# Vulnerabilities published in 2026


- [CVE-2026-27168](https://insights.sbomify.com/CVE-2026-27168/): SAIL: Heap-based Buffer Overflow in Sail-codecs-xwd (high 8.8)
- [CVE-2026-27167](https://insights.sbomify.com/CVE-2026-27167/): Gradio: Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session Secret (not scored)
- [CVE-2026-27166](https://insights.sbomify.com/CVE-2026-27166/): Discourse vulnerable to HTML injection via prohibited iframe URLs (medium 4.1)
- [CVE-2026-27162](https://insights.sbomify.com/CVE-2026-27162/): DIscourse doesn't prevent whispers to leak in excerpts (medium 4.9)
- [CVE-2026-27161](https://insights.sbomify.com/CVE-2026-27161/): Unauthenticated Information Disclosure via .htaccess Reliance in Sensitive Directories (high 8.7)
- [CVE-2026-2716](https://insights.sbomify.com/CVE-2026-2716/): Cross-site scripting in Client Testimonial Slider (medium 4.4)
- [CVE-2026-27156](https://insights.sbomify.com/CVE-2026-27156/): NiceGUI has XSS via Code Injection (medium 6.1)
- [CVE-2026-27154](https://insights.sbomify.com/CVE-2026-27154/): Discourse has XSS when editing a malicious post (low 1.3)
- [CVE-2026-27153](https://insights.sbomify.com/CVE-2026-27153/): Discourse doesn't prevent moderators from exporting user Chat DMs (low 1.3)
- [CVE-2026-27152](https://insights.sbomify.com/CVE-2026-27152/): DIscourse has DM communication-preference bypass when adding members (low 1.3)
- [CVE-2026-27151](https://insights.sbomify.com/CVE-2026-27151/): Discourse doesn't validate destination topic when moving posts (low 1.3)
- [CVE-2026-27150](https://insights.sbomify.com/CVE-2026-27150/): Discourse doesn't ensure guardian check when creating QueryGroupBookmark (low 1.3)
- [CVE-2026-27149](https://insights.sbomify.com/CVE-2026-27149/): Discourse has SQL injection in PM tag filtering (medium 4.9)
- [CVE-2026-27148](https://insights.sbomify.com/CVE-2026-27148/): Storybook Dev Server Vulnerable to WebSocket Hijacking (high 8.9)
- [CVE-2026-27147](https://insights.sbomify.com/CVE-2026-27147/): GetSimple CMS: Stored Cross-Site Scripting (XSS) via SVG File Upload (Authenticated) (medium 6.9)
- [CVE-2026-27146](https://insights.sbomify.com/CVE-2026-27146/): GetSimple CMS: Cross-Site Request Forgery (CSRF) in File Upload Allows Arbitrary Uploads (high 7.1)
- [CVE-2026-27145](https://insights.sbomify.com/CVE-2026-27145/): Inefficient candidate hostname parsing in crypto/x509 (medium 6.5)
- [CVE-2026-27144](https://insights.sbomify.com/CVE-2026-27144/): Miscompilation allows memory corruption via CONVNOP-wrapped array copy in cmd/compile (high 7.1)
- [CVE-2026-27143](https://insights.sbomify.com/CVE-2026-27143/): Missing bound checks can lead to memory corruption in safe Go in cmd/compile (critical 9.8)
- [CVE-2026-27142](https://insights.sbomify.com/CVE-2026-27142/): URLs in meta content attribute actions are not escaped in html/template (medium 6.1)
- [CVE-2026-27141](https://insights.sbomify.com/CVE-2026-27141/): Sending certain HTTP/2 frames can cause a server to panic in golang.org/x/net (high 7.5)
- [CVE-2026-27140](https://insights.sbomify.com/CVE-2026-27140/): Code execution vulnerability in SWIG code generation in cmd/go (high 8.8)
- [CVE-2026-2714](https://insights.sbomify.com/CVE-2026-2714/): Cross-site scripting in Institute Management – Learning Management System (medium 4.4)
- [CVE-2026-27139](https://insights.sbomify.com/CVE-2026-27139/): FileInfo can escape from a Root in os (low 2.5)
- [CVE-2026-27138](https://insights.sbomify.com/CVE-2026-27138/): Panic in name constraint checking for malformed certificates in crypto/x509 (medium 5.9)
- [CVE-2026-27137](https://insights.sbomify.com/CVE-2026-27137/): Incorrect enforcement of email constraints in crypto/x509 (high 7.5)
- [CVE-2026-27136](https://insights.sbomify.com/CVE-2026-27136/): Invoking duplicate attributes can cause XSS in golang.org/x/net/html (medium 6.1)
- [CVE-2026-27135](https://insights.sbomify.com/CVE-2026-27135/): nghttp2 Denial of service: Assertion failure due to the missing state validation (high 7.5)
- [CVE-2026-27134](https://insights.sbomify.com/CVE-2026-27134/): Strimzi: All CAs from a custom CA chain consisting of multiple CAs are trusted for mTLS user autentication (high 8.1)
- [CVE-2026-27133](https://insights.sbomify.com/CVE-2026-27133/): Strimzi All CAs from CA chain will be trusted in Kafka Connect and Kafka MirrorMaker 2 target clusters (medium 5.9)
- [CVE-2026-27131](https://insights.sbomify.com/CVE-2026-27131/): Sprig Plugin for Craft CMS potentially discloses sensitive information via Sprig Playground (medium 5.5)
- [CVE-2026-27130](https://insights.sbomify.com/CVE-2026-27130/): Dokploy has Command Injection in its Service Operations (critical 9.9)
- [CVE-2026-2713](https://insights.sbomify.com/CVE-2026-2713/): IBM Trusteer Rapport installer affected by uncontrolled search path element vulnerability (high 7.4)
- [CVE-2026-27129](https://insights.sbomify.com/CVE-2026-27129/): Cloud Metadata SSRF Protection Bypass via IPv6 Resolution (medium 5.7)
- [CVE-2026-27128](https://insights.sbomify.com/CVE-2026-27128/): Craft CMS's race condition in Token Service potentially allows for token usage greater than the token limit (medium 6.9)
- [CVE-2026-27127](https://insights.sbomify.com/CVE-2026-27127/): Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding (high 7.0)
- [CVE-2026-27126](https://insights.sbomify.com/CVE-2026-27126/): Craft CMS has Stored XSS in Table Field via "HTML" Column Type (medium 5.9)
- [CVE-2026-27125](https://insights.sbomify.com/CVE-2026-27125/): Svelte SSR attribute spreading includes inherited properties from prototype chain (medium 5.3)
- [CVE-2026-27124](https://insights.sbomify.com/CVE-2026-27124/): FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy Vulnerabilities (high 8.2)
- [CVE-2026-27122](https://insights.sbomify.com/CVE-2026-27122/): Svelte SSR does not validate dynamic element tag names in `<svelte:element>` (medium 5.1)
- [CVE-2026-27121](https://insights.sbomify.com/CVE-2026-27121/): Svelte affected by cross-site scripting via spread attributes in Svelte SSR (medium 5.1)
- [CVE-2026-27120](https://insights.sbomify.com/CVE-2026-27120/): Leaf-kit html escaping does not work on characters that are part of extended grapheme cluster (medium 6.1)
- [CVE-2026-2712](https://insights.sbomify.com/CVE-2026-2712/): Missing authorization in WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance (medium 5.4)
- [CVE-2026-27119](https://insights.sbomify.com/CVE-2026-27119/): Svelte affected by XSS in SSR `<option>` element (medium 5.1)
- [CVE-2026-27118](https://insights.sbomify.com/CVE-2026-27118/): Cache poisoning in @sveltejs/adapter-vercel (medium 5.3)
- [CVE-2026-27117](https://insights.sbomify.com/CVE-2026-27117/): bit7z has a path traversal vulnerability (medium 5.5)
- [CVE-2026-27116](https://insights.sbomify.com/CVE-2026-27116/): Vikunja has Reflected HTML Injection via filter Parameter in Projects Module (medium 6.1)
- [CVE-2026-27115](https://insights.sbomify.com/CVE-2026-27115/): ADB Explorer is Vulnerable to Arbitrary Directory Deletion via Command-Line Argument (high 7.1)
- [CVE-2026-27114](https://insights.sbomify.com/CVE-2026-27114/): NanaZip has ROMFS Archive Infinite Loop (medium 5.1)
- [CVE-2026-27113](https://insights.sbomify.com/CVE-2026-27113/): Liquid Prompt arbitrary command injection via crafted Git branch names in gitstatusd backend (medium 6.3)
- [CVE-2026-27112](https://insights.sbomify.com/CVE-2026-27112/): Kargo has an Authorization Bypass Vulnerability in Batch Resource Creation API Endpoints (critical 9.4)
- [CVE-2026-27111](https://insights.sbomify.com/CVE-2026-27111/): Kargo has Missing Authorization Vulnerabilities in Approval & Promotion REST API Endpoints (medium 5.3)
- [CVE-2026-2711](https://insights.sbomify.com/CVE-2026-2711/): zhutoutoutousan worldquant-miner URL ssrf_proxy.py server-side request forgery (medium 6.3)
- [CVE-2026-27105](https://insights.sbomify.com/CVE-2026-27105/): Path traversal in Dell/Alienware Purchased Apps (medium 6.3)
- [CVE-2026-27102](https://insights.sbomify.com/CVE-2026-27102/): Privilege escalation in PowerScale OneFS (medium 6.6)
- [CVE-2026-27101](https://insights.sbomify.com/CVE-2026-27101/): Path traversal in Secure Connect Gateway (medium 4.7)
- [CVE-2026-27100](https://insights.sbomify.com/CVE-2026-27100/): Jenkins has a build information disclosure vulnerability through Run Parameter (medium 4.3)
- [CVE-2026-27099](https://insights.sbomify.com/CVE-2026-27099/): Jenkins has a stored XSS vulnerability in node offline cause description (high 8.0)
- [CVE-2026-27098](https://insights.sbomify.com/CVE-2026-27098/): WordPress Au Pair Agency - Babysitting & Nanny Theme theme <= 1.2.2 - Deserialization of untrusted data vulnerability (high 8.1)
- [CVE-2026-27097](https://insights.sbomify.com/CVE-2026-27097/): WordPress CasaMia | Property Rental Real Estate WordPress Theme theme <= 1.1.2 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-27096](https://insights.sbomify.com/CVE-2026-27096/): Deserialization in ColorFolio - Freelance Designer WordPress Theme (high 8.1)
- [CVE-2026-27095](https://insights.sbomify.com/CVE-2026-27095/): WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.6.0 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-27094](https://insights.sbomify.com/CVE-2026-27094/): WordPress CoBlocks plugin <= 3.1.16 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-27093](https://insights.sbomify.com/CVE-2026-27093/): WordPress Tripgo theme < 1.5.6 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-27092](https://insights.sbomify.com/CVE-2026-27092/): WordPress WPAdverts plugin <= 2.3.0 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-27091](https://insights.sbomify.com/CVE-2026-27091/): WordPress UiPress lite plugin <= 3.5.09 - Broken Access Control vulnerability (medium 6.3)
- [CVE-2026-27090](https://insights.sbomify.com/CVE-2026-27090/): WordPress Kenta Companion plugin <= 1.3.3 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2026-2709](https://insights.sbomify.com/CVE-2026-2709/): busy Callback app.js redirect (medium 5.1)
- [CVE-2026-27089](https://insights.sbomify.com/CVE-2026-27089/): WordPress WpTravelly plugin <= 2.1.7 - Bypass Vulnerability vulnerability (high 7.5)
- [CVE-2026-27088](https://insights.sbomify.com/CVE-2026-27088/): WordPress Darna Framework plugin <= 2.9 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-27087](https://insights.sbomify.com/CVE-2026-27087/): WordPress Wolverine Framework plugin <= 1.9 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-27086](https://insights.sbomify.com/CVE-2026-27086/): WordPress WoodMart theme < 8.3.8 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-27085](https://insights.sbomify.com/CVE-2026-27085/): WordPress Astra WordPress theme theme <= 4.13.12 - Content Injection vulnerability (low 2.7)
- [CVE-2026-27084](https://insights.sbomify.com/CVE-2026-27084/): WordPress Buisson theme <= 1.1.11 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-27083](https://insights.sbomify.com/CVE-2026-27083/): WordPress Work & Travel Company theme <= 1.2 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-27082](https://insights.sbomify.com/CVE-2026-27082/): WordPress Love Story theme <= 1.3.12 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-27081](https://insights.sbomify.com/CVE-2026-27081/): WordPress Rosebud theme <= 1.4 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-27080](https://insights.sbomify.com/CVE-2026-27080/): WordPress Deston theme <= 1.0 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-2708](https://insights.sbomify.com/CVE-2026-2708/): Libsoup: libsoup: http request smuggling via duplicate content-length headers (low 3.7)
- [CVE-2026-27079](https://insights.sbomify.com/CVE-2026-27079/): WordPress Amfissa theme <= 1.1 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-27078](https://insights.sbomify.com/CVE-2026-27078/): WordPress Emaurri theme <= 1.0.1 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-27077](https://insights.sbomify.com/CVE-2026-27077/): WordPress MultiOffice theme <= 1.2 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-27076](https://insights.sbomify.com/CVE-2026-27076/): WordPress LuxeDrive theme <= 1.0 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-27075](https://insights.sbomify.com/CVE-2026-27075/): WordPress Belfort theme <= 1.0 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-27074](https://insights.sbomify.com/CVE-2026-27074/): WordPress Shortcoder plugin <= 6.5.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-27073](https://insights.sbomify.com/CVE-2026-27073/): WordPress Addi – Cuotas que se adaptan a ti plugin <= 2.0.4 - Broken Authentication vulnerability (high 7.5)
- [CVE-2026-27072](https://insights.sbomify.com/CVE-2026-27072/): WordPress PixelYourSite – Your smart PIXEL (TAG) Manager plugin <= 11.2.0.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-27071](https://insights.sbomify.com/CVE-2026-27071/): WordPress WPCafe plugin <= 3.0.7 - Broken Access Control vulnerability (critical 9.1)
- [CVE-2026-27070](https://insights.sbomify.com/CVE-2026-27070/): WordPress Everest Forms Pro plugin <= 1.9.10 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-2707](https://insights.sbomify.com/CVE-2026-2707/): weForms <= 1.6.27 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Hidden Field Value via REST API (medium 6.4)
- [CVE-2026-27069](https://insights.sbomify.com/CVE-2026-27069/): WordPress Soledad theme <= 8.7.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-27068](https://insights.sbomify.com/CVE-2026-27068/): WordPress Website LLMs.txt plugin <= 8.2.6 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-27067](https://insights.sbomify.com/CVE-2026-27067/): WordPress Mobile App Editor plugin <= 1.3.1 - Arbitrary File Upload vulnerability (critical 9.1)
- [CVE-2026-27065](https://insights.sbomify.com/CVE-2026-27065/): WordPress BuilderPress plugin <= 2.0.1 - Local File Inclusion vulnerability (critical 9.8)
- [CVE-2026-27064](https://insights.sbomify.com/CVE-2026-27064/): WordPress Mailster plugin <= 4.1.17 - Arbitrary File Upload vulnerability (critical 9.1)
- [CVE-2026-27063](https://insights.sbomify.com/CVE-2026-27063/): WordPress Kit (formerly ConvertKit) plugin <= 3.4.7 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-27062](https://insights.sbomify.com/CVE-2026-27062/): WordPress WPFunnels plugin <= 3.13.5 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2026-27060](https://insights.sbomify.com/CVE-2026-27060/): WordPress ARMember Premium plugin < 7.6 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-2706](https://insights.sbomify.com/CVE-2026-2706/): code-projects Patient Record Management System fecalysis_not.php sql injection (medium 5.3)
- [CVE-2026-27059](https://insights.sbomify.com/CVE-2026-27059/): WordPress Penci Recipe plugin <= 4.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/758/