# Vulnerabilities published in 2026


- [CVE-2026-22602](https://insights.sbomify.com/CVE-2026-22602/): OpenProject is Vulnerable to User Enumeration via User ID (low 3.5)
- [CVE-2026-22601](https://insights.sbomify.com/CVE-2026-22601/): OpenProject is Vulnerable to Code Execution in E-Mail function (high 8.6)
- [CVE-2026-22600](https://insights.sbomify.com/CVE-2026-22600/): OpenProject is Vulnerable to Arbitrary File Read via ImageMagick SVG Coder (critical 9.1)
- [CVE-2026-2260](https://insights.sbomify.com/CVE-2026-2260/): D-Link DCS-931L setSysAdmin os command injection (high 8.6)
- [CVE-2026-22599](https://insights.sbomify.com/CVE-2026-22599/): Strapi Vulnerable to SQL Injection in Content Type Builder (critical 9.3)
- [CVE-2026-22598](https://insights.sbomify.com/CVE-2026-22598/): ManageIQ vulnerable to DoS Attack when creating TimeProfiles (high 7.1)
- [CVE-2026-22597](https://insights.sbomify.com/CVE-2026-22597/): Ghost has SSRF via External Media Inliner (medium 5.1)
- [CVE-2026-22596](https://insights.sbomify.com/CVE-2026-22596/): Ghost has SQL Injection in Members Activity Feed (medium 6.7)
- [CVE-2026-22595](https://insights.sbomify.com/CVE-2026-22595/): Ghost has Staff Token permission bypass (high 8.1)
- [CVE-2026-22594](https://insights.sbomify.com/CVE-2026-22594/): Ghost has Staff 2FA bypass (high 8.1)
- [CVE-2026-22593](https://insights.sbomify.com/CVE-2026-22593/): EVerest has off-by-one stack buffer overflow in IsoMux certificate filename parsing (high 8.4)
- [CVE-2026-22592](https://insights.sbomify.com/CVE-2026-22592/): Gogs is Vulnerable to Denial of Service (medium 6.5)
- [CVE-2026-22591](https://insights.sbomify.com/CVE-2026-22591/): Fast DDS DDSSQLFilter Recursive Parser Stack Exhaustion (Remote DoS) (high 7.5)
- [CVE-2026-22590](https://insights.sbomify.com/CVE-2026-22590/): Memory corruption in Fast-DDS (critical 9.1)
- [CVE-2026-2259](https://insights.sbomify.com/CVE-2026-2259/): aardappel lobster Parsing parser.h ParseStatements memory corruption (medium 4.8)
- [CVE-2026-22589](https://insights.sbomify.com/CVE-2026-22589/): Spree API has Unauthenticated IDOR - Guest Address (high 7.5)
- [CVE-2026-22588](https://insights.sbomify.com/CVE-2026-22588/): Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification (medium 6.5)
- [CVE-2026-22587](https://insights.sbomify.com/CVE-2026-22587/): Ideagen DevonWay Reports page stored XSS (medium 4.8)
- [CVE-2026-22586](https://insights.sbomify.com/CVE-2026-22586/): Hardcoded credentials in Marketing Cloud Engagement (critical 9.8)
- [CVE-2026-22585](https://insights.sbomify.com/CVE-2026-22585/): Weak cryptography in Marketing Cloud Engagement (critical 9.8)
- [CVE-2026-22584](https://insights.sbomify.com/CVE-2026-22584/): Salesforce Uni2TS has a Code Injection vulnerability (critical 9.8)
- [CVE-2026-22583](https://insights.sbomify.com/CVE-2026-22583/): Command injection in Marketing Cloud Engagement (critical 9.8)
- [CVE-2026-22582](https://insights.sbomify.com/CVE-2026-22582/): Command injection in Marketing Cloud Engagement (critical 9.8)
- [CVE-2026-2258](https://insights.sbomify.com/CVE-2026-2258/): aardappel lobster wfc.h WaveFunctionCollapse memory corruption (medium 4.8)
- [CVE-2026-22576](https://insights.sbomify.com/CVE-2026-22576/): Information disclosure in FortiSOAR PaaS (medium 4.1)
- [CVE-2026-22575](https://insights.sbomify.com/CVE-2026-22575/): Missing authorization in FortiManager (medium 4.7)
- [CVE-2026-22574](https://insights.sbomify.com/CVE-2026-22574/): Information disclosure in FortiSOAR PaaS (medium 4.1)
- [CVE-2026-22573](https://insights.sbomify.com/CVE-2026-22573/): Path traversal in FortiSOAR PaaS (medium 6.2)
- [CVE-2026-22572](https://insights.sbomify.com/CVE-2026-22572/): Auth bypass in FortiAnalyzer (medium 6.8)
- [CVE-2026-2257](https://insights.sbomify.com/CVE-2026-2257/): Cross-site scripting in GetGenie – AI Content Writer with Keyword Research & SEO Tracking Tools (medium 6.4)
- [CVE-2026-22569](https://insights.sbomify.com/CVE-2026-22569/): Incorrect startup configuration in ZCC (medium 5.4)
- [CVE-2026-22568](https://insights.sbomify.com/CVE-2026-22568/): Unauthorized information retrieval in ZIA Admin UI (medium 5.5)
- [CVE-2026-22567](https://insights.sbomify.com/CVE-2026-22567/): ZIA Admin UI Input Validation Bug (high 7.6)
- [CVE-2026-22566](https://insights.sbomify.com/CVE-2026-22566/): Missing authorization in UniFi Play Audio Port (high 7.5)
- [CVE-2026-22565](https://insights.sbomify.com/CVE-2026-22565/): Denial of service in UniFi Play Audio Port (high 7.5)
- [CVE-2026-22564](https://insights.sbomify.com/CVE-2026-22564/): Missing authorization in UniFi Play Audio Port (critical 9.8)
- [CVE-2026-22563](https://insights.sbomify.com/CVE-2026-22563/): Command injection in UniFi Play Audio Port (critical 9.8)
- [CVE-2026-22562](https://insights.sbomify.com/CVE-2026-22562/): Path traversal in UniFi Play Audio Port (critical 9.8)
- [CVE-2026-22561](https://insights.sbomify.com/CVE-2026-22561/): Privilege escalation in Claude Desktop - Windows (medium 4.7)
- [CVE-2026-22560](https://insights.sbomify.com/CVE-2026-22560/): Open redirect in Rocket.Chat (medium 5.3)
- [CVE-2026-2256](https://insights.sbomify.com/CVE-2026-2256/): Command injection vulnerability in ModelScope's ms-agent (medium 6.5)
- [CVE-2026-22559](https://insights.sbomify.com/CVE-2026-22559/): Other in UniFi Network Server (high 8.8)
- [CVE-2026-22558](https://insights.sbomify.com/CVE-2026-22558/): SQL injection in UniFi Network Application (high 7.7)
- [CVE-2026-22557](https://insights.sbomify.com/CVE-2026-22557/): Path traversal in UniFi Network Application (critical 10.0)
- [CVE-2026-22555](https://insights.sbomify.com/CVE-2026-22555/): Gitea organization forks can expose organization secrets without create permission (high 8.1)
- [CVE-2026-22554](https://insights.sbomify.com/CVE-2026-22554/): Memory corruption in MediaInfoLib (high 7.8)
- [CVE-2026-22553](https://insights.sbomify.com/CVE-2026-22553/): InSAT MasterSCADA BUK-TS OS Command Injection (critical 9.3)
- [CVE-2026-22552](https://insights.sbomify.com/CVE-2026-22552/): ePower epower.ie Missing Authentication for Critical Function (critical 9.3)
- [CVE-2026-22551](https://insights.sbomify.com/CVE-2026-22551/): [Eclipse Theia] Data Exfiltration via Markdown Image Rendering in AI Chat (medium 6.7)
- [CVE-2026-22550](https://insights.sbomify.com/CVE-2026-22550/): Command injection in WRC-X1500GS-B (high 8.6)
- [CVE-2026-2255](https://insights.sbomify.com/CVE-2026-2255/): Hitachi Vantara Pentaho Data Integration & Analytics - Insufficiently Protected Credentials (medium 4.3)
- [CVE-2026-22549](https://insights.sbomify.com/CVE-2026-22549/): BIG-IP Container Ingress Services vulnerability (medium 6.9)
- [CVE-2026-22548](https://insights.sbomify.com/CVE-2026-22548/): BIG-IP Advanced WAF and ASM vulnerability (high 8.2)
- [CVE-2026-22547](https://insights.sbomify.com/CVE-2026-22547/): Gitea repository creation accepts invalid field values (critical 9.1)
- [CVE-2026-22545](https://insights.sbomify.com/CVE-2026-22545/): Password Change Bypass via Auth Switch Endpoint (low 3.1)
- [CVE-2026-22544](https://insights.sbomify.com/CVE-2026-22544/): EXCHANGE OF CREDENTIALS IN CLEAR TEXT (high 8.7)
- [CVE-2026-22543](https://insights.sbomify.com/CVE-2026-22543/): WEEK ENCODING FOR PASSWORDS (medium 6.9)
- [CVE-2026-22542](https://insights.sbomify.com/CVE-2026-22542/): DENIAL OF SERVICE FOR CONCURRENT CONNECTIONS ON TELNET (critical 9.2)
- [CVE-2026-22541](https://insights.sbomify.com/CVE-2026-22541/): DENIAL OF SERVICE VIA ICMP PACKETS (high 8.2)
- [CVE-2026-22540](https://insights.sbomify.com/CVE-2026-22540/): DENIAL OF SERVICE VIA ARP PACKETS (critical 9.2)
- [CVE-2026-2254](https://insights.sbomify.com/CVE-2026-2254/): Hitachi Vantara Pentaho Data Integration & Analytics - Incorrect Permission Assignment for Critical Resource (medium 6.3)
- [CVE-2026-22539](https://insights.sbomify.com/CVE-2026-22539/): INFORMATION DISCLOSURE VIA CURL REQUESTS (OCPP) (medium 5.3)
- [CVE-2026-22537](https://insights.sbomify.com/CVE-2026-22537/): INFORMATION DISCLOSURE WITHIN THE OPERATING SYSTEM (medium 6.8)
- [CVE-2026-22536](https://insights.sbomify.com/CVE-2026-22536/): PRIVILEGE ESCALATION VIA SUDO COMMAND (high 8.6)
- [CVE-2026-22535](https://insights.sbomify.com/CVE-2026-22535/): FRAIL SECURITY IN MQTT PROTOCOL ALLOWS AN ATTACKER MODIFY CRITICAL PARAMETERS (high 8.9)
- [CVE-2026-2253](https://insights.sbomify.com/CVE-2026-2253/): Hitachi Vantara Pentaho Data Integration & Analytics - Improper Restriction of XML External Entity Reference (high 7.7)
- [CVE-2026-22524](https://insights.sbomify.com/CVE-2026-22524/): WordPress Legacy Admin plugin <= 9.5 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-22523](https://insights.sbomify.com/CVE-2026-22523/): WordPress Ultra WordPress Admin plugin <= 11.7 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-22522](https://insights.sbomify.com/CVE-2026-22522/): WordPress Block Slider plugin <= 2.2.3 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-22521](https://insights.sbomify.com/CVE-2026-22521/): WordPress Handmade Framework plugin <= 3.9 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2026-22520](https://insights.sbomify.com/CVE-2026-22520/): WordPress Handmade Framework plugin <= 3.9 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-2252](https://insights.sbomify.com/CVE-2026-2252/): XML External Entity (XXE) vulnerability resulting in Server-Side Request Forgery (SSRF) (high 7.5)
- [CVE-2026-22519](https://insights.sbomify.com/CVE-2026-22519/): WordPress MediaPress plugin <= 1.6.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-22518](https://insights.sbomify.com/CVE-2026-22518/): WordPress X Addons for Elementor plugin <= 1.0.23 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-22517](https://insights.sbomify.com/CVE-2026-22517/): WordPress GA4WP: Google Analytics for WordPress plugin <= 2.10.0 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-22516](https://insights.sbomify.com/CVE-2026-22516/): WordPress Wizor's theme <= 2.12 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22515](https://insights.sbomify.com/CVE-2026-22515/): WordPress VegaDays theme <= 1.2.0 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22514](https://insights.sbomify.com/CVE-2026-22514/): WordPress Unica theme <= 1.4.1 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22513](https://insights.sbomify.com/CVE-2026-22513/): WordPress Triompher theme <= 1.1.0 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22512](https://insights.sbomify.com/CVE-2026-22512/): WordPress Roisin theme <= 1.2.1 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22511](https://insights.sbomify.com/CVE-2026-22511/): WordPress NeoBeat theme <= 1.2 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22510](https://insights.sbomify.com/CVE-2026-22510/): WordPress Melody theme <= 1.6.3 - PHP Object Injection vulnerability (high 8.1)
- [CVE-2026-2251](https://insights.sbomify.com/CVE-2026-2251/): Path Traversal leading to Remote Code Execution (RCE) (critical 9.8)
- [CVE-2026-22509](https://insights.sbomify.com/CVE-2026-22509/): WordPress Gioia theme <= 1.4 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22508](https://insights.sbomify.com/CVE-2026-22508/): WordPress Dentalux theme <= 3.3 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22507](https://insights.sbomify.com/CVE-2026-22507/): WordPress Beelove theme <= 1.2.6 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-22506](https://insights.sbomify.com/CVE-2026-22506/): WordPress Amoli theme <= 1.0 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22505](https://insights.sbomify.com/CVE-2026-22505/): WordPress Morning Records theme <= 1.2 - PHP Object Injection vulnerability (high 8.1)
- [CVE-2026-22504](https://insights.sbomify.com/CVE-2026-22504/): WordPress ProLingua theme <= 1.1.12 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22503](https://insights.sbomify.com/CVE-2026-22503/): WordPress Nelson theme <= 1.2.0 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22502](https://insights.sbomify.com/CVE-2026-22502/): WordPress Mr. Cobbler theme <= 1.1.9 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22501](https://insights.sbomify.com/CVE-2026-22501/): WordPress Mounthood theme <= 1.3.2 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-22500](https://insights.sbomify.com/CVE-2026-22500/): WordPress m2 | Construction and Tools Store theme <= 1.1.2 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-2250](https://insights.sbomify.com/CVE-2026-2250/): Unauthenticated Data Export and Source Code Disclosure via /dbviewer/ in METIS WIC (high 7.5)
- [CVE-2026-22499](https://insights.sbomify.com/CVE-2026-22499/): WordPress Lella theme <= 1.2 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22498](https://insights.sbomify.com/CVE-2026-22498/): WordPress Laurent theme <= 3.1 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22497](https://insights.sbomify.com/CVE-2026-22497/): WordPress Jardi theme <= 1.7.2 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-22496](https://insights.sbomify.com/CVE-2026-22496/): WordPress Hypnotherapy theme <= 1.2.10 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22495](https://insights.sbomify.com/CVE-2026-22495/): WordPress Greenville theme <= 1.3.2 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-22494](https://insights.sbomify.com/CVE-2026-22494/): WordPress Good Homes theme <= 1.3.13 - Local File Inclusion vulnerability (high 8.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/797/