# Vulnerabilities published in 2026


- [CVE-2026-23884](https://insights.sbomify.com/CVE-2026-23884/): Heap-use-after-free in gdi_set_bounds (high 7.7)
- [CVE-2026-23883](https://insights.sbomify.com/CVE-2026-23883/): Heap-use-after-free in update_pointer_new (high 7.7)
- [CVE-2026-23882](https://insights.sbomify.com/CVE-2026-23882/): Blinko: Admin RCE - MCP Server Command Injection (high 8.6)
- [CVE-2026-23881](https://insights.sbomify.com/CVE-2026-23881/): Kyverno Denial of Service via Context Variable Amplification in Policy Engine (high 7.7)
- [CVE-2026-23880](https://insights.sbomify.com/CVE-2026-23880/): OnboardLite has stored Cross-site Scripting issue that may lead to admin Account Take Over (high 7.3)
- [CVE-2026-2388](https://insights.sbomify.com/CVE-2026-2388/): Cross-site scripting in Reviews and Rating – Google Reviews (medium 6.4)
- [CVE-2026-23879](https://insights.sbomify.com/CVE-2026-23879/): py7zr: Arbitrary File Write Vulnerability (high 8.0)
- [CVE-2026-23878](https://insights.sbomify.com/CVE-2026-23878/): HotCRP vulnerable to exposure of submitted documents (medium 6.5)
- [CVE-2026-23877](https://insights.sbomify.com/CVE-2026-23877/): Directory Traversal & Filesystem can be accessed by a non-admin user (medium 5.3)
- [CVE-2026-23876](https://insights.sbomify.com/CVE-2026-23876/): Heap buffer overflow with attacker-controlled data in XBM parser (high 8.1)
- [CVE-2026-23875](https://insights.sbomify.com/CVE-2026-23875/): CrawlChat's Discord Bot has a Knowledge Permission vulnerability (medium 5.7)
- [CVE-2026-23874](https://insights.sbomify.com/CVE-2026-23874/): ImageMagick's MSL: Stack overflow via infinite recursion in ProcessMSLScript (medium 5.5)
- [CVE-2026-23873](https://insights.sbomify.com/CVE-2026-23873/): HUSTOJ is Vulnerable to Stored CSV Injection (Formula Injection) in Contest Rank Export (medium 5.2)
- [CVE-2026-23870](https://insights.sbomify.com/CVE-2026-23870/): Facebook React has a Denial of Service Vulnerability in React Server Components (high 7.5)
- [CVE-2026-2387](https://insights.sbomify.com/CVE-2026-2387/): Event Organiser <= 3.12.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via eo_events Shortcode (medium 6.4)
- [CVE-2026-23869](https://insights.sbomify.com/CVE-2026-23869/): React Server Components have a Denial of Service Vulnerability (high 7.5)
- [CVE-2026-23868](https://insights.sbomify.com/CVE-2026-23868/): Memory corruption in giflib (medium 5.1)
- [CVE-2026-23866](https://insights.sbomify.com/CVE-2026-23866/): Code injection in WhatsApp for Android (medium 4.3)
- [CVE-2026-23865](https://insights.sbomify.com/CVE-2026-23865/): Integer overflow in FreeType (medium 5.3)
- [CVE-2026-23864](https://insights.sbomify.com/CVE-2026-23864/): React Server Components have multiple Denial of Service Vulnerabilities (high 7.5)
- [CVE-2026-23863](https://insights.sbomify.com/CVE-2026-23863/): Security feature bypass in WhatsApp Desktop for Windows (medium 6.5)
- [CVE-2026-23862](https://insights.sbomify.com/CVE-2026-23862/): Command injection in ThinOS 10 (high 7.8)
- [CVE-2026-23861](https://insights.sbomify.com/CVE-2026-23861/): Cross-site scripting in Unisphere for PowerMax vApp, (medium 5.4)
- [CVE-2026-2386](https://insights.sbomify.com/CVE-2026-2386/): Missing authorization in The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce (medium 4.3)
- [CVE-2026-23859](https://insights.sbomify.com/CVE-2026-23859/): Security feature bypass in Wyse Management Suite (low 2.7)
- [CVE-2026-23858](https://insights.sbomify.com/CVE-2026-23858/): Cross-site scripting in Wyse Management Suite (medium 5.4)
- [CVE-2026-23857](https://insights.sbomify.com/CVE-2026-23857/): Privilege escalation in Update Package (high 8.2)
- [CVE-2026-23856](https://insights.sbomify.com/CVE-2026-23856/): Privilege escalation in iDRAC Service Module (high 7.8)
- [CVE-2026-23855](https://insights.sbomify.com/CVE-2026-23855/): Command injection in iDRAC10 (high 7.2)
- [CVE-2026-23853](https://insights.sbomify.com/CVE-2026-23853/): Hardcoded credentials in PowerProtect Data Domain (high 8.4)
- [CVE-2026-23852](https://insights.sbomify.com/CVE-2026-23852/): SiYuan vulnerable to Stored XSS / RCE via `setBlockAttrs` icon attribute (medium 5.8)
- [CVE-2026-23851](https://insights.sbomify.com/CVE-2026-23851/): SiYuan Vulnerable to Arbitrary File Read via File Copy Functionality (high 8.3)
- [CVE-2026-23850](https://insights.sbomify.com/CVE-2026-23850/): SiYuan vulnerable to arbitrary file read (high 7.8)
- [CVE-2026-2385](https://insights.sbomify.com/CVE-2026-2385/): Security feature bypass in The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce (medium 5.3)
- [CVE-2026-23849](https://insights.sbomify.com/CVE-2026-23849/): File Browser vulnerable to Username Enumeration via Timing Attack in /api/login (medium 5.3)
- [CVE-2026-23848](https://insights.sbomify.com/CVE-2026-23848/): MyTube has Rate Limiting Bypass via X-Forwarded-For Header Spoofing (medium 6.5)
- [CVE-2026-23847](https://insights.sbomify.com/CVE-2026-23847/): SiYuan Vulnerable to Reflected Cross-Site Scripting (XSS) via /api/icon/getDynamicIcon (low 2.1)
- [CVE-2026-23846](https://insights.sbomify.com/CVE-2026-23846/): Tugtainer vulnerable to Password Exposure via URL Query Parameter (high 8.1)
- [CVE-2026-23845](https://insights.sbomify.com/CVE-2026-23845/): Mailpit Vulnerable to Server-Side Request Forgery (SSRF) via HTML Check API (medium 5.8)
- [CVE-2026-23844](https://insights.sbomify.com/CVE-2026-23844/): Whisper Money has IDOR Vulnerability on sync/balances endpoint (medium 4.9)
- [CVE-2026-23843](https://insights.sbomify.com/CVE-2026-23843/): teklifolustur_app's IDOR vulnerability allows unauthorized access to other users' offers (high 7.1)
- [CVE-2026-23842](https://insights.sbomify.com/CVE-2026-23842/): ChatterBot has Denial of Service via Database Connection Pool Exhaustion (high 7.5)
- [CVE-2026-23841](https://insights.sbomify.com/CVE-2026-23841/): Movary vulnerable to Cross-site Scripting with `?categoryCreated=` param (critical 9.3)
- [CVE-2026-23840](https://insights.sbomify.com/CVE-2026-23840/): Movary vulnerable to Cross-site Scripting with `?categoryDeleted=` param (critical 9.3)
- [CVE-2026-2384](https://insights.sbomify.com/CVE-2026-2384/): Quiz Maker <= 6.7.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2026-23839](https://insights.sbomify.com/CVE-2026-23839/): Movary vulnerable to Cross-site Scripting with `?categoryUpdated=` param (critical 9.3)
- [CVE-2026-23838](https://insights.sbomify.com/CVE-2026-23838/): Tandoor Recipes module allows SQLite database to be externally accessible with the default settings (high 8.7)
- [CVE-2026-23837](https://insights.sbomify.com/CVE-2026-23837/): MyTube has an Authorization Bypass vulnerability (critical 9.8)
- [CVE-2026-23836](https://insights.sbomify.com/CVE-2026-23836/): HotCRP vulnerable to remote code execution through formulas (critical 10.0)
- [CVE-2026-23835](https://insights.sbomify.com/CVE-2026-23835/): LobeHub Vulnerable to Improper Authorization in Presigned Upload (medium 5.7)
- [CVE-2026-23833](https://insights.sbomify.com/CVE-2026-23833/): ESPHome vulnerable to denial-of-service via out-of-bounds check bypass in the API component (low 1.7)
- [CVE-2026-23831](https://insights.sbomify.com/CVE-2026-23831/): Rekor COSE v0.0.1 Canonicalize crashes when passed empty Message (medium 5.3)
- [CVE-2026-23830](https://insights.sbomify.com/CVE-2026-23830/): SandboxJS has Sandbox Escape via Unprotected AsyncFunction Constructor (critical 10.0)
- [CVE-2026-2383](https://insights.sbomify.com/CVE-2026-2383/): Simple Download Monitor <= 4.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field (medium 6.4)
- [CVE-2026-23829](https://insights.sbomify.com/CVE-2026-23829/): Mailpit has SMTP Header Injection via Regex Bypass (medium 5.3)
- [CVE-2026-23827](https://insights.sbomify.com/CVE-2026-23827/): Unauthenticated Remote Code Execution via Heap Buffer Overflow in Network Management Service (high 7.5)
- [CVE-2026-23826](https://insights.sbomify.com/CVE-2026-23826/): Unauthenticated Denial of Service in AOS-8 Network Management Service (high 7.5)
- [CVE-2026-23825](https://insights.sbomify.com/CVE-2026-23825/): Unauthenticated Denial-of-Service via Crafted Messages in a Network Protocol Handling Component (high 7.5)
- [CVE-2026-23824](https://insights.sbomify.com/CVE-2026-23824/): Unauthenticated Denial-of-Service via Crafted Messages in a Network Protocol Handling Component (high 7.5)
- [CVE-2026-23823](https://insights.sbomify.com/CVE-2026-23823/): Authenticated Command Injection leads to RCE in AOS-10 CLI Command (high 7.2)
- [CVE-2026-23822](https://insights.sbomify.com/CVE-2026-23822/): Unauthenticated XML External Entity Injection in AOS-8 Instant allows Denial of Service (medium 5.3)
- [CVE-2026-23821](https://insights.sbomify.com/CVE-2026-23821/): Inconsistent input filtering allows Authenticated Command Injection in AOS-10 CLI (high 7.2)
- [CVE-2026-23820](https://insights.sbomify.com/CVE-2026-23820/): Inconsistent input filtering allows Authenticated Command Injection in AOS-8 Instant and AOS-10 CLI (high 7.2)
- [CVE-2026-2382](https://insights.sbomify.com/CVE-2026-2382/): FPW Category Thumbnails <= 1.9.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'id' Parameter (medium 6.4)
- [CVE-2026-23819](https://insights.sbomify.com/CVE-2026-23819/): Error in SSID Processing allows Stored XSS in Web Management Interface (high 8.8)
- [CVE-2026-23818](https://insights.sbomify.com/CVE-2026-23818/): Open Redirect Vulnerability in HPE Aruba Networking Private 5G Core On-Prem (high 8.8)
- [CVE-2026-23817](https://insights.sbomify.com/CVE-2026-23817/): Unauthenticated Open Redirect allows URL Manipulation in Web Interface (medium 6.5)
- [CVE-2026-23816](https://insights.sbomify.com/CVE-2026-23816/): Authenticated Command Injection found in admin AOS-CX CLI command (high 7.2)
- [CVE-2026-23815](https://insights.sbomify.com/CVE-2026-23815/): Authenticated Command Injection found in AOS-CX Administrative CLI Command (high 7.2)
- [CVE-2026-23814](https://insights.sbomify.com/CVE-2026-23814/): Authenticated Command Injection found in AOS-CX CLI Command (high 8.8)
- [CVE-2026-23813](https://insights.sbomify.com/CVE-2026-23813/): Authentication Bypass in Web Interface allows Unauthenticated Admin Password Reset (critical 9.8)
- [CVE-2026-23812](https://insights.sbomify.com/CVE-2026-23812/): Security Boundary Bypass via Routing Node Impersonation (medium 4.3)
- [CVE-2026-23811](https://insights.sbomify.com/CVE-2026-23811/): Unauthorized Bi-Directional Traffic Interception via L2/L3 Manipulation (medium 4.3)
- [CVE-2026-23810](https://insights.sbomify.com/CVE-2026-23810/): Cross-BSSID GTK Re-encryption and Traffic Injection (medium 4.3)
- [CVE-2026-2381](https://insights.sbomify.com/CVE-2026-2381/): Missing authorization in WooCommerce Stripe Payment Gateway (medium 6.5)
- [CVE-2026-23809](https://insights.sbomify.com/CVE-2026-23809/): MAC Address Spoofing leads to Inter-BSSID Isolation Bypass Resulting in Traffic Redirection (medium 5.4)
- [CVE-2026-23808](https://insights.sbomify.com/CVE-2026-23808/): Client Isolation Bypass via GTK Manipulation (medium 5.4)
- [CVE-2026-23807](https://insights.sbomify.com/CVE-2026-23807/): WordPress WP Telegram Widget and Join Link plugin <= 2.2.13 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-23806](https://insights.sbomify.com/CVE-2026-23806/): WordPress Jobs for WordPress plugin <= 2.8 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-23805](https://insights.sbomify.com/CVE-2026-23805/): WordPress Media Search Enhanced plugin <= 0.9.1 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-23804](https://insights.sbomify.com/CVE-2026-23804/): WordPress Better Business Reviews plugin <= 0.1.1 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-23803](https://insights.sbomify.com/CVE-2026-23803/): WordPress Smart Auto Upload Images plugin <= 1.2.2 - Server Side Request Forgery (SSRF) vulnerability (high 7.2)
- [CVE-2026-23802](https://insights.sbomify.com/CVE-2026-23802/): WordPress AI Engine plugin <= 3.3.2 - Arbitrary File Upload vulnerability (critical 9.1)
- [CVE-2026-23801](https://insights.sbomify.com/CVE-2026-23801/): WordPress The Issue theme <= 1.6.11 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-23800](https://insights.sbomify.com/CVE-2026-23800/): WordPress Modular DS plugin <= 2.5.2 - Privilege Escalation vulnerability (critical 10.0)
- [CVE-2026-2380](https://insights.sbomify.com/CVE-2026-2380/): Security Advisory 0168 (medium 5.1)
- [CVE-2026-23799](https://insights.sbomify.com/CVE-2026-23799/): WordPress Tutor LMS plugin <= 3.9.5 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-23798](https://insights.sbomify.com/CVE-2026-23798/): WordPress PowerPress Podcasting plugin <= 11.15.10 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-23797](https://insights.sbomify.com/CVE-2026-23797/): Plaintext password display in Quick.Cart (medium 6.9)
- [CVE-2026-23796](https://insights.sbomify.com/CVE-2026-23796/): Session Fixation in Quick.Cart (medium 4.8)
- [CVE-2026-23795](https://insights.sbomify.com/CVE-2026-23795/): Apache Syncope: Console XXE on Keymaster parameters (medium 4.9)
- [CVE-2026-23794](https://insights.sbomify.com/CVE-2026-23794/): Apache Syncope: Reflected XSS on Enduser Login (medium 6.8)
- [CVE-2026-23793](https://insights.sbomify.com/CVE-2026-23793/): Memory corruption in Exynos 1330 firmware (low 3.5)
- [CVE-2026-23792](https://insights.sbomify.com/CVE-2026-23792/): Denial of service in Exynos 1080 firmware (medium 4.0)
- [CVE-2026-23791](https://insights.sbomify.com/CVE-2026-23791/): Memory corruption in Exynos 1280 firmware (medium 4.2)
- [CVE-2026-23790](https://insights.sbomify.com/CVE-2026-23790/): Memory corruption in Exynos 1280 firmware (medium 4.2)
- [CVE-2026-2379](https://insights.sbomify.com/CVE-2026-2379/): Arista EOS IPsec Tunnel Sequence Number Mismatch via Interface Flaps when Anti-Replay is Disabled (high 8.2)
- [CVE-2026-23789](https://insights.sbomify.com/CVE-2026-23789/): Memory corruption in Exynos 850 firmware (high 7.8)
- [CVE-2026-23788](https://insights.sbomify.com/CVE-2026-23788/): Memory corruption in Exynos 1280 firmware (medium 4.2)
- [CVE-2026-23787](https://insights.sbomify.com/CVE-2026-23787/): Use after free in Exynos 1280 firmware (medium 4.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/785/