# Vulnerabilities published in 2026


- [CVE-2026-24540](https://insights.sbomify.com/CVE-2026-24540/): WordPress Integrate Google Drive plugin <= 1.5.6 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-2454](https://insights.sbomify.com/CVE-2026-2454/): DoS in Calls plugin via malformed msgpack in websocket request. (medium 5.8)
- [CVE-2026-24539](https://insights.sbomify.com/CVE-2026-24539/): WordPress Protección de datos – RGPD plugin <= 0.68 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-24538](https://insights.sbomify.com/CVE-2026-24538/): WordPress Omnipress plugin <= 1.6.7 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-24537](https://insights.sbomify.com/CVE-2026-24537/): WordPress WP Accessibility Helper (WAH) plugin <= 0.6.6 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2026-24536](https://insights.sbomify.com/CVE-2026-24536/): WordPress Webpushr plugin <= 4.38.0 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-24535](https://insights.sbomify.com/CVE-2026-24535/): WordPress Automatic Featured Images from Videos plugin <= 1.2.7 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-24534](https://insights.sbomify.com/CVE-2026-24534/): WordPress Booter plugin <= 1.5.7 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-24533](https://insights.sbomify.com/CVE-2026-24533/): WordPress Cozy Blocks plugin <= 2.2.27 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-24532](https://insights.sbomify.com/CVE-2026-24532/): WordPress SiteLock Security plugin <= 5.0.2 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-24531](https://insights.sbomify.com/CVE-2026-24531/): WordPress Prowess theme <= 2.3 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-24530](https://insights.sbomify.com/CVE-2026-24530/): WordPress WebP Conversion plugin <= 2.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-24529](https://insights.sbomify.com/CVE-2026-24529/): WordPress Quick Restaurant Reservations plugin <= 1.6.7 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-24528](https://insights.sbomify.com/CVE-2026-24528/): WordPress Nova Blocks plugin <= 2.1.9 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-24527](https://insights.sbomify.com/CVE-2026-24527/): WordPress Autoship Cloud for WooCommerce Subscription Products plugin <= 2.14.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-24526](https://insights.sbomify.com/CVE-2026-24526/): WordPress Email Inquiry & Cart Options for WooCommerce plugin <= 3.4.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-24525](https://insights.sbomify.com/CVE-2026-24525/): WordPress CLP Varnish Cache plugin <= 1.0.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-24524](https://insights.sbomify.com/CVE-2026-24524/): WordPress Tablesome plugin <= 1.2.8 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-24523](https://insights.sbomify.com/CVE-2026-24523/): WordPress WP FullCalendar plugin <= 1.6 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-24522](https://insights.sbomify.com/CVE-2026-24522/): WordPress WP Subscribe plugin <= 1.2.16 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-24521](https://insights.sbomify.com/CVE-2026-24521/): WordPress Kama Thumbnail plugin <= 3.5.1 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2026-24520](https://insights.sbomify.com/CVE-2026-24520/): WordPress Tiktok Feed plugin <= 1.0.24 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-2452](https://insights.sbomify.com/CVE-2026-2452/): Unsafe variable evaluation in email templates (high 7.5)
- [CVE-2026-24517](https://insights.sbomify.com/CVE-2026-24517/): Copeland XWEB and XWEB Pro OS Command Injection (high 8.0)
- [CVE-2026-24516](https://insights.sbomify.com/CVE-2026-24516/): DigitalOcean Droplet Agent: Command Injection via Metadata Service Endpoint (high 8.8)
- [CVE-2026-24515](https://insights.sbomify.com/CVE-2026-24515/): Memory corruption in libexpat (low 2.9)
- [CVE-2026-24514](https://insights.sbomify.com/CVE-2026-24514/): ingress-nginx Admission Controller denial of service (medium 6.5)
- [CVE-2026-24513](https://insights.sbomify.com/CVE-2026-24513/): ingress-nginx auth-url protection bypass (low 3.1)
- [CVE-2026-24512](https://insights.sbomify.com/CVE-2026-24512/): ingress-nginx auth-method nginx configuration injection (high 8.8)
- [CVE-2026-24511](https://insights.sbomify.com/CVE-2026-24511/): Information disclosure in PowerScale OneFS (medium 4.4)
- [CVE-2026-24510](https://insights.sbomify.com/CVE-2026-24510/): Privilege escalation in Alienware Command Center (AWCC) (medium 6.7)
- [CVE-2026-2451](https://insights.sbomify.com/CVE-2026-2451/): Unsafe variable evaluation in email templates (high 7.5)
- [CVE-2026-24509](https://insights.sbomify.com/CVE-2026-24509/): Missing authorization in Alienware Command Center (AWCC) (low 3.6)
- [CVE-2026-24508](https://insights.sbomify.com/CVE-2026-24508/): Security feature bypass in Alienware Command Center (AWCC) (low 2.5)
- [CVE-2026-24506](https://insights.sbomify.com/CVE-2026-24506/): Command injection in PowerProtect Data Domain (high 7.2)
- [CVE-2026-24505](https://insights.sbomify.com/CVE-2026-24505/): Command injection in PowerProtect Data Domain (high 7.2)
- [CVE-2026-24504](https://insights.sbomify.com/CVE-2026-24504/): Command injection in PowerProtect Data Domain (high 7.2)
- [CVE-2026-24502](https://insights.sbomify.com/CVE-2026-24502/): Privilege escalation in Dell Command | Intel vPro Out of Band (high 8.8)
- [CVE-2026-2450](https://insights.sbomify.com/CVE-2026-2450/): Privilege escalation in upKeeper Instant Privilege Access (high 7.4)
- [CVE-2026-24498](https://insights.sbomify.com/CVE-2026-24498/): Auth bypass in ipTIME AX2004M (medium 6.0)
- [CVE-2026-24497](https://insights.sbomify.com/CVE-2026-24497/): Memory corruption in ThinkWise (high 8.4)
- [CVE-2026-24494](https://insights.sbomify.com/CVE-2026-24494/): SQL injection vulnerability in Order Up Online Ordering System (critical 9.8)
- [CVE-2026-24491](https://insights.sbomify.com/CVE-2026-24491/): FreeRDP has a heap-use-after-free in video_timer (high 7.7)
- [CVE-2026-24490](https://insights.sbomify.com/CVE-2026-24490/): MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field (high 8.1)
- [CVE-2026-2449](https://insights.sbomify.com/CVE-2026-2449/): Command injection in upKeeper Instant Privilege Access (critical 9.0)
- [CVE-2026-24489](https://insights.sbomify.com/CVE-2026-24489/): Gakido vulnerable to HTTP Header Injection (CRLF Injection) (medium 5.3)
- [CVE-2026-24488](https://insights.sbomify.com/CVE-2026-24488/): OpenEMR Vulnerable to Arbitrary File Exfiltration via Fax Endpoint (medium 6.5)
- [CVE-2026-24487](https://insights.sbomify.com/CVE-2026-24487/): OpenEMR has FHIR Patient Compartment Bypass in CareTeam Resource (medium 5.7)
- [CVE-2026-24486](https://insights.sbomify.com/CVE-2026-24486/): Python-Multipart has Arbitrary File Write via Non-Default Configuration (high 8.6)
- [CVE-2026-24485](https://insights.sbomify.com/CVE-2026-24485/): ImageMagick: Infinite loop vulnerability when parsing a PCD file (high 7.5)
- [CVE-2026-24484](https://insights.sbomify.com/CVE-2026-24484/): ImageMagick: Converting multi-layer nested MVG to SVG can cause DoS (medium 5.3)
- [CVE-2026-24481](https://insights.sbomify.com/CVE-2026-24481/): ImageMagick has Possible Heap Information Disclosure in PSD ZIP Decompression (high 7.5)
- [CVE-2026-24480](https://insights.sbomify.com/CVE-2026-24480/): QGIS had validated RCE and Repository Takeover via GitHub Actions (high 8.7)
- [CVE-2026-2448](https://insights.sbomify.com/CVE-2026-2448/): Page Builder by SiteOrigin <= 2.33.5 - Authenticated (Contributor+) Local File Inclusion (high 8.8)
- [CVE-2026-24479](https://insights.sbomify.com/CVE-2026-24479/): HUSTOJ has Arbitrary File Write (Zip Slip) in Problem Import Modules that leads to RCE (critical 9.3)
- [CVE-2026-24478](https://insights.sbomify.com/CVE-2026-24478/): AnythingLLM vulnerable to Path Traversal (high 7.2)
- [CVE-2026-24477](https://insights.sbomify.com/CVE-2026-24477/): AnythingLLM has key leak in `systemSettings.js` (high 8.7)
- [CVE-2026-24476](https://insights.sbomify.com/CVE-2026-24476/): Shaarli vulnerable to stored XSS via Suggested Tags (medium 5.3)
- [CVE-2026-24474](https://insights.sbomify.com/CVE-2026-24474/): Dioxus Components has JavaScript injection via user-supplied IDs (medium 5.3)
- [CVE-2026-24473](https://insights.sbomify.com/CVE-2026-24473/): Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter) (medium 6.3)
- [CVE-2026-24472](https://insights.sbomify.com/CVE-2026-24472/): Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deception (medium 5.3)
- [CVE-2026-24471](https://insights.sbomify.com/CVE-2026-24471/): Improper Validation in Conduit-derived homeservers resulting in Unintended Proxy or Intermediary ('Confused Deputy') (critical 9.3)
- [CVE-2026-24470](https://insights.sbomify.com/CVE-2026-24470/): Skipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalName (high 8.1)
- [CVE-2026-2447](https://insights.sbomify.com/CVE-2026-2447/): Heap buffer overflow in libvpx (high 8.8)
- [CVE-2026-24469](https://insights.sbomify.com/CVE-2026-24469/): C++ HTTP Server has Critical Path Traversal Vulnerability in RequestHandler Allowing Arbitrary File Read (high 7.5)
- [CVE-2026-24468](https://insights.sbomify.com/CVE-2026-24468/): OpenAEV Vulnerable to Username/Email Enumeration Through Differential HTTP Responses in Password Reset API (medium 5.3)
- [CVE-2026-24467](https://insights.sbomify.com/CVE-2026-24467/): OpenAEV's Improper Password Reset Token Management Leads to Unauthenticated Account Takeover and Platform Compromise (critical 9.1)
- [CVE-2026-24466](https://insights.sbomify.com/CVE-2026-24466/): Privilege escalation in See "References" section (high 8.4)
- [CVE-2026-24465](https://insights.sbomify.com/CVE-2026-24465/): Memory corruption in WAB-S300IW-AC (critical 9.3)
- [CVE-2026-24464](https://insights.sbomify.com/CVE-2026-24464/): Appliance mode iControl REST vulnerability (medium 6.9)
- [CVE-2026-2446](https://insights.sbomify.com/CVE-2026-2446/): Powerpack for LearnDash < 1.3.0 - Unauthenticated Arbitrary Option Update (critical 9.8)
- [CVE-2026-24458](https://insights.sbomify.com/CVE-2026-24458/): DoS attack via login attempts with multi-megabyte passwords (high 7.5)
- [CVE-2026-24457](https://insights.sbomify.com/CVE-2026-24457/): Path traversal in Eclipse GlassFish (critical 9.1)
- [CVE-2026-24455](https://insights.sbomify.com/CVE-2026-24455/): Jinan USR IOT Technology Limited (PUSR) USR-W610 Cleartext Transmission of Sensitive Information (high 7.5)
- [CVE-2026-24452](https://insights.sbomify.com/CVE-2026-24452/): Copeland XWEB and XWEB Pro OS Command Injection (high 8.0)
- [CVE-2026-24451](https://insights.sbomify.com/CVE-2026-24451/): Gitea fork synchronization can expose private parent repository data (high 7.5)
- [CVE-2026-24450](https://insights.sbomify.com/CVE-2026-24450/): Integer overflow in LibRaw (high 8.1)
- [CVE-2026-2445](https://insights.sbomify.com/CVE-2026-2445/): Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Redirection and Modification (medium 6.1)
- [CVE-2026-24449](https://insights.sbomify.com/CVE-2026-24449/): Weak cryptography in WRC-X1500GS-B (medium 5.1)
- [CVE-2026-24448](https://insights.sbomify.com/CVE-2026-24448/): Hardcoded credentials in MR-GM5A-L1 (critical 9.3)
- [CVE-2026-24447](https://insights.sbomify.com/CVE-2026-24447/): Code injection in Movable Type (Cloud Edition) (medium 4.8)
- [CVE-2026-24445](https://insights.sbomify.com/CVE-2026-24445/): EV Energy ev.energy Improper Restriction of Excessive Authentication Attempts (high 8.7)
- [CVE-2026-24444](https://insights.sbomify.com/CVE-2026-24444/): SDMC NE6037 Hardcoded Password via mgmt.php/npcmd.php (critical 9.3)
- [CVE-2026-24443](https://insights.sbomify.com/CVE-2026-24443/): EventSentry < 6.0.1.20 Web Reports Unverified Password Change (high 8.6)
- [CVE-2026-24441](https://insights.sbomify.com/CVE-2026-24441/): Tenda AC7 Transmits Admin Credentials Without HTTPS Protection (high 8.2)
- [CVE-2026-24440](https://insights.sbomify.com/CVE-2026-24440/): Tenda W30E V2 Allows Password Changes Without Verifying Current Password (high 8.7)
- [CVE-2026-24439](https://insights.sbomify.com/CVE-2026-24439/): Tenda W30E V2 Lacks X-Content-Type-Options Header (low 2.1)
- [CVE-2026-24437](https://insights.sbomify.com/CVE-2026-24437/): Tenda W30E V2 Missing Cache Controls for Credential-bearing Pages (medium 4.8)
- [CVE-2026-24436](https://insights.sbomify.com/CVE-2026-24436/): Tenda W30E V2 Lacks Rate Limiting on Authentication (critical 9.2)
- [CVE-2026-24435](https://insights.sbomify.com/CVE-2026-24435/): Tenda W30E V2 Permissive CORS Allows Cross-origin Data Access (high 7.1)
- [CVE-2026-24434](https://insights.sbomify.com/CVE-2026-24434/): Tenda AC7 Web Interface Lacks CSRF Protections for Admin Actions (medium 5.1)
- [CVE-2026-24433](https://insights.sbomify.com/CVE-2026-24433/): Tenda W30E V2 Stored XSS via Username Field (medium 5.1)
- [CVE-2026-24432](https://insights.sbomify.com/CVE-2026-24432/): Tenda W30E V2 Missing CSRF Protections for Administrative Actions (medium 5.1)
- [CVE-2026-24431](https://insights.sbomify.com/CVE-2026-24431/): Tenda W30E V2 Web UI Reveals Passwords in Cleartext (high 7.1)
- [CVE-2026-24430](https://insights.sbomify.com/CVE-2026-24430/): Tenda W30E V2 HTTP Responses Expose Plaintext Credentials (high 8.2)
- [CVE-2026-2443](https://insights.sbomify.com/CVE-2026-2443/): Libsoup: out-of-bounds read in libsoup handle_partial_get() leading to heap information disclosure (medium 5.3)
- [CVE-2026-24429](https://insights.sbomify.com/CVE-2026-24429/): Tenda W30E V2 Hardcoded Default Password for Built-in Account (critical 9.3)
- [CVE-2026-24428](https://insights.sbomify.com/CVE-2026-24428/): Tenda W30E V2 Incorrect Authorization Allows Administrator Password Change (high 8.7)
- [CVE-2026-24427](https://insights.sbomify.com/CVE-2026-24427/): Tenda AC7 Exposes Admin Credentials in Configuration Responses (medium 6.8)
- [CVE-2026-24426](https://insights.sbomify.com/CVE-2026-24426/): Tenda AC7 Reflected XSS via Web Interface Output Encoding (medium 5.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/779/