# Vulnerabilities published in 2026


- [CVE-2026-15675](https://insights.sbomify.com/CVE-2026-15675/): code-projects Online Job Portal EditUser.php sql injection (medium 6.9)
- [CVE-2026-15673](https://insights.sbomify.com/CVE-2026-15673/): SQL injection in SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery (medium 4.4)
- [CVE-2026-15672](https://insights.sbomify.com/CVE-2026-15672/): itsourcecode Electronic Judging System add_judges.php sql injection (medium 5.3)
- [CVE-2026-15671](https://insights.sbomify.com/CVE-2026-15671/): SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'id' Parameter (medium 4.9)
- [CVE-2026-15670](https://insights.sbomify.com/CVE-2026-15670/): SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter (medium 4.9)
- [CVE-2026-1567](https://insights.sbomify.com/CVE-2026-1567/): IBM InfoSphere Information Server is affected by an XML external entity injection (XXE) vulnerability (high 7.1)
- [CVE-2026-15669](https://insights.sbomify.com/CVE-2026-15669/): louisho5 picobot exec Tool exec.go ExecTool.Execute os command injection (medium 4.8)
- [CVE-2026-15668](https://insights.sbomify.com/CVE-2026-15668/): louisho5 picobot web Tool web.go WebTool.Execute server-side request forgery (medium 5.3)
- [CVE-2026-15667](https://insights.sbomify.com/CVE-2026-15667/): Eventin <= 4.1.22 - Authenticated (Contirbutor+) Local File Inclusion via 'event_layout' Parameter (high 7.5)
- [CVE-2026-15665](https://insights.sbomify.com/CVE-2026-15665/): Cross-site scripting in Fluent Support – Helpdesk & Customer Support Ticket System (medium 6.4)
- [CVE-2026-15664](https://insights.sbomify.com/CVE-2026-15664/): Cross-site scripting in Quill Forms | Conversational Multi Step Forms, Surveys & quizzes (high 7.2)
- [CVE-2026-15663](https://insights.sbomify.com/CVE-2026-15663/): Ninja Forms <= 3.14.9 - Authenticated (Administrator+) SQL Injection via Import File 'settings' Key (medium 4.9)
- [CVE-2026-15662](https://insights.sbomify.com/CVE-2026-15662/): Advanced Woo Labels <= 2.48 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'bg_color' Parameter (medium 6.4)
- [CVE-2026-15661](https://insights.sbomify.com/CVE-2026-15661/): IBM Concert Software Improper Output Neutralization for Logs (medium 5.3)
- [CVE-2026-15660](https://insights.sbomify.com/CVE-2026-15660/): Missing authorization in SEO Booster (medium 4.3)
- [CVE-2026-1566](https://insights.sbomify.com/CVE-2026-1566/): LatePoint <= 5.2.7 - Authenticated (Agent+) Privilege Escalation (high 8.8)
- [CVE-2026-15658](https://insights.sbomify.com/CVE-2026-15658/): foreUP customer REST API allows unauthenticated endpoint access (high 8.1)
- [CVE-2026-15657](https://insights.sbomify.com/CVE-2026-15657/): foreUP customer REST API allows authenticated users to read cleartext payment-processor merchant credentials (medium 6.5)
- [CVE-2026-15656](https://insights.sbomify.com/CVE-2026-15656/): Information disclosure in Maximo Application Suite (medium 4.3)
- [CVE-2026-15653](https://insights.sbomify.com/CVE-2026-15653/): Visualizer <= 4.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'backend-title' Parameter (medium 6.4)
- [CVE-2026-15652](https://insights.sbomify.com/CVE-2026-15652/): Easy Accordion <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' Block Attribute (medium 6.4)
- [CVE-2026-15651](https://insights.sbomify.com/CVE-2026-15651/): WP TripAdvisor Review Slider <= 14.6 - Authenticated (Administrator+) SQL Injection via 'filtersource' Parameter (medium 4.9)
- [CVE-2026-15650](https://insights.sbomify.com/CVE-2026-15650/): Cross-site scripting in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg (medium 6.4)
- [CVE-2026-1565](https://insights.sbomify.com/CVE-2026-1565/): File upload in User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration (high 8.8)
- [CVE-2026-15649](https://insights.sbomify.com/CVE-2026-15649/): Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-15648](https://insights.sbomify.com/CVE-2026-15648/): Cross-site scripting in Brands for WooCommerce (medium 6.4)
- [CVE-2026-15647](https://insights.sbomify.com/CVE-2026-15647/): Cross-site scripting in Brands for WooCommerce (medium 4.4)
- [CVE-2026-15646](https://insights.sbomify.com/CVE-2026-15646/): Cross-site scripting in Brands for WooCommerce (medium 6.4)
- [CVE-2026-15645](https://insights.sbomify.com/CVE-2026-15645/): Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'nav' Shortcode Attribute (medium 6.4)
- [CVE-2026-15644](https://insights.sbomify.com/CVE-2026-15644/): Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute (medium 6.4)
- [CVE-2026-15643](https://insights.sbomify.com/CVE-2026-15643/): AWS HealthLake MCP Server SSRF via Pagination URL (critical 9.2)
- [CVE-2026-15642](https://insights.sbomify.com/CVE-2026-15642/): Information disclosure in Server (low 3.3)
- [CVE-2026-15641](https://insights.sbomify.com/CVE-2026-15641/): Missing authorization in Server (high 7.1)
- [CVE-2026-15640](https://insights.sbomify.com/CVE-2026-15640/): Authentication Bypass via SAML Response Manipulation (critical 9.5)
- [CVE-2026-1564](https://insights.sbomify.com/CVE-2026-1564/): Cross-site scripting in Pega Infinity (medium 5.1)
- [CVE-2026-15639](https://insights.sbomify.com/CVE-2026-15639/): Reflected Cross-Site Scripting (critical 9.3)
- [CVE-2026-15638](https://insights.sbomify.com/CVE-2026-15638/): Cryptographic Padding Oracle (critical 9.1)
- [CVE-2026-15637](https://insights.sbomify.com/CVE-2026-15637/): Missing authorization in Server (high 7.5)
- [CVE-2026-15634](https://insights.sbomify.com/CVE-2026-15634/): IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty Request Smuggling (medium 6.5)
- [CVE-2026-15631](https://insights.sbomify.com/CVE-2026-15631/): @fastify/http-proxy vulnerable to prefix escape via WebSocket path traversal (high 8.7)
- [CVE-2026-15630](https://insights.sbomify.com/CVE-2026-15630/): CVE-2026-15630 (critical 9.9)
- [CVE-2026-1563](https://insights.sbomify.com/CVE-2026-1563/): Cross-site scripting in Pega Infinity (medium 4.8)
- [CVE-2026-15629](https://insights.sbomify.com/CVE-2026-15629/): louisho5 picobot Workspace filesystem.go GetSkill link following (medium 5.3)
- [CVE-2026-15628](https://insights.sbomify.com/CVE-2026-15628/): zhayujie chatgpt-on-wechat CowAgent Vision Tool vision.py Vision._download_to_data_url server-side request forgery (medium 5.3)
- [CVE-2026-15627](https://insights.sbomify.com/CVE-2026-15627/): nextlevelbuilder GoClaw tool.go handleNavigate information disclosure (medium 5.3)
- [CVE-2026-15626](https://insights.sbomify.com/CVE-2026-15626/): nextlevelbuilder GoClaw ACP ToolBridge Workspace tool_bridge.go writeFile path traversal (medium 5.3)
- [CVE-2026-15625](https://insights.sbomify.com/CVE-2026-15625/): nextlevelbuilder GoClaw exec_approval.go ExecApprovalManager.CheckCommand incomplete blacklist (medium 5.3)
- [CVE-2026-15624](https://insights.sbomify.com/CVE-2026-15624/): nextlevelbuilder GoClaw invoke Endpoint create_video_byteplus.go bytePlusDownloadVideo server-side request forgery (medium 5.3)
- [CVE-2026-15623](https://insights.sbomify.com/CVE-2026-15623/): Authenticated Blind SQL Injection in Google Cloud SecOps SOAR Dashboard Widget Query Service (critical 9.4)
- [CVE-2026-15622](https://insights.sbomify.com/CVE-2026-15622/): poco-ai poco-claw Workspace API workspace.py get_workspace_file authorization (medium 6.9)
- [CVE-2026-15621](https://insights.sbomify.com/CVE-2026-15621/): mosaxiv clawlet File Tools fs_ops.go edit_file link following (medium 4.8)
- [CVE-2026-15620](https://insights.sbomify.com/CVE-2026-15620/): mosaxiv clawlet tool_web_fetch.go tools.webFetch server-side request forgery (medium 5.3)
- [CVE-2026-1562](https://insights.sbomify.com/CVE-2026-1562/): Cross-site scripting in Pega Infinity (medium 4.6)
- [CVE-2026-15619](https://insights.sbomify.com/CVE-2026-15619/): mosaxiv clawlet IPv4 tool_web_fetch.go web_fetch server-side request forgery (medium 5.3)
- [CVE-2026-15618](https://insights.sbomify.com/CVE-2026-15618/): mosaxiv clawlet exec Safety Guard tool_exec.go guardExecCommand protection mechanism (medium 5.3)
- [CVE-2026-15617](https://insights.sbomify.com/CVE-2026-15617/): Principal/domain lookup without case normalization (critical 9.1)
- [CVE-2026-15616](https://insights.sbomify.com/CVE-2026-15616/): Local MFA not enforced during SSO sign-in (critical 9.1)
- [CVE-2026-15615](https://insights.sbomify.com/CVE-2026-15615/): SAML <Conditions> element not validated (high 7.5)
- [CVE-2026-15614](https://insights.sbomify.com/CVE-2026-15614/): IdP-initiated SAML sessions not reliably invalidated (replay) (high 7.5)
- [CVE-2026-15612](https://insights.sbomify.com/CVE-2026-15612/): LOIDC nonce validation bypass (critical 9.1)
- [CVE-2026-15611](https://insights.sbomify.com/CVE-2026-15611/): Unverified email-based SSO account linking (critical 9.1)
- [CVE-2026-15610](https://insights.sbomify.com/CVE-2026-15610/): Missing authorization in WPBot – AI ChatBot for Live Support, Lead Generation, AI Services (medium 4.3)
- [CVE-2026-1561](https://insights.sbomify.com/CVE-2026-1561/): IBM WebSphere Application Server Liberty Server-Side Request Forgery (medium 5.4)
- [CVE-2026-15609](https://insights.sbomify.com/CVE-2026-15609/): Cross-site scripting in Bridge - Creative Multipurpose WordPress Theme (medium 6.4)
- [CVE-2026-15607](https://insights.sbomify.com/CVE-2026-15607/): tanstack db Alias Path select.ts select prototype pollution (medium 5.3)
- [CVE-2026-15606](https://insights.sbomify.com/CVE-2026-15606/): Missing authorization in Frontend Admin by DynamiApps (high 8.8)
- [CVE-2026-15605](https://insights.sbomify.com/CVE-2026-15605/): wandb Artifact Integrity Validation hashutil.py ArtifactManifestEntry.download weak hash (low 2.3)
- [CVE-2026-15604](https://insights.sbomify.com/CVE-2026-15604/): Toocheke Companion <= 2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'series_bg_color' Post Meta (medium 6.4)
- [CVE-2026-15603](https://insights.sbomify.com/CVE-2026-15603/): morgan vulnerable to Log Forging via unescaped Unicode line separators (medium 5.3)
- [CVE-2026-15602](https://insights.sbomify.com/CVE-2026-15602/): NEX-Forms <= 9.2.4 - Authenticated (Admin+) SQL Injection via 'additional_params' Parameter (medium 4.9)
- [CVE-2026-15601](https://insights.sbomify.com/CVE-2026-15601/): Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip) (medium 4.9)
- [CVE-2026-15600](https://insights.sbomify.com/CVE-2026-15600/): SQL Injection in Alior Bank raty PrestaShop module (high 8.6)
- [CVE-2026-1560](https://insights.sbomify.com/CVE-2026-1560/): Custom Block Builder – Lazy Blocks <= 4.2.0 - Authenticated (Contributor+) Remote Code Execution (high 8.8)
- [CVE-2026-15599](https://insights.sbomify.com/CVE-2026-15599/): Arbitrary Process Termination in TÜBİTAK BİLGEM's pardus-domain-joiner (low 3.3)
- [CVE-2026-15598](https://insights.sbomify.com/CVE-2026-15598/): antv layout object.js setNestedValue prototype pollution (medium 5.3)
- [CVE-2026-15597](https://insights.sbomify.com/CVE-2026-15597/): SourceCodester Class and Exam Timetabling System edit_exam2.php sql injection (medium 6.9)
- [CVE-2026-15596](https://insights.sbomify.com/CVE-2026-15596/): SourceCodester Class and Exam Timetabling System subject.php cross site scripting (medium 5.3)
- [CVE-2026-15595](https://insights.sbomify.com/CVE-2026-15595/): SourceCodester Class and Exam Timetabling System forsubject.php cross site scripting (medium 5.3)
- [CVE-2026-15594](https://insights.sbomify.com/CVE-2026-15594/): waooAI waoowaoo Media hash.ts stablePublicIdFromStorageKey improper authorization (medium 6.3)
- [CVE-2026-1559](https://insights.sbomify.com/CVE-2026-1559/): Youzify <= 1.3.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'checkin_place_id' Parameter (medium 6.4)
- [CVE-2026-15588](https://insights.sbomify.com/CVE-2026-15588/): Gdbusserver: glib2: gdbusserver pre-authentication dos via unbounded sasl line buffering (medium 5.3)
- [CVE-2026-15587](https://insights.sbomify.com/CVE-2026-15587/): Privilege Escalation in Google SecOps (Chronicle SOAR) via Crafted Authentication Header (critical 9.4)
- [CVE-2026-15586](https://insights.sbomify.com/CVE-2026-15586/): OTP Brute-Force Account Takeover in Idvlabs Software's Ontime (medium 5.3)
- [CVE-2026-15585](https://insights.sbomify.com/CVE-2026-15585/): Path Traversal in AKIN Software's Wolvox9 ERP (high 7.5)
- [CVE-2026-15584](https://insights.sbomify.com/CVE-2026-15584/): Privilege escalation in Pen Drive Powered by Red Hat Lightspeed (high 7.5)
- [CVE-2026-15583](https://insights.sbomify.com/CVE-2026-15583/): SSRF (confused deputy) in Grafana MCP Server via X-Grafana-URL header (high 8.6)
- [CVE-2026-15581](https://insights.sbomify.com/CVE-2026-15581/): Auth bypass in Red Hat OpenShift AI 2.25 (high 8.0)
- [CVE-2026-15580](https://insights.sbomify.com/CVE-2026-15580/): PassPortal browser extension: vault token disclosure via unvalidated postMessage (medium 6.9)
- [CVE-2026-1558](https://insights.sbomify.com/CVE-2026-1558/): Missing authorization in WP Recipe Maker (medium 5.3)
- [CVE-2026-15579](https://insights.sbomify.com/CVE-2026-15579/): Memory corruption in TN-4500B Series (high 8.8)
- [CVE-2026-15577](https://insights.sbomify.com/CVE-2026-15577/): Git Sync connection configuration can be modified with read-only access (medium 6.5)
- [CVE-2026-15576](https://insights.sbomify.com/CVE-2026-15576/): Agent receiver accepts mTLS requests without a client certificate (medium 6.9)
- [CVE-2026-15575](https://insights.sbomify.com/CVE-2026-15575/): Sensitive Information Disclosure Due to Enabled Debug Mode in Production in SFM Software's Costifier (medium 5.3)
- [CVE-2026-15574](https://insights.sbomify.com/CVE-2026-15574/): Information disclosure in Red Hat OpenShift AI 2.25 (high 7.5)
- [CVE-2026-15573](https://insights.sbomify.com/CVE-2026-15573/): Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher (high 8.1)
- [CVE-2026-15572](https://insights.sbomify.com/CVE-2026-15572/): Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalation (high 8.8)
- [CVE-2026-15571](https://insights.sbomify.com/CVE-2026-15571/): Weak cryptography in Red Hat Data Grid 8 (high 7.3)
- [CVE-2026-15570](https://insights.sbomify.com/CVE-2026-15570/): Improper URL Scheme and Destination Validation in SmartCenter browserseturl Command (high 7.1)
- [CVE-2026-1557](https://insights.sbomify.com/CVE-2026-1557/): WP Responsive Images <= 1.0 - Unauthenticated Path Traversal to Arbitrary File Read via src (high 7.5)
- [CVE-2026-15567](https://insights.sbomify.com/CVE-2026-15567/): Wildfly: wildfly-iiop: wildfly-jacorb: wildfly: pre-auth denial of service on the iiop listener (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/856/