# Vulnerabilities published in 2026


- [CVE-2026-15471](https://insights.sbomify.com/CVE-2026-15471/): Eleveo Call Recording Software pci_dss_status.jsp improper authorization (medium 5.3)
- [CVE-2026-15470](https://insights.sbomify.com/CVE-2026-15470/): Eleveo Call Recording Software group.jsp improper authorization (medium 5.3)
- [CVE-2026-1547](https://insights.sbomify.com/CVE-2026-1547/): Totolink A7000R cstecgi.cgi setUnloadUserData command injection (medium 5.3)
- [CVE-2026-15469](https://insights.sbomify.com/CVE-2026-15469/): Hard-coded Mesh Group Private Key in TP-Link Deco XE75, XE5300, and WE10800 (high 7.7)
- [CVE-2026-15468](https://insights.sbomify.com/CVE-2026-15468/): Auth bypass in Passwordless (medium 6.9)
- [CVE-2026-15467](https://insights.sbomify.com/CVE-2026-15467/): Security feature bypass in Red Hat OpenShift AI 2.25 (high 8.1)
- [CVE-2026-15464](https://insights.sbomify.com/CVE-2026-15464/): Cross-site scripting in WP Hotel Booking (medium 6.4)
- [CVE-2026-15463](https://insights.sbomify.com/CVE-2026-15463/): SSL Zen <= 4.7.42 - Reflected Cross-Site Scripting via 'uri' and 'host' Parameters (medium 6.1)
- [CVE-2026-15462](https://insights.sbomify.com/CVE-2026-15462/): Sticky Chat Widget <= 1.4.2 - Unauthenticated SQL Injection (high 7.5)
- [CVE-2026-15461](https://insights.sbomify.com/CVE-2026-15461/): Type confusion in Zephyr HL78xx GNSS NMEA driver causes wild-pointer write from GNSS input (medium 5.3)
- [CVE-2026-15460](https://insights.sbomify.com/CVE-2026-15460/): Missing channel-state validation in Zephyr Bluetooth Classic L2CAP receive path (medium 5.4)
- [CVE-2026-1546](https://insights.sbomify.com/CVE-2026-1546/): jishenghua jshERP com.jsh.erp.datasource.mappers.DepotItemMapperEx importItemExcel getBillItemByParam sql injection (medium 5.3)
- [CVE-2026-15459](https://insights.sbomify.com/CVE-2026-15459/): Auth bypass in WPMU DEV Dashboard (high 8.1)
- [CVE-2026-15458](https://insights.sbomify.com/CVE-2026-15458/): SEO Booster <= 7.3.1 - Authenticated (Administrator+) SQL Injection via 'sort_field' Parameter (medium 4.9)
- [CVE-2026-15457](https://insights.sbomify.com/CVE-2026-15457/): Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary Directory Deletion via 'family' Parameter (medium 4.9)
- [CVE-2026-15453](https://insights.sbomify.com/CVE-2026-15453/): KiviCare <= 4.5.1 - Authenticated (Doctor+) SQL Injection via 'searchTerm' Parameter (medium 6.5)
- [CVE-2026-15452](https://insights.sbomify.com/CVE-2026-15452/): Smash Balloon Social Photo Feed <= 6.11.3 - Reflected Cross-Site Scripting via REQUEST_URI Query String (medium 4.7)
- [CVE-2026-15451](https://insights.sbomify.com/CVE-2026-15451/): Privilege escalation in MemberPress Corporate Accounts (high 8.8)
- [CVE-2026-15450](https://insights.sbomify.com/CVE-2026-15450/): NEX-Forms <= 9.2.3 - Authenticated (Admin+) Arbitrary File Deletion via Path Traversal via 'location' Parameter (high 8.1)
- [CVE-2026-1545](https://insights.sbomify.com/CVE-2026-1545/): itsourcecode School Management System index.php sql injection (medium 6.9)
- [CVE-2026-15449](https://insights.sbomify.com/CVE-2026-15449/): TOCTOU double copyin in illumos dld ioctl handling causes kernel heap corruption (medium 5.8)
- [CVE-2026-15448](https://insights.sbomify.com/CVE-2026-15448/): Tickera <= 3.6.0.1 - Authenticated (Staff+) SQL Injection via 'tc_order_status_filter' Parameter (medium 6.5)
- [CVE-2026-15446](https://insights.sbomify.com/CVE-2026-15446/): Cross-site scripting in EWWW Image Optimizer (medium 6.4)
- [CVE-2026-15445](https://insights.sbomify.com/CVE-2026-15445/): SEO Booster <= 7.3.1 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter (medium 4.9)
- [CVE-2026-15444](https://insights.sbomify.com/CVE-2026-15444/): Tutor LMS <= 4.0.1 - Authenticated (Administrator+) SQL Injection via 'coupon_code' Parameter (medium 4.9)
- [CVE-2026-15442](https://insights.sbomify.com/CVE-2026-15442/): Heap use-after-free on read during bidirectional (D)TLS shutdown (low 2.3)
- [CVE-2026-15441](https://insights.sbomify.com/CVE-2026-15441/): Cross-site scripting in Product Table & List Builder For WooCommerce (medium 5.3)
- [CVE-2026-1544](https://insights.sbomify.com/CVE-2026-1544/): D-Link DIR-823X set_mode sub_41E2A0 os command injection (medium 5.3)
- [CVE-2026-15439](https://insights.sbomify.com/CVE-2026-15439/): GamiPress <= 7.9.7 - Authenticated (Subscriber+) SQL Injection (medium 6.5)
- [CVE-2026-15435](https://insights.sbomify.com/CVE-2026-15435/): IBM App Connect Enterprise is vulnerable to arbitrary file write vulnerability (critical 9.8)
- [CVE-2026-15432](https://insights.sbomify.com/CVE-2026-15432/): Observable Timing Discrepancy in Tink-Java and Tink-Android ChunkedMacVerification (high 8.2)
- [CVE-2026-15431](https://insights.sbomify.com/CVE-2026-15431/): HP Support Assistant – Potential Escalation of Privilege (high 7.3)
- [CVE-2026-15430](https://insights.sbomify.com/CVE-2026-15430/): CVE-2026-15430 (medium 6.2)
- [CVE-2026-1543](https://insights.sbomify.com/CVE-2026-1543/): Avada (Fusion) Builder <= 3.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Shortcodes (medium 6.4)
- [CVE-2026-15429](https://insights.sbomify.com/CVE-2026-15429/): Privilege Escalation via Improper Input Sanitization in TP-Link Archer VX1800v (medium 5.1)
- [CVE-2026-15428](https://insights.sbomify.com/CVE-2026-15428/): OS Command Injection in TR-069 (CWMP) Management Interface in TP-Link Archer VX1800v (high 8.5)
- [CVE-2026-15427](https://insights.sbomify.com/CVE-2026-15427/): OS Command Injection in TR-069 (CWMP) Management Interface in TP-Link Archer VX1800v (high 8.6)
- [CVE-2026-15426](https://insights.sbomify.com/CVE-2026-15426/): Missing authorization in AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress (high 8.8)
- [CVE-2026-15425](https://insights.sbomify.com/CVE-2026-15425/): Yoast SEO <= 28.0 - Authenticated (Author+) Stored Cross-Site Scripting via Post Slug (post_name) (medium 6.4)
- [CVE-2026-15423](https://insights.sbomify.com/CVE-2026-15423/): Incorrect Authorization in GitLab (high 8.5)
- [CVE-2026-15422](https://insights.sbomify.com/CVE-2026-15422/): SCTP needs to better-check INIT ACK chunk parameters (critical 9.1)
- [CVE-2026-15421](https://insights.sbomify.com/CVE-2026-15421/): Speed Optimizer <= 7.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Tag Attributes (medium 6.4)
- [CVE-2026-15420](https://insights.sbomify.com/CVE-2026-15420/): Path traversal in Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder (medium 4.3)
- [CVE-2026-1542](https://insights.sbomify.com/CVE-2026-1542/): Super Stage WP <= 1.0.1 - Unauthenticated PHP Object Injection (medium 6.5)
- [CVE-2026-15419](https://insights.sbomify.com/CVE-2026-15419/): CP210x Driver Memory Corruption results in Arbitrary Code Execution (high 7.0)
- [CVE-2026-15418](https://insights.sbomify.com/CVE-2026-15418/): CP210x Memory Leakage (low 2.4)
- [CVE-2026-15417](https://insights.sbomify.com/CVE-2026-15417/): CP210x Denial of Service (medium 6.9)
- [CVE-2026-15416](https://insights.sbomify.com/CVE-2026-15416/): Argo-cd: argo cd unauthenticated remote code execution in repo-server via generatemanifest grpc endpoint (high 8.9)
- [CVE-2026-15415](https://insights.sbomify.com/CVE-2026-15415/): Path traversal and arbitrary file write in the workflow linters of aws-healthomics-mcp-server (medium 6.8)
- [CVE-2026-15414](https://insights.sbomify.com/CVE-2026-15414/): Privilege escalation in Subscriptions for WooCommerce (high 8.8)
- [CVE-2026-15413](https://insights.sbomify.com/CVE-2026-15413/): Link Factory - Backdoor (critical 10.0)
- [CVE-2026-15412](https://insights.sbomify.com/CVE-2026-15412/): IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty Open Redirect (medium 6.5)
- [CVE-2026-15411](https://insights.sbomify.com/CVE-2026-15411/): Missing authorization in StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce (medium 5.3)
- [CVE-2026-15410](https://insights.sbomify.com/CVE-2026-15410/): SonicWall SMA1000 Appliances Code Injection (high 7.2, exploited in the wild)
- [CVE-2026-1541](https://insights.sbomify.com/CVE-2026-1541/): Information disclosure in Avada (Fusion) Builder (medium 4.3)
- [CVE-2026-15409](https://insights.sbomify.com/CVE-2026-15409/): SonicWall SMA1000 Appliances Server-Side Request Forgery (critical 10.0, exploited in the wild)
- [CVE-2026-15407](https://insights.sbomify.com/CVE-2026-15407/): Missing authorization in Themify Builder (medium 4.3)
- [CVE-2026-15406](https://insights.sbomify.com/CVE-2026-15406/): Eventin <= 4.1.22 - Authenticated (Custom+) Local File Inclusion via 'event_layout' Parameter (high 7.5)
- [CVE-2026-15404](https://insights.sbomify.com/CVE-2026-15404/): Bulk Page Generator <= 2.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title (medium 6.4)
- [CVE-2026-15403](https://insights.sbomify.com/CVE-2026-15403/): Pinpoint Booking System <= 2.9.9.6.9 - Authenticated (Administrator+) SQL Injection via 'field' Parameter (medium 4.9)
- [CVE-2026-15402](https://insights.sbomify.com/CVE-2026-15402/): Cross-site scripting in Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce (medium 6.4)
- [CVE-2026-15401](https://insights.sbomify.com/CVE-2026-15401/): Cross-site scripting in VikBooking Hotel Booking Engine & PMS (high 7.2)
- [CVE-2026-1540](https://insights.sbomify.com/CVE-2026-1540/): Spam Protect for Contact Form 7 < 1.2.10 - Editor+ Remote Code Execution (high 7.2)
- [CVE-2026-15399](https://insights.sbomify.com/CVE-2026-15399/): Animated Number Counters <= 3.0 - Authenticated (Editor+) SQL Injection via 'counterid' Parameter (medium 4.9)
- [CVE-2026-15397](https://insights.sbomify.com/CVE-2026-15397/): Missing authorization in Subscriptions for WooCommerce (high 7.2)
- [CVE-2026-15396](https://insights.sbomify.com/CVE-2026-15396/): IBM WebSphere Application Server IBM WebSphere Application Server - Liberty HTTP Request Smuggling (medium 6.5)
- [CVE-2026-15395](https://insights.sbomify.com/CVE-2026-15395/): Kali Forms <= 2.4.18 - Unauthenticated Stored Cross-Site Scripting via 'digitalSignature' Field Value (high 7.2)
- [CVE-2026-15394](https://insights.sbomify.com/CVE-2026-15394/): Header Footer Script Adder <= 2.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'asm_code' Snippet Meta (medium 6.4)
- [CVE-2026-15393](https://insights.sbomify.com/CVE-2026-15393/): Cross-site scripting in Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates (medium 6.4)
- [CVE-2026-15392](https://insights.sbomify.com/CVE-2026-15392/): DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location (high 7.7)
- [CVE-2026-15390](https://insights.sbomify.com/CVE-2026-15390/): Out-of-bounds write in Das U-Boot (critical 9.0)
- [CVE-2026-1539](https://insights.sbomify.com/CVE-2026-1539/): Libsoup: libsoup: credential leakage via http redirects (medium 5.8)
- [CVE-2026-15389](https://insights.sbomify.com/CVE-2026-15389/): Inadequate access control in Sesame Time session management (high 8.7)
- [CVE-2026-15388](https://insights.sbomify.com/CVE-2026-15388/): Cookie Consent < 0.0.10 - Subscriber+ Consent Settings Update and Consent Log Disclosure (medium 4.3)
- [CVE-2026-15387](https://insights.sbomify.com/CVE-2026-15387/): Acceptance of Extraneous Untrusted Data With Trusted Data in GitLab (medium 4.3)
- [CVE-2026-15386](https://insights.sbomify.com/CVE-2026-15386/): Meow Gallery < 5.5.2 - Author+ Stored XSS via Attachment Alt-Text (medium 5.4)
- [CVE-2026-15385](https://insights.sbomify.com/CVE-2026-15385/): RT Mega Menu < 1.5.2 - Subscriber+ Stored XSS via Menu Item CSS (medium 5.4)
- [CVE-2026-15384](https://insights.sbomify.com/CVE-2026-15384/): Manual Image Crop < 1.15 - Subscriber+ Arbitrary Attachment Image Overwrite via IDOR (medium 5.7)
- [CVE-2026-15383](https://insights.sbomify.com/CVE-2026-15383/): Blog Floating Button <= 1.4.20 - Unauthenticated Stored XSS via User-Agent Header (medium 6.1)
- [CVE-2026-15382](https://insights.sbomify.com/CVE-2026-15382/): Ultimate Addons for WPBakery Page Builder < 3.21.4 - Unauthenticated Custom Icon Font Deletion via delete-bsf-fonts (medium 6.5)
- [CVE-2026-15381](https://insights.sbomify.com/CVE-2026-15381/): WP Go Maps < 10.1.04 - Unauthenticated SQL Injection via Markers REST filter (low 3.7)
- [CVE-2026-15380](https://insights.sbomify.com/CVE-2026-15380/): Local privilege escalation in Symantec ITMS (medium 5.1)
- [CVE-2026-15379](https://insights.sbomify.com/CVE-2026-15379/): Arbitrary File Read as SYSTEM in Symantec ITMS (medium 5.1)
- [CVE-2026-15378](https://insights.sbomify.com/CVE-2026-15378/): Guardrails-detectors: guardrails-detectors: ssrf and local file read via user-supplied xml schema (xml-with-schema:) (critical 9.3)
- [CVE-2026-15377](https://insights.sbomify.com/CVE-2026-15377/): Eleveo Call Recording Software sendlogfile improper authorization (medium 5.3)
- [CVE-2026-15376](https://insights.sbomify.com/CVE-2026-15376/): Eleveo Call Recording Software statisticReportAction.do improper authorization (medium 5.3)
- [CVE-2026-15375](https://insights.sbomify.com/CVE-2026-15375/): Eleveo Call Recording Software LDAP User users_ldap.jsp improper authorization (medium 5.3)
- [CVE-2026-15374](https://insights.sbomify.com/CVE-2026-15374/): Eleveo Call Recording Software Group roleAddAction.do improper authorization (medium 5.3)
- [CVE-2026-15373](https://insights.sbomify.com/CVE-2026-15373/): Eleveo Call Recording Software userAddAction.do improper authorization (medium 5.3)
- [CVE-2026-15372](https://insights.sbomify.com/CVE-2026-15372/): WP 2FA < 4.1.0 - Two-Factor Authentication Bypass via Passkeys Provider (high 7.5)
- [CVE-2026-15371](https://insights.sbomify.com/CVE-2026-15371/): Velociraptor Stored XSS in URL column types (high 8.1)
- [CVE-2026-15370](https://insights.sbomify.com/CVE-2026-15370/): Libssh: libssh: stack buffer overflow in sftp server longname construction (medium 6.7)
- [CVE-2026-1537](https://insights.sbomify.com/CVE-2026-1537/): Missing authorization in LatePoint – Calendar Booking Plugin for Appointments and Events (medium 5.3)
- [CVE-2026-15369](https://insights.sbomify.com/CVE-2026-15369/): Privilege escalation in Custom User Registration Fields for WooCommerce (critical 9.8)
- [CVE-2026-15368](https://insights.sbomify.com/CVE-2026-15368/): Profile Builder < 3.16.4 - Unauthenticated Account Takeover via Auto-Login After Registration (high 8.1)
- [CVE-2026-15366](https://insights.sbomify.com/CVE-2026-15366/): Security feature bypass in Kids Mode (low 2.4)
- [CVE-2026-15365](https://insights.sbomify.com/CVE-2026-15365/): Security feature bypass in Kids Mode (low 2.4)
- [CVE-2026-15361](https://insights.sbomify.com/CVE-2026-15361/): Content Views < 4.5 - Subscriber+ SQL Injection via preview_request (high 8.1)
- [CVE-2026-15360](https://insights.sbomify.com/CVE-2026-15360/): Ajax Load More < 8.0.1 - Unauthenticated SQL Injection via custom_args (critical 9.1)
- [CVE-2026-1536](https://insights.sbomify.com/CVE-2026-1536/): Libsoup: libsoup: http header injection or response splitting via crlf injection in content-disposition header (medium 5.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/858/