# Vulnerabilities published in 2026


- [CVE-2026-27374](https://insights.sbomify.com/CVE-2026-27374/): WordPress WooCommerce Order Details plugin <= 3.1 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-27373](https://insights.sbomify.com/CVE-2026-27373/): WordPress Tablesome plugin <= 1.2.3 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-27372](https://insights.sbomify.com/CVE-2026-27372/): WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Sensitive Data Exposure vulnerability (medium 6.5)
- [CVE-2026-27371](https://insights.sbomify.com/CVE-2026-27371/): WordPress WPFunnels plugin <= 3.13.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-27370](https://insights.sbomify.com/CVE-2026-27370/): WordPress Chaty plugin <= 3.5.1 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2026-2737](https://insights.sbomify.com/CVE-2026-2737/): Possibility of unintended actions when an administrator clicks a malicious link in the Progress Flowmon web application (high 8.5)
- [CVE-2026-27369](https://insights.sbomify.com/CVE-2026-27369/): WordPress Celeste theme <= 1.3.6 - PHP Object Injection vulnerability (high 8.1)
- [CVE-2026-27368](https://insights.sbomify.com/CVE-2026-27368/): Missing authorization in Coming Soon Page, Under Construction & Maintenance Mode by SeedProd (medium 5.3)
- [CVE-2026-27367](https://insights.sbomify.com/CVE-2026-27367/): WordPress Musico theme < 3.4.5 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-27366](https://insights.sbomify.com/CVE-2026-27366/): WordPress MainWP Child plugin <= 6.1.1 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-27365](https://insights.sbomify.com/CVE-2026-27365/): WordPress PublishPress Series plugin <= 2.17.0 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2026-27364](https://insights.sbomify.com/CVE-2026-27364/): WordPress Style Kits plugin <= 2.6.5 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-27363](https://insights.sbomify.com/CVE-2026-27363/): WordPress WP Bakery Autoresponder Addon plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-27362](https://insights.sbomify.com/CVE-2026-27362/): WordPress WP Bakery Autoresponder Addon plugin <= 1.0.6 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-27361](https://insights.sbomify.com/CVE-2026-27361/): WordPress Responsive Posts Carousel Pro plugin <= 15.1 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-27360](https://insights.sbomify.com/CVE-2026-27360/): WordPress Photo Gallery by 10Web plugin <= 1.8.38 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2026-2736](https://insights.sbomify.com/CVE-2026-2736/): Reflected Cross-Site Scripting (XSS) vulnerability in Alkacon's OpenCms (medium 5.1)
- [CVE-2026-27359](https://insights.sbomify.com/CVE-2026-27359/): WordPress Awa Plugins plugin <= 1.4.4 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-27358](https://insights.sbomify.com/CVE-2026-27358/): WordPress Architecturer theme < 3.9.5 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-27357](https://insights.sbomify.com/CVE-2026-27357/): WordPress WP Search Analytics plugin < 1.5.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-27355](https://insights.sbomify.com/CVE-2026-27355/): WordPress Ditty plugin <= 3.1.66 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-27354](https://insights.sbomify.com/CVE-2026-27354/): WordPress WooCommerce Coming Soon Product with Countdown plugin <= 5.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-27353](https://insights.sbomify.com/CVE-2026-27353/): WordPress Grand News | Magazine Newspaper WordPress theme <= 3.4.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-27352](https://insights.sbomify.com/CVE-2026-27352/): WordPress Starto theme < 2.2.5 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-27351](https://insights.sbomify.com/CVE-2026-27351/): WordPress Crew HRM plugin <= 1.2.2 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-27350](https://insights.sbomify.com/CVE-2026-27350/): WordPress Builderius plugin <= 1.4-beta - Server Side Request Forgery (SSRF) vulnerability (high 7.2)
- [CVE-2026-2735](https://insights.sbomify.com/CVE-2026-2735/): Stored Cross-Site Scripting (XSS) vulnerability in Alkacon's OpenCms (medium 5.1)
- [CVE-2026-27349](https://insights.sbomify.com/CVE-2026-27349/): WordPress Mail Mint plugin <= 1.19.5 - Sensitive Data Exposure vulnerability (medium 4.3)
- [CVE-2026-27348](https://insights.sbomify.com/CVE-2026-27348/): WordPress Photography theme < 7.7.6 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-27347](https://insights.sbomify.com/CVE-2026-27347/): WordPress JetPopup plugin <= 2.0.20.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-27346](https://insights.sbomify.com/CVE-2026-27346/): WordPress B2BKing plugin < 5.2.10 - Broken Access Control vulnerability (medium 4.9)
- [CVE-2026-27345](https://insights.sbomify.com/CVE-2026-27345/): WordPress Taxi Booking Manager for WooCommerce plugin <= 2.0.3 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-27344](https://insights.sbomify.com/CVE-2026-27344/): WordPress inseri core plugin <= 1.0.5 - Broken Access Control vulnerability (medium 5.9)
- [CVE-2026-27343](https://insights.sbomify.com/CVE-2026-27343/): WordPress Airtifact theme <= 1.2.91 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-27342](https://insights.sbomify.com/CVE-2026-27342/): WordPress TopFit - Fitness and Gym WordPress Theme theme <= 1.9 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-27341](https://insights.sbomify.com/CVE-2026-27341/): WordPress TopScorer - Sports WordPress Theme theme <= 1.2 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-27340](https://insights.sbomify.com/CVE-2026-27340/): WordPress Apollo | Night Club, DJ Event WordPress Theme theme <= 1.3.1 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-2734](https://insights.sbomify.com/CVE-2026-2734/): Authorization Bypass in SearchModelVersions in mlflow/mlflow (medium 6.5)
- [CVE-2026-27339](https://insights.sbomify.com/CVE-2026-27339/): WordPress Buzz Stone | Magazine & Viral Blog WordPress Theme theme <= 1.0.2 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-27338](https://insights.sbomify.com/CVE-2026-27338/): WordPress Car Zone theme <= 3.7 - Deserialization of untrusted data vulnerability (high 8.8)
- [CVE-2026-27337](https://insights.sbomify.com/CVE-2026-27337/): WordPress Chronicle - Lifestyle Magazine & Blog WordPress Theme theme <= 1.0 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-27336](https://insights.sbomify.com/CVE-2026-27336/): Path traversal in Consultor | Consulting, Accounting & Legal Counsel WordPress Theme (high 8.1)
- [CVE-2026-27335](https://insights.sbomify.com/CVE-2026-27335/): WordPress Ekoterra - NonProfit, Green Energy & Ecology Theme theme <= 1.0.0 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-27334](https://insights.sbomify.com/CVE-2026-27334/): WordPress Alchemists theme <= 4.6.0 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-27333](https://insights.sbomify.com/CVE-2026-27333/): WordPress Paid Videochat Turnkey Site plugin <= 7.3.23 - Deserialization of untrusted data vulnerability (high 8.1)
- [CVE-2026-27332](https://insights.sbomify.com/CVE-2026-27332/): WordPress Agrofood theme < 1.4.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-27331](https://insights.sbomify.com/CVE-2026-27331/): WordPress WpTravelly plugin <= 2.1.5 - Broken Access Control vulnerability (medium 6.3)
- [CVE-2026-27330](https://insights.sbomify.com/CVE-2026-27330/): WordPress Mobile App for WooCommerce plugin <= 0.4.62 - Broken Access Control vulnerability (high 8.6)
- [CVE-2026-2733](https://insights.sbomify.com/CVE-2026-2733/): Org.keycloak/keycloak-services: keycloak: missing check on disabled client for docker registry protocol (low 3.8)
- [CVE-2026-27329](https://insights.sbomify.com/CVE-2026-27329/): WordPress YITH WooCommerce Wishlist plugin <= 4.12.0 - Insecure Direct Object References (IDOR) vulnerability (medium 5.3)
- [CVE-2026-27328](https://insights.sbomify.com/CVE-2026-27328/): WordPress EduBlink theme <= 2.0.7 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-27327](https://insights.sbomify.com/CVE-2026-27327/): WordPress YayMail – WooCommerce Email Customizer plugin <= 4.3.2 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-27326](https://insights.sbomify.com/CVE-2026-27326/): Path traversal in AC Services | HVAC, Air Conditioning & Heating Company WordPress Theme (high 8.1)
- [CVE-2026-2732](https://insights.sbomify.com/CVE-2026-2732/): Missing authorization in Enable Media Replace (medium 5.4)
- [CVE-2026-27316](https://insights.sbomify.com/CVE-2026-27316/): Information disclosure in FortiSandbox (low 2.5)
- [CVE-2026-27315](https://insights.sbomify.com/CVE-2026-27315/): Apache Cassandra: cqlsh history sensitive information leak (medium 5.5)
- [CVE-2026-27314](https://insights.sbomify.com/CVE-2026-27314/): Apache Cassandra: Privilege escalation via ADD IDENTITY authorization bypass (high 8.8)
- [CVE-2026-27313](https://insights.sbomify.com/CVE-2026-27313/): Bridge | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2026-27312](https://insights.sbomify.com/CVE-2026-27312/): Bridge | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2026-27311](https://insights.sbomify.com/CVE-2026-27311/): Bridge | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2026-27310](https://insights.sbomify.com/CVE-2026-27310/): Bridge | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2026-2731](https://insights.sbomify.com/CVE-2026-2731/): Unauthenticated RCE in Dynamicweb 9 and Dynamicweb 8 (critical 10.0)
- [CVE-2026-27309](https://insights.sbomify.com/CVE-2026-27309/): Substance3D - Stager | Use After Free (CWE-416) (high 7.8)
- [CVE-2026-27308](https://insights.sbomify.com/CVE-2026-27308/): ColdFusion | Uncontrolled Resource Consumption (CWE-400) (low 2.4)
- [CVE-2026-27307](https://insights.sbomify.com/CVE-2026-27307/): ColdFusion | Uncontrolled Resource Consumption (CWE-400) (low 2.4)
- [CVE-2026-27306](https://insights.sbomify.com/CVE-2026-27306/): ColdFusion | Improper Input Validation (CWE-20) (high 8.4)
- [CVE-2026-27305](https://insights.sbomify.com/CVE-2026-27305/): ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) (high 8.6)
- [CVE-2026-27304](https://insights.sbomify.com/CVE-2026-27304/): ColdFusion | Improper Input Validation (CWE-20) (critical 9.3)
- [CVE-2026-27303](https://insights.sbomify.com/CVE-2026-27303/): Adobe Connect | Deserialization of Untrusted Data (CWE-502) (critical 9.6)
- [CVE-2026-27302](https://insights.sbomify.com/CVE-2026-27302/): Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863) (critical 10.0)
- [CVE-2026-27301](https://insights.sbomify.com/CVE-2026-27301/): Adobe Framemaker | Heap-based Buffer Overflow (CWE-122) (medium 5.5)
- [CVE-2026-27300](https://insights.sbomify.com/CVE-2026-27300/): Adobe Framemaker | Access of Uninitialized Pointer (CWE-824) (medium 5.5)
- [CVE-2026-27299](https://insights.sbomify.com/CVE-2026-27299/): Adobe Framemaker | Improper Input Validation (CWE-20) (medium 6.3)
- [CVE-2026-27298](https://insights.sbomify.com/CVE-2026-27298/): Adobe Framemaker | Access of Resource Using Incompatible Type ('Type Confusion') (CWE-843) (high 7.8)
- [CVE-2026-27297](https://insights.sbomify.com/CVE-2026-27297/): Adobe Framemaker | Integer Underflow (Wrap or Wraparound) (CWE-191) (high 7.8)
- [CVE-2026-27296](https://insights.sbomify.com/CVE-2026-27296/): Adobe Framemaker | Integer Underflow (Wrap or Wraparound) (CWE-191) (high 7.8)
- [CVE-2026-27295](https://insights.sbomify.com/CVE-2026-27295/): Adobe Framemaker | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-27294](https://insights.sbomify.com/CVE-2026-27294/): Adobe Framemaker | Out-of-bounds Read (CWE-125) (high 7.8)
- [CVE-2026-27293](https://insights.sbomify.com/CVE-2026-27293/): Adobe Framemaker | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2026-27292](https://insights.sbomify.com/CVE-2026-27292/): Adobe Framemaker | Use After Free (CWE-416) (high 7.8)
- [CVE-2026-27291](https://insights.sbomify.com/CVE-2026-27291/): InDesign Desktop | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-27290](https://insights.sbomify.com/CVE-2026-27290/): Adobe Framemaker | Untrusted Search Path (CWE-426) (high 8.6)
- [CVE-2026-2729](https://insights.sbomify.com/CVE-2026-2729/): Business logic in Forminator Forms – Contact Form, Payment Form & Custom Form Builder (medium 5.3)
- [CVE-2026-27289](https://insights.sbomify.com/CVE-2026-27289/): Photoshop Desktop | Out-of-bounds Read (CWE-125) (high 7.8)
- [CVE-2026-27288](https://insights.sbomify.com/CVE-2026-27288/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-27287](https://insights.sbomify.com/CVE-2026-27287/): InCopy | Out-of-bounds Read (CWE-125) (high 7.8)
- [CVE-2026-27286](https://insights.sbomify.com/CVE-2026-27286/): InDesign Desktop | Heap-based Buffer Overflow (CWE-122) (medium 5.5)
- [CVE-2026-27285](https://insights.sbomify.com/CVE-2026-27285/): InDesign Desktop | Heap-based Buffer Overflow (CWE-122) (medium 5.5)
- [CVE-2026-27284](https://insights.sbomify.com/CVE-2026-27284/): InDesign Desktop | Out-of-bounds Read (CWE-125) (high 7.8)
- [CVE-2026-27283](https://insights.sbomify.com/CVE-2026-27283/): InDesign Desktop | Use After Free (CWE-416) (high 7.8)
- [CVE-2026-27282](https://insights.sbomify.com/CVE-2026-27282/): ColdFusion | Improper Input Validation (CWE-20) (high 7.5)
- [CVE-2026-27281](https://insights.sbomify.com/CVE-2026-27281/): DNG SDK | Integer Overflow or Wraparound (CWE-190) (medium 5.5)
- [CVE-2026-27280](https://insights.sbomify.com/CVE-2026-27280/): DNG SDK | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-2728](https://insights.sbomify.com/CVE-2026-2728/): LibreNMS: Cross-Site Scripting in ShowConfigController (medium 4.6)
- [CVE-2026-27279](https://insights.sbomify.com/CVE-2026-27279/): Substance3D - Stager | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-27278](https://insights.sbomify.com/CVE-2026-27278/): Acrobat Reader | Use After Free (CWE-416) (high 7.8)
- [CVE-2026-27277](https://insights.sbomify.com/CVE-2026-27277/): Substance3D - Stager | Use After Free (CWE-416) (high 7.8)
- [CVE-2026-27276](https://insights.sbomify.com/CVE-2026-27276/): Substance3D - Stager | Use After Free (CWE-416) (high 7.8)
- [CVE-2026-27275](https://insights.sbomify.com/CVE-2026-27275/): Substance3D - Stager | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2026-27274](https://insights.sbomify.com/CVE-2026-27274/): Substance3D - Stager | Out-of-bounds Write (CWE-787) (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/756/