# Vulnerabilities published in 2026


- [CVE-2026-1988](https://insights.sbomify.com/CVE-2026-1988/): Path traversal in Flexi Product Slider and Grid for WooCommerce (high 7.5)
- [CVE-2026-19879](https://insights.sbomify.com/CVE-2026-19879/): Io.undertow/undertow: undertow: http response header integrity issue due to character truncation (medium 5.3)
- [CVE-2026-19878](https://insights.sbomify.com/CVE-2026-19878/): Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access (medium 6.5)
- [CVE-2026-19875](https://insights.sbomify.com/CVE-2026-19875/): Unauthenticated Registration POST Endpoint Permits Admin Email Overwrite and Outbound Relay Abuse in Langflow (high 7.5)
- [CVE-2026-19874](https://insights.sbomify.com/CVE-2026-19874/): Konami's Metal Gear Online 3 contains a heap-based buffer overflow (critical 9.1)
- [CVE-2026-19873](https://insights.sbomify.com/CVE-2026-19873/): HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elements. (high 7.5)
- [CVE-2026-19872](https://insights.sbomify.com/CVE-2026-19872/): HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rendered unescaped in an error message. (medium 6.1)
- [CVE-2026-19871](https://insights.sbomify.com/CVE-2026-19871/): Use of hard-coded credentials in Prospero Flow CRM employee onboarding (critical 9.3)
- [CVE-2026-19870](https://insights.sbomify.com/CVE-2026-19870/): IDOR in Prospero Flow CRM allows cross-tenant payroll disclosure and creation (high 8.6)
- [CVE-2026-1987](https://insights.sbomify.com/CVE-2026-1987/): Missing authorization in Scheduler Widget (medium 5.4)
- [CVE-2026-19869](https://insights.sbomify.com/CVE-2026-19869/): Privilege Escalation via Dropped Field-Level @authentication (high 7.6)
- [CVE-2026-19867](https://insights.sbomify.com/CVE-2026-19867/): Uncapped mention keys in user notification properties allow CPU exhaustion during post processing (medium 4.3)
- [CVE-2026-19864](https://insights.sbomify.com/CVE-2026-19864/): Eclipse Jetty's `SessionAuthentication` retains authentication credentials in a serializable object. (medium 5.6)
- [CVE-2026-19863](https://insights.sbomify.com/CVE-2026-19863/): An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configured login path. (critical 9.3)
- [CVE-2026-19862](https://insights.sbomify.com/CVE-2026-19862/): JetFormBuilder < 3.6.5.2 - Unauthenticated Email Header Injection via Send Email Action (medium 4.8)
- [CVE-2026-19861](https://insights.sbomify.com/CVE-2026-19861/): JetFormBuilder < 3.6.5.2 - Unauthenticated Stored XSS via WYSIWYG Field in Notification Emails (medium 4.7)
- [CVE-2026-19860](https://insights.sbomify.com/CVE-2026-19860/): JetFormBuilder 3.5.6.2 - 3.6.5.2 - Admin+ Arbitrary File Deletion via Server-Side Validation Callback (medium 5.5)
- [CVE-2026-1986](https://insights.sbomify.com/CVE-2026-1986/): FloristPress for Woo <= 7.8.2 - Reflected Cross-Site Scripting via 'noresults' Parameter (medium 6.1)
- [CVE-2026-19859](https://insights.sbomify.com/CVE-2026-19859/): JetFormBuilder < 3.6.5.2 - Unauthenticated Arbitrary Shortcode Execution via 'status' Parameter (medium 6.5)
- [CVE-2026-19858](https://insights.sbomify.com/CVE-2026-19858/): JetFormBuilder < 3.6.5.2 - Unauthenticated Password Hash and Arbitrary Metadata Disclosure via Dynamic Preset (high 7.5)
- [CVE-2026-19857](https://insights.sbomify.com/CVE-2026-19857/): Formidable Forms < 6.35 - Unauthenticated Arbitrary Shortcode Execution via [entry_key] Custom HTML Token (medium 4.8)
- [CVE-2026-19856](https://insights.sbomify.com/CVE-2026-19856/): All in One SEO < 5.0.2.1 - Unauthenticated Arbitrary Shortcode Execution via Search Query (medium 6.5)
- [CVE-2026-19855](https://insights.sbomify.com/CVE-2026-19855/): Code injection in CleanTalk (medium 6.5)
- [CVE-2026-19854](https://insights.sbomify.com/CVE-2026-19854/): CVE-2026-19854 CVE Record (medium 6.1)
- [CVE-2026-19853](https://insights.sbomify.com/CVE-2026-19853/): CyberTutor｜NewSiteServer (NSS) - Missing Authentication (medium 6.9)
- [CVE-2026-19852](https://insights.sbomify.com/CVE-2026-19852/): CyberTutor｜NewSiteServer (NSS) - Arbitrary File Upload (medium 5.1)
- [CVE-2026-19851](https://insights.sbomify.com/CVE-2026-19851/): Use of Default Password vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 (high 7.7)
- [CVE-2026-1985](https://insights.sbomify.com/CVE-2026-1985/): Press3D <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via Link URL Parameter in 3D Model Block (medium 6.4)
- [CVE-2026-19848](https://insights.sbomify.com/CVE-2026-19848/): ProfilePress < 4.17.1 - Unauthenticated Arbitrary Shortcode Execution via Display Name (medium 6.5)
- [CVE-2026-19847](https://insights.sbomify.com/CVE-2026-19847/): TOTOLINK A800R wps.so cstecgi.cgi setWiFiWpsConfig stack-based overflow (high 8.7)
- [CVE-2026-19846](https://insights.sbomify.com/CVE-2026-19846/): TOTOLINK A800R firewall.so cstecgi.cgi setUrlFilterRules stack-based overflow (high 8.7)
- [CVE-2026-19845](https://insights.sbomify.com/CVE-2026-19845/): TOTOLINK A800R lan.so cstecgi.cgi setStaticDhcpConfig stack-based overflow (high 8.7)
- [CVE-2026-19844](https://insights.sbomify.com/CVE-2026-19844/): TOTOLINK A800R ipv6.so cstecgi.cgi setRadvdCfg stack-based overflow (high 8.7)
- [CVE-2026-19843](https://insights.sbomify.com/CVE-2026-19843/): 389-ds-base: 389-ds-base: command injection via unescaped ldap dn in cockpit 389 console ldap editor (high 8.4)
- [CVE-2026-19842](https://insights.sbomify.com/CVE-2026-19842/): SAML Single Sign On 4.8.85 - 5.4.6 - Unauthenticated Administrator Account Takeover via SAML Trust Anchor Overwrite (high 8.8)
- [CVE-2026-19841](https://insights.sbomify.com/CVE-2026-19841/): TRENDNET TEW-813DRU vsftpd vsftpd.conf default permission (low 2.3)
- [CVE-2026-19840](https://insights.sbomify.com/CVE-2026-19840/): Notiqoo < 1.4.14 - Contributor+ Arbitrary Option Update via Multiple AJAX Actions (medium 6.5)
- [CVE-2026-1984](https://insights.sbomify.com/CVE-2026-1984/): Missing authorization in Ibtana – Ecommerce Product Addons (medium 5.3)
- [CVE-2026-19839](https://insights.sbomify.com/CVE-2026-19839/): SourceCodester Simple Doctors Appointment System save_file.php save_doctor unrestricted upload (medium 5.1)
- [CVE-2026-19838](https://insights.sbomify.com/CVE-2026-19838/): Webkul Bagisto Backend Reporting Endpoint sales authorization (medium 5.3)
- [CVE-2026-19837](https://insights.sbomify.com/CVE-2026-19837/): Webkul Bagisto Customer Search search information disclosure (medium 5.1)
- [CVE-2026-19836](https://insights.sbomify.com/CVE-2026-19836/): Webkul Bagisto Backend Customer Detail Feature view authorization (medium 5.3)
- [CVE-2026-19835](https://insights.sbomify.com/CVE-2026-19835/): Webkul Bagisto Customer Item Deletion Endpoint access control (medium 5.1)
- [CVE-2026-19834](https://insights.sbomify.com/CVE-2026-19834/): Webkul Bagisto Admin Customer Impersonation Feature login-as-customer authorization (medium 5.1)
- [CVE-2026-19830](https://insights.sbomify.com/CVE-2026-19830/): TRENDnet TEW-816DRM bftpd bftpd.conf allocation of resources (medium 6.9)
- [CVE-2026-1983](https://insights.sbomify.com/CVE-2026-1983/): SEATT: Simple Event Attendance <= 1.5.0 - Cross-Site Request Forgery to Arbitrary Event Deletion (medium 4.3)
- [CVE-2026-19829](https://insights.sbomify.com/CVE-2026-19829/): 648540858 wvp-GB28181-pro Log File Download Endpoint LogController.java path traversal (medium 5.3)
- [CVE-2026-19828](https://insights.sbomify.com/CVE-2026-19828/): 648540858 wvp-GB28181-pro Snapshot Endpoint PlayController.java path traversal (medium 5.3)
- [CVE-2026-19827](https://insights.sbomify.com/CVE-2026-19827/): alldatacenter alldata logDetailCat Endpoint JobLogController.java FileInputStream path traversal (medium 6.9)
- [CVE-2026-19826](https://insights.sbomify.com/CVE-2026-19826/): alldatacenter alldata xxl-rpc Listener HessianSerializer.java Hessian2Input.readObject deserialization (medium 6.9)
- [CVE-2026-19825](https://insights.sbomify.com/CVE-2026-19825/): SourceCodester Simple Client Management System Master.php save_service sql injection (medium 6.9)
- [CVE-2026-19824](https://insights.sbomify.com/CVE-2026-19824/): Tenda W20E addIpMacBind ipMacBindListStore stack-based overflow (high 8.7)
- [CVE-2026-19823](https://insights.sbomify.com/CVE-2026-19823/): Tenda W20E QoS Rule Deletion delQos formQOSRuleDel stack-based overflow (high 8.7)
- [CVE-2026-19822](https://insights.sbomify.com/CVE-2026-19822/): Tenda W20E QoS Edit editQos lstAdd stack-based overflow (high 8.7)
- [CVE-2026-19821](https://insights.sbomify.com/CVE-2026-19821/): Tenda AC12 httpd web management interface SetSysAutoRebbotCfg formSetRebootTimer buffer overflow (high 8.7)
- [CVE-2026-19820](https://insights.sbomify.com/CVE-2026-19820/): Backblaze Client for Windows Improper Link Resolution Vulnerability (medium 5.8)
- [CVE-2026-1982](https://insights.sbomify.com/CVE-2026-1982/): Persian Elementor (المنتور فارسی) <= 2.8.1 - Unauthenticated Price Manipulation via ZarinPal Widget (medium 5.3)
- [CVE-2026-19816](https://insights.sbomify.com/CVE-2026-19816/): PackageKit: dnf5 backend ignores SIMULATE on RepoRemove (high 7.1)
- [CVE-2026-19815](https://insights.sbomify.com/CVE-2026-19815/): TOTOLINK A800R firewall.so cstecgi.cgi setParentalRules stack-based overflow (high 8.7)
- [CVE-2026-19814](https://insights.sbomify.com/CVE-2026-19814/): TOTOLINK A800R firewall.so cstecgi.cgi setMacQos stack-based overflow (high 8.7)
- [CVE-2026-19813](https://insights.sbomify.com/CVE-2026-19813/): TOTOLINK A800R firewall.so cstecgi.cgi setMacFilterRules stack-based overflow (high 8.7)
- [CVE-2026-19812](https://insights.sbomify.com/CVE-2026-19812/): TOTOLINK A800R product.so cstecgi.cgi UploadCustomModule stack-based overflow (high 8.7)
- [CVE-2026-19811](https://insights.sbomify.com/CVE-2026-19811/): TOTOLINK A800R firewall.so cstecgi.cgi setIpQosRules stack-based overflow (high 8.7)
- [CVE-2026-19810](https://insights.sbomify.com/CVE-2026-19810/): Cross-Site Scripting (XSS) in Symantec Endpoint Detection and Response Console (medium 5.4)
- [CVE-2026-1981](https://insights.sbomify.com/CVE-2026-1981/): Winston AI <= 0.0.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Deletion (medium 4.3)
- [CVE-2026-19807](https://insights.sbomify.com/CVE-2026-19807/): ByteCoreStack <= 1.2.3 - Authenticated (Subscriber+) Privilege Escalation via wp_update_user_meta MCP Tool (high 8.8)
- [CVE-2026-19806](https://insights.sbomify.com/CVE-2026-19806/): Weak cryptography in Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System (high 8.8)
- [CVE-2026-19804](https://insights.sbomify.com/CVE-2026-19804/): s2Member <= 260814 - Unauthenticated Remote Code Execution via 'first_name' Parameter in PayPal Proxy Return (high 8.8)
- [CVE-2026-19802](https://insights.sbomify.com/CVE-2026-19802/): Missing authorization in Checkout Custom Fields Builder for WooCommerce (medium 4.3)
- [CVE-2026-19801](https://insights.sbomify.com/CVE-2026-19801/): Missing authorization in BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP (medium 4.3)
- [CVE-2026-19800](https://insights.sbomify.com/CVE-2026-19800/): Mail Mint <= 1.31.0 - Authenticated (Custom+) SQL Injection via 'status' Parameter (medium 4.9)
- [CVE-2026-1980](https://insights.sbomify.com/CVE-2026-1980/): WPBookit <= 1.0.8 - Missing Authorization to Unauthenticated Sensitive Customer Data Exposure (medium 5.3)
- [CVE-2026-19798](https://insights.sbomify.com/CVE-2026-19798/): Missing authorization in WP Map Block – Google Maps, OpenStreetMap, Mapbox, Store & Shop Locator, Directory, Listings & Filters (medium 4.3)
- [CVE-2026-19797](https://insights.sbomify.com/CVE-2026-19797/): User Access Manager <= 2.3.18 - Reflected Cross-Site Scripting via 'tab_group_section' Parameter (medium 6.1)
- [CVE-2026-19796](https://insights.sbomify.com/CVE-2026-19796/): Cross-site scripting in Listdom: AI-powered Business Directory with Classifieds Ads Listings (high 7.2)
- [CVE-2026-19795](https://insights.sbomify.com/CVE-2026-19795/): Qiskit SDK is vulnerable when deserializing QPY Files and may overflow the available stack space. (medium 6.2)
- [CVE-2026-19794](https://insights.sbomify.com/CVE-2026-19794/): WP-Stats <= 2.56 - Unauthenticated Stored Cross-Site Scripting (high 7.2)
- [CVE-2026-19792](https://insights.sbomify.com/CVE-2026-19792/): Tenda G0 httpd web management interface module setPortMapping buffer overflow (high 8.7)
- [CVE-2026-19791](https://insights.sbomify.com/CVE-2026-19791/): Tenda G0 httpd web management interface module addStaticRoute stack-based overflow (high 8.7)
- [CVE-2026-19790](https://insights.sbomify.com/CVE-2026-19790/): Tenda G0 httpd Web Management module formSetPortMirror stack-based overflow (high 8.7)
- [CVE-2026-1979](https://insights.sbomify.com/CVE-2026-1979/): mruby JMPNOT-to-JMPIF Optimization vm.c mrb_vm_exec use after free (medium 4.8)
- [CVE-2026-19789](https://insights.sbomify.com/CVE-2026-19789/): Tenda AC1206 httpd web management interface WifiGuestSet set_wl_guest_iplist stack-based overflow (high 8.7)
- [CVE-2026-19788](https://insights.sbomify.com/CVE-2026-19788/): Tenda AC1206 httpd web management interface SetOnlineDevName set_device_name stack-based overflow (high 8.7)
- [CVE-2026-19787](https://insights.sbomify.com/CVE-2026-19787/): SourceCodester Air Cargo Management System Master.php save_cargo_type sql injection (medium 5.1)
- [CVE-2026-19786](https://insights.sbomify.com/CVE-2026-19786/): francoisjacquet RosarioSIS Modules.php cross-site request forgery (medium 5.3)
- [CVE-2026-19785](https://insights.sbomify.com/CVE-2026-19785/): francoisjacquet RosarioSIS Student Medical Medical.inc.php sql injection (medium 5.3)
- [CVE-2026-19784](https://insights.sbomify.com/CVE-2026-19784/): francoisjacquet RosarioSIS Referrals.php DBUpdate authorization (medium 5.3)
- [CVE-2026-19783](https://insights.sbomify.com/CVE-2026-19783/): Vulnerabilities in IBM AIX and PowerVM VIOS (medium 6.7)
- [CVE-2026-19782](https://insights.sbomify.com/CVE-2026-19782/): WPS Bidouille < 1.33.5 - Subscriber+ User Email Disclosure via wps_get_users (medium 5.4)
- [CVE-2026-19781](https://insights.sbomify.com/CVE-2026-19781/): Ashlar-Vellum Cobalt VS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-19780](https://insights.sbomify.com/CVE-2026-19780/): Koha Eval Code Injection Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-1978](https://insights.sbomify.com/CVE-2026-1978/): kalyan02 NanoCMS User Information pagesdata.txt direct request (medium 6.9)
- [CVE-2026-19778](https://insights.sbomify.com/CVE-2026-19778/): WPMR Google Feed Manager for WooCommerce <= 2.23.7 - Authenticated (Administrator+) SQL Injection via 'feed' Parameter (medium 6.5)
- [CVE-2026-19775](https://insights.sbomify.com/CVE-2026-19775/): Missing authorization in OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin (medium 4.3)
- [CVE-2026-19774](https://insights.sbomify.com/CVE-2026-19774/): BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 7.1)
- [CVE-2026-19773](https://insights.sbomify.com/CVE-2026-19773/): libwebsockets HTTP/2 HPACK Path Header Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-19771](https://insights.sbomify.com/CVE-2026-19771/): Baicells EG3661M LuCI Web luci os command injection (high 8.6)
- [CVE-2026-19770](https://insights.sbomify.com/CVE-2026-19770/): feedmob fm-mcp-servers Download Endpoint index.ts downloadReport server-side request forgery (medium 4.8)
- [CVE-2026-1977](https://insights.sbomify.com/CVE-2026-1977/): isaacwasserman mcp-vegalite-server visualize_data eval code injection (medium 5.3)
- [CVE-2026-19769](https://insights.sbomify.com/CVE-2026-19769/): Cross-site scripting in Ninja Forms – The Contact Form Builder That Grows With You (high 7.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/821/