# Vulnerabilities published in 2026


- [CVE-2026-15359](https://insights.sbomify.com/CVE-2026-15359/): Templately < 3.7.1 - Unauthenticated Administrator Templately Cloud Connection Overwrite (medium 6.5)
- [CVE-2026-15358](https://insights.sbomify.com/CVE-2026-15358/): Path Traversal Vulnerability (high 7.5)
- [CVE-2026-15352](https://insights.sbomify.com/CVE-2026-15352/): NASA Core Flight System (cFS) Health & Safety (HS) Application NULL Pointer Dereference (high 8.2)
- [CVE-2026-15351](https://insights.sbomify.com/CVE-2026-15351/): WC Vendors <= 2.7.0 - Authenticated (Shop Manager+) SQL Injection via 'status' Parameter (medium 4.9)
- [CVE-2026-15350](https://insights.sbomify.com/CVE-2026-15350/): Missing authorization in The Cache Purger (medium 4.3)
- [CVE-2026-1535](https://insights.sbomify.com/CVE-2026-1535/): code-projects Online Music Site AdminReply.php sql injection (medium 6.9)
- [CVE-2026-15349](https://insights.sbomify.com/CVE-2026-15349/): Missing authorization in ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce (medium 4.3)
- [CVE-2026-15348](https://insights.sbomify.com/CVE-2026-15348/): Premium Packages <= 7.0.4 - Authentication Bypass to Non-Admin via 'wpdmppdl' Parameter (medium 6.3)
- [CVE-2026-15346](https://insights.sbomify.com/CVE-2026-15346/): VikBooking Hotel Booking Engine & PMS <= 1.8.13 - Reflected Cross-Site Scripting via 'category_id' Parameter (medium 6.1)
- [CVE-2026-15345](https://insights.sbomify.com/CVE-2026-15345/): Missing authorization in ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization (medium 4.3)
- [CVE-2026-15344](https://insights.sbomify.com/CVE-2026-15344/): WP Photo Album Plus <= 9.2.04.002 - Authenticated (Administrator+) SQL Injection via 'table' Parameter (medium 4.9)
- [CVE-2026-15343](https://insights.sbomify.com/CVE-2026-15343/): Path traversal in Enterprise Server (high 8.6)
- [CVE-2026-15342](https://insights.sbomify.com/CVE-2026-15342/): CVE-2026-15342 (medium 6.5)
- [CVE-2026-15341](https://insights.sbomify.com/CVE-2026-15341/): Auth bypass in User Session Synchronizer (critical 9.8)
- [CVE-2026-15340](https://insights.sbomify.com/CVE-2026-15340/): Savannah lwIP SMTP client Classic Buffer Overflow (critical 9.3)
- [CVE-2026-1534](https://insights.sbomify.com/CVE-2026-1534/): code-projects Online Music Site AdminEditUser.php sql injection (medium 6.9)
- [CVE-2026-15338](https://insights.sbomify.com/CVE-2026-15338/): Path traversal in LA-Studio Element Kit for Elementor (high 7.5)
- [CVE-2026-15337](https://insights.sbomify.com/CVE-2026-15337/): Potential denial-of-service vulnerability in check_for_language() (medium 6.9)
- [CVE-2026-15336](https://insights.sbomify.com/CVE-2026-15336/): Missing authorization in Catch Themes Demo Import (medium 4.3)
- [CVE-2026-15335](https://insights.sbomify.com/CVE-2026-15335/): Booking Package <= 1.7.20 - Unauthenticated SQL Injection via 'email' Form Parameter (high 7.5)
- [CVE-2026-15334](https://insights.sbomify.com/CVE-2026-15334/): Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon.view' Block Attribute (medium 6.4)
- [CVE-2026-15333](https://insights.sbomify.com/CVE-2026-15333/): Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cozyCustomFont' Block Attribute (medium 6.4)
- [CVE-2026-15332](https://insights.sbomify.com/CVE-2026-15332/): zhayujie CowAgent Message Endpoint channel.py authorization (medium 5.3)
- [CVE-2026-15331](https://insights.sbomify.com/CVE-2026-15331/): zhayujie CowAgent Skill Installation service.py _add_package path traversal (medium 5.3)
- [CVE-2026-15330](https://insights.sbomify.com/CVE-2026-15330/): zhayujie CowAgent Vision Tool vision.py _download_to_data_url server-side request forgery (medium 6.9)
- [CVE-2026-1533](https://insights.sbomify.com/CVE-2026-1533/): code-projects Online Music Site AdminAddCategory.php sql injection (medium 5.1)
- [CVE-2026-15329](https://insights.sbomify.com/CVE-2026-15329/): zhayujie CowAgent Browser Tool browser_tool.py BrowserTool._do_navigate information disclosure (medium 5.3)
- [CVE-2026-15328](https://insights.sbomify.com/CVE-2026-15328/): Other in WebSphere Application Server (high 7.4)
- [CVE-2026-15326](https://insights.sbomify.com/CVE-2026-15326/): halo-dev halo Theme Installation ThemeUtils.java ThemeUtils.unzipThemeTo path traversal (medium 5.1)
- [CVE-2026-15325](https://insights.sbomify.com/CVE-2026-15325/): IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities (high 8.7)
- [CVE-2026-15324](https://insights.sbomify.com/CVE-2026-15324/): Cross-site scripting in SysBasics Customize My Account for WooCommerce – Live My Account Customizer (medium 4.4)
- [CVE-2026-15323](https://insights.sbomify.com/CVE-2026-15323/): Path traversal in Product Designer for WooCommerce WordPress | Lumise (high 7.5)
- [CVE-2026-15322](https://insights.sbomify.com/CVE-2026-15322/): Multiple Vulnerabilities in IBM Engineering AI hub. (high 7.5)
- [CVE-2026-15321](https://insights.sbomify.com/CVE-2026-15321/): MyEMS Admin Backend svg.py on_post cross site scripting (medium 4.8)
- [CVE-2026-15320](https://insights.sbomify.com/CVE-2026-15320/): Sipeed PicoClaw pico.go rt.ReloadConfig authorization (medium 5.3)
- [CVE-2026-1532](https://insights.sbomify.com/CVE-2026-1532/): D-Link DCS-700L Music File Upload Service setUploadMusic uploadmusic path traversal (medium 4.8)
- [CVE-2026-15319](https://insights.sbomify.com/CVE-2026-15319/): Sipeed PicoClaw Launcher access_control.go IPAllowlist access control (medium 6.9)
- [CVE-2026-15318](https://insights.sbomify.com/CVE-2026-15318/): Sipeed PicoClaw MQTT Channel mqtt.go authorization (medium 5.3)
- [CVE-2026-15317](https://insights.sbomify.com/CVE-2026-15317/): Sipeed PicoClaw Guarded Web Fetch Flow web.go WebFetchTool.Execute server-side request forgery (medium 5.3)
- [CVE-2026-15316](https://insights.sbomify.com/CVE-2026-15316/): Denial-of-Service via Oversized Encrypted Credential Input in TP-Link Tapo C200 (high 7.1)
- [CVE-2026-15315](https://insights.sbomify.com/CVE-2026-15315/): Unauthenticated Administrative Authentication Bypass via device_confirm Replay in TP-Link Tapo C120 and C200 (high 8.7)
- [CVE-2026-15314](https://insights.sbomify.com/CVE-2026-15314/): Authenticated Denial-of-Service Vulnerability in TP-Link Tapo P110 (high 7.1)
- [CVE-2026-15312](https://insights.sbomify.com/CVE-2026-15312/): Privilege escalation in Propovoice: All-in-One Client Management System (high 8.8)
- [CVE-2026-15311](https://insights.sbomify.com/CVE-2026-15311/): NousResearch hermes-agent Matrix Adapter matrix.py MatrixAdapter._markdown_to_html cross site scripting (medium 5.1)
- [CVE-2026-15310](https://insights.sbomify.com/CVE-2026-15310/): zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits (low 2.1)
- [CVE-2026-1531](https://insights.sbomify.com/CVE-2026-1531/): Foreman-kubevirt: foreman_kubevirt: man-in-the-middle due to insecure default ssl verification (high 8.1)
- [CVE-2026-15308](https://insights.sbomify.com/CVE-2026-15308/): Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations (high 8.7)
- [CVE-2026-15307](https://insights.sbomify.com/CVE-2026-15307/): Server-side file-write and request forgery via spatial lookups (high 8.7)
- [CVE-2026-15306](https://insights.sbomify.com/CVE-2026-15306/): Product Feed Manager For WooCommerce <= 7.6.1 - Reflected Cross-Site Scripting via 's' Search Parameter (medium 6.1)
- [CVE-2026-15305](https://insights.sbomify.com/CVE-2026-15305/): TYPO3 CMS - Unrestricted File Upload in Form Framework (medium 6.3)
- [CVE-2026-15304](https://insights.sbomify.com/CVE-2026-15304/): Plugin Organizer <= 10.2.4 - Authenticated (Subscriber+) SQL Injection (medium 6.5)
- [CVE-2026-15303](https://insights.sbomify.com/CVE-2026-15303/): 6Storage Rentals <= 2.27.0 - Unauthenticated Account Takeover via 'email' Parameter (critical 9.8)
- [CVE-2026-15302](https://insights.sbomify.com/CVE-2026-15302/): ARMember <= 4.0.27 - Directory Traversal via X-FILENAME (medium 5.3)
- [CVE-2026-15301](https://insights.sbomify.com/CVE-2026-15301/): BuddyHolis TableSearch <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2026-15300](https://insights.sbomify.com/CVE-2026-15300/): GEO my WP <= 4.5.4 - Unauthenticated SQL Injection via 'distance' / 'lat' / 'lng' Parameters (critical 9.1)
- [CVE-2026-1530](https://insights.sbomify.com/CVE-2026-1530/): Fog-kubevirt: fog-kubevirt: man-in-the-middle vulnerability due to disabled certificate validation (high 8.1)
- [CVE-2026-15299](https://insights.sbomify.com/CVE-2026-15299/): Animation Addons for Elementor <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Weather Widget (medium 6.4)
- [CVE-2026-15298](https://insights.sbomify.com/CVE-2026-15298/): TelSender <= 1.14.14 - Unauthenticated Stored Cross-Site Scripting via Telegram Chat Title (high 7.2)
- [CVE-2026-15297](https://insights.sbomify.com/CVE-2026-15297/): Cross-site scripting in Brevo – Email, SMS, Web Push, Chat, and more. (medium 6.1)
- [CVE-2026-15296](https://insights.sbomify.com/CVE-2026-15296/): affiliate-toolkit – WP Affiliate Plugin with Amazon <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2026-15295](https://insights.sbomify.com/CVE-2026-15295/): Ajax Load More <= 7.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2026-15293](https://insights.sbomify.com/CVE-2026-15293/): Missing authorization in WP Business Intelligence Lite (high 8.0)
- [CVE-2026-15292](https://insights.sbomify.com/CVE-2026-15292/): Sudoku Shortcode <= 1.0.0 - Authenticated (Contributor+) Cross-Site Scripting via 'background' Shortcode Attribute (medium 6.4)
- [CVE-2026-15291](https://insights.sbomify.com/CVE-2026-15291/): Missing authorization in ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form (high 7.5)
- [CVE-2026-15290](https://insights.sbomify.com/CVE-2026-15290/): SQL injection in Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin (high 7.5)
- [CVE-2026-1529](https://insights.sbomify.com/CVE-2026-1529/): Keycloak affected by improper invitation token validation (high 8.1)
- [CVE-2026-15289](https://insights.sbomify.com/CVE-2026-15289/): Booking calendar, Appointment Booking System <= 3.2.17 - Unauthenticated Time-Based SQL Injection via 'wpdevart_id' (medium 5.9)
- [CVE-2026-15288](https://insights.sbomify.com/CVE-2026-15288/): SureForms – Drag and Drop Form Builder for WordPress <= 2.2.1 - Unauthenticated Stripe Payment Amount Manipulation (high 7.5)
- [CVE-2026-15287](https://insights.sbomify.com/CVE-2026-15287/): rtMedia for WordPress, BuddyPress and bbPress <= 4.6.18 - Authenticated (Subscriber+) SQL Injection (medium 6.5)
- [CVE-2026-15286](https://insights.sbomify.com/CVE-2026-15286/): Missing authorization in Kadence Blocks — Page Builder Toolkit for Gutenberg Editor (medium 4.3)
- [CVE-2026-15285](https://insights.sbomify.com/CVE-2026-15285/): Cross-site scripting in The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce (medium 6.4)
- [CVE-2026-15284](https://insights.sbomify.com/CVE-2026-15284/): Cross-site scripting in King Addons for Elementor – 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder (medium 6.4)
- [CVE-2026-15283](https://insights.sbomify.com/CVE-2026-15283/): WPvivid Backup for MainWP <= 0.9.33 - Authenticated (Admin+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2026-15282](https://insights.sbomify.com/CVE-2026-15282/): Instant Appointment <= 1.2 - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2026-15281](https://insights.sbomify.com/CVE-2026-15281/): User Access Manager <= 2.3.12 - Authenticated (Subscriber+) SQL Injection (medium 6.5)
- [CVE-2026-15280](https://insights.sbomify.com/CVE-2026-15280/): Path traversal in WebSphere Application Server - Liberty (high 7.5)
- [CVE-2026-1528](https://insights.sbomify.com/CVE-2026-1528/): undici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client (high 7.5)
- [CVE-2026-15276](https://insights.sbomify.com/CVE-2026-15276/): pdeljanov Symphonia Metadata denial of service (medium 4.8)
- [CVE-2026-15275](https://insights.sbomify.com/CVE-2026-15275/): WP Multi Store Locator Pro <= 4.5.1 - Unauthenticated SQL Injection via 'store_locator_search_radius' Parameter (high 7.5)
- [CVE-2026-15274](https://insights.sbomify.com/CVE-2026-15274/): lo48576 fbxcel Node Header parser.rs denial of service (medium 4.8)
- [CVE-2026-15273](https://insights.sbomify.com/CVE-2026-15273/): Automatic.css 4.0.0 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI (medium 6.4)
- [CVE-2026-15271](https://insights.sbomify.com/CVE-2026-15271/): TOTOLINK EX200 Web boa.conf least privilege violation (high 7.7)
- [CVE-2026-15270](https://insights.sbomify.com/CVE-2026-15270/): D-link DIR-823G Web boa.conf least privilege violation (high 7.7)
- [CVE-2026-1527](https://insights.sbomify.com/CVE-2026-1527/): undici is vulnerable to CRLF Injection via upgrade option (medium 4.6)
- [CVE-2026-15267](https://insights.sbomify.com/CVE-2026-15267/): Taskbuilder <= 5.0.9 - Authenticated (Subscriber+) SQL Injection (medium 6.5)
- [CVE-2026-15265](https://insights.sbomify.com/CVE-2026-15265/): Tenable Agent Path Traversal Leading to Remote Code Execution (critical 9.3)
- [CVE-2026-15262](https://insights.sbomify.com/CVE-2026-15262/): Admin Columns for ACF Fields <= 0.3.2 - Contributor+ Stored XSS via ACF Field Value Column (medium 5.4)
- [CVE-2026-15261](https://insights.sbomify.com/CVE-2026-15261/): TI WooCommerce Wishlist < 2.13.0 - Unauthenticated Private Wishlist Disclosure via share_key (medium 5.3)
- [CVE-2026-15260](https://insights.sbomify.com/CVE-2026-15260/): Geo My WP < 4.5.5.3 - Subscriber+ Arbitrary Geolocation Record Modification and Deletion via IDOR (medium 4.3)
- [CVE-2026-1526](https://insights.sbomify.com/CVE-2026-1526/): undici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression (high 7.5)
- [CVE-2026-15258](https://insights.sbomify.com/CVE-2026-15258/): Product Feed Manager for WooCommerce < 7.6.1 - Contributor+ SQL Injection via Feed Filter (high 8.1)
- [CVE-2026-15257](https://insights.sbomify.com/CVE-2026-15257/): RegistrationMagic < 6.0.9.4 - Unauthenticated Form Submission and User Profile Modification (medium 5.3)
- [CVE-2026-15256](https://insights.sbomify.com/CVE-2026-15256/): Ninja Forms < 3.14.10 - Unauthenticated Arbitrary Shortcode Execution via Query-String Populated Field Default (medium 4.8)
- [CVE-2026-15255](https://insights.sbomify.com/CVE-2026-15255/): RegistrationMagic < 6.0.9.4 - Unauthenticated Form Submission Disclosure via IDOR (medium 5.3)
- [CVE-2026-15254](https://insights.sbomify.com/CVE-2026-15254/): Simply Schedule Appointments < 1.6.12.11 - Contributor+ Sensitive Data Disclosure via Admin Shortcode (medium 6.5)
- [CVE-2026-15253](https://insights.sbomify.com/CVE-2026-15253/): Easy Media Replace <= 0.2.0 - Author+ Stored XSS via Attachment Title (medium 6.8)
- [CVE-2026-15252](https://insights.sbomify.com/CVE-2026-15252/): Search Atlas SEO < 2.6.12 - Subscriber+ Google Indexing API Access (medium 5.4)
- [CVE-2026-15250](https://insights.sbomify.com/CVE-2026-15250/): LatePoint < 5.6.8 - Unauthenticated Booking Object Mass Assignment via Public Booking Funnel (medium 5.3)
- [CVE-2026-1525](https://insights.sbomify.com/CVE-2026-1525/): undici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') (medium 6.5)
- [CVE-2026-15249](https://insights.sbomify.com/CVE-2026-15249/): Patterns Kit <= 1.0.3 - Contributor+ Stored XSS via YouTube Popup Link (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/859/