# Vulnerabilities published in 2026


- [CVE-2026-24951](https://insights.sbomify.com/CVE-2026-24951/): WordPress myCred plugin <= 2.9.7.3 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-24950](https://insights.sbomify.com/CVE-2026-24950/): WordPress Authorsy plugin <= 1.0.6 - Insecure Direct Object References (IDOR) vulnerability (high 7.5)
- [CVE-2026-2495](https://insights.sbomify.com/CVE-2026-2495/): WPNakama <= 0.6.5 - Unauthenticated SQL Injection via 'order' REST API Parameter (high 7.5)
- [CVE-2026-24949](https://insights.sbomify.com/CVE-2026-24949/): WordPress PhotoMe theme <= 5.7.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-24948](https://insights.sbomify.com/CVE-2026-24948/): WordPress Reflector plugin <= 1.2.2 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-24947](https://insights.sbomify.com/CVE-2026-24947/): WordPress LA-Studio Element Kit for Elementor plugin < 1.5.6.3 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-24946](https://insights.sbomify.com/CVE-2026-24946/): WordPress Print Invoice & Delivery Notes for WooCommerce plugin <= 5.8.0 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-24945](https://insights.sbomify.com/CVE-2026-24945/): WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.34 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-24944](https://insights.sbomify.com/CVE-2026-24944/): WordPress Subscribe2 plugin <= 10.44 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-24943](https://insights.sbomify.com/CVE-2026-24943/): WordPress Grand Conference theme <= 5.3.4 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-24942](https://insights.sbomify.com/CVE-2026-24942/): WordPress WpEvently plugin <= 5.1.1 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2026-24941](https://insights.sbomify.com/CVE-2026-24941/): WordPress WP Job Portal plugin <= 2.4.4 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-24940](https://insights.sbomify.com/CVE-2026-24940/): WordPress Travelfic Toolkit plugin <= 1.3.3 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-2494](https://insights.sbomify.com/CVE-2026-2494/): ProfileGrid <= 5.9.8.2 - Cross-Site Request Forgery to Group Membership Request Approval/Denial (medium 4.3)
- [CVE-2026-24939](https://insights.sbomify.com/CVE-2026-24939/): WordPress Modula Image Gallery plugin <= 2.13.6 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-24938](https://insights.sbomify.com/CVE-2026-24938/): WordPress Better Search plugin <= 4.2.1 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2026-24937](https://insights.sbomify.com/CVE-2026-24937/): WordPress Broadcast Live Video plugin < 7.1.3 - Remote Code Execution (RCE) vulnerability (high 7.2)
- [CVE-2026-24936](https://insights.sbomify.com/CVE-2026-24936/): An improper input validation vulnerability was found in ADM while joining a AD Domain. (critical 9.5)
- [CVE-2026-24935](https://insights.sbomify.com/CVE-2026-24935/): An improper certificate validation vulnerability was found in a third-party NAT traversal module. (medium 6.3)
- [CVE-2026-24934](https://insights.sbomify.com/CVE-2026-24934/): Security feature bypass in ADM (medium 6.3)
- [CVE-2026-24933](https://insights.sbomify.com/CVE-2026-24933/): An improper certificate validation vulnerability was found in ADM while sending HTTPS requests to the server. (high 8.9)
- [CVE-2026-24932](https://insights.sbomify.com/CVE-2026-24932/): An improper certificate validation vulnerability was found in ADM while updating the DDNS settings. (high 8.9)
- [CVE-2026-24931](https://insights.sbomify.com/CVE-2026-24931/): Security feature bypass in HarmonyOS (medium 5.9)
- [CVE-2026-24930](https://insights.sbomify.com/CVE-2026-24930/): Use after free in HarmonyOS (high 8.4)
- [CVE-2026-2493](https://insights.sbomify.com/CVE-2026-2493/): IceWarp collaboration Directory Traversal Information Disclosure Vulnerability (high 7.5)
- [CVE-2026-24929](https://insights.sbomify.com/CVE-2026-24929/): Memory corruption in HarmonyOS (medium 5.9)
- [CVE-2026-24928](https://insights.sbomify.com/CVE-2026-24928/): Memory corruption in EMUI (medium 5.8)
- [CVE-2026-24927](https://insights.sbomify.com/CVE-2026-24927/): Use after free in EMUI (medium 5.5)
- [CVE-2026-24926](https://insights.sbomify.com/CVE-2026-24926/): Memory corruption in HarmonyOS (high 8.4)
- [CVE-2026-24925](https://insights.sbomify.com/CVE-2026-24925/): Memory corruption in HarmonyOS (high 7.3)
- [CVE-2026-24924](https://insights.sbomify.com/CVE-2026-24924/): Missing authorization in HarmonyOS (medium 6.1)
- [CVE-2026-24923](https://insights.sbomify.com/CVE-2026-24923/): Missing authorization in HarmonyOS (medium 6.3)
- [CVE-2026-24922](https://insights.sbomify.com/CVE-2026-24922/): Memory corruption in HarmonyOS (medium 6.9)
- [CVE-2026-24921](https://insights.sbomify.com/CVE-2026-24921/): Memory corruption in HarmonyOS (medium 4.8)
- [CVE-2026-24920](https://insights.sbomify.com/CVE-2026-24920/): Missing authorization in EMUI (medium 6.2)
- [CVE-2026-2492](https://insights.sbomify.com/CVE-2026-2492/): TensorFlow HDF5 Library Uncontrolled Search Path Element Local Privilege Escalation Vulnerability (high 7.0)
- [CVE-2026-24919](https://insights.sbomify.com/CVE-2026-24919/): Memory corruption in EMUI (medium 6.0)
- [CVE-2026-24918](https://insights.sbomify.com/CVE-2026-24918/): Null dereference in EMUI (medium 6.8)
- [CVE-2026-24917](https://insights.sbomify.com/CVE-2026-24917/): Use after free in EMUI (medium 6.5)
- [CVE-2026-24916](https://insights.sbomify.com/CVE-2026-24916/): Auth bypass in HarmonyOS (medium 5.9)
- [CVE-2026-24915](https://insights.sbomify.com/CVE-2026-24915/): Memory corruption in HarmonyOS (medium 6.2)
- [CVE-2026-24914](https://insights.sbomify.com/CVE-2026-24914/): Memory corruption in HarmonyOS (medium 4.0)
- [CVE-2026-24913](https://insights.sbomify.com/CVE-2026-24913/): SQL injection in MATCHA INVOICE (high 8.7)
- [CVE-2026-24912](https://insights.sbomify.com/CVE-2026-24912/): ePower epower.ie Insufficient Session Expiration (medium 6.9)
- [CVE-2026-24911](https://insights.sbomify.com/CVE-2026-24911/): Memory corruption in Intel(R) PROSet/Wireless WiFi Software for Windows (high 8.3)
- [CVE-2026-24910](https://insights.sbomify.com/CVE-2026-24910/): Security feature bypass in Bun (medium 5.9)
- [CVE-2026-2491](https://insights.sbomify.com/CVE-2026-2491/): Socomec DIRIS A-40 HTTP API Authentication Bypass Vulnerability (medium 6.3)
- [CVE-2026-24909](https://insights.sbomify.com/CVE-2026-24909/): vlt Mishandles Path Sanitization for tar (medium 5.9)
- [CVE-2026-24908](https://insights.sbomify.com/CVE-2026-24908/): OpenEMR has SQL Injection in Patient API Sort Parameter (critical 10.0)
- [CVE-2026-24907](https://insights.sbomify.com/CVE-2026-24907/): October CMS has Stored XSS via Event Log Mail Preview (medium 5.1)
- [CVE-2026-24906](https://insights.sbomify.com/CVE-2026-24906/): October CMS has Stored XSS in its Backend Editor Markup Classes (medium 5.1)
- [CVE-2026-24905](https://insights.sbomify.com/CVE-2026-24905/): Inspektor Gadget has a Command Injection vulnerability in Makefile.build (medium 6.6)
- [CVE-2026-24904](https://insights.sbomify.com/CVE-2026-24904/): TrustTunnel has `client_random_prefix` rule bypass via fragmented or partial TLS ClientHello (medium 5.3)
- [CVE-2026-24903](https://insights.sbomify.com/CVE-2026-24903/): OrcaStatLLM Researcher Stored Cross-Site Scripting (XSS) via Log Message Injection in Session Page (medium 5.3)
- [CVE-2026-24902](https://insights.sbomify.com/CVE-2026-24902/): TrustTunnel has SSRF and private network restriction bypass via numeric address destinations (high 7.1)
- [CVE-2026-24901](https://insights.sbomify.com/CVE-2026-24901/): Outline's IDOR allows unauthorized viewing and seizing of private deleted drafts (high 8.1)
- [CVE-2026-24900](https://insights.sbomify.com/CVE-2026-24900/): MarkUs has a submission-view IDOR exposes all student submissions (medium 6.5)
- [CVE-2026-2490](https://insights.sbomify.com/CVE-2026-2490/): RustDesk Client for Windows Transfer File Link Following Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-24899](https://insights.sbomify.com/CVE-2026-24899/): Fleet Windows MDM Azure AD JWT Authentication Bypass (high 8.2)
- [CVE-2026-24898](https://insights.sbomify.com/CVE-2026-24898/): OpenEMR has an Unauthenticated MedEx Token Disclosure (critical 10.0)
- [CVE-2026-24897](https://insights.sbomify.com/CVE-2026-24897/): Authenticated Remote Code Execution via Arbitrary File Upload (critical 10.0)
- [CVE-2026-24896](https://insights.sbomify.com/CVE-2026-24896/): OpenEMR has Broken Access Control that allows unauthorized access to EDI Logs (medium 6.5)
- [CVE-2026-24895](https://insights.sbomify.com/CVE-2026-24895/): FrankenPHP affected by Path Confusion via Unicode casing in CGI path splitting allows execution of arbitrary files (high 8.9)
- [CVE-2026-24894](https://insights.sbomify.com/CVE-2026-24894/): FrankenPHP leaks session data between requests in worker mode (high 8.7)
- [CVE-2026-24893](https://insights.sbomify.com/CVE-2026-24893/): openITCOCKPIT has Authenticated Command Injection Leading to Remote Code Execution via Host Address Macro Expansion (high 8.8)
- [CVE-2026-24892](https://insights.sbomify.com/CVE-2026-24892/): openITCOCKPIT has Unsafe Deserialization in openITCOCKPIT Changelog Handling (high 7.5)
- [CVE-2026-24891](https://insights.sbomify.com/CVE-2026-24891/): openITCOCKPIT has Unsafe PHP Deserialization in Gearman Worker Allowing Conditional Object Injection (high 7.5)
- [CVE-2026-24890](https://insights.sbomify.com/CVE-2026-24890/): OpenEMR Portal Users Can Forge Provider Signatures (high 8.1)
- [CVE-2026-2489](https://insights.sbomify.com/CVE-2026-2489/): TP2WP Importer <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Watched domains' Textarea (medium 4.4)
- [CVE-2026-24889](https://insights.sbomify.com/CVE-2026-24889/): soroban-sdk has overflow in Bytes::slice, Vec::slice, GenRange::gen_range for u64 (medium 5.3)
- [CVE-2026-24888](https://insights.sbomify.com/CVE-2026-24888/): Maker.js Vulnerable to Unsafe Property Copying in makerjs.extendObject (medium 6.5)
- [CVE-2026-24887](https://insights.sbomify.com/CVE-2026-24887/): Claude Code has a Command Injection in find Command Bypasses User Approval Prompt (high 7.7)
- [CVE-2026-24885](https://insights.sbomify.com/CVE-2026-24885/): Kanboard Affected by Cross-Site Request Forgery (CSRF) via Content-Type Misconfiguration in Project Role Assignment (medium 5.7)
- [CVE-2026-24884](https://insights.sbomify.com/CVE-2026-24884/): Compressing Vulnerable to Arbitrary File Write via Symlink Extraction (high 8.4)
- [CVE-2026-24883](https://insights.sbomify.com/CVE-2026-24883/): Null dereference in GnuPG (low 3.7)
- [CVE-2026-24882](https://insights.sbomify.com/CVE-2026-24882/): Memory corruption in GnuPG (high 8.4)
- [CVE-2026-24881](https://insights.sbomify.com/CVE-2026-24881/): Memory corruption in GnuPG (high 8.1)
- [CVE-2026-24880](https://insights.sbomify.com/CVE-2026-24880/): Apache Tomcat: Request smuggling via invalid chunk extension (high 7.5)
- [CVE-2026-2488](https://insights.sbomify.com/CVE-2026-2488/): ProfileGrid <= 5.9.8.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Message Deletion (medium 4.3)
- [CVE-2026-24875](https://insights.sbomify.com/CVE-2026-24875/): Integer overflow in modizer (high 7.8)
- [CVE-2026-24874](https://insights.sbomify.com/CVE-2026-24874/): Type confusion in xray-monolith (critical 9.1)
- [CVE-2026-24873](https://insights.sbomify.com/CVE-2026-24873/): Out-of-bounds read in lpp-vita (high 7.8)
- [CVE-2026-24872](https://insights.sbomify.com/CVE-2026-24872/): Pointer arithmetic error in SkyFire_548 (critical 9.8)
- [CVE-2026-24871](https://insights.sbomify.com/CVE-2026-24871/): Code injection in Minecraft-Rcon-Manage (critical 10.0)
- [CVE-2026-24870](https://insights.sbomify.com/CVE-2026-24870/): Information disclosure in ixray-1.6-stcop (low 3.7)
- [CVE-2026-2487](https://insights.sbomify.com/CVE-2026-2487/): Cross-site scripting in Admin Custom Login (medium 4.4)
- [CVE-2026-24869](https://insights.sbomify.com/CVE-2026-24869/): Use-after-free in the Layout: Scrolling and Overflow component (high 8.8)
- [CVE-2026-24868](https://insights.sbomify.com/CVE-2026-24868/): Mitigation bypass in the Privacy: Anti-Tracking component (medium 6.5)
- [CVE-2026-2486](https://insights.sbomify.com/CVE-2026-2486/): Cross-site scripting in Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits (medium 6.4)
- [CVE-2026-24858](https://insights.sbomify.com/CVE-2026-24858/): Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel (critical 9.4, exploited in the wild)
- [CVE-2026-24857](https://insights.sbomify.com/CVE-2026-24857/): bulk_extractor has Heap-based Buffer Overflow vulnerability (medium 5.5)
- [CVE-2026-24856](https://insights.sbomify.com/CVE-2026-24856/): iccDEV has UB runtime error in <icTagTypeSignature> (high 7.8)
- [CVE-2026-24855](https://insights.sbomify.com/CVE-2026-24855/): ChurchCRM has Stored Cross-Site Scripting (XSS) in Create Events in Church Calendar, Leading to Account Takeover (high 7.2)
- [CVE-2026-24854](https://insights.sbomify.com/CVE-2026-24854/): Church CRM has SQL injection in PaddleNumEditor.php (high 8.8)
- [CVE-2026-24853](https://insights.sbomify.com/CVE-2026-24853/): Caido has an insufficient patch for DNS rebind leading to RCE (high 8.1)
- [CVE-2026-24852](https://insights.sbomify.com/CVE-2026-24852/): iccDEV has a heap-buffer-overflow in icXmlParseTextString() (medium 6.1)
- [CVE-2026-24851](https://insights.sbomify.com/CVE-2026-24851/): OpenFGA Improper Policy Enforcement (medium 5.8)
- [CVE-2026-24850](https://insights.sbomify.com/CVE-2026-24850/): ML-DSA Signature Verification Accepts Signatures with Repeated Hint Indices (medium 5.3)
- [CVE-2026-2485](https://insights.sbomify.com/CVE-2026-2485/): IBM InfoSphere Information Server Cross-Site Scripting (medium 4.8)
- [CVE-2026-24849](https://insights.sbomify.com/CVE-2026-24849/): OpenEMR Arbitrary File Read Vulnerability (critical 10.0)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/775/