# Vulnerabilities published in 2026


- [CVE-2026-18545](https://insights.sbomify.com/CVE-2026-18545/): Server-side request forgery in Langflow OSS (medium 4.3)
- [CVE-2026-18544](https://insights.sbomify.com/CVE-2026-18544/): Portieris is vulnerable to Image Policy Bypass via Unvalidated ownerReference (high 8.1)
- [CVE-2026-18541](https://insights.sbomify.com/CVE-2026-18541/): IBM Planning Analytics Local is affected by security vulnerabilities (medium 6.4)
- [CVE-2026-18540](https://insights.sbomify.com/CVE-2026-18540/): undici vulnerable to downstream response splitting via retry interceptor (low 3.7)
- [CVE-2026-1854](https://insights.sbomify.com/CVE-2026-1854/): Post Flagger <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slug' Shortcode Attribute (medium 6.4)
- [CVE-2026-18537](https://insights.sbomify.com/CVE-2026-18537/): IBM Maximo Application Suite - Location Service for Esri Component Code Execution (high 8.7)
- [CVE-2026-18536](https://insights.sbomify.com/CVE-2026-18536/): Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP (high 7.5)
- [CVE-2026-18534](https://insights.sbomify.com/CVE-2026-18534/): Address bar spoofing risk in affected iOS versions of Arc Search (high 7.4)
- [CVE-2026-18533](https://insights.sbomify.com/CVE-2026-18533/): IBM Maximo Application Suite - Location Service for Esri Component Code Execution (medium 6.5)
- [CVE-2026-18531](https://insights.sbomify.com/CVE-2026-18531/): Weak cryptography in Maximo Application Suite (medium 5.3)
- [CVE-2026-1853](https://insights.sbomify.com/CVE-2026-1853/): Cross-site scripting in BuddyHolis ListSearch (medium 6.4)
- [CVE-2026-18529](https://insights.sbomify.com/CVE-2026-18529/): IBM Maximo Application Suite - Location Service for Esri Component Code Execution (high 8.7)
- [CVE-2026-18527](https://insights.sbomify.com/CVE-2026-18527/): Privilege escalation in Administration Runtime Expert for i (critical 9.9)
- [CVE-2026-18526](https://insights.sbomify.com/CVE-2026-18526/): HumHub 1.18.4 / 1.18.4-pl1 – Stored Cross-Site Scripting in oEmbed confirmation (high 7.4)
- [CVE-2026-1852](https://insights.sbomify.com/CVE-2026-1852/): Product Pricing Table by WooBeWoo <= 1.1.0 - Cross-Site Request Forgery to Stored XSS and Pricing Table Deletion (medium 6.1)
- [CVE-2026-18517](https://insights.sbomify.com/CVE-2026-18517/): IBM Maximo Application Suite - Location Service for Esri Component Improper Access Control (high 7.7)
- [CVE-2026-18516](https://insights.sbomify.com/CVE-2026-18516/): Improper Encoding or Escaping of Output in Crafty Controller (critical 9.6)
- [CVE-2026-18515](https://insights.sbomify.com/CVE-2026-18515/): IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i. (medium 4.3)
- [CVE-2026-18513](https://insights.sbomify.com/CVE-2026-18513/): IBM Maximo Application Suite - Location Service for Esri Component Improper Privilege Management (high 7.2)
- [CVE-2026-18512](https://insights.sbomify.com/CVE-2026-18512/): Cross-site scripting in TranslatePress – Translate Multilingual sites with AI Translation (medium 6.4)
- [CVE-2026-18511](https://insights.sbomify.com/CVE-2026-18511/): IBM i is Affected By Multiple Vulnerabilities in Java Secure Sockets Extension (high 7.3)
- [CVE-2026-18510](https://insights.sbomify.com/CVE-2026-18510/): TranslatePress <= 3.2.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content (high 7.2)
- [CVE-2026-1851](https://insights.sbomify.com/CVE-2026-1851/): iVysilani Shortcode <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute (medium 6.4)
- [CVE-2026-18509](https://insights.sbomify.com/CVE-2026-18509/): IBM i is Affected By A Prvilege Escalation Vulnerability [] (high 8.2)
- [CVE-2026-18508](https://insights.sbomify.com/CVE-2026-18508/): Tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite (medium 4.4)
- [CVE-2026-18505](https://insights.sbomify.com/CVE-2026-18505/): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (medium 5.4)
- [CVE-2026-18504](https://insights.sbomify.com/CVE-2026-18504/): fastify vulnerable to schema validation bypass via root primitive coercion mismatch (medium 5.4)
- [CVE-2026-18503](https://insights.sbomify.com/CVE-2026-18503/): Super-linear CPU usage for unbounded input to csv.Sniffer.sniff() (low 2.4)
- [CVE-2026-18501](https://insights.sbomify.com/CVE-2026-18501/): UsersWP <= 1.2.69 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Badge Widget Variable Substitution (medium 6.4)
- [CVE-2026-18500](https://insights.sbomify.com/CVE-2026-18500/): @fastify/jwt vulnerable to authorization bypass via global secret overriding the per-request key (high 8.1)
- [CVE-2026-1850](https://insights.sbomify.com/CVE-2026-1850/): Denial of service in MongoDB Server (high 7.1)
- [CVE-2026-18499](https://insights.sbomify.com/CVE-2026-18499/): IBM WebSphere Application Server Liberty is affected by a privilege escalation (high 8.1)
- [CVE-2026-18497](https://insights.sbomify.com/CVE-2026-18497/): The nothings stb TrueType library contains a heap buffer overflow vulnerability (high 7.1)
- [CVE-2026-18496](https://insights.sbomify.com/CVE-2026-18496/): Booking Calendar <= 11.4.3 - Unauthenticated Sensitive Information Exposure in 'WPBC_FLEXTIMELINE_NAV' AJAX Action (medium 5.3)
- [CVE-2026-18495](https://insights.sbomify.com/CVE-2026-18495/): Libtiff: libtiff: heap-buffer overflow via numeric truncation in the jpeg raw passthrough (medium 6.1)
- [CVE-2026-18490](https://insights.sbomify.com/CVE-2026-18490/): IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities (high 8.8)
- [CVE-2026-1849](https://insights.sbomify.com/CVE-2026-1849/): Mongod can run out of stack memory when expressions create deeply nested documents (high 7.1)
- [CVE-2026-18489](https://insights.sbomify.com/CVE-2026-18489/): IBM ContextForge Translate is affected by cross-client credential context confusion (high 7.4)
- [CVE-2026-18488](https://insights.sbomify.com/CVE-2026-18488/): Cross-site scripting in Blocksy Companion (medium 6.4)
- [CVE-2026-18487](https://insights.sbomify.com/CVE-2026-18487/): Epiphany: address bar / host spoofing via userinfo in ephy_uri_get_decoded_host() (medium 5.4)
- [CVE-2026-18486](https://insights.sbomify.com/CVE-2026-18486/): IBM ContextForge MCP Gateway is affected by credential disclosure and privilege escalation via jq filter execution (high 8.8)
- [CVE-2026-18485](https://insights.sbomify.com/CVE-2026-18485/): Local Privilege Escalation in NI-PAL (high 8.5)
- [CVE-2026-18482](https://insights.sbomify.com/CVE-2026-18482/): CVE-2026-18482 (critical 9.8)
- [CVE-2026-18481](https://insights.sbomify.com/CVE-2026-18481/): Stored XSS in Participant URL Field leads to Account Takeover via Session Token Theft (medium 6.2)
- [CVE-2026-18480](https://insights.sbomify.com/CVE-2026-18480/): SureCart < 4.6.3 - Subscriber+ Administrator Account Takeover (high 8.8)
- [CVE-2026-1848](https://insights.sbomify.com/CVE-2026-1848/): Connections received from the proxy port may not count towards total accepted connections (high 8.2)
- [CVE-2026-18478](https://insights.sbomify.com/CVE-2026-18478/): Stored XSS in Magnolia CMS (medium 5.1)
- [CVE-2026-18477](https://insights.sbomify.com/CVE-2026-18477/): Tar: tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape (medium 4.4)
- [CVE-2026-18474](https://insights.sbomify.com/CVE-2026-18474/): WP Directory Kit < 1.5.6 - Unauthenticated SQL Injection via search_location and search_category (high 8.6)
- [CVE-2026-18473](https://insights.sbomify.com/CVE-2026-18473/): WP Directory Kit < 1.5.5 - Unauthenticated SQL Injection via 'field_search' Parameter (critical 9.1)
- [CVE-2026-18470](https://insights.sbomify.com/CVE-2026-18470/): Login & Register Forms < 4.0.2 - Unauthenticated Registered User Email Address Disclosure via Lost Password Response (high 7.5)
- [CVE-2026-1847](https://insights.sbomify.com/CVE-2026-1847/): MongoDB Server may crash when inserting large documents (high 7.1)
- [CVE-2026-18469](https://insights.sbomify.com/CVE-2026-18469/): Login & Register Forms < 4.0.2 - Unauthenticated Account Takeover via Password Reset Code Brute Force (high 8.1)
- [CVE-2026-18468](https://insights.sbomify.com/CVE-2026-18468/): Auth bypass in Login & Register Forms (high 8.1)
- [CVE-2026-18467](https://insights.sbomify.com/CVE-2026-18467/): Privilege escalation in Paytium: Mollie payment forms & donations (critical 9.8)
- [CVE-2026-18466](https://insights.sbomify.com/CVE-2026-18466/): WP Maps < 4.9.8 - Subscriber+ Unlimited Autoloaded Option Creation (medium 5.4)
- [CVE-2026-18465](https://insights.sbomify.com/CVE-2026-18465/): WP Maps Pro < 6.1.3 - Unauthenticated Local File Inclusion (medium 6.5)
- [CVE-2026-18464](https://insights.sbomify.com/CVE-2026-18464/): WP Maps Pro < 6.1.3 - Unauthenticated Denial of Service (high 7.5)
- [CVE-2026-18462](https://insights.sbomify.com/CVE-2026-18462/): Integer overflow in Connext Professional (high 7.3)
- [CVE-2026-18461](https://insights.sbomify.com/CVE-2026-18461/): Memory corruption in Connext Professional (critical 9.2)
- [CVE-2026-18460](https://insights.sbomify.com/CVE-2026-18460/): Memory corruption in Connext Professional (medium 6.9)
- [CVE-2026-18459](https://insights.sbomify.com/CVE-2026-18459/): Incorrect Calculation vulnerability in RTI Connext Professional (Core Libraries) allows Abuse Existing Functionality. (high 8.7)
- [CVE-2026-18458](https://insights.sbomify.com/CVE-2026-18458/): Memory corruption in Connext Professional (medium 6.8)
- [CVE-2026-18457](https://insights.sbomify.com/CVE-2026-18457/): Heap-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Buffers. (high 8.3)
- [CVE-2026-18453](https://insights.sbomify.com/CVE-2026-18453/): Null dereference in Red Hat Directory Server 11.5 E4S for RHEL 8 (high 7.5)
- [CVE-2026-18452](https://insights.sbomify.com/CVE-2026-18452/): Rich Source｜DMS+ (Non-Mobile) - Use of Hard-coded Credentials (critical 10.0)
- [CVE-2026-18451](https://insights.sbomify.com/CVE-2026-18451/): Supermicro BMC's iKVM feature is vulnerable to KVM session hijacking due to a predictable time-seeded launch token (low 3.1)
- [CVE-2026-18450](https://insights.sbomify.com/CVE-2026-18450/): Supermicro BMC contains Unprotected IPMI Commands Accepted on Active RMCP+ Sessions vulnerability (critical 9.8)
- [CVE-2026-1845](https://insights.sbomify.com/CVE-2026-1845/): Real Estate Pro <= 1.0.9 - Authenticated (Admin+) Stored Cross-Site Scripting via Settings (medium 5.5)
- [CVE-2026-18449](https://insights.sbomify.com/CVE-2026-18449/): Supermicro BMC contains a SMCRAKP Fixed Key vulnerability (high 7.5)
- [CVE-2026-18446](https://insights.sbomify.com/CVE-2026-18446/): fast-uri vulnerable to host confusion via backslash authority introducer (high 7.5)
- [CVE-2026-18445](https://insights.sbomify.com/CVE-2026-18445/): Integer Overflow Vulnerability Resulting in an Out of Bounds Write in NI LabVIEW (medium 6.9)
- [CVE-2026-18444](https://insights.sbomify.com/CVE-2026-18444/): Integer Conversion Vulnerability Resulting in an Out of Bounds Read in NI LabVIEW (medium 6.9)
- [CVE-2026-18443](https://insights.sbomify.com/CVE-2026-18443/): SQL injection in Smart Manager – WooCommerce Bulk Edit: Products, Orders, Users & More (Spreadsheet) (high 8.8)
- [CVE-2026-18442](https://insights.sbomify.com/CVE-2026-18442/): SQL injection in WCFM Marketplace – Multivendor Marketplace for WooCommerce (high 7.5)
- [CVE-2026-18441](https://insights.sbomify.com/CVE-2026-18441/): Missing authorization in Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress (medium 4.3)
- [CVE-2026-1844](https://insights.sbomify.com/CVE-2026-1844/): PixelYourSite PRO <= 12.4.0.2 - Unauthenticated Stored Cross-Site Scripting (high 7.2)
- [CVE-2026-18439](https://insights.sbomify.com/CVE-2026-18439/): Missing authorization in Tutor LMS – eLearning and online course solution (medium 4.3)
- [CVE-2026-18438](https://insights.sbomify.com/CVE-2026-18438/): File upload in Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! (high 8.8)
- [CVE-2026-18437](https://insights.sbomify.com/CVE-2026-18437/): MailPress <= 1.5.0 - Missing Authorization to Unauthenticated Contact Updates (medium 5.3)
- [CVE-2026-18436](https://insights.sbomify.com/CVE-2026-18436/): MailerPress <= 1.5.0 - Missing Authorization to Unauthenticated Arbitrary Modification via REST API Endpoint (medium 5.3)
- [CVE-2026-18435](https://insights.sbomify.com/CVE-2026-18435/): Kadence Blocks <= 3.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'toggleIcon' Block Attribute (medium 6.4)
- [CVE-2026-18433](https://insights.sbomify.com/CVE-2026-18433/): Incorrect Authorization in GitLab (medium 4.3)
- [CVE-2026-18432](https://insights.sbomify.com/CVE-2026-18432/): Frontend Admin by DynamiApps <= 3.29.9 - Unauthenticated Privilege Escalation via 'item_id' Parameter (critical 9.8)
- [CVE-2026-18431](https://insights.sbomify.com/CVE-2026-18431/): Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write (critical 9.8)
- [CVE-2026-18430](https://insights.sbomify.com/CVE-2026-18430/): HumHub 1.18.4 - Stored XSS in comment-deletion notifications through unescaped administrator reason (high 7.2)
- [CVE-2026-1843](https://insights.sbomify.com/CVE-2026-1843/): Super Page Cache <= 5.2.2 - Unauthenticated Stored Cross-Site Scripting via Activity Log (high 7.2)
- [CVE-2026-18428](https://insights.sbomify.com/CVE-2026-18428/): SQL Query Validation Bypass in OpenSearch Direct Query (high 8.7)
- [CVE-2026-18427](https://insights.sbomify.com/CVE-2026-18427/): @fastify/static vulnerable to route guard bypass via non-canonical path segments (high 7.5)
- [CVE-2026-18426](https://insights.sbomify.com/CVE-2026-18426/): Missing authorization in Concrete CMS (low 2.0)
- [CVE-2026-18425](https://insights.sbomify.com/CVE-2026-18425/): Missing authorization in Concrete CMS (low 2.1)
- [CVE-2026-18424](https://insights.sbomify.com/CVE-2026-18424/): Server-side request forgery in Concrete CMS (low 2.1)
- [CVE-2026-18423](https://insights.sbomify.com/CVE-2026-18423/): Missing authorization in Concrete CMS (low 2.1)
- [CVE-2026-18422](https://insights.sbomify.com/CVE-2026-18422/): Concrete CMS below 9.5.3 Multilingual Page Assign Action Lacks Destination Authorization and CSRF Token Validation (low 2.1)
- [CVE-2026-18421](https://insights.sbomify.com/CVE-2026-18421/): Missing authorization in Concrete CMS (low 2.1)
- [CVE-2026-18420](https://insights.sbomify.com/CVE-2026-18420/): RCE via Prototype Pollution in OpenSearch Dashboards (high 8.7)
- [CVE-2026-1842](https://insights.sbomify.com/CVE-2026-1842/): HyperCloud Improper Refresh Token Validation and Access Token Invalidation Allows Long-Term Unauthorized Access (medium 6.2)
- [CVE-2026-18418](https://insights.sbomify.com/CVE-2026-18418/): Out-of-bounds read when the zbus proxy agent IPC backend logs a rejected peer frame's channel name (low 3.4)
- [CVE-2026-18417](https://insights.sbomify.com/CVE-2026-18417/): Wild pointer dereference in Zephyr BSD sockets when a TCP listening socket reports an asynchronous error (medium 6.5)
- [CVE-2026-18416](https://insights.sbomify.com/CVE-2026-18416/): Out-of-bounds read in CoAP well-known-core Uri-Query href matching (match_path_uri) (low 3.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/832/