# Vulnerabilities published in 2026


- [CVE-2026-27058](https://insights.sbomify.com/CVE-2026-27058/): WordPress Penci Podcast plugin <= 1.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-27057](https://insights.sbomify.com/CVE-2026-27057/): WordPress Penci Filter Everything plugin <= 1.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-27056](https://insights.sbomify.com/CVE-2026-27056/): WordPress iThemes Sync plugin <= 3.2.8 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-27055](https://insights.sbomify.com/CVE-2026-27055/): WordPress Penci AI SmartContent Creator plugin <= 2.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-27054](https://insights.sbomify.com/CVE-2026-27054/): WordPress Penci Soledad Data Migrator plugin <= 1.3.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-27053](https://insights.sbomify.com/CVE-2026-27053/): WordPress Broadcast Live Video plugin < 7.1.3 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-27052](https://insights.sbomify.com/CVE-2026-27052/): WordPress Sales Countdown Timer for WooCommerce and WordPress plugin < 1.1.9 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-27051](https://insights.sbomify.com/CVE-2026-27051/): WordPress Golo theme <= 1.7.0 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2026-27050](https://insights.sbomify.com/CVE-2026-27050/): WordPress RealPress plugin <= 1.1.0 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2026-2705](https://insights.sbomify.com/CVE-2026-2705/): Open Babel MOL2 File atom.h SetFormalCharge out-of-bounds (medium 5.3)
- [CVE-2026-27049](https://insights.sbomify.com/CVE-2026-27049/): WordPress Jobica Core plugin <= 1.4.2 - Account Takeover vulnerability (critical 9.8)
- [CVE-2026-27048](https://insights.sbomify.com/CVE-2026-27048/): WordPress The Aisle Core plugin <= 2.0.5 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-27047](https://insights.sbomify.com/CVE-2026-27047/): WordPress Curly Core plugin <= 2.1.6 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-27046](https://insights.sbomify.com/CVE-2026-27046/): WordPress StoreCustomizer plugin <= 2.6.3 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-27045](https://insights.sbomify.com/CVE-2026-27045/): WordPress WooCommerce Infinite Scroll plugin <= 1.6.2 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-27044](https://insights.sbomify.com/CVE-2026-27044/): WordPress Total Poll Lite plugin <= 4.12.0 - Remote Code Execution (RCE) vulnerability (critical 9.9)
- [CVE-2026-27043](https://insights.sbomify.com/CVE-2026-27043/): WordPress Photography theme < 7.7.6 - Arbitrary File Upload vulnerability (high 7.2)
- [CVE-2026-27042](https://insights.sbomify.com/CVE-2026-27042/): WordPress NotificationX plugin <= 3.2.1 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-27041](https://insights.sbomify.com/CVE-2026-27041/): WordPress Unlimited Elements for Elementor (Premium) plugin <= 2.0.6 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2026-27040](https://insights.sbomify.com/CVE-2026-27040/): WordPress WZone plugin <= 14.0.31 - Arbitrary File Deletion vulnerability (high 8.8)
- [CVE-2026-2704](https://insights.sbomify.com/CVE-2026-2704/): Open Babel CIF File transform3d.cpp DescribeAsString out-of-bounds (medium 5.3)
- [CVE-2026-27039](https://insights.sbomify.com/CVE-2026-27039/): WordPress WZone plugin <= 14.0.31 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-2703](https://insights.sbomify.com/CVE-2026-2703/): xlnt-community xlnt Encrypted XLSX File base64.cpp decode_base64 off-by-one (medium 4.8)
- [CVE-2026-27028](https://insights.sbomify.com/CVE-2026-27028/): Mobility46 mobility46.se Missing Authentication for Critical Function (critical 9.3)
- [CVE-2026-27027](https://insights.sbomify.com/CVE-2026-27027/): Everon api.everon.io Insufficiently Protected Credentials (medium 6.9)
- [CVE-2026-27026](https://insights.sbomify.com/CVE-2026-27026/): pypdf possibly has long runtimes for malformed FlateDecode streams (medium 6.9)
- [CVE-2026-27025](https://insights.sbomify.com/CVE-2026-27025/): pypdf has possible long runtimes/large memory usage for large /ToUnicode streams (medium 6.9)
- [CVE-2026-27024](https://insights.sbomify.com/CVE-2026-27024/): pypdf has a possible infinite loop when processing TreeObject (medium 6.9)
- [CVE-2026-27023](https://insights.sbomify.com/CVE-2026-27023/): Twenty: SSRF protection bypass via HTTP redirect following in secure HTTP client (medium 5.0)
- [CVE-2026-27022](https://insights.sbomify.com/CVE-2026-27022/): RediSearch Query Injection in @langchain/langgraph-checkpoint-redis (medium 6.5)
- [CVE-2026-27021](https://insights.sbomify.com/CVE-2026-27021/): Discourse: Poll voters endpoint lacked post visibility checks (medium 6.9)
- [CVE-2026-27020](https://insights.sbomify.com/CVE-2026-27020/): Photobooth has a XSS vulnerability in user input (medium 5.3)
- [CVE-2026-2702](https://insights.sbomify.com/CVE-2026-2702/): Beetel 777VR1 WPA2 PSK hard-coded credentials (low 2.3)
- [CVE-2026-27018](https://insights.sbomify.com/CVE-2026-27018/): Gotenberg: Chromium deny-list bypass via case-insensitive URL scheme (high 7.8)
- [CVE-2026-27017](https://insights.sbomify.com/CVE-2026-27017/): uTLS has a Chrome Parrot Fingerprint Vulnerability due to GREASE ECH Cipher Suite Mismatch (low 2.3)
- [CVE-2026-27016](https://insights.sbomify.com/CVE-2026-27016/): LibreNMS has Stored XSS in Custom OID - unit parameter missing strip_tags() (medium 5.4)
- [CVE-2026-27015](https://insights.sbomify.com/CVE-2026-27015/): FreeRDP: Smartcard NDR Alignment Padding Triggers Reachable WINPR_ASSERT Abort (Client DoS) (medium 5.0)
- [CVE-2026-27014](https://insights.sbomify.com/CVE-2026-27014/): NanZip has ROMFS Archive Infinite Loop / Stack Overflow (medium 5.1)
- [CVE-2026-27013](https://insights.sbomify.com/CVE-2026-27013/): Fabric.js Affected by Stored XSS via SVG Export (high 7.6)
- [CVE-2026-27012](https://insights.sbomify.com/CVE-2026-27012/): Unauthenticated privilege escalation in OpenSTAManager via modules/utenti/actions.php (critical 9.8)
- [CVE-2026-2701](https://insights.sbomify.com/CVE-2026-2701/): RCE vulnerability in Progress ShareFile Storage Zones Controller (SZC) (critical 9.1)
- [CVE-2026-27009](https://insights.sbomify.com/CVE-2026-27009/): OpenClaw affected by Stored XSS in Control UI via unsanitized assistant name/avatar in inline script injection (medium 5.8)
- [CVE-2026-27008](https://insights.sbomify.com/CVE-2026-27008/): OpenClaw hardened the skill download target directory validation (medium 6.8)
- [CVE-2026-27007](https://insights.sbomify.com/CVE-2026-27007/): OpenClaw's sandbox config hash sorted primitive arrays and suppressed needed container recreation (medium 4.8)
- [CVE-2026-27005](https://insights.sbomify.com/CVE-2026-27005/): Chartbrew: SQL injection in date-type variable handling (applyMysqlOrPostgresVariables) (high 8.8)
- [CVE-2026-27004](https://insights.sbomify.com/CVE-2026-27004/): OpenClaw session tool visibility hardening and Telegram webhook secret fallback (medium 6.9)
- [CVE-2026-27003](https://insights.sbomify.com/CVE-2026-27003/): OpenClaw: Telegram bot token exposure via logs (medium 6.9)
- [CVE-2026-27002](https://insights.sbomify.com/CVE-2026-27002/): OpenClaw: Docker container escape via unvalidated bind mount config injection (high 7.7)
- [CVE-2026-27001](https://insights.sbomify.com/CVE-2026-27001/): OpenClaw: Unsanitized CWD path injection into LLM prompts (high 8.6)
- [CVE-2026-26999](https://insights.sbomify.com/CVE-2026-26999/): Traefik: tcp router clears read deadlines before tls forwarding, enabling stalled handshakes (slowloris doS) (high 7.5)
- [CVE-2026-26998](https://insights.sbomify.com/CVE-2026-26998/): Traefik: unbounded io.ReadAll on auth server response body causes OOM denial of service(DOS) (medium 4.4)
- [CVE-2026-26997](https://insights.sbomify.com/CVE-2026-26997/): ClipBucket v5 has Stored XSS via Collection name (low 2.0)
- [CVE-2026-26996](https://insights.sbomify.com/CVE-2026-26996/): minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern (high 8.7)
- [CVE-2026-26994](https://insights.sbomify.com/CVE-2026-26994/): uTLS ServerHellos are accepted without checking TLS 1.3 downgrade canaries (medium 6.5)
- [CVE-2026-26993](https://insights.sbomify.com/CVE-2026-26993/): Flare has XSS vulnerability in Raw File Preview (medium 4.6)
- [CVE-2026-26992](https://insights.sbomify.com/CVE-2026-26992/): LibreNMS has Stored Cross-Site Scripting via unsanitized /port-groups name (medium 5.1)
- [CVE-2026-26991](https://insights.sbomify.com/CVE-2026-26991/): LibreNMS vulnerable to Stored Cross-site Scripting through unsanitized /device-groups name (medium 5.1)
- [CVE-2026-26990](https://insights.sbomify.com/CVE-2026-26990/): LibreNMS has Time-Based Blind SQL Injection in address-search.inc.php (high 8.8)
- [CVE-2026-2699](https://insights.sbomify.com/CVE-2026-2699/): EAR vulnerability in Progress ShareFile Storage Zones Controller (SZC) (critical 9.8)
- [CVE-2026-26989](https://insights.sbomify.com/CVE-2026-26989/): LibreNMS has Stored XSS in Alert Rule (medium 4.3)
- [CVE-2026-26988](https://insights.sbomify.com/CVE-2026-26988/): LibreNMS: SQL Injection in ajax_table.php spreads through a covert data stream (critical 9.3)
- [CVE-2026-26987](https://insights.sbomify.com/CVE-2026-26987/): LibreNMS affected by reflected XSS via email field (medium 5.3)
- [CVE-2026-26986](https://insights.sbomify.com/CVE-2026-26986/): FreeRDP has heap-use-after-free in rail_window_free (medium 5.5)
- [CVE-2026-26985](https://insights.sbomify.com/CVE-2026-26985/): LORIS vulnerable to path traversal in electrophysiology_browser (high 8.1)
- [CVE-2026-26984](https://insights.sbomify.com/CVE-2026-26984/): LORIS media module vulnerable to remote code execution (high 8.7)
- [CVE-2026-26983](https://insights.sbomify.com/CVE-2026-26983/): ImageMagick: Invalid MSL <map> can result in a use after free (medium 5.3)
- [CVE-2026-26982](https://insights.sbomify.com/CVE-2026-26982/): Ghostty affected by arbitrary command execution via control characters in paste and drag-and-drop operations (medium 6.3)
- [CVE-2026-26981](https://insights.sbomify.com/CVE-2026-26981/): OpenEXR has heap-buffer-overflow via signed integer underflow in ImfContextInit.cpp (medium 6.5)
- [CVE-2026-26980](https://insights.sbomify.com/CVE-2026-26980/): Ghost has a SQL Injection in its Content API (critical 9.4)
- [CVE-2026-2698](https://insights.sbomify.com/CVE-2026-2698/): Improper Access Control (medium 5.7)
- [CVE-2026-26979](https://insights.sbomify.com/CVE-2026-26979/): Discourse: TL4 users are able to change status of restricted topics (not scored)
- [CVE-2026-26978](https://insights.sbomify.com/CVE-2026-26978/): Free PBX backup: Deserialization of Untrusted Data in admin/modules/backup/Models/BackupSplFileInfo.php (high 8.6)
- [CVE-2026-26977](https://insights.sbomify.com/CVE-2026-26977/): Frappe Learning Management System exposes details of unpublished courses to unauthorized users (medium 6.9)
- [CVE-2026-26975](https://insights.sbomify.com/CVE-2026-26975/): Music Assistant Server Path Traversal in Playlist Update API Allows Remote Code Execution (high 8.8)
- [CVE-2026-26974](https://insights.sbomify.com/CVE-2026-26974/): Sylde has Improper Control of Generation of Code (high 7.6)
- [CVE-2026-26973](https://insights.sbomify.com/CVE-2026-26973/): Discourse doesn't scope reviewable notes to user-visible reviewables (medium 4.3)
- [CVE-2026-26972](https://insights.sbomify.com/CVE-2026-26972/): OpenClaw has a Path Traversal in Browser Download Functionality (medium 6.7)
- [CVE-2026-2697](https://insights.sbomify.com/CVE-2026-2697/): Indirect Object Reference (IDOR) in Security Center (low 2.1)
- [CVE-2026-26967](https://insights.sbomify.com/CVE-2026-26967/): PJSIP has a Heap-based Buffer Overflow vulnerability in its H.264 unpacketizer (high 8.1)
- [CVE-2026-26965](https://insights.sbomify.com/CVE-2026-26965/): FreeRDP has Out-of-bounds Write (high 8.8)
- [CVE-2026-26964](https://insights.sbomify.com/CVE-2026-26964/): Windmill Exposes Workspace Slack OAuth Client Secrets to Non-Admin Workspace Members (low 2.7)
- [CVE-2026-26963](https://insights.sbomify.com/CVE-2026-26963/): Cilium may not enforce host firewall policies when Native Routing, WireGuard and Node Encryption are enabled (medium 6.1)
- [CVE-2026-26962](https://insights.sbomify.com/CVE-2026-26962/): Rack: Header injection in multipart requests (medium 4.8)
- [CVE-2026-26961](https://insights.sbomify.com/CVE-2026-26961/): Rack: Multipart Boundary Parsing Ambiguity allowing WAF Bypass (low 3.7)
- [CVE-2026-26960](https://insights.sbomify.com/CVE-2026-26960/): node-tar has Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in Extraction (high 7.1)
- [CVE-2026-2696](https://insights.sbomify.com/CVE-2026-2696/): Export All URLs < 5.1 - Unauthenticated Sensitive Data Exposure (medium 5.3)
- [CVE-2026-26959](https://insights.sbomify.com/CVE-2026-26959/): ADB Explorer Vulnerable to RCE via Insufficient Input Validation (high 7.8)
- [CVE-2026-26958](https://insights.sbomify.com/CVE-2026-26958/): filippo.io/edwards25519 MultiScalarMult produces invalid results or undefined behavior if receiver is not the identity (low 1.7)
- [CVE-2026-26956](https://insights.sbomify.com/CVE-2026-26956/): vm2: WASM Sandbox Escape (Node 25 only) (critical 9.8)
- [CVE-2026-26955](https://insights.sbomify.com/CVE-2026-26955/): FreeRDP has Out-of-bounds Write (high 8.8)
- [CVE-2026-26954](https://insights.sbomify.com/CVE-2026-26954/): SandboxJS has a Sandbox Escape (critical 10.0)
- [CVE-2026-26953](https://insights.sbomify.com/CVE-2026-26953/): Pi-hole Web Interface has Stored HTML Injection via X-Forwarded-For Header in Active Sessions Table (medium 5.4)
- [CVE-2026-26952](https://insights.sbomify.com/CVE-2026-26952/): Pi-hole Web Interface has Stored HTML Injection via Local DNS Records (CNAME/Hosts) in data-tag Attribute (medium 5.4)
- [CVE-2026-26951](https://insights.sbomify.com/CVE-2026-26951/): Memory corruption in PowerProtect Data Domain (medium 6.7)
- [CVE-2026-26950](https://insights.sbomify.com/CVE-2026-26950/): Privilege escalation in SmartFabric Manager (high 8.1)
- [CVE-2026-2695](https://insights.sbomify.com/CVE-2026-2695/): Lack of Server-side validation in Instruction Input in TeamViewer DEX Platform (On-Premises) (medium 6.3)
- [CVE-2026-26949](https://insights.sbomify.com/CVE-2026-26949/): Privilege escalation in Device Management Agent (DDMA) (medium 5.5)
- [CVE-2026-26948](https://insights.sbomify.com/CVE-2026-26948/): Information disclosure in Integrated Dell Remote Access Controller (medium 4.9)
- [CVE-2026-26947](https://insights.sbomify.com/CVE-2026-26947/): Privilege escalation in ECS (medium 6.7)
- [CVE-2026-26946](https://insights.sbomify.com/CVE-2026-26946/): Privilege escalation in ECS (medium 6.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/759/