2026-27388/): WordPress DesignThemes Booking Manager plugin <= 2.0 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-27387](https://insights.sbomify.com/CVE-2026-27387/): WordPress DirectoryPress plugin <= 3.6.26 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-27386](https://insights.sbomify.com/CVE-2026-27386/): WordPress DesignThemes Directory Addon plugin <= 1.8 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-27385](https://insights.sbomify.com/CVE-2026-27385/): WordPress DesignThemes Portfolio plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-27384](https://insights.sbomify.com/CVE-2026-27384/): WordPress W3 Total Cache plugin <= 2.9.1 - Arbitrary Code Execution vulnerability (critical 9.0)
- [CVE-2026-27383](https://insights.sbomify.com/CVE-2026-27383/): WordPress Metro theme <= 2.13 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-27382](https://insights.sbomify.com/CVE-2026-27382/): WordPress Metro theme <= 2.13 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-27381](https://insights.sbomify.com/CVE-2026-27381/): WordPress Aora theme <= 1.3.15 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-27380](https://insights.sbomify.com/CVE-2026-27380/): WordPress Car Rental Manager plugin <= 1.3.9 - PHP Object Injection vulnerability (high 7.2)
- [CVE-2026-2738](https://insights.sbomify.com/CVE-2026-2738/): Memory corruption in ovpn-dco-win (medium 5.6)
- [CVE-2026-27379](https://insights.sbomify.com/CVE-2026-27379/): WordPress NextScripts plugin <= 4.4.7 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-27378](https://insights.sbomify.com/CVE-2026-27378/): WordPress Deposits and Partial Payments for WooCommerce plugin <= 3.1.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-27377](https://insights.sbomify.com/CVE-2026-27377/): WordPress QuickCal - Appointment Booking Calendar for WordPress plugin <= 1.0.16 - Broken Access Control vulnerability (medium 6.7)
- [CVE-2026-27376](https://insights.sbomify.com/CVE-2026-27376/): Cross-site scripting in Claue - Clean, Minimal Elementor WooCommerce Theme (high 7.1)
- [CVE-2026-27375](https://insights.sbomify.com/CVE-2026-27375/): WordPress Gecko theme <= 1.9.8 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/755/