# Vulnerabilities published in 2026


- [CVE-2026-1514](https://insights.sbomify.com/CVE-2026-1514/): 2100 Technology｜Official Document Management System - Incorrect Authorization (high 7.1)
- [CVE-2026-15138](https://insights.sbomify.com/CVE-2026-15138/): tumf mcp-text-editor text_editor.py _validate_file_path path traversal (medium 5.3)
- [CVE-2026-15137](https://insights.sbomify.com/CVE-2026-15137/): code-projects Interview Management System View.php sql injection (medium 6.9)
- [CVE-2026-15136](https://insights.sbomify.com/CVE-2026-15136/): Cross-site request forgery in WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode (medium 4.3)
- [CVE-2026-15135](https://insights.sbomify.com/CVE-2026-15135/): code-projects Online Food Order System edit_food_items.php sql injection (medium 6.9)
- [CVE-2026-15134](https://insights.sbomify.com/CVE-2026-15134/): CodeAstro Simple Online Leave Management System index.php sql injection (medium 6.9)
- [CVE-2026-15133](https://insights.sbomify.com/CVE-2026-15133/): Use after free in Chrome (high 8.8)
- [CVE-2026-15132](https://insights.sbomify.com/CVE-2026-15132/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-15131](https://insights.sbomify.com/CVE-2026-15131/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2026-15130](https://insights.sbomify.com/CVE-2026-15130/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2026-1513](https://insights.sbomify.com/CVE-2026-1513/): billboard.js is vulnerable to XSS during chart option binding (medium 6.1)
- [CVE-2026-15129](https://insights.sbomify.com/CVE-2026-15129/): Use after free in Chrome (high 8.8)
- [CVE-2026-15128](https://insights.sbomify.com/CVE-2026-15128/): Cross-site scripting in Chrome (medium 6.1)
- [CVE-2026-15127](https://insights.sbomify.com/CVE-2026-15127/): Cross-site scripting in Chrome (medium 6.1)
- [CVE-2026-15126](https://insights.sbomify.com/CVE-2026-15126/): Use after free in Chrome (high 8.8)
- [CVE-2026-15125](https://insights.sbomify.com/CVE-2026-15125/): Code injection in Chrome (high 8.8)
- [CVE-2026-15124](https://insights.sbomify.com/CVE-2026-15124/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2026-15123](https://insights.sbomify.com/CVE-2026-15123/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-15122](https://insights.sbomify.com/CVE-2026-15122/): Security feature bypass in Chrome (high 8.3)
- [CVE-2026-15121](https://insights.sbomify.com/CVE-2026-15121/): Use after free in Chrome (high 8.8)
- [CVE-2026-15120](https://insights.sbomify.com/CVE-2026-15120/): Use after free in Chrome (high 8.3)
- [CVE-2026-1512](https://insights.sbomify.com/CVE-2026-1512/): Essential Addons for Elementor <= 6.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Info Box Widget (medium 6.4)
- [CVE-2026-15119](https://insights.sbomify.com/CVE-2026-15119/): Race condition in Chrome (high 8.3)
- [CVE-2026-15118](https://insights.sbomify.com/CVE-2026-15118/): Use after free in Chrome (high 8.8)
- [CVE-2026-15117](https://insights.sbomify.com/CVE-2026-15117/): Use after free in Chrome (high 7.5)
- [CVE-2026-15116](https://insights.sbomify.com/CVE-2026-15116/): Use after free in Chrome (high 8.8)
- [CVE-2026-15115](https://insights.sbomify.com/CVE-2026-15115/): Security feature bypass in Chrome (low 3.3)
- [CVE-2026-15114](https://insights.sbomify.com/CVE-2026-15114/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-15113](https://insights.sbomify.com/CVE-2026-15113/): Use after free in Chrome (critical 9.6)
- [CVE-2026-15112](https://insights.sbomify.com/CVE-2026-15112/): Use after free in Chrome (high 8.8)
- [CVE-2026-15111](https://insights.sbomify.com/CVE-2026-15111/): Use after free in Chrome (high 7.5)
- [CVE-2026-15110](https://insights.sbomify.com/CVE-2026-15110/): Use after free in Chrome (high 8.8)
- [CVE-2026-15109](https://insights.sbomify.com/CVE-2026-15109/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-15108](https://insights.sbomify.com/CVE-2026-15108/): Integer overflow in Chrome (medium 4.3)
- [CVE-2026-15107](https://insights.sbomify.com/CVE-2026-15107/): Use after free in Chrome (high 8.8)
- [CVE-2026-15106](https://insights.sbomify.com/CVE-2026-15106/): WPBot <= 8.5.6 - Missing Authorization to Unauthenticated Arbitrary Chat Session Deletion via 'userid' Parameter (medium 5.3)
- [CVE-2026-15105](https://insights.sbomify.com/CVE-2026-15105/): davenardella snap7 ReadVar Request s7_server.cpp PerformFunctionRead out-of-bounds write (medium 5.3)
- [CVE-2026-15104](https://insights.sbomify.com/CVE-2026-15104/): BetterDocs <= 4.6.0 - Authenticated (Custom+) SQL Injection via 'lang' Parameter (medium 6.5)
- [CVE-2026-15103](https://insights.sbomify.com/CVE-2026-15103/): WPFunnels <= 3.12.8 - Authenticated (Funnel Manager+) Privilege Escalation via 'group_id' Path Parameter (high 8.8)
- [CVE-2026-15102](https://insights.sbomify.com/CVE-2026-15102/): Cleartext Transmission of Sensitive Information in ADP Desktop SDK (high 7.5)
- [CVE-2026-15101](https://insights.sbomify.com/CVE-2026-15101/): WPBakery Page Builder <= 8.7.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter (medium 6.4)
- [CVE-2026-15100](https://insights.sbomify.com/CVE-2026-15100/): Cross-site scripting in Post Grid Gutenberg Blocks – PostX (medium 6.4)
- [CVE-2026-1510](https://insights.sbomify.com/CVE-2026-1510/): IBM Concert Software Improper Clearing of Heap Memory (medium 4.7)
- [CVE-2026-15099](https://insights.sbomify.com/CVE-2026-15099/): WP Delicious <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'steps' Block Attribute (medium 6.4)
- [CVE-2026-15098](https://insights.sbomify.com/CVE-2026-15098/): Cross-site scripting in Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder (medium 6.4)
- [CVE-2026-15097](https://insights.sbomify.com/CVE-2026-15097/): Cross-site scripting in Themify Builder (medium 6.4)
- [CVE-2026-15096](https://insights.sbomify.com/CVE-2026-15096/): Themify Builder <= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Module 'b_width_map' Field (medium 6.4)
- [CVE-2026-15095](https://insights.sbomify.com/CVE-2026-15095/): Path traversal in Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels (medium 4.9)
- [CVE-2026-15094](https://insights.sbomify.com/CVE-2026-15094/): WP Hotel Booking <= 2.3.2 - Reflected Cross-Site Scripting via 'check_in_date' Parameter (medium 6.1)
- [CVE-2026-15093](https://insights.sbomify.com/CVE-2026-15093/): Multiple Vulnerabilities in IBM Engineering AI hub. (medium 4.3)
- [CVE-2026-15091](https://insights.sbomify.com/CVE-2026-15091/): Multiple Vulnerabilities in IBM Engineering AI hub. (critical 9.3)
- [CVE-2026-15090](https://insights.sbomify.com/CVE-2026-15090/): Link Library <= 7.9.2 - Unauthenticated SQL Injection via 'link_url' Parameter (high 7.5)
- [CVE-2026-1509](https://insights.sbomify.com/CVE-2026-1509/): Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Limited Arbitrary WordPress Action Execution (medium 5.4)
- [CVE-2026-15089](https://insights.sbomify.com/CVE-2026-15089/): Commerce guest registration - Critical - Unsupported - SA-CONTRIB-2026-079 (critical 9.1)
- [CVE-2026-15088](https://insights.sbomify.com/CVE-2026-15088/): Development Environment - Critical - Unsupported - SA-CONTRIB-2026-089 (medium 5.7)
- [CVE-2026-15087](https://insights.sbomify.com/CVE-2026-15087/): Clean RESTful - Critical - Unsupported - SA-CONTRIB-2026-078 (medium 5.9)
- [CVE-2026-15086](https://insights.sbomify.com/CVE-2026-15086/): Raw Formatter [Meta Tag Formatter] - Critical - Unsupported - SA-CONTRIB-2026-077 (medium 5.9)
- [CVE-2026-15085](https://insights.sbomify.com/CVE-2026-15085/): AI SEO/GEO Analyzer - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-076 (medium 5.4)
- [CVE-2026-15084](https://insights.sbomify.com/CVE-2026-15084/): UI Patterns (SDC in Drupal UI) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-075 (medium 5.4)
- [CVE-2026-15083](https://insights.sbomify.com/CVE-2026-15083/): ECA: Event - Condition - Action - Less critical - Information disclosure - SA-CONTRIB-2026-074 (medium 4.2)
- [CVE-2026-15082](https://insights.sbomify.com/CVE-2026-15082/): Siteimprove Analytics - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-073 (medium 5.4)
- [CVE-2026-15081](https://insights.sbomify.com/CVE-2026-15081/): Location Selector - Critical - SQL Injection - SA-CONTRIB-2026-072 (high 7.4)
- [CVE-2026-15080](https://insights.sbomify.com/CVE-2026-15080/): Ray Enterprise Translation - Moderately critical - Cross site request forgery - SA-CONTRIB-2026-071 (medium 4.3)
- [CVE-2026-1508](https://insights.sbomify.com/CVE-2026-1508/): Court Reservation < 1.10.9 - Event Deletion via CSRF (medium 4.3)
- [CVE-2026-15079](https://insights.sbomify.com/CVE-2026-15079/): Login Disable - Moderately critical - Access bypass - SA-CONTRIB-2026-070 (medium 5.4)
- [CVE-2026-15078](https://insights.sbomify.com/CVE-2026-15078/): Vulnerabilities in IBM AIX and PowerVM VIOS (high 8.1)
- [CVE-2026-15077](https://insights.sbomify.com/CVE-2026-15077/): Improper Neutralization of Input Used for LLM Prompting in GitLab (medium 4.3)
- [CVE-2026-15076](https://insights.sbomify.com/CVE-2026-15076/): Security feature bypass in Eclipse Vert.x (high 8.2)
- [CVE-2026-15075](https://insights.sbomify.com/CVE-2026-15075/): Information disclosure in Eclipse Vert.x (high 8.2)
- [CVE-2026-15074](https://insights.sbomify.com/CVE-2026-15074/): @fastify/static vulnerable to route guard bypass via path traversal (high 7.5)
- [CVE-2026-15073](https://insights.sbomify.com/CVE-2026-15073/): KiviCare <= 4.5.0 - Authenticated (Doctor+) SQL Injection via 'orderby' Parameter in DoctorSessionController (medium 6.5)
- [CVE-2026-15072](https://insights.sbomify.com/CVE-2026-15072/): KiviCare <= 4.5.0 - Authenticated (Doctor+) SQL Injection via 'orderby' Parameter in KCQueryBuilder (medium 6.5)
- [CVE-2026-15070](https://insights.sbomify.com/CVE-2026-15070/): Salon Booking System <= 10.30.32 - Cross-Site Request Forgery to Remote Code Execution via 'value' Parameter (high 8.8)
- [CVE-2026-1507](https://insights.sbomify.com/CVE-2026-1507/): Uncaught Exception vulnerability in AVEVA PI Data Archive (high 8.7)
- [CVE-2026-15069](https://insights.sbomify.com/CVE-2026-15069/): Multiple Vulnerabilities in IBM Engineering AI hub. (medium 5.4)
- [CVE-2026-15068](https://insights.sbomify.com/CVE-2026-15068/): Vulnerabilities in IBM AIX and PowerVM VIOS (critical 9.9)
- [CVE-2026-15067](https://insights.sbomify.com/CVE-2026-15067/): SQL injection in Terraform Provider for Snowflake (high 8.8)
- [CVE-2026-15066](https://insights.sbomify.com/CVE-2026-15066/): Loco Translate <= 2.8.7 - Authenticated (Translator+) Stored Cross-Site Scripting via PO File Extracted Comments (medium 6.4)
- [CVE-2026-15065](https://insights.sbomify.com/CVE-2026-15065/): Vulnerabilities in IBM AIX and PowerVM VIOS (critical 9.1)
- [CVE-2026-15064](https://insights.sbomify.com/CVE-2026-15064/): IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities (high 8.7)
- [CVE-2026-15063](https://insights.sbomify.com/CVE-2026-15063/): Trustyai-service-operator: trustyai service operator: gorch port bypass when auth is enabled (medium 6.3)
- [CVE-2026-15062](https://insights.sbomify.com/CVE-2026-15062/): SQL Injection in Snowflake Snowpark Python SDK (critical 9.6)
- [CVE-2026-15061](https://insights.sbomify.com/CVE-2026-15061/): Vulnerabilities in IBM AIX and PowerVM VIOS (high 8.2)
- [CVE-2026-15060](https://insights.sbomify.com/CVE-2026-15060/): systemd-machined: unprivileged users can terminate arbitrary processes (medium 4.7)
- [CVE-2026-1506](https://insights.sbomify.com/CVE-2026-1506/): D-Link DIR-615 MAC Filter Configuration adv_mac_filter.php os command injection (high 8.6)
- [CVE-2026-15059](https://insights.sbomify.com/CVE-2026-15059/): systemd-oomd: unprivileged users can terminate arbitrary processes (medium 5.5)
- [CVE-2026-15058](https://insights.sbomify.com/CVE-2026-15058/): Missing authorization in Server (low 3.1)
- [CVE-2026-15057](https://insights.sbomify.com/CVE-2026-15057/): IBM WebSphere Application Server Liberty is affected by a denial of service vulnerability (high 7.5)
- [CVE-2026-15056](https://insights.sbomify.com/CVE-2026-15056/): StoreEngine <= 2.1.1 - Authenticated (Vendor+) Arbitrary File Read via Path Traversal in Downloadable File URL (medium 6.5)
- [CVE-2026-15055](https://insights.sbomify.com/CVE-2026-15055/): PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input (medium 5.3)
- [CVE-2026-15054](https://insights.sbomify.com/CVE-2026-15054/): Bit Form < 3.1.2 - Unauthenticated Inactive Form Submission (low 3.7)
- [CVE-2026-15053](https://insights.sbomify.com/CVE-2026-15053/): Tanium addressed a denial of service vulnerability in Tanium Server. (high 7.5)
- [CVE-2026-15052](https://insights.sbomify.com/CVE-2026-15052/): Cross-site scripting in MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder (high 7.2)
- [CVE-2026-1505](https://insights.sbomify.com/CVE-2026-1505/): D-Link DIR-615 URL Filter set_temp_nodes.php os command injection (high 8.6)
- [CVE-2026-15049](https://insights.sbomify.com/CVE-2026-15049/): Depicter < 4.8.0 - Editor+ Arbitrary File Upload via ZIP Import (high 7.2)
- [CVE-2026-15048](https://insights.sbomify.com/CVE-2026-15048/): GeekyBot < 1.2.8 - Unauthenticated Sensitive Information Exposure via Chat History (high 7.5)
- [CVE-2026-15047](https://insights.sbomify.com/CVE-2026-15047/): s2Member < 260805 - Contributor+ Stored XSS via Shortcode (medium 6.8)
- [CVE-2026-15046](https://insights.sbomify.com/CVE-2026-15046/): LitExtension: Store to WooCommerce Migration <= 1.2.5 - Connector Token Takeover via CSRF (medium 4.2)
- [CVE-2026-15045](https://insights.sbomify.com/CVE-2026-15045/): Wallet System for WooCommerce < 2.7.10 - Customer+ Checkout Price Manipulation via Unvalidated Wallet Amount (medium 6.5)
- [CVE-2026-15044](https://insights.sbomify.com/CVE-2026-15044/): Trustyai-service-operator: trustyai service operator: unauthenticated access to ai guardrails and orchestrator apis (medium 6.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/861/