# Vulnerabilities published in 2026


- [CVE-2026-23556](https://insights.sbomify.com/CVE-2026-23556/): oxenstored keeps quota related use counts across domain destruction (critical 9.4)
- [CVE-2026-23555](https://insights.sbomify.com/CVE-2026-23555/): Xenstored DoS by unprivileged domain (high 7.1)
- [CVE-2026-23554](https://insights.sbomify.com/CVE-2026-23554/): Use after free of paging structures in EPT (high 7.8)
- [CVE-2026-23553](https://insights.sbomify.com/CVE-2026-23553/): x86: incomplete IBPB for vCPU isolation (low 2.9)
- [CVE-2026-23552](https://insights.sbomify.com/CVE-2026-23552/): Apache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy (critical 9.1)
- [CVE-2026-23550](https://insights.sbomify.com/CVE-2026-23550/): WordPress Modular DS plugin <= 2.5.1 - Privilege Escalation vulnerability (critical 10.0)
- [CVE-2026-2355](https://insights.sbomify.com/CVE-2026-2355/): Cross-site scripting in My Calendar – Accessible Event Manager (medium 6.4)
- [CVE-2026-23549](https://insights.sbomify.com/CVE-2026-23549/): WordPress WpEvently plugin <= 5.1.1 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-23548](https://insights.sbomify.com/CVE-2026-23548/): WordPress DirectoryPress plugin <= 3.6.25 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-23547](https://insights.sbomify.com/CVE-2026-23547/): WordPress CMSMasters Content Composer plugin <= 2.5.8 - Broken Access Control vulnerability (high 7.1)
- [CVE-2026-23546](https://insights.sbomify.com/CVE-2026-23546/): WordPress Classified Listing plugin <= 5.3.4 - Sensitive Data Exposure vulnerability (medium 6.5)
- [CVE-2026-23545](https://insights.sbomify.com/CVE-2026-23545/): WordPress Aruba HiSpeed Cache plugin <= 3.0.4 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-23544](https://insights.sbomify.com/CVE-2026-23544/): WordPress Valenti theme <= 5.6.3.5 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-23543](https://insights.sbomify.com/CVE-2026-23543/): WordPress Essential Addons for Elementor plugin <= 6.5.5 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-23542](https://insights.sbomify.com/CVE-2026-23542/): WordPress Grand Restaurant theme <= 7.0.10 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-23541](https://insights.sbomify.com/CVE-2026-23541/): WordPress Mail Mint plugin <= 1.19.4 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-2354](https://insights.sbomify.com/CVE-2026-2354/): Swiss Toolkit For WP <= 1.4.6 - Authenticated (Author+) Arbitrary File Upload via upload_extension_files() (high 8.8)
- [CVE-2026-23538](https://insights.sbomify.com/CVE-2026-23538/): Feast: resource exhaustion via websocket endpoint (high 7.5)
- [CVE-2026-23537](https://insights.sbomify.com/CVE-2026-23537/): Feast: unauthenticated arbitrary file write (critical 9.1)
- [CVE-2026-23536](https://insights.sbomify.com/CVE-2026-23536/): Feast: unauthenticated arbitrary file read (high 7.5)
- [CVE-2026-23535](https://insights.sbomify.com/CVE-2026-23535/): wlc Path traversal: Unsanitized API slugs in download command (high 8.1)
- [CVE-2026-23534](https://insights.sbomify.com/CVE-2026-23534/): FreeRDP has heap-buffer-overflow in clear_decompress_bands_data (high 7.7)
- [CVE-2026-23533](https://insights.sbomify.com/CVE-2026-23533/): FreeRDP has heap-buffer-overflow in clear_decompress_residual_data (high 7.7)
- [CVE-2026-23532](https://insights.sbomify.com/CVE-2026-23532/): FreeRDP has heap-buffer-overflow in gdi_SurfaceToSurface (high 7.7)
- [CVE-2026-23531](https://insights.sbomify.com/CVE-2026-23531/): FreeRDP has heap-buffer-overflow in clear_decompress (high 7.7)
- [CVE-2026-23530](https://insights.sbomify.com/CVE-2026-23530/): FreeRDP has heap-buffer-overflow in planar_decompress_plane_rle (high 7.7)
- [CVE-2026-23529](https://insights.sbomify.com/CVE-2026-23529/): Arbitrary File Read in Google BigQuery Sink connector (high 7.7)
- [CVE-2026-23528](https://insights.sbomify.com/CVE-2026-23528/): Dask distributed Vulnerable to Remote Code Execution via Jupyter Proxy and Dashboard (medium 5.3)
- [CVE-2026-23527](https://insights.sbomify.com/CVE-2026-23527/): h3 v1 has Request Smuggling (TE.TE) issue (high 8.9)
- [CVE-2026-23526](https://insights.sbomify.com/CVE-2026-23526/): CVAT vulnerable to privilege escalation of users with staff status (high 8.5)
- [CVE-2026-23525](https://insights.sbomify.com/CVE-2026-23525/): 1panel App Store vulnerable to Cross-site Scripting (medium 6.4)
- [CVE-2026-23524](https://insights.sbomify.com/CVE-2026-23524/): Laravel Redis Horizontal Scaling Insecure Deserialization (critical 9.8)
- [CVE-2026-23523](https://insights.sbomify.com/CVE-2026-23523/): Dive allows One-click Remote Code Execution through Deep Links for MCP Install (critical 9.7)
- [CVE-2026-23522](https://insights.sbomify.com/CVE-2026-23522/): Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletion (low 3.7)
- [CVE-2026-23521](https://insights.sbomify.com/CVE-2026-23521/): Traccar vulnerable to Path Traversal and External Control of File Name or Path (medium 6.5)
- [CVE-2026-23520](https://insights.sbomify.com/CVE-2026-23520/): Arcane has a Command Injection in Arcane Updater Lifecycle Labels Enables RCE (critical 9.1)
- [CVE-2026-2352](https://insights.sbomify.com/CVE-2026-2352/): Autoptimize <= 3.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ao_post_preload' Meta Value (medium 6.4)
- [CVE-2026-23519](https://insights.sbomify.com/CVE-2026-23519/): RustCrypto cmov: thumbv6m-none-eabi compiler emits non-constant time assembly when using cmovnz (high 8.9)
- [CVE-2026-23518](https://insights.sbomify.com/CVE-2026-23518/): Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment (critical 9.3)
- [CVE-2026-23517](https://insights.sbomify.com/CVE-2026-23517/): Fleet has an Access Control vulnerability in debug/pprof endpoints (medium 6.3)
- [CVE-2026-23516](https://insights.sbomify.com/CVE-2026-23516/): CVAT vulnerable to XSS via skeleton SVG images (high 8.6)
- [CVE-2026-23515](https://insights.sbomify.com/CVE-2026-23515/): RCE - Command Injection in Signal K set-system-time plugin (critical 10.0)
- [CVE-2026-23514](https://insights.sbomify.com/CVE-2026-23514/): Kiteworks Core before 9.2.2 is vulnerable to Improper Ownership Management (high 8.8)
- [CVE-2026-23513](https://insights.sbomify.com/CVE-2026-23513/): FOSSBilling: Broken Authorization in Client Transaction and Order Listings (high 7.1)
- [CVE-2026-23512](https://insights.sbomify.com/CVE-2026-23512/): SumatraPDF has an Untrusted Search Path in sumatrapdf/src/AppTools.cpp (high 8.6)
- [CVE-2026-23511](https://insights.sbomify.com/CVE-2026-23511/): ZITADEL has a user enumeration vulnerability in Login UIs (medium 5.3)
- [CVE-2026-2351](https://insights.sbomify.com/CVE-2026-2351/): Task Manager <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Read (medium 6.5)
- [CVE-2026-23501](https://insights.sbomify.com/CVE-2026-23501/): Command injection in RecoverPoint for Virtual Machines (high 7.2)
- [CVE-2026-23500](https://insights.sbomify.com/CVE-2026-23500/): Dolibarr: OS Command Injection (RCE) via MAIN_ODT_AS_PDF configuration (critical 9.4)
- [CVE-2026-2350](https://insights.sbomify.com/CVE-2026-2350/): Tanium addressed an insertion of sensitive information into log file vulnerability in Interact and TDS. (medium 6.5)
- [CVE-2026-23499](https://insights.sbomify.com/CVE-2026-23499/): Saleor vulnerable to stored XSS via Unrestricted File Upload (high 8.5)
- [CVE-2026-23498](https://insights.sbomify.com/CVE-2026-23498/): Shopware Improper Control of Generation of Code in Twig rendered views (high 7.2)
- [CVE-2026-23497](https://insights.sbomify.com/CVE-2026-23497/): Frappe LMS has a Stored XSS via Unsanitized Image Filename in Course and Jobs Pages (low 1.3)
- [CVE-2026-23496](https://insights.sbomify.com/CVE-2026-23496/): Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization (medium 5.4)
- [CVE-2026-23495](https://insights.sbomify.com/CVE-2026-23495/): Pimcore's Admin Classic Bundle is Missing Function Level Authorization on "Predefined Properties" Listing (medium 4.3)
- [CVE-2026-23494](https://insights.sbomify.com/CVE-2026-23494/): Pimcore is Missing Function Level Authorization on "Static Routes" Listing (medium 4.3)
- [CVE-2026-23493](https://insights.sbomify.com/CVE-2026-23493/): Pimcore ENV Variables and Cookie Informations are exposed in http_error_log (high 8.6)
- [CVE-2026-23492](https://insights.sbomify.com/CVE-2026-23492/): Pimcore has a Blind SQL Injection in Admin Search Find API due to an incomplete fix for CVE-2023-30848 (high 8.8)
- [CVE-2026-23491](https://insights.sbomify.com/CVE-2026-23491/): InvoicePlane has Unauthenticated Path Traversal in Guest Controller (critical 9.3)
- [CVE-2026-23490](https://insights.sbomify.com/CVE-2026-23490/): pyasn1 has a DoS vulnerability in decoder (high 7.5)
- [CVE-2026-2349](https://insights.sbomify.com/CVE-2026-2349/): UI Icons - Critical - Cross-site Scripting - SA-CONTRIB-2026-010 (medium 6.1)
- [CVE-2026-23489](https://insights.sbomify.com/CVE-2026-23489/): Fields GLPI plugin vulnerable to RCE in dropdown generation (critical 9.1)
- [CVE-2026-23488](https://insights.sbomify.com/CVE-2026-23488/): Blinko: multiple interfaces in the comment feature allow unauthorized access (medium 6.9)
- [CVE-2026-23487](https://insights.sbomify.com/CVE-2026-23487/): Blinko: IDOR - user.detail Endpoint Leaks Superadmin Token (medium 6.0)
- [CVE-2026-23486](https://insights.sbomify.com/CVE-2026-23486/): Blinko: Unauthorized User Information Leak (medium 6.9)
- [CVE-2026-23485](https://insights.sbomify.com/CVE-2026-23485/): Blinko: Unauthorized Path Traversal File Enumeration - music-metadata (medium 6.9)
- [CVE-2026-23484](https://insights.sbomify.com/CVE-2026-23484/): Blinko: Authenticated Arbitrary File Write - saveDevPlugin (medium 5.3)
- [CVE-2026-23483](https://insights.sbomify.com/CVE-2026-23483/): Blinko: Unauthorized Arbitrary File Read - /plugins (medium 6.9)
- [CVE-2026-23482](https://insights.sbomify.com/CVE-2026-23482/): Blinko: Unauthorized Arbitrary File Read - /api/file/temp (high 8.2)
- [CVE-2026-23481](https://insights.sbomify.com/CVE-2026-23481/): Blinko: Authenticated Arbitrary File Write - saveAdditionalDevFile (medium 5.3)
- [CVE-2026-23480](https://insights.sbomify.com/CVE-2026-23480/): Blinko: Low Privilege User Privilege Escalation - upsertUser Endpoint (medium 5.3)
- [CVE-2026-2348](https://insights.sbomify.com/CVE-2026-2348/): Quick Edit - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-009 (medium 5.4)
- [CVE-2026-23479](https://insights.sbomify.com/CVE-2026-23479/): redis-server use-after-free in unblock client flow may allow remote code execution (high 7.7)
- [CVE-2026-23478](https://insights.sbomify.com/CVE-2026-23478/): Cal.com has an Authentication Bypass via Unvalidated Email in Custom JWT Callback (critical 10.0)
- [CVE-2026-23477](https://insights.sbomify.com/CVE-2026-23477/): Rocket.Chat Unauthorized Access to OAuth App Details (high 7.7)
- [CVE-2026-23476](https://insights.sbomify.com/CVE-2026-23476/): FacturaScripts Affected by Reflected XSS (medium 5.4)
- [CVE-2026-23475](https://insights.sbomify.com/CVE-2026-23475/): spi: fix statistics allocation (medium 5.5)
- [CVE-2026-23474](https://insights.sbomify.com/CVE-2026-23474/): mtd: Avoid boot crash in RedBoot partition table parser (medium 5.5)
- [CVE-2026-23472](https://insights.sbomify.com/CVE-2026-23472/): serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (medium 5.5)
- [CVE-2026-23470](https://insights.sbomify.com/CVE-2026-23470/): drm/imagination: Fix deadlock in soft reset sequence (medium 5.5)
- [CVE-2026-2347](https://insights.sbomify.com/CVE-2026-2347/): IDOR in Akıllı Ticaret's E-Commerce Pack (critical 9.8)
- [CVE-2026-23469](https://insights.sbomify.com/CVE-2026-23469/): drm/imagination: Synchronize interrupts before suspending the GPU (medium 4.7)
- [CVE-2026-23468](https://insights.sbomify.com/CVE-2026-23468/): drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (medium 5.5)
- [CVE-2026-23467](https://insights.sbomify.com/CVE-2026-23467/): drm/i915/dmc: Fix an unlikely NULL pointer deference at probe (medium 5.5)
- [CVE-2026-23466](https://insights.sbomify.com/CVE-2026-23466/): drm/xe: Open-code GGTT MMIO access protection (high 7.8)
- [CVE-2026-23465](https://insights.sbomify.com/CVE-2026-23465/): btrfs: log new dentries when logging parent dir of a conflicting inode (medium 5.5)
- [CVE-2026-23464](https://insights.sbomify.com/CVE-2026-23464/): soc: microchip: mpfs: Fix memory leak in mpfs_sys_controller_probe() (medium 5.5)
- [CVE-2026-23463](https://insights.sbomify.com/CVE-2026-23463/): soc: fsl: qbman: fix race condition in qman_destroy_fq (medium 4.7)
- [CVE-2026-23462](https://insights.sbomify.com/CVE-2026-23462/): Bluetooth: HIDP: Fix possible UAF (high 8.8)
- [CVE-2026-23461](https://insights.sbomify.com/CVE-2026-23461/): Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user (high 8.8)
- [CVE-2026-23460](https://insights.sbomify.com/CVE-2026-23460/): net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect (medium 5.5)
- [CVE-2026-2346](https://insights.sbomify.com/CVE-2026-2346/): IDOR in Menulux Software's Mobile App (critical 9.8)
- [CVE-2026-23459](https://insights.sbomify.com/CVE-2026-23459/): ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS (high 8.2)
- [CVE-2026-23458](https://insights.sbomify.com/CVE-2026-23458/): netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (high 7.8)
- [CVE-2026-23457](https://insights.sbomify.com/CVE-2026-23457/): netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (high 8.6)
- [CVE-2026-23456](https://insights.sbomify.com/CVE-2026-23456/): netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (high 8.2)
- [CVE-2026-23455](https://insights.sbomify.com/CVE-2026-23455/): netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (critical 9.1)
- [CVE-2026-23454](https://insights.sbomify.com/CVE-2026-23454/): net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown (high 7.0)
- [CVE-2026-23453](https://insights.sbomify.com/CVE-2026-23453/): net: ti: icssg-prueth: Fix memory leak in XDP_DROP for non-zero-copy mode (high 7.5)
- [CVE-2026-23452](https://insights.sbomify.com/CVE-2026-23452/): PM: runtime: Fix a race condition related to device removal (medium 4.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/788/