# Vulnerabilities published in 2026


- [CVE-2026-24425](https://insights.sbomify.com/CVE-2026-24425/): Twig 2.16.x & 3.9.0-3.25.x Sandbox Bypass via SourcePolicyInterface (high 8.7)
- [CVE-2026-24423](https://insights.sbomify.com/CVE-2026-24423/): SmarterTools SmarterMail Missing Authentication for Critical Function (critical 9.3, exploited in the wild)
- [CVE-2026-24422](https://insights.sbomify.com/CVE-2026-24422/): phpMyFAQ: Public API endpoints expose emails and invisible questions (medium 5.3)
- [CVE-2026-24421](https://insights.sbomify.com/CVE-2026-24421/): phpMyFAQ missing authorization exposes /api/setup/backup to any authenticated user (medium 6.5)
- [CVE-2026-24420](https://insights.sbomify.com/CVE-2026-24420/): phpMyFAQ: Attachment download allowed without dlattachment right (broken access control) (medium 6.5)
- [CVE-2026-2442](https://insights.sbomify.com/CVE-2026-2442/): Pagelayer <= 2.0.7 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via 'email' (medium 5.3)
- [CVE-2026-24419](https://insights.sbomify.com/CVE-2026-24419/): OpenSTAManager has an SQL Injection in the Prima Nota module (high 8.7)
- [CVE-2026-24418](https://insights.sbomify.com/CVE-2026-24418/): OpenSTAManager has an SQL Injection vulnerability in the Scadenzario bulk operations module (high 8.7)
- [CVE-2026-24417](https://insights.sbomify.com/CVE-2026-24417/): OpenSTAManager has a Time-Based Blind SQL Injection with Amplified Denial of Service (high 8.7)
- [CVE-2026-24416](https://insights.sbomify.com/CVE-2026-24416/): OpenSTAManager has a Time-Based Blind SQL Injection in Article Pricing Module (high 8.7)
- [CVE-2026-24415](https://insights.sbomify.com/CVE-2026-24415/): OpenSTAManager affected by reflected XSS in modifica_iva.php via righe parameter (medium 5.1)
- [CVE-2026-24414](https://insights.sbomify.com/CVE-2026-24414/): Icinga for Windows certificate can have too-open permissions (medium 6.8)
- [CVE-2026-24413](https://insights.sbomify.com/CVE-2026-24413/): Icinga has insecure permission of %ProgramData%\icinga2\var on Windows (medium 6.8)
- [CVE-2026-24412](https://insights.sbomify.com/CVE-2026-24412/): iccDEV has Heap Buffer Overflow in icCurvesFromXml() (high 8.8)
- [CVE-2026-24411](https://insights.sbomify.com/CVE-2026-24411/): iccDEV has Undefined Behavior and Null Pointer Deference in CIccTagXmlSegmentedCurve::ToXml() (high 7.1)
- [CVE-2026-24410](https://insights.sbomify.com/CVE-2026-24410/): iccDEV has Undefined Behavior and Null Pointer Deference in CIccProfileXml::ParseBasic() (high 7.1)
- [CVE-2026-2441](https://insights.sbomify.com/CVE-2026-2441/): Google Chromium CSS Use-After-Free (high 8.8, exploited in the wild)
- [CVE-2026-24409](https://insights.sbomify.com/CVE-2026-24409/): iccDEV has Undefined Behavior and Null Pointer Deference in CIccTagXmlFloatNum<>::ParseXml() (high 7.1)
- [CVE-2026-24408](https://insights.sbomify.com/CVE-2026-24408/): sigstore has CSRF possibility in OIDC authentication during signing (not scored)
- [CVE-2026-24407](https://insights.sbomify.com/CVE-2026-24407/): iccDEV has Undefined Behavior in icSigCalcOp() (high 7.1)
- [CVE-2026-24406](https://insights.sbomify.com/CVE-2026-24406/): iccDEV has Heap Buffer Overflow in CIccTagNamedColor2::SetSize() (high 8.8)
- [CVE-2026-24405](https://insights.sbomify.com/CVE-2026-24405/): iccDEV has Heap Buffer Overflow in CIccMpeCalculator::Read() (high 8.8)
- [CVE-2026-24404](https://insights.sbomify.com/CVE-2026-24404/): iccDEV has Null Pointer Deference and Undefined Behavior in CIccXmlArrayType() (high 7.1)
- [CVE-2026-24403](https://insights.sbomify.com/CVE-2026-24403/): iccDEV Undefined Behavior in CIccProfile::CheckHeader() Leads to Integer Overflow (high 7.1)
- [CVE-2026-24401](https://insights.sbomify.com/CVE-2026-24401/): Avahi has Uncontrolled Recursion in lookup_handle_cname function (medium 6.5)
- [CVE-2026-24400](https://insights.sbomify.com/CVE-2026-24400/): AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion (high 8.2)
- [CVE-2026-2440](https://insights.sbomify.com/CVE-2026-2440/): SurveyJS: Drag & Drop Form Builder <= 2.5.3 - Unauthenticated Stored Cross-Site Scripting (high 7.2)
- [CVE-2026-24399](https://insights.sbomify.com/CVE-2026-24399/): ChatterMate has Stored Cross-Site Scripting (XSS) via Chatbot Input Execution (critical 9.3)
- [CVE-2026-24398](https://insights.sbomify.com/CVE-2026-24398/): Hono's IPv4 address validation bypass in IP Restriction Middleware allows IP spoofing (medium 4.8)
- [CVE-2026-24392](https://insights.sbomify.com/CVE-2026-24392/): WordPress HurryTimer plugin <= 2.14.2 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2026-24391](https://insights.sbomify.com/CVE-2026-24391/): WordPress Car Dealer theme <= 1.6.7 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-24390](https://insights.sbomify.com/CVE-2026-24390/): WordPress Kentha Elementor Widgets plugin < 3.1 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-2439](https://insights.sbomify.com/CVE-2026-2439/): Concierge::Sessions versions from 0.8.1 before 0.8.5 for Perl generate insecure session ids (critical 9.8)
- [CVE-2026-24389](https://insights.sbomify.com/CVE-2026-24389/): WordPress Gallery PhotoBlocks plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-24388](https://insights.sbomify.com/CVE-2026-24388/): WordPress WPMasterToolKit plugin <= 2.14.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-24387](https://insights.sbomify.com/CVE-2026-24387/): WordPress WP Quick Post Duplicator plugin <= 2.1 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-24386](https://insights.sbomify.com/CVE-2026-24386/): WordPress Element Invader – Template Kits for Elementor plugin <= 1.2.4 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-24385](https://insights.sbomify.com/CVE-2026-24385/): WordPress Podlove Web Player plugin <= 5.9.1 - PHP Object Injection vulnerability (high 7.5)
- [CVE-2026-24384](https://insights.sbomify.com/CVE-2026-24384/): WordPress Merge + Minify + Refresh plugin <= 2.14 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2026-24383](https://insights.sbomify.com/CVE-2026-24383/): WordPress B Slider plugin <= 2.0.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-24382](https://insights.sbomify.com/CVE-2026-24382/): WordPress News Magazine X theme <= 1.2.50 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-24381](https://insights.sbomify.com/CVE-2026-24381/): WordPress PhotoMe theme < 5.7.2 - Server Side Request Forgery (SSRF) vulnerability (medium 5.4)
- [CVE-2026-24380](https://insights.sbomify.com/CVE-2026-24380/): WordPress EventPrime plugin <= 4.2.8.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-24379](https://insights.sbomify.com/CVE-2026-24379/): WordPress WP Job Portal plugin <= 2.4.3 - Insecure Direct Object References (IDOR) vulnerability (medium 4.3)
- [CVE-2026-24378](https://insights.sbomify.com/CVE-2026-24378/): WordPress EventPrime plugin <= 4.2.8.0 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-24377](https://insights.sbomify.com/CVE-2026-24377/): WordPress Nexter Blocks plugin <= 4.6.3 - Sensitive Data Exposure vulnerability (medium 4.3)
- [CVE-2026-24376](https://insights.sbomify.com/CVE-2026-24376/): WordPress WPVulnerability plugin <= 4.2.1 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-24375](https://insights.sbomify.com/CVE-2026-24375/): WordPress Ultimate Gift Cards For WooCommerce plugin <= 3.2.4 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-24374](https://insights.sbomify.com/CVE-2026-24374/): WordPress RegistrationMagic plugin <= 6.0.6.9 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2026-24373](https://insights.sbomify.com/CVE-2026-24373/): WordPress RegistrationMagic plugin <= 6.0.7.1 - Account Takeover vulnerability (high 8.1)
- [CVE-2026-24372](https://insights.sbomify.com/CVE-2026-24372/): WordPress Subscriptions for WooCommerce plugin <= 1.8.10 - Bypass Vulnerability vulnerability (high 7.5)
- [CVE-2026-24371](https://insights.sbomify.com/CVE-2026-24371/): WordPress BA Book Everything plugin <= 1.8.16 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-24370](https://insights.sbomify.com/CVE-2026-24370/): WordPress The Grid plugin <= 2.8.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-2437](https://insights.sbomify.com/CVE-2026-2437/): Cross-site scripting in WP Travel Engine – Tour Booking Plugin – Tour Operator Software (medium 6.4)
- [CVE-2026-24369](https://insights.sbomify.com/CVE-2026-24369/): WordPress The Grid plugin <= 2.8.0 - Broken Access Control vulnerability (high 7.1)
- [CVE-2026-24368](https://insights.sbomify.com/CVE-2026-24368/): WordPress The Grid plugin <= 2.8.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-24367](https://insights.sbomify.com/CVE-2026-24367/): WordPress Traveler theme < 3.2.8 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-24366](https://insights.sbomify.com/CVE-2026-24366/): WordPress YITH WooCommerce Request A Quote plugin <= 2.46.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-24365](https://insights.sbomify.com/CVE-2026-24365/): WordPress Stock Manager for WooCommerce plugin < 3.6.0 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2026-24364](https://insights.sbomify.com/CVE-2026-24364/): WordPress WP User Frontend plugin <= 4.2.5 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-24363](https://insights.sbomify.com/CVE-2026-24363/): WordPress WP Cost Estimation & Payment Forms Builder plugin < 10.3.0 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-24362](https://insights.sbomify.com/CVE-2026-24362/): WordPress Ultimate Post Kit plugin <= 4.0.21 - Broken Access Control vulnerability (medium 6.4)
- [CVE-2026-24361](https://insights.sbomify.com/CVE-2026-24361/): WordPress LearnPress – Course Review plugin <= 4.1.9 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-24360](https://insights.sbomify.com/CVE-2026-24360/): WordPress Seriously Simple Podcasting plugin <= 3.14.1 - Server Side Request Forgery (SSRF) vulnerability (medium 4.4)
- [CVE-2026-2436](https://insights.sbomify.com/CVE-2026-2436/): Libsoup: libsoup: denial of service via use-after-free in soupserver during tls handshake (medium 6.5)
- [CVE-2026-24359](https://insights.sbomify.com/CVE-2026-24359/): WordPress Dokan plugin <= 4.2.4 - Broken Authentication vulnerability (high 8.8)
- [CVE-2026-24358](https://insights.sbomify.com/CVE-2026-24358/): WordPress Quiz And Survey Master plugin <= 10.3.3 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-24357](https://insights.sbomify.com/CVE-2026-24357/): WordPress WP Recipe Maker plugin <= 10.2.4 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-24356](https://insights.sbomify.com/CVE-2026-24356/): WordPress GetGenie plugin <= 4.3.0 - Broken Access Control vulnerability (medium 4.9)
- [CVE-2026-24355](https://insights.sbomify.com/CVE-2026-24355/): WordPress Houzez Theme - Functionality plugin <= 4.2.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-24354](https://insights.sbomify.com/CVE-2026-24354/): WordPress Penci Shortcodes & Performance plugin <= 6.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-24353](https://insights.sbomify.com/CVE-2026-24353/): WordPress User Registration plugin <= 4.4.9 - Arbitrary Shortcode Execution vulnerability (medium 4.3)
- [CVE-2026-24352](https://insights.sbomify.com/CVE-2026-24352/): Session Fixation in PluXml CMS (medium 4.8)
- [CVE-2026-24351](https://insights.sbomify.com/CVE-2026-24351/): Stored XSS in PluXml CMS (medium 5.1)
- [CVE-2026-24350](https://insights.sbomify.com/CVE-2026-24350/): Stored XSS in PluXml CMS (medium 5.1)
- [CVE-2026-2435](https://insights.sbomify.com/CVE-2026-2435/): ASSET-7706 (medium 6.3)
- [CVE-2026-24349](https://insights.sbomify.com/CVE-2026-24349/): Information disclosure in SIMATIC WinCC Unified PC Runtime V16 (high 8.2)
- [CVE-2026-24348](https://insights.sbomify.com/CVE-2026-24348/): Multiple cross-site scripting vulnerabilities in EZCast Pro II Dongle (high 7.4)
- [CVE-2026-24347](https://insights.sbomify.com/CVE-2026-24347/): Arbitrary file write to /tmp directory in EZCast Pro II Dongle (medium 5.7)
- [CVE-2026-24346](https://insights.sbomify.com/CVE-2026-24346/): Use of well-known default credentials in EZCast Pro II Dongle (high 7.6)
- [CVE-2026-24345](https://insights.sbomify.com/CVE-2026-24345/): Cross-Site Request Forgery in EZCast Pro II Dongle (medium 6.8)
- [CVE-2026-24344](https://insights.sbomify.com/CVE-2026-24344/): Multiple Buffer Overflows in EZCast Pro II Dongle (high 7.3)
- [CVE-2026-24343](https://insights.sbomify.com/CVE-2026-24343/): Apache HertzBeat: Uncontrolled Resource Consumption via Crafted XPath Expressions (high 8.8)
- [CVE-2026-2434](https://insights.sbomify.com/CVE-2026-2434/): Pz-LinkCard <= 2.5.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-24332](https://insights.sbomify.com/CVE-2026-24332/): Information disclosure in WebSocket API service (medium 4.3)
- [CVE-2026-24330](https://insights.sbomify.com/CVE-2026-24330/): Wildfly-core: wildfly: arbitrary file read via malicious archive deployment (medium 6.5)
- [CVE-2026-2433](https://insights.sbomify.com/CVE-2026-2433/): Cross-site scripting in RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging (medium 6.1)
- [CVE-2026-24329](https://insights.sbomify.com/CVE-2026-24329/): Wildfly-core: wildfly core: denial of service via malformed payload injection by an authenticated administrative user. (medium 4.9)
- [CVE-2026-24328](https://insights.sbomify.com/CVE-2026-24328/): Open Redirection vulnerability in Business Server Pages Application (TAF_APPLAUNCHER) (medium 6.1)
- [CVE-2026-24327](https://insights.sbomify.com/CVE-2026-24327/): Missing Authorization Check in SAP Strategic Enterprise Management (Balanced Scorecard in BSP Application) (medium 4.3)
- [CVE-2026-24326](https://insights.sbomify.com/CVE-2026-24326/): Missing authorization check in SAP S/4HANA Defense & Security (Disconnected Operations) (medium 4.3)
- [CVE-2026-24325](https://insights.sbomify.com/CVE-2026-24325/): Cross Site Scripting (XSS) vulnerability in SAP BusinessObjects Enterprise (Central Management Console) (medium 4.8)
- [CVE-2026-24324](https://insights.sbomify.com/CVE-2026-24324/): Denial of service (DOS) vulnerability in SAP BusinessObjects Business Intelligence Platform (AdminTools) (medium 6.5)
- [CVE-2026-24323](https://insights.sbomify.com/CVE-2026-24323/): Multiple vulnerabilities in BSP Applications of SAP Document Management System (medium 6.1)
- [CVE-2026-24322](https://insights.sbomify.com/CVE-2026-24322/): Missing Authorization check in SAP Solution Tools Plug-In (ST-PI) (high 7.7)
- [CVE-2026-24321](https://insights.sbomify.com/CVE-2026-24321/): Information Disclosure vulnerability in SAP Commerce Cloud (medium 5.3)
- [CVE-2026-24320](https://insights.sbomify.com/CVE-2026-24320/): Memory Corruption vulnerability in SAP NetWeaver and ABAP Platform (Application Server ABAP) (low 3.1)
- [CVE-2026-2432](https://insights.sbomify.com/CVE-2026-2432/): CM Custom Reports <= 1.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Labels (medium 4.4)
- [CVE-2026-24319](https://insights.sbomify.com/CVE-2026-24319/): Information Disclosure Vulnerability in SAP Business One (B1 Client Memory Dump Files) (medium 5.8)
- [CVE-2026-24318](https://insights.sbomify.com/CVE-2026-24318/): Insecure Session Management vulnerability in SAP BusinessObjects Business Intelligence Platform (medium 4.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/780/