# Vulnerabilities published in 2026


- [CVE-2026-17585](https://insights.sbomify.com/CVE-2026-17585/): Information disclosure in Royal Addons for Elementor – Addons and Templates Kit for Elementor (medium 5.3)
- [CVE-2026-17583](https://insights.sbomify.com/CVE-2026-17583/): Thermo Fisher Applied Biosystems Genetic Analyzers Missing Support for Integrity Check (high 8.3)
- [CVE-2026-17582](https://insights.sbomify.com/CVE-2026-17582/): SQL injection in Slider Hero with Video Background, Animation (medium 4.9)
- [CVE-2026-17581](https://insights.sbomify.com/CVE-2026-17581/): WCPOS <= 1.9.14 - Authenticated (Shop Manager+) Code Injection via 'thermal' Template Engine (high 7.2)
- [CVE-2026-17580](https://insights.sbomify.com/CVE-2026-17580/): Missing authorization in Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… (medium 6.5)
- [CVE-2026-1758](https://insights.sbomify.com/CVE-2026-1758/): Session Fixation (high 8.3)
- [CVE-2026-17578](https://insights.sbomify.com/CVE-2026-17578/): Kong Event Gateway AES-GCM nonce reuse due to missing key rotation enforcement (low 2.3)
- [CVE-2026-17577](https://insights.sbomify.com/CVE-2026-17577/): SSL Zen <= 4.7.42 - Reflected Cross-Site Scripting via 'uri' Parameter (medium 6.1)
- [CVE-2026-17576](https://insights.sbomify.com/CVE-2026-17576/): InfiniteWP Client <= 1.13.9 - Authenticated (Admin+) SQL Injection via 'iwp_get_comments_*' Array Key (medium 6.5)
- [CVE-2026-17574](https://insights.sbomify.com/CVE-2026-17574/): NULL Pointer Dereference in HDF5 via Invalid Variable-Length Datatype Type Tag (medium 5.2)
- [CVE-2026-17573](https://insights.sbomify.com/CVE-2026-17573/): Double Free in H5D__chunk_copy() in HDF5 via a Crafted Chunk-Index Size Field (medium 4.0)
- [CVE-2026-17572](https://insights.sbomify.com/CVE-2026-17572/): HDF5 SOHM List Index Heap Buffer Overflow (medium 5.5)
- [CVE-2026-17571](https://insights.sbomify.com/CVE-2026-17571/): Fluent Forms <= 6.2.8 - Reflected Cross-Site Scripting via 'param' (medium 6.1)
- [CVE-2026-17570](https://insights.sbomify.com/CVE-2026-17570/): Missing authorization in Server (medium 4.3)
- [CVE-2026-1757](https://insights.sbomify.com/CVE-2026-1757/): Libxml2: memory leak leading to local denial of service in xmllint interactive shell (medium 6.2)
- [CVE-2026-17569](https://insights.sbomify.com/CVE-2026-17569/): Missing authorization in Server (medium 4.3)
- [CVE-2026-17568](https://insights.sbomify.com/CVE-2026-17568/): Privilege escalation in Server (high 8.8)
- [CVE-2026-17567](https://insights.sbomify.com/CVE-2026-17567/): Missing authorization in Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder (medium 5.3)
- [CVE-2026-17566](https://insights.sbomify.com/CVE-2026-17566/): Command injection in pgAdmin 4 (critical 9.4)
- [CVE-2026-17565](https://insights.sbomify.com/CVE-2026-17565/): Animation Addons for Elementor < 2.7.2 - Unauthenticated Server-Side Request Forgery (high 7.2)
- [CVE-2026-17563](https://insights.sbomify.com/CVE-2026-17563/): WP User Frontend < 4.3.11 - Unauthenticated Post Creation via Subscription-Gated Form (medium 5.3)
- [CVE-2026-17562](https://insights.sbomify.com/CVE-2026-17562/): IDOR in Zirve Security's AdisyonPro (medium 6.5)
- [CVE-2026-17561](https://insights.sbomify.com/CVE-2026-17561/): Unauthenticated RCE in Innotim Software's Logsign SIEM (critical 9.8)
- [CVE-2026-1756](https://insights.sbomify.com/CVE-2026-1756/): WP FOFT Loader <= 2.1.39 - Authenticated (Author+) Arbitrary File Upload (high 8.8)
- [CVE-2026-17559](https://insights.sbomify.com/CVE-2026-17559/): Content Protector (Passster) < 4.3.9 - Unauthenticated Protected Content Disclosure via REST Path Allowlist Bypass (medium 5.3)
- [CVE-2026-17557](https://insights.sbomify.com/CVE-2026-17557/): Lm-evaluation-harness: lm-evaluation-harness: ssrf via job-spec model.url with bearer credential forwarding (medium 6.5)
- [CVE-2026-17556](https://insights.sbomify.com/CVE-2026-17556/): Path traversal in Enterprise Server (high 8.8)
- [CVE-2026-17555](https://insights.sbomify.com/CVE-2026-17555/): WPvivid <= 0.9.131 - Authenticated (Administrator+) SQL Injection via 'export_data' Parameter (medium 4.9)
- [CVE-2026-17553](https://insights.sbomify.com/CVE-2026-17553/): Privilege escalation in Shopping Cart & eCommerce Store (high 7.2)
- [CVE-2026-17552](https://insights.sbomify.com/CVE-2026-17552/): Server-side request forgery in Plack::App::Prerender (critical 9.1)
- [CVE-2026-17550](https://insights.sbomify.com/CVE-2026-17550/): DWG or DXF File Parsing Out-of-Bounds Read in Autodesk AutoCAD (medium 5.5)
- [CVE-2026-1755](https://insights.sbomify.com/CVE-2026-1755/): Menu Icons by ThemeIsle <= 0.13.20 - Authenticated (Author+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2026-17548](https://insights.sbomify.com/CVE-2026-17548/): Missing authorization for viewing background jobs (medium 5.3)
- [CVE-2026-17545](https://insights.sbomify.com/CVE-2026-17545/): PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS (medium 6.9)
- [CVE-2026-17544](https://insights.sbomify.com/CVE-2026-17544/): Out-of-bounds write in bccomp() via crafted operand and scale (high 8.1)
- [CVE-2026-17543](https://insights.sbomify.com/CVE-2026-17543/): SQL injection in ext-pgsql via E'...' backslash breakout (high 8.1)
- [CVE-2026-17542](https://insights.sbomify.com/CVE-2026-17542/): Bit File Manager < 6.9.1 - Subscriber+ Sensitive Data Disclosure via bitapps_fm_connector (high 7.5)
- [CVE-2026-17541](https://insights.sbomify.com/CVE-2026-17541/): Bit File Manager < 6.9.1 - Unauthenticated File Activity Log Disclosure (high 7.5)
- [CVE-2026-17540](https://insights.sbomify.com/CVE-2026-17540/): Bit File Manager < 6.9.1 - Subscriber+ Arbitrary File Read and Deletion via Connector Command Request-Source Mismatch (high 8.8)
- [CVE-2026-1754](https://insights.sbomify.com/CVE-2026-1754/): personal-authors-category <= 0.3 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2026-17539](https://insights.sbomify.com/CVE-2026-17539/): Null dereference in RTU500 series CMU firmware (medium 5.9)
- [CVE-2026-17538](https://insights.sbomify.com/CVE-2026-17538/): Missing authorization in Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress (medium 5.4)
- [CVE-2026-17535](https://insights.sbomify.com/CVE-2026-17535/): Velociraptor Multiple Crashes in NTFS Parser when applied to invalid NTFS Volumes (medium 6.2)
- [CVE-2026-17534](https://insights.sbomify.com/CVE-2026-17534/): Kimi Code FetchURL SSRF protection bypass via DNS-resolving hostnames and redirects (medium 5.5)
- [CVE-2026-17533](https://insights.sbomify.com/CVE-2026-17533/): All-in-One WP Migration and Backup < 7.108 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via REST Import (high 7.2)
- [CVE-2026-17532](https://insights.sbomify.com/CVE-2026-17532/): Seraphinite Accelerator <= 2.29.18 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2026-17531](https://insights.sbomify.com/CVE-2026-17531/): unitedbyai droidclaw Unsigned Scheduled Callback goals.ts authorization (low 2.3)
- [CVE-2026-17530](https://insights.sbomify.com/CVE-2026-17530/): AstrBotDevs AstrBot Subagent astr_agent_tool_exec.py _build_handoff_toolset authorization (medium 5.3)
- [CVE-2026-1753](https://insights.sbomify.com/CVE-2026-1753/): Gutena Forms < 1.6.1 - Contributor+ Arbitrary Limited Options Update (medium 6.8)
- [CVE-2026-17529](https://insights.sbomify.com/CVE-2026-17529/): AstrBotDevs AstrBot astr_main_agent.py authorization (medium 5.3)
- [CVE-2026-17528](https://insights.sbomify.com/CVE-2026-17528/): Cross-site scripting in nice-select2 (medium 5.3)
- [CVE-2026-17527](https://insights.sbomify.com/CVE-2026-17527/): Privilege escalation in Red Hat Container Native Virtualization 4.14 (high 7.7)
- [CVE-2026-17526](https://insights.sbomify.com/CVE-2026-17526/): Privilege escalation in Red Hat Data Grid 8 (high 7.2)
- [CVE-2026-17525](https://insights.sbomify.com/CVE-2026-17525/): My Control System 26.5 – Disk space exhaustion due to incorrect temporary file cleanup after XML conversion (medium 5.1)
- [CVE-2026-17524](https://insights.sbomify.com/CVE-2026-17524/): Path traversal in zip-lib (high 8.7)
- [CVE-2026-17523](https://insights.sbomify.com/CVE-2026-17523/): can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (high 7.8)
- [CVE-2026-17522](https://insights.sbomify.com/CVE-2026-17522/): Newsletters < 4.17 - Arbitrary Plugin Option Update via CSRF (medium 5.4)
- [CVE-2026-17520](https://insights.sbomify.com/CVE-2026-17520/): Newsletters < 4.17 - Unauthenticated API Access via Predictable API Key (medium 4.8)
- [CVE-2026-1752](https://insights.sbomify.com/CVE-2026-1752/): Incorrect Authorization in GitLab (medium 4.3)
- [CVE-2026-17518](https://insights.sbomify.com/CVE-2026-17518/): Memory corruption in Router (high 8.2)
- [CVE-2026-17517](https://insights.sbomify.com/CVE-2026-17517/): Content Views < 4.5.1.2 - Unauthenticated Non-Public Post Content Disclosure via Views Status Filter (medium 5.3)
- [CVE-2026-17515](https://insights.sbomify.com/CVE-2026-17515/): MLS Import < 7.0.4 - Subscriber+ Sensitive Information Disclosure via mlsimport_logger_per_item (medium 4.3)
- [CVE-2026-17514](https://insights.sbomify.com/CVE-2026-17514/): ZJONSSON node-unzipper extract.js Extract path traversal (medium 4.8)
- [CVE-2026-17513](https://insights.sbomify.com/CVE-2026-17513/): ggml-org whisper.cpp ggml.c ggml_ftype_to_ggml_type assertion (medium 4.8)
- [CVE-2026-17512](https://insights.sbomify.com/CVE-2026-17512/): ggml-org whisper.cpp log_mel_spectrogram out-of-bounds (medium 4.8)
- [CVE-2026-17511](https://insights.sbomify.com/CVE-2026-17511/): This Power System update is being released to address (low 3.4)
- [CVE-2026-17510](https://insights.sbomify.com/CVE-2026-17510/): Null dereference in Crypt::OpenSSL::PKCS12 (high 7.5)
- [CVE-2026-1751](https://insights.sbomify.com/CVE-2026-1751/): Missing Authorization in GitLab (low 3.1)
- [CVE-2026-17509](https://insights.sbomify.com/CVE-2026-17509/): WPML Multilingual CMS <= 4.9.5 - Incorrect Authorization to Authenticated (Subscriber+) SQL Injection via ‘elementIds’ (medium 6.5)
- [CVE-2026-17508](https://insights.sbomify.com/CVE-2026-17508/): Password-based KDF cost parameters honoured unbounded from untrusted input across the remaining PBE entry points (medium 5.3)
- [CVE-2026-17507](https://insights.sbomify.com/CVE-2026-17507/): MLS membership checks compare a uint32 leaf_index as signed, admitting an out-of-range sender (high 8.7)
- [CVE-2026-17506](https://insights.sbomify.com/CVE-2026-17506/): Independent Analytics <= 2.15.0 - Unauthenticated Stored Cross-Site Scripting (high 7.2)
- [CVE-2026-17505](https://insights.sbomify.com/CVE-2026-17505/): TranslatePress <= 3.2.5 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2026-17504](https://insights.sbomify.com/CVE-2026-17504/): This Power System update is being released to address (medium 5.1)
- [CVE-2026-17503](https://insights.sbomify.com/CVE-2026-17503/): This Power System update is being released to address (medium 5.1)
- [CVE-2026-17502](https://insights.sbomify.com/CVE-2026-17502/): IBM i is Affected By Multiple Vulnerabilities in NetServer (high 8.6)
- [CVE-2026-17501](https://insights.sbomify.com/CVE-2026-17501/): ggml-org llama.cpp JSON-Schema-to-GBNF Conversion json-schema-to-grammar.cpp transform recursion (medium 6.9)
- [CVE-2026-17500](https://insights.sbomify.com/CVE-2026-17500/): ggml-org llama.cpp json-schema-to-grammar.cpp _visit_pattern null pointer dereference (medium 6.9)
- [CVE-2026-1750](https://insights.sbomify.com/CVE-2026-1750/): Privilege escalation in Ecwid by Lightspeed Ecommerce Shopping Cart (high 8.8)
- [CVE-2026-17499](https://insights.sbomify.com/CVE-2026-17499/): IBM i is Affected By Multiple Vulnerabilities in Debug Server (medium 4.4)
- [CVE-2026-17497](https://insights.sbomify.com/CVE-2026-17497/): NoteGen arbitrary OS command execution via Tauri shell:allow-execute for bash/python (high 8.3)
- [CVE-2026-17496](https://insights.sbomify.com/CVE-2026-17496/): NoteGen chat preview XSS via unsanitized AI/skill HTML rendering (high 8.1)
- [CVE-2026-17495](https://insights.sbomify.com/CVE-2026-17495/): moment vulnerable to Path Traversal via crafted non-string locale name (medium 5.9)
- [CVE-2026-17494](https://insights.sbomify.com/CVE-2026-17494/): Power System Buffer Overflow (high 8.2)
- [CVE-2026-17491](https://insights.sbomify.com/CVE-2026-17491/): IBM i is Affected By An Improper Privilege Management Vulnerability in OpenSSH (medium 5.4)
- [CVE-2026-1749](https://insights.sbomify.com/CVE-2026-1749/): Missing authorization in HikCentral Professional (medium 6.8)
- [CVE-2026-17488](https://insights.sbomify.com/CVE-2026-17488/): IBM i is Affected By An Improper Authentication Vulnerability in SST / DST (medium 4.3)
- [CVE-2026-17487](https://insights.sbomify.com/CVE-2026-17487/): IBM i is Information Disclosure (medium 5.3)
- [CVE-2026-17485](https://insights.sbomify.com/CVE-2026-17485/): IBM i is Affected By Denial of Service Vulnerability [] (high 8.2)
- [CVE-2026-17484](https://insights.sbomify.com/CVE-2026-17484/): IBM i is Information Disclosure (medium 5.3)
- [CVE-2026-17483](https://insights.sbomify.com/CVE-2026-17483/): IBM Db2 Mirror for i is affected by multiple vulnerabilities [, , ] (medium 4.3)
- [CVE-2026-17482](https://insights.sbomify.com/CVE-2026-17482/): IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code execution (critical 9.8)
- [CVE-2026-17481](https://insights.sbomify.com/CVE-2026-17481/): IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code execution (high 8.8)
- [CVE-2026-1748](https://insights.sbomify.com/CVE-2026-1748/): Missing authorization in Invoct – PDF Invoices & Billing for WooCommerce (medium 4.3)
- [CVE-2026-17476](https://insights.sbomify.com/CVE-2026-17476/): IBM i Is Affected By Multiple Vulnerabilities in IBM Java SDK and IBM Java Runtime (medium 4.8)
- [CVE-2026-17475](https://insights.sbomify.com/CVE-2026-17475/): IBM Planning Analytics Local is affected by security vulnerabilities (high 7.1)
- [CVE-2026-17473](https://insights.sbomify.com/CVE-2026-17473/): IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code execution (high 7.5)
- [CVE-2026-17472](https://insights.sbomify.com/CVE-2026-17472/): Multiple Vulnerabilities in IBM Concert Software (critical 9.6)
- [CVE-2026-17470](https://insights.sbomify.com/CVE-2026-17470/): IBM i is Affected By Denial of Service Vulnerabilities in Line Printer Daemon [, ] (medium 5.3)
- [CVE-2026-1747](https://insights.sbomify.com/CVE-2026-1747/): Authentication Bypass Using an Alternate Path or Channel in GitLab (medium 4.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/841/